From d819e2afa40258b55c912a3c121f3aff85405a54 Mon Sep 17 00:00:00 2001 From: Mathieu Tortuyaux Date: Wed, 2 Jun 2021 15:44:15 +0200 Subject: [PATCH] sec-policy/selinux-base-policy: sync with upstream Signed-off-by: Mathieu Tortuyaux --- .../sec-policy/selinux-base-policy/ChangeLog | 1033 ----------------- .../sec-policy/selinux-base-policy/Manifest | 6 +- .../selinux-base-policy/files/config | 15 - .../selinux-base-policy/files/modules.conf | 50 - .../selinux-base-policy/metadata.xml | 7 +- .../selinux-base-policy-2.20141203-r14.ebuild | 117 -- .../selinux-base-policy-2.20200818-r2.ebuild | 129 ++ .../selinux-base-policy-2.20210203-r1.ebuild | 129 ++ .../selinux-base-policy-9999.ebuild | 104 +- 9 files changed, 312 insertions(+), 1278 deletions(-) delete mode 100644 sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/ChangeLog delete mode 100644 sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/files/config delete mode 100644 sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/files/modules.conf delete mode 100644 sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/selinux-base-policy-2.20141203-r14.ebuild create mode 100644 sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/selinux-base-policy-2.20200818-r2.ebuild create mode 100644 sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/selinux-base-policy-2.20210203-r1.ebuild diff --git a/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/ChangeLog b/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/ChangeLog deleted file mode 100644 index 0c374d421d..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/ChangeLog +++ /dev/null @@ -1,1033 +0,0 @@ -# ChangeLog for sec-policy/selinux-base-policy -# Copyright 1999-2015 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-base-policy/ChangeLog,v 1.176 2015/06/05 16:10:32 perfinion Exp $ - - 05 Jun 2015; Jason Zaman - selinux-base-policy-2.20141203-r5.ebuild: - Stabilize policy 2.20141203-r5 - -*selinux-base-policy-2.20141203-r6 (05 Jun 2015) - - 05 Jun 2015; Jason Zaman - +selinux-base-policy-2.20141203-r6.ebuild: - Release of 2.20141203-r6 - - 25 Apr 2015; Mike Gilbert - selinux-base-policy-2.20140311-r5.ebuild, - selinux-base-policy-2.20140311-r6.ebuild, - selinux-base-policy-2.20140311-r7.ebuild, - selinux-base-policy-2.20141203-r1.ebuild, - selinux-base-policy-2.20141203-r2.ebuild, - selinux-base-policy-2.20141203-r3.ebuild, - selinux-base-policy-2.20141203-r4.ebuild, - selinux-base-policy-2.20141203-r5.ebuild: - Replace links pointing at git.overlays.gentoo.org. - - 21 Apr 2015; Jason Zaman - selinux-base-policy-9999.ebuild: - update git urls and migrate git-2 -> git-r3 - - 15 Apr 2015; Jason Zaman - selinux-base-policy-2.20141203-r4.ebuild: - Stabilize policy 2.20141203-r4 - -*selinux-base-policy-2.20141203-r5 (15 Apr 2015) - - 15 Apr 2015; Jason Zaman - +selinux-base-policy-2.20141203-r5.ebuild: - Release of 2.20141203-r5 - - 22 Mar 2015; Sven Vermeulen - selinux-base-policy-2.20141203-r3.ebuild: - Stabilize 2.20141203-r3 policies - -*selinux-base-policy-2.20141203-r4 (22 Mar 2015) - - 22 Mar 2015; Sven Vermeulen - +selinux-base-policy-2.20141203-r4.ebuild, selinux-base-policy-9999.ebuild: - Release of 2.20141203-r4 - -*selinux-base-policy-2.20141203-r3 (29 Jan 2015) - - 29 Jan 2015; Jason Zaman - +selinux-base-policy-2.20141203-r3.ebuild, - selinux-base-policy-2.20141203-r2.ebuild: - Release of 2.20141203-r3, stable 2.20141203-r2 - - 21 Dec 2014; Sven Vermeulen - -selinux-base-policy-2.20140311-r1.ebuild, - -selinux-base-policy-2.20140311-r2.ebuild, - -selinux-base-policy-2.20140311-r3.ebuild, - -selinux-base-policy-2.20140311-r4.ebuild: - Remove old ebuilds - - 21 Dec 2014; Sven Vermeulen - selinux-base-policy-2.20141203-r1.ebuild: - Stabilize 2.20141203-r1 - -*selinux-base-policy-2.20141203-r2 (21 Dec 2014) - - 21 Dec 2014; Sven Vermeulen - +selinux-base-policy-2.20141203-r2.ebuild: - Release of 2.20141203-r2 - - 07 Dec 2014; Jason Zaman - selinux-base-policy-2.20140311-r7.ebuild, selinux-base-policy-9999.ebuild: - Stabilize 2.20140311-r7 - -*selinux-base-policy-2.20141203-r1 (07 Dec 2014) - - 07 Dec 2014; Jason Zaman - +selinux-base-policy-2.20141203-r1.ebuild: - Release of 2.20141203-r1 - - 07 Dec 2014; Jason Zaman - selinux-base-policy-9999.ebuild: - update SRC_URI - - 05 Dec 2014; Jason Zaman - selinux-base-policy-9999.ebuild: - enable parallel build, bug 530178 - - 29 Nov 2014; Jason Zaman - selinux-base-policy-2.20140311-r7.ebuild, selinux-base-policy-9999.ebuild: - Must relabel RDEP not DEP - - 23 Nov 2014; Sven Vermeulen - selinux-base-policy-9999.ebuild: - Add notice about bug 530178 - - 23 Nov 2014; Sven Vermeulen - selinux-base-policy-9999.ebuild: - Parallel builds are fixed since February 2014 - - 01 Nov 2014; Sven Vermeulen - selinux-base-policy-2.20140311-r6.ebuild: - Stabilize rev 6 - -*selinux-base-policy-2.20140311-r7 (01 Nov 2014) - - 01 Nov 2014; Sven Vermeulen - +selinux-base-policy-2.20140311-r7.ebuild: - Bump revision r7 of SELinux policies - - 01 Nov 2014; Sven Vermeulen - selinux-base-policy-9999.ebuild: - Add KEYWORDS logic in -9999 ebuilds for ease of copying - - 30 Aug 2014; Sven Vermeulen - selinux-base-policy-9999.ebuild: - Use single-line rlpkg call and do not label policy packages - - 24 Aug 2014; Sven Vermeulen - selinux-base-policy-9999.ebuild: - Back to gogo infrastructure - - 23 Aug 2014; Sven Vermeulen - selinux-base-policy-9999.ebuild: - Temporarily use github until gogo is back on track - - 22 Aug 2014; Sven Vermeulen - selinux-base-policy-2.20140311-r5.ebuild: - Stabilize r5 policies - -*selinux-base-policy-2.20140311-r6 (21 Aug 2014) - - 21 Aug 2014; Sven Vermeulen - +selinux-base-policy-2.20140311-r6.ebuild: - Release of 2.20140311-r6 - -*selinux-base-policy-2.20140311-r5 (09 Aug 2014) - - 09 Aug 2014; Sven Vermeulen - +selinux-base-policy-2.20140311-r5.ebuild, selinux-base-policy-9999.ebuild: - Bump towards r5 (fixes duplicate context for hiawatha) - - 08 Aug 2014; Sven Vermeulen - selinux-base-policy-9999.ebuild: - Make 9999 ebuilds EAPI=5 and transform to make master for version bumps - - 06 Aug 2014; Sven Vermeulen - selinux-base-policy-9999.ebuild: - Supporting the SELINUX_GIT_* variables - - 05 Aug 2014; Sven Vermeulen - -selinux-base-policy-2.20130424-r1.ebuild, - -selinux-base-policy-2.20130424-r2.ebuild, - -selinux-base-policy-2.20130424-r3.ebuild, - -selinux-base-policy-2.20130424-r4.ebuild: - Remove obsolete ebuilds - -*selinux-base-policy-2.20140311-r4 (01 Aug 2014) - - 01 Aug 2014; Sven Vermeulen - +selinux-base-policy-2.20140311-r4.ebuild, - selinux-base-policy-2.20140311-r3.ebuild: - Stabilization of r3, and make r4 available for testing - - 29 May 2014; Sven Vermeulen - selinux-base-policy-2.20140311-r2.ebuild: - Stabilize 2.20140311-r2 - -*selinux-base-policy-2.20140311-r3 (29 May 2014) - - 29 May 2014; Sven Vermeulen - +selinux-base-policy-2.20140311-r3.ebuild: - Bump to 2.20140311-r3 - - 19 Apr 2014; Sven Vermeulen - selinux-base-policy-2.20140311-r1.ebuild: - Stabilize r1 policies - -*selinux-base-policy-2.20140311-r2 (19 Apr 2014) - - 19 Apr 2014; Sven Vermeulen - +selinux-base-policy-2.20140311-r2.ebuild: - Release of 2.20140311-r2 - - 24 Mar 2014; Sven Vermeulen - -selinux-base-policy-2.20120725-r5.ebuild, - -selinux-base-policy-2.20120725-r7.ebuild, - -selinux-base-policy-2.20120725-r8.ebuild, - -selinux-base-policy-2.20120725-r9.ebuild, - -selinux-base-policy-2.20120725-r10.ebuild, - -selinux-base-policy-2.20120725-r11.ebuild, - -selinux-base-policy-2.20120725-r12.ebuild: - Removing older SELinux policies - -*selinux-base-policy-2.20140311-r1 (21 Mar 2014) - - 21 Mar 2014; Sven Vermeulen - +selinux-base-policy-2.20140311-r1.ebuild: - New upstream refpolicy release - - 12 Jan 2014; Sven Vermeulen - selinux-base-policy-2.20130424-r4.ebuild: - Stabilize 2.20130424-r4 - -*selinux-base-policy-2.20130424-r4 (11 Dec 2013) - - 11 Dec 2013; Sven Vermeulen - +selinux-base-policy-2.20130424-r4.ebuild: - Release of 2.20130424-r4 - -*selinux-base-policy-2.20130424-r3 (26 Sep 2013) - - 26 Sep 2013; Sven Vermeulen - +selinux-base-policy-2.20130424-r3.ebuild: - Release 2.20130424-r3, fixing bugs #480628, #482196, #475432, #485304, #480870 - and #428322 - - 15 Aug 2013; Sven Vermeulen - selinux-base-policy-2.20130424-r2.ebuild: - Stabilize r2 of policies - -*selinux-base-policy-2.20130424-r2 (20 Jul 2013) - - 20 Jul 2013; Sven Vermeulen - +selinux-base-policy-2.20130424-r2.ebuild, selinux-base-policy-9999.ebuild: - release rev2 - - 16 Jun 2013; Sven Vermeulen - selinux-base-policy-2.20130424-r1.ebuild: - Stabilize 20130424 policies - - 07 May 2013; Sven Vermeulen - selinux-base-policy-2.20130424-r1.ebuild, selinux-base-policy-9999.ebuild: - Adding support for epatch_user since selinux-base-policy will not inherit - this from the selinux eclass - -*selinux-base-policy-2.20130424-r1 (06 May 2013) - - 06 May 2013; Sven Vermeulen - +selinux-base-policy-2.20130424-r1.ebuild: - Adding 20130424 release - - 29 Mar 2013; Sven Vermeulen - selinux-base-policy-9999.ebuild: - Fix bug #462952 - cyclic dependency for unconfined - - 29 Mar 2013; Sven Vermeulen - selinux-base-policy-2.20120725-r12.ebuild: - Stabilize r12, fixes 455080, 453724, 461880, 453722, 452166, 458876, 457618, - 456910, 456194, 453990 and 460152 - - 26 Mar 2013; Sven Vermeulen - selinux-base-policy-2.20120725-r12.ebuild, selinux-base-policy-9999.ebuild: - unconfined package is PDEPEND, otherwise circular dependency. See bug #462952 - - 09 Mar 2013; Sven Vermeulen - selinux-base-policy-2.20120725-r12.ebuild: - Fix bug #458876 - USE=unconfined if targeted is set - -*selinux-base-policy-2.20120725-r12 (09 Mar 2013) - - 09 Mar 2013; Sven Vermeulen - +selinux-base-policy-2.20120725-r12.ebuild, selinux-base-policy-9999.ebuild: - Pushing out rev 12 - - 23 Feb 2013; Sven Vermeulen - selinux-base-policy-2.20120725-r11.ebuild: - Stabilization - -*selinux-base-policy-2.20120725-r11 (26 Jan 2013) - - 26 Jan 2013; Sven Vermeulen - +selinux-base-policy-2.20120725-r11.ebuild: - Bumping selinux-base-policy to revision 11 - - 16 Jan 2013; Sven Vermeulen - selinux-base-policy-2.20120725-r10.ebuild: - Stabilizing - -*selinux-base-policy-2.20120725-r10 (16 Jan 2013) - - 16 Jan 2013; Sven Vermeulen - +selinux-base-policy-2.20120725-r10.ebuild: - Bumping with fix for #451128 - - 13 Jan 2013; Sven Vermeulen - selinux-base-policy-2.20120725-r9.ebuild: - Stabilizing r9 - -*selinux-base-policy-2.20120725-r9 (21 Dec 2012) - - 21 Dec 2012; Sven Vermeulen +selinux-base-policy-2.20120725-r9.ebuild: - Bumping to revision 9 - - 17 Dec 2012; Sven Vermeulen -selinux-base-policy-2.20120215-r13.ebuild, - -selinux-base-policy-2.20120215-r14.ebuild, - -selinux-base-policy-2.20120215-r15.ebuild, - -selinux-base-policy-2.20120215-r6.ebuild, - -selinux-base-policy-2.20120215-r7.ebuild, - -selinux-base-policy-2.20120215-r8.ebuild, - -selinux-base-policy-2.20120215-r9.ebuild: - Removing older ebuilds - - 13 Dec 2012; Sven Vermeulen selinux-base-policy-2.20120725-r8.ebuild: - Stabilization - - 04 Dec 2012; Sven Vermeulen selinux-base-policy-9999.ebuild, - metadata.xml: - Add in support for unconfined USE flag - -*selinux-base-policy-2.20120725-r8 (03 Dec 2012) - - 03 Dec 2012; Sven Vermeulen +selinux-base-policy-2.20120725-r8.ebuild: - Bumping to revision 8 - -*selinux-base-policy-2.20120725-r7 (18 Nov 2012) - - 18 Nov 2012; Sven Vermeulen +selinux-base-policy-2.20120725-r7.ebuild: - Pushing out rev 7 - -*selinux-base-policy-9999 (13 Oct 2012) - - 13 Oct 2012; Sven Vermeulen +selinux-base-policy-9999.ebuild: - Adding live ebuild - - 04 Oct 2012; Sven Vermeulen selinux-base-policy-2.20120725-r5.ebuild: - Stabilization - -*selinux-base-policy-2.20120725-r5 (21 Sep 2012) - - 21 Sep 2012; Sven Vermeulen +selinux-base-policy-2.20120725-r5.ebuild: - Introducing policy for 2.20120725, rev5 - - 30 Jul 2012; Sven Vermeulen selinux-base-policy-2.20120215-r14.ebuild: - Stabilization of revision 14 of the SELinux policy modules - -*selinux-base-policy-2.20120215-r15 (26 Jul 2012) - - 26 Jul 2012; Sven Vermeulen +selinux-base-policy-2.20120215-r15.ebuild: - Bump to rev15 - -*selinux-base-policy-2.20120215-r14 (16 Jul 2012) - - 16 Jul 2012; Sven Vermeulen +selinux-base-policy-2.20120215-r14.ebuild: - Bumping to rev14 - -*selinux-base-policy-2.20120215-r13 (27 Jun 2012) - - 27 Jun 2012; Sven Vermeulen +selinux-base-policy-2.20120215-r13.ebuild: - Bump to revision 13 - -*selinux-base-policy-2.20120215-r9 (20 May 2012) - - 20 May 2012; Sven Vermeulen +selinux-base-policy-2.20120215-r9.ebuild: - Bumping to rev 9 - - 13 May 2012; Sven Vermeulen -selinux-base-policy-2.20110726-r5.ebuild, - -selinux-base-policy-2.20110726-r6.ebuild, - -selinux-base-policy-2.20110726-r7.ebuild, - -selinux-base-policy-2.20110726-r8.ebuild, - -selinux-base-policy-2.20110726-r11.ebuild, - -selinux-base-policy-2.20110726-r13.ebuild, metadata.xml: - Drop unused local USE flag definitions - - 13 May 2012; Sven Vermeulen -selinux-base-policy-2.20110726-r5.ebuild, - -selinux-base-policy-2.20110726-r6.ebuild, - -selinux-base-policy-2.20110726-r7.ebuild, - -selinux-base-policy-2.20110726-r8.ebuild, - -selinux-base-policy-2.20110726-r11.ebuild, - -selinux-base-policy-2.20110726-r13.ebuild: - Removing deprecated ebuilds (cleanup) - - 29 Apr 2012; Sven Vermeulen selinux-base-policy-2.20120215-r7.ebuild: - Stabilize rev7 - -*selinux-base-policy-2.20120215-r8 (26 Apr 2012) - - 26 Apr 2012; Sven Vermeulen +selinux-base-policy-2.20120215-r8.ebuild: - Bump to rev8, fix #411719, #411149 and #411943 - - 22 Apr 2012; Michael Sterrett - selinux-base-policy-2.20120215-r7.ebuild: - inherit goes near the top - -*selinux-base-policy-2.20120215-r7 (22 Apr 2012) - - 22 Apr 2012; Sven Vermeulen +selinux-base-policy-2.20120215-r7.ebuild: - Bumping to rev 7, fixing bugs #401595, #411193 and #403293 - - 01 Apr 2012; Michael Sterrett - selinux-base-policy-2.20120215-r6.ebuild: - inherit goes near the top - - 31 Mar 2012; Sven Vermeulen selinux-base-policy-2.20110726-r13.ebuild: - Stabilizing - -*selinux-base-policy-2.20120215-r6 (31 Mar 2012) - - 31 Mar 2012; Sven Vermeulen +selinux-base-policy-2.20120215-r6.ebuild: - Bumping to 2.20120215 policies - - 23 Feb 2012; Sven Vermeulen selinux-base-policy-2.20110726-r11.ebuild: - Stabilizing - -*selinux-base-policy-2.20110726-r13 (23 Feb 2012) - - 23 Feb 2012; Sven Vermeulen +selinux-base-policy-2.20110726-r13.ebuild: - Adding revision 13 - - 29 Jan 2012; Manifest: - Updating manifest - - 29 Jan 2012; Sven Vermeulen selinux-base-policy-2.20110726-r8.ebuild: - Stabilize r8 series - -*selinux-base-policy-2.20110726-r11 (14 Jan 2012) - - 14 Jan 2012; Sven Vermeulen +selinux-base-policy-2.20110726-r11.ebuild: - Bumping to rev 11 - - 19 Dec 2011; Sven Vermeulen selinux-base-policy-2.20110726-r6.ebuild: - Stabilize rev6 - -*selinux-base-policy-2.20110726-r8 (17 Dec 2011) - - 17 Dec 2011; Sven Vermeulen +selinux-base-policy-2.20110726-r8.ebuild: - Bumping to rev8, list of changes available at - http://archives.gentoo.org/gentoo-hardened/msg_b11ef32142076034abd0616e373361 - da.xml - -*selinux-base-policy-2.20110726-r7 (04 Dec 2011) - - 04 Dec 2011; Sven Vermeulen +selinux-base-policy-2.20110726-r7.ebuild: - Bumping to rev 7 - - 27 Nov 2011; Sven Vermeulen selinux-base-policy-2.20110726-r4.ebuild, - selinux-base-policy-2.20110726-r5.ebuild, - selinux-base-policy-2.20110726-r6.ebuild, files/modules.conf: - Put XDG selection (for base) in modules.conf instead of ebuild hocus-pocus - - 27 Nov 2011; Sven Vermeulen selinux-base-policy-2.20110726-r5.ebuild: - Stable on x86/amd64 - -*selinux-base-policy-2.20110726-r6 (15 Nov 2011) - - 15 Nov 2011; Sven Vermeulen +selinux-base-policy-2.20110726-r6.ebuild: - Fixing #389579, #389917, #388875 and #389569. Also improves support for - gcc-config and updates VDE patch with upstream feedback - - 12 Nov 2011; Sven Vermeulen -selinux-base-policy-2.20090730.ebuild, - -selinux-base-policy-2.20090814.ebuild, - -selinux-base-policy-2.20091215.ebuild, - -selinux-base-policy-2.20101213-r16.ebuild, - -selinux-base-policy-2.20101213-r17.ebuild, - -selinux-base-policy-2.20101213-r18.ebuild, - -selinux-base-policy-2.20101213-r20.ebuild, - -selinux-base-policy-2.20101213-r21.ebuild, - -selinux-base-policy-2.20101213-r22.ebuild, - -selinux-base-policy-2.20110726-r3.ebuild, - -files/modules.conf.strict.20090730, -files/modules.conf.targeted.20090730: - Removing old policies - - 23 Oct 2011; Sven Vermeulen selinux-base-policy-2.20110726-r4.ebuild: - Stabilization (tracker #384231) - -*selinux-base-policy-2.20110726-r5 (23 Oct 2011) - - 23 Oct 2011; Sven Vermeulen +selinux-base-policy-2.20110726-r5.ebuild: - Update patches with XDG support, clean up patches with upstream feedback, - include asterisk fix - -*selinux-base-policy-2.20110726-r4 (17 Sep 2011) - - 17 Sep 2011; Sven Vermeulen +selinux-base-policy-2.20110726-r4.ebuild: - Update on portage and portage_fetch domains, fix puppet issues, normalize - patches with refpolicy - -*selinux-base-policy-2.20110726-r3 (28 Aug 2011) - - 28 Aug 2011; Sven Vermeulen +selinux-base-policy-2.20110726-r3.ebuild: - Introduce policy based on refpolicy 20110726 - -*selinux-base-policy-2.20101213-r22 (07 Aug 2011) - - 07 Aug 2011; Anthony G. Basile - +selinux-base-policy-2.20101213-r22.ebuild: - Fix patchbundle issue with portage patch - -*selinux-base-policy-2.20101213-r21 (25 Jul 2011) -*selinux-base-policy-2.20101213-r20 (25 Jul 2011) - - 25 Jul 2011; Anthony G. Basile - +selinux-base-policy-2.20101213-r20.ebuild, - +selinux-base-policy-2.20101213-r21.ebuild, +files/modules.conf, - files/config: - Support unattended use of portage/emerge-webrsync, add layman in its own - domain, fix a firefox context mismatch, allow cron to call portage, mark - semanage as being an eselect wrapper too (fixes /etc/selinux labeling - mismatches). Bugs fixed: #376005, #375835 (workaround) - - 11 Jul 2011; Anthony G. Basile - -files/selinux-base-policy-20070329.diff, - -selinux-base-policy-20080525.ebuild, - -selinux-base-policy-20080525-r1.ebuild, -files/modules.conf.strict, - -files/modules.conf.strict.20070928, -files/modules.conf.strict.20080525, - -files/modules.conf.targeted, -files/modules.conf.targeted.20070928, - -files/modules.conf.targeted.20080525: - Removed all pre 2.20xx base policies - -*selinux-base-policy-2.20101213-r18 (10 Jul 2011) - - 10 Jul 2011; Anthony G. Basile - +selinux-base-policy-2.20101213-r18.ebuild: - Bump to r18, improve support for openrc, allow portage to work with - NFS-mounted locations, fix firefox plugin support, fix postgres init - script support, fix syslog startup issue - - 03 Jul 2011; Anthony G. Basile - selinux-base-policy-2.20101213-r16.ebuild, - selinux-base-policy-2.20101213-r17.ebuild, - -files/patchbundle-selinux-base-policy-2.20101213-r16.tar.bz2, - -files/patchbundle-selinux-base-policy-2.20101213-r17.tar.bz2: - Moved patchbundles out of ${FILESDIR}, bug #370927 - - 30 Jun 2011; Anthony G. Basile - -selinux-base-policy-2.20101213-r11.ebuild, - -selinux-base-policy-2.20101213-r12.ebuild, - -files/patchbundle-selinux-base-policy-2.20101213-r11.tar.bz2, - -files/patchbundle-selinux-base-policy-2.20101213-r12.tar.bz2: - Removed deprecated versions - -*selinux-base-policy-2.20101213-r17 (30 Jun 2011) - - 30 Jun 2011; Anthony G. Basile - +selinux-base-policy-2.20101213-r17.ebuild, - +files/patchbundle-selinux-base-policy-2.20101213-r17.tar.bz2: - Add support for zabbix - - 02 Jun 2011; Anthony G. Basile - selinux-base-policy-2.20101213-r16.ebuild: - Stable amd64 x86 - - 20 May 2011; Anthony G. Basile - -selinux-base-policy-2.20101213-r5.ebuild, - -selinux-base-policy-2.20101213-r6.ebuild, - -selinux-base-policy-2.20101213-r7.ebuild, - -selinux-base-policy-2.20101213-r9.ebuild, - -selinux-base-policy-2.20101213-r10.ebuild, - -files/patchbundle-selinux-base-policy-2.20101213-r10.tar.bz2, - -files/patchbundle-selinux-base-policy-2.20101213-r5.tar.bz2, - -files/patchbundle-selinux-base-policy-2.20101213-r6.tar.bz2, - -files/patchbundle-selinux-base-policy-2.20101213-r7.tar.bz2, - -files/patchbundle-selinux-base-policy-2.20101213-r9.tar.bz2: - Removed deprecated revisions of base policy 2.20101213 - -*selinux-base-policy-2.20101213-r16 (20 May 2011) - - 20 May 2011; Anthony G. Basile - +selinux-base-policy-2.20101213-r16.ebuild, - +files/patchbundle-selinux-base-policy-2.20101213-r16.tar.bz2, metadata.xml: - Drop obsoleted policy builds, add openrc support (rc-update, rc-status), - correct file contexts for /lib64, make UBAC optional (#257111 and #306393), - use portage_srcrepo_t for live ebuilds and match mdadm policy with upstream - -*selinux-base-policy-2.20101213-r12 (16 Apr 2011) -*selinux-base-policy-2.20101213-r11 (16 Apr 2011) - - 16 Apr 2011; Anthony G. Basile - +selinux-base-policy-2.20101213-r11.ebuild, - +selinux-base-policy-2.20101213-r12.ebuild, - +files/patchbundle-selinux-base-policy-2.20101213-r11.tar.bz2, - +files/patchbundle-selinux-base-policy-2.20101213-r12.tar.bz2: - Added new patchbundles for rev bumps to base policy 2.20101213 - -*selinux-base-policy-2.20101213-r10 (07 Mar 2011) -*selinux-base-policy-2.20101213-r9 (07 Mar 2011) - - 07 Mar 2011; Anthony G. Basile - +selinux-base-policy-2.20101213-r9.ebuild, - +selinux-base-policy-2.20101213-r10.ebuild, - +files/patchbundle-selinux-base-policy-2.20101213-r10.tar.bz2, - +files/patchbundle-selinux-base-policy-2.20101213-r9.tar.bz2: - Added new patchbundles for rev bumps to base policy 2.20101213 - - 05 Feb 2011; Anthony G. Basile - +files/patchbundle-selinux-base-policy-2.20101213-r5.tar.bz2, - +files/patchbundle-selinux-base-policy-2.20101213-r6.tar.bz2, - +files/patchbundle-selinux-base-policy-2.20101213-r7.tar.bz2: - Added patchbundle for base policy 2.20101213. - -*selinux-base-policy-2.20101213-r7 (05 Feb 2011) -*selinux-base-policy-2.20101213-r6 (05 Feb 2011) -*selinux-base-policy-2.20101213-r5 (05 Feb 2011) - - 05 Feb 2011; Anthony G. Basile - +selinux-base-policy-2.20101213-r5.ebuild, - +selinux-base-policy-2.20101213-r6.ebuild, - +selinux-base-policy-2.20101213-r7.ebuild: - New upstream policy. - -*selinux-base-policy-2.20091215 (16 Dec 2009) - - 16 Dec 2009; Chris PeBenito - +selinux-base-policy-2.20091215.ebuild: - New upstream release. - -*selinux-base-policy-20080525-r1 (14 Sep 2009) - - 14 Sep 2009; Chris PeBenito - +selinux-base-policy-20080525-r1.ebuild: - Update old base policy to support ext4. - - 14 Aug 2009; Chris PeBenito - -selinux-base-policy-20070329.ebuild, - -selinux-base-policy-20070928.ebuild, selinux-base-policy-20080525.ebuild: - Mark 20080525 stable, clear old ebuilds. - -*selinux-base-policy-2.20090814 (14 Aug 2009) - - 14 Aug 2009; Chris PeBenito - +selinux-base-policy-2.20090814.ebuild: - Git version of refpolicy for misc fixes including some cron problems. - -*selinux-base-policy-2.20090730 (03 Aug 2009) - - 03 Aug 2009; Chris PeBenito - +selinux-base-policy-2.20090730.ebuild: - New upstream release. - - 18 Jul 2009; Chris PeBenito - selinux-base-policy-20070329.ebuild, selinux-base-policy-20070928.ebuild, - selinux-base-policy-20080525.ebuild: - Drop alpha, mips, ppc, sparc selinux support. - -*selinux-base-policy-20080525 (25 May 2008) - - 25 May 2008; Chris PeBenito - +selinux-base-policy-20080525.ebuild: - New SVN snapshot. - - 16 Mar 2008; Chris PeBenito - -selinux-base-policy-20051022-r1.ebuild, - -selinux-base-policy-20061114.ebuild: - Remove old ebuilds. - - 03 Feb 2008; Chris PeBenito - selinux-base-policy-20070928.ebuild: - Mark stable. - -*selinux-base-policy-20070928 (26 Nov 2007) - - 26 Nov 2007; Chris PeBenito - +selinux-base-policy-20070928.ebuild: - New SVN snapshot. - - 04 Jun 2007; Chris PeBenito - selinux-base-policy-20070329.ebuild: - Mark stable. - - 30 Mar 2007; Chris PeBenito - +files/selinux-base-policy-20070329.diff, - selinux-base-policy-20070329.ebuild: - Compile fix. - -*selinux-base-policy-20070329 (29 Mar 2007) - - 29 Mar 2007; Chris PeBenito - +selinux-base-policy-20070329.ebuild: - New SVN snapshot. - - 22 Feb 2007; Markus Ullmann ChangeLog: - Redigest for Manifest2 - -*selinux-base-policy-20061114 (15 Nov 2006) - - 15 Nov 2006; Chris PeBenito - +selinux-base-policy-20061114.ebuild: - New SVN snapshot. - - 25 Oct 2006; Chris PeBenito - selinux-base-policy-20061015.ebuild: - Fix to have default POLICY_TYPES if it is empty. - - 21 Oct 2006; Chris PeBenito - selinux-base-policy-20061015.ebuild: - Fix xml generation failure to die. - -*selinux-base-policy-20061015 (15 Oct 2006) - - 15 Oct 2006; Chris PeBenito - -selinux-base-policy-20061008.ebuild, - +selinux-base-policy-20061015.ebuild: - Update for testing fixes. - -*selinux-base-policy-20061008 (08 Oct 2006) - - 08 Oct 2006; Chris PeBenito -files/semanage.conf, - +selinux-base-policy-20061008.ebuild, - -selinux-base-policy-99999999.ebuild: - First mainstream reference policy testing release. - - 29 Sep 2006; Chris PeBenito - selinux-base-policy-99999999.ebuild: - Fix for new SVN location. Fixes 147781. - - 22 Feb 2006; Stephen Bennett - selinux-base-policy-20051022-r1.ebuild: - Alpha stable - -*selinux-base-policy-99999999 (02 Feb 2006) - - 02 Feb 2006; Chris PeBenito +files/config, - +files/modules.conf.strict, +files/modules.conf.targeted, - +files/semanage.conf, +selinux-base-policy-99999999.ebuild: - Add experimental policy for testing reference policy. Requires portage fix - from bug #110857. - - 02 Feb 2006; Chris PeBenito - -selinux-base-policy-20050322.ebuild, - -selinux-base-policy-20050618.ebuild, - -selinux-base-policy-20050821.ebuild, - -selinux-base-policy-20051022.ebuild: - Clean out old ebuilds. - - 14 Jan 2006; Stephen Bennett - selinux-base-policy-20051022-r1.ebuild: - Added ~alpha - -*selinux-base-policy-20051022-r1 (08 Dec 2005) - - 08 Dec 2005; Chris PeBenito - +selinux-base-policy-20051022-r1.ebuild: - Change to use compatability genhomedircon. Newer policycoreutils (1.28) - breaks the backwards compatability this policy uses. - -*selinux-base-policy-20051022 (22 Oct 2005) - - 22 Oct 2005; Chris PeBenito - +selinux-base-policy-20051022.ebuild: - Very trivial fixes. - - 08 Sep 2005; Chris PeBenito - selinux-base-policy-20050821.ebuild: - Mark stable. - -*selinux-base-policy-20050821 (21 Aug 2005) - - 21 Aug 2005; Chris PeBenito - +selinux-base-policy-20050821.ebuild: - Minor updates for 2.6.12. - - 21 Jun 2005; Chris PeBenito - selinux-base-policy-20050618.ebuild: - Mark stable. - -*selinux-base-policy-20050618 (18 Jun 2005) - - 18 Jun 2005; Chris PeBenito - -selinux-base-policy-20041123.ebuild, - -selinux-base-policy-20050306.ebuild, - +selinux-base-policy-20050618.ebuild: - New release to support 2.6.12 features. - - 10 May 2005; Stephen Bennett - selinux-base-policy-20050322.ebuild: - mips stable - - 01 May 2005; Stephen Bennett - selinux-base-policy-20050322.ebuild: - Added ~mips. - -*selinux-base-policy-20050322 (23 Mar 2005) - - 23 Mar 2005; Chris PeBenito - +selinux-base-policy-20050322.ebuild: - New release. - -*selinux-base-policy-20050306 (06 Mar 2005) - - 06 Mar 2005; Chris PeBenito - +selinux-base-policy-20050306.ebuild: - Fix bad samba_domain dummy macro. Add policies needed for udev support. - -*selinux-base-policy-20050224 (24 Feb 2005) - - 24 Feb 2005; Chris PeBenito - +selinux-base-policy-20050224.ebuild: - New release. - - 19 Jan 2005; Chris PeBenito - selinux-base-policy-20041123.ebuild: - Mark stable. - -*selinux-base-policy-20041123 (23 Nov 2004) - - 23 Nov 2004; Chris PeBenito - +selinux-base-policy-20041123.ebuild: - New release with 1.18 merge. - -*selinux-base-policy-20041023 (23 Oct 2004) - - 23 Oct 2004; Chris PeBenito - +selinux-base-policy-20041023.ebuild: - New release with 1.16 merge. Tcpd and inetd have been deprecated since they - are not in the base system anymore, and probably no one uses them anyway. - -*selinux-base-policy-20040906 (06 Sep 2004) - - 06 Sep 2004; Chris PeBenito - +selinux-base-policy-20040906.ebuild: - New release with 1.14 merge, which has policy 18 (fine-grained netlink) - features. - - 05 Sep 2004; Chris PeBenito - selinux-base-policy-20040225.ebuild, -selinux-base-policy-20040509.ebuild, - -selinux-base-policy-20040604.ebuild, selinux-base-policy-20040629.ebuild, - selinux-base-policy-20040702.ebuild: - Remove old builds, switch to epause and ebeep in remaining builds. - -*selinux-base-policy-20040702 (02 Jul 2004) - - 02 Jul 2004; Chris PeBenito - +selinux-base-policy-20040702.ebuild: - Same as 20040629, except with updated flask headers, which will come out in - 2.6.8. - -*selinux-base-policy-20040629 (29 Jun 2004) - - 29 Jun 2004; Chris PeBenito - +selinux-base-policy-20040629.ebuild: - Large sysadmfile cleanup: disable admin_separation to give sysadm_r back its - ablility to modify all files. Minor fixes: portage_r works again, syslog-ng - breakage fixed, put back manual PaX policy for pageexec/segmexec. - - 16 Jun 2004; Chris PeBenito - selinux-base-policy-20040604.ebuild: - Mark stable. - - 10 Jun 2004; Chris PeBenito - selinux-base-policy-20040225.ebuild, selinux-base-policy-20040509.ebuild, - selinux-base-policy-20040604.ebuild: - Add src_compile() stub - -*selinux-base-policy-20040604 (04 Jun 2004) - - 04 Jun 2004; Chris PeBenito - +selinux-base-policy-20040604.ebuild: - New release including 1.12 NSA policy, and experimental sesandbox. - - 15 May 2004; Chris PeBenito - selinux-base-policy-20040509.ebuild: - Mark stable. - -*selinux-base-policy-20040509 (09 May 2004) - - 09 May 2004; Chris PeBenito - +selinux-base-policy-20040509.ebuild: - A few small cleanups. Make PaX non exec pages macro based on arch. Large - portage update, get rid of portage_exec_fetch_t, portage will setexec. Add - global_ssp tunable. - -*selinux-base-policy-20040418 (18 Apr 2004) - - 18 Apr 2004; Chris PeBenito - +selinux-base-policy-20040418.ebuild: - New release for checkpolicy 1.10 - -*selinux-base-policy-20040414 (14 Apr 2004) - - 14 Apr 2004; Chris PeBenito - -selinux-base-policy-20040408.ebuild, +selinux-base-policy-20040414.ebuild: - Minor updates - -*selinux-base-policy-20040408 (08 Apr 2004) - - 08 Apr 2004; Chris PeBenito - selinux-base-policy-20040408.ebuild: - New update. Users.fc is now deprecated, as the contexts for user directories - is now automatically generated. Portage fetching of distfiles now has a - subdomain, for dropping priviledges. - - 28 Feb 2004; Chris PeBenito - selinux-base-policy-20040225.ebuild: - Mark stable. - -*selinux-base-policy-20040225 (25 Feb 2004) - - 25 Feb 2004; Chris PeBenito - selinux-base-policy-20040225.ebuild: - New support for PaX ACL hooks. Addition of tunable.te for configurable policy - options. Rewrite of portage.te. Now auto-transition for sysadm is default, can - reenable portage_r by tunable.te. Makefile update from NSA CVS. - -*selinux-base-policy-20040209 (09 Feb 2004) - - 09 Feb 2004; Chris PeBenito - selinux-base-policy-20040209.ebuild: - Minor revision to add XFS labeling and policy for integrated - runscript-run_init. - - 07 Feb 2004; Chris PeBenito - selinux-base-policy-20040202.ebuild: - Mark x86 stable. - -*selinux-base-policy-20040202 (02 Feb 2004) - - 02 Feb 2004; Chris PeBenito - selinux-base-policy-20040202.ebuild: - A few misc fixes. Allow portage to update bootloader code, such as in lilo or - grub postinst. This requires checkpolicy 1.4-r1. - -*selinux-base-policy-20031225 (25 Dec 2003) - - 25 Dec 2003; Chris PeBenito - selinux-base-policy-20031225.ebuild: - New release, with merged NSA 1.4 policy. One critical note, this policy - requires pam 0.77. Much work has been done to minimize access to /etc/shadow, - and one requirement is in the patch for pam 0.77. If you do not use this pam - version or newer, you will be unable to authenticate in enforcing. Since - devfs no longer is usable in SELinux, it's policy has been removed. You - should merge the changes, remove the devfsd policy (devfsd.te and devfsd.fc), - load the policy, and relabel. - - 27 Nov 2003; Chris PeBenito - selinux-base-policy-20031010-r1.ebuild: - Mark stable. Add build USE flag for stage building. - -*selinux-base-policy-20031010-r1 (12 Nov 2003) - - 12 Nov 2003; Chris PeBenito - selinux-base-policy-20031010-r1.ebuild, - files/selinux-base-policy-20031010-cvs.diff: - Add fixes from policy cvs for compilers, so non x86 and ppc compilers can - work. Also portage update as a side effect of updated setfiles code in - portage, from bug 31748. - - 28 Oct 2003; Chris PeBenito - selinux-base-policy-20031010.ebuild: - Mark stable - -*selinux-base-policy-20031010 (10 Oct 2003) - - 10 Oct 2003; Chris PeBenito - selinux-base-policy-20031010.ebuild: - New release for new API. Massive cleanups all over the place. - -*selinux-base-policy-20030817 (17 Aug 2003) - - 17 Aug 2003; Chris PeBenito - selinux-base-policy-20030817.ebuild: - Initial commit of new API policy - - 10 Aug 2003; Chris PeBenito - selinux-base-policy-20030729-r1.ebuild: - Mark stable - -*selinux-base-policy-20030729-r1 (31 Jul 2003) - - 31 Jul 2003; Chris PeBenito - selinux-base-policy-20030729-r1.ebuild: - New rev that handles an empty POLICYDIR sanely. - -*selinux-base-policy-20030729 (29 Jul 2003) - - 29 Jul 2003; Chris PeBenito - selinux-base-policy-20030729.ebuild: - Make the ebuild use POLICYDIR. Important fix so portage can load policy so - selinux-policy.eclass works. update_modules_t cleanup. Fix for an access when - merging baselayout. - -*selinux-base-policy-20030720 (20 Jul 2003) - - 20 Jul 2003; Chris PeBenito - selinux-base-policy-20030720.ebuild: - Many fixes, including the syslog fix. File contexts have changed, so a relabel - is needed. You may encounter problems relabeling /usr/portage, as its file - context has changed, as files should not have the same type as a domain. - Relabelling in permissive will fix this, or temporarily give portage_t a - file_type attribute. Tightened the can_exec_any() macro. Moved staff.fc to - users.fc, since all users with SELinux identities should have their home - directories have the correct identity, not the generic identity. - - 06 Jun 2003; Chris PeBenito - selinux-base-policy-20030604.ebuild: - Mark stable - -*selinux-base-policy-20030604 (04 Jun 2003) - - 04 Jun 2003; Chris PeBenito - selinux-base-policy-20030604.ebuild: - Fix broken 20030603 - - 04 Jun 2003; Chris PeBenito - selinux-base-policy-20030603.ebuild: - Pulling 20030603, as there are problems, 20030604 later today - -*selinux-base-policy-20030603 (03 Jun 2003) - - 03 Jun 2003; Chris PeBenito - selinux-base-policy-20030603.ebuild: - Numerous various fixes. Added staff role. Removed ipsec, gpm and gpg policies - as they are not appropriate for the base policy, and untested. - -*selinux-base-policy-20030522 (22 May 2003) - - 22 May 2003; Chris PeBenito - selinux-base-policy-20030522.ebuild: - The policy is in pretty good shape now. I've been able to run in enforcing mode - with little problem. I've also been able to successfully merge and unmerge - packages in enforcing mode, with few exceptions (why does mysql need to run ps - during configure?). - -*selinux-base-policy-20030514 (14 May 2003) - - 14 May 2003; Chris PeBenito - selinux-base-policy-20030514.ebuild: - Many improvements in many areas. Of note, rlogind policies were removed. Klogd - is being merged into syslogd. The portage policy is much more complete, but - still needs work. Its suggested that all changes be merged in, policy - reloaded, then relabel. - -*selinux-base-policy-20030419 (19 Apr 2003) - - 23 Apr 2003; Chris PeBenito - selinux-base-policy-20030419.ebuild: - Marking stable for selinux-small stable usage - - 19 Apr 2003; Chris PeBenito Manifest, - selinux-base-policy-20030419.ebuild: - Initial commit. Base policies for SELinux, with Gentoo-specifics diff --git a/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/Manifest b/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/Manifest index 8c79c9abb3..531f9303e2 100644 --- a/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/Manifest +++ b/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/Manifest @@ -1,2 +1,4 @@ -DIST patchbundle-selinux-base-policy-2.20141203-r9.tar.bz2 299602 SHA256 e8518004942a6c57170a609683e22b1410c93a2a195829c41dc8fbc703d941b5 SHA512 ce6484fbca1d2d074e50d1a3953392bd3ce0a4617df98fbac37747b469b4f160a9331586dfe1c3ddccb1ccbee24876a2f05ab49e37c8492a48baf83c2d01d140 WHIRLPOOL 1fd7b956e98e95a64c3a713a944d4531259bd156a7feabf6a89c4b5f33ac846377730eede97889e85183be086f282ebd18e860214f6ca3f01b40f2323470ee04 -DIST refpolicy-2.20141203.tar.bz2 680243 SHA256 f438209c430d8a2d4ddcbe4bdd3edb46f6af7dc4913637af0b73c635e40c1522 SHA512 682e4280c5799e4c12ec7594afc1389f67be35055748d2e0dbdc3419159a16c96d4946ca6178daee8370515951f8653b2e452efe8c962b8d7f9bc192f0b15a0c WHIRLPOOL 74bca232534e7af9051bb1ab9f77c1ff6c425781cf4561f781d6e9a40cc5ca0d9add540249ea5493e8782a9372aea296ead6c165c6c440ae1509eb319d151ee5 +DIST patchbundle-selinux-base-policy-2.20200818-r2.tar.bz2 433623 BLAKE2B f0655c45c50347faf1217e5861298dce822e4b726c0b4489d4c70c4815842f7c17ac1b0a302ae5482a3ad25d1d5b6c4c3b6395194e79005f31560d103ad0fce6 SHA512 9fd22683ecd602a429b2d489f7b8c2936409fa060046255b72a4b95c9fdefa2455ba7655945278dc972c22f3ade6617898ed169e22001aaaaded4b47ca51b0c3 +DIST patchbundle-selinux-base-policy-2.20210203-r1.tar.bz2 298116 BLAKE2B 50c5523a8b758652af6aa59d548e9499b899898b58f52f74f1667a0c552f2b2d0ed5a44352e59245c7f0ebd199e2391400168d6ab27b4160d726fccded0c56f2 SHA512 ddb877ec3e2883f57e54e7380dd449d4d89a0769a1fb87141786e5de741ac21b2ead60362fd17c25888eb1334c68f71da561f4f29f406f0d4b5d13d378f6baff +DIST refpolicy-2.20200818.tar.bz2 570896 BLAKE2B 502c00fec39e1b81e42de3f7f942623f8b3fbdeac19f9f01126722a368b7d4f70427d6e4a574754c4f2fa551e4bc75c912dbc515c004f0dcd5eb28ab416498f6 SHA512 e4b527bb7a87b9359fc42eb111d5008103f57c37128998ea0e21ec7b0b8607ffe3f67697450e4c51a0db172ece69083335b279bacef4b1bd0b7748b58caa99a7 +DIST refpolicy-2.20210203.tar.bz2 564099 BLAKE2B a94a11ebb78890ba2c98714be2fe9054fdb8ccaf5154f47b881a9575a4a6865e8df475805550d7bba8039b4230c6a0c9f5c6130bf8c35a26bc7c473d550fb40d SHA512 a6ffe718626dd6121023b4cbc424c933d44ca8b662bd708baad307cf6284be0d80fef40cdc8b37f6f17ecb3636fd8d6c1d5d4072c17d835b7f500e17a3acd9fc diff --git a/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/files/config b/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/files/config deleted file mode 100644 index 55933ea0e5..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/files/config +++ /dev/null @@ -1,15 +0,0 @@ -# This file controls the state of SELinux on the system on boot. - -# SELINUX can take one of these three values: -# enforcing - SELinux security policy is enforced. -# permissive - SELinux prints warnings instead of enforcing. -# disabled - No SELinux policy is loaded. -SELINUX=permissive - -# SELINUXTYPE can take one of these four values: -# targeted - Only targeted network daemons are protected. -# strict - Full SELinux protection. -# mls - Full SELinux protection with Multi-Level Security -# mcs - Full SELinux protection with Multi-Category Security -# (mls, but only one sensitivity level) -SELINUXTYPE=strict diff --git a/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/files/modules.conf b/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/files/modules.conf deleted file mode 100644 index 47535f6b38..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/files/modules.conf +++ /dev/null @@ -1,50 +0,0 @@ -application = base -authlogin = base -bootloader = base -clock = base -consoletype = base -corecommands = base -corenetwork = base -cron = base -devices = base -dmesg = base -domain = base -files = base -filesystem = base -fstools = base -getty = base -hostname = base -hotplug = base -init = base -iptables = base -kernel = base -libraries = base -locallogin = base -logging = base -lvm = base -miscfiles = base -mcs = base -mls = base -modutils = base -mount = base -mta = base -netutils = base -nscd = base -portage = base -raid = base -rsync = base -selinux = base -selinuxutil = base -ssh = base -staff = base -storage = base -su = base -sysadm = base -sysnetwork = base -terminal = base -ubac = base -udev = base -userdomain = base -usermanage = base -unprivuser = base -xdg = base diff --git a/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/metadata.xml b/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/metadata.xml index 4adcb401b0..46dc07f542 100644 --- a/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/metadata.xml +++ b/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/metadata.xml @@ -1,12 +1,15 @@ - selinux + + selinux@gentoo.org + SELinux Team + Gentoo SELinux base policy. This contains policy for a system at the end of system installation. There is no extra policy in this package. - Enable support for the unconfined SELinux policy module + Enable support for the unconfined SELinux policy module diff --git a/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/selinux-base-policy-2.20141203-r14.ebuild b/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/selinux-base-policy-2.20141203-r14.ebuild deleted file mode 100644 index 0d1dab10a2..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/selinux-base-policy-2.20141203-r14.ebuild +++ /dev/null @@ -1,117 +0,0 @@ -# Copyright 1999-2015 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-base-policy/selinux-base-policy-2.20141203-r5.ebuild,v 1.3 2015/06/05 16:10:32 perfinion Exp $ -EAPI="5" - -inherit eutils - -if [[ ${PV} == 9999* ]]; then - EGIT_REPO_URI="${SELINUX_GIT_REPO:-git://anongit.gentoo.org/proj/hardened-refpolicy.git https://anongit.gentoo.org/git/proj/hardened-refpolicy.git}" - EGIT_BRANCH="${SELINUX_GIT_BRANCH:-master}" - EGIT_SOURCEDIR="${WORKDIR}/refpolicy" - - inherit git-2 - - KEYWORDS="" -else - SRC_URI="https://raw.githubusercontent.com/wiki/TresysTechnology/refpolicy/files/refpolicy-${PV}.tar.bz2 - http://dev.gentoo.org/~swift/patches/${PN}/patchbundle-${PN}-2.20141203-r9.tar.bz2" - KEYWORDS="amd64 x86" -fi - -HOMEPAGE="http://www.gentoo.org/proj/en/hardened/selinux/" -DESCRIPTION="SELinux policy for core modules" - -IUSE="+unconfined" - -RDEPEND="=sec-policy/selinux-base-${PVR}" -PDEPEND="unconfined? ( sec-policy/selinux-unconfined )" -DEPEND="" - -MODS="application authlogin bootloader clock consoletype cron dmesg fstools getty hostname hotplug init iptables libraries locallogin logging lvm miscfiles modutils mount mta netutils nscd portage raid rsync selinuxutil setrans ssh staff storage su sysadm sysnetwork tmpfiles udev userdomain usermanage unprivuser xdg" -LICENSE="GPL-2" -SLOT="0" -S="${WORKDIR}/" - -# Code entirely copied from selinux-eclass (cannot inherit due to dependency on -# itself), when reworked reinclude it. Only postinstall (where -b base.pp is -# added) needs to remain then. - -pkg_pretend() { - for i in ${POLICY_TYPES}; do - if [[ "${i}" == "targeted" ]] && ! use unconfined; then - die "If you use POLICY_TYPES=targeted, then USE=unconfined is mandatory." - fi - done -} - -src_prepare() { - local modfiles - - if [[ ${PV} != 9999* ]]; then - # Patch the source with the base patchbundle - cd "${S}" - EPATCH_MULTI_MSG="Applying SELinux policy updates ... " \ - EPATCH_SUFFIX="patch" \ - EPATCH_SOURCE="${WORKDIR}" \ - EPATCH_FORCE="yes" \ - epatch - fi - - # Apply the additional patches refered to by the module ebuild. - # But first some magic to differentiate between bash arrays and strings - if [[ "$(declare -p POLICY_PATCH 2>/dev/null 2>&1)" == "declare -a"* ]]; - then - cd "${S}/refpolicy/policy/modules" - for POLPATCH in "${POLICY_PATCH[@]}"; - do - epatch "${POLPATCH}" - done - else - if [[ -n ${POLICY_PATCH} ]]; - then - cd "${S}/refpolicy/policy/modules" - for POLPATCH in ${POLICY_PATCH}; - do - epatch "${POLPATCH}" - done - fi - fi - - # Calling user patches - epatch_user - - # Collect only those files needed for this particular module - for i in ${MODS}; do - modfiles="$(find ${S}/refpolicy/policy/modules -iname $i.te) $modfiles" - modfiles="$(find ${S}/refpolicy/policy/modules -iname $i.fc) $modfiles" - done - - for i in ${POLICY_TYPES}; do - mkdir "${S}"/${i} || die "Failed to create directory ${S}/${i}" - cp "${S}"/refpolicy/doc/Makefile.example "${S}"/${i}/Makefile \ - || die "Failed to copy Makefile.example to ${S}/${i}/Makefile" - - cp ${modfiles} "${S}"/${i} \ - || die "Failed to copy the module files to ${S}/${i}" - done -} - -src_compile() { - for i in ${POLICY_TYPES}; do - emake BINDIR="${ROOT}/usr/bin" SHAREDIR="${ROOT}/usr/share/selinux" NAME=$i -C "${S}"/${i} || die "${i} compile failed" - done -} - -src_install() { - local BASEDIR="/usr/share/selinux" - - for i in ${POLICY_TYPES}; do - for j in ${MODS}; do - einfo "Installing ${i} ${j} policy package" - insinto ${BASEDIR}/${i} - doins "${S}"/${i}/${j}.pp || die "Failed to add ${j}.pp to ${i}" - done - done -} - diff --git a/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/selinux-base-policy-2.20200818-r2.ebuild b/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/selinux-base-policy-2.20200818-r2.ebuild new file mode 100644 index 0000000000..f7f0f25733 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/selinux-base-policy-2.20200818-r2.ebuild @@ -0,0 +1,129 @@ +# Copyright 1999-2021 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI="7" + +if [[ ${PV} == 9999* ]]; then + EGIT_REPO_URI="${SELINUX_GIT_REPO:-https://anongit.gentoo.org/git/proj/hardened-refpolicy.git}" + EGIT_BRANCH="${SELINUX_GIT_BRANCH:-master}" + EGIT_CHECKOUT_DIR="${WORKDIR}/refpolicy" + + inherit git-r3 +else + SRC_URI="https://github.com/SELinuxProject/refpolicy/releases/download/RELEASE_${PV/./_}/refpolicy-${PV}.tar.bz2 + https://dev.gentoo.org/~perfinion/patches/${PN}/patchbundle-${PN}-${PVR}.tar.bz2" + KEYWORDS="amd64 -arm ~arm64 ~mips x86" +fi + +HOMEPAGE="https://wiki.gentoo.org/wiki/Project:SELinux" +DESCRIPTION="SELinux policy for core modules" + +IUSE="systemd +unconfined" + +PDEPEND="unconfined? ( sec-policy/selinux-unconfined )" +DEPEND="=sec-policy/selinux-base-${PVR}[systemd?]" +RDEPEND="${DEPEND}" +BDEPEND=" + sys-apps/checkpolicy + sys-devel/m4" + +MODS="application authlogin bootloader clock consoletype cron dmesg fstools getty hostname hotplug init iptables libraries locallogin logging lvm miscfiles modutils mount mta netutils nscd portage raid rsync selinuxutil setrans ssh staff storage su sysadm sysnetwork systemd tmpfiles udev userdomain usermanage unprivuser xdg" +LICENSE="GPL-2" +SLOT="0" +S="${WORKDIR}/" + +# Code entirely copied from selinux-eclass (cannot inherit due to dependency on +# itself), when reworked reinclude it. Only postinstall (where -b base.pp is +# added) needs to remain then. + +pkg_pretend() { + for i in ${POLICY_TYPES}; do + if [[ "${i}" == "targeted" ]] && ! use unconfined; then + die "If you use POLICY_TYPES=targeted, then USE=unconfined is mandatory." + fi + done +} + +src_prepare() { + local modfiles + + if [[ ${PV} != 9999* ]]; then + einfo "Applying SELinux policy updates ... " + eapply -p0 "${WORKDIR}/0001-full-patch-against-stable-release.patch" + fi + + eapply_user + + # Collect only those files needed for this particular module + for i in ${MODS}; do + modfiles="$(find ${S}/refpolicy/policy/modules -iname $i.te) $modfiles" + modfiles="$(find ${S}/refpolicy/policy/modules -iname $i.fc) $modfiles" + done + + for i in ${POLICY_TYPES}; do + mkdir "${S}"/${i} || die "Failed to create directory ${S}/${i}" + cp "${S}"/refpolicy/doc/Makefile.example "${S}"/${i}/Makefile \ + || die "Failed to copy Makefile.example to ${S}/${i}/Makefile" + + cp ${modfiles} "${S}"/${i} \ + || die "Failed to copy the module files to ${S}/${i}" + done +} + +src_compile() { + for i in ${POLICY_TYPES}; do + emake NAME=$i SHAREDIR="${ROOT}"/usr/share/selinux -C "${S}"/${i} + done +} + +src_install() { + local BASEDIR="/usr/share/selinux" + + for i in ${POLICY_TYPES}; do + for j in ${MODS}; do + einfo "Installing ${i} ${j} policy package" + insinto ${BASEDIR}/${i} + doins "${S}"/${i}/${j}.pp + done + done +} + +pkg_postinst() { + # Set root path and don't load policy into the kernel when cross compiling + local root_opts="" + if [[ "${ROOT}" != "" ]]; then + root_opts="-p ${ROOT} -n" + fi + + # Override the command from the eclass, we need to load in base as well here + local COMMAND="-i base.pp" + if has_version "/dev/null 2>&1)" == "declare -a"* ]]; - then - cd "${S}/refpolicy/policy/modules" - for POLPATCH in "${POLICY_PATCH[@]}"; - do - epatch "${POLPATCH}" - done - else - if [[ -n ${POLICY_PATCH} ]]; - then - cd "${S}/refpolicy/policy/modules" - for POLPATCH in ${POLICY_PATCH}; - do - epatch "${POLPATCH}" - done - fi - fi - - # Calling user patches - epatch_user + eapply_user # Collect only those files needed for this particular module for i in ${MODS}; do @@ -99,7 +72,7 @@ src_prepare() { src_compile() { for i in ${POLICY_TYPES}; do - emake NAME=$i -C "${S}"/${i} || die "${i} compile failed" + emake NAME=$i SHAREDIR="${ROOT}"/usr/share/selinux -C "${S}"/${i} done } @@ -110,34 +83,47 @@ src_install() { for j in ${MODS}; do einfo "Installing ${i} ${j} policy package" insinto ${BASEDIR}/${i} - doins "${S}"/${i}/${j}.pp || die "Failed to add ${j}.pp to ${i}" + doins "${S}"/${i}/${j}.pp done done } pkg_postinst() { + # Set root path and don't load policy into the kernel when cross compiling + local root_opts="" + if [[ "${ROOT}" != "" ]]; then + root_opts="-p ${ROOT} -n" + fi + # Override the command from the eclass, we need to load in base as well here - local COMMAND + local COMMAND="-i base.pp" + if has_version "