Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package rke2-selinux for openSUSE:Factory checked in at 2026-10-29 16:08:06 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/rke2-selinux (Old) and /work/SRC/openSUSE:Factory/.rke2-selinux.new.1255 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "rke2-selinux" Thu Oct 29 16:08:06 2026 rev:10 rq:1393542 version:0.24.stable.1 Changes: -------- --- /work/SRC/openSUSE:Factory/rke2-selinux/rke2-selinux.changes 2026-06-05 14:58:01.522661806 +0200 +++ /work/SRC/openSUSE:Factory/.rke2-selinux.new.1255/rke2-selinux.changes 2026-10-29 16:10:58.538725085 +0100 @@ -1,0 +2,18 @@ +Thu Oct 29 06:37:19 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 0.24.stable.1: + * fix: upload rpm checksums to the github release + * feat: add sle policy for SLES 16 and SL Micro 6.x + * fix: use .microos release suffix for the microos rpm + * refactor: move build scripts out of the policy directories + * fix: race condition if the user does not have the container + selinux in SUSE OS + * Label runtime-created /opt/cni dirs as container_file_t + * feat: add a specific type for etcd snapshots + * adding none to catch-all rule for containerd policy + * Revert local-path-provisioner policy + * Fix github ownership in sign-and-upload + * Add support for Local Path Provisioner volumes in the default + path + +------------------------------------------------------------------- Old: ---- rke2-selinux-0.23.stable.1.obscpio New: ---- rke2-selinux-0.24.stable.1.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ rke2-selinux.spec ++++++ --- /var/tmp/diff_new_pack.82Mh1c/_old 2026-10-29 16:10:59.348759055 +0100 +++ /var/tmp/diff_new_pack.82Mh1c/_new 2026-10-29 16:10:59.350759139 +0100 @@ -46,7 +46,7 @@ %define container_policyver 2.164.2-1.1 Name: rke2-selinux -Version: 0.23.stable.1 +Version: 0.24.stable.1 Release: 0 Summary: SELinux policy module for rke2 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.82Mh1c/_old 2026-10-29 16:10:59.420762075 +0100 +++ /var/tmp/diff_new_pack.82Mh1c/_new 2026-10-29 16:10:59.424762243 +0100 @@ -3,7 +3,7 @@ <param name="url">https://github.com/rancher/rke2-selinux</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">v0.23.stable.1</param> + <param name="revision">v0.24.stable.1</param> <param name="versionformat">@PARENT_TAG@</param> <param name="changesgenerate">enable</param> <param name="versionrewrite-pattern">v(.*)</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.82Mh1c/_old 2026-10-29 16:10:59.446763165 +0100 +++ /var/tmp/diff_new_pack.82Mh1c/_new 2026-10-29 16:10:59.450763333 +0100 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/rancher/rke2-selinux</param> - <param name="changesrevision">95659f017f74a6833be3d2576ce47e0755611c53</param></service></servicedata> + <param name="changesrevision">d06460348b1743db6c0160d59a8c7b1ce3f103ef</param></service></servicedata> (No newline at EOF) ++++++ rke2-selinux-0.23.stable.1.obscpio -> rke2-selinux-0.24.stable.1.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/Dockerfile.centos10 new/rke2-selinux-0.24.stable.1/Dockerfile.centos10 --- old/rke2-selinux-0.23.stable.1/Dockerfile.centos10 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/Dockerfile.centos10 2026-10-22 23:12:29.000000000 +0200 @@ -20,7 +20,9 @@ ARG TAG ARG SCRIPT=build -RUN ${SOURCE}/policy/centos10/scripts/entry "${SCRIPT}" +ENV POLICY=centos10 +ENV BUILD_DIR=/build +RUN ${SOURCE}/scripts/entry "${SCRIPT}" FROM scratch AS result ENV SOURCE=/source diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/Dockerfile.centos8 new/rke2-selinux-0.24.stable.1/Dockerfile.centos8 --- old/rke2-selinux-0.23.stable.1/Dockerfile.centos8 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/Dockerfile.centos8 2026-10-22 23:12:29.000000000 +0200 @@ -12,7 +12,9 @@ ARG TAG ARG SCRIPT=build -RUN ${SOURCE}/policy/centos8/scripts/entry "${SCRIPT}" +ENV POLICY=centos8 +ENV BUILD_DIR=/build +RUN ${SOURCE}/scripts/entry "${SCRIPT}" FROM scratch AS result ENV SOURCE=/source diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/Dockerfile.centos9 new/rke2-selinux-0.24.stable.1/Dockerfile.centos9 --- old/rke2-selinux-0.23.stable.1/Dockerfile.centos9 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/Dockerfile.centos9 2026-10-22 23:12:29.000000000 +0200 @@ -12,7 +12,9 @@ ARG TAG ARG SCRIPT=build -RUN ${SOURCE}/policy/centos9/scripts/entry "${SCRIPT}" +ENV POLICY=centos9 +ENV BUILD_DIR=/build +RUN ${SOURCE}/scripts/entry "${SCRIPT}" FROM scratch AS result ENV SOURCE=/source diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/Dockerfile.microos new/rke2-selinux-0.24.stable.1/Dockerfile.microos --- old/rke2-selinux-0.23.stable.1/Dockerfile.microos 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/Dockerfile.microos 2026-10-22 23:12:29.000000000 +0200 @@ -14,7 +14,9 @@ ARG TAG ARG SCRIPT=build -RUN ${SOURCE}/policy/microos/scripts/entry "${SCRIPT}" +ENV POLICY=microos +ENV BUILD_DIR=/build +RUN ${SOURCE}/scripts/entry "${SCRIPT}" FROM scratch AS result ENV SOURCE=/source diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/Dockerfile.sle new/rke2-selinux-0.24.stable.1/Dockerfile.sle --- old/rke2-selinux-0.23.stable.1/Dockerfile.sle 1970-01-01 01:00:00.000000000 +0100 +++ new/rke2-selinux-0.24.stable.1/Dockerfile.sle 2026-10-22 23:12:29.000000000 +0200 @@ -0,0 +1,24 @@ +ARG OPENSUSE=opensuse/leap:16.0 +FROM ${OPENSUSE} AS build + +RUN zypper install -y container-selinux git rpm-build selinux-policy-devel + +ENV SOURCE=/source + +WORKDIR ${SOURCE} + +COPY . . + +ARG TAG +ARG SCRIPT=build + +# SL Micro 6.0/6.1 ship libsepol 3.5, which only reads policy modules up to version 21 +ENV MODULE_POLICY_VERSION=21 +ENV POLICY=sle +ENV BUILD_DIR=/build +RUN ${SOURCE}/scripts/entry "${SCRIPT}" + +FROM scratch AS result +ENV SOURCE=/source + +COPY --from=build ${SOURCE}/dist /dist diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/Dockerfile.slemicro new/rke2-selinux-0.24.stable.1/Dockerfile.slemicro --- old/rke2-selinux-0.23.stable.1/Dockerfile.slemicro 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/Dockerfile.slemicro 2026-10-22 23:12:29.000000000 +0200 @@ -28,7 +28,9 @@ ARG TAG ARG SCRIPT=build -RUN ${SOURCE}/policy/slemicro/scripts/entry "${SCRIPT}" +ENV POLICY=slemicro +ENV BUILD_DIR=/build +RUN ${SOURCE}/scripts/entry "${SCRIPT}" FROM scratch AS result ENV SOURCE=/source diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/centos10/rke2.fc new/rke2-selinux-0.24.stable.1/policy/centos10/rke2.fc --- old/rke2-selinux-0.23.stable.1/policy/centos10/rke2.fc 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/centos10/rke2.fc 2026-10-22 23:12:29.000000000 +0200 @@ -13,6 +13,7 @@ #/var/lib/cni(/.*)? gen_context(system_u:object_r:container_var_lib_t,s0) /opt/cni(/.*)? gen_context(system_u:object_r:container_file_t,s0) /etc/cni(/.*)? gen_context(system_u:object_r:container_file_t,s0) +#/opt/local-path-provisioner(/.*)? gen_context(system_u:object_r:container_file_t,s0) #/var/lib/kubelet/pods(/.*)? gen_context(system_u:object_r:container_file_t,s0) /var/lib/rancher/rke2(/.*)? gen_context(system_u:object_r:container_var_lib_t,s0) /var/lib/rancher/rke2/data(/.*)? gen_context(system_u:object_r:container_runtime_exec_t,s0) @@ -24,11 +25,12 @@ /var/lib/rancher/rke2/server/logs(/.*)? gen_context(system_u:object_r:container_log_t,s0) /var/lib/rancher/rke2/agent/containerd/containerd\.log gen_context(system_u:object_r:container_log_t,s0) /var/lib/rancher/rke2/agent/logs(/.*)? gen_context(system_u:object_r:container_log_t,s0) +/var/lib/rancher/rke2/server/db(/.*)? gen_context(system_u:object_r:rke2_service_db_file_t,s0) /var/lib/rancher/rke2/server/tls(/.*)? gen_context(system_u:object_r:rke2_tls_t,s0) #/var/run/flannel(/.*)? gen_context(system_u:object_r:container_var_run_t,s0) -/run/k3s(/.*)? gen_context(system_u:object_r:container_var_run_t,s0) -/run/k3s/containerd/[^/]*/sandboxes/[^/]*/shm(/.*)? gen_context(system_u:object_r:container_runtime_tmpfs_t,s0) +/run/k3s(/.*)? gen_context(system_u:object_r:container_var_run_t,s0) +/run/k3s/containerd/[^/]*/sandboxes/[^/]*/shm(/.*)? <<none>> /var/run/k3s(/.*)? gen_context(system_u:object_r:container_var_run_t,s0) -/var/run/k3s/containerd/[^/]*/sandboxes/[^/]*/shm(/.*)? gen_context(system_u:object_r:container_runtime_tmpfs_t,s0) +/var/run/k3s/containerd/[^/]*/sandboxes/[^/]*/shm(/.*)? <<none>> #/var/log/containers(/.*)? gen_context(system_u:object_r:container_log_t,s0) #/var/log/pods(/.*)? gen_context(system_u:object_r:container_log_t,s0) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/centos10/rke2.if new/rke2-selinux-0.24.stable.1/policy/centos10/rke2.if --- old/rke2-selinux-0.23.stable.1/policy/centos10/rke2.if 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/centos10/rke2.if 2026-10-22 23:12:29.000000000 +0200 @@ -14,6 +14,7 @@ type var_lib_t; type var_log_t; type rke2_tls_t; + type rke2_service_db_file_t; ') #container_filetrans_named_content($1) @@ -26,6 +27,7 @@ filetrans_pattern($1, var_log_t, container_log_t, dir, "containers") filetrans_pattern($1, container_var_lib_t, container_log_t, dir, "logs") filetrans_pattern($1, container_var_lib_t, container_log_t, file, "containerd.log") + filetrans_pattern($1, container_var_lib_t, rke2_service_db_file_t, dir, "db") filetrans_pattern($1, container_var_lib_t, rke2_tls_t, dir, "tls") ') @@ -57,4 +59,5 @@ admin_pattern($1_t, container_log_t) admin_pattern($1_t, rke2_tls_t) + admin_pattern($1_t, rke2_service_db_file_t) ') diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/centos10/rke2.te new/rke2-selinux-0.24.stable.1/policy/centos10/rke2.te --- old/rke2-selinux-0.23.stable.1/policy/centos10/rke2.te 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/centos10/rke2.te 2026-10-22 23:12:29.000000000 +0200 @@ -35,3 +35,12 @@ ################### type rke2_tls_t; container_file(rke2_tls_t); + +############################### +# type rke2_service_db_file_t # +############################### +# etcd data and snapshots under /var/lib/rancher/rke2/server/db +type rke2_service_db_file_t; +container_file(rke2_service_db_file_t); +# etcd mmaps its bbolt database (db/etcd/member/snap/db) +allow rke2_service_db_t rke2_service_db_file_t:file { map }; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/centos10/scripts/build new/rke2-selinux-0.24.stable.1/policy/centos10/scripts/build --- old/rke2-selinux-0.23.stable.1/policy/centos10/scripts/build 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/centos10/scripts/build 1970-01-01 01:00:00.000000000 +0100 @@ -1,27 +0,0 @@ -#!/bin/bash -set -e -x - -cd $(dirname $0)/.. -. ../../scripts/version - -make -f /usr/share/selinux/devel/Makefile rke2.pp - -mkdir -p /source/dist/centos10 -CHANGELOG_PATH=/source/dist/centos10/CHANGELOG.md -touch $CHANGELOG_PATH - -. ../../scripts/gen-changelog $CHANGELOG_PATH - -rpmbuild \ - --define "rke2_selinux_version ${RPM_VERSION}" \ - --define "rke2_selinux_release ${RPM_RELEASE}" \ - --define "_sourcedir $PWD" \ - --define "_specdir $PWD" \ - --define "_builddir $PWD" \ - --define "_srcrpmdir ${PWD}/dist/source" \ - --define "_buildrootdir $PWD/.build" \ - --define "_rpmdir ${PWD}/dist" \ - --define "changelog_path $CHANGELOG_PATH" \ - -ba rke2-selinux.spec - -cp -r dist/* /source/dist/centos10 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/centos10/scripts/checksum new/rke2-selinux-0.24.stable.1/policy/centos10/scripts/checksum --- old/rke2-selinux-0.23.stable.1/policy/centos10/scripts/checksum 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/centos10/scripts/checksum 1970-01-01 01:00:00.000000000 +0100 @@ -1,22 +0,0 @@ -#!/bin/bash -set -ex - - -cd $(dirname $0)/.. -ls -la -pwd - -CHECKSUM_DIR=${CHECKSUM_DIR:-./dist/centos7/noarch/} -CHECKSUM_FILE=${CHECKSUM_FILE:-CHECKSUMsum-centos7-noarch.txt} -DEST_DIR=${DEST_DIR:-${CHECKSUM_DIR}} - -sumfile="${DEST_DIR}/${CHECKSUM_FILE}" - -touch "${sumfile}" - -files=$(ls ${CHECKSUM_DIR} | grep -v "sha256sum") -for file in ${files}; do - sha256sum "${CHECKSUM_DIR}/${file}" | sed "s;$(dirname ${CHECKSUM_DIR}/${file})/;;g" >> "${sumfile}" -done - -cat "${sumfile}" \ No newline at end of file diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/centos10/scripts/entry new/rke2-selinux-0.24.stable.1/policy/centos10/scripts/entry --- old/rke2-selinux-0.23.stable.1/policy/centos10/scripts/entry 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/centos10/scripts/entry 1970-01-01 01:00:00.000000000 +0100 @@ -1,8 +0,0 @@ -#!/bin/sh -set -ex - -if [ -e ./policy/centos10/scripts/"$1" ]; then - ./policy/centos10/scripts/"$@" -else - exec "$@" -fi diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/centos8/rke2.fc new/rke2-selinux-0.24.stable.1/policy/centos8/rke2.fc --- old/rke2-selinux-0.23.stable.1/policy/centos8/rke2.fc 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/centos8/rke2.fc 2026-10-22 23:12:29.000000000 +0200 @@ -13,6 +13,7 @@ #/var/lib/cni(/.*)? gen_context(system_u:object_r:container_var_lib_t,s0) /opt/cni(/.*)? gen_context(system_u:object_r:container_file_t,s0) /etc/cni(/.*)? gen_context(system_u:object_r:container_file_t,s0) +#/opt/local-path-provisioner(/.*)? gen_context(system_u:object_r:container_file_t,s0) #/var/lib/kubelet/pods(/.*)? gen_context(system_u:object_r:container_file_t,s0) /var/lib/rancher/rke2(/.*)? gen_context(system_u:object_r:container_var_lib_t,s0) /var/lib/rancher/rke2/data(/.*)? gen_context(system_u:object_r:container_runtime_exec_t,s0) @@ -24,6 +25,7 @@ /var/lib/rancher/rke2/server/logs(/.*)? gen_context(system_u:object_r:container_log_t,s0) /var/lib/rancher/rke2/agent/containerd/containerd\.log gen_context(system_u:object_r:container_log_t,s0) /var/lib/rancher/rke2/agent/logs(/.*)? gen_context(system_u:object_r:container_log_t,s0) +/var/lib/rancher/rke2/server/db(/.*)? gen_context(system_u:object_r:rke2_service_db_file_t,s0) /var/lib/rancher/rke2/server/tls(/.*)? gen_context(system_u:object_r:rke2_tls_t,s0) #/var/run/flannel(/.*)? gen_context(system_u:object_r:container_var_run_t,s0) #/var/run/k3s(/.*)? gen_context(system_u:object_r:container_var_run_t,s0) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/centos8/rke2.if new/rke2-selinux-0.24.stable.1/policy/centos8/rke2.if --- old/rke2-selinux-0.23.stable.1/policy/centos8/rke2.if 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/centos8/rke2.if 2026-10-22 23:12:29.000000000 +0200 @@ -14,6 +14,7 @@ type var_lib_t; type var_log_t; type rke2_tls_t; + type rke2_service_db_file_t; ') #container_filetrans_named_content($1) @@ -26,6 +27,7 @@ filetrans_pattern($1, var_log_t, container_log_t, dir, "containers") filetrans_pattern($1, container_var_lib_t, container_log_t, dir, "logs") filetrans_pattern($1, container_var_lib_t, container_log_t, file, "containerd.log") + filetrans_pattern($1, container_var_lib_t, rke2_service_db_file_t, dir, "db") filetrans_pattern($1, container_var_lib_t, rke2_tls_t, dir, "tls") ') @@ -57,4 +59,5 @@ admin_pattern($1_t, container_log_t) admin_pattern($1_t, rke2_tls_t) + admin_pattern($1_t, rke2_service_db_file_t) ') diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/centos8/rke2.te new/rke2-selinux-0.24.stable.1/policy/centos8/rke2.te --- old/rke2-selinux-0.23.stable.1/policy/centos8/rke2.te 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/centos8/rke2.te 2026-10-22 23:12:29.000000000 +0200 @@ -34,3 +34,12 @@ ################### type rke2_tls_t; files_type(rke2_tls_t); + +############################### +# type rke2_service_db_file_t # +############################### +# etcd data and snapshots under /var/lib/rancher/rke2/server/db +type rke2_service_db_file_t; +files_type(rke2_service_db_file_t); +# etcd mmaps its bbolt database (db/etcd/member/snap/db) +allow rke2_service_db_t rke2_service_db_file_t:file { map }; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/centos8/scripts/build new/rke2-selinux-0.24.stable.1/policy/centos8/scripts/build --- old/rke2-selinux-0.23.stable.1/policy/centos8/scripts/build 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/centos8/scripts/build 1970-01-01 01:00:00.000000000 +0100 @@ -1,27 +0,0 @@ -#!/bin/bash -set -e -x - -cd $(dirname $0)/.. -. ../../scripts/version - -make -f /usr/share/selinux/devel/Makefile rke2.pp - -mkdir -p /source/dist/centos8 -CHANGELOG_PATH=/source/dist/centos8/CHANGELOG.md -touch $CHANGELOG_PATH - -. ../../scripts/gen-changelog $CHANGELOG_PATH - -rpmbuild \ - --define "rke2_selinux_version ${RPM_VERSION}" \ - --define "rke2_selinux_release ${RPM_RELEASE}" \ - --define "_sourcedir $PWD" \ - --define "_specdir $PWD" \ - --define "_builddir $PWD" \ - --define "_srcrpmdir ${PWD}/dist/source" \ - --define "_buildrootdir $PWD/.build" \ - --define "_rpmdir ${PWD}/dist" \ - --define "changelog_path $CHANGELOG_PATH" \ - -ba rke2-selinux.spec - -cp -r dist/* /source/dist/centos8 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/centos8/scripts/checksum new/rke2-selinux-0.24.stable.1/policy/centos8/scripts/checksum --- old/rke2-selinux-0.23.stable.1/policy/centos8/scripts/checksum 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/centos8/scripts/checksum 1970-01-01 01:00:00.000000000 +0100 @@ -1,22 +0,0 @@ -#!/bin/bash -set -ex - - -cd $(dirname $0)/.. -ls -la -pwd - -CHECKSUM_DIR=${CHECKSUM_DIR:-./dist/centos7/noarch/} -CHECKSUM_FILE=${CHECKSUM_FILE:-CHECKSUMsum-centos7-noarch.txt} -DEST_DIR=${DEST_DIR:-${CHECKSUM_DIR}} - -sumfile="${DEST_DIR}/${CHECKSUM_FILE}" - -touch "${sumfile}" - -files=$(ls ${CHECKSUM_DIR} | grep -v "sha256sum") -for file in ${files}; do - sha256sum "${CHECKSUM_DIR}/${file}" | sed "s;$(dirname ${CHECKSUM_DIR}/${file})/;;g" >> "${sumfile}" -done - -cat "${sumfile}" \ No newline at end of file diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/centos8/scripts/entry new/rke2-selinux-0.24.stable.1/policy/centos8/scripts/entry --- old/rke2-selinux-0.23.stable.1/policy/centos8/scripts/entry 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/centos8/scripts/entry 1970-01-01 01:00:00.000000000 +0100 @@ -1,8 +0,0 @@ -#!/bin/sh -set -ex - -if [ -e ./policy/centos8/scripts/"$1" ]; then - ./policy/centos8/scripts/"$@" -else - exec "$@" -fi diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/centos9/rke2.fc new/rke2-selinux-0.24.stable.1/policy/centos9/rke2.fc --- old/rke2-selinux-0.23.stable.1/policy/centos9/rke2.fc 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/centos9/rke2.fc 2026-10-22 23:12:29.000000000 +0200 @@ -13,6 +13,7 @@ #/var/lib/cni(/.*)? gen_context(system_u:object_r:container_var_lib_t,s0) /opt/cni(/.*)? gen_context(system_u:object_r:container_file_t,s0) /etc/cni(/.*)? gen_context(system_u:object_r:container_file_t,s0) +#/opt/local-path-provisioner(/.*)? gen_context(system_u:object_r:container_file_t,s0) #/var/lib/kubelet/pods(/.*)? gen_context(system_u:object_r:container_file_t,s0) /var/lib/rancher/rke2(/.*)? gen_context(system_u:object_r:container_var_lib_t,s0) /var/lib/rancher/rke2/data(/.*)? gen_context(system_u:object_r:container_runtime_exec_t,s0) @@ -24,11 +25,12 @@ /var/lib/rancher/rke2/server/logs(/.*)? gen_context(system_u:object_r:container_log_t,s0) /var/lib/rancher/rke2/agent/containerd/containerd\.log gen_context(system_u:object_r:container_log_t,s0) /var/lib/rancher/rke2/agent/logs(/.*)? gen_context(system_u:object_r:container_log_t,s0) +/var/lib/rancher/rke2/server/db(/.*)? gen_context(system_u:object_r:rke2_service_db_file_t,s0) /var/lib/rancher/rke2/server/tls(/.*)? gen_context(system_u:object_r:rke2_tls_t,s0) #/var/run/flannel(/.*)? gen_context(system_u:object_r:container_var_run_t,s0) -/run/k3s(/.*)? gen_context(system_u:object_r:container_var_run_t,s0) -/run/k3s/containerd/[^/]*/sandboxes/[^/]*/shm(/.*)? gen_context(system_u:object_r:container_runtime_tmpfs_t,s0) +/run/k3s(/.*)? gen_context(system_u:object_r:container_var_run_t,s0) +/run/k3s/containerd/[^/]*/sandboxes/[^/]*/shm(/.*)? <<none>> /var/run/k3s(/.*)? gen_context(system_u:object_r:container_var_run_t,s0) -/var/run/k3s/containerd/[^/]*/sandboxes/[^/]*/shm(/.*)? gen_context(system_u:object_r:container_runtime_tmpfs_t,s0) +/var/run/k3s/containerd/[^/]*/sandboxes/[^/]*/shm(/.*)? <<none>> #/var/log/containers(/.*)? gen_context(system_u:object_r:container_log_t,s0) #/var/log/pods(/.*)? gen_context(system_u:object_r:container_log_t,s0) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/centos9/rke2.if new/rke2-selinux-0.24.stable.1/policy/centos9/rke2.if --- old/rke2-selinux-0.23.stable.1/policy/centos9/rke2.if 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/centos9/rke2.if 2026-10-22 23:12:29.000000000 +0200 @@ -14,6 +14,7 @@ type var_lib_t; type var_log_t; type rke2_tls_t; + type rke2_service_db_file_t; ') #container_filetrans_named_content($1) @@ -26,6 +27,7 @@ filetrans_pattern($1, var_log_t, container_log_t, dir, "containers") filetrans_pattern($1, container_var_lib_t, container_log_t, dir, "logs") filetrans_pattern($1, container_var_lib_t, container_log_t, file, "containerd.log") + filetrans_pattern($1, container_var_lib_t, rke2_service_db_file_t, dir, "db") filetrans_pattern($1, container_var_lib_t, rke2_tls_t, dir, "tls") ') @@ -57,4 +59,5 @@ admin_pattern($1_t, container_log_t) admin_pattern($1_t, rke2_tls_t) + admin_pattern($1_t, rke2_service_db_file_t) ') diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/centos9/rke2.te new/rke2-selinux-0.24.stable.1/policy/centos9/rke2.te --- old/rke2-selinux-0.23.stable.1/policy/centos9/rke2.te 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/centos9/rke2.te 2026-10-22 23:12:29.000000000 +0200 @@ -35,3 +35,12 @@ ################### type rke2_tls_t; container_file(rke2_tls_t); + +############################### +# type rke2_service_db_file_t # +############################### +# etcd data and snapshots under /var/lib/rancher/rke2/server/db +type rke2_service_db_file_t; +container_file(rke2_service_db_file_t); +# etcd mmaps its bbolt database (db/etcd/member/snap/db) +allow rke2_service_db_t rke2_service_db_file_t:file { map }; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/centos9/scripts/build new/rke2-selinux-0.24.stable.1/policy/centos9/scripts/build --- old/rke2-selinux-0.23.stable.1/policy/centos9/scripts/build 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/centos9/scripts/build 1970-01-01 01:00:00.000000000 +0100 @@ -1,28 +0,0 @@ -#!/bin/bash -set -e -x - -cd $(dirname $0)/.. -. ../../scripts/version - -make -f /usr/share/selinux/devel/Makefile rke2.pp - -mkdir -p /source/dist/centos9 - -CHANGELOG_PATH=/source/dist/centos9/CHANGELOG.md -touch $CHANGELOG_PATH - -. ../../scripts/gen-changelog $CHANGELOG_PATH - -rpmbuild \ - --define "rke2_selinux_version ${RPM_VERSION}" \ - --define "rke2_selinux_release ${RPM_RELEASE}" \ - --define "_sourcedir $PWD" \ - --define "_specdir $PWD" \ - --define "_builddir $PWD" \ - --define "_srcrpmdir ${PWD}/dist/source" \ - --define "_buildrootdir $PWD/.build" \ - --define "_rpmdir ${PWD}/dist" \ - --define "changelog_path $CHANGELOG_PATH" \ - -ba rke2-selinux.spec - -cp -r dist/* /source/dist/centos9 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/centos9/scripts/checksum new/rke2-selinux-0.24.stable.1/policy/centos9/scripts/checksum --- old/rke2-selinux-0.23.stable.1/policy/centos9/scripts/checksum 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/centos9/scripts/checksum 1970-01-01 01:00:00.000000000 +0100 @@ -1,22 +0,0 @@ -#!/bin/bash -set -ex - - -cd $(dirname $0)/.. -ls -la -pwd - -CHECKSUM_DIR=${CHECKSUM_DIR:-./dist/centos7/noarch/} -CHECKSUM_FILE=${CHECKSUM_FILE:-CHECKSUMsum-centos7-noarch.txt} -DEST_DIR=${DEST_DIR:-${CHECKSUM_DIR}} - -sumfile="${DEST_DIR}/${CHECKSUM_FILE}" - -touch "${sumfile}" - -files=$(ls ${CHECKSUM_DIR} | grep -v "sha256sum") -for file in ${files}; do - sha256sum "${CHECKSUM_DIR}/${file}" | sed "s;$(dirname ${CHECKSUM_DIR}/${file})/;;g" >> "${sumfile}" -done - -cat "${sumfile}" \ No newline at end of file diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/centos9/scripts/entry new/rke2-selinux-0.24.stable.1/policy/centos9/scripts/entry --- old/rke2-selinux-0.23.stable.1/policy/centos9/scripts/entry 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/centos9/scripts/entry 1970-01-01 01:00:00.000000000 +0100 @@ -1,8 +0,0 @@ -#!/bin/sh -set -ex - -if [ -e ./policy/centos9/scripts/"$1" ]; then - ./policy/centos9/scripts/"$@" -else - exec "$@" -fi diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/microos/rke2-selinux.spec new/rke2-selinux-0.24.stable.1/policy/microos/rke2-selinux.spec --- old/rke2-selinux-0.23.stable.1/policy/microos/rke2-selinux.spec 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/microos/rke2-selinux.spec 2026-10-22 23:12:29.000000000 +0200 @@ -34,7 +34,7 @@ Name: rke2-selinux Version: %{rke2_selinux_version} -Release: %{rke2_selinux_release}.sle +Release: %{rke2_selinux_release}.microos Summary: SELinux policy module for rke2 Vendor: SUSE LLC Packager: SUSE LLC <https://www.suse.com/> @@ -74,22 +74,22 @@ %pre %selinux_relabel_pre -%post -semodule -n -i %{_datadir}/selinux/packages/rke2.pp -if /usr/sbin/selinuxenabled ; then - if [ -z "${TRANSACTIONAL_UPDATE}" ]; then - /usr/sbin/load_policy - fi - %rke2_relabel_files -fi; - %postun if [ $1 -eq 0 ]; then %selinux_modules_uninstall rke2 fi; %posttrans +semodule -n -i %{_datadir}/selinux/packages/rke2.pp +if /usr/sbin/selinuxenabled ; then + if [ -z "${TRANSACTIONAL_UPDATE}" ]; then + /usr/sbin/load_policy + fi +fi; %selinux_relabel_post +if /usr/sbin/selinuxenabled ; then + %rke2_relabel_files +fi; %files %attr(0600,root,root) %{_datadir}/selinux/packages/rke2.pp diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/microos/rke2.fc new/rke2-selinux-0.24.stable.1/policy/microos/rke2.fc --- old/rke2-selinux-0.23.stable.1/policy/microos/rke2.fc 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/microos/rke2.fc 2026-10-22 23:12:29.000000000 +0200 @@ -12,7 +12,9 @@ /usr/local/bin/rke2 -- gen_context(system_u:object_r:container_runtime_exec_t,s0) #/var/lib/cni(/.*)? gen_context(system_u:object_r:container_var_lib_t,s0) /opt/cni(/.*)? gen_context(system_u:object_r:container_file_t,s0) +/usr/lib/cni(/.*)? gen_context(system_u:object_r:container_file_t,s0) /etc/cni(/.*)? gen_context(system_u:object_r:container_file_t,s0) +#/opt/local-path-provisioner(/.*)? gen_context(system_u:object_r:container_file_t,s0) #/var/lib/kubelet/pods(/.*)? gen_context(system_u:object_r:container_file_t,s0) /var/lib/rancher/rke2(/.*)? gen_context(system_u:object_r:container_var_lib_t,s0) /var/lib/rancher/rke2/data(/.*)? gen_context(system_u:object_r:container_runtime_exec_t,s0) @@ -24,6 +26,7 @@ /var/lib/rancher/rke2/server/logs(/.*)? gen_context(system_u:object_r:container_log_t,s0) /var/lib/rancher/rke2/agent/containerd/containerd\.log gen_context(system_u:object_r:container_log_t,s0) /var/lib/rancher/rke2/agent/logs(/.*)? gen_context(system_u:object_r:container_log_t,s0) +/var/lib/rancher/rke2/server/db(/.*)? gen_context(system_u:object_r:rke2_service_db_file_t,s0) /var/lib/rancher/rke2/server/tls(/.*)? gen_context(system_u:object_r:rke2_tls_t,s0) #/var/run/flannel(/.*)? gen_context(system_u:object_r:container_var_run_t,s0) #/var/run/k3s(/.*)? gen_context(system_u:object_r:container_var_run_t,s0) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/microos/rke2.if new/rke2-selinux-0.24.stable.1/policy/microos/rke2.if --- old/rke2-selinux-0.23.stable.1/policy/microos/rke2.if 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/microos/rke2.if 2026-10-22 23:12:29.000000000 +0200 @@ -13,7 +13,9 @@ type container_kvm_var_run_t; type var_lib_t; type var_log_t; + type usr_t; type rke2_tls_t; + type rke2_service_db_file_t; ') #container_filetrans_named_content($1) @@ -26,7 +28,9 @@ filetrans_pattern($1, var_log_t, container_log_t, dir, "containers") filetrans_pattern($1, container_var_lib_t, container_log_t, dir, "logs") filetrans_pattern($1, container_var_lib_t, container_log_t, file, "containerd.log") + filetrans_pattern($1, container_var_lib_t, rke2_service_db_file_t, dir, "db") filetrans_pattern($1, container_var_lib_t, rke2_tls_t, dir, "tls") + filetrans_pattern($1, usr_t, container_file_t, dir, "cni") ') template(`rke2_service_domain_template',` @@ -57,4 +61,5 @@ admin_pattern($1_t, container_log_t) admin_pattern($1_t, rke2_tls_t) + admin_pattern($1_t, rke2_service_db_file_t) ') diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/microos/rke2.te new/rke2-selinux-0.24.stable.1/policy/microos/rke2.te --- old/rke2-selinux-0.23.stable.1/policy/microos/rke2.te 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/microos/rke2.te 2026-10-22 23:12:29.000000000 +0200 @@ -34,3 +34,12 @@ ################### type rke2_tls_t; container_file(rke2_tls_t); + +############################### +# type rke2_service_db_file_t # +############################### +# etcd data and snapshots under /var/lib/rancher/rke2/server/db +type rke2_service_db_file_t; +container_file(rke2_service_db_file_t); +# etcd mmaps its bbolt database (db/etcd/member/snap/db) +allow rke2_service_db_t rke2_service_db_file_t:file { map }; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/microos/scripts/build new/rke2-selinux-0.24.stable.1/policy/microos/scripts/build --- old/rke2-selinux-0.23.stable.1/policy/microos/scripts/build 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/microos/scripts/build 1970-01-01 01:00:00.000000000 +0100 @@ -1,27 +0,0 @@ -#!/bin/bash -set -e -x - -cd $(dirname $0)/.. -. ../../scripts/version - -make -f /usr/share/selinux/devel/Makefile rke2.pp - -mkdir -p /source/dist/microos -CHANGELOG_PATH=/source/dist/microos/CHANGELOG.md -touch $CHANGELOG_PATH - -. ../../scripts/gen-changelog $CHANGELOG_PATH - -rpmbuild \ - --define "rke2_selinux_version ${RPM_VERSION}" \ - --define "rke2_selinux_release ${RPM_RELEASE}" \ - --define "_sourcedir $PWD" \ - --define "_specdir $PWD" \ - --define "_builddir $PWD" \ - --define "_srcrpmdir ${PWD}/dist/source" \ - --define "_buildrootdir $PWD/.build" \ - --define "_rpmdir ${PWD}/dist" \ - --define "changelog_path $CHANGELOG_PATH" \ - -ba rke2-selinux.spec - -cp -r dist/* /source/dist/microos diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/microos/scripts/checksum new/rke2-selinux-0.24.stable.1/policy/microos/scripts/checksum --- old/rke2-selinux-0.23.stable.1/policy/microos/scripts/checksum 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/microos/scripts/checksum 1970-01-01 01:00:00.000000000 +0100 @@ -1,22 +0,0 @@ -#!/bin/bash -set -ex - - -cd $(dirname $0)/.. -ls -la -pwd - -CHECKSUM_DIR=${CHECKSUM_DIR:-./dist/centos7/noarch/} -CHECKSUM_FILE=${CHECKSUM_FILE:-CHECKSUMsum-centos7-noarch.txt} -DEST_DIR=${DEST_DIR:-${CHECKSUM_DIR}} - -sumfile="${DEST_DIR}/${CHECKSUM_FILE}" - -touch "${sumfile}" - -files=$(ls ${CHECKSUM_DIR} | grep -v "sha256sum") -for file in ${files}; do - sha256sum "${CHECKSUM_DIR}/${file}" | sed "s;$(dirname ${CHECKSUM_DIR}/${file})/;;g" >> "${sumfile}" -done - -cat "${sumfile}" \ No newline at end of file diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/microos/scripts/entry new/rke2-selinux-0.24.stable.1/policy/microos/scripts/entry --- old/rke2-selinux-0.23.stable.1/policy/microos/scripts/entry 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/microos/scripts/entry 1970-01-01 01:00:00.000000000 +0100 @@ -1,8 +0,0 @@ -#!/bin/sh -set -ex - -if [ -e ./policy/microos/scripts/"$1" ]; then - ./policy/microos/scripts/"$@" -else - exec "$@" -fi diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/sle/rke2-selinux.spec new/rke2-selinux-0.24.stable.1/policy/sle/rke2-selinux.spec --- old/rke2-selinux-0.23.stable.1/policy/sle/rke2-selinux.spec 1970-01-01 01:00:00.000000000 +0100 +++ new/rke2-selinux-0.24.stable.1/policy/sle/rke2-selinux.spec 2026-10-22 23:12:29.000000000 +0200 @@ -0,0 +1,99 @@ +# vim: sw=4:ts=4:et + +%define rke2_relabel_files() \ +umask 0022; \ +mkdir -p /var/lib/cni; \ +mkdir -p /var/lib/kubelet; \ +mkdir -p /var/lib/rancher/rke2/data; \ +mkdir -p /var/run/flannel; \ +umask 0027; \ +mkdir -p /var/lib/kubelet/pods; \ +mkdir -p /var/lib/rancher/rke2/agent/logs; \ +umask 0066; \ +mkdir -p /var/run/k3s; \ +umask 0077; \ +mkdir -p /var/lib/rancher/rke2/agent/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots; \ +mkdir -p /var/lib/rancher/rke2/server/db/snapshots; \ +restorecon -RT 0 /var/lib/cni; \ +restorecon -RT 0 /var/lib/kubelet; \ +restorecon -RT 0 /var/lib/rancher/rke2; \ +restorecon -RT 0 /var/run/k3s; \ +restorecon -RT 0 /var/run/flannel; \ +if [ -z "${TRANSACTIONAL_UPDATE}" ]; then \ +umask 0022; \ +mkdir -p /etc/cni; \ +mkdir -p /opt/cni; \ +restorecon -RT 0 -i /etc/systemd/system/rke2*; \ +restorecon -RT 0 -i /usr/lib/systemd/system/rke2*; \ +restorecon -RT 0 /opt/cni; \ +restorecon -RT 0 /etc/cni; \ +fi + +%define selinux_policyver 20230523 +%define container_policyver 2.211.0 + +Name: rke2-selinux +Version: %{rke2_selinux_version} +Release: %{rke2_selinux_release}.sle +Summary: SELinux policy module for rke2 +Vendor: SUSE LLC +Packager: SUSE LLC <https://www.suse.com/> + +Group: System Environment/Base +License: Apache-2.0 +URL: https://rke2.io +Source0: rke2.pp +Source1: rke2.if + +BuildArch: noarch +BuildRequires: container-selinux >= %{container_policyver} +BuildRequires: git +BuildRequires: selinux-policy >= %{selinux_policyver} +BuildRequires: selinux-policy-devel >= %{selinux_policyver} + +Requires: policycoreutils, selinux-tools +Requires(post): selinux-policy-base >= %{selinux_policyver} +Requires(post): policycoreutils +Requires(post): container-selinux >= %{container_policyver} +Requires(postun): policycoreutils + +Provides: %{name} = %{version}-%{release} +Obsoletes: rke2-selinux < 0.9 +Conflicts: k3s-selinux + +%description +This package installs and sets up the SELinux policy security module for rke2. + +%install +install -d %{buildroot}%{_datadir}/selinux/packages +install -m 644 %{SOURCE0} %{buildroot}%{_datadir}/selinux/packages +install -d %{buildroot}%{_datadir}/selinux/devel/include/contrib +install -m 644 %{SOURCE1} %{buildroot}%{_datadir}/selinux/devel/include/contrib/ +install -d %{buildroot}/etc/selinux/targeted/contexts/users/ + +%pre +%selinux_relabel_pre + +%postun +if [ $1 -eq 0 ]; then + %selinux_modules_uninstall rke2 +fi; + +%posttrans +semodule -n -i %{_datadir}/selinux/packages/rke2.pp +if /usr/sbin/selinuxenabled ; then + if [ -z "${TRANSACTIONAL_UPDATE}" ]; then + /usr/sbin/load_policy + fi +fi; +%selinux_relabel_post +if /usr/sbin/selinuxenabled ; then + %rke2_relabel_files +fi; + +%files +%attr(0600,root,root) %{_datadir}/selinux/packages/rke2.pp +%{_datadir}/selinux/devel/include/contrib/rke2.if + +%changelog +%include %{changelog_path} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/sle/rke2.fc new/rke2-selinux-0.24.stable.1/policy/sle/rke2.fc --- old/rke2-selinux-0.23.stable.1/policy/sle/rke2.fc 1970-01-01 01:00:00.000000000 +0100 +++ new/rke2-selinux-0.24.stable.1/policy/sle/rke2.fc 2026-10-22 23:12:29.000000000 +0200 @@ -0,0 +1,36 @@ +# vim: sw=8:ts=8:et + +# commented items are lines retained for parity when comparing policy between target distributions. +# these are commented because they will cause conflict and/or crash when attempting to install with upstream +# container-selinux: https://github.com/containers/container-selinux/pull/140/files + +/etc/systemd/system/rke2.* -- gen_context(system_u:object_r:container_unit_file_t,s0) +/lib/systemd/system/rke2.* -- gen_context(system_u:object_r:container_unit_file_t,s0) +/usr/local/lib/systemd/system/rke2.* -- gen_context(system_u:object_r:container_unit_file_t,s0) +/usr/lib/systemd/system/rke2.* -- gen_context(system_u:object_r:container_unit_file_t,s0) +/usr/bin/rke2 -- gen_context(system_u:object_r:container_runtime_exec_t,s0) +/usr/local/bin/rke2 -- gen_context(system_u:object_r:container_runtime_exec_t,s0) +/opt/rke2/bin/rke2 -- gen_context(system_u:object_r:container_runtime_exec_t,s0) +#/var/lib/cni(/.*)? gen_context(system_u:object_r:container_var_lib_t,s0) +/opt/cni(/.*)? gen_context(system_u:object_r:container_file_t,s0) +/usr/lib/cni(/.*)? gen_context(system_u:object_r:container_file_t,s0) +/etc/cni(/.*)? gen_context(system_u:object_r:container_file_t,s0) +#/opt/local-path-provisioner(/.*)? gen_context(system_u:object_r:container_file_t,s0) +#/var/lib/kubelet/pods(/.*)? gen_context(system_u:object_r:container_file_t,s0) +/var/lib/rancher/rke2(/.*)? gen_context(system_u:object_r:container_var_lib_t,s0) +/var/lib/rancher/rke2/data(/.*)? gen_context(system_u:object_r:container_runtime_exec_t,s0) +/var/lib/rancher/rke2/data/[^/]*/charts(/.*)? gen_context(system_u:object_r:container_config_t,s0) +/var/lib/rancher/rke2/agent/containerd/[^/]*/snapshots -d gen_context(system_u:object_r:container_share_t,s0) +/var/lib/rancher/rke2/agent/containerd/[^/]*/snapshots/[^/]* -d gen_context(system_u:object_r:container_share_t,s0) +/var/lib/rancher/rke2/agent/containerd/[^/]*/snapshots/[^/]*/.* <<none>> +/var/lib/rancher/rke2/agent/containerd/[^/]*/sandboxes(/.*)? gen_context(system_u:object_r:container_share_t,s0) +/var/lib/rancher/rke2/server/logs(/.*)? gen_context(system_u:object_r:container_log_t,s0) +/var/lib/rancher/rke2/agent/containerd/containerd\.log gen_context(system_u:object_r:container_log_t,s0) +/var/lib/rancher/rke2/agent/logs(/.*)? gen_context(system_u:object_r:container_log_t,s0) +/var/lib/rancher/rke2/server/db(/.*)? gen_context(system_u:object_r:rke2_service_db_file_t,s0) +/var/lib/rancher/rke2/server/tls(/.*)? gen_context(system_u:object_r:rke2_tls_t,s0) +#/var/run/flannel(/.*)? gen_context(system_u:object_r:container_var_run_t,s0) +#/var/run/k3s(/.*)? gen_context(system_u:object_r:container_var_run_t,s0) +#/var/run/k3s/containerd/[^/]*/sandboxes/[^/]*/shm(/.*)? gen_context(system_u:object_r:container_runtime_tmpfs_t,s0) +#/var/log/containers(/.*)? gen_context(system_u:object_r:container_log_t,s0) +#/var/log/pods(/.*)? gen_context(system_u:object_r:container_log_t,s0) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/sle/rke2.if new/rke2-selinux-0.24.stable.1/policy/sle/rke2.if --- old/rke2-selinux-0.23.stable.1/policy/sle/rke2.if 1970-01-01 01:00:00.000000000 +0100 +++ new/rke2-selinux-0.24.stable.1/policy/sle/rke2.if 2026-10-22 23:12:29.000000000 +0200 @@ -0,0 +1,65 @@ +# adapted from https://github.com/containers/container-selinux/blob/v2.143.0/container.if#L484 +interface(`rke2_filetrans_named_content',` + + gen_require(` + type container_config_t; + type container_file_t; + type container_log_t; + type container_runtime_exec_t; + type container_runtime_tmpfs_t; + type container_share_t; + type container_var_lib_t; + type container_var_run_t; + type container_kvm_var_run_t; + type var_lib_t; + type var_log_t; + type usr_t; + type rke2_tls_t; + type rke2_service_db_file_t; + ') + + #container_filetrans_named_content($1) + files_pid_filetrans($1, container_var_run_t, dir, "rke2") + filetrans_pattern($1, container_var_lib_t, container_runtime_exec_t, dir, "data") + filetrans_pattern($1, container_runtime_exec_t, container_config_t, dir, "charts") + filetrans_pattern($1, container_var_lib_t, container_file_t, dir, "pods") + filetrans_pattern($1, var_lib_t, container_var_lib_t, dir, "kubelet") + filetrans_pattern($1, var_log_t, container_log_t, dir, "pods") + filetrans_pattern($1, var_log_t, container_log_t, dir, "containers") + filetrans_pattern($1, container_var_lib_t, container_log_t, dir, "logs") + filetrans_pattern($1, container_var_lib_t, container_log_t, file, "containerd.log") + filetrans_pattern($1, container_var_lib_t, rke2_service_db_file_t, dir, "db") + filetrans_pattern($1, container_var_lib_t, rke2_tls_t, dir, "tls") + filetrans_pattern($1, usr_t, container_file_t, dir, "cni") +') + +template(`rke2_service_domain_template',` + container_domain_template($1, container) + virt_sandbox_domain($1_t) + + gen_require(` + attribute container_domain, container_net_domain; + attribute sandbox_net_domain; + ') + typeattribute $1_t container_domain, container_net_domain, sandbox_net_domain; + + virt_default_capabilities($1_t) + kernel_read_messages($1_t) + logging_send_syslog_msg($1_t) + + corenet_unconfined($1_t) + corenet_tcp_bind_generic_node($1_t) + corenet_udp_bind_generic_node($1_t) + corenet_raw_bind_generic_node($1_t) + corenet_tcp_sendrecv_all_ports($1_t) + corenet_udp_sendrecv_all_ports($1_t) + corenet_udp_bind_all_ports($1_t) + corenet_tcp_bind_all_ports($1_t) + corenet_tcp_connect_all_ports($1_t) + + miscfiles_read_all_certs($1_t) + + admin_pattern($1_t, container_log_t) + admin_pattern($1_t, rke2_tls_t) + admin_pattern($1_t, rke2_service_db_file_t) +') diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/sle/rke2.te new/rke2-selinux-0.24.stable.1/policy/sle/rke2.te --- old/rke2-selinux-0.23.stable.1/policy/sle/rke2.te 1970-01-01 01:00:00.000000000 +0100 +++ new/rke2-selinux-0.24.stable.1/policy/sle/rke2.te 2026-10-22 23:12:29.000000000 +0200 @@ -0,0 +1,45 @@ +policy_module(rke2, 1.0.0) + +gen_require(` + type container_runtime_t, unconfined_service_t, iscsid_t; + class capability dac_override; +') +rke2_filetrans_named_content(container_runtime_t) +rke2_filetrans_named_content(unconfined_service_t) + +####################### +# type rke2_service_t # +####################### +rke2_service_domain_template(rke2_service) +container_read_lib_files(rke2_service_t) +allow rke2_service_t container_var_lib_t:sock_file { write }; +allow rke2_service_t container_runtime_t:unix_stream_socket { connectto }; + +########################## +# type rke2_service_db_t # +########################## +rke2_service_domain_template(rke2_service_db) +container_manage_lib_dirs(rke2_service_db_t) +container_manage_lib_files(rke2_service_db_t) +allow rke2_service_db_t container_var_lib_t:file { map }; + +######################### +# Longhorn ISCSID_T FIX # +######################### +# https://github.com/longhorn/longhorn/issues/5627#issuecomment-1577498183 +allow iscsid_t self:capability dac_override; + +################### +# type rke2_tls_t # +################### +type rke2_tls_t; +container_file(rke2_tls_t); + +############################### +# type rke2_service_db_file_t # +############################### +# etcd data and snapshots under /var/lib/rancher/rke2/server/db +type rke2_service_db_file_t; +container_file(rke2_service_db_file_t); +# etcd mmaps its bbolt database (db/etcd/member/snap/db) +allow rke2_service_db_t rke2_service_db_file_t:file { map }; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/slemicro/rke2-selinux.spec new/rke2-selinux-0.24.stable.1/policy/slemicro/rke2-selinux.spec --- old/rke2-selinux-0.23.stable.1/policy/slemicro/rke2-selinux.spec 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/slemicro/rke2-selinux.spec 2026-10-22 23:12:29.000000000 +0200 @@ -75,22 +75,22 @@ %pre %selinux_relabel_pre -%post -semodule -n -i %{_datadir}/selinux/packages/rke2.pp -if /usr/sbin/selinuxenabled ; then - if [ -z "${TRANSACTIONAL_UPDATE}" ]; then - /usr/sbin/load_policy - fi - %rke2_relabel_files -fi; - %postun if [ $1 -eq 0 ]; then %selinux_modules_uninstall rke2 fi; %posttrans +semodule -n -i %{_datadir}/selinux/packages/rke2.pp +if /usr/sbin/selinuxenabled ; then + if [ -z "${TRANSACTIONAL_UPDATE}" ]; then + /usr/sbin/load_policy + fi +fi; %selinux_relabel_post +if /usr/sbin/selinuxenabled ; then + %rke2_relabel_files +fi; %files %attr(0600,root,root) %{_datadir}/selinux/packages/rke2.pp diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/slemicro/rke2.fc new/rke2-selinux-0.24.stable.1/policy/slemicro/rke2.fc --- old/rke2-selinux-0.23.stable.1/policy/slemicro/rke2.fc 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/slemicro/rke2.fc 2026-10-22 23:12:29.000000000 +0200 @@ -13,7 +13,9 @@ /opt/rke2/bin/rke2 -- gen_context(system_u:object_r:container_runtime_exec_t,s0) #/var/lib/cni(/.*)? gen_context(system_u:object_r:container_var_lib_t,s0) /opt/cni(/.*)? gen_context(system_u:object_r:container_file_t,s0) +/usr/lib/cni(/.*)? gen_context(system_u:object_r:container_file_t,s0) /etc/cni(/.*)? gen_context(system_u:object_r:container_file_t,s0) +#/opt/local-path-provisioner(/.*)? gen_context(system_u:object_r:container_file_t,s0) #/var/lib/kubelet/pods(/.*)? gen_context(system_u:object_r:container_file_t,s0) /var/lib/rancher/rke2(/.*)? gen_context(system_u:object_r:container_var_lib_t,s0) /var/lib/rancher/rke2/data(/.*)? gen_context(system_u:object_r:container_runtime_exec_t,s0) @@ -25,6 +27,7 @@ /var/lib/rancher/rke2/server/logs(/.*)? gen_context(system_u:object_r:container_log_t,s0) /var/lib/rancher/rke2/agent/containerd/containerd\.log gen_context(system_u:object_r:container_log_t,s0) /var/lib/rancher/rke2/agent/logs(/.*)? gen_context(system_u:object_r:container_log_t,s0) +/var/lib/rancher/rke2/server/db(/.*)? gen_context(system_u:object_r:rke2_service_db_file_t,s0) /var/lib/rancher/rke2/server/tls(/.*)? gen_context(system_u:object_r:rke2_tls_t,s0) #/var/run/flannel(/.*)? gen_context(system_u:object_r:container_var_run_t,s0) #/var/run/k3s(/.*)? gen_context(system_u:object_r:container_var_run_t,s0) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/slemicro/rke2.if new/rke2-selinux-0.24.stable.1/policy/slemicro/rke2.if --- old/rke2-selinux-0.23.stable.1/policy/slemicro/rke2.if 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/slemicro/rke2.if 2026-10-22 23:12:29.000000000 +0200 @@ -13,7 +13,9 @@ type container_kvm_var_run_t; type var_lib_t; type var_log_t; + type usr_t; type rke2_tls_t; + type rke2_service_db_file_t; ') #container_filetrans_named_content($1) @@ -26,7 +28,9 @@ filetrans_pattern($1, var_log_t, container_log_t, dir, "containers") filetrans_pattern($1, container_var_lib_t, container_log_t, dir, "logs") filetrans_pattern($1, container_var_lib_t, container_log_t, file, "containerd.log") + filetrans_pattern($1, container_var_lib_t, rke2_service_db_file_t, dir, "db") filetrans_pattern($1, container_var_lib_t, rke2_tls_t, dir, "tls") + filetrans_pattern($1, usr_t, container_file_t, dir, "cni") ') template(`rke2_service_domain_template',` @@ -57,4 +61,5 @@ admin_pattern($1_t, container_log_t) admin_pattern($1_t, rke2_tls_t) + admin_pattern($1_t, rke2_service_db_file_t) ') diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/slemicro/rke2.te new/rke2-selinux-0.24.stable.1/policy/slemicro/rke2.te --- old/rke2-selinux-0.23.stable.1/policy/slemicro/rke2.te 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/slemicro/rke2.te 2026-10-22 23:12:29.000000000 +0200 @@ -35,3 +35,12 @@ ################### type rke2_tls_t; files_type(rke2_tls_t); + +############################### +# type rke2_service_db_file_t # +############################### +# etcd data and snapshots under /var/lib/rancher/rke2/server/db +type rke2_service_db_file_t; +files_type(rke2_service_db_file_t); +# etcd mmaps its bbolt database (db/etcd/member/snap/db) +allow rke2_service_db_t rke2_service_db_file_t:file { map }; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/slemicro/scripts/build new/rke2-selinux-0.24.stable.1/policy/slemicro/scripts/build --- old/rke2-selinux-0.23.stable.1/policy/slemicro/scripts/build 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/slemicro/scripts/build 1970-01-01 01:00:00.000000000 +0100 @@ -1,28 +0,0 @@ -#!/bin/bash -set -e -x - -cd $(dirname $0)/.. -. ../../scripts/version - -make -f /usr/share/selinux/devel/Makefile rke2.pp - -mkdir -p /source/dist/slemicro -CHANGELOG_PATH=/source/dist/slemicro/CHANGELOG.md -touch $CHANGELOG_PATH - -. ../../scripts/gen-changelog $CHANGELOG_PATH - -rpmbuild \ - --define "rke2_selinux_version ${RPM_VERSION}" \ - --define "rke2_selinux_release ${RPM_RELEASE}" \ - --define "_sourcedir $PWD" \ - --define "_specdir $PWD" \ - --define "_builddir $PWD" \ - --define "_srcrpmdir ${PWD}/dist/source" \ - --define "_buildrootdir $PWD/.build" \ - --define "_rpmdir ${PWD}/dist" \ - --define "changelog_path $CHANGELOG_PATH" \ - -ba rke2-selinux.spec - -mkdir -p /source/dist/slemicro -cp -r dist/* /source/dist/slemicro diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/slemicro/scripts/checksum new/rke2-selinux-0.24.stable.1/policy/slemicro/scripts/checksum --- old/rke2-selinux-0.23.stable.1/policy/slemicro/scripts/checksum 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/slemicro/scripts/checksum 1970-01-01 01:00:00.000000000 +0100 @@ -1,22 +0,0 @@ -#!/bin/bash -set -ex - - -cd $(dirname $0)/.. -ls -la -pwd - -CHECKSUM_DIR=${CHECKSUM_DIR:-./dist/centos7/noarch/} -CHECKSUM_FILE=${CHECKSUM_FILE:-CHECKSUMsum-centos7-noarch.txt} -DEST_DIR=${DEST_DIR:-${CHECKSUM_DIR}} - -sumfile="${DEST_DIR}/${CHECKSUM_FILE}" - -touch "${sumfile}" - -files=$(ls ${CHECKSUM_DIR} | grep -v "sha256sum") -for file in ${files}; do - sha256sum "${CHECKSUM_DIR}/${file}" | sed "s;$(dirname ${CHECKSUM_DIR}/${file})/;;g" >> "${sumfile}" -done - -cat "${sumfile}" \ No newline at end of file diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/policy/slemicro/scripts/entry new/rke2-selinux-0.24.stable.1/policy/slemicro/scripts/entry --- old/rke2-selinux-0.23.stable.1/policy/slemicro/scripts/entry 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/policy/slemicro/scripts/entry 1970-01-01 01:00:00.000000000 +0100 @@ -1,8 +0,0 @@ -#!/bin/sh -set -ex - -if [ -e ./policy/slemicro/scripts/"$1" ]; then - ./policy/slemicro/scripts/"$@" -else - exec "$@" -fi diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/scripts/build new/rke2-selinux-0.24.stable.1/scripts/build --- old/rke2-selinux-0.23.stable.1/scripts/build 1970-01-01 01:00:00.000000000 +0100 +++ new/rke2-selinux-0.24.stable.1/scripts/build 2026-10-22 23:12:29.000000000 +0200 @@ -0,0 +1,39 @@ +#!/bin/bash +set -e -x + +POLICY=${POLICY:?POLICY must be set to one of the directories under policy/} +BUILD_DIR=${BUILD_DIR:?BUILD_DIR must be set to the directory to build in} + +cd $(dirname $0)/.. +. ./scripts/version + +POLICY_DIR=${PWD}/policy/${POLICY} +DIST_DIR=${SOURCE}/dist/${POLICY} + +# build out of tree so the policy directory only ever holds policy sources +mkdir -p ${BUILD_DIR} +cp ${POLICY_DIR}/rke2.te ${POLICY_DIR}/rke2.if ${POLICY_DIR}/rke2.fc ${POLICY_DIR}/rke2-selinux.spec ${BUILD_DIR} +pushd ${BUILD_DIR} +# MODULE_POLICY_VERSION pins the module format for targets with an older libsepol +make -f /usr/share/selinux/devel/Makefile \ + ${MODULE_POLICY_VERSION:+"CHECKMODULE=/usr/bin/checkmodule -M -c ${MODULE_POLICY_VERSION}"} \ + rke2.pp +popd + +mkdir -p ${DIST_DIR} +CHANGELOG_PATH=${DIST_DIR}/CHANGELOG.md +touch $CHANGELOG_PATH + +. ./scripts/gen-changelog $CHANGELOG_PATH + +rpmbuild \ + --define "rke2_selinux_version ${RPM_VERSION}" \ + --define "rke2_selinux_release ${RPM_RELEASE}" \ + --define "_sourcedir ${BUILD_DIR}" \ + --define "_specdir ${BUILD_DIR}" \ + --define "_builddir ${BUILD_DIR}" \ + --define "_srcrpmdir ${DIST_DIR}/source" \ + --define "_buildrootdir ${BUILD_DIR}/.build" \ + --define "_rpmdir ${DIST_DIR}" \ + --define "changelog_path $CHANGELOG_PATH" \ + -ba ${BUILD_DIR}/rke2-selinux.spec diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/scripts/entry new/rke2-selinux-0.24.stable.1/scripts/entry --- old/rke2-selinux-0.23.stable.1/scripts/entry 1970-01-01 01:00:00.000000000 +0100 +++ new/rke2-selinux-0.24.stable.1/scripts/entry 2026-10-22 23:12:29.000000000 +0200 @@ -0,0 +1,8 @@ +#!/bin/sh +set -ex + +if [ -e ./scripts/"$1" ]; then + ./scripts/"$@" +else + exec "$@" +fi diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/test/sle/README.md new/rke2-selinux-0.24.stable.1/test/sle/README.md --- old/rke2-selinux-0.23.stable.1/test/sle/README.md 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/test/sle/README.md 1970-01-01 01:00:00.000000000 +0100 @@ -1,13 +0,0 @@ -rke2-selinux for sle ---- - -The Vagrant box in use supports these providers: -- `libvirt` -- `virtualbox` -- `vmware_desktop` - -To spin up a VM to test locally built rke2-selinux RPM: -```shell -cp -vf ../../dist/microos/noarch/*.rpm . -INSTALL_PACKAGES=/vagrant/rke2-selinux-*.noarch.rpm vagrant up -``` diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rke2-selinux-0.23.stable.1/test/sle/Vagrantfile new/rke2-selinux-0.24.stable.1/test/sle/Vagrantfile --- old/rke2-selinux-0.23.stable.1/test/sle/Vagrantfile 2026-06-01 15:43:58.000000000 +0200 +++ new/rke2-selinux-0.24.stable.1/test/sle/Vagrantfile 1970-01-01 01:00:00.000000000 +0100 @@ -1,138 +0,0 @@ -# -*- mode: ruby -*- -# vi: set ft=ruby : - -Vagrant.configure("2") do |config| - config.vm.box = "dweomer/microos.amd64" - config.vm.synced_folder '.', '/vagrant', type: 'rsync', disabled: false - %w[libvirt virtualbox vmware_desktop].each do |p| - config.vm.provider p do |v, o| - v.memory = "2048" - v.cpus = 2 - end - end - - config.vm.define "rke2-selinux-sle", primary: true do |test| - test.vm.hostname = "test-sle" - test.vm.provision "install-rke2", type: "shell", run: "once" do |sh| - sh.env = ENV.select{|k,v| k.start_with?('RKE2_') || k.start_with?('INSTALL_RKE2_')}.merge({ - :INSTALL_RKE2_TYPE => 'server', - :RKE2_KUBECONFIG_MODE => '0664', - :RKE2_TOKEN => 'vagrant', - }) - sh.inline = <<~SHELL - #!/usr/bin/env bash - set -eux -o pipefail - curl -fsSL https://get.rke2.io | sh - - echo >> /etc/sysconfig/rke2-${INSTALL_RKE2_TYPE} - bash +x -ec 'sh -c export | while read x v; do echo $v; done | grep -E "^(RKE2|CONTAINERD)_"' >> /etc/sysconfig/rke2-${INSTALL_RKE2_TYPE} - systemctl enable --now rke2-${INSTALL_RKE2_TYPE} - SHELL - sh.upload_path = "/tmp/vagrant-install-rke2" - end - test.vm.provision "rke2-wait-for-node", type: "shell", run: "once" do |sh| - sh.inline = <<~SHELL - #!/usr/bin/env bash - source /etc/profile.d/rke2.sh - set -eu -o pipefail - echo 'Waiting for node (and static pods) to be ready ...' - time { - timeout 180 bash -c 'while ! (kubectl wait --for condition=ready node/$(hostname) 2>/dev/null); do sleep 5; done' - timeout 120 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/etcd-$(hostname) 2>/dev/null); do sleep 5; done' - timeout 120 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/kube-apiserver-$(hostname) 2>/dev/null); do sleep 5; done' - timeout 120 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/kube-scheduler-$(hostname) 2>/dev/null); do sleep 5; done' - timeout 120 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/kube-proxy-$(hostname) 2>/dev/null); do sleep 5; done' - timeout 120 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/kube-controller-manager-$(hostname) 2>/dev/null); do sleep 5; done' - timeout 120 bash -c 'while ! (kubectl wait --for condition=ready -n kube-system pod/cloud-controller-manager-$(hostname) 2>/dev/null); do sleep 5; done' - } - kubectl get node,all -A -o wide - SHELL - end - test.vm.provision "rke2-wait-for-canal", type: "shell", run: "once" do |sh| - sh.inline = <<~SHELL - #!/usr/bin/env bash - source /etc/profile.d/rke2.sh - set -eu -o pipefail - time { - timeout 120 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s daemonset/rke2-canal 2>/dev/null); do sleep 5; done' - } - SHELL - end - test.vm.provision "rke2-wait-for-coredns", type: "shell", run: "once" do |sh| - sh.inline = <<~SHELL - #!/usr/bin/env bash - source /etc/profile.d/rke2.sh - set -eu -o pipefail - time { - timeout 120 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/rke2-coredns-rke2-coredns 2>/dev/null); do sleep 5; done' - timeout 120 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/rke2-coredns-rke2-coredns-autoscaler 2>/dev/null); do sleep 5; done' - } - SHELL - end - test.vm.provision "rke2-wait-for-ingress-nginx", type: "shell", run: "once" do |sh| - sh.inline = <<~SHELL - #!/usr/bin/env bash - source /etc/profile.d/rke2.sh - set -eu -o pipefail - time { - timeout 120 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s daemonset/rke2-ingress-nginx-controller 2>/dev/null); do sleep 5; done' - } - SHELL - end - test.vm.provision "rke2-wait-for-metrics-server", type: "shell", run: "once" do |sh| - sh.inline = <<~SHELL - #!/usr/bin/env bash - source /etc/profile.d/rke2.sh - set -eu -o pipefail - time { - timeout 120 bash -c 'while ! (kubectl --namespace kube-system rollout status --timeout 10s deploy/rke2-metrics-server 2>/dev/null); do sleep 5; done' - } - SHELL - end - test.vm.provision "rke2-status", type: "shell", run: "once" do |sh| - sh.inline = <<~SHELL - #!/usr/bin/env bash - source /etc/profile.d/rke2.sh - set -eux -o pipefail - kubectl get node,all -A -o wide - SHELL - end - test.vm.provision "rke2-status-selinux", type: "shell", run: "once" do |sh| - sh.inline = <<~SHELL - #!/usr/bin/env bash - source /etc/profile.d/rke2.sh - set -eux -o pipefail - ps auxZ | grep -E 'etcd|kube|rke2|container|spc_t|unconfined_t' | grep -v grep - SHELL - end - end - - config.vm.provision "install-packages", type: "shell", run: "once" do |sh| - sh.upload_path = "/tmp/vagrant-install-packages" - sh.env = { - 'INSTALL_PACKAGES': ENV['INSTALL_PACKAGES'], - } - sh.inline = <<~SHELL - #!/usr/bin/env bash - source /etc/profile.d/rke2.sh - set -eux -o pipefail - transactional-update --no-selfupdate -d pkg install -y --allow-unsigned-rpm \ - curl \ - iptables \ - less \ - lsof \ - socat \ - ${INSTALL_PACKAGES} - SHELL - end - config.vm.provision "install-packages-reload", type: "reload", run: "once" - config.vm.provision "selinux-status", type: "shell", run: "once", inline: "sestatus -v" - config.vm.provision "install-rke2-profile", type: "shell", run: "once" do |sh| - sh.inline = <<~SHELL - #!/usr/bin/env bash - cat <<-EOF > /etc/profile.d/rke2.sh -export KUBECONFIG=/etc/rancher/rke2/rke2.yaml PATH=/usr/local/bin:$PATH:/var/lib/rancher/rke2/bin -EOF - SHELL - end - -end ++++++ rke2-selinux.obsinfo ++++++ --- /var/tmp/diff_new_pack.82Mh1c/_old 2026-10-29 16:10:59.584768953 +0100 +++ /var/tmp/diff_new_pack.82Mh1c/_new 2026-10-29 16:10:59.587769079 +0100 @@ -1,5 +1,5 @@ name: rke2-selinux -version: 0.23.stable.1 -mtime: 1780321438 -commit: 95659f017f74a6833be3d2576ce47e0755611c53 +version: 0.24.stable.1 +mtime: 1792703549 +commit: d06460348b1743db6c0160d59a8c7b1ce3f103ef
