sec-policy: Release of SELinux policies 2.20161023-r3

Package-Manager: portage-2.3.0

2 files changed, 123 insertions, 0 deletions

diff --git a/sec-policy/selinux-base-policy/Manifest b/sec-policy/selinux-base-policy/Manifest
index f5ffe3ae414e..17f1705b8a6a 100644
--- a/sec-policy/selinux-base-policy/Manifest
+++ b/sec-policy/selinux-base-policy/Manifest
@@ -7,6 +7,7 @@ DIST patchbundle-selinux-base-policy-2.20151208-r5.tar.bz2 304623 SHA256 90bbbeb
 DIST patchbundle-selinux-base-policy-2.20151208-r6.tar.bz2 307239 SHA256 dd8cbe50f5fff68af543062157c778cb026f1bbacfb5825dbdb1121be757c5ec SHA512 22758f5fa1d4058cc34613d61271ddf0947a4d21f4ee9b298b290ef17f0bdbbb6f389577c0c3c4f5625d8ef599bb8f1a91c8c5a9cf372a7c07ae5784385130b4 WHIRLPOOL a8500aae051924d1cc646f080f2e511ee6cbea493efea699afc4b7a0d7bfb6365bd862cea5134fe81c11c26923ffef2d7424eb4a262263e8eb7590970f4c3283
 DIST patchbundle-selinux-base-policy-2.20161023-r1.tar.bz2 298107 SHA256 fa5be024a7f3b59b155f3cb3852d8b4124f4e75112cd42014090146221169660 SHA512 f8720e4998023aa5186dd5fdebeb41eb998992fd629dd3ae369c855c00308a0aa47761b7a0fb4638893d7b3d8ef42e11b1ca7c5010cfc055258a3077d83f396d WHIRLPOOL 2cfcb976a2beb5e55049e562d75bb3887ca0cbeac9bc630df23a4456f4026f31673b0be012c8ffda89af9b7417b7202089607cd79e6804f69fa826dd017779f4
 DIST patchbundle-selinux-base-policy-2.20161023-r2.tar.bz2 333180 SHA256 d258a0cdc8a6fed19d1d43bcb5946feb2ab422132bb4fa67012dbfc227aa2b4d SHA512 5bca02bd1ddeffc77ce7c59094f4900d54a9f00ec5399ce99fd707a26f705dd973ef8cb81e03d81e7f80dfba84889ec2d690d17803451e34e12c8cd038a293f4 WHIRLPOOL cc6df67f8850d6c464937fdf815dabab7d768ff9c657d4d976fe4899358cad1125851035128775b3c5d1b9e53bb1b5c86b7cad8e8aba55b8d7c90983abc651e6
+DIST patchbundle-selinux-base-policy-2.20161023-r3.tar.bz2 321394 SHA256 76521408b62a17120072cd0db5e037f4b7b967be4340985ce354786e5d2948f7 SHA512 2e9ca3be900c549ddbcd306f1bf5483934d7baf23ffd66a2172d26bcb81b4aa768596555dd8d362398013778e7a127024ec2468d6bf1b487f0c4a14e479e53f4 WHIRLPOOL 246399de9a96f3605fd490cd118f4301b19935990705ab87133911ad3e4befb5aa6d412e5e43b2e2c60936bc485969f55406316c3d37c2a2e8676642153231dd
 DIST refpolicy-2.20141203.tar.bz2 680243 SHA256 f438209c430d8a2d4ddcbe4bdd3edb46f6af7dc4913637af0b73c635e40c1522 SHA512 682e4280c5799e4c12ec7594afc1389f67be35055748d2e0dbdc3419159a16c96d4946ca6178daee8370515951f8653b2e452efe8c962b8d7f9bc192f0b15a0c WHIRLPOOL 74bca232534e7af9051bb1ab9f77c1ff6c425781cf4561f781d6e9a40cc5ca0d9add540249ea5493e8782a9372aea296ead6c165c6c440ae1509eb319d151ee5
 DIST refpolicy-2.20151208.tar.bz2 698182 SHA256 2dd2f45a7132137afe8302805c3b7839739759b9ab73dd1815c01afe34ac99de SHA512 cbefe117f143adea834065949e24e9fe86336c049e9e0518026597d5b0a18c482a9717422bd39b7fb0012d19df00365c969d87e1f13a7bb9dcb9996313ed6cf8 WHIRLPOOL cb843a602dde4234a62e6f92001bff689a457796215b015bcccce79e7aa73bfe875a82bdbdbf59236f218eb41aaf665fcc5753c42d86eb3ed1caa1b69ddc2efa
 DIST refpolicy-2.20161023.tar.bz2 1768667 SHA256 14c9576e2cdf0ecf656134bc59cba99589dbba2895344d2fc226bdb5d8e541c7 SHA512 3201ca3c6cada1053343d3763d36072cf40afa46bf5343087a8254320879cb61fef539dc7742e04e5645d0c886b8f4bf552bf502e9716f7a3282efc0b0ed970d WHIRLPOOL 3f44955c3b13f5a6152d8ca8b75b3c8d52becc1c47b3b0126f5c86fbdad8bf6a1ae72c42e0b130352e139f987340b3c0d3d37aac5b80c5e3d731fcd666b88504
diff --git a/sec-policy/selinux-base-policy/selinux-base-policy-2.20161023-r3.ebuild b/sec-policy/selinux-base-policy/selinux-base-policy-2.20161023-r3.ebuild
new file mode 100644
index 000000000000..b7ba9e2815b0
--- /dev/null
+++ b/sec-policy/selinux-base-policy/selinux-base-policy-2.20161023-r3.ebuild
@@ -0,0 +1,122 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+EAPI="6"
+
+if [[ ${PV} == 9999* ]]; then
+	EGIT_REPO_URI="${SELINUX_GIT_REPO:-git://anongit.gentoo.org/proj/hardened-refpolicy.git https://anongit.gentoo.org/git/proj/hardened-refpolicy.git}"
+	EGIT_BRANCH="${SELINUX_GIT_BRANCH:-master}"
+	EGIT_CHECKOUT_DIR="${WORKDIR}/refpolicy"
+
+	inherit git-r3
+else
+	SRC_URI="https://raw.githubusercontent.com/wiki/TresysTechnology/refpolicy/files/refpolicy-${PV}.tar.bz2
+			https://dev.gentoo.org/~swift/patches/${PN}/patchbundle-${PN}-${PVR}.tar.bz2"
+	KEYWORDS="~amd64 ~arm ~arm64 ~mips ~x86"
+fi
+
+HOMEPAGE="https://www.gentoo.org/proj/en/hardened/selinux/"
+DESCRIPTION="SELinux policy for core modules"
+
+IUSE="systemd +unconfined"
+
+PDEPEND="unconfined? ( sec-policy/selinux-unconfined )"
+DEPEND="=sec-policy/selinux-base-${PVR}[systemd?]"
+
+MODS="application authlogin bootloader clock consoletype cron dmesg fstools getty hostname hotplug init iptables libraries locallogin logging lvm miscfiles modutils mount mta netutils nscd portage raid rsync selinuxutil setrans ssh staff storage su sysadm sysnetwork tmpfiles udev userdomain usermanage unprivuser xdg"
+LICENSE="GPL-2"
+SLOT="0"
+S="${WORKDIR}/"
+
+# Code entirely copied from selinux-eclass (cannot inherit due to dependency on
+# itself), when reworked reinclude it. Only postinstall (where -b base.pp is
+# added) needs to remain then.
+
+pkg_setup() {
+	if use systemd; then
+		MODS="${MODS} systemd"
+	fi
+}
+
+pkg_pretend() {
+	for i in ${POLICY_TYPES}; do
+		if [[ "${i}" == "targeted" ]] && ! use unconfined; then
+			die "If you use POLICY_TYPES=targeted, then USE=unconfined is mandatory."
+		fi
+	done
+}
+
+src_prepare() {
+	local modfiles
+
+	if [[ ${PV} != 9999* ]]; then
+		einfo "Applying SELinux policy updates ... "
+		eapply -p0 "${WORKDIR}/0001-full-patch-against-stable-release.patch"
+	fi
+
+	eapply_user
+
+	# Collect only those files needed for this particular module
+	for i in ${MODS}; do
+		modfiles="$(find ${S}/refpolicy/policy/modules -iname $i.te) $modfiles"
+		modfiles="$(find ${S}/refpolicy/policy/modules -iname $i.fc) $modfiles"
+	done
+
+	for i in ${POLICY_TYPES}; do
+		mkdir "${S}"/${i} || die "Failed to create directory ${S}/${i}"
+		cp "${S}"/refpolicy/doc/Makefile.example "${S}"/${i}/Makefile \
+			|| die "Failed to copy Makefile.example to ${S}/${i}/Makefile"
+
+		cp ${modfiles} "${S}"/${i} \
+			|| die "Failed to copy the module files to ${S}/${i}"
+	done
+}
+
+src_compile() {
+	for i in ${POLICY_TYPES}; do
+		emake NAME=$i -C "${S}"/${i} || die "${i} compile failed"
+	done
+}
+
+src_install() {
+	local BASEDIR="/usr/share/selinux"
+
+	for i in ${POLICY_TYPES}; do
+		for j in ${MODS}; do
+			einfo "Installing ${i} ${j} policy package"
+			insinto ${BASEDIR}/${i}
+			doins "${S}"/${i}/${j}.pp || die "Failed to add ${j}.pp to ${i}"
+		done
+	done
+}
+
+pkg_postinst() {
+	# Override the command from the eclass, we need to load in base as well here
+	local COMMAND="-i base.pp"
+	if has_version "<sys-apps/policycoreutils-2.5"; then
+		COMMAND="-b base.pp"
+	fi
+
+	for i in ${MODS}; do
+		COMMAND="${COMMAND} -i ${i}.pp"
+	done
+
+	for i in ${POLICY_TYPES}; do
+		einfo "Inserting the following modules, with base, into the $i module store: ${MODS}"
+
+		cd /usr/share/selinux/${i} || die "Could not enter /usr/share/selinux/${i}"
+
+		semodule -s ${i} ${COMMAND} || die "Failed to load in base and modules ${MODS} in the $i policy store"
+	done
+
+	# Relabel depending packages
+	local PKGSET="";
+	if [[ -x /usr/bin/qdepends ]] ; then
+		PKGSET=$(/usr/bin/qdepends -Cq -r -Q ${CATEGORY}/${PN} | grep -v 'sec-policy/selinux-');
+	elif [[ -x /usr/bin/equery ]] ; then
+		PKGSET=$(/usr/bin/equery -Cq depends ${CATEGORY}/${PN} | grep -v 'sec-policy/selinux-');
+	fi
+	if [[ -n "${PKGSET}" ]] ; then
+		rlpkg ${PKGSET};
+	fi
+}