From aa0f5b6e3359f52db66f178450fbec35db487bc7 Mon Sep 17 00:00:00 2001
From: Miroslav Grepl <mgrepl@redhat.com>
Date: Aug 21 2014 06:59:15 +0000
Subject: - Compiled file context files and the original should have the same permissions from dwalsh@redhat.com

- Add selinux_openssh_contexts_path() to get a path to /contexts/openssh_contexts

---

diff --git a/libselinux-rhat.patch b/libselinux-rhat.patch
index 3c2e965..4528fbf 100644
--- a/libselinux-rhat.patch
+++ b/libselinux-rhat.patch
@@ -1,18 +1,18 @@
-diff --git a/libselinux/Makefile b/libselinux/Makefile
+diff --git a/Makefile b/Makefile
 index 6142b60..bdf9de8 100644
---- a/libselinux/Makefile
-+++ b/libselinux/Makefile
+--- a/Makefile
++++ b/Makefile
 @@ -1,4 +1,4 @@
 -SUBDIRS = src include utils man
 +SUBDIRS = src include utils man golang
  
  DISABLE_AVC ?= n
  DISABLE_SETRANS ?= n
-diff --git a/libselinux/golang/Makefile b/libselinux/golang/Makefile
+diff --git a/golang/Makefile b/golang/Makefile
 new file mode 100644
 index 0000000..b75677b
 --- /dev/null
-+++ b/libselinux/golang/Makefile
++++ b/golang/Makefile
 @@ -0,0 +1,22 @@
 +# Installation directories.
 +PREFIX ?= $(DESTDIR)/usr
@@ -36,11 +36,11 @@ index 0000000..b75677b
 +indent:
 +
 +relabel:
-diff --git a/libselinux/golang/selinux.go b/libselinux/golang/selinux.go
+diff --git a/golang/selinux.go b/golang/selinux.go
 new file mode 100644
 index 0000000..34bf6bb
 --- /dev/null
-+++ b/libselinux/golang/selinux.go
++++ b/golang/selinux.go
 @@ -0,0 +1,412 @@
 +package selinux
 +
@@ -454,11 +454,11 @@ index 0000000..34bf6bb
 +	fmt.Println(Getfscreatecon())
 +	fmt.Println(Getpidcon(1))
 +}
-diff --git a/libselinux/golang/test.go b/libselinux/golang/test.go
+diff --git a/golang/test.go b/golang/test.go
 new file mode 100644
 index 0000000..fed6de8
 --- /dev/null
-+++ b/libselinux/golang/test.go
++++ b/golang/test.go
 @@ -0,0 +1,9 @@
 +package main
 +
@@ -469,10 +469,22 @@ index 0000000..fed6de8
 +func main() {
 +	selinux.Test()
 +}
-diff --git a/libselinux/man/man3/getfscreatecon.3 b/libselinux/man/man3/getfscreatecon.3
+diff --git a/include/selinux/selinux.h b/include/selinux/selinux.h
+index d0eb5c6..4beb170 100644
+--- a/include/selinux/selinux.h
++++ b/include/selinux/selinux.h
+@@ -543,6 +543,7 @@ extern const char *selinux_virtual_image_context_path(void);
+ extern const char *selinux_lxc_contexts_path(void);
+ extern const char *selinux_x_context_path(void);
+ extern const char *selinux_sepgsql_context_path(void);
++extern const char *selinux_openssh_contexts_path(void);
+ extern const char *selinux_systemd_contexts_path(void);
+ extern const char *selinux_contexts_path(void);
+ extern const char *selinux_securetty_types_path(void);
+diff --git a/man/man3/getfscreatecon.3 b/man/man3/getfscreatecon.3
 index e348d3b..8cc4df5 100644
---- a/libselinux/man/man3/getfscreatecon.3
-+++ b/libselinux/man/man3/getfscreatecon.3
+--- a/man/man3/getfscreatecon.3
++++ b/man/man3/getfscreatecon.3
 @@ -49,6 +49,11 @@ Signal handlers that perform a
  must take care to
  save, reset, and restore the fscreate context to avoid unexpected behavior.
@@ -485,10 +497,10 @@ index e348d3b..8cc4df5 100644
  .SH "RETURN VALUE"
  On error \-1 is returned.
  On success 0 is returned.
-diff --git a/libselinux/man/man3/getkeycreatecon.3 b/libselinux/man/man3/getkeycreatecon.3
+diff --git a/man/man3/getkeycreatecon.3 b/man/man3/getkeycreatecon.3
 index 4d70f10..b51008d 100644
---- a/libselinux/man/man3/getkeycreatecon.3
-+++ b/libselinux/man/man3/getkeycreatecon.3
+--- a/man/man3/getkeycreatecon.3
++++ b/man/man3/getkeycreatecon.3
 @@ -48,6 +48,10 @@ Signal handlers that perform a
  .BR setkeycreatecon ()
  must take care to
@@ -500,10 +512,10 @@ index 4d70f10..b51008d 100644
  .
  .SH "RETURN VALUE"
  On error \-1 is returned.
-diff --git a/libselinux/man/man3/getsockcreatecon.3 b/libselinux/man/man3/getsockcreatecon.3
+diff --git a/man/man3/getsockcreatecon.3 b/man/man3/getsockcreatecon.3
 index 4dd8f30..26086d9 100644
---- a/libselinux/man/man3/getsockcreatecon.3
-+++ b/libselinux/man/man3/getsockcreatecon.3
+--- a/man/man3/getsockcreatecon.3
++++ b/man/man3/getsockcreatecon.3
 @@ -49,6 +49,11 @@ Signal handlers that perform a
  must take care to
  save, reset, and restore the sockcreate context to avoid unexpected behavior.
@@ -516,10 +528,10 @@ index 4dd8f30..26086d9 100644
  .SH "RETURN VALUE"
  On error \-1 is returned.
  On success 0 is returned.
-diff --git a/libselinux/man/man8/selinux.8 b/libselinux/man/man8/selinux.8
-index e89b1ef..9e3bdc4 100644
---- a/libselinux/man/man8/selinux.8
-+++ b/libselinux/man/man8/selinux.8
+diff --git a/man/man8/selinux.8 b/man/man8/selinux.8
+index e89b1ef..fd20363 100644
+--- a/man/man8/selinux.8
++++ b/man/man8/selinux.8
 @@ -74,7 +74,7 @@ The best way to relabel the file system is to create the flag file
  and reboot.
  .BR system\-config\-selinux ,
@@ -529,10 +541,26 @@ index e89b1ef..9e3bdc4 100644
  commands are also available for relabeling files.
  .
  .SH AUTHOR	
-diff --git a/libselinux/src/Makefile b/libselinux/src/Makefile
+@@ -91,11 +91,13 @@ This manual page was written by Dan Walsh <dwalsh@redhat.com>.
+ .BR sepolicy (8),
+ .BR system-config-selinux (8),
+ .BR togglesebool (8),
+-.BR restorecon (8),
+ .BR fixfiles (8),
++.BR restorecon (8),
+ .BR setfiles (8),
+ .BR semanage (8),
+-.BR sepolicy(8)
++.BR sepolicy(8),
++.BR seinfo(8),
++.BR sesearch(8)
+ 
+ Every confined service on the system has a man page in the following format:
+ .br
+diff --git a/src/Makefile b/src/Makefile
 index 4d07ba6..62c8dad 100644
---- a/libselinux/src/Makefile
-+++ b/libselinux/src/Makefile
+--- a/src/Makefile
++++ b/src/Makefile
 @@ -111,7 +111,7 @@ $(LIBA): $(OBJS)
  	$(RANLIB) $@
  
@@ -542,10 +570,10 @@ index 4d07ba6..62c8dad 100644
  	ln -sf $@ $(TARGET) 
  
  $(LIBPC): $(LIBPC).in ../VERSION
-diff --git a/libselinux/src/avc_sidtab.c b/libselinux/src/avc_sidtab.c
+diff --git a/src/avc_sidtab.c b/src/avc_sidtab.c
 index 52f21df..66ad9e1 100644
---- a/libselinux/src/avc_sidtab.c
-+++ b/libselinux/src/avc_sidtab.c
+--- a/src/avc_sidtab.c
++++ b/src/avc_sidtab.c
 @@ -81,6 +81,11 @@ sidtab_context_to_sid(struct sidtab *s,
  	int hvalue, rc = 0;
  	struct sidtab_node *cur;
@@ -558,10 +586,10 @@ index 52f21df..66ad9e1 100644
  	*sid = NULL;
  	hvalue = sidtab_hash(ctx);
  
-diff --git a/libselinux/src/canonicalize_context.c b/libselinux/src/canonicalize_context.c
+diff --git a/src/canonicalize_context.c b/src/canonicalize_context.c
 index 7cf3139..364a746 100644
---- a/libselinux/src/canonicalize_context.c
-+++ b/libselinux/src/canonicalize_context.c
+--- a/src/canonicalize_context.c
++++ b/src/canonicalize_context.c
 @@ -17,6 +17,11 @@ int security_canonicalize_context_raw(const char * con,
  	size_t size;
  	int fd, ret;
@@ -574,10 +602,10 @@ index 7cf3139..364a746 100644
  	if (!selinux_mnt) {
  		errno = ENOENT;
  		return -1;
-diff --git a/libselinux/src/check_context.c b/libselinux/src/check_context.c
+diff --git a/src/check_context.c b/src/check_context.c
 index 52063fa..234749c 100644
---- a/libselinux/src/check_context.c
-+++ b/libselinux/src/check_context.c
+--- a/src/check_context.c
++++ b/src/check_context.c
 @@ -14,6 +14,11 @@ int security_check_context_raw(const char * con)
  	char path[PATH_MAX];
  	int fd, ret;
@@ -590,10 +618,10 @@ index 52063fa..234749c 100644
  	if (!selinux_mnt) {
  		errno = ENOENT;
  		return -1;
-diff --git a/libselinux/src/compute_av.c b/libselinux/src/compute_av.c
+diff --git a/src/compute_av.c b/src/compute_av.c
 index 937e5c3..35ace7f 100644
---- a/libselinux/src/compute_av.c
-+++ b/libselinux/src/compute_av.c
+--- a/src/compute_av.c
++++ b/src/compute_av.c
 @@ -26,6 +26,11 @@ int security_compute_av_flags_raw(const char * scon,
  		return -1;
  	}
@@ -606,10 +634,10 @@ index 937e5c3..35ace7f 100644
  	snprintf(path, sizeof path, "%s/access", selinux_mnt);
  	fd = open(path, O_RDWR);
  	if (fd < 0)
-diff --git a/libselinux/src/compute_create.c b/libselinux/src/compute_create.c
+diff --git a/src/compute_create.c b/src/compute_create.c
 index 9559d42..14a65d1 100644
---- a/libselinux/src/compute_create.c
-+++ b/libselinux/src/compute_create.c
+--- a/src/compute_create.c
++++ b/src/compute_create.c
 @@ -64,6 +64,11 @@ int security_compute_create_name_raw(const char * scon,
  		return -1;
  	}
@@ -622,10 +650,10 @@ index 9559d42..14a65d1 100644
  	snprintf(path, sizeof path, "%s/create", selinux_mnt);
  	fd = open(path, O_RDWR);
  	if (fd < 0)
-diff --git a/libselinux/src/compute_member.c b/libselinux/src/compute_member.c
+diff --git a/src/compute_member.c b/src/compute_member.c
 index 1fc7e41..065d996 100644
---- a/libselinux/src/compute_member.c
-+++ b/libselinux/src/compute_member.c
+--- a/src/compute_member.c
++++ b/src/compute_member.c
 @@ -25,6 +25,11 @@ int security_compute_member_raw(const char * scon,
  		return -1;
  	}
@@ -638,10 +666,10 @@ index 1fc7e41..065d996 100644
  	snprintf(path, sizeof path, "%s/member", selinux_mnt);
  	fd = open(path, O_RDWR);
  	if (fd < 0)
-diff --git a/libselinux/src/compute_relabel.c b/libselinux/src/compute_relabel.c
+diff --git a/src/compute_relabel.c b/src/compute_relabel.c
 index 4615aee..cc77f36 100644
---- a/libselinux/src/compute_relabel.c
-+++ b/libselinux/src/compute_relabel.c
+--- a/src/compute_relabel.c
++++ b/src/compute_relabel.c
 @@ -25,6 +25,11 @@ int security_compute_relabel_raw(const char * scon,
  		return -1;
  	}
@@ -654,10 +682,10 @@ index 4615aee..cc77f36 100644
  	snprintf(path, sizeof path, "%s/relabel", selinux_mnt);
  	fd = open(path, O_RDWR);
  	if (fd < 0)
-diff --git a/libselinux/src/compute_user.c b/libselinux/src/compute_user.c
+diff --git a/src/compute_user.c b/src/compute_user.c
 index b37c5d3..7703c26 100644
---- a/libselinux/src/compute_user.c
-+++ b/libselinux/src/compute_user.c
+--- a/src/compute_user.c
++++ b/src/compute_user.c
 @@ -24,6 +24,11 @@ int security_compute_user_raw(const char * scon,
  		return -1;
  	}
@@ -670,10 +698,22 @@ index b37c5d3..7703c26 100644
  	snprintf(path, sizeof path, "%s/user", selinux_mnt);
  	fd = open(path, O_RDWR);
  	if (fd < 0)
-diff --git a/libselinux/src/fsetfilecon.c b/libselinux/src/fsetfilecon.c
+diff --git a/src/file_path_suffixes.h b/src/file_path_suffixes.h
+index 3c92424..d1f9b48 100644
+--- a/src/file_path_suffixes.h
++++ b/src/file_path_suffixes.h
+@@ -23,6 +23,7 @@ S_(BINPOLICY, "/policy/policy")
+     S_(VIRTUAL_DOMAIN, "/contexts/virtual_domain_context")
+     S_(VIRTUAL_IMAGE, "/contexts/virtual_image_context")
+     S_(LXC_CONTEXTS, "/contexts/lxc_contexts")
++    S_(OPENSSH_CONTEXTS, "/contexts/openssh_contexts")
+     S_(SYSTEMD_CONTEXTS, "/contexts/systemd_contexts")
+     S_(FILE_CONTEXT_SUBS, "/contexts/files/file_contexts.subs")
+     S_(FILE_CONTEXT_SUBS_DIST, "/contexts/files/file_contexts.subs_dist")
+diff --git a/src/fsetfilecon.c b/src/fsetfilecon.c
 index 52707d0..0cbe12d 100644
---- a/libselinux/src/fsetfilecon.c
-+++ b/libselinux/src/fsetfilecon.c
+--- a/src/fsetfilecon.c
++++ b/src/fsetfilecon.c
 @@ -9,8 +9,12 @@
  
  int fsetfilecon_raw(int fd, const char * context)
@@ -689,10 +729,10 @@ index 52707d0..0cbe12d 100644
  	if (rc < 0 && errno == ENOTSUP) {
  		char * ccontext = NULL;
  		int err = errno;
-diff --git a/libselinux/src/load_policy.c b/libselinux/src/load_policy.c
+diff --git a/src/load_policy.c b/src/load_policy.c
 index e419f1a..275672d 100644
---- a/libselinux/src/load_policy.c
-+++ b/libselinux/src/load_policy.c
+--- a/src/load_policy.c
++++ b/src/load_policy.c
 @@ -16,6 +16,82 @@
  #include <dlfcn.h>
  #include "policy.h"
@@ -868,10 +908,10 @@ index e419f1a..275672d 100644
        close:
  	close(fd);
        dlclose:
-diff --git a/libselinux/src/lsetfilecon.c b/libselinux/src/lsetfilecon.c
+diff --git a/src/lsetfilecon.c b/src/lsetfilecon.c
 index 1d3b28a..ea6d70b 100644
---- a/libselinux/src/lsetfilecon.c
-+++ b/libselinux/src/lsetfilecon.c
+--- a/src/lsetfilecon.c
++++ b/src/lsetfilecon.c
 @@ -9,8 +9,13 @@
  
  int lsetfilecon_raw(const char *path, const char * context)
@@ -888,10 +928,10 @@ index 1d3b28a..ea6d70b 100644
  	if (rc < 0 && errno == ENOTSUP) {
  		char * ccontext = NULL;
  		int err = errno;
-diff --git a/libselinux/src/matchpathcon.c b/libselinux/src/matchpathcon.c
+diff --git a/src/matchpathcon.c b/src/matchpathcon.c
 index 3b96b1d..d5c90f6 100644
---- a/libselinux/src/matchpathcon.c
-+++ b/libselinux/src/matchpathcon.c
+--- a/src/matchpathcon.c
++++ b/src/matchpathcon.c
 @@ -2,6 +2,7 @@
  #include <string.h>
  #include <errno.h>
@@ -909,10 +949,52 @@ index 3b96b1d..d5c90f6 100644
  	va_end(ap);
  }
  
-diff --git a/libselinux/src/setfilecon.c b/libselinux/src/setfilecon.c
+diff --git a/src/selinux_config.c b/src/selinux_config.c
+index 30e9dc7..1bfe500 100644
+--- a/src/selinux_config.c
++++ b/src/selinux_config.c
+@@ -50,8 +50,9 @@
+ #define FILE_CONTEXT_SUBS_DIST 25
+ #define LXC_CONTEXTS      26
+ #define BOOLEAN_SUBS      27
+-#define SYSTEMD_CONTEXTS  28
+-#define NEL               29
++#define OPENSSH_CONTEXTS  28
++#define SYSTEMD_CONTEXTS  29
++#define NEL               30
+ 
+ /* Part of one-time lazy init */
+ static pthread_once_t once = PTHREAD_ONCE_INIT;
+@@ -493,6 +494,13 @@ const char *selinux_lxc_contexts_path(void)
+ 
+ hidden_def(selinux_lxc_contexts_path)
+ 
++const char *selinux_openssh_contexts_path(void)
++{
++    return get_path(OPENSSH_CONTEXTS);
++}
++
++hidden_def(selinux_openssh_contexts_path)
++
+ const char *selinux_systemd_contexts_path(void)
+ {
+ 	return get_path(SYSTEMD_CONTEXTS);
+diff --git a/src/selinux_internal.h b/src/selinux_internal.h
+index afb2170..fe8eb67 100644
+--- a/src/selinux_internal.h
++++ b/src/selinux_internal.h
+@@ -82,6 +82,7 @@ hidden_proto(selinux_mkload_policy)
+     hidden_proto(selinux_customizable_types_path)
+     hidden_proto(selinux_media_context_path)
+     hidden_proto(selinux_x_context_path)
++    hidden_proto(selinux_openssh_contexts_path)
+     hidden_proto(selinux_sepgsql_context_path)
+     hidden_proto(selinux_systemd_contexts_path)
+     hidden_proto(selinux_path)
+diff --git a/src/setfilecon.c b/src/setfilecon.c
 index d05969c..3f0200e 100644
---- a/libselinux/src/setfilecon.c
-+++ b/libselinux/src/setfilecon.c
+--- a/src/setfilecon.c
++++ b/src/setfilecon.c
 @@ -9,8 +9,12 @@
  
  int setfilecon_raw(const char *path, const char * context)
@@ -928,3 +1010,50 @@ index d05969c..3f0200e 100644
  	if (rc < 0 && errno == ENOTSUP) {
  		char * ccontext = NULL;
  		int err = errno;
+diff --git a/utils/sefcontext_compile.c b/utils/sefcontext_compile.c
+index 0adc968..9618989 100644
+--- a/utils/sefcontext_compile.c
++++ b/utils/sefcontext_compile.c
+@@ -4,6 +4,9 @@
+ #include <stdint.h>
+ #include <stdio.h>
+ #include <string.h>
++#include <unistd.h>
++#include <sys/types.h>
++#include <sys/stat.h>
+ 
+ #include <linux/limits.h>
+ 
+@@ -323,6 +326,7 @@ int main(int argc, char *argv[])
+ 	int rc;
+ 	char *tmp= NULL;
+ 	int fd;
++	struct stat buf;
+ 
+ 	if (argc != 2) {
+ 		fprintf(stderr, "usage: %s input_file\n", argv[0]);
+@@ -333,6 +337,11 @@ int main(int argc, char *argv[])
+ 
+ 	path = argv[1];
+ 
++	if (stat(path, &buf) < 0) {
++		fprintf(stderr, "Can not stat: %s: %m\n", argv[0]);
++		exit(EXIT_FAILURE);
++	}
++
+ 	rc = process_file(&data, path);
+ 	if (rc < 0)
+ 		return rc;
+@@ -352,6 +361,12 @@ int main(int argc, char *argv[])
+ 	if (fd < 0)
+ 		goto err;
+ 
++	rc = fchmod(fd, buf.st_mode);
++	if (rc < 0) {
++		perror("fchmod failed to set permission on compiled regexs");
++		goto err;
++	}
++
+ 	rc = write_binary_file(&data, fd);
+ 
+ 	if (rc < 0)
diff --git a/libselinux.spec b/libselinux.spec
index 3e31f1b..8bb6841 100644
--- a/libselinux.spec
+++ b/libselinux.spec
@@ -10,7 +10,7 @@
 Summary: SELinux library and simple utilities
 Name: libselinux
 Version: 2.3
-Release: 4%{?dist}
+Release: 5%{?dist}
 License: Public Domain
 Group: System Environment/Libraries
 Source: %{name}-%{version}.tgz
@@ -243,6 +243,10 @@ rm -rf %{buildroot}
 %{ruby_sitearch}/selinux.so
 
 %changelog
+* Thu Aug 21 2014 Miroslav Grepl <mgrepl@redhat.com> - 2.3-5
+- Compiled file context files and the original should have the same permissions from dwalsh@redhat.com
+- Add selinux_openssh_contexts_path() to get a path to /contexts/openssh_contexts
+
 * Sun Aug 17 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.3-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild