Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package selinux-policy for openSUSE:Factory
checked in at 2026-10-20 12:57:00
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/selinux-policy (Old)
and /work/SRC/openSUSE:Factory/.selinux-policy.new.3698736 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "selinux-policy"
Tue Oct 20 12:57:00 2026 rev:182 rq:1386337 version:20261019
Changes:
--------
--- /work/SRC/openSUSE:Factory/selinux-policy/selinux-policy.changes
2026-10-16 20:06:50.374998182 +0200
+++
/work/SRC/openSUSE:Factory/.selinux-policy.new.3698736/selinux-policy.changes
2026-10-20 12:57:02.003501246 +0200
@@ -1,0 +2,7 @@
+Mon Oct 19 15:00:53 UTC 2026 - Cathy Hu <[email protected]>
+
+- Update to version 20261019:
+ * Allow systemd_nsresourced_t setuid/setgid inside a userns (bsc#1285095)
+ * broaden ld.so.cache regex to include temporary files (bsc#1270243)
+
+-------------------------------------------------------------------
Old:
----
selinux-policy-20261014.tar.xz
New:
----
selinux-policy-20261019.tar.xz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ selinux-policy.spec ++++++
--- /var/tmp/diff_new_pack.Tr4GLF/_old 2026-10-20 12:57:03.692571975 +0200
+++ /var/tmp/diff_new_pack.Tr4GLF/_new 2026-10-20 12:57:03.694572059 +0200
@@ -37,7 +37,7 @@
License: GPL-2.0-or-later
Group: System/Management
Name: selinux-policy
-Version: 20261014
+Version: 20261019
Release: 0
Source0: %{name}-%{version}.tar.xz
Source1: container.fc
++++++ _servicedata ++++++
--- /var/tmp/diff_new_pack.Tr4GLF/_old 2026-10-20 12:57:03.844578340 +0200
+++ /var/tmp/diff_new_pack.Tr4GLF/_new 2026-10-20 12:57:03.851578633 +0200
@@ -1,6 +1,6 @@
<servicedata>
<service name="tar_scm">
<param
name="url">https://gitlab.suse.de/selinux/selinux-policy.git</param>
- <param
name="changesrevision">80755a1a58a6d819673df1f0fd20a02f9d140545</param></service></servicedata>
+ <param
name="changesrevision">ac53459b5d38a6c9e481c1d2c28e27f40aeac0bd</param></service></servicedata>
(No newline at EOF)
++++++ selinux-policy-20261014.tar.xz -> selinux-policy-20261019.tar.xz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/selinux-policy-20261014/policy/modules/system/libraries.fc
new/selinux-policy-20261019/policy/modules/system/libraries.fc
--- old/selinux-policy-20261014/policy/modules/system/libraries.fc
2026-10-14 17:01:41.000000000 +0200
+++ new/selinux-policy-20261019/policy/modules/system/libraries.fc
2026-10-19 17:00:14.000000000 +0200
@@ -30,7 +30,7 @@
#
/etc/ld\.so\.cache --
gen_context(system_u:object_r:ld_so_cache_t,s0)
/etc/ld\.so\.cache~ --
gen_context(system_u:object_r:ld_so_cache_t,s0)
-/etc/ld\.so\.cache\.[^/]+ --
gen_context(system_u:object_r:ld_so_cache_t,s0)
+/etc/ld\.so\.cache.* --
gen_context(system_u:object_r:ld_so_cache_t,s0)
/etc/ld\.so\.preload --
gen_context(system_u:object_r:ld_so_cache_t,s0)
/etc/ld\.so\.preload~ --
gen_context(system_u:object_r:ld_so_cache_t,s0)
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/selinux-policy-20261014/policy/modules/system/systemd.te
new/selinux-policy-20261019/policy/modules/system/systemd.te
--- old/selinux-policy-20261014/policy/modules/system/systemd.te
2026-10-14 17:01:41.000000000 +0200
+++ new/selinux-policy-20261019/policy/modules/system/systemd.te
2026-10-19 17:00:14.000000000 +0200
@@ -2219,7 +2219,7 @@
allow systemd_nsresourced_t self:bpf { map_create map_read map_write prog_load
prog_run };
allow systemd_nsresourced_t self:capability { setgid setuid sys_resource };
allow systemd_nsresourced_t self:capability2 { bpf perfmon };
-allow systemd_nsresourced_t self:cap_userns sys_admin;
+allow systemd_nsresourced_t self:cap_userns { sys_admin setgid setuid };
allow systemd_nsresourced_t self:perf_event manage_perf_event_perms;
allow systemd_nsresourced_t systemd_nsresourced_exec_t:file execute_no_trans;
