enable optionals in base/monolithic

refpolicy/Changelog

@@ -1,3 +1,5 @@
+- Enable optional blocks in base module and monolithic policy.
+  This requires checkpolicy 1.30.1.
 - Fix vpn module declaration.
 - Numerous fixes from Dan Walsh.
 - Change build order to preserve m4 line number information so policy

refpolicy/policy/support/loadable_module.spt

@@ -24,10 +24,16 @@ define(`policy_module',`
 # For use in interfaces, to optionally insert a require block
 #
 define(`gen_require',`
-	ifdef(`self_contained_policy',`',`
+	ifdef(`self_contained_policy',`
+		ifdef(`__in_optional_policy',`
+			require {
+				$1
+			} # end require
+		')
+	',`
 		require {
 			$1
-		}
+		} # end require
 	')
 ')
 
@@ -86,17 +92,15 @@ define(`policy_call_depth',0)
 # Optional policy handling
 #
 define(`optional_policy',`
-	ifdef(`self_contained_policy',`
+	optional {
-		ifdef(`$1.te',`$2',`$3')
+		pushdef(`__in_optional_policy') dnl
-	',`
+		$2
-		optional {
+		popdef(`__in_optional_policy') dnl
-			$2
+	ifelse(`$3',`',`',`
-		ifelse(`$3',`',`',`
+	} else {
-		} else {
+		$3
-			$3
-		')
-		}
 	')
+	}
 ')
 
 ##############################