passt, branch 2023_03_17.dd23496

fedora: Refresh SELinux labels in scriptlets, require -selinux package

2023-03-17T07:26:07+00:00

Instead of:
  https://fedoraproject.org/wiki/SELinux_Policy_Modules_Packaging_Draft

follow this:
  https://fedoraproject.org/wiki/PackagingDrafts/SELinux_Independent_Policy

which seems to make more sense and fixes the issue that, on a fresh
install, without a reboot, the file contexts for the binaries are not
actually updated.

In detail:

- labels are refreshed using the selinux_relabel_pre and
  selinux_relabel_post on install, upgrade, and uninstall

- use the selinux_modules_install and selinux_modules_uninstall
  macros, instead of calling 'semodule' directly (no functional
  changes in our case)

- require the -selinux package on SELinux-enabled environments and if
  the current system policy is "targeted"

Signed-off-by: Stefano Brivio

Makefile: Enable external override for TARGET

2023-03-17T07:26:07+00:00

A cross-architecture build might pass a target-specific CC on 'make',
and not on 'make install', and this is what happens in Debian
cross-qa tests.

Given that we select binaries to be installed depending on the target
architecture, this means we would build AVX2 binaries in any case on
a x86_64 build machine.

By overriding TARGET in package build rules, we can tell the Makefile
about the target architecture, also for the 'install' (Makefile)
target.

Signed-off-by: Stefano Brivio

passt.1: Fix description of --mtu option

2023-03-17T07:26:07+00:00

By default, 65520 bytes are advertised, and zero disables DHCP and
NDP options.

Fixes: ec2b58ea4dc4 ("conf, dhcp, ndp: Fix message about default MTU, make NDP consistent")
Signed-off-by: Stefano Brivio

log: Avoid time_t/__syscall_slong_t format mismatch with long int on X32 ABI

2023-03-17T07:25:56+00:00

On X32 (ILP32 using AMD64 system call ABI) and glibc,
struct timespec::tv_nsec is __syscall_slong_t and not a long int, see
also https://sourceware.org/bugzilla/show_bug.cgi?id=16437 and
timespec(3type). Fine, we could cast that down to long and be done
with it.

But it turns out that also time_t (not guaranteed to be equivalent to
any type) is a long long int, and there we can't downcast.

To keep it simple, cast both to long long int, and change formats to
%lli, to avoid format warnings from gcc.

Signed-off-by: Stefano Brivio 
Reviewed-by: David Gibson

fedora: Install SELinux interface files to shared include directory

2023-03-10T19:01:41+00:00

Link: https://github.com/fedora-selinux/selinux-policy/pull/1613
Signed-off-by: Stefano Brivio

contrib/selinux: Split interfaces into smaller bits

2023-03-10T19:01:41+00:00

...to fit accepted Fedora practices.

Link: https://github.com/fedora-selinux/selinux-policy/pull/1613
Signed-off-by: Stefano Brivio

contrib/selinux: Drop unused passt_read_data() interface

2023-03-10T19:01:41+00:00

Signed-off-by: Stefano Brivio

contrib/selinux: Drop "example" from headers: this is the actual policy

2023-03-10T19:01:41+00:00

Signed-off-by: Stefano Brivio

README: Update Features section, plus minor improvements

2023-03-09T02:44:21+00:00

...it's been a while.

Signed-off-by: Stefano Brivio 
Reviewed-by: David Gibson

contrib: Drop libvirt out-of-tree patch, integration mostly works in 9.1.0

2023-03-09T02:44:21+00:00

...and in any case, this patch doesn't offer any advantage over the
current upstream integration.

Signed-off-by: Stefano Brivio 
Reviewed-by: David Gibson