rpm: adjust SELinux snippets for relabeling

[marmarek]

Adjust according to https://fedoraproject.org/wiki/SELinux/IndependentPolicy#Creating_the_Spec_File

Specifically, when %selinux_relabel_post is used, %selinux_relabel_pre
needs to be there too.

QubesOS/qubes-issues#9663

[qubesos-bot]

OpenQA test summary

Complete test suite and dependencies: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2025010322-4.3&flavor=pull-requests

Test run included the following:

• rpm: adjust SELinux snippets for relabeling #184 (6077a10)
• Remove deprecated pkg_resources, replace with importlib qubes-desktop-linux-common#67 (QubesOS/qubes-desktop-linux-common@42def06)
• Use the UUID for the machine ID qubes-core-admin#642 (QubesOS/qubes-core-admin@3efd0c3)
• Don't rely on kdelibs qubes-desktop-linux-kde#20 (QubesOS/qubes-desktop-linux-kde@997a5a3)
• Do not set timezone for VMs with anon-timezone feature qubes-core-admin#646 (QubesOS/qubes-core-admin@c76735f)
• log stdout/err from updates check on Debian qubes-core-agent-linux#537 (QubesOS/qubes-core-agent-linux@b8b485f)
• Wrap all JavaScript in an Immediately-Invoked Function Expression qubes-desktop-linux-kde#19 (QubesOS/qubes-desktop-linux-kde@a1b31ca)
• SystemD dropins for minimal sys-net and sys-usb qubes-core-agent-linux#540 (QubesOS/qubes-core-agent-linux@f4b3d19)
• vmupdate: fix waiting for the other apt-get process qubes-core-admin-linux#175 (QubesOS/qubes-core-admin-linux@1d8ebf9)
• updater: make UpdateListIter a proper iterator qubes-desktop-linux-manager#238 (QubesOS/qubes-desktop-linux-manager@41ba839)

New failures, excluding unstable

Compared to: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2024111705-4.3&flavor=update

• system_tests_network_updates

  • VmUpdates_debian-12-xfce: test_020_updates_available_notification (failure)
    ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^... AssertionError: '1' is not false

• system_tests_kde_gui_interactive

  • gui_keyboard_layout: wait_serial (wait serial expected)
    # wait_serial expected: "echo -e '[Layout]\nLayoutList=us,de' | sud...

• system_tests_basic_vm_qrexec_gui_zfs

  • TC_30_Gui_daemon: test_000_clipboard (error)
    FileNotFoundError: [Errno 2] No such file or directory: '/var/run/q...

  • TC_30_Gui_daemon: test_002_clipboard_300k (failure)
    : Clipboard copy operation failed - content...

Failed tests

5 failures

• system_tests_network_updates

  • VmUpdates_debian-12-xfce: test_020_updates_available_notification (failure)
    ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^... AssertionError: '1' is not false

• system_tests_kde_gui_interactive

  • gui_keyboard_layout: wait_serial (wait serial expected)
    # wait_serial expected: "echo -e '[Layout]\nLayoutList=us,de' | sud...

  • gui_keyboard_layout: Failed (test died)
    # Test died: command 'test "$(cd ~user;ls e1*)" = "$(qvm-run -p wor...

• system_tests_basic_vm_qrexec_gui_zfs

  • TC_30_Gui_daemon: test_000_clipboard (error)
    FileNotFoundError: [Errno 2] No such file or directory: '/var/run/q...

  • TC_30_Gui_daemon: test_002_clipboard_300k (failure)
    : Clipboard copy operation failed - content...

Fixed failures

Compared to: https://openqa.qubes-os.org/tests/119126#dependencies

3 fixed

• system_tests_extra

  • TC_00_QVCTest_whonix-gateway-17: test_010_screenshare (failure)
    ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^... AssertionError: 0 == 0

• system_tests_basic_vm_qrexec_gui_zfs

  • switch_pool: Failed (test died)
    # Test died: command 'dnf install -y ./zfs-release.rpm' failed at /...

• system_tests_audio@hw1

  • TC_20_AudioVM_PipeWire_whonix-workstation-17: test_260_audio_mic_enabled_switch_audiovm (failure)
    AssertionError: too short audio, expected 10s, got 0.00013605442176...

Unstable tests

Details

• system_tests_update

  update2/Failed (1/5 times with errors)

  • job 121711 # Test died: command '(set -o pipefail; qubesctl --show-output stat...

• system_tests_update@hw1

  update2/Failed (1/5 times with errors)

  • job 121711 # Test died: command '(set -o pipefail; qubesctl --show-output stat...

• system_tests_update@hw7

  update2/Failed (1/5 times with errors)

  • job 121711 # Test died: command '(set -o pipefail; qubesctl --show-output stat...

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 79.17%. Comparing base (0e35fa4) to head (6077a10).
Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #184      +/-   ##
==========================================
+ Coverage   79.13%   79.17%   +0.04%     
==========================================
  Files          54       54              
  Lines        9953     9953              
==========================================
+ Hits         7876     7880       +4     
+ Misses       2077     2073       -4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.