gentoo auto-resync : 14:12:2022 - 03:28:57

2 files changed, 143 insertions, 0 deletions

diff --git a/sec-policy/selinux-base-policy/Manifest b/sec-policy/selinux-base-policy/Manifest
index d7faffb9bc7a..75c3701b430a 100644
--- a/sec-policy/selinux-base-policy/Manifest
+++ b/sec-policy/selinux-base-policy/Manifest
@@ -1,8 +1,10 @@
 DIST patchbundle-selinux-base-policy-2.20220520-r1.tar.bz2 294472 BLAKE2B 12dbda1952bde3db32758470735327c9934f42128dd54513c5a5d082d41cc73e39f49567dafa6abca3fd9d7d036e3a032a26a572e3ba3871de451a78f3757057 SHA512 d75e66f484281d1987e9c6fbe18a483934af39f28f908cfd21c14ba72acbf2ce9afc3bb9211f83e17badbbfaeadbd5263845dc8535eb28bf3b6b56f89db62d43
 DIST patchbundle-selinux-base-policy-2.20221101-r2.tar.bz2 285989 BLAKE2B e6c5851c4f9b4cbe3f0b478d72e20a1ce05ce85dd0b11d2be7a9a6a4a6c4091e70c092307ed8a1c626a39e13e6437417bc78875fc5985e7d652c69f4644d347e SHA512 8d881cd42f1da699af7ea39023fcc2d89fab5b2476975e2ab8764ad110b237cbf44d1688499d6cbc0514ee538f7770f391a3e2df32e8980f1af6a509ea9ffd78
+DIST patchbundle-selinux-base-policy-2.20221101-r3.tar.bz2 444710 BLAKE2B e33cc01a8be5a354e022be1e8bf242883b09b15ead0673f859819f5e668f18773a16527f2e608878e6976695dcb2890c55658e77877e93c716ae0b2dd2ed5a9b SHA512 52e60b22346903a6fead95c9fb348fa1d4037b7dcd3e5781248a7dfc426c8c3fced258fd22762c779a5f436d8be21eaed5425ed36ff99c267daae5e1cb9c8e7f
 DIST refpolicy-2.20220520.tar.bz2 577155 BLAKE2B d4352009ef5eb8599feb4adbec0ecef7fd5c9617b820300ab5e95723ddc790dc9244628417c71097ea3f7fff47c1d47a6e4a39da539e6b662acfd9d7ea8cc190 SHA512 eeeca3817fd305f82f62a53ae9c5120775fdf6f6c57d5420584e225019cd66357f7da119e8ea8f21549631d14b1c8076e9ac81aa4907de6c6fa0d7fc827b67ff
 DIST refpolicy-2.20221101.tar.bz2 583183 BLAKE2B 783d8af40fd77d7ddb848dba32e91921dd7c1380c094c45b719ada7b15f91aacbb52b410ffa6341f2f705ecbc9674b8570bd4867ce998e944fa0054ffd8bdf74 SHA512 29e5a29d90f714018c88fead2d5006ea90338fb5b7a1e4e98cb2e588c96cd861871d32176f6cc6f7c4e864ce5acae1aeed85d4c706ce2da8168986535baaf3a6
 EBUILD selinux-base-policy-2.20220520-r1.ebuild 4199 BLAKE2B de34a43ae4e7c17e0ff9a189c679e335d721b98edbcf756fd4679fe3c3867af1d58fd93ea8545149f26dbf78fc290e61c171f39c20b5fe9fd6922c387f0f7230 SHA512 b6664f9c433c6fa6225f6459bf962d5fed49767da4249b2468c63e9b281a336875ce80e90c8107981725b581fb43342df8875a31445ed79800f2dc88d6bc7ca6
 EBUILD selinux-base-policy-2.20221101-r2.ebuild 4199 BLAKE2B de34a43ae4e7c17e0ff9a189c679e335d721b98edbcf756fd4679fe3c3867af1d58fd93ea8545149f26dbf78fc290e61c171f39c20b5fe9fd6922c387f0f7230 SHA512 b6664f9c433c6fa6225f6459bf962d5fed49767da4249b2468c63e9b281a336875ce80e90c8107981725b581fb43342df8875a31445ed79800f2dc88d6bc7ca6
+EBUILD selinux-base-policy-2.20221101-r3.ebuild 4203 BLAKE2B 347ed6cef732eb6ebe2eff504ea5d632d9596ad0c5495053b84e6442530a18fbf810d67e424478c76343b3b46cd1a5a02edae76985bb2d9e121822a775c29f8d SHA512 d347e516ac4f03f70fba5b5afcaf7cd61af0c87d0cf20874d6091fd5165f2a62e4b18b5ef7aff911b72d60f87d6f1bb5dc8ef60a6b1ee8f32d5a2a2392a5576a
 EBUILD selinux-base-policy-9999.ebuild 4203 BLAKE2B 347ed6cef732eb6ebe2eff504ea5d632d9596ad0c5495053b84e6442530a18fbf810d67e424478c76343b3b46cd1a5a02edae76985bb2d9e121822a775c29f8d SHA512 d347e516ac4f03f70fba5b5afcaf7cd61af0c87d0cf20874d6091fd5165f2a62e4b18b5ef7aff911b72d60f87d6f1bb5dc8ef60a6b1ee8f32d5a2a2392a5576a
 MISC metadata.xml 535 BLAKE2B db3aa01f5f57a5d30b7a39721a569bd2efe77a87701fb4e5d4e64ead0d13b4055dc5224bb7c95bf261e623163a59c18da5500d8da77b3de07801dcb13a9d4077 SHA512 592e02632b459156a686aa752bdcd04c00b6de8029831e39c2bf7c2e9a5e7886d8ebf0a5d16cbe1f6878428ce4e266dc676bf80657d018d204304d1113af7fcf
diff --git a/sec-policy/selinux-base-policy/selinux-base-policy-2.20221101-r3.ebuild b/sec-policy/selinux-base-policy/selinux-base-policy-2.20221101-r3.ebuild
new file mode 100644
index 000000000000..9ca7ee646d2e
--- /dev/null
+++ b/sec-policy/selinux-base-policy/selinux-base-policy-2.20221101-r3.ebuild
@@ -0,0 +1,141 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+if [[ ${PV} == 9999* ]]; then
+	EGIT_REPO_URI="${SELINUX_GIT_REPO:-https://anongit.gentoo.org/git/proj/hardened-refpolicy.git}"
+	EGIT_BRANCH="${SELINUX_GIT_BRANCH:-master}"
+	EGIT_CHECKOUT_DIR="${WORKDIR}/refpolicy"
+
+	inherit git-r3
+else
+	SRC_URI="https://github.com/SELinuxProject/refpolicy/releases/download/RELEASE_${PV/./_}/refpolicy-${PV}.tar.bz2
+			https://dev.gentoo.org/~perfinion/patches/${PN}/patchbundle-${PN}-${PVR}.tar.bz2"
+	KEYWORDS="~amd64 ~arm ~arm64 ~mips ~x86"
+fi
+
+HOMEPAGE="https://wiki.gentoo.org/wiki/Project:SELinux"
+DESCRIPTION="SELinux policy for core modules"
+
+IUSE="systemd +unconfined"
+
+PDEPEND="unconfined? ( sec-policy/selinux-unconfined )"
+DEPEND="=sec-policy/selinux-base-${PVR}[systemd?]"
+RDEPEND="${DEPEND}"
+BDEPEND="
+	sys-apps/checkpolicy
+	sys-devel/m4"
+
+MODS="application authlogin bootloader clock consoletype cron dmesg fstools getty hostname init iptables libraries locallogin logging lvm miscfiles modutils mount mta netutils nscd portage raid rsync selinuxutil setrans ssh staff storage su sysadm sysnetwork systemd tmpfiles udev userdomain usermanage unprivuser xdg"
+DEL_MODS="hotplug"
+LICENSE="GPL-2"
+SLOT="0"
+S="${WORKDIR}/"
+
+# Code entirely copied from selinux-eclass (cannot inherit due to dependency on
+# itself), when reworked reinclude it. Only postinstall (where -b base.pp is
+# added) needs to remain then.
+
+pkg_pretend() {
+	for i in ${POLICY_TYPES}; do
+		if [[ "${i}" == "targeted" ]] && ! use unconfined; then
+			die "If you use POLICY_TYPES=targeted, then USE=unconfined is mandatory."
+		fi
+	done
+}
+
+src_prepare() {
+	local modfiles
+
+	if [[ ${PV} != 9999* ]]; then
+		einfo "Applying SELinux policy updates ... "
+		eapply -p0 "${WORKDIR}/0001-full-patch-against-stable-release.patch"
+	fi
+
+	eapply_user
+
+	# Collect only those files needed for this particular module
+	for i in ${MODS}; do
+		modfiles="$(find "${S}"/refpolicy/policy/modules -iname $i.te) $modfiles"
+		modfiles="$(find "${S}"/refpolicy/policy/modules -iname $i.fc) $modfiles"
+	done
+
+	for i in ${DEL_MODS}; do
+		[[ "${MODS}" != *${i}* ]] || die "Duplicate module in MODS and DEL_MODS: ${i}"
+	done
+
+	for i in ${POLICY_TYPES}; do
+		mkdir "${S}"/${i} || die "Failed to create directory ${S}/${i}"
+		cp "${S}"/refpolicy/doc/Makefile.example "${S}"/${i}/Makefile \
+			|| die "Failed to copy Makefile.example to ${S}/${i}/Makefile"
+
+		cp ${modfiles} "${S}"/${i} \
+			|| die "Failed to copy the module files to ${S}/${i}"
+	done
+}
+
+src_compile() {
+	for i in ${POLICY_TYPES}; do
+		emake NAME=$i SHAREDIR="${SYSROOT%/}/usr/share/selinux" -C "${S}"/${i}
+	done
+}
+
+src_install() {
+	local BASEDIR="/usr/share/selinux"
+
+	for i in ${POLICY_TYPES}; do
+		for j in ${MODS}; do
+			einfo "Installing ${i} ${j} policy package"
+			insinto ${BASEDIR}/${i}
+			doins "${S}"/${i}/${j}.pp
+		done
+	done
+}
+
+pkg_postinst() {
+	# Set root path and don't load policy into the kernel when cross compiling
+	local root_opts=""
+	if [[ "${ROOT}" != "" ]]; then
+		root_opts="-p ${ROOT} -n"
+	fi
+
+	# Override the command from the eclass, we need to load in base as well here
+	local COMMAND="-i base.pp"
+	if has_version "<sys-apps/policycoreutils-2.5"; then
+		COMMAND="-b base.pp"
+	fi
+
+	for i in ${MODS}; do
+		COMMAND="${COMMAND} -i ${i}.pp"
+	done
+
+	for i in ${POLICY_TYPES}; do
+		einfo "Inserting the following modules, with base, into the $i module store: ${MODS}"
+
+		cd "${ROOT}/usr/share/selinux/${i}"
+
+		semodule ${root_opts} -s ${i} ${COMMAND}
+
+		for mod in ${DEL_MODS}; do
+			if semodule ${root_opts} -s ${i} -l | grep -q "\b${mod}\b"; then
+				einfo "Removing obsolete ${i} ${mod} policy package"
+				semodule ${root_opts} -s ${i} -r ${mod}
+			fi
+		done
+	done
+
+	# Don't relabel when cross compiling
+	if [[ "${ROOT}" == "" ]]; then
+		# Relabel depending packages
+		local PKGSET="";
+		if [[ -x /usr/bin/qdepends ]] ; then
+			PKGSET=$(/usr/bin/qdepends -Cq -r -Q ${CATEGORY}/${PN} | grep -v 'sec-policy/selinux-');
+		elif [[ -x /usr/bin/equery ]] ; then
+			PKGSET=$(/usr/bin/equery -Cq depends ${CATEGORY}/${PN} | grep -v 'sec-policy/selinux-');
+		fi
+		if [[ -n "${PKGSET}" ]] ; then
+			rlpkg ${PKGSET};
+		fi
+	fi
+}