Merge updates from master

38 files changed, 536 insertions, 66 deletions

diff --git a/app-admin/webalizer/webalizer-2.23.08-r1.ebuild b/app-admin/webalizer/webalizer-2.23.08-r1.ebuild
index 4599eb628b61..06ed7a36b4d5 100644
--- a/app-admin/webalizer/webalizer-2.23.08-r1.ebuild
+++ b/app-admin/webalizer/webalizer-2.23.08-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # uses webapp.eclass to create directories with right permissions
@@ -31,7 +31,7 @@ S="${WORKDIR}/${MY_P}"
 LICENSE="GPL-2"
 SLOT="0"
 KEYWORDS="~alpha amd64 ~arm ~hppa ppc ppc64 ~sparc x86"
-IUSE="bzip2 xtended geoip nls"
+IUSE="bzip2 xtended geoip nls selinux"
 
 DEPEND="
 	>=sys-libs/db-4.2:*
@@ -39,8 +39,12 @@ DEPEND="
 	>=media-libs/libpng-1.2:0=
 	>=media-libs/gd-1.8.3[png]
 	dev-libs/geoip
-	bzip2? ( app-arch/bzip2 )"
-RDEPEND="${DEPEND}"
+	bzip2? ( app-arch/bzip2 )
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-webalizer )
+"
 
 pkg_setup() {
 	webapp_pkg_setup
diff --git a/app-arch/dpkg/dpkg-1.20.12-r1.ebuild b/app-arch/dpkg/dpkg-1.20.12-r1.ebuild
index 47e490a6a164..bbf52c31d007 100644
--- a/app-arch/dpkg/dpkg-1.20.12-r1.ebuild
+++ b/app-arch/dpkg/dpkg-1.20.12-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -42,6 +42,8 @@ BDEPEND="
 		>=sys-devel/gettext-0.18.2
 	)
 "
+RDEPEND+=" selinux? ( sec-policy/selinux-dpkg )"
+
 DOCS=(
 	ChangeLog
 	THANKS
diff --git a/app-arch/dpkg/dpkg-1.21.15-r2.ebuild b/app-arch/dpkg/dpkg-1.21.15-r2.ebuild
index e4aff12c714a..c084bc5906ca 100644
--- a/app-arch/dpkg/dpkg-1.21.15-r2.ebuild
+++ b/app-arch/dpkg/dpkg-1.21.15-r2.ebuild
@@ -43,6 +43,7 @@ BDEPEND="
 		>=sys-devel/gettext-0.18.2
 	)
 "
+RDEPEND+=" selinux? ( sec-policy/selinux-dpkg )"
 
 PATCHES=(
 	"${FILESDIR}"/${PN}-1.18.12-flags.patch
diff --git a/app-arch/dpkg/dpkg-1.21.19.ebuild b/app-arch/dpkg/dpkg-1.21.19.ebuild
index 9853cc616b20..1e8d1390623c 100644
--- a/app-arch/dpkg/dpkg-1.21.19.ebuild
+++ b/app-arch/dpkg/dpkg-1.21.19.ebuild
@@ -44,6 +44,7 @@ BDEPEND="
 		>=sys-devel/gettext-0.18.2
 	)
 "
+RDEPEND+=" selinux? ( sec-policy/selinux-dpkg )"
 
 PATCHES=(
 	"${FILESDIR}"/${PN}-1.18.12-flags.patch
diff --git a/app-backup/amanda/amanda-3.5.1-r5.ebuild b/app-backup/amanda/amanda-3.5.1-r5.ebuild
index 77330631d602..a1851ada2afe 100644
--- a/app-backup/amanda/amanda-3.5.1-r5.ebuild
+++ b/app-backup/amanda/amanda-3.5.1-r5.ebuild
@@ -11,9 +11,9 @@ SRC_URI="mirror://sourceforge/amanda/${P}.tar.gz"
 
 LICENSE="HPND BSD BSD-2 GPL-2+ GPL-3+"
 SLOT="0"
-IUSE="curl gnuplot ipv6 kerberos minimal ndmp nls readline s3 samba systemd xfs"
-
+IUSE="curl gnuplot ipv6 kerberos minimal ndmp nls readline s3 samba selinux systemd xfs"
 KEYWORDS="amd64 ppc ppc64 ~sparc x86"
+
 DEPEND="
 	acct-group/amanda
 	acct-user/amanda
@@ -42,7 +42,10 @@ DEPEND="
 		virtual/mailx
 		gnuplot? ( sci-visualization/gnuplot )
 	)"
-RDEPEND="${DEPEND}"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-amanda )
+"
 BDEPEND="
 	app-text/docbook-xsl-stylesheets
 	app-text/docbook-xml-dtd
diff --git a/app-backup/bacula/bacula-13.0.3.ebuild b/app-backup/bacula/bacula-13.0.3.ebuild
index 31f0e4ddc989..2c66671d124f 100644
--- a/app-backup/bacula/bacula-13.0.3.ebuild
+++ b/app-backup/bacula/bacula-13.0.3.ebuild
@@ -15,7 +15,7 @@ SRC_URI="mirror://sourceforge/bacula/${MY_P}.tar.gz"
 LICENSE="AGPL-3"
 SLOT="0"
 KEYWORDS="~amd64 ~ppc ~sparc ~x86"
-IUSE="acl bacula-clientonly bacula-nodir bacula-nosd +batch-insert examples ipv6 logwatch mysql postgres qt5 readline +sqlite ssl static tcpd vim-syntax X"
+IUSE="acl bacula-clientonly bacula-nodir bacula-nosd +batch-insert examples ipv6 logwatch mysql postgres qt5 readline selinux +sqlite ssl static tcpd vim-syntax X"
 
 DEPEND="
 	!bacula-clientonly? (
@@ -64,6 +64,7 @@ RDEPEND="${DEPEND}
 			sys-block/mtx
 		)
 	)
+	selinux? ( sec-policy/selinux-bacula )
 	vim-syntax? ( || ( app-editors/vim app-editors/gvim ) )
 "
 
diff --git a/app-misc/vlock/metadata.xml b/app-misc/vlock/metadata.xml
index 6258504e5133..9c9e6b017abf 100644
--- a/app-misc/vlock/metadata.xml
+++ b/app-misc/vlock/metadata.xml
@@ -5,4 +5,7 @@
 		<email>shell-tools@gentoo.org</email>
 		<name>Gentoo Shell Tools Project</name>
 	</maintainer>
+	<upstream>
+		<remote-id type="github">WorMzy/vlock</remote-id>
+	</upstream>
 </pkgmetadata>
diff --git a/app-misc/vlock/vlock-2.2.3-r2.ebuild b/app-misc/vlock/vlock-2.2.3-r2.ebuild
index eef753337853..b980e22df4c0 100644
--- a/app-misc/vlock/vlock-2.2.3-r2.ebuild
+++ b/app-misc/vlock/vlock-2.2.3-r2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -14,7 +14,7 @@ SRC_URI="https://github.com/WorMzy/vlock/archive/${EGIT_COMMIT}.tar.gz -> ${P}.t
 LICENSE="GPL-2"
 SLOT="0"
 KEYWORDS="~alpha amd64 ~arm ~hppa ~ia64 ~mips ppc ppc64 sparc x86"
-IUSE="pam test"
+IUSE="pam selinux test"
 RESTRICT="!test? ( test )"
 
 COMMON_DEPEND="
@@ -30,6 +30,7 @@ DEPEND="
 RDEPEND="
 	${COMMON_DEPEND}
 	acct-group/vlock
+	selinux? ( sec-policy/selinux-vlock )
 "
 
 DOCS=( ChangeLog PLUGINS README README.X11 SECURITY STYLE TODO )
diff --git a/app-pda/usbmuxd/usbmuxd-1.1.1.ebuild b/app-pda/usbmuxd/usbmuxd-1.1.1.ebuild
index 3b9e4262a51e..30099a03f5d5 100644
--- a/app-pda/usbmuxd/usbmuxd-1.1.1.ebuild
+++ b/app-pda/usbmuxd/usbmuxd-1.1.1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -13,7 +13,7 @@ SRC_URI="https://github.com/libimobiledevice/usbmuxd/releases/download/${PV}/${P
 LICENSE="GPL-2 GPL-3 LGPL-2.1+"
 SLOT="0"
 KEYWORDS="amd64 ~arm ~ppc ~ppc64 x86"
-IUSE="systemd"
+IUSE="selinux systemd"
 
 DEPEND="
 	acct-user/usbmux
@@ -24,6 +24,7 @@ DEPEND="
 RDEPEND="
 	${DEPEND}
 	virtual/udev
+	selinux? ( sec-policy/selinux-usbmuxd )
 "
 
 BDEPEND="
diff --git a/app-text/dictd/dictd-1.13.0-r6.ebuild b/app-text/dictd/dictd-1.13.0-r6.ebuild
index 24de03a69b3b..fc52f063c6d4 100644
--- a/app-text/dictd/dictd-1.13.0-r6.ebuild
+++ b/app-text/dictd/dictd-1.13.0-r6.ebuild
@@ -12,7 +12,7 @@ SRC_URI="mirror://sourceforge/dict/${P}.tar.gz"
 LICENSE="GPL-1+ GPL-2+"
 SLOT="0"
 KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos"
-IUSE="dbi judy minimal test"
+IUSE="dbi judy minimal selinux test"
 RESTRICT="!test? ( test )"
 
 # <gawk-3.1.6 makes tests fail.
@@ -32,6 +32,7 @@ BDEPEND="
 	app-alternatives/yacc
 	test? ( !~sys-apps/gawk-4.2.1 )
 "
+RDEPEND+=" selinux? ( sec-policy/selinux-dictd )"
 
 DOC_CONTENTS="
 	To start and use ${PN} you need to emerge at least one dictionary from
diff --git a/dev-libs/openct/openct-0.6.20-r5.ebuild b/dev-libs/openct/openct-0.6.20-r5.ebuild
index b240704e94ee..c53d713b370a 100644
--- a/dev-libs/openct/openct-0.6.20-r5.ebuild
+++ b/dev-libs/openct/openct-0.6.20-r5.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -7,13 +7,12 @@ inherit autotools flag-o-matic udev
 
 DESCRIPTION="library for accessing smart card terminals"
 HOMEPAGE="https://github.com/OpenSC/openct/wiki"
-
 SRC_URI="mirror://sourceforge/opensc/${PN}/${P}.tar.gz"
-KEYWORDS="~alpha amd64 arm ~hppa ~ia64 ~m68k ~mips ppc ppc64 ~s390 sparc x86"
 
 LICENSE="LGPL-2.1"
 SLOT="0"
-IUSE="doc debug pcsc-lite usb"
+KEYWORDS="~alpha amd64 arm ~hppa ~ia64 ~m68k ~mips ppc ppc64 ~s390 sparc x86"
+IUSE="doc debug pcsc-lite selinux usb"
 
 DEPEND="
 	pcsc-lite? ( >=sys-apps/pcsc-lite-1.7.2-r1:= )
@@ -24,6 +23,7 @@ RDEPEND="
 	${DEPEND}
 	acct-group/openct
 	acct-user/openctd
+	selinux? ( sec-policy/selinux-openct )
 "
 BDEPEND="doc? ( app-doc/doxygen )"
 
diff --git a/dev-vcs/cvs/cvs-1.12.12-r14.ebuild b/dev-vcs/cvs/cvs-1.12.12-r14.ebuild
index 35880c743e8b..582b59739112 100644
--- a/dev-vcs/cvs/cvs-1.12.12-r14.ebuild
+++ b/dev-vcs/cvs/cvs-1.12.12-r14.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -17,14 +17,19 @@ LICENSE="GPL-2 LGPL-2"
 SLOT="0"
 KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-solaris"
 
-IUSE="crypt doc kerberos nls pam server"
+IUSE="crypt doc kerberos nls pam selinux server"
 RESTRICT="test"
 
-DEPEND=">=sys-libs/zlib-1.1.4
+DEPEND="
+	>=sys-libs/zlib-1.1.4
 	kerberos? ( virtual/krb5 )
 	pam? ( sys-libs/pam )
-	server? ( virtual/libcrypt:= )"
-RDEPEND="${DEPEND}"
+	server? ( virtual/libcrypt:= )
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-cvs )
+"
 
 src_unpack() {
 	unpack ${P}.tar.bz2
diff --git a/mail-client/evolution/evolution-3.48.3.ebuild b/mail-client/evolution/evolution-3.48.3.ebuild
index 915b9f86c631..ad31665982c8 100644
--- a/mail-client/evolution/evolution-3.48.3.ebuild
+++ b/mail-client/evolution/evolution-3.48.3.ebuild
@@ -12,7 +12,7 @@ HOMEPAGE="https://wiki.gnome.org/Apps/Evolution https://gitlab.gnome.org/GNOME/e
 LICENSE="|| ( LGPL-2 LGPL-3 ) CC-BY-SA-3.0 FDL-1.3+ OPENLDAP"
 SLOT="2.0"
 
-IUSE="archive +bogofilter geolocation gtk-doc highlight ldap spamassassin spell ssl +weather ytnef"
+IUSE="archive +bogofilter geolocation gtk-doc highlight ldap selinux spamassassin spell ssl +weather ytnef"
 
 KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
 
@@ -69,6 +69,7 @@ DEPEND="
 "
 RDEPEND="${DEPEND}
 	highlight? ( app-text/highlight )
+	selinux? ( sec-policy/selinux-evolution )
 "
 BDEPEND="
 	app-text/docbook-xml-dtd:4.1.2
diff --git a/mail-filter/amavisd-new/amavisd-new-2.12.2.ebuild b/mail-filter/amavisd-new/amavisd-new-2.12.2.ebuild
index 26ed77e5373a..9946e2926b68 100644
--- a/mail-filter/amavisd-new/amavisd-new-2.12.2.ebuild
+++ b/mail-filter/amavisd-new/amavisd-new-2.12.2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -12,7 +12,7 @@ SRC_URI="https://gitlab.com/amavis/amavis/-/archive/v${PV}/amavis-v${PV}.tar.bz2
 LICENSE="GPL-2 BSD-2"
 SLOT="0"
 KEYWORDS="amd64 ppc ppc64 sparc x86"
-IUSE="clamav courier dkim ldap mysql postgres qmail razor rspamd rspamd-https snmp spamassassin"
+IUSE="clamav courier dkim ldap mysql postgres qmail razor rspamd rspamd-https selinux snmp spamassassin"
 
 MY_RSPAMD_DEPEND="dev-perl/HTTP-Message
 	dev-perl/JSON
@@ -68,6 +68,7 @@ RDEPEND="${DEPEND}
 	rspamd-https? ( ${MY_RSPAMD_DEPEND}
 		dev-perl/LWP-Protocol-https
 		dev-perl/Net-SSLeay )
+	selinux? ( sec-policy/selinux-amavis )
 	snmp? ( net-analyzer/net-snmp[perl] )
 	spamassassin? ( mail-filter/spamassassin dev-perl/Image-Info )"
 
diff --git a/mail-filter/amavisd-new/metadata.xml b/mail-filter/amavisd-new/metadata.xml
index 102bbb9bf7c9..564c4ee745b7 100644
--- a/mail-filter/amavisd-new/metadata.xml
+++ b/mail-filter/amavisd-new/metadata.xml
@@ -11,4 +11,7 @@
 		<flag name="rspamd-https">Add support for <pkg>mail-filter/rspamd</pkg> extension (both HTTP and HTTPS)</flag>
 		<flag name="spamassassin">Add support for <pkg>mail-filter/spamassassin</pkg></flag>
 	</use>
+	<upstream>
+		<remote-id type="gitlab">amavis/amavis</remote-id>
+	</upstream>
 </pkgmetadata>
diff --git a/mail-filter/pyzor/pyzor-1.0.0_p20211223.ebuild b/mail-filter/pyzor/pyzor-1.0.0_p20211223.ebuild
index a2e78f468788..6c6ce3b2abe0 100644
--- a/mail-filter/pyzor/pyzor-1.0.0_p20211223.ebuild
+++ b/mail-filter/pyzor/pyzor-1.0.0_p20211223.ebuild
@@ -16,7 +16,7 @@ S="${WORKDIR}/${PN}-${MY_COMMIT}"
 LICENSE="GPL-2"
 SLOT="0"
 KEYWORDS="~alpha amd64 ~hppa ~ia64 ~ppc ppc64 ~sparc x86 ~amd64-linux ~x86-linux"
-IUSE="doc gdbm mysql pyzord redis test"
+IUSE="doc gdbm mysql pyzord redis selinux test"
 RESTRICT="!test? ( test )"
 
 RDEPEND="
@@ -24,7 +24,9 @@ RDEPEND="
 		gdbm? ( $(python_gen_impl_dep 'gdbm') )
 		mysql? ( dev-python/mysqlclient[${PYTHON_USEDEP}] )
 		redis? ( dev-python/redis[${PYTHON_USEDEP}] )
-	)"
+	)
+	selinux? ( sec-policy/selinux-pyzor )
+"
 DEPEND="
 	test? (
 		gdbm? ( $(python_gen_impl_dep 'gdbm') )
diff --git a/mail-mta/sendmail/sendmail-8.17.1.9.ebuild b/mail-mta/sendmail/sendmail-8.17.1.9.ebuild
index a136caf3c842..5a8859e306d1 100644
--- a/mail-mta/sendmail/sendmail-8.17.1.9.ebuild
+++ b/mail-mta/sendmail/sendmail-8.17.1.9.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -21,7 +21,7 @@ fi
 LICENSE="Sendmail GPL-2" # GPL-2 is here for initscript
 SLOT="0"
 KEYWORDS="~alpha amd64 arm hppa ~ia64 ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="ipv6 ldap mbox nis sasl sockets ssl tcpd"
+IUSE="ipv6 ldap mbox nis sasl selinux sockets ssl tcpd"
 
 DEPEND="
 	acct-group/smmsp
@@ -49,6 +49,7 @@ RDEPEND="
 	!mail-mta/qmail-ldap
 	!>=mail-mta/ssmtp-2.64-r2[mta]
 	!net-mail/vacation
+	selinux? ( sec-policy/selinux-sendmail )
 "
 BDEPEND="
 	sys-devel/m4
diff --git a/net-analyzer/calamaris/calamaris-2.99.4.5.ebuild b/net-analyzer/calamaris/calamaris-2.99.4.5.ebuild
index 446233781cb7..658b1514c2ec 100644
--- a/net-analyzer/calamaris/calamaris-2.99.4.5.ebuild
+++ b/net-analyzer/calamaris/calamaris-2.99.4.5.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2020 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -10,10 +10,12 @@ SRC_URI="https://cord.de/files/${PN}/${P}.tar.gz"
 LICENSE="GPL-2"
 SLOT="0"
 KEYWORDS="~amd64 ~arm ~ppc ~x86"
+IUSE="selinux"
 
 RDEPEND="
 	dev-lang/perl
 	dev-perl/GDGraph
+	selinux? ( sec-policy/selinux-calamaris )
 "
 
 src_prepare() {
diff --git a/net-analyzer/zabbix/Manifest b/net-analyzer/zabbix/Manifest
index fec9ed2ce8b4..e36aadc3f9fd 100644
--- a/net-analyzer/zabbix/Manifest
+++ b/net-analyzer/zabbix/Manifest
@@ -19,3 +19,5 @@ DIST zabbix-6.4.2-go-deps.tar.xz 21577064 BLAKE2B 5a695f354b9fab5af34529fdd2d532
 DIST zabbix-6.4.2.tar.gz 43141377 BLAKE2B 3d20de6b203d7f04bc90d23a989f7a0f2d85de26d144eb22d4326b056e37a995283105d270f30902c21a167b4421f3929949268f0361107c8efb5a3c22ba41b7 SHA512 72b8842444aade42519d78856231024c1587ad9076ef21597a2dde580a49b99ea884a62508ebb1c08d883430b911a54d8a5f8421bee0d9e99b3610342191632f
 DIST zabbix-6.4.3-go-deps.tar.xz 21580912 BLAKE2B a8d67ca707ebc0b7c873ebc9210643c8409975931e316556ceb47fd8e89eb998a13b7581643f4031de3d1d167e860752edb4589ea4d89037f18b2c14423d954c SHA512 277271b2a15e3fb04a1e30dcfe4b499f874d93e2509283b5acf2b6380f1ad4fb2627d8021c401076277d84f1a2031f6bfae285cbd4e6f2f45ec7daa42294bc59
 DIST zabbix-6.4.3.tar.gz 43369742 BLAKE2B a19cc8fa1fec26b152f84427394d1e1dd947aae62bce69eeb0f7cb3326d84a9eae9e79f17e7583cef36fbb7c6f39560ee0c495cfa61eaf9983238618bb33c406 SHA512 ddb90a0a7699a7cf007ee2efcbc807e573221b92bf4fb104b8dfb07355d79235b5bbd1aae8c70a7edcc42555b5f182230057162cf2bd899ba4b62ed433711f69
+DIST zabbix-6.4.4-go-deps.tar.xz 21588740 BLAKE2B 4f02c2c6fbfc44ec65bd697a1494dae26d528ce18bc060939e8a86bfcee1bf513dfe51440338c0ca0209ac260abff429da6ba0f9e6c381c96ac96cd8cc7f0d9f SHA512 ce0c2f4df1c42c45db7b3f42c75973f01b83996eb1f04b7d456ee6e5b7fab99a4ed224d7bab7ac4d9ed37fd35fbbee4f40ba826849a9c4007044384310c50b09
+DIST zabbix-6.4.4.tar.gz 43403307 BLAKE2B c6616045da913aa681543d038348f5273853621ee698e21fbf196935d4ef16f6c18052ca5f9b00526d0fb0710e833a24b7fac8987affb19f2e836a5c3426f366 SHA512 f01fb33707e16a2784fbc4102222418277eb4abf4d83d01f7981b0bf085c2db8510362366c4f2bbd69790a3da5a8e563415d6b3dd36a70c1cf94f8b57ee9e283
diff --git a/net-analyzer/zabbix/zabbix-4.0.46.ebuild b/net-analyzer/zabbix/zabbix-4.0.46.ebuild
index c15a63c282db..249e6dc9f35f 100644
--- a/net-analyzer/zabbix/zabbix-4.0.46.ebuild
+++ b/net-analyzer/zabbix/zabbix-4.0.46.ebuild
@@ -16,7 +16,7 @@ LICENSE="GPL-2"
 SLOT="0/$(ver_cut 1-2)"
 WEBAPP_MANUAL_SLOT="yes"
 KEYWORDS="~amd64 ~x86"
-IUSE="+agent curl frontend gnutls ipv6 java ldap libxml2 mbedtls mysql odbc openipmi +openssl oracle +postgres proxy server snmp sqlite ssh static xmpp"
+IUSE="+agent curl frontend gnutls ipv6 java ldap libxml2 mbedtls mysql odbc openipmi +openssl oracle +postgres proxy selinux server snmp sqlite ssh static xmpp"
 REQUIRED_USE="|| ( agent frontend proxy server )
 	?? ( gnutls mbedtls openssl )
 	proxy? ( ^^ ( mysql oracle postgres sqlite ) )
@@ -63,6 +63,7 @@ RDEPEND="${COMMON_DEPEND}
 		dev-libs/libpcre
 		net-analyzer/fping[suid]
 	)
+	selinux? ( sec-policy/selinux-zabbix )
 	server? (
 		app-admin/webapp-config
 		dev-libs/libpcre
diff --git a/net-analyzer/zabbix/zabbix-5.0.35.ebuild b/net-analyzer/zabbix/zabbix-5.0.35.ebuild
index 6e481bc98c71..ec1e25bbcd14 100644
--- a/net-analyzer/zabbix/zabbix-5.0.35.ebuild
+++ b/net-analyzer/zabbix/zabbix-5.0.35.ebuild
@@ -25,7 +25,7 @@ LICENSE="GPL-2"
 SLOT="0/$(ver_cut 1-2)"
 WEBAPP_MANUAL_SLOT="yes"
 KEYWORDS="~amd64 ~x86"
-IUSE="+agent +agent2 curl frontend gnutls ipv6 java ldap libxml2 mysql odbc openipmi +openssl oracle +postgres proxy server snmp sqlite ssh static"
+IUSE="+agent +agent2 curl frontend gnutls ipv6 java ldap libxml2 mysql odbc openipmi +openssl oracle +postgres proxy selinux server snmp sqlite ssh static"
 REQUIRED_USE="|| ( agent agent2 frontend proxy server )
 	?? ( gnutls openssl )
 	proxy? ( ^^ ( mysql oracle postgres sqlite ) )
@@ -70,6 +70,7 @@ RDEPEND="${COMMON_DEPEND}
 		dev-libs/libpcre
 		net-analyzer/fping[suid]
 	)
+	selinux? ( sec-policy/selinux-zabbix )
 	server? (
 		app-admin/webapp-config
 		dev-libs/libpcre
diff --git a/net-analyzer/zabbix/zabbix-6.0.18.ebuild b/net-analyzer/zabbix/zabbix-6.0.18.ebuild
index 1404fe7a2c48..e5e5f002a22e 100644
--- a/net-analyzer/zabbix/zabbix-6.0.18.ebuild
+++ b/net-analyzer/zabbix/zabbix-6.0.18.ebuild
@@ -25,7 +25,7 @@ LICENSE="GPL-2"
 SLOT="0/$(ver_cut 1-2)"
 WEBAPP_MANUAL_SLOT="yes"
 KEYWORDS="~amd64 ~x86"
-IUSE="agent +agent2 curl frontend gnutls ipv6 java ldap libxml2 mysql odbc openipmi +openssl oracle +postgres proxy server snmp sqlite ssh static"
+IUSE="agent +agent2 curl frontend gnutls ipv6 java ldap libxml2 mysql odbc openipmi +openssl oracle +postgres proxy selinux server snmp sqlite ssh static"
 REQUIRED_USE="|| ( agent agent2 frontend proxy server )
 	?? ( gnutls openssl )
 	proxy? ( ^^ ( mysql oracle postgres sqlite ) )
@@ -70,6 +70,7 @@ RDEPEND="${COMMON_DEPEND}
 		dev-libs/libpcre2:=
 		net-analyzer/fping[suid]
 	)
+	selinux? ( sec-policy/selinux-zabbix )
 	server? (
 		app-admin/webapp-config
 		dev-libs/libpcre2:=
diff --git a/net-analyzer/zabbix/zabbix-6.4.3.ebuild b/net-analyzer/zabbix/zabbix-6.4.3.ebuild
index e43f9f4d55ac..2423117090ed 100644
--- a/net-analyzer/zabbix/zabbix-6.4.3.ebuild
+++ b/net-analyzer/zabbix/zabbix-6.4.3.ebuild
@@ -25,7 +25,7 @@ LICENSE="GPL-2"
 SLOT="0/$(ver_cut 1-2)"
 WEBAPP_MANUAL_SLOT="yes"
 KEYWORDS="~amd64 ~x86"
-IUSE="agent +agent2 curl frontend gnutls ipv6 java ldap libxml2 mysql odbc openipmi +openssl oracle +postgres proxy server snmp sqlite ssh static"
+IUSE="agent +agent2 curl frontend gnutls ipv6 java ldap libxml2 mysql odbc openipmi +openssl oracle +postgres proxy selinux server snmp sqlite ssh static"
 REQUIRED_USE="|| ( agent agent2 frontend proxy server )
 	?? ( gnutls openssl )
 	proxy? ( ^^ ( mysql oracle postgres sqlite ) )
@@ -70,6 +70,7 @@ RDEPEND="${COMMON_DEPEND}
 		dev-libs/libpcre2:=
 		net-analyzer/fping[suid]
 	)
+	selinux? ( sec-policy/selinux-zabbix )
 	server? (
 		app-admin/webapp-config
 		dev-libs/libpcre2:=
diff --git a/net-analyzer/zabbix/zabbix-6.4.4.ebuild b/net-analyzer/zabbix/zabbix-6.4.4.ebuild
new file mode 100644
index 000000000000..e43f9f4d55ac
--- /dev/null
+++ b/net-analyzer/zabbix/zabbix-6.4.4.ebuild
@@ -0,0 +1,401 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# To create the go modules tarball:
+#   cd src/go
+#   GOMODCACHE="${PWD}"/go-mod go mod download -modcacherw
+#   tar -acf zabbix-${PV}-go-deps.tar.xz go-mod
+
+EAPI=8
+
+GO_OPTIONAL="yes"
+# needed to make webapp-config dep optional
+WEBAPP_OPTIONAL="yes"
+inherit webapp java-pkg-opt-2 systemd tmpfiles toolchain-funcs go-module user-info
+
+DESCRIPTION="ZABBIX is software for monitoring of your applications, network and servers"
+HOMEPAGE="https://www.zabbix.com/"
+MY_P=${P/_/}
+MY_PV=${PV/_/}
+SRC_URI="https://cdn.zabbix.com/${PN}/sources/stable/$(ver_cut 1-2)/${P}.tar.gz
+	agent2? ( https://dev.gentoo.org/~fordfrog/distfiles/${P}-go-deps.tar.xz )
+"
+
+LICENSE="GPL-2"
+SLOT="0/$(ver_cut 1-2)"
+WEBAPP_MANUAL_SLOT="yes"
+KEYWORDS="~amd64 ~x86"
+IUSE="agent +agent2 curl frontend gnutls ipv6 java ldap libxml2 mysql odbc openipmi +openssl oracle +postgres proxy server snmp sqlite ssh static"
+REQUIRED_USE="|| ( agent agent2 frontend proxy server )
+	?? ( gnutls openssl )
+	proxy? ( ^^ ( mysql oracle postgres sqlite ) )
+	server? ( ^^ ( mysql oracle postgres ) !sqlite )
+	static? ( !oracle !snmp )"
+
+COMMON_DEPEND="
+	curl? ( net-misc/curl )
+	gnutls? ( net-libs/gnutls:0= )
+	java? ( >=virtual/jdk-1.8:* )
+	ldap? (
+		=dev-libs/cyrus-sasl-2*
+		net-libs/gnutls:=
+		net-nds/openldap:=
+	)
+	libxml2? ( dev-libs/libxml2 )
+	mysql? ( dev-db/mysql-connector-c:= )
+	odbc? ( dev-db/unixODBC )
+	openipmi? ( sys-libs/openipmi )
+	openssl? ( dev-libs/openssl:=[-bindist(-)] )
+	oracle? ( dev-db/oracle-instantclient[odbc,sdk] )
+	postgres? ( dev-db/postgresql:* )
+	proxy?  (
+		dev-libs/libevent:=
+		sys-libs/zlib
+	)
+	server? (
+		dev-libs/libevent:=
+		sys-libs/zlib
+	)
+	snmp? ( net-analyzer/net-snmp:= )
+	sqlite? ( dev-db/sqlite )
+	ssh? ( net-libs/libssh2 )
+"
+
+RDEPEND="${COMMON_DEPEND}
+	acct-group/zabbix
+	acct-user/zabbix
+	java? ( >=virtual/jre-1.8:* )
+	mysql? ( virtual/mysql )
+	proxy? (
+		dev-libs/libpcre2:=
+		net-analyzer/fping[suid]
+	)
+	server? (
+		app-admin/webapp-config
+		dev-libs/libpcre2:=
+		net-analyzer/fping[suid]
+	)
+	frontend? (
+		app-admin/webapp-config
+		dev-lang/php:*[bcmath,ctype,sockets,gd,truetype,xml,session,xmlreader,xmlwriter,nls,sysvipc,unicode]
+		media-libs/gd[png]
+		virtual/httpd-php:*
+		mysql? ( dev-lang/php[mysqli] )
+		odbc? ( dev-lang/php[odbc] )
+		oracle? ( dev-lang/php[oci8-instant-client] )
+		postgres? ( dev-lang/php[postgres] )
+		sqlite? ( dev-lang/php[sqlite] )
+	)
+"
+DEPEND="${COMMON_DEPEND}
+	static? (
+		curl? ( net-misc/curl[static-libs] )
+		ldap? (
+			=dev-libs/cyrus-sasl-2*[static-libs]
+			net-libs/gnutls[static-libs]
+			net-nds/openldap[static-libs]
+		)
+		libxml2? ( dev-libs/libxml2[static-libs] )
+		mysql? ( dev-db/mysql-connector-c[static-libs] )
+		odbc? ( dev-db/unixODBC[static-libs] )
+		postgres? ( dev-db/postgresql:*[static-libs] )
+		sqlite? ( dev-db/sqlite[static-libs] )
+		ssh? ( net-libs/libssh2 )
+	)
+"
+BDEPEND="
+	virtual/pkgconfig
+	agent2? (
+		>=dev-lang/go-1.12
+		app-arch/unzip
+	)
+"
+
+# upstream tests fail for agent2
+RESTRICT="test"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-4.0.18-modulepathfix.patch"
+	"${FILESDIR}/${PN}-3.0.30-security-disable-PidFile.patch"
+	"${FILESDIR}/${PN}-6.4.0-configure-sscanf.patch"
+)
+
+S=${WORKDIR}/${MY_P}
+
+ZABBIXJAVA_BASE="opt/zabbix_java"
+
+pkg_setup() {
+	if use oracle; then
+		if [ -z "${ORACLE_HOME}" ]; then
+			eerror
+			eerror "The environment variable ORACLE_HOME must be set"
+			eerror "and point to the correct location."
+			eerror "It looks like you don't have Oracle installed."
+			eerror
+			die "Environment variable ORACLE_HOME is not set"
+		fi
+	fi
+
+	if use frontend; then
+		webapp_pkg_setup
+	fi
+
+	java-pkg-opt-2_pkg_setup
+}
+
+src_prepare() {
+	default
+}
+
+src_configure() {
+	local econf_args=(
+		--with-libpcre2
+		"$(use_enable agent)"
+		"$(use_enable agent2)"
+		"$(use_enable ipv6)"
+		"$(use_enable java)"
+		"$(use_enable proxy)"
+		"$(use_enable server)"
+		"$(use_enable static)"
+		"$(use_with curl libcurl)"
+		"$(use_with gnutls)"
+		"$(use_with ldap)"
+		"$(use_with libxml2)"
+		"$(use_with mysql)"
+		"$(use_with odbc unixodbc)"
+		"$(use_with openipmi openipmi)"
+		"$(use_with openssl)"
+		"$(use_with oracle)"
+		"$(use_with postgres postgresql)"
+		"$(use_with snmp net-snmp)"
+		"$(use_with sqlite sqlite3)"
+		"$(use_with ssh ssh2)"
+	)
+
+	econf ${econf_args[@]}
+}
+
+src_compile() {
+	if [ -f Makefile ] || [ -f GNUmakefile ] || [ -f makefile ]; then
+		emake AR="$(tc-getAR)" RANLIB="$(tc-getRANLIB)"
+	fi
+}
+
+src_install() {
+	local dirs=(
+		/etc/zabbix
+		/var/lib/zabbix
+		/var/lib/zabbix/home
+		/var/lib/zabbix/scripts
+		/var/lib/zabbix/alertscripts
+		/var/lib/zabbix/externalscripts
+		/var/log/zabbix
+	)
+
+	for dir in "${dirs[@]}"; do
+		keepdir "${dir}"
+	done
+
+	if use server; then
+		insinto /etc/zabbix
+		doins "${S}"/conf/zabbix_server.conf
+		fperms 0640 /etc/zabbix/zabbix_server.conf
+		fowners root:zabbix /etc/zabbix/zabbix_server.conf
+
+		newinitd "${FILESDIR}"/zabbix-server-r1.init zabbix-server
+
+		dosbin src/zabbix_server/zabbix_server
+
+		insinto /usr/share/zabbix
+		doins -r "${S}"/database/
+
+		systemd_dounit "${FILESDIR}"/zabbix-server.service
+		newtmpfiles "${FILESDIR}"/zabbix-server.tmpfiles zabbix-server.conf
+	fi
+
+	if use proxy; then
+		insinto /etc/zabbix
+		doins "${S}"/conf/zabbix_proxy.conf
+		fperms 0640 /etc/zabbix/zabbix_proxy.conf
+		fowners root:zabbix /etc/zabbix/zabbix_proxy.conf
+
+		newinitd "${FILESDIR}"/zabbix-proxy.init zabbix-proxy
+
+		dosbin src/zabbix_proxy/zabbix_proxy
+
+		insinto /usr/share/zabbix
+		doins -r "${S}"/database/
+
+		systemd_dounit "${FILESDIR}"/zabbix-proxy.service
+		newtmpfiles "${FILESDIR}"/zabbix-proxy.tmpfiles zabbix-proxy.conf
+	fi
+
+	if use agent; then
+		insinto /etc/zabbix
+		doins "${S}"/conf/zabbix_agentd.conf
+		fperms 0640 /etc/zabbix/zabbix_agentd.conf
+		fowners root:zabbix /etc/zabbix/zabbix_agentd.conf
+
+		newinitd "${FILESDIR}"/zabbix-agentd.init zabbix-agentd
+
+		dosbin src/zabbix_agent/zabbix_agentd
+		dobin \
+			src/zabbix_sender/zabbix_sender \
+			src/zabbix_get/zabbix_get
+
+		systemd_dounit "${FILESDIR}"/zabbix-agentd.service
+		newtmpfiles "${FILESDIR}"/zabbix-agentd.tmpfiles zabbix-agentd.conf
+	fi
+	if use agent2; then
+		insinto /etc/zabbix
+		doins "${S}"/src/go/conf/zabbix_agent2.conf
+		fperms 0640 /etc/zabbix/zabbix_agent2.conf
+		fowners root:zabbix /etc/zabbix/zabbix_agent2.conf
+		keepdir /etc/zabbix/zabbix_agent2.d/plugins.d
+
+		newinitd "${FILESDIR}"/zabbix-agent2.init zabbix-agent2
+
+		dosbin src/go/bin/zabbix_agent2
+
+		systemd_dounit "${FILESDIR}"/zabbix-agent2.service
+		newtmpfiles "${FILESDIR}"/zabbix-agent2.tmpfiles zabbix-agent2.conf
+	fi
+
+	fowners root:zabbix /etc/zabbix
+	fowners zabbix:zabbix \
+		/var/lib/zabbix \
+		/var/lib/zabbix/home \
+		/var/lib/zabbix/scripts \
+		/var/lib/zabbix/alertscripts \
+		/var/lib/zabbix/externalscripts \
+		/var/log/zabbix
+	fperms 0750 \
+		/etc/zabbix \
+		/var/lib/zabbix \
+		/var/lib/zabbix/home \
+		/var/lib/zabbix/scripts \
+		/var/lib/zabbix/alertscripts \
+		/var/lib/zabbix/externalscripts \
+		/var/log/zabbix
+
+	dodoc README INSTALL NEWS ChangeLog \
+		conf/zabbix_agentd.conf \
+		conf/zabbix_proxy.conf \
+		conf/zabbix_agentd/userparameter_examples.conf \
+		conf/zabbix_agentd/userparameter_mysql.conf \
+		conf/zabbix_server.conf
+
+	if use frontend; then
+		webapp_src_preinst
+		cp -R ui/* "${D}/${MY_HTDOCSDIR}"
+		webapp_configfile \
+			"${MY_HTDOCSDIR}"/include/db.inc.php \
+			"${MY_HTDOCSDIR}"/include/config.inc.php
+		webapp_src_install
+	fi
+
+	if use java; then
+		dodir \
+			/${ZABBIXJAVA_BASE} \
+			/${ZABBIXJAVA_BASE}/bin \
+			/${ZABBIXJAVA_BASE}/lib
+		keepdir /${ZABBIXJAVA_BASE}
+		exeinto /${ZABBIXJAVA_BASE}/bin
+		doexe src/zabbix_java/bin/zabbix-java-gateway-"${MY_PV}".jar
+		exeinto /${ZABBIXJAVA_BASE}/lib
+		doexe \
+			src/zabbix_java/lib/logback-classic-1.2.9.jar \
+			src/zabbix_java/lib/logback-console.xml \
+			src/zabbix_java/lib/logback-core-1.2.9.jar \
+			src/zabbix_java/lib/logback.xml \
+			src/zabbix_java/lib/android-json-4.3_r3.1.jar \
+			src/zabbix_java/lib/slf4j-api-1.7.32.jar
+		newinitd "${FILESDIR}"/zabbix-jmx-proxy.init zabbix-jmx-proxy
+		newconfd "${FILESDIR}"/zabbix-jmx-proxy.conf zabbix-jmx-proxy
+	fi
+}
+
+pkg_postinst() {
+	if use server || use proxy ; then
+		elog
+		elog "You may need to configure your database for Zabbix"
+		elog "if you have not already done so."
+		elog
+
+		zabbix_homedir=$(egethome zabbix)
+		if [ -n "${zabbix_homedir}" ] && \
+			[ "${zabbix_homedir}" != "/var/lib/zabbix/home" ]; then
+			ewarn
+			ewarn "The user 'zabbix' should have his homedir changed"
+			ewarn "to /var/lib/zabbix/home if you want to use"
+			ewarn "custom alert scripts."
+			ewarn
+			ewarn "A real homedir might be needed for configfiles"
+			ewarn "for custom alert scripts."
+			ewarn
+			ewarn "To change the homedir use:"
+			ewarn "  usermod -d /var/lib/zabbix/home zabbix"
+			ewarn
+		fi
+	fi
+
+	if use server; then
+		tmpfiles_process zabbix-server.conf
+
+		elog
+		elog "For distributed monitoring you have to run:"
+		elog
+		elog "zabbix_server -n <nodeid>"
+		elog
+		elog "This will convert database data for use with Node ID"
+		elog "and also adds a local node."
+		elog
+	fi
+
+	if use proxy; then
+		tmpfiles_process zabbix-proxy.conf
+	fi
+
+	if use agent; then
+		tmpfiles_process zabbix-agentd.conf
+	fi
+
+	if use agent2; then
+		tmpfiles_process zabbix-agent2.conf
+	fi
+
+	elog "--"
+	elog
+	elog "You may need to add these lines to /etc/services:"
+	elog
+	elog "zabbix-agent     10050/tcp Zabbix Agent"
+	elog "zabbix-agent     10050/udp Zabbix Agent"
+	elog "zabbix-trapper   10051/tcp Zabbix Trapper"
+	elog "zabbix-trapper   10051/udp Zabbix Trapper"
+	elog
+
+	if use server || use proxy ; then
+		# check for fping
+		fping_perms=$(stat -c %a /usr/sbin/fping 2>/dev/null)
+		case "${fping_perms}" in
+			4[157][157][157])
+				;;
+			*)
+				ewarn
+				ewarn "If you want to use the checks 'icmpping' and 'icmppingsec',"
+				ewarn "you have to make /usr/sbin/fping setuid root and executable"
+				ewarn "by everyone. Run the following command to fix it:"
+				ewarn
+				ewarn "  chmod u=rwsx,g=rx,o=rx /usr/sbin/fping"
+				ewarn
+				ewarn "Please be aware that this might impose a security risk,"
+				ewarn "depending on the code quality of fping."
+				ewarn
+				;;
+		esac
+	fi
+}
+
+pkg_prerm() {
+	(use frontend || use server) && webapp_pkg_prerm
+}
diff --git a/net-dialup/freeradius/freeradius-3.2.2.ebuild b/net-dialup/freeradius/freeradius-3.2.2.ebuild
index c42360c89bca..00ea3f5bc11d 100644
--- a/net-dialup/freeradius/freeradius-3.2.2.ebuild
+++ b/net-dialup/freeradius/freeradius-3.2.2.ebuild
@@ -22,7 +22,7 @@ KEYWORDS="amd64 ~arm arm64 ~ppc ~ppc64 ~sparc x86"
 
 IUSE="
 	debug firebird iodbc kerberos ldap memcached mysql mongodb odbc oracle pam
-	postgres python readline redis samba sqlite ssl systemd
+	postgres python readline redis samba selinux sqlite ssl systemd
 "
 
 RESTRICT="firebird? ( bindist )"
@@ -37,7 +37,8 @@ RESTRICT="firebird? ( bindist )"
 # TODO: unconditional json-c for now as automagic dep despite efforts to stop it
 # ditto libpcap. Can restore USE=rest, USE=pcap if/when fixed.
 
-RDEPEND="acct-group/radius
+DEPEND="
+	acct-group/radius
 	acct-user/radius
 	!net-dialup/cistronradius
 	dev-libs/libltdl
@@ -67,8 +68,12 @@ RDEPEND="acct-group/radius
 	samba? ( net-fs/samba )
 	sqlite? ( dev-db/sqlite:3 )
 	ssl? ( >=dev-libs/openssl-1.0.2:=[-bindist(-)] )
-	systemd? ( sys-apps/systemd:= )"
-DEPEND="${RDEPEND}"
+	systemd? ( sys-apps/systemd:= )
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-radius )
+"
 
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 
diff --git a/net-fs/openafs/openafs-1.8.7.ebuild b/net-fs/openafs/openafs-1.8.7.ebuild
index d56c1e3f22b4..dc0591d62b80 100644
--- a/net-fs/openafs/openafs-1.8.7.ebuild
+++ b/net-fs/openafs/openafs-1.8.7.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -26,7 +26,7 @@ SLOT="0"
 KEYWORDS="amd64 -riscv ~sparc x86 ~amd64-linux ~x86-linux"
 
 IUSE="apidoc bitmap-later debug doc fuse kauth kerberos +modules +namei
-ncurses perl +pthreaded-ubik +supergroups tsm ubik-read-while-write"
+ncurses perl +pthreaded-ubik selinux +supergroups tsm ubik-read-while-write"
 
 BDEPEND="
 	dev-lang/perl
@@ -57,7 +57,9 @@ DEPEND="
 	kauth? ( sys-libs/pam )
 	kerberos? ( virtual/krb5 )
 	ncurses? ( sys-libs/ncurses:0= )"
-RDEPEND="${DEPEND}"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-afs )"
 
 S="${WORKDIR}/${MY_P}"
 
diff --git a/net-fs/openafs/openafs-1.8.8.1-r1.ebuild b/net-fs/openafs/openafs-1.8.8.1-r1.ebuild
index 8e3c091a6aca..5ed40f6c700e 100644
--- a/net-fs/openafs/openafs-1.8.8.1-r1.ebuild
+++ b/net-fs/openafs/openafs-1.8.8.1-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -26,7 +26,7 @@ SLOT="0"
 KEYWORDS="~amd64 -riscv ~sparc ~x86 ~amd64-linux ~x86-linux"
 
 IUSE="apidoc bitmap-later debug doc fuse kauth kerberos +modules +namei
-ncurses perl +pthreaded-ubik +supergroups tsm ubik-read-while-write"
+ncurses perl +pthreaded-ubik selinux +supergroups tsm ubik-read-while-write"
 
 BDEPEND="
 	dev-lang/perl
@@ -58,7 +58,9 @@ DEPEND="
 	kauth? ( sys-libs/pam )
 	kerberos? ( virtual/krb5 )
 	ncurses? ( sys-libs/ncurses:0= )"
-RDEPEND="${DEPEND}"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-afs )"
 
 S="${WORKDIR}/${MY_P}"
 
diff --git a/net-mail/fetchmail/fetchmail-6.4.37.ebuild b/net-mail/fetchmail/fetchmail-6.4.37.ebuild
index dde853d803e1..fcfe5be8e090 100644
--- a/net-mail/fetchmail/fetchmail-6.4.37.ebuild
+++ b/net-mail/fetchmail/fetchmail-6.4.37.ebuild
@@ -12,7 +12,7 @@ SRC_URI="mirror://sourceforge/${PN}/${P}.tar.xz"
 LICENSE="GPL-2 public-domain"
 SLOT="0"
 KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-solaris"
-IUSE="ssl nls kerberos tk socks"
+IUSE="ssl nls kerberos tk selinux socks"
 
 RDEPEND="acct-user/fetchmail
 	ssl? (
@@ -29,6 +29,7 @@ DEPEND="${RDEPEND}
 	app-arch/xz-utils
 	sys-devel/flex
 	nls? ( sys-devel/gettext )"
+RDEPEND+=" selinux? ( sec-policy/selinux-fetchmail )"
 
 DOCS="FAQ FEATURES NEWS NOTES README README.NTLM README.SSL* TODO"
 HTML_DOCS="*.html"
diff --git a/net-misc/nx/nx-3.5.99.26.ebuild b/net-misc/nx/nx-3.5.99.26.ebuild
index 5aa7cefa7174..01e20ce031b4 100644
--- a/net-misc/nx/nx-3.5.99.26.ebuild
+++ b/net-misc/nx/nx-3.5.99.26.ebuild
@@ -6,12 +6,12 @@ inherit autotools toolchain-funcs
 
 DESCRIPTION="NX compression technology core libraries"
 HOMEPAGE="https://github.com/ArcticaProject/nx-libs"
-
 SRC_URI="https://github.com/ArcticaProject/nx-libs/archive/${PV}.tar.gz -> nx-libs-${PV}.tar.gz"
 
 LICENSE="GPL-2"
 SLOT="0"
 KEYWORDS="amd64 ~arm64 ~ppc ~riscv x86"
+IUSE="selinux"
 
 RDEPEND="dev-libs/libxml2
 	media-libs/libjpeg-turbo:*
@@ -39,6 +39,8 @@ BDEPEND="virtual/pkgconfig
 	x11-misc/gccmakedep
 	x11-misc/imake"
 
+RDEPEND+=" selinux? ( sec-policy/selinux-nx )"
+
 S="${WORKDIR}/nx-libs-${PV}"
 
 PATCHES=(
diff --git a/net-proxy/lyrebird/lyrebird-0.1.0.ebuild b/net-proxy/lyrebird/lyrebird-0.1.0.ebuild
index 34cb1326cb3f..a6d7ea8ca8aa 100644
--- a/net-proxy/lyrebird/lyrebird-0.1.0.ebuild
+++ b/net-proxy/lyrebird/lyrebird-0.1.0.ebuild
@@ -13,6 +13,9 @@ SRC_URI="https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/
 LICENSE="BSD CC0-1.0 BZIP2 GPL-3+ MIT public-domain"
 SLOT="0"
 KEYWORDS="~amd64 ~arm ~riscv ~x86"
+IUSE="selinux"
+
+RDEPEND="selinux? ( sec-policy/selinux-obfs4proxy )"
 
 S="${WORKDIR}"/${PN}-${P}
 
diff --git a/sys-apps/logwatch/logwatch-7.8-r1.ebuild b/sys-apps/logwatch/logwatch-7.8-r1.ebuild
index a7ef017b044c..22edd4652a28 100644
--- a/sys-apps/logwatch/logwatch-7.8-r1.ebuild
+++ b/sys-apps/logwatch/logwatch-7.8-r1.ebuild
@@ -5,6 +5,9 @@ EAPI=8
 
 inherit tmpfiles
 
+DESCRIPTION="Analyzes and Reports on system logs"
+HOMEPAGE="https://sourceforge.net/projects/logwatch/"
+
 if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://git.code.sf.net/p/logwatch/git ${PN}"
 	inherit git-r3
@@ -13,11 +16,9 @@ else
 	KEYWORDS="~alpha amd64 arm arm64 hppa ppc ppc64 sparc x86"
 fi
 
-DESCRIPTION="Analyzes and Reports on system logs"
-HOMEPAGE="https://sourceforge.net/projects/logwatch/"
-
 LICENSE="MIT"
 SLOT="0"
+IUSE="selinux"
 
 RDEPEND="
 	dev-lang/perl
@@ -30,6 +31,7 @@ RDEPEND="
 	virtual/cron
 	virtual/mta
 	virtual/mailx
+	selinux? ( sec-policy/selinux-logwatch )
 "
 
 src_install() {
diff --git a/sys-apps/logwatch/logwatch-9999.ebuild b/sys-apps/logwatch/logwatch-9999.ebuild
index 5f4d3a5769c8..7f77c326c65c 100644
--- a/sys-apps/logwatch/logwatch-9999.ebuild
+++ b/sys-apps/logwatch/logwatch-9999.ebuild
@@ -5,6 +5,9 @@ EAPI=8
 
 inherit tmpfiles
 
+DESCRIPTION="Analyzes and Reports on system logs"
+HOMEPAGE="https://sourceforge.net/projects/logwatch/"
+
 if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://git.code.sf.net/p/logwatch/git ${PN}"
 	inherit git-r3
@@ -13,11 +16,9 @@ else
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~sparc ~x86"
 fi
 
-DESCRIPTION="Analyzes and Reports on system logs"
-HOMEPAGE="https://sourceforge.net/projects/logwatch/"
-
 LICENSE="MIT"
 SLOT="0"
+IUSE="selinux"
 
 RDEPEND="
 	dev-lang/perl
@@ -30,6 +31,7 @@ RDEPEND="
 	virtual/cron
 	virtual/mta
 	virtual/mailx
+	selinux? ( sec-policy/selinux-logwatch )
 "
 
 src_install() {
diff --git a/sys-apps/vbetool/vbetool-1.2.2.ebuild b/sys-apps/vbetool/vbetool-1.2.2.ebuild
index 4d5e0e3f4732..ecd6b7b6c7c1 100644
--- a/sys-apps/vbetool/vbetool-1.2.2.ebuild
+++ b/sys-apps/vbetool/vbetool-1.2.2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -12,12 +12,17 @@ SRC_URI="https://dev.gentoo.org/~ionen/distfiles/${P}.tar.xz"
 LICENSE="GPL-2"
 SLOT="0"
 KEYWORDS="amd64 x86"
+IUSE="selinux"
 
-RDEPEND="
+DEPEND="
 	dev-libs/libx86
 	sys-libs/zlib:=
-	x11-libs/libpciaccess"
-DEPEND="${RDEPEND}"
+	x11-libs/libpciaccess
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-vbetool )
+"
 BDEPEND="virtual/pkgconfig"
 
 PATCHES=(
diff --git a/sys-auth/fprintd/fprintd-1.94.2.ebuild b/sys-auth/fprintd/fprintd-1.94.2.ebuild
index fb78a5dd004a..f97be3fe5000 100644
--- a/sys-auth/fprintd/fprintd-1.94.2.ebuild
+++ b/sys-auth/fprintd/fprintd-1.94.2.ebuild
@@ -16,7 +16,7 @@ SRC_URI="https://gitlab.freedesktop.org/libfprint/${PN}/-/archive/v${PV}/${MY_P}
 LICENSE="GPL-2+"
 SLOT="0"
 KEYWORDS="~alpha amd64 arm arm64 ~ia64 ppc ppc64 ~riscv sparc x86"
-IUSE="doc pam systemd test"
+IUSE="doc pam selinux systemd test"
 RESTRICT="!test? ( test )"
 
 RDEPEND="
@@ -54,6 +54,8 @@ BDEPEND="
 	)
 "
 
+RDEPEND+=" selinux? ( sec-policy/selinux-fprintd )"
+
 PATCHES=(
 	"${FILESDIR}/${PN}-1.90.7_0001-add-test-feature-and-make-tests-optional.patch"
 	"${FILESDIR}/${PN}-1.90.8_0002-add-configure-option-for-libsystemd-provider.patch"
diff --git a/sys-cluster/ceph/ceph-16.2.13-r1.ebuild b/sys-cluster/ceph/ceph-16.2.13-r1.ebuild
index 4a9e6e99bade..5077fc2be131 100644
--- a/sys-cluster/ceph/ceph-16.2.13-r1.ebuild
+++ b/sys-cluster/ceph/ceph-16.2.13-r1.ebuild
@@ -25,7 +25,7 @@ CPU_FLAGS_X86=(avx2 avx512f pclmul sse{,2,3,4_1,4_2} ssse3)
 IUSE="
 	babeltrace +cephfs custom-cflags diskprediction dpdk fuse grafana
 	jemalloc jaeger kafka kerberos ldap lttng +mgr numa pmdk rabbitmq
-	+radosgw rbd-rwl rbd-ssd rdma rgw-lua +ssl spdk +sqlite +system-boost
+	+radosgw rbd-rwl rbd-ssd rdma rgw-lua selinux +ssl spdk +sqlite +system-boost
 	systemd +tcmalloc test uring xfs zbd zfs
 "
 
@@ -164,6 +164,7 @@ RDEPEND="
 		sci-libs/scikit-learn[${PYTHON_USEDEP}]
 		dev-python/six[${PYTHON_USEDEP}]
 	)
+	selinux? ( sec-policy/selinux-ceph )
 "
 REQUIRED_USE="
 	${PYTHON_REQUIRED_USE}
diff --git a/sys-cluster/ceph/ceph-17.2.6-r5.ebuild b/sys-cluster/ceph/ceph-17.2.6-r5.ebuild
index c475facef11a..16a9a26387dc 100644
--- a/sys-cluster/ceph/ceph-17.2.6-r5.ebuild
+++ b/sys-cluster/ceph/ceph-17.2.6-r5.ebuild
@@ -27,7 +27,7 @@ CPU_FLAGS_X86=(avx2 avx512f pclmul sse{,2,3,4_1,4_2} ssse3)
 IUSE="
 	babeltrace +cephfs custom-cflags diskprediction dpdk fuse grafana
 	jemalloc jaeger kafka kerberos ldap lttng +mgr +parquet pmdk rabbitmq
-	+radosgw rbd-rwl rbd-ssd rdma rgw-lua +ssl spdk +sqlite +system-boost
+	+radosgw rbd-rwl rbd-ssd rdma rgw-lua selinux +ssl spdk +sqlite +system-boost
 	systemd +tcmalloc test +uring xfs zbd zfs
 "
 
@@ -172,6 +172,7 @@ RDEPEND="
 		sci-libs/scikit-learn[${PYTHON_USEDEP}]
 		dev-python/six[${PYTHON_USEDEP}]
 	)
+	selinux? ( sec-policy/selinux-ceph )
 "
 REQUIRED_USE="
 	${PYTHON_REQUIRED_USE}
diff --git a/www-client/links/links-2.29.ebuild b/www-client/links/links-2.29.ebuild
index 5d00117ebd69..340c6cac2337 100644
--- a/www-client/links/links-2.29.ebuild
+++ b/www-client/links/links-2.29.ebuild
@@ -13,7 +13,7 @@ SRC_URI="http://${PN}.twibright.com/download/${P}.tar.bz2
 LICENSE="GPL-2"
 SLOT="2"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="avif brotli bzip2 fbcon freetype gpm jpeg libevent livecd lzip lzma ssl suid svga tiff webp X zlib zstd"
+IUSE="avif brotli bzip2 fbcon freetype gpm jpeg libevent livecd lzip lzma selinux ssl suid svga tiff webp X zlib zstd"
 
 GRAPHICS_DEPEND="media-libs/libpng:="
 
@@ -87,6 +87,8 @@ BDEPEND="virtual/pkgconfig"
 
 IDEPEND="X? ( dev-util/desktop-file-utils )"
 
+RDEPEND+=" selinux? ( sec-policy/selinux-links )"
+
 REQUIRED_USE="!livecd? ( fbcon? ( gpm ) )
 	svga? ( suid )"
 
diff --git a/www-misc/awstats/awstats-7.8-r1.ebuild b/www-misc/awstats/awstats-7.8-r1.ebuild
index eb1b99ea5e90..f99c49572678 100644
--- a/www-misc/awstats/awstats-7.8-r1.ebuild
+++ b/www-misc/awstats/awstats-7.8-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -9,11 +9,11 @@ DESCRIPTION="AWStats is short for Advanced Web Statistics"
 HOMEPAGE="https://www.awstats.org/"
 SRC_URI="https://www.awstats.org/files/${P}.tar.gz"
 S=${WORKDIR}/${MY_P}
-LICENSE="GPL-3"
-KEYWORDS="~alpha ~amd64 ~hppa ~ppc ~sparc ~x86"
-IUSE="geoip ipv6"
 
+LICENSE="GPL-3"
 SLOT="0"
+KEYWORDS="~alpha ~amd64 ~hppa ~ppc ~sparc ~x86"
+IUSE="geoip ipv6 selinux"
 
 RDEPEND="
 	>=dev-lang/perl-5.6.1
@@ -26,8 +26,8 @@ RDEPEND="
 		dev-perl/Net-DNS
 		dev-perl/Net-IP
 	)
+	selinux? ( sec-policy/selinux-awstats )
 "
-DEPEND=""
 
 src_prepare() {
 	eapply "${FILESDIR}"/${PN}-7.1-gentoo.diff