[ptxdist] [PATCH v1 07/17] libselinux: version bump 2.1.12 -> 3.11

[Ladislav Michl <oss-lists@triops.cz>]

From: Ladislav Michl <ladis@triops.cz>

Signed-off-by: Ladislav Michl <ladis@triops.cz>
---
 ...PyString_FromString-with-PyUnicode_F.patch | 48 ++++++++++++
 patches/libselinux-3.11/series                |  4 +
 rules/libselinux.in                           | 56 +++++++++++---
 rules/libselinux.make                         | 76 +++++++++++++------
 4 files changed, 153 insertions(+), 31 deletions(-)
 create mode 100644 patches/libselinux-3.11/0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch
 create mode 100644 patches/libselinux-3.11/series

diff --git a/patches/libselinux-3.11/0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch b/patches/libselinux-3.11/0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch
new file mode 100644
index 000000000..015ede608
--- /dev/null
+++ b/patches/libselinux-3.11/0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch
@@ -0,0 +1,48 @@
+From: Petr Lautrbach <lautrbach@redhat.com>
+Date: Thu, 6 Aug 2026 16:30:44 +0200
+Subject: [PATCH] libselinux: Replace PyString_FromString with
+ PyUnicode_FromString for SWIG 4.5.0 compatibility
+
+SWIG 4.5.0 removed Python 2 C API compatibility macros (PyInt_*,
+PyString_*, SWIG_Python_str_*) from its runtime header pyhead.swg.
+These macros previously mapped deprecated Python 2 C API names to their
+Python 3 equivalents.
+
+Fixes: https://github.com/SELinuxProject/selinux/issues/538
+Authored-by: Jitka Plesníková <jplesnik@redhat.com>
+Signed-off-by: Petr Lautrbach <lautrbach@redhat.com>
+Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
+---
+ src/selinuxswig_python.i | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/selinuxswig_python.i b/src/selinuxswig_python.i
+--- a/src/selinuxswig_python.i
++++ b/src/selinuxswig_python.i
+@@ -69,7 +69,7 @@
+ 	PyObject* list = PyList_New(*$2);
+ 	int i;
+ 	for (i = 0; i < *$2; i++) {
+-		PyList_SetItem(list, i, PyString_FromString((*$1)[i]));
++		PyList_SetItem(list, i, PyUnicode_FromString((*$1)[i]));
+ 	}
+ 	$result = SWIG_AppendOutput($result, list);
+ }
+@@ -102,7 +102,7 @@
+ 			len++;
+ 		plist = PyList_New(len);
+ 		for (i = 0; i < len; i++) {
+-			PyList_SetItem(plist, i, PyString_FromString((*$1)[i]));
++			PyList_SetItem(plist, i, PyUnicode_FromString((*$1)[i]));
+ 		}
+ 	} else {
+ 		plist = PyList_New(0);
+@@ -119,7 +119,7 @@
+ 	if (*$1) {
+ 		plist = PyList_New(result);
+ 		for (i = 0; i < result; i++) {
+-			PyList_SetItem(plist, i, PyString_FromString((*$1)[i]));
++			PyList_SetItem(plist, i, PyUnicode_FromString((*$1)[i]));
+ 		}
+ 	} else {
+ 		plist = PyList_New(0);
diff --git a/patches/libselinux-3.11/series b/patches/libselinux-3.11/series
new file mode 100644
index 000000000..9d79f21d8
--- /dev/null
+++ b/patches/libselinux-3.11/series
@@ -0,0 +1,4 @@
+# generated by git-ptx-patches
+#tag:base --start-number 1
+0001-libselinux-Replace-PyString_FromString-with-PyUnicode_F.patch
+# 9229b75b9f37589afb32a0e0c582e3b8  - git-ptx-patches magic
diff --git a/rules/libselinux.in b/rules/libselinux.in
index 6d6b1e655..908964b55 100644
--- a/rules/libselinux.in
+++ b/rules/libselinux.in
@@ -1,27 +1,65 @@
-## SECTION=staging
-## old section:
-### SECTION=selinux
+## SECTION=selinux
 
 menuconfig LIBSELINUX
 	tristate
 	prompt "libselinux                    "
-	select LIBPCRE
+	select PCRE2
+	select PCRE2_8
 	select LIBSEPOL
-	select PYTHON		if LIBSELINUX_PYTHON
+	select PYTHON3		if LIBSELINUX_PYTHON
 	select HOST_SWIG	if LIBSELINUX_PYTHON
+	select HOST_PYTHON3_PIP	if LIBSELINUX_PYTHON
 	help
 	  libselinux provides an API for SELinux applications to get and set
 	  process and file security contexts and to obtain security policy
 	  decisions. Required for any applications that use the SELinux
 	  API.
 
-	  STAGING: remove in ptxdist-2020.12.0
-	  Old version that need to be updated. Fails to build with gcc >= 9.x.
-
 if LIBSELINUX
 
+config LIBSELINUX_UTILS
+	bool "install utilities"
+
+if LIBSELINUX_UTILS
+
+config LIBSELINUX_GETENFORCE
+	bool "getenforce"
+	depends on !BUSYBOX_GETENFORCE || ALLYES
+
+comment "busybox' getenforce is selected!"
+	depends on BUSYBOX_GETENFORCE
+
+config LIBSELINUX_GETSEBOOL
+	bool "getsebool"
+	depends on !BUSYBOX_GETSEBOOL || ALLYES
+
+comment "busybox' getsebool is selected!"
+	depends on BUSYBOX_GETSEBOOL
+
+config LIBSELINUX_MATCHPATHCON
+	bool "matchpathcon"
+	depends on !BUSYBOX_MATCHPATHCON || ALLYES
+
+comment "busybox' matchpathcon is selected!"
+	depends on BUSYBOX_MATCHPATHCON
+
+config LIBSELINUX_SELINUXENABLED
+	bool "selinuxenabled"
+	depends on !BUSYBOX_SELINUXENABLED || ALLYES
+
+comment "busybox' selinuxenabled is selected!"
+	depends on BUSYBOX_SELINUXENABLED
+
+config LIBSELINUX_SETENFORCE
+	bool "setenforce"
+	depends on !BUSYBOX_SETENFORCE || ALLYES
+
+comment "busybox' setenforce is selected!"
+	depends on BUSYBOX_SETENFORCE
+
+endif
+
 config LIBSELINUX_PYTHON
 	bool "python wrapper"
-	depends on STAGING
 
 endif
diff --git a/rules/libselinux.make b/rules/libselinux.make
index 9f6b6a62f..51fff977c 100644
--- a/rules/libselinux.make
+++ b/rules/libselinux.make
@@ -14,62 +14,94 @@ PACKAGES-$(PTXCONF_LIBSELINUX) += libselinux
 #
 # Paths and names
 #
-LIBSELINUX_VERSION	:= 2.1.12
-LIBSELINUX_MD5		:= 73270f384a032fad34b5fe075fa05ce2
+LIBSELINUX_VERSION	:= $(SELINUX_VERSION)
+LIBSELINUX_SHA256	:= 73d419c6e20e874adaa4019372cbd097eecf4d276e13f27ec5e67d35c0bd203c
 LIBSELINUX		:= libselinux-$(LIBSELINUX_VERSION)
 LIBSELINUX_SUFFIX	:= tar.gz
-LIBSELINUX_URL		:= https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20120924/$(LIBSELINUX).$(LIBSELINUX_SUFFIX)
+LIBSELINUX_URL		:= $(SELINUX_URL)/$(LIBSELINUX).$(LIBSELINUX_SUFFIX)
 LIBSELINUX_SOURCE	:= $(SRCDIR)/$(LIBSELINUX).$(LIBSELINUX_SUFFIX)
 LIBSELINUX_DIR		:= $(BUILDDIR)/$(LIBSELINUX)
 LIBSELINUX_LICENSE	:= public_domain
+LIBSELINUX_LICENSE_FILES	:= file://LICENSE;md5=84b4d2c6ef954a2d4081e775a270d0d0
+LIBSELINUX_CVE_PRODUCT	:= selinuxproject:libselinux
 
 # ----------------------------------------------------------------------------
 # Prepare
 # ----------------------------------------------------------------------------
 
-LIBSELINUX_CONF_TOOL := NO
-# no := due to CROSS_PYTHON
-LIBSELINUX_MAKE_ENV = \
-	$(CROSS_ENV) \
-	CFLAGS="-O2 -Wall -g" \
-	PYTHON=$(CROSS_PYTHON)
-LIBSELINUX_MAKE_OPT := \
-	LIBDIR=$(PTXDIST_SYSROOT_TARGET)/usr/lib
-LIBSELINUX_INSTALL_OPT := \
+LIBSELINUX_CONF_TOOL	:= NO
+LIBSELINUX_MAKE_ENV	:= $(CROSS_ENV)
+LIBSELINUX_MAKE_OPT	= \
+	PREFIX=/usr \
+	LIBDIR=/usr/lib \
+	SHLIBDIR=/usr/lib \
+	INCLUDEDIR=/usr/include \
+	SBINDIR=/usr/sbin \
+	USE_PCRE2=y \
+	USE_LFS=y \
+	DISABLE_SHARED=n \
+	DISABLE_BOOL=n \
+	DISABLE_SETRANS=y \
+	DISABLE_RPM=y \
+	DISABLE_X11=y \
+	ANDROID_HOST=n \
+	LABEL_BACKEND_ANDROID=n \
+	CFLAGS="-O2 -Wall -g"
+
+ifdef PTXCONF_LIBSELINUX_PYTHON
+LIBSELINUX_MAKE_OPT	+= \
+	PYTHON=$(CROSS_PYTHON3) \
+	PYTHONLIBDIR=$(PYTHON3_SITEPACKAGES)
+endif
+
+LIBSELINUX_INSTALL_OPT	= \
+	$(LIBSELINUX_MAKE_OPT) \
 	install
 
 ifdef PTXCONF_LIBSELINUX_PYTHON
-LIBSELINUX_MAKE_OPT	+= pywrap
 LIBSELINUX_INSTALL_OPT	+= install-pywrap
 endif
 
+# ----------------------------------------------------------------------------
+# Compile
+# ----------------------------------------------------------------------------
+
+$(STATEDIR)/libselinux.compile:
+	@$(call targetinfo)
+	@$(call world/compile, LIBSELINUX)
+ifdef PTXCONF_LIBSELINUX_PYTHON
+	@$(call compile, LIBSELINUX, $(LIBSELINUX_MAKE_OPT) pywrap)
+endif
+	@$(call touch)
+
 # ----------------------------------------------------------------------------
 # Target-Install
 # ----------------------------------------------------------------------------
 
-LIBSELINUX_PROGS := \
+LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_UTILS) := \
 	avcstat \
 	compute_av \
 	compute_create \
 	compute_member \
 	compute_relabel \
-	compute_user \
 	getconlist \
 	getdefaultcon \
-	getenforce \
 	getfilecon \
 	getpidcon \
-	getsebool \
 	getseuser \
-	matchpathcon \
 	policyvers \
+	sefcontext_compile \
 	selinux_check_securetty_context \
-	selinuxenabled \
 	selinuxexeccon \
-	setenforce \
 	setfilecon \
 	togglesebool
 
+LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_GETENFORCE)	+= getenforce
+LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_GETSEBOOL)	+= getsebool
+LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_MATCHPATHCON)	+= matchpathcon
+LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_SELINUXENABLED)	+= selinuxenabled
+LIBSELINUX_PROGS-$(PTXCONF_LIBSELINUX_SETENFORCE)	+= setenforce
+
 $(STATEDIR)/libselinux.targetinstall:
 	@$(call targetinfo)
 
@@ -81,11 +113,11 @@ $(STATEDIR)/libselinux.targetinstall:
 
 	@$(call install_lib, libselinux, 0, 0, 0644, libselinux)
 
-	@$(foreach prog, $(LIBSELINUX_PROGS), \
+	@$(foreach prog, $(LIBSELINUX_PROGS-y), \
 		$(call install_copy, libselinux, 0, 0, 0755, -, /usr/sbin/$(prog));)
 
 ifdef PTXCONF_LIBSELINUX_PYTHON
-	@$(call install_tree, libselinux, 0, 0, -, $(PYTHON_SITEPACKAGES))
+	@$(call install_tree, libselinux, 0, 0, -, $(PYTHON3_SITEPACKAGES))
 endif
 	@$(call install_finish, libselinux)
 
-- 
2.47.3