[PATCH] spec: use %selinux_requires macro, drop overlapping dependencies

[PATCH] spec: use %selinux_requires macro, drop overlapping dependencies

[Danish Prakash]

Also, drop unused preun policycoreutils requires.

Signed-off-by: Danish Prakash <contact@danishpraka.sh>
---
 contrib/fedora/passt.spec | 20 ++++++++------------
 1 file changed, 8 insertions(+), 12 deletions(-)

diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec
index d1bcf4a74338..cab2bb4c409b 100644
--- a/contrib/fedora/passt.spec
+++ b/contrib/fedora/passt.spec
@@ -34,19 +34,15 @@ for network namespaces: traffic is forwarded using a tap interface inside the
 namespace, without the need to create further interfaces on the host, hence not
 requiring any capabilities or privileges.
 
-%package		selinux
-BuildArch:		noarch
-Summary:		SELinux support for passt and pasta
-Requires:		selinux-policy-%{selinuxtype}
-Requires:		container-selinux
-Requires(post):		selinux-policy-%{selinuxtype}
+%package		    selinux
+BuildArch:		    noarch
+Summary:		    SELinux support for passt and pasta
+%selinux_requires
+Requires:		    container-selinux
+Requires:		    selinux-policy-%{selinuxtype}
 Requires(post):		container-selinux
-Requires(post):		policycoreutils
-Requires(post):		libselinux-utils
-Requires(preun):	policycoreutils
-BuildRequires:		selinux-policy-devel
-BuildRequires:		pkgconfig(systemd)
-Recommends:		selinux-policy-%{selinuxtype} >= %{selinux_policy_version}
+Requires(post):		selinux-policy-%{selinuxtype}
+Recommends:		    selinux-policy-%{selinuxtype} >= %{selinux_policy_version}
 
 %description selinux
 This package adds SELinux enforcement to passt(1), pasta(1), passt-repair(1).
-- 
2.51.0

Re: [PATCH] spec: use %selinux_requires macro, drop overlapping dependencies

[Max Chernoff]

Hi Danish,

On Thu, 2025-11-13 at 12:52 +0530, Danish Prakash wrote:
> Also, drop unused preun policycoreutils requires.
>
> Signed-off-by: Danish Prakash <contact@danishpraka.sh>
> ---
>  contrib/fedora/passt.spec | 20 ++++++++------------
>  1 file changed, 8 insertions(+), 12 deletions(-)
>
> diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec
> index d1bcf4a74338..cab2bb4c409b 100644
> --- a/contrib/fedora/passt.spec
> +++ b/contrib/fedora/passt.spec
> @@ -34,19 +34,15 @@ for network namespaces: traffic is forwarded using a tap interface inside the
>  namespace, without the need to create further interfaces on the host, hence not
>  requiring any capabilities or privileges.
>
> -%package		selinux
> -BuildArch:		noarch
> -Summary:		SELinux support for passt and pasta
> -Requires:		selinux-policy-%{selinuxtype}
> -Requires:		container-selinux
> -Requires(post):		selinux-policy-%{selinuxtype}
> +%package		    selinux
> +BuildArch:		    noarch
> +Summary:		    SELinux support for passt and pasta
> +%selinux_requires

I think that we want "%selinux_requires_min" instead, since
"%selinux_requires" also pulls in "policycoreutils-python-utils" (and
hence all of Python).

(I'm not very familiar with spec files, but since the RPM macro
"%selinux_requires" is provided by the "selinux-policy" package, do we
also need to add a Requires/BuildRequires for that?)

> +Requires:		    container-selinux
> +Requires:		    selinux-policy-%{selinuxtype}

I think that "selinux-policy-%{selinuxtype}" is included via
"%selinux_requires" above.

>  Requires(post):		container-selinux
> -Requires(post):		policycoreutils
> -Requires(post):		libselinux-utils
> -Requires(preun):	policycoreutils
> -BuildRequires:		selinux-policy-devel
> -BuildRequires:		pkgconfig(systemd)
> -Recommends:		selinux-policy-%{selinuxtype} >= %{selinux_policy_version}
> +Requires(post):		selinux-policy-%{selinuxtype}
> +Recommends:		    selinux-policy-%{selinuxtype} >= %{selinux_policy_version}
>
>  %description selinux
>  This package adds SELinux enforcement to passt(1), pasta(1), passt-repair(1).

Everything else looks good to me.

Thanks,
-- Max

Re: [PATCH] spec: use %selinux_requires macro, drop overlapping dependencies

[Stefano Brivio]

Adding Vit as author of some parts now changed by this patch. Full
discussion thread at:

  https://archives.passt.top/passt-dev/20251113072256.4034068-1-contact@danishpraka.sh/

On Thu, 13 Nov 2025 02:47:42 -0700
Max Chernoff <git@maxchernoff.ca> wrote:

> Hi Danish,
> 
> On Thu, 2025-11-13 at 12:52 +0530, Danish Prakash wrote:
> > Also, drop unused preun policycoreutils requires.
> >
> > Signed-off-by: Danish Prakash <contact@danishpraka.sh>
> > ---
> >  contrib/fedora/passt.spec | 20 ++++++++------------
> >  1 file changed, 8 insertions(+), 12 deletions(-)
> >
> > diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec
> > index d1bcf4a74338..cab2bb4c409b 100644
> > --- a/contrib/fedora/passt.spec
> > +++ b/contrib/fedora/passt.spec
> > @@ -34,19 +34,15 @@ for network namespaces: traffic is forwarded using a tap interface inside the
> >  namespace, without the need to create further interfaces on the host, hence not
> >  requiring any capabilities or privileges.
> >
> > -%package		selinux
> > -BuildArch:		noarch
> > -Summary:		SELinux support for passt and pasta
> > -Requires:		selinux-policy-%{selinuxtype}
> > -Requires:		container-selinux
> > -Requires(post):		selinux-policy-%{selinuxtype}
> > +%package		    selinux
> > +BuildArch:		    noarch
> > +Summary:		    SELinux support for passt and pasta
> > +%selinux_requires  
> 
> I think that we want "%selinux_requires_min" instead, since
> "%selinux_requires" also pulls in "policycoreutils-python-utils" (and
> hence all of Python).
> 
> (I'm not very familiar with spec files, but since the RPM macro
> "%selinux_requires" is provided by the "selinux-policy" package, do we
> also need to add a Requires/BuildRequires for that?)
> 
> > +Requires:		    container-selinux
> > +Requires:		    selinux-policy-%{selinuxtype}  
> 
> I think that "selinux-policy-%{selinuxtype}" is included via
> "%selinux_requires" above.
> 
> >  Requires(post):		container-selinux
> > -Requires(post):		policycoreutils
> > -Requires(post):		libselinux-utils
> > -Requires(preun):	policycoreutils
> > -BuildRequires:		selinux-policy-devel
> > -BuildRequires:		pkgconfig(systemd)
> > -Recommends:		selinux-policy-%{selinuxtype} >= %{selinux_policy_version}
> > +Requires(post):		selinux-policy-%{selinuxtype}
> > +Recommends:		    selinux-policy-%{selinuxtype} >= %{selinux_policy_version}
> >
> >  %description selinux
> >  This package adds SELinux enforcement to passt(1), pasta(1), passt-repair(1).  
> 
> Everything else looks good to me.
> 
> Thanks,
> -- Max
> 

-- 
Stefano

Re: [PATCH] spec: use %selinux_requires macro, drop overlapping dependencies

[Vit Mojzis]

Hi,

On 11/13/25 12:10 PM, Stefano Brivio wrote:
> Adding Vit as author of some parts now changed by this patch. Full
> discussion thread at:
>
>    https://archives.passt.top/passt-dev/20251113072256.4034068-1-contact@danishpraka.sh/
>
> On Thu, 13 Nov 2025 02:47:42 -0700
> Max Chernoff <git@maxchernoff.ca> wrote:
>
>> Hi Danish,
>>
>> On Thu, 2025-11-13 at 12:52 +0530, Danish Prakash wrote:
>>> Also, drop unused preun policycoreutils requires.
>>>
>>> Signed-off-by: Danish Prakash <contact@danishpraka.sh>
>>> ---
>>>   contrib/fedora/passt.spec | 20 ++++++++------------
>>>   1 file changed, 8 insertions(+), 12 deletions(-)
>>>
>>> diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec
>>> index d1bcf4a74338..cab2bb4c409b 100644
>>> --- a/contrib/fedora/passt.spec
>>> +++ b/contrib/fedora/passt.spec
>>> @@ -34,19 +34,15 @@ for network namespaces: traffic is forwarded using a tap interface inside the
>>>   namespace, without the need to create further interfaces on the host, hence not
>>>   requiring any capabilities or privileges.
>>>
>>> -%package		selinux
>>> -BuildArch:		noarch
>>> -Summary:		SELinux support for passt and pasta
>>> -Requires:		selinux-policy-%{selinuxtype}
>>> -Requires:		container-selinux
>>> -Requires(post):		selinux-policy-%{selinuxtype}
>>> +%package		    selinux
>>> +BuildArch:		    noarch
>>> +Summary:		    SELinux support for passt and pasta
>>> +%selinux_requires
>> I think that we want "%selinux_requires_min" instead, since
>> "%selinux_requires" also pulls in "policycoreutils-python-utils" (and
>> hence all of Python).
Yes, we only recently added this option and selinux_requires_min is what 
you need as long as you're not using semanage (e.g. to customize booleans).

>>
>> (I'm not very familiar with spec files, but since the RPM macro
>> "%selinux_requires" is provided by the "selinux-policy" package, do we
>> also need to add a Requires/BuildRequires for that?)

Yes, BuildRequires: selinux-policy-devel is indeed needed (it will bring 
selinux-policy with it) for RPM to have access to the macro.
Please test all the "Requires" you removed, because unfortunately 
%selinux_requires gets expanded too late for some of the contents to 
matter (which is why I recomended using this set of "Requires"): 
https://fedoraproject.org/wiki/SELinux/IndependentPolicy#The_Preamble 
(It has been a few years since I tested it last though)

>>
>>> +Requires:		    container-selinux
>>> +Requires:		    selinux-policy-%{selinuxtype}
>> I think that "selinux-policy-%{selinuxtype}" is included via
>> "%selinux_requires" above.

It is not. %selinux_requires does not specify which one of 
selinux-policy-{mls|minimum|targeted|atomotive} to install.

>>
>>>   Requires(post):		container-selinux
>>> -Requires(post):		policycoreutils
>>> -Requires(post):		libselinux-utils
>>> -Requires(preun):	policycoreutils
>>> -BuildRequires:		selinux-policy-devel
>>> -BuildRequires:		pkgconfig(systemd)
>>> -Recommends:		selinux-policy-%{selinuxtype} >= %{selinux_policy_version}
>>> +Requires(post):		selinux-policy-%{selinuxtype}
>>> +Recommends:		    selinux-policy-%{selinuxtype} >= %{selinux_policy_version}
You can drop the Recommends, since that is part of the macro.
We recently replaced the original hard "Requires" with "Recommends" 
(along with a Requires for the "stable version"). So the original reason 
for removing the macro from your package is mostly gone.

Vit
>>>   %description selinux
>>>   This package adds SELinux enforcement to passt(1), pasta(1), passt-repair(1).
>> Everything else looks good to me.
>>
>> Thanks,
>> -- Max
>>

Re: [PATCH] spec: use %selinux_requires macro, drop overlapping dependencies

[Danish Prakash]

On 11/13/25 5:34 PM, Vit Mojzis wrote:
>>>> -%package        selinux
>>>> -BuildArch:        noarch
>>>> -Summary:        SELinux support for passt and pasta
>>>> -Requires:        selinux-policy-%{selinuxtype}
>>>> -Requires:        container-selinux
>>>> -Requires(post):        selinux-policy-%{selinuxtype}
>>>> +%package            selinux
>>>> +BuildArch:            noarch
>>>> +Summary:            SELinux support for passt and pasta
>>>> +%selinux_requires
>>> I think that we want "%selinux_requires_min" instead, since
>>> "%selinux_requires" also pulls in "policycoreutils-python-utils" (and
>>> hence all of Python).
> Yes, we only recently added this option and selinux_requires_min is what
> you need as long as you're not using semanage (e.g. to customize booleans).

I checked and it seems that %selinux_requires_min is available on >=F43;
I've added a conditional macro use in the patch (v2) and relying on
explicit Requires (same as before) for <F43. Is it possible to pull in a
specific version of selinux-policy-devel to rely on
%selinux_requires_min at all times?


>>> (I'm not very familiar with spec files, but since the RPM macro
>>> "%selinux_requires" is provided by the "selinux-policy" package, do we
>>> also need to add a Requires/BuildRequires for that?)
> 
> Yes, BuildRequires: selinux-policy-devel is indeed needed (it will bring
> selinux-policy with it) for RPM to have access to the macro.
> Please test all the "Requires" you removed, because unfortunately
> %selinux_requires gets expanded too late for some of the contents to
> matter (which is why I recomended using this set of "Requires"):
> https://fedoraproject.org/wiki/SELinux/IndependentPolicy#The_Preamble
> (It has been a few years since I tested it last though)

I've tested local builds on F42 and F43, looks good to me, though if
there's a better way to test this, I'd love to do that as well.


regards!
-- 
danishpraka.sh

[PATCH v2] spec: use %selinux_requires_min macro, drop overlapping dependencies

[Danish Prakash]

Also, drop unused preun policycoreutils requires, and Recommends on
selinux-policy-%{targeted}, it has since been added to
%selinux_requires_min.

Signed-off-by: Danish Prakash <contact@danishpraka.sh>
---
 contrib/fedora/passt.spec | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec
index d1bcf4a74338..bcbe1f77bb6c 100644
--- a/contrib/fedora/passt.spec
+++ b/contrib/fedora/passt.spec
@@ -34,19 +34,21 @@ for network namespaces: traffic is forwarded using a tap interface inside the
 namespace, without the need to create further interfaces on the host, hence not
 requiring any capabilities or privileges.
 
-%package		selinux
-BuildArch:		noarch
-Summary:		SELinux support for passt and pasta
-Requires:		selinux-policy-%{selinuxtype}
-Requires:		container-selinux
-Requires(post):		selinux-policy-%{selinuxtype}
+%package		    selinux
+BuildArch:		    noarch
+Summary:		    SELinux support for passt and pasta
+%if 0%{?fedora} >= 43
+BuildRequires:      selinux-policy-devel
+%selinux_requires_min
+%else
+BuildRequires:      pkgconfig(systemd)
+Requires(post):     libselinux-utils
+Requires(post):     policycoreutils
+%endif
+Requires:		    container-selinux
+Requires:		    selinux-policy-%{selinuxtype}
 Requires(post):		container-selinux
-Requires(post):		policycoreutils
-Requires(post):		libselinux-utils
-Requires(preun):	policycoreutils
-BuildRequires:		selinux-policy-devel
-BuildRequires:		pkgconfig(systemd)
-Recommends:		selinux-policy-%{selinuxtype} >= %{selinux_policy_version}
+Requires(post):		selinux-policy-%{selinuxtype}
 
 %description selinux
 This package adds SELinux enforcement to passt(1), pasta(1), passt-repair(1).
-- 
2.51.0

Re: [PATCH v2] spec: use %selinux_requires_min macro, drop overlapping dependencies

[Max Chernoff]

Hi Danish,

On Fri, 2025-11-21 at 18:17 +0530, Danish Prakash wrote:
> Also, drop unused preun policycoreutils requires, and Recommends on
> selinux-policy-%{targeted}, it has since been added to
> %selinux_requires_min.
>
> Signed-off-by: Danish Prakash <contact@danishpraka.sh>

Reviewed-by: Max Chernoff <git@maxchernoff.ca>
Tested-by: Max Chernoff <git@maxchernoff.ca>

(I've only tested this on F43, but the non-F43 changes also look good to
me)

> ---
>  contrib/fedora/passt.spec | 26 ++++++++++++++------------
>  1 file changed, 14 insertions(+), 12 deletions(-)
>
> diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec
> index d1bcf4a74338..bcbe1f77bb6c 100644
> --- a/contrib/fedora/passt.spec
> +++ b/contrib/fedora/passt.spec
> @@ -34,19 +34,21 @@ for network namespaces: traffic is forwarded using a tap interface inside the
>  namespace, without the need to create further interfaces on the host, hence not
>  requiring any capabilities or privileges.
>
> -%package		selinux
> -BuildArch:		noarch
> -Summary:		SELinux support for passt and pasta
> -Requires:		selinux-policy-%{selinuxtype}
> -Requires:		container-selinux
> -Requires(post):		selinux-policy-%{selinuxtype}
> +%package		    selinux
> +BuildArch:		    noarch
> +Summary:		    SELinux support for passt and pasta
> +%if 0%{?fedora} >= 43
> +BuildRequires:      selinux-policy-devel
> +%selinux_requires_min
> +%else
> +BuildRequires:      pkgconfig(systemd)
> +Requires(post):     libselinux-utils
> +Requires(post):     policycoreutils
> +%endif
> +Requires:		    container-selinux
> +Requires:		    selinux-policy-%{selinuxtype}
>  Requires(post):		container-selinux
> -Requires(post):		policycoreutils
> -Requires(post):		libselinux-utils
> -Requires(preun):	policycoreutils
> -BuildRequires:		selinux-policy-devel
> -BuildRequires:		pkgconfig(systemd)
> -Recommends:		selinux-policy-%{selinuxtype} >= %{selinux_policy_version}
> +Requires(post):		selinux-policy-%{selinuxtype}
>
>  %description selinux
>  This package adds SELinux enforcement to passt(1), pasta(1), passt-repair(1).

Thanks,
-- Max

Re: [PATCH v2] spec: use %selinux_requires_min macro, drop overlapping dependencies

[Stefano Brivio]

On Sun, 23 Nov 2025 00:37:24 -0700
Max Chernoff <git@maxchernoff.ca> wrote:

> Hi Danish,
> 
> On Fri, 2025-11-21 at 18:17 +0530, Danish Prakash wrote:
> > Also, drop unused preun policycoreutils requires, and Recommends on
> > selinux-policy-%{targeted}, it has since been added to
> > %selinux_requires_min.
> >
> > Signed-off-by: Danish Prakash <contact@danishpraka.sh>  
> 
> Reviewed-by: Max Chernoff <git@maxchernoff.ca>
> Tested-by: Max Chernoff <git@maxchernoff.ca>
> 
> (I've only tested this on F43, but the non-F43 changes also look good to
> me)

Applied, thanks everybody!

-- 
Stefano

Re: [PATCH v2] spec: use %selinux_requires_min macro, drop overlapping dependencies

[Stefano Brivio]

On Sun, 23 Nov 2025 00:37:24 -0700
Max Chernoff <git@maxchernoff.ca> wrote:

> Hi Danish,
> 
> On Fri, 2025-11-21 at 18:17 +0530, Danish Prakash wrote:
> > Also, drop unused preun policycoreutils requires, and Recommends on
> > selinux-policy-%{targeted}, it has since been added to
> > %selinux_requires_min.
> >
> > Signed-off-by: Danish Prakash <contact@danishpraka.sh>  
> 
> Reviewed-by: Max Chernoff <git@maxchernoff.ca>
> Tested-by: Max Chernoff <git@maxchernoff.ca>
> 
> (I've only tested this on F43, but the non-F43 changes also look good to
> me)

...for some reason, this broke Fedora 43 Copr builds on most builders,
so I just applied and posted a quick build fix:

  https://archives.passt.top/passt-dev/20251208103427.2535279-1-sbrivio@redhat.com/

I guess it's not a drama to start using %selinux_requires_min starting
from Fedora 44 instead, regardless of whether that's the right fix.

Let me know if I'm missing something though.

-- 
Stefano


> 
> > ---
> >  contrib/fedora/passt.spec | 26 ++++++++++++++------------
> >  1 file changed, 14 insertions(+), 12 deletions(-)
> >
> > diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec
> > index d1bcf4a74338..bcbe1f77bb6c 100644
> > --- a/contrib/fedora/passt.spec
> > +++ b/contrib/fedora/passt.spec
> > @@ -34,19 +34,21 @@ for network namespaces: traffic is forwarded using a tap interface inside the
> >  namespace, without the need to create further interfaces on the host, hence not
> >  requiring any capabilities or privileges.
> >
> > -%package		selinux
> > -BuildArch:		noarch
> > -Summary:		SELinux support for passt and pasta
> > -Requires:		selinux-policy-%{selinuxtype}
> > -Requires:		container-selinux
> > -Requires(post):		selinux-policy-%{selinuxtype}
> > +%package		    selinux
> > +BuildArch:		    noarch
> > +Summary:		    SELinux support for passt and pasta
> > +%if 0%{?fedora} >= 43
> > +BuildRequires:      selinux-policy-devel
> > +%selinux_requires_min
> > +%else
> > +BuildRequires:      pkgconfig(systemd)
> > +Requires(post):     libselinux-utils
> > +Requires(post):     policycoreutils
> > +%endif
> > +Requires:		    container-selinux
> > +Requires:		    selinux-policy-%{selinuxtype}
> >  Requires(post):		container-selinux
> > -Requires(post):		policycoreutils
> > -Requires(post):		libselinux-utils
> > -Requires(preun):	policycoreutils
> > -BuildRequires:		selinux-policy-devel
> > -BuildRequires:		pkgconfig(systemd)
> > -Recommends:		selinux-policy-%{selinuxtype} >= %{selinux_policy_version}
> > +Requires(post):		selinux-policy-%{selinuxtype}
> >
> >  %description selinux
> >  This package adds SELinux enforcement to passt(1), pasta(1), passt-repair(1).  
> 
> Thanks,
> -- Max
>