[ptxdist] [PATCH v2 00/17] selinux: back at version 3.11

[ptxdist] [PATCH v2 00/17] selinux: back at version 3.11

[Ladislav Michl]

From: Ladislav Michl <ladis@triops.cz>

This serie was originally written for selinux-3.0 in 2019 when all the
patches were just version bumps with fixes. Now, once PTXdist dropped
most of them after quite some time in staging, every package is first
restored by a partial revert of its removal commit, followed by a version
bump that does the actual changes. Only the still needed files are
restored by each revert. This will hopefully make the serie easier
to review and keep a history in tree.

Tested on an ARMv7 target with glibc and python 3.13.

This is a second attempt, see changelog appended to patches.

Link to v1: https://lore.ptxdist.org/ptxdist/cover.1792491301.git.ladis@triops.cz/

Ladislav Michl (17):
  selinux: add common version and URL
  Revert "python: remove after more than one year in staging"
  host-swig: version bump 4.0.1 -> 4.5.1
  Revert "*libsepol: remove"
  libsepol: version bump 2.1.8 -> 3.11
  Revert "libselinux: remove after more than one year in staging"
  libselinux: version bump 2.1.12 -> 3.11
  audit: new package
  Revert "libsemanage: remove after more than one year in staging"
  libsemanage: version bump 2.1.9 -> 3.11
  Revert "checkpolicy: remove after more than one year in staging"
  checkpolicy: version bump 2.1.11 -> 3.11
  Revert "policycoreutils: remove after more than one year in staging"
  policycoreutils: version bump 2.1.13 -> 3.11
  Revert "sepolgen: remove after one year in staging"
  sepolgen: version bump 1.1.8 -> 3.11
  selinux: restore the global option

 patches/audit-userspace-4.2.1/autogen.sh      |   1 +
 ...PyString_FromString-with-PyUnicode_F.patch |  48 ++++++
 patches/libselinux-3.11/series                |   4 +
 rules/at.in                                   |   1 +
 rules/audit.in                                |  19 +++
 rules/audit.make                              | 102 +++++++++++++
 rules/busybox.in                              |   1 +
 rules/casync.in                               |   1 +
 rules/checkpolicy.in                          |  25 ++++
 rules/checkpolicy.make                        |  59 ++++++++
 rules/connman.in                              |   1 +
 rules/core-selinux.in                         |   1 -
 rules/coreutils.in                            |   1 +
 rules/dbus.in                                 |   6 +-
 rules/dbus.make                               |   2 +-
 rules/f2fs-tools.in                           |   1 +
 rules/gnupg.in                                |   1 +
 rules/host-swig.in                            |   6 +
 rules/host-swig.make                          |  48 ++++++
 rules/iproute2.in                             |   1 +
 rules/iproute2.make                           |   3 +
 rules/libselinux.in                           |  66 +++++++++
 rules/libselinux.make                         | 126 ++++++++++++++++
 rules/libsemanage.in                          |  24 +++
 rules/libsemanage.make                        |  91 ++++++++++++
 rules/libsepol.in                             |  11 ++
 rules/libsepol.make                           |  60 ++++++++
 rules/logrotate.in                            |   1 +
 rules/lxc.in                                  |   1 +
 rules/mtd-utils.in                            |   1 +
 rules/openssh.in                              |   1 +
 rules/policycoreutils.in                      |  90 ++++++++++++
 rules/policycoreutils.make                    | 138 ++++++++++++++++++
 rules/pre/Rules.make                          |   6 -
 rules/pre/selinux.make                        |  10 ++
 rules/selinux-python.in                       |  12 ++
 rules/selinux-python.make                     |  68 +++++++++
 rules/shadow.in                               |   1 +
 rules/strongswan.in                           |   1 +
 rules/systemd.in                              |   1 +
 40 files changed, 1028 insertions(+), 13 deletions(-)
 create mode 120000 patches/audit-userspace-4.2.1/autogen.sh
 create mode 100644 patches/libselinux-3.11/0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch
 create mode 100644 patches/libselinux-3.11/series
 create mode 100644 rules/audit.in
 create mode 100644 rules/audit.make
 create mode 100644 rules/checkpolicy.in
 create mode 100644 rules/checkpolicy.make
 create mode 100644 rules/host-swig.in
 create mode 100644 rules/host-swig.make
 create mode 100644 rules/libselinux.in
 create mode 100644 rules/libselinux.make
 create mode 100644 rules/libsemanage.in
 create mode 100644 rules/libsemanage.make
 create mode 100644 rules/libsepol.in
 create mode 100644 rules/libsepol.make
 create mode 100644 rules/policycoreutils.in
 create mode 100644 rules/policycoreutils.make
 create mode 100644 rules/pre/selinux.make
 create mode 100644 rules/selinux-python.in
 create mode 100644 rules/selinux-python.make

-- 
2.47.3

[ptxdist] [PATCH v2 01/17] selinux: add common version and URL

[Ladislav Michl]

From: Ladislav Michl <ladis@triops.cz>

All SELinux userspace components are released together, so keep the
version and download location in one place.

Signed-off-by: Ladislav Michl <ladis@triops.cz>
---
 CHANGES:
 - v2: None

 rules/pre/selinux.make | 10 ++++++++++
 1 file changed, 10 insertions(+)
 create mode 100644 rules/pre/selinux.make

diff --git a/rules/pre/selinux.make b/rules/pre/selinux.make
new file mode 100644
index 000000000..d996d4080
--- /dev/null
+++ b/rules/pre/selinux.make
@@ -0,0 +1,10 @@
+# -*-makefile-*-
+#
+# Copyright (C) 2019 by Ladislav Michl <ladis@linux-mips.org>
+#
+# For further information about the PTXdist project and license conditions
+# see the README file.
+#
+
+SELINUX_VERSION	:= 3.11
+SELINUX_URL	:= https://github.com/SELinuxProject/selinux/releases/download/$(SELINUX_VERSION)
-- 
2.47.3

[ptxdist] [PATCH v2 02/17] Revert "python: remove after more than one year in staging"

[Ladislav Michl]

From: Ladislav Michl <ladis@triops.cz>

This partially reverts commit 441d22b5ed7a4a7a87f952150222004ef989f8d6.

Signed-off-by: Ladislav Michl <ladis@triops.cz>
---
 CHANGES:
 - v2: None

 rules/host-swig.in   | 23 ++++++++++++++++
 rules/host-swig.make | 63 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 86 insertions(+)
 create mode 100644 rules/host-swig.in
 create mode 100644 rules/host-swig.make

diff --git a/rules/host-swig.in b/rules/host-swig.in
new file mode 100644
index 000000000..56a23fcce
--- /dev/null
+++ b/rules/host-swig.in
@@ -0,0 +1,23 @@
+## SECTION=hosttools_noprompt
+
+config HOST_SWIG
+	tristate
+	default y if ALLYES
+	select HOST_ZLIB
+	select HOST_LIBPCRE
+	select HOST_PYTHON	if HOST_SWIG_PYTHON_SUPPORT
+	select HOST_PYTHON3	if HOST_SWIG_PYTHON3_SUPPORT
+	select HOST_SYSTEM_JDK	if HOST_SWIG_JAVA_SUPPORT
+
+if HOST_SWIG
+
+config HOST_SWIG_JAVA_SUPPORT
+	bool
+
+config HOST_SWIG_PYTHON_SUPPORT
+	bool
+
+config HOST_SWIG_PYTHON3_SUPPORT
+	bool
+
+endif
diff --git a/rules/host-swig.make b/rules/host-swig.make
new file mode 100644
index 000000000..0bdfe858f
--- /dev/null
+++ b/rules/host-swig.make
@@ -0,0 +1,63 @@
+# -*-makefile-*-
+#
+# Copyright (C) 2013 by Marc Kleine-Budde <mkl@pengutronix.de>
+#
+# For further information about the PTXdist project and license conditions
+# see the README file.
+#
+
+#
+# We provide this package
+#
+HOST_PACKAGES-$(PTXCONF_HOST_SWIG) += host-swig
+
+#
+# Paths and names
+#
+HOST_SWIG_VERSION	:= 4.0.1
+HOST_SWIG_MD5		:= 54cc40b3804816f7d38ab510b6f13b04
+HOST_SWIG		:= swig-$(HOST_SWIG_VERSION)
+HOST_SWIG_SUFFIX	:= tar.gz
+HOST_SWIG_URL		:= $(call ptx/mirror, SF, swig/$(HOST_SWIG).$(HOST_SWIG_SUFFIX))
+HOST_SWIG_SOURCE	:= $(SRCDIR)/$(HOST_SWIG).$(HOST_SWIG_SUFFIX)
+HOST_SWIG_DIR		:= $(HOST_BUILDDIR)/$(HOST_SWIG)
+
+# ----------------------------------------------------------------------------
+# Prepare
+# ----------------------------------------------------------------------------
+
+#
+# autoconf
+#
+HOST_SWIG_CONF_TOOL := autoconf
+HOST_SWIG_DEVPKG := NO
+
+# no := due to CROSS_PYTHON
+HOST_SWIG_CONF_OPT = \
+	$(HOST_AUTOCONF_SYSROOT) \
+	--without-boost \
+	--without-x \
+	--without-tcl \
+	$(call ptx/ifdef, PTXCONF_HOST_SWIG_PYTHON_SUPPORT, --with-python=$(CROSS_PYTHON), --without-python) \
+	$(call ptx/ifdef, PTXCONF_HOST_SWIG_PYTHON3_SUPPORT, --with-python=$(CROSS_PYTHON3), --without-python3) \
+	--without-perl5 \
+	--without-octave \
+	$(call ptx/ifdef, PTXCONF_HOST_SWIG_JAVA_SUPPORT, --with-java=$(PTXCONF_SETUP_JAVA_SDK), --without-java) \
+	--without-gcj \
+	--without-android \
+	--without-guile \
+	--without-mzscheme \
+	--without-ruby \
+	--without-php \
+	--without-ocaml \
+	--without-pike \
+	--without-chicken \
+	--without-csharp \
+	--without-lua \
+	--without-allegrocl \
+	--without-clisp \
+	--without-r \
+	--without-go \
+	--without-d
+
+# vim: syntax=make
-- 
2.47.3

[ptxdist] [PATCH v2 03/17] host-swig: version bump 4.0.1 -> 4.5.1

[Ladislav Michl]

From: Ladislav Michl <ladis@triops.cz>

Only the code generator is needed for the SELinux python wrappers, so
disable all language checks.

Signed-off-by: Ladislav Michl <ladis@triops.cz>
---
 CHANGES:
 - v2: None

 rules/host-swig.in   | 19 +---------------
 rules/host-swig.make | 53 ++++++++++++++++----------------------------
 2 files changed, 20 insertions(+), 52 deletions(-)

diff --git a/rules/host-swig.in b/rules/host-swig.in
index 56a23fcce..25a974d8f 100644
--- a/rules/host-swig.in
+++ b/rules/host-swig.in
@@ -3,21 +3,4 @@
 config HOST_SWIG
 	tristate
 	default y if ALLYES
-	select HOST_ZLIB
-	select HOST_LIBPCRE
-	select HOST_PYTHON	if HOST_SWIG_PYTHON_SUPPORT
-	select HOST_PYTHON3	if HOST_SWIG_PYTHON3_SUPPORT
-	select HOST_SYSTEM_JDK	if HOST_SWIG_JAVA_SUPPORT
-
-if HOST_SWIG
-
-config HOST_SWIG_JAVA_SUPPORT
-	bool
-
-config HOST_SWIG_PYTHON_SUPPORT
-	bool
-
-config HOST_SWIG_PYTHON3_SUPPORT
-	bool
-
-endif
+	select HOST_PCRE2
diff --git a/rules/host-swig.make b/rules/host-swig.make
index 0bdfe858f..2aef23ba0 100644
--- a/rules/host-swig.make
+++ b/rules/host-swig.make
@@ -14,50 +14,35 @@ HOST_PACKAGES-$(PTXCONF_HOST_SWIG) += host-swig
 #
 # Paths and names
 #
-HOST_SWIG_VERSION	:= 4.0.1
-HOST_SWIG_MD5		:= 54cc40b3804816f7d38ab510b6f13b04
+HOST_SWIG_VERSION	:= 4.5.1
+HOST_SWIG_SHA256	:= 7fec50b27deddab5455a9633780b6341eddfb96215a7619e93a76eb27178f653
 HOST_SWIG		:= swig-$(HOST_SWIG_VERSION)
 HOST_SWIG_SUFFIX	:= tar.gz
-HOST_SWIG_URL		:= $(call ptx/mirror, SF, swig/$(HOST_SWIG).$(HOST_SWIG_SUFFIX))
+HOST_SWIG_URL		:= $(call ptx/mirror, SF, swig/swig/$(HOST_SWIG)/$(HOST_SWIG).$(HOST_SWIG_SUFFIX))
 HOST_SWIG_SOURCE	:= $(SRCDIR)/$(HOST_SWIG).$(HOST_SWIG_SUFFIX)
 HOST_SWIG_DIR		:= $(HOST_BUILDDIR)/$(HOST_SWIG)
+HOST_SWIG_LICENSE	:= GPL-3.0-or-later AND BSD-3-Clause AND custom
+HOST_SWIG_LICENSE_FILES	:= \
+	file://LICENSE;md5=e7807a6282784a7dde4c846626b08fc6 \
+	file://LICENSE-GPL;md5=d32239bcb673463ab874e80d47fae504 \
+	file://LICENSE-UNIVERSITIES;md5=8ce9dcc8f7c994de4a408b205c72ba08
+HOST_SWIG_CVE_PRODUCT	:= swig_project:swig
 
 # ----------------------------------------------------------------------------
 # Prepare
 # ----------------------------------------------------------------------------
 
-#
-# autoconf
-#
-HOST_SWIG_CONF_TOOL := autoconf
-HOST_SWIG_DEVPKG := NO
-
-# no := due to CROSS_PYTHON
-HOST_SWIG_CONF_OPT = \
+HOST_SWIG_CONF_TOOL	:= autoconf
+HOST_SWIG_DEVPKG	:= NO
+HOST_SWIG_CONF_OPT	:= \
 	$(HOST_AUTOCONF_SYSROOT) \
+	--disable-ccache \
+	--disable-cpp11-testing \
+	--without-maximum-compile-warnings \
+	--with-pcre \
+	--with-pcre2-prefix=$(PTXDIST_SYSROOT_HOST)/usr \
+	--without-clang-format \
 	--without-boost \
-	--without-x \
-	--without-tcl \
-	$(call ptx/ifdef, PTXCONF_HOST_SWIG_PYTHON_SUPPORT, --with-python=$(CROSS_PYTHON), --without-python) \
-	$(call ptx/ifdef, PTXCONF_HOST_SWIG_PYTHON3_SUPPORT, --with-python=$(CROSS_PYTHON3), --without-python3) \
-	--without-perl5 \
-	--without-octave \
-	$(call ptx/ifdef, PTXCONF_HOST_SWIG_JAVA_SUPPORT, --with-java=$(PTXCONF_SETUP_JAVA_SDK), --without-java) \
-	--without-gcj \
-	--without-android \
-	--without-guile \
-	--without-mzscheme \
-	--without-ruby \
-	--without-php \
-	--without-ocaml \
-	--without-pike \
-	--without-chicken \
-	--without-csharp \
-	--without-lua \
-	--without-allegrocl \
-	--without-clisp \
-	--without-r \
-	--without-go \
-	--without-d
+	--without-alllang
 
 # vim: syntax=make
-- 
2.47.3

[ptxdist] [PATCH v2 04/17] Revert "*libsepol: remove"

[Ladislav Michl]

From: Ladislav Michl <ladis@triops.cz>

This partially reverts commit 43c4d983818f726dfe651ea72d4b5ddd6a5c91bc.

Signed-off-by: Ladislav Michl <ladis@triops.cz>
---
 CHANGES:
 - v2: do not restore host-libsepol, nothing uses it. Host tools are
       only needed to build a policy, so they should come back together
       with a policy package.

 rules/libsepol.in   | 10 +++++++++
 rules/libsepol.make | 55 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 65 insertions(+)
 create mode 100644 rules/libsepol.in
 create mode 100644 rules/libsepol.make

diff --git a/rules/libsepol.in b/rules/libsepol.in
new file mode 100644
index 000000000..4ac087610
--- /dev/null
+++ b/rules/libsepol.in
@@ -0,0 +1,10 @@
+## SECTION=selinux
+
+config LIBSEPOL
+	tristate
+	prompt "libsepol"
+	help
+	  libsepol provides an API for the manipulation of SELinux binary policies.
+	  It is used by checkpolicy (the policy compiler) and similar tools, as well
+	  as by programs like load_policy that need to perform specific transformations
+	  on binary policies such as customizing policy boolean settings.
diff --git a/rules/libsepol.make b/rules/libsepol.make
new file mode 100644
index 000000000..cf5f4ef4d
--- /dev/null
+++ b/rules/libsepol.make
@@ -0,0 +1,55 @@
+# -*-makefile-*-
+#
+# Copyright (C) 2012 by Wolfram Sang <w.sang@pengutronix.de>
+#
+# For further information about the PTXdist project and license conditions
+# see the README file.
+#
+
+#
+# We provide this package
+#
+PACKAGES-$(PTXCONF_LIBSEPOL) += libsepol
+
+#
+# Paths and names
+#
+LIBSEPOL_VERSION	:= 2.1.8
+LIBSEPOL_MD5		:= 56fa100ed85d7f06bd92f2892d92b3b0
+LIBSEPOL		:= libsepol-$(LIBSEPOL_VERSION)
+LIBSEPOL_SUFFIX		:= tar.gz
+LIBSEPOL_URL		:= https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20120924/$(LIBSEPOL).$(LIBSEPOL_SUFFIX)
+LIBSEPOL_SOURCE		:= $(SRCDIR)/$(LIBSEPOL).$(LIBSEPOL_SUFFIX)
+LIBSEPOL_DIR		:= $(BUILDDIR)/$(LIBSEPOL)
+LIBSEPOL_LICENSE	:= LGPL-2.1-or-later
+
+# ----------------------------------------------------------------------------
+# Prepare
+# ----------------------------------------------------------------------------
+
+LIBSEPOL_CONF_TOOL := NO
+LIBSEPOL_MAKE_ENV := \
+	$(CROSS_ENV) \
+	SHLIBDIR=$(LIBSEPOL_PKGDIR)/usr/lib \
+	CFLAGS="-O2 -Wall -g"
+
+# ----------------------------------------------------------------------------
+# Target-Install
+# ----------------------------------------------------------------------------
+
+$(STATEDIR)/libsepol.targetinstall:
+	@$(call targetinfo)
+
+	@$(call install_init, libsepol)
+	@$(call install_fixup, libsepol,PRIORITY,optional)
+	@$(call install_fixup, libsepol,SECTION,base)
+	@$(call install_fixup, libsepol,AUTHOR,"Wolfram Sang <w.sang@pengutronix.de>")
+	@$(call install_fixup, libsepol,DESCRIPTION,missing)
+
+	@$(call install_lib, libsepol, 0, 0, 0644, libsepol)
+
+	@$(call install_finish, libsepol)
+
+	@$(call touch)
+
+# vim: syntax=make
-- 
2.47.3

[ptxdist] [PATCH v2 05/17] libsepol: version bump 2.1.8 -> 3.11

[Ladislav Michl]

From: Ladislav Michl <ladis@triops.cz>

Signed-off-by: Ladislav Michl <ladis@triops.cz>
---
 CHANGES:
 - v2: drop host-libsepol update accordingly.

 rules/libsepol.in   |  1 +
 rules/libsepol.make | 19 ++++++++++++-------
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/rules/libsepol.in b/rules/libsepol.in
index 4ac087610..08e0aba60 100644
--- a/rules/libsepol.in
+++ b/rules/libsepol.in
@@ -3,6 +3,7 @@
 config LIBSEPOL
 	tristate
 	prompt "libsepol"
+	select HOST_FLEX
 	help
 	  libsepol provides an API for the manipulation of SELinux binary policies.
 	  It is used by checkpolicy (the policy compiler) and similar tools, as well
diff --git a/rules/libsepol.make b/rules/libsepol.make
index cf5f4ef4d..6e63b6b1a 100644
--- a/rules/libsepol.make
+++ b/rules/libsepol.make
@@ -14,24 +14,29 @@ PACKAGES-$(PTXCONF_LIBSEPOL) += libsepol
 #
 # Paths and names
 #
-LIBSEPOL_VERSION	:= 2.1.8
-LIBSEPOL_MD5		:= 56fa100ed85d7f06bd92f2892d92b3b0
+LIBSEPOL_VERSION	:= $(SELINUX_VERSION)
+LIBSEPOL_SHA256		:= 79f3d2c88f44b7eb5cf54d9792e03232297e17f97a179163f2750099a00f164d
 LIBSEPOL		:= libsepol-$(LIBSEPOL_VERSION)
 LIBSEPOL_SUFFIX		:= tar.gz
-LIBSEPOL_URL		:= https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20120924/$(LIBSEPOL).$(LIBSEPOL_SUFFIX)
+LIBSEPOL_URL		:= $(SELINUX_URL)/$(LIBSEPOL).$(LIBSEPOL_SUFFIX)
 LIBSEPOL_SOURCE		:= $(SRCDIR)/$(LIBSEPOL).$(LIBSEPOL_SUFFIX)
 LIBSEPOL_DIR		:= $(BUILDDIR)/$(LIBSEPOL)
 LIBSEPOL_LICENSE	:= LGPL-2.1-or-later
+LIBSEPOL_LICENSE_FILES	:= file://LICENSE;md5=a6f89e2100d9b6cdffcea4f398e37343
+LIBSEPOL_CVE_PRODUCT	:= selinuxproject:libsepol
 
 # ----------------------------------------------------------------------------
 # Prepare
 # ----------------------------------------------------------------------------
 
-LIBSEPOL_CONF_TOOL := NO
-LIBSEPOL_MAKE_ENV := \
-	$(CROSS_ENV) \
-	SHLIBDIR=$(LIBSEPOL_PKGDIR)/usr/lib \
+LIBSEPOL_CONF_TOOL	:= NO
+LIBSEPOL_MAKE_ENV	:= $(CROSS_ENV)
+LIBSEPOL_MAKE_OPT	:= \
+	SHLIBDIR=/usr/lib \
 	CFLAGS="-O2 -Wall -g"
+LIBSEPOL_INSTALL_OPT	:= \
+	$(LIBSEPOL_MAKE_OPT) \
+	install
 
 # ----------------------------------------------------------------------------
 # Target-Install
-- 
2.47.3

[ptxdist] [PATCH v2 06/17] Revert "libselinux: remove after more than one year in staging"

[Ladislav Michl]

From: Ladislav Michl <ladis@triops.cz>

This partially reverts commit f4b8d42822a645d4336f9c25090fc3281886ce7e.

Signed-off-by: Ladislav Michl <ladis@triops.cz>
---
 CHANGES:
 - v2: None

 rules/libselinux.in   | 27 +++++++++++++
 rules/libselinux.make | 94 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 121 insertions(+)
 create mode 100644 rules/libselinux.in
 create mode 100644 rules/libselinux.make

diff --git a/rules/libselinux.in b/rules/libselinux.in
new file mode 100644
index 000000000..6d6b1e655
--- /dev/null
+++ b/rules/libselinux.in
@@ -0,0 +1,27 @@
+## SECTION=staging
+## old section:
+### SECTION=selinux
+
+menuconfig LIBSELINUX
+	tristate
+	prompt "libselinux                    "
+	select LIBPCRE
+	select LIBSEPOL
+	select PYTHON		if LIBSELINUX_PYTHON
+	select HOST_SWIG	if LIBSELINUX_PYTHON
+	help
+	  libselinux provides an API for SELinux applications to get and set
+	  process and file security contexts and to obtain security policy
+	  decisions. Required for any applications that use the SELinux
+	  API.
+
+	  STAGING: remove in ptxdist-2020.12.0
+	  Old version that need to be updated. Fails to build with gcc >= 9.x.
+
+if LIBSELINUX
+
+config LIBSELINUX_PYTHON
+	bool "python wrapper"
+	depends on STAGING
+
+endif
diff --git a/rules/libselinux.make b/rules/libselinux.make
new file mode 100644
index 000000000..9f6b6a62f
--- /dev/null
+++ b/rules/libselinux.make
@@ -0,0 +1,94 @@
+# -*-makefile-*-
+#
+# Copyright (C) 2012 by Wolfram Sang <w.sang@pengutronix.de>
+#
+# For further information about the PTXdist project and license conditions
+# see the README file.
+#
+
+#
+# We provide this package
+#
+PACKAGES-$(PTXCONF_LIBSELINUX) += libselinux
+
+#
+# Paths and names
+#
+LIBSELINUX_VERSION	:= 2.1.12
+LIBSELINUX_MD5		:= 73270f384a032fad34b5fe075fa05ce2
+LIBSELINUX		:= libselinux-$(LIBSELINUX_VERSION)
+LIBSELINUX_SUFFIX	:= tar.gz
+LIBSELINUX_URL		:= https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20120924/$(LIBSELINUX).$(LIBSELINUX_SUFFIX)
+LIBSELINUX_SOURCE	:= $(SRCDIR)/$(LIBSELINUX).$(LIBSELINUX_SUFFIX)
+LIBSELINUX_DIR		:= $(BUILDDIR)/$(LIBSELINUX)
+LIBSELINUX_LICENSE	:= public_domain
+
+# ----------------------------------------------------------------------------
+# Prepare
+# ----------------------------------------------------------------------------
+
+LIBSELINUX_CONF_TOOL := NO
+# no := due to CROSS_PYTHON
+LIBSELINUX_MAKE_ENV = \
+	$(CROSS_ENV) \
+	CFLAGS="-O2 -Wall -g" \
+	PYTHON=$(CROSS_PYTHON)
+LIBSELINUX_MAKE_OPT := \
+	LIBDIR=$(PTXDIST_SYSROOT_TARGET)/usr/lib
+LIBSELINUX_INSTALL_OPT := \
+	install
+
+ifdef PTXCONF_LIBSELINUX_PYTHON
+LIBSELINUX_MAKE_OPT	+= pywrap
+LIBSELINUX_INSTALL_OPT	+= install-pywrap
+endif
+
+# ----------------------------------------------------------------------------
+# Target-Install
+# ----------------------------------------------------------------------------
+
+LIBSELINUX_PROGS := \
+	avcstat \
+	compute_av \
+	compute_create \
+	compute_member \
+	compute_relabel \
+	compute_user \
+	getconlist \
+	getdefaultcon \
+	getenforce \
+	getfilecon \
+	getpidcon \
+	getsebool \
+	getseuser \
+	matchpathcon \
+	policyvers \
+	selinux_check_securetty_context \
+	selinuxenabled \
+	selinuxexeccon \
+	setenforce \
+	setfilecon \
+	togglesebool
+
+$(STATEDIR)/libselinux.targetinstall:
+	@$(call targetinfo)
+
+	@$(call install_init, libselinux)
+	@$(call install_fixup, libselinux,PRIORITY,optional)
+	@$(call install_fixup, libselinux,SECTION,base)
+	@$(call install_fixup, libselinux,AUTHOR,"Wolfram Sang <w.sang@pengutronix.de>")
+	@$(call install_fixup, libselinux,DESCRIPTION,missing)
+
+	@$(call install_lib, libselinux, 0, 0, 0644, libselinux)
+
+	@$(foreach prog, $(LIBSELINUX_PROGS), \
+		$(call install_copy, libselinux, 0, 0, 0755, -, /usr/sbin/$(prog));)
+
+ifdef PTXCONF_LIBSELINUX_PYTHON
+	@$(call install_tree, libselinux, 0, 0, -, $(PYTHON_SITEPACKAGES))
+endif
+	@$(call install_finish, libselinux)
+
+	@$(call touch)
+
+# vim: syntax=make
-- 
2.47.3

[ptxdist] [PATCH v2 07/17] libselinux: version bump 2.1.12 -> 3.11

[Ladislav Michl]

From: Ladislav Michl <ladis@triops.cz>

Signed-off-by: Ladislav Michl <ladis@triops.cz>
---
 CHANGES:
 - v2: build with setrans and rpm support, libselinux exports their
       symbols even when disabled, leading to undefined references
       (e.g. selinux_raw_context_to_color in secon). Select LIBC_DL.
       Make python wrapper depend on PYTHON3 instead of selecting it to
       avoid Kconfig recursive dependency (PYTHON3 -> LIBUUID ->
       UTIL_LINUX -> LIBSELINUX -> PYTHON3).

 ...PyString_FromString-with-PyUnicode_F.patch | 48 ++++++++++++
 patches/libselinux-3.11/series                |  4 +
 rules/libselinux.in                           | 57 +++++++++++---
 rules/libselinux.make                         | 76 +++++++++++++------
 4 files changed, 154 insertions(+), 31 deletions(-)
 create mode 100644 patches/libselinux-3.11/0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch
 create mode 100644 patches/libselinux-3.11/series

diff --git a/patches/libselinux-3.11/0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch b/patches/libselinux-3.11/0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch
new file mode 100644
index 000000000..015ede608
--- /dev/null
+++ b/patches/libselinux-3.11/0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch
@@ -0,0 +1,48 @@
+From: Petr Lautrbach <lautrbach@redhat.com>
+Date: Thu, 6 Aug 2026 16:30:44 +0200
+Subject: [PATCH] libselinux: Replace PyString_FromString with
+ PyUnicode_FromString for SWIG 4.5.0 compatibility
+
+SWIG 4.5.0 removed Python 2 C API compatibility macros (PyInt_*,
+PyString_*, SWIG_Python_str_*) from its runtime header pyhead.swg.
+These macros previously mapped deprecated Python 2 C API names to their
+Python 3 equivalents.
+
+Fixes: https://github.com/SELinuxProject/selinux/issues/538
+Authored-by: Jitka Plesníková <jplesnik@redhat.com>
+Signed-off-by: Petr Lautrbach <lautrbach@redhat.com>
+Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
+---
+ src/selinuxswig_python.i | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/selinuxswig_python.i b/src/selinuxswig_python.i
+--- a/src/selinuxswig_python.i
++++ b/src/selinuxswig_python.i
+@@ -69,7 +69,7 @@
+ 	PyObject* list = PyList_New(*$2);
+ 	int i;
+ 	for (i = 0; i < *$2; i++) {
+-		PyList_SetItem(list, i, PyString_FromString((*$1)[i]));
++		PyList_SetItem(list, i, PyUnicode_FromString((*$1)[i]));
+ 	}
+ 	$result = SWIG_AppendOutput($result, list);
+ }
+@@ -102,7 +102,7 @@
+ 			len++;
+ 		plist = PyList_New(len);
+ 		for (i = 0; i < len; i++) {
+-			PyList_SetItem(plist, i, PyString_FromString((*$1)[i]));
++			PyList_SetItem(plist, i, PyUnicode_FromString((*$1)[i]));
+ 		}
+ 	} else {
+ 		plist = PyList_New(0);
+@@ -119,7 +119,7 @@
+ 	if (*$1) {
+ 		plist = PyList_New(result);
+ 		for (i = 0; i < result; i++) {
+-			PyList_SetItem(plist, i, PyString_FromString((*$1)[i]));
++			PyList_SetItem(plist, i, PyUnicode_FromString((*$1)[i]));
+ 		}
+ 	} else {
+ 		plist = PyList_New(0);
diff --git a/patches/libselinux-3.11/series b/patches/libselinux-3.11/series
new file mode 100644
index 000000000..9d79f21d8
--- /dev/null
+++ b/patches/libselinux-3.11/series
@@ -0,0 +1,4 @@
+# generated by git-ptx-patches
+#tag:base --start-number 1
+0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch
+# 9229b75b9f37589afb32a0e0c582e3b8  - git-ptx-patches magic
diff --git a/rules/libselinux.in b/rules/libselinux.in
index 6d6b1e655..0ff1358af 100644
--- a/rules/libselinux.in
+++ b/rules/libselinux.in
@@ -1,27 +1,66 @@
-## SECTION=staging
-## old section:
-### SECTION=selinux
+## SECTION=selinux
 
 menuconfig LIBSELINUX
 	tristate
 	prompt "libselinux                    "
-	select LIBPCRE
+	select LIBC_DL
+	select PCRE2
+	select PCRE2_8
 	select LIBSEPOL
-	select PYTHON		if LIBSELINUX_PYTHON
 	select HOST_SWIG	if LIBSELINUX_PYTHON
+	select HOST_PYTHON3_PIP	if LIBSELINUX_PYTHON
 	help
 	  libselinux provides an API for SELinux applications to get and set
 	  process and file security contexts and to obtain security policy
 	  decisions. Required for any applications that use the SELinux
 	  API.
 
-	  STAGING: remove in ptxdist-2020.12.0
-	  Old version that need to be updated. Fails to build with gcc >= 9.x.
-
 if LIBSELINUX
 
+config LIBSELINUX_UTILS
+	bool "install utilities"
+
+if LIBSELINUX_UTILS
+
+config LIBSELINUX_GETENFORCE
+	bool "getenforce"
+	depends on !BUSYBOX_GETENFORCE || ALLYES
+
+comment "busybox' getenforce is selected!"
+	depends on BUSYBOX_GETENFORCE
+
+config LIBSELINUX_GETSEBOOL
+	bool "getsebool"
+	depends on !BUSYBOX_GETSEBOOL || ALLYES
+
+comment "busybox' getsebool is selected!"
+	depends on BUSYBOX_GETSEBOOL
+
+config LIBSELINUX_MATCHPATHCON
+	bool "matchpathcon"
+	depends on !BUSYBOX_MATCHPATHCON || ALLYES
+
+comment "busybox' matchpathcon is selected!"
+	depends on BUSYBOX_MATCHPATHCON
+
+config LIBSELINUX_SELINUXENABLED
+	bool "selinuxenabled"
+	depends on !BUSYBOX_SELINUXENABLED || ALLYES
+
+comment "busybox' selinuxenabled is selected!"
+	depends on BUSYBOX_SELINUXENABLED
+
+config LIBSELINUX_SETENFORCE
+	bool "setenforce"
+	depends on !BUSYBOX_SETENFORCE || ALLYES
+
+comment "busybox' setenforce is selected!"
+	depends on BUSYBOX_SETENFORCE
+
+endif
+
 config LIBSELINUX_PYTHON
 	bool "python wrapper"
-	depends on STAGING
+	depends on PYTHON3
 
 endif
diff --git a/rules/libselinux.make b/rules/libselinux.make
index 9f6b6a62f..b7bf42854 100644
--- a/rules/libselinux.make
+++ b/rules/libselinux.make
@@ -14,62 +14,94 @@ PACKAGES-$(PTXCONF_LIBSELINUX) += libselinux
 #
 # Paths and names
 #
-LIBSELINUX_VERSION	:= 2.1.12
-LIBSELINUX_MD5		:= 73270f384a032fad34b5fe075fa05ce2
+LIBSELINUX_VERSION	:= $(SELINUX_VERSION)
+LIBSELINUX_SHA256	:= 73d419c6e20e874adaa4019372cbd097eecf4d276e13f27ec5e67d35c0bd203c
 LIBSELINUX		:= libselinux-$(LIBSELINUX_VERSION)
 LIBSELINUX_SUFFIX	:= tar.gz
-LIBSELINUX_URL		:= https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20120924/$(LIBSELINUX).$(LIBSELINUX_SUFFIX)
+LIBSELINUX_URL		:= $(SELINUX_URL)/$(LIBSELINUX).$(LIBSELINUX_SUFFIX)
 LIBSELINUX_SOURCE	:= $(SRCDIR)/$(LIBSELINUX).$(LIBSELINUX_SUFFIX)
 LIBSELINUX_DIR		:= $(BUILDDIR)/$(LIBSELINUX)
 LIBSELINUX_LICENSE	:= public_domain
+LIBSELINUX_LICENSE_FILES	:= file://LICENSE;md5=84b4d2c6ef954a2d4081e775a270d0d0
+LIBSELINUX_CVE_PRODUCT	:= selinuxproject:libselinux
 
 # ----------------------------------------------------------------------------
 # Prepare
 # ----------------------------------------------------------------------------
 
-LIBSELINUX_CONF_TOOL := NO
-# no := due to CROSS_PYTHON
-LIBSELINUX_MAKE_ENV = \
-	$(CROSS_ENV) \
-	CFLAGS="-O2 -Wall -g" \
-	PYTHON=$(CROSS_PYTHON)
-LIBSELINUX_MAKE_OPT := \
-	LIBDIR=$(PTXDIST_SYSROOT_TARGET)/usr/lib
-LIBSELINUX_INSTALL_OPT := \
+LIBSELINUX_CONF_TOOL	:= NO
+LIBSELINUX_MAKE_ENV	:= $(CROSS_ENV)
+LIBSELINUX_MAKE_OPT	= \
+	PREFIX=/usr \
+	LIBDIR=/usr/lib \
+	SHLIBDIR=/usr/lib \
+	INCLUDEDIR=/usr/include \
+	SBINDIR=/usr/sbin \
+	USE_PCRE2=y \
+	USE_LFS=y \
+	DISABLE_SHARED=n \
+	DISABLE_BOOL=n \
+	DISABLE_SETRANS=n \
+	DISABLE_RPM=n \
+	DISABLE_X11=y \
+	ANDROID_HOST=n \
+	LABEL_BACKEND_ANDROID=n \
+	CFLAGS="-O2 -Wall -g"
+
+ifdef PTXCONF_LIBSELINUX_PYTHON
+LIBSELINUX_MAKE_OPT	+= \
+	PYTHON=$(CROSS_PYTHON3) \
+	PYTHONLIBDIR=$(PYTHON3_SITEPACKAGES)
+endif
+
+LIBSELINUX_INSTALL_OPT	= \
+	$(LIBSELINUX_MAKE_OPT) \
 	install
 
 ifdef PTXCONF_LIBSELINUX_PYTHON
-LIBSELINUX_MAKE_OPT	+= pywrap
 LIBSELINUX_INSTALL_OPT	+= install-pywrap
 endif
 
+# ----------------------------------------------------------------------------
+# Compile
+# ----------------------------------------------------------------------------
+
+$(STATEDIR)/libselinux.compile:
+	@$(call targetinfo)
+	@$(call world/compile, LIBSELINUX)
+ifdef PTXCONF_LIBSELINUX_PYTHON
+	@$(call compile, LIBSELINUX, $(LIBSELINUX_MAKE_OPT) pywrap)
+endif
+	@$(call touch)
+
 # ----------------------------------------------------------------------------
 # Target-Install
 # ----------------------------------------------------------------------------
 
-LIBSELINUX_PROGS := \
+LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_UTILS) := \
 	avcstat \
 	compute_av \
 	compute_create \
 	compute_member \
 	compute_relabel \
-	compute_user \
 	getconlist \
 	getdefaultcon \
-	getenforce \
 	getfilecon \
 	getpidcon \
-	getsebool \
 	getseuser \
-	matchpathcon \
 	policyvers \
+	sefcontext_compile \
 	selinux_check_securetty_context \
-	selinuxenabled \
 	selinuxexeccon \
-	setenforce \
 	setfilecon \
 	togglesebool
 
+LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_GETENFORCE)	+= getenforce
+LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_GETSEBOOL)	+= getsebool
+LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_MATCHPATHCON)	+= matchpathcon
+LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_SELINUXENABLED)	+= selinuxenabled
+LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_SETENFORCE)	+= setenforce
+
 $(STATEDIR)/libselinux.targetinstall:
 	@$(call targetinfo)
 
@@ -81,11 +113,11 @@ $(STATEDIR)/libselinux.targetinstall:
 
 	@$(call install_lib, libselinux, 0, 0, 0644, libselinux)
 
-	@$(foreach prog, $(LIBSELINUX_PROGS), \
+	@$(foreach prog, $(LIBSELINUX_PROGS-y), \
 		$(call install_copy, libselinux, 0, 0, 0755, -, /usr/sbin/$(prog));)
 
 ifdef PTXCONF_LIBSELINUX_PYTHON
-	@$(call install_tree, libselinux, 0, 0, -, $(PYTHON_SITEPACKAGES))
+	@$(call install_tree, libselinux, 0, 0, -, $(PYTHON3_SITEPACKAGES))
 endif
 	@$(call install_finish, libselinux)
 
-- 
2.47.3

[ptxdist] [PATCH v2 08/17] audit: new package

[Ladislav Michl]

From: Ladislav Michl <ladis@triops.cz>

Linux audit userspace, needed by libsemanage for libaudit.

Signed-off-by: Ladislav Michl <ladis@triops.cz>
---
 CHANGES:
 - v2: install /etc/libaudit.conf and tmpfiles.d snippet with 0640
       permissions, as upstream does.

 patches/audit-userspace-4.2.1/autogen.sh |   1 +
 rules/audit.in                           |  19 +++++
 rules/audit.make                         | 102 +++++++++++++++++++++++
 3 files changed, 122 insertions(+)
 create mode 120000 patches/audit-userspace-4.2.1/autogen.sh
 create mode 100644 rules/audit.in
 create mode 100644 rules/audit.make

diff --git a/patches/audit-userspace-4.2.1/autogen.sh b/patches/audit-userspace-4.2.1/autogen.sh
new file mode 120000
index 000000000..9f8a4cb7d
--- /dev/null
+++ b/patches/audit-userspace-4.2.1/autogen.sh
@@ -0,0 +1 @@
+../autogen.sh
\ No newline at end of file
diff --git a/rules/audit.in b/rules/audit.in
new file mode 100644
index 000000000..2c2582d8e
--- /dev/null
+++ b/rules/audit.in
@@ -0,0 +1,19 @@
+## SECTION=security
+
+menuconfig AUDIT
+	tristate
+	prompt "audit                         "
+	select LIBCAP_NG
+	help
+	  Linux audit userspace: libaudit, libauparse and the auditd
+	  daemon with its tools.
+
+if AUDIT
+
+config AUDIT_TOOLS
+	bool
+	prompt "install auditd and tools"
+	help
+	  Install auditd, auditctl, augenrules, ausearch and aureport.
+
+endif
diff --git a/rules/audit.make b/rules/audit.make
new file mode 100644
index 000000000..0353efd94
--- /dev/null
+++ b/rules/audit.make
@@ -0,0 +1,102 @@
+# -*-makefile-*-
+#
+# Copyright (C) 2026 by Ladislav Michl <ladis@triops.cz>
+#
+# For further information about the PTXdist project and license conditions
+# see the README file.
+#
+
+#
+# We provide this package
+#
+PACKAGES-$(PTXCONF_AUDIT) += audit
+
+#
+# Paths and names
+#
+AUDIT_VERSION	:= 4.2.1
+AUDIT_SHA256	:= 42876d195ee2ded19e5f72d7664096eee314928aa36ad346719ba5b25818fc84
+AUDIT		:= audit-userspace-$(AUDIT_VERSION)
+AUDIT_SUFFIX	:= tar.gz
+AUDIT_URL	:= https://github.com/linux-audit/audit-userspace/archive/refs/tags/v$(AUDIT_VERSION).$(AUDIT_SUFFIX)
+AUDIT_SOURCE	:= $(SRCDIR)/$(AUDIT).$(AUDIT_SUFFIX)
+AUDIT_DIR	:= $(BUILDDIR)/$(AUDIT)
+AUDIT_LICENSE	:= GPL-2.0-or-later AND LGPL-2.1-or-later
+AUDIT_LICENSE_FILES	:= \
+	file://COPYING;md5=94d55d512a9ba36caa9b7df079bae19f \
+	file://COPYING.LIB;md5=e3eda01d9815f8d24aae2dbd89b68b06
+AUDIT_CVE_PRODUCT	:= audit-userspace_project:audit-userspace
+
+# ----------------------------------------------------------------------------
+# Prepare
+# ----------------------------------------------------------------------------
+
+#
+# autoconf
+#
+AUDIT_CONF_TOOL	:= autoconf
+AUDIT_CONF_OPT	:= \
+	$(CROSS_AUTOCONF_USR) \
+	--runstatedir=/run \
+	--disable-listener \
+	--disable-zos-remote \
+	--disable-legacy-actions \
+	--disable-gssapi-krb5 \
+	--disable-tls \
+	--disable-experimental \
+	--without-python3 \
+	--without-golang \
+	--without-asan \
+	--$(call ptx/wwo, PTXCONF_ARCH_ARM)-arm \
+	--$(call ptx/wwo, PTXCONF_ARCH_ARM64)-aarch64 \
+	--$(call ptx/wwo, PTXCONF_ARCH_RISCV)-riscv \
+	--without-apparmor \
+	--without-libwrap \
+	--without-io_uring \
+	--without-nftables \
+	--with-libcap-ng
+
+# ----------------------------------------------------------------------------
+# Target-Install
+# ----------------------------------------------------------------------------
+
+$(STATEDIR)/audit.targetinstall:
+	@$(call targetinfo)
+
+	@$(call install_init, audit)
+	@$(call install_fixup, audit,PRIORITY,optional)
+	@$(call install_fixup, audit,SECTION,base)
+	@$(call install_fixup, audit,AUTHOR,"Ladislav Michl <ladis@triops.cz>")
+	@$(call install_fixup, audit,DESCRIPTION,missing)
+
+	@$(call install_lib, audit, 0, 0, 0644, libaudit)
+	@$(call install_lib, audit, 0, 0, 0644, libauparse)
+	@$(call install_alternative, audit, 0, 0, 0640, /etc/libaudit.conf)
+
+ifdef PTXCONF_AUDIT_TOOLS
+	@$(call install_copy, audit, 0, 0, 0755, -, /usr/sbin/auditd)
+	@$(call install_copy, audit, 0, 0, 0755, -, /usr/sbin/auditctl)
+	@$(call install_copy, audit, 0, 0, 0755, -, /usr/sbin/augenrules)
+	@$(call install_copy, audit, 0, 0, 0755, -, /usr/sbin/aureport)
+	@$(call install_copy, audit, 0, 0, 0755, -, /usr/sbin/ausearch)
+	@$(call install_alternative, audit, 0, 0, 0640, /etc/audit/auditd.conf)
+	@$(call install_alternative, audit, 0, 0, 0640, /etc/audit/audit-stop.rules)
+	@$(call install_copy, audit, 0, 0, 0750, /etc/audit/rules.d)
+	@$(call install_copy, audit, 0, 0, 0700, /var/log/audit)
+
+ifdef PTXCONF_INITMETHOD_SYSTEMD
+	@$(call install_alternative, audit, 0, 0, 0644, /usr/lib/systemd/system/auditd.service)
+	@$(call install_link, audit, ../auditd.service, \
+		/usr/lib/systemd/system/multi-user.target.wants/auditd.service)
+	@$(call install_alternative, audit, 0, 0, 0644, /usr/lib/systemd/system/audit-rules.service)
+	@$(call install_link, audit, ../audit-rules.service, \
+		/usr/lib/systemd/system/multi-user.target.wants/audit-rules.service)
+	@$(call install_alternative, audit, 0, 0, 0640, /usr/lib/tmpfiles.d/audit.conf)
+endif
+endif
+
+	@$(call install_finish, audit)
+
+	@$(call touch)
+
+# vim: syntax=make
-- 
2.47.3

[ptxdist] [PATCH v2 09/17] Revert "libsemanage: remove after more than one year in staging"

[Ladislav Michl]

From: Ladislav Michl <ladis@triops.cz>

This partially reverts commit 9de860c283e9c33727aa35bf3c766dfd4a37f9bd.

Signed-off-by: Ladislav Michl <ladis@triops.cz>
---
 CHANGES:
 - v2: None

 rules/libsemanage.in   | 29 +++++++++++++++++
 rules/libsemanage.make | 70 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 99 insertions(+)
 create mode 100644 rules/libsemanage.in
 create mode 100644 rules/libsemanage.make

diff --git a/rules/libsemanage.in b/rules/libsemanage.in
new file mode 100644
index 000000000..9d7ebf03d
--- /dev/null
+++ b/rules/libsemanage.in
@@ -0,0 +1,29 @@
+## SECTION=staging
+## old section:
+### SECTION=selinux
+
+menuconfig LIBSEMANAGE
+	tristate
+	prompt "libsemanage                   "
+	select BZIP2
+	select BZIP2_LIBBZ2
+	select LIBSEPOL
+	select LIBSELINUX
+	select USTR
+	select PYTHON		if LIBSEMANAGE_PYTHON
+	select HOST_SWIG	if LIBSEMANAGE_PYTHON
+	help
+	  This package provides the shared libraries for SELinux policy management.
+	  It uses libsepol for binary policy manipulation and libselinux for
+	  interacting with the SELinux system.
+
+	  STAGING: remove in ptxdist-2020.12.0
+	  Old version that need to be updated. Moved to staging with libselinux.
+
+if LIBSEMANAGE
+
+config LIBSEMANAGE_PYTHON
+	bool "python wrapper"
+	depends on STAGING
+
+endif
diff --git a/rules/libsemanage.make b/rules/libsemanage.make
new file mode 100644
index 000000000..9e8a641e9
--- /dev/null
+++ b/rules/libsemanage.make
@@ -0,0 +1,70 @@
+# -*-makefile-*-
+#
+# Copyright (C) 2012 by Wolfram Sang <w.sang@pengutronix.de>
+#
+# For further information about the PTXdist project and license conditions
+# see the README file.
+#
+
+#
+# We provide this package
+#
+PACKAGES-$(PTXCONF_LIBSEMANAGE) += libsemanage
+
+#
+# Paths and names
+#
+LIBSEMANAGE_VERSION	:= 2.1.9
+LIBSEMANAGE_MD5		:= 209e11da5b36c595a796751583f016f8
+LIBSEMANAGE		:= libsemanage-$(LIBSEMANAGE_VERSION)
+LIBSEMANAGE_SUFFIX	:= tar.gz
+LIBSEMANAGE_URL		:= https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20120924/$(LIBSEMANAGE).$(LIBSEMANAGE_SUFFIX)
+LIBSEMANAGE_SOURCE	:= $(SRCDIR)/$(LIBSEMANAGE).$(LIBSEMANAGE_SUFFIX)
+LIBSEMANAGE_DIR		:= $(BUILDDIR)/$(LIBSEMANAGE)
+LIBSEMANAGE_LICENSE	:= LGPL-2.1-or-later
+
+# ----------------------------------------------------------------------------
+# Prepare
+# ----------------------------------------------------------------------------
+
+LIBSEMANAGE_CONF_TOOL := NO
+# no := due to CROSS_PYTHON
+LIBSEMANAGE_MAKE_ENV = \
+	$(CROSS_ENV) \
+	CFLAGS="-O2 -Wall -g" \
+	PYTHON=$(CROSS_PYTHON)
+
+LIBSEMANAGE_MAKE_OPT := \
+	LIBDIR=$(PTXDIST_SYSROOT_TARGET)/usr/lib
+LIBSEMANAGE_INSTALL_OPT := \
+	install
+
+ifdef PTXCONF_LIBSEMANAGE_PYTHON
+LIBSEMANAGE_MAKE_OPT	+= pywrap
+LIBSEMANAGE_INSTALL_OPT	+= install-pywrap
+endif
+
+# ----------------------------------------------------------------------------
+# Target-Install
+# ----------------------------------------------------------------------------
+
+$(STATEDIR)/libsemanage.targetinstall:
+	@$(call targetinfo)
+
+	@$(call install_init, libsemanage)
+	@$(call install_fixup, libsemanage,PRIORITY,optional)
+	@$(call install_fixup, libsemanage,SECTION,base)
+	@$(call install_fixup, libsemanage,AUTHOR,"Wolfram Sang <w.sang@pengutronix.de>")
+	@$(call install_fixup, libsemanage,DESCRIPTION,missing)
+
+	@$(call install_lib, libsemanage, 0, 0, 0644, libsemanage)
+	@$(call install_alternative, libsemanage, 0, 0, 0644, /etc/selinux/semanage.conf)
+
+ifdef PTXCONF_LIBSEMANAGE_PYTHON
+	@$(call install_tree, libsemanage, 0, 0, -, $(PYTHON_SITEPACKAGES))
+endif
+	@$(call install_finish, libsemanage)
+
+	@$(call touch)
+
+# vim: syntax=make
-- 
2.47.3

[ptxdist] [PATCH v2 10/17] libsemanage: version bump 2.1.9 -> 3.11

[Ladislav Michl]

From: Ladislav Michl <ladis@triops.cz>

Signed-off-by: Ladislav Michl <ladis@triops.cz>
---
 CHANGES:
 - v2: make python wrapper depend on PYTHON3 instead of selecting it.

 rules/libsemanage.in   | 13 ++++-------
 rules/libsemanage.make | 49 ++++++++++++++++++++++++++++++------------
 2 files changed, 39 insertions(+), 23 deletions(-)

diff --git a/rules/libsemanage.in b/rules/libsemanage.in
index 9d7ebf03d..aaf46c4a9 100644
--- a/rules/libsemanage.in
+++ b/rules/libsemanage.in
@@ -1,29 +1,24 @@
-## SECTION=staging
-## old section:
-### SECTION=selinux
+## SECTION=selinux
 
 menuconfig LIBSEMANAGE
 	tristate
 	prompt "libsemanage                   "
+	select AUDIT
 	select BZIP2
 	select BZIP2_LIBBZ2
 	select LIBSEPOL
 	select LIBSELINUX
-	select USTR
-	select PYTHON		if LIBSEMANAGE_PYTHON
+	select HOST_FLEX
 	select HOST_SWIG	if LIBSEMANAGE_PYTHON
 	help
 	  This package provides the shared libraries for SELinux policy management.
 	  It uses libsepol for binary policy manipulation and libselinux for
 	  interacting with the SELinux system.
 
-	  STAGING: remove in ptxdist-2020.12.0
-	  Old version that need to be updated. Moved to staging with libselinux.
-
 if LIBSEMANAGE
 
 config LIBSEMANAGE_PYTHON
 	bool "python wrapper"
-	depends on STAGING
+	depends on PYTHON3
 
 endif
diff --git a/rules/libsemanage.make b/rules/libsemanage.make
index 9e8a641e9..c9972c474 100644
--- a/rules/libsemanage.make
+++ b/rules/libsemanage.make
@@ -14,36 +14,57 @@ PACKAGES-$(PTXCONF_LIBSEMANAGE) += libsemanage
 #
 # Paths and names
 #
-LIBSEMANAGE_VERSION	:= 2.1.9
-LIBSEMANAGE_MD5		:= 209e11da5b36c595a796751583f016f8
+LIBSEMANAGE_VERSION	:= $(SELINUX_VERSION)
+LIBSEMANAGE_SHA256	:= e76160286bbfb0821602c6c0c3220ebcf366ad3246d3b9d0a0fbefcd35e86043
 LIBSEMANAGE		:= libsemanage-$(LIBSEMANAGE_VERSION)
 LIBSEMANAGE_SUFFIX	:= tar.gz
-LIBSEMANAGE_URL		:= https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20120924/$(LIBSEMANAGE).$(LIBSEMANAGE_SUFFIX)
+LIBSEMANAGE_URL		:= $(SELINUX_URL)/$(LIBSEMANAGE).$(LIBSEMANAGE_SUFFIX)
 LIBSEMANAGE_SOURCE	:= $(SRCDIR)/$(LIBSEMANAGE).$(LIBSEMANAGE_SUFFIX)
 LIBSEMANAGE_DIR		:= $(BUILDDIR)/$(LIBSEMANAGE)
 LIBSEMANAGE_LICENSE	:= LGPL-2.1-or-later
+LIBSEMANAGE_LICENSE_FILES	:= file://LICENSE;md5=03068f550c635f6520e0f0252da412fc
+LIBSEMANAGE_CVE_PRODUCT	:= selinuxproject:libsemanage
 
 # ----------------------------------------------------------------------------
 # Prepare
 # ----------------------------------------------------------------------------
 
-LIBSEMANAGE_CONF_TOOL := NO
-# no := due to CROSS_PYTHON
-LIBSEMANAGE_MAKE_ENV = \
-	$(CROSS_ENV) \
-	CFLAGS="-O2 -Wall -g" \
-	PYTHON=$(CROSS_PYTHON)
+LIBSEMANAGE_CONF_TOOL	:= NO
+LIBSEMANAGE_MAKE_ENV	:= $(CROSS_ENV)
+LIBSEMANAGE_MAKE_OPT	= \
+	PREFIX=/usr \
+	LIBDIR=/usr/lib \
+	INCLUDEDIR=/usr/include \
+	SYSCONFDIR=/etc \
+	DISABLE_SHARED=n \
+	CFLAGS="-O2 -Wall -g"
 
-LIBSEMANAGE_MAKE_OPT := \
-	LIBDIR=$(PTXDIST_SYSROOT_TARGET)/usr/lib
-LIBSEMANAGE_INSTALL_OPT := \
+ifdef PTXCONF_LIBSEMANAGE_PYTHON
+LIBSEMANAGE_MAKE_OPT	+= \
+	PYTHON=$(CROSS_PYTHON3) \
+	PYTHONLIBDIR=$(PYTHON3_SITEPACKAGES)
+endif
+
+LIBSEMANAGE_INSTALL_OPT	= \
+	$(LIBSEMANAGE_MAKE_OPT) \
 	install
 
 ifdef PTXCONF_LIBSEMANAGE_PYTHON
-LIBSEMANAGE_MAKE_OPT	+= pywrap
 LIBSEMANAGE_INSTALL_OPT	+= install-pywrap
 endif
 
+# ----------------------------------------------------------------------------
+# Compile
+# ----------------------------------------------------------------------------
+
+$(STATEDIR)/libsemanage.compile:
+	@$(call targetinfo)
+	@$(call world/compile, LIBSEMANAGE)
+ifdef PTXCONF_LIBSEMANAGE_PYTHON
+	@$(call compile, LIBSEMANAGE, $(LIBSEMANAGE_MAKE_OPT) pywrap)
+endif
+	@$(call touch)
+
 # ----------------------------------------------------------------------------
 # Target-Install
 # ----------------------------------------------------------------------------
@@ -61,7 +82,7 @@ $(STATEDIR)/libsemanage.targetinstall:
 	@$(call install_alternative, libsemanage, 0, 0, 0644, /etc/selinux/semanage.conf)
 
 ifdef PTXCONF_LIBSEMANAGE_PYTHON
-	@$(call install_tree, libsemanage, 0, 0, -, $(PYTHON_SITEPACKAGES))
+	@$(call install_tree, libsemanage, 0, 0, -, $(PYTHON3_SITEPACKAGES))
 endif
 	@$(call install_finish, libsemanage)
 
-- 
2.47.3

[ptxdist] [PATCH v2 11/17] Revert "checkpolicy: remove after more than one year in staging"

[Ladislav Michl]

From: Ladislav Michl <ladis@triops.cz>

This partially reverts commit be09c6089c7c6c818b17701af5127ed47160d625.

Signed-off-by: Ladislav Michl <ladis@triops.cz>
---
 CHANGES:
 - v2: None

 rules/checkpolicy.in   | 36 ++++++++++++++++++++++++++
 rules/checkpolicy.make | 59 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 95 insertions(+)
 create mode 100644 rules/checkpolicy.in
 create mode 100644 rules/checkpolicy.make

diff --git a/rules/checkpolicy.in b/rules/checkpolicy.in
new file mode 100644
index 000000000..b1e8bca01
--- /dev/null
+++ b/rules/checkpolicy.in
@@ -0,0 +1,36 @@
+## SECTION=staging
+## old section:
+### SECTION=selinux
+
+config CHECKPOLICY
+	tristate
+	prompt "checkpolicy"
+	#
+	# The target package is not functional yet, but we need the host
+	# package. Depend on broken for now.
+	#
+	depends on BROKEN
+	select LIBSELINUX
+	select LIBSEPOL
+	select FLEX
+	help
+	  Security-enhanced Linux is a patch of the Linux kernel and a
+	  number of utilities with enhanced security functionality
+	  designed to add mandatory access controls to Linux. The
+	  Security-enhanced Linux kernel contains new architectural
+	  components originally developed to improve the security of
+	  the Flask operating system. These architectural components
+	  provide general support for the enforcement of many kinds of
+	  mandatory access control policies, including those based on
+	  the concepts of Type Enforcement, Role-based Access Control,
+	  and Multi-level Security.
+
+	  This package contains checkpolicy, the SELinux policy
+	  compiler. Only required for building policies. It uses
+	  libsepol to generate the binary policy. checkpolicy uses
+	  the static libsepol since it deals with low level details of
+	  the policy that have not been encapsulated/abstracted by a
+	  proper shared library interface.
+
+	  STAGING: remove in ptxdist-2020.12.0
+	  Old version that need to be updated. Moved to staging with libselinux.
diff --git a/rules/checkpolicy.make b/rules/checkpolicy.make
new file mode 100644
index 000000000..6946fcecd
--- /dev/null
+++ b/rules/checkpolicy.make
@@ -0,0 +1,59 @@
+# -*-makefile-*-
+#
+# Copyright (C) 2013 by Marc Kleine-Budde <mkl@pengutronix.de>
+#
+# For further information about the PTXdist project and license conditions
+# see the README file.
+#
+
+#
+# We provide this package
+#
+PACKAGES-$(PTXCONF_CHECKPOLICY) += checkpolicy
+
+#
+# Paths and names
+#
+CHECKPOLICY_VERSION	:= 2.1.11
+CHECKPOLICY_MD5		:= 046b590de004f8a6cee655c4e95a7970
+CHECKPOLICY		:= checkpolicy-$(CHECKPOLICY_VERSION)
+CHECKPOLICY_SUFFIX	:= tar.gz
+CHECKPOLICY_URL		:= https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20120924/$(CHECKPOLICY).$(CHECKPOLICY_SUFFIX)
+CHECKPOLICY_SOURCE	:= $(SRCDIR)/$(CHECKPOLICY).$(CHECKPOLICY_SUFFIX)
+CHECKPOLICY_DIR		:= $(BUILDDIR)/$(CHECKPOLICY)
+CHECKPOLICY_LICENSE	:= unknown
+
+# ----------------------------------------------------------------------------
+# Prepare
+# ----------------------------------------------------------------------------
+
+#
+# autoconf
+#
+CHECKPOLICY_CONF_TOOL := NO
+CHECKPOLICY_MAKE_ENV := $(CROSS_ENV)
+CHECKPOLICY_MAKE_OPT := LIBDIR=$(PTXDIST_SYSROOT_TARGET)/usr/lib
+CHECKPOLICY_INSTALL_OPT = \
+	PREFIX=$(CHECKPOLICY_PKGDIR) \
+	install
+
+# ----------------------------------------------------------------------------
+# Target-Install
+# ----------------------------------------------------------------------------
+
+$(STATEDIR)/checkpolicy.targetinstall:
+	@$(call targetinfo)
+
+	@$(call install_init, checkpolicy)
+	@$(call install_fixup, checkpolicy,PRIORITY,optional)
+	@$(call install_fixup, checkpolicy,SECTION,base)
+	@$(call install_fixup, checkpolicy,AUTHOR,"Marc Kleine-Budde <mkl@pengutronix.de>")
+	@$(call install_fixup, checkpolicy,DESCRIPTION,missing)
+
+	@$(call install_copy, checkpolicy, 0, 0, 0755, $(CHECKPOLICY_DIR)/foobar, /dev/null)
+
+	@$(call install_finish, checkpolicy)
+
+	@$(call touch)
+
+# vim: syntax=make
-- 
2.47.3

[ptxdist] [PATCH v2 12/17] checkpolicy: version bump 2.1.11 -> 3.11

[Ladislav Michl]

From: Ladislav Michl <ladis@triops.cz>

Signed-off-by: Ladislav Michl <ladis@triops.cz>
---
 CHANGES:
 - v2: None

 rules/checkpolicy.in   | 15 ++-------------
 rules/checkpolicy.make | 26 +++++++++++++-------------
 2 files changed, 15 insertions(+), 26 deletions(-)

diff --git a/rules/checkpolicy.in b/rules/checkpolicy.in
index b1e8bca01..6b51dd6be 100644
--- a/rules/checkpolicy.in
+++ b/rules/checkpolicy.in
@@ -1,18 +1,10 @@
-## SECTION=staging
-## old section:
-### SECTION=selinux
+## SECTION=selinux
 
 config CHECKPOLICY
 	tristate
 	prompt "checkpolicy"
-	#
-	# The target package is not functional yet, but we need the host
-	# package. Depend on broken for now.
-	#
-	depends on BROKEN
-	select LIBSELINUX
 	select LIBSEPOL
-	select FLEX
+	select HOST_FLEX
 	help
 	  Security-enhanced Linux is a patch of the Linux kernel and a
 	  number of utilities with enhanced security functionality
@@ -31,6 +23,3 @@ config CHECKPOLICY
 	  the static libsepol since it deals with low level details of
 	  the policy that have not been encapsulated/abstracted by a
 	  proper shared library interface.
-
-	  STAGING: remove in ptxdist-2020.12.0
-	  Old version that need to be updated. Moved to staging with libselinux.
diff --git a/rules/checkpolicy.make b/rules/checkpolicy.make
index 6946fcecd..1cbf427d7 100644
--- a/rules/checkpolicy.make
+++ b/rules/checkpolicy.make
@@ -14,27 +14,26 @@ PACKAGES-$(PTXCONF_CHECKPOLICY) += checkpolicy
 #
 # Paths and names
 #
-CHECKPOLICY_VERSION	:= 2.1.11
-CHECKPOLICY_MD5		:= 046b590de004f8a6cee655c4e95a7970
+CHECKPOLICY_VERSION	:= $(SELINUX_VERSION)
+CHECKPOLICY_SHA256	:= 9b81bfceef7fa9d02f9872e56a786f343dc58ef4b5713dce0d5c416e5b84cefa
 CHECKPOLICY		:= checkpolicy-$(CHECKPOLICY_VERSION)
 CHECKPOLICY_SUFFIX	:= tar.gz
-CHECKPOLICY_URL		:= https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20120924/$(CHECKPOLICY).$(CHECKPOLICY_SUFFIX)
+CHECKPOLICY_URL		:= $(SELINUX_URL)/$(CHECKPOLICY).$(CHECKPOLICY_SUFFIX)
 CHECKPOLICY_SOURCE	:= $(SRCDIR)/$(CHECKPOLICY).$(CHECKPOLICY_SUFFIX)
 CHECKPOLICY_DIR		:= $(BUILDDIR)/$(CHECKPOLICY)
-CHECKPOLICY_LICENSE	:= unknown
+CHECKPOLICY_LICENSE	:= GPL-2.0-only AND LGPL-2.1-or-later
+CHECKPOLICY_LICENSE_FILES	:= file://LICENSE;md5=393a5ca445f6965873eca0259a17f833
 
 # ----------------------------------------------------------------------------
 # Prepare
 # ----------------------------------------------------------------------------
 
-#
-# autoconf
-#
-CHECKPOLICY_CONF_TOOL := NO
-CHECKPOLICY_MAKE_ENV := $(CROSS_ENV)
-CHECKPOLICY_MAKE_OPT := LIBDIR=$(PTXDIST_SYSROOT_TARGET)/usr/lib
-CHECKPOLICY_INSTALL_OPT = \
-	PREFIX=$(CHECKPOLICY_PKGDIR) \
+CHECKPOLICY_CONF_TOOL	:= NO
+CHECKPOLICY_MAKE_ENV	:= $(CROSS_ENV)
+CHECKPOLICY_MAKE_OPT	:= \
+	CFLAGS="-O2 -Wall -g"
+CHECKPOLICY_INSTALL_OPT	:= \
+	$(CHECKPOLICY_MAKE_OPT) \
 	install
 
 # ----------------------------------------------------------------------------
@@ -50,7 +49,8 @@ $(STATEDIR)/checkpolicy.targetinstall:
 	@$(call install_fixup, checkpolicy,AUTHOR,"Marc Kleine-Budde <mkl@pengutronix.de>")
 	@$(call install_fixup, checkpolicy,DESCRIPTION,missing)
 
-	@$(call install_copy, checkpolicy, 0, 0, 0755, $(CHECKPOLICY_DIR)/foobar, /dev/null)
+	@$(call install_copy, checkpolicy, 0, 0, 0755, -, /usr/bin/checkpolicy)
+	@$(call install_copy, checkpolicy, 0, 0, 0755, -, /usr/bin/checkmodule)
 
 	@$(call install_finish, checkpolicy)
 
-- 
2.47.3

[ptxdist] [PATCH v2 13/17] Revert "policycoreutils: remove after more than one year in staging"

[Ladislav Michl]

From: Ladislav Michl <ladis@triops.cz>

This partially reverts commit a7faf563f3149944b772a0e7c9540c03867d29dd.

Signed-off-by: Ladislav Michl <ladis@triops.cz>
---
 CHANGES:
 - v2: None

 rules/policycoreutils.in   | 111 ++++++++++++++++++++++++++
 rules/policycoreutils.make | 159 +++++++++++++++++++++++++++++++++++++
 2 files changed, 270 insertions(+)
 create mode 100644 rules/policycoreutils.in
 create mode 100644 rules/policycoreutils.make

diff --git a/rules/policycoreutils.in b/rules/policycoreutils.in
new file mode 100644
index 000000000..fce42b002
--- /dev/null
+++ b/rules/policycoreutils.in
@@ -0,0 +1,111 @@
+## SECTION=staging
+## old section:
+### SECTION=selinux
+
+menuconfig POLICYCOREUTILS
+	tristate
+	prompt "policycoreutils               "
+	select LIBCAP_NG
+	select LIBCGROUP
+	select LIBSELINUX
+	select LIBSEMANAGE
+	select LIBSEPOL
+	select DBUS_GLIB	if POLICYCOREUTILS_RESTORECOND
+	select BUSYBOX_FEATURE_FIND_DEPTH	if BUSYBOX_FIND
+	select BUSYBOX_FEATURE_FIND_DELETE	if BUSYBOX_FIND
+	select BUSYBOX_SELINUX			if BUSYBOX_FIND
+	select BUSYBOX_FEATURE_FIND_CONTEXT	if BUSYBOX_FIND
+	help
+	  This package contains the core policy utilities that are required
+	  for basic operation of an SELinux system.  These utilities include
+	  load_policy to load policies, setfiles to label filesystems, newrole
+	  to switch roles, and run_init to run /etc/init.d scripts in the proper
+	  context.
+
+	  STAGING: remove in ptxdist-2020.12.0
+	  Old version that need to be updated. Moved to staging with libselinux.
+
+if POLICYCOREUTILS
+
+menuconfig POLICYCOREUTILS_PYTHON
+	# needs sepolgen
+	depends on BROKEN
+	bool "python based tools"
+
+if POLICYCOREUTILS_PYTHON
+
+config POLICYCOREUTILS_AUDIT2ALLOW
+	bool "audit2allow"
+
+config POLICYCOREUTILS_SEPOLGEN_IFGEN
+	select POLICYCOREUTILS_AUDIT2ALLOW
+	bool "sepolgen-ifgen"
+
+config POLICYCOREUTILS_AUDIT2WHY
+	select POLICYCOREUTILS_AUDIT2ALLOW
+	bool "audit2why"
+
+config POLICYCOREUTILS_SANDBOX
+	bool "sandbox"
+	depends on BROKEN
+
+config POLICYCOREUTILS_CHCAT
+	select LIBSEMANAGE_PYTHON
+	depends on BROKEN
+	bool "chcat"
+
+config POLICYCOREUTILS_SEMANAGE
+	select LIBSEMANAGE_PYTHON
+	depends on BROKEN
+	bool "semanage"
+
+endif
+
+config POLICYCOREUTILS_LOAD_POLICY
+	bool "load_policy"
+
+config POLICYCOREUTILS_NEWROLE
+	bool "newrole"
+
+config POLICYCOREUTILS_RESTORECOND
+	bool "restorecond"
+	depends on BROKEN
+
+config POLICYCOREUTILS_RUN_INIT
+	bool "run_init/open_init_pty"
+
+config POLICYCOREUTILS_FIXFILES
+	bool "fixfiles"
+
+config POLICYCOREUTILS_GENHOMEDIRCON
+	select POLICYCOREUTILS_SEMODULE
+	bool "genhomedircon"
+
+config POLICYCOREUTILS_SECON
+	bool "secon"
+
+config POLICYCOREUTILS_SEMODULE
+	bool "semodule"
+
+config POLICYCOREUTILS_SEMODULE_DEPS
+	bool "semodule_deps"
+
+config POLICYCOREUTILS_SEMODULE_EXPAND
+	bool "semodule_expand"
+
+config POLICYCOREUTILS_SEMODULE_LINK
+	bool "semodule_link"
+
+config POLICYCOREUTILS_SEMODULE_PACKAGE
+	bool "semodule_package"
+
+config POLICYCOREUTILS_SESTATUS
+	bool "sestatus"
+
+config POLICYCOREUTILS_SETFILES
+	bool "setfiles/restorecon"
+
+config POLICYCOREUTILS_SETSEBOOL
+	bool "setsebool"
+
+endif
diff --git a/rules/policycoreutils.make b/rules/policycoreutils.make
new file mode 100644
index 000000000..07baaebe8
--- /dev/null
+++ b/rules/policycoreutils.make
@@ -0,0 +1,159 @@
+# -*-makefile-*-
+#
+# Copyright (C) 2012 by Wolfram Sang <w.sang@pengutronix.de>
+#
+# For further information about the PTXdist project and license conditions
+# see the README file.
+#
+
+#
+# We provide this package
+#
+PACKAGES-$(PTXCONF_POLICYCOREUTILS) += policycoreutils
+
+#
+# Paths and names
+#
+POLICYCOREUTILS_VERSION	:= 2.1.13
+POLICYCOREUTILS_MD5	:= 97c0b828599fe608f37894989820d71d
+POLICYCOREUTILS		:= policycoreutils-$(POLICYCOREUTILS_VERSION)
+POLICYCOREUTILS_SUFFIX	:= tar.gz
+POLICYCOREUTILS_URL	:= https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20120924/$(POLICYCOREUTILS).$(POLICYCOREUTILS_SUFFIX)
+POLICYCOREUTILS_SOURCE	:= $(SRCDIR)/$(POLICYCOREUTILS).$(POLICYCOREUTILS_SUFFIX)
+POLICYCOREUTILS_DIR	:= $(BUILDDIR)/$(POLICYCOREUTILS)
+POLICYCOREUTILS_LICENSE	:= GPL-2.0-or-later
+
+# ----------------------------------------------------------------------------
+# Prepare
+# ----------------------------------------------------------------------------
+
+POLICYCOREUTILS_SUBDIRS_y := \
+	man \
+	po \
+	scripts
+
+POLICYCOREUTILS_PROGS_y :=
+
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_AUDIT2ALLOW)		+= audit2allow
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_AUDIT2ALLOW)		+= /usr/bin/audit2allow
+
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEPOLGEN_IFGEN)	+= sepolgen-ifgen
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEPOLGEN_IFGEN)		+= /usr/bin/sepolgen-ifgen
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEPOLGEN_IFGEN)		+= /usr/bin/sepolgen-ifgen-attr-helper
+
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_AUDIT2WHY)		+= audit2why
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_AUDIT2WHY)		+= /usr/bin/audit2why
+
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_LOAD_POLICY)		+= load_policy
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_LOAD_POLICY)		+= /usr/sbin/load_policy
+
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_NEWROLE)		+= newrole
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_NEWROLE)		+= /usr/bin/newrole
+
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_RESTORECOND)		+= restorecond
+#POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_RESTORECOND)		+=
+
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT)		+= run_init
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT)		+= /usr/sbin/run_init
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT)		+= /usr/sbin/open_init_pty
+
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SANDBOX)		+= sandbox
+#POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SANDBOX)		+=
+
+# no SUBDIRS needed for scripts
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_CHCAT)			+= /usr/bin/chcat
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_FIXFILES)		+= /usr/sbin/fixfiles
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_GENHOMEDIRCON)		+= /usr/sbin/genhomedircon
+
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SECON)		+= secon
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SECON)			+= /usr/bin/secon
+
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMANAGE)		+= semanage
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMANAGE)		+= /usr/sbin/semanage
+
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE)		+= semodule
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE)		+= /usr/sbin/semodule
+
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_DEPS)	+= semodule_deps
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_DEPS)		+= /usr/bin/semodule_deps
+
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_EXPAND)	+= semodule_expand
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_EXPAND)	+= /usr/bin/semodule_expand
+
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_LINK)	+= semodule_link
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_LINK)		+= /usr/bin/semodule_link
+
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_PACKAGE)	+= semodule_package
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_PACKAGE)	+= /usr/bin/semodule_package
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_PACKAGE)	+= /usr/bin/semodule_unpackage
+
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SESTATUS)		+= sestatus
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SESTATUS)		+= /usr/sbin/sestatus
+
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SETFILES)		+= setfiles
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SETFILES)		+= /usr/sbin/setfiles
+
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SETSEBOOL)		+= setsebool
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SETSEBOOL)		+= /usr/sbin/setsebool
+
+POLICYCOREUTILS_CONF_TOOL := NO
+
+# no ':=' because of $(PYTHON_SITEPACKAGES)
+POLICYCOREUTILS_MAKE_ENV = \
+	$(CROSS_ENV) \
+	SBINDIR=$(POLICYCOREUTILS_PKGDIR)/usr/sbin \
+	PYTHONLIBDIR=$(POLICYCOREUTILS_PKGDIR)$(PYTHON_SITEPACKAGES)/.. \
+	CFLAGS="-O2 -Wall" \
+	INOTIFYH="/usr/include/sys/inotify.h" \
+	PAMH="" \
+	AUDITH=""
+#
+# We don't have PAM or AUDIT, so turn off.
+#
+# Use the following to turn on:
+# (Use these paths, as of version 2.1.13)
+#
+# PAMH=/usr/include/security/pam_appl.h
+# AUDITH=/usr/include/libaudit.h
+#
+
+POLICYCOREUTILS_MAKE_OPT := \
+	SUBDIRS="$(POLICYCOREUTILS_SUBDIRS_y)" \
+	LIBDIR=$(PTXDIST_SYSROOT_TARGET)/usr/lib
+POLICYCOREUTILS_INSTALL_OPT := \
+	SUBDIRS="$(POLICYCOREUTILS_SUBDIRS_y)" \
+	install
+
+# ----------------------------------------------------------------------------
+# Target-Install
+# ----------------------------------------------------------------------------
+
+$(STATEDIR)/policycoreutils.targetinstall:
+	@$(call targetinfo)
+
+	@$(call install_init, policycoreutils)
+	@$(call install_fixup, policycoreutils,PRIORITY,optional)
+	@$(call install_fixup, policycoreutils,SECTION,base)
+	@$(call install_fixup, policycoreutils,AUTHOR,"Wolfram Sang <w.sang@pengutronix.de>")
+	@$(call install_fixup, policycoreutils,DESCRIPTION,missing)
+
+	@$(foreach prog, $(POLICYCOREUTILS_PROGS_y), \
+		$(call install_copy, policycoreutils, 0, 0, 0755, -, $(prog));)
+
+ifdef PTXCONF_POLICYCOREUTILS_SETFILES
+	@$(call install_link, policycoreutils, setfiles, /usr/sbin/restorecon)
+endif
+
+ifdef PTXCONF_POLICYCOREUTILS_SEMANAGE
+	@$(call install_copy, policycoreutils, 0, 0, 0644, -, $(PYTHON_SITEPACKAGES)/seobject.py)
+endif
+
+ifdef PTXCONF_POLICYCOREUTILS_SESTATUS
+	@$(call install_alternative, policycoreutils, 0, 0, 0644, /etc/sestatus.conf)
+endif
+
+	@$(call install_finish, policycoreutils)
+
+	@$(call touch)
+
+# vim: syntax=make
-- 
2.47.3

[ptxdist] [PATCH v2 14/17] policycoreutils: version bump 2.1.13 -> 3.11

[Ladislav Michl]

From: Ladislav Michl <ladis@triops.cz>

Upstream moved the python tools to selinux-python and the semodule_*
tools to semodule-utils. While there also add PAM support.

Signed-off-by: Ladislav Michl <ladis@triops.cz>
---
 CHANGES:
 - v2: use full PTXCONF_ variable names in ptx/ifdef and ifdef, so PAM,
       audit and PAM config files actually work. Select needed libc
       parts (crypt, dl, util, pthread). Drop BusyBox find selects and
       document fixfiles requirements in help text instead.

 rules/policycoreutils.in   | 113 +++++++++++---------------
 rules/policycoreutils.make | 159 ++++++++++++++++---------------------
 2 files changed, 115 insertions(+), 157 deletions(-)

diff --git a/rules/policycoreutils.in b/rules/policycoreutils.in
index fce42b002..52208c2e4 100644
--- a/rules/policycoreutils.in
+++ b/rules/policycoreutils.in
@@ -1,20 +1,18 @@
-## SECTION=staging
-## old section:
-### SECTION=selinux
+## SECTION=selinux
 
 menuconfig POLICYCOREUTILS
 	tristate
 	prompt "policycoreutils               "
-	select LIBCAP_NG
-	select LIBCGROUP
 	select LIBSELINUX
-	select LIBSEMANAGE
 	select LIBSEPOL
-	select DBUS_GLIB	if POLICYCOREUTILS_RESTORECOND
-	select BUSYBOX_FEATURE_FIND_DEPTH	if BUSYBOX_FIND
-	select BUSYBOX_FEATURE_FIND_DELETE	if BUSYBOX_FIND
-	select BUSYBOX_SELINUX			if BUSYBOX_FIND
-	select BUSYBOX_FEATURE_FIND_CONTEXT	if BUSYBOX_FIND
+	select LIBSEMANAGE	if POLICYCOREUTILS_SEMODULE
+	select LIBSEMANAGE	if POLICYCOREUTILS_SETSEBOOL
+	select AUDIT		if POLICYCOREUTILS_AUDIT
+	select PAM		if GLOBAL_PAM
+	select LIBC_CRYPT	if !GLOBAL_PAM && (POLICYCOREUTILS_NEWROLE || POLICYCOREUTILS_RUN_INIT)
+	select LIBC_DL		if POLICYCOREUTILS_RUN_INIT
+	select LIBC_UTIL	if POLICYCOREUTILS_RUN_INIT
+	select LIBC_PTHREAD	if POLICYCOREUTILS_SETFILES
 	help
 	  This package contains the core policy utilities that are required
 	  for basic operation of an SELinux system.  These utilities include
@@ -22,90 +20,71 @@ menuconfig POLICYCOREUTILS
 	  to switch roles, and run_init to run /etc/init.d scripts in the proper
 	  context.
 
-	  STAGING: remove in ptxdist-2020.12.0
-	  Old version that need to be updated. Moved to staging with libselinux.
-
 if POLICYCOREUTILS
 
-menuconfig POLICYCOREUTILS_PYTHON
-	# needs sepolgen
-	depends on BROKEN
-	bool "python based tools"
-
-if POLICYCOREUTILS_PYTHON
-
-config POLICYCOREUTILS_AUDIT2ALLOW
-	bool "audit2allow"
-
-config POLICYCOREUTILS_SEPOLGEN_IFGEN
-	select POLICYCOREUTILS_AUDIT2ALLOW
-	bool "sepolgen-ifgen"
-
-config POLICYCOREUTILS_AUDIT2WHY
-	select POLICYCOREUTILS_AUDIT2ALLOW
-	bool "audit2why"
-
-config POLICYCOREUTILS_SANDBOX
-	bool "sandbox"
-	depends on BROKEN
-
-config POLICYCOREUTILS_CHCAT
-	select LIBSEMANAGE_PYTHON
-	depends on BROKEN
-	bool "chcat"
-
-config POLICYCOREUTILS_SEMANAGE
-	select LIBSEMANAGE_PYTHON
-	depends on BROKEN
-	bool "semanage"
-
-endif
+config POLICYCOREUTILS_AUDIT
+	bool "audit support"
+	help
+	  Let newrole, run_init and setfiles log to the audit subsystem.
 
 config POLICYCOREUTILS_LOAD_POLICY
 	bool "load_policy"
+	depends on !BUSYBOX_LOAD_POLICY || ALLYES
+
+comment "busybox' load_policy is selected!"
+	depends on BUSYBOX_LOAD_POLICY
 
 config POLICYCOREUTILS_NEWROLE
 	bool "newrole"
 
-config POLICYCOREUTILS_RESTORECOND
-	bool "restorecond"
-	depends on BROKEN
+config POLICYCOREUTILS_NEWROLE_PAM_CFG
+	bool "install /etc/pam.d/newrole"
+	depends on POLICYCOREUTILS_NEWROLE && GLOBAL_PAM
 
 config POLICYCOREUTILS_RUN_INIT
 	bool "run_init/open_init_pty"
 
+config POLICYCOREUTILS_RUN_INIT_PAM_CFG
+	bool "install /etc/pam.d/run_init"
+	depends on POLICYCOREUTILS_RUN_INIT && GLOBAL_PAM
+
 config POLICYCOREUTILS_FIXFILES
 	bool "fixfiles"
-
-config POLICYCOREUTILS_GENHOMEDIRCON
-	select POLICYCOREUTILS_SEMODULE
-	bool "genhomedircon"
+	help
+	  fixfiles script needs a 'find' supporting -context, -delete,
+	  -mindepth, -exec, -type, -print0 and parentheses, plus
+	  'chcon --reference'. BusyBox can provide these with SELinux
+	  support enabled, but 'fixfiles -N' additionally requires
+	  -mount and -newermt only provided by GNU findutils.
 
 config POLICYCOREUTILS_SECON
 	bool "secon"
 
 config POLICYCOREUTILS_SEMODULE
-	bool "semodule"
-
-config POLICYCOREUTILS_SEMODULE_DEPS
-	bool "semodule_deps"
-
-config POLICYCOREUTILS_SEMODULE_EXPAND
-	bool "semodule_expand"
-
-config POLICYCOREUTILS_SEMODULE_LINK
-	bool "semodule_link"
-
-config POLICYCOREUTILS_SEMODULE_PACKAGE
-	bool "semodule_package"
+	bool "semodule/genhomedircon"
 
 config POLICYCOREUTILS_SESTATUS
 	bool "sestatus"
+	depends on !BUSYBOX_SESTATUS || ALLYES
+
+comment "busybox' sestatus is selected!"
+	depends on BUSYBOX_SESTATUS
 
 config POLICYCOREUTILS_SETFILES
 	bool "setfiles/restorecon"
+	depends on !BUSYBOX_SETFILES && !BUSYBOX_RESTORECON || ALLYES
+
+comment "busybox' setfiles/restorecon is selected!"
+	depends on BUSYBOX_SETFILES || BUSYBOX_RESTORECON
 
 config POLICYCOREUTILS_SETSEBOOL
 	bool "setsebool"
+	depends on !BUSYBOX_SETSEBOOL || ALLYES
+
+comment "busybox' setsebool is selected!"
+	depends on BUSYBOX_SETSEBOOL
+
+config POLICYCOREUTILS_UNSETFILES
+	bool "unsetfiles"
 
 endif
diff --git a/rules/policycoreutils.make b/rules/policycoreutils.make
index 07baaebe8..a5ca327bf 100644
--- a/rules/policycoreutils.make
+++ b/rules/policycoreutils.make
@@ -14,116 +14,88 @@ PACKAGES-$(PTXCONF_POLICYCOREUTILS) += policycoreutils
 #
 # Paths and names
 #
-POLICYCOREUTILS_VERSION	:= 2.1.13
-POLICYCOREUTILS_MD5	:= 97c0b828599fe608f37894989820d71d
+POLICYCOREUTILS_VERSION	:= $(SELINUX_VERSION)
+POLICYCOREUTILS_SHA256	:= 054e41ec039731a5ee6b797a8e0b8d6e346ee1d0a9bac2f252db48c23f9a8b1b
 POLICYCOREUTILS		:= policycoreutils-$(POLICYCOREUTILS_VERSION)
 POLICYCOREUTILS_SUFFIX	:= tar.gz
-POLICYCOREUTILS_URL	:= https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20120924/$(POLICYCOREUTILS).$(POLICYCOREUTILS_SUFFIX)
+POLICYCOREUTILS_URL	:= $(SELINUX_URL)/$(POLICYCOREUTILS).$(POLICYCOREUTILS_SUFFIX)
 POLICYCOREUTILS_SOURCE	:= $(SRCDIR)/$(POLICYCOREUTILS).$(POLICYCOREUTILS_SUFFIX)
 POLICYCOREUTILS_DIR	:= $(BUILDDIR)/$(POLICYCOREUTILS)
-POLICYCOREUTILS_LICENSE	:= GPL-2.0-or-later
+POLICYCOREUTILS_LICENSE	:= GPL-2.0-only
+POLICYCOREUTILS_LICENSE_FILES	:= file://LICENSE;md5=393a5ca445f6965873eca0259a17f833
+POLICYCOREUTILS_CVE_PRODUCT	:= selinuxproject:policycoreutils
 
 # ----------------------------------------------------------------------------
 # Prepare
 # ----------------------------------------------------------------------------
 
-POLICYCOREUTILS_SUBDIRS_y := \
-	man \
-	po \
-	scripts
-
+POLICYCOREUTILS_SUBDIRS_y :=
 POLICYCOREUTILS_PROGS_y :=
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_AUDIT2ALLOW)		+= audit2allow
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_AUDIT2ALLOW)		+= /usr/bin/audit2allow
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEPOLGEN_IFGEN)	+= sepolgen-ifgen
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEPOLGEN_IFGEN)		+= /usr/bin/sepolgen-ifgen
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEPOLGEN_IFGEN)		+= /usr/bin/sepolgen-ifgen-attr-helper
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_AUDIT2WHY)		+= audit2why
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_AUDIT2WHY)		+= /usr/bin/audit2why
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_LOAD_POLICY)		+= load_policy
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_LOAD_POLICY)		+= /usr/sbin/load_policy
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_NEWROLE)		+= newrole
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_NEWROLE)		+= /usr/bin/newrole
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_RESTORECOND)		+= restorecond
-#POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_RESTORECOND)		+=
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT)		+= run_init
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT)		+= /usr/sbin/run_init
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT)		+= /usr/sbin/open_init_pty
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SANDBOX)		+= sandbox
-#POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SANDBOX)		+=
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_LOAD_POLICY)	+= load_policy
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_LOAD_POLICY)	+= /usr/sbin/load_policy
 
-# no SUBDIRS needed for scripts
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_CHCAT)			+= /usr/bin/chcat
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_FIXFILES)		+= /usr/sbin/fixfiles
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_GENHOMEDIRCON)		+= /usr/sbin/genhomedircon
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_NEWROLE)	+= newrole
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_NEWROLE)	+= /usr/bin/newrole
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SECON)		+= secon
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SECON)			+= /usr/bin/secon
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT)	+= run_init
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT)	+= /usr/sbin/run_init
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_RUN_INIT)	+= /usr/sbin/open_init_pty
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMANAGE)		+= semanage
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMANAGE)		+= /usr/sbin/semanage
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_FIXFILES)	+= scripts
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_FIXFILES)	+= /usr/sbin/fixfiles
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE)		+= semodule
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE)		+= /usr/sbin/semodule
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SECON)	+= secon
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SECON)		+= /usr/bin/secon
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_DEPS)	+= semodule_deps
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_DEPS)		+= /usr/bin/semodule_deps
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE)	+= semodule hll/pp
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE)	+= /usr/sbin/semodule
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE)	+= /usr/libexec/selinux/hll/pp
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_EXPAND)	+= semodule_expand
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_EXPAND)	+= /usr/bin/semodule_expand
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SESTATUS)	+= sestatus
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SESTATUS)	+= /usr/bin/sestatus
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_LINK)	+= semodule_link
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_LINK)		+= /usr/bin/semodule_link
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SETFILES)	+= setfiles
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SETFILES)	+= /usr/sbin/setfiles
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SETFILES)	+= /usr/sbin/restorecon_xattr
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_PACKAGE)	+= semodule_package
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_PACKAGE)	+= /usr/bin/semodule_package
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SEMODULE_PACKAGE)	+= /usr/bin/semodule_unpackage
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SETSEBOOL)	+= setsebool
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SETSEBOOL)	+= /usr/sbin/setsebool
 
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SESTATUS)		+= sestatus
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SESTATUS)		+= /usr/sbin/sestatus
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SETFILES)		+= setfiles
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SETFILES)		+= /usr/sbin/setfiles
-
-POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_SETSEBOOL)		+= setsebool
-POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_SETSEBOOL)		+= /usr/sbin/setsebool
-
-POLICYCOREUTILS_CONF_TOOL := NO
-
-# no ':=' because of $(PYTHON_SITEPACKAGES)
-POLICYCOREUTILS_MAKE_ENV = \
-	$(CROSS_ENV) \
-	SBINDIR=$(POLICYCOREUTILS_PKGDIR)/usr/sbin \
-	PYTHONLIBDIR=$(POLICYCOREUTILS_PKGDIR)$(PYTHON_SITEPACKAGES)/.. \
-	CFLAGS="-O2 -Wall" \
-	INOTIFYH="/usr/include/sys/inotify.h" \
-	PAMH="" \
-	AUDITH=""
-#
-# We don't have PAM or AUDIT, so turn off.
-#
-# Use the following to turn on:
-# (Use these paths, as of version 2.1.13)
-#
-# PAMH=/usr/include/security/pam_appl.h
-# AUDITH=/usr/include/libaudit.h
-#
+POLICYCOREUTILS_SUBDIRS_$(PTXCONF_POLICYCOREUTILS_UNSETFILES)	+= unsetfiles
+POLICYCOREUTILS_PROGS_$(PTXCONF_POLICYCOREUTILS_UNSETFILES)	+= /usr/sbin/unsetfiles
 
-POLICYCOREUTILS_MAKE_OPT := \
-	SUBDIRS="$(POLICYCOREUTILS_SUBDIRS_y)" \
-	LIBDIR=$(PTXDIST_SYSROOT_TARGET)/usr/lib
-POLICYCOREUTILS_INSTALL_OPT := \
+POLICYCOREUTILS_CONF_TOOL	:= NO
+POLICYCOREUTILS_MAKE_ENV	:= $(CROSS_ENV)
+POLICYCOREUTILS_MAKE_OPT	:= \
 	SUBDIRS="$(POLICYCOREUTILS_SUBDIRS_y)" \
+	PREFIX=/usr \
+	BINDIR=/usr/bin \
+	SBINDIR=/usr/sbin \
+	ETCDIR=/etc \
+	LOCALEDIR=/usr/share/locale \
+	PAMH=$(call ptx/ifdef, PTXCONF_GLOBAL_PAM, y, n) \
+	AUDITH=$(call ptx/ifdef, PTXCONF_POLICYCOREUTILS_AUDIT, y, n) \
+	AUDIT_LOG_PRIV=n \
+	NAMESPACE_PRIV=n \
+	LSPP_PRIV=n \
+	CFLAGS="-O2 -Wall -g"
+POLICYCOREUTILS_INSTALL_OPT	:= \
+	$(POLICYCOREUTILS_MAKE_OPT) \
 	install
 
+# ----------------------------------------------------------------------------
+# Install
+# ----------------------------------------------------------------------------
+
+$(STATEDIR)/policycoreutils.install:
+	@$(call targetinfo)
+ifdef PTXCONF_GLOBAL_PAM
+	@mkdir -p $(POLICYCOREUTILS_PKGDIR)/etc/pam.d
+endif
+	@$(call world/install, POLICYCOREUTILS)
+	@$(call touch)
+
 # ----------------------------------------------------------------------------
 # Target-Install
 # ----------------------------------------------------------------------------
@@ -137,15 +109,22 @@ $(STATEDIR)/policycoreutils.targetinstall:
 	@$(call install_fixup, policycoreutils,AUTHOR,"Wolfram Sang <w.sang@pengutronix.de>")
 	@$(call install_fixup, policycoreutils,DESCRIPTION,missing)
 
+ifdef PTXCONF_POLICYCOREUTILS_NEWROLE_PAM_CFG
+	@$(call install_alternative, policycoreutils, 0, 0, 0644, /etc/pam.d/newrole)
+endif
+ifdef PTXCONF_POLICYCOREUTILS_RUN_INIT_PAM_CFG
+	@$(call install_alternative, policycoreutils, 0, 0, 0644, /etc/pam.d/run_init)
+endif
+
 	@$(foreach prog, $(POLICYCOREUTILS_PROGS_y), \
 		$(call install_copy, policycoreutils, 0, 0, 0755, -, $(prog));)
 
-ifdef PTXCONF_POLICYCOREUTILS_SETFILES
-	@$(call install_link, policycoreutils, setfiles, /usr/sbin/restorecon)
+ifdef PTXCONF_POLICYCOREUTILS_SEMODULE
+	@$(call install_link, policycoreutils, semodule, /usr/sbin/genhomedircon)
 endif
 
-ifdef PTXCONF_POLICYCOREUTILS_SEMANAGE
-	@$(call install_copy, policycoreutils, 0, 0, 0644, -, $(PYTHON_SITEPACKAGES)/seobject.py)
+ifdef PTXCONF_POLICYCOREUTILS_SETFILES
+	@$(call install_link, policycoreutils, setfiles, /usr/sbin/restorecon)
 endif
 
 ifdef PTXCONF_POLICYCOREUTILS_SESTATUS
-- 
2.47.3

[ptxdist] [PATCH v2 15/17] Revert "sepolgen: remove after one year in staging"

[Ladislav Michl]

From: Ladislav Michl <ladis@triops.cz>

This partially reverts commit 9fe5462616de2ce93663f409f471ea83a6d5fbb5.

Signed-off-by: Ladislav Michl <ladis@triops.cz>
---
 CHANGES:
 - v2: None

 rules/sepolgen.in   | 29 ++++++++++++++++++++++++
 rules/sepolgen.make | 54 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 83 insertions(+)
 create mode 100644 rules/sepolgen.in
 create mode 100644 rules/sepolgen.make

diff --git a/rules/sepolgen.in b/rules/sepolgen.in
new file mode 100644
index 000000000..94f2ce071
--- /dev/null
+++ b/rules/sepolgen.in
@@ -0,0 +1,29 @@
+## SECTION=staging
+## old section:
+### SECTION=selinux
+
+config SEPOLGEN
+	tristate
+	prompt "sepolgen"
+	select PYTHON
+	select LIBSELINUX
+	select LIBSELINUX_PYTHON
+	help
+	  A Python module used in SELinux policy generation
+
+	  This package contains a Python module that forms the core of
+	  the modern audit2allow (which is a part of the package
+	  policycoreutils). The sepolgen library is structured to give
+	  flexibility to the application using it. The library
+	  contains: Reference Policy Representation, which are Objects
+	  for representing policies and the reference policy
+	  interfaces. Secondly, it has objects and algorithms for
+	  representing access and sets of access in an abstract way
+	  and searching that access. It also has a parser for
+	  reference policy "headers". It contains infrastructure for
+	  parsing SELinux related messages as produced by the audit
+	  system. It has facilities for generating policy based on
+	  required access.
+
+	  STAGING: remove in ptxdist-2020.06.0
+	  Old version that needs to be updated.
diff --git a/rules/sepolgen.make b/rules/sepolgen.make
new file mode 100644
index 000000000..7084e1d1d
--- /dev/null
+++ b/rules/sepolgen.make
@@ -0,0 +1,54 @@
+# -*-makefile-*-
+#
+# Copyright (C) 2013 by Marc Kleine-Budde <mkl@pengutronix.de>
+#
+# For further information about the PTXdist project and license conditions
+# see the README file.
+#
+
+#
+# We provide this package
+#
+PACKAGES-$(PTXCONF_SEPOLGEN) += sepolgen
+
+#
+# Paths and names
+#
+SEPOLGEN_VERSION	:= 1.1.8
+SEPOLGEN_MD5		:= d734ff236639cc1bd3a33901774fa98d
+SEPOLGEN		:= sepolgen-$(SEPOLGEN_VERSION)
+SEPOLGEN_SUFFIX		:= tar.gz
+SEPOLGEN_URL		:= https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20120924/$(SEPOLGEN).$(SEPOLGEN_SUFFIX)
+SEPOLGEN_SOURCE		:= $(SRCDIR)/$(SEPOLGEN).$(SEPOLGEN_SUFFIX)
+SEPOLGEN_DIR		:= $(BUILDDIR)/$(SEPOLGEN)
+SEPOLGEN_LICENSE	:= GPL-2.0-only
+
+# ----------------------------------------------------------------------------
+# Prepare
+# ----------------------------------------------------------------------------
+
+SEPOLGEN_CONF_TOOL := NO
+# no ':=' because of $(PYTHON_SITEPACKAGES)
+SEPOLGEN_MAKE_ENV = PYTHONLIBDIR=$(PYTHON_SITEPACKAGES)
+
+# ----------------------------------------------------------------------------
+# Target-Install
+# ----------------------------------------------------------------------------
+
+$(STATEDIR)/sepolgen.targetinstall:
+	@$(call targetinfo)
+
+	@$(call install_init, sepolgen)
+	@$(call install_fixup, sepolgen,PRIORITY,optional)
+	@$(call install_fixup, sepolgen,SECTION,base)
+	@$(call install_fixup, sepolgen,AUTHOR,"Marc Kleine-Budde <mkl@pengutronix.de>")
+	@$(call install_fixup, sepolgen,DESCRIPTION,missing)
+
+	@$(call install_tree, sepolgen, 0, 0, -, $(PYTHON_SITEPACKAGES))
+	@$(call install_alternative, sepolgen, 0, 0, 0644, /var/lib/sepolgen/perm_map)
+
+	@$(call install_finish, sepolgen)
+
+	@$(call touch)
+
+# vim: syntax=make
-- 
2.47.3

[ptxdist] [PATCH v2 16/17] sepolgen: version bump 1.1.8 -> 3.11

[Ladislav Michl]

From: Ladislav Michl <ladis@triops.cz>

Since SELinux userspace 2.8, the sepolgen python module is shipped in the
selinux-python tarball together with audit2allow, so rename the package
to selinux-python.

Signed-off-by: Ladislav Michl <ladis@triops.cz>
---
 CHANGES:
 - v2: pass PREFIX, BINDIR, PYTHON, PYTHONLIBDIR and CFLAGS as make
       options instead of environment, so they apply to install as well.

 rules/selinux-python.in   | 12 +++++++
 rules/selinux-python.make | 68 +++++++++++++++++++++++++++++++++++++++
 rules/sepolgen.in         | 29 -----------------
 rules/sepolgen.make       | 54 -------------------------------
 4 files changed, 80 insertions(+), 83 deletions(-)
 create mode 100644 rules/selinux-python.in
 create mode 100644 rules/selinux-python.make
 delete mode 100644 rules/sepolgen.in
 delete mode 100644 rules/sepolgen.make

diff --git a/rules/selinux-python.in b/rules/selinux-python.in
new file mode 100644
index 000000000..d2f6eb655
--- /dev/null
+++ b/rules/selinux-python.in
@@ -0,0 +1,12 @@
+## SECTION=selinux
+
+config SELINUX_PYTHON
+	tristate
+	prompt "selinux-python"
+	select PYTHON3
+	select LIBSEPOL
+	select LIBSELINUX
+	select LIBSELINUX_PYTHON
+	help
+	  audit2allow and the sepolgen python module it uses to
+	  generate SELinux policy from audit messages.
diff --git a/rules/selinux-python.make b/rules/selinux-python.make
new file mode 100644
index 000000000..89e4c0f32
--- /dev/null
+++ b/rules/selinux-python.make
@@ -0,0 +1,68 @@
+# -*-makefile-*-
+#
+# Copyright (C) 2013 by Marc Kleine-Budde <mkl@pengutronix.de>
+#
+# For further information about the PTXdist project and license conditions
+# see the README file.
+#
+
+#
+# We provide this package
+#
+PACKAGES-$(PTXCONF_SELINUX_PYTHON) += selinux-python
+
+#
+# Paths and names
+#
+SELINUX_PYTHON_VERSION	:= $(SELINUX_VERSION)
+SELINUX_PYTHON_SHA256	:= f854d7fe67981d80c612067e97c1804f641a9dfcca2d38baeb3efe52b7875398
+SELINUX_PYTHON		:= selinux-python-$(SELINUX_PYTHON_VERSION)
+SELINUX_PYTHON_SUFFIX	:= tar.gz
+SELINUX_PYTHON_URL	:= $(SELINUX_URL)/$(SELINUX_PYTHON).$(SELINUX_PYTHON_SUFFIX)
+SELINUX_PYTHON_SOURCE	:= $(SRCDIR)/$(SELINUX_PYTHON).$(SELINUX_PYTHON_SUFFIX)
+SELINUX_PYTHON_DIR	:= $(BUILDDIR)/$(SELINUX_PYTHON)
+SELINUX_PYTHON_LICENSE	:= GPL-2.0-only
+SELINUX_PYTHON_LICENSE_FILES	:= file://LICENSE;md5=393a5ca445f6965873eca0259a17f833
+
+# ----------------------------------------------------------------------------
+# Prepare
+# ----------------------------------------------------------------------------
+
+SELINUX_PYTHON_CONF_TOOL	:= NO
+SELINUX_PYTHON_MAKE_ENV		:= $(CROSS_ENV)
+SELINUX_PYTHON_MAKE_OPT		= \
+	SUBDIRS="sepolgen audit2allow" \
+	PREFIX=/usr \
+	BINDIR=/usr/bin \
+	PYTHON=$(CROSS_PYTHON3) \
+	PYTHONLIBDIR=$(PYTHON3_SITEPACKAGES) \
+	CFLAGS="-O2 -Wall -g"
+SELINUX_PYTHON_INSTALL_OPT	= \
+	$(SELINUX_PYTHON_MAKE_OPT) \
+	install
+
+# ----------------------------------------------------------------------------
+# Target-Install
+# ----------------------------------------------------------------------------
+
+$(STATEDIR)/selinux-python.targetinstall:
+	@$(call targetinfo)
+
+	@$(call install_init, selinux-python)
+	@$(call install_fixup, selinux-python,PRIORITY,optional)
+	@$(call install_fixup, selinux-python,SECTION,base)
+	@$(call install_fixup, selinux-python,AUTHOR,"Marc Kleine-Budde <mkl@pengutronix.de>")
+	@$(call install_fixup, selinux-python,DESCRIPTION,missing)
+
+	@$(call install_tree, selinux-python, 0, 0, -, $(PYTHON3_SITEPACKAGES))
+	@$(call install_alternative, selinux-python, 0, 0, 0644, /var/lib/sepolgen/perm_map)
+	@$(call install_copy, selinux-python, 0, 0, 0755, -, /usr/bin/audit2allow)
+	@$(call install_link, selinux-python, audit2allow, /usr/bin/audit2why)
+	@$(call install_copy, selinux-python, 0, 0, 0755, -, /usr/bin/sepolgen-ifgen)
+	@$(call install_copy, selinux-python, 0, 0, 0755, -, /usr/bin/sepolgen-ifgen-attr-helper)
+
+	@$(call install_finish, selinux-python)
+
+	@$(call touch)
+
+# vim: syntax=make
diff --git a/rules/sepolgen.in b/rules/sepolgen.in
deleted file mode 100644
index 94f2ce071..000000000
--- a/rules/sepolgen.in
+++ /dev/null
@@ -1,29 +0,0 @@
-## SECTION=staging
-## old section:
-### SECTION=selinux
-
-config SEPOLGEN
-	tristate
-	prompt "sepolgen"
-	select PYTHON
-	select LIBSELINUX
-	select LIBSELINUX_PYTHON
-	help
-	  A Python module used in SELinux policy generation
-
-	  This package contains a Python module that forms the core of
-	  the modern audit2allow (which is a part of the package
-	  policycoreutils). The sepolgen library is structured to give
-	  flexibility to the application using it. The library
-	  contains: Reference Policy Representation, which are Objects
-	  for representing policies and the reference policy
-	  interfaces. Secondly, it has objects and algorithms for
-	  representing access and sets of access in an abstract way
-	  and searching that access. It also has a parser for
-	  reference policy "headers". It contains infrastructure for
-	  parsing SELinux related messages as produced by the audit
-	  system. It has facilities for generating policy based on
-	  required access.
-
-	  STAGING: remove in ptxdist-2020.06.0
-	  Old version that needs to be updated.
diff --git a/rules/sepolgen.make b/rules/sepolgen.make
deleted file mode 100644
index 7084e1d1d..000000000
--- a/rules/sepolgen.make
+++ /dev/null
@@ -1,54 +0,0 @@
-# -*-makefile-*-
-#
-# Copyright (C) 2013 by Marc Kleine-Budde <mkl@pengutronix.de>
-#
-# For further information about the PTXdist project and license conditions
-# see the README file.
-#
-
-#
-# We provide this package
-#
-PACKAGES-$(PTXCONF_SEPOLGEN) += sepolgen
-
-#
-# Paths and names
-#
-SEPOLGEN_VERSION	:= 1.1.8
-SEPOLGEN_MD5		:= d734ff236639cc1bd3a33901774fa98d
-SEPOLGEN		:= sepolgen-$(SEPOLGEN_VERSION)
-SEPOLGEN_SUFFIX		:= tar.gz
-SEPOLGEN_URL		:= https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20120924/$(SEPOLGEN).$(SEPOLGEN_SUFFIX)
-SEPOLGEN_SOURCE		:= $(SRCDIR)/$(SEPOLGEN).$(SEPOLGEN_SUFFIX)
-SEPOLGEN_DIR		:= $(BUILDDIR)/$(SEPOLGEN)
-SEPOLGEN_LICENSE	:= GPL-2.0-only
-
-# ----------------------------------------------------------------------------
-# Prepare
-# ----------------------------------------------------------------------------
-
-SEPOLGEN_CONF_TOOL := NO
-# no ':=' because of $(PYTHON_SITEPACKAGES)
-SEPOLGEN_MAKE_ENV = PYTHONLIBDIR=$(PYTHON_SITEPACKAGES)
-
-# ----------------------------------------------------------------------------
-# Target-Install
-# ----------------------------------------------------------------------------
-
-$(STATEDIR)/sepolgen.targetinstall:
-	@$(call targetinfo)
-
-	@$(call install_init, sepolgen)
-	@$(call install_fixup, sepolgen,PRIORITY,optional)
-	@$(call install_fixup, sepolgen,SECTION,base)
-	@$(call install_fixup, sepolgen,AUTHOR,"Marc Kleine-Budde <mkl@pengutronix.de>")
-	@$(call install_fixup, sepolgen,DESCRIPTION,missing)
-
-	@$(call install_tree, sepolgen, 0, 0, -, $(PYTHON_SITEPACKAGES))
-	@$(call install_alternative, sepolgen, 0, 0, 0644, /var/lib/sepolgen/perm_map)
-
-	@$(call install_finish, sepolgen)
-
-	@$(call touch)
-
-# vim: syntax=make
-- 
2.47.3

[ptxdist] [PATCH v2 17/17] selinux: restore the global option

[Ladislav Michl]

From: Ladislav Michl <ladis@triops.cz>

Restore the GLOBAL_SELINUX option in its former glory.

As GLOBAL_SELINUX_OPTION has no users, drop it.

Signed-off-by: Ladislav Michl <ladis@triops.cz>
---
 CHANGES:
 - v2: wire GLOBAL_SELINUX also into dbus (replacing BROKEN DBUS_SELINUX)
       and iproute2.

 rules/at.in           | 1 +
 rules/busybox.in      | 1 +
 rules/casync.in       | 1 +
 rules/connman.in      | 1 +
 rules/core-selinux.in | 1 -
 rules/coreutils.in    | 1 +
 rules/dbus.in         | 6 +-----
 rules/dbus.make       | 2 +-
 rules/f2fs-tools.in   | 1 +
 rules/gnupg.in        | 1 +
 rules/iproute2.in     | 1 +
 rules/iproute2.make   | 3 +++
 rules/logrotate.in    | 1 +
 rules/lxc.in          | 1 +
 rules/mtd-utils.in    | 1 +
 rules/openssh.in      | 1 +
 rules/pre/Rules.make  | 6 ------
 rules/shadow.in       | 1 +
 rules/strongswan.in   | 1 +
 rules/systemd.in      | 1 +
 20 files changed, 20 insertions(+), 13 deletions(-)

diff --git a/rules/at.in b/rules/at.in
index 13a1916c6..567324300 100644
--- a/rules/at.in
+++ b/rules/at.in
@@ -9,6 +9,7 @@ menuconfig AT
 	select ROOTFS_VAR_SPOOL_CRON
 	select BUSYBOX_START_STOP_DAEMON			if AT_STARTSCRIPT
 	select BUSYBOX_FEATURE_START_STOP_DAEMON_FANCY		if AT_STARTSCRIPT
+	select LIBSELINUX	if GLOBAL_SELINUX
 	help
 	  Delayed job execution and batch processing
 
diff --git a/rules/busybox.in b/rules/busybox.in
index 6bb60145d..612e21ade 100644
--- a/rules/busybox.in
+++ b/rules/busybox.in
@@ -10,6 +10,7 @@ menuconfig BUSYBOX
 	select GCCLIBS_GCC_S	if !BUSYBOX_STATIC
 	select PAM		if GLOBAL_PAM
 	select BUSYBOX_PAM	if GLOBAL_PAM
+	select LIBSELINUX	if BUSYBOX_SELINUX
 	select LIBTIRPC		if BUSYBOX_NEED_LIBTIRPC
 	select BUSYBOX_INSTALL_NO_USR
 	help
diff --git a/rules/casync.in b/rules/casync.in
index 2135e84ff..b11b8c5ce 100644
--- a/rules/casync.in
+++ b/rules/casync.in
@@ -16,6 +16,7 @@ menuconfig CASYNC
 	select UDEV_LIBUDEV	if CASYNC_UDEV
 	select XZ		if CASYNC_LZMA
 	select ZLIB		if CASYNC_ZLIB
+	select LIBSELINUX	if GLOBAL_SELINUX
 	help
 	  casync - Content Addressable Data Synchronizer.
 
diff --git a/rules/connman.in b/rules/connman.in
index a051e66f7..53738fcf0 100644
--- a/rules/connman.in
+++ b/rules/connman.in
@@ -14,6 +14,7 @@ menuconfig CONNMAN
 	select WPA_SUPPLICANT_CTRL_IFACE_DBUS	if CONNMAN_WIFI
 	select BUSYBOX_START_STOP_DAEMON	if CONNMAN_STARTSCRIPT && RUNTIME
 	select ROOTFS_VAR_LIB			if RUNTIME
+	select LIBSELINUX	if GLOBAL_SELINUX
 	prompt "connman                       "
 	help
 	  The Connection Manager project provides a daemon for
diff --git a/rules/core-selinux.in b/rules/core-selinux.in
index 2a5cb87ef..236c77441 100644
--- a/rules/core-selinux.in
+++ b/rules/core-selinux.in
@@ -5,7 +5,6 @@ config GLOBAL_SELINUX
 	select BUSYBOX_SELINUX			if BUSYBOX
 	select BUSYBOX_BUILD_LIBBUSYBOX		if BUSYBOX
 	select BUSYBOX_FEATURE_INDIVIDUAL	if BUSYBOX
-	depends on BROKEN
 	prompt "SELinux support"
 	help
 	  This will enable SELinux for all packages with optional
diff --git a/rules/coreutils.in b/rules/coreutils.in
index 504283736..c3aee2786 100644
--- a/rules/coreutils.in
+++ b/rules/coreutils.in
@@ -8,6 +8,7 @@ menuconfig COREUTILS
 	select GCCLIBS_GCC_S
 	select ATTR		if COREUTILS_XATTR
 	select SYSTEMD		if COREUTILS_SYSTEMD
+	select LIBSELINUX	if GLOBAL_SELINUX
 	help
 	  This package contains the essential basic system utilities.
 
diff --git a/rules/dbus.in b/rules/dbus.in
index b205ee62f..d4776a5d1 100644
--- a/rules/dbus.in
+++ b/rules/dbus.in
@@ -8,6 +8,7 @@ menuconfig DBUS
 	select XORG_LIB_X11	if DBUS_X
 	select MACHINE_ID	if RUNTIME
 	select SYSTEMD		if DBUS_SYSTEMD
+	select LIBSELINUX	if GLOBAL_SELINUX
 	select LIBC_PTHREAD
 	select LIBC_RT
 	help
@@ -27,11 +28,6 @@ menuconfig DBUS
 
 if DBUS
 
-config DBUS_SELINUX
-	prompt "selinux support [BROKEN]"
-	depends on BROKEN
-	bool
-
 config DBUS_SYSTEMD
 	bool
 	default INITMETHOD_SYSTEMD
diff --git a/rules/dbus.make b/rules/dbus.make
index db5b9d0b6..fd0f3fb1e 100644
--- a/rules/dbus.make
+++ b/rules/dbus.make
@@ -62,7 +62,7 @@ DBUS_CONF_OPT	:= \
 	-Dmodular_tests=disabled \
 	-Dqt_help=disabled \
 	-Drelocation=disabled \
-	-Dselinux=$(call ptx/endis, PTXCONF_DBUS_SELINUX)d \
+	-Dselinux=$(call ptx/endis, PTXCONF_GLOBAL_SELINUX)d \
 	-Dstats=false \
 	-Dsystemd=$(call ptx/endis, PTXCONF_DBUS_SYSTEMD)d \
 	-Dsystemd_system_unitdir=/usr/lib/systemd/system \
diff --git a/rules/f2fs-tools.in b/rules/f2fs-tools.in
index dbcdb9d96..5d2ba5f41 100644
--- a/rules/f2fs-tools.in
+++ b/rules/f2fs-tools.in
@@ -5,6 +5,7 @@ config F2FS_TOOLS
 	prompt "f2fs-tools"
 	select LIBUUID
 	select LIBBLKID
+	select LIBSELINUX	if GLOBAL_SELINUX
 	help
 	  The f2fs-tools package provides the filesystem utilities for use
 	  with the f2fs filesystem (flash-friendly filesystem)
diff --git a/rules/gnupg.in b/rules/gnupg.in
index 2bad06187..9b731efc0 100644
--- a/rules/gnupg.in
+++ b/rules/gnupg.in
@@ -15,6 +15,7 @@ menuconfig GNUPG
 	select BZIP2_LIBBZ2 if GNUPG_GPG_BZIP2
 	# disabling GNUPG_GPG_EDDSA is broken
 	select GNUPG_GPG_EDDSA
+	select LIBSELINUX	if GLOBAL_SELINUX
 	help
 	  GnuPG - The GNU Privacy Guard suite of programs
 
diff --git a/rules/iproute2.in b/rules/iproute2.in
index 48e44fb3b..03a7bf4a1 100644
--- a/rules/iproute2.in
+++ b/rules/iproute2.in
@@ -11,6 +11,7 @@ menuconfig IPROUTE2
 	select LIBC_PTHREAD	if IPROUTE2_ARPD
 	select LIBC_RESOLV
 	select LIBMNL		if IPROUTE2_DEVLINK || IPROUTE2_DCB
+	select LIBSELINUX	if GLOBAL_SELINUX
 	select PYTHON3		if IPROUTE2_ROUTEL && RUNTIME
 	help
 	  Networking and traffic control tools
diff --git a/rules/iproute2.make b/rules/iproute2.make
index 18222d792..706d31089 100644
--- a/rules/iproute2.make
+++ b/rules/iproute2.make
@@ -39,6 +39,9 @@ $(STATEDIR)/iproute2.prepare:
 	@echo 'TC_CONFIG_ATM:=n'	>> $(IPROUTE2_DIR)/config.mk
 ifndef PTXCONF_IPROUTE2_ARPD
 	@echo 'HAVE_BERKELEY_DB:=n'	>> $(IPROUTE2_DIR)/config.mk
+endif
+ifndef PTXCONF_GLOBAL_SELINUX
+	@echo 'HAVE_SELINUX:=n'		>> $(IPROUTE2_DIR)/config.mk
 endif
 	@$(call touch)
 
diff --git a/rules/logrotate.in b/rules/logrotate.in
index f3b465b87..9f13695d3 100644
--- a/rules/logrotate.in
+++ b/rules/logrotate.in
@@ -6,6 +6,7 @@ menuconfig LOGROTATE
 	select LIBPOPT
 	select ACL if LOGROTATE_ACL
 	select ROOTFS_VAR_LIB		if RUNTIME
+	select LIBSELINUX	if GLOBAL_SELINUX
 	help
 	  The logrotate utility is designed to simplify the
 	  administration of log files on a system which generates a lot
diff --git a/rules/lxc.in b/rules/lxc.in
index e8dc765e6..3a06c8724 100644
--- a/rules/lxc.in
+++ b/rules/lxc.in
@@ -13,6 +13,7 @@ menuconfig LXC
 	select IPTABLES_IPV4		if LXC_SYSTEMD_UNIT
 	select IPTABLES_IPV6		if LXC_SYSTEMD_UNIT
 	select IPTABLES_INSTALL_TOOLS	if LXC_SYSTEMD_UNIT
+	select LIBSELINUX	if GLOBAL_SELINUX
 	help
 	  LXC is a userspace interface for the Linux kernel containment
 	  features. Through a powerful API and simple tools, it lets
diff --git a/rules/mtd-utils.in b/rules/mtd-utils.in
index d3143e2d5..265279f72 100644
--- a/rules/mtd-utils.in
+++ b/rules/mtd-utils.in
@@ -8,6 +8,7 @@ menuconfig MTD_UTILS
 	select ZLIB
 	select LIBUUID		if MTD_UTILS_UBIFS
 	select LIBLZO		if MTD_UTILS_USE_LIBLZO
+	select LIBSELINUX	if GLOBAL_SELINUX
 	help
 	  Memory Technology Device Utilities
 
diff --git a/rules/openssh.in b/rules/openssh.in
index afbd19675..e73b3343e 100644
--- a/rules/openssh.in
+++ b/rules/openssh.in
@@ -9,6 +9,7 @@ menuconfig OPENSSH
 	select RC_ONCE if OPENSSH_SSHD_GENKEYS && RUNTIME
 	select BUSYBOX_START_STOP_DAEMON if OPENSSH_SSHD_STARTSCRIPT
 	select OPENSSH_KEYGEN if OPENSSH_SSHD_GENKEYS
+	select LIBSELINUX	if GLOBAL_SELINUX
 	prompt "openssh                       "
 	help
 	  secure shell client/server, an rlogin/rsh/rcp replacement
diff --git a/rules/pre/Rules.make b/rules/pre/Rules.make
index fd5ddfe55..89b4e9c02 100644
--- a/rules/pre/Rules.make
+++ b/rules/pre/Rules.make
@@ -296,12 +296,6 @@ else
 GLOBAL_PAM_OPTION := --disable-pam
 endif
 
-ifdef PTXCONF_GLOBAL_SELINUX
-GLOBAL_SELINUX_OPTION := --enable-selinux
-else
-GLOBAL_SELINUX_OPTION := --disable-selinux
-endif
-
 # ----------------------------------------------------------------------------
 # HOST stuff
 # ----------------------------------------------------------------------------
diff --git a/rules/shadow.in b/rules/shadow.in
index b3979ebd3..3313d3771 100644
--- a/rules/shadow.in
+++ b/rules/shadow.in
@@ -7,6 +7,7 @@ menuconfig SHADOW
 	depends on (!BUSYBOX_ADDUSER && !BUSYBOX_ADDGROUP && !BUSYBOX_LOGIN && !BUSYBOX_PASSWD && !BUSYBOX_SU) || ALLYES
 	select LIBC_CRYPT
 	select PAM		if GLOBAL_PAM
+	select LIBSELINUX	if GLOBAL_SELINUX
 	prompt "shadow                        "
 	help
 	  Password and account management tool suite with support
diff --git a/rules/strongswan.in b/rules/strongswan.in
index dca4cac99..78ddbd526 100644
--- a/rules/strongswan.in
+++ b/rules/strongswan.in
@@ -7,6 +7,7 @@ menuconfig STRONGSWAN
 	select LIBCURL if STRONGSWAN_LIBCURL
 	select OPENSSL if STRONGSWAN_OPENSSL
 	select SYSTEMD if STRONGSWAN_SYSTEMD_UNIT
+	select LIBSELINUX	if GLOBAL_SELINUX
 	help
 	  strongSwan is a complete IPsec implementation.
 	  Please keep in mind to configure the kernel accordingly to fulfill
diff --git a/rules/systemd.in b/rules/systemd.in
index cfe4d40b5..cc1fda27e 100644
--- a/rules/systemd.in
+++ b/rules/systemd.in
@@ -35,6 +35,7 @@ config SYSTEMD
 	select LZ4		if SYSTEMD_LZ4
 	select ZSTD		if SYSTEMD_ZSTD
 	select PCRE2		if SYSTEMD_PCRE2
+	select LIBSELINUX	if GLOBAL_SELINUX
 	select LIBMICROHTTPD	if SYSTEMD_MICROHTTPD
 	select LIBSECCOMP	if SYSTEMD_SECCOMP
 	select IPTABLES		if SYSTEMD_IPMASQUERADE
-- 
2.47.3