fix(linux): restore SELinux service startup with v2.7.2

Upgrade clash_verge_service_ipc and bundled service downloads to v2.7.2,
which labels runtime-installed executables before publication and repairs
existing core labels instead of timing out waiting for service IPC.

Register persistent bin_t rules for production and development service
binaries and cores in the RPM post-install script. Support older semanage
versions, apply rules to existing directories, and warn when optional
SELinux tools are unavailable.

Refs: #7965

Cargo.lock

@@ -1223,8 +1223,8 @@ dependencies = [
 
 [[package]]
 name = "clash_verge_service_ipc"
-version = "2.7.1"
-source = "git+https://github.com/clash-verge-rev/clash-verge-service-ipc.git?tag=v2.7.1#807480e9afc7b9deb8ff3040b54be34326986dfd"
+version = "2.7.2"
+source = "git+https://github.com/clash-verge-rev/clash-verge-service-ipc.git?tag=v2.7.2#cad270fe753553cfa2fd26fa5c338eabd210a2d5"
 dependencies = [
  "anyhow",
  "kode-bridge",

Changelog.md

@@ -40,6 +40,7 @@
 **🐧 Linux**
 
 - 修复 Linux 安装或卸载服务时授权失败的问题
+- 修复 Fedora 等启用 SELinux 的系统更新后服务无法启动的问题
 
 **🍎/🐧 macOS/Linux**
 

src-tauri/Cargo.toml

@@ -99,7 +99,7 @@ tracing = { workspace = true }
 tauri-plugin-devtools = { version = "2.2.1", optional = true }
 tauri-plugin-mihomo = { git = "https://github.com/clash-verge-rev/tauri-plugin-mihomo", branch = "main" }
 async-trait = "0.1.92"
-clash_verge_service_ipc = { git = "https://github.com/clash-verge-rev/clash-verge-service-ipc.git", tag = "v2.7.1", version = "2.7.1", features = [
+clash_verge_service_ipc = { git = "https://github.com/clash-verge-rev/clash-verge-service-ipc.git", tag = "v2.7.2", version = "2.7.2", features = [
   "client",
 ] }
 arc-swap = "1.9.2"

src-tauri/packages/linux/post-install-rpm.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+set -e
+
+chmod +x /usr/bin/clash-verge-service-install
+chmod +x /usr/bin/clash-verge-service-uninstall
+chmod +x /usr/bin/clash-verge-service
+
+# The enforcement file exists in both Enforcing and Permissive mode.
+if [ ! -e /sys/fs/selinux/enforce ]; then
+    exit 0
+fi
+
+if [ ! -x /usr/sbin/semanage ] || [ ! -x /usr/sbin/restorecon ]; then
+    echo "Warning: persistent SELinux rules were not installed; install policycoreutils and policycoreutils-python-utils, then reinstall this package. The service installer repairs executable labels, but a system relabel can reset them." >&2
+    exit 0
+fi
+
+# Keep these local rules on removal: they may predate this package or serve a standalone development service.
+for service in clash-verge-service clash-verge-service-dev; do
+    for directory in bin cores; do
+        target="/var/lib/$service/$directory"
+        if [ -L "/var/lib/$service" ] || [ -L "$target" ]; then
+            echo "Refusing to relabel a symlinked service directory: $target" >&2
+            exit 1
+        fi
+        spec="$target(/.*)?"
+        # Older semanage versions reject -a when an exact rule already exists.
+        if ! add_error="$(/usr/sbin/semanage fcontext -a -t bin_t "$spec" 2>&1)"; then
+            if ! /usr/sbin/semanage fcontext -m -t bin_t "$spec"; then
+                printf '%s\n' "$add_error" >&2
+                exit 1
+            fi
+        fi
+        if [ -d "$target" ]; then
+            /usr/sbin/restorecon -R "$target"
+        fi
+    done
+done

src-tauri/tauri.linux.conf.json

@@ -15,11 +15,12 @@
       },
       "rpm": {
         "depends": ["openssl", "libayatana-appindicator-gtk3"],
+        "recommends": ["policycoreutils", "policycoreutils-python-utils"],
         "desktopTemplate": "./packages/linux/clash-verge.desktop",
         "provides": ["clash-verge"],
         "conflicts": ["clash-verge"],
         "obsoletes": ["clash-verge"],
-        "postInstallScript": "./packages/linux/post-install.sh",
+        "postInstallScript": "./packages/linux/post-install-rpm.sh",
         "preRemoveScript": "./packages/linux/pre-remove.sh"
       }
     },