Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package selinux-policy for openSUSE:Factory
checked in at 2026-10-16 20:06:47
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/selinux-policy (Old)
and /work/SRC/openSUSE:Factory/.selinux-policy.new.3698736 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "selinux-policy"
Fri Oct 16 20:06:47 2026 rev:181 rq:1384959 version:20261014
Changes:
--------
--- /work/SRC/openSUSE:Factory/selinux-policy/selinux-policy.changes
2026-10-06 19:14:47.897434330 +0200
+++
/work/SRC/openSUSE:Factory/.selinux-policy.new.3698736/selinux-policy.changes
2026-10-16 20:06:50.374998182 +0200
@@ -1,0 +2,10 @@
+Thu Oct 15 07:36:56 UTC 2026 - Cathy Hu <[email protected]>
+
+- Update to version 20261014:
+ * Allow account-utils domains to getattr/setattr their sockets (bsc#1284992)
+ * Allow wtmpdb to getattr/setattr its sockets (bsc#1284992)
+ * Allow rebootmgr send over varlink to systemd_report_t (bsc#1284659)
+ * Introduce systemd_report_t domain (bsc#1284659)
+ * Extend CI for SLE 16.1
+
+-------------------------------------------------------------------
Old:
----
selinux-policy-20261006.tar.xz
New:
----
selinux-policy-20261014.tar.xz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ selinux-policy.spec ++++++
--- /var/tmp/diff_new_pack.FBQxFb/_old 2026-10-16 20:06:52.375081698 +0200
+++ /var/tmp/diff_new_pack.FBQxFb/_new 2026-10-16 20:06:52.382081991 +0200
@@ -37,7 +37,7 @@
License: GPL-2.0-or-later
Group: System/Management
Name: selinux-policy
-Version: 20261006
+Version: 20261014
Release: 0
Source0: %{name}-%{version}.tar.xz
Source1: container.fc
++++++ _servicedata ++++++
--- /var/tmp/diff_new_pack.FBQxFb/_old 2026-10-16 20:06:52.539088547 +0200
+++ /var/tmp/diff_new_pack.FBQxFb/_new 2026-10-16 20:06:52.559089382 +0200
@@ -1,6 +1,6 @@
<servicedata>
<service name="tar_scm">
<param
name="url">https://gitlab.suse.de/selinux/selinux-policy.git</param>
- <param
name="changesrevision">91399b935bb1cd2f50f68e2d1cd6e7e49f67b97d</param></service></servicedata>
+ <param
name="changesrevision">80755a1a58a6d819673df1f0fd20a02f9d140545</param></service></servicedata>
(No newline at EOF)
++++++ selinux-policy-20261006.tar.xz -> selinux-policy-20261014.tar.xz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/selinux-policy-20261006/.gitlab-ci.yml
new/selinux-policy-20261014/.gitlab-ci.yml
--- old/selinux-policy-20261006/.gitlab-ci.yml 2026-10-06 09:53:13.000000000
+0200
+++ new/selinux-policy-20261014/.gitlab-ci.yml 2026-10-14 17:01:41.000000000
+0200
@@ -48,6 +48,17 @@
- if: $CI_PIPELINE_SOURCE == 'web' &&
$CI_COMMIT_REF_NAME == 'slfo-1.2'
+.slfo-1.3:
+ variables:
+ SLFO_BRANCH: slfo-1.3
+ LEAP_VERSION: "16.1"
+ VM_IMAGE_URL:
https://download.opensuse.org/distribution/leap/16.1/appliances/Leap-16.1-Minimal-VM.x86_64-kvm-and-xen.qcow2
+ rules:
+ - if: $CI_PIPELINE_SOURCE == 'merge_request_event' &&
+ $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == 'slfo-1.3'
+ - if: $CI_PIPELINE_SOURCE == 'web' &&
+ $CI_COMMIT_REF_NAME == 'slfo-1.3'
+
# ============================================================================
# Stage templates — codestream-agnostic; reference $SLFO_BRANCH /
$LEAP_VERSION.
# ============================================================================
@@ -179,3 +190,13 @@
test-leap16.0:
extends: [.slfo-1.2, .test-vm]
+
+# ---- Leap 16.1 / slfo-1.3 (SLE 16.1 / SLFO 1.3) ----
+build-leap16.1:
+ extends: [.slfo-1.3, .leap-build]
+
+rpmbuild-leap16.1:
+ extends: [.slfo-1.3, .leap-rpmbuild]
+
+test-leap16.1:
+ extends: [.slfo-1.3, .test-vm]
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/selinux-policy-20261006/policy/modules/contrib/account-utils.te
new/selinux-policy-20261014/policy/modules/contrib/account-utils.te
--- old/selinux-policy-20261006/policy/modules/contrib/account-utils.te
2026-10-06 09:53:13.000000000 +0200
+++ new/selinux-policy-20261014/policy/modules/contrib/account-utils.te
2026-10-14 17:01:41.000000000 +0200
@@ -41,7 +41,7 @@
allow newidmapd_t self:capability { dac_override setgid setuid };
allow newidmapd_t self:cap_userns sys_admin;
-allow newidmapd_t self:unix_dgram_socket { create getopt setopt write };
+allow newidmapd_t self:unix_dgram_socket create_socket_perms;
accountutils_pwaccessd_varlink_socket_connect(newidmapd_t)
@@ -71,7 +71,7 @@
# pwaccessd local policy
#
-allow pwaccessd_t self:unix_dgram_socket { create getopt setopt write };
+allow pwaccessd_t self:unix_dgram_socket create_socket_perms;
kernel_dgram_send(pwaccessd_t)
@@ -101,7 +101,7 @@
allow pwupdd_t self:capability setuid;
allow pwupdd_t self:process setfscreate;
-allow pwupdd_t self:unix_dgram_socket { create connect getopt setopt write };
+allow pwupdd_t self:unix_dgram_socket create_socket_perms;
kernel_dgram_send(pwupdd_t)
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/selinux-policy-20261006/policy/modules/system/authlogin.te
new/selinux-policy-20261014/policy/modules/system/authlogin.te
--- old/selinux-policy-20261006/policy/modules/system/authlogin.te
2026-10-06 09:53:13.000000000 +0200
+++ new/selinux-policy-20261014/policy/modules/system/authlogin.te
2026-10-14 17:01:41.000000000 +0200
@@ -763,7 +763,7 @@
# wtmpdb Program local policy
#
-allow wtmpdbd_t self:unix_dgram_socket { create write getopt setopt };
+allow wtmpdbd_t self:unix_dgram_socket create_socket_perms;
allow wtmpdbd_t wtmpdbd_var_run_t:dir getattr;
allow wtmpdbd_t wtmpdb_t:file manage_file_perms;
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/selinux-policy-20261006/policy/modules/system/systemd.fc
new/selinux-policy-20261014/policy/modules/system/systemd.fc
--- old/selinux-policy-20261006/policy/modules/system/systemd.fc
2026-10-06 09:53:13.000000000 +0200
+++ new/selinux-policy-20261014/policy/modules/system/systemd.fc
2026-10-14 17:01:41.000000000 +0200
@@ -64,6 +64,7 @@
/usr/lib/systemd/systemd-pcrextend --
gen_context(system_u:object_r:systemd_pcrextend_exec_t,s0)
/usr/lib/systemd/systemd-pcrlock --
gen_context(system_u:object_r:systemd_pcrlock_exec_t,s0)
/usr/lib/systemd/systemd-pstore --
gen_context(system_u:object_r:systemd_pstore_exec_t,s0)
+/usr/lib/systemd/systemd-report --
gen_context(system_u:object_r:systemd_report_exec_t,s0)
/usr/lib/systemd/systemd-rfkill --
gen_context(system_u:object_r:systemd_rfkill_exec_t,s0)
/usr/lib/systemd/systemd-socket-proxyd --
gen_context(system_u:object_r:systemd_socket_proxyd_exec_t,s0)
/usr/lib/systemd/systemd-ssh-issue --
gen_context(system_u:object_r:systemd_ssh_issue_exec_t,s0)
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/selinux-policy-20261006/policy/modules/system/systemd.te
new/selinux-policy-20261014/policy/modules/system/systemd.te
--- old/selinux-policy-20261006/policy/modules/system/systemd.te
2026-10-06 09:53:13.000000000 +0200
+++ new/selinux-policy-20261014/policy/modules/system/systemd.te
2026-10-14 17:01:41.000000000 +0200
@@ -352,6 +352,8 @@
type systemd_pcrlock_var_run_t;
files_pid_file(systemd_pcrlock_var_run_t)
+systemd_domain_template(systemd_report)
+
# /run/varlink{,/registry}
type systemd_varlink_t;
files_pid_file(systemd_varlink_t)
@@ -2294,6 +2296,23 @@
# still keep it permissive for now. Failure to run can prevent booting
permissive systemd_pcrlock_t;
+########################################
+#
+# systemd_report local policy
+#
+
+kernel_dgram_send(systemd_report_t)
+
+corenet_tcp_connect_http_port(systemd_report_t)
+
+init_list_pid_dirs(systemd_report_t)
+
+optional_policy(`
+ rebootmgr_varlink_chat(systemd_report_t)
+')
+
+permissive systemd_report_t;
+
#######################################
#
# systemd_user_runtimedir local policy
