Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package swtpm for openSUSE:Factory checked in at 2026-08-05 17:46:35 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/swtpm (Old) and /work/SRC/openSUSE:Factory/.swtpm.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "swtpm" Wed Aug 5 17:46:35 2026 rev:27 rq:1369535 version:0.10.1 Changes: -------- --- /work/SRC/openSUSE:Factory/swtpm/swtpm.changes 2026-07-15 16:31:43.962308325 +0200 +++ /work/SRC/openSUSE:Factory/.swtpm.new.16738/swtpm.changes 2026-08-05 17:47:02.834986492 +0200 @@ -1,0 +2,11 @@ +Thu Jul 30 04:37:06 UTC 2026 - Jehu Marcos Herrera Puentes <[email protected]> + +- Fix SELinux policy for virtqemud_t swtpm_t setsched + process and unix socket interactions. Allows virtqemud_t to: Signal and + control swtpm_t processes (noatsecure, rlimitinh, siginh, signull, setsched), + create and listen on Unix stream sockets with swtpm_t processes (bsc#1266339). + Already accepted on upstream: + https://github.com/stefanberger/swtpm/pull/1132 +- Add patch: 1132.patch + +------------------------------------------------------------------- New: ---- 1132.patch ----------(New B)---------- New: https://github.com/stefanberger/swtpm/pull/1132 - Add patch: 1132.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ swtpm.spec ++++++ --- /var/tmp/diff_new_pack.IvUfiB/_old 2026-08-05 17:47:04.583047718 +0200 +++ /var/tmp/diff_new_pack.IvUfiB/_new 2026-08-05 17:47:04.599048279 +0200 @@ -44,6 +44,8 @@ Patch1: https://patch-diff.githubusercontent.com/raw/stefanberger/swtpm/pull/1027.patch # PATCH-FIX-UPSTREAM - [email protected] bsc#1271417 drop tunable requires as it overrides booleanif Patch2: 1271417-drop-tunable-requires.patch +# PATCH-FIX-UPSTREAM - [email protected] bsc#1266339 allow unix_stream_socket and setsched for virtqemud +Patch3: https://patch-diff.githubusercontent.com/raw/stefanberger/swtpm/pull/1132.patch BuildRequires: autoconf BuildRequires: automake BuildRequires: expect ++++++ 1132.patch ++++++ >From 52bbff4c7ecdf9b5ff77f08ccc5cef2548036822 Mon Sep 17 00:00:00 2001 From: JMarcosHP <[email protected]> Date: Wed, 27 May 2026 09:49:33 -0600 Subject: [PATCH] selinux: Add SELinux policy for virtqemud_t swtpm_t setsched process and unix socket interactions. Allows virtqemud_t to: - Signal and control swtpm_t processes (noatsecure, rlimitinh, siginh, signull, setsched) - Create and listen on Unix stream sockets with swtpm_t processes This enables libvirt to properly control swtpm instances, including sending signals and managing process scheduling attributes, when the system is using cockpit-machines interface to manage and start VMs. Fixes: https://github.com/stefanberger/swtpm/issues/1131 Signed-off-by: JMarcosHP <[email protected]> --- src/selinux/swtpm_libvirt.te | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/selinux/swtpm_libvirt.te b/src/selinux/swtpm_libvirt.te index 43e4ad216..f411ecb2a 100644 --- a/src/selinux/swtpm_libvirt.te +++ b/src/selinux/swtpm_libvirt.te @@ -40,7 +40,8 @@ allow virtqemud_t svirt_tcg_t:file { open read }; allow virtqemud_t svirt_tcg_t:process { noatsecure rlimitinh setsched siginh signal signull transition }; allow virtqemud_t svirt_tcg_t:unix_stream_socket { bind connectto create listen }; allow virtqemud_t svirt_tcg_devpts_t:chr_file { ioctl open read write }; -allow virtqemud_t swtpm_t:process { noatsecure rlimitinh siginh signull }; +allow virtqemud_t swtpm_t:process { noatsecure rlimitinh siginh signull setsched }; +allow virtqemud_t swtpm_t:unix_stream_socket { bind connectto create listen }; allow virtqemud_t urandom_device_t:chr_file setattr; # Some rules are due to swtpm-localca ( https://bugzilla.redhat.com/show_bug.cgi?id=2278905#c34 )
