libselinux-2.3-10.fc21.1

The merge was accidentally made against Fedora 22 dist git branch.
Updates should be created from github fedora-selinux/selinux repository
branch f21

Recreate libselinux-rhat.patch from
399c6647b1

libselinux-rhat.patch

@@ -659,72 +659,20 @@ index e89b1ef..fd20363 100644
  Every confined service on the system has a man page in the following format:
  .br
 diff --git libselinux-2.3/src/Makefile libselinux-2.3/src/Makefile
-index 4d07ba6..0a34d9b 100644
+index 4d07ba6..62c8dad 100644
 --- libselinux-2.3/src/Makefile
 +++ libselinux-2.3/src/Makefile
-@@ -59,7 +59,7 @@ CFLAGS ?= -O -Wall -W -Wundef -Wformat-y2k -Wformat-security -Winit-self -Wmissi
-           -Wstrict-prototypes -Wold-style-definition -Wmissing-prototypes \
-           -Wmissing-declarations -Wmissing-noreturn -Wmissing-format-attribute \
-           -Wredundant-decls -Wnested-externs -Winline -Winvalid-pch -Wvolatile-register-var \
--          -Wdisabled-optimization -Wbuiltin-macro-redefined -Wmudflap -Wpacked-bitfield-compat \
-+          -Wdisabled-optimization -Wbuiltin-macro-redefined -Wpacked-bitfield-compat \
-           -Wsync-nand -Wattributes -Wcoverage-mismatch -Wmultichar -Wcpp \
-           -Wdeprecated-declarations -Wdiv-by-zero -Wdouble-promotion -Wendif-labels -Wextra \
-           -Wformat-contains-nul -Wformat-extra-args -Wformat-zero-length -Wformat=2 -Wmultichar \
-diff --git libselinux-2.3/src/avc.c libselinux-2.3/src/avc.c
-index 2bd7d13..b1ec57f 100644
---- libselinux-2.3/src/avc.c
-+++ libselinux-2.3/src/avc.c
-@@ -288,7 +288,7 @@ void avc_av_stats(void)
+@@ -111,7 +111,7 @@ $(LIBA): $(OBJS)
+ 	$(RANLIB) $@
  
- 	avc_release_lock(avc_lock);
+ $(LIBSO): $(LOBJS)
+-	$(CC) $(CFLAGS) -shared -o $@ $^ -lpcre -ldl $(LDFLAGS) -L$(LIBDIR) -Wl,-soname,$(LIBSO),-z,defs,-z,relro
++	$(CC) $(CFLAGS) -shared -o $@ $^ -lpcre -llzma -ldl $(LDFLAGS) -L$(LIBDIR) -Wl,-soname,$(LIBSO),-z,defs,-z,relro
+ 	ln -sf $@ $(TARGET) 
  
--	avc_log(SELINUX_INFO, "%s:  %d AV entries and %d/%d buckets used, "
-+	avc_log(SELINUX_INFO, "%s:  %u AV entries and %d/%d buckets used, "
- 		"longest chain length %d\n", avc_prefix,
- 		avc_cache.active_nodes,
- 		slots_used, AVC_CACHE_SLOTS, max_chain_len);
-@@ -471,7 +471,7 @@ static int avc_insert(security_id_t ssid, security_id_t tsid,
- 
- 	if (ae->avd.seqno < avc_cache.latest_notif) {
- 		avc_log(SELINUX_WARNING,
--			"%s:  seqno %d < latest_notif %d\n", avc_prefix,
-+			"%s:  seqno %u < latest_notif %u\n", avc_prefix,
- 			ae->avd.seqno, avc_cache.latest_notif);
- 		errno = EAGAIN;
- 		rc = -1;
-diff --git libselinux-2.3/src/avc_internal.c libselinux-2.3/src/avc_internal.c
-index f735e73..be94857 100644
---- libselinux-2.3/src/avc_internal.c
-+++ libselinux-2.3/src/avc_internal.c
-@@ -125,14 +125,14 @@ static int avc_netlink_receive(char *buf, unsigned buflen, int blocking)
- 
- 	if (nladdrlen != sizeof nladdr) {
- 		avc_log(SELINUX_WARNING,
--			"%s:  warning: netlink address truncated, len %d?\n",
-+			"%s:  warning: netlink address truncated, len %u?\n",
- 			avc_prefix, nladdrlen);
- 		return -1;
- 	}
- 
- 	if (nladdr.nl_pid) {
- 		avc_log(SELINUX_WARNING,
--			"%s:  warning: received spoofed netlink packet from: %d\n",
-+			"%s:  warning: received spoofed netlink packet from: %u\n",
- 			avc_prefix, nladdr.nl_pid);
- 		return -1;
- 	}
-@@ -197,7 +197,7 @@ static int avc_netlink_process(char *buf)
- 	case SELNL_MSG_POLICYLOAD:{
- 		struct selnl_msg_policyload *msg = NLMSG_DATA(nlh);
- 		avc_log(SELINUX_INFO,
--			"%s:  received policyload notice (seqno=%d)\n",
-+			"%s:  received policyload notice (seqno=%u)\n",
- 			avc_prefix, msg->seqno);
- 		rc = avc_ss_reset(msg->seqno);
- 		if (rc < 0) {
+ $(LIBPC): $(LIBPC).in ../VERSION
 diff --git libselinux-2.3/src/avc_sidtab.c libselinux-2.3/src/avc_sidtab.c
-index 52f21df..c775430 100644
+index 52f21df..66ad9e1 100644
 --- libselinux-2.3/src/avc_sidtab.c
 +++ libselinux-2.3/src/avc_sidtab.c
 @@ -81,6 +81,11 @@ sidtab_context_to_sid(struct sidtab *s,
@@ -739,15 +687,6 @@ index 52f21df..c775430 100644
  	*sid = NULL;
  	hvalue = sidtab_hash(ctx);
  
-@@ -124,7 +129,7 @@ void sidtab_sid_stats(struct sidtab *h, char *buf, int buflen)
- 	}
- 
- 	snprintf(buf, buflen,
--		 "%s:  %d SID entries and %d/%d buckets used, longest "
-+		 "%s:  %u SID entries and %d/%d buckets used, longest "
- 		 "chain length %d\n", avc_prefix, h->nel, slots_used,
- 		 SIDTAB_SIZE, max_chain_len);
- }
 diff --git libselinux-2.3/src/canonicalize_context.c libselinux-2.3/src/canonicalize_context.c
 index 7cf3139..364a746 100644
 --- libselinux-2.3/src/canonicalize_context.c
@@ -860,42 +799,6 @@ index b37c5d3..7703c26 100644
  	snprintf(path, sizeof path, "%s/user", selinux_mnt);
  	fd = open(path, O_RDWR);
  	if (fd < 0)
-diff --git libselinux-2.3/src/enabled.c libselinux-2.3/src/enabled.c
-index 5c252dd..bb659a9 100644
---- libselinux-2.3/src/enabled.c
-+++ libselinux-2.3/src/enabled.c
-@@ -11,26 +11,14 @@
- 
- int is_selinux_enabled(void)
- {
--	int enabled = 0;
--	char * con;
--
- 	/* init_selinuxmnt() gets called before this function. We
-  	 * will assume that if a selinux file system is mounted, then
-  	 * selinux is enabled. */
--	if (selinux_mnt) {
--
--		/* Since a file system is mounted, we consider selinux
--		 * enabled. If getcon_raw fails, selinux is still enabled.
--		 * We only consider it disabled if no policy is loaded. */
--		enabled = 1;
--		if (getcon_raw(&con) == 0) {
--			if (!strcmp(con, "kernel"))
--				enabled = 0;
--			freecon(con);
--		}
--        }
--
--	return enabled;
-+#ifdef ANDROID
-+	return (selinux_mnt ? 1 : 0);
-+#else
-+	return (selinux_mnt && has_selinux_config);
-+#endif
- }
- 
- hidden_def(is_selinux_enabled)
 diff --git libselinux-2.3/src/file_path_suffixes.h libselinux-2.3/src/file_path_suffixes.h
 index 3c92424..d1f9b48 100644
 --- libselinux-2.3/src/file_path_suffixes.h
@@ -927,166 +830,185 @@ index 52707d0..0cbe12d 100644
  	if (rc < 0 && errno == ENOTSUP) {
  		char * ccontext = NULL;
  		int err = errno;
-diff --git libselinux-2.3/src/init.c libselinux-2.3/src/init.c
-index 6d1ef33..3c687a2 100644
---- libselinux-2.3/src/init.c
-+++ libselinux-2.3/src/init.c
-@@ -21,6 +21,8 @@ char *selinux_mnt = NULL;
- int selinux_page_size = 0;
- int obj_class_compat = 1;
- 
-+int has_selinux_config = 0;
+diff --git libselinux-2.3/src/load_policy.c libselinux-2.3/src/load_policy.c
+index e419f1a..275672d 100644
+--- libselinux-2.3/src/load_policy.c
++++ libselinux-2.3/src/load_policy.c
+@@ -16,6 +16,82 @@
+ #include <dlfcn.h>
+ #include "policy.h"
+ #include <limits.h>
++#include <lzma.h>
 +
- /* Verify the mount point for selinux file system has a selinuxfs.
-    If the file system:
-    * Exist,
-@@ -151,6 +153,9 @@ static void init_lib(void)
++static char *lzmaread(int fd, size_t *rsize) {
++	int capacity = 64*1024;
++	char *buf = NULL;
++	int tmpsize = 8 * 1024;
++	unsigned char tmp[tmpsize];
++	unsigned char tmp_out[tmpsize];
++	size_t size = 0;
++	lzma_stream strm = LZMA_STREAM_INIT;
++	lzma_action action = LZMA_RUN;
++	lzma_ret ret;
++	
++	FILE *stream = fdopen (fd, "r");
++	if (!stream) {
++		return NULL;
++	}
++	ret = lzma_stream_decoder(&strm, UINT64_MAX,
++				  LZMA_CONCATENATED);
++	
++	strm.avail_in = 0;
++	strm.next_out = tmp_out;
++	strm.avail_out = tmpsize;
++	
++	buf = (char *) malloc (capacity);
++	if (!buf)
++		goto err;
++	
++	while (1) {
++		if (strm.avail_in == 0) {
++			strm.next_in = tmp;
++			strm.avail_in = fread(tmp, 1, tmpsize, stream);
++			
++			if (ferror(stream)) {
++				// POSIX says that fread() sets errno if
++				// an error occurred. ferror() doesn't
++				// touch errno.
++				goto err;
++			}
++			if (feof(stream)) action = LZMA_FINISH;
++		}
++		
++		ret = lzma_code(&strm, action);
++		
++		// Write and check write error before checking decoder error.
++		// This way as much data as possible gets written to output
++		// even if decoder detected an error.
++		if (strm.avail_out == 0 || ret != LZMA_OK) {
++			const size_t num =  tmpsize - strm.avail_out;
++			if (num > capacity) {
++				buf = (char*) realloc (buf, size*2);
++				capacity = size;
++			}
++			memcpy (buf+size, tmp_out, num);
++			capacity -= num;
++			size += num;
++			strm.next_out = tmp_out;
++			strm.avail_out = tmpsize;
++		}
++		if (ret != LZMA_OK) {
++			if (ret == LZMA_STREAM_END) {
++				break;
++			} else {
++				goto err;
++			}
++		}
++	}
++	*rsize = size;
++	
++	goto exit;
++err:
++	free(buf); buf = NULL;
++exit:
++	lzma_end(&strm);
++	return buf;
++}
+ 
+ int security_load_policy(void *data, size_t len)
  {
- 	selinux_page_size = sysconf(_SC_PAGE_SIZE);
- 	init_selinuxmnt();
-+#ifndef ANDROID
-+	has_selinux_config = (access(SELINUXCONFIG, F_OK) == 0);
-+#endif
- }
- 
- static void fini_lib(void) __attribute__ ((destructor));
-diff --git libselinux-2.3/src/label_android_property.c libselinux-2.3/src/label_android_property.c
-index b00eb07..5e1b76e 100644
---- libselinux-2.3/src/label_android_property.c
-+++ libselinux-2.3/src/label_android_property.c
-@@ -101,7 +101,7 @@ static int process_line(struct selabel_handle *rec,
- 	items = sscanf(line_buf, "%255s %255s", prop, context);
- 	if (items != 2) {
- 		selinux_log(SELINUX_WARNING,
--			    "%s:  line %d is missing fields, skipping\n", path,
-+			    "%s:  line %u is missing fields, skipping\n", path,
- 			    lineno);
- 		return 0;
- 	}
-@@ -111,7 +111,7 @@ static int process_line(struct selabel_handle *rec,
- 		spec_arr[nspec].property_key = strdup(prop);
- 		if (!spec_arr[nspec].property_key) {
- 			selinux_log(SELINUX_WARNING,
--				    "%s:  out of memory at line %d on prop %s\n",
-+				    "%s:  out of memory at line %u on prop %s\n",
- 				    path, lineno, prop);
- 			return -1;
- 
-@@ -120,7 +120,7 @@ static int process_line(struct selabel_handle *rec,
- 		spec_arr[nspec].lr.ctx_raw = strdup(context);
- 		if (!spec_arr[nspec].lr.ctx_raw) {
- 			selinux_log(SELINUX_WARNING,
--				    "%s:  out of memory at line %d on context %s\n",
-+				    "%s:  out of memory at line %u on context %s\n",
- 				    path, lineno, context);
- 			return -1;
- 		}
-diff --git libselinux-2.3/src/label_db.c libselinux-2.3/src/label_db.c
-index ab0696a..00503a5 100644
---- libselinux-2.3/src/label_db.c
-+++ libselinux-2.3/src/label_db.c
-@@ -105,12 +105,12 @@ process_line(const char *path, char *line_buf, unsigned int line_num,
- 	 *   <object class> <object name> <security context>
- 	 */
- 	type = key = context = temp = NULL;
--	items = sscanf(line_buf, "%as %as %as %as",
-+	items = sscanf(line_buf, "%ms %ms %ms %ms",
- 		       &type, &key, &context, &temp);
- 	if (items != 3) {
- 		if (items > 0)
- 			selinux_log(SELINUX_WARNING,
--				    "%s:  line %d has invalid format, skipped",
-+				    "%s:  line %u has invalid format, skipped",
- 				    path, line_num);
- 		goto skip;
- 	}
-@@ -142,7 +142,7 @@ process_line(const char *path, char *line_buf, unsigned int line_num,
- 		spec->type = SELABEL_DB_LANGUAGE;
- 	else {
- 		selinux_log(SELINUX_WARNING,
--			    "%s:  line %d has invalid object type %s\n",
-+			    "%s:  line %u has invalid object type %s\n",
- 			    path, line_num, type);
- 		goto skip;
- 	}
-diff --git libselinux-2.3/src/label_file.c libselinux-2.3/src/label_file.c
-index 615aea9..c01991c 100644
---- libselinux-2.3/src/label_file.c
-+++ libselinux-2.3/src/label_file.c
-@@ -170,10 +170,10 @@ static int process_line(struct selabel_handle *rec,
- 	/* Skip comment lines and empty lines. */
- 	if (*buf_p == '#' || *buf_p == 0)
- 		return 0;
--	items = sscanf(line_buf, "%as %as %as", &regex, &type, &context);
-+	items = sscanf(line_buf, "%ms %ms %ms", &regex, &type, &context);
- 	if (items < 2) {
- 		COMPAT_LOG(SELINUX_WARNING,
--			    "%s:  line %d is missing fields, skipping\n", path,
-+			    "%s:  line %u is missing fields, skipping\n", path,
- 			    lineno);
- 		if (items == 1)
- 			free(regex);
-@@ -204,7 +204,7 @@ static int process_line(struct selabel_handle *rec,
- 	spec_arr[nspec].stem_id = find_stem_from_spec(data, regex);
- 	spec_arr[nspec].regex_str = regex;
- 	if (rec->validating && compile_regex(data, &spec_arr[nspec], &errbuf)) {
--		COMPAT_LOG(SELINUX_WARNING, "%s:  line %d has invalid regex %s:  %s\n",
-+		COMPAT_LOG(SELINUX_WARNING, "%s:  line %u has invalid regex %s:  %s\n",
- 			   path, lineno, regex, (errbuf ? errbuf : "out of memory"));
+@@ -55,7 +131,7 @@ int selinux_mkload_policy(int preservebools)
+ 	struct stat sb;
+ 	struct utsname uts;
+ 	size_t size;
+-	void *map, *data;
++	void *map = NULL, *data=NULL;
+ 	int fd, rc = -1, prot;
+ 	sepol_policydb_t *policydb;
+ 	sepol_policy_file_t *pf;
+@@ -181,24 +257,28 @@ checkbool:
+ 		goto dlclose;
  	}
  
-@@ -214,7 +214,7 @@ static int process_line(struct selabel_handle *rec,
- 	if (type) {
- 		mode_t mode = string_to_mode(type);
- 		if (mode == -1) {
--			COMPAT_LOG(SELINUX_WARNING, "%s:  line %d has invalid file type %s\n",
-+			COMPAT_LOG(SELINUX_WARNING, "%s:  line %u has invalid file type %s\n",
- 				   path, lineno, type);
- 			mode = 0;
- 		}
-diff --git libselinux-2.3/src/label_media.c libselinux-2.3/src/label_media.c
-index 227785f..a09486b 100644
---- libselinux-2.3/src/label_media.c
-+++ libselinux-2.3/src/label_media.c
-@@ -44,10 +44,10 @@ static int process_line(const char *path, char *line_buf, int pass,
- 	/* Skip comment lines and empty lines. */
- 	if (*buf_p == '#' || *buf_p == 0)
- 		return 0;
--	items = sscanf(line_buf, "%as %as ", &key, &context);
-+	items = sscanf(line_buf, "%ms %ms ", &key, &context);
- 	if (items < 2) {
- 		selinux_log(SELINUX_WARNING,
--			  "%s:  line %d is missing fields, skipping\n", path,
-+			  "%s:  line %u is missing fields, skipping\n", path,
- 			  lineno);
- 		if (items == 1)
- 			free(key);
-diff --git libselinux-2.3/src/label_x.c libselinux-2.3/src/label_x.c
-index 896ef02..8435b76 100644
---- libselinux-2.3/src/label_x.c
-+++ libselinux-2.3/src/label_x.c
-@@ -46,10 +46,10 @@ static int process_line(const char *path, char *line_buf, int pass,
- 	/* Skip comment lines and empty lines. */
- 	if (*buf_p == '#' || *buf_p == 0)
- 		return 0;
--	items = sscanf(line_buf, "%as %as %as ", &type, &key, &context);
-+	items = sscanf(line_buf, "%ms %ms %ms ", &type, &key, &context);
- 	if (items < 3) {
- 		selinux_log(SELINUX_WARNING,
--			    "%s:  line %d is missing fields, skipping\n", path,
-+			    "%s:  line %u is missing fields, skipping\n", path,
- 			    lineno);
- 		if (items > 0)
- 			free(type);
-@@ -76,7 +76,7 @@ static int process_line(const char *path, char *line_buf, int pass,
- 			data->spec_arr[data->nspec].type = SELABEL_X_POLYSELN;
- 		else {
- 			selinux_log(SELINUX_WARNING,
--				    "%s:  line %d has invalid object type %s\n",
-+				    "%s:  line %u has invalid object type %s\n",
- 				    path, lineno, type);
- 			return 0;
+-	if (fstat(fd, &sb) < 0) {
+-		fprintf(stderr,
+-			"SELinux:  Could not stat policy file %s:  %s\n",
+-			path, strerror(errno));
+-		goto close;
+-	}
+-
+-	prot = PROT_READ;
+-	if (setlocaldefs || preservebools)
+-		prot |= PROT_WRITE;
++	data = lzmaread(fd,&size);
+ 
+-	size = sb.st_size;
+-	data = map = mmap(NULL, size, prot, MAP_PRIVATE, fd, 0);
+-	if (map == MAP_FAILED) {
+-		fprintf(stderr,
+-			"SELinux:  Could not map policy file %s:  %s\n",
++	if (!data) {
++		if (fstat(fd, &sb) < 0) {
++			fprintf(stderr,
++				"SELinux:  Could not stat policy file %s:  %s\n",
+ 			path, strerror(errno));
+-		goto close;
++			goto close;
++		}
++		
++		prot = PROT_READ;
++		if (setlocaldefs || preservebools)
++			prot |= PROT_WRITE;
++		
++		size = sb.st_size;
++		data = map = mmap(NULL, size, prot, MAP_PRIVATE, fd, 0);
++		if (map == MAP_FAILED) {
++			fprintf(stderr,
++				"SELinux:  Could not map policy file %s:  %s\n",
++				path, strerror(errno));
++			goto close;
++		}
+ 	}
+ 
+ 	if (vers > kernvers && usesepol) {
+@@ -210,6 +290,8 @@ checkbool:
+ 			goto unmap;
  		}
+ 		policy_file_set_mem(pf, data, size);
++		if (!map)
++			free(data);
+ 		if (policydb_read(policydb, pf)) {
+ 			policy_file_free(pf);
+ 			policydb_free(policydb);
+@@ -223,7 +305,8 @@ checkbool:
+ 				path);
+ 			policy_file_free(pf);
+ 			policydb_free(policydb);
+-			munmap(map, sb.st_size);
++			if (map)
++				munmap(map, sb.st_size);
+ 			close(fd);
+ 			vers--;
+ 			goto search;
+@@ -275,7 +358,7 @@ checkbool:
+ #endif
+ 	}
+ 
+-
++	
+ 	rc = security_load_policy(data, size);
+ 	
+ 	if (rc)
+@@ -286,7 +369,8 @@ checkbool:
+       unmap:
+ 	if (data != map)
+ 		free(data);
+-	munmap(map, sb.st_size);
++	if (map)
++		munmap(map, sb.st_size);
+       close:
+ 	close(fd);
+       dlclose:
 diff --git libselinux-2.3/src/lsetfilecon.c libselinux-2.3/src/lsetfilecon.c
 index 1d3b28a..ea6d70b 100644
 --- libselinux-2.3/src/lsetfilecon.c
@@ -1108,7 +1030,7 @@ index 1d3b28a..ea6d70b 100644
  		char * ccontext = NULL;
  		int err = errno;
 diff --git libselinux-2.3/src/matchpathcon.c libselinux-2.3/src/matchpathcon.c
-index 3b96b1d..3868711 100644
+index 3b96b1d..d5c90f6 100644
 --- libselinux-2.3/src/matchpathcon.c
 +++ libselinux-2.3/src/matchpathcon.c
 @@ -2,6 +2,7 @@
@@ -1128,29 +1050,11 @@ index 3b96b1d..3868711 100644
  	va_end(ap);
  }
  
-@@ -541,7 +542,7 @@ int compat_validate(struct selabel_handle *rec,
- 		if (rc < 0) {
- 			if (lineno) {
- 				COMPAT_LOG(SELINUX_WARNING,
--					    "%s: line %d has invalid context %s\n",
-+					    "%s: line %u has invalid context %s\n",
- 						path, lineno, *ctx);
- 			} else {
- 				COMPAT_LOG(SELINUX_WARNING,
 diff --git libselinux-2.3/src/selinux_config.c libselinux-2.3/src/selinux_config.c
-index 30e9dc7..bec5f3b 100644
+index 30e9dc7..1bfe500 100644
 --- libselinux-2.3/src/selinux_config.c
 +++ libselinux-2.3/src/selinux_config.c
-@@ -13,8 +13,6 @@
- #include "selinux_internal.h"
- #include "get_default_type_internal.h"
- 
--#define SELINUXDIR "/etc/selinux/"
--#define SELINUXCONFIG SELINUXDIR "config"
- #define SELINUXDEFAULT "targeted"
- #define SELINUXTYPETAG "SELINUXTYPE="
- #define SELINUXTAG "SELINUX="
-@@ -50,8 +48,9 @@
+@@ -50,8 +50,9 @@
  #define FILE_CONTEXT_SUBS_DIST 25
  #define LXC_CONTEXTS      26
  #define BOOLEAN_SUBS      27
@@ -1162,7 +1066,7 @@ index 30e9dc7..bec5f3b 100644
  
  /* Part of one-time lazy init */
  static pthread_once_t once = PTHREAD_ONCE_INIT;
-@@ -493,6 +492,13 @@ const char *selinux_lxc_contexts_path(void)
+@@ -493,6 +494,13 @@ const char *selinux_lxc_contexts_path(void)
  
  hidden_def(selinux_lxc_contexts_path)
  
@@ -1177,7 +1081,7 @@ index 30e9dc7..bec5f3b 100644
  {
  	return get_path(SYSTEMD_CONTEXTS);
 diff --git libselinux-2.3/src/selinux_internal.h libselinux-2.3/src/selinux_internal.h
-index afb2170..9b1ca4d 100644
+index afb2170..fe8eb67 100644
 --- libselinux-2.3/src/selinux_internal.h
 +++ libselinux-2.3/src/selinux_internal.h
 @@ -82,6 +82,7 @@ hidden_proto(selinux_mkload_policy)
@@ -1188,32 +1092,6 @@ index afb2170..9b1ca4d 100644
      hidden_proto(selinux_sepgsql_context_path)
      hidden_proto(selinux_systemd_contexts_path)
      hidden_proto(selinux_path)
-@@ -137,3 +138,8 @@ extern int selinux_page_size hidden;
- 		if (pthread_setspecific != NULL)		\
- 			pthread_setspecific(KEY, VALUE);	\
- 	} while (0)
-+
-+#define SELINUXDIR "/etc/selinux/"
-+#define SELINUXCONFIG SELINUXDIR "config"
-+
-+extern int has_selinux_config hidden;
-diff --git libselinux-2.3/src/selinuxswig_python.i libselinux-2.3/src/selinuxswig_python.i
-index ae72246..c9a2341 100644
---- libselinux-2.3/src/selinuxswig_python.i
-+++ libselinux-2.3/src/selinuxswig_python.i
-@@ -31,9 +31,9 @@ def restorecon(path, recursive=False):
-             lsetfilecon(path, context)
- 
-         if recursive:
--            os.path.walk(path, lambda arg, dirname, fnames:
--                             map(restorecon, [os.path.join(dirname, fname)
--                                              for fname in fnames]), None)
-+            for root, dirs, files in os.walk(path):
-+                for name in files + dirs:
-+                   restorecon(os.path.join(root, name))
- 
- def chcon(path, context, recursive=False):
-     """ Set the SELinux context on a given path """
 diff --git libselinux-2.3/src/setfilecon.c libselinux-2.3/src/setfilecon.c
 index d05969c..3f0200e 100644
 --- libselinux-2.3/src/setfilecon.c
@@ -1233,21 +1111,8 @@ index d05969c..3f0200e 100644
  	if (rc < 0 && errno == ENOTSUP) {
  		char * ccontext = NULL;
  		int err = errno;
-diff --git libselinux-2.3/utils/Makefile libselinux-2.3/utils/Makefile
-index f469924..5499538 100644
---- libselinux-2.3/utils/Makefile
-+++ libselinux-2.3/utils/Makefile
-@@ -11,7 +11,7 @@ CFLAGS ?= -O -Wall -W -Wundef -Wformat-y2k -Wformat-security -Winit-self -Wmissi
-           -Wstrict-prototypes -Wold-style-definition -Wmissing-prototypes \
-           -Wmissing-declarations -Wmissing-noreturn -Wmissing-format-attribute \
-           -Wredundant-decls -Wnested-externs -Winline -Winvalid-pch -Wvolatile-register-var \
--          -Wdisabled-optimization -Wbuiltin-macro-redefined -Wmudflap -Wpacked-bitfield-compat \
-+          -Wdisabled-optimization -Wbuiltin-macro-redefined -Wpacked-bitfield-compat \
-           -Wsync-nand -Wattributes -Wcoverage-mismatch -Wmultichar -Wcpp \
-           -Wdeprecated-declarations -Wdiv-by-zero -Wdouble-promotion -Wendif-labels -Wextra \
-           -Wformat-contains-nul -Wformat-extra-args -Wformat-zero-length -Wformat=2 -Wmultichar \
 diff --git libselinux-2.3/utils/sefcontext_compile.c libselinux-2.3/utils/sefcontext_compile.c
-index 0adc968..fa392d1 100644
+index 0adc968..9618989 100644
 --- libselinux-2.3/utils/sefcontext_compile.c
 +++ libselinux-2.3/utils/sefcontext_compile.c
 @@ -4,6 +4,9 @@
@@ -1260,15 +1125,6 @@ index 0adc968..fa392d1 100644
  
  #include <linux/limits.h>
  
-@@ -70,7 +73,7 @@ static int process_file(struct saved_data *data, const char *filename)
- 		spec->lr.ctx_raw = context;
- 		spec->mode = string_to_mode(mode);
- 		if (spec->mode == -1) {
--			fprintf(stderr, "%s: line %d has invalid file type %s\n",
-+			fprintf(stderr, "%s: line %u has invalid file type %s\n",
- 				regex, line_num + 1, mode);
- 			spec->mode = 0;
- 		}
 @@ -323,6 +326,7 @@ int main(int argc, char *argv[])
  	int rc;
  	char *tmp= NULL;
@@ -1302,16 +1158,3 @@ index 0adc968..fa392d1 100644
  	rc = write_binary_file(&data, fd);
  
  	if (rc < 0)
-diff --git libselinux-2.3/utils/togglesebool.c libselinux-2.3/utils/togglesebool.c
-index ad0d2a2..309f83b 100644
---- libselinux-2.3/utils/togglesebool.c
-+++ libselinux-2.3/utils/togglesebool.c
-@@ -86,7 +86,7 @@ int main(int argc, char **argv)
- 					       argv[i], pwd->pw_name);
- 				else
- 					syslog(LOG_NOTICE,
--					       "The %s policy boolean was toggled by uid:%d",
-+					       "The %s policy boolean was toggled by uid:%u",
- 					       argv[i], getuid());
- 
- 			}

libselinux.spec

@@ -9,7 +9,7 @@
 Summary: SELinux library and simple utilities
 Name: libselinux
 Version: 2.3
-Release: 10%{?dist}
+Release: 10%{?dist}.1
 License: Public Domain
 Group: System Environment/Libraries
 # https://github.com/SELinuxProject/selinux/wiki/Releases
@@ -245,18 +245,9 @@ rm -rf %{buildroot}
 %{ruby_vendorarchdir}/selinux.so
 
 %changelog
-* Tue May 12 2015 Petr Lautrbach <plautrba@redhat.com> 2.3-10
-- is_selinux_enabled: Add /etc/selinux/config test (#1219045)
+* Thu Jun 25 2015 Petr Lautrbach <plautrba@redhat.com> 2.3-10.1
 - matchpathcon/selabel_file: Fix man pages (#1219718)
 
-* Thu Apr 23 2015 Petr Lautrbach <plautrba@redhat.com> 2.3-9
-- revert support for policy compressed with xv (#1185266)
-
-* Tue Apr 21 2015 Petr Lautrbach <plautrba@redhat.com> 2.3-8
-- selinux.py - use os.walk() instead of os.path.walk() (#1195004)
-- is_selinux_enabled(): drop no-policy-loaded test (#1195074)
-- fix -Wformat errors and remove deprecated mudflap option
-
 * Mon Mar 16 2015 Than Ngo <than@redhat.com> - 2.3-7
 - bump release and rebuild so that koji-shadow can rebuild it
   against new gcc on secondary arch

make-rhat-patches.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 
 LIBSELINUX_VERSION=2.3
-BRANCH=master
+BRANCH=f21
 
 REBASEDIR=`mktemp -d rebase.XXXXXX`
 pushd $REBASEDIR