From 99541e18236b4a458112f1447c047e3fe9f056eb Mon Sep 17 00:00:00 2001 From: MSVSphere Packaging Team Date: Thu, 5 Sep 2024 03:36:49 +0300 Subject: [PATCH] import libdnf-0.69.0-8.el9_4.1 --- ...o-perform-labeling-if-SELinux-is-dis.patch | 93 +++++++++++++++++++ SPECS/libdnf.spec | 9 +- 2 files changed, 98 insertions(+), 4 deletions(-) create mode 100644 SOURCES/0009-repo-Don-t-try-to-perform-labeling-if-SELinux-is-dis.patch diff --git a/SOURCES/0009-repo-Don-t-try-to-perform-labeling-if-SELinux-is-dis.patch b/SOURCES/0009-repo-Don-t-try-to-perform-labeling-if-SELinux-is-dis.patch new file mode 100644 index 0000000..02ad251 --- /dev/null +++ b/SOURCES/0009-repo-Don-t-try-to-perform-labeling-if-SELinux-is-dis.patch @@ -0,0 +1,93 @@ +From a0a32b4c2e2a03ff6ffcb6b7285905ec50892798 Mon Sep 17 00:00:00 2001 +From: Colin Walters +Date: Tue, 4 Jun 2024 06:57:19 -0400 +Subject: [PATCH] repo: Don't try to perform labeling if SELinux is disabled +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The default for container execution is that `/sys/fs/selinux` +is not mounted, and the libselinux library function `is_selinux_enabled` +should be used to dynamically check if the system should attempt to perform SELinux labeling. + +This is how it's done by rpm, ostree, and systemd for example. + +But this code unconditionally tries to label if it finds a policy, +which breaks in an obscure corner case +when executed inside a container that includes policy files (e.g. +fedora/rhel-bootc) but when we're not using overlayfs for the backend +(with BUILDAH_BACKEND=vfs). + +Signed-off-by: Petr Písař +--- + libdnf/repo/Repo.cpp | 50 +++++++++++++++++++++++--------------------- + 1 file changed, 26 insertions(+), 24 deletions(-) + +diff --git a/libdnf/repo/Repo.cpp b/libdnf/repo/Repo.cpp +index 16f15195..10b88813 100644 +--- a/libdnf/repo/Repo.cpp ++++ b/libdnf/repo/Repo.cpp +@@ -679,34 +679,36 @@ static int create_temporary_directory(char *name_template) { + int old_default_context_was_retrieved = 0; + struct selabel_handle *labeling_handle = NULL; + +- /* A purpose of this piece of code is to deal with applications whose +- * security policy overrides a file context for temporary files but don't +- * know that libdnf executes GnuPG which expects a default file context. */ +- if (0 == getfscreatecon(&old_default_context)) { +- old_default_context_was_retrieved = 1; +- } else { +- logger->debug(tfm::format("Failed to retrieve a default SELinux context")); +- } ++ if (is_selinux_enabled()) { ++ /* A purpose of this piece of code is to deal with applications whose ++ * security policy overrides a file context for temporary files but don't ++ * know that libdnf executes GnuPG which expects a default file context. */ ++ if (0 == getfscreatecon(&old_default_context)) { ++ old_default_context_was_retrieved = 1; ++ } else { ++ logger->debug(tfm::format("Failed to retrieve a default SELinux context")); ++ } + +- labeling_handle = selabel_open(SELABEL_CTX_FILE, NULL, 0); +- if (NULL == labeling_handle) { +- logger->debug(tfm::format("Failed to open a SELinux labeling handle: %s", +- strerror(errno))); +- } else { +- if (selabel_lookup(labeling_handle, &new_default_context, name_template, 0700)) { +- /* Here we could hard-code "system_u:object_r:user_tmp_t:s0", but +- * that value should be really defined in default file context +- * SELinux policy. Only log that the policy is incpomplete. */ +- logger->debug(tfm::format("Failed to look up a default SELinux label for \"%s\"", +- name_template)); ++ labeling_handle = selabel_open(SELABEL_CTX_FILE, NULL, 0); ++ if (NULL == labeling_handle) { ++ logger->debug(tfm::format("Failed to open a SELinux labeling handle: %s", ++ strerror(errno))); + } else { +- if (setfscreatecon(new_default_context)) { +- logger->debug(tfm::format("Failed to set default SELinux context to \"%s\"", +- new_default_context)); ++ if (selabel_lookup(labeling_handle, &new_default_context, name_template, 0700)) { ++ /* Here we could hard-code "system_u:object_r:user_tmp_t:s0", but ++ * that value should be really defined in default file context ++ * SELinux policy. Only log that the policy is incpomplete. */ ++ logger->debug(tfm::format("Failed to look up a default SELinux label for \"%s\"", ++ name_template)); ++ } else { ++ if (setfscreatecon(new_default_context)) { ++ logger->debug(tfm::format("Failed to set default SELinux context to \"%s\"", ++ new_default_context)); ++ } ++ freecon(new_default_context); + } +- freecon(new_default_context); ++ selabel_close(labeling_handle); + } +- selabel_close(labeling_handle); + } + #endif + +-- +2.45.2 + diff --git a/SPECS/libdnf.spec b/SPECS/libdnf.spec index 727a434..e66cd1f 100644 --- a/SPECS/libdnf.spec +++ b/SPECS/libdnf.spec @@ -58,7 +58,7 @@ Name: libdnf Version: %{libdnf_major_version}.%{libdnf_minor_version}.%{libdnf_micro_version} -Release: 8%{?dist}.inferit +Release: 8%{?dist}.1.inferit Summary: Library providing simplified C and Python API to libsolv License: LGPLv2+ URL: https://github.com/rpm-software-management/libdnf @@ -71,10 +71,10 @@ Patch5: 0005-filterAdvisory-installed_solvables-sort-RhBug2212838.patch Patch6: 0006-hawkeysubject-get_best_selectors-only-obsol-oflatest.patch Patch7: 0007-Avoid-reinstal-installonly-packages-marked-for-ERASE.patch Patch8: 0008-PGP-Set-a-default-creation-SELinux-labels-on-GnuPG-d.patch +Patch9: 0009-repo-Don-t-try-to-perform-labeling-if-SELinux-is-dis.patch # MSVSphere Patch1000: 0001-Change-bugrtacker-url.patch - BuildRequires: cmake BuildRequires: gcc BuildRequires: gcc-c++ @@ -322,8 +322,9 @@ popd %endif %changelog -* Tue Apr 02 2024 Arkady L. Shane - 0.69.0-8.inferit -- Change bugtracker url +* Fri Jun 21 2024 Petr Pisar - 0.69.0-8.1 +- Do not set a default SELinux creation context if SELinux appears to be + disabled (RHEL-39796) * Wed Oct 25 2023 Petr Pisar - 0.69.0-8 - Set default SELinux labels on GnuPG directories (RHEL-11238)