Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package policycoreutils for openSUSE:Factory
checked in at 2026-07-20 09:57:22
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/policycoreutils (Old)
and /work/SRC/openSUSE:Factory/.policycoreutils.new.24530 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "policycoreutils"
Mon Jul 20 09:57:22 2026 rev:92 rq:1366399 version:3.11
Changes:
--------
--- /work/SRC/openSUSE:Factory/policycoreutils/policycoreutils.changes
2026-07-13 14:25:45.042665435 +0200
+++
/work/SRC/openSUSE:Factory/.policycoreutils.new.24530/policycoreutils.changes
2026-07-20 09:59:57.609382191 +0200
@@ -1,0 +2,8 @@
+Fri Jul 17 11:33:32 UTC 2026 - Cathy Hu <[email protected]>
+
+- Drop /tmp cleanup to avoid TOCTOU issues (bsc#1271645)
+ - can be dropped once "policycoreutils/scripts/fixfiles: drop /tmp cleanup"
is
+ in the upstream release
+ - Add patch: 1271645-drop-tmp-cleanup.patch
+
+-------------------------------------------------------------------
New:
----
1271645-drop-tmp-cleanup.patch
----------(New B)----------
New: in the upstream release
- Add patch: 1271645-drop-tmp-cleanup.patch
----------(New E)----------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ policycoreutils.spec ++++++
--- /var/tmp/diff_new_pack.ibI6ok/_old 2026-07-20 09:59:58.377408038 +0200
+++ /var/tmp/diff_new_pack.ibI6ok/_new 2026-07-20 09:59:58.381408172 +0200
@@ -59,6 +59,8 @@
Patch2: get_os_version.patch
Patch3: run_init.pamd.patch
Patch4: usr_etc.patch
+# PATCH-FIX-UPSTREAM [email protected] bsc#1271645 2026-07-17 upstream patch, can
be dropped in next release
+Patch5: 1271645-drop-tmp-cleanup.patch
BuildRequires: audit-devel >= %{libaudit_ver}
BuildRequires: bison
BuildRequires: dbus-1-glib-devel
@@ -211,6 +213,7 @@
%patch -P2 -p2 -d selinux-python-%{version}
%patch -P3 -p1
%patch -P4 -p1
+%patch -P5 -p2
mv ${setools_python_pwd}/audit2allow ${setools_python_pwd}/chcat
${setools_python_pwd}/semanage ${setools_python_pwd}/sepolgen
${setools_python_pwd}/sepolicy .
mv ${semodule_utils_pwd}/semodule_expand ${semodule_utils_pwd}/semodule_link
${semodule_utils_pwd}/semodule_package .
++++++ 1271645-drop-tmp-cleanup.patch ++++++
The /tmp/{gconfd-*,pulse-*,orbit-*} directories are no longer
created/used by those daemons so we can drop the old commands removing
them.
The find commands used to find unlabeled files under /tmp and other
directories and then invoke chcon on their pathnames will re-lookup
the full path each time and is therefore subject to TOCTOU issues.
Since some of these directories are tmpfs on modern Linux systems,
they can't have any lingering unlabeled files anyway from a prior
SELinux-disabled boot and we can't restorecon at least some of these
directories because they have <<none>> in file_contexts. Just drop
this /tmp cleanup altogether - it is unsafe and shouldn't be needed
anymore.
Signed-off-by: Stephen Smalley <[email protected]>
---
policycoreutils/scripts/fixfiles | 10 ----------
1 file changed, 10 deletions(-)
diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
index b7cd765c..b5f193e1 100755
--- a/policycoreutils/scripts/fixfiles
+++ b/policycoreutils/scripts/fixfiles
@@ -288,16 +288,6 @@ case "$RESTORE_MODE" in
if [ ${OPTION} != "Relabel" ]; then
return
fi
- echo "Cleaning up labels on /tmp"
- rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-*
-
- UNDEFINED=`get_undefined_type` || exit $?
- UNLABELED=`get_unlabeled_type` || exit $?
- find /tmp \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*"
\) \( -type s -o -type p \) -delete
- find /tmp \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*"
\) -exec chcon --no-dereference --reference /tmp {} \;
- find /var/tmp \( -context "*:${UNLABELED}*" -o -context
"*:${UNDEFINED}*" \) -exec chcon --no-dereference --reference /var/tmp {} \;
- find /var/run \( -context "*:${UNLABELED}*" -o -context
"*:${UNDEFINED}*" \) -exec chcon --no-dereference --reference /var/run {} \;
- [ ! -e /var/lib/debug ] || find /var/lib/debug \( -context
"*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --no-dereference
--reference /lib {} \;
;;
esac
}
--
2.55.0
