Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package container-selinux for openSUSE:Factory checked in at 2026-09-15 12:47:57 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/container-selinux (Old) and /work/SRC/openSUSE:Factory/.container-selinux.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "container-selinux" Tue Sep 15 12:47:57 2026 rev:41 rq:1377890 version:2.251.0 Changes: -------- --- /work/SRC/openSUSE:Factory/container-selinux/container-selinux.changes 2026-07-02 20:07:36.781554221 +0200 +++ /work/SRC/openSUSE:Factory/.container-selinux.new.383539/container-selinux.changes 2026-09-15 12:47:59.046842080 +0200 @@ -1,0 +2,9 @@ +Mon Sep 14 11:40:17 UTC 2026 - Johannes Segitz <[email protected]> + +- Update to version 2.251.0: + * Allow spc_t permissions for container_runtime_domain directory management + * Allow sshd_session_t to launch containers + * Add missing contexts for Docker's containerd-snapshotter + * Add container_runtime_nnp_domtrans interface + +------------------------------------------------------------------- Old: ---- container-selinux-2.250.0.tar.xz New: ---- container-selinux-2.251.0.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ container-selinux.spec ++++++ --- /var/tmp/diff_new_pack.WBZCbY/_old 2026-09-15 12:47:59.801873530 +0200 +++ /var/tmp/diff_new_pack.WBZCbY/_new 2026-09-15 12:47:59.803873614 +0200 @@ -26,7 +26,7 @@ # Version of SELinux we were using %define selinux_policyver %(rpm -q selinux-policy --qf '%%{version}') Name: container-selinux -Version: 2.250.0 +Version: 2.251.0 Release: 0 Summary: SELinux policies for container runtimes License: GPL-2.0-only ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.WBZCbY/_old 2026-09-15 12:47:59.860875988 +0200 +++ /var/tmp/diff_new_pack.WBZCbY/_new 2026-09-15 12:47:59.863876113 +0200 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/containers/container-selinux.git</param> - <param name="changesrevision">9715eb09108e9fabb0fbaeee9044636b349370eb</param></service></servicedata> + <param name="changesrevision">4ac019955c8885496ffbd978520c905434d4273e</param></service></servicedata> (No newline at EOF) ++++++ container-selinux-2.250.0.tar.xz -> container-selinux-2.251.0.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/container-selinux-2.250.0/container.fc new/container-selinux-2.251.0/container.fc --- old/container-selinux-2.250.0/container.fc 2026-07-02 12:09:09.000000000 +0200 +++ new/container-selinux-2.251.0/container.fc 2026-09-08 20:16:26.000000000 +0200 @@ -81,6 +81,9 @@ /var/lib/docker/init(/.*)? gen_context(system_u:object_r:container_ro_file_t,s0) /var/lib/docker/overlay(/.*)? gen_context(system_u:object_r:container_ro_file_t,s0) /var/lib/docker/overlay2(/.*)? gen_context(system_u:object_r:container_ro_file_t,s0) +# For Docker's embedded/supervised containerd instance. +/var/lib/docker/containerd/daemon/[^/]*/snapshots(/.*)? gen_context(system_u:object_r:container_file_t,s0) +/var/lib/docker/containerd/daemon/[^/]*/sandboxes(/.*)? gen_context(system_u:object_r:container_ro_file_t,s0) /var/lib/containerd(/.*)? gen_context(system_u:object_r:container_var_lib_t,s0) # The "snapshots" directory of containerd and BuildKit must be writable, as it is used as an upperdir as well as a lowerdir. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/container-selinux-2.250.0/container.if new/container-selinux-2.251.0/container.if --- old/container-selinux-2.250.0/container.if 2026-07-02 12:09:09.000000000 +0200 +++ new/container-selinux-2.251.0/container.if 2026-09-08 20:16:26.000000000 +0200 @@ -1145,3 +1145,23 @@ allow $1 container_t:process signull; ') + +######################################## +## <summary> +## Execute container_runtime in the container_runtime domain, +## and allow the transition under NoNewPrivileges (NNP) or nosuid. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed to transition. +## </summary> +## </param> +# +interface(`container_runtime_nnp_domtrans',` + gen_require(` + type container_runtime_t; + ') + + container_runtime_domtrans($1) + allow $1 container_runtime_t:process2 { nnp_transition nosuid_transition }; +') \ No newline at end of file diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/container-selinux-2.250.0/container.te new/container-selinux-2.251.0/container.te --- old/container-selinux-2.250.0/container.te 2026-07-02 12:09:09.000000000 +0200 +++ new/container-selinux-2.251.0/container.te 2026-09-08 20:16:26.000000000 +0200 @@ -1,4 +1,4 @@ -policy_module(container, 2.250.0) +policy_module(container, 2.251.0) gen_require(` class passwd rootok; @@ -830,6 +830,7 @@ admin_pattern(spc_t, kubernetes_file_t) allow spc_t container_runtime_domain:fifo_file manage_fifo_file_perms; +manage_dirs_pattern(spc_t, container_runtime_domain, container_runtime_domain) allow spc_t { container_ro_file_t container_file_t }:system module_load; allow container_runtime_domain spc_t:process { dyntransition setsched signal_perms }; @@ -1691,6 +1692,17 @@ dontaudit systemd_logind_t iptables_var_run_t:dir read; ') +# OpenSSH 9.8+ split sshd into sshd (listener) + sshd-session (post-auth). +# Forwarding now runs as sshd_session_t instead of sshd_t. +optional_policy(` + tunable_policy(`sshd_launch_containers',` + gen_require(` + type sshd_session_t; + ') + container_runtime_domtrans(sshd_session_t) + ') +') + role container_user_r; userdom_restricted_user_template(container_user) userdom_manage_home_role(container_user_r, container_user_t) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/container-selinux-2.250.0/test/main.fmf new/container-selinux-2.251.0/test/main.fmf --- old/container-selinux-2.250.0/test/main.fmf 2026-07-02 12:09:09.000000000 +0200 +++ new/container-selinux-2.251.0/test/main.fmf 2026-09-08 20:16:26.000000000 +0200 @@ -36,6 +36,6 @@ - when: distro == centos-stream environment+: ROOTLESS_USER: "ec2-user" - - when: distro == rhel + - when: distro == rhel or distro == fedora-eln environment+: ROOTLESS_USER: "cloud-user"
