passt/contrib, branch 2023_03_29.b10b983

fedora: Adjust path for SELinux policy and interface file to latest guidelines

2023-03-29T20:11:07+00:00

Forget about:
  https://fedoraproject.org/wiki/SELinux_Policy_Modules_Packaging_Draft

and:
  https://fedoraproject.org/wiki/PackagingDrafts/SELinux_Independent_Policy

The guidelines to follow are:
  https://fedoraproject.org/wiki/SELinux/IndependentPolicy

Start from fixing the most pressing issue, that is, a path conflict
with policy-selinux-devel about passt.if, and, while at it, adjust
the installation paths for policy files too.

Reported-by: Xose Vazquez Perez 
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2182476
Signed-off-by: Stefano Brivio

fedora: Don't install useless SELinux interface file for pasta

2023-03-29T11:48:12+00:00

That was meant to be an example, and I just dropped it in the
previous commit -- passt.if should be more than enough as a possible
example.

Reported-by: Carl G. 
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2182145
Signed-off-by: Stefano Brivio

selinux: Drop useless interface file for pasta

2023-03-29T11:48:12+00:00

This was meant to be an example, but I managed to add syntax errors
to it. Drop it altogether.

Reported-by: Carl G. 
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2182145
Signed-off-by: Stefano Brivio

fedora: Refresh SELinux labels in scriptlets, require -selinux package

2023-03-17T07:26:07+00:00

Instead of:
  https://fedoraproject.org/wiki/SELinux_Policy_Modules_Packaging_Draft

follow this:
  https://fedoraproject.org/wiki/PackagingDrafts/SELinux_Independent_Policy

which seems to make more sense and fixes the issue that, on a fresh
install, without a reboot, the file contexts for the binaries are not
actually updated.

In detail:

- labels are refreshed using the selinux_relabel_pre and
  selinux_relabel_post on install, upgrade, and uninstall

- use the selinux_modules_install and selinux_modules_uninstall
  macros, instead of calling 'semodule' directly (no functional
  changes in our case)

- require the -selinux package on SELinux-enabled environments and if
  the current system policy is "targeted"

Signed-off-by: Stefano Brivio

fedora: Install SELinux interface files to shared include directory

2023-03-10T19:01:41+00:00

Link: https://github.com/fedora-selinux/selinux-policy/pull/1613
Signed-off-by: Stefano Brivio

contrib/selinux: Split interfaces into smaller bits

2023-03-10T19:01:41+00:00

...to fit accepted Fedora practices.

Link: https://github.com/fedora-selinux/selinux-policy/pull/1613
Signed-off-by: Stefano Brivio

contrib/selinux: Drop unused passt_read_data() interface

2023-03-10T19:01:41+00:00

Signed-off-by: Stefano Brivio

contrib/selinux: Drop "example" from headers: this is the actual policy

2023-03-10T19:01:41+00:00

Signed-off-by: Stefano Brivio

contrib: Drop libvirt out-of-tree patch, integration mostly works in 9.1.0

2023-03-09T02:44:21+00:00

...and in any case, this patch doesn't offer any advantage over the
current upstream integration.

Signed-off-by: Stefano Brivio 
Reviewed-by: David Gibson

contrib: Drop QEMU out-of-tree patches

2023-03-09T02:44:21+00:00

Native support was introduced with commit 13c6be96618c, QEMU 7.2.

Signed-off-by: Stefano Brivio 
Reviewed-by: David Gibson