It might be possible to avoid using SELinux template (%USERID),
and instead using regex to match user ids. This would allow
discarding the explicit restorecon call while during package builds[1].
Original suggestion from cathy.hu@suse.com:
running restorecon would be unnecessary if the passt upstream selinux
module would not use ${USERID} in pasta.fc (gets converted to [0-9]+ anyway)
[1] - https://passt.top/passt/commit/?id=e019323538699967c155c29411545223dadfc0f5
Signed-off-by: Danish Prakash
---
contrib/fedora/passt.spec | 11 -----------
contrib/selinux/pasta.fc | 12 ++++++------
2 files changed, 6 insertions(+), 17 deletions(-)
diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec
index 663289f53d97..d1bcf4a74338 100644
--- a/contrib/fedora/passt.spec
+++ b/contrib/fedora/passt.spec
@@ -103,17 +103,6 @@ fi
%posttrans selinux
%selinux_relabel_post -s %{selinuxtype}
-# %selinux_relabel_post calls fixfiles(8) with the previous file_contexts file
-# (see selabel_file(5)) in order to restore only the file contexts which
-# actually changed. However, as file_contexts doesn't support %{USERID}
-# substitutions, this will not work for specific file contexts that pasta needs
-# to have under /run/user.
-#
-# Restore those explicitly, hiding errors from restorecon(8): we can't pass a
-# path that's more specific than this, but at the same time /run/user often
-# contains FUSE mountpoints that can't be accessed as root, leading to
-# "Permission denied" messages, but not failures.
-restorecon -R /run/user 2>/dev/null
%files
%license LICENSES/{GPL-2.0-or-later.txt,BSD-3-Clause.txt}
diff --git a/contrib/selinux/pasta.fc b/contrib/selinux/pasta.fc
index e60c6148f412..82dbcbe2b75e 100644
--- a/contrib/selinux/pasta.fc
+++ b/contrib/selinux/pasta.fc
@@ -12,11 +12,11 @@
/usr/bin/pasta.avx2 system_u:object_r:pasta_exec_t:s0
/tmp/pasta\.pcap system_u:object_r:pasta_log_t:s0
/var/run/pasta\.pid system_u:object_r:pasta_pid_t:s0
-/run/user/%{USERID}/netns system_u:object_r:ifconfig_var_run_t:s0
-/run/user/%{USERID}/containers/networks/rootless-netns system_u:object_r:ifconfig_var_run_t:s0
+/run/user/[0-9]+/netns system_u:object_r:ifconfig_var_run_t:s0
+/run/user/[0-9]+/containers/networks/rootless-netns system_u:object_r:ifconfig_var_run_t:s0
# In case XDG_RUNTIME_DIR is not set (i.e. no systemd user session) Podman falls
# back to a location under /tmp
-/tmp/storage-run-%{USERID}/netns system_u:object_r:ifconfig_var_run_t:s0
-/tmp/storage-run-%{USERID}/containers/networks/rootless-netns system_u:object_r:ifconfig_var_run_t:s0
-/tmp/containers-user-%{USERID}/netns system_u:object_r:ifconfig_var_run_t:s0
-/tmp/containers-user-%{USERID}/containers/networks/rootless-netns system_u:object_r:ifconfig_var_run_t:s0
+/tmp/storage-run-[0-9]+/netns system_u:object_r:ifconfig_var_run_t:s0
+/tmp/storage-run-[0-9]+/containers/networks/rootless-netns system_u:object_r:ifconfig_var_run_t:s0
+/tmp/containers-user-[0-9]+/netns system_u:object_r:ifconfig_var_run_t:s0
+/tmp/containers-user-[0-9]+/containers/networks/rootless-netns system_u:object_r:ifconfig_var_run_t:s0
--
2.51.0