[PATCH v2] contrib/selinux: use regex instead of SELinux template

[Danish Prakash <contact@danishpraka.sh>]

It might be possible to avoid using SELinux template (%USERID),
and instead using regex to match user ids. This would allow
discarding the explicit restorecon call while during package builds[1].

Original suggestion from cathy.hu@suse.com:

> running restorecon would be unnecessary if the passt upstream selinux
> module would not use ${USERID} in pasta.fc (gets converted to [0-9]+ anyway)

[1] - https://passt.top/passt/commit/?id=e019323538699967c155c29411545223dadfc0f5

Signed-off-by: Danish Prakash <contact@danishpraka.sh>
---
 contrib/fedora/passt.spec | 11 -----------
 contrib/selinux/pasta.fc  | 12 ++++++------
 2 files changed, 6 insertions(+), 17 deletions(-)

diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec
index 663289f53d97..d1bcf4a74338 100644
--- a/contrib/fedora/passt.spec
+++ b/contrib/fedora/passt.spec
@@ -103,17 +103,6 @@ fi
 
 %posttrans selinux
 %selinux_relabel_post -s %{selinuxtype}
-# %selinux_relabel_post calls fixfiles(8) with the previous file_contexts file
-# (see selabel_file(5)) in order to restore only the file contexts which
-# actually changed. However, as file_contexts doesn't support %{USERID}
-# substitutions, this will not work for specific file contexts that pasta needs
-# to have under /run/user.
-#
-# Restore those explicitly, hiding errors from restorecon(8): we can't pass a
-# path that's more specific than this, but at the same time /run/user often
-# contains FUSE mountpoints that can't be accessed as root, leading to
-# "Permission denied" messages, but not failures.
-restorecon -R /run/user 2>/dev/null
 
 %files
 %license LICENSES/{GPL-2.0-or-later.txt,BSD-3-Clause.txt}
diff --git a/contrib/selinux/pasta.fc b/contrib/selinux/pasta.fc
index e60c6148f412..82dbcbe2b75e 100644
--- a/contrib/selinux/pasta.fc
+++ b/contrib/selinux/pasta.fc
@@ -12,11 +12,11 @@
 /usr/bin/pasta.avx2					system_u:object_r:pasta_exec_t:s0
 /tmp/pasta\.pcap					system_u:object_r:pasta_log_t:s0
 /var/run/pasta\.pid					system_u:object_r:pasta_pid_t:s0
-/run/user/%{USERID}/netns				system_u:object_r:ifconfig_var_run_t:s0
-/run/user/%{USERID}/containers/networks/rootless-netns	system_u:object_r:ifconfig_var_run_t:s0
+/run/user/[0-9]+/netns				system_u:object_r:ifconfig_var_run_t:s0
+/run/user/[0-9]+/containers/networks/rootless-netns	system_u:object_r:ifconfig_var_run_t:s0
 # In case XDG_RUNTIME_DIR is not set (i.e. no systemd user session) Podman falls
 # back to a location under /tmp
-/tmp/storage-run-%{USERID}/netns					system_u:object_r:ifconfig_var_run_t:s0
-/tmp/storage-run-%{USERID}/containers/networks/rootless-netns		system_u:object_r:ifconfig_var_run_t:s0
-/tmp/containers-user-%{USERID}/netns					system_u:object_r:ifconfig_var_run_t:s0
-/tmp/containers-user-%{USERID}/containers/networks/rootless-netns	system_u:object_r:ifconfig_var_run_t:s0
+/tmp/storage-run-[0-9]+/netns					system_u:object_r:ifconfig_var_run_t:s0
+/tmp/storage-run-[0-9]+/containers/networks/rootless-netns		system_u:object_r:ifconfig_var_run_t:s0
+/tmp/containers-user-[0-9]+/netns					system_u:object_r:ifconfig_var_run_t:s0
+/tmp/containers-user-[0-9]+/containers/networks/rootless-netns	system_u:object_r:ifconfig_var_run_t:s0
-- 
2.51.0