Update SELinux policies to rev 8

3 files changed, 153 insertions, 2 deletions

diff --git a/sec-policy/selinux-base/ChangeLog b/sec-policy/selinux-base/ChangeLog
index 6ffdf0e0da4e..4ee149aaa562 100644
--- a/sec-policy/selinux-base/ChangeLog
+++ b/sec-policy/selinux-base/ChangeLog
@@ -1,6 +1,11 @@
 # ChangeLog for sec-policy/selinux-base
 # Copyright 1999-2012 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-base/ChangeLog,v 1.2 2012/04/22 08:46:05 swift Exp $
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-base/ChangeLog,v 1.3 2012/04/26 18:38:44 swift Exp $
+
+*selinux-base-2.20120215-r8 (26 Apr 2012)
+
+  26 Apr 2012; <swift@gentoo.org> +selinux-base-2.20120215-r8.ebuild:
+  Bump to rev8, fix #411719, #411149 and #411943
 
 *selinux-base-2.20120215-r7 (22 Apr 2012)
 
diff --git a/sec-policy/selinux-base/Manifest b/sec-policy/selinux-base/Manifest
index a9f2c7d877b5..62002bc63626 100644
--- a/sec-policy/selinux-base/Manifest
+++ b/sec-policy/selinux-base/Manifest
@@ -1,8 +1,10 @@
 AUX config 631 RMD160 076ae6441a3a29ead502c8bc4b646546095ad95a SHA1 022e0457876cea7068b46c4f14601278215b1056 SHA256 891ddc7cfd577a8591d65f6cb3398863ec338209b347ce9bfc125817b841860e
 DIST patchbundle-selinux-base-policy-2.20120215-r6.tar.bz2 28970 RMD160 4726fd1dc85b5f6ad78389cf882d69c487a664dc SHA1 53e3acd5ce30582636462ae4d3fe834215b88810 SHA256 2a9e0bde439032a2183aed12ff6c18a7bdc00c05c4e1ce59ba097b0733bc776a
 DIST patchbundle-selinux-base-policy-2.20120215-r7.tar.bz2 29331 RMD160 d2f25fcc1bfe063392b68706644b5ff90381fc91 SHA1 557f77ac862d28191aabe2b6a18c1bc5beebae69 SHA256 e9ebe825c0f3651fc8fbf8183036fd61007d1c901d613071c6cfec3bec77963a
+DIST patchbundle-selinux-base-policy-2.20120215-r8.tar.bz2 29993 RMD160 6d6a03ff3d24951529f32442dd713b1f4982aa7b SHA1 1a2fec3e59f4f440598c52cf28c2eee45ce46d92 SHA256 0d2b6b35007f833d49701f4ea4a71b91d056ee4b86c990aa000aea1c431a8d60
 DIST refpolicy-2.20120215.tar.bz2 589917 RMD160 333960d5fdd5f9a23a024d1782950a06ada4f2d1 SHA1 1fe2dd03ea27e0e6fbde6e11309895efd43916e6 SHA256 6df77faf62f73bd1f6e3bfca3fa2f77cdfd2cada94a7dcc4816ed9bbcf3545dc
 EBUILD selinux-base-2.20120215-r6.ebuild 4113 RMD160 9bba272c1d2d7912a8852aab1a8264d10e4c6c21 SHA1 f77672a526754474399f2ce34c4ad1e6a20bdf41 SHA256 85738c8e52b5fb5fea1a16f2f823d076767c4b41de2d6d21ba0bea59fdf9c66c
 EBUILD selinux-base-2.20120215-r7.ebuild 4113 RMD160 913f4802ef1d1b34ee0a5d7f2c9de9e031571bb4 SHA1 58a3ec70f0a3ab1c9d9331e1ef56002104ef17b0 SHA256 dd2f1f828c07faf295a13e23e41302fd1ade4608152d8dd895c8bcad69e0cef5
-MISC ChangeLog 734 RMD160 e1b4854dbac711390b012b5cc09149daff2ce8d8 SHA1 a2aef84b31b32aaf5b3935cbd522d34baaa8065d SHA256 a5e8c1ec5f4384724d4ef0f9ff21c7107f56bf2c65cd8dec90ebc1a37c5e6c72
+EBUILD selinux-base-2.20120215-r8.ebuild 4128 RMD160 c16f99dc5a73b4b448b9430d6eb25a96efbba988 SHA1 8233d8baa94be32a75c416e1bc1b167afebfaaf9 SHA256 ef0490372be08cdb82e4137c80218437ad31297a1e158e95397f9c84297c9657
+MISC ChangeLog 897 RMD160 591f62f798a1869b3e4d46882d4d555d2f8796a8 SHA1 dd7f46b50d44211d748b424ea36c1a4829bec596 SHA256 f333f0619fa3783f959dc84fecf1b41746164738923579fdf3eaa2f5de327baf
 MISC metadata.xml 671 RMD160 49dd94bb827c4ab2bb8043739ef7564df4cf1c07 SHA1 a92b8a5ef129707a44fe2ae1913060d02badd566 SHA256 c32ccc54ca7df400974a19ad14c093ea7b777f7a40467bdb672f441314122e55
diff --git a/sec-policy/selinux-base/selinux-base-2.20120215-r8.ebuild b/sec-policy/selinux-base/selinux-base-2.20120215-r8.ebuild
new file mode 100644
index 000000000000..abaea4e64b8c
--- /dev/null
+++ b/sec-policy/selinux-base/selinux-base-2.20120215-r8.ebuild
@@ -0,0 +1,144 @@
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-base/selinux-base-2.20120215-r8.ebuild,v 1.1 2012/04/26 18:38:44 swift Exp $
+EAPI="4"
+
+inherit eutils
+
+IUSE="+peer_perms +open_perms +ubac doc"
+
+DESCRIPTION="Gentoo base policy for SELinux"
+HOMEPAGE="http://www.gentoo.org/proj/en/hardened/selinux/"
+SRC_URI="http://oss.tresys.com/files/refpolicy/refpolicy-${PV}.tar.bz2
+	http://dev.gentoo.org/~swift/patches/selinux-base-policy/patchbundle-selinux-base-policy-${PVR}.tar.bz2"
+LICENSE="GPL-2"
+SLOT="0"
+
+KEYWORDS="~amd64 ~x86"
+
+RDEPEND=">=sys-apps/policycoreutils-2.1.10
+	>=sys-fs/udev-151
+	!<=sec-policy/selinux-base-policy-2.20120215"
+DEPEND="${RDEPEND}
+	sys-devel/m4
+	>=sys-apps/checkpolicy-2.1.8"
+
+S=${WORKDIR}/
+
+src_prepare() {
+	# Apply the gentoo patches to the policy. These patches are only necessary
+	# for base policies, or for interface changes on modules.
+	EPATCH_MULTI_MSG="Applying SELinux policy updates ... " \
+	EPATCH_SUFFIX="patch" \
+	EPATCH_SOURCE="${WORKDIR}" \
+	EPATCH_FORCE="yes" \
+	epatch
+
+	cd "${S}/refpolicy"
+	# Fix bug 257111 - Correct the initial sid for cron-started jobs in the
+	# system_r role
+	sed -i -e 's:system_crond_t:system_cronjob_t:g' \
+		"${S}/refpolicy/config/appconfig-standard/default_contexts"
+	sed -i -e 's|system_r:cronjob_t|system_r:system_cronjob_t|g' \
+		"${S}/refpolicy/config/appconfig-mls/default_contexts"
+	sed -i -e 's|system_r:cronjob_t|system_r:system_cronjob_t|g' \
+		"${S}/refpolicy/config/appconfig-mcs/default_contexts"
+}
+
+src_configure() {
+	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs"
+
+	# Update the SELinux refpolicy capabilities based on the users' USE flags.
+
+	if ! use peer_perms; then
+		sed -i -e '/network_peer_controls/d' \
+			"${S}/refpolicy/policy/policy_capabilities"
+	fi
+
+	if ! use open_perms; then
+		sed -i -e '/open_perms/d' \
+			"${S}/refpolicy/policy/policy_capabilities"
+	fi
+
+	if ! use ubac; then
+		sed -i -e '/^UBAC/s/y/n/' "${S}/refpolicy/build.conf" \
+			|| die "Failed to disable User Based Access Control"
+	fi
+
+	echo "DISTRO = gentoo" >> "${S}/refpolicy/build.conf"
+
+	# Setup the policies based on the types delivered by the end user.
+	# These types can be "targeted", "strict", "mcs" and "mls".
+	for i in ${POLICY_TYPES}; do
+		cp -a "${S}/refpolicy" "${S}/${i}"
+
+		cd "${S}/${i}";
+		make conf || die "Make conf in ${i} failed"
+
+		#cp "${FILESDIR}/modules-2.20120215.conf" "${S}/${i}/policy/modules.conf"
+		sed -i -e "/= module/d" "${S}/${i}/policy/modules.conf"
+
+		sed -i -e '/^QUIET/s/n/y/' -e "/^NAME/s/refpolicy/$i/" \
+			"${S}/${i}/build.conf" || die "build.conf setup failed."
+
+		if [[ "${i}" == "mls" ]] || [[ "${i}" == "mcs" ]];
+		then
+			# MCS/MLS require additional settings
+			sed -i -e "/^TYPE/s/standard/${i}/" "${S}/${i}/build.conf" \
+				|| die "failed to set type to mls"
+		fi
+
+		if [ "${i}" == "targeted" ]; then
+			sed -i -e '/root/d' -e 's/user_u/unconfined_u/' \
+			"${S}/${i}/config/appconfig-standard/seusers" \
+			|| die "targeted seusers setup failed."
+		fi
+	done
+}
+
+src_compile() {
+	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs"
+
+	for i in ${POLICY_TYPES}; do
+		cd "${S}/${i}"
+		make base || die "${i} compile failed"
+		if use doc; then
+			make html || die
+		fi
+	done
+}
+
+src_install() {
+	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs"
+
+	for i in ${POLICY_TYPES}; do
+		cd "${S}/${i}"
+
+		make DESTDIR="${D}" install \
+			|| die "${i} install failed."
+
+		make DESTDIR="${D}" install-headers \
+			|| die "${i} headers install failed."
+
+		echo "run_init_t" > "${D}/etc/selinux/${i}/contexts/run_init_type"
+
+		echo "textrel_shlib_t" >> "${D}/etc/selinux/${i}/contexts/customizable_types"
+
+		# libsemanage won't make this on its own
+		keepdir "/etc/selinux/${i}/policy"
+
+		if use doc; then
+			dohtml doc/html/*;
+		fi
+	done
+
+	dodoc doc/Makefile.example doc/example.{te,fc,if}
+
+	insinto /etc/selinux
+	doins "${FILESDIR}/config"
+}
+
+pkg_preinst() {
+	has_version "<${CATEGORY}/${PN}-2.20101213-r13"
+	previous_less_than_r13=$?
+}