7fc6c8
diff -durpN gcl-2.6.8.ORIG/clcs/makefile gcl-2.6.8/clcs/makefile
7fc6c8
--- gcl-2.6.8.ORIG/clcs/makefile	2010-08-04 15:44:22.000000000 -0600
7fc6c8
+++ gcl-2.6.8/clcs/makefile	2010-12-29 11:46:30.623141563 -0700
7fc6c8
@@ -9,6 +9,9 @@ all: $(addsuffix .c,$(FILES)) $(addsuffi
e6a250
 
7fc6c8
 saved_clcs_gcl: ../unixport/saved_pcl_gcl$(EXE)
e6a250
 	echo '(load "package.lisp")(load "myload.lisp")(si::save-system "$@")' | $< $(
e6a250
+	if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then \
e6a250
+		chcon -t gcl_exec_t $@; \
e6a250
+	fi
e6a250
 
e6a250
 %.h %.data %.c : %.lisp saved_clcs_gcl
e6a250
 	cp ../h/cmpinclude.h .
7fc6c8
@@ -31,6 +34,9 @@ compile: ${LISP}
e6a250
 
e6a250
 saved_full_gcl: ${LISP}
e6a250
 	echo '(load "package.lisp")(load "loading.lisp")(jamie-load-clcs :compiled)(system::save-system "saved_full_gcl")' | ${LISP}
e6a250
+	if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then \
e6a250
+		chcon -t gcl_exec_t $@; \
e6a250
+	fi
e6a250
 
e6a250
 clean:
7fc6c8
 	rm -f *.o *.fn saved_full_gcl$(EXE) saved_full_gcl cmpinclude.h *.c *.h *.data saved_clcs_gcl$(EXE)
7fc6c8
diff -durpN gcl-2.6.8.ORIG/makefile gcl-2.6.8/makefile
7fc6c8
--- gcl-2.6.8.ORIG/makefile	2010-11-04 11:53:32.000000000 -0600
7fc6c8
+++ gcl-2.6.8/makefile	2010-12-29 11:46:30.624141447 -0700
7fc6c8
@@ -187,6 +187,9 @@ install1:
e6a250
 	if gcc --version | grep -i mingw >/dev/null 2>&1 ; then if grep -i oncrpc makedefs >/dev/null 2>&1 ; then cp /mingw/bin/oncrpc.dll $(DESTDIR)$(INSTALL_LIB_DIR)/$(PORTDIR); fi ; fi
e6a250
 	cd $(DESTDIR)$(INSTALL_LIB_DIR)/$(PORTDIR) && \
e6a250
 		mv $(FLISP)$(EXE) temp$(EXE) && \
e6a250
+		if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then \
e6a250
+			chcon -t gcl_exec_t temp$(EXE); \
e6a250
+		fi && \
e6a250
 		echo '(reset-sys-paths "$(INSTALL_LIB_DIR)/")(si::save-system "$(FLISP)$(EXE)")' | ./temp$(EXE) && \
e6a250
 		rm -f temp$(EXE)
e6a250
 	if [ -e "unixport/rsym$(EXE)" ] ; then cp unixport/rsym$(EXE) $(DESTDIR)$(INSTALL_LIB_DIR)/unixport/ ; fi
7fc6c8
diff -durpN gcl-2.6.8.ORIG/selinux/gcl.fc gcl-2.6.8/selinux/gcl.fc
e6a250
--- gcl-2.6.8.ORIG/selinux/gcl.fc	1969-12-31 17:00:00.000000000 -0700
7fc6c8
+++ gcl-2.6.8/selinux/gcl.fc	2010-12-29 11:46:30.625141327 -0700
767892
@@ -0,0 +1,5 @@
e6a250
+/usr/lib64/gcl-[^/]+/unixport/saved_.*	--	gen_context(system_u:object_r:gcl_exec_t,s0)
e6a250
+/usr/lib/gcl-[^/]+/unixport/saved_.*	--	gen_context(system_u:object_r:gcl_exec_t,s0)
277e3b
+/usr/lib/maxima/[^/]+/binary-gcl/maxima --	gen_context(system_u:object_r:gcl_exec_t,s0)
277e3b
+/usr/lib64/maxima/[^/]+/binary-gcl/maxima --	gen_context(system_u:object_r:gcl_exec_t,s0)
767892
+
7fc6c8
diff -durpN gcl-2.6.8.ORIG/selinux/gcl.if gcl-2.6.8/selinux/gcl.if
e6a250
--- gcl-2.6.8.ORIG/selinux/gcl.if	1969-12-31 17:00:00.000000000 -0700
7fc6c8
+++ gcl-2.6.8/selinux/gcl.if	2010-12-29 11:46:30.626141206 -0700
e6a250
@@ -0,0 +1,146 @@
e6a250
+
e6a250
+## <summary>policy for gcl</summary>
e6a250
+
e6a250
+########################################
e6a250
+## <summary>
e6a250
+##	Execute a domain transition to run gcl.
e6a250
+## </summary>
e6a250
+## <param name="domain">
e6a250
+## <summary>
e6a250
+##	Domain allowed to transition.
e6a250
+## </summary>
e6a250
+## </param>
e6a250
+#
e6a250
+interface(`gcl_domtrans',`
e6a250
+	gen_require(`
e6a250
+		type gcl_t;
e6a250
+                type gcl_exec_t;
e6a250
+	')
e6a250
+
e6a250
+	domtrans_pattern($1,gcl_exec_t,gcl_t)
e6a250
+')
e6a250
+
e6a250
+
e6a250
+########################################
e6a250
+## <summary>
e6a250
+##	Do not audit attempts to read, 
e6a250
+##	gcl tmp files
e6a250
+## </summary>
e6a250
+## <param name="domain">
e6a250
+##	<summary>
e6a250
+##	Domain to not audit.
e6a250
+##	</summary>
e6a250
+## </param>
e6a250
+#
e6a250
+interface(`gcl_dontaudit_read_tmp_files',`
e6a250
+	gen_require(`
e6a250
+		type gcl_tmp_t;
e6a250
+	')
e6a250
+
e6a250
+	dontaudit $1 gcl_tmp_t:file read_file_perms;
e6a250
+')
e6a250
+
e6a250
+########################################
e6a250
+## <summary>
e6a250
+##	Allow domain to read, gcl tmp files
e6a250
+## </summary>
e6a250
+## <param name="domain">
e6a250
+##	<summary>
e6a250
+##	Domain to not audit.
e6a250
+##	</summary>
e6a250
+## </param>
e6a250
+#
e6a250
+interface(`gcl_read_tmp_files',`
e6a250
+	gen_require(`
e6a250
+		type gcl_tmp_t;
e6a250
+	')
e6a250
+
e6a250
+	allow $1 gcl_tmp_t:file read_file_perms;
e6a250
+')
e6a250
+
e6a250
+########################################
e6a250
+## <summary>
e6a250
+##	Allow domain to manage gcl tmp files
e6a250
+## </summary>
e6a250
+## <param name="domain">
e6a250
+##	<summary>
e6a250
+##	Domain to not audit.
e6a250
+##	</summary>
e6a250
+## </param>
e6a250
+#
e6a250
+interface(`gcl_manage_tmp',`
e6a250
+	gen_require(`
e6a250
+		type gcl_tmp_t;
e6a250
+	')
e6a250
+
e6a250
+         manage_dirs_pattern($1,gcl_tmp_t,gcl_tmp_t)
e6a250
+         manage_files_pattern($1,gcl_tmp_t,gcl_tmp_t)
e6a250
+         manage_lnk_files_pattern($1,gcl_tmp_t,gcl_tmp_t)
e6a250
+')
e6a250
+
e6a250
+########################################
e6a250
+## <summary>
e6a250
+##	Execute gcl in the gcl domain, and
e6a250
+##	allow the specified role the gcl domain.
e6a250
+## </summary>
e6a250
+## <param name="domain">
e6a250
+##	<summary>
e6a250
+##	Domain allowed access
e6a250
+##	</summary>
e6a250
+## </param>
e6a250
+## <param name="role">
e6a250
+##	<summary>
e6a250
+##	The role to be allowed the gcl domain.
e6a250
+##	</summary>
e6a250
+## </param>
e6a250
+## <param name="terminal">
e6a250
+##	<summary>
e6a250
+##	The type of the role's terminal.
e6a250
+##	</summary>
e6a250
+## </param>
e6a250
+#
e6a250
+interface(`gcl_run',`
e6a250
+	gen_require(`
e6a250
+		type gcl_t;
e6a250
+	')
e6a250
+
e6a250
+	gcl_domtrans($1)
e6a250
+	role $2 types gcl_t;
e6a250
+	dontaudit gcl_t $3:chr_file rw_term_perms;
e6a250
+')
e6a250
+
e6a250
+
e6a250
+########################################
e6a250
+## <summary>
e6a250
+##	All of the rules required to administrate 
e6a250
+##	an gcl environment
e6a250
+## </summary>
e6a250
+## <param name="domain">
e6a250
+##	<summary>
e6a250
+##	Domain allowed access.
e6a250
+##	</summary>
e6a250
+## </param>
e6a250
+## <param name="role">
e6a250
+##	<summary>
e6a250
+##	The role to be allowed to manage the gcl domain.
e6a250
+##	</summary>
e6a250
+## </param>
e6a250
+## <param name="terminal">
e6a250
+##	<summary>
e6a250
+##	The type of the user terminal.
e6a250
+##	</summary>
e6a250
+## </param>
e6a250
+## <rolecap/>
e6a250
+#
e6a250
+interface(`gcl_admin',`
e6a250
+	gen_require(`
e6a250
+		type gcl_t;
e6a250
+	')
e6a250
+
e6a250
+	allow $1 gcl_t:process { ptrace signal_perms getattr };
e6a250
+	read_files_pattern($1, gcl_t, gcl_t)
e6a250
+	        
e6a250
+
e6a250
+	gcl_manage_tmp($1)
e6a250
+
e6a250
+')
7fc6c8
diff -durpN gcl-2.6.8.ORIG/selinux/gcl.te gcl-2.6.8/selinux/gcl.te
e6a250
--- gcl-2.6.8.ORIG/selinux/gcl.te	1969-12-31 17:00:00.000000000 -0700
7fc6c8
+++ gcl-2.6.8/selinux/gcl.te	2010-12-29 11:46:30.627141086 -0700
4e91f1
@@ -0,0 +1,45 @@
4e91f1
+policy_module(gcl,1.0.1)
e6a250
+
e6a250
+########################################
e6a250
+#
e6a250
+# Declarations
e6a250
+#
e6a250
+
e6a250
+type gcl_t;
e6a250
+type gcl_exec_t;
e6a250
+application_domain(gcl_t, gcl_exec_t)
e6a250
+role system_r types gcl_t;
e6a250
+
e6a250
+########################################
e6a250
+#
e6a250
+# gcl local policy
e6a250
+#
e6a250
+
e6a250
+## internal communication is often done using fifo and unix sockets.
e6a250
+allow gcl_t self:fifo_file rw_file_perms;
e6a250
+allow gcl_t self:unix_stream_socket create_stream_socket_perms;
e6a250
+
e6a250
+libs_use_ld_so(gcl_t)
e6a250
+libs_use_shared_libs(gcl_t)
e6a250
+
e6a250
+miscfiles_read_localization(gcl_t)
e6a250
+
e6a250
+## The GCL memory management and executable dumping routines manipulate memory
e6a250
+## in various (usually forbidden) ways.
e6a250
+allow gcl_t self:process { execmem execheap };
e6a250
+
4e91f1
+optional_policy(`
4e91f1
+	unconfined_domain(gcl_t)
4e91f1
+')
e6a250
+
e6a250
+optional_policy(`
e6a250
+	gen_require(`
e6a250
+		type unconfined_t;
e6a250
+		type unconfined_devpts_t;
e6a250
+		type unconfined_tty_device_t;
e6a250
+		role unconfined_r;
e6a250
+	')
e6a250
+
e6a250
+	gcl_run(unconfined_t, unconfined_r, { unconfined_tty_device_t unconfined_devpts_t })
e6a250
+	allow gcl_t gcl_exec_t:file execmod;
e6a250
+')
7fc6c8
diff -durpN gcl-2.6.8.ORIG/unixport/makefile gcl-2.6.8/unixport/makefile
7fc6c8
--- gcl-2.6.8.ORIG/unixport/makefile	2010-11-05 07:26:31.000000000 -0600
7fc6c8
+++ gcl-2.6.8/unixport/makefile	2010-12-29 11:46:30.628140965 -0700
7fc6c8
@@ -122,6 +122,9 @@ saved_%:raw_% $(RSYM) init_%.lsp raw_%_m
e6a250
 	echo " (in-package \"USER\")(system:save-system \"$@\")" >>foo
7fc6c8
 	ar x lib$*.a $$(ar t lib$*.a |grep ^gcl_)
e6a250
 	$(PORTDIR)/raw_$*$(EXE) $(PORTDIR)/ -libdir $(GCLDIR)/ < foo
e6a250
+	if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then \
e6a250
+		chcon -t gcl_exec_t $@; \
e6a250
+	fi
e6a250
 
e6a250
 $(RSYM): $(SPECIAL_RSYM) $(HDIR)/mdefs.h
7fc6c8
 	$(CC) $(LD_FLAGS) $(CFLAGS) -I$(HDIR) -I$(ODIR) -o $(RSYM) $(SPECIAL_RSYM)
7fc6c8
@@ -162,6 +165,9 @@ ifeq ($(GNU_LD),1)
7fc6c8
 else
7fc6c8
 	$(CC) $(LD_FLAGS) -o raw_$*$(EXE) $(filter %.o,$^) -L. $(EXTRA_LD_LIBS) $(LD_LIBS_PRE) -l$* $(LD_LIBS_POST)
e6a250
 endif
e6a250
+	if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then \
e6a250
+		chcon -t gcl_exec_t raw_$*$(EXE); \
e6a250
+	fi
e6a250
 #	diff map_$* map_$*.old >/dev/null || (cp map_$* map_$*.old && rm -f $@ && $(MAKE) $@)
e6a250
 #	cp map_$*.old map_$*
e6a250