From bb6a3212129a1d36892fd961c4b0984d9ada4d80 Mon Sep 17 00:00:00 2001
From: Adam Samalik <asamalik@redhat.com>
Date: Thu, 29 Jun 2023 17:59:20 +0200
Subject: [PATCH] re-import sources as agreed with the maintainer

---
 .gitignore     |   3 ++
 netlabel       | 119 +++++++++++++++++++++++++++++++++++++++++++++++++
 netlabel.rules |  59 ++++++++++++++++++++++++
 3 files changed, 181 insertions(+)
 create mode 100644 netlabel
 create mode 100644 netlabel.rules

diff --git a/.gitignore b/.gitignore
index 8ec86ef..773f963 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,4 @@
+netlabel_tools-0.19.tar.gz
+/netlabel_tools-0.20.tar.gz
+/netlabel_tools-0.21.tar.gz
 /netlabel_tools-0.30.0.tar.gz
diff --git a/netlabel b/netlabel
new file mode 100644
index 0000000..668c2aa
--- /dev/null
+++ b/netlabel
@@ -0,0 +1,119 @@
+#!/bin/sh
+#
+# netlabel	Start CIPSO labeled networking
+#
+# chkconfig: - 09 91
+# description:	Starts and stops CIPSO labeled networking
+#
+# config: /etc/netlabel.rules
+#
+# Return values according to LSB for all commands but status:
+# 0 - success
+# 1 - generic or unspecified error
+# 2 - invalid or excess argument(s)
+# 3 - unimplemented feature (e.g. "reload")
+# 4 - insufficient privilege
+# 5 - program is not installed
+# 6 - program is not configured
+# 7 - program is not running
+
+PATH=/sbin:/bin:/usr/bin:/usr/sbin
+VAR_SUBSYS_NETLABEL=/var/lock/subsys/netlabel
+RULES=/etc/netlabel.rules
+
+# Source function library.
+. /etc/init.d/functions
+
+# Check that we are root ... so non-root users stop here
+test `id -u` = 0  || exit 4
+test -x /sbin/netlabelctl || exit 5
+test -f $RULES || exit 6
+
+start() {
+    ret_val="0"
+
+    # Loop through rules
+    while read LINE
+    do
+	# Skip comments and blank lines
+	if echo $LINE | egrep '^#|^$' >/dev/null ; then
+		continue
+	fi
+	/sbin/netlabelctl $LINE >/dev/null 2>&1
+	ret="$?"
+	if [ "$ret" != "0" ] ; then
+		ret_val="$ret"
+	fi
+    done < $RULES
+    touch $VAR_SUBSYS_NETLABEL
+    return $ret_val
+}
+
+stop() {
+    rm -f $VAR_SUBSYS_NETLABEL
+
+    # Delete rules
+    list=`/sbin/netlabelctl cipsov4 list 2>/dev/null`
+    ret="$?"
+    if [ x"$list" != "x" ] ; then
+	for line in "$list"
+	do
+		/sbin/netlabelctl cipsov4 del "doi:$line" 2>/dev/null
+    		ret="$?"
+	done
+    fi
+    return $ret
+}
+
+status() {
+    # Do not print status if lockfile is missing 
+    if [ ! -f "$VAR_SUBSYS_NETLABEL" ]; then
+	echo $"Netlabel is stopped."
+	return 3
+    fi
+
+    # List rules
+    /sbin/netlabelctl -p cipsov4 list 2>/dev/null
+    ret1="$?"
+    /sbin/netlabelctl -p mgmt protocols 2>/dev/null
+    ret2="$?"
+
+    if [ "$ret1" != "0" -o "$ret2" != "0" ] ; then
+	return 2
+    fi
+    return 0
+}
+
+restart() {
+    stop
+    start
+}
+
+case "$1" in
+    start)
+	stop
+	start
+	RETVAL="$?"
+	;;
+    stop)
+	stop
+	RETVAL="$?"
+	;;
+    restart)
+	restart
+	RETVAL="$?"
+	;;
+    condrestart)
+	[ -e "$VAR_SUBSYS_NETLABEL" ] && restart
+	;;
+    status)
+	status
+	RETVAL="$?"
+	;;
+    *)
+	echo $"Usage: $0 {start|stop|restart|condrestart|status}"
+	exit 3
+	;;
+esac
+
+exit $RETVAL
diff --git a/netlabel.rules b/netlabel.rules
new file mode 100644
index 0000000..4c24972
--- /dev/null
+++ b/netlabel.rules
@@ -0,0 +1,59 @@
+# This file contains the rules for the Netlabel subsystem, for more information
+# please see the netlabelctl(1) man page.
+#
+# Each line contains just the arguments to the netlabel command
+
+####
+# NOTE: By default the kernel sends unlabeled traffic and allows unlabled
+#       traffic into the system, to disable that add the following two lines to
+#       the beginning of your configuration.  However, be warned that you
+#       should only change these settings if you know what you are doing as you
+#       could accidently disable networking with a bad configuration.
+#
+
+# Remove the default domain mapping
+#map del default
+
+# Do not accept incoming unlabeled packets
+#unlbl accept off
+
+####
+# Unlabeled examples:
+#
+
+# Enable unlabeled packets
+#unlbl accept on
+
+# Disable unlabeled packets
+#unlbl accept off
+
+
+####
+# CIPSOv4 examples:
+#
+
+# Create a CIPSOv4 DOI definition using a pass-through mapping with a DOI
+# value of 6 and the restricted bitmap tag (CIPSOv4 tag type #1)
+#cipsov4 add pass doi:6 tags:1
+
+# Create a CIPSOv4 DOI definition using a standard mapping with a DOI value
+# of 8 and the restricted bitmap tag (CIPSOv4 tag type #1).  The example
+# below maps MLS sensitivity levels and categories 0 through 2 to the same
+# values for both CIPSO and the Linux LSM
+#cipsov4 add std doi:8 tags:1 levels:0=0,1=1,2=2 categories:0=0,1=1,2=2
+
+
+####
+# LSM mapping examples:
+#
+
+# Create a default mapping for all LSM domains using the unlabeled protocol
+#map add default protocol:unlbl
+
+# Create a default mapping for all LSM domains using the CIPSOv4 protocol
+# with DOI number 6
+#map add default protocol:cipsov4,6
+
+# Create a mapping for the "secret_t" LSM domain and the CIPSOv4 protocol
+# with DOI number 8
+#map add domain:secret_t protocol:cipsov4,8