.gitignore

@@ -1,2 +1,2 @@
 SOURCES/container-selinux.tgz
-SOURCES/selinux-policy-0113b35.tar.gz
+SOURCES/selinux-policy-6112821.tar.gz

.selinux-policy.metadata

@@ -1,2 +1,2 @@
-484f3f9e443621ccd65c42d11229424a36bf58b9 SOURCES/container-selinux.tgz
+af02e18349519dd577a4cc9bef8a3a78b26923f9 SOURCES/container-selinux.tgz
-430470dababaa6af18348fc2f8f0fe2108b50e05 SOURCES/selinux-policy-0113b35.tar.gz
+c39699459cb607824f45fae42aa452e6f84fbc68 SOURCES/selinux-policy-6112821.tar.gz

SOURCES/booleans-targeted.conf

@@ -12,6 +12,7 @@ pppd_can_insmod = false
 privoxy_connect_any = true
 selinuxuser_direct_dri_enabled = true
 selinuxuser_execmem = true
+selinuxuser_execmod = true
 selinuxuser_execstack = true
 selinuxuser_rw_noexattrfile=true
 selinuxuser_ping = true

SOURCES/file_contexts.subs_dist

@@ -1,5 +1,5 @@
-/run /var/run
+/var/run /run
-/run/lock /var/lock
+/var/lock /run/lock
 /run/systemd/system /usr/lib/systemd/system
 /run/systemd/generator /usr/lib/systemd/system
 /run/systemd/generator.early /usr/lib/systemd/system

SOURCES/modules-targeted-contrib.conf

@@ -706,6 +706,13 @@ git = module
 # 
 glance = module
 
+# Layer: contrib
+# Module: glusterd
+#  
+#  policy for glusterd service
+#
+glusterd =  module
+
 # Layer: apps
 # Module: gnome
 #
@@ -2650,6 +2657,13 @@ stratisd = module
 #
 ica = module
 
+# Layer: contrib
+# Module: fedoratp
+#
+# fedoratp
+#
+fedoratp = module
+
 # Layer: contrib
 # Module: insights_client
 #
@@ -2692,6 +2706,20 @@ mptcpd = module
 #
 rshim = module
 
+# Layer: contrib
+# Module: keyutils
+#
+# keyutils
+#
+keyutils = module
+
+# Layer: contrib
+# Module: cifsutils
+#
+#  cifsutils - Utilities for managing CIFS mounts
+#
+cifsutils = module
+
 # Layer: contrib
 # Module: boothd
 #
@@ -2699,6 +2727,20 @@ rshim = module
 #
 boothd = module
 
+# Layer: contrib
+# Module: kafs
+#
+#  kafs - Tools for kAFS
+#
+kafs = module
+
+# Layer: contrib
+# Module: bootupd
+#
+#  bootupd - bootloader update daemon
+#
+bootupd = module
+
 # Layer: contrib
 # Module: fdo
 #
@@ -2713,6 +2755,13 @@ fdo = module
 #
 qatlib = module
 
+# Layer: services
+# Module: virt_supplementary
+#
+# non-libvirt virtualization libraries
+#
+virt_supplementary = module
+
 # Layer: contrib
 # Module: nvme_stas
 #
@@ -2733,17 +2782,3 @@ coreos_installer = module
 # afterburn
 #
 afterburn = module
-
-# Layer: contrib
-# Module: sap_unconfined
-#
-#  sap_unconfined
-#
-sap = module
-
-# Layer: contrib
-# Module: bootupd
-#
-#  bootupd - bootloader update daemon
-#
-bootupd = module

SOURCES/rpm.macros

@@ -55,8 +55,10 @@ if [ -z "${_policytype}" ]; then \
   _policytype="targeted" \
 fi \
 if [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
+  %{_bindir}/rm -rf %{_sharedstatedir}/selinux/${_policytype}/active/modules/400/extra_varrun || : \
   %{_sbindir}/semodule -n -s ${_policytype} -X %{!-p:200}%{-p*} -i %* || : \
   %{_sbindir}/selinuxenabled && %{_sbindir}/load_policy || : \
+  %{_libexecdir}/selinux/varrun-convert.sh ${_policytype} || : \
 fi \
 %{nil}
 
@@ -71,8 +73,10 @@ if [ -z "${_policytype}" ]; then \
 fi \
 if [ $1 -eq 0 ]; then \
   if [ "${SELINUXTYPE}" = "${_policytype}" ]; then \
+    %{_bindir}/rm -rf %{_sharedstatedir}/selinux/${_policytype}/active/modules/400/extra_varrun || : \
     %{_sbindir}/semodule -n -X %{!-p:200}%{-p*} -s ${_policytype} -r %* &> /dev/null || : \
     %{_sbindir}/selinuxenabled && %{_sbindir}/load_policy || : \
+    %{_libexecdir}/selinux/varrun-convert.sh ${_policytype} || : \
   fi \
 fi \
 %{nil}

SOURCES/varrun-convert.sh

@@ -0,0 +1,80 @@
+#!/bin/bash
+### varrun-convert.sh
+### convert legacy filecontext entries containing /var/run to /run
+### and load an extra selinux module with the new content
+### the script takes a policy name as an argument
+
+# Set DEBUG=yes before running the script to get more verbose output
+if [ "${DEBUG}" = "yes" ]; then
+  set -x
+fi
+
+# Look for working files and log in OUTPUTDIR
+OUTPUTDIR="/run/selinux-policy"
+LOG="$OUTPUTDIR/log"
+mkdir -p ${OUTPUTDIR}
+
+if [ -z ${1} ]; then
+  [ "${DEBUG}" = "yes" ] && echo "Error: Policy name required as an argument (e.g. targeted)" >> $LOG
+  exit
+fi
+
+FILE_CONTEXTS="/etc/selinux/${1}/contexts/files/file_contexts"
+if [ ! -f ${FILE_CONTEXTS} ]; then
+  [ "${DEBUG}" = "yes" ] && echo "Error: File context database file does not exist" >> $LOG
+  exit
+fi
+
+SEMODULEOPT="-s ${1}"
+[ "${DEBUG}" = "yes" ] && SEMODULEOPT="-v ${SEMODULEOPT}"
+
+if ! grep -q ^/var/run ${FILE_CONTEXTS}; then
+  [ "${DEBUG}" = "yes" ] && echo "Info: No entries containing /var/run" >> $LOG
+  exit
+fi
+
+EXTRA_VARRUN_ENTRIES="$OUTPUTDIR/extra_varrun_entries.txt"
+EXTRA_VARRUN_CIL="/$OUTPUTDIR/extra_varrun.cil"
+
+# Print only /var/run entries
+grep ^/var/run ${FILE_CONTEXTS} > ${EXTRA_VARRUN_ENTRIES}
+
+# Unify whitespace separators
+sed -i 's/[ \t]\+/ /g' ${EXTRA_VARRUN_ENTRIES}
+
+# Change /var/run to /run
+sed -i 's|^/var/run|/run|' ${EXTRA_VARRUN_ENTRIES}
+
+# Exception handling: packages with already duplicate entries
+sed -i '/^\/run\/snapd/d' ${EXTRA_VARRUN_ENTRIES}
+sed -i '/^\/run\/vfrnav/d' ${EXTRA_VARRUN_ENTRIES}
+sed -i '/^\/run\/waydroid/d' ${EXTRA_VARRUN_ENTRIES}
+
+# Change format to cil
+sed -i 's/^\([^ ]\+\) \([^-]\)/\1 any \2/' ${EXTRA_VARRUN_ENTRIES}
+sed -i 's/^\([^ ]\+\) -- /\1 file /' ${EXTRA_VARRUN_ENTRIES}
+sed -i 's/^\([^ ]\+\) -b /\1 block /' ${EXTRA_VARRUN_ENTRIES}
+sed -i 's/^\([^ ]\+\) -c /\1 char /' ${EXTRA_VARRUN_ENTRIES}
+sed -i 's/^\([^ ]\+\) -d /\1 dir /' ${EXTRA_VARRUN_ENTRIES}
+sed -i 's/^\([^ ]\+\) -l /\1 symlink /' ${EXTRA_VARRUN_ENTRIES}
+sed -i 's/^\([^ ]\+\) -p /\1 pipe /' ${EXTRA_VARRUN_ENTRIES}
+sed -i 's/^\([^ ]\+\) -s /\1 socket /' ${EXTRA_VARRUN_ENTRIES}
+sed -i 's/^\([^ ]\+\) /(filecon "\1" /' ${EXTRA_VARRUN_ENTRIES}
+sed -i 's/system_u:object_r:\([^:]*\):\(.*\)$/(system_u object_r \1 ((\2) (\2))))/' ${EXTRA_VARRUN_ENTRIES}
+
+# Handle entries with <<none>> which do not match previous regexps
+sed -i s'/ <<none>>$/ ())/' ${EXTRA_VARRUN_ENTRIES}
+
+# Wrap each line with an optional block
+i=1
+while read line
+do
+  echo "(optional extra_var_run_${i}"
+  echo "  $line"
+  echo ")"
+  ((i++))
+done < ${EXTRA_VARRUN_ENTRIES} > ${EXTRA_VARRUN_CIL}
+
+# Load module
+/usr/sbin/semodule ${SEMODULEOPT} -i ${EXTRA_VARRUN_CIL}
+