policycoreutils/policycoreutils-rhat.patch

diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/Makefile policycoreutils-2.0.26/Makefile
--- nsapolicycoreutils/Makefile	2007-07-16 14:20:43.000000000 -0400
+++ policycoreutils-2.0.26/Makefile	2007-09-18 16:40:57.000000000 -0400
@@ -1,4 +1,4 @@
-SUBDIRS=setfiles semanage load_policy newrole run_init restorecond secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po
+SUBDIRS=setfiles semanage load_policy newrole run_init restorecond secon audit2allow audit2why scripts sestatus semodule_package semodule semodule_link semodule_expand semodule_deps setsebool po gui
 
 all install relabel clean indent:
 	@for subdir in $(SUBDIRS); do \
diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/restorecond/restorecond.c policycoreutils-2.0.26/restorecond/restorecond.c
--- nsapolicycoreutils/restorecond/restorecond.c	2007-07-16 14:20:41.000000000 -0400
+++ policycoreutils-2.0.26/restorecond/restorecond.c	2007-09-18 16:40:57.000000000 -0400
@@ -210,9 +210,10 @@
 			}
 
 			if (fsetfilecon(fd, scontext) < 0) {
-				syslog(LOG_ERR,
-				       "set context %s->%s failed:'%s'\n",
-				       filename, scontext, strerror(errno));
+				if (errno != EOPNOTSUPP) 
+					syslog(LOG_ERR,
+					       "set context %s->%s failed:'%s'\n",
+					       filename, scontext, strerror(errno));
 				if (retcontext >= 0)
 					free(prev_context);
 				free(scontext);
@@ -225,8 +226,9 @@
 		if (retcontext >= 0)
 			free(prev_context);
 	} else {
-		syslog(LOG_ERR, "get context on %s failed: '%s'\n",
-		       filename, strerror(errno));
+		if (errno != EOPNOTSUPP) 
+			syslog(LOG_ERR, "get context on %s failed: '%s'\n",
+			       filename, strerror(errno));
 	}
 	free(scontext);
 	close(fd);
diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semanage/seobject.py policycoreutils-2.0.26/semanage/seobject.py
--- nsapolicycoreutils/semanage/seobject.py	2007-07-16 14:20:41.000000000 -0400
+++ policycoreutils-2.0.26/semanage/seobject.py	2007-09-18 16:40:57.000000000 -0400
@@ -210,6 +210,7 @@
 		os.write(fd, self.out())
 		os.close(fd)
 		os.rename(newfilename, self.filename)
+                os.system("/sbin/service mcstrans reload > /dev/null")
                 
 class semanageRecords:
 	def __init__(self):
@@ -1024,14 +1025,31 @@
 	def __init__(self):
 		semanageRecords.__init__(self)
 		
-	def add(self, target, type, ftype = "", serange = "", seuser = "system_u"):
+        def createcon(self, target, seuser = "system_u"):
+                (rc, con) = semanage_context_create(self.sh)
+                if rc < 0:
+                       raise ValueError(_("Could not create context for %s") % target)
 		if seuser == "":
 			seuser = "system_u"
+
+                rc = semanage_context_set_user(self.sh, con, seuser)
+                if rc < 0:
+                       raise ValueError(_("Could not set user in file context for %s") % target)
+		
+                rc = semanage_context_set_role(self.sh, con, "object_r")
+                if rc < 0:
+                       raise ValueError(_("Could not set role in file context for %s") % target)
+
 		if is_mls_enabled == 1:
-			if serange == "":
-				serange = "s0"
-			else:
-				serange = untranslate(serange)
+                       rc = semanage_context_set_mls(self.sh, con, "s0")
+                       if rc < 0:
+                              raise ValueError(_("Could not set mls fields in file context for %s") % target)
+
+                return con
+               
+	def add(self, target, type, ftype = "", serange = "", seuser = "system_u"):
+		if is_mls_enabled == 1:
+                       serange = untranslate(serange)
 			
 		if type == "":
 			raise ValueError(_("SELinux Type is required"))
@@ -1051,33 +1069,23 @@
 			raise ValueError(_("Could not create file context for %s") % target)
 		
 		rc = semanage_fcontext_set_expr(self.sh, fcontext, target)
-		(rc, con) = semanage_context_create(self.sh)
-		if rc < 0:
-			raise ValueError(_("Could not create context for %s") % target)
-
-		rc = semanage_context_set_user(self.sh, con, seuser)
-		if rc < 0:
-			raise ValueError(_("Could not set user in file context for %s") % target)
-		
-		rc = semanage_context_set_role(self.sh, con, "object_r")
-		if rc < 0:
-			raise ValueError(_("Could not set role in file context for %s") % target)
-
-		rc = semanage_context_set_type(self.sh, con, type)
-		if rc < 0:
-			raise ValueError(_("Could not set type in file context for %s") % target)
+                if type != "<<none>>":
+                       con = self.createcon(target, seuser)
 
-		if serange != "":
-			rc = semanage_context_set_mls(self.sh, con, serange)
-			if rc < 0:
-				raise ValueError(_("Could not set mls fields in file context for %s") % target)
+                       rc = semanage_context_set_type(self.sh, con, type)
+                       if rc < 0:
+                              raise ValueError(_("Could not set type in file context for %s") % target)
+
+                       if serange != "":
+                              rc = semanage_context_set_mls(self.sh, con, serange)
+                              if rc < 0:
+                                     raise ValueError(_("Could not set mls fields in file context for %s") % target)
+                       rc = semanage_fcontext_set_con(self.sh, fcontext, con)
+                       if rc < 0:
+                              raise ValueError(_("Could not set file context for %s") % target)
 
 		semanage_fcontext_set_type(fcontext, file_types[ftype])
 
-		rc = semanage_fcontext_set_con(self.sh, fcontext, con)
-		if rc < 0:
-			raise ValueError(_("Could not set file context for %s") % target)
-
 		rc = semanage_begin_transaction(self.sh)
 		if rc < 0:
 			raise ValueError(_("Could not start semanage transaction"))
@@ -1090,7 +1098,8 @@
 		if rc < 0:
 			raise ValueError(_("Could not add file context for %s") % target)
 
-		semanage_context_free(con)
+                if type != "<<none>>":
+                       semanage_context_free(con)
 		semanage_fcontext_key_free(k)
 		semanage_fcontext_free(fcontext)
 
@@ -1112,16 +1121,29 @@
 		if rc < 0:
 			raise ValueError(_("Could not query file context for %s") % target)
 
-		con = semanage_fcontext_get_con(fcontext)
+                if setype != "<<none>>":
+                       con = semanage_fcontext_get_con(fcontext)
 			
-		if serange != "":
-			semanage_context_set_mls(self.sh, con, untranslate(serange))
-		if seuser != "":
-			semanage_context_set_user(self.sh, con, seuser)	
-		if setype != "":
-			semanage_context_set_type(self.sh, con, setype)
-
-		rc = semanage_begin_transaction(self.sh)
+                       if con == None:
+                              con = self.createcon(target)
+                              
+                       if serange != "":
+                              semanage_context_set_mls(self.sh, con, untranslate(serange))
+                       if seuser != "":
+                              semanage_context_set_user(self.sh, con, seuser)
+                              
+                       if setype != "":
+                              semanage_context_set_type(self.sh, con, setype)
+
+                       rc = semanage_fcontext_set_con(self.sh, fcontext, con)
+                       if rc < 0:
+                              raise ValueError(_("Could not set file context for %s") % target)
+                else:
+                       rc = semanage_fcontext_set_con(self.sh, fcontext, None)
+                       if rc < 0:
+                              raise ValueError(_("Could not set file context for %s") % target)
+                       
+                rc = semanage_begin_transaction(self.sh)
 		if rc < 0:
 			raise ValueError(_("Could not start semanage transaction"))
 
@@ -1283,9 +1305,12 @@
 			raise ValueError(_("Could not list booleans"))
 
 		for boolean in self.blist:
-			name = semanage_bool_get_name(boolean)
-			value = semanage_bool_get_value(boolean)
-			ddict[name] = value
+                       value = []
+                       name = semanage_bool_get_name(boolean)
+                       value[0] = semanage_bool_get_value(boolean)
+                       value[1] = selinux.security_get_boolean_pending(boolean)
+                       value[2] = selinux.security_get_boolean_active(boolean)
+                       ddict[name] = value
 
 		return ddict
 			
diff --exclude-from=exclude --exclude=sepolgen-1.0.10 --exclude=gui --exclude=po -N -u -r nsapolicycoreutils/semodule/semodule.8 policycoreutils-2.0.26/semodule/semodule.8
--- nsapolicycoreutils/semodule/semodule.8	2007-07-16 14:20:42.000000000 -0400
+++ policycoreutils-2.0.26/semodule/semodule.8	2007-09-18 16:40:57.000000000 -0400
@@ -23,6 +23,9 @@
 .B \-B, \-\-build		
 force a rebuild of policy (also reloads unless -n is used)
 .TP
+.B \-D, \-\-disable_dontaudit
+Temporarily remove dontaudits from policy.  Reverts whenever policy is rebuilt
+.TP
 .B \-i,\-\-install=MODULE_PKG
 install/replace a module package
 .TP
@@ -58,6 +61,10 @@
 $ semodule -i httpd.pp
 # List non-base modules.
 $ semodule -l
+# Turn on all AVC Messages for which SELinux currently is "dontaudit"ing.
+$ semodule -DB
+# Turn "dontaudit" rules back on.
+$ semodule -B
 # Install or replace all non-base modules in the current directory.
 $ semodule -i *.pp
 # Install or replace all modules in the current directory.