Disable debug packages on riscv64

Temporary change. Debug packages are currently broken.

Signed-off-by: David Abdurachmanov <davidlt@rivosinc.com>

.gitignore

@@ -322,3 +322,25 @@ policycoreutils-2.0.83.tgz
 /selinux-python-3.1.tar.gz
 /selinux-sandbox-3.1.tar.gz
 /semodule-utils-3.1.tar.gz
+/policycoreutils-3.2-rc1.tar.gz
+/restorecond-3.2-rc1.tar.gz
+/selinux-dbus-3.2-rc1.tar.gz
+/selinux-gui-3.2-rc1.tar.gz
+/selinux-python-3.2-rc1.tar.gz
+/selinux-sandbox-3.2-rc1.tar.gz
+/semodule-utils-3.2-rc1.tar.gz
+/policycoreutils-3.2-rc2.tar.gz
+/restorecond-3.2-rc2.tar.gz
+/selinux-dbus-3.2-rc2.tar.gz
+/selinux-gui-3.2-rc2.tar.gz
+/selinux-python-3.2-rc2.tar.gz
+/selinux-sandbox-3.2-rc2.tar.gz
+/semodule-utils-3.2-rc2.tar.gz
+/selinux-3.2.tar.gz
+/selinux-3.3-rc2.tar.gz
+/selinux-3.3-rc3.tar.gz
+/selinux-3.3.tar.gz
+/selinux-3.4-rc1.tar.gz
+/selinux-3.4-rc2.tar.gz
+/selinux-3.4-rc3.tar.gz
+/selinux-3.4.tar.gz

0001-python-audit2allow-add-include-limits.h-to-sepolgen-.patch

@@ -1,34 +0,0 @@
-From ccd973f721c48945fc706d8fef6b396580853a9f Mon Sep 17 00:00:00 2001
-From: "W. Michael Petullo" <mike@flyn.org>
-Date: Thu, 16 Jul 2020 15:29:20 -0500
-Subject: [PATCH] python/audit2allow: add #include <limits.h> to
- sepolgen-ifgen-attr-helper.c
-
-I found that building on OpenWrt/musl failed with:
-
-  sepolgen-ifgen-attr-helper.c:152:16: error: 'PATH_MAX' undeclared ...
-
-Musl is less "generous" than glibc in recursively including header
-files, and I suspect this is the reason for this error. Explicitly
-including limits.h fixes the problem.
-
-Signed-off-by: W. Michael Petullo <mike@flyn.org>
----
- python/audit2allow/sepolgen-ifgen-attr-helper.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/python/audit2allow/sepolgen-ifgen-attr-helper.c b/python/audit2allow/sepolgen-ifgen-attr-helper.c
-index 53f20818722a..f010c9584c1f 100644
---- a/python/audit2allow/sepolgen-ifgen-attr-helper.c
-+++ b/python/audit2allow/sepolgen-ifgen-attr-helper.c
-@@ -28,6 +28,7 @@
- 
- #include <selinux/selinux.h>
- 
-+#include <limits.h>
- #include <stdio.h>
- #include <sys/types.h>
- #include <sys/stat.h>
--- 
-2.29.0
-

0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch

@@ -1,8 +1,9 @@
-From ea624dcc70d93867f23b94c368b8cf102269c13b Mon Sep 17 00:00:00 2001
+From f361ee407490bc74b43ec408b1edc70cd647d4e0 Mon Sep 17 00:00:00 2001
 From: Petr Lautrbach <plautrba@redhat.com>
 Date: Thu, 20 Aug 2015 12:58:41 +0200
 Subject: [PATCH] sandbox: add -reset to Xephyr as it works better with it in
  recent Fedoras
+Content-type: text/plain
 
 ---
  sandbox/sandboxX.sh | 2 +-
@@ -22,5 +23,5 @@ index eaa500d08143..4774528027ef 100644
      cat > ~/seremote << __EOF
  #!/bin/sh
 -- 
-2.29.0
+2.35.1
 

0002-Fix-STANDARD_FILE_CONTEXT-section-in-man-pages.patch

@@ -1,7 +1,8 @@
-From 932c1244bc98d3a05a238f3f0b333cf8c429113b Mon Sep 17 00:00:00 2001
+From 71a2f14767c0ec70c23ecce43d7cbc5404c95552 Mon Sep 17 00:00:00 2001
 From: Dan Walsh <dwalsh@redhat.com>
 Date: Mon, 21 Apr 2014 13:54:40 -0400
 Subject: [PATCH] Fix STANDARD_FILE_CONTEXT section in man pages
+Content-type: text/plain
 
 Signed-off-by: Miroslav Grepl <mgrepl@redhat.com>
 ---
@@ -9,10 +10,10 @@ Signed-off-by: Miroslav Grepl <mgrepl@redhat.com>
  1 file changed, 5 insertions(+), 2 deletions(-)
 
 diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
-index 3e8a3be907e3..a1d70623cff0 100755
+index 3e61e333193f..82338aeeef32 100755
 --- a/python/sepolicy/sepolicy/manpage.py
 +++ b/python/sepolicy/sepolicy/manpage.py
-@@ -735,10 +735,13 @@ Default Defined Ports:""")
+@@ -737,10 +737,13 @@ Default Defined Ports:""")
  
      def _file_context(self):
          flist = []
@@ -26,9 +27,9 @@ index 3e8a3be907e3..a1d70623cff0 100755
                  if f in self.fcdict:
                      mpaths = mpaths + self.fcdict[f]["regex"]
          if len(mpaths) == 0:
-@@ -797,12 +800,12 @@ SELinux %(domainname)s policy is very flexible allowing users to setup their %(d
+@@ -799,12 +802,12 @@ SELinux %(domainname)s policy is very flexible allowing users to setup their %(d
  SELinux defines the file context types for the %(domainname)s, if you wanted to
- store files with these types in a diffent paths, you need to execute the semanage command to sepecify alternate labeling and then use restorecon to put the labels on disk.
+ store files with these types in a diffent paths, you need to execute the semanage command to specify alternate labeling and then use restorecon to put the labels on disk.
  
 -.B semanage fcontext -a -t %(type)s '/srv/%(domainname)s/content(/.*)?'
 +.B semanage fcontext -a -t %(type)s '/srv/my%(domainname)s_content(/.*)?'
@@ -42,5 +43,5 @@ index 3e8a3be907e3..a1d70623cff0 100755
          self.fd.write(r"""
  .I The following file types are defined for %(domainname)s:
 -- 
-2.29.0
+2.35.1
 

0002-restorecond-Set-X-GNOME-HiddenUnderSystemd-true-in-r.patch

@@ -1,26 +0,0 @@
-From 9e2b8c61bfd275d0f007a736721c557755edf4a0 Mon Sep 17 00:00:00 2001
-From: Laurent Bigonville <bigon@bigon.be>
-Date: Thu, 16 Jul 2020 14:22:13 +0200
-Subject: [PATCH] restorecond: Set X-GNOME-HiddenUnderSystemd=true in
- restorecond.desktop file
-
-This completely inactivate the .desktop file incase the user session is
-managed by systemd as restorecond also provide a service file
-
-Signed-off-by: Laurent Bigonville <bigon@bigon.be>
----
- restorecond/restorecond.desktop | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/restorecond/restorecond.desktop b/restorecond/restorecond.desktop
-index af7286801c24..7df854727a3f 100644
---- a/restorecond/restorecond.desktop
-+++ b/restorecond/restorecond.desktop
-@@ -5,3 +5,4 @@ Comment=Fix file context in owned by the user
- Type=Application
- StartupNotify=false
- X-GNOME-Autostart-enabled=false
-+X-GNOME-HiddenUnderSystemd=true
--- 
-2.29.0
-

0003-If-there-is-no-executable-we-don-t-want-to-print-a-p.patch

@@ -1,27 +1,28 @@
-From ae3780eb560fa5f00a3dd591c8233c2a9068a348 Mon Sep 17 00:00:00 2001
+From d55a06c002641dce1301b9b5639bd8e206460724 Mon Sep 17 00:00:00 2001
 From: Miroslav Grepl <mgrepl@redhat.com>
 Date: Mon, 12 May 2014 14:11:22 +0200
 Subject: [PATCH] If there is no executable we don't want to print a part of
  STANDARD FILE CONTEXT
+Content-type: text/plain
 
 ---
  python/sepolicy/sepolicy/manpage.py | 3 ++-
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
-index a1d70623cff0..2d33eabb2536 100755
+index 82338aeeef32..ec8aa1cb94a2 100755
 --- a/python/sepolicy/sepolicy/manpage.py
 +++ b/python/sepolicy/sepolicy/manpage.py
-@@ -793,7 +793,8 @@ SELinux %(domainname)s policy is very flexible allowing users to setup their %(d
+@@ -795,7 +795,8 @@ SELinux %(domainname)s policy is very flexible allowing users to setup their %(d
  .PP
  """ % {'domainname': self.domainname, 'equiv': e, 'alt': e.split('/')[-1]})
  
 -        self.fd.write(r"""
 +        if flist_non_exec:
-+                self.fd.write(r"""
++            self.fd.write(r"""
  .PP
  .B STANDARD FILE CONTEXT
  
 -- 
-2.29.0
+2.35.1
 

0003-fixfiles-correctly-restore-context-of-mountpoints.patch

@@ -1,136 +0,0 @@
-From ba2d6c10635a021d2b1a5fc2123fde13b04295a5 Mon Sep 17 00:00:00 2001
-From: bauen1 <j2468h@googlemail.com>
-Date: Thu, 6 Aug 2020 16:48:36 +0200
-Subject: [PATCH] fixfiles: correctly restore context of mountpoints
-
-By bind mounting every filesystem we want to relabel we can access all
-files without anything hidden due to active mounts.
-
-This comes at the cost of user experience, because setfiles only
-displays the percentage if no path is given or the path is /
-
-Signed-off-by: Jonathan Hettwer <j2468h@gmail.com>
-Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
----
- policycoreutils/scripts/fixfiles   | 29 +++++++++++++++++++++++++----
- policycoreutils/scripts/fixfiles.8 |  8 ++++++--
- 2 files changed, 31 insertions(+), 6 deletions(-)
-
-diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
-index 5d7770348349..30dadb4f4cb6 100755
---- a/policycoreutils/scripts/fixfiles
-+++ b/policycoreutils/scripts/fixfiles
-@@ -112,6 +112,7 @@ FORCEFLAG=""
- RPMFILES=""
- PREFC=""
- RESTORE_MODE=""
-+BIND_MOUNT_FILESYSTEMS=""
- SETFILES=/sbin/setfiles
- RESTORECON=/sbin/restorecon
- FILESYSTEMSRW=`get_rw_labeled_mounts`
-@@ -243,7 +244,23 @@ case "$RESTORE_MODE" in
- 	if [ -n "${FILESYSTEMSRW}" ]; then
- 	    LogReadOnly
- 	    echo "${OPTION}ing `echo ${FILESYSTEMSRW}`"
--	    ${SETFILES} ${VERBOSE} ${EXCLUDEDIRS} ${FORCEFLAG} $* -q ${FC} ${FILESYSTEMSRW}
-+
-+	    if [ -z "$BIND_MOUNT_FILESYSTEMS" ]; then
-+	        ${SETFILES} ${VERBOSE} ${EXCLUDEDIRS} ${FORCEFLAG} $* -q ${FC} ${FILESYSTEMSRW}
-+	    else
-+	        # we bind mount so we can fix the labels of files that have already been
-+	        # mounted over
-+	        for m in `echo $FILESYSTEMSRW`; do
-+	            TMP_MOUNT="$(mktemp -d)"
-+	            test -z ${TMP_MOUNT+x} && echo "Unable to find temporary directory!" && exit 1
-+
-+	            mkdir -p "${TMP_MOUNT}${m}" || exit 1
-+	            mount --bind "${m}" "${TMP_MOUNT}${m}" || exit 1
-+	            ${SETFILES} ${VERBOSE} ${EXCLUDEDIRS} ${FORCEFLAG} $* -q ${FC} -r "${TMP_MOUNT}" "${TMP_MOUNT}${m}"
-+	            umount "${TMP_MOUNT}${m}" || exit 1
-+	            rm -rf "${TMP_MOUNT}" || echo "Error cleaning up."
-+	        done;
-+	    fi
- 	else
- 	    echo >&2 "fixfiles: No suitable file systems found"
- 	fi
-@@ -313,6 +330,7 @@ case "$1" in
- 	> /.autorelabel || exit $?
- 	[ -z "$FORCEFLAG" ] || echo -n "$FORCEFLAG " >> /.autorelabel
- 	[ -z "$BOOTTIME" ] || echo -N $BOOTTIME >> /.autorelabel
-+	[ -z "$BIND_MOUNT_FILESYSTEMS" ] || echo "-M" >> /.autorelabel
- 	# Force full relabel if SELinux is not enabled
- 	selinuxenabled || echo -F > /.autorelabel
- 	echo "System will relabel on next boot"
-@@ -324,7 +342,7 @@ esac
- }
- usage() {
- 	echo $"""
--Usage: $0 [-v] [-F] [-f] relabel
-+Usage: $0 [-v] [-F] [-M] [-f] relabel
- or
- Usage: $0 [-v] [-F] [-B | -N time ] { check | restore | verify }
- or
-@@ -334,7 +352,7 @@ Usage: $0 [-v] [-F] -R rpmpackage[,rpmpackage...] { check | restore | verify }
- or
- Usage: $0 [-v] [-F] -C PREVIOUS_FILECONTEXT { check | restore | verify }
- or
--Usage: $0 [-F] [-B] onboot
-+Usage: $0 [-F] [-M] [-B] onboot
- """
- }
- 
-@@ -353,7 +371,7 @@ set_restore_mode() {
- }
- 
- # See how we were called.
--while getopts "N:BC:FfR:l:v" i; do
-+while getopts "N:BC:FfR:l:vM" i; do
-     case "$i" in
- 	B)
- 		BOOTTIME=`/bin/who -b | awk '{print $3}'`
-@@ -379,6 +397,9 @@ while getopts "N:BC:FfR:l:v" i; do
- 		echo "Redirecting output to $OPTARG"
- 		exec >>"$OPTARG" 2>&1
- 		;;
-+	M)
-+		BIND_MOUNT_FILESYSTEMS="-M"
-+		;;
- 	F)
- 		FORCEFLAG="-F"
- 		;;
-diff --git a/policycoreutils/scripts/fixfiles.8 b/policycoreutils/scripts/fixfiles.8
-index 9f447f03d444..123425308416 100644
---- a/policycoreutils/scripts/fixfiles.8
-+++ b/policycoreutils/scripts/fixfiles.8
-@@ -6,7 +6,7 @@ fixfiles \- fix file SELinux security contexts.
- .na
- 
- .B fixfiles
--.I [\-v] [\-F] [\-f] relabel
-+.I [\-v] [\-F] [-M] [\-f] relabel
- 
- .B fixfiles
- .I [\-v] [\-F] { check | restore | verify } dir/file ...
-@@ -21,7 +21,7 @@ fixfiles \- fix file SELinux security contexts.
- .I [\-v] [\-F] \-C PREVIOUS_FILECONTEXT  { check | restore | verify }
- 
- .B fixfiles
--.I [-F] [-B] onboot
-+.I [-F] [-M] [-B] onboot
- 
- .ad
- 
-@@ -68,6 +68,10 @@ Run a diff on  the PREVIOUS_FILECONTEXT file to the currently installed one, and
- Only act on files created after the specified date.  Date must be specified in
- "YYYY\-MM\-DD HH:MM" format.  Date field will be passed to find \-\-newermt command.
- 
-+.TP
-+.B \-M
-+Bind mount filesystems before relabeling them, this allows fixing the context of files or directories that have been mounted over.
-+
- .TP
- .B -v
- Modify verbosity from progress to verbose. (Run restorecon with \-v instead of \-p)
--- 
-2.29.0
-

0004-Simplication-of-sepolicy-manpage-web-functionality.-.patch

@@ -1,9 +1,10 @@
-From 7d21b9f41c4d00f1e0499a64089a5e13a8f636ab Mon Sep 17 00:00:00 2001
+From b180f7679c5e09535416f47d48afd0c0738f5fa9 Mon Sep 17 00:00:00 2001
 From: Miroslav Grepl <mgrepl@redhat.com>
 Date: Thu, 19 Feb 2015 17:45:15 +0100
 Subject: [PATCH] Simplication of sepolicy-manpage web functionality.
  system_release is no longer hardcoded and it creates only index.html and html
  man pages in the directory for the system release.
+Content-type: text/plain
 
 ---
  python/sepolicy/sepolicy/__init__.py | 25 +++--------
@@ -11,10 +12,10 @@ Subject: [PATCH] Simplication of sepolicy-manpage web functionality.
  2 files changed, 13 insertions(+), 77 deletions(-)
 
 diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py
-index e4540977d042..ad718797ca68 100644
+index 203ca25f4210..9447812b7450 100644
 --- a/python/sepolicy/sepolicy/__init__.py
 +++ b/python/sepolicy/sepolicy/__init__.py
-@@ -1208,27 +1208,14 @@ def boolean_desc(boolean):
+@@ -1225,27 +1225,14 @@ def boolean_desc(boolean):
  
  
  def get_os_version():
@@ -49,10 +50,10 @@ index e4540977d042..ad718797ca68 100644
  
  def reinit():
 diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
-index 2d33eabb2536..acc77f368d95 100755
+index ec8aa1cb94a2..c632d05dbb1b 100755
 --- a/python/sepolicy/sepolicy/manpage.py
 +++ b/python/sepolicy/sepolicy/manpage.py
-@@ -149,10 +149,6 @@ def prettyprint(f, trim):
+@@ -151,10 +151,6 @@ def prettyprint(f, trim):
  manpage_domains = []
  manpage_roles = []
  
@@ -63,7 +64,7 @@ index 2d33eabb2536..acc77f368d95 100755
  def get_alphabet_manpages(manpage_list):
      alphabet_manpages = dict.fromkeys(string.ascii_letters, [])
      for i in string.ascii_letters:
-@@ -182,7 +178,7 @@ def convert_manpage_to_html(html_manpage, manpage):
+@@ -184,7 +180,7 @@ def convert_manpage_to_html(html_manpage, manpage):
  class HTMLManPages:
  
      """
@@ -72,7 +73,7 @@ index 2d33eabb2536..acc77f368d95 100755
      """
  
      def __init__(self, manpage_roles, manpage_domains, path, os_version):
-@@ -190,9 +186,9 @@ class HTMLManPages:
+@@ -192,9 +188,9 @@ class HTMLManPages:
          self.manpage_domains = get_alphabet_manpages(manpage_domains)
          self.os_version = os_version
          self.old_path = path + "/"
@@ -84,7 +85,7 @@ index 2d33eabb2536..acc77f368d95 100755
              self.__gen_html_manpages()
          else:
              print("SELinux HTML man pages can not be generated for this %s" % os_version)
-@@ -201,7 +197,6 @@ class HTMLManPages:
+@@ -203,7 +199,6 @@ class HTMLManPages:
      def __gen_html_manpages(self):
          self._write_html_manpage()
          self._gen_index()
@@ -92,7 +93,7 @@ index 2d33eabb2536..acc77f368d95 100755
          self._gen_css()
  
      def _write_html_manpage(self):
-@@ -219,67 +214,21 @@ class HTMLManPages:
+@@ -221,67 +216,21 @@ class HTMLManPages:
                      convert_manpage_to_html((self.new_path + r.rsplit("_selinux", 1)[0] + ".html"), self.old_path + r)
  
      def _gen_index(self):
@@ -165,5 +166,5 @@ index 2d33eabb2536..acc77f368d95 100755
              if len(self.manpage_roles[letter]):
                  fd.write("""
 -- 
-2.29.0
+2.35.1
 

0004-sepolgen-print-extended-permissions-in-hexadecimal.patch

@@ -1,112 +0,0 @@
-From 9e239e55692b578ba546b4dff2b07604a2ca6baa Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
-Date: Wed, 19 Aug 2020 17:05:33 +0200
-Subject: [PATCH] sepolgen: print extended permissions in hexadecimal
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-All tools like ausearch(8) or sesearch(1) and online documentation[1]
-use hexadecimal values for extended permissions.
-Hence use them, e.g. for audit2allow output, as well.
-
-[1]: https://github.com/strace/strace/blob/master/linux/64/ioctls_inc.h
-
-Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
-Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
----
- python/sepolgen/src/sepolgen/refpolicy.py |  5 ++---
- python/sepolgen/tests/test_access.py      | 10 +++++-----
- python/sepolgen/tests/test_refpolicy.py   | 12 ++++++------
- 3 files changed, 13 insertions(+), 14 deletions(-)
-
-diff --git a/python/sepolgen/src/sepolgen/refpolicy.py b/python/sepolgen/src/sepolgen/refpolicy.py
-index 43cecfc77385..747636875ef7 100644
---- a/python/sepolgen/src/sepolgen/refpolicy.py
-+++ b/python/sepolgen/src/sepolgen/refpolicy.py
-@@ -407,10 +407,9 @@ class XpermSet():
- 
-         # print single value without braces
-         if len(self.ranges) == 1 and self.ranges[0][0] == self.ranges[0][1]:
--            return compl + str(self.ranges[0][0])
-+            return compl + hex(self.ranges[0][0])
- 
--        vals = map(lambda x: str(x[0]) if x[0] == x[1] else "%s-%s" % x,
--                   self.ranges)
-+        vals = map(lambda x: hex(x[0]) if x[0] == x[1] else "%s-%s" % (hex(x[0]), hex(x[1]), ), self.ranges)
- 
-         return "%s{ %s }" % (compl, " ".join(vals))
- 
-diff --git a/python/sepolgen/tests/test_access.py b/python/sepolgen/tests/test_access.py
-index 73a5407df617..623588e09aeb 100644
---- a/python/sepolgen/tests/test_access.py
-+++ b/python/sepolgen/tests/test_access.py
-@@ -171,7 +171,7 @@ class TestAccessVector(unittest.TestCase):
-         a.merge(b)
-         self.assertEqual(sorted(list(a.perms)), ["append", "read", "write"])
-         self.assertEqual(list(a.xperms.keys()), ["ioctl"])
--        self.assertEqual(a.xperms["ioctl"].to_string(), "{ 42 12345 }")
-+        self.assertEqual(a.xperms["ioctl"].to_string(), "{ 0x2a 0x3039 }")
- 
-     def text_merge_xperm2(self):
-         """Test merging AV that does not contain xperms with AV that does"""
-@@ -185,7 +185,7 @@ class TestAccessVector(unittest.TestCase):
-         a.merge(b)
-         self.assertEqual(sorted(list(a.perms)), ["append", "read", "write"])
-         self.assertEqual(list(a.xperms.keys()), ["ioctl"])
--        self.assertEqual(a.xperms["ioctl"].to_string(), "{ 42 12345 }")
-+        self.assertEqual(a.xperms["ioctl"].to_string(), "{ 0x2a 0x3039 }")
- 
-     def test_merge_xperm_diff_op(self):
-         """Test merging two AVs that contain xperms with different operation"""
-@@ -203,8 +203,8 @@ class TestAccessVector(unittest.TestCase):
-         a.merge(b)
-         self.assertEqual(list(a.perms), ["read"])
-         self.assertEqual(sorted(list(a.xperms.keys())), ["asdf", "ioctl"])
--        self.assertEqual(a.xperms["asdf"].to_string(), "23")
--        self.assertEqual(a.xperms["ioctl"].to_string(), "{ 42 12345 }")
-+        self.assertEqual(a.xperms["asdf"].to_string(), "0x17")
-+        self.assertEqual(a.xperms["ioctl"].to_string(), "{ 0x2a 0x3039 }")
-                          
-     def test_merge_xperm_same_op(self):
-         """Test merging two AVs that contain xperms with same operation"""
-@@ -222,7 +222,7 @@ class TestAccessVector(unittest.TestCase):
-         a.merge(b)
-         self.assertEqual(list(a.perms), ["read"])
-         self.assertEqual(list(a.xperms.keys()), ["ioctl"])
--        self.assertEqual(a.xperms["ioctl"].to_string(), "{ 23 42 12345 }")
-+        self.assertEqual(a.xperms["ioctl"].to_string(), "{ 0x17 0x2a 0x3039 }")
- 
- class TestUtilFunctions(unittest.TestCase):
-     def test_is_idparam(self):
-diff --git a/python/sepolgen/tests/test_refpolicy.py b/python/sepolgen/tests/test_refpolicy.py
-index 4b50c8aada96..c7219fd568e9 100644
---- a/python/sepolgen/tests/test_refpolicy.py
-+++ b/python/sepolgen/tests/test_refpolicy.py
-@@ -90,17 +90,17 @@ class TestXpermSet(unittest.TestCase):
-         a.complement = True
-         self.assertEqual(a.to_string(), "")
-         a.add(1234)
--        self.assertEqual(a.to_string(), "~ 1234")
-+        self.assertEqual(a.to_string(), "~ 0x4d2")
-         a.complement = False
--        self.assertEqual(a.to_string(), "1234")
-+        self.assertEqual(a.to_string(), "0x4d2")
-         a.add(2345)
--        self.assertEqual(a.to_string(), "{ 1234 2345 }")
-+        self.assertEqual(a.to_string(), "{ 0x4d2 0x929 }")
-         a.complement = True
--        self.assertEqual(a.to_string(), "~ { 1234 2345 }")
-+        self.assertEqual(a.to_string(), "~ { 0x4d2 0x929 }")
-         a.add(42,64)
--        self.assertEqual(a.to_string(), "~ { 42-64 1234 2345 }")
-+        self.assertEqual(a.to_string(), "~ { 0x2a-0x40 0x4d2 0x929 }")
-         a.complement = False
--        self.assertEqual(a.to_string(), "{ 42-64 1234 2345 }")
-+        self.assertEqual(a.to_string(), "{ 0x2a-0x40 0x4d2 0x929 }")
- 
- class TestSecurityContext(unittest.TestCase):
-     def test_init(self):
--- 
-2.29.0
-

0005-We-want-to-remove-the-trailing-newline-for-etc-syste.patch

@@ -1,18 +1,19 @@
-From f0f030495dddb2e633403f360fdaaf6951da11ad Mon Sep 17 00:00:00 2001
+From 1747f59fece8183772e5591ce5b5feb5f421f602 Mon Sep 17 00:00:00 2001
 From: Miroslav Grepl <mgrepl@redhat.com>
 Date: Fri, 20 Feb 2015 16:42:01 +0100
 Subject: [PATCH] We want to remove the trailing newline for
  /etc/system_release.
+Content-type: text/plain
 
 ---
  python/sepolicy/sepolicy/__init__.py | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py
-index ad718797ca68..ea05d892bf3b 100644
+index 9447812b7450..aa8beda313c8 100644
 --- a/python/sepolicy/sepolicy/__init__.py
 +++ b/python/sepolicy/sepolicy/__init__.py
-@@ -1211,7 +1211,7 @@ def get_os_version():
+@@ -1228,7 +1228,7 @@ def get_os_version():
      system_release = ""
      try:
          with open('/etc/system-release') as f:
@@ -22,5 +23,5 @@ index ad718797ca68..ea05d892bf3b 100644
          system_release = "Misc"
  
 -- 
-2.29.0
+2.35.1
 

0005-sepolgen-sort-extended-rules-like-normal-ones.patch

@@ -1,109 +0,0 @@
-From 2a60de8eca6bd91e276b60441a5dc72d85c6eda3 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
-Date: Wed, 19 Aug 2020 17:05:34 +0200
-Subject: [PATCH] sepolgen: sort extended rules like normal ones
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Currently:
-
-    #============= sshd_t ==============
-
-    #!!!! This avc is allowed in the current policy
-    #!!!! This av rule may have been overridden by an extended permission av rule
-    allow sshd_t ptmx_t:chr_file ioctl;
-
-    #!!!! This avc is allowed in the current policy
-    #!!!! This av rule may have been overridden by an extended permission av rule
-    allow sshd_t sshd_devpts_t:chr_file ioctl;
-
-    #!!!! This avc is allowed in the current policy
-    #!!!! This av rule may have been overridden by an extended permission av rule
-    allow sshd_t user_devpts_t:chr_file ioctl;
-
-    #============= user_t ==============
-
-    #!!!! This avc is allowed in the current policy
-    #!!!! This av rule may have been overridden by an extended permission av rule
-    allow user_t devtty_t:chr_file ioctl;
-
-    #!!!! This avc is allowed in the current policy
-    #!!!! This av rule may have been overridden by an extended permission av rule
-    allow user_t user_devpts_t:chr_file ioctl;
-    allowxperm sshd_t ptmx_t:chr_file ioctl { 0x5430-0x5431 0x5441 };
-    allowxperm sshd_t sshd_devpts_t:chr_file ioctl 0x5401;
-    allowxperm sshd_t user_devpts_t:chr_file ioctl { 0x5401-0x5402 0x540e };
-    allowxperm user_t user_devpts_t:chr_file ioctl { 0x4b33 0x5401 0x5403 0x540a 0x540f-0x5410 0x5413-0x5414 };
-    allowxperm user_t devtty_t:chr_file ioctl 0x4b33;
-
-Changed:
-
-    #============= sshd_t ==============
-
-    #!!!! This avc is allowed in the current policy
-    #!!!! This av rule may have been overridden by an extended permission av rule
-    allow sshd_t ptmx_t:chr_file ioctl;
-    allowxperm sshd_t ptmx_t:chr_file ioctl { 0x5430-0x5431 0x5441 };
-
-    #!!!! This avc is allowed in the current policy
-    #!!!! This av rule may have been overridden by an extended permission av rule
-    allow sshd_t sshd_devpts_t:chr_file ioctl;
-    allowxperm sshd_t sshd_devpts_t:chr_file ioctl 0x5401;
-
-    #!!!! This avc is allowed in the current policy
-    #!!!! This av rule may have been overridden by an extended permission av rule
-    allow sshd_t user_devpts_t:chr_file ioctl;
-    allowxperm sshd_t user_devpts_t:chr_file ioctl { 0x5401-0x5402 0x540e };
-
-    #============= user_t ==============
-
-    #!!!! This avc is allowed in the current policy
-    #!!!! This av rule may have been overridden by an extended permission av rule
-    allow user_t devtty_t:chr_file ioctl;
-    allowxperm user_t devtty_t:chr_file ioctl 0x4b33;
-
-    #!!!! This avc is allowed in the current policy
-    #!!!! This av rule may have been overridden by an extended permission av rule
-    allow user_t user_devpts_t:chr_file ioctl;
-    allowxperm user_t user_devpts_t:chr_file ioctl { 0x4b33 0x5401 0x5403 0x540a 0x540f-0x5410 0x5413-0x5414 };
-
-Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
-Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
----
- python/sepolgen/src/sepolgen/output.py | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/python/sepolgen/src/sepolgen/output.py b/python/sepolgen/src/sepolgen/output.py
-index 3a21b64c19f7..aeeaafc889e7 100644
---- a/python/sepolgen/src/sepolgen/output.py
-+++ b/python/sepolgen/src/sepolgen/output.py
-@@ -84,7 +84,7 @@ def avrule_cmp(a, b):
-         return ret
- 
-     # At this point, who cares - just return something
--    return cmp(len(a.perms), len(b.perms))
-+    return 0
- 
- # Compare two interface calls
- def ifcall_cmp(a, b):
-@@ -100,7 +100,7 @@ def rule_cmp(a, b):
-         else:
-             return id_set_cmp([a.args[0]], b.src_types)
-     else:
--        if isinstance(b, refpolicy.AVRule):
-+        if isinstance(b, refpolicy.AVRule) or isinstance(b, refpolicy.AVExtRule):
-             return avrule_cmp(a,b)
-         else:
-             return id_set_cmp(a.src_types, [b.args[0]])
-@@ -130,6 +130,7 @@ def sort_filter(module):
-         # we assume is the first argument for interfaces).
-         rules = []
-         rules.extend(node.avrules())
-+        rules.extend(node.avextrules())
-         rules.extend(node.interface_calls())
-         rules.sort(key=util.cmp_to_key(rule_cmp))
- 
--- 
-2.29.0
-

0006-Fix-title-in-manpage.py-to-not-contain-online.patch

@@ -1,17 +1,18 @@
-From 4a18939d21c06d036f1063cbfd2d0b5ae9d0010f Mon Sep 17 00:00:00 2001
+From 0bd28bc715034c644405d3c03f160d69ae710500 Mon Sep 17 00:00:00 2001
 From: Miroslav Grepl <mgrepl@redhat.com>
 Date: Fri, 20 Feb 2015 16:42:53 +0100
 Subject: [PATCH] Fix title in manpage.py to not contain 'online'.
+Content-type: text/plain
 
 ---
  python/sepolicy/sepolicy/manpage.py | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
-index acc77f368d95..4aeb3e2e51ba 100755
+index c632d05dbb1b..3ae2f42b2fdf 100755
 --- a/python/sepolicy/sepolicy/manpage.py
 +++ b/python/sepolicy/sepolicy/manpage.py
-@@ -220,7 +220,7 @@ class HTMLManPages:
+@@ -222,7 +222,7 @@ class HTMLManPages:
  <html>
  <head>
  	<link rel=stylesheet type="text/css" href="style.css" title="style">
@@ -21,5 +22,5 @@ index acc77f368d95..4aeb3e2e51ba 100755
  <body>
  <h1>SELinux man pages for %s</h1>
 -- 
-2.29.0
+2.35.1
 

0006-newrole-support-cross-compilation-with-PAM-and-audit.patch

@@ -1,32 +0,0 @@
-From 8bc865e1fe8f6f734b7306441ccbeec3b7c37f97 Mon Sep 17 00:00:00 2001
-From: Dominick Grift <dominick.grift@defensec.nl>
-Date: Tue, 1 Sep 2020 18:16:41 +0200
-Subject: [PATCH] newrole: support cross-compilation with PAM and audit
-
-Compilation of newrole with PAM and audit support currently requires that you have the respective headers installed on the host. Instead make the header location customizable to accomodate cross-compilation.
-
-Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
-Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
----
- policycoreutils/newrole/Makefile | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/policycoreutils/newrole/Makefile b/policycoreutils/newrole/Makefile
-index 73ebd413da85..0e7ebce3dd56 100644
---- a/policycoreutils/newrole/Makefile
-+++ b/policycoreutils/newrole/Makefile
-@@ -5,8 +5,9 @@ BINDIR ?= $(PREFIX)/bin
- MANDIR ?= $(PREFIX)/share/man
- ETCDIR ?= /etc
- LOCALEDIR = $(DESTDIR)$(PREFIX)/share/locale
--PAMH ?= $(shell test -f /usr/include/security/pam_appl.h && echo y)
--AUDITH ?= $(shell test -f /usr/include/libaudit.h && echo y)
-+INCLUDEDIR ?= $(PREFIX)/include
-+PAMH ?= $(shell test -f $(INCLUDEDIR)/security/pam_appl.h && echo y)
-+AUDITH ?= $(shell test -f $(INCLUDEDIR)/libaudit.h && echo y)
- # Enable capabilities to permit newrole to generate audit records.
- # This will make newrole a setuid root program.
- # The capabilities used are: CAP_AUDIT_WRITE.
--- 
-2.29.0
-

0007-Don-t-be-verbose-if-you-are-not-on-a-tty.patch

@@ -1,14 +1,15 @@
-From ffe429b49874175f5ec1156e9c89e75cc67a0ddd Mon Sep 17 00:00:00 2001
+From f204dd292340689c2d7ab75612b9fd81337fcbc3 Mon Sep 17 00:00:00 2001
 From: Dan Walsh <dwalsh@redhat.com>
 Date: Fri, 14 Feb 2014 12:32:12 -0500
 Subject: [PATCH] Don't be verbose if you are not on a tty
+Content-type: text/plain
 
 ---
  policycoreutils/scripts/fixfiles | 1 +
  1 file changed, 1 insertion(+)
 
 diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
-index 30dadb4f4cb6..e73bb81c3336 100755
+index c72ca0eb9d61..163ebcd1f232 100755
 --- a/policycoreutils/scripts/fixfiles
 +++ b/policycoreutils/scripts/fixfiles
 @@ -108,6 +108,7 @@ exclude_dirs_from_relabelling() {
@@ -17,8 +18,8 @@ index 30dadb4f4cb6..e73bb81c3336 100755
  VERBOSE="-p"
 +[ -t 1 ] || VERBOSE=""
  FORCEFLAG=""
+ THREADS=""
  RPMFILES=""
- PREFC=""
 -- 
-2.29.0
+2.35.1
 

0008-sepolicy-generate-Handle-more-reserved-port-types.patch

@@ -1,7 +1,8 @@
-From fa94b0faf12a79158d971f363e8ec65227d67de3 Mon Sep 17 00:00:00 2001
+From d8f51aa7d299383247213b69ec7cbb68c1fa3bc4 Mon Sep 17 00:00:00 2001
 From: Masatake YAMATO <yamato@redhat.com>
 Date: Thu, 14 Dec 2017 15:57:58 +0900
 Subject: [PATCH] sepolicy-generate: Handle more reserved port types
+Content-type: text/plain
 
 Currently only reserved_port_t, port_t and hi_reserved_port_t are
 handled as special when making a ports-dictionary.  However, as fas as
@@ -67,5 +68,5 @@ index 43180ca6fda4..d60a08e1d72c 100644
          dict[(p['low'], p['high'], p['protocol'])] = (p['type'], p.get('range'))
      return dict
 -- 
-2.29.0
+2.35.1
 

0009-sandbox-Use-matchbox-window-manager-instead-of-openb.patch

@@ -1,7 +1,8 @@
-From e63814eb18bdbb48a7e6bf79b17d79d6a9ca56d6 Mon Sep 17 00:00:00 2001
+From 8054dc44cf105b959864a1424fe857fac3ba3d73 Mon Sep 17 00:00:00 2001
 From: Petr Lautrbach <plautrba@redhat.com>
 Date: Wed, 18 Jul 2018 09:09:35 +0200
 Subject: [PATCH] sandbox: Use matchbox-window-manager instead of openbox
+Content-type: text/plain
 
 ---
  sandbox/sandbox     |  4 ++--
@@ -70,5 +71,5 @@ index 4774528027ef..c211ebc14549 100644
      export DISPLAY=:$D
      cat > ~/seremote << __EOF
 -- 
-2.29.0
+2.35.1
 

0010-Use-SHA-2-instead-of-SHA-1.patch

@@ -0,0 +1,298 @@
+From 53d085d8d6edc05886d473e412a8025b7f8d9ce4 Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Fri, 30 Jul 2021 14:14:37 +0200
+Subject: [PATCH] Use SHA-2 instead of SHA-1
+Content-type: text/plain
+
+The use of SHA-1 in RHEL9 is deprecated
+---
+ policycoreutils/setfiles/restorecon.8          | 10 +++++-----
+ policycoreutils/setfiles/restorecon_xattr.8    |  8 ++++----
+ policycoreutils/setfiles/restorecon_xattr.c    | 12 ++++++------
+ policycoreutils/setfiles/ru/restorecon.8       |  8 ++++----
+ policycoreutils/setfiles/ru/restorecon_xattr.8 | 10 +++++-----
+ policycoreutils/setfiles/ru/setfiles.8         |  8 ++++----
+ policycoreutils/setfiles/setfiles.8            | 10 +++++-----
+ 7 files changed, 33 insertions(+), 33 deletions(-)
+
+diff --git a/policycoreutils/setfiles/restorecon.8 b/policycoreutils/setfiles/restorecon.8
+index e07db2c87dc4..dbd55ce7c512 100644
+--- a/policycoreutils/setfiles/restorecon.8
++++ b/policycoreutils/setfiles/restorecon.8
+@@ -95,14 +95,14 @@ display usage information and exit.
+ ignore files that do not exist.
+ .TP
+ .B \-I
+-ignore digest to force checking of labels even if the stored SHA1 digest
+-matches the specfiles SHA1 digest. The digest will then be updated provided
++ignore digest to force checking of labels even if the stored SHA256 digest
++matches the specfiles SHA256 digest. The digest will then be updated provided
+ there are no errors. See the
+ .B NOTES
+ section for further details.
+ .TP
+ .B \-D
+-Set or update any directory SHA1 digests. Use this option to
++Set or update any directory SHA256 digests. Use this option to
+ enable usage of the
+ .IR security.sehash
+ extended attribute.
+@@ -200,7 +200,7 @@ the
+ .B \-D
+ option to
+ .B restorecon
+-will cause it to store a SHA1 digest of the default specfiles set in an extended
++will cause it to store a SHA256 digest of the default specfiles set in an extended
+ attribute named
+ .IR security.sehash
+ on each directory specified in
+@@ -217,7 +217,7 @@ for further details.
+ .sp
+ The
+ .B \-I
+-option will ignore the SHA1 digest from each directory specified in
++option will ignore the SHA256 digest from each directory specified in
+ .IR pathname \ ...
+ and provided the
+ .B \-n
+diff --git a/policycoreutils/setfiles/restorecon_xattr.8 b/policycoreutils/setfiles/restorecon_xattr.8
+index e04528e60824..4b1ce304d995 100644
+--- a/policycoreutils/setfiles/restorecon_xattr.8
++++ b/policycoreutils/setfiles/restorecon_xattr.8
+@@ -23,7 +23,7 @@ or
+ 
+ .SH "DESCRIPTION"
+ .B restorecon_xattr
+-will display the SHA1 digests added to extended attributes
++will display the SHA256 digests added to extended attributes
+ .I security.sehash
+ or delete the attribute completely. These attributes are set by
+ .BR restorecon (8)
+@@ -48,12 +48,12 @@ extended attribute and are automatically excluded from searches.
+ .sp
+ By default
+ .B restorecon_xattr
+-will display the SHA1 digests with "Match" appended if they match the default
++will display the SHA256 digests with "Match" appended if they match the default
+ specfile set or the
+ .I specfile
+ set used with the
+ .B \-f
+-option. Non-matching SHA1 digests will be displayed with "No Match" appended.
++option. Non-matching SHA256 digests will be displayed with "No Match" appended.
+ This feature can be disabled by the
+ .B \-n
+ option.
+@@ -87,7 +87,7 @@ Do not append "Match" or "No Match" to displayed digests.
+ recursively descend directories.
+ .TP
+ .B \-v
+-display SHA1 digest generated by specfile set (Note that this digest is not
++display SHA256 digest generated by specfile set (Note that this digest is not
+ used to match the
+ .I security.sehash
+ directory digest entries, and is shown for reference only).
+diff --git a/policycoreutils/setfiles/restorecon_xattr.c b/policycoreutils/setfiles/restorecon_xattr.c
+index 31fb82fd2099..bc22d3fd4560 100644
+--- a/policycoreutils/setfiles/restorecon_xattr.c
++++ b/policycoreutils/setfiles/restorecon_xattr.c
+@@ -38,7 +38,7 @@ int main(int argc, char **argv)
+ 	unsigned int xattr_flags = 0, delete_digest = 0, recurse = 0;
+ 	unsigned int delete_all_digests = 0, ignore_mounts = 0;
+ 	bool display_digest = false;
+-	char *sha1_buf, **specfiles, *fc_file = NULL, *pathname = NULL;
++	char *sha256_buf, **specfiles, *fc_file = NULL, *pathname = NULL;
+ 	unsigned char *fc_digest = NULL;
+ 	size_t i, fc_digest_len = 0, num_specfiles;
+ 
+@@ -133,8 +133,8 @@ int main(int argc, char **argv)
+ 			exit(-1);
+ 		}
+ 
+-		sha1_buf = malloc(fc_digest_len * 2 + 1);
+-		if (!sha1_buf) {
++		sha256_buf = malloc(fc_digest_len * 2 + 1);
++		if (!sha256_buf) {
+ 			fprintf(stderr,
+ 				"Error allocating digest buffer: %s\n",
+ 							    strerror(errno));
+@@ -143,16 +143,16 @@ int main(int argc, char **argv)
+ 		}
+ 
+ 		for (i = 0; i < fc_digest_len; i++)
+-			sprintf((&sha1_buf[i * 2]), "%02x", fc_digest[i]);
++			sprintf((&sha256_buf[i * 2]), "%02x", fc_digest[i]);
+ 
+-		printf("specfiles SHA1 digest: %s\n", sha1_buf);
++		printf("specfiles SHA256 digest: %s\n", sha256_buf);
+ 
+ 		printf("calculated using the following specfile(s):\n");
+ 		if (specfiles) {
+ 			for (i = 0; i < num_specfiles; i++)
+ 				printf("%s\n", specfiles[i]);
+ 		}
+-		free(sha1_buf);
++		free(sha256_buf);
+ 		printf("\n");
+ 	}
+ 
+diff --git a/policycoreutils/setfiles/ru/restorecon.8 b/policycoreutils/setfiles/ru/restorecon.8
+index 9be3a63db356..745135020f4b 100644
+--- a/policycoreutils/setfiles/ru/restorecon.8
++++ b/policycoreutils/setfiles/ru/restorecon.8
+@@ -82,11 +82,11 @@ restorecon \- восстановить SELinux-контексты безопас
+ игнорировать файлы, которые не существуют.
+ .TP
+ .B \-I
+-игнорировать дайджест, чтобы принудительно проверить метки, даже если хранимый дайджест SHA1 соответствует дайджесту SHA1 файлов спецификации. Затем (при условии отсутствия ошибок) дайджест будет обновлён. Более подробные сведения доступны в разделе
++игнорировать дайджест, чтобы принудительно проверить метки, даже если хранимый дайджест SHA256 соответствует дайджесту SHA256 файлов спецификации. Затем (при условии отсутствия ошибок) дайджест будет обновлён. Более подробные сведения доступны в разделе
+ .B ПРИМЕЧАНИЯ.
+ .TP
+ .B \-D
+-установить или обновить дайджесты SHA1 для любых каталогов. Используйте этот параметр, чтобы включить использование расширенного атрибута
++установить или обновить дайджесты SHA256 для любых каталогов. Используйте этот параметр, чтобы включить использование расширенного атрибута
+ .IR security.restorecon_last.
+ .TP
+ .B \-m
+@@ -159,7 +159,7 @@ GNU
+ .B \-D
+ команды
+ .B restorecon
+-обеспечит сохранение дайджеста SHA1 файлов спецификации по умолчанию в расширенном атрибуте с именем
++обеспечит сохранение дайджеста SHA256 файлов спецификации по умолчанию в расширенном атрибуте с именем
+ .IR security.restorecon_last
+ для каталогов, указанных в соответствующих путях
+ .IR pathname \ ...
+@@ -173,7 +173,7 @@ GNU
+ .sp
+ Параметр
+ .B \-I
+-позволяет игнорировать дайджест SHA1 из каждого каталога, указанного в 
++позволяет игнорировать дайджест SHA256 из каждого каталога, указанного в
+ .IR pathname \ ...
+ , и, при условии, что НЕ установлен параметр
+ .B \-n
+diff --git a/policycoreutils/setfiles/ru/restorecon_xattr.8 b/policycoreutils/setfiles/ru/restorecon_xattr.8
+index 41c441b8c5c2..25c4c3033334 100644
+--- a/policycoreutils/setfiles/ru/restorecon_xattr.8
++++ b/policycoreutils/setfiles/ru/restorecon_xattr.8
+@@ -23,7 +23,7 @@ restorecon_xattr \- управление записями расширенных
+ 
+ .SH "ОПИСАНИЕ"
+ .B restorecon_xattr
+-покажет дайджесты SHA1, добавленные в расширенные атрибуты
++покажет дайджесты SHA256, добавленные в расширенные атрибуты
+ .I security.restorecon_last,
+ или полностью удалит эти атрибуты. Эти атрибуты устанавливаются командой
+ .BR restorecon (8)
+@@ -47,11 +47,11 @@ restorecon_xattr \- управление записями расширенных
+ .sp
+ По умолчанию
+ .B restorecon_xattr
+-показывает дайджесты SHA1, добавляя в конце "Match", если они соответствуют установленному по умолчанию файлу спецификации или файлу спецификации
++показывает дайджесты SHA256, добавляя в конце "Match", если они соответствуют установленному по умолчанию файлу спецификации или файлу спецификации
+ .I specfile,
+ который установлен с помощью параметра
+ .B \-f.
+-Несоответствующие дайджесты SHA1 будут показаны с добавлением "No Match" в конце.
++Несоответствующие дайджесты SHA256 будут показаны с добавлением "No Match" в конце.
+ Эту возможность можно отключить с помощью параметра
+ .B \-n.
+ 
+@@ -81,7 +81,7 @@ restorecon_xattr \- управление записями расширенных
+ рекурсивно спускаться по каталогам.
+ .TP
+ .B \-v
+-показать дайджест SHA1, созданный установленным файлом спецификации.
++показать дайджест SHA256, созданный установленным файлом спецификации.
+ .TP
+ .B \-e
+ .I directory
+@@ -97,7 +97,7 @@ restorecon_xattr \- управление записями расширенных
+ .BR file_contexts (5).
+ Он будет использоваться
+ .BR selabel_open (3)
+-для получения набора записей меток; получение дайджеста SHA1 выполняется с помощью
++для получения набора записей меток; получение дайджеста SHA256 выполняется с помощью
+ .BR selabel_digest (3).
+ Если этот параметр не указан, будет использоваться файл file_contexts по умолчанию.
+ 
+diff --git a/policycoreutils/setfiles/ru/setfiles.8 b/policycoreutils/setfiles/ru/setfiles.8
+index 910101452625..7f2daa09191b 100644
+--- a/policycoreutils/setfiles/ru/setfiles.8
++++ b/policycoreutils/setfiles/ru/setfiles.8
+@@ -69,11 +69,11 @@ setfiles \- установить SELinux-контексты безопаснос
+ игнорировать файлы, которые не существуют.
+ .TP
+ .B \-I
+-игнорировать дайджест, чтобы принудительно проверить метки, даже если хранимый дайджест SHA1 соответствует дайджесту SHA1 файлов спецификации. Затем (при условии отсутствия ошибок) дайджест будет обновлён. Более подробные сведения доступны в разделе
++игнорировать дайджест, чтобы принудительно проверить метки, даже если хранимый дайджест SHA256 соответствует дайджесту SHA256 файлов спецификации. Затем (при условии отсутствия ошибок) дайджест будет обновлён. Более подробные сведения доступны в разделе
+ .B ПРИМЕЧАНИЯ.
+ .TP
+ .B \-D
+-установить или обновить дайджесты SHA1 для любых каталогов. Используйте этот параметр, чтобы включить использование расширенного атрибута
++установить или обновить дайджесты SHA256 для любых каталогов. Используйте этот параметр, чтобы включить использование расширенного атрибута
+ .IR security.restorecon_last.
+ .TP
+ .B \-l
+@@ -186,7 +186,7 @@ GNU
+ .B \-D
+ команды
+ .B setfiles .
+-Он обеспечивает сохранение дайджеста SHA1 файла спецификации
++Он обеспечивает сохранение дайджеста SHA256 файла спецификации
+ .B spec_file 
+ в расширенном атрибуте с именем
+ .IR security.restorecon_last
+@@ -204,7 +204,7 @@ GNU
+ .sp
+ Параметр
+ .B \-I
+-позволяет игнорировать дайджест SHA1 из каждого каталога, указанного в 
++позволяет игнорировать дайджест SHA256 из каждого каталога, указанного в
+ .IR pathname \ ...
+ , и, при условии, что НЕ установлен параметр
+ .B \-n
+diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
+index 19b59a2cc90d..bad9f37a9ac4 100644
+--- a/policycoreutils/setfiles/setfiles.8
++++ b/policycoreutils/setfiles/setfiles.8
+@@ -87,14 +87,14 @@ display usage information and exit.
+ ignore files that do not exist.
+ .TP
+ .B \-I
+-ignore digest to force checking of labels even if the stored SHA1 digest
+-matches the specfiles SHA1 digest. The digest will then be updated provided
++ignore digest to force checking of labels even if the stored SHA256 digest
++matches the specfiles SHA256 digest. The digest will then be updated provided
+ there are no errors. See the
+ .B NOTES
+ section for further details.
+ .TP
+ .B \-D
+-Set or update any directory SHA1 digests. Use this option to
++Set or update any directory SHA256 digests. Use this option to
+ enable usage of the
+ .IR security.sehash
+ extended attribute.
+@@ -239,7 +239,7 @@ the
+ .B \-D
+ option to
+ .B setfiles
+-will cause it to store a SHA1 digest of the
++will cause it to store a SHA256 digest of the
+ .B spec_file
+ set in an extended attribute named
+ .IR security.sehash
+@@ -260,7 +260,7 @@ for further details.
+ .sp
+ The
+ .B \-I
+-option will ignore the SHA1 digest from each directory specified in
++option will ignore the SHA256 digest from each directory specified in
+ .IR pathname \ ...
+ and provided the
+ .B \-n
+-- 
+2.35.1
+

0011-sepolicy-Drop-old-interface-file_type_is_executable-.patch

@@ -1,8 +1,9 @@
-From 4a337405da16857dc2a979e4b4963a6fd7b975c6 Mon Sep 17 00:00:00 2001
+From 3748b7eab7434698998edfcf613fe738cf19d5c9 Mon Sep 17 00:00:00 2001
 From: Petr Lautrbach <plautrba@redhat.com>
 Date: Mon, 27 Feb 2017 17:12:39 +0100
 Subject: [PATCH] sepolicy: Drop old interface file_type_is_executable(f) and
  file_type_is_entrypoint(f)
+Content-type: text/plain
 
 - use direct queries
 - load exec_types and entry_types only once
@@ -11,10 +12,10 @@ Subject: [PATCH] sepolicy: Drop old interface file_type_is_executable(f) and
  1 file changed, 20 insertions(+), 2 deletions(-)
 
 diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
-index 4aeb3e2e51ba..330b055af214 100755
+index 3ae2f42b2fdf..5a434bd360ae 100755
 --- a/python/sepolicy/sepolicy/manpage.py
 +++ b/python/sepolicy/sepolicy/manpage.py
-@@ -125,8 +125,24 @@ def gen_domains():
+@@ -127,8 +127,24 @@ def gen_domains():
      domains.sort()
      return domains
  
@@ -40,7 +41,7 @@ index 4aeb3e2e51ba..330b055af214 100755
  
  def _gen_types():
      global types
-@@ -372,6 +388,8 @@ class ManPage:
+@@ -374,6 +390,8 @@ class ManPage:
          self.all_file_types = sepolicy.get_all_file_types()
          self.role_allows = sepolicy.get_all_role_allows()
          self.types = _gen_types()
@@ -49,15 +50,15 @@ index 4aeb3e2e51ba..330b055af214 100755
  
          if self.source_files:
              self.fcpath = self.root + "file_contexts"
-@@ -689,7 +707,7 @@ Default Defined Ports:""")
+@@ -691,7 +709,7 @@ Default Defined Ports:""")
          for f in self.all_file_types:
              if f.startswith(self.domainname):
                  flist.append(f)
 -                if not file_type_is_executable(f) or not file_type_is_entrypoint(f):
-+                if not f in self.exec_types or not f in self.entry_types:
++                if f not in self.exec_types or f not in self.entry_types:
                      flist_non_exec.append(f)
                  if f in self.fcdict:
                      mpaths = mpaths + self.fcdict[f]["regex"]
 -- 
-2.29.0
+2.35.1
 

0012-gettext-handle-unsupported-languages-properly.patch

@@ -0,0 +1,349 @@
+From ff2aba6d202f49749cbb19a84bf0e1cdae54c5e9 Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Fri, 24 Jun 2022 16:24:25 +0200
+Subject: [PATCH] gettext: handle unsupported languages properly
+Content-type: text/plain
+
+With "fallback=True" gettext.translation behaves the same as
+gettext.install and uses NullTranslations in case the
+translation file for given language was not found (as opposed to
+throwing an exception).
+
+Fixes:
+  # LANG is set to any "unsupported" language, e.g. en_US.UTF-8
+  $ chcat --help
+  Traceback (most recent call last):
+  File "/usr/bin/chcat", line 39, in <module>
+    t = gettext.translation(PROGNAME,
+  File "/usr/lib64/python3.9/gettext.py", line 592, in translation
+    raise FileNotFoundError(ENOENT,
+  FileNotFoundError: [Errno 2] No translation file found for domain: 'selinux-python'
+
+Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
+Reviewed-by: Daniel Burgener <dburgener@linux.microsoft.com>
+Acked-by: Petr Lautrbach <plautrba@redhat.com>
+---
+ gui/booleansPage.py                          | 3 ++-
+ gui/domainsPage.py                           | 3 ++-
+ gui/fcontextPage.py                          | 3 ++-
+ gui/loginsPage.py                            | 3 ++-
+ gui/modulesPage.py                           | 3 ++-
+ gui/polgengui.py                             | 3 ++-
+ gui/portsPage.py                             | 3 ++-
+ gui/semanagePage.py                          | 3 ++-
+ gui/statusPage.py                            | 3 ++-
+ gui/system-config-selinux.py                 | 3 ++-
+ gui/usersPage.py                             | 3 ++-
+ python/chcat/chcat                           | 5 +++--
+ python/semanage/semanage                     | 3 ++-
+ python/semanage/seobject.py                  | 3 ++-
+ python/sepolgen/src/sepolgen/sepolgeni18n.py | 4 +++-
+ python/sepolicy/sepolicy.py                  | 3 ++-
+ python/sepolicy/sepolicy/__init__.py         | 3 ++-
+ python/sepolicy/sepolicy/generate.py         | 3 ++-
+ python/sepolicy/sepolicy/gui.py              | 3 ++-
+ python/sepolicy/sepolicy/interface.py        | 3 ++-
+ sandbox/sandbox                              | 3 ++-
+ 21 files changed, 44 insertions(+), 22 deletions(-)
+
+diff --git a/gui/booleansPage.py b/gui/booleansPage.py
+index 5beec58bc360..ad11a9b24c79 100644
+--- a/gui/booleansPage.py
++++ b/gui/booleansPage.py
+@@ -46,7 +46,8 @@ try:
+         kwargs['unicode'] = True
+     t = gettext.translation(PROGNAME,
+                     localedir="/usr/share/locale",
+-                    **kwargs)
++                    **kwargs,
++                    fallback=True)
+     _ = t.gettext
+ except:
+     try:
+diff --git a/gui/domainsPage.py b/gui/domainsPage.py
+index e08f34b4d3a9..e6eadd61c1bc 100644
+--- a/gui/domainsPage.py
++++ b/gui/domainsPage.py
+@@ -38,7 +38,8 @@ try:
+         kwargs['unicode'] = True
+     t = gettext.translation(PROGNAME,
+                     localedir="/usr/share/locale",
+-                    **kwargs)
++                    **kwargs,
++                    fallback=True)
+     _ = t.gettext
+ except:
+     try:
+diff --git a/gui/fcontextPage.py b/gui/fcontextPage.py
+index bac2bec3ebbd..767664f26ec8 100644
+--- a/gui/fcontextPage.py
++++ b/gui/fcontextPage.py
+@@ -55,7 +55,8 @@ try:
+         kwargs['unicode'] = True
+     t = gettext.translation(PROGNAME,
+                     localedir="/usr/share/locale",
+-                    **kwargs)
++                    **kwargs,
++                    fallback=True)
+     _ = t.gettext
+ except:
+     try:
+diff --git a/gui/loginsPage.py b/gui/loginsPage.py
+index 18b93d8c9756..7e08232a90b5 100644
+--- a/gui/loginsPage.py
++++ b/gui/loginsPage.py
+@@ -37,7 +37,8 @@ try:
+         kwargs['unicode'] = True
+     t = gettext.translation(PROGNAME,
+                     localedir="/usr/share/locale",
+-                    **kwargs)
++                    **kwargs,
++                    fallback=True)
+     _ = t.gettext
+ except:
+     try:
+diff --git a/gui/modulesPage.py b/gui/modulesPage.py
+index c546d455d4cd..02b79f150a13 100644
+--- a/gui/modulesPage.py
++++ b/gui/modulesPage.py
+@@ -38,7 +38,8 @@ try:
+         kwargs['unicode'] = True
+     t = gettext.translation(PROGNAME,
+                     localedir="/usr/share/locale",
+-                    **kwargs)
++                    **kwargs,
++                    fallback=True)
+     _ = t.gettext
+ except:
+     try:
+diff --git a/gui/polgengui.py b/gui/polgengui.py
+index a18f1cba17b9..7a3ecd50c91c 100644
+--- a/gui/polgengui.py
++++ b/gui/polgengui.py
+@@ -71,7 +71,8 @@ try:
+         kwargs['unicode'] = True
+     t = gettext.translation(PROGNAME,
+                     localedir="/usr/share/locale",
+-                    **kwargs)
++                    **kwargs,
++                    fallback=True)
+     _ = t.gettext
+ except:
+     try:
+diff --git a/gui/portsPage.py b/gui/portsPage.py
+index 54aa80ded327..bee2bdf17b99 100644
+--- a/gui/portsPage.py
++++ b/gui/portsPage.py
+@@ -43,7 +43,8 @@ try:
+         kwargs['unicode'] = True
+     t = gettext.translation(PROGNAME,
+                     localedir="/usr/share/locale",
+-                    **kwargs)
++                    **kwargs,
++                    fallback=True)
+     _ = t.gettext
+ except:
+     try:
+diff --git a/gui/semanagePage.py b/gui/semanagePage.py
+index 1371d4e7dabe..efad14d9b375 100644
+--- a/gui/semanagePage.py
++++ b/gui/semanagePage.py
+@@ -30,7 +30,8 @@ try:
+         kwargs['unicode'] = True
+     t = gettext.translation(PROGNAME,
+                     localedir="/usr/share/locale",
+-                    **kwargs)
++                    **kwargs,
++                    fallback=True)
+     _ = t.gettext
+ except:
+     try:
+diff --git a/gui/statusPage.py b/gui/statusPage.py
+index c241ef83dfa0..832849e60d60 100644
+--- a/gui/statusPage.py
++++ b/gui/statusPage.py
+@@ -43,7 +43,8 @@ try:
+         kwargs['unicode'] = True
+     t = gettext.translation(PROGNAME,
+                     localedir="/usr/share/locale",
+-                    **kwargs)
++                    **kwargs,
++                    fallback=True)
+     _ = t.gettext
+ except:
+     try:
+diff --git a/gui/system-config-selinux.py b/gui/system-config-selinux.py
+index 1b460c99363b..9f53b7fe9020 100644
+--- a/gui/system-config-selinux.py
++++ b/gui/system-config-selinux.py
+@@ -53,7 +53,8 @@ try:
+         kwargs['unicode'] = True
+     t = gettext.translation(PROGNAME,
+                     localedir="/usr/share/locale",
+-                    **kwargs)
++                    **kwargs,
++                    fallback=True)
+     _ = t.gettext
+ except:
+     try:
+diff --git a/gui/usersPage.py b/gui/usersPage.py
+index d51bd968b77e..9acd3b844056 100644
+--- a/gui/usersPage.py
++++ b/gui/usersPage.py
+@@ -37,7 +37,8 @@ try:
+         kwargs['unicode'] = True
+     t = gettext.translation(PROGNAME,
+                     localedir="/usr/share/locale",
+-                    **kwargs)
++                    **kwargs,
++                    fallback=True)
+     _ = t.gettext
+ except:
+     try:
+diff --git a/python/chcat/chcat b/python/chcat/chcat
+index e779fcc6ebd7..952cb8187599 100755
+--- a/python/chcat/chcat
++++ b/python/chcat/chcat
+@@ -38,9 +38,10 @@ try:
+         kwargs['unicode'] = True
+     t = gettext.translation(PROGNAME,
+                     localedir="/usr/share/locale",
+-                    **kwargs)
++                    **kwargs,
++                    fallback=True)
+     _ = t.gettext
+-except ImportError:
++except:
+     try:
+         import builtins
+         builtins.__dict__['_'] = str
+diff --git a/python/semanage/semanage b/python/semanage/semanage
+index 8f4e44a7a9cd..f45061a601f9 100644
+--- a/python/semanage/semanage
++++ b/python/semanage/semanage
+@@ -38,7 +38,8 @@ try:
+         kwargs['unicode'] = True
+     t = gettext.translation(PROGNAME,
+                     localedir="/usr/share/locale",
+-                    **kwargs)
++                    **kwargs,
++                    fallback=True)
+     _ = t.gettext
+ except:
+     try:
+diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
+index ff8f4e9c3008..0782c082dc0c 100644
+--- a/python/semanage/seobject.py
++++ b/python/semanage/seobject.py
+@@ -42,7 +42,8 @@ try:
+         kwargs['unicode'] = True
+     t = gettext.translation(PROGNAME,
+                     localedir="/usr/share/locale",
+-                    **kwargs)
++                    **kwargs,
++                    fallback=True)
+     _ = t.gettext
+ except:
+     try:
+diff --git a/python/sepolgen/src/sepolgen/sepolgeni18n.py b/python/sepolgen/src/sepolgen/sepolgeni18n.py
+index 56ebd807c69c..1ff307d9b27d 100644
+--- a/python/sepolgen/src/sepolgen/sepolgeni18n.py
++++ b/python/sepolgen/src/sepolgen/sepolgeni18n.py
+@@ -19,7 +19,9 @@
+ 
+ try: 
+     import gettext
+-    t = gettext.translation( 'selinux-python' )
++    t = gettext.translation("selinux-python",
++                        localedir="/usr/share/locale",
++                        fallback=True)
+     _ = t.gettext
+ except:
+     def _(str):
+diff --git a/python/sepolicy/sepolicy.py b/python/sepolicy/sepolicy.py
+index 7ebe0efa88a1..c7a70e094b0c 100755
+--- a/python/sepolicy/sepolicy.py
++++ b/python/sepolicy/sepolicy.py
+@@ -36,7 +36,8 @@ try:
+         kwargs['unicode'] = True
+     t = gettext.translation(PROGNAME,
+                     localedir="/usr/share/locale",
+-                    **kwargs)
++                    **kwargs,
++                    fallback=True)
+     _ = t.gettext
+ except:
+     try:
+diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py
+index 95520f9bc35d..6bde1971fd7c 100644
+--- a/python/sepolicy/sepolicy/__init__.py
++++ b/python/sepolicy/sepolicy/__init__.py
+@@ -31,7 +31,8 @@ try:
+         kwargs['unicode'] = True
+     t = gettext.translation(PROGNAME,
+                     localedir="/usr/share/locale",
+-                    **kwargs)
++                    **kwargs,
++                    fallback=True)
+     _ = t.gettext
+ except:
+     try:
+diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py
+index 3e8b9f9c291d..eff3a8973917 100644
+--- a/python/sepolicy/sepolicy/generate.py
++++ b/python/sepolicy/sepolicy/generate.py
+@@ -56,7 +56,8 @@ try:
+         kwargs['unicode'] = True
+     t = gettext.translation(PROGNAME,
+                     localedir="/usr/share/locale",
+-                    **kwargs)
++                    **kwargs,
++                    fallback=True)
+     _ = t.gettext
+ except:
+     try:
+diff --git a/python/sepolicy/sepolicy/gui.py b/python/sepolicy/sepolicy/gui.py
+index b0263740a79f..5bdbfebade1d 100644
+--- a/python/sepolicy/sepolicy/gui.py
++++ b/python/sepolicy/sepolicy/gui.py
+@@ -49,7 +49,8 @@ try:
+         kwargs['unicode'] = True
+     t = gettext.translation(PROGNAME,
+                     localedir="/usr/share/locale",
+-                    **kwargs)
++                    **kwargs,
++                    fallback=True)
+     _ = t.gettext
+ except:
+     try:
+diff --git a/python/sepolicy/sepolicy/interface.py b/python/sepolicy/sepolicy/interface.py
+index 599f97fdc6e7..43f86443f2c8 100644
+--- a/python/sepolicy/sepolicy/interface.py
++++ b/python/sepolicy/sepolicy/interface.py
+@@ -38,7 +38,8 @@ try:
+         kwargs['unicode'] = True
+     t = gettext.translation(PROGNAME,
+                     localedir="/usr/share/locale",
+-                    **kwargs)
++                    **kwargs,
++                    fallback=True)
+     _ = t.gettext
+ except:
+     try:
+diff --git a/sandbox/sandbox b/sandbox/sandbox
+index 3ef444a12561..53cc504149c9 100644
+--- a/sandbox/sandbox
++++ b/sandbox/sandbox
+@@ -45,7 +45,8 @@ try:
+         kwargs['unicode'] = True
+     t = gettext.translation(PROGNAME,
+                     localedir="/usr/share/locale",
+-                    **kwargs)
++                    **kwargs,
++                    fallback=True)
+     _ = t.gettext
+ except:
+     try:
+-- 
+2.36.1
+

0013-semodule-rename-rebuild-if-modules-changed-to-refres.patch

@@ -0,0 +1,82 @@
+From afafe02fa9b6b7fdcce883c5e873d46b9d811d66 Mon Sep 17 00:00:00 2001
+From: Ondrej Mosnacek <omosnace@redhat.com>
+Date: Wed, 8 Jun 2022 19:09:54 +0200
+Subject: [PATCH] semodule: rename --rebuild-if-modules-changed to --refresh
+Content-type: text/plain
+
+After the last commit this option's name and description no longer
+matches the semantic, so give it a new one and update the descriptions.
+The old name is still recognized and aliased to the new one for
+backwards compatibility.
+
+Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
+Acked-by: Nicolas Iooss <nicolas.iooss@m4x.org>
+---
+ policycoreutils/semodule/semodule.8 | 12 ++++++------
+ policycoreutils/semodule/semodule.c | 13 ++++++++++---
+ 2 files changed, 16 insertions(+), 9 deletions(-)
+
+diff --git a/policycoreutils/semodule/semodule.8 b/policycoreutils/semodule/semodule.8
+index d1735d216276..c56e580f27b8 100644
+--- a/policycoreutils/semodule/semodule.8
++++ b/policycoreutils/semodule/semodule.8
+@@ -23,12 +23,12 @@ force a reload of policy
+ .B \-B, \-\-build
+ force a rebuild of policy (also reloads unless \-n is used)
+ .TP
+-.B \-\-rebuild-if-modules-changed
+-Force a rebuild of the policy if any changes to module content are detected
+-(by comparing with checksum from the last transaction).  One can use this
+-instead of \-B to ensure that any changes to the module store done by an
+-external tool (e.g. a package manager) are applied, while automatically
+-skipping the rebuild if there are no new changes.
++.B \-\-refresh
++Like \-\-build, but reuses existing linked policy if no changes to module
++files are detected (by comparing with checksum from the last transaction).
++One can use this instead of \-B to ensure that any changes to the module
++store done by an external tool (e.g. a package manager) are applied, while
++automatically skipping the module re-linking if there are no module changes.
+ .TP
+ .B \-D, \-\-disable_dontaudit
+ Temporarily remove dontaudits from policy.  Reverts whenever policy is rebuilt
+diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c
+index 1ed8e69054e0..ec0794866daa 100644
+--- a/policycoreutils/semodule/semodule.c
++++ b/policycoreutils/semodule/semodule.c
+@@ -150,9 +150,12 @@ static void usage(char *progname)
+ 	printf("  -c, --cil extract module as cil. This only affects module extraction.\n");
+ 	printf("  -H, --hll extract module as hll. This only affects module extraction.\n");
+ 	printf("  -m, --checksum   print module checksum (SHA256).\n");
+-	printf("      --rebuild-if-modules-changed\n"
+-	       "                   force policy rebuild if module content changed since\n"
+-	       "                   last rebuild (based on checksum)\n");
++	printf("      --refresh    like --build, but reuses existing linked policy if no\n"
++	       "                   changes to module files are detected (via checksum)\n");
++	printf("Deprecated options:\n");
++	printf("  -b,--base	   same as --install\n");
++	printf("  --rebuild-if-modules-changed\n"
++	       "                   same as --refresh\n");
+ }
+ 
+ /* Sets the global mode variable to new_mode, but only if no other
+@@ -185,6 +188,7 @@ static void parse_command_line(int argc, char **argv)
+ {
+ 	static struct option opts[] = {
+ 		{"rebuild-if-modules-changed", 0, NULL, '\0'},
++		{"refresh", 0, NULL, '\0'},
+ 		{"store", required_argument, NULL, 's'},
+ 		{"base", required_argument, NULL, 'b'},
+ 		{"help", 0, NULL, 'h'},
+@@ -225,6 +229,9 @@ static void parse_command_line(int argc, char **argv)
+ 		case '\0':
+ 			switch(longind) {
+ 			case 0: /* --rebuild-if-modules-changed */
++				fprintf(stderr, "The --rebuild-if-modules-changed option is deprecated. Use --refresh instead.\n");
++				/* fallthrough */
++			case 1: /* --refresh */
+ 				check_ext_changes = 1;
+ 				break;
+ 			default:
+-- 
+2.36.1
+

0014-python-Split-semanage-import-into-two-transactions.patch

@@ -0,0 +1,65 @@
+From 4a53c0c3ee0edba37ba8e62064175c4928f761a8 Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Mon, 30 May 2022 14:20:21 +0200
+Subject: [PATCH] python: Split "semanage import" into two transactions
+Content-type: text/plain
+
+First transaction applies all deletion operations, so that there are no
+collisions when applying the rest of the changes.
+
+Fixes:
+  # semanage port -a -t http_cache_port_t -r s0 -p tcp 3024
+  # semanage export | semanage import
+  ValueError: Port tcp/3024 already defined
+
+Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
+---
+ python/semanage/semanage | 21 +++++++++++++++++++--
+ 1 file changed, 19 insertions(+), 2 deletions(-)
+
+diff --git a/python/semanage/semanage b/python/semanage/semanage
+index f45061a601f9..4e8d64d6863a 100644
+--- a/python/semanage/semanage
++++ b/python/semanage/semanage
+@@ -853,10 +853,29 @@ def handleImport(args):
+     trans = seobject.semanageRecords(args)
+     trans.start()
+ 
++    deleteCommands = []
++    commands = []
++    # separate commands for deletion from the rest so they can be
++    # applied in a separate transaction
+     for l in sys.stdin.readlines():
+         if len(l.strip()) == 0:
+             continue
++        if "-d" in l or "-D" in l:
++            deleteCommands.append(l)
++        else:
++            commands.append(l)
++
++    if deleteCommands:
++        importHelper(deleteCommands)
++        trans.finish()
++        trans.start()
++
++    importHelper(commands)
++    trans.finish()
+ 
++
++def importHelper(commands):
++    for l in commands:
+         try:
+             commandParser = createCommandParser()
+             args = commandParser.parse_args(mkargv(l))
+@@ -870,8 +889,6 @@ def handleImport(args):
+         except KeyboardInterrupt:
+             sys.exit(0)
+ 
+-    trans.finish()
+-
+ 
+ def setupImportParser(subparsers):
+     importParser = subparsers.add_parser('import', help=_('Import local customizations'))
+-- 
+2.36.1
+

0015-sepolicy-Another-small-optimization-for-mcs-types.patch

@@ -1,53 +0,0 @@
-From 7c315fff5e7ce74b0598b62d9aa0b21ca6b06b6d Mon Sep 17 00:00:00 2001
-From: Petr Lautrbach <plautrba@redhat.com>
-Date: Tue, 28 Feb 2017 21:29:46 +0100
-Subject: [PATCH] sepolicy: Another small optimization for mcs types
-
----
- python/sepolicy/sepolicy/manpage.py | 16 +++++++++++-----
- 1 file changed, 11 insertions(+), 5 deletions(-)
-
-diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
-index 330b055af214..f8584436960d 100755
---- a/python/sepolicy/sepolicy/manpage.py
-+++ b/python/sepolicy/sepolicy/manpage.py
-@@ -142,6 +142,15 @@ def _gen_entry_types():
-         entry_types = next(sepolicy.info(sepolicy.ATTRIBUTE, "entry_type"))["types"]
-     return entry_types
- 
-+mcs_constrained_types = None
-+
-+def _gen_mcs_constrained_types():
-+    global mcs_constrained_types
-+    if mcs_constrained_types is None:
-+        mcs_constrained_types = next(sepolicy.info(sepolicy.ATTRIBUTE, "mcs_constrained_type"))
-+    return mcs_constrained_types
-+
-+
- types = None
- 
- def _gen_types():
-@@ -390,6 +399,7 @@ class ManPage:
-         self.types = _gen_types()
-         self.exec_types = _gen_exec_types()
-         self.entry_types = _gen_entry_types()
-+        self.mcs_constrained_types = _gen_mcs_constrained_types()
- 
-         if self.source_files:
-             self.fcpath = self.root + "file_contexts"
-@@ -944,11 +954,7 @@ All executables with the default executable label, usually stored in /usr/bin an
- %s""" % ", ".join(paths))
- 
-     def _mcs_types(self):
--        try:
--            mcs_constrained_type = next(sepolicy.info(sepolicy.ATTRIBUTE, "mcs_constrained_type"))
--        except StopIteration:
--            return
--        if self.type not in mcs_constrained_type['types']:
-+        if self.type not in self.mcs_constrained_types['types']:
-             return
-         self.fd.write ("""
- .SH "MCS Constrained"
--- 
-2.29.0
-

0016-Move-po-translation-files-into-the-right-sub-directo.patch

@@ -1,515 +0,0 @@
-From a07e9652785c6196d916dfca3d36c898959406b4 Mon Sep 17 00:00:00 2001
-From: Petr Lautrbach <plautrba@redhat.com>
-Date: Mon, 6 Aug 2018 13:23:00 +0200
-Subject: [PATCH] Move po/ translation files into the right sub-directories
-
-When policycoreutils was split into policycoreutils/ python/ gui/ and sandbox/
-sub-directories, po/ translation files stayed in policycoreutils/.
-
-This commit split original policycoreutils/po directory into
-policycoreutils/po
-python/po
-gui/po
-sandbox/po
-
-See https://github.com/fedora-selinux/selinux/issues/43
----
- gui/Makefile                |  3 ++
- gui/po/Makefile             | 82 ++++++++++++++++++++++++++++++++++++
- gui/po/POTFILES             | 17 ++++++++
- policycoreutils/po/Makefile | 70 ++-----------------------------
- policycoreutils/po/POTFILES |  9 ++++
- python/Makefile             |  2 +-
- python/po/Makefile          | 83 +++++++++++++++++++++++++++++++++++++
- python/po/POTFILES          | 10 +++++
- sandbox/Makefile            |  2 +
- sandbox/po/Makefile         | 82 ++++++++++++++++++++++++++++++++++++
- sandbox/po/POTFILES         |  1 +
- 11 files changed, 293 insertions(+), 68 deletions(-)
- create mode 100644 gui/po/Makefile
- create mode 100644 gui/po/POTFILES
- create mode 100644 policycoreutils/po/POTFILES
- create mode 100644 python/po/Makefile
- create mode 100644 python/po/POTFILES
- create mode 100644 sandbox/po/Makefile
- create mode 100644 sandbox/po/POTFILES
-
-diff --git a/gui/Makefile b/gui/Makefile
-index ca965c942912..5a5bf6dcae19 100644
---- a/gui/Makefile
-+++ b/gui/Makefile
-@@ -22,6 +22,7 @@ system-config-selinux.ui \
- usersPage.py
- 
- all: $(TARGETS) system-config-selinux.py polgengui.py
-+	(cd po && $(MAKE) $@)
- 
- install: all
- 	-mkdir -p $(DESTDIR)$(MANDIR)/man8
-@@ -54,6 +55,8 @@ install: all
- 		install -m 644 sepolicy_$${i}.png $(DESTDIR)$(DATADIR)/icons/hicolor/$${i}x$${i}/apps/sepolicy.png; \
- 	done
- 	install -m 644 org.selinux.config.policy $(DESTDIR)$(DATADIR)/polkit-1/actions/
-+	(cd po && $(MAKE) $@)
-+
- clean:
- 
- indent:
-diff --git a/gui/po/Makefile b/gui/po/Makefile
-new file mode 100644
-index 000000000000..a0f5439f2d1c
---- /dev/null
-+++ b/gui/po/Makefile
-@@ -0,0 +1,82 @@
-+#
-+# Makefile for the PO files (translation) catalog
-+#
-+
-+PREFIX ?= /usr
-+
-+# What is this package?
-+NLSPACKAGE	= gui
-+POTFILE		= $(NLSPACKAGE).pot
-+INSTALL		= /usr/bin/install -c -p
-+INSTALL_DATA	= $(INSTALL) -m 644
-+INSTALL_DIR	= /usr/bin/install -d
-+
-+# destination directory
-+INSTALL_NLS_DIR = $(PREFIX)/share/locale
-+
-+# PO catalog handling
-+MSGMERGE	= msgmerge
-+MSGMERGE_FLAGS	= -q
-+XGETTEXT	= xgettext --default-domain=$(NLSPACKAGE)
-+MSGFMT		= msgfmt
-+
-+# All possible linguas
-+PO_LINGUAS := $(sort $(patsubst %.po,%,$(wildcard *.po)))
-+
-+# Only the files matching what the user has set in LINGUAS
-+USER_LINGUAS := $(filter $(patsubst %,%%,$(LINGUAS)),$(PO_LINGUAS))
-+
-+# if no valid LINGUAS, build all languages
-+USE_LINGUAS := $(if $(USER_LINGUAS),$(USER_LINGUAS),$(PO_LINGUAS))
-+
-+POFILES		= $(patsubst %,%.po,$(USE_LINGUAS))
-+MOFILES		= $(patsubst %.po,%.mo,$(POFILES))
-+POTFILES  = $(shell cat POTFILES)
-+
-+#default:: clean
-+
-+all::  $(MOFILES)
-+
-+$(POTFILE): $(POTFILES)
-+	$(XGETTEXT) --keyword=_ --keyword=N_ $(POTFILES)
-+	@if cmp -s $(NLSPACKAGE).po $(POTFILE); then \
-+	    rm -f $(NLSPACKAGE).po; \
-+	else \
-+	    mv -f $(NLSPACKAGE).po $(POTFILE); \
-+	fi; \
-+
-+
-+refresh-po: Makefile
-+	for cat in $(POFILES); do \
-+		lang=`basename $$cat .po`; \
-+		if $(MSGMERGE) $(MSGMERGE_FLAGS) $$lang.po $(POTFILE) > $$lang.pot ; then \
-+			mv -f $$lang.pot $$lang.po ; \
-+			echo "$(MSGMERGE) of $$lang succeeded" ; \
-+		else \
-+			echo "$(MSGMERGE) of $$lang failed" ; \
-+			rm -f $$lang.pot ; \
-+		fi \
-+	done
-+
-+clean:
-+	@rm -fv *mo *~ .depend
-+	@rm -rf tmp
-+
-+install: $(MOFILES)
-+	@for n in $(MOFILES); do \
-+	    l=`basename $$n .mo`; \
-+	    $(INSTALL_DIR) $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES; \
-+	    $(INSTALL_DATA) --verbose $$n $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES/selinux-$(NLSPACKAGE).mo; \
-+	done
-+
-+%.mo: %.po
-+	$(MSGFMT) -o $@ $<
-+report:
-+	@for cat in $(wildcard *.po); do \
-+                echo -n "$$cat: "; \
-+                msgfmt -v --statistics -o /dev/null $$cat; \
-+        done
-+
-+.PHONY: missing depend
-+
-+relabel:
-diff --git a/gui/po/POTFILES b/gui/po/POTFILES
-new file mode 100644
-index 000000000000..1795c5c1951b
---- /dev/null
-+++ b/gui/po/POTFILES
-@@ -0,0 +1,17 @@
-+../booleansPage.py
-+../domainsPage.py
-+../fcontextPage.py
-+../loginsPage.py
-+../modulesPage.py
-+../org.selinux.config.policy
-+../polgengui.py
-+../polgen.ui
-+../portsPage.py
-+../selinux-polgengui.desktop
-+../semanagePage.py
-+../sepolicy.desktop
-+../statusPage.py
-+../system-config-selinux.desktop
-+../system-config-selinux.py
-+../system-config-selinux.ui
-+../usersPage.py
-diff --git a/policycoreutils/po/Makefile b/policycoreutils/po/Makefile
-index 575e143122e6..18bc1dff8d1f 100644
---- a/policycoreutils/po/Makefile
-+++ b/policycoreutils/po/Makefile
-@@ -3,7 +3,6 @@
- #
- 
- PREFIX ?= /usr
--TOP	 = ../..
- 
- # What is this package?
- NLSPACKAGE	= policycoreutils
-@@ -32,74 +31,13 @@ USE_LINGUAS := $(if $(USER_LINGUAS),$(USER_LINGUAS),$(PO_LINGUAS))
- 
- POFILES		= $(patsubst %,%.po,$(USE_LINGUAS))
- MOFILES		= $(patsubst %.po,%.mo,$(POFILES))
--POTFILES = \
--	../run_init/open_init_pty.c \
--	../run_init/run_init.c \
--	../semodule_link/semodule_link.c \
--	../audit2allow/audit2allow \
--	../semanage/seobject.py \
--	../setsebool/setsebool.c \
--	../newrole/newrole.c \
--	../load_policy/load_policy.c \
--	../sestatus/sestatus.c \
--	../semodule/semodule.c \
--	../setfiles/setfiles.c \
--	../semodule_package/semodule_package.c \
--	../semodule_deps/semodule_deps.c \
--	../semodule_expand/semodule_expand.c \
--	../scripts/chcat \
--	../scripts/fixfiles \
--	../restorecond/stringslist.c \
--	../restorecond/restorecond.h \
--	../restorecond/utmpwatcher.h \
--	../restorecond/stringslist.h \
--	../restorecond/restorecond.c \
--	../restorecond/utmpwatcher.c \
--	../gui/booleansPage.py \
--	../gui/fcontextPage.py \
--	../gui/loginsPage.py \
--	../gui/mappingsPage.py \
--	../gui/modulesPage.py \
--	../gui/polgen.glade \
--	../gui/polgengui.py \
--	../gui/portsPage.py \
--	../gui/semanagePage.py \
--	../gui/statusPage.py \
--	../gui/system-config-selinux.glade \
--	../gui/system-config-selinux.py \
--	../gui/usersPage.py \
--	../secon/secon.c \
--	booleans.py \
--	../sepolicy/sepolicy.py \
--	../sepolicy/sepolicy/communicate.py \
--	../sepolicy/sepolicy/__init__.py \
--	../sepolicy/sepolicy/network.py \
--	../sepolicy/sepolicy/generate.py \
--	../sepolicy/sepolicy/sepolicy.glade \
--	../sepolicy/sepolicy/gui.py \
--	../sepolicy/sepolicy/manpage.py \
--	../sepolicy/sepolicy/transition.py \
--	../sepolicy/sepolicy/templates/executable.py \
--	../sepolicy/sepolicy/templates/__init__.py \
--	../sepolicy/sepolicy/templates/network.py \
--	../sepolicy/sepolicy/templates/rw.py \
--	../sepolicy/sepolicy/templates/script.py \
--	../sepolicy/sepolicy/templates/semodule.py \
--	../sepolicy/sepolicy/templates/tmp.py \
--	../sepolicy/sepolicy/templates/user.py \
--	../sepolicy/sepolicy/templates/var_lib.py \
--	../sepolicy/sepolicy/templates/var_log.py \
--	../sepolicy/sepolicy/templates/var_run.py \
--	../sepolicy/sepolicy/templates/var_spool.py
-+POTFILES  = $(shell cat POTFILES)
- 
- #default:: clean
- 
--all::  $(MOFILES)
-+all:: $(POTFILE) $(MOFILES)
- 
--booleans.py:
--	sepolicy booleans -a > booleans.py
--
--$(POTFILE): $(POTFILES) booleans.py
-+$(POTFILE): $(POTFILES)
- 	$(XGETTEXT) --keyword=_ --keyword=N_ $(POTFILES)
- 	@if cmp -s $(NLSPACKAGE).po $(POTFILE); then \
- 	    rm -f $(NLSPACKAGE).po; \
-@@ -107,8 +45,6 @@ $(POTFILE): $(POTFILES) booleans.py
- 	    mv -f $(NLSPACKAGE).po $(POTFILE); \
- 	fi; \
- 
--update-po: Makefile $(POTFILE) refresh-po
--	@rm -f booleans.py
- 
- refresh-po: Makefile
- 	for cat in $(POFILES); do \
-diff --git a/policycoreutils/po/POTFILES b/policycoreutils/po/POTFILES
-new file mode 100644
-index 000000000000..12237dc61ee4
---- /dev/null
-+++ b/policycoreutils/po/POTFILES
-@@ -0,0 +1,9 @@
-+../run_init/open_init_pty.c
-+../run_init/run_init.c
-+../setsebool/setsebool.c
-+../newrole/newrole.c
-+../load_policy/load_policy.c
-+../sestatus/sestatus.c
-+../semodule/semodule.c
-+../setfiles/setfiles.c
-+../secon/secon.c
-diff --git a/python/Makefile b/python/Makefile
-index 9b66d52fbd4d..00312dbdb5c6 100644
---- a/python/Makefile
-+++ b/python/Makefile
-@@ -1,4 +1,4 @@
--SUBDIRS = sepolicy audit2allow semanage sepolgen chcat
-+SUBDIRS = sepolicy audit2allow semanage sepolgen chcat po
- 
- all install relabel clean indent test:
- 	@for subdir in $(SUBDIRS); do \
-diff --git a/python/po/Makefile b/python/po/Makefile
-new file mode 100644
-index 000000000000..4e052d5a2bd7
---- /dev/null
-+++ b/python/po/Makefile
-@@ -0,0 +1,83 @@
-+#
-+# Makefile for the PO files (translation) catalog
-+#
-+
-+PREFIX ?= /usr
-+
-+# What is this package?
-+NLSPACKAGE	= python
-+POTFILE		= $(NLSPACKAGE).pot
-+INSTALL		= /usr/bin/install -c -p
-+INSTALL_DATA	= $(INSTALL) -m 644
-+INSTALL_DIR	= /usr/bin/install -d
-+
-+# destination directory
-+INSTALL_NLS_DIR = $(PREFIX)/share/locale
-+
-+# PO catalog handling
-+MSGMERGE	= msgmerge
-+MSGMERGE_FLAGS	= -q
-+XGETTEXT	= xgettext --default-domain=$(NLSPACKAGE)
-+MSGFMT		= msgfmt
-+
-+# All possible linguas
-+PO_LINGUAS := $(sort $(patsubst %.po,%,$(wildcard *.po)))
-+
-+# Only the files matching what the user has set in LINGUAS
-+USER_LINGUAS := $(filter $(patsubst %,%%,$(LINGUAS)),$(PO_LINGUAS))
-+
-+# if no valid LINGUAS, build all languages
-+USE_LINGUAS := $(if $(USER_LINGUAS),$(USER_LINGUAS),$(PO_LINGUAS))
-+
-+POFILES		= $(patsubst %,%.po,$(USE_LINGUAS))
-+MOFILES		= $(patsubst %.po,%.mo,$(POFILES))
-+POTFILES  = $(shell cat POTFILES)
-+
-+#default:: clean
-+
-+all::  $(MOFILES)
-+
-+$(POTFILE): $(POTFILES) 
-+	$(XGETTEXT) -L Python --keyword=_ --keyword=N_ $(POTFILES)
-+	$(XGETTEXT) -j --keyword=_ --keyword=N_ ../sepolicy/sepolicy/sepolicy.glade
-+	@if cmp -s $(NLSPACKAGE).po $(POTFILE); then \
-+	    rm -f $(NLSPACKAGE).po; \
-+	else \
-+	    mv -f $(NLSPACKAGE).po $(POTFILE); \
-+	fi; \
-+
-+
-+refresh-po: Makefile
-+	for cat in $(POFILES); do \
-+		lang=`basename $$cat .po`; \
-+		if $(MSGMERGE) $(MSGMERGE_FLAGS) $$lang.po $(POTFILE) > $$lang.pot ; then \
-+			mv -f $$lang.pot $$lang.po ; \
-+			echo "$(MSGMERGE) of $$lang succeeded" ; \
-+		else \
-+			echo "$(MSGMERGE) of $$lang failed" ; \
-+			rm -f $$lang.pot ; \
-+		fi \
-+	done
-+
-+clean:
-+	@rm -fv *mo *~ .depend
-+	@rm -rf tmp
-+
-+install: $(MOFILES)
-+	@for n in $(MOFILES); do \
-+	    l=`basename $$n .mo`; \
-+	    $(INSTALL_DIR) $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES; \
-+	    $(INSTALL_DATA) --verbose $$n $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES/selinux-$(NLSPACKAGE).mo; \
-+	done
-+
-+%.mo: %.po
-+	$(MSGFMT) -o $@ $<
-+report:
-+	@for cat in $(wildcard *.po); do \
-+                echo -n "$$cat: "; \
-+                msgfmt -v --statistics -o /dev/null $$cat; \
-+        done
-+
-+.PHONY: missing depend
-+
-+relabel:
-diff --git a/python/po/POTFILES b/python/po/POTFILES
-new file mode 100644
-index 000000000000..128eb870a69e
---- /dev/null
-+++ b/python/po/POTFILES
-@@ -0,0 +1,10 @@
-+../audit2allow/audit2allow
-+../chcat/chcat
-+../semanage/semanage
-+../semanage/seobject.py
-+../sepolgen/src/sepolgen/interfaces.py
-+../sepolicy/sepolicy/generate.py
-+../sepolicy/sepolicy/gui.py
-+../sepolicy/sepolicy/__init__.py
-+../sepolicy/sepolicy/interface.py
-+../sepolicy/sepolicy.py
-diff --git a/sandbox/Makefile b/sandbox/Makefile
-index 9da5e58db9e6..b817824e2102 100644
---- a/sandbox/Makefile
-+++ b/sandbox/Makefile
-@@ -13,6 +13,7 @@ override LDLIBS += -lselinux -lcap-ng
- SEUNSHARE_OBJS = seunshare.o
- 
- all: sandbox seunshare sandboxX.sh start
-+	(cd po && $(MAKE) $@)
- 
- seunshare: $(SEUNSHARE_OBJS)
- 
-@@ -39,6 +40,7 @@ install: all
- 	install -m 755 start $(DESTDIR)$(SHAREDIR)
- 	-mkdir -p $(DESTDIR)$(SYSCONFDIR)
- 	install -m 644 sandbox.conf $(DESTDIR)$(SYSCONFDIR)/sandbox
-+	(cd po && $(MAKE) $@)
- 
- test:
- 	@$(PYTHON) test_sandbox.py -v
-diff --git a/sandbox/po/Makefile b/sandbox/po/Makefile
-new file mode 100644
-index 000000000000..0556bbe953f0
---- /dev/null
-+++ b/sandbox/po/Makefile
-@@ -0,0 +1,82 @@
-+#
-+# Makefile for the PO files (translation) catalog
-+#
-+
-+PREFIX ?= /usr
-+
-+# What is this package?
-+NLSPACKAGE	= sandbox
-+POTFILE		= $(NLSPACKAGE).pot
-+INSTALL		= /usr/bin/install -c -p
-+INSTALL_DATA	= $(INSTALL) -m 644
-+INSTALL_DIR	= /usr/bin/install -d
-+
-+# destination directory
-+INSTALL_NLS_DIR = $(PREFIX)/share/locale
-+
-+# PO catalog handling
-+MSGMERGE	= msgmerge
-+MSGMERGE_FLAGS	= -q
-+XGETTEXT	= xgettext -L Python --default-domain=$(NLSPACKAGE)
-+MSGFMT		= msgfmt
-+
-+# All possible linguas
-+PO_LINGUAS := $(sort $(patsubst %.po,%,$(wildcard *.po)))
-+
-+# Only the files matching what the user has set in LINGUAS
-+USER_LINGUAS := $(filter $(patsubst %,%%,$(LINGUAS)),$(PO_LINGUAS))
-+
-+# if no valid LINGUAS, build all languages
-+USE_LINGUAS := $(if $(USER_LINGUAS),$(USER_LINGUAS),$(PO_LINGUAS))
-+
-+POFILES		= $(patsubst %,%.po,$(USE_LINGUAS))
-+MOFILES		= $(patsubst %.po,%.mo,$(POFILES))
-+POTFILES  = $(shell cat POTFILES)
-+
-+#default:: clean
-+
-+all:: $(POTFILE) $(MOFILES)
-+
-+$(POTFILE): $(POTFILES)
-+	$(XGETTEXT) --keyword=_ --keyword=N_ $(POTFILES)
-+	@if cmp -s $(NLSPACKAGE).po $(POTFILE); then \
-+	    rm -f $(NLSPACKAGE).po; \
-+	else \
-+	    mv -f $(NLSPACKAGE).po $(POTFILE); \
-+	fi; \
-+
-+
-+refresh-po: Makefile
-+	for cat in $(POFILES); do \
-+		lang=`basename $$cat .po`; \
-+		if $(MSGMERGE) $(MSGMERGE_FLAGS) $$lang.po $(POTFILE) > $$lang.pot ; then \
-+			mv -f $$lang.pot $$lang.po ; \
-+			echo "$(MSGMERGE) of $$lang succeeded" ; \
-+		else \
-+			echo "$(MSGMERGE) of $$lang failed" ; \
-+			rm -f $$lang.pot ; \
-+		fi \
-+	done
-+
-+clean:
-+	@rm -fv *mo *~ .depend
-+	@rm -rf tmp
-+
-+install: $(MOFILES)
-+	@for n in $(MOFILES); do \
-+	    l=`basename $$n .mo`; \
-+	    $(INSTALL_DIR) $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES; \
-+	    $(INSTALL_DATA) --verbose $$n $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES/selinux-$(NLSPACKAGE).mo; \
-+	done
-+
-+%.mo: %.po
-+	$(MSGFMT) -o $@ $<
-+report:
-+	@for cat in $(wildcard *.po); do \
-+                echo -n "$$cat: "; \
-+                msgfmt -v --statistics -o /dev/null $$cat; \
-+        done
-+
-+.PHONY: missing depend
-+
-+relabel:
-diff --git a/sandbox/po/POTFILES b/sandbox/po/POTFILES
-new file mode 100644
-index 000000000000..deff3f2f4656
---- /dev/null
-+++ b/sandbox/po/POTFILES
-@@ -0,0 +1 @@
-+../sandbox
--- 
-2.29.0
-

0017-Use-correct-gettext-domains-in-python-gui-sandbox.patch

@@ -1,306 +0,0 @@
-From eab0fc05a38ab2cd47b3e0ff69981850cc7cd538 Mon Sep 17 00:00:00 2001
-From: Petr Lautrbach <plautrba@redhat.com>
-Date: Mon, 6 Aug 2018 13:37:07 +0200
-Subject: [PATCH] Use correct gettext domains in python/ gui/ sandbox/
-
-https://github.com/fedora-selinux/selinux/issues/43
----
- gui/booleansPage.py                          | 2 +-
- gui/domainsPage.py                           | 2 +-
- gui/fcontextPage.py                          | 2 +-
- gui/loginsPage.py                            | 2 +-
- gui/modulesPage.py                           | 2 +-
- gui/polgengui.py                             | 2 +-
- gui/portsPage.py                             | 2 +-
- gui/semanagePage.py                          | 2 +-
- gui/statusPage.py                            | 2 +-
- gui/system-config-selinux.py                 | 2 +-
- gui/usersPage.py                             | 2 +-
- python/chcat/chcat                           | 2 +-
- python/semanage/semanage                     | 2 +-
- python/semanage/seobject.py                  | 2 +-
- python/sepolgen/src/sepolgen/sepolgeni18n.py | 2 +-
- python/sepolicy/sepolicy.py                  | 2 +-
- python/sepolicy/sepolicy/__init__.py         | 2 +-
- python/sepolicy/sepolicy/generate.py         | 2 +-
- python/sepolicy/sepolicy/gui.py              | 2 +-
- python/sepolicy/sepolicy/interface.py        | 2 +-
- sandbox/sandbox                              | 2 +-
- 21 files changed, 21 insertions(+), 21 deletions(-)
-
-diff --git a/gui/booleansPage.py b/gui/booleansPage.py
-index 7849bea26a06..dd12b6d6ab86 100644
---- a/gui/booleansPage.py
-+++ b/gui/booleansPage.py
-@@ -38,7 +38,7 @@ DISABLED = 2
- ##
- ## I18N
- ##
--PROGNAME = "policycoreutils"
-+PROGNAME = "selinux-gui"
- try:
-     import gettext
-     kwargs = {}
-diff --git a/gui/domainsPage.py b/gui/domainsPage.py
-index bad5140d8c59..6bbe4de5884f 100644
---- a/gui/domainsPage.py
-+++ b/gui/domainsPage.py
-@@ -30,7 +30,7 @@ from semanagePage import *
- ##
- ## I18N
- ##
--PROGNAME = "policycoreutils"
-+PROGNAME = "selinux-gui"
- try:
-     import gettext
-     kwargs = {}
-diff --git a/gui/fcontextPage.py b/gui/fcontextPage.py
-index 370bbee40786..e424366da26f 100644
---- a/gui/fcontextPage.py
-+++ b/gui/fcontextPage.py
-@@ -47,7 +47,7 @@ class context:
- ##
- ## I18N
- ##
--PROGNAME = "policycoreutils"
-+PROGNAME = "selinux-gui"
- try:
-     import gettext
-     kwargs = {}
-diff --git a/gui/loginsPage.py b/gui/loginsPage.py
-index b67eb8bc42af..cbfb0cc23f65 100644
---- a/gui/loginsPage.py
-+++ b/gui/loginsPage.py
-@@ -29,7 +29,7 @@ from semanagePage import *
- ##
- ## I18N
- ##
--PROGNAME = "policycoreutils"
-+PROGNAME = "selinux-gui"
- try:
-     import gettext
-     kwargs = {}
-diff --git a/gui/modulesPage.py b/gui/modulesPage.py
-index 0584acf9b3a4..35a0129bab9c 100644
---- a/gui/modulesPage.py
-+++ b/gui/modulesPage.py
-@@ -30,7 +30,7 @@ from semanagePage import *
- ##
- ## I18N
- ##
--PROGNAME = "policycoreutils"
-+PROGNAME = "selinux-gui"
- try:
-     import gettext
-     kwargs = {}
-diff --git a/gui/polgengui.py b/gui/polgengui.py
-index d284ded65279..01f541bafae8 100644
---- a/gui/polgengui.py
-+++ b/gui/polgengui.py
-@@ -63,7 +63,7 @@ def get_all_modules():
- ##
- ## I18N
- ##
--PROGNAME = "policycoreutils"
-+PROGNAME = "selinux-gui"
- try:
-     import gettext
-     kwargs = {}
-diff --git a/gui/portsPage.py b/gui/portsPage.py
-index 30f58383bc1d..a537ecc8c0a1 100644
---- a/gui/portsPage.py
-+++ b/gui/portsPage.py
-@@ -35,7 +35,7 @@ from semanagePage import *
- ##
- ## I18N
- ##
--PROGNAME = "policycoreutils"
-+PROGNAME = "selinux-gui"
- try:
-     import gettext
-     kwargs = {}
-diff --git a/gui/semanagePage.py b/gui/semanagePage.py
-index 4127804fbbee..5361d69c1313 100644
---- a/gui/semanagePage.py
-+++ b/gui/semanagePage.py
-@@ -22,7 +22,7 @@ from gi.repository import Gdk, Gtk
- ##
- ## I18N
- ##
--PROGNAME = "policycoreutils"
-+PROGNAME = "selinux-gui"
- try:
-     import gettext
-     kwargs = {}
-diff --git a/gui/statusPage.py b/gui/statusPage.py
-index 766854b19cba..a8f079b9b163 100644
---- a/gui/statusPage.py
-+++ b/gui/statusPage.py
-@@ -35,7 +35,7 @@ RELABELFILE = "/.autorelabel"
- ##
- ## I18N
- ##
--PROGNAME = "policycoreutils"
-+PROGNAME = "selinux-gui"
- try:
-     import gettext
-     kwargs = {}
-diff --git a/gui/system-config-selinux.py b/gui/system-config-selinux.py
-index 3f70122b87e8..8c46c987b974 100644
---- a/gui/system-config-selinux.py
-+++ b/gui/system-config-selinux.py
-@@ -45,7 +45,7 @@ import selinux
- ##
- ## I18N
- ##
--PROGNAME = "policycoreutils"
-+PROGNAME = "selinux-gui"
- try:
-     import gettext
-     kwargs = {}
-diff --git a/gui/usersPage.py b/gui/usersPage.py
-index 26794ed5c3f3..d15d4c5a71dd 100644
---- a/gui/usersPage.py
-+++ b/gui/usersPage.py
-@@ -29,7 +29,7 @@ from semanagePage import *
- ##
- ## I18N
- ##
--PROGNAME = "policycoreutils"
-+PROGNAME = "selinux-gui"
- try:
-     import gettext
-     kwargs = {}
-diff --git a/python/chcat/chcat b/python/chcat/chcat
-index fdd2e46ee3f9..839ddd3b54b6 100755
---- a/python/chcat/chcat
-+++ b/python/chcat/chcat
-@@ -30,7 +30,7 @@ import getopt
- import selinux
- import seobject
- 
--PROGNAME = "policycoreutils"
-+PROGNAME = "selinux-python"
- try:
-     import gettext
-     kwargs = {}
-diff --git a/python/semanage/semanage b/python/semanage/semanage
-index b2fabea67a87..3cc30a160a74 100644
---- a/python/semanage/semanage
-+++ b/python/semanage/semanage
-@@ -27,7 +27,7 @@ import traceback
- import argparse
- import seobject
- import sys
--PROGNAME = "policycoreutils"
-+PROGNAME = "selinux-python"
- try:
-     import gettext
-     kwargs = {}
-diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
-index 6a14f7b47dd5..b51a7e3e7ca3 100644
---- a/python/semanage/seobject.py
-+++ b/python/semanage/seobject.py
-@@ -29,7 +29,7 @@ import sys
- import stat
- import socket
- from semanage import *
--PROGNAME = "policycoreutils"
-+PROGNAME = "selinux-python"
- import sepolicy
- import setools
- import ipaddress
-diff --git a/python/sepolgen/src/sepolgen/sepolgeni18n.py b/python/sepolgen/src/sepolgen/sepolgeni18n.py
-index 998c4356415c..56ebd807c69c 100644
---- a/python/sepolgen/src/sepolgen/sepolgeni18n.py
-+++ b/python/sepolgen/src/sepolgen/sepolgeni18n.py
-@@ -19,7 +19,7 @@
- 
- try: 
-     import gettext
--    t = gettext.translation( 'yumex' )
-+    t = gettext.translation( 'selinux-python' )
-     _ = t.gettext
- except:
-     def _(str):
-diff --git a/python/sepolicy/sepolicy.py b/python/sepolicy/sepolicy.py
-index 7b2230651099..32956e58f52e 100755
---- a/python/sepolicy/sepolicy.py
-+++ b/python/sepolicy/sepolicy.py
-@@ -28,7 +28,7 @@ import sepolicy
- from multiprocessing import Pool
- from sepolicy import get_os_version, get_conditionals, get_conditionals_format_text
- import argparse
--PROGNAME = "policycoreutils"
-+PROGNAME = "selinux-python"
- try:
-     import gettext
-     kwargs = {}
-diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py
-index ea05d892bf3b..9a9c2ae9f237 100644
---- a/python/sepolicy/sepolicy/__init__.py
-+++ b/python/sepolicy/sepolicy/__init__.py
-@@ -13,7 +13,7 @@ import os
- import re
- import gzip
- 
--PROGNAME = "policycoreutils"
-+PROGNAME = "selinux-python"
- try:
-     import gettext
-     kwargs = {}
-diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py
-index 4e1ed4e9dc31..43180ca6fda4 100644
---- a/python/sepolicy/sepolicy/generate.py
-+++ b/python/sepolicy/sepolicy/generate.py
-@@ -48,7 +48,7 @@ import sepolgen.defaults as defaults
- ##
- ## I18N
- ##
--PROGNAME = "policycoreutils"
-+PROGNAME = "selinux-python"
- try:
-     import gettext
-     kwargs = {}
-diff --git a/python/sepolicy/sepolicy/gui.py b/python/sepolicy/sepolicy/gui.py
-index 1e86422b864a..c9ca158ddd09 100644
---- a/python/sepolicy/sepolicy/gui.py
-+++ b/python/sepolicy/sepolicy/gui.py
-@@ -41,7 +41,7 @@ import os
- import re
- import unicodedata
- 
--PROGNAME = "policycoreutils"
-+PROGNAME = "selinux-python"
- try:
-     import gettext
-     kwargs = {}
-diff --git a/python/sepolicy/sepolicy/interface.py b/python/sepolicy/sepolicy/interface.py
-index bdffb770f364..9d40aea1498d 100644
---- a/python/sepolicy/sepolicy/interface.py
-+++ b/python/sepolicy/sepolicy/interface.py
-@@ -30,7 +30,7 @@ __all__ = ['get_all_interfaces', 'get_interfaces_from_xml', 'get_admin', 'get_us
- ##
- ## I18N
- ##
--PROGNAME = "policycoreutils"
-+PROGNAME = "selinux-python"
- try:
-     import gettext
-     kwargs = {}
-diff --git a/sandbox/sandbox b/sandbox/sandbox
-index ca5f1e030a51..16c43b51eaaa 100644
---- a/sandbox/sandbox
-+++ b/sandbox/sandbox
-@@ -37,7 +37,7 @@ import sepolicy
- 
- SEUNSHARE = "/usr/sbin/seunshare"
- SANDBOXSH = "/usr/share/sandbox/sandboxX.sh"
--PROGNAME = "policycoreutils"
-+PROGNAME = "selinux-sandbox"
- try:
-     import gettext
-     kwargs = {}
--- 
-2.29.0
-

0019-policycoreutils-setfiles-Improve-description-of-d-sw.patch

@@ -1,30 +0,0 @@
-From 4277ef04de699e1939c95c4813de6a78d1ea1656 Mon Sep 17 00:00:00 2001
-From: Vit Mojzis <vmojzis@redhat.com>
-Date: Wed, 21 Mar 2018 08:51:31 +0100
-Subject: [PATCH] policycoreutils/setfiles: Improve description of -d switch
-
-The "-q" switch is becoming obsolete (completely unused in fedora) and
-debug output ("-d" switch) makes sense in any scenario. Therefore both
-options can be specified at once.
-
-Resolves: rhbz#1271327
----
- policycoreutils/setfiles/setfiles.8 | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
-index e328a5628682..02e0960289d3 100644
---- a/policycoreutils/setfiles/setfiles.8
-+++ b/policycoreutils/setfiles/setfiles.8
-@@ -58,7 +58,7 @@ check the validity of the contexts against the specified binary policy.
- .TP
- .B \-d
- show what specification matched each file (do not abort validation
--after ABORT_ON_ERRORS errors).
-+after ABORT_ON_ERRORS errors). Not affected by "\-q"
- .TP
- .BI \-e \ directory
- directory to exclude (repeat option for more than one directory).
--- 
-2.29.0
-

0021-semodule-utils-Fix-RESOURCE_LEAK-coverity-scan-defec.patch

@@ -1,24 +0,0 @@
-From 122e35c4d11b5b623e8bc463f81c6792385523cb Mon Sep 17 00:00:00 2001
-From: Petr Lautrbach <plautrba@redhat.com>
-Date: Thu, 8 Nov 2018 09:20:58 +0100
-Subject: [PATCH] semodule-utils: Fix RESOURCE_LEAK coverity scan defects
-
----
- semodule-utils/semodule_package/semodule_package.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/semodule-utils/semodule_package/semodule_package.c b/semodule-utils/semodule_package/semodule_package.c
-index 3515234e36de..7b75b3fd9bb4 100644
---- a/semodule-utils/semodule_package/semodule_package.c
-+++ b/semodule-utils/semodule_package/semodule_package.c
-@@ -74,6 +74,7 @@ static int file_to_data(const char *path, char **data, size_t * len)
- 	}
- 	if (!sb.st_size) {
- 		*len = 0;
-+		close(fd);
- 		return 0;
- 	}
- 
--- 
-2.29.0
-

0023-sepolicy-Fix-flake8-warnings-in-Fedora-only-code.patch

@@ -1,46 +0,0 @@
-From b1f380c75f8a4ea7a4062d3735d190a1dcbc3aaa Mon Sep 17 00:00:00 2001
-From: Ondrej Mosnacek <omosnace@redhat.com>
-Date: Tue, 28 Jul 2020 14:37:13 +0200
-Subject: [PATCH] sepolicy: Fix flake8 warnings in Fedora-only code
-
-Fixes:
-$ PATH="$VIRTUAL_ENV/bin:$PATH" ./scripts/run-flake8
-Analyzing 187 Python scripts
-./installdir/usr/lib/python3.8/site-packages/sepolicy/manpage.py:720:20: E713 test for membership should be 'not in'
-./installdir/usr/lib/python3.8/site-packages/sepolicy/manpage.py:774:17: E117 over-indented
-./python/sepolicy/build/lib/sepolicy/manpage.py:720:20: E713 test for membership should be 'not in'
-./python/sepolicy/build/lib/sepolicy/manpage.py:774:17: E117 over-indented
-./python/sepolicy/sepolicy/manpage.py:720:20: E713 test for membership should be 'not in'
-./python/sepolicy/sepolicy/manpage.py:774:17: E117 over-indented
-The command "PATH="$VIRTUAL_ENV/bin:$PATH" ./scripts/run-flake8" exited with 1.
-
-Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
----
- python/sepolicy/sepolicy/manpage.py | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
-index f8584436960d..6a3e08fca58c 100755
---- a/python/sepolicy/sepolicy/manpage.py
-+++ b/python/sepolicy/sepolicy/manpage.py
-@@ -717,7 +717,7 @@ Default Defined Ports:""")
-         for f in self.all_file_types:
-             if f.startswith(self.domainname):
-                 flist.append(f)
--                if not f in self.exec_types or not f in self.entry_types:
-+                if f not in self.exec_types or f not in self.entry_types:
-                     flist_non_exec.append(f)
-                 if f in self.fcdict:
-                     mpaths = mpaths + self.fcdict[f]["regex"]
-@@ -771,7 +771,7 @@ SELinux %(domainname)s policy is very flexible allowing users to setup their %(d
- """ % {'domainname': self.domainname, 'equiv': e, 'alt': e.split('/')[-1]})
- 
-         if flist_non_exec:
--                self.fd.write(r"""
-+            self.fd.write(r"""
- .PP
- .B STANDARD FILE CONTEXT
- 
--- 
-2.29.0
-

0024-selinux_config-5-add-a-note-that-runtime-disable-is-.patch

@@ -1,29 +0,0 @@
-From 99450e5c391f0e5b7da9234588123edca0993794 Mon Sep 17 00:00:00 2001
-From: Ondrej Mosnacek <omosnace@redhat.com>
-Date: Wed, 11 Nov 2020 17:23:40 +0100
-Subject: [PATCH] selinux_config(5): add a note that runtime disable is
- deprecated
-
-...and refer to selinux(8), which explains it further.
-
-Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
----
- policycoreutils/man/man5/selinux_config.5 | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/policycoreutils/man/man5/selinux_config.5 b/policycoreutils/man/man5/selinux_config.5
-index 1ffade150128..58b42a0e234d 100644
---- a/policycoreutils/man/man5/selinux_config.5
-+++ b/policycoreutils/man/man5/selinux_config.5
-@@ -48,7 +48,7 @@ SELinux security policy is enforced.
- .IP \fIpermissive\fR 4
- SELinux security policy is not enforced but logs the warnings (i.e. the action is allowed to proceed).
- .IP \fIdisabled\fR
--SELinux is disabled and no policy is loaded.
-+No SELinux policy is loaded.  This option was used to disable SELinux completely, which is now deprecated.  Use the \fBselinux=0\fR kernel boot option instead (see \fBselinux\fR(8)).
- .RE
- .sp
- The entry can be determined using the \fBsestatus\fR(8) command or \fBselinux_getenforcemode\fR(3).
--- 
-2.29.2
-

0025-python-sepolicy-allow-to-override-manpage-date.patch

@@ -1,51 +0,0 @@
-From 794dbdb6b1336cae872f45b5adaa594796e4806b Mon Sep 17 00:00:00 2001
-From: "Bernhard M. Wiedemann" <bwiedemann@suse.de>
-Date: Fri, 30 Oct 2020 22:53:09 +0100
-Subject: [PATCH] python/sepolicy: allow to override manpage date
-
-in order to make builds reproducible.
-See https://reproducible-builds.org/ for why this is good
-and https://reproducible-builds.org/specs/source-date-epoch/
-for the definition of this variable.
-
-This patch was done while working on reproducible builds for openSUSE.
-
-Signed-off-by: Bernhard M. Wiedemann <bwiedemann@suse.de>
----
- python/sepolicy/sepolicy/manpage.py | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
-index 6a3e08fca58c..c013c0d48502 100755
---- a/python/sepolicy/sepolicy/manpage.py
-+++ b/python/sepolicy/sepolicy/manpage.py
-@@ -39,6 +39,8 @@ typealias_types = {
- equiv_dict = {"smbd": ["samba"], "httpd": ["apache"], "virtd": ["virt", "libvirt"], "named": ["bind"], "fsdaemon": ["smartmon"], "mdadm": ["raid"]}
- 
- equiv_dirs = ["/var"]
-+man_date = time.strftime("%y-%m-%d", time.gmtime(
-+        int(os.environ.get('SOURCE_DATE_EPOCH', time.time()))))
- modules_dict = None
- 
- 
-@@ -546,7 +548,7 @@ class ManPage:
- 
-     def _typealias(self,typealias):
-         self.fd.write('.TH  "%(typealias)s_selinux"  "8"  "%(date)s" "%(typealias)s" "SELinux Policy %(typealias)s"'
--                 % {'typealias':typealias, 'date': time.strftime("%y-%m-%d")})
-+                 % {'typealias':typealias, 'date': man_date})
-         self.fd.write(r"""
- .SH "NAME"
- %(typealias)s_selinux \- Security Enhanced Linux Policy for the %(typealias)s processes
-@@ -565,7 +567,7 @@ man page for more details.
- 
-     def _header(self):
-         self.fd.write('.TH  "%(domainname)s_selinux"  "8"  "%(date)s" "%(domainname)s" "SELinux Policy %(domainname)s"'
--                      % {'domainname': self.domainname, 'date': time.strftime("%y-%m-%d")})
-+                      % {'domainname': self.domainname, 'date': man_date})
-         self.fd.write(r"""
- .SH "NAME"
- %(domainname)s_selinux \- Security Enhanced Linux Policy for the %(domainname)s processes
--- 
-2.29.2
-

policycoreutils.spec

@@ -1,7 +1,11 @@
+%ifarch riscv64
+%global debug_package %{nil}
+%endif
+
 %global libauditver     3.0
-%global libsepolver     3.1-5
-%global libsemanagever  3.1-5
-%global libselinuxver   3.1-5
+%global libsepolver     3.4-1
+%global libsemanagever  3.4-1
+%global libselinuxver   3.4-1
 
 %global generatorsdir %{_prefix}/lib/systemd/system-generators
 
@@ -10,17 +14,11 @@
 
 Summary: SELinux policy core utilities
 Name:    policycoreutils
-Version: 3.1
-Release: 8%{?dist}
+Version: 3.4
+Release: 6.0.riscv64%{?dist}
 License: GPLv2
 # https://github.com/SELinuxProject/selinux/wiki/Releases
-Source0: https://github.com/SELinuxProject/selinux/releases/download/20200710/policycoreutils-3.1.tar.gz
-Source1: https://github.com/SELinuxProject/selinux/releases/download/20200710/selinux-python-3.1.tar.gz
-Source2: https://github.com/SELinuxProject/selinux/releases/download/20200710/selinux-gui-3.1.tar.gz
-Source3: https://github.com/SELinuxProject/selinux/releases/download/20200710/selinux-sandbox-3.1.tar.gz
-Source4: https://github.com/SELinuxProject/selinux/releases/download/20200710/selinux-dbus-3.1.tar.gz
-Source5: https://github.com/SELinuxProject/selinux/releases/download/20200710/semodule-utils-3.1.tar.gz
-Source6: https://github.com/SELinuxProject/selinux/releases/download/20200710/restorecond-3.1.tar.gz
+Source0: https://github.com/SELinuxProject/selinux/releases/download/3.4/selinux-3.4.tar.gz
 URL:     https://github.com/SELinuxProject/selinux
 Source13: system-config-selinux.png
 Source14: sepolicy-icons.tgz
@@ -34,34 +32,23 @@ Source21: python-po.tgz
 Source22: gui-po.tgz
 Source23: sandbox-po.tgz
 # https://github.com/fedora-selinux/selinux
-# $ git format-patch -N 20200710 -- policycoreutils python gui sandbox dbus semodule-utils restorecond
+# $ git format-patch -N 3.4 -- policycoreutils python gui sandbox dbus semodule-utils restorecond
 # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done
 # Patch list start
-Patch0001: 0001-python-audit2allow-add-include-limits.h-to-sepolgen-.patch
-Patch0002: 0002-restorecond-Set-X-GNOME-HiddenUnderSystemd-true-in-r.patch
-Patch0003: 0003-fixfiles-correctly-restore-context-of-mountpoints.patch
-Patch0004: 0004-sepolgen-print-extended-permissions-in-hexadecimal.patch
-Patch0005: 0005-sepolgen-sort-extended-rules-like-normal-ones.patch
-Patch0006: 0006-newrole-support-cross-compilation-with-PAM-and-audit.patch
-Patch0007: 0007-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch
-Patch0008: 0008-Fix-STANDARD_FILE_CONTEXT-section-in-man-pages.patch
-Patch0009: 0009-If-there-is-no-executable-we-don-t-want-to-print-a-p.patch
-Patch0010: 0010-Simplication-of-sepolicy-manpage-web-functionality.-.patch
-Patch0011: 0011-We-want-to-remove-the-trailing-newline-for-etc-syste.patch
-Patch0012: 0012-Fix-title-in-manpage.py-to-not-contain-online.patch
-Patch0013: 0013-Don-t-be-verbose-if-you-are-not-on-a-tty.patch
-Patch0014: 0014-sepolicy-Drop-old-interface-file_type_is_executable-.patch
-Patch0015: 0015-sepolicy-Another-small-optimization-for-mcs-types.patch
-Patch0016: 0016-Move-po-translation-files-into-the-right-sub-directo.patch
-Patch0017: 0017-Use-correct-gettext-domains-in-python-gui-sandbox.patch
-Patch0018: 0018-Initial-.pot-files-for-gui-python-sandbox.patch
-Patch0019: 0019-policycoreutils-setfiles-Improve-description-of-d-sw.patch
-Patch0020: 0020-sepolicy-generate-Handle-more-reserved-port-types.patch
-Patch0021: 0021-semodule-utils-Fix-RESOURCE_LEAK-coverity-scan-defec.patch
-Patch0022: 0022-sandbox-Use-matchbox-window-manager-instead-of-openb.patch
-Patch0023: 0023-sepolicy-Fix-flake8-warnings-in-Fedora-only-code.patch
-Patch0024: 0024-selinux_config-5-add-a-note-that-runtime-disable-is-.patch
-Patch0025: 0025-python-sepolicy-allow-to-override-manpage-date.patch
+Patch0001: 0001-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch
+Patch0002: 0002-Fix-STANDARD_FILE_CONTEXT-section-in-man-pages.patch
+Patch0003: 0003-If-there-is-no-executable-we-don-t-want-to-print-a-p.patch
+Patch0004: 0004-Simplication-of-sepolicy-manpage-web-functionality.-.patch
+Patch0005: 0005-We-want-to-remove-the-trailing-newline-for-etc-syste.patch
+Patch0006: 0006-Fix-title-in-manpage.py-to-not-contain-online.patch
+Patch0007: 0007-Don-t-be-verbose-if-you-are-not-on-a-tty.patch
+Patch0008: 0008-sepolicy-generate-Handle-more-reserved-port-types.patch
+Patch0009: 0009-sandbox-Use-matchbox-window-manager-instead-of-openb.patch
+Patch0010: 0010-Use-SHA-2-instead-of-SHA-1.patch
+Patch0011: 0011-sepolicy-Drop-old-interface-file_type_is_executable-.patch
+Patch0012: 0012-gettext-handle-unsupported-languages-properly.patch
+Patch0013: 0013-semodule-rename-rebuild-if-modules-changed-to-refres.patch
+Patch0014: 0014-python-Split-semanage-import-into-two-transactions.patch
 # Patch list end
 
 Obsoletes: policycoreutils < 2.0.61-2
@@ -97,42 +84,26 @@ load_policy to load policies, setfiles to label filesystems, newrole
 to switch roles.
 
 %prep -p /usr/bin/bash
-# create selinux/ directory and extract sources
-%autosetup -S git -N -c -n selinux
-%autosetup -S git -N -T -D -a 1 -n selinux
-%autosetup -S git -N -T -D -a 2 -n selinux
-%autosetup -S git -N -T -D -a 3 -n selinux
-%autosetup -S git -N -T -D -a 4 -n selinux
-%autosetup -S git -N -T -D -a 5 -n selinux
-%autosetup -S git -N -T -D -a 6 -n selinux
-
-for i in *; do
-    git mv $i ${i/-%{version}/}
-    git commit -q --allow-empty -a --author 'rpm-build <rpm-build>' -m "$i -> ${i/-%{version}/}"
-done
-
-for i in selinux-*; do
-    git mv $i ${i#selinux-}
-    git commit -q --allow-empty -a --author 'rpm-build <rpm-build>' -m "$i -> ${i#selinux-}"
-done
-
-git am %{_sourcedir}/[0-9]*.patch
+%autosetup -n selinux-%{version} -p 1
 
 cp %{SOURCE13} gui/
 tar -xvf %{SOURCE14} -C python/sepolicy/
 
+# Temporary disabled since upstream updated translations in this release
 # Since patches containing translation changes were too big, translations were moved to separate tarballs
 # For more information see README.translations
-tar -x -f %{SOURCE20} -C policycoreutils -z
-tar -x -f %{SOURCE21} -C python -z
-tar -x -f %{SOURCE22} -C gui -z
+# First remove old translation files
+# rm -f policycoreutils/po/*.po python/po/*.po gui/po/*.po sandbox/po/*.po
+# tar -x -f %{SOURCE20} -C policycoreutils -z
+# tar -x -f %{SOURCE21} -C python -z
+# tar -x -f %{SOURCE22} -C gui -z
 tar -x -f %{SOURCE23} -C sandbox -z
 
 %build
 %set_build_flags
 export PYTHON=%{__python3}
 
-make -C policycoreutils LSPP_PRIV=y SBINDIR="%{_sbindir}" LIBDIR="%{_libdir}" SEMODULE_PATH="/usr/sbin" LIBSEPOLA="%{_libdir}/libsepol.a" all
+make -C policycoreutils SBINDIR="%{_sbindir}" LSPP_PRIV=y LIBDIR="%{_libdir}" SEMODULE_PATH="/usr/sbin" LIBSEPOLA="%{_libdir}/libsepol.a" all
 make -C python SBINDIR="%{_sbindir}" LSPP_PRIV=y LIBDIR="%{_libdir}" LIBSEPOLA="%{_libdir}/libsepol.a" all
 make -C gui SBINDIR="%{_sbindir}" LSPP_PRIV=y LIBDIR="%{_libdir}" LIBSEPOLA="%{_libdir}/libsepol.a" all
 make -C sandbox SBINDIR="%{_sbindir}" LSPP_PRIV=y LIBDIR="%{_libdir}" LIBSEPOLA="%{_libdir}/libsepol.a" all
@@ -244,8 +215,8 @@ an SELinux environment.
 %package dbus
 Summary:    SELinux policy core DBUS api
 Requires:   python3-policycoreutils = %{version}-%{release}
-Requires:   python3-slip-dbus
 Requires:   python3-gobject-base
+Requires:   polkit
 BuildArch:  noarch
 
 %description dbus
@@ -304,7 +275,7 @@ by python 3 in an SELinux environment.
 Summary: SELinux policy core policy devel utilities
 Requires: policycoreutils-python-utils = %{version}-%{release}
 Requires: /usr/bin/make dnf
-Requires: selinux-policy-devel
+Requires: (selinux-policy-devel if selinux-policy)
 
 %description devel
 The policycoreutils-devel package contains the management tools use to develop policy in an SELinux environment.
@@ -415,12 +386,14 @@ system-config-selinux is a utility for managing the SELinux environment
 %{_sbindir}/genhomedircon
 %{_sbindir}/setsebool
 %{_sbindir}/semodule
+# symlink to %%{_bindir}/sestatus
 %{_sbindir}/sestatus
 %{_bindir}/secon
 %{_bindir}/semodule_expand
 %{_bindir}/semodule_link
 %{_bindir}/semodule_package
 %{_bindir}/semodule_unpackage
+%{_bindir}/sestatus
 %{_libexecdir}/selinux/hll
 %{_libexecdir}/selinux/selinux-autorelabel
 %{_unitdir}/selinux-autorelabel-mark.service
@@ -483,42 +456,6 @@ The policycoreutils-restorecond package contains the restorecond service.
 %{_datadir}/dbus-1/services/org.selinux.Restorecond.service
 %{_mandir}/man8/restorecond.8*
 %{_mandir}/ru/man8/restorecond.8*
-/usr/share/man/ru/man1/audit2why.1.gz
-/usr/share/man/ru/man1/newrole.1.gz
-/usr/share/man/ru/man5/sandbox.5.gz
-/usr/share/man/ru/man5/selinux_config.5.gz
-/usr/share/man/ru/man5/sestatus.conf.5.gz
-/usr/share/man/ru/man8/genhomedircon.8.gz
-/usr/share/man/ru/man8/restorecon_xattr.8.gz
-/usr/share/man/ru/man8/sandbox.8.gz
-/usr/share/man/ru/man8/selinux-polgengui.8.gz
-/usr/share/man/ru/man8/semanage-boolean.8.gz
-/usr/share/man/ru/man8/semanage-dontaudit.8.gz
-/usr/share/man/ru/man8/semanage-export.8.gz
-/usr/share/man/ru/man8/semanage-fcontext.8.gz
-/usr/share/man/ru/man8/semanage-ibendport.8.gz
-/usr/share/man/ru/man8/semanage-ibpkey.8.gz
-/usr/share/man/ru/man8/semanage-import.8.gz
-/usr/share/man/ru/man8/semanage-interface.8.gz
-/usr/share/man/ru/man8/semanage-login.8.gz
-/usr/share/man/ru/man8/semanage-module.8.gz
-/usr/share/man/ru/man8/semanage-node.8.gz
-/usr/share/man/ru/man8/semanage-permissive.8.gz
-/usr/share/man/ru/man8/semanage-port.8.gz
-/usr/share/man/ru/man8/semanage-user.8.gz
-/usr/share/man/ru/man8/semodule_unpackage.8.gz
-/usr/share/man/ru/man8/sepolgen.8.gz
-/usr/share/man/ru/man8/sepolicy-booleans.8.gz
-/usr/share/man/ru/man8/sepolicy-communicate.8.gz
-/usr/share/man/ru/man8/sepolicy-generate.8.gz
-/usr/share/man/ru/man8/sepolicy-gui.8.gz
-/usr/share/man/ru/man8/sepolicy-interface.8.gz
-/usr/share/man/ru/man8/sepolicy-manpage.8.gz
-/usr/share/man/ru/man8/sepolicy-network.8.gz
-/usr/share/man/ru/man8/sepolicy-transition.8.gz
-/usr/share/man/ru/man8/sepolicy.8.gz
-/usr/share/man/ru/man8/seunshare.8.gz
-/usr/share/man/ru/man8/system-config-selinux.8.gz
 
 %{!?_licensedir:%global license %%doc}
 %license policycoreutils/COPYING
@@ -539,6 +476,96 @@ The policycoreutils-restorecond package contains the restorecond service.
 %systemd_postun_with_restart restorecond.service
 
 %changelog
+* Mon Aug  8 2022 David Abdurachmanov <davidlt@rivosinc.com> - 3.4-6.0.riscv64
+- Disable debug packages on riscv64
+
+* Tue Aug  2 2022 Petr Lautrbach <plautrba@redhat.com> - 3.4-6
+- Run autorelabel in parallel by default
+  https://fedoraproject.org/wiki/Changes/SELinux_Parallel_Autorelabel
+
+* Mon Jul 25 2022 Petr Lautrbach <plautrba@redhat.com> - 3.4-5
+- gettext: handle unsupported languages properly (#2100378)
+- semodule: rename --rebuild-if-modules-changed to --refresh
+- python: Split "semanage import" into two transactions (#2063353)
+- selinux-autorelabel: Do not force reboot (#2093133)
+
+* Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 3.4-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Mon Jun 13 2022 Python Maint <python-maint@redhat.com> - 3.4-3
+- Rebuilt for Python 3.11
+
+* Wed May 25 2022 Petr Lautrbach <plautrba@redhat.com> - 3.4-2
+- rebuilt
+
+* Thu May 19 2022 Petr Lautrbach <plautrba@redhat.com> - 3.4-1
+- SELinux userspace 3.4 release
+
+* Tue May 10 2022 Petr Lautrbach <plautrba@redhat.com> - 3.4-0.rc3.1
+- SELinux userspace 3.4-rc3 release
+
+* Thu Apr 21 2022 Petr Lautrbach <plautrba@redhat.com> - 3.4-0.rc.1
+- SELinux userspace 3.4-rc2 release
+
+* Wed Apr 13 2022 Petr Lautrbach <plautrba@redhat.com> - 3.4-0.rc.1
+- SELinux userspace 3.4-rc1 release
+
+* Tue Feb 22 2022 Petr Lautrbach <plautrba@redhat.com> - 3.3-5
+- Improve error message when selabel_open fails
+
+* Sat Feb 19 2022 Petr Lautrbach <plautrba@redhat.com> - 3.3-4
+- semodule: add command-line option to detect module changes
+- fixfiles: Use parallel relabeling
+
+* Fri Jan 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 3.3-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Mon Nov 29 2021 Petr Lautrbach <plautrba@redhat.com> - 3.3-2
+- setfiles/restorecon: support parallel relabeling with -T <N> option
+- semodule: add -m | --checksum option
+
+* Fri Oct 22 2021 Petr Lautrbach <plautrba@redhat.com> - 3.3-1
+- SELinux userspace 3.3 release
+
+* Mon Oct 11 2021 Petr Lautrbach <plautrba@redhat.com> - 3.3-0.rc3.1
+- SELinux userspace 3.3-rc3 release
+
+* Wed Sep 29 2021 Petr Lautrbach <plautrba@redhat.com> - 3.3-0.rc2.1
+- SELinux userspace 3.3-rc2 release
+
+* Tue Aug  3 2021 Petr Lautrbach <plautrba@redhat.com> - 3.2-6
+- Drop forgotten ru/ man pages from -restorecond
+
+* Wed Jul 28 2021 Petr Lautrbach <plautrba@redhat.com> - 3.2-5
+- Rebase on upstream commit 32611aea6543
+
+* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.2-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Thu Jun 03 2021 Python Maint <python-maint@redhat.com> - 3.2-3
+- Rebuilt for Python 3.10
+
+* Mon May 10 2021 Petr Lautrbach <plautrba@redhat.com> - 3.2-2
+- Do not use Python slip
+- fixfiles: do not exclude /dev and /run in -C mode
+- dbus: use GLib.MainLoop
+
+* Mon Mar  8 2021 Petr Lautrbach <plautrba@redhat.com> - 3.2-1
+- SELinux userspace 3.2 release
+
+* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.2-0.rc2.1.1
+- Rebuilt for updated systemd-rpm-macros
+  See https://pagure.io/fesco/issue/2583.
+
+* Fri Feb  5 2021 Petr Lautrbach <plautrba@redhat.com> - 3.2-0.rc2.1
+- SELinux userspace 3.2-rc2 release
+
+* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.2-0.rc1.1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Wed Jan 20 2021 Petr Lautrbach <plautrba@redhat.com> - 3.2-0.rc1.1
+- SELinux userspace 3.2-rc1 release
+
 * Tue Nov 24 2020 Petr Lautrbach <plautrba@redhat.com> - 3.1-8
 - Fix BuildRequires to libsemanage-devel
 

selinux-autorelabel

@@ -51,9 +51,15 @@ relabel_selinux() {
 	echo $"*** Relabeling could take a very long time, depending on file"
 	echo $"*** system size and speed of hard drives."
 
-	FORCE=`cat /.autorelabel`
-        [ -x "/usr/sbin/quotaoff" ] && /usr/sbin/quotaoff -aug
-	/sbin/fixfiles $FORCE restore
+	OPTS=`cat /.autorelabel`
+	# by default, use as many threads as there are available
+	# another -T X in $OPTS will override the default value
+	OPTS="-T 0 $OPTS"
+
+	[ -x "/usr/sbin/quotaoff" ] && /usr/sbin/quotaoff -aug
+	echo
+	echo $"Running: /sbin/fixfiles $OPTS restore"
+	/sbin/fixfiles $OPTS restore
     fi
 
     rm -f  /.autorelabel
@@ -63,7 +69,7 @@ relabel_selinux() {
         grub2-editenv - incr boot_indeterminate >/dev/null 2>&1
     fi
     sync
-    systemctl --force reboot
+    systemctl reboot
 }
 
 # Check to see if a full relabel is needed

sources

@@ -1,11 +1,5 @@
-SHA512 (policycoreutils-3.1.tar.gz) = 0592f218563a99ba95d2cfd07fdc3761b61c1cc3c01a17ab89ad840169e1a7d4083521d5cacc72d1b76911d516bf592db7a3f90d9ef0cc11ceed007e4580e140
-SHA512 (restorecond-3.1.tar.gz) = cdcf299f48b89a7c641ded9507b9b966bf648497394f8e988a9cb1ceb3224c86369706027f3416a4f9750836f7a8f4580a4b3df76673e03f897b383d7ed0e2c8
-SHA512 (selinux-dbus-3.1.tar.gz) = d5e1715539ec9aeef2285fc141617b7c25f39ddacc3968d2d19722553b97b873632545a2c7002faef44b671604b2cfca52e9624c57cedbae64d616a080cc955f
-SHA512 (selinux-gui-3.1.tar.gz) = c8bd618da3bd1dcc8aeb470e8410765ea7d38e861b0be78aaddaa5384ec3de12d364de1b63e2d9e3262e1179463f0ee78cb60f11ab72c996899bd72af137ae7c
-SHA512 (selinux-python-3.1.tar.gz) = 5dd98f77ae8ea8bac6a89ec7def76e12496b9a9f8c9612c4cc1dac7a8e8c60380a00c857426bfefbcb4273706addd2594e9b467f69408ef284f082a09d45bd49
-SHA512 (selinux-sandbox-3.1.tar.gz) = e9a772c720704de3fc33a70316780d5995442a1e25ba7df6dc68dd7b7a4eb59dfd2b68e4576051053fe81fbea207fcb1648baad3ea2d56d5b3005e9ca4b8ceb7
-SHA512 (semodule-utils-3.1.tar.gz) = b92794bbfbce5834ee7f62fddb40b5506e9291e8fa7c5d669b2e281089b8f8dc40c4522ea287ac5deffdaee751442ba8e691e2ac45fdd378b60d5d6b2527d157
 SHA512 (gui-po.tgz) = 8e0855256b825eea422b8e2b82cc0decf66b902c9930840905c5ad5dda7bef3679943a22db62709907d48f8a331d67edc5efed3e2638b53e379959b14077b4ea
 SHA512 (policycoreutils-po.tgz) = 66b908f7a167225bebded46f9cf92f42eb194daa2a083d48de43c2a5d33fa42724c5add0a9d029ac9d62c500f6f1c8d3bc138dd598b1fd97e609d7cc7160be72
 SHA512 (python-po.tgz) = 7f2a082b77c7b4417d5d3dac35d86dd635635a9c05a80e5f9284d03604e2f2a06ec879fb29b056d1a46d3fc448cd76e6fd25196834c18a161fd6677f2e11b2be
 SHA512 (sandbox-po.tgz) = 3d4b389b56bab1a6dddce9884dcebdefbefd1017fec6d987ac22a0705f409ed56722387aaca8fe7d9c468862136387bc703062e2b6de8fd102e13fed04ce811b
+SHA512 (selinux-3.4.tar.gz) = 9b619f6b2c632cc5cfebf5e9a9c1aa4130ef1efe9b85954d5a9da4f7a9bc15e82b9efcb4aa9c7ba2e16bac79cf116163a5d4d9cb7cbba3c96c88e01509bd60ab