Reorginize sepolicy so all get_all functions are in main module

- Add -B capability to fixfiles onboot and fixfiles restore, basically searches for all files created since the last boot.

policycoreutils-rhat.patch

@@ -96,7 +96,7 @@ index 1464971..b5abbb9 100644
  clean:
  
 diff --git a/policycoreutils/gui/domainsPage.py b/policycoreutils/gui/domainsPage.py
-index 03451b6..91c88a8 100644
+index 03451b6..6af1e9a 100644
 --- a/policycoreutils/gui/domainsPage.py
 +++ b/policycoreutils/gui/domainsPage.py
 @@ -26,7 +26,7 @@ import sys
@@ -104,7 +104,7 @@ index 03451b6..91c88a8 100644
  import selinux
  from semanagePage import *;
 -import polgen
-+from sepolicy.generate import get_all_domains
++from sepolicy import get_all_entrypoint_domains
  
  ##
  ## I18N
@@ -113,7 +113,7 @@ index 03451b6..91c88a8 100644
          self.enforcing_button = xml.get_widget("enforcingButton")
  
 -        self.domains=polgen.get_all_domains()
-+        self.domains=get_all_domains()
++        self.domains=get_all_entrypoint_domains()
          self.load()
  
      def get_modules(self):
@@ -336583,14 +336583,15 @@ index 4ba51bf..6673f00 100644
 +"services."
  msgstr ""
 diff --git a/policycoreutils/restorecond/restorecond.conf b/policycoreutils/restorecond/restorecond.conf
-index f133755..cfe851e 100644
+index f133755..c64e747 100644
 --- a/policycoreutils/restorecond/restorecond.conf
 +++ b/policycoreutils/restorecond/restorecond.conf
-@@ -1,7 +1,6 @@
+@@ -1,7 +1,7 @@
  /etc/services
  /etc/resolv.conf
  /etc/samba/secrets.tdb
 -/etc/mtab*
++/etc/updatedb.conf
  /var/run/utmp
  /var/log/wtmp
  /root/*
@@ -336836,18 +336837,47 @@ index e08088e..201a988 100644
  install: all
  	-mkdir -p $(BINDIR)
 diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
-index 989b1ae..23ab94d 100755
+index 989b1ae..6901e4d 100755
 --- a/policycoreutils/scripts/fixfiles
 +++ b/policycoreutils/scripts/fixfiles
-@@ -114,6 +114,7 @@ exclude_dirs() {
+@@ -103,7 +103,7 @@ exclude_dirs_from_relabelling() {
+ 
+ exclude_dirs() {
+     exclude=
+-    for i in /var/lib/BackupPC /home /tmp /dev; do
++    for i in /sys /proc /dev /run /mnt /var/tmp /var/lib/BackupPC /home /tmp /dev; do
+         [ -e $i ]  && exclude="$exclude -e $i";
+     done
+     exclude="$exclude `exclude_dirs_from_relabelling`"
+@@ -114,6 +114,9 @@ exclude_dirs() {
  # Set global Variables
  #
  fullFlag=0
++BOOTTIME=""
++FORCEFLAG=""
 +VERBOSE="-p"
  FORCEFLAG=""
  DIRS=""
  RPMILES=""
-@@ -176,7 +177,7 @@ if [ -f ${PREFC} -a -x /usr/bin/diff ]; then
+@@ -144,6 +147,17 @@ if [ -n $LOGFILE ]; then
+ fi
+ }
+ #
++# Find files newer then the passed in date and fix the label
++#
++newer() {
++    DATE=$1
++    for m in `echo $FILESYSTEMSRW`; do
++	find $m -mount -newermt $DATE -print0 2>/dev/null | ${RESTORECON} ${VERBOSE} -i -0 -f -
++    done;
++
++}
++
++#
+ # Compare PREVious File Context to currently installed File Context and 
+ # run restorecon on all files affected by the differences.
+ #
+@@ -176,7 +190,7 @@ if [ -f ${PREFC} -a -x /usr/bin/diff ]; then
                    esac; \
                 fi; \
              done | \
@@ -336856,8 +336886,14 @@ index 989b1ae..23ab94d 100755
  	rm -f ${TEMPFILE} ${PREFCTEMPFILE}
  fi
  }
-@@ -206,12 +207,12 @@ if [ ! -z "$PREFC" ]; then
+@@ -204,14 +218,18 @@ if [ ! -z "$PREFC" ]; then
+     diff_filecontext $*
+     exit $?
  fi
++if [ ! -z "$BOOTTIME" ]; then
++    newer $BOOTTIME
++    exit $?
++fi
  if [ ! -z "$RPMFILES" ]; then
      for i in `echo "$RPMFILES" | sed 's/,/ /g'`; do
 -	rpmlist $i | ${RESTORECON} ${FORCEFLAG} $* -R -i -f - 2>&1 | cat >> $LOGFILE
@@ -336871,7 +336907,7 @@ index 989b1ae..23ab94d 100755
      return
  fi
  [ -x /usr/sbin/genhomedircon ] && /usr/sbin/genhomedircon
-@@ -235,7 +236,7 @@ FC=$TEMPFCFILE
+@@ -235,7 +253,7 @@ FC=$TEMPFCFILE
  fi
  if [  -n "${FILESYSTEMSRW}" ]; then
      echo "Relabeling `echo ${FILESYSTEMSRW}`"
@@ -336880,7 +336916,7 @@ index 989b1ae..23ab94d 100755
  else
      echo >&2 "fixfiles: No suitable file systems found"
  fi
-@@ -286,12 +287,12 @@ process() {
+@@ -286,12 +304,16 @@ process() {
  # Make sure they specified one of the three valid commands
  #
  case "$1" in
@@ -336891,17 +336927,25 @@ index 989b1ae..23ab94d 100755
      relabel) relabel;;
      onboot)
 -	touch /.autorelabel
-+	echo $FORCEFLAG > /.autorelabel
++	> /.autorelabel
++	[ -z "$FORCEFLAG" ] || echo -n "$FORCEFLAG " >> /.autorelabel
++	[ -z "$BOOTTIME" ] || echo -N $BOOTTIME >> /.autorelabel
++	# Force full relabel if / does not have a label on it
++	getfilecon / > /dev/null 2>&1  || echo -F >/.autorelabel
  	echo "System will relabel on next boot"
  	;;
      *)
-@@ -317,11 +318,14 @@ if [ $# = 0 ]; then
+@@ -317,11 +339,18 @@ if [ $# = 0 ]; then
  fi
  
  # See how we were called.
 -while getopts "C:FfR:l:" i; do
-+while getopts "C:FfR:l:v" i; do
++while getopts "N:BC:FfR:l:v" i; do
      case "$i" in
++	B)
++		BOOTTIME=`/bin/who -b | awk '{print $3}'`
++		echo $BOOTTIME
++		;;
  	f)
  		fullFlag=1
  		;;
@@ -336911,6 +336955,16 @@ index 989b1ae..23ab94d 100755
          R)
  		RPMFILES=$OPTARG
  		;;
+@@ -334,6 +363,9 @@ while getopts "C:FfR:l:" i; do
+ 	F)
+ 		FORCEFLAG="-F"
+ 		;;
++	N)
++		BOOTTIME=$OPTARG
++		;;
+ 	*)
+ 	    usage
+ 	    exit 1
 diff --git a/policycoreutils/scripts/fixfiles.8 b/policycoreutils/scripts/fixfiles.8
 index 0b4cbaa..9ab7334 100644
 --- a/policycoreutils/scripts/fixfiles.8
@@ -340156,7 +340210,7 @@ index 0000000..4693bb4
 +}
 diff --git a/policycoreutils/sepolicy/sepolicy-bash-completion.sh b/policycoreutils/sepolicy/sepolicy-bash-completion.sh
 new file mode 100644
-index 0000000..28b6767
+index 0000000..82fea52
 --- /dev/null
 +++ b/policycoreutils/sepolicy/sepolicy-bash-completion.sh
 @@ -0,0 +1,190 @@
@@ -340207,6 +340261,9 @@ index 0000000..28b6767
 +__get_all_user_domains () {
 +    seinfo -auserdomain -x 2> /dev/null | tail -n +2
 +}
++__get_all_users () {
++    seinfo -u 2> /dev/null | tail -n +2
++}
 +__get_all_classes () {
 +    seinfo -c 2> /dev/null | tail -n +2
 +}
@@ -340219,9 +340276,6 @@ index 0000000..28b6767
 +__get_all_domains () {
 +    seinfo -adomain -x 2>/dev/null | sed 's/_t$//g'
 +}
-+__get_all_generate_types () {
-+    seinfo -agenerate_type -x 2>/dev/null | tail -n +2
-+}
 +_sepolicy () {
 +        local command=${COMP_WORDS[1]}
 +        local cur=${COMP_WORDS[COMP_CWORD]} prev=${COMP_WORDS[COMP_CWORD-1]}
@@ -340241,7 +340295,7 @@ index 0000000..28b6767
 +        local -A OPTS=(
 +               [booleans]='-h --help -p --path -a -all -b --boolean'
 +               [communicate]='-h --help -s --source -t --target -c --class -S --sourceaccess -T --targetaccess'
-+               [generate]='-a --admin --admin_user --application --cgi --confined_admin --customize  -d --domain --dbus --desktop_user -h --help --inetd --init -n --name --newuser -p --path --sandbox -T --test --term_user -u --user -w --writepath --x_user'
++               [generate]='-a --admin --admin_user --application --cgi --confined_admin --customize  -d --domain --dbus --desktop_user -h --help --inetd --init -n --name --newtype -p --path --sandbox -T --test --term_user -u --user -w --writepath --x_user'
 +               [interface]='-h --help -a --list_admin" -u --list_user -l --list'
 +               [manpage]='-h --help -p --path -a -all -o --os -d --domain -w --web'
 +               [network]='-h --help -d --domain -l --list -p --port -t --type '
@@ -340302,7 +340356,7 @@ index 0000000..28b6767
 +                COMPREPLY=( $(compgen -W "$( __get_all_admin_interaces ) " -- "$cur") )
 +                return 0
 +            elif [ "$prev" = "--user" -o "$prev" = "-u" ]; then
-+                COMPREPLY=( $(compgen -W "$( __get_all_user_domains ) " -- "$cur") )
++                COMPREPLY=( $(compgen -W "$( __get_all_users ) " -- "$cur") )
 +                return 0
 +            elif [[ "$cur" == "$verb" || "$cur" == "" || "$cur" == -* ]]; then
 +                COMPREPLY=( $(compgen -W '${OPTS[$verb]}' -- "$cur") )
@@ -340793,10 +340847,10 @@ index 0000000..0748ca9
 +selinux(8), sepolicy-booleans(8), sepolicy-communicate(8), sepolicy-generate(8), sepolicy-interface(8),  sepolicy-network(8), sepolicy-manpage(8), sepolicy-transition(8)
 diff --git a/policycoreutils/sepolicy/sepolicy.py b/policycoreutils/sepolicy/sepolicy.py
 new file mode 100755
-index 0000000..154369d
+index 0000000..b25d3b2
 --- /dev/null
 +++ b/policycoreutils/sepolicy/sepolicy.py
-@@ -0,0 +1,470 @@
+@@ -0,0 +1,471 @@
 +#! /usr/bin/python -Es
 +# Copyright (C) 2012 Red Hat
 +# AUTHOR: Dan Walsh <dwalsh@redhat.com>
@@ -340863,7 +340917,7 @@ index 0000000..154369d
 +
 +        if isinstance(values,str):
 +            if values not in domains:
-+                raise ValueError("%s must be an SELinux process domain" % values)
++                raise ValueError("%s must be an SELinux process domain:\nValid domains: %s" % (values, ", ".join(domains)))
 +            setattr(namespace, self.dest, values)
 +        else:
 +            newval = getattr(namespace, self.dest)
@@ -340872,7 +340926,7 @@ index 0000000..154369d
 +
 +            for v in values:
 +                if v not in domains:
-+                    raise ValueError("%s must be an SELinux process domain" % values)
++                    raise ValueError("%s must be an SELinux process domain:\nValid domains: %s" % (v, ", ".join(domains)))
 +                newval.append(v)
 +            setattr(namespace, self.dest, newval)
 +
@@ -340884,7 +340938,8 @@ index 0000000..154369d
 +        if not all_classes:
 +                all_classes = map(lambda x: x['name'], sepolicy.info(sepolicy.TCLASS))
 +        if values not in all_classes:
-+            raise ValueError("%s must be an SELinux process domain" % values)
++            raise ValueError("%s must be an SELinux class:\nValid classes: %s" % (values, ", ".join(all_classes)))
++
 +        setattr(namespace, self.dest, values)
 +
 +class CheckAdmin(argparse.Action):
@@ -340895,7 +340950,7 @@ index 0000000..154369d
 +            newval = []
 +        admins = get_admin()
 +        if values not in admins:
-+            raise ValueError("%s must be an SELinux admin domain" % values)
++            raise ValueError("%s must be an SELinux admin domain:\nValid admin domains: %s" % (values, ", ".join(admins)))
 +        newval.append(values)
 +        setattr(namespace, self.dest, newval)
 +
@@ -340918,7 +340973,7 @@ index 0000000..154369d
 +            newval = []
 +        for v in values:
 +            if v not in port_types:
-+                raise ValueError("%s must be an SELinux port type" % values)
++                raise ValueError("%s must be an SELinux port type:\nValid port types: %s" % (v, ", ".join(port_types)))
 +            newval.append(v)
 +        setattr(namespace, self.dest, values)
 +
@@ -340938,13 +340993,13 @@ index 0000000..154369d
 +
 +class CheckUser(argparse.Action):
 +    def __call__(self, parser, namespace, value, option_string=None):
-+        from sepolicy.generate import get_all_users
++        from sepolicy import get_all_users
 +        newval = getattr(namespace, self.dest)
 +        if not newval:
 +            newval = []
 +        users = get_all_users()
 +        if value not in users:
-+                raise ValueError("%s must be an SELinux user" % value)
++                raise ValueError("%s must be an SELinux user:\nValid users: %s" % (value, ", ".join(users)))
 +        newval.append(value)
 +        setattr(namespace, self.dest, newval)
 +
@@ -341179,13 +341234,13 @@ index 0000000..154369d
 +    from sepolicy.generate import DAEMON, get_poltype_desc, poltype, DAEMON, DBUS, INETD, CGI, SANDBOX, USER, EUSER, TUSER, XUSER, LUSER, AUSER, RUSER, NEWTYPE
 +    pol = parser.add_parser("generate",
 +                            help=_('Generate SELinux Policy module template'))
-+    pol.add_argument("-d", "--domain", dest="domain", 
-+                     action=CheckDomain, default=None,
++    pol.add_argument("-d", "--domain", dest="domain", default=[],
++                     action=CheckDomain, nargs="*",
 +                     help=_("Enter domain type which you will be extending"))
-+    pol.add_argument("-u", "--user", dest="user",
++    pol.add_argument("-u", "--user", dest="user", default=[],
 +                     action=CheckUser, 
 +                     help=_("Enter SELinux user(s) which will transition to this domain"))
-+    pol.add_argument("-a", "--admin", dest="admin_domain",
++    pol.add_argument("-a", "--admin", dest="admin_domain",default=[],
 +                     action=CheckAdmin,
 +                     help=_("Enter domain(s) that this confined admin will administrate"))
 +    pol.add_argument("-n", "--name", dest="name",
@@ -341269,10 +341324,10 @@ index 0000000..154369d
 +        sys.exit(0)
 diff --git a/policycoreutils/sepolicy/sepolicy/__init__.py b/policycoreutils/sepolicy/sepolicy/__init__.py
 new file mode 100644
-index 0000000..68be859
+index 0000000..5e7415c
 --- /dev/null
 +++ b/policycoreutils/sepolicy/sepolicy/__init__.py
-@@ -0,0 +1,159 @@
+@@ -0,0 +1,250 @@
 +#!/usr/bin/python
 +
 +# Author: Thomas Liu <tliu@redhat.com>
@@ -341322,6 +341377,97 @@ index 0000000..68be859
 +        pass
 +    raise ValueError(_("No SELinux Policy installed"))
 +        
++all_types = None
++def get_all_types():
++    global all_types
++    if all_types == None:
++        all_types = map(lambda x: x['name'], info(TYPE))
++    return all_types
++
++role_allows = None
++def get_all_role_allows():
++	global role_allows
++	if role_allows:
++		return role_allows
++	role_allows = {}
++	for r in search([ROLE_ALLOW]):
++		if r["source"] == "system_r" or r["target"] == "system_r":
++			continue
++		if r["source"] in role_allows:
++			role_allows[r["source"]].append(r["target"])
++		else:
++			role_allows[r["source"]] = [ r["target"] ]
++
++	return role_allows
++
++def get_all_entrypoint_domains():
++    all_domains = []
++    types=get_all_types()
++    types.sort()
++    for i in types:
++        m = re.findall("(.*)%s" % "_exec_t$", i)
++        if len(m) > 0:
++            if len(re.findall("(.*)%s" % "_initrc$", m[0])) == 0 and m[0] not in all_domains:
++                all_domains.append(m[0])
++    return all_domains
++
++all_domains = None
++def get_all_domains():
++	global all_domains
++	if not all_domains:
++		all_domains = info(ATTRIBUTE,"domain")[0]["types"]
++	return all_domains
++
++roles = None
++def get_all_roles():
++	global roles
++	if roles:
++		return roles
++        roles = map(lambda x: x['name'], info(ROLE))
++        roles.remove("object_r")
++        roles.sort()
++        return roles
++
++users = None
++def get_all_users():
++    global users
++    if users:
++        return users
++    users = map(lambda x: x['name'], info(USER))
++    return users 
++
++file_types = None
++def get_all_file_types():
++	global file_types
++	if file_types:
++		return file_types
++	file_types =  info(ATTRIBUTE,"file_type")[0]["types"]
++	file_types.sort()
++	return file_types
++
++port_types = None
++def get_all_port_types():
++	global port_types
++	if port_types:
++		return port_types
++	port_types =  info(ATTRIBUTE,"port_type")[0]["types"]
++	port_types.sort()
++	return port_types
++
++bools = None
++def get_all_bools():
++	global bools
++	if not bools:
++		bools = info(BOOLEAN)
++	return bools
++
++all_attributes = None
++def get_all_attributes():
++	global all_attributes
++	if not all_attributes:
++		all_attributes = map(lambda x: x['name'], info(ATTRIBUTE))
++	return all_attributes
++
 +def policy(policy_file):
 +    try:
 +        _policy.policy(policy_file)
@@ -341536,10 +341682,10 @@ index 0000000..a179d95
 +
 diff --git a/policycoreutils/sepolicy/sepolicy/generate.py b/policycoreutils/sepolicy/sepolicy/generate.py
 new file mode 100644
-index 0000000..6c5e482
+index 0000000..26f8390
 --- /dev/null
 +++ b/policycoreutils/sepolicy/sepolicy/generate.py
-@@ -0,0 +1,1378 @@
+@@ -0,0 +1,1354 @@
 +#!/usr/bin/python -Es
 +#
 +# Copyright (C) 2007-2012 Red Hat
@@ -341566,6 +341712,7 @@ index 0000000..6c5e482
 +import os, sys, stat
 +import re
 +import sepolicy
++from sepolicy import get_all_types, get_all_attributes, get_all_roles
 +import time
 +import yum
 +
@@ -341643,13 +341790,6 @@ index 0000000..6c5e482
 +
 +    return nvr
 +
-+all_types = None
-+def get_all_types():
-+    global all_types
-+    if all_types == None:
-+        all_types = map(lambda x: x['name'], sepolicy.info(sepolicy.TYPE))
-+    return all_types
-+
 +def get_all_ports():
 +    dict = {}
 +    for p in sepolicy.info(sepolicy.PORT):
@@ -341660,28 +341800,6 @@ index 0000000..6c5e482
 +        dict[(p['low'], p['high'], p['protocol'])]=(p['type'], p['range'])
 +    return dict
 +
-+def get_all_roles():
-+    roles = map(lambda x: x['name'], sepolicy.info(sepolicy.ROLE))
-+    roles.remove("object_r")
-+    roles.sort()
-+    return roles
-+
-+def get_all_attributes():
-+    attributes = map(lambda x: x['name'], sepolicy.info(sepolicy.ATTRIBUTE))
-+    attributes.sort()
-+    return attributes
-+
-+def get_all_domains():
-+    all_domains = []
-+    types=get_all_types()
-+    types.sort()
-+    for i in types:
-+        m = re.findall("(.*)%s" % "_exec_t$", i)
-+        if len(m) > 0:
-+            if len(re.findall("(.*)%s" % "_initrc$", m[0])) == 0 and m[0] not in all_domains:
-+                all_domains.append(m[0])
-+    return all_domains
-+
 +def get_all_users():
 +    users = map(lambda x: x['name'], sepolicy.info(sepolicy.USER))
 +    users.remove("system_u")
@@ -341770,6 +341888,7 @@ index 0000000..6c5e482
 +                self.rpms = []
 +                self.ports = []
 +                self.all_roles = get_all_roles()
++                self.types = []
 +
 +                if type not in poltype:
 +                    raise ValueError(_("You must enter a valid policy type"))
@@ -342436,10 +342555,13 @@ index 0000000..6c5e482
 +
 +	def generate_new_types(self):
 +                newte = ""
++                if len(self.types) == 0:
++                    raise ValueError(_("Type field required"))
++                    
 +                for t in self.types:
 +                    for i in self.DEFAULT_EXT:
 +                        if t.endswith(i):
-+                            newte += re.sub("TEMPLATETYPE", t[:len(i)], self.DEFAULT_EXT[i].te_types)
++                            newte += re.sub("TEMPLATETYPE", t[:-len(i)], self.DEFAULT_EXT[i].te_types)
 +                            break
 +                return newte
 +
@@ -342644,8 +342766,8 @@ index 0000000..6c5e482
 +		newfc = ""
 +                fclist = []
 +                if self.type in USERS +  [ SANDBOX ]:
-+                    return re.sub("EXECUTABLE", self.program, executable.fc_user)
-+                if self.type != NEWTYPE and self.program:
++                    return executable.fc_user
++                if self.type != NEWTYPE and not self.program:
 +                    raise ValueError(_("You must enter the executable path for your confined process"))
 +
 +                if self.program:
@@ -343007,10 +343129,10 @@ index 0000000..8b063ca
 +    return trans_list
 diff --git a/policycoreutils/sepolicy/sepolicy/manpage.py b/policycoreutils/sepolicy/sepolicy/manpage.py
 new file mode 100755
-index 0000000..a321faa
+index 0000000..25062da
 --- /dev/null
 +++ b/policycoreutils/sepolicy/sepolicy/manpage.py
-@@ -0,0 +1,1432 @@
+@@ -0,0 +1,1365 @@
 +#! /usr/bin/python -Es
 +# Copyright (C) 2012-2013 Red Hat
 +# AUTHOR: Dan Walsh <dwalsh@redhat.com>
@@ -343041,7 +343163,7 @@ index 0000000..a321faa
 +import argparse
 +import selinux
 +import sepolicy
-+from sepolicy import network, gen_bool_dict
++from sepolicy import network, gen_bool_dict, get_all_file_types, get_all_domains, get_all_roles, get_all_users, get_all_port_types, get_all_bools, get_all_attributes, get_all_role_allows
 +
 +import commands
 +import sys, os, re, time
@@ -343074,12 +343196,28 @@ index 0000000..a321faa
 +		pass
 +	return modules_dict
 +
-+all_attributes = None
-+def get_all_attributes():
-+	global all_attributes
-+	if not all_attributes:
-+		all_attributes = map(lambda x: x['name'], sepolicy.info(sepolicy.ATTRIBUTE))
-+	return all_attributes
++users = None
++users_range = None
++def get_all_users_info():
++	global users
++	global users_range
++	if users and users_range:
++		return users, users_range
++
++	users = []
++	users_range ={}
++	allusers = []
++	allusers_info = info(USER)
++
++	for d in allusers_info:
++		allusers.append(d['name'])
++		users_range[d['name'].split("_")[0]] = d['range']
++
++	for u in allusers:
++		if u not in [ "system_u", "root", "unconfined_u" ]:
++			users.append(u.replace("_u",""))
++	users.sort()
++	return users, users_range
 +
 +all_entrypoints = None
 +def get_entrypoints():
@@ -343088,25 +343226,6 @@ index 0000000..a321faa
 +		all_entrypoints =  sepolicy.info(sepolicy.ATTRIBUTE,"entry_type")[0]["types"]
 +	return all_entrypoints
 +
-+all_domains = None
-+def get_all_domains():
-+	global all_domains
-+	if not all_domains:
-+		all_domains = sepolicy.info(sepolicy.ATTRIBUTE,"domain")[0]["types"]
-+	return all_domains
-+
-+roles = None
-+def get_all_roles():
-+	global roles
-+	if roles:
-+		return roles
-+	roles = []
-+	allroles = map(lambda x: x['name'], sepolicy.info(sepolicy.ROLE))
-+	for r in allroles:
-+		if r not in [ "system_r", "object_r" ]:
-+			roles.append(r[:-2])
-+	return roles
-+
 +domains = None
 +def gen_domains():
 +	global domains
@@ -343123,9 +343242,9 @@ index 0000000..a321faa
 +		domains.append(domain)
 +
 +	for role in get_all_roles():
-+		if role in domains:
++		if role[:-2] in domains or role == "system_r":
 +			continue
-+		domains.append(role)
++		domains.append(role[:-2])
 +
 +	domains.sort()
 +	return domains
@@ -343163,45 +343282,6 @@ index 0000000..a321faa
 +	fcdict["samba_share_t"] = [ "use this label for random content that will be shared using samba" ]
 +	return fcdict
 +
-+role_allows = None
-+def get_all_role_allows():
-+	global role_allows
-+	if role_allows:
-+		return role_allows
-+	role_allows = {}
-+	for r in sepolicy.search([sepolicy.ROLE_ALLOW]):
-+		if r["source"] == "system_r" or r["target"] == "system_r":
-+			continue
-+		if r["source"] in role_allows:
-+			role_allows[r["source"]].append(r["target"])
-+		else:
-+			role_allows[r["source"]] = [ r["target"] ]
-+
-+	return role_allows
-+
-+users = None
-+users_range = None
-+def get_all_users():
-+	global users
-+	global users_range
-+	if users and users_range:
-+		return users, users_range
-+
-+	users = []
-+	users_range ={}
-+	allusers = []
-+	allusers_info = sepolicy.info(sepolicy.USER)
-+
-+	for d in allusers_info:
-+		allusers.append(d['name'])
-+		users_range[d['name'].split("_")[0]] = d['range']
-+
-+	for u in allusers:
-+		if u not in [ "system_u", "root", "unconfined_u" ]:
-+			users.append(u.replace("_u",""))
-+	users.sort()
-+	return users, users_range
-+
 +types = None
 +def _gen_types():
 +	global types
@@ -343216,31 +343296,6 @@ index 0000000..a321faa
 +			types[rec["name"]] = []
 +	return types
 +
-+file_types = None
-+def get_all_file_types():
-+	global file_types
-+	if file_types:
-+		return file_types
-+	file_types =  sepolicy.info(sepolicy.ATTRIBUTE,"file_type")[0]["types"]
-+	file_types.sort()
-+	return file_types
-+
-+port_types = None
-+def get_all_port_types():
-+	global port_types
-+	if port_types:
-+		return port_types
-+	port_types =  sepolicy.info(sepolicy.ATTRIBUTE,"port_type")[0]["types"]
-+	port_types.sort()
-+	return port_types
-+
-+bools = None
-+def get_all_bools():
-+	global bools
-+	if not bools:
-+		bools = sepolicy.info(sepolicy.BOOLEAN)
-+	return bools
-+
 +def prettyprint(f,trim):
 +    return " ".join(f[:-len(trim)].split("_"))
 +
@@ -343501,8 +343556,8 @@ index 0000000..a321faa
 +    all_bools = get_all_bools()
 +    all_port_types = get_all_port_types()
 +    all_roles = get_all_roles()
-+    all_users = get_all_users()[0]
-+    all_users_range = get_all_users()[1]
++    all_users = get_all_users_info()[0]
++    all_users_range = get_all_users_info()[1]
 +    all_file_types = get_all_file_types()
 +    types = _gen_types()
 +    modules_dict = None
@@ -343545,7 +343600,7 @@ index 0000000..a321faa
 +	self._gen_bools()
 +	self.man_page_path = "%s/%s_selinux.8" % (path, self.domainname)
 +	self.fd = open(self.man_page_path, 'w')
-+	if domainname in self.all_roles:
++	if domainname + "_r" in self.all_roles:
 +	    self.__gen_user_man_page()
 +	    if self.html:
 +		manpage_roles.append(self.man_page_path)
@@ -344756,7 +344811,7 @@ index 0000000..dcf445e
 +"""
 diff --git a/policycoreutils/sepolicy/sepolicy/templates/executable.py b/policycoreutils/sepolicy/sepolicy/templates/executable.py
 new file mode 100644
-index 0000000..092a53e
+index 0000000..4b9534d
 --- /dev/null
 +++ b/policycoreutils/sepolicy/sepolicy/templates/executable.py
 @@ -0,0 +1,454 @@
@@ -345208,7 +345263,7 @@ index 0000000..092a53e
 +"""
 +
 +fc_user="""\
-+# Users do not have file context, leave blank
++#  No file context, leave blank
 +"""
 +
 +fc_initscript="""\

policycoreutils.spec

@@ -7,7 +7,7 @@
 Summary: SELinux policy core utilities
 Name:	 policycoreutils
 Version: 2.1.13
-Release: 57%{?dist}
+Release: 58%{?dist}
 License: GPLv2
 Group:	 System Environment/Base
 # Based on git repository with tag 20101221
@@ -338,6 +338,10 @@ The policycoreutils-restorecond package contains the restorecond service.
 %{_bindir}/systemctl try-restart restorecond.service >/dev/null 2>&1 || :
 
 %changelog
+* Thu Jan 31 2013 Dan Walsh <dwalsh@redhat.com> - 2.1.12-58
+- Reorginize sepolicy so all get_all functions are in main module
+- Add -B capability to fixfiles onboot and fixfiles restore, basically searches for all files created since the last boot.
+
 * Fri Jan 25 2013 Dan Walsh <dwalsh@redhat.com> - 2.1.12-57
 - Update to latest patches from eparis/Upstream
 - fixfiles onboot will write any flags handed to it to /.autorelabel.