Allow watch on more logfiles

Depend on pyasynchat and pyasyncore, as these are removed from
Python 3.12 but fail2ban is so heavily built on them we cannot
rewrite it in time for the Fedora 39 release. Drop the smtp tests
as they require the Python smptd module that was removed from
Python 3.12 and there's no drop-in replacement. Disable the
database repair test as it cannot work with sqlite 3.42.0.

Upstream references:
https://github.com/fail2ban/fail2ban/issues/3487
https://github.com/fail2ban/fail2ban/issues/3586

Signed-off-by: Adam Williamson <awilliam@redhat.com>

fail2ban.spec

@@ -6,7 +6,7 @@
 
 Name: fail2ban
 Version: 1.0.2
-Release: 7%{?dist}
+Release: 12%{?dist}
 Summary: Daemon to ban hosts that cause multiple authentication errors
 
 License: GPLv2+
@@ -53,11 +53,25 @@ BuildRequires: /usr/bin/2to3
 # For testcases
 BuildRequires: python3-inotify
 %endif
+# using a python3_version-based conditional does not work here, so
+# this is a proxy for "Python version greater than 3.12". asyncore
+# and asynchat were dropped from cpython core in 3.12, these modules
+# make them available again. See:
+# https://github.com/fail2ban/fail2ban/issues/3487
+# https://bugzilla.redhat.com/show_bug.cgi?id=2219991
+%if 0%{?fedora} > 38
+BuildRequires: python3-pyasyncore
+BuildRequires: python3-pyasynchat
+%endif
 BuildRequires: sqlite
 BuildRequires: systemd
 BuildRequires: selinux-policy-devel
 BuildRequires: make
+%if 0%{?fedora} >= 41
+BuildRequires: bash-completion-devel
+%else
 BuildRequires: bash-completion
+%endif
 BuildRequires: gnupg2
 
 # Default components
@@ -110,6 +124,11 @@ Requires: (%{name}-selinux if selinux-policy-%{selinuxtype})
 %else
 Requires: %{name}-selinux
 %endif
+# see note above in BuildRequires section
+%if 0%{?fedora} > 38
+Requires: python3-pyasyncore
+Requires: python3-pyasynchat
+%endif
 
 %description server
 This package contains the core server components for Fail2Ban with minimal
@@ -224,6 +243,11 @@ by default.
 %prep
 %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %autosetup -p1
+# this test uses smtpd which is removed in Python 3.12, rewriting it
+# isn't trivial
+%if 0%{?fedora} > 38
+rm -f fail2ban/tests/action_d/test_smtp.py
+%endif
 
 # Use Fedora paths
 sed -i -e 's/^before = paths-.*/before = paths-fedora.conf/' config/jail.conf
@@ -318,8 +342,14 @@ COMPLETIONDIR=%{buildroot}$(pkg-config --variable=completionsdir bash-completion
 %if 0%{?rhel} && 0%{?rhel} < 8
 %python2 bin/fail2ban-testcases --verbosity=2 --no-network
 %else
+%if 0%{?fedora} > 38
+# testRepairDb does not work with sqlite 3.42.0+
+# https://github.com/fail2ban/fail2ban/issues/3586
+%python3 bin/fail2ban-testcases --verbosity=2 --no-network -i testRepairDb
+%else
 %python3 bin/fail2ban-testcases --verbosity=2 --no-network
 %endif
+%endif
 
 
 %pre selinux
@@ -430,6 +460,23 @@ fi
 
 
 %changelog
+* Thu Feb 22 2024 Orion Poplawski <orion@nwra.com> - 1.0.2-12
+- Allow watch on more logfiles
+
+* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.0.2-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Fri Jan 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.0.2-10
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Wed Sep 27 2023 Adam Williamson <awilliam@redhat.com> - 1.0.2-9
+- Require pyasynchat and pyasyncore with Python 3.12+
+- Disable smtp tests on F39+ due to removal of smtpd from Python 3.12
+- Disable db repair test on F39+ as it's broken with sqlite 3.42.0+
+
+* Wed Jul 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.0.2-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
 * Mon Jun 26 2023 Todd Zullinger <tmz@pobox.com> - 1.0.2-7
 - exclude shorewall subpackage on epel9 (rhbz#2217649)
 

fail2ban.te

@@ -100,6 +100,11 @@ logging_dontaudit_search_audit_logs(fail2ban_t)
 logging_mmap_generic_logs(fail2ban_t)
 logging_mmap_journal(fail2ban_t)
 allow fail2ban_t fail2ban_log_t:file watch;
+gen_require(`
+        attribute logfile;
+')
+allow fail2ban_t logfile:dir { watch_dir_perms };
+allow fail2ban_t logfile:file { watch_file_perms };
 # Not in EL9 yet
 #logging_watch_audit_log_files(fail2ban_t)
 gen_require(`