From 04a2a09368f76620d3eeb51eafeb1791b41e00ae Mon Sep 17 00:00:00 2001 From: wonfen Date: Sat, 19 Sep 2026 22:28:57 +0800 Subject: [PATCH] fix(linux): restore SELinux service startup with v2.7.2 Upgrade clash_verge_service_ipc and bundled service downloads to v2.7.2, which labels runtime-installed executables before publication and repairs existing core labels instead of timing out waiting for service IPC. Register persistent bin_t rules for production and development service binaries and cores in the RPM post-install script. Support older semanage versions, apply rules to existing directories, and warn when optional SELinux tools are unavailable. Refs: #7965 --- Cargo.lock | 4 +-- Changelog.md | 1 + src-tauri/Cargo.toml | 2 +- src-tauri/packages/linux/post-install-rpm.sh | 38 ++++++++++++++++++++ src-tauri/tauri.linux.conf.json | 3 +- 5 files changed, 44 insertions(+), 4 deletions(-) create mode 100644 src-tauri/packages/linux/post-install-rpm.sh diff --git a/Cargo.lock b/Cargo.lock index e33ddbcc8..4941f7d0f 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1223,8 +1223,8 @@ dependencies = [ [[package]] name = "clash_verge_service_ipc" -version = "2.7.1" -source = "git+https://github.com/clash-verge-rev/clash-verge-service-ipc.git?tag=v2.7.1#807480e9afc7b9deb8ff3040b54be34326986dfd" +version = "2.7.2" +source = "git+https://github.com/clash-verge-rev/clash-verge-service-ipc.git?tag=v2.7.2#cad270fe753553cfa2fd26fa5c338eabd210a2d5" dependencies = [ "anyhow", "kode-bridge", diff --git a/Changelog.md b/Changelog.md index 0a2e682e8..0ecee8914 100644 --- a/Changelog.md +++ b/Changelog.md @@ -40,6 +40,7 @@ **🐧 Linux** - 修复 Linux 安装或卸载服务时授权失败的问题 +- 修复 Fedora 等启用 SELinux 的系统更新后服务无法启动的问题 **🍎/🐧 macOS/Linux** diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml index 534ca98cf..b0871e38f 100755 --- a/src-tauri/Cargo.toml +++ b/src-tauri/Cargo.toml @@ -99,7 +99,7 @@ tracing = { workspace = true } tauri-plugin-devtools = { version = "2.2.1", optional = true } tauri-plugin-mihomo = { git = "https://github.com/clash-verge-rev/tauri-plugin-mihomo", branch = "main" } async-trait = "0.1.92" -clash_verge_service_ipc = { git = "https://github.com/clash-verge-rev/clash-verge-service-ipc.git", tag = "v2.7.1", version = "2.7.1", features = [ +clash_verge_service_ipc = { git = "https://github.com/clash-verge-rev/clash-verge-service-ipc.git", tag = "v2.7.2", version = "2.7.2", features = [ "client", ] } arc-swap = "1.9.2" diff --git a/src-tauri/packages/linux/post-install-rpm.sh b/src-tauri/packages/linux/post-install-rpm.sh new file mode 100644 index 000000000..cb1f3ca75 --- /dev/null +++ b/src-tauri/packages/linux/post-install-rpm.sh @@ -0,0 +1,38 @@ +#!/bin/bash +set -e + +chmod +x /usr/bin/clash-verge-service-install +chmod +x /usr/bin/clash-verge-service-uninstall +chmod +x /usr/bin/clash-verge-service + +# The enforcement file exists in both Enforcing and Permissive mode. +if [ ! -e /sys/fs/selinux/enforce ]; then + exit 0 +fi + +if [ ! -x /usr/sbin/semanage ] || [ ! -x /usr/sbin/restorecon ]; then + echo "Warning: persistent SELinux rules were not installed; install policycoreutils and policycoreutils-python-utils, then reinstall this package. The service installer repairs executable labels, but a system relabel can reset them." >&2 + exit 0 +fi + +# Keep these local rules on removal: they may predate this package or serve a standalone development service. +for service in clash-verge-service clash-verge-service-dev; do + for directory in bin cores; do + target="/var/lib/$service/$directory" + if [ -L "/var/lib/$service" ] || [ -L "$target" ]; then + echo "Refusing to relabel a symlinked service directory: $target" >&2 + exit 1 + fi + spec="$target(/.*)?" + # Older semanage versions reject -a when an exact rule already exists. + if ! add_error="$(/usr/sbin/semanage fcontext -a -t bin_t "$spec" 2>&1)"; then + if ! /usr/sbin/semanage fcontext -m -t bin_t "$spec"; then + printf '%s\n' "$add_error" >&2 + exit 1 + fi + fi + if [ -d "$target" ]; then + /usr/sbin/restorecon -R "$target" + fi + done +done diff --git a/src-tauri/tauri.linux.conf.json b/src-tauri/tauri.linux.conf.json index eea413dd4..166faf26b 100644 --- a/src-tauri/tauri.linux.conf.json +++ b/src-tauri/tauri.linux.conf.json @@ -15,11 +15,12 @@ }, "rpm": { "depends": ["openssl", "libayatana-appindicator-gtk3"], + "recommends": ["policycoreutils", "policycoreutils-python-utils"], "desktopTemplate": "./packages/linux/clash-verge.desktop", "provides": ["clash-verge"], "conflicts": ["clash-verge"], "obsoletes": ["clash-verge"], - "postInstallScript": "./packages/linux/post-install.sh", + "postInstallScript": "./packages/linux/post-install-rpm.sh", "preRemoveScript": "./packages/linux/pre-remove.sh" } },