.gitignore

@@ -1 +1 @@
-SOURCES/4.3.0.tar.gz
+SOURCES/4.4.4.tar.gz

.setools.metadata

@@ -1 +1 @@
-7b4a07a20ecee70da558bfe4ad26edf7eb6ca103 SOURCES/4.3.0.tar.gz
+384cd748118761a3197708eb75deb9e68123ceeb SOURCES/4.4.4.tar.gz

SOURCES/0001-Support-old-boolean-names-in-policy-queries.patch

@@ -1,94 +0,0 @@
-From 97bd46865e12246c00517d1e07aabca530a305ac Mon Sep 17 00:00:00 2001
-From: Vit Mojzis <vmojzis@redhat.com>
-Date: Wed, 17 Jun 2020 13:34:19 +0200
-Subject: [PATCH] Support old boolean names in policy queries
-
-Translate old boolean names based on /etc/selinux/*/booleans.subs_dist
-file. The translation is only attempted when "policy" was not specified
-to avoid influencing queries of policies from other systems.
-
-Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
----
- seinfo                        |  6 +++++-
- sesearch                      |  7 ++++++-
- setools/policyrep/selinux.pxd |  1 +
- setools/policyrep/util.pxi    | 22 ++++++++++++++++++++++
- 4 files changed, 34 insertions(+), 2 deletions(-)
-
-diff --git a/seinfo b/seinfo
-index d2caf7c..bc33e12 100755
---- a/seinfo
-+++ b/seinfo
-@@ -125,7 +125,11 @@ try:
-     if args.boolquery or args.all:
-         q = setools.BoolQuery(p)
-         if isinstance(args.boolquery, str):
--            q.name = args.boolquery
-+            if args.policy:
-+                q.name = args.boolquery
-+            else:
-+                # try to find substitutions for old boolean names
-+                q.name = setools.policyrep.lookup_boolean_name_sub(args.boolquery)
- 
-         components.append(("Booleans", q, lambda x: x.statement()))
- 
-diff --git a/sesearch b/sesearch
-index c4b1d38..733f3d3 100755
---- a/sesearch
-+++ b/sesearch
-@@ -189,7 +189,12 @@ try:
-             if args.boolean_regex:
-                 q.boolean = args.boolean
-             else:
--                q.boolean = args.boolean.split(",")
-+                if args.policy:
-+                    q.boolean = args.boolean.split(",")
-+                else:
-+                    # try to find substitutions for old boolean names
-+                    q.boolean = map(setools.policyrep.lookup_boolean_name_sub,
-+                                    args.boolean.split(","))
- 
-         for r in sorted(q.results()):
-             print(r)
-diff --git a/setools/policyrep/selinux.pxd b/setools/policyrep/selinux.pxd
-index a2e8af0..1686831 100644
---- a/setools/policyrep/selinux.pxd
-+++ b/setools/policyrep/selinux.pxd
-@@ -24,3 +24,4 @@ cdef extern from "<selinux/selinux.h>":
-     bint selinuxfs_exists()
-     const char* selinux_current_policy_path()
-     const char* selinux_binary_policy_path()
-+    char* selinux_boolean_sub(const char *boolean_name);
-diff --git a/setools/policyrep/util.pxi b/setools/policyrep/util.pxi
-index 40f21a7..abc7be8 100644
---- a/setools/policyrep/util.pxi
-+++ b/setools/policyrep/util.pxi
-@@ -230,3 +230,25 @@ cdef flatten_list(input_list):
-             ret.append(i)
- 
-     return ret
-+
-+
-+def lookup_boolean_name_sub(name):
-+    """
-+    Read the /etc/selinux/TYPE/booleans.subs_dist file looking
-+    for a record with 'name'.
-+    Return the translated name if a corresponding substitution exists,
-+    otherwise return the original name.
-+    """
-+    cdef:
-+        char *_name = selinux.selinux_boolean_sub(name)
-+        str new_name = name
-+
-+    if _name == NULL:
-+        raise MemoryError
-+    # cast "char *" to "str" and free
-+    try:
-+        new_name = _name
-+    finally:
-+        free(_name)
-+
-+    return new_name
--- 
-2.25.4
-

SOURCES/0002-Make-seinfo-output-predictable.patch

@@ -1,90 +0,0 @@
-From 4e6f6c95cfe7ca4a3a9d9e0dbd6e23e4bac2449c Mon Sep 17 00:00:00 2001
-From: Petr Lautrbach <plautrba@redhat.com>
-Date: Thu, 18 Nov 2021 13:59:08 +0100
-Subject: [PATCH] Make seinfo output predictable
-
-There are few places where frozenset is used. Given that frozenset is an unordered
-collection the output generated from this is unpredictable.
-
-The following command outputs are fixed using sorted() on frozensets:
-
-    seinfo --constrain
-    seinfo --common
-    seinfo -c -x
-    seinfo -r -x
-    seinfo -u -x
-
-Fixes: https://github.com/SELinuxProject/setools/issues/65
-
-Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
----
- setools/policyrep/constraint.pxi | 2 +-
- setools/policyrep/objclass.pxi   | 4 ++--
- setools/policyrep/role.pxi       | 2 +-
- setools/policyrep/user.pxi       | 2 +-
- 4 files changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/setools/policyrep/constraint.pxi b/setools/policyrep/constraint.pxi
-index d5221a1..77c3e2e 100644
---- a/setools/policyrep/constraint.pxi
-+++ b/setools/policyrep/constraint.pxi
-@@ -66,7 +66,7 @@ cdef class Constraint(BaseConstraint):
- 
-     def statement(self):
-         if len(self.perms) > 1:
--            perms = "{{ {0} }}".format(' '.join(self.perms))
-+            perms = "{{ {0} }}".format(' '.join(sorted(self.perms)))
-         else:
-             # convert to list since sets cannot be indexed
-             perms = list(self.perms)[0]
-diff --git a/setools/policyrep/objclass.pxi b/setools/policyrep/objclass.pxi
-index b7ec7b7..8ed2be5 100644
---- a/setools/policyrep/objclass.pxi
-+++ b/setools/policyrep/objclass.pxi
-@@ -75,7 +75,7 @@ cdef class Common(PolicySymbol):
-         return other in self.perms
- 
-     def statement(self):
--        return "common {0}\n{{\n\t{1}\n}}".format(self, '\n\t'.join(self.perms))
-+        return "common {0}\n{{\n\t{1}\n}}".format(self, '\n\t'.join(sorted(self.perms)))
- 
- 
- cdef class ObjClass(PolicySymbol):
-@@ -204,7 +204,7 @@ cdef class ObjClass(PolicySymbol):
- 
-         # a class that inherits may not have additional permissions
-         if len(self.perms) > 0:
--            stmt += "{{\n\t{0}\n}}".format('\n\t'.join(self.perms))
-+            stmt += "{{\n\t{0}\n}}".format('\n\t'.join(sorted(self.perms)))
- 
-         return stmt
- 
-diff --git a/setools/policyrep/role.pxi b/setools/policyrep/role.pxi
-index 9a0dd39..3af8a3f 100644
---- a/setools/policyrep/role.pxi
-+++ b/setools/policyrep/role.pxi
-@@ -58,7 +58,7 @@ cdef class Role(PolicySymbol):
-         if count == 1:
-             stmt += " types {0}".format(types[0])
-         else:
--            stmt += " types {{ {0} }}".format(' '.join(types))
-+            stmt += " types {{ {0} }}".format(' '.join(sorted(types)))
- 
-         stmt += ";"
-         return stmt
-diff --git a/setools/policyrep/user.pxi b/setools/policyrep/user.pxi
-index 9c82aa9..e37af29 100644
---- a/setools/policyrep/user.pxi
-+++ b/setools/policyrep/user.pxi
-@@ -81,7 +81,7 @@ cdef class User(PolicySymbol):
-         if count == 1:
-             stmt += roles[0]
-         else:
--            stmt += "{{ {0} }}".format(' '.join(roles))
-+            stmt += "{{ {0} }}".format(' '.join(sorted(roles)))
- 
-         if self._level:
-             stmt += " level {0.mls_level} range {0.mls_range};".format(self)
--- 
-2.30.2
-

SOURCES/0003-Disable-remove-neverallow-options-in-frontends.patch

@@ -1,114 +0,0 @@
-From 92b692452d07d67b1d901baf36798cab8e36077a Mon Sep 17 00:00:00 2001
-From: Chris PeBenito <chpebeni@linux.microsoft.com>
-Date: Mon, 3 Apr 2023 09:13:31 -0400
-Subject: [PATCH] Disable/remove neverallow options in frontends.
-
-These rules are not available in the binary policy. Keep library support in
-case this changes in the future.
-
-Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com>
----
- man/ru/sesearch.1              |  4 ----
- man/sesearch.1                 |  4 ----
- sesearch                       | 12 ++++++------
- setoolsgui/apol/terulequery.ui | 12 ++++++++++++
- 4 files changed, 18 insertions(+), 14 deletions(-)
-
-diff --git a/man/ru/sesearch.1 b/man/ru/sesearch.1
-index df6f449..2f86f9c 100644
---- a/man/ru/sesearch.1
-+++ b/man/ru/sesearch.1
-@@ -35,16 +35,12 @@ sesearch \- утилита опроса политики SELinux
- Найти правила включения журналирования событий.
- .IP "--dontaudit"
- Найти правила запрета журналирования событий.
--.IP "--neverallow"
--Найти запрещающие правила.
- .IP "--allowxperm"
- Найти расширенные разрешительные правила.
- .IP "--auditallowxperm"
- Найти расширенные правила включения журналирования событий.
- .IP "--dontauditxperm"
- Найти расширенные правила запрета журналирования событий.
--.IP "--neverallowxperm"
--Найти расширенные запрещающие правила.
- .IP "-T, --type_trans"
- Найти правила перехода типов.
- .IP "--type_member"
-diff --git a/man/sesearch.1 b/man/sesearch.1
-index 65eebf9..97e9110 100644
---- a/man/sesearch.1
-+++ b/man/sesearch.1
-@@ -30,16 +30,12 @@ Find allow rules.
- Find auditallow rules.
- .IP "--dontaudit"
- Find dontaudit rules.
--.IP "--neverallow"
--Find neverallow rules.
- .IP "--allowxperm"
- Find allowxperm rules.
- .IP "--auditallowxperm"
- Find auditallowxperm rules.
- .IP "--dontauditxperm"
- Find dontauditxperm rules.
--.IP "--neverallowxperm"
--Find neverallowxperm rules.
- .IP "-T, --type_trans"
- Find type_transition rules.
- .IP "--type_member"
-diff --git a/sesearch b/sesearch
-index 733f3d3..7caa41d 100755
---- a/sesearch
-+++ b/sesearch
-@@ -54,12 +54,12 @@ rtypes.add_argument("--dontaudit", action="append_const",
- rtypes.add_argument("--dontauditxperm", action="append_const",
-                     const=setools.TERuletype.dontauditxperm, dest="tertypes",
-                     help="Search dontauditxperm rules.")
--rtypes.add_argument("--neverallow", action="append_const",
--                    const=setools.TERuletype.neverallow, dest="tertypes",
--                    help="Search neverallow rules.")
--rtypes.add_argument("--neverallowxperm", action="append_const",
--                    const=setools.TERuletype.neverallowxperm, dest="tertypes",
--                    help="Search neverallowxperm rules.")
-+# rtypes.add_argument("--neverallow", action="append_const",
-+#                    const=setools.TERuletype.neverallow, dest="tertypes",
-+#                    help="Search neverallow rules.")
-+# rtypes.add_argument("--neverallowxperm", action="append_const",
-+#                    const=setools.TERuletype.neverallowxperm, dest="tertypes",
-+#                    help="Search neverallowxperm rules.")
- rtypes.add_argument("-T", "--type_trans", action="append_const",
-                     const=setools.TERuletype.type_transition, dest="tertypes",
-                     help="Search type_transition rules.")
-diff --git a/setoolsgui/apol/terulequery.ui b/setoolsgui/apol/terulequery.ui
-index 950c590..6c6f14f 100644
---- a/setoolsgui/apol/terulequery.ui
-+++ b/setoolsgui/apol/terulequery.ui
-@@ -465,6 +465,12 @@
-           </item>
-           <item row="0" column="1">
-            <widget class="QCheckBox" name="neverallow">
-+            <property name="enabled">
-+             <bool>false</bool>
-+            </property>
-+            <property name="toolTip">
-+             <string>Neverallow is not available in binary policies.</string>
-+            </property>
-             <property name="text">
-              <string>Neverallow</string>
-             </property>
-@@ -482,6 +488,12 @@
-           </item>
-           <item row="1" column="1">
-            <widget class="QCheckBox" name="neverallowxperm">
-+            <property name="enabled">
-+             <bool>false</bool>
-+            </property>
-+            <property name="toolTip">
-+             <string>Neverallowxperms is not available in binary policies.</string>
-+            </property>
-             <property name="text">
-              <string>Neverallowxperms</string>
-             </property>
--- 
-2.40.0
-

SOURCES/0004-Disable-remove-neverallow-options-in-sediff.patch

@@ -1,91 +0,0 @@
-From 158283058160f4ae40d0b215e0ff2e5045de5a28 Mon Sep 17 00:00:00 2001
-From: Petr Lautrbach <lautrbach@redhat.com>
-Date: Tue, 9 May 2023 19:22:01 +0200
-Subject: [PATCH] Disable/remove neverallow options in sediff.
-
-Apply change from commit 06335957b701 ("Disable/remove neverallow
-options in frontends.") to sediff
-
-Signed-off-by: Petr Lautrbach <lautrbach@redhat.com>
----
- man/ru/sediff.1 |  4 ----
- man/sediff.1    |  4 ----
- sediff          | 10 +++++++---
- 3 files changed, 7 insertions(+), 11 deletions(-)
-
-diff --git a/man/ru/sediff.1 b/man/ru/sediff.1
-index c6bf293..af5d8ef 100644
---- a/man/ru/sediff.1
-+++ b/man/ru/sediff.1
-@@ -57,16 +57,12 @@ sediff \- утилита выявления различий политик SELi
- Найти различия правил включения журналирования событий.
- .IP "--dontaudit"
- Найти различия правил запрета журналирования событий.
--.IP "--neverallow"
--Найти различия запрещающих правил.
- .IP "--allowxperm"
- Найти различия расширенных разрешительных правил.
- .IP "--auditallowxperm"
- Найти различия расширенных правил включения журналирования событий.
- .IP "--dontauditxperm"
- Найти различия расширенных правил запрета журналирования событий.
--.IP "--neverallowxperm"
--Найти различия расширенных запрещающих правил.
- .IP "-T, --type_trans"
- Найти различия правил перехода типов.
- .IP "--type_member"
-diff --git a/man/sediff.1 b/man/sediff.1
-index ed3b497..18466d8 100644
---- a/man/sediff.1
-+++ b/man/sediff.1
-@@ -50,16 +50,12 @@ Find differences in allow rules.
- Find differences in auditallow rules.
- .IP "--dontaudit"
- Find differences in dontaudit rules.
--.IP "--neverallow"
--Find differences in neverallow rules.
- .IP "--allowxperm"
- Find differences in allowxperm rules.
- .IP "--auditallowxperm"
- Find differences in auditallowxperm rules.
- .IP "--dontauditxperm"
- Find differences in dontauditxperm rules.
--.IP "--neverallowxperm"
--Find differences in neverallowxperm rules.
- .IP "-T, --type_trans"
- Find differences in type_transition rules.
- .IP "--type_member"
-diff --git a/sediff b/sediff
-index d31fa3a..93af837 100755
---- a/sediff
-+++ b/sediff
-@@ -57,12 +57,12 @@ comp.add_argument("--level", action="store_true", help="Print MLS level definiti
- terule = parser.add_argument_group("type enforcement rule differences")
- terule.add_argument("-A", action="store_true", help="Print allow and allowxperm rule differences")
- terule.add_argument("--allow", action="store_true", help="Print allow rule differences")
--terule.add_argument("--neverallow", action="store_true", help="Print neverallow rule differences")
-+# terule.add_argument("--neverallow", action="store_true", help="Print neverallow rule differences")
- terule.add_argument("--auditallow", action="store_true", help="Print auditallow rule differences")
- terule.add_argument("--dontaudit", action="store_true", help="Print dontaudit rule differences")
- terule.add_argument("--allowxperm", action="store_true", help="Print allowxperm rule differences")
--terule.add_argument("--neverallowxperm", action="store_true",
--                    help="Print neverallowxperm rule differences")
-+# terule.add_argument("--neverallowxperm", action="store_true",
-+#                     help="Print neverallowxperm rule differences")
- terule.add_argument("--auditallowxperm", action="store_true",
-                     help="Print auditallowxperm rule differences")
- terule.add_argument("--dontauditxperm", action="store_true",
-@@ -109,6 +109,10 @@ other.add_argument("--typebounds", action="store_true", help="Print typebounds d
- 
- args = parser.parse_args()
- 
-+# neverallow and neverallowxperm options are disabled
-+args.neverallow = False
-+args.neverallowxperm = False
-+
- if args.A:
-     args.allow = True
-     args.allowxperm = True
--- 
-2.41.0
-

SOURCES/0005-AVRuleXperm-Fix-permission-set-creation-for-AVTAB_XP.patch

@@ -1,259 +0,0 @@
-From ec4f5e19ea94e42416fda103d94118577eb18b95 Mon Sep 17 00:00:00 2001
-From: Chris PeBenito <chpebeni@linux.microsoft.com>
-Date: Tue, 30 Aug 2022 13:58:54 -0400
-Subject: [PATCH] AVRuleXperm: Fix permission set creation for
- AVTAB_XPERMS_IOCTLDRIVER.
-
-Closes #74
-
-Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com>
----
- setools/policyrep/terule.pxi        |   8 +-
- tests/policyrep/terule.py           |  26 +++++
- tests/policyrep/terule_issue74.conf | 159 ++++++++++++++++++++++++++++
- 3 files changed, 189 insertions(+), 4 deletions(-)
- create mode 100644 tests/policyrep/terule_issue74.conf
-
-diff --git a/setools/policyrep/terule.pxi b/setools/policyrep/terule.pxi
-index 59aeea5..8b2659b 100644
---- a/setools/policyrep/terule.pxi
-+++ b/setools/policyrep/terule.pxi
-@@ -282,22 +282,22 @@ cdef class AVRuleXperm(BaseTERule):
-             set perms = set()
-             size_t curr = 0
-             size_t len = sizeof(xperms.perms) * sepol.EXTENDED_PERMS_LEN
-+            size_t base_value = 0
- 
-         #
-         # Build permission set
-         #
--        while curr < len:
-+        for curr in range(len):
-             if sepol.xperm_test(curr, xperms.perms):
-                 if xperms.specified & sepol.AVTAB_XPERMS_IOCTLFUNCTION:
-                     perms.add(xperms.driver << 8 | curr)
-                 elif xperms.specified & sepol.AVTAB_XPERMS_IOCTLDRIVER:
--                    perms.add(curr << 8)
-+                    base_value = curr << 8
-+                    perms.update(range(base_value, base_value + 0x100))
-                 else:
-                     raise LowLevelPolicyError("Unknown extended permission: {}".format(
-                                               xperms.specified))
- 
--            curr += 1
--
-         #
-         # Determine xperm type
-         #
-diff --git a/tests/policyrep/terule.py b/tests/policyrep/terule.py
-index 0f24054..30afd4b 100644
---- a/tests/policyrep/terule.py
-+++ b/tests/policyrep/terule.py
-@@ -24,6 +24,8 @@ from setools import SELinuxPolicy
- from setools.exception import InvalidTERuleType, RuleNotConditional, RuleUseError, \
-     TERuleNoFilename
- 
-+from .util import compile_policy
-+
- 
- @unittest.skip("Needs to be reworked for cython")
- @patch('setools.policyrep.boolcond.condexpr_factory', lambda x, y: y)
-@@ -262,6 +264,30 @@ class AVRuleXpermTest(unittest.TestCase):
-         self.assertEqual(rule.statement(), "allowxperm a b:c d { 0x0003-0x0005 0x0007-0x0009 };")
- 
- 
-+class AVRuleXpermTestIssue74(unittest.TestCase):
-+
-+    """
-+    Regression test for xperm ranges starting with 0x00 not being loaded.
-+    https://github.com/SELinuxProject/setools/issues/74
-+    """
-+
-+    @classmethod
-+    def setUpClass(cls):
-+        cls.p = compile_policy("tests/policyrep/terule_issue74.conf")
-+
-+    def test_issue74_regression(self):
-+        """Regression test for GitHub issue 74."""
-+        rules = sorted(self.p.terules())
-+        print(rules)
-+        self.assertEqual(2, len(rules))
-+
-+        # expect 2 rules:
-+        # allowxperm init_type_t init_type_t : unix_dgram_socket ioctl { 0x8910 };
-+        # allowxperm init_type_t init_type_t : unix_dgram_socket ioctl { 0x0-0xff };
-+        self.assertSetEqual(set(range(0x100)), rules[0].perms)
-+        self.assertSetEqual(set([0x8910]), rules[1].perms)
-+
-+
- @unittest.skip("Needs to be reworked for cython")
- @patch('setools.policyrep.boolcond.condexpr_factory', lambda x, y: y)
- @patch('setools.policyrep.typeattr.type_factory', lambda x, y: y)
-diff --git a/tests/policyrep/terule_issue74.conf b/tests/policyrep/terule_issue74.conf
-new file mode 100644
-index 0000000..158a38e
---- /dev/null
-+++ b/tests/policyrep/terule_issue74.conf
-@@ -0,0 +1,159 @@
-+class infoflow
-+class infoflow2
-+class infoflow3
-+class infoflow4
-+class infoflow5
-+class infoflow6
-+class infoflow7
-+class infoflow8
-+class infoflow9
-+class infoflow10
-+class unix_dgram_socket
-+
-+sid kernel
-+sid security
-+
-+common infoflow
-+{
-+	low_w
-+	med_w
-+	hi_w
-+	low_r
-+	med_r
-+	hi_r
-+}
-+
-+common com_a
-+{
-+    hi_w
-+    hi_r
-+    super_r
-+    super_w
-+}
-+
-+common com_b
-+{
-+    send
-+    recv
-+}
-+
-+common com_c
-+{
-+    getattr
-+    setattr
-+    read
-+    write
-+}
-+
-+class infoflow
-+inherits infoflow
-+
-+class infoflow2
-+inherits infoflow
-+{
-+	super_w
-+	super_r
-+}
-+
-+class infoflow3
-+{
-+	null
-+}
-+
-+class infoflow4
-+inherits infoflow
-+{
-+	super_w
-+	super_r
-+	super_none
-+	super_both
-+	super_unmapped
-+}
-+
-+class infoflow5
-+inherits com_a
-+
-+class infoflow6
-+inherits com_b
-+
-+class infoflow7
-+inherits infoflow
-+{
-+    unmapped
-+}
-+
-+class infoflow8
-+{
-+	super_w
-+	super_r
-+}
-+
-+class infoflow9
-+inherits com_c
-+
-+class infoflow10
-+{
-+    read
-+    write
-+}
-+
-+class unix_dgram_socket
-+{
-+    ioctl
-+}
-+
-+sensitivity low_s;
-+sensitivity medium_s alias med;
-+sensitivity high_s;
-+
-+dominance { low_s med high_s }
-+
-+category here;
-+category there;
-+category elsewhere alias lost;
-+
-+#level decl
-+level low_s:here.there;
-+level med:here, elsewhere;
-+level high_s:here.lost;
-+
-+#some constraints
-+mlsconstrain infoflow hi_r ((l1 dom l2) or (t1 == mls_exempt));
-+
-+attribute mls_exempt;
-+
-+type system;
-+role system;
-+role system types system;
-+
-+type init_type_t;
-+allowxperm init_type_t self:unix_dgram_socket ioctl 0x8910;
-+allowxperm init_type_t self:unix_dgram_socket ioctl { 0x0000 - 0x00ff };
-+
-+#users
-+user system roles system level med range low_s - high_s:here.lost;
-+
-+#normal constraints
-+constrain infoflow hi_w (u1 == u2);
-+
-+#isids
-+sid kernel system:system:system:medium_s:here
-+sid security system:system:system:high_s:lost
-+
-+#fs_use
-+fs_use_trans devpts system:object_r:system:low_s;
-+fs_use_xattr ext3 system:object_r:system:low_s;
-+fs_use_task pipefs system:object_r:system:low_s;
-+
-+#genfscon
-+genfscon proc / system:object_r:system:med
-+genfscon proc /sys system:object_r:system:low_s
-+genfscon selinuxfs / system:object_r:system:high_s:here.there
-+
-+portcon tcp 80 system:object_r:system:low_s
-+
-+netifcon eth0 system:object_r:system:low_s system:object_r:system:low_s
-+
-+nodecon 127.0.0.1 255.255.255.255 system:object_r:system:low_s:here
-+nodecon ::1 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff system:object_r:system:low_s:here
-+
--- 
-2.41.0
-

SOURCES/1001-Do-not-use-Werror-during-build.patch

@@ -1,49 +0,0 @@
-From 8d98b324fabcad6b09f9c734f79e6da9f9e85786 Mon Sep 17 00:00:00 2001
-From: rpm-build <rpm-build>
-Date: Thu, 23 Feb 2017 08:17:07 +0100
-Subject: [PATCH] Do not use -Werror during build
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-There are new warnings when setools are built with gcc 7 therefore we
-want to suppress -Werror for now
-
-Fixes:
-libqpol/policy_extend.c: In function ‘policy_extend’:
-libqpol/policy_extend.c:161:27: error: ‘%04zd’ directive output may be truncated writing between 4 and 10 bytes into a region of size 5 [-Werror=format-truncation=]
-    snprintf(buff, 9, "@ttr%04zd", i + 1);
-                           ^~~~~
-libqpol/policy_extend.c:161:22: note: directive argument in the range [1, 4294967295]
-    snprintf(buff, 9, "@ttr%04zd", i + 1);
-                      ^~~~~~~~~~~
-In file included from /usr/include/stdio.h:939:0,
-                 from /usr/include/sepol/policydb/policydb.h:53,
-                 from libqpol/policy_extend.c:29:
-/usr/include/bits/stdio2.h:64:10: note: ‘__builtin___snprintf_chk’ output between 9 and 15 bytes into a destination of size 9
-   return __builtin___snprintf_chk (__s, __n, __USE_FORTIFY_LEVEL - 1,
-          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-        __bos (__s), __fmt, __va_arg_pack ());
-        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-cc1: all warnings being treated as errors
-error: command 'gcc' failed with exit status 1
----
- setup.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/setup.py b/setup.py
-index 457c830..4dcb301 100644
---- a/setup.py
-+++ b/setup.py
-@@ -106,7 +106,7 @@ ext_py_mods = [Extension('setools.policyrep', ['setools/policyrep.pyx'],
-                          libraries=['selinux', 'sepol'],
-                          library_dirs=lib_dirs,
-                          define_macros=macros,
--                         extra_compile_args=['-Werror', '-Wextra',
-+                         extra_compile_args=['-Wextra',
-                                              '-Waggregate-return',
-                                              '-Wfloat-equal',
-                                              '-Wformat', '-Wformat=2',
--- 
-2.25.1
-

SOURCES/1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch

@@ -1,139 +0,0 @@
-From 52f5f911c4ae481530a57b6a0dd42067406a9d36 Mon Sep 17 00:00:00 2001
-From: Vit Mojzis <vmojzis@redhat.com>
-Date: Fri, 26 Apr 2019 15:27:25 +0200
-Subject: [PATCH] Do not export/use setools.InfoFlowAnalysis and
- setools.DomainTransitionAnalysis
-
-dta and infoflow modules require networkx which brings lot of dependencies.
-These dependencies are not necessary for setools module itself as it's
-used in policycoreutils.
-
-Therefore it's better to use setools.infoflow.InfoFlowAnalysis and
-setools.dta.DomainTransitionAnalysis and let the package containing
-sedta and seinfoflow to require python3-networkx
----
- sedta                       | 4 ++--
- seinfoflow                  | 4 ++--
- setools/__init__.py         | 4 ----
- setoolsgui/apol/dta.py      | 2 +-
- setoolsgui/apol/infoflow.py | 2 +-
- tests/dta.py                | 2 +-
- tests/infoflow.py           | 2 +-
- 7 files changed, 8 insertions(+), 12 deletions(-)
-
-diff --git a/sedta b/sedta
-index 60861ca..41e38a2 100755
---- a/sedta
-+++ b/sedta
-@@ -22,7 +22,7 @@ import argparse
- import logging
- import signal
- 
--import setools
-+import setools.dta
- 
- 
- def print_transition(trans):
-@@ -114,7 +114,7 @@ else:
- 
- try:
-     p = setools.SELinuxPolicy(args.policy)
--    g = setools.DomainTransitionAnalysis(p, reverse=args.reverse, exclude=args.exclude)
-+    g = setools.dta.DomainTransitionAnalysis(p, reverse=args.reverse, exclude=args.exclude)
- 
-     if args.shortest_path or args.all_paths:
-         if args.shortest_path:
-diff --git a/seinfoflow b/seinfoflow
-index f10c39d..fee749a 100755
---- a/seinfoflow
-+++ b/seinfoflow
-@@ -17,7 +17,7 @@
- # along with SETools.  If not, see <http://www.gnu.org/licenses/>.
- #
- 
--import setools
-+import setools.infoflow
- import argparse
- import sys
- import logging
-@@ -101,7 +101,7 @@ elif args.booleans is not None:
- try:
-     p = setools.SELinuxPolicy(args.policy)
-     m = setools.PermissionMap(args.map)
--    g = setools.InfoFlowAnalysis(p, m, min_weight=args.min_weight, exclude=args.exclude,
-+    g = setools.infoflow.InfoFlowAnalysis(p, m, min_weight=args.min_weight, exclude=args.exclude,
-                                  booleans=booleans)
- 
-     if args.shortest_path or args.all_paths:
-diff --git a/setools/__init__.py b/setools/__init__.py
-index 26fa5aa..b7e51c4 100644
---- a/setools/__init__.py
-+++ b/setools/__init__.py
-@@ -75,12 +75,8 @@ from .pcideviceconquery import PcideviceconQuery
- from .devicetreeconquery import DevicetreeconQuery
- 
- # Information Flow Analysis
--from .infoflow import InfoFlowAnalysis
- from .permmap import PermissionMap
- 
--# Domain Transition Analysis
--from .dta import DomainTransitionAnalysis
--
- # Policy difference
- from .diff import PolicyDifference
- 
-diff --git a/setoolsgui/apol/dta.py b/setoolsgui/apol/dta.py
-index 4608b9d..2cde44c 100644
---- a/setoolsgui/apol/dta.py
-+++ b/setoolsgui/apol/dta.py
-@@ -23,7 +23,7 @@ from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread
- from PyQt5.QtGui import QPalette, QTextCursor
- from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog, \
-     QTreeWidgetItem
--from setools import DomainTransitionAnalysis
-+from setools.dta import DomainTransitionAnalysis
- 
- from ..logtosignal import LogHandlerToSignal
- from .analysistab import AnalysisTab
-diff --git a/setoolsgui/apol/infoflow.py b/setoolsgui/apol/infoflow.py
-index 7bca299..7fee277 100644
---- a/setoolsgui/apol/infoflow.py
-+++ b/setoolsgui/apol/infoflow.py
-@@ -26,7 +26,7 @@ from PyQt5.QtCore import pyqtSignal, Qt, QStringListModel, QThread
- from PyQt5.QtGui import QPalette, QTextCursor
- from PyQt5.QtWidgets import QCompleter, QHeaderView, QMessageBox, QProgressDialog, \
-     QTreeWidgetItem
--from setools import InfoFlowAnalysis
-+from setools.infoflow import InfoFlowAnalysis
- from setools.exception import UnmappedClass, UnmappedPermission
- 
- from ..logtosignal import LogHandlerToSignal
-diff --git a/tests/dta.py b/tests/dta.py
-index a0cc938..177e6fb 100644
---- a/tests/dta.py
-+++ b/tests/dta.py
-@@ -18,7 +18,7 @@
- import os
- import unittest
- 
--from setools import DomainTransitionAnalysis
-+from setools.dta import DomainTransitionAnalysis
- from setools import TERuletype as TERT
- from setools.exception import InvalidType
- from setools.policyrep import Type
-diff --git a/tests/infoflow.py b/tests/infoflow.py
-index aa0e44a..fca2848 100644
---- a/tests/infoflow.py
-+++ b/tests/infoflow.py
-@@ -18,7 +18,7 @@
- import os
- import unittest
- 
--from setools import InfoFlowAnalysis
-+from setools.infoflow import InfoFlowAnalysis
- from setools import TERuletype as TERT
- from setools.exception import InvalidType
- from setools.permmap import PermissionMap
--- 
-2.25.1
-

SOURCES/1003-Require-networkx-on-package-level.patch

@@ -1,24 +0,0 @@
-From 67067b6df7139cc38cf33d3cb2c66434cf4e89e4 Mon Sep 17 00:00:00 2001
-From: Petr Lautrbach <plautrba@redhat.com>
-Date: Thu, 2 Apr 2020 16:06:14 +0200
-Subject: [PATCH] Require networkx on package level
-
-It allows us to ship python3-setools without dependency on python3-networkx
----
- setup.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/setup.py b/setup.py
-index 4dcb301..9333e0c 100644
---- a/setup.py
-+++ b/setup.py
-@@ -170,5 +170,5 @@ setup(name='setools',
-       # setup also requires libsepol and libselinux
-       # C libraries and headers to compile.
-       setup_requires=['setuptools', 'Cython>=0.27'],
--      install_requires=['setuptools', 'networkx>=2.0']
-+      install_requires=['setuptools']
-       )
--- 
-2.25.1
-

SOURCES/1004-Do-not-use-NoteNotFound-as-it-s-not-implemented-in-n.patch

@@ -1,93 +0,0 @@
-From d249ea3316fcfaa203055d2b1f2c52423216e7e7 Mon Sep 17 00:00:00 2001
-From: Petr Lautrbach <plautrba@redhat.com>
-Date: Tue, 30 Jul 2019 17:13:44 +0200
-Subject: [PATCH] Do not use NoteNotFound as it's not implemented in networkx-1
-
----
- setools/dta.py      | 8 ++++----
- setools/infoflow.py | 8 ++++----
- 2 files changed, 8 insertions(+), 8 deletions(-)
-
-diff --git a/setools/dta.py b/setools/dta.py
-index 3239d2d..e15d8b8 100644
---- a/setools/dta.py
-+++ b/setools/dta.py
-@@ -24,7 +24,7 @@ from collections import defaultdict, namedtuple
- from contextlib import suppress
- 
- import networkx as nx
--from networkx.exception import NetworkXError, NetworkXNoPath, NodeNotFound
-+from networkx.exception import NetworkXError, NetworkXNoPath
- 
- from .descriptors import EdgeAttrDict, EdgeAttrList
- from .policyrep import TERuletype
-@@ -111,7 +111,7 @@ class DomainTransitionAnalysis:
- 
-         self.log.info("Generating one domain transition path from {0} to {1}...".format(s, t))
- 
--        with suppress(NetworkXNoPath, NodeNotFound):
-+        with suppress(NetworkXNoPath):
-             # NodeNotFound: the type is valid but not in graph, e.g. excluded
-             # NetworkXNoPath: no paths or the target type is
-             # not in the graph
-@@ -146,7 +146,7 @@ class DomainTransitionAnalysis:
-         self.log.info("Generating all domain transition paths from {0} to {1}, max length {2}...".
-                       format(s, t, maxlen))
- 
--        with suppress(NetworkXNoPath, NodeNotFound):
-+        with suppress(NetworkXNoPath):
-             # NodeNotFound: the type is valid but not in graph, e.g. excluded
-             # NetworkXNoPath: no paths or the target type is
-             # not in the graph
-@@ -177,7 +177,7 @@ class DomainTransitionAnalysis:
-         self.log.info("Generating all shortest domain transition paths from {0} to {1}...".
-                       format(s, t))
- 
--        with suppress(NetworkXNoPath, NodeNotFound):
-+        with suppress(NetworkXNoPath):
-             # NodeNotFound: the type is valid but not in graph, e.g. excluded
-             # NetworkXNoPath: no paths or the target type is
-             # not in the graph
-diff --git a/setools/infoflow.py b/setools/infoflow.py
-index 579e064..89e5c8e 100644
---- a/setools/infoflow.py
-+++ b/setools/infoflow.py
-@@ -21,7 +21,7 @@ import logging
- from contextlib import suppress
- 
- import networkx as nx
--from networkx.exception import NetworkXError, NetworkXNoPath, NodeNotFound
-+from networkx.exception import NetworkXError, NetworkXNoPath
- 
- from .descriptors import EdgeAttrIntMax, EdgeAttrList
- from .exception import RuleNotConditional
-@@ -124,7 +124,7 @@ class InfoFlowAnalysis:
-         self.log.info("Generating one shortest information flow path from {0} to {1}...".
-                       format(s, t))
- 
--        with suppress(NetworkXNoPath, NodeNotFound):
-+        with suppress(NetworkXNoPath):
-             # NodeNotFound: the type is valid but not in graph, e.g.
-             # excluded or disconnected due to min weight
-             # NetworkXNoPath: no paths or the target type is
-@@ -163,7 +163,7 @@ class InfoFlowAnalysis:
-         self.log.info("Generating all information flow paths from {0} to {1}, max length {2}...".
-                       format(s, t, maxlen))
- 
--        with suppress(NetworkXNoPath, NodeNotFound):
-+        with suppress(NetworkXNoPath):
-             # NodeNotFound: the type is valid but not in graph, e.g.
-             # excluded or disconnected due to min weight
-             # NetworkXNoPath: no paths or the target type is
-@@ -197,7 +197,7 @@ class InfoFlowAnalysis:
-         self.log.info("Generating all shortest information flow paths from {0} to {1}...".
-                       format(s, t))
- 
--        with suppress(NetworkXNoPath, NodeNotFound):
-+        with suppress(NetworkXNoPath):
-             # NodeNotFound: the type is valid but not in graph, e.g.
-             # excluded or disconnected due to min weight
-             # NetworkXNoPath: no paths or the target type is
--- 
-2.25.1
-

SPECS/setools.spec

@@ -1,34 +1,20 @@
-# % global setools_pre_ver rc
+%global sepol_ver 3.5-1
-# % global gitver f1e5b20
+%global selinux_ver 3.5-1
-
-%global sepol_ver 2.9-1
-%global selinux_ver 2.9-1
-
-%bcond_without     networkx
 
 Name:           setools
-Version:        4.3.0
+Version:        4.4.4
-Release:        5%{?setools_pre_ver:.%{setools_pre_ver}}%{?dist}
+Release:        1%{?dist}
 Summary:        Policy analysis tools for SELinux
 
-License:        GPLv2
+License:        GPL-2.0-only and LGPL-2.1-only
 URL:            https://github.com/SELinuxProject/setools/wiki
-Source0:        https://github.com/SELinuxProject/setools/archive/%{version}%{?setools_pre_ver:-%{setools_pre_ver}}.tar.gz
+Source0:        https://github.com/SELinuxProject/setools/archive/%{version}.tar.gz
 Source1:        setools.pam
 Source2:        apol.desktop
-Patch0001:      0001-Support-old-boolean-names-in-policy-queries.patch
-Patch0002:      0002-Make-seinfo-output-predictable.patch
-Patch0003:      0003-Disable-remove-neverallow-options-in-frontends.patch
-Patch0004:      0004-Disable-remove-neverallow-options-in-sediff.patch
-Patch0005:      0005-AVRuleXperm-Fix-permission-set-creation-for-AVTAB_XP.patch
-Patch1001:      1001-Do-not-use-Werror-during-build.patch
-Patch1002:      1002-Do-not-export-use-setools.InfoFlowAnalysis-and-setoo.patch
-Patch1003:      1003-Require-networkx-on-package-level.patch
-Patch1004:      1004-Do-not-use-NoteNotFound-as-it-s-not-implemented-in-n.patch
 
 Obsoletes:      setools < 4.0.0, setools-devel < 4.0.0
 BuildRequires:  flex,  bison
-BuildRequires:  glibc-devel, gcc, git
+BuildRequires:  glibc-devel, gcc, git-core
 BuildRequires:  libsepol-devel >= %{sepol_ver}, libsepol-static >= %{sepol_ver}
 BuildRequires:  qt5-qtbase-devel
 BuildRequires:  swig
@@ -37,12 +23,9 @@ BuildRequires:  python3-devel
 BuildRequires:  python3-setuptools
 BuildRequires:  libselinux-devel
 
-# BuildArch:      
 Requires:       %{name}-console = %{version}-%{release}
-%if %{with networkx}
 Requires:       %{name}-console-analyses = %{version}-%{release}
 Requires:       %{name}-gui = %{version}-%{release}
-%endif
 
 %description
 SETools is a collection of graphical tools, command-line tools, and
@@ -50,7 +33,7 @@ Python modules designed to facilitate SELinux policy analysis.
 
 %package     console
 Summary:     Policy analysis command-line tools for SELinux
-License:     GPLv2
+License:     GPL-2.0-only
 Requires:    python3-setools = %{version}-%{release}
 Requires:    libselinux >= %{selinux_ver}
 
@@ -65,10 +48,9 @@ This package includes the following console tools:
   sesearch     Search rules (allow, type_transition, etc.)
 
 
-%if %{with networkx}
 %package     console-analyses
 Summary:     Policy analysis command-line tools for SELinux
-License:     GPLv2
+License:     GPL-2.0-only
 Requires:    python3-setools = %{version}-%{release}
 Requires:    libselinux >= %{selinux_ver}
 Requires:    python3-networkx
@@ -81,31 +63,23 @@ This package includes the following console tools:
 
   sedta        Perform domain transition analyses.
   seinfoflow   Perform information flow analyses.
-%endif
 
 
 %package     -n python3-setools
 Summary:     Policy analysis tools for SELinux
-Obsoletes:   setools-libs < 4.0.0, setools-libs-tcl
+License:     LGPL-2.1-only
-Recommends:  libselinux-python3
+Obsoletes:   setools-libs < 4.0.0
-# Remove before F30
+%{?python_provide:%python_provide python3-setools}
-Provides: %{name}-python3 = %{version}-%{release}
-Provides: %{name}-python3%{?_isa} = %{version}-%{release}
-Obsoletes: %{name}-python3 < %{version}-%{release}
-%if 0%{?rhel} && 0%{?rhel} >= 8
-Requires:    platform-python-setuptools
-%else
 Requires:    python3-setuptools
-%endif
 
 %description -n python3-setools
 SETools is a collection of graphical tools, command-line tools, and
 Python 3 modules designed to facilitate SELinux policy analysis.
 
 
-%if %{with networkx}
 %package     gui
 Summary:     Policy analysis graphical tools for SELinux
+License:     GPL-2.0-only
 Requires:    python3-setools = %{version}-%{release}
 Requires:    python3-qt5
 Requires:    python3-networkx
@@ -113,28 +87,18 @@ Requires:    python3-networkx
 %description gui
 SETools is a collection of graphical tools, command-line tools, and
 Python modules designed to facilitate SELinux policy analysis.
-%endif
 
 
 %prep
-%autosetup -p 1 -S git -n setools-%{version}%{?setools_pre_ver:-%{setools_pre_ver}}
+%autosetup -p 1 -S git -n setools-%{version}
 
 
 %build
-# Remove CFLAGS=... for noarch packages (unneeded)
+%py3_build
-%set_build_flags
-%{__python3} setup.py build
 
 
 %install
-%{__python3} setup.py install --root %{buildroot}
+%py3_install
-
-%if %{without networkx}
-rm -f %{buildroot}%{_bindir}/sedta %{buildroot}%{_bindir}/seinfoflow \
-  %{buildroot}%{_mandir}*/man1/sedta* %{buildroot}%{_mandir}*/man1/sedinfoflow* \
-rm -rf %{buildroot}%{_bindir}/apol %{buildroot}%{python3_sitearch}/setoolsgui \
-  %{buildroot}%{_mandir}*/man1/apol*
-%endif
 
 %check
 %if %{?_with_check:1}%{!?_with_check:0}
@@ -145,9 +109,12 @@ rm -rf %{buildroot}%{_bindir}/apol %{buildroot}%{python3_sitearch}/setoolsgui \
 %files
 
 %files console
+%license COPYING.GPL
+%{_bindir}/sechecker
 %{_bindir}/sediff
 %{_bindir}/seinfo
 %{_bindir}/sesearch
+%{_mandir}/man1/sechecker*
 %{_mandir}/man1/sediff*
 %{_mandir}/man1/seinfo*
 %{_mandir}/man1/sesearch*
@@ -155,45 +122,97 @@ rm -rf %{buildroot}%{_bindir}/apol %{buildroot}%{python3_sitearch}/setoolsgui \
 %{_mandir}/ru/man1/seinfo*
 %{_mandir}/ru/man1/sesearch*
 
-%if %{with networkx}
 %files console-analyses
+%license COPYING.GPL
 %{_bindir}/sedta
 %{_bindir}/seinfoflow
 %{_mandir}/man1/sedta*
 %{_mandir}/man1/seinfoflow*
 %{_mandir}/ru/man1/sedta*
 %{_mandir}/ru/man1/seinfoflow*
-%endif
 
 %files -n python3-setools
-%license COPYING COPYING.GPL COPYING.LGPL
+%license COPYING COPYING.LGPL
 %{python3_sitearch}/setools
 %{python3_sitearch}/setools-*
 
-%if %{with networkx}
 %files gui
+%license COPYING.GPL
 %{_bindir}/apol
 %{python3_sitearch}/setoolsgui
 %{_mandir}/man1/apol*
 %{_mandir}/ru/man1/apol*
-%endif
 
 %changelog
-* Mon Aug 21 2023 Vit Mojzis <vmojzis@redhat.com> - 4.3.0-5
+* Tue Dec 12 2023 Petr Lautrbach <lautrbach@redhat.com> - 4.4.4-1
-- Disable/remove neverallow options in sediff (#2184141)
+- SETools 4.4.4 release
 
-* Mon Jun 19 2023 Vit Mojzis <vmojzis@redhat.com> - 4.3.0-4
+* Mon Aug 14 2023 Petr Lautrbach <lautrbach@redhat.com> - 4.4.3-1
-- Disable/remove neverallow options in frontends (#2184141)
+- SETools 4.4.3 release
-- AVRuleXperm: Fix permission set creation for AVTAB_XPERMS_IOCTLDRIVER (#2174376)
+- Improve man pages
+- seinfoflow: Add -r option to get flows into the source type.
+- seinfoflow.1: Remove references to sepolgen permission map.
+- AVRule/AVRuleXperm: Treat rules with no permissions as invalid policy.
+- SELinuxPolicy: Add explicit cast for libspol message
 
-* Tue Nov 30 2021 Vit Mojzis <vmojzis@redhat.com> - 4.3.0-3
+* Wed May 10 2023 Petr Lautrbach <lautrbach@redhat.com> - 4.4.2-2.1
-- Make seinfo output predictable (#2019961)
+- Disable sediff --neverallow and --neverallowxperm options
 
-* Tue Jun 30 2020 Vit Mojzis <vmojzis@redhat.com> - 4.3.0-2
+* Thu Apr 20 2023 Petr Lautrbach <lautrbach@redhat.com> - 4.4.2-1
-- Support old boolean names in policy queries (#1595572, #1581848)
+- SETools 4.4.2 release
 
-* Fri Apr 03 2020 Vit Mojzis <vmojzis@redhat.com> - 4.3.0-1
+* Mon Feb  6 2023 Petr Lautrbach <lautrbach@redhat.com> - 4.4.1-1
-- SETools 4.3.0 release (#1820079)
+- SETools 4.4.1 release
+
+* Fri Jun 10 2022 Petr Lautrbach <plautrba@redhat.com> - 4.4.0-5
+- Update required userspace versions to 3.4
+- Drop unnecessary Recommends
+
+* Fri Nov 19 2021 Petr Lautrbach <plautrba@redhat.com> - 4.4.0-4
+- Make seinfo output predictable
+  https://github.com/SELinuxProject/setools/issues/65
+
+* Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 4.4.0-3
+- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+  Related: rhbz#1991688
+
+* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 4.4.0-2
+- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
+
+* Mon Mar  8 2021 Petr Lautrbach <plautrba@redhat.com> - 4.4.0-1
+- SETools 4.4.0 release
+
+* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.0-0.3.20210121git16c0696
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Thu Jan 21 2021 Petr Lautrbach <plautrba@redhat.com> - 4.4.0-0.2.20210121git16c0696
+- Rebuild with SELinux userspace 3.2-rc1
+- Update to 16c0696
+
+* Thu Dec 10 2020 Petr Lautrbach <plautrba@redhat.com> - 4.4.0-0.2.20201102git05e90ee
+- Fix imports in /usr/bin/sedta
+
+* Tue Nov  3 2020 Petr Lautrbach <plautrba@redhat.com> - 4.4.0-0.1.20201102git05e90ee
+- Update to 05e90ee
+- Add /usr/bin/sechecker
+- Adapt to new libsepol filename transition structures
+- Rebuild with libsepol.so.2
+
+* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 4.3.0-5
+- Second attempt - Rebuilt for
+  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 4.3.0-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Thu Jul 16 2020 Petr Lautrbach <plautrba@redhat.com> - 4.3.0-3
+- rebuild with SELinux userspace 3.1 release
+
+* Tue May 26 2020 Miro Hrončok <mhroncok@redhat.com> - 4.3.0-2
+- Rebuilt for Python 3.9
+
+* Thu Apr  2 2020 Petr Lautrbach <plautrba@redhat.com> - 4.3.0-1
+- SETools 4.3.0 release
 - Revised sediff method for TE rules. This drastically reduced memory and run time.
 - Added infiniband context support to seinfo, sediff, and apol.
 - Added apol configuration for location of Qt assistant.
@@ -203,12 +222,20 @@ rm -rf %{buildroot}%{_bindir}/apol %{buildroot}%{python3_sitearch}/setoolsgui \
 - Added methods to TypeAttribute class to make it a complete Python collection.
 - Genfscon now will look up classes rather than using fixed values which
     were dropped from libsepol.
-- setools requires -console, -console-analyses and -gui packages (#1820078)
 
-* Sat Nov 30 2019 Petr Lautrbach <plautrba@redhat.com> - 4.2.2-2
+* Mon Mar 23 2020 Petr Lautrbach <plautrba@redhat.com> - 4.2.2-5
-- Build setools-console-analyses and setools-gui (#1731519)
+- setools requires -console, -console-analyses and -gui packages (#1794314)
 
-* Mon Jul 08 2019 Vit Mojzis <vmojzis@redhat.com> - 4.2.2-1
+* Thu Jan 30 2020 Fedora Release Engineering <releng@fedoraproject.org> - 4.2.2-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Thu Oct 03 2019 Miro Hrončok <mhroncok@redhat.com> - 4.2.2-3
+- Rebuilt for Python 3.8.0rc1 (#1748018)
+
+* Mon Aug 19 2019 Miro Hrončok <mhroncok@redhat.com> - 4.2.2-2
+- Rebuilt for Python 3.8
+
+* Mon Jul 08 2019 Vit Mojzis <vmojzis@redhat.com> - 4.2.2-1}
 - SETools 4.2.2 release
 
 * Mon May 13 2019 Vit Mojzis <vmojzis@redhat.com> - 4.2.1-3
@@ -220,25 +247,33 @@ rm -rf %{buildroot}%{_bindir}/apol %{buildroot}%{python3_sitearch}/setoolsgui \
 * Tue Mar 26 2019 Petr Lautrbach <plautrba@redhat.com> - 4.2.1-1
 - SETools 4.2.1 release (#1581761, #1595582)
 
-* Fri Nov 16 2018 Lumír Balhar <lbalhar@redhat.com> - 4.2.0-2
+* Wed Nov 14 2018 Vit Mojzis <vmojzis@redhat.com> - 4.2.0-1
-- Require platform-python-setuptools instead of python3-setuptools
+- Update source to SETools 4.2.0 release
-- Resolves: rhbz#1650548
-
-* Tue Nov 13 2018 Petr Lautrbach <plautrba@redhat.com> - 4.2.0-1
-- SETools 4.2.0 release
 
 * Mon Oct 01 2018 Vit Mojzis <vmojzis@redhat.com> - 4.2.0-0.3.rc
 - Update upstream source to 4.2.0-rc
 
-* Wed Aug 22 2018 Petr Lautrbach <plautrba@redhat.com> - 4.1.1-11
+* Wed Sep 19 2018 Vit Mojzis <vmojzis@redhat.com> - 4.2.0-0.2.beta
+- Require userspace release 2.8
+- setools-gui requires python3-setools
+- Add Requires for python[23]-setuptools - no longer required (just recommended) by python[23] (#1623371)
+- Drop python2 subpackage (4.2.0 no longer supports python2)
+
+* Wed Aug 29 2018 Vit Mojzis <vmojzis@redhat.com> - 4.1.1-13
+- Add Requires for python[23]-setuptools - no longer required (just recommended)
+  by python[23] (#1623371)
+
+* Wed Aug 22 2018 Petr Lautrbach <plautrba@redhat.com> - 4.1.1-12.1
 - Fix SCTP patch - https://github.com/SELinuxProject/setools/issues/9
 
-* Thu Jun 14 2018 Petr Lautrbach <plautrba@redhat.com> - 4.1.1-10
+* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 4.1.1-11
-- Move gui python files to -gui subpackage
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
-- Do not build gui and console-analyses by default
 
-* Wed Jun  6 2018 Petr Lautrbach <plautrba@redhat.com> - 4.1.1-9
+* Tue Jun 19 2018 Miro Hrončok <mhroncok@redhat.com> - 4.1.1-10
-- Don't build the Python 2 subpackage (#1567362)
+- Rebuilt for Python 3.7
+
+* Thu Jun 14 2018 Petr Lautrbach <plautrba@redhat.com> - 4.1.1-9
+- Move gui python files to -gui subpackage
 
 * Thu Apr 26 2018 Vit Mojzis <vmojzis@redhat.com> - 4.1.1-8
 - Add support for SCTP protocol (#1568333)