Revert patches

* reserve policycapability for redhat testing of ptrace child
	* cosmetic changes to make the source easier to read
	* prepend instead of append to filename_trans list
	* Android/MacOS X build support
	* allocate enough space to hold filename in trans rules

.gitignore

@@ -157,3 +157,5 @@ libsepol-2.0.41.tgz
 /libsepol-2.1.2.tgz
 /libsepol-2.1.3.tgz
 /libsepol-2.1.4.tgz
+/libsepol-2.1.5.tgz
+/libsepol-2.1.7.tgz

libsepol-bad.patch

@@ -0,0 +1,175 @@
+diff --git a/libsepol/include/sepol/policydb/polcaps.h b/libsepol/include/sepol/policydb/polcaps.h
+diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c
+index bef759c..4663321 100644
+--- a/libsepol/src/expand.c
++++ b/libsepol/src/expand.c
+@@ -49,6 +49,79 @@ typedef struct expand_state {
+ 	int expand_neverallow;
+ } expand_state_t;
+ 
++struct linear_probe {
++	filename_trans_t **table;	/* filename_trans chunks with same stype */
++	filename_trans_t **ends;	/* pointers to ends of **table chunks */
++	uint32_t length;		/* length of the table */
++};
++
++static int linear_probe_create(struct linear_probe *probe, uint32_t length)
++{
++	probe->table = calloc(length, sizeof(*probe->table));
++	if (probe->table == NULL)
++		return -1;
++
++	probe->ends = calloc(length, sizeof(*probe->ends));
++	if (probe->ends == NULL)
++		return -1;
++
++	probe->length = length;
++
++	return 0;
++}
++
++static void linear_probe_destroy(struct linear_probe *probe)
++{
++	if (probe->length == 0)
++		return;
++
++	free(probe->table);
++	free(probe->ends);
++	memset(probe, 0, sizeof(*probe));
++}
++
++static void linear_probe_insert(struct linear_probe *probe, uint32_t key,
++				filename_trans_t *data)
++{
++	assert(probe->length > key);
++
++	if (probe->table[key] != NULL) {
++		data->next = probe->table[key];
++		probe->table[key] = data;
++	} else {
++		probe->table[key] = probe->ends[key] = data;
++	}
++}
++
++static filename_trans_t *linear_probe_find(struct linear_probe *probe, uint32_t key)
++{
++	assert(probe->length > key);
++
++	return probe->table[key];
++}
++
++/* Returns all chunks stored in the *probe as single-linked list */
++static filename_trans_t *linear_probe_dump(struct linear_probe *probe,
++					   filename_trans_t **endp)
++{
++	uint32_t i;
++	filename_trans_t *result = NULL;
++	filename_trans_t *end = NULL;
++
++	for (i = 0; i < probe->length; i++) {
++		if (probe->table[i] != NULL) {
++			if (end == NULL)
++				end = probe->ends[i];
++			probe->ends[i]->next = result;
++			result = probe->table[i];
++			probe->table[i] = probe->ends[i] = NULL;
++		}
++	}
++
++	*endp = end;
++	return result;
++}
++
+ static void expand_state_init(expand_state_t * state)
+ {
+ 	memset(state, 0, sizeof(expand_state_t));
+@@ -1352,10 +1425,20 @@ static int copy_role_trans(expand_state_t * state, role_trans_rule_t * rules)
+ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *rules)
+ {
+ 	unsigned int i, j;
+-	filename_trans_t *new_trans, *cur_trans;
++	filename_trans_t *new_trans, *cur_trans, *end;
+ 	filename_trans_rule_t *cur_rule;
+ 	ebitmap_t stypes, ttypes;
+ 	ebitmap_node_t *snode, *tnode;
++	struct linear_probe probe;
++
++	/*
++	 * Linear probing speeds-up finding filename_trans rules with certain
++	 * "stype" value.
++	 */
++	if (linear_probe_create(&probe, 4096)) { /* Assume 4096 is enough for most cases */
++		ERR(state->handle, "Out of memory!");
++		return -1;
++	}
+ 
+ 	cur_rule = rules;
+ 	while (cur_rule) {
+@@ -1378,6 +1461,14 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
+ 
+ 		mapped_otype = state->typemap[cur_rule->otype - 1];
+ 
++		if (ebitmap_length(&stypes) > probe.length) {
++			linear_probe_destroy(&probe);
++			if (linear_probe_create(&probe, ebitmap_length(&stypes))) {
++				ERR(state->handle, "Out of memory!");
++				return -1;
++			}
++		}
++
+ 		ebitmap_for_each_bit(&stypes, snode, i) {
+ 			if (!ebitmap_node_get_bit(snode, i))
+ 				continue;
+@@ -1385,16 +1476,14 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
+ 				if (!ebitmap_node_get_bit(tnode, j))
+ 					continue;
+ 
+-				cur_trans = state->out->filename_trans;
+-				while (cur_trans) {
+-					if ((cur_trans->stype == i + 1) &&
+-					    (cur_trans->ttype == j + 1) &&
++				cur_trans = linear_probe_find(&probe, i);
++				while (cur_trans != NULL) {
++					if ((cur_trans->ttype == j + 1) &&
+ 					    (cur_trans->tclass == cur_rule->tclass) &&
+ 					    (!strcmp(cur_trans->name, cur_rule->name))) {
+ 						/* duplicate rule, who cares */
+ 						if (cur_trans->otype == mapped_otype)
+ 							break;
+-
+ 						ERR(state->handle, "Conflicting filename trans rules %s %s %s : %s otype1:%s otype2:%s",
+ 						    cur_trans->name,
+ 						    state->out->p_type_val_to_name[i],
+@@ -1402,7 +1491,7 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
+ 						    state->out->p_class_val_to_name[cur_trans->tclass - 1],
+ 						    state->out->p_type_val_to_name[cur_trans->otype - 1],
+ 						    state->out->p_type_val_to_name[mapped_otype - 1]);
+-						    
++
+ 						return -1;
+ 					}
+ 					cur_trans = cur_trans->next;
+@@ -1417,8 +1506,6 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
+ 					return -1;
+ 				}
+ 				memset(new_trans, 0, sizeof(*new_trans));
+-				new_trans->next = state->out->filename_trans;
+-				state->out->filename_trans = new_trans;
+ 
+ 				new_trans->name = strdup(cur_rule->name);
+ 				if (!new_trans->name) {
+@@ -1429,9 +1516,14 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
+ 				new_trans->ttype = j + 1;
+ 				new_trans->tclass = cur_rule->tclass;
+ 				new_trans->otype = mapped_otype;
++				linear_probe_insert(&probe, i, new_trans);
+ 			}
+ 		}
+ 
++		cur_trans = linear_probe_dump(&probe, &end);
++		end->next = state->out->filename_trans;
++		state->out->filename_trans = cur_trans;
++
+ 		ebitmap_destroy(&stypes);
+ 		ebitmap_destroy(&ttypes);
+ 

libsepol-rhat.patch

@@ -1,241 +1,260 @@
-diff --git a/libsepol/include/sepol/policydb/policydb.h b/libsepol/include/sepol/policydb/policydb.h
-index 1848a7b..f53a499 100644
---- a/libsepol/include/sepol/policydb/policydb.h
-+++ b/libsepol/include/sepol/policydb/policydb.h
-@@ -111,6 +111,19 @@ typedef struct class_datum {
- 	symtab_t permissions;	/* class-specific permission symbol table */
- 	constraint_node_t *constraints;	/* constraints on class permissions */
- 	constraint_node_t *validatetrans;	/* special transition rules */
-+/* Options how a new object user and role should be decided */
-+#define DEFAULT_SOURCE		1
-+#define DEFAULT_TARGET		2
-+	char default_user;
-+	char default_role;
-+/* Options how a new object range should be decided */
-+#define DEFAULT_SOURCE_LOW	1
-+#define DEFAULT_SOURCE_HIGH	2
-+#define DEFAULT_SOURCE_LOW_HIGH	3
-+#define DEFAULT_TARGET_LOW	4
-+#define DEFAULT_TARGET_HIGH	5
-+#define DEFAULT_TARGET_LOW_HIGH	6
-+	char default_range;
- } class_datum_t;
- 
- /* Role attributes */
-@@ -667,10 +680,11 @@ extern int policydb_set_target_platform(policydb_t *p, int platform);
- #define POLICYDB_VERSION_BOUNDARY	24
- #define POLICYDB_VERSION_FILENAME_TRANS	25
- #define POLICYDB_VERSION_ROLETRANS	26
-+#define POLICYDB_VERSION_NEW_OBJECT_DEFAULTS	27
- 
- /* Range of policy versions we understand*/
- #define POLICYDB_VERSION_MIN	POLICYDB_VERSION_BASE
--#define POLICYDB_VERSION_MAX	POLICYDB_VERSION_ROLETRANS
-+#define POLICYDB_VERSION_MAX	POLICYDB_VERSION_NEW_OBJECT_DEFAULTS
- 
- /* Module versions and specific changes*/
- #define MOD_POLICYDB_VERSION_BASE		4
-@@ -686,9 +700,10 @@ extern int policydb_set_target_platform(policydb_t *p, int platform);
- #define MOD_POLICYDB_VERSION_ROLETRANS		12
- #define MOD_POLICYDB_VERSION_ROLEATTRIB		13
- #define MOD_POLICYDB_VERSION_TUNABLE_SEP	14
-+#define MOD_POLICYDB_VERSION_NEW_OBJECT_DEFAULTS	15
- 
- #define MOD_POLICYDB_VERSION_MIN MOD_POLICYDB_VERSION_BASE
--#define MOD_POLICYDB_VERSION_MAX MOD_POLICYDB_VERSION_TUNABLE_SEP
-+#define MOD_POLICYDB_VERSION_MAX MOD_POLICYDB_VERSION_NEW_OBJECT_DEFAULTS
- 
- #define POLICYDB_CONFIG_MLS    1
- 
+diff --git a/libsepol/include/sepol/policydb/polcaps.h b/libsepol/include/sepol/policydb/polcaps.h
+index 481c0ba..f90a48d 100644
+--- a/libsepol/include/sepol/policydb/polcaps.h
++++ b/libsepol/include/sepol/policydb/polcaps.h
+@@ -6,6 +6,7 @@ enum {
+ 	POLICYDB_CAPABILITY_NETPEER,
+ 	POLICYDB_CAPABILITY_OPENPERM,
+ 	POLICYDB_CAPABILITY_REDHAT1, /* reserved for RH testing of ptrace_child */
++	POLICYDB_CAPABILITY_ALWAYSNETWORK,
+ 	__POLICYDB_CAPABILITY_MAX
+ };
+ #define POLICYDB_CAPABILITY_MAX (__POLICYDB_CAPABILITY_MAX - 1)
 diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c
-index 493e478..73b9107 100644
+index bef759c..4663321 100644
 --- a/libsepol/src/expand.c
 +++ b/libsepol/src/expand.c
-@@ -358,6 +358,35 @@ static int constraint_node_clone(constraint_node_t ** dst,
- 	return -1;
- }
+@@ -49,6 +49,79 @@ typedef struct expand_state {
+ 	int expand_neverallow;
+ } expand_state_t;
  
-+static int class_copy_default_new_object(expand_state_t *state,
-+					 class_datum_t *olddatum,
-+					 class_datum_t *newdatum)
-+{
-+	if (olddatum->default_user) {
-+		if (newdatum->default_user && olddatum->default_user != newdatum->default_user) {
-+			ERR(state->handle, "Found conflicting default user definitions");
-+			return SEPOL_ENOTSUP;
-+		}
-+		newdatum->default_user = olddatum->default_user;
++struct linear_probe {
++	filename_trans_t **table;	/* filename_trans chunks with same stype */
++	filename_trans_t **ends;	/* pointers to ends of **table chunks */
++	uint32_t length;		/* length of the table */
++};
++
++static int linear_probe_create(struct linear_probe *probe, uint32_t length)
++{
++	probe->table = calloc(length, sizeof(*probe->table));
++	if (probe->table == NULL)
++		return -1;
++
++	probe->ends = calloc(length, sizeof(*probe->ends));
++	if (probe->ends == NULL)
++		return -1;
++
++	probe->length = length;
 +
-+	}
-+	if (olddatum->default_role) {
-+		if (newdatum->default_role && olddatum->default_role != newdatum->default_role) {
-+			ERR(state->handle, "Found conflicting default role definitions");
-+			return SEPOL_ENOTSUP;
-+		}
-+		newdatum->default_role = olddatum->default_role;
-+	}
-+	if (olddatum->default_range) {
-+		if (newdatum->default_range && olddatum->default_range != newdatum->default_range) {
-+			ERR(state->handle, "Found conflicting default range definitions");
-+			return SEPOL_ENOTSUP;
-+		}
-+		newdatum->default_range = olddatum->default_range;
-+	}
 +	return 0;
 +}
 +
- static int class_copy_callback(hashtab_key_t key, hashtab_datum_t datum,
- 			       void *data)
- {
-@@ -393,6 +422,12 @@ static int class_copy_callback(hashtab_key_t key, hashtab_datum_t datum,
- 	new_class->s.value = class->s.value;
- 	state->out->p_classes.nprim++;
- 
-+	ret = class_copy_default_new_object(state, class, new_class);
-+	if (ret) {
-+		free(new_class);
-+		return ret;
-+	}
-+	
- 	new_id = strdup(id);
- 	if (!new_id) {
- 		ERR(state->handle, "Out of memory!");
-diff --git a/libsepol/src/link.c b/libsepol/src/link.c
-index ee9675b..01d3231 100644
---- a/libsepol/src/link.c
-+++ b/libsepol/src/link.c
-@@ -205,6 +205,34 @@ static int permission_copy_callback(hashtab_key_t key, hashtab_datum_t datum,
- 	return ret;
- }
- 
-+static int class_copy_default_new_object(link_state_t *state,
-+					 class_datum_t *olddatum,
-+					 class_datum_t *newdatum)
++static void linear_probe_destroy(struct linear_probe *probe)
 +{
-+	if (olddatum->default_user) {
-+		if (newdatum->default_user && olddatum->default_user != newdatum->default_user) {
-+			ERR(state->handle, "Found conflicting default user definitions");
-+			return SEPOL_ENOTSUP;
-+		}
-+		newdatum->default_user = olddatum->default_user;
-+	}
-+	if (olddatum->default_role) {
-+		if (newdatum->default_role && olddatum->default_role != newdatum->default_role) {
-+			ERR(state->handle, "Found conflicting default role definitions");
-+			return SEPOL_ENOTSUP;
-+		}
-+		newdatum->default_role = olddatum->default_role;
-+	}
-+	if (olddatum->default_range) {
-+		if (newdatum->default_range && olddatum->default_range != newdatum->default_range) {
-+			ERR(state->handle, "Found conflicting default range definitions");
-+			return SEPOL_ENOTSUP;
-+		}
-+		newdatum->default_range = olddatum->default_range;
-+	}
-+	return 0;
++	if (probe->length == 0)
++		return;
++
++	free(probe->table);
++	free(probe->ends);
++	memset(probe, 0, sizeof(*probe));
 +}
 +
- static int class_copy_callback(hashtab_key_t key, hashtab_datum_t datum,
- 			       void *data)
- {
-@@ -287,6 +315,11 @@ static int class_copy_callback(hashtab_key_t key, hashtab_datum_t datum,
- 	state->dest_class = new_class;
- 	state->dest_class_name = (char *)key;
- 
-+	/* copy default new object rules */
-+	ret = class_copy_default_new_object(state, cladatum, new_class);
-+	if (ret)
-+		return ret;
++static void linear_probe_insert(struct linear_probe *probe, uint32_t key,
++				filename_trans_t *data)
++{
++	assert(probe->length > key);
 +
- 	ret =
- 	    hashtab_map(cladatum->permissions.table, permission_copy_callback,
- 			state);
-diff --git a/libsepol/src/policydb.c b/libsepol/src/policydb.c
-index 136b450..a84de2f 100644
---- a/libsepol/src/policydb.c
-+++ b/libsepol/src/policydb.c
-@@ -151,6 +151,13 @@ static struct policydb_compat_info policydb_compat[] = {
- 	 .target_platform = SEPOL_TARGET_SELINUX,
- 	},
- 	{
-+	 .type = POLICY_KERN,
-+	 .version = POLICYDB_VERSION_NEW_OBJECT_DEFAULTS,
-+	 .sym_num = SYM_NUM,
-+	 .ocon_num = OCON_NODE6 + 1,
-+	 .target_platform = SEPOL_TARGET_SELINUX,
-+	},
-+	{
- 	 .type = POLICY_BASE,
- 	 .version = MOD_POLICYDB_VERSION_BASE,
- 	 .sym_num = SYM_NUM,
-@@ -228,6 +235,13 @@ static struct policydb_compat_info policydb_compat[] = {
- 	 .target_platform = SEPOL_TARGET_SELINUX,
- 	},
- 	{
-+	 .type = POLICY_BASE,
-+	 .version = MOD_POLICYDB_VERSION_NEW_OBJECT_DEFAULTS,
-+	 .sym_num = SYM_NUM,
-+	 .ocon_num = OCON_NODE6 + 1,
-+	 .target_platform = SEPOL_TARGET_SELINUX,
-+	},
-+	{
- 	 .type = POLICY_MOD,
- 	 .version = MOD_POLICYDB_VERSION_BASE,
- 	 .sym_num = SYM_NUM,
-@@ -304,6 +318,13 @@ static struct policydb_compat_info policydb_compat[] = {
- 	 .ocon_num = 0,
- 	 .target_platform = SEPOL_TARGET_SELINUX,
- 	},
-+	{
-+	 .type = POLICY_MOD,
-+	 .version = MOD_POLICYDB_VERSION_NEW_OBJECT_DEFAULTS,
-+	 .sym_num = SYM_NUM,
-+	 .ocon_num = 0,
-+	 .target_platform = SEPOL_TARGET_SELINUX,
-+	},
++	if (probe->table[key] != NULL) {
++		data->next = probe->table[key];
++		probe->table[key] = data;
++	} else {
++		probe->table[key] = probe->ends[key] = data;
++	}
++}
++
++static filename_trans_t *linear_probe_find(struct linear_probe *probe, uint32_t key)
++{
++	assert(probe->length > key);
++
++	return probe->table[key];
++}
++
++/* Returns all chunks stored in the *probe as single-linked list */
++static filename_trans_t *linear_probe_dump(struct linear_probe *probe,
++					   filename_trans_t **endp)
++{
++	uint32_t i;
++	filename_trans_t *result = NULL;
++	filename_trans_t *end = NULL;
++
++	for (i = 0; i < probe->length; i++) {
++		if (probe->table[i] != NULL) {
++			if (end == NULL)
++				end = probe->ends[i];
++			probe->ends[i]->next = result;
++			result = probe->table[i];
++			probe->table[i] = probe->ends[i] = NULL;
++		}
++	}
++
++	*endp = end;
++	return result;
++}
++
+ static void expand_state_init(expand_state_t * state)
+ {
+ 	memset(state, 0, sizeof(expand_state_t));
+@@ -1352,10 +1425,20 @@ static int copy_role_trans(expand_state_t * state, role_trans_rule_t * rules)
+ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *rules)
+ {
+ 	unsigned int i, j;
+-	filename_trans_t *new_trans, *cur_trans;
++	filename_trans_t *new_trans, *cur_trans, *end;
+ 	filename_trans_rule_t *cur_rule;
+ 	ebitmap_t stypes, ttypes;
+ 	ebitmap_node_t *snode, *tnode;
++	struct linear_probe probe;
++
++	/*
++	 * Linear probing speeds-up finding filename_trans rules with certain
++	 * "stype" value.
++	 */
++	if (linear_probe_create(&probe, 4096)) { /* Assume 4096 is enough for most cases */
++		ERR(state->handle, "Out of memory!");
++		return -1;
++	}
+ 
+ 	cur_rule = rules;
+ 	while (cur_rule) {
+@@ -1378,6 +1461,14 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
+ 
+ 		mapped_otype = state->typemap[cur_rule->otype - 1];
+ 
++		if (ebitmap_length(&stypes) > probe.length) {
++			linear_probe_destroy(&probe);
++			if (linear_probe_create(&probe, ebitmap_length(&stypes))) {
++				ERR(state->handle, "Out of memory!");
++				return -1;
++			}
++		}
++
+ 		ebitmap_for_each_bit(&stypes, snode, i) {
+ 			if (!ebitmap_node_get_bit(snode, i))
+ 				continue;
+@@ -1385,16 +1476,14 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
+ 				if (!ebitmap_node_get_bit(tnode, j))
+ 					continue;
+ 
+-				cur_trans = state->out->filename_trans;
+-				while (cur_trans) {
+-					if ((cur_trans->stype == i + 1) &&
+-					    (cur_trans->ttype == j + 1) &&
++				cur_trans = linear_probe_find(&probe, i);
++				while (cur_trans != NULL) {
++					if ((cur_trans->ttype == j + 1) &&
+ 					    (cur_trans->tclass == cur_rule->tclass) &&
+ 					    (!strcmp(cur_trans->name, cur_rule->name))) {
+ 						/* duplicate rule, who cares */
+ 						if (cur_trans->otype == mapped_otype)
+ 							break;
+-
+ 						ERR(state->handle, "Conflicting filename trans rules %s %s %s : %s otype1:%s otype2:%s",
+ 						    cur_trans->name,
+ 						    state->out->p_type_val_to_name[i],
+@@ -1402,7 +1491,7 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
+ 						    state->out->p_class_val_to_name[cur_trans->tclass - 1],
+ 						    state->out->p_type_val_to_name[cur_trans->otype - 1],
+ 						    state->out->p_type_val_to_name[mapped_otype - 1]);
+-						    
++
+ 						return -1;
+ 					}
+ 					cur_trans = cur_trans->next;
+@@ -1417,8 +1506,6 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
+ 					return -1;
+ 				}
+ 				memset(new_trans, 0, sizeof(*new_trans));
+-				new_trans->next = state->out->filename_trans;
+-				state->out->filename_trans = new_trans;
+ 
+ 				new_trans->name = strdup(cur_rule->name);
+ 				if (!new_trans->name) {
+@@ -1429,9 +1516,14 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
+ 				new_trans->ttype = j + 1;
+ 				new_trans->tclass = cur_rule->tclass;
+ 				new_trans->otype = mapped_otype;
++				linear_probe_insert(&probe, i, new_trans);
+ 			}
+ 		}
+ 
++		cur_trans = linear_probe_dump(&probe, &end);
++		end->next = state->out->filename_trans;
++		state->out->filename_trans = cur_trans;
++
+ 		ebitmap_destroy(&stypes);
+ 		ebitmap_destroy(&ttypes);
+ 
+@@ -2032,13 +2124,14 @@ static int ocontext_copy_xen(expand_state_t *state)
+ 			else
+ 				state->out->ocontexts[i] = n;
+ 			l = n;
+-			if (context_copy(&n->context[0], &c->context[0],
+-				state)) {
+-				ERR(state->handle, "Out of memory!");
+-				return -1;
+-			}
+ 			switch (i) {
+ 			case OCON_XEN_ISID:
++				if (c->context[0].user == 0) {
++					ERR(state->handle,
++					    "Missing context for %s initial sid",
++					    c->u.name);
++					return -1;
++				}
+ 				n->sid[0] = c->sid[0];
+ 				break;
+ 			case OCON_XEN_PIRQ:
+@@ -2061,6 +2154,11 @@ static int ocontext_copy_xen(expand_state_t *state)
+ 				ERR(state->handle, "Unknown ocontext");
+ 				return -1;
+ 			}
++			if (context_copy(&n->context[0], &c->context[0],
++				state)) {
++				ERR(state->handle, "Out of memory!");
++				return -1;
++			}
+ 		}
+ 	}
+ 	return 0;
+@@ -2085,12 +2183,14 @@ static int ocontext_copy_selinux(expand_state_t *state)
+ 			else
+ 				state->out->ocontexts[i] = n;
+ 			l = n;
+-			if (context_copy(&n->context[0], &c->context[0], state)) {
+-				ERR(state->handle, "Out of memory!");
+-				return -1;
+-			}
+ 			switch (i) {
+ 			case OCON_ISID:
++				if (c->context[0].user == 0) {
++					ERR(state->handle,
++					    "Missing context for %s initial sid",
++					    c->u.name);
++					return -1;
++				}
+ 				n->sid[0] = c->sid[0];
+ 				break;
+ 			case OCON_FS:	/* FALLTHROUGH */
+@@ -2134,6 +2234,10 @@ static int ocontext_copy_selinux(expand_state_t *state)
+ 				ERR(state->handle, "Unknown ocontext");
+ 				return -1;
+ 			}
++			if (context_copy(&n->context[0], &c->context[0], state)) {
++				ERR(state->handle, "Out of memory!");
++				return -1;
++			}
+ 		}
+ 	}
+ 	return 0;
+diff --git a/libsepol/src/polcaps.c b/libsepol/src/polcaps.c
+index bcaef0c..43a71a7 100644
+--- a/libsepol/src/polcaps.c
++++ b/libsepol/src/polcaps.c
+@@ -9,6 +9,7 @@ static const char *polcap_names[] = {
+ 	"network_peer_controls",	/* POLICYDB_CAPABILITY_NETPEER */
+ 	"open_perms",			/* POLICYDB_CAPABILITY_OPENPERM */
+ 	"redhat1",			/* POLICYDB_CAPABILITY_REDHAT1, aka ptrace_child */
++	"always_check_network",		/* POLICYDB_CAPABILITY_ALWAYSNETWORK */
+ 	NULL
  };
  
- #if 0
-@@ -2064,6 +2085,18 @@ static int class_read(policydb_t * p, hashtab_t h, struct policy_file *fp)
- 			goto bad;
- 	}
- 
-+	if ((p->policy_type == POLICY_KERN &&
-+	     p->policyvers >= POLICYDB_VERSION_NEW_OBJECT_DEFAULTS) ||
-+	    (p->policy_type == POLICY_BASE &&
-+	     p->policyvers >= MOD_POLICYDB_VERSION_NEW_OBJECT_DEFAULTS)) {
-+		rc = next_entry(buf, fp, sizeof(uint32_t) * 3);
-+		if (rc < 0)
-+			goto bad;
-+		cladatum->default_user = le32_to_cpu(buf[0]);
-+		cladatum->default_role = le32_to_cpu(buf[1]);
-+		cladatum->default_range = le32_to_cpu(buf[2]);
-+	}
-+
- 	if (hashtab_insert(h, key, cladatum))
- 		goto bad;
- 
-diff --git a/libsepol/src/write.c b/libsepol/src/write.c
-index e34ab52..22e6143 100644
---- a/libsepol/src/write.c
-+++ b/libsepol/src/write.c
-@@ -976,6 +976,18 @@ static int class_write(hashtab_key_t key, hashtab_datum_t datum, void *ptr)
- 			return POLICYDB_ERROR;
- 	}
- 
-+	if ((p->policy_type == POLICY_KERN &&
-+	     p->policyvers >= POLICYDB_VERSION_NEW_OBJECT_DEFAULTS) ||
-+	    (p->policy_type == POLICY_BASE &&
-+	     p->policyvers >= MOD_POLICYDB_VERSION_NEW_OBJECT_DEFAULTS)) {
-+		buf[0] = cpu_to_le32(cladatum->default_user);
-+		buf[1] = cpu_to_le32(cladatum->default_role);
-+		buf[2] = cpu_to_le32(cladatum->default_range);
-+		items = put_entry(buf, sizeof(uint32_t), 3, fp);
-+		if (items != 3)
-+			return POLICYDB_ERROR;
-+	}
-+
- 	return POLICYDB_SUCCESS;
- }
- 

libsepol.spec

@@ -1,11 +1,12 @@
 Summary: SELinux binary policy manipulation library 
 Name: libsepol
-Version: 2.1.4
-Release: 6%{?dist}
+Version: 2.1.7
+Release: 3%{?dist}
 License: LGPLv2+
 Group: System Environment/Libraries
 Source: http://www.nsa.gov/selinux/archives/libsepol-%{version}.tgz
 Patch: libsepol-rhat.patch
+Patch1: libsepol-bad.patch
 URL: http://www.selinuxproject.org
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -46,6 +47,7 @@ needed for developing applications that manipulate binary policies.
 %prep
 %setup -q
 %patch -p2 -b .rhat
+%patch1 -p2 -R -b .bad
 
 # sparc64 is an -fPIC arch, so we need to fix it here
 %ifarch sparc64
@@ -99,6 +101,30 @@ exit 0
 /%{_lib}/libsepol.so.1
 
 %changelog
+* Tue Jul 24 2012 Dan Walsh <dwalsh@redhat.com> - 2.1.7-3
+- Revert patches
+
+* Thu Jul 19 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.1.7-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
+
+* Wed Jul 4 2012 Dan Walsh <dwalsh@redhat.com> - 2.1.7-1
+- Update to upstream 
+	* reserve policycapability for redhat testing of ptrace child
+	* cosmetic changes to make the source easier to read
+	* prepend instead of append to filename_trans list
+	* Android/MacOS X build support
+	* allocate enough space to hold filename in trans rules
+
+* Mon Apr 23 2012 Dan Walsh <dwalsh@redhat.com> - 2.1.5-3
+- Fix off by one error that is causing file_name transition rules to be expanded- incorrectly on i686 machines
+
+* Tue Apr 17 2012 Dan Walsh <dwalsh@redhat.com> - 2.1.5-2
+- Add support for ptrace_child
+
+* Thu Mar 29 2012 Dan Walsh <dwalsh@redhat.com> - 2.1.5-1
+- Update to upstream 
+  * checkpolicy: implement new default labeling behaviors
+
 * Fri Jan 13 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.1.4-6
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
 

sources

@@ -1 +1 @@
-5906915444f2d9e17fbdce7dd55e3d7d  libsepol-2.1.4.tgz
+332c564144780537c25f4498578e531f  libsepol-2.1.7.tgz