Re: [PATCH] contrib/selinux: use regex instead of non-standard bash macro

[Stefano Brivio <sbrivio@redhat.com>]

[Cc'ing Max and Paul for awareness]

Hi Danish,

On Thu, 16 Oct 2025 13:10:41 +0530
Danish Prakash <contact@danishpraka.sh> wrote:

> It might be possible to avoid using non-standard bash macro (%USERID),
> and instead using regex to match user ids. This would also mean
> discarding the explicit restorecon call while packaging[1].
> 
> [1] - https://passt.top/passt/commit/?id=e019323538699967c155c29411545223dadfc0f5
> 
> Link: https://bugzilla.suse.com/show_bug.cgi?id=1246291

Thanks for the patch. This link is private. Would you mind making a copy
with the essential information in another ticket, or file a different
ticket somewhere else (bugs.passt.top, or Podman's tracker...)?

> Signed-off-by: Danish Prakash <contact@danishpraka.sh>
> ---
>  contrib/fedora/passt.spec | 11 -----------
>  contrib/selinux/pasta.fc  | 12 ++++++------
>  2 files changed, 6 insertions(+), 17 deletions(-)
> 
> diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec
> index 663289f53d97..d1bcf4a74338 100644
> --- a/contrib/fedora/passt.spec
> +++ b/contrib/fedora/passt.spec
> @@ -103,17 +103,6 @@ fi
>  
>  %posttrans selinux
>  %selinux_relabel_post -s %{selinuxtype}
> -# %selinux_relabel_post calls fixfiles(8) with the previous file_contexts file
> -# (see selabel_file(5)) in order to restore only the file contexts which
> -# actually changed. However, as file_contexts doesn't support %{USERID}
> -# substitutions, this will not work for specific file contexts that pasta needs
> -# to have under /run/user.
> -#
> -# Restore those explicitly, hiding errors from restorecon(8): we can't pass a
> -# path that's more specific than this, but at the same time /run/user often
> -# contains FUSE mountpoints that can't be accessed as root, leading to
> -# "Permission denied" messages, but not failures.
> -restorecon -R /run/user 2>/dev/null
>  
>  %files
>  %license LICENSES/{GPL-2.0-or-later.txt,BSD-3-Clause.txt}
> diff --git a/contrib/selinux/pasta.fc b/contrib/selinux/pasta.fc
> index e60c6148f412..82dbcbe2b75e 100644
> --- a/contrib/selinux/pasta.fc
> +++ b/contrib/selinux/pasta.fc
> @@ -12,11 +12,11 @@
>  /usr/bin/pasta.avx2					system_u:object_r:pasta_exec_t:s0
>  /tmp/pasta\.pcap					system_u:object_r:pasta_log_t:s0
>  /var/run/pasta\.pid					system_u:object_r:pasta_pid_t:s0
> -/run/user/%{USERID}/netns				system_u:object_r:ifconfig_var_run_t:s0
> -/run/user/%{USERID}/containers/networks/rootless-netns	system_u:object_r:ifconfig_var_run_t:s0
> +/run/user/[0-9]+/netns				system_u:object_r:ifconfig_var_run_t:s0
> +/run/user/[0-9]+/containers/networks/rootless-netns	system_u:object_r:ifconfig_var_run_t:s0
>  # In case XDG_RUNTIME_DIR is not set (i.e. no systemd user session) Podman falls
>  # back to a location under /tmp
> -/tmp/storage-run-%{USERID}/netns					system_u:object_r:ifconfig_var_run_t:s0
> -/tmp/storage-run-%{USERID}/containers/networks/rootless-netns		system_u:object_r:ifconfig_var_run_t:s0
> -/tmp/containers-user-%{USERID}/netns					system_u:object_r:ifconfig_var_run_t:s0
> -/tmp/containers-user-%{USERID}/containers/networks/rootless-netns	system_u:object_r:ifconfig_var_run_t:s0
> +/tmp/storage-run-[0-9]+/netns					system_u:object_r:ifconfig_var_run_t:s0
> +/tmp/storage-run-[0-9]+/containers/networks/rootless-netns		system_u:object_r:ifconfig_var_run_t:s0
> +/tmp/containers-user-[0-9]+/netns					system_u:object_r:ifconfig_var_run_t:s0
> +/tmp/containers-user-[0-9]+/containers/networks/rootless-netns	system_u:object_r:ifconfig_var_run_t:s0

At a glance, this looks like a better solution regardless of the
reported issue. It sounds too good to be true, though, so I wonder if
Max remembers any reason why we couldn't do this in the first place.

-- 
Stefano