sec-policy: Release of SELinux policies 2.20161023-r4

Package-Manager: portage-2.3.3

2 files changed, 123 insertions, 0 deletions

diff --git a/sec-policy/selinux-base-policy/Manifest b/sec-policy/selinux-base-policy/Manifest
index b3f58dd826ef..d59fcbc8d961 100644
--- a/sec-policy/selinux-base-policy/Manifest
+++ b/sec-policy/selinux-base-policy/Manifest
@@ -2,5 +2,6 @@ DIST patchbundle-selinux-base-policy-2.20151208-r4.tar.bz2 294731 SHA256 ee21453
 DIST patchbundle-selinux-base-policy-2.20151208-r6.tar.bz2 307239 SHA256 dd8cbe50f5fff68af543062157c778cb026f1bbacfb5825dbdb1121be757c5ec SHA512 22758f5fa1d4058cc34613d61271ddf0947a4d21f4ee9b298b290ef17f0bdbbb6f389577c0c3c4f5625d8ef599bb8f1a91c8c5a9cf372a7c07ae5784385130b4 WHIRLPOOL a8500aae051924d1cc646f080f2e511ee6cbea493efea699afc4b7a0d7bfb6365bd862cea5134fe81c11c26923ffef2d7424eb4a262263e8eb7590970f4c3283
 DIST patchbundle-selinux-base-policy-2.20161023-r1.tar.bz2 298107 SHA256 fa5be024a7f3b59b155f3cb3852d8b4124f4e75112cd42014090146221169660 SHA512 f8720e4998023aa5186dd5fdebeb41eb998992fd629dd3ae369c855c00308a0aa47761b7a0fb4638893d7b3d8ef42e11b1ca7c5010cfc055258a3077d83f396d WHIRLPOOL 2cfcb976a2beb5e55049e562d75bb3887ca0cbeac9bc630df23a4456f4026f31673b0be012c8ffda89af9b7417b7202089607cd79e6804f69fa826dd017779f4
 DIST patchbundle-selinux-base-policy-2.20161023-r3.tar.bz2 321394 SHA256 76521408b62a17120072cd0db5e037f4b7b967be4340985ce354786e5d2948f7 SHA512 2e9ca3be900c549ddbcd306f1bf5483934d7baf23ffd66a2172d26bcb81b4aa768596555dd8d362398013778e7a127024ec2468d6bf1b487f0c4a14e479e53f4 WHIRLPOOL 246399de9a96f3605fd490cd118f4301b19935990705ab87133911ad3e4befb5aa6d412e5e43b2e2c60936bc485969f55406316c3d37c2a2e8676642153231dd
+DIST patchbundle-selinux-base-policy-2.20161023-r4.tar.bz2 358553 SHA256 d105d5fbf2859d7f9766ef46ef29c3d71165b4f5ff9548bcbdeca5a1f76b0c27 SHA512 a99f3eda699eb4b040c19f51060a96a116a76aabda323d1a2d840f130c6ccfe34118645d296d48f855a2a2abb0ab6db686b37d02950012798796eafcebfdd781 WHIRLPOOL 849b0e88ed3f1f54de18c0c2edcc0fecd3968e30eb970aace41d0b79aa3d203b2bbcf96f4c564fed95e7b3c8e3b2f524e11c9942ab36e6d6c49431696925b8a8
 DIST refpolicy-2.20151208.tar.bz2 698182 SHA256 2dd2f45a7132137afe8302805c3b7839739759b9ab73dd1815c01afe34ac99de SHA512 cbefe117f143adea834065949e24e9fe86336c049e9e0518026597d5b0a18c482a9717422bd39b7fb0012d19df00365c969d87e1f13a7bb9dcb9996313ed6cf8 WHIRLPOOL cb843a602dde4234a62e6f92001bff689a457796215b015bcccce79e7aa73bfe875a82bdbdbf59236f218eb41aaf665fcc5753c42d86eb3ed1caa1b69ddc2efa
 DIST refpolicy-2.20161023.tar.bz2 1768667 SHA256 14c9576e2cdf0ecf656134bc59cba99589dbba2895344d2fc226bdb5d8e541c7 SHA512 3201ca3c6cada1053343d3763d36072cf40afa46bf5343087a8254320879cb61fef539dc7742e04e5645d0c886b8f4bf552bf502e9716f7a3282efc0b0ed970d WHIRLPOOL 3f44955c3b13f5a6152d8ca8b75b3c8d52becc1c47b3b0126f5c86fbdad8bf6a1ae72c42e0b130352e139f987340b3c0d3d37aac5b80c5e3d731fcd666b88504
diff --git a/sec-policy/selinux-base-policy/selinux-base-policy-2.20161023-r4.ebuild b/sec-policy/selinux-base-policy/selinux-base-policy-2.20161023-r4.ebuild
new file mode 100644
index 000000000000..ca3d71c9d366
--- /dev/null
+++ b/sec-policy/selinux-base-policy/selinux-base-policy-2.20161023-r4.ebuild
@@ -0,0 +1,122 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+EAPI="6"
+
+if [[ ${PV} == 9999* ]]; then
+	EGIT_REPO_URI="${SELINUX_GIT_REPO:-git://anongit.gentoo.org/proj/hardened-refpolicy.git https://anongit.gentoo.org/git/proj/hardened-refpolicy.git}"
+	EGIT_BRANCH="${SELINUX_GIT_BRANCH:-master}"
+	EGIT_CHECKOUT_DIR="${WORKDIR}/refpolicy"
+
+	inherit git-r3
+else
+	SRC_URI="https://raw.githubusercontent.com/wiki/TresysTechnology/refpolicy/files/refpolicy-${PV}.tar.bz2
+			https://dev.gentoo.org/~swift/patches/${PN}/patchbundle-${PN}-${PVR}.tar.bz2"
+	KEYWORDS="~amd64 ~arm ~arm64 ~mips ~x86"
+fi
+
+HOMEPAGE="https://www.gentoo.org/proj/en/hardened/selinux/"
+DESCRIPTION="SELinux policy for core modules"
+
+IUSE="systemd +unconfined"
+
+PDEPEND="unconfined? ( sec-policy/selinux-unconfined )"
+DEPEND="=sec-policy/selinux-base-${PVR}[systemd?]"
+
+MODS="application authlogin bootloader clock consoletype cron dmesg fstools getty hostname hotplug init iptables libraries locallogin logging lvm miscfiles modutils mount mta netutils nscd portage raid rsync selinuxutil setrans ssh staff storage su sysadm sysnetwork tmpfiles udev userdomain usermanage unprivuser xdg"
+LICENSE="GPL-2"
+SLOT="0"
+S="${WORKDIR}/"
+
+# Code entirely copied from selinux-eclass (cannot inherit due to dependency on
+# itself), when reworked reinclude it. Only postinstall (where -b base.pp is
+# added) needs to remain then.
+
+pkg_setup() {
+	if use systemd; then
+		MODS="${MODS} systemd"
+	fi
+}
+
+pkg_pretend() {
+	for i in ${POLICY_TYPES}; do
+		if [[ "${i}" == "targeted" ]] && ! use unconfined; then
+			die "If you use POLICY_TYPES=targeted, then USE=unconfined is mandatory."
+		fi
+	done
+}
+
+src_prepare() {
+	local modfiles
+
+	if [[ ${PV} != 9999* ]]; then
+		einfo "Applying SELinux policy updates ... "
+		eapply -p0 "${WORKDIR}/0001-full-patch-against-stable-release.patch"
+	fi
+
+	eapply_user
+
+	# Collect only those files needed for this particular module
+	for i in ${MODS}; do
+		modfiles="$(find ${S}/refpolicy/policy/modules -iname $i.te) $modfiles"
+		modfiles="$(find ${S}/refpolicy/policy/modules -iname $i.fc) $modfiles"
+	done
+
+	for i in ${POLICY_TYPES}; do
+		mkdir "${S}"/${i} || die "Failed to create directory ${S}/${i}"
+		cp "${S}"/refpolicy/doc/Makefile.example "${S}"/${i}/Makefile \
+			|| die "Failed to copy Makefile.example to ${S}/${i}/Makefile"
+
+		cp ${modfiles} "${S}"/${i} \
+			|| die "Failed to copy the module files to ${S}/${i}"
+	done
+}
+
+src_compile() {
+	for i in ${POLICY_TYPES}; do
+		emake NAME=$i -C "${S}"/${i} || die "${i} compile failed"
+	done
+}
+
+src_install() {
+	local BASEDIR="/usr/share/selinux"
+
+	for i in ${POLICY_TYPES}; do
+		for j in ${MODS}; do
+			einfo "Installing ${i} ${j} policy package"
+			insinto ${BASEDIR}/${i}
+			doins "${S}"/${i}/${j}.pp || die "Failed to add ${j}.pp to ${i}"
+		done
+	done
+}
+
+pkg_postinst() {
+	# Override the command from the eclass, we need to load in base as well here
+	local COMMAND="-i base.pp"
+	if has_version "<sys-apps/policycoreutils-2.5"; then
+		COMMAND="-b base.pp"
+	fi
+
+	for i in ${MODS}; do
+		COMMAND="${COMMAND} -i ${i}.pp"
+	done
+
+	for i in ${POLICY_TYPES}; do
+		einfo "Inserting the following modules, with base, into the $i module store: ${MODS}"
+
+		cd /usr/share/selinux/${i} || die "Could not enter /usr/share/selinux/${i}"
+
+		semodule -s ${i} ${COMMAND} || die "Failed to load in base and modules ${MODS} in the $i policy store"
+	done
+
+	# Relabel depending packages
+	local PKGSET="";
+	if [[ -x /usr/bin/qdepends ]] ; then
+		PKGSET=$(/usr/bin/qdepends -Cq -r -Q ${CATEGORY}/${PN} | grep -v 'sec-policy/selinux-');
+	elif [[ -x /usr/bin/equery ]] ; then
+		PKGSET=$(/usr/bin/equery -Cq depends ${CATEGORY}/${PN} | grep -v 'sec-policy/selinux-');
+	fi
+	if [[ -n "${PKGSET}" ]] ; then
+		rlpkg ${PKGSET};
+	fi
+}