policycoreutils/policycoreutils-rhat.patch

diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/audit2allow/Makefile policycoreutils-2.0.9/audit2allow/Makefile
--- nsapolicycoreutils/audit2allow/Makefile	2007-02-07 12:11:49.000000000 -0500
+++ policycoreutils-2.0.9/audit2allow/Makefile	2007-04-18 14:32:01.000000000 -0400
@@ -1,6 +1,7 @@
 # Installation directories.
 PREFIX ?= ${DESTDIR}/usr
 BINDIR ?= $(PREFIX)/bin
+SBINDIR ?= $(PREFIX)/sbin
 LIBDIR ?= $(PREFIX)/lib
 MANDIR ?= $(PREFIX)/share/man
 LOCALEDIR ?= /usr/share/locale
@@ -10,7 +11,7 @@
 install: all
 	-mkdir -p $(BINDIR)
 	install -m 755 audit2allow $(BINDIR)
-	install -m 755 sepolgen-ifgen $(BINDIR)
+	install -m 755 sepolgen-ifgen $(SBINDIR)
 	-mkdir -p $(MANDIR)/man1
 	install -m 644 audit2allow.1 $(MANDIR)/man1/
 
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/audit2why/Makefile policycoreutils-2.0.9/audit2why/Makefile
--- nsapolicycoreutils/audit2why/Makefile	2006-11-16 17:14:26.000000000 -0500
+++ policycoreutils-2.0.9/audit2why/Makefile	2007-04-18 14:28:26.000000000 -0400
@@ -1,6 +1,6 @@
 # Installation directories.
 PREFIX ?= ${DESTDIR}/usr
-BINDIR ?= $(PREFIX)/sbin
+BINDIR ?= $(PREFIX)/bin
 LIBDIR ?= ${PREFIX}/lib
 MANDIR ?= $(PREFIX)/share/man
 LOCALEDIR ?= /usr/share/locale
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.9/Makefile
--- nsapolicycoreutils/Makefile	2006-11-16 17:15:00.000000000 -0500
+++ policycoreutils-2.0.9/Makefile	2007-04-16 13:26:34.000000000 -0400
@@ -1,4 +1,4 @@
-SUBDIRS=setfiles semanage load_policy newrole run_init restorecon restorecond secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po
+SUBDIRS=setfiles semanage load_policy newrole run_init restorecon restorecond secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po gui
 
 all install relabel clean indent:
 	@for subdir in $(SUBDIRS); do \
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecon/restorecon.c policycoreutils-2.0.9/restorecon/restorecon.c
--- nsapolicycoreutils/restorecon/restorecon.c	2006-11-16 17:14:26.000000000 -0500
+++ policycoreutils-2.0.9/restorecon/restorecon.c	2007-04-18 14:26:39.000000000 -0400
@@ -16,6 +16,7 @@
  * -v	Show changes in file labels.  
  * -o	filename save list of files with incorrect context
  * -F	Force reset of context to match file_context for customizable files
+ * -l   Limit directory tree walk to a single filesystem
  *
  * pathname...	The file(s) to label 
  *
@@ -50,6 +51,7 @@
 static int recurse = 0;
 static int file_exist = 1;
 static int force = 0;
+static int onefs = 0;
 #define STAT_BLOCK_SIZE 1
 static int pipe_fds[2] = { -1, -1 };
 static unsigned long long count = 0;
@@ -326,18 +328,20 @@
 			rc = fork();
 		if (rc == 0) {
 			close(pipe_fds[0]);
-			nftw(buf, pre_stat, 1024, FTW_PHYS);
+			nftw(buf, pre_stat, 1024, 
+                             FTW_PHYS | (onefs ? FTW_MOUNT : 0));
 			exit(1);
 		}
 		if (rc > 0)
 			close(pipe_fds[1]);
 		if (rc == -1 || rc > 0) {
-			if (nftw(buf, apply_spec, 1024, FTW_PHYS)) {
+			if (nftw(buf, apply_spec, 1024, 
+                                 FTW_PHYS | (onefs ? FTW_MOUNT : 0))) {
 				if (!file_exist && errno == ENOENT)
 					return;
 				fprintf(stderr,
-					"%s:  error while labeling files under %s\n",
-					progname, buf);
+					"%s: %s: %s\n",
+					progname, buf, strerror(errno));
 				errors++;
 			}
 		}
@@ -367,11 +371,14 @@
 
 	set_matchpathcon_flags(MATCHPATHCON_NOTRANS);
 
-	while ((opt = getopt(argc, argv, "ipFrRnvf:o:e:")) > 0) {
+	while ((opt = getopt(argc, argv, "ipFrRnvf:lo:e:")) > 0) {
 		switch (opt) {
 		case 'n':
 			change = 0;
 			break;
+                case 'l':
+                    onefs = 1;
+                    break;
 		case 'i':
 			file_exist = 0;
 			break;
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.c policycoreutils-2.0.9/restorecond/restorecond.c
--- nsapolicycoreutils/restorecond/restorecond.c	2007-02-22 08:53:22.000000000 -0500
+++ policycoreutils-2.0.9/restorecond/restorecond.c	2007-04-16 13:26:34.000000000 -0400
@@ -210,9 +210,10 @@
 			}
 
 			if (fsetfilecon(fd, scontext) < 0) {
-				syslog(LOG_ERR,
-				       "set context %s->%s failed:'%s'\n",
-				       filename, scontext, strerror(errno));
+				if (errno != EOPNOTSUPP) 
+					syslog(LOG_ERR,
+					       "set context %s->%s failed:'%s'\n",
+					       filename, scontext, strerror(errno));
 				if (retcontext >= 0)
 					free(prev_context);
 				free(scontext);
@@ -225,8 +226,9 @@
 		if (retcontext >= 0)
 			free(prev_context);
 	} else {
-		syslog(LOG_ERR, "get context on %s failed: '%s'\n",
-		       filename, strerror(errno));
+		if (errno != EOPNOTSUPP) 
+			syslog(LOG_ERR, "get context on %s failed: '%s'\n",
+			       filename, strerror(errno));
 	}
 	free(scontext);
 	close(fd);
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.conf policycoreutils-2.0.9/restorecond/restorecond.conf
--- nsapolicycoreutils/restorecond/restorecond.conf	2006-11-20 12:19:55.000000000 -0500
+++ policycoreutils-2.0.9/restorecond/restorecond.conf	2007-04-16 13:26:34.000000000 -0400
@@ -1,7 +1,10 @@
 /etc/resolv.conf
+/etc/localtime
 /etc/samba/secrets.tdb
 /etc/mtab
 /var/run/utmp
+/var/run/faillog
 /var/log/wtmp
+/etc/lvm/.cache
 ~/public_html
 ~/.mozilla/plugins/libflashplayer.so
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.init policycoreutils-2.0.9/restorecond/restorecond.init
--- nsapolicycoreutils/restorecond/restorecond.init	2007-03-01 17:23:40.000000000 -0500
+++ policycoreutils-2.0.9/restorecond/restorecond.init	2007-04-16 13:26:34.000000000 -0400
@@ -73,6 +73,7 @@
         ;;
   status)
 	status restorecond
+	RETVAL=$?
 	;;
   restart|reload)
 	restart
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/chcat policycoreutils-2.0.9/scripts/chcat
--- nsapolicycoreutils/scripts/chcat	2007-02-22 08:53:22.000000000 -0500
+++ policycoreutils-2.0.9/scripts/chcat	2007-04-16 13:26:34.000000000 -0400
@@ -74,9 +74,11 @@
             if i not in cats:
                 cats.append(i)
 
-        new_serange = "%s-%s:%s" % (serange[0], top[0], string.join(cats, ","))
-        if new_serange[-1:] == ":":
-            new_serange = new_serange[:-1]
+            
+        if len(cats) > 0:
+            new_serange = "%s-%s:%s" % (serange[0], top[0], ",".join(cats))
+        else
+            new_serange = "%s-%s" % (serange[0], top[0])
             
         if add_ind:
             cmd = "semanage login -a -r %s -s %s %s" % (new_serange, user[0], u)
@@ -151,10 +153,11 @@
             if i in cats:
                 cats.remove(i)
 
-        new_serange = "%s-%s:%s" % (serange[0], top[0], string.join(cats, ","))
-        if new_serange[-1:] == ":":
-            new_serange = new_serange[:-1]
-        
+        if len(cats) > 0:
+            new_serange = "%s-%s:%s" % (serange[0], top[0], ",".join(cats))
+        else
+            new_serange = "%s-%s" % (serange[0], top[0])
+            
         if add_ind:
             cmd = "semanage login -a -r %s -s %s %s" % (new_serange, user[0], u)
         else:
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/fixfiles policycoreutils-2.0.9/scripts/fixfiles
--- nsapolicycoreutils/scripts/fixfiles	2007-01-11 08:56:30.000000000 -0500
+++ policycoreutils-2.0.9/scripts/fixfiles	2007-04-16 13:26:34.000000000 -0400
@@ -138,7 +138,7 @@
     exit $?
 fi
 LogReadOnly
-${SETFILES} ${OUTFILES} ${SYSLOGFLAG} ${FORCEFLAG} $* ${FC} ${FILESYSTEMSRW} 2>&1 >> $LOGFILE
+${SETFILES} -q ${OUTFILES} ${SYSLOGFLAG} ${FORCEFLAG} $* ${FC} ${FILESYSTEMSRW} 2>&1 >> $LOGFILE
 exit $?
 }
 
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/scripts/genhomedircon policycoreutils-2.0.9/scripts/genhomedircon
--- nsapolicycoreutils/scripts/genhomedircon	2006-11-28 09:24:33.000000000 -0500
+++ policycoreutils-2.0.9/scripts/genhomedircon	2007-04-16 13:26:34.000000000 -0400
@@ -26,6 +26,7 @@
 
 import sys, os, pwd, string, getopt, re
 from semanage import *;
+import selinux
 import gettext
 gettext.install('policycoreutils')
 
@@ -249,7 +250,10 @@
 				i = i.replace("HOME_DIR", home)
 				i = i.replace("ROLE", prefix)
 				i = i.replace("system_u", seuser)
-				ret = ret+i
+				# Validate if the generated context exists.  Some user types may not exist
+				scon = i.split()[-1]
+				if selinux.security_check_context(scon) == 0:
+					ret = ret+i
 		fd.close()
 		return ret
 
diff --exclude-from=exclude --exclude=sepolgen-1.0.8 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.9/semanage/seobject.py
--- nsapolicycoreutils/semanage/seobject.py	2007-04-12 12:43:06.000000000 -0400
+++ policycoreutils-2.0.9/semanage/seobject.py	2007-04-16 13:26:34.000000000 -0400
@@ -210,6 +210,7 @@
 		os.write(fd, self.out())
 		os.close(fd)
 		os.rename(newfilename, self.filename)
+                os.system("/sbin/service mcstrans reload > /dev/null")
                 
 class semanageRecords:
 	def __init__(self):
@@ -1283,9 +1284,12 @@
 			raise ValueError(_("Could not list booleans"))
 
 		for boolean in self.blist:
-			name = semanage_bool_get_name(boolean)
-			value = semanage_bool_get_value(boolean)
-			ddict[name] = value
+                       value = []
+                       name = semanage_bool_get_name(boolean)
+                       value[0] = semanage_bool_get_value(boolean)
+                       value[1] = selinux.security_get_boolean_pending(boolean)
+                       value[2] = selinux.security_get_boolean_active(boolean)
+                       ddict[name] = value
 
 		return ddict