Improve portage/emerge-webrsync, layman; fix firefox, cron, semanage, bugs #376005, #375835

Package-Manager: portage-2.1.10.3/cvs/Linux x86_64

6 files changed, 367 insertions, 8 deletions

diff --git a/sec-policy/selinux-base-policy/ChangeLog b/sec-policy/selinux-base-policy/ChangeLog
index 3cb40ff775f3..d2235b164775 100644
--- a/sec-policy/selinux-base-policy/ChangeLog
+++ b/sec-policy/selinux-base-policy/ChangeLog
@@ -1,6 +1,18 @@
 # ChangeLog for sec-policy/selinux-base-policy
 # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-base-policy/ChangeLog,v 1.80 2011/07/11 01:59:36 blueness Exp $
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-base-policy/ChangeLog,v 1.81 2011/07/25 22:13:22 blueness Exp $
+
+*selinux-base-policy-2.20101213-r21 (25 Jul 2011)
+*selinux-base-policy-2.20101213-r20 (25 Jul 2011)
+
+  25 Jul 2011; Anthony G. Basile <blueness@gentoo.org>
+  +selinux-base-policy-2.20101213-r20.ebuild,
+  +selinux-base-policy-2.20101213-r21.ebuild, +files/modules.conf,
+  files/config:
+  Support unattended use of portage/emerge-webrsync, add layman in its own
+  domain, fix a firefox context mismatch, allow cron to call portage, mark
+  semanage as being an eselect wrapper too (fixes /etc/selinux labeling
+  mismatches). Bugs fixed: #376005, #375835 (workaround)
 
   11 Jul 2011; Anthony G. Basile <blueness@gentoo.org>
   -files/selinux-base-policy-20070329.diff,
diff --git a/sec-policy/selinux-base-policy/Manifest b/sec-policy/selinux-base-policy/Manifest
index f81d5b23d6a9..bd8034d6ef5c 100644
--- a/sec-policy/selinux-base-policy/Manifest
+++ b/sec-policy/selinux-base-policy/Manifest
@@ -1,12 +1,15 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA256
 
-AUX config 447 RMD160 e7c65cdee66dd93597f6608c48ab672327dfaf99 SHA1 32ec28fff992016971ddec982c203a44275552fc SHA256 8192a534941ef95ca93bfff3a0a078407480e52047048daccb5cb7acac1eaddf
+AUX config 631 RMD160 076ae6441a3a29ead502c8bc4b646546095ad95a SHA1 022e0457876cea7068b46c4f14601278215b1056 SHA256 891ddc7cfd577a8591d65f6cb3398863ec338209b347ce9bfc125817b841860e
+AUX modules.conf 728 RMD160 20c291e9a1ab63c7ffeda41f1b28a1a3d1058a5b SHA1 79f164d12565c3f9cc633fbbfc3469f1337cabc9 SHA256 7deba8527d6002e25d5b307fa085341473add1bc6489902a920096012ba56456
 AUX modules.conf.strict.20090730 728 RMD160 20c291e9a1ab63c7ffeda41f1b28a1a3d1058a5b SHA1 79f164d12565c3f9cc633fbbfc3469f1337cabc9 SHA256 7deba8527d6002e25d5b307fa085341473add1bc6489902a920096012ba56456
 AUX modules.conf.targeted.20090730 746 RMD160 51929329cb860f5412ea4fda11e1d4bc8eafadae SHA1 80c8ac75f2102968f22f7469142b820a33a0a2c0 SHA256 435cb66eee3c702bd217a66d138d740ceb7f750380fb4681d6eae4b5acacf2c0
 DIST patchbundle-selinux-base-policy-2.20101213-r16.tar.bz2 13853 RMD160 7cfa1a2af1677bb4609fccc6225e963657892e96 SHA1 2fb4f1ba11e95c5a8bf3f6887fd7eb54e9d7439d SHA256 800004fc009e3e7894c21554119c26ef460ed497cebf792412fbbadab41f96c4
 DIST patchbundle-selinux-base-policy-2.20101213-r17.tar.bz2 15055 RMD160 5fbaf0263a6b71d3fab614ef7fc9a1c1a0fb9532 SHA1 57a8df9c04bc17cfb1b1dbd45c18b8a56274d4c7 SHA256 717402987115facee72e7517f866f245987fea2e4312d710b9c62853d779319d
 DIST patchbundle-selinux-base-policy-2.20101213-r18.tar.bz2 15951 RMD160 ff5f27778184717ccd8eb9ad1ba42c5abf57dd2b SHA1 e6e563d43f4c64dcc9437f9eb227dd62ba674b2a SHA256 4245364ff20f4e0eb69aec6e57276e9f2f2bcbb45b5ecf4484fcb3d11e80da7b
+DIST patchbundle-selinux-base-policy-2.20101213-r20.tar.bz2 18585 RMD160 f2410675d178e9d001979b96693c22e33ecd909d SHA1 def300941d269c227ae21f50adfc2dde23694da2 SHA256 a25390b56466780c84a2c8f01e1ce8f6ba0e967eb869553cfe93c720ec796dbe
+DIST patchbundle-selinux-base-policy-2.20101213-r21.tar.bz2 19683 RMD160 aa381cfb741c12c223a844dd9d403137c3efd1fc SHA1 e9acf7aa2230614b37c3d3f43b53af32461ef81c SHA256 96c1851a6d1c8ee934da1837f50a3bac53fb7a6037530d060404e5fa4406f859
 DIST refpolicy-2.20090730.tar.bz2 489840 RMD160 d1d157a5ad243edd5d216504ed697f128420e8c1 SHA1 af479258b4e78b8bd7aa2a23dead49f4d61a552f SHA256 745077f6db86646458fe65df82eaa6ffc8491752e511d2a7397f4b46bd478f03
 DIST refpolicy-2.20090814.tar.bz2 490191 RMD160 a62b13cac598dcb83e9730d8fc3771f5130a4776 SHA1 b80315c3ea09f1cfac637f09ca3fad1e19674790 SHA256 d7c500e76089240b00a1a53238ccca581ef02cce7812bc68f8d0299b9c261c22
 DIST refpolicy-2.20091215.tar.bz2 502893 RMD160 d4951a3d2025630734c4664dca0cc8297a354275 SHA1 3a64189cda00475d60b70ed0876b3e297ad463c6 SHA256 8c264680d130e7d0e0a49ee80d54a3fbdf083bc341c7f7516b5edef34e222ca5
@@ -17,12 +20,14 @@ EBUILD selinux-base-policy-2.20091215.ebuild 3065 RMD160 8477cbb7a0cf627421110ab
 EBUILD selinux-base-policy-2.20101213-r16.ebuild 3669 RMD160 c98ef6044636a3a92f8869698fa6a8d4103c3dc1 SHA1 5d4b18ac25c7d95e84a509d800416fbcd493faab SHA256 3e45915e68e76893f4b5d3efd704ac23fd4ca6466aa4d98988cd8a2f2db9822d
 EBUILD selinux-base-policy-2.20101213-r17.ebuild 3668 RMD160 72e220bc95a2b9f7e244962a96575b18d7281900 SHA1 aa36481a98d6da77d8dca72f197262654060189c SHA256 ed871031168ac7f5d2a0b2ee60ca93dda4ebe080f768afcd3461710462c138c6
 EBUILD selinux-base-policy-2.20101213-r18.ebuild 3665 RMD160 e9d05055519957244db6f893a23ce2ff7bcecac8 SHA1 ab2e6969510b7950a63be62404b3e4f5e35f8261 SHA256 d32cb918c05035a5376a8d7e5b8f28bc591d5f6951ad9fdbc475315ab6e0182c
-MISC ChangeLog 19671 RMD160 af36ccb84c3108f8ad559501688081176438e9f4 SHA1 3636d5af4ff6493ab1d253642cdd32eb036f448f SHA256 af90241d816096164d98660990e75d2eb733ffb70ea49b9c5bdc2bffc90cf612
+EBUILD selinux-base-policy-2.20101213-r20.ebuild 4037 RMD160 754a30a8a8ca2d035fed77e63dfce4dbabe98d0d SHA1 23458dd89213bf64941edaed469dbf8b6d35d8f3 SHA256 0494ab98c4a73bf7bee611f82d7fac745c1d13fc4d580f02dd09da9faabdb3dd
+EBUILD selinux-base-policy-2.20101213-r21.ebuild 4279 RMD160 44143e13822c208b35636c07ed2968978d43a2f8 SHA1 2ae04846e46a465b8ed58fd2ec09ea7c1aaca752 SHA256 31d8a7b345c04ced0cc475eccc1364561d67f6d49729cca0f607bbfd2e1d0236
+MISC ChangeLog 20236 RMD160 4ab57fd6bde3b47c6f8464005bd53485a73eebc4 SHA1 b7e051114b30ef0cd9c35f296f1743dd7e14f4d0 SHA256 ce8015c1c81c1c404c25003344ea1137036480c05654fe697c554120e17b9510
 MISC metadata.xml 671 RMD160 49dd94bb827c4ab2bb8043739ef7564df4cf1c07 SHA1 a92b8a5ef129707a44fe2ae1913060d02badd566 SHA256 c32ccc54ca7df400974a19ad14c093ea7b777f7a40467bdb672f441314122e55
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.17 (GNU/Linux)
 
-iEYEAREIAAYFAk4aWRgACgkQl5yvQNBFVTWjmwCeOIunKIHh5ckiESCjdaBO7uGp
-3EkAn2SkiRDwn/NcDvYRp3VGyrr8LXpb
-=UEuu
+iEYEAREIAAYFAk4t6pAACgkQl5yvQNBFVTXcIgCfVmIKbPj4axoIaj92GXjsR40t
+1mQAoIUXP259F/b2b1PAm3xXzBlPXTYB
+=I7Fz
 -----END PGP SIGNATURE-----
diff --git a/sec-policy/selinux-base-policy/files/config b/sec-policy/selinux-base-policy/files/config
index 41e69934447d..55933ea0e534 100644
--- a/sec-policy/selinux-base-policy/files/config
+++ b/sec-policy/selinux-base-policy/files/config
@@ -6,7 +6,10 @@
 #	disabled - No SELinux policy is loaded.
 SELINUX=permissive
 
-# SELINUXTYPE can take one of these two values:
+# SELINUXTYPE can take one of these four values:
 #	targeted - Only targeted network daemons are protected.
-#	strict - Full SELinux protection.
+#	strict   - Full SELinux protection.
+#	mls      - Full SELinux protection with Multi-Level Security
+#	mcs      - Full SELinux protection with Multi-Category Security 
+#	           (mls, but only one sensitivity level)
 SELINUXTYPE=strict
diff --git a/sec-policy/selinux-base-policy/files/modules.conf b/sec-policy/selinux-base-policy/files/modules.conf
new file mode 100644
index 000000000000..fcb3fd8a94ff
--- /dev/null
+++ b/sec-policy/selinux-base-policy/files/modules.conf
@@ -0,0 +1,49 @@
+application = base
+authlogin = base
+bootloader = base
+clock = base
+consoletype = base
+corecommands = base
+corenetwork = base
+cron = base
+devices = base
+dmesg = base
+domain = base
+files = base
+filesystem = base
+fstools = base
+getty = base
+hostname = base
+hotplug = base
+init = base
+iptables = base
+kernel = base
+libraries = base
+locallogin = base
+logging = base
+lvm = base
+miscfiles = base
+mcs = base
+mls = base
+modutils = base
+mount = base
+mta = base
+netutils = base
+nscd = base
+portage = base
+raid = base
+rsync = base
+selinux = base
+selinuxutil = base
+ssh = base
+staff = base
+storage = base
+su = base
+sysadm = base
+sysnetwork = base
+terminal = base
+ubac = base
+udev = base
+userdomain = base
+usermanage = base
+unprivuser = base
diff --git a/sec-policy/selinux-base-policy/selinux-base-policy-2.20101213-r20.ebuild b/sec-policy/selinux-base-policy/selinux-base-policy-2.20101213-r20.ebuild
new file mode 100644
index 000000000000..02e56d27717a
--- /dev/null
+++ b/sec-policy/selinux-base-policy/selinux-base-policy-2.20101213-r20.ebuild
@@ -0,0 +1,143 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-base-policy/selinux-base-policy-2.20101213-r20.ebuild,v 1.1 2011/07/25 22:13:22 blueness Exp $
+
+EAPI="1"
+IUSE="+peer_perms +open_perms +ubac"
+
+inherit eutils
+
+#PATCHBUNDLE="${FILESDIR}/patchbundle-${PF}.tar.bz2"
+PATCHBUNDLE="${DISTDIR}/patchbundle-${PF}.tar.bz2"
+DESCRIPTION="Gentoo base policy for SELinux"
+HOMEPAGE="http://www.gentoo.org/proj/en/hardened/selinux/"
+#SRC_URI="http://oss.tresys.com/files/refpolicy/refpolicy-${PV}.tar.bz2"
+SRC_URI="http://oss.tresys.com/files/refpolicy/refpolicy-${PV}.tar.bz2
+	http://dev.gentoo.org/~blueness/patchbundle-selinux-base-policy/patchbundle-${PF}.tar.bz2"
+LICENSE="GPL-2"
+SLOT="0"
+
+KEYWORDS="~amd64 ~x86"
+
+RDEPEND=">=sys-apps/policycoreutils-1.30.30
+	>=sys-fs/udev-151"
+DEPEND="${RDEPEND}
+	sys-devel/m4
+	>=sys-apps/checkpolicy-1.30.12"
+
+S=${WORKDIR}/
+
+src_unpack() {
+	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs"
+
+	unpack ${A}
+
+	cd "${S}"
+	epatch "${PATCHBUNDLE}"
+	cd "${S}/refpolicy"
+	# Fix bug 257111
+	sed -i -e 's:system_crond_t:system_cronjob_t:g' \
+		"${S}/refpolicy/config/appconfig-standard/default_contexts"
+
+	if ! use peer_perms; then
+		sed -i -e '/network_peer_controls/d' \
+			"${S}/refpolicy/policy/policy_capabilities"
+	fi
+
+	if ! use open_perms; then
+		sed -i -e '/open_perms/d' \
+			"${S}/refpolicy/policy/policy_capabilities"
+	fi
+
+	for i in ${POLICY_TYPES}; do
+		cp -a "${S}/refpolicy" "${S}/${i}"
+
+		cd "${S}/${i}";
+		make conf || die "Make conf in ${i} failed"
+
+		# Define what we see as "base" and what we want to remain modular
+		cp "${FILESDIR}/modules.conf" \
+			"${S}/${i}/policy/modules.conf" \
+			|| die "failed to set up modules.conf"
+		if [[ "${i}" == "targeted" ]];
+		then
+			echo "unconfined = base" >> "${S}/${i}/policy/modules.conf"
+		fi
+		sed -i -e '/^QUIET/s/n/y/' -e '/^MONOLITHIC/s/y/n/' \
+			-e "/^NAME/s/refpolicy/$i/" "${S}/${i}/build.conf" \
+			|| die "build.conf setup failed."
+
+		if [[ "${i}" == "mls" ]] || [[ "${i}" == "mcs" ]];
+		then
+			# MCS/MLS require additional settings
+			sed -i -e "/^TYPE/s/standard/${i}/" "${S}/${i}/build.conf" \
+				|| die "failed to set type to mls"
+		fi
+
+		if ! use ubac; then
+			sed -i -e 's:^UBAC = y:UBAC = n:g' "${S}/${i}/build.conf"
+		fi
+
+		echo "DISTRO = gentoo" >> "${S}/${i}/build.conf"
+
+		if [ "${i}" == "targeted" ]; then
+			sed -i -e '/root/d' -e 's/user_u/unconfined_u/' \
+			"${S}/${i}/config/appconfig-standard/seusers" \
+			|| die "targeted seusers setup failed."
+		fi
+	done
+}
+
+src_compile() {
+	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs"
+
+	for i in ${POLICY_TYPES}; do
+		cd "${S}/${i}"
+		make base || die "${i} compile failed"
+	done
+}
+
+src_install() {
+	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs"
+
+	for i in ${POLICY_TYPES}; do
+		cd "${S}/${i}"
+
+		make DESTDIR="${D}" install \
+			|| die "${i} install failed."
+
+		make DESTDIR="${D}" install-headers \
+			|| die "${i} headers install failed."
+
+		echo "run_init_t" > "${D}/etc/selinux/${i}/contexts/run_init_type"
+
+		echo "textrel_shlib_t" >> "${D}/etc/selinux/${i}/contexts/customizable_types"
+
+		# libsemanage won't make this on its own
+		keepdir "/etc/selinux/${i}/policy"
+	done
+
+	dodoc doc/Makefile.example doc/example.{te,fc,if}
+
+	insinto /etc/selinux
+	doins "${FILESDIR}/config"
+}
+
+pkg_preinst() {
+	has_version "<${CATEGORY}/${PN}-2.20101213-r13"
+	previous_less_than_r13=$?
+}
+
+pkg_postinst() {
+	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs"
+
+	for i in ${POLICY_TYPES}; do
+		einfo "Inserting base module into ${i} module store."
+
+		cd "/usr/share/selinux/${i}"
+		semodule -s "${i}" -b base.pp || die "Could not load in new base policy"
+	done
+	elog "Updates on policies might require you to relabel files. If you, after"
+	elog "installing new SELinux policies, get 'permission denied' errors,"
+	elog "relabelling your system using 'rlpkg -a -r' might resolve the issues."
+}
diff --git a/sec-policy/selinux-base-policy/selinux-base-policy-2.20101213-r21.ebuild b/sec-policy/selinux-base-policy/selinux-base-policy-2.20101213-r21.ebuild
new file mode 100644
index 000000000000..9c58b4c643e0
--- /dev/null
+++ b/sec-policy/selinux-base-policy/selinux-base-policy-2.20101213-r21.ebuild
@@ -0,0 +1,147 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-base-policy/selinux-base-policy-2.20101213-r21.ebuild,v 1.1 2011/07/25 22:13:22 blueness Exp $
+
+EAPI="1"
+IUSE="+peer_perms +open_perms +ubac"
+
+inherit eutils
+
+#PATCHBUNDLE="${FILESDIR}/patchbundle-${PF}.tar.bz2"
+PATCHBUNDLE="${DISTDIR}/patchbundle-${PF}.tar.bz2"
+DESCRIPTION="Gentoo base policy for SELinux"
+HOMEPAGE="http://www.gentoo.org/proj/en/hardened/selinux/"
+#SRC_URI="http://oss.tresys.com/files/refpolicy/refpolicy-${PV}.tar.bz2"
+SRC_URI="http://oss.tresys.com/files/refpolicy/refpolicy-${PV}.tar.bz2
+	http://dev.gentoo.org/~blueness/patchbundle-selinux-base-policy/patchbundle-${PF}.tar.bz2"
+LICENSE="GPL-2"
+SLOT="0"
+
+KEYWORDS="~amd64 ~x86"
+
+RDEPEND=">=sys-apps/policycoreutils-1.30.30
+	>=sys-fs/udev-151"
+DEPEND="${RDEPEND}
+	sys-devel/m4
+	>=sys-apps/checkpolicy-1.30.12"
+
+S=${WORKDIR}/
+
+src_unpack() {
+	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs"
+
+	unpack ${A}
+
+	cd "${S}"
+	epatch "${PATCHBUNDLE}"
+	cd "${S}/refpolicy"
+	# Fix bug 257111
+	sed -i -e 's:system_crond_t:system_cronjob_t:g' \
+		"${S}/refpolicy/config/appconfig-standard/default_contexts"
+	sed -i -e 's|system_r:cronjob_t|system_r:system_cronjob_t|g' \
+		"${S}/refpolicy/config/appconfig-mls/default_contexts"
+	sed -i -e 's|system_r:cronjob_t|system_r:system_cronjob_t|g' \
+		"${S}/refpolicy/config/appconfig-mcs/default_contexts"
+
+	if ! use peer_perms; then
+		sed -i -e '/network_peer_controls/d' \
+			"${S}/refpolicy/policy/policy_capabilities"
+	fi
+
+	if ! use open_perms; then
+		sed -i -e '/open_perms/d' \
+			"${S}/refpolicy/policy/policy_capabilities"
+	fi
+
+	for i in ${POLICY_TYPES}; do
+		cp -a "${S}/refpolicy" "${S}/${i}"
+
+		cd "${S}/${i}";
+		make conf || die "Make conf in ${i} failed"
+
+		# Define what we see as "base" and what we want to remain modular
+		cp "${FILESDIR}/modules.conf" \
+			"${S}/${i}/policy/modules.conf" \
+			|| die "failed to set up modules.conf"
+		if [[ "${i}" == "targeted" ]];
+		then
+			echo "unconfined = base" >> "${S}/${i}/policy/modules.conf"
+		fi
+		sed -i -e '/^QUIET/s/n/y/' -e '/^MONOLITHIC/s/y/n/' \
+			-e "/^NAME/s/refpolicy/$i/" "${S}/${i}/build.conf" \
+			|| die "build.conf setup failed."
+
+		if [[ "${i}" == "mls" ]] || [[ "${i}" == "mcs" ]];
+		then
+			# MCS/MLS require additional settings
+			sed -i -e "/^TYPE/s/standard/${i}/" "${S}/${i}/build.conf" \
+				|| die "failed to set type to mls"
+		fi
+
+		if ! use ubac; then
+			sed -i -e 's:^UBAC = y:UBAC = n:g' "${S}/${i}/build.conf"
+		fi
+
+		echo "DISTRO = gentoo" >> "${S}/${i}/build.conf"
+
+		if [ "${i}" == "targeted" ]; then
+			sed -i -e '/root/d' -e 's/user_u/unconfined_u/' \
+			"${S}/${i}/config/appconfig-standard/seusers" \
+			|| die "targeted seusers setup failed."
+		fi
+	done
+}
+
+src_compile() {
+	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs"
+
+	for i in ${POLICY_TYPES}; do
+		cd "${S}/${i}"
+		make base || die "${i} compile failed"
+	done
+}
+
+src_install() {
+	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs"
+
+	for i in ${POLICY_TYPES}; do
+		cd "${S}/${i}"
+
+		make DESTDIR="${D}" install \
+			|| die "${i} install failed."
+
+		make DESTDIR="${D}" install-headers \
+			|| die "${i} headers install failed."
+
+		echo "run_init_t" > "${D}/etc/selinux/${i}/contexts/run_init_type"
+
+		echo "textrel_shlib_t" >> "${D}/etc/selinux/${i}/contexts/customizable_types"
+
+		# libsemanage won't make this on its own
+		keepdir "/etc/selinux/${i}/policy"
+	done
+
+	dodoc doc/Makefile.example doc/example.{te,fc,if}
+
+	insinto /etc/selinux
+	doins "${FILESDIR}/config"
+}
+
+pkg_preinst() {
+	has_version "<${CATEGORY}/${PN}-2.20101213-r13"
+	previous_less_than_r13=$?
+}
+
+pkg_postinst() {
+	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs"
+
+	for i in ${POLICY_TYPES}; do
+		einfo "Inserting base module into ${i} module store."
+
+		cd "/usr/share/selinux/${i}"
+		semodule -s "${i}" -b base.pp || die "Could not load in new base policy"
+	done
+	elog "Updates on policies might require you to relabel files. If you, after"
+	elog "installing new SELinux policies, get 'permission denied' errors,"
+	elog "relabelling your system using 'rlpkg -a -r' might resolve the issues."
+}