Try new patches

libsepol-rhat.patch

@@ -1,20 +1,8 @@
-diff --git a/libsepol/include/sepol/policydb/polcaps.h b/libsepol/include/sepol/policydb/polcaps.h
-index 481c0ba..f90a48d 100644
---- a/libsepol/include/sepol/policydb/polcaps.h
-+++ b/libsepol/include/sepol/policydb/polcaps.h
-@@ -6,6 +6,7 @@ enum {
- 	POLICYDB_CAPABILITY_NETPEER,
- 	POLICYDB_CAPABILITY_OPENPERM,
- 	POLICYDB_CAPABILITY_REDHAT1, /* reserved for RH testing of ptrace_child */
-+	POLICYDB_CAPABILITY_ALWAYSNETWORK,
- 	__POLICYDB_CAPABILITY_MAX
- };
- #define POLICYDB_CAPABILITY_MAX (__POLICYDB_CAPABILITY_MAX - 1)
 diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c
-index bef759c..4663321 100644
+index bef759c..2854f33 100644
 --- a/libsepol/src/expand.c
 +++ b/libsepol/src/expand.c
-@@ -49,6 +49,79 @@ typedef struct expand_state {
+@@ -49,6 +49,82 @@ typedef struct expand_state {
  	int expand_neverallow;
  } expand_state_t;
  
@@ -87,6 +75,9 @@ index bef759c..4663321 100644
 +		}
 +	}
 +
++	/* Incoherent result and end pointers indicates bug */
++	assert((result != NULL && end != NULL) || (result == NULL && end == NULL));
++
 +	*endp = end;
 +	return result;
 +}
@@ -94,7 +85,7 @@ index bef759c..4663321 100644
  static void expand_state_init(expand_state_t * state)
  {
  	memset(state, 0, sizeof(expand_state_t));
-@@ -1352,10 +1425,20 @@ static int copy_role_trans(expand_state_t * state, role_trans_rule_t * rules)
+@@ -1352,10 +1428,20 @@ static int copy_role_trans(expand_state_t * state, role_trans_rule_t * rules)
  static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *rules)
  {
  	unsigned int i, j;
@@ -116,7 +107,7 @@ index bef759c..4663321 100644
  
  	cur_rule = rules;
  	while (cur_rule) {
-@@ -1378,6 +1461,14 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
+@@ -1378,6 +1464,14 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
  
  		mapped_otype = state->typemap[cur_rule->otype - 1];
  
@@ -131,7 +122,7 @@ index bef759c..4663321 100644
  		ebitmap_for_each_bit(&stypes, snode, i) {
  			if (!ebitmap_node_get_bit(snode, i))
  				continue;
-@@ -1385,16 +1476,14 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
+@@ -1385,16 +1479,14 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
  				if (!ebitmap_node_get_bit(tnode, j))
  					continue;
  
@@ -151,7 +142,7 @@ index bef759c..4663321 100644
  						ERR(state->handle, "Conflicting filename trans rules %s %s %s : %s otype1:%s otype2:%s",
  						    cur_trans->name,
  						    state->out->p_type_val_to_name[i],
-@@ -1402,7 +1491,7 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
+@@ -1402,7 +1494,7 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
  						    state->out->p_class_val_to_name[cur_trans->tclass - 1],
  						    state->out->p_type_val_to_name[cur_trans->otype - 1],
  						    state->out->p_type_val_to_name[mapped_otype - 1]);
@@ -160,7 +151,7 @@ index bef759c..4663321 100644
  						return -1;
  					}
  					cur_trans = cur_trans->next;
-@@ -1417,8 +1506,6 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
+@@ -1417,8 +1509,6 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
  					return -1;
  				}
  				memset(new_trans, 0, sizeof(*new_trans));
@@ -169,7 +160,7 @@ index bef759c..4663321 100644
  
  				new_trans->name = strdup(cur_rule->name);
  				if (!new_trans->name) {
-@@ -1429,9 +1516,14 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
+@@ -1429,9 +1519,16 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
  				new_trans->ttype = j + 1;
  				new_trans->tclass = cur_rule->tclass;
  				new_trans->otype = mapped_otype;
@@ -178,83 +169,11 @@ index bef759c..4663321 100644
  		}
  
 +		cur_trans = linear_probe_dump(&probe, &end);
++		if (cur_trans != NULL) {
 +			end->next = state->out->filename_trans;
 +			state->out->filename_trans = cur_trans;
++		}
 +
  		ebitmap_destroy(&stypes);
  		ebitmap_destroy(&ttypes);
  
-@@ -2032,13 +2124,14 @@ static int ocontext_copy_xen(expand_state_t *state)
- 			else
- 				state->out->ocontexts[i] = n;
- 			l = n;
--			if (context_copy(&n->context[0], &c->context[0],
--				state)) {
--				ERR(state->handle, "Out of memory!");
--				return -1;
--			}
- 			switch (i) {
- 			case OCON_XEN_ISID:
-+				if (c->context[0].user == 0) {
-+					ERR(state->handle,
-+					    "Missing context for %s initial sid",
-+					    c->u.name);
-+					return -1;
-+				}
- 				n->sid[0] = c->sid[0];
- 				break;
- 			case OCON_XEN_PIRQ:
-@@ -2061,6 +2154,11 @@ static int ocontext_copy_xen(expand_state_t *state)
- 				ERR(state->handle, "Unknown ocontext");
- 				return -1;
- 			}
-+			if (context_copy(&n->context[0], &c->context[0],
-+				state)) {
-+				ERR(state->handle, "Out of memory!");
-+				return -1;
-+			}
- 		}
- 	}
- 	return 0;
-@@ -2085,12 +2183,14 @@ static int ocontext_copy_selinux(expand_state_t *state)
- 			else
- 				state->out->ocontexts[i] = n;
- 			l = n;
--			if (context_copy(&n->context[0], &c->context[0], state)) {
--				ERR(state->handle, "Out of memory!");
--				return -1;
--			}
- 			switch (i) {
- 			case OCON_ISID:
-+				if (c->context[0].user == 0) {
-+					ERR(state->handle,
-+					    "Missing context for %s initial sid",
-+					    c->u.name);
-+					return -1;
-+				}
- 				n->sid[0] = c->sid[0];
- 				break;
- 			case OCON_FS:	/* FALLTHROUGH */
-@@ -2134,6 +2234,10 @@ static int ocontext_copy_selinux(expand_state_t *state)
- 				ERR(state->handle, "Unknown ocontext");
- 				return -1;
- 			}
-+			if (context_copy(&n->context[0], &c->context[0], state)) {
-+				ERR(state->handle, "Out of memory!");
-+				return -1;
-+			}
- 		}
- 	}
- 	return 0;
-diff --git a/libsepol/src/polcaps.c b/libsepol/src/polcaps.c
-index bcaef0c..43a71a7 100644
---- a/libsepol/src/polcaps.c
-+++ b/libsepol/src/polcaps.c
-@@ -9,6 +9,7 @@ static const char *polcap_names[] = {
- 	"network_peer_controls",	/* POLICYDB_CAPABILITY_NETPEER */
- 	"open_perms",			/* POLICYDB_CAPABILITY_OPENPERM */
- 	"redhat1",			/* POLICYDB_CAPABILITY_REDHAT1, aka ptrace_child */
-+	"always_check_network",		/* POLICYDB_CAPABILITY_ALWAYSNETWORK */
- 	NULL
- };
- 

libsepol.spec

@@ -6,7 +6,6 @@ License: LGPLv2+
 Group: System Environment/Libraries
 Source: http://www.nsa.gov/selinux/archives/libsepol-%{version}.tgz
 Patch: libsepol-rhat.patch
-Patch1: libsepol-emptytable.patch
 URL: http://www.selinuxproject.org
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -47,7 +46,6 @@ needed for developing applications that manipulate binary policies.
 %prep
 %setup -q
 %patch -p2 -b .rhat
-%patch1 -p1 -b .empty
 
 # sparc64 is an -fPIC arch, so we need to fix it here
 %ifarch sparc64