import policycoreutils-2.9-25.el8

9 months ago · 06725a4ca7
commit 06725a4ca7
61 changed files with 15262 additions and 0 deletions
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1,13 @@
+SOURCES/gui-po.tgz
+SOURCES/policycoreutils-2.9.tar.gz
+SOURCES/policycoreutils-po.tgz
+SOURCES/python-po.tgz
+SOURCES/restorecond-2.9.tar.gz
+SOURCES/sandbox-po.tgz
+SOURCES/selinux-dbus-2.9.tar.gz
+SOURCES/selinux-gui-2.9.tar.gz
+SOURCES/selinux-python-2.9.tar.gz
+SOURCES/selinux-sandbox-2.9.tar.gz
+SOURCES/semodule-utils-2.9.tar.gz
+SOURCES/sepolicy-icons.tgz
+SOURCES/system-config-selinux.png
--- a/.policycoreutils.metadata
+++ b/.policycoreutils.metadata
@ -0,0 +1,13 @@
+3f355f8cbfdf7be6f9a8190153090af95d2c7358 SOURCES/gui-po.tgz
+6e64d9a38fb516738023eb429eef29af5383f443 SOURCES/policycoreutils-2.9.tar.gz
+51122ae6029657bf762d72bff94bab38890fd1e7 SOURCES/policycoreutils-po.tgz
+c503e61733af54159d5950bbd9fa8080771ee938 SOURCES/python-po.tgz
+0a34ef54394972870203832c8ce52d4405bd5330 SOURCES/restorecond-2.9.tar.gz
+7df1784ab0c6b0823943571d733b856d10a87f76 SOURCES/sandbox-po.tgz
+8645509cdfc433278c2e4d29ee8f511625c7edcc SOURCES/selinux-dbus-2.9.tar.gz
+5c155ae47692389d9fabaa154195e7f978f2a3f0 SOURCES/selinux-gui-2.9.tar.gz
+660e1ab824ef80f7a69f0b70f61e231957fd398e SOURCES/selinux-python-2.9.tar.gz
+0e208cad193021ad17a445b76b72af3fef8db999 SOURCES/selinux-sandbox-2.9.tar.gz
+a4414223e60bb664ada4824e54f8d36ab208d599 SOURCES/semodule-utils-2.9.tar.gz
+d849fa76cc3ef4a26047d8a69fef3a55d2f3097f SOURCES/sepolicy-icons.tgz
+611a5d497efaddd45ec0dcc3e9b2e5b0f81ebc41 SOURCES/system-config-selinux.png
--- a/SOURCES/0001-gui-Install-polgengui.py-to-usr-bin-selinux-polgengu.patch
+++ b/SOURCES/0001-gui-Install-polgengui.py-to-usr-bin-selinux-polgengu.patch
@ -0,0 +1,43 @@
+From c778509dd0ed3b184d720032f31971f975e42973 Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Tue, 5 Mar 2019 17:38:55 +0100
+Subject: [PATCH] gui: Install polgengui.py to /usr/bin/selinux-polgengui
+
+polgengui.py is a standalone gui tool which should be in /usr/bin with other
+tools.
+
+Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
+---
+ gui/Makefile       | 2 +-
+ gui/modulesPage.py | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/gui/Makefile b/gui/Makefile
+index c2f982de..b2375fbf 100644
+--- a/gui/Makefile
+++ b/gui/Makefile
+@@ -31,7 +31,7 @@ install: all
+ 	-mkdir -p $(DESTDIR)$(DATADIR)/polkit-1/actions/
+ 	install -m 755 system-config-selinux.py $(DESTDIR)$(SHAREDIR)
+ 	install -m 755 system-config-selinux $(DESTDIR)$(BINDIR)
+-	install -m 755 polgengui.py $(DESTDIR)$(SHAREDIR)
+	install -m 755 polgengui.py $(DESTDIR)$(BINDIR)/selinux-polgengui
+ 	install -m 644 $(TARGETS) $(DESTDIR)$(SHAREDIR)
+ 	install -m 644 system-config-selinux.8 $(DESTDIR)$(MANDIR)/man8
+ 	install -m 644 selinux-polgengui.8 $(DESTDIR)$(MANDIR)/man8
+diff --git a/gui/modulesPage.py b/gui/modulesPage.py
+index 34c5d9e3..cb856b2d 100644
+--- a/gui/modulesPage.py
+++ b/gui/modulesPage.py
+@@ -118,7 +118,7 @@ class modulesPage(semanagePage):
+ 
+     def new_module(self, args):
+         try:
+-            Popen(["/usr/share/system-config-selinux/polgengui.py"])
+            Popen(["selinux-polgengui"])
+         except ValueError as e:
+             self.error(e.args[0])
+ 
+-- 
+2.21.0
+
--- a/SOURCES/0002-gui-Install-.desktop-files-to-usr-share-applications.patch
+++ b/SOURCES/0002-gui-Install-.desktop-files-to-usr-share-applications.patch
@ -0,0 +1,49 @@
+From 04b632e6de14ec0336e14988bf4c2bd581f7308e Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Tue, 5 Mar 2019 17:25:00 +0100
+Subject: [PATCH] gui: Install .desktop files to /usr/share/applications by
+ default
+
+/usr/share/applications is a standard directory for .desktop files.
+Installation path can be changed using DESKTOPDIR variable in installation
+phase, e.g.
+
+make DESKTOPDIR=/usr/local/share/applications install
+
+Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
+---
+ gui/Makefile | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/gui/Makefile b/gui/Makefile
+index b2375fbf..ca965c94 100644
+--- a/gui/Makefile
+++ b/gui/Makefile
+@@ -5,6 +5,7 @@ BINDIR ?= $(PREFIX)/bin
+ SHAREDIR ?= $(PREFIX)/share/system-config-selinux
+ DATADIR ?= $(PREFIX)/share
+ MANDIR ?= $(PREFIX)/share/man
+DESKTOPDIR ?= $(PREFIX)/share/applications
+ 
+ TARGETS= \
+ booleansPage.py \
+@@ -29,6 +30,7 @@ install: all
+ 	-mkdir -p $(DESTDIR)$(DATADIR)/pixmaps
+ 	-mkdir -p $(DESTDIR)$(DATADIR)/icons/hicolor/24x24/apps
+ 	-mkdir -p $(DESTDIR)$(DATADIR)/polkit-1/actions/
+	-mkdir -p $(DESTDIR)$(DESKTOPDIR)
+ 	install -m 755 system-config-selinux.py $(DESTDIR)$(SHAREDIR)
+ 	install -m 755 system-config-selinux $(DESTDIR)$(BINDIR)
+ 	install -m 755 polgengui.py $(DESTDIR)$(BINDIR)/selinux-polgengui
+@@ -44,7 +46,7 @@ install: all
+ 	install -m 644 system-config-selinux.png $(DESTDIR)$(DATADIR)/pixmaps
+ 	install -m 644 system-config-selinux.png $(DESTDIR)$(DATADIR)/icons/hicolor/24x24/apps
+ 	install -m 644 system-config-selinux.png $(DESTDIR)$(DATADIR)/system-config-selinux
+-	install -m 644 *.desktop $(DESTDIR)$(DATADIR)/system-config-selinux
+	install -m 644 *.desktop $(DESTDIR)$(DESKTOPDIR)
+ 	-mkdir -p $(DESTDIR)$(DATADIR)/pixmaps
+ 	install -m 644 sepolicy_256.png $(DESTDIR)$(DATADIR)/pixmaps/sepolicy.png
+ 	for i in 16 22 32 48 256; do \
+-- 
+2.21.0
+
--- a/SOURCES/0003-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch
+++ b/SOURCES/0003-sandbox-add-reset-to-Xephyr-as-it-works-better-with-.patch
@ -0,0 +1,26 @@
+From 52e0583f6adfe70825b009b626e19c290b49763a Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Thu, 20 Aug 2015 12:58:41 +0200
+Subject: [PATCH] sandbox: add -reset to Xephyr as it works better with it in
+ recent Fedoras
+
+---
+ sandbox/sandboxX.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sandbox/sandboxX.sh b/sandbox/sandboxX.sh
+index eaa500d0..47745280 100644
+--- a/sandbox/sandboxX.sh
+++ b/sandbox/sandboxX.sh
+@@ -20,7 +20,7 @@ cat > ~/.config/openbox/rc.xml << EOF
+ </openbox_config>
+ EOF
+ 
+-(/usr/bin/Xephyr -resizeable -title "$TITLE" -terminate -screen $SCREENSIZE -dpi $DPI -nolisten tcp -displayfd 5 5>&1 2>/dev/null) | while read D; do
+(/usr/bin/Xephyr -resizeable -title "$TITLE" -terminate -reset -screen $SCREENSIZE -dpi $DPI -nolisten tcp -displayfd 5 5>&1 2>/dev/null) | while read D; do
+     export DISPLAY=:$D
+     cat > ~/seremote << __EOF
+ #!/bin/sh
+-- 
+2.21.0
+
--- a/SOURCES/0004-Fix-STANDARD_FILE_CONTEXT-section-in-man-pages.patch
+++ b/SOURCES/0004-Fix-STANDARD_FILE_CONTEXT-section-in-man-pages.patch
@ -0,0 +1,46 @@
+From 7504614fdd7dcf11b3a7568ca9b4b921973531dd Mon Sep 17 00:00:00 2001
+From: Dan Walsh <dwalsh@redhat.com>
+Date: Mon, 21 Apr 2014 13:54:40 -0400
+Subject: [PATCH] Fix STANDARD_FILE_CONTEXT section in man pages
+
+Signed-off-by: Miroslav Grepl <mgrepl@redhat.com>
+---
+ python/sepolicy/sepolicy/manpage.py | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
+index 1d367962..24e311a3 100755
+--- a/python/sepolicy/sepolicy/manpage.py
+++ b/python/sepolicy/sepolicy/manpage.py
+@@ -735,10 +735,13 @@ Default Defined Ports:""")
+ 
+     def _file_context(self):
+         flist = []
+        flist_non_exec = []
+         mpaths = []
+         for f in self.all_file_types:
+             if f.startswith(self.domainname):
+                 flist.append(f)
+                if not file_type_is_executable(f) or not file_type_is_entrypoint(f):
+                    flist_non_exec.append(f)
+                 if f in self.fcdict:
+                     mpaths = mpaths + self.fcdict[f]["regex"]
+         if len(mpaths) == 0:
+@@ -797,12 +800,12 @@ SELinux %(domainname)s policy is very flexible allowing users to setup their %(d
+ SELinux defines the file context types for the %(domainname)s, if you wanted to
+ store files with these types in a diffent paths, you need to execute the semanage command to sepecify alternate labeling and then use restorecon to put the labels on disk.
+ 
+-.B semanage fcontext -a -t %(type)s '/srv/%(domainname)s/content(/.*)?'
+.B semanage fcontext -a -t %(type)s '/srv/my%(domainname)s_content(/.*)?'
+ .br
+ .B restorecon -R -v /srv/my%(domainname)s_content
+ 
+ Note: SELinux often uses regular expressions to specify labels that match multiple files.
+-""" % {'domainname': self.domainname, "type": flist[0]})
+""" % {'domainname': self.domainname, "type": flist_non_exec[-1]})
+ 
+         self.fd.write(r"""
+ .I The following file types are defined for %(domainname)s:
+-- 
+2.21.0
+
--- a/SOURCES/0005-If-there-is-no-executable-we-don-t-want-to-print-a-p.patch
+++ b/SOURCES/0005-If-there-is-no-executable-we-don-t-want-to-print-a-p.patch
@ -0,0 +1,27 @@
+From 9847a26b7f8358432ee4c7019efb3cbad0c162b0 Mon Sep 17 00:00:00 2001
+From: Miroslav Grepl <mgrepl@redhat.com>
+Date: Mon, 12 May 2014 14:11:22 +0200
+Subject: [PATCH] If there is no executable we don't want to print a part of
+ STANDARD FILE CONTEXT
+
+---
+ python/sepolicy/sepolicy/manpage.py | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
+index 24e311a3..46092be0 100755
+--- a/python/sepolicy/sepolicy/manpage.py
+++ b/python/sepolicy/sepolicy/manpage.py
+@@ -793,7 +793,8 @@ SELinux %(domainname)s policy is very flexible allowing users to setup their %(d
+ .PP
+ """ % {'domainname': self.domainname, 'equiv': e, 'alt': e.split('/')[-1]})
+ 
+-        self.fd.write(r"""
+        if flist_non_exec:
+                self.fd.write(r"""
+ .PP
+ .B STANDARD FILE CONTEXT
+ 
+-- 
+2.21.0
+
--- a/SOURCES/0006-Simplication-of-sepolicy-manpage-web-functionality.-.patch
+++ b/SOURCES/0006-Simplication-of-sepolicy-manpage-web-functionality.-.patch
@ -0,0 +1,169 @@
+From b2993d464e05291020dbf60fc2948ac152eb0003 Mon Sep 17 00:00:00 2001
+From: Miroslav Grepl <mgrepl@redhat.com>
+Date: Thu, 19 Feb 2015 17:45:15 +0100
+Subject: [PATCH] Simplication of sepolicy-manpage web functionality.
+ system_release is no longer hardcoded and it creates only index.html and html
+ man pages in the directory for the system release.
+
+---
+ python/sepolicy/sepolicy/__init__.py | 25 +++--------
+ python/sepolicy/sepolicy/manpage.py  | 65 +++-------------------------
+ 2 files changed, 13 insertions(+), 77 deletions(-)
+
+diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py
+index 6aed31bd..88a2b8f6 100644
+--- a/python/sepolicy/sepolicy/__init__.py
+++ b/python/sepolicy/sepolicy/__init__.py
+@@ -1209,27 +1209,14 @@ def boolean_desc(boolean):
+ 
+ 
+ def get_os_version():
+-    os_version = ""
+-    pkg_name = "selinux-policy"
+    system_release = ""
+     try:
+-        try:
+-            from commands import getstatusoutput
+-        except ImportError:
+-            from subprocess import getstatusoutput
+-        rc, output = getstatusoutput("rpm -q '%s'" % pkg_name)
+-        if rc == 0:
+-            os_version = output.split(".")[-2]
+-    except:
+-        os_version = ""
+-
+-    if os_version[0:2] == "fc":
+-        os_version = "Fedora" + os_version[2:]
+-    elif os_version[0:2] == "el":
+-        os_version = "RHEL" + os_version[2:]
+-    else:
+-        os_version = ""
+        with open('/etc/system-release') as f:
+            system_release = f.readline()
+    except IOError:
+        system_release = "Misc"
+ 
+-    return os_version
+    return system_release
+ 
+ 
+ def reinit():
+diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
+index 46092be0..d60acfaf 100755
+--- a/python/sepolicy/sepolicy/manpage.py
+++ b/python/sepolicy/sepolicy/manpage.py
+@@ -149,10 +149,6 @@ def prettyprint(f, trim):
+ manpage_domains = []
+ manpage_roles = []
+ 
+-fedora_releases = ["Fedora17", "Fedora18"]
+-rhel_releases = ["RHEL6", "RHEL7"]
+-
+-
+ def get_alphabet_manpages(manpage_list):
+     alphabet_manpages = dict.fromkeys(string.ascii_letters, [])
+     for i in string.ascii_letters:
+@@ -182,7 +178,7 @@ def convert_manpage_to_html(html_manpage, manpage):
+ class HTMLManPages:
+ 
+     """
+-            Generate a HHTML Manpages on an given SELinux domains
+            Generate a HTML Manpages on an given SELinux domains
+     """
+ 
+     def __init__(self, manpage_roles, manpage_domains, path, os_version):
+@@ -190,9 +186,9 @@ class HTMLManPages:
+         self.manpage_domains = get_alphabet_manpages(manpage_domains)
+         self.os_version = os_version
+         self.old_path = path + "/"
+-        self.new_path = self.old_path + self.os_version + "/"
+        self.new_path = self.old_path
+ 
+-        if self.os_version in fedora_releases or self.os_version in rhel_releases:
+        if self.os_version:
+             self.__gen_html_manpages()
+         else:
+             print("SELinux HTML man pages can not be generated for this %s" % os_version)
+@@ -201,7 +197,6 @@ class HTMLManPages:
+     def __gen_html_manpages(self):
+         self._write_html_manpage()
+         self._gen_index()
+-        self._gen_body()
+         self._gen_css()
+ 
+     def _write_html_manpage(self):
+@@ -219,67 +214,21 @@ class HTMLManPages:
+                     convert_manpage_to_html((self.new_path + r.rsplit("_selinux", 1)[0] + ".html"), self.old_path + r)
+ 
+     def _gen_index(self):
+-        index = self.old_path + "index.html"
+-        fd = open(index, 'w')
+-        fd.write("""
+-<html>
+-<head>
+-    <link rel=stylesheet type="text/css" href="style.css" title="style">
+-    <title>SELinux man pages online</title>
+-</head>
+-<body>
+-<h1>SELinux man pages</h1>
+-<br></br>
+-Fedora or Red Hat Enterprise Linux Man Pages.</h2>
+-<br></br>
+-<hr>
+-<h3>Fedora</h3>
+-<table><tr>
+-<td valign="middle">
+-</td>
+-</tr></table>
+-<pre>
+-""")
+-        for f in fedora_releases:
+-            fd.write("""
+-<a href=%s/%s.html>%s</a> - SELinux man pages for %s """ % (f, f, f, f))
+-
+-        fd.write("""
+-</pre>
+-<hr>
+-<h3>RHEL</h3>
+-<table><tr>
+-<td valign="middle">
+-</td>
+-</tr></table>
+-<pre>
+-""")
+-        for r in rhel_releases:
+-            fd.write("""
+-<a href=%s/%s.html>%s</a> - SELinux man pages for %s """ % (r, r, r, r))
+-
+-        fd.write("""
+-</pre>
+-	""")
+-        fd.close()
+-        print("%s has been created" % index)
+-
+-    def _gen_body(self):
+         html = self.new_path + self.os_version + ".html"
+         fd = open(html, 'w')
+         fd.write("""
+ <html>
+ <head>
+-	<link rel=stylesheet type="text/css" href="../style.css" title="style">
+-	<title>Linux man-pages online for Fedora18</title>
+	<link rel=stylesheet type="text/css" href="style.css" title="style">
+	<title>SELinux man pages online</title>
+ </head>
+ <body>
+-<h1>SELinux man pages for Fedora18</h1>
+<h1>SELinux man pages for %s</h1>
+ <hr>
+ <table><tr>
+ <td valign="middle">
+ <h3>SELinux roles</h3>
+-""")
+""" % self.os_version)
+         for letter in self.manpage_roles:
+             if len(self.manpage_roles[letter]):
+                 fd.write("""
+-- 
+2.21.0
+
--- a/SOURCES/0007-We-want-to-remove-the-trailing-newline-for-etc-syste.patch
+++ b/SOURCES/0007-We-want-to-remove-the-trailing-newline-for-etc-syste.patch
@ -0,0 +1,26 @@
+From bfcb599d9424ef6ffcd250931c89675b451edd00 Mon Sep 17 00:00:00 2001
+From: Miroslav Grepl <mgrepl@redhat.com>
+Date: Fri, 20 Feb 2015 16:42:01 +0100
+Subject: [PATCH] We want to remove the trailing newline for
+ /etc/system_release.
+
+---
+ python/sepolicy/sepolicy/__init__.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py
+index 88a2b8f6..0c66f4d5 100644
+--- a/python/sepolicy/sepolicy/__init__.py
+++ b/python/sepolicy/sepolicy/__init__.py
+@@ -1212,7 +1212,7 @@ def get_os_version():
+     system_release = ""
+     try:
+         with open('/etc/system-release') as f:
+-            system_release = f.readline()
+            system_release = f.readline().rstrip()
+     except IOError:
+         system_release = "Misc"
+ 
+-- 
+2.21.0
+
--- a/SOURCES/0008-Fix-title-in-manpage.py-to-not-contain-online.patch
+++ b/SOURCES/0008-Fix-title-in-manpage.py-to-not-contain-online.patch
@ -0,0 +1,25 @@
+From 4ea504acce6389c3e28134c4b8e6bf9072c295ce Mon Sep 17 00:00:00 2001
+From: Miroslav Grepl <mgrepl@redhat.com>
+Date: Fri, 20 Feb 2015 16:42:53 +0100
+Subject: [PATCH] Fix title in manpage.py to not contain 'online'.
+
+---
+ python/sepolicy/sepolicy/manpage.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
+index d60acfaf..de8184d8 100755
+--- a/python/sepolicy/sepolicy/manpage.py
+++ b/python/sepolicy/sepolicy/manpage.py
+@@ -220,7 +220,7 @@ class HTMLManPages:
+ <html>
+ <head>
+ 	<link rel=stylesheet type="text/css" href="style.css" title="style">
+-	<title>SELinux man pages online</title>
+	<title>SELinux man pages</title>
+ </head>
+ <body>
+ <h1>SELinux man pages for %s</h1>
+-- 
+2.21.0
+
--- a/SOURCES/0009-Don-t-be-verbose-if-you-are-not-on-a-tty.patch
+++ b/SOURCES/0009-Don-t-be-verbose-if-you-are-not-on-a-tty.patch
@ -0,0 +1,24 @@
+From 8af697659bd662517571577bf47946a2113f34a1 Mon Sep 17 00:00:00 2001
+From: Dan Walsh <dwalsh@redhat.com>
+Date: Fri, 14 Feb 2014 12:32:12 -0500
+Subject: [PATCH] Don't be verbose if you are not on a tty
+
+---
+ policycoreutils/scripts/fixfiles | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
+index b2779581..53d28c7b 100755
+--- a/policycoreutils/scripts/fixfiles
+++ b/policycoreutils/scripts/fixfiles
+@@ -108,6 +108,7 @@ exclude_dirs_from_relabelling() {
+ fullFlag=0
+ BOOTTIME=""
+ VERBOSE="-p"
+[ -t 1 ] || VERBOSE=""
+ FORCEFLAG=""
+ RPMFILES=""
+ PREFC=""
+-- 
+2.21.0
+
--- a/SOURCES/0010-sepolicy-Drop-old-interface-file_type_is_executable-.patch
+++ b/SOURCES/0010-sepolicy-Drop-old-interface-file_type_is_executable-.patch
@ -0,0 +1,63 @@
+From ef0f54ffc6d691d10e66a0793204edd159cd45d0 Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Mon, 27 Feb 2017 17:12:39 +0100
+Subject: [PATCH] sepolicy: Drop old interface file_type_is_executable(f) and
+ file_type_is_entrypoint(f)
+
+- use direct queries
+- load exec_types and entry_types only once
+---
+ python/sepolicy/sepolicy/manpage.py | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
+index de8184d8..f8a94fc0 100755
+--- a/python/sepolicy/sepolicy/manpage.py
+++ b/python/sepolicy/sepolicy/manpage.py
+@@ -125,8 +125,24 @@ def gen_domains():
+     domains.sort()
+     return domains
+ 
+-types = None
+ 
+exec_types = None
+
+def _gen_exec_types():
+    global exec_types
+    if exec_types is None:
+        exec_types = next(sepolicy.info(sepolicy.ATTRIBUTE, "exec_type"))["types"]
+    return exec_types
+
+entry_types = None
+
+def _gen_entry_types():
+    global entry_types
+    if entry_types is None:
+        entry_types = next(sepolicy.info(sepolicy.ATTRIBUTE, "entry_type"))["types"]
+    return entry_types
+
+types = None
+ 
+ def _gen_types():
+     global types
+@@ -372,6 +388,8 @@ class ManPage:
+         self.all_file_types = sepolicy.get_all_file_types()
+         self.role_allows = sepolicy.get_all_role_allows()
+         self.types = _gen_types()
+        self.exec_types = _gen_exec_types()
+        self.entry_types = _gen_entry_types()
+ 
+         if self.source_files:
+             self.fcpath = self.root + "file_contexts"
+@@ -689,7 +707,7 @@ Default Defined Ports:""")
+         for f in self.all_file_types:
+             if f.startswith(self.domainname):
+                 flist.append(f)
+-                if not file_type_is_executable(f) or not file_type_is_entrypoint(f):
+                if not f in self.exec_types or not f in self.entry_types:
+                     flist_non_exec.append(f)
+                 if f in self.fcdict:
+                     mpaths = mpaths + self.fcdict[f]["regex"]
+-- 
+2.21.0
+
--- a/SOURCES/0011-sepolicy-Another-small-optimization-for-mcs-types.patch
+++ b/SOURCES/0011-sepolicy-Another-small-optimization-for-mcs-types.patch
@ -0,0 +1,53 @@
+From e54db76a3bff8e911ddd7c7ce834c024d634d9e1 Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Tue, 28 Feb 2017 21:29:46 +0100
+Subject: [PATCH] sepolicy: Another small optimization for mcs types
+
+---
+ python/sepolicy/sepolicy/manpage.py | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
+index f8a94fc0..67d39301 100755
+--- a/python/sepolicy/sepolicy/manpage.py
+++ b/python/sepolicy/sepolicy/manpage.py
+@@ -142,6 +142,15 @@ def _gen_entry_types():
+         entry_types = next(sepolicy.info(sepolicy.ATTRIBUTE, "entry_type"))["types"]
+     return entry_types
+ 
+mcs_constrained_types = None
+
+def _gen_mcs_constrained_types():
+    global mcs_constrained_types
+    if mcs_constrained_types is None:
+        mcs_constrained_types = next(sepolicy.info(sepolicy.ATTRIBUTE, "mcs_constrained_type"))
+    return mcs_constrained_types
+
+
+ types = None
+ 
+ def _gen_types():
+@@ -390,6 +399,7 @@ class ManPage:
+         self.types = _gen_types()
+         self.exec_types = _gen_exec_types()
+         self.entry_types = _gen_entry_types()
+        self.mcs_constrained_types = _gen_mcs_constrained_types()
+ 
+         if self.source_files:
+             self.fcpath = self.root + "file_contexts"
+@@ -944,11 +954,7 @@ All executeables with the default executable label, usually stored in /usr/bin a
+ %s""" % ", ".join(paths))
+ 
+     def _mcs_types(self):
+-        try:
+-            mcs_constrained_type = next(sepolicy.info(sepolicy.ATTRIBUTE, "mcs_constrained_type"))
+-        except StopIteration:
+-            return
+-        if self.type not in mcs_constrained_type['types']:
+        if self.type not in self.mcs_constrained_types['types']:
+             return
+         self.fd.write ("""
+ .SH "MCS Constrained"
+-- 
+2.21.0
+
--- a/SOURCES/0012-Move-po-translation-files-into-the-right-sub-directo.patch
+++ b/SOURCES/0012-Move-po-translation-files-into-the-right-sub-directo.patch
@ -0,0 +1,515 @@
+From 4015e9299bfda622e9d407cdbcc536000688aa8f Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Mon, 6 Aug 2018 13:23:00 +0200
+Subject: [PATCH] Move po/ translation files into the right sub-directories
+
+When policycoreutils was split into policycoreutils/ python/ gui/ and sandbox/
+sub-directories, po/ translation files stayed in policycoreutils/.
+
+This commit split original policycoreutils/po directory into
+policycoreutils/po
+python/po
+gui/po
+sandbox/po
+
+See https://github.com/fedora-selinux/selinux/issues/43
+---
+ gui/Makefile                |  3 ++
+ gui/po/Makefile             | 82 ++++++++++++++++++++++++++++++++++++
+ gui/po/POTFILES             | 17 ++++++++
+ policycoreutils/po/Makefile | 70 ++-----------------------------
+ policycoreutils/po/POTFILES |  9 ++++
+ python/Makefile             |  2 +-
+ python/po/Makefile          | 83 +++++++++++++++++++++++++++++++++++++
+ python/po/POTFILES          | 10 +++++
+ sandbox/Makefile            |  2 +
+ sandbox/po/Makefile         | 82 ++++++++++++++++++++++++++++++++++++
+ sandbox/po/POTFILES         |  1 +
+ 11 files changed, 293 insertions(+), 68 deletions(-)
+ create mode 100644 gui/po/Makefile
+ create mode 100644 gui/po/POTFILES
+ create mode 100644 policycoreutils/po/POTFILES
+ create mode 100644 python/po/Makefile
+ create mode 100644 python/po/POTFILES
+ create mode 100644 sandbox/po/Makefile
+ create mode 100644 sandbox/po/POTFILES
+
+diff --git a/gui/Makefile b/gui/Makefile
+index ca965c94..5a5bf6dc 100644
+--- a/gui/Makefile
+++ b/gui/Makefile
+@@ -22,6 +22,7 @@ system-config-selinux.ui \
+ usersPage.py
+ 
+ all: $(TARGETS) system-config-selinux.py polgengui.py
+	(cd po && $(MAKE) $@)
+ 
+ install: all
+ 	-mkdir -p $(DESTDIR)$(MANDIR)/man8
+@@ -54,6 +55,8 @@ install: all
+ 		install -m 644 sepolicy_$${i}.png $(DESTDIR)$(DATADIR)/icons/hicolor/$${i}x$${i}/apps/sepolicy.png; \
+ 	done
+ 	install -m 644 org.selinux.config.policy $(DESTDIR)$(DATADIR)/polkit-1/actions/
+	(cd po && $(MAKE) $@)
+
+ clean:
+ 
+ indent:
+diff --git a/gui/po/Makefile b/gui/po/Makefile
+new file mode 100644
+index 00000000..a0f5439f
+--- /dev/null
+++ b/gui/po/Makefile
+@@ -0,0 +1,82 @@
+#
+# Makefile for the PO files (translation) catalog
+#
+
+PREFIX ?= /usr
+
+# What is this package?
+NLSPACKAGE	= gui
+POTFILE		= $(NLSPACKAGE).pot
+INSTALL		= /usr/bin/install -c -p
+INSTALL_DATA	= $(INSTALL) -m 644
+INSTALL_DIR	= /usr/bin/install -d
+
+# destination directory
+INSTALL_NLS_DIR = $(PREFIX)/share/locale
+
+# PO catalog handling
+MSGMERGE	= msgmerge
+MSGMERGE_FLAGS	= -q
+XGETTEXT	= xgettext --default-domain=$(NLSPACKAGE)
+MSGFMT		= msgfmt
+
+# All possible linguas
+PO_LINGUAS := $(sort $(patsubst %.po,%,$(wildcard *.po)))
+
+# Only the files matching what the user has set in LINGUAS
+USER_LINGUAS := $(filter $(patsubst %,%%,$(LINGUAS)),$(PO_LINGUAS))
+
+# if no valid LINGUAS, build all languages
+USE_LINGUAS := $(if $(USER_LINGUAS),$(USER_LINGUAS),$(PO_LINGUAS))
+
+POFILES		= $(patsubst %,%.po,$(USE_LINGUAS))
+MOFILES		= $(patsubst %.po,%.mo,$(POFILES))
+POTFILES  = $(shell cat POTFILES)
+
+#default:: clean
+
+all::  $(MOFILES)
+
+$(POTFILE): $(POTFILES)
+	$(XGETTEXT) --keyword=_ --keyword=N_ $(POTFILES)
+	@if cmp -s $(NLSPACKAGE).po $(POTFILE); then \
+	    rm -f $(NLSPACKAGE).po; \
+	else \
+	    mv -f $(NLSPACKAGE).po $(POTFILE); \
+	fi; \
+
+
+refresh-po: Makefile
+	for cat in $(POFILES); do \
+		lang=`basename $$cat .po`; \
+		if $(MSGMERGE) $(MSGMERGE_FLAGS) $$lang.po $(POTFILE) > $$lang.pot ; then \
+			mv -f $$lang.pot $$lang.po ; \
+			echo "$(MSGMERGE) of $$lang succeeded" ; \
+		else \
+			echo "$(MSGMERGE) of $$lang failed" ; \
+			rm -f $$lang.pot ; \
+		fi \
+	done
+
+clean:
+	@rm -fv *mo *~ .depend
+	@rm -rf tmp
+
+install: $(MOFILES)
+	@for n in $(MOFILES); do \
+	    l=`basename $$n .mo`; \
+	    $(INSTALL_DIR) $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES; \
+	    $(INSTALL_DATA) --verbose $$n $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES/selinux-$(NLSPACKAGE).mo; \
+	done
+
+%.mo: %.po
+	$(MSGFMT) -o $@ $<
+report:
+	@for cat in $(wildcard *.po); do \
+                echo -n "$$cat: "; \
+                msgfmt -v --statistics -o /dev/null $$cat; \
+        done
+
+.PHONY: missing depend
+
+relabel:
+diff --git a/gui/po/POTFILES b/gui/po/POTFILES
+new file mode 100644
+index 00000000..1795c5c1
+--- /dev/null
+++ b/gui/po/POTFILES
+@@ -0,0 +1,17 @@
+../booleansPage.py
+../domainsPage.py
+../fcontextPage.py
+../loginsPage.py
+../modulesPage.py
+../org.selinux.config.policy
+../polgengui.py
+../polgen.ui
+../portsPage.py
+../selinux-polgengui.desktop
+../semanagePage.py
+../sepolicy.desktop
+../statusPage.py
+../system-config-selinux.desktop
+../system-config-selinux.py
+../system-config-selinux.ui
+../usersPage.py
+diff --git a/policycoreutils/po/Makefile b/policycoreutils/po/Makefile
+index 575e1431..18bc1dff 100644
+--- a/policycoreutils/po/Makefile
+++ b/policycoreutils/po/Makefile
+@@ -3,7 +3,6 @@
+ #
+ 
+ PREFIX ?= /usr
+-TOP	 = ../..
+ 
+ # What is this package?
+ NLSPACKAGE	= policycoreutils
+@@ -32,74 +31,13 @@ USE_LINGUAS := $(if $(USER_LINGUAS),$(USER_LINGUAS),$(PO_LINGUAS))
+ 
+ POFILES		= $(patsubst %,%.po,$(USE_LINGUAS))
+ MOFILES		= $(patsubst %.po,%.mo,$(POFILES))
+-POTFILES = \
+-	../run_init/open_init_pty.c \
+-	../run_init/run_init.c \
+-	../semodule_link/semodule_link.c \
+-	../audit2allow/audit2allow \
+-	../semanage/seobject.py \
+-	../setsebool/setsebool.c \
+-	../newrole/newrole.c \
+-	../load_policy/load_policy.c \
+-	../sestatus/sestatus.c \
+-	../semodule/semodule.c \
+-	../setfiles/setfiles.c \
+-	../semodule_package/semodule_package.c \
+-	../semodule_deps/semodule_deps.c \
+-	../semodule_expand/semodule_expand.c \
+-	../scripts/chcat \
+-	../scripts/fixfiles \
+-	../restorecond/stringslist.c \
+-	../restorecond/restorecond.h \
+-	../restorecond/utmpwatcher.h \
+-	../restorecond/stringslist.h \
+-	../restorecond/restorecond.c \
+-	../restorecond/utmpwatcher.c \
+-	../gui/booleansPage.py \
+-	../gui/fcontextPage.py \
+-	../gui/loginsPage.py \
+-	../gui/mappingsPage.py \
+-	../gui/modulesPage.py \
+-	../gui/polgen.glade \
+-	../gui/polgengui.py \
+-	../gui/portsPage.py \
+-	../gui/semanagePage.py \
+-	../gui/statusPage.py \
+-	../gui/system-config-selinux.glade \
+-	../gui/system-config-selinux.py \
+-	../gui/usersPage.py \
+-	../secon/secon.c \
+-	booleans.py \
+-	../sepolicy/sepolicy.py \
+-	../sepolicy/sepolicy/communicate.py \
+-	../sepolicy/sepolicy/__init__.py \
+-	../sepolicy/sepolicy/network.py \
+-	../sepolicy/sepolicy/generate.py \
+-	../sepolicy/sepolicy/sepolicy.glade \
+-	../sepolicy/sepolicy/gui.py \
+-	../sepolicy/sepolicy/manpage.py \
+-	../sepolicy/sepolicy/transition.py \
+-	../sepolicy/sepolicy/templates/executable.py \
+-	../sepolicy/sepolicy/templates/__init__.py \
+-	../sepolicy/sepolicy/templates/network.py \
+-	../sepolicy/sepolicy/templates/rw.py \
+-	../sepolicy/sepolicy/templates/script.py \
+-	../sepolicy/sepolicy/templates/semodule.py \
+-	../sepolicy/sepolicy/templates/tmp.py \
+-	../sepolicy/sepolicy/templates/user.py \
+-	../sepolicy/sepolicy/templates/var_lib.py \
+-	../sepolicy/sepolicy/templates/var_log.py \
+-	../sepolicy/sepolicy/templates/var_run.py \
+-	../sepolicy/sepolicy/templates/var_spool.py
+POTFILES  = $(shell cat POTFILES)
+ 
+ #default:: clean
+ 
+-all::  $(MOFILES)
+all:: $(POTFILE) $(MOFILES)
+ 
+-booleans.py:
+-	sepolicy booleans -a > booleans.py
+-
+-$(POTFILE): $(POTFILES) booleans.py
+$(POTFILE): $(POTFILES)
+ 	$(XGETTEXT) --keyword=_ --keyword=N_ $(POTFILES)
+ 	@if cmp -s $(NLSPACKAGE).po $(POTFILE); then \
+ 	    rm -f $(NLSPACKAGE).po; \
+@@ -107,8 +45,6 @@ $(POTFILE): $(POTFILES) booleans.py
+ 	    mv -f $(NLSPACKAGE).po $(POTFILE); \
+ 	fi; \
+ 
+-update-po: Makefile $(POTFILE) refresh-po
+-	@rm -f booleans.py
+ 
+ refresh-po: Makefile
+ 	for cat in $(POFILES); do \
+diff --git a/policycoreutils/po/POTFILES b/policycoreutils/po/POTFILES
+new file mode 100644
+index 00000000..12237dc6
+--- /dev/null
+++ b/policycoreutils/po/POTFILES
+@@ -0,0 +1,9 @@
+../run_init/open_init_pty.c
+../run_init/run_init.c
+../setsebool/setsebool.c
+../newrole/newrole.c
+../load_policy/load_policy.c
+../sestatus/sestatus.c
+../semodule/semodule.c
+../setfiles/setfiles.c
+../secon/secon.c
+diff --git a/python/Makefile b/python/Makefile
+index 9b66d52f..00312dbd 100644
+--- a/python/Makefile
+++ b/python/Makefile
+@@ -1,4 +1,4 @@
+-SUBDIRS = sepolicy audit2allow semanage sepolgen chcat
+SUBDIRS = sepolicy audit2allow semanage sepolgen chcat po
+ 
+ all install relabel clean indent test:
+ 	@for subdir in $(SUBDIRS); do \
+diff --git a/python/po/Makefile b/python/po/Makefile
+new file mode 100644
+index 00000000..4e052d5a
+--- /dev/null
+++ b/python/po/Makefile
+@@ -0,0 +1,83 @@
+#
+# Makefile for the PO files (translation) catalog
+#
+
+PREFIX ?= /usr
+
+# What is this package?
+NLSPACKAGE	= python
+POTFILE		= $(NLSPACKAGE).pot
+INSTALL		= /usr/bin/install -c -p
+INSTALL_DATA	= $(INSTALL) -m 644
+INSTALL_DIR	= /usr/bin/install -d
+
+# destination directory
+INSTALL_NLS_DIR = $(PREFIX)/share/locale
+
+# PO catalog handling
+MSGMERGE	= msgmerge
+MSGMERGE_FLAGS	= -q
+XGETTEXT	= xgettext --default-domain=$(NLSPACKAGE)
+MSGFMT		= msgfmt
+
+# All possible linguas
+PO_LINGUAS := $(sort $(patsubst %.po,%,$(wildcard *.po)))
+
+# Only the files matching what the user has set in LINGUAS
+USER_LINGUAS := $(filter $(patsubst %,%%,$(LINGUAS)),$(PO_LINGUAS))
+
+# if no valid LINGUAS, build all languages
+USE_LINGUAS := $(if $(USER_LINGUAS),$(USER_LINGUAS),$(PO_LINGUAS))
+
+POFILES		= $(patsubst %,%.po,$(USE_LINGUAS))
+MOFILES		= $(patsubst %.po,%.mo,$(POFILES))
+POTFILES  = $(shell cat POTFILES)
+
+#default:: clean
+
+all::  $(MOFILES)
+
+$(POTFILE): $(POTFILES) 
+	$(XGETTEXT) -L Python --keyword=_ --keyword=N_ $(POTFILES)
+	$(XGETTEXT) -j --keyword=_ --keyword=N_ ../sepolicy/sepolicy/sepolicy.glade
+	@if cmp -s $(NLSPACKAGE).po $(POTFILE); then \
+	    rm -f $(NLSPACKAGE).po; \
+	else \
+	    mv -f $(NLSPACKAGE).po $(POTFILE); \
+	fi; \
+
+
+refresh-po: Makefile
+	for cat in $(POFILES); do \
+		lang=`basename $$cat .po`; \
+		if $(MSGMERGE) $(MSGMERGE_FLAGS) $$lang.po $(POTFILE) > $$lang.pot ; then \
+			mv -f $$lang.pot $$lang.po ; \
+			echo "$(MSGMERGE) of $$lang succeeded" ; \
+		else \
+			echo "$(MSGMERGE) of $$lang failed" ; \
+			rm -f $$lang.pot ; \
+		fi \
+	done
+
+clean:
+	@rm -fv *mo *~ .depend
+	@rm -rf tmp
+
+install: $(MOFILES)
+	@for n in $(MOFILES); do \
+	    l=`basename $$n .mo`; \
+	    $(INSTALL_DIR) $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES; \
+	    $(INSTALL_DATA) --verbose $$n $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES/selinux-$(NLSPACKAGE).mo; \
+	done
+
+%.mo: %.po
+	$(MSGFMT) -o $@ $<
+report:
+	@for cat in $(wildcard *.po); do \
+                echo -n "$$cat: "; \
+                msgfmt -v --statistics -o /dev/null $$cat; \
+        done
+
+.PHONY: missing depend
+
+relabel:
+diff --git a/python/po/POTFILES b/python/po/POTFILES
+new file mode 100644
+index 00000000..128eb870
+--- /dev/null
+++ b/python/po/POTFILES
+@@ -0,0 +1,10 @@
+../audit2allow/audit2allow
+../chcat/chcat
+../semanage/semanage
+../semanage/seobject.py
+../sepolgen/src/sepolgen/interfaces.py
+../sepolicy/sepolicy/generate.py
+../sepolicy/sepolicy/gui.py
+../sepolicy/sepolicy/__init__.py
+../sepolicy/sepolicy/interface.py
+../sepolicy/sepolicy.py
+diff --git a/sandbox/Makefile b/sandbox/Makefile
+index 9da5e58d..b817824e 100644
+--- a/sandbox/Makefile
+++ b/sandbox/Makefile
+@@ -13,6 +13,7 @@ override LDLIBS += -lselinux -lcap-ng
+ SEUNSHARE_OBJS = seunshare.o
+ 
+ all: sandbox seunshare sandboxX.sh start
+	(cd po && $(MAKE) $@)
+ 
+ seunshare: $(SEUNSHARE_OBJS)
+ 
+@@ -39,6 +40,7 @@ install: all
+ 	install -m 755 start $(DESTDIR)$(SHAREDIR)
+ 	-mkdir -p $(DESTDIR)$(SYSCONFDIR)
+ 	install -m 644 sandbox.conf $(DESTDIR)$(SYSCONFDIR)/sandbox
+	(cd po && $(MAKE) $@)
+ 
+ test:
+ 	@$(PYTHON) test_sandbox.py -v
+diff --git a/sandbox/po/Makefile b/sandbox/po/Makefile
+new file mode 100644
+index 00000000..0556bbe9
+--- /dev/null
+++ b/sandbox/po/Makefile
+@@ -0,0 +1,82 @@
+#
+# Makefile for the PO files (translation) catalog
+#
+
+PREFIX ?= /usr
+
+# What is this package?
+NLSPACKAGE	= sandbox
+POTFILE		= $(NLSPACKAGE).pot
+INSTALL		= /usr/bin/install -c -p
+INSTALL_DATA	= $(INSTALL) -m 644
+INSTALL_DIR	= /usr/bin/install -d
+
+# destination directory
+INSTALL_NLS_DIR = $(PREFIX)/share/locale
+
+# PO catalog handling
+MSGMERGE	= msgmerge
+MSGMERGE_FLAGS	= -q
+XGETTEXT	= xgettext -L Python --default-domain=$(NLSPACKAGE)
+MSGFMT		= msgfmt
+
+# All possible linguas
+PO_LINGUAS := $(sort $(patsubst %.po,%,$(wildcard *.po)))
+
+# Only the files matching what the user has set in LINGUAS
+USER_LINGUAS := $(filter $(patsubst %,%%,$(LINGUAS)),$(PO_LINGUAS))
+
+# if no valid LINGUAS, build all languages
+USE_LINGUAS := $(if $(USER_LINGUAS),$(USER_LINGUAS),$(PO_LINGUAS))
+
+POFILES		= $(patsubst %,%.po,$(USE_LINGUAS))
+MOFILES		= $(patsubst %.po,%.mo,$(POFILES))
+POTFILES  = $(shell cat POTFILES)
+
+#default:: clean
+
+all:: $(POTFILE) $(MOFILES)
+
+$(POTFILE): $(POTFILES)
+	$(XGETTEXT) --keyword=_ --keyword=N_ $(POTFILES)
+	@if cmp -s $(NLSPACKAGE).po $(POTFILE); then \
+	    rm -f $(NLSPACKAGE).po; \
+	else \
+	    mv -f $(NLSPACKAGE).po $(POTFILE); \
+	fi; \
+
+
+refresh-po: Makefile
+	for cat in $(POFILES); do \
+		lang=`basename $$cat .po`; \
+		if $(MSGMERGE) $(MSGMERGE_FLAGS) $$lang.po $(POTFILE) > $$lang.pot ; then \
+			mv -f $$lang.pot $$lang.po ; \
+			echo "$(MSGMERGE) of $$lang succeeded" ; \
+		else \
+			echo "$(MSGMERGE) of $$lang failed" ; \
+			rm -f $$lang.pot ; \
+		fi \
+	done
+
+clean:
+	@rm -fv *mo *~ .depend
+	@rm -rf tmp
+
+install: $(MOFILES)
+	@for n in $(MOFILES); do \
+	    l=`basename $$n .mo`; \
+	    $(INSTALL_DIR) $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES; \
+	    $(INSTALL_DATA) --verbose $$n $(DESTDIR)$(INSTALL_NLS_DIR)/$$l/LC_MESSAGES/selinux-$(NLSPACKAGE).mo; \
+	done
+
+%.mo: %.po
+	$(MSGFMT) -o $@ $<
+report:
+	@for cat in $(wildcard *.po); do \
+                echo -n "$$cat: "; \
+                msgfmt -v --statistics -o /dev/null $$cat; \
+        done
+
+.PHONY: missing depend
+
+relabel:
+diff --git a/sandbox/po/POTFILES b/sandbox/po/POTFILES
+new file mode 100644
+index 00000000..deff3f2f
+--- /dev/null
+++ b/sandbox/po/POTFILES
+@@ -0,0 +1 @@
+../sandbox
+-- 
+2.21.0
+
--- a/SOURCES/0013-Use-correct-gettext-domains-in-python-gui-sandbox.patch
+++ b/SOURCES/0013-Use-correct-gettext-domains-in-python-gui-sandbox.patch
@ -0,0 +1,306 @@
+From 57cd23e11e1a700802a5955e84a0a7e04c30ec73 Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Mon, 6 Aug 2018 13:37:07 +0200
+Subject: [PATCH] Use correct gettext domains in python/ gui/ sandbox/
+
+https://github.com/fedora-selinux/selinux/issues/43
+---
+ gui/booleansPage.py                          | 2 +-
+ gui/domainsPage.py                           | 2 +-
+ gui/fcontextPage.py                          | 2 +-
+ gui/loginsPage.py                            | 2 +-
+ gui/modulesPage.py                           | 2 +-
+ gui/polgengui.py                             | 2 +-
+ gui/portsPage.py                             | 2 +-
+ gui/semanagePage.py                          | 2 +-
+ gui/statusPage.py                            | 2 +-
+ gui/system-config-selinux.py                 | 2 +-
+ gui/usersPage.py                             | 2 +-
+ python/chcat/chcat                           | 2 +-
+ python/semanage/semanage                     | 2 +-
+ python/semanage/seobject.py                  | 2 +-
+ python/sepolgen/src/sepolgen/sepolgeni18n.py | 2 +-
+ python/sepolicy/sepolicy.py                  | 2 +-
+ python/sepolicy/sepolicy/__init__.py         | 2 +-
+ python/sepolicy/sepolicy/generate.py         | 2 +-
+ python/sepolicy/sepolicy/gui.py              | 2 +-
+ python/sepolicy/sepolicy/interface.py        | 2 +-
+ sandbox/sandbox                              | 2 +-
+ 21 files changed, 21 insertions(+), 21 deletions(-)
+
+diff --git a/gui/booleansPage.py b/gui/booleansPage.py
+index 7849bea2..dd12b6d6 100644
+--- a/gui/booleansPage.py
+++ b/gui/booleansPage.py
+@@ -38,7 +38,7 @@ DISABLED = 2
+ ##
+ ## I18N
+ ##
+-PROGNAME = "policycoreutils"
+PROGNAME = "selinux-gui"
+ try:
+     import gettext
+     kwargs = {}
+diff --git a/gui/domainsPage.py b/gui/domainsPage.py
+index bad5140d..6bbe4de5 100644
+--- a/gui/domainsPage.py
+++ b/gui/domainsPage.py
+@@ -30,7 +30,7 @@ from semanagePage import *
+ ##
+ ## I18N
+ ##
+-PROGNAME = "policycoreutils"
+PROGNAME = "selinux-gui"
+ try:
+     import gettext
+     kwargs = {}
+diff --git a/gui/fcontextPage.py b/gui/fcontextPage.py
+index 370bbee4..e424366d 100644
+--- a/gui/fcontextPage.py
+++ b/gui/fcontextPage.py
+@@ -47,7 +47,7 @@ class context:
+ ##
+ ## I18N
+ ##
+-PROGNAME = "policycoreutils"
+PROGNAME = "selinux-gui"
+ try:
+     import gettext
+     kwargs = {}
+diff --git a/gui/loginsPage.py b/gui/loginsPage.py
+index b67eb8bc..cbfb0cc2 100644
+--- a/gui/loginsPage.py
+++ b/gui/loginsPage.py
+@@ -29,7 +29,7 @@ from semanagePage import *
+ ##
+ ## I18N
+ ##
+-PROGNAME = "policycoreutils"
+PROGNAME = "selinux-gui"
+ try:
+     import gettext
+     kwargs = {}
+diff --git a/gui/modulesPage.py b/gui/modulesPage.py
+index cb856b2d..26ac5404 100644
+--- a/gui/modulesPage.py
+++ b/gui/modulesPage.py
+@@ -30,7 +30,7 @@ from semanagePage import *
+ ##
+ ## I18N
+ ##
+-PROGNAME = "policycoreutils"
+PROGNAME = "selinux-gui"
+ try:
+     import gettext
+     kwargs = {}
+diff --git a/gui/polgengui.py b/gui/polgengui.py
+index b1cc9937..46a1bd2c 100644
+--- a/gui/polgengui.py
+++ b/gui/polgengui.py
+@@ -63,7 +63,7 @@ def get_all_modules():
+ ##
+ ## I18N
+ ##
+-PROGNAME = "policycoreutils"
+PROGNAME = "selinux-gui"
+ try:
+     import gettext
+     kwargs = {}
+diff --git a/gui/portsPage.py b/gui/portsPage.py
+index 30f58383..a537ecc8 100644
+--- a/gui/portsPage.py
+++ b/gui/portsPage.py
+@@ -35,7 +35,7 @@ from semanagePage import *
+ ##
+ ## I18N
+ ##
+-PROGNAME = "policycoreutils"
+PROGNAME = "selinux-gui"
+ try:
+     import gettext
+     kwargs = {}
+diff --git a/gui/semanagePage.py b/gui/semanagePage.py
+index 4127804f..5361d69c 100644
+--- a/gui/semanagePage.py
+++ b/gui/semanagePage.py
+@@ -22,7 +22,7 @@ from gi.repository import Gdk, Gtk
+ ##
+ ## I18N
+ ##
+-PROGNAME = "policycoreutils"
+PROGNAME = "selinux-gui"
+ try:
+     import gettext
+     kwargs = {}
+diff --git a/gui/statusPage.py b/gui/statusPage.py
+index 766854b1..a8f079b9 100644
+--- a/gui/statusPage.py
+++ b/gui/statusPage.py
+@@ -35,7 +35,7 @@ RELABELFILE = "/.autorelabel"
+ ##
+ ## I18N
+ ##
+-PROGNAME = "policycoreutils"
+PROGNAME = "selinux-gui"
+ try:
+     import gettext
+     kwargs = {}
+diff --git a/gui/system-config-selinux.py b/gui/system-config-selinux.py
+index c42301b6..1e0d5eb1 100644
+--- a/gui/system-config-selinux.py
+++ b/gui/system-config-selinux.py
+@@ -45,7 +45,7 @@ import selinux
+ ##
+ ## I18N
+ ##
+-PROGNAME = "policycoreutils"
+PROGNAME = "selinux-gui"
+ try:
+     import gettext
+     kwargs = {}
+diff --git a/gui/usersPage.py b/gui/usersPage.py
+index 26794ed5..d15d4c5a 100644
+--- a/gui/usersPage.py
+++ b/gui/usersPage.py
+@@ -29,7 +29,7 @@ from semanagePage import *
+ ##
+ ## I18N
+ ##
+-PROGNAME = "policycoreutils"
+PROGNAME = "selinux-gui"
+ try:
+     import gettext
+     kwargs = {}
+diff --git a/python/chcat/chcat b/python/chcat/chcat
+index ba398684..df2509f2 100755
+--- a/python/chcat/chcat
+++ b/python/chcat/chcat
+@@ -30,7 +30,7 @@ import getopt
+ import selinux
+ import seobject
+ 
+-PROGNAME = "policycoreutils"
+PROGNAME = "selinux-python"
+ try:
+     import gettext
+     kwargs = {}
+diff --git a/python/semanage/semanage b/python/semanage/semanage
+index 144cc000..56db3e0d 100644
+--- a/python/semanage/semanage
+++ b/python/semanage/semanage
+@@ -27,7 +27,7 @@ import traceback
+ import argparse
+ import seobject
+ import sys
+-PROGNAME = "policycoreutils"
+PROGNAME = "selinux-python"
+ try:
+     import gettext
+     kwargs = {}
+diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
+index 13fdf531..b90b1070 100644
+--- a/python/semanage/seobject.py
+++ b/python/semanage/seobject.py
+@@ -29,7 +29,7 @@ import sys
+ import stat
+ import socket
+ from semanage import *
+-PROGNAME = "policycoreutils"
+PROGNAME = "selinux-python"
+ import sepolicy
+ import setools
+ from IPy import IP
+diff --git a/python/sepolgen/src/sepolgen/sepolgeni18n.py b/python/sepolgen/src/sepolgen/sepolgeni18n.py
+index 998c4356..56ebd807 100644
+--- a/python/sepolgen/src/sepolgen/sepolgeni18n.py
+++ b/python/sepolgen/src/sepolgen/sepolgeni18n.py
+@@ -19,7 +19,7 @@
+ 
+ try: 
+     import gettext
+-    t = gettext.translation( 'yumex' )
+    t = gettext.translation( 'selinux-python' )
+     _ = t.gettext
+ except:
+     def _(str):
+diff --git a/python/sepolicy/sepolicy.py b/python/sepolicy/sepolicy.py
+index 1934cd86..8bd6a579 100755
+--- a/python/sepolicy/sepolicy.py
+++ b/python/sepolicy/sepolicy.py
+@@ -27,7 +27,7 @@ import selinux
+ import sepolicy
+ from sepolicy import get_os_version, get_conditionals, get_conditionals_format_text
+ import argparse
+-PROGNAME = "policycoreutils"
+PROGNAME = "selinux-python"
+ try:
+     import gettext
+     kwargs = {}
+diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py
+index 0c66f4d5..b6ca57c3 100644
+--- a/python/sepolicy/sepolicy/__init__.py
+++ b/python/sepolicy/sepolicy/__init__.py
+@@ -13,7 +13,7 @@ import os
+ import re
+ import gzip
+ 
+-PROGNAME = "policycoreutils"
+PROGNAME = "selinux-python"
+ try:
+     import gettext
+     kwargs = {}
+diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py
+index 019e7836..7175d36b 100644
+--- a/python/sepolicy/sepolicy/generate.py
+++ b/python/sepolicy/sepolicy/generate.py
+@@ -49,7 +49,7 @@ import sepolgen.defaults as defaults
+ ##
+ ## I18N
+ ##
+-PROGNAME = "policycoreutils"
+PROGNAME = "selinux-python"
+ try:
+     import gettext
+     kwargs = {}
+diff --git a/python/sepolicy/sepolicy/gui.py b/python/sepolicy/sepolicy/gui.py
+index 00fd7a11..805cee67 100644
+--- a/python/sepolicy/sepolicy/gui.py
+++ b/python/sepolicy/sepolicy/gui.py
+@@ -41,7 +41,7 @@ import os
+ import re
+ import unicodedata
+ 
+-PROGNAME = "policycoreutils"
+PROGNAME = "selinux-python"
+ try:
+     import gettext
+     kwargs = {}
+diff --git a/python/sepolicy/sepolicy/interface.py b/python/sepolicy/sepolicy/interface.py
+index 583091ae..e2b8d23b 100644
+--- a/python/sepolicy/sepolicy/interface.py
+++ b/python/sepolicy/sepolicy/interface.py
+@@ -30,7 +30,7 @@ __all__ = ['get_all_interfaces', 'get_interfaces_from_xml', 'get_admin', 'get_us
+ ##
+ ## I18N
+ ##
+-PROGNAME = "policycoreutils"
+PROGNAME = "selinux-python"
+ try:
+     import gettext
+     kwargs = {}
+diff --git a/sandbox/sandbox b/sandbox/sandbox
+index 1dec07ac..a12403b3 100644
+--- a/sandbox/sandbox
+++ b/sandbox/sandbox
+@@ -37,7 +37,7 @@ import sepolicy
+ 
+ SEUNSHARE = "/usr/sbin/seunshare"
+ SANDBOXSH = "/usr/share/sandbox/sandboxX.sh"
+-PROGNAME = "policycoreutils"
+PROGNAME = "selinux-sandbox"
+ try:
+     import gettext
+     kwargs = {}
+-- 
+2.21.0
+
--- a/SOURCES/0014-Initial-.pot-files-for-gui-python-sandbox.patch
+++ b/SOURCES/0014-Initial-.pot-files-for-gui-python-sandbox.patch
--- a/SOURCES/0016-policycoreutils-setfiles-Improve-description-of-d-sw.patch
+++ b/SOURCES/0016-policycoreutils-setfiles-Improve-description-of-d-sw.patch
@ -0,0 +1,30 @@
+From c8fbb8042852c18775c001999ce949e9b591e381 Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Wed, 21 Mar 2018 08:51:31 +0100
+Subject: [PATCH] policycoreutils/setfiles: Improve description of -d switch
+
+The "-q" switch is becoming obsolete (completely unused in fedora) and
+debug output ("-d" switch) makes sense in any scenario. Therefore both
+options can be specified at once.
+
+Resolves: rhbz#1271327
+---
+ policycoreutils/setfiles/setfiles.8 | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
+index ccaaf4de..a8a76c86 100644
+--- a/policycoreutils/setfiles/setfiles.8
+++ b/policycoreutils/setfiles/setfiles.8
+@@ -57,7 +57,7 @@ check the validity of the contexts against the specified binary policy.
+ .TP
+ .B \-d
+ show what specification matched each file (do not abort validation
+-after ABORT_ON_ERRORS errors).
+after ABORT_ON_ERRORS errors). Not affected by "\-q"
+ .TP
+ .BI \-e \ directory
+ directory to exclude (repeat option for more than one directory).
+-- 
+2.21.0
+
--- a/SOURCES/0017-sepolicy-generate-Handle-more-reserved-port-types.patch
+++ b/SOURCES/0017-sepolicy-generate-Handle-more-reserved-port-types.patch
@ -0,0 +1,71 @@
+From 3073efc112929b535f3a832c6f99e0dbe3af29ca Mon Sep 17 00:00:00 2001
+From: Masatake YAMATO <yamato@redhat.com>
+Date: Thu, 14 Dec 2017 15:57:58 +0900
+Subject: [PATCH] sepolicy-generate: Handle more reserved port types
+
+Currently only reserved_port_t, port_t and hi_reserved_port_t are
+handled as special when making a ports-dictionary.  However, as fas as
+corenetwork.te.in of serefpolicy, unreserved_port_t and
+ephemeral_port_t should be handled in the same way, too.
+
+(Details) I found the need of this change when I was using
+selinux-polgengui.  Though tcp port 12345, which my application may
+use, was given to the gui, selinux-polgengui generates expected te
+file and sh file which didn't utilize the tcp port.
+
+selinux-polgengui checks whether a port given via gui is already typed
+or not.
+
+If it is already typed, selinux-polgengui generates a te file having
+rules to allow the application to use the port. (A)
+
+If not, it seems for me that selinux-polgengui is designed to generate
+a te file having rules to allow the application to own(?) the port;
+and a sh file having a command line to assign the application own type
+to the port. (B)
+
+As we can see the output of `semanage port -l' some of ports for
+specified purpose have types already.  The important point is that the
+rest of ports also have types already:
+
+    hi_reserved_port_t tcp 512-1023
+    hi_reserved_port_t udp 512-1023
+    unreserved_port_t tcp 1024-32767, 61001-65535
+    unreserved_port_t udp 1024-32767, 61001-65535
+    ephemeral_port_t tcp 32768-61000
+    ephemeral_port_t udp 32768-61000
+
+As my patch shows, the original selinux-polgengui ignored
+hi_reserved_port_t; though hi_reserved_port_t is assigned,
+selinux-polgengui considered ports 512-1023 are not used. As the
+result selinux-polgengui generates file sets of (B).
+
+For the purpose of selinux-polgengui, I think unreserved_port_t and
+ephemeral_port_t are treated as the same as hi_reserved_port_t.
+
+Signed-off-by: Masatake YAMATO <yamato@redhat.com>
+
+Fedora only patch:
+https://lore.kernel.org/selinux/20150610.190635.1866127952891120915.yamato@redhat.com/
+---
+ python/sepolicy/sepolicy/generate.py | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py
+index 7175d36b..93caedee 100644
+--- a/python/sepolicy/sepolicy/generate.py
+++ b/python/sepolicy/sepolicy/generate.py
+@@ -100,7 +100,9 @@ def get_all_ports():
+     for p in sepolicy.info(sepolicy.PORT):
+         if p['type'] == "reserved_port_t" or \
+                 p['type'] == "port_t" or \
+-                p['type'] == "hi_reserved_port_t":
+                p['type'] == "hi_reserved_port_t" or \
+                p['type'] == "ephemeral_port_t" or \
+                p['type'] == "unreserved_port_t":
+             continue
+         dict[(p['low'], p['high'], p['protocol'])] = (p['type'], p.get('range'))
+     return dict
+-- 
+2.21.0
+
--- a/SOURCES/0018-semodule-utils-Fix-RESOURCE_LEAK-coverity-scan-defec.patch
+++ b/SOURCES/0018-semodule-utils-Fix-RESOURCE_LEAK-coverity-scan-defec.patch
@ -0,0 +1,24 @@
+From f8602180d042e95947fe0bbd35d261771b347705 Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Thu, 8 Nov 2018 09:20:58 +0100
+Subject: [PATCH] semodule-utils: Fix RESOURCE_LEAK coverity scan defects
+
+---
+ semodule-utils/semodule_package/semodule_package.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/semodule-utils/semodule_package/semodule_package.c b/semodule-utils/semodule_package/semodule_package.c
+index 3515234e..7b75b3fd 100644
+--- a/semodule-utils/semodule_package/semodule_package.c
+++ b/semodule-utils/semodule_package/semodule_package.c
+@@ -74,6 +74,7 @@ static int file_to_data(const char *path, char **data, size_t * len)
+ 	}
+ 	if (!sb.st_size) {
+ 		*len = 0;
+		close(fd);
+ 		return 0;
+ 	}
+ 
+-- 
+2.21.0
+
--- a/SOURCES/0019-sandbox-Use-matchbox-window-manager-instead-of-openb.patch
+++ b/SOURCES/0019-sandbox-Use-matchbox-window-manager-instead-of-openb.patch
@ -0,0 +1,74 @@
+From 89895635ae012d1864a03700054ecc723973b5c0 Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Wed, 18 Jul 2018 09:09:35 +0200
+Subject: [PATCH] sandbox: Use matchbox-window-manager instead of openbox
+
+---
+ sandbox/sandbox     |  4 ++--
+ sandbox/sandbox.8   |  2 +-
+ sandbox/sandboxX.sh | 14 --------------
+ 3 files changed, 3 insertions(+), 17 deletions(-)
+
+diff --git a/sandbox/sandbox b/sandbox/sandbox
+index a12403b3..707959a6 100644
+--- a/sandbox/sandbox
+++ b/sandbox/sandbox
+@@ -268,7 +268,7 @@ class Sandbox:
+             copyfile(f, "/tmp", self.__tmpdir)
+             copyfile(f, "/var/tmp", self.__tmpdir)
+ 
+-    def __setup_sandboxrc(self, wm="/usr/bin/openbox"):
+    def __setup_sandboxrc(self, wm="/usr/bin/matchbox-window-manager"):
+         execfile = self.__homedir + "/.sandboxrc"
+         fd = open(execfile, "w+")
+         if self.__options.session:
+@@ -362,7 +362,7 @@ sandbox [-h] [-l level ] [-[X|M] [-H homedir] [-T tempdir]] [-I includefile ] [-
+ 
+         parser.add_option("-W", "--windowmanager", dest="wm",
+                           type="string",
+-                          default="/usr/bin/openbox",
+                          default="/usr/bin/matchbox-window-manager",
+                           help=_("alternate window manager"))
+ 
+         parser.add_option("-l", "--level", dest="level",
+diff --git a/sandbox/sandbox.8 b/sandbox/sandbox.8
+index d83fee76..90ef4951 100644
+--- a/sandbox/sandbox.8
+++ b/sandbox/sandbox.8
+@@ -77,7 +77,7 @@ Specifies the windowsize when creating an X based Sandbox. The default windowsiz
+ \fB\-W\fR \fB\-\-windowmanager\fR
+ Select alternative window manager to run within 
+ .B sandbox \-X.
+-Default to /usr/bin/openbox.
+Default to /usr/bin/matchbox-window-manager.
+ .TP
+ \fB\-X\fR 
+ Create an X based Sandbox for gui apps, temporary files for
+diff --git a/sandbox/sandboxX.sh b/sandbox/sandboxX.sh
+index 47745280..c211ebc1 100644
+--- a/sandbox/sandboxX.sh
+++ b/sandbox/sandboxX.sh
+@@ -6,20 +6,6 @@ export TITLE="Sandbox $context -- `grep ^#TITLE: ~/.sandboxrc | /usr/bin/cut -b8
+ [ -z $2 ] && export DPI="96" || export DPI="$2"
+ trap "exit 0" HUP
+ 
+-mkdir -p ~/.config/openbox
+-cat > ~/.config/openbox/rc.xml << EOF
+-<openbox_config xmlns="http://openbox.org/3.4/rc"
+-		xmlns:xi="http://www.w3.org/2001/XInclude">
+-<applications>
+-  <application class="*">
+-    <decor>no</decor>
+-    <desktop>all</desktop>
+-    <maximized>yes</maximized>
+-  </application>
+-</applications>
+-</openbox_config>
+-EOF
+-
+ (/usr/bin/Xephyr -resizeable -title "$TITLE" -terminate -reset -screen $SCREENSIZE -dpi $DPI -nolisten tcp -displayfd 5 5>&1 2>/dev/null) | while read D; do
+     export DISPLAY=:$D
+     cat > ~/seremote << __EOF
+-- 
+2.21.0
+
--- a/SOURCES/0020-python-Use-ipaddress-instead-of-IPy.patch
+++ b/SOURCES/0020-python-Use-ipaddress-instead-of-IPy.patch
@ -0,0 +1,45 @@
+From b2512e2a92a33360639a3459039cdf2e685655a8 Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Mon, 3 Dec 2018 14:40:09 +0100
+Subject: [PATCH] python: Use ipaddress instead of IPy
+
+ipaddress module was added in python 3.3 and this allows us to drop python3-IPy
+---
+ python/semanage/seobject.py | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
+index b90b1070..58497e3b 100644
+--- a/python/semanage/seobject.py
+++ b/python/semanage/seobject.py
+@@ -32,7 +32,7 @@ from semanage import *
+ PROGNAME = "selinux-python"
+ import sepolicy
+ import setools
+-from IPy import IP
+import ipaddress
+ 
+ try:
+     import gettext
+@@ -1851,13 +1851,13 @@ class nodeRecords(semanageRecords):
+ 
+         # verify valid comination
+         if len(mask) == 0 or mask[0] == "/":
+-            i = IP(addr + mask)
+-            newaddr = i.strNormal(0)
+-            newmask = str(i.netmask())
+-            if newmask == "0.0.0.0" and i.version() == 6:
+            i = ipaddress.ip_network(addr + mask)
+            newaddr = str(i.network_address)
+            newmask = str(i.netmask)
+            if newmask == "0.0.0.0" and i.version == 6:
+                 newmask = "::"
+ 
+-            protocol = "ipv%d" % i.version()
+            protocol = "ipv%d" % i.version
+ 
+         try:
+             newprotocol = self.protocol.index(protocol)
+-- 
+2.21.0
+
--- a/SOURCES/0021-python-semanage-Do-not-traceback-when-the-default-po.patch
+++ b/SOURCES/0021-python-semanage-Do-not-traceback-when-the-default-po.patch
@ -0,0 +1,93 @@
+From 5938d18536f4c0a76521d1f0721e981e6570b012 Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Thu, 4 Apr 2019 23:02:56 +0200
+Subject: [PATCH] python/semanage: Do not traceback when the default policy is
+ not available
+
+"import seobject" causes "import sepolicy" which crashes when the system policy
+is not available. It's better to provide an error message instead.
+
+Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
+---
+ python/semanage/semanage | 37 +++++++++++++++++++++----------------
+ 1 file changed, 21 insertions(+), 16 deletions(-)
+
+diff --git a/python/semanage/semanage b/python/semanage/semanage
+index 56db3e0d..4c766ae3 100644
+--- a/python/semanage/semanage
+++ b/python/semanage/semanage
+@@ -25,7 +25,6 @@
+ 
+ import traceback
+ import argparse
+-import seobject
+ import sys
+ PROGNAME = "selinux-python"
+ try:
+@@ -129,21 +128,6 @@ class SetImportFile(argparse.Action):
+                 sys.exit(1)
+         setattr(namespace, self.dest, values)
+ 
+-# define dictonary for seobject OBEJCTS
+-object_dict = {
+-    'login': seobject.loginRecords,
+-    'user': seobject.seluserRecords,
+-    'port': seobject.portRecords,
+-    'module': seobject.moduleRecords,
+-    'interface': seobject.interfaceRecords,
+-    'node': seobject.nodeRecords,
+-    'fcontext': seobject.fcontextRecords,
+-    'boolean': seobject.booleanRecords,
+-    'permissive': seobject.permissiveRecords,
+-    'dontaudit': seobject.dontauditClass,
+-    'ibpkey': seobject.ibpkeyRecords,
+-    'ibendport': seobject.ibendportRecords
+-}
+ 
+ def generate_custom_usage(usage_text, usage_dict):
+     # generate custom usage from given text and dictonary
+@@ -608,6 +592,7 @@ def setupInterfaceParser(subparsers):
+ 
+ 
+ def handleModule(args):
+    import seobject
+     OBJECT = seobject.moduleRecords(args)
+     if args.action_add:
+         OBJECT.add(args.action_add[0], args.priority)
+@@ -846,6 +831,7 @@ def mkargv(line):
+ 
+ 
+ def handleImport(args):
+    import seobject
+     trans = seobject.semanageRecords(args)
+     trans.start()
+ 
+@@ -887,6 +873,25 @@ def createCommandParser():
+     #To add a new subcommand define the parser for it in a function above and call it here.
+     subparsers = commandParser.add_subparsers(dest='subcommand')
+     subparsers.required = True
+
+    import seobject
+    # define dictonary for seobject OBEJCTS
+    global object_dict
+    object_dict = {
+        'login': seobject.loginRecords,
+        'user': seobject.seluserRecords,
+        'port': seobject.portRecords,
+        'module': seobject.moduleRecords,
+        'interface': seobject.interfaceRecords,
+        'node': seobject.nodeRecords,
+        'fcontext': seobject.fcontextRecords,
+        'boolean': seobject.booleanRecords,
+        'permissive': seobject.permissiveRecords,
+        'dontaudit': seobject.dontauditClass,
+        'ibpkey': seobject.ibpkeyRecords,
+        'ibendport': seobject.ibendportRecords
+    }
+
+     setupImportParser(subparsers)
+     setupExportParser(subparsers)
+     setupLoginParser(subparsers)
+-- 
+2.21.0
+
--- a/SOURCES/0022-policycoreutils-fixfiles-Fix-B-F-onboot.patch
+++ b/SOURCES/0022-policycoreutils-fixfiles-Fix-B-F-onboot.patch
@ -0,0 +1,108 @@
+From 99582e3bf63475b7af5793bb9230e88d847dc7c8 Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Tue, 2 Jul 2019 17:11:32 +0200
+Subject: [PATCH] policycoreutils/fixfiles: Fix [-B] [-F] onboot
+
+Commit 6e289bb7bf3d ("policycoreutils: fixfiles: remove bad modes of "relabel"
+command") added "$RESTORE_MODE" != DEFAULT test when onboot is used. It makes
+`fixfiles -B onboot` to show usage instead of updating /.autorelabel
+
+The code is restructured to handle -B for different modes correctly.
+
+Fixes:
+    # fixfiles -B onboot
+    Usage: /usr/sbin/fixfiles [-v] [-F] [-f] relabel
+    ...
+
+Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
+---
+ policycoreutils/scripts/fixfiles | 29 +++++++++++++++--------------
+ 1 file changed, 15 insertions(+), 14 deletions(-)
+
+diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
+index 53d28c7b..9dd44213 100755
+--- a/policycoreutils/scripts/fixfiles
+++ b/policycoreutils/scripts/fixfiles
+@@ -112,7 +112,7 @@ VERBOSE="-p"
+ FORCEFLAG=""
+ RPMFILES=""
+ PREFC=""
+-RESTORE_MODE="DEFAULT"
+RESTORE_MODE=""
+ SETFILES=/sbin/setfiles
+ RESTORECON=/sbin/restorecon
+ FILESYSTEMSRW=`get_rw_labeled_mounts`
+@@ -214,16 +214,17 @@ restore () {
+ OPTION=$1
+ shift
+ 
+-case "$RESTORE_MODE" in
+-    PREFC)
+-	diff_filecontext $*
+-	return
+-    ;;
+-    BOOTTIME)
+# [-B | -N time ]
+if [ -z "$BOOTTIME" ]; then
+ 	newer $BOOTTIME $*
+ 	return
+-    ;;
+-esac
+fi
+
+# -C PREVIOUS_FILECONTEXT
+if [ "$RESTORE_MODE" == PREFC ]; then
+	diff_filecontext $*
+	return
+fi
+ 
+ [ -x /usr/sbin/genhomedircon ] && /usr/sbin/genhomedircon
+ 
+@@ -239,7 +240,7 @@ case "$RESTORE_MODE" in
+     FILEPATH)
+ 	${RESTORECON} ${VERBOSE} ${EXCLUDEDIRS} ${FORCEFLAG} $* -R -- "$FILEPATH"
+     ;;
+-    DEFAULT)
+    *)
+ 	if [ -n "${FILESYSTEMSRW}" ]; then
+ 	    LogReadOnly
+ 	    echo "${OPTION}ing `echo ${FILESYSTEMSRW}`"
+@@ -272,7 +273,7 @@ fullrelabel() {
+ 
+ 
+ relabel() {
+-    if [ "$RESTORE_MODE" != DEFAULT ]; then
+    if [ -n "$RESTORE_MODE" -a "$RESTORE_MODE" != DEFAULT ]; then
+ 	usage
+ 	exit 1
+     fi
+@@ -306,7 +307,7 @@ case "$1" in
+     verify) restore Verify -n;;
+     relabel) relabel;;
+     onboot)
+-	if [ "$RESTORE_MODE" != DEFAULT ]; then
+	if [ -n "$RESTORE_MODE" -a "$RESTORE_MODE" != DEFAULT ]; then
+ 	    usage
+ 	    exit 1
+ 	fi
+@@ -344,7 +345,7 @@ if [ $# -eq 0 ]; then
+ fi
+ 
+ set_restore_mode() {
+-	if [ "$RESTORE_MODE" != DEFAULT ]; then
+	if [ -n "$RESTORE_MODE" ]; then
+ 		# can't specify two different modes
+ 		usage
+ 		exit 1
+@@ -357,7 +358,7 @@ while getopts "N:BC:FfR:l:v" i; do
+     case "$i" in
+ 	B)
+ 		BOOTTIME=`/bin/who -b | awk '{print $3}'`
+-		set_restore_mode BOOTTIME
+		set_restore_mode DEFAULT
+ 		;;
+ 	N)
+ 		BOOTTIME=$OPTARG
+-- 
+2.21.0
+
--- a/SOURCES/0023-policycoreutils-fixfiles-Force-full-relabel-when-SEL.patch
+++ b/SOURCES/0023-policycoreutils-fixfiles-Force-full-relabel-when-SEL.patch
@ -0,0 +1,33 @@
+From 9bcf8ad7b9b6d8d761f7d097196b2b9bc114fa0a Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Tue, 2 Jul 2019 17:12:07 +0200
+Subject: [PATCH] policycoreutils/fixfiles: Force full relabel when SELinux is
+ disabled
+
+The previous check used getfilecon to check whether / slash contains a label,
+but getfilecon fails only when SELinux is disabled. Therefore it's better to
+check this using selinuxenabled.
+
+Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
+---
+ policycoreutils/scripts/fixfiles | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
+index 9dd44213..a9d27d13 100755
+--- a/policycoreutils/scripts/fixfiles
+++ b/policycoreutils/scripts/fixfiles
+@@ -314,8 +314,8 @@ case "$1" in
+ 	> /.autorelabel || exit $?
+ 	[ -z "$FORCEFLAG" ] || echo -n "$FORCEFLAG " >> /.autorelabel
+ 	[ -z "$BOOTTIME" ] || echo -N $BOOTTIME >> /.autorelabel
+-	# Force full relabel if / does not have a label on it
+-	getfilecon / > /dev/null 2>&1  || echo -F >/.autorelabel
+	# Force full relabel if SELinux is not enabled
+	selinuxenabled || echo -F > /.autorelabel
+ 	echo "System will relabel on next boot"
+ 	;;
+     *)
+-- 
+2.21.0
+
--- a/SOURCES/0024-policycoreutils-fixfiles-Fix-unbound-variable-proble.patch
+++ b/SOURCES/0024-policycoreutils-fixfiles-Fix-unbound-variable-proble.patch
@ -0,0 +1,32 @@
+From 7383f8fbab82826de21d3013a43680867642e49e Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Wed, 21 Aug 2019 17:43:25 +0200
+Subject: [PATCH] policycoreutils/fixfiles: Fix unbound variable problem
+
+Fix a typo introduced in commit d3f8b2c3cd909 ("policycoreutils/fixfiles: Fix
+[-B] [-F] onboot"), which broke  "fixfiles relabel":
+
+    #fixfiles relabel
+    /sbin/fixfiles: line 151: $1: unbound variable
+
+Resolves: rhbz#1743213
+---
+ policycoreutils/scripts/fixfiles | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
+index a9d27d13..df0042aa 100755
+--- a/policycoreutils/scripts/fixfiles
+++ b/policycoreutils/scripts/fixfiles
+@@ -215,7 +215,7 @@ OPTION=$1
+ shift
+ 
+ # [-B | -N time ]
+-if [ -z "$BOOTTIME" ]; then
+if [ -n "$BOOTTIME" ]; then
+ 	newer $BOOTTIME $*
+ 	return
+ fi
+-- 
+2.21.0
+
--- a/SOURCES/0025-gui-Fix-remove-module-in-system-config-selinux.patch
+++ b/SOURCES/0025-gui-Fix-remove-module-in-system-config-selinux.patch
@ -0,0 +1,38 @@
+From f6c67c02f25d3a8971dcc5667121236fab85dd65 Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Thu, 29 Aug 2019 08:58:20 +0200
+Subject: [PATCH] gui: Fix remove module in system-config-selinux
+
+When a user tried to remove a policy module with priority other than 400 via
+GUI, it failed with a message:
+
+libsemanage.semanage_direct_remove_key: Unable to remove module somemodule at priority 400. (No such file or directory).
+
+This is fixed by calling "semodule -x PRIORITY -r NAME" instead of
+"semodule -r NAME".
+
+From Jono Hein <fredwacko40@hotmail.com>
+Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
+---
+ gui/modulesPage.py | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/gui/modulesPage.py b/gui/modulesPage.py
+index 26ac5404..35a0129b 100644
+--- a/gui/modulesPage.py
+++ b/gui/modulesPage.py
+@@ -125,9 +125,10 @@ class modulesPage(semanagePage):
+     def delete(self):
+         store, iter = self.view.get_selection().get_selected()
+         module = store.get_value(iter, 0)
+        priority = store.get_value(iter, 1)
+         try:
+             self.wait()
+-            status, output = getstatusoutput("semodule -r %s" % module)
+            status, output = getstatusoutput("semodule -X %s -r %s" % (priority, module))
+             self.ready()
+             if status != 0:
+                 self.error(output)
+-- 
+2.21.0
+
--- a/SOURCES/0026-python-semanage-Do-not-use-default-s0-range-in-seman.patch
+++ b/SOURCES/0026-python-semanage-Do-not-use-default-s0-range-in-seman.patch
@ -0,0 +1,30 @@
+From c2e942fc452bff06cc5ed9017afe169c6941f4e4 Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Tue, 3 Sep 2019 15:17:27 +0200
+Subject: [PATCH] python/semanage: Do not use default s0 range in "semanage
+ login -a"
+
+Using the "s0" default means that new login mappings are always added with "s0"
+range instead of the range of SELinux user.
+
+Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
+---
+ python/semanage/semanage | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/python/semanage/semanage b/python/semanage/semanage
+index 4c766ae3..fa78afce 100644
+--- a/python/semanage/semanage
+++ b/python/semanage/semanage
+@@ -221,7 +221,7 @@ def parser_add_level(parser, name):
+ 
+ 
+ def parser_add_range(parser, name):
+-    parser.add_argument('-r', '--range', default="s0",
+    parser.add_argument('-r', '--range', default='',
+                         help=_('''
+ MLS/MCS Security Range (MLS/MCS Systems only)
+ SELinux Range  for SELinux login mapping
+-- 
+2.21.0
+
--- a/SOURCES/0027-policycoreutils-fixfiles-Fix-verify-option.patch
+++ b/SOURCES/0027-policycoreutils-fixfiles-Fix-verify-option.patch
@ -0,0 +1,33 @@
+From 4733a594c5df14f64293d19f16498e68dc5e3a98 Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Tue, 24 Sep 2019 08:41:30 +0200
+Subject: [PATCH] policycoreutils/fixfiles: Fix "verify" option
+
+"restorecon -n" (used in the "restore" function) has to be used with
+"-v" to display the files whose labels would be changed.
+
+Fixes:
+   Fixfiles verify does not report misslabelled files unless "-v" option is
+   used.
+
+Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
+---
+ policycoreutils/scripts/fixfiles | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
+index df0042aa..be19e56c 100755
+--- a/policycoreutils/scripts/fixfiles
+++ b/policycoreutils/scripts/fixfiles
+@@ -304,7 +304,7 @@ process() {
+ case "$1" in
+     restore) restore Relabel;;
+     check) VERBOSE="-v"; restore Check -n;;
+-    verify) restore Verify -n;;
+    verify) VERBOSE="-v"; restore Verify -n;;
+     relabel) relabel;;
+     onboot)
+ 	if [ -n "$RESTORE_MODE" -a "$RESTORE_MODE" != DEFAULT ]; then
+-- 
+2.21.0
+
--- a/SOURCES/0028-python-semanage-Improve-handling-of-permissive-state.patch
+++ b/SOURCES/0028-python-semanage-Improve-handling-of-permissive-state.patch
@ -0,0 +1,102 @@
+From 0803fcb2c014b2cedf8f4d92b80fc382916477ee Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Fri, 27 Sep 2019 16:13:47 +0200
+Subject: [PATCH] python/semanage: Improve handling of "permissive" statements
+
+- Add "customized" method to permissiveRecords which is than used for
+  "semanage permissive --extract" and "semanage export"
+- Enable "semanage permissive --deleteall" (already implemented)
+- Add "permissive" to the list of modules exported using
+  "semanage export"
+- Update "semanage permissive" man page
+
+Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
+---
+ python/semanage/semanage              | 11 ++++++++---
+ python/semanage/semanage-permissive.8 |  8 +++++++-
+ python/semanage/seobject.py           |  3 +++
+ 3 files changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/python/semanage/semanage b/python/semanage/semanage
+index fa78afce..b2bd9df9 100644
+--- a/python/semanage/semanage
+++ b/python/semanage/semanage
+@@ -722,6 +722,11 @@ def handlePermissive(args):
+ 
+     if args.action == "list":
+         OBJECT.list(args.noheading)
+    elif args.action == "deleteall":
+        OBJECT.deleteall()
+    elif args.action == "extract":
+        for i in OBJECT.customized():
+            print("permissive %s" % str(i))
+     elif args.type is not None:
+         if args.action == "add":
+             OBJECT.add(args.type)
+@@ -737,9 +742,9 @@ def setupPermissiveParser(subparsers):
+     pgroup = permissiveParser.add_mutually_exclusive_group(required=True)
+     parser_add_add(pgroup, "permissive")
+     parser_add_delete(pgroup, "permissive")
+    parser_add_deleteall(pgroup, "permissive")
+    parser_add_extract(pgroup, "permissive")
+     parser_add_list(pgroup, "permissive")
+-    #TODO: probably should be also added => need to implement own option handling
+-    #parser_add_deleteall(pgroup)
+ 
+     parser_add_noheading(permissiveParser, "permissive")
+     parser_add_noreload(permissiveParser, "permissive")
+@@ -763,7 +768,7 @@ def setupDontauditParser(subparsers):
+ 
+ 
+ def handleExport(args):
+-    manageditems = ["boolean", "login", "interface", "user", "port", "node", "fcontext", "module", "ibendport", "ibpkey"]
+    manageditems = ["boolean", "login", "interface", "user", "port", "node", "fcontext", "module", "ibendport", "ibpkey", "permissive"]
+     for i in manageditems:
+         print("%s -D" % i)
+     for i in manageditems:
+diff --git a/python/semanage/semanage-permissive.8 b/python/semanage/semanage-permissive.8
+index 1999a451..5c3364fa 100644
+--- a/python/semanage/semanage-permissive.8
+++ b/python/semanage/semanage-permissive.8
+@@ -2,7 +2,7 @@
+ .SH "NAME"
+ .B semanage\-permissive \- SELinux Policy Management permissive mapping tool
+ .SH "SYNOPSIS"
+-.B semanage permissive [\-h] (\-a | \-d | \-l) [\-n] [\-N] [\-S STORE] [type]
+.B semanage permissive [\-h] [\-n] [\-N] [\-S STORE] (\-\-add TYPE | \-\-delete TYPE | \-\-deleteall | \-\-extract | \-\-list)
+ 
+ .SH "DESCRIPTION"
+ semanage is used to configure certain elements of SELinux policy without requiring modification to or recompilation from policy sources.  semanage permissive adds or removes a SELinux Policy permissive module.
+@@ -18,9 +18,15 @@ Add a record of the specified object type
+ .I   \-d, \-\-delete
+ Delete a record of the specified object type
+ .TP
+.I   \-D, \-\-deleteall
+Remove all local customizations of permissive domains
+.TP
+ .I   \-l, \-\-list
+ List records of the specified object type
+ .TP
+.I   \-E, \-\-extract
+Extract customizable commands, for use within a transaction
+.TP
+ .I   \-n, \-\-noheading
+ Do not print heading when listing the specified object type
+ .TP
+diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
+index 58497e3b..3959abc8 100644
+--- a/python/semanage/seobject.py
+++ b/python/semanage/seobject.py
+@@ -478,6 +478,9 @@ class permissiveRecords(semanageRecords):
+                 l.append(name.split("permissive_")[1])
+         return l
+ 
+    def customized(self):
+        return ["-a %s" % x for x in sorted(self.get_all())]
+
+     def list(self, heading=1, locallist=0):
+         all = [y["name"] for y in [x for x in sepolicy.info(sepolicy.TYPE) if x["permissive"]]]
+         if len(all) == 0:
+-- 
+2.21.0
+
--- a/SOURCES/0029-python-semanage-fix-moduleRecords.customized.patch
+++ b/SOURCES/0029-python-semanage-fix-moduleRecords.customized.patch
@ -0,0 +1,41 @@
+From 7cc31c4799dd94ed516a39d853744bd1ffb6dc69 Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Mon, 30 Sep 2019 09:49:04 +0200
+Subject: [PATCH] python/semanage: fix moduleRecords.customized()
+
+Return value of "customized" has to be iterable.
+
+Fixes:
+   "semanage export" with no modules in the system (eg. monolithic policy)
+   crashes:
+
+   Traceback (most recent call last):
+     File "/usr/sbin/semanage", line 970, in <module>
+       do_parser()
+     File "/usr/sbin/semanage", line 949, in do_parser
+       args.func(args)
+     File "/usr/sbin/semanage", line 771, in handleExport
+       for c in OBJECT.customized():
+   TypeError: 'NoneType' object is not iterable
+
+Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
+---
+ python/semanage/seobject.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
+index 3959abc8..16edacaa 100644
+--- a/python/semanage/seobject.py
+++ b/python/semanage/seobject.py
+@@ -380,7 +380,7 @@ class moduleRecords(semanageRecords):
+     def customized(self):
+         all = self.get_all()
+         if len(all) == 0:
+-            return
+            return []
+         return ["-d %s" % x[0] for x in [t for t in all if t[1] == 0]]
+ 
+     def list(self, heading=1, locallist=0):
+-- 
+2.21.0
+
--- a/SOURCES/0030-python-semanage-Add-support-for-DCCP-and-SCTP-protoc.patch
+++ b/SOURCES/0030-python-semanage-Add-support-for-DCCP-and-SCTP-protoc.patch
@ -0,0 +1,45 @@
+From 7cbfcec89a6972f9c700687ed3cef25ff0846461 Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Tue, 8 Oct 2019 14:22:13 +0200
+Subject: [PATCH] python/semanage: Add support for DCCP and SCTP protocols
+
+Fixes:
+   # semanage port -a -p sctp -t port_t 1234
+   ValueError: Protocol udp or tcp is required
+   # semanage port -d -p sctp -t port_t 1234
+   ValueError: Protocol udp or tcp is required
+
+Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
+---
+ python/semanage/seobject.py | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
+index 16edacaa..70ebfd08 100644
+--- a/python/semanage/seobject.py
+++ b/python/semanage/seobject.py
+@@ -1058,13 +1058,15 @@ class portRecords(semanageRecords):
+             pass
+ 
+     def __genkey(self, port, proto):
+-        if proto == "tcp":
+-            proto_d = SEMANAGE_PROTO_TCP
+        protocols = {"tcp": SEMANAGE_PROTO_TCP,
+                     "udp": SEMANAGE_PROTO_UDP,
+                     "sctp": SEMANAGE_PROTO_SCTP,
+                     "dccp": SEMANAGE_PROTO_DCCP}
+
+        if proto in protocols.keys():
+            proto_d = protocols[proto]
+         else:
+-            if proto == "udp":
+-                proto_d = SEMANAGE_PROTO_UDP
+-            else:
+-                raise ValueError(_("Protocol udp or tcp is required"))
+            raise ValueError(_("Protocol has to be one of udp, tcp, dccp or sctp"))
+         if port == "":
+             raise ValueError(_("Port is required"))
+ 
+-- 
+2.21.0
+
--- a/SOURCES/0031-dbus-Fix-FileNotFoundError-in-org.selinux.relabel_on.patch
+++ b/SOURCES/0031-dbus-Fix-FileNotFoundError-in-org.selinux.relabel_on.patch
@ -0,0 +1,40 @@
+From 6e5ccf2dd3329b400b70b7806b9c6128c5c50995 Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Fri, 15 Nov 2019 09:15:49 +0100
+Subject: [PATCH] dbus: Fix FileNotFoundError in org.selinux.relabel_on_boot
+
+When org.selinux.relabel_on_boot(0) was called twice, it failed with
+FileNotFoundError.
+
+Fixes:
+    $ dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.relabel_on_boot int64:1
+    method return sender=:1.53 -> dest=:1.54 reply_serial=2
+    $ dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.relabel_on_boot int64:0
+    method return sender=:1.53 -> dest=:1.55 reply_serial=2
+    $ dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.relabel_on_boot int64:0
+    Error org.freedesktop.DBus.Python.FileNotFoundError: FileNotFoundError: [Errno 2] No such file or directory: '/.autorelabel'
+
+Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
+---
+ dbus/selinux_server.py | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/dbus/selinux_server.py b/dbus/selinux_server.py
+index b9debc071485..be4f4557a9fa 100644
+--- a/dbus/selinux_server.py
+++ b/dbus/selinux_server.py
+@@ -85,7 +85,10 @@ class selinux_server(slip.dbus.service.Object):
+             fd = open("/.autorelabel", "w")
+             fd.close()
+         else:
+-            os.unlink("/.autorelabel")
+            try:
+                os.unlink("/.autorelabel")
+            except FileNotFoundError:
+                pass
+ 
+     def write_selinux_config(self, enforcing=None, policy=None):
+         path = selinux.selinux_path() + "config"
+-- 
+2.23.0
+
--- a/SOURCES/0032-restorecond-Fix-redundant-console-log-output-error.patch
+++ b/SOURCES/0032-restorecond-Fix-redundant-console-log-output-error.patch
@ -0,0 +1,200 @@
+From 76371721bafed56efcb7a83b3fa3285383ede5b7 Mon Sep 17 00:00:00 2001
+From: Baichuan Kong <kongbaichuan@huawei.com>
+Date: Thu, 14 Nov 2019 10:48:07 +0800
+Subject: [PATCH] restorecond: Fix redundant console log output error
+
+When starting restorecond without any option the following redundant
+console log is outputed:
+
+/dev/log 100.0%
+/var/volatile/run/syslogd.pid 100.0%
+...
+
+This is caused by two global variables of same name r_opts. When
+executes r_opts = opts in restore_init(), it originally intends
+to assign the address of struct r_opts in "restorecond.c" to the
+pointer *r_opts in "restore.c".
+
+However, the address is assigned to the struct r_opts and covers
+the value of low eight bytes in it. That causes unexpected value
+of member varibale 'nochange' and 'verbose' in struct r_opts, thus
+affects value of 'restorecon_flags' and executes unexpected operations
+when restorecon the files such as the redundant console log output or
+file label nochange.
+
+Cause restorecond/restore.c is copied from policycoreutils/setfiles,
+which share the same pattern. It also has potential risk to generate
+same problems, So fix it in case.
+
+Signed-off-by: Baichuan Kong <kongbaichuan@huawei.com>
+
+(cherry-picked from SElinuxProject
+commit ad2208ec220f55877a4d31084be2b4d6413ee082)
+
+Resolves: rhbz#1626468
+---
+ policycoreutils/setfiles/restore.c | 42 ++++++++++++++----------------
+ restorecond/restore.c              | 40 +++++++++++++---------------
+ 2 files changed, 37 insertions(+), 45 deletions(-)
+
+diff --git a/policycoreutils/setfiles/restore.c b/policycoreutils/setfiles/restore.c
+index 9dea5656..d3335d1a 100644
+--- a/policycoreutils/setfiles/restore.c
+++ b/policycoreutils/setfiles/restore.c
+@@ -17,40 +17,37 @@
+ char **exclude_list;
+ int exclude_count;
+ 
+-struct restore_opts *r_opts;
+-
+ void restore_init(struct restore_opts *opts)
+ {
+ 	int rc;
+ 
+-	r_opts = opts;
+ 	struct selinux_opt selinux_opts[] = {
+-		{ SELABEL_OPT_VALIDATE, r_opts->selabel_opt_validate },
+-		{ SELABEL_OPT_PATH, r_opts->selabel_opt_path },
+-		{ SELABEL_OPT_DIGEST, r_opts->selabel_opt_digest }
+		{ SELABEL_OPT_VALIDATE, opts->selabel_opt_validate },
+		{ SELABEL_OPT_PATH, opts->selabel_opt_path },
+		{ SELABEL_OPT_DIGEST, opts->selabel_opt_digest }
+ 	};
+ 
+-	r_opts->hnd = selabel_open(SELABEL_CTX_FILE, selinux_opts, 3);
+-	if (!r_opts->hnd) {
+-		perror(r_opts->selabel_opt_path);
+	opts->hnd = selabel_open(SELABEL_CTX_FILE, selinux_opts, 3);
+	if (!opts->hnd) {
+		perror(opts->selabel_opt_path);
+ 		exit(1);
+ 	}
+ 
+-	r_opts->restorecon_flags = 0;
+-	r_opts->restorecon_flags = r_opts->nochange | r_opts->verbose |
+-			   r_opts->progress | r_opts->set_specctx  |
+-			   r_opts->add_assoc | r_opts->ignore_digest |
+-			   r_opts->recurse | r_opts->userealpath |
+-			   r_opts->xdev | r_opts->abort_on_error |
+-			   r_opts->syslog_changes | r_opts->log_matches |
+-			   r_opts->ignore_noent | r_opts->ignore_mounts |
+-			   r_opts->mass_relabel;
+	opts->restorecon_flags = 0;
+	opts->restorecon_flags = opts->nochange | opts->verbose |
+			   opts->progress | opts->set_specctx  |
+			   opts->add_assoc | opts->ignore_digest |
+			   opts->recurse | opts->userealpath |
+			   opts->xdev | opts->abort_on_error |
+			   opts->syslog_changes | opts->log_matches |
+			   opts->ignore_noent | opts->ignore_mounts |
+			   opts->mass_relabel;
+ 
+ 	/* Use setfiles, restorecon and restorecond own handles */
+-	selinux_restorecon_set_sehandle(r_opts->hnd);
+	selinux_restorecon_set_sehandle(opts->hnd);
+ 
+-	if (r_opts->rootpath) {
+-		rc = selinux_restorecon_set_alt_rootpath(r_opts->rootpath);
+	if (opts->rootpath) {
+		rc = selinux_restorecon_set_alt_rootpath(opts->rootpath);
+ 		if (rc) {
+ 			fprintf(stderr,
+ 				"selinux_restorecon_set_alt_rootpath error: %s.\n",
+@@ -81,7 +78,6 @@ int process_glob(char *name, struct restore_opts *opts)
+ 	size_t i = 0;
+ 	int len, rc, errors;
+ 
+-	r_opts = opts;
+ 	memset(&globbuf, 0, sizeof(globbuf));
+ 
+ 	errors = glob(name, GLOB_TILDE | GLOB_PERIOD |
+@@ -96,7 +92,7 @@ int process_glob(char *name, struct restore_opts *opts)
+ 		if (len > 0 && strcmp(&globbuf.gl_pathv[i][len], "/..") == 0)
+ 			continue;
+ 		rc = selinux_restorecon(globbuf.gl_pathv[i],
+-					r_opts->restorecon_flags);
+					opts->restorecon_flags);
+ 		if (rc < 0)
+ 			errors = rc;
+ 	}
+diff --git a/restorecond/restore.c b/restorecond/restore.c
+index f6e30001..b93b5fdb 100644
+--- a/restorecond/restore.c
+++ b/restorecond/restore.c
+@@ -12,39 +12,36 @@
+ char **exclude_list;
+ int exclude_count;
+ 
+-struct restore_opts *r_opts;
+-
+ void restore_init(struct restore_opts *opts)
+ {
+ 	int rc;
+ 
+-	r_opts = opts;
+ 	struct selinux_opt selinux_opts[] = {
+-		{ SELABEL_OPT_VALIDATE, r_opts->selabel_opt_validate },
+-		{ SELABEL_OPT_PATH, r_opts->selabel_opt_path },
+-		{ SELABEL_OPT_DIGEST, r_opts->selabel_opt_digest }
+		{ SELABEL_OPT_VALIDATE, opts->selabel_opt_validate },
+		{ SELABEL_OPT_PATH, opts->selabel_opt_path },
+		{ SELABEL_OPT_DIGEST, opts->selabel_opt_digest }
+ 	};
+ 
+-	r_opts->hnd = selabel_open(SELABEL_CTX_FILE, selinux_opts, 3);
+-	if (!r_opts->hnd) {
+-		perror(r_opts->selabel_opt_path);
+	opts->hnd = selabel_open(SELABEL_CTX_FILE, selinux_opts, 3);
+	if (!opts->hnd) {
+		perror(opts->selabel_opt_path);
+ 		exit(1);
+ 	}
+ 
+-	r_opts->restorecon_flags = 0;
+-	r_opts->restorecon_flags = r_opts->nochange | r_opts->verbose |
+-			   r_opts->progress | r_opts->set_specctx  |
+-			   r_opts->add_assoc | r_opts->ignore_digest |
+-			   r_opts->recurse | r_opts->userealpath |
+-			   r_opts->xdev | r_opts->abort_on_error |
+-			   r_opts->syslog_changes | r_opts->log_matches |
+-			   r_opts->ignore_noent | r_opts->ignore_mounts;
+	opts->restorecon_flags = 0;
+	opts->restorecon_flags = opts->nochange | opts->verbose |
+			   opts->progress | opts->set_specctx  |
+			   opts->add_assoc | opts->ignore_digest |
+			   opts->recurse | opts->userealpath |
+			   opts->xdev | opts->abort_on_error |
+			   opts->syslog_changes | opts->log_matches |
+			   opts->ignore_noent | opts->ignore_mounts;
+ 
+ 	/* Use setfiles, restorecon and restorecond own handles */
+-	selinux_restorecon_set_sehandle(r_opts->hnd);
+	selinux_restorecon_set_sehandle(opts->hnd);
+ 
+-	if (r_opts->rootpath) {
+-		rc = selinux_restorecon_set_alt_rootpath(r_opts->rootpath);
+	if (opts->rootpath) {
+		rc = selinux_restorecon_set_alt_rootpath(opts->rootpath);
+ 		if (rc) {
+ 			fprintf(stderr,
+ 				"selinux_restorecon_set_alt_rootpath error: %s.\n",
+@@ -75,7 +72,6 @@ int process_glob(char *name, struct restore_opts *opts)
+ 	size_t i = 0;
+ 	int len, rc, errors;
+ 
+-	r_opts = opts;
+ 	memset(&globbuf, 0, sizeof(globbuf));
+ 
+ 	errors = glob(name, GLOB_TILDE | GLOB_PERIOD |
+@@ -90,7 +86,7 @@ int process_glob(char *name, struct restore_opts *opts)
+ 		if (len > 0 && strcmp(&globbuf.gl_pathv[i][len], "/..") == 0)
+ 			continue;
+ 		rc = selinux_restorecon(globbuf.gl_pathv[i],
+-					r_opts->restorecon_flags);
+					opts->restorecon_flags);
+ 		if (rc < 0)
+ 			errors = rc;
+ 	}
+-- 
+2.21.0
+
--- a/SOURCES/0033-python-semanage-empty-stdout-before-exiting-on-Broke.patch
+++ b/SOURCES/0033-python-semanage-empty-stdout-before-exiting-on-Broke.patch
@ -0,0 +1,55 @@
+From 0bed778c53a4f93b1b092b3db33e8c36aabfa39d Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Tue, 5 Jan 2021 17:00:21 +0100
+Subject: [PATCH] python/semanage: empty stdout before exiting on
+ BrokenPipeError
+
+Empty stdout buffer before exiting when BrokenPipeError is
+encountered. Otherwise python will flush the bufer during exit, which
+may trigger the exception again.
+https://docs.python.org/3/library/signal.html#note-on-sigpipe
+
+Fixes:
+   #semanage fcontext -l | egrep -q -e '^/home'
+   BrokenPipeError: [Errno 32] Broken pipe
+   Exception ignored in: <_io.TextIOWrapper name='<stdout>' mode='w' encoding='UTF-8'>
+   BrokenPipeError: [Errno 32] Broken pipe
+
+Note that the error above only appears occasionally (usually only the
+first line is printed).
+
+Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
+Acked-by: Nicolas Iooss <nicolas.iooss@m4x.org>
+---
+ python/semanage/semanage | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/python/semanage/semanage b/python/semanage/semanage
+index b2bd9df9..1abe3536 100644
+--- a/python/semanage/semanage
+++ b/python/semanage/semanage
+@@ -26,6 +26,7 @@
+ import traceback
+ import argparse
+ import sys
+import os
+ PROGNAME = "selinux-python"
+ try:
+     import gettext
+@@ -953,6 +954,13 @@ def do_parser():
+         args = commandParser.parse_args(make_args(sys.argv))
+         args.func(args)
+         sys.exit(0)
+    except BrokenPipeError as e:
+        sys.stderr.write("%s: %s\n" % (e.__class__.__name__, str(e)))
+        # Python flushes standard streams on exit; redirect remaining output
+        # to devnull to avoid another BrokenPipeError at shutdown
+        devnull = os.open(os.devnull, os.O_WRONLY)
+        os.dup2(devnull, sys.stdout.fileno())
+        sys.exit(1)
+     except IOError as e:
+         sys.stderr.write("%s: %s\n" % (e.__class__.__name__, str(e)))
+         sys.exit(1)
+-- 
+2.29.2
+
--- a/SOURCES/0034-python-semanage-Sort-imports-in-alphabetical-order.patch
+++ b/SOURCES/0034-python-semanage-Sort-imports-in-alphabetical-order.patch
@ -0,0 +1,41 @@
+From 4b0e627d42f9a8e09dcd064a6ae897f4c2e9cf6c Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Wed, 6 Jan 2021 10:00:07 +0100
+Subject: [PATCH] python/semanage: Sort imports in alphabetical order
+
+Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
+---
+ python/semanage/semanage | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/python/semanage/semanage b/python/semanage/semanage
+index 1abe3536..781e8645 100644
+--- a/python/semanage/semanage
+++ b/python/semanage/semanage
+@@ -23,10 +23,12 @@
+ #
+ #
+ 
+-import traceback
+ import argparse
+-import sys
+ import os
+import re
+import sys
+import traceback
+
+ PROGNAME = "selinux-python"
+ try:
+     import gettext
+@@ -786,8 +788,6 @@ def setupExportParser(subparsers):
+     exportParser.add_argument('-f', '--output_file', dest='output_file', action=SetExportFile, help=_('Output file'))
+     exportParser.set_defaults(func=handleExport)
+ 
+-import re
+-
+ 
+ def mkargv(line):
+     dquote = "\""
+-- 
+2.29.2
+
--- a/SOURCES/0035-python-sepolgen-allow-any-policy-statement-in-if-n-d.patch
+++ b/SOURCES/0035-python-sepolgen-allow-any-policy-statement-in-if-n-d.patch
@ -0,0 +1,49 @@
+From e0a1cdb6181bcf3a23fe63b8e67fd5020e81d05e Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Fri, 22 Jan 2021 16:25:52 +0100
+Subject: [PATCH] python/sepolgen: allow any policy statement in if(n)def
+
+"ifdef/ifndef" statements can be used to conditionally define
+an interface, but this syntax is not recognised by sepolgen-ifgen.
+Fix sepolgen-ifgen to allow any policy statement inside an
+"ifdef/ifndef" statement.
+
+Fixes:
+        $ cat <<EOF > i.if
+ifndef(`apache_manage_pid_files',`
+        interface(`apache_manage_pid_files',`
+                manage_files_pattern($1, httpd_var_run_t, httpd_var_run_t)
+        ')
+')
+
+        #sepolgen-ifgen --interface=i.if
+        i.if: Syntax error on line 2 interface [type=INTERFACE]
+        i.if: Syntax error on line 4 ' [type=SQUOTE]
+
+Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
+[OM: s/fidef/ifdef/]
+Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
+---
+ python/sepolgen/src/sepolgen/refparser.py | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/python/sepolgen/src/sepolgen/refparser.py b/python/sepolgen/src/sepolgen/refparser.py
+index f506dc3a..5d77e2a3 100644
+--- a/python/sepolgen/src/sepolgen/refparser.py
+++ b/python/sepolgen/src/sepolgen/refparser.py
+@@ -431,9 +431,9 @@ def p_ifelse(p):
+ 
+ 
+ def p_ifdef(p):
+-    '''ifdef : IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
+-             | IFNDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
+-             | IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK interface_stmts SQUOTE COMMA TICK interface_stmts SQUOTE CPAREN optional_semi
+    '''ifdef : IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi
+             | IFNDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi
+             | IFDEF OPAREN TICK IDENTIFIER SQUOTE COMMA TICK statements SQUOTE COMMA TICK statements SQUOTE CPAREN optional_semi
+     '''
+     x = refpolicy.IfDef(p[4])
+     if p[1] == 'ifdef':
+-- 
+2.29.2
+
--- a/SOURCES/0036-setfiles-Do-not-abort-on-labeling-error.patch
+++ b/SOURCES/0036-setfiles-Do-not-abort-on-labeling-error.patch
@ -0,0 +1,68 @@
+From 53ccdd55adfbec60fb4277286f2ad94660838504 Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Wed, 13 Jan 2021 22:09:47 +0100
+Subject: [PATCH] setfiles: Do not abort on labeling error
+
+Commit 602347c7422e ("policycoreutils: setfiles - Modify to use
+selinux_restorecon") changed behavior of setfiles. Original
+implementation skipped files which it couldn't set context to while the
+new implementation aborts on them. setfiles should abort only if it
+can't validate a context from spec_file.
+
+Reproducer:
+
+    # mkdir -p r/1 r/2 r/3
+    # touch r/1/1 r/2/1
+    # chattr +i r/2/1
+    # touch r/3/1
+    # setfiles -r r -v /etc/selinux/targeted/contexts/files/file_contexts r
+    Relabeled r from unconfined_u:object_r:mnt_t:s0 to unconfined_u:object_r:root_t:s0
+    Relabeled r/2 from unconfined_u:object_r:mnt_t:s0 to unconfined_u:object_r:default_t:s0
+    setfiles: Could not set context for r/2/1:  Operation not permitted
+
+r/3 and r/1 are not relabeled.
+
+Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
+---
+ policycoreutils/setfiles/setfiles.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
+index bc83c27b4c06..68eab45aa2b4 100644
+--- a/policycoreutils/setfiles/setfiles.c
+++ b/policycoreutils/setfiles/setfiles.c
+@@ -182,6 +182,7 @@ int main(int argc, char **argv)
+ 	policyfile = NULL;
+ 	nerr = 0;
+ 
+	r_opts.abort_on_error = 0;
+ 	r_opts.progname = strdup(argv[0]);
+ 	if (!r_opts.progname) {
+ 		fprintf(stderr, "%s:  Out of memory!\n", argv[0]);
+@@ -194,7 +195,6 @@ int main(int argc, char **argv)
+ 		 * setfiles:
+ 		 * Recursive descent,
+ 		 * Does not expand paths via realpath,
+-		 * Aborts on errors during the file tree walk,
+ 		 * Try to track inode associations for conflict detection,
+ 		 * Does not follow mounts (sets SELINUX_RESTORECON_XDEV),
+ 		 * Validates all file contexts at init time.
+@@ -202,7 +202,6 @@ int main(int argc, char **argv)
+ 		iamrestorecon = 0;
+ 		r_opts.recurse = SELINUX_RESTORECON_RECURSE;
+ 		r_opts.userealpath = 0; /* SELINUX_RESTORECON_REALPATH */
+-		r_opts.abort_on_error = SELINUX_RESTORECON_ABORT_ON_ERROR;
+ 		r_opts.add_assoc = SELINUX_RESTORECON_ADD_ASSOC;
+ 		/* FTS_PHYSICAL and FTS_NOCHDIR are always set by selinux_restorecon(3) */
+ 		r_opts.xdev = SELINUX_RESTORECON_XDEV;
+@@ -226,7 +225,6 @@ int main(int argc, char **argv)
+ 		iamrestorecon = 1;
+ 		r_opts.recurse = 0;
+ 		r_opts.userealpath = SELINUX_RESTORECON_REALPATH;
+-		r_opts.abort_on_error = 0;
+ 		r_opts.add_assoc = 0;
+ 		r_opts.xdev = 0;
+ 		r_opts.ignore_mounts = 0;
+-- 
+2.30.0
+
--- a/SOURCES/0037-setfiles-drop-ABORT_ON_ERRORS-and-related-code.patch
+++ b/SOURCES/0037-setfiles-drop-ABORT_ON_ERRORS-and-related-code.patch
@ -0,0 +1,110 @@
+From 2f135022f4372dc34198c48cfd67b91044e6dfd7 Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Wed, 13 Jan 2021 22:09:48 +0100
+Subject: [PATCH] setfiles: drop ABORT_ON_ERRORS and related code
+
+`setfiles -d` doesn't have any impact on number of errors before it
+aborts. It always aborts on first invalid context in spec file.
+
+Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
+---
+ policycoreutils/setfiles/Makefile      |  3 ---
+ policycoreutils/setfiles/ru/setfiles.8 |  2 +-
+ policycoreutils/setfiles/setfiles.8    |  3 +--
+ policycoreutils/setfiles/setfiles.c    | 18 ------------------
+ 4 files changed, 2 insertions(+), 24 deletions(-)
+
+diff --git a/policycoreutils/setfiles/Makefile b/policycoreutils/setfiles/Makefile
+index bc5a8db789a5..a3bbbe116b7f 100644
+--- a/policycoreutils/setfiles/Makefile
+++ b/policycoreutils/setfiles/Makefile
+@@ -5,8 +5,6 @@ SBINDIR ?= /sbin
+ MANDIR = $(PREFIX)/share/man
+ AUDITH ?= $(shell test -f /usr/include/libaudit.h && echo y)
+ 
+-ABORT_ON_ERRORS=$(shell grep "^\#define ABORT_ON_ERRORS" setfiles.c | awk -S '{ print $$3 }')
+-
+ CFLAGS ?= -g -Werror -Wall -W
+ override LDLIBS += -lselinux -lsepol
+ 
+@@ -26,7 +24,6 @@ restorecon_xattr: restorecon_xattr.o restore.o
+ 
+ man:
+ 	@cp -af setfiles.8 setfiles.8.man
+-	@sed -i "s/ABORT_ON_ERRORS/$(ABORT_ON_ERRORS)/g" setfiles.8.man
+ 
+ install: all
+ 	[ -d $(DESTDIR)$(MANDIR)/man8 ] || mkdir -p $(DESTDIR)$(MANDIR)/man8
+diff --git a/policycoreutils/setfiles/ru/setfiles.8 b/policycoreutils/setfiles/ru/setfiles.8
+index 27815a3f1eee..910101452625 100644
+--- a/policycoreutils/setfiles/ru/setfiles.8
+++ b/policycoreutils/setfiles/ru/setfiles.8
+@@ -47,7 +47,7 @@ setfiles \- установить SELinux-контексты безопаснос
+ проверить действительность контекстов относительно указанной двоичной политики.
+ .TP
+ .B \-d
+-показать, какая спецификация соответствует каждому из файлов (не прекращать проверку после получения ошибок ABORT_ON_ERRORS).
+показать, какая спецификация соответствует каждому из файлов.
+ .TP
+ .BI \-e \ directory
+ исключить каталог (чтобы исключить более одного каталога, этот параметр необходимо использовать соответствующее количество раз).
+diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
+index a8a76c860dac..b7d3cefb96ff 100644
+--- a/policycoreutils/setfiles/setfiles.8
+++ b/policycoreutils/setfiles/setfiles.8
+@@ -56,8 +56,7 @@ option will force a replacement of the entire context.
+ check the validity of the contexts against the specified binary policy.
+ .TP
+ .B \-d
+-show what specification matched each file (do not abort validation
+-after ABORT_ON_ERRORS errors). Not affected by "\-q"
+show what specification matched each file. Not affected by "\-q"
+ .TP
+ .BI \-e \ directory
+ directory to exclude (repeat option for more than one directory).
+diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
+index 68eab45aa2b4..bcbdfbfe53e2 100644
+--- a/policycoreutils/setfiles/setfiles.c
+++ b/policycoreutils/setfiles/setfiles.c
+@@ -23,14 +23,6 @@ static int nerr;
+ 
+ #define STAT_BLOCK_SIZE 1
+ 
+-/* setfiles will abort its operation after reaching the
+- * following number of errors (e.g. invalid contexts),
+- * unless it is used in "debug" mode (-d option).
+- */
+-#ifndef ABORT_ON_ERRORS
+-#define ABORT_ON_ERRORS	10
+-#endif
+-
+ #define SETFILES "setfiles"
+ #define RESTORECON "restorecon"
+ static int iamrestorecon;
+@@ -57,15 +49,6 @@ static __attribute__((__noreturn__)) void usage(const char *const name)
+ 	exit(-1);
+ }
+ 
+-void inc_err(void)
+-{
+-	nerr++;
+-	if (nerr > ABORT_ON_ERRORS - 1 && !r_opts.debug) {
+-		fprintf(stderr, "Exiting after %d errors.\n", ABORT_ON_ERRORS);
+-		exit(-1);
+-	}
+-}
+-
+ void set_rootpath(const char *arg)
+ {
+ 	if (strlen(arg) == 1 && strncmp(arg, "/", 1) == 0) {
+@@ -98,7 +81,6 @@ int canoncon(char **contextp)
+ 		*contextp = tmpcon;
+ 	} else if (errno != ENOENT) {
+ 		rc = -1;
+-		inc_err();
+ 	}
+ 
+ 	return rc;
+-- 
+2.30.0
+
--- a/SOURCES/0038-policycoreutils-setfiles-Drop-unused-nerr-variable.patch
+++ b/SOURCES/0038-policycoreutils-setfiles-Drop-unused-nerr-variable.patch
@ -0,0 +1,44 @@
+From a691da617a2d3c864786ff2742d9a9f87ecc7d05 Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Mon, 1 Feb 2021 15:24:32 +0100
+Subject: [PATCH] policycoreutils/setfiles: Drop unused nerr variable
+
+Suggested-by: Nicolas Iooss <nicolas.iooss@m4x.org>
+Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
+---
+ policycoreutils/setfiles/setfiles.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
+index bcbdfbfe53e2..82d0aaa75893 100644
+--- a/policycoreutils/setfiles/setfiles.c
+++ b/policycoreutils/setfiles/setfiles.c
+@@ -19,7 +19,6 @@ static int warn_no_match;
+ static int null_terminated;
+ static int request_digest;
+ static struct restore_opts r_opts;
+-static int nerr;
+ 
+ #define STAT_BLOCK_SIZE 1
+ 
+@@ -162,7 +161,6 @@ int main(int argc, char **argv)
+ 	warn_no_match = 0;
+ 	request_digest = 0;
+ 	policyfile = NULL;
+-	nerr = 0;
+ 
+ 	r_opts.abort_on_error = 0;
+ 	r_opts.progname = strdup(argv[0]);
+@@ -417,9 +415,6 @@ int main(int argc, char **argv)
+ 	r_opts.selabel_opt_digest = (request_digest ? (char *)1 : NULL);
+ 	r_opts.selabel_opt_path = altpath;
+ 
+-	if (nerr)
+-		exit(-1);
+-
+ 	restore_init(&r_opts);
+ 
+ 	if (use_input_file) {
+-- 
+2.30.0
+
--- a/SOURCES/0039-selinux-8-5-Describe-fcontext-regular-expressions.patch
+++ b/SOURCES/0039-selinux-8-5-Describe-fcontext-regular-expressions.patch
@ -0,0 +1,62 @@
+From c556c6ad0b94cf3ba4b441a1a0930f2468434227 Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Wed, 10 Feb 2021 18:05:29 +0100
+Subject: [PATCH] selinux(8,5): Describe fcontext regular expressions
+
+Describe which type of regular expression is used in file context
+definitions and which flags are in effect.
+
+Explain how local file context modifications are processed.
+
+Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
+Acked-by: Petr Lautrbach <plautrba@redhat.com>
+---
+ python/semanage/semanage            |  2 +-
+ python/semanage/semanage-fcontext.8 | 18 ++++++++++++++++++
+ 2 files changed, 19 insertions(+), 1 deletion(-)
+
+diff --git a/python/semanage/semanage b/python/semanage/semanage
+index 781e8645..ebb93ea5 100644
+--- a/python/semanage/semanage
+++ b/python/semanage/semanage
+@@ -366,7 +366,7 @@ If you do not specify a file type, the file type will default to "all files".
+     parser_add_seuser(fcontextParser, "fcontext")
+     parser_add_type(fcontextParser, "fcontext")
+     parser_add_range(fcontextParser, "fcontext")
+-    fcontextParser.add_argument('file_spec', nargs='?', default=None, help=_('file_spec'))
+    fcontextParser.add_argument('file_spec', nargs='?', default=None, help=_('Path to be labeled (may be in the form of a Perl compatible regular expression)'))
+     fcontextParser.set_defaults(func=handleFcontext)
+ 
+ 
+diff --git a/python/semanage/semanage-fcontext.8 b/python/semanage/semanage-fcontext.8
+index 561123af..49635ba7 100644
+--- a/python/semanage/semanage-fcontext.8
+++ b/python/semanage/semanage-fcontext.8
+@@ -11,6 +11,24 @@ SELinux policy without requiring modification to or recompilation
+ from policy sources.  semanage fcontext is used to  manage the default
+ file system labeling on an SELinux system.  This command maps file paths using regular expressions to SELinux labels.
+ 
+FILE_SPEC may contain either a fully qualified path,
+or a Perl compatible regular expression (PCRE),
+describing fully qualified path(s). The only PCRE flag in use is PCRE2_DOTALL,
+which causes a wildcard '.' to match anything, including a new line.
+Strings representing paths are processed as bytes (as opposed to Unicode),
+meaning that non-ASCII characters are not matched by a single wildcard.
+
+Note, that file context definitions specified using 'semanage fcontext'
+(i.e. local file context modifications stored in file_contexts.local)
+have higher priority than those specified in policy modules.
+This means that whenever a match for given file path is found in
+file_contexts.local, no other file context definitions are considered.
+Entries in file_contexts.local are processed from most recent one to the oldest,
+with first match being used (as opposed to the most specific match,
+which is used when matching other file context definitions).
+All regular expressions should therefore be as specific as possible,
+to avoid unintentionally impacting other parts of the filesystem.
+
+ .SH "OPTIONS"
+ .TP
+ .I  \-h, \-\-help
+-- 
+2.29.2
+
--- a/SOURCES/0040-policycoreutils-setfiles-do-not-restrict-checks-agai.patch
+++ b/SOURCES/0040-policycoreutils-setfiles-do-not-restrict-checks-agai.patch
@ -0,0 +1,69 @@
+From d10e773c014a12b17fefd9caef0bd02528d75d18 Mon Sep 17 00:00:00 2001
+From: Antoine Tenart <antoine.tenart@bootlin.com>
+Date: Tue, 7 Jul 2020 16:35:01 +0200
+Subject: [PATCH] policycoreutils: setfiles: do not restrict checks against a
+ binary policy
+
+The -c option allows to check the validity of contexts against a
+specified binary policy. Its use is restricted: no pathname can be used
+when a binary policy is given to setfiles. It's not clear if this is
+intentional as the built-in help and the man page are not stating the
+same thing about this (the man page document -c as a normal option,
+while the built-in help shows it is restricted).
+
+When generating full system images later used with SELinux in enforcing
+mode, the extended attributed of files have to be set by the build
+machine. The issue is setfiles always checks the contexts against a
+policy (ctx_validate = 1) and using an external binary policy is not
+currently possible when using a pathname. This ends up in setfiles
+failing early as the contexts of the target image are not always
+compatible with the ones of the build machine.
+
+This patch reworks a check on optind only made when -c is used, that
+enforced the use of a single argument to allow 1+ arguments, allowing to
+use setfiles with an external binary policy and pathnames. The following
+command is then allowed, as already documented in the man page:
+
+  $ setfiles -m -r target/ -c policy.32 file_contexts target/
+
+Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
+Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
+
+(cherry-picked from SElinuxProject
+ commit: c94e542c98da2f26863c1cbd9d7ad9bc5cca6aff )
+---
+ policycoreutils/setfiles/setfiles.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
+index 82d0aaa7..4fd3d756 100644
+--- a/policycoreutils/setfiles/setfiles.c
+++ b/policycoreutils/setfiles/setfiles.c
+@@ -39,11 +39,10 @@ static __attribute__((__noreturn__)) void usage(const char *const name)
+ 			name, name);
+ 	} else {
+ 		fprintf(stderr,
+-			"usage:  %s [-diIDlmnpqvFW] [-e excludedir] [-r alt_root_path] spec_file pathname...\n"
+-			"usage:  %s [-diIDlmnpqvFW] [-e excludedir] [-r alt_root_path] spec_file -f filename\n"
+-			"usage:  %s -s [-diIDlmnpqvFW] spec_file\n"
+-			"usage:  %s -c policyfile spec_file\n",
+-			name, name, name, name);
+			"usage:  %s [-diIDlmnpqvEFW] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n"
+			"usage:  %s [-diIDlmnpqvEFW] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n"
+			"usage:  %s -s [-diIDlmnpqvFW] spec_file\n",
+			name, name, name);
+ 	}
+ 	exit(-1);
+ }
+@@ -376,7 +375,7 @@ int main(int argc, char **argv)
+ 
+ 	if (!iamrestorecon) {
+ 		if (policyfile) {
+-			if (optind != (argc - 1))
+			if (optind > (argc - 1))
+ 				usage(argv[0]);
+ 		} else if (use_input_file) {
+ 			if (optind != (argc - 1)) {
+-- 
+2.30.2
+
--- a/SOURCES/0041-semodule-add-m-checksum-option.patch
+++ b/SOURCES/0041-semodule-add-m-checksum-option.patch
@ -0,0 +1,674 @@
+From e748832819b781507903838483376d308c90ca79 Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Tue, 16 Nov 2021 14:27:11 +0100
+Subject: [PATCH] semodule: add -m | --checksum option
+
+Since cil doesn't store module name and module version in module itself,
+there's no simple way how to compare that installed module is the same
+version as the module which is supposed to be installed. Even though the
+version was not used by semodule itself, it was apparently used by some
+team.
+
+With `semodule -l --checksum` users get SHA256 hashes of modules and
+could compare them with their files which is faster than installing
+modules again and again.
+
+E.g.
+
+    # time (
+    semodule -l --checksum | grep localmodule
+    /usr/libexec/selinux/hll/pp localmodule.pp | sha256sum
+    )
+    localmodule db002f64ddfa3983257b42b54da7b182c9b2e476f47880ae3494f9099e1a42bd
+    db002f64ddfa3983257b42b54da7b182c9b2e476f47880ae3494f9099e1a42bd  -
+
+    real    0m0.876s
+    user    0m0.849s
+    sys     0m0.028s
+
+vs
+
+    # time semodule -i localmodule.pp
+
+    real    0m6.147s
+    user    0m5.800s
+    sys     0m0.231s
+
+Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
+Acked-by: James Carter <jwcart2@gmail.com>
+---
+ policycoreutils/semodule/Makefile   |   2 +-
+ policycoreutils/semodule/semodule.8 |   6 +
+ policycoreutils/semodule/semodule.c |  95 ++++++++-
+ policycoreutils/semodule/sha256.c   | 294 ++++++++++++++++++++++++++++
+ policycoreutils/semodule/sha256.h   |  89 +++++++++
+ 5 files changed, 480 insertions(+), 6 deletions(-)
+ create mode 100644 policycoreutils/semodule/sha256.c
+ create mode 100644 policycoreutils/semodule/sha256.h
+
+diff --git a/policycoreutils/semodule/Makefile b/policycoreutils/semodule/Makefile
+index 73801e487a76..9875ac383280 100644
+--- a/policycoreutils/semodule/Makefile
+++ b/policycoreutils/semodule/Makefile
+@@ -6,7 +6,7 @@ MANDIR = $(PREFIX)/share/man
+ 
+ CFLAGS ?= -Werror -Wall -W
+ override LDLIBS += -lsepol -lselinux -lsemanage
+-SEMODULE_OBJS = semodule.o
+SEMODULE_OBJS = semodule.o sha256.o
+ 
+ all: semodule genhomedircon
+ 
+diff --git a/policycoreutils/semodule/semodule.8 b/policycoreutils/semodule/semodule.8
+index 18d4f708661c..3a2fb21c2481 100644
+--- a/policycoreutils/semodule/semodule.8
+++ b/policycoreutils/semodule/semodule.8
+@@ -95,6 +95,9 @@ only modules listed in \-\-extract after this option.
+ .B  \-H,\-\-hll
+ Extract module as an HLL file. This only affects the \-\-extract option and
+ only modules listed in \-\-extract after this option.
+.TP
+.B  \-m,\-\-checksum
+Add SHA256 checksum of modules to the list output.
+ 
+ .SH EXAMPLE
+ .nf
+@@ -130,6 +133,9 @@ $ semodule \-B \-S "/tmp/var/lib/selinux"
+ # Write the HLL version of puppet and the CIL version of wireshark
+ # modules at priority 400 to the current working directory
+ $ semodule \-X 400 \-\-hll \-E puppet \-\-cil \-E wireshark
+# Check whether a module in "localmodule.pp" file is same as installed module "localmodule"
+$ /usr/libexec/selinux/hll/pp localmodule.pp | sha256sum
+$ semodule -l -m | grep localmodule
+ .fi
+ 
+ .SH SEE ALSO
+diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c
+index a76797f505cd..300a97d735cc 100644
+--- a/policycoreutils/semodule/semodule.c
+++ b/policycoreutils/semodule/semodule.c
+@@ -24,6 +24,8 @@
+ 
+ #include <semanage/modules.h>
+ 
+#include "sha256.h"
+
+ enum client_modes {
+ 	NO_MODE, INSTALL_M, REMOVE_M, EXTRACT_M, CIL_M, HLL_M,
+ 	LIST_M, RELOAD, PRIORITY_M, ENABLE_M, DISABLE_M
+@@ -56,6 +58,7 @@ static semanage_handle_t *sh = NULL;
+ static char *store;
+ static char *store_root;
+ int extract_cil = 0;
+static int checksum = 0;
+ 
+ extern char *optarg;
+ extern int optind;
+@@ -146,6 +149,7 @@ static void usage(char *progname)
+ 	printf("  -S,--store-path  use an alternate path for the policy store root\n");
+ 	printf("  -c, --cil extract module as cil. This only affects module extraction.\n");
+ 	printf("  -H, --hll extract module as hll. This only affects module extraction.\n");
+	printf("  -m, --checksum   print module checksum (SHA256).\n");
+ }
+ 
+ /* Sets the global mode variable to new_mode, but only if no other
+@@ -199,6 +203,7 @@ static void parse_command_line(int argc, char **argv)
+ 		{"disable", required_argument, NULL, 'd'},
+ 		{"path", required_argument, NULL, 'p'},
+ 		{"store-path", required_argument, NULL, 'S'},
+		{"checksum", 0, NULL, 'm'},
+ 		{NULL, 0, NULL, 0}
+ 	};
+ 	int extract_selected = 0;
+@@ -209,7 +214,7 @@ static void parse_command_line(int argc, char **argv)
+ 	no_reload = 0;
+ 	priority = 400;
+ 	while ((i =
+-		getopt_long(argc, argv, "s:b:hi:l::vr:u:RnNBDCPX:e:d:p:S:E:cH", opts,
+		getopt_long(argc, argv, "s:b:hi:l::vr:u:RnNBDCPX:e:d:p:S:E:cHm", opts,
+ 			    NULL)) != -1) {
+ 		switch (i) {
+ 		case 'b':
+@@ -286,6 +291,9 @@ static void parse_command_line(int argc, char **argv)
+ 		case 'd':
+ 			set_mode(DISABLE_M, optarg);
+ 			break;
+		case 'm':
+			checksum = 1;
+			break;
+ 		case '?':
+ 		default:{
+ 				usage(argv[0]);
+@@ -337,6 +345,61 @@ static void parse_command_line(int argc, char **argv)
+ 	}
+ }
+ 
+/* Get module checksum */
+static char *hash_module_data(const char *module_name, const int prio) {
+	semanage_module_info_t *extract_info = NULL;
+	semanage_module_key_t *modkey = NULL;
+	Sha256Context context;
+	uint8_t sha256_hash[SHA256_HASH_SIZE];
+	char *sha256_buf = NULL;
+	void *data;
+	size_t data_len = 0, i;
+	int result;
+
+	result = semanage_module_key_create(sh, &modkey);
+	if (result != 0) {
+		goto cleanup_extract;
+	}
+
+	result = semanage_module_key_set_name(sh, modkey, module_name);
+	if (result != 0) {
+		goto cleanup_extract;
+	}
+
+	result = semanage_module_key_set_priority(sh, modkey, prio);
+	if (result != 0) {
+		goto cleanup_extract;
+	}
+
+	result = semanage_module_extract(sh, modkey, 1, &data, &data_len,
+									 &extract_info);
+	if (result != 0) {
+		goto cleanup_extract;
+	}
+
+	Sha256Initialise(&context);
+	Sha256Update(&context, data, data_len);
+
+	Sha256Finalise(&context, (SHA256_HASH *)sha256_hash);
+
+	sha256_buf = calloc(1, SHA256_HASH_SIZE * 2 + 1);
+
+	if (sha256_buf == NULL)
+		goto cleanup_extract;
+
+	for (i = 0; i < SHA256_HASH_SIZE; i++) {
+		sprintf((&sha256_buf[i * 2]), "%02x", sha256_hash[i]);
+	}
+	sha256_buf[i * 2] = 0;
+
+cleanup_extract:
+	semanage_module_info_destroy(sh, extract_info);
+	free(extract_info);
+	semanage_module_key_destroy(sh, modkey);
+	free(modkey);
+	return sha256_buf;
+}
+
+ int main(int argc, char *argv[])
+ {
+ 	int i, commit = 0;
+@@ -544,6 +607,8 @@ cleanup_extract:
+ 				int modinfos_len = 0;
+ 				semanage_module_info_t *m = NULL;
+ 				int j = 0;
+				char *module_checksum = NULL;
+				uint16_t pri = 0;
+ 
+ 				if (verbose) {
+ 					printf
+@@ -568,7 +633,18 @@ cleanup_extract:
+ 						result = semanage_module_info_get_name(sh, m, &name);
+ 						if (result != 0) goto cleanup_list;
+ 
+-						printf("%s\n", name);
+						result = semanage_module_info_get_priority(sh, m, &pri);
+						if (result != 0) goto cleanup_list;
+
+						printf("%s", name);
+						if (checksum) {
+							module_checksum = hash_module_data(name, pri);
+							if (module_checksum) {
+								printf(" %s", module_checksum);
+								free(module_checksum);
+							}
+						}
+						printf("\n");
+ 					}
+ 				}
+ 				else if (strcmp(mode_arg, "full") == 0) {
+@@ -583,11 +659,12 @@ cleanup_extract:
+ 					}
+ 
+ 					/* calculate column widths */
+-					size_t column[4] = { 0, 0, 0, 0 };
+					size_t column[5] = { 0, 0, 0, 0, 0 };
+ 
+ 					/* fixed width columns */
+ 					column[0] = sizeof("000") - 1;
+ 					column[3] = sizeof("disabled") - 1;
+					column[4] = 64; /* SHA256_HASH_SIZE * 2 */
+ 
+ 					/* variable width columns */
+ 					const char *tmp = NULL;
+@@ -610,7 +687,6 @@ cleanup_extract:
+ 
+ 					/* print out each module */
+ 					for (j = 0; j < modinfos_len; j++) {
+-						uint16_t pri = 0;
+ 						const char *name = NULL;
+ 						int enabled = 0;
+ 						const char *lang_ext = NULL;
+@@ -629,11 +705,20 @@ cleanup_extract:
+ 						result = semanage_module_info_get_lang_ext(sh, m, &lang_ext);
+ 						if (result != 0) goto cleanup_list;
+ 
+-						printf("%0*u %-*s %-*s %-*s\n",
+						printf("%0*u %-*s %-*s %-*s",
+ 							(int)column[0], pri,
+ 							(int)column[1], name,
+ 							(int)column[2], lang_ext,
+ 							(int)column[3], enabled ? "" : "disabled");
+						if (checksum) {
+							module_checksum = hash_module_data(name, pri);
+							if (module_checksum) {
+								printf(" %-*s", (int)column[4], module_checksum);
+								free(module_checksum);
+							}
+						}
+						printf("\n");
+
+ 					}
+ 				}
+ 				else {
+diff --git a/policycoreutils/semodule/sha256.c b/policycoreutils/semodule/sha256.c
+new file mode 100644
+index 000000000000..fe2aeef07f53
+--- /dev/null
+++ b/policycoreutils/semodule/sha256.c
+@@ -0,0 +1,294 @@
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  WjCryptLib_Sha256
+//
+//  Implementation of SHA256 hash function.
+//  Original author: Tom St Denis, tomstdenis@gmail.com, http://libtom.org
+//  Modified by WaterJuice retaining Public Domain license.
+//
+//  This is free and unencumbered software released into the public domain - June 2013 waterjuice.org
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  IMPORTS
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+#include "sha256.h"
+#include <memory.h>
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  MACROS
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+#define ror(value, bits) (((value) >> (bits)) | ((value) << (32 - (bits))))
+
+#define MIN(x, y) ( ((x)<(y))?(x):(y) )
+
+#define STORE32H(x, y)                                                                     \
+     { (y)[0] = (uint8_t)(((x)>>24)&255); (y)[1] = (uint8_t)(((x)>>16)&255);   \
+       (y)[2] = (uint8_t)(((x)>>8)&255); (y)[3] = (uint8_t)((x)&255); }
+
+#define LOAD32H(x, y)                            \
+     { x = ((uint32_t)((y)[0] & 255)<<24) | \
+           ((uint32_t)((y)[1] & 255)<<16) | \
+           ((uint32_t)((y)[2] & 255)<<8)  | \
+           ((uint32_t)((y)[3] & 255)); }
+
+#define STORE64H(x, y)                                                                     \
+   { (y)[0] = (uint8_t)(((x)>>56)&255); (y)[1] = (uint8_t)(((x)>>48)&255);     \
+     (y)[2] = (uint8_t)(((x)>>40)&255); (y)[3] = (uint8_t)(((x)>>32)&255);     \
+     (y)[4] = (uint8_t)(((x)>>24)&255); (y)[5] = (uint8_t)(((x)>>16)&255);     \
+     (y)[6] = (uint8_t)(((x)>>8)&255); (y)[7] = (uint8_t)((x)&255); }
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  CONSTANTS
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+// The K array
+static const uint32_t K[64] = {
+    0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL, 0x3956c25bUL,
+    0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL, 0xd807aa98UL, 0x12835b01UL,
+    0x243185beUL, 0x550c7dc3UL, 0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL,
+    0xc19bf174UL, 0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL,
+    0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL, 0x983e5152UL,
+    0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL, 0xc6e00bf3UL, 0xd5a79147UL,
+    0x06ca6351UL, 0x14292967UL, 0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL,
+    0x53380d13UL, 0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL,
+    0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL, 0xd192e819UL,
+    0xd6990624UL, 0xf40e3585UL, 0x106aa070UL, 0x19a4c116UL, 0x1e376c08UL,
+    0x2748774cUL, 0x34b0bcb5UL, 0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL,
+    0x682e6ff3UL, 0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL,
+    0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL
+};
+
+#define BLOCK_SIZE          64
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  INTERNAL FUNCTIONS
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+// Various logical functions
+#define Ch( x, y, z )     (z ^ (x & (y ^ z)))
+#define Maj( x, y, z )    (((x | y) & z) | (x & y))
+#define S( x, n )         ror((x),(n))
+#define R( x, n )         (((x)&0xFFFFFFFFUL)>>(n))
+#define Sigma0( x )       (S(x, 2) ^ S(x, 13) ^ S(x, 22))
+#define Sigma1( x )       (S(x, 6) ^ S(x, 11) ^ S(x, 25))
+#define Gamma0( x )       (S(x, 7) ^ S(x, 18) ^ R(x, 3))
+#define Gamma1( x )       (S(x, 17) ^ S(x, 19) ^ R(x, 10))
+
+#define Sha256Round( a, b, c, d, e, f, g, h, i )       \
+     t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i];   \
+     t1 = Sigma0(a) + Maj(a, b, c);                    \
+     d += t0;                                          \
+     h  = t0 + t1;
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  TransformFunction
+//
+//  Compress 512-bits
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+static
+void
+    TransformFunction
+    (
+        Sha256Context*      Context,
+        uint8_t const*      Buffer
+    )
+{
+    uint32_t    S[8];
+    uint32_t    W[64];
+    uint32_t    t0;
+    uint32_t    t1;
+    uint32_t    t;
+    int         i;
+
+    // Copy state into S
+    for( i=0; i<8; i++ )
+    {
+        S[i] = Context->state[i];
+    }
+
+    // Copy the state into 512-bits into W[0..15]
+    for( i=0; i<16; i++ )
+    {
+        LOAD32H( W[i], Buffer + (4*i) );
+    }
+
+    // Fill W[16..63]
+    for( i=16; i<64; i++ )
+    {
+        W[i] = Gamma1( W[i-2]) + W[i-7] + Gamma0( W[i-15] ) + W[i-16];
+    }
+
+    // Compress
+    for( i=0; i<64; i++ )
+    {
+        Sha256Round( S[0], S[1], S[2], S[3], S[4], S[5], S[6], S[7], i );
+        t = S[7];
+        S[7] = S[6];
+        S[6] = S[5];
+        S[5] = S[4];
+        S[4] = S[3];
+        S[3] = S[2];
+        S[2] = S[1];
+        S[1] = S[0];
+        S[0] = t;
+    }
+
+    // Feedback
+    for( i=0; i<8; i++ )
+    {
+        Context->state[i] = Context->state[i] + S[i];
+    }
+}
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  PUBLIC FUNCTIONS
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  Sha256Initialise
+//
+//  Initialises a SHA256 Context. Use this to initialise/reset a context.
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+void
+    Sha256Initialise
+    (
+        Sha256Context*      Context         // [out]
+    )
+{
+    Context->curlen = 0;
+    Context->length = 0;
+    Context->state[0] = 0x6A09E667UL;
+    Context->state[1] = 0xBB67AE85UL;
+    Context->state[2] = 0x3C6EF372UL;
+    Context->state[3] = 0xA54FF53AUL;
+    Context->state[4] = 0x510E527FUL;
+    Context->state[5] = 0x9B05688CUL;
+    Context->state[6] = 0x1F83D9ABUL;
+    Context->state[7] = 0x5BE0CD19UL;
+}
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  Sha256Update
+//
+//  Adds data to the SHA256 context. This will process the data and update the internal state of the context. Keep on
+//  calling this function until all the data has been added. Then call Sha256Finalise to calculate the hash.
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+void
+    Sha256Update
+    (
+        Sha256Context*      Context,        // [in out]
+        void const*         Buffer,         // [in]
+        uint32_t            BufferSize      // [in]
+    )
+{
+    uint32_t n;
+
+    if( Context->curlen > sizeof(Context->buf) )
+    {
+       return;
+    }
+
+    while( BufferSize > 0 )
+    {
+        if( Context->curlen == 0 && BufferSize >= BLOCK_SIZE )
+        {
+           TransformFunction( Context, (uint8_t*)Buffer );
+           Context->length += BLOCK_SIZE * 8;
+           Buffer = (uint8_t*)Buffer + BLOCK_SIZE;
+           BufferSize -= BLOCK_SIZE;
+        }
+        else
+        {
+           n = MIN( BufferSize, (BLOCK_SIZE - Context->curlen) );
+           memcpy( Context->buf + Context->curlen, Buffer, (size_t)n );
+           Context->curlen += n;
+           Buffer = (uint8_t*)Buffer + n;
+           BufferSize -= n;
+           if( Context->curlen == BLOCK_SIZE )
+           {
+              TransformFunction( Context, Context->buf );
+              Context->length += 8*BLOCK_SIZE;
+              Context->curlen = 0;
+           }
+       }
+    }
+}
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  Sha256Finalise
+//
+//  Performs the final calculation of the hash and returns the digest (32 byte buffer containing 256bit hash). After
+//  calling this, Sha256Initialised must be used to reuse the context.
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+void
+    Sha256Finalise
+    (
+        Sha256Context*      Context,        // [in out]
+        SHA256_HASH*        Digest          // [out]
+    )
+{
+    int i;
+
+    if( Context->curlen >= sizeof(Context->buf) )
+    {
+       return;
+    }
+
+    // Increase the length of the message
+    Context->length += Context->curlen * 8;
+
+    // Append the '1' bit
+    Context->buf[Context->curlen++] = (uint8_t)0x80;
+
+    // if the length is currently above 56 bytes we append zeros
+    // then compress.  Then we can fall back to padding zeros and length
+    // encoding like normal.
+    if( Context->curlen > 56 )
+    {
+        while( Context->curlen < 64 )
+        {
+            Context->buf[Context->curlen++] = (uint8_t)0;
+        }
+        TransformFunction(Context, Context->buf);
+        Context->curlen = 0;
+    }
+
+    // Pad up to 56 bytes of zeroes
+    while( Context->curlen < 56 )
+    {
+        Context->buf[Context->curlen++] = (uint8_t)0;
+    }
+
+    // Store length
+    STORE64H( Context->length, Context->buf+56 );
+    TransformFunction( Context, Context->buf );
+
+    // Copy output
+    for( i=0; i<8; i++ )
+    {
+        STORE32H( Context->state[i], Digest->bytes+(4*i) );
+    }
+}
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  Sha256Calculate
+//
+//  Combines Sha256Initialise, Sha256Update, and Sha256Finalise into one function. Calculates the SHA256 hash of the
+//  buffer.
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+void
+    Sha256Calculate
+    (
+        void  const*        Buffer,         // [in]
+        uint32_t            BufferSize,     // [in]
+        SHA256_HASH*        Digest          // [in]
+    )
+{
+    Sha256Context context;
+
+    Sha256Initialise( &context );
+    Sha256Update( &context, Buffer, BufferSize );
+    Sha256Finalise( &context, Digest );
+}
+diff --git a/policycoreutils/semodule/sha256.h b/policycoreutils/semodule/sha256.h
+new file mode 100644
+index 000000000000..406ed869cd82
+--- /dev/null
+++ b/policycoreutils/semodule/sha256.h
+@@ -0,0 +1,89 @@
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  WjCryptLib_Sha256
+//
+//  Implementation of SHA256 hash function.
+//  Original author: Tom St Denis, tomstdenis@gmail.com, http://libtom.org
+//  Modified by WaterJuice retaining Public Domain license.
+//
+//  This is free and unencumbered software released into the public domain - June 2013 waterjuice.org
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+#pragma once
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  IMPORTS
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+#include <stdint.h>
+#include <stdio.h>
+
+typedef struct
+{
+    uint64_t    length;
+    uint32_t    state[8];
+    uint32_t    curlen;
+    uint8_t     buf[64];
+} Sha256Context;
+
+#define SHA256_HASH_SIZE           ( 256 / 8 )
+
+typedef struct
+{
+    uint8_t      bytes [SHA256_HASH_SIZE];
+} SHA256_HASH;
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  PUBLIC FUNCTIONS
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  Sha256Initialise
+//
+//  Initialises a SHA256 Context. Use this to initialise/reset a context.
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+void
+    Sha256Initialise
+    (
+        Sha256Context*      Context         // [out]
+    );
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  Sha256Update
+//
+//  Adds data to the SHA256 context. This will process the data and update the internal state of the context. Keep on
+//  calling this function until all the data has been added. Then call Sha256Finalise to calculate the hash.
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+void
+    Sha256Update
+    (
+        Sha256Context*      Context,        // [in out]
+        void const*         Buffer,         // [in]
+        uint32_t            BufferSize      // [in]
+    );
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  Sha256Finalise
+//
+//  Performs the final calculation of the hash and returns the digest (32 byte buffer containing 256bit hash). After
+//  calling this, Sha256Initialised must be used to reuse the context.
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+void
+    Sha256Finalise
+    (
+        Sha256Context*      Context,        // [in out]
+        SHA256_HASH*        Digest          // [out]
+    );
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  Sha256Calculate
+//
+//  Combines Sha256Initialise, Sha256Update, and Sha256Finalise into one function. Calculates the SHA256 hash of the
+//  buffer.
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+void
+    Sha256Calculate
+    (
+        void  const*        Buffer,         // [in]
+        uint32_t            BufferSize,     // [in]
+        SHA256_HASH*        Digest          // [in]
+    );
+-- 
+2.33.1
+
--- a/SOURCES/0042-semodule-Fix-lang_ext-column-index.patch
+++ b/SOURCES/0042-semodule-Fix-lang_ext-column-index.patch
@ -0,0 +1,29 @@
+From 14084bad4f5bcfdb769ba39c9a6f12e4787ab909 Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Tue, 16 Nov 2021 16:11:22 +0100
+Subject: [PATCH] semodule: Fix lang_ext column index
+
+lang_ext is 3. column - index number 2.
+
+Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
+Acked-by: James Carter <jwcart2@gmail.com>
+---
+ policycoreutils/semodule/semodule.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c
+index 300a97d735cc..c677cc4f1d81 100644
+--- a/policycoreutils/semodule/semodule.c
+++ b/policycoreutils/semodule/semodule.c
+@@ -682,7 +682,7 @@ cleanup_extract:
+ 						if (result != 0) goto cleanup_list;
+ 
+ 						size = strlen(tmp);
+-						if (size > column[3]) column[3] = size;
+						if (size > column[2]) column[2] = size;
+ 					}
+ 
+ 					/* print out each module */
+-- 
+2.33.1
+
--- a/SOURCES/0043-semodule-Don-t-forget-to-munmap-data.patch
+++ b/SOURCES/0043-semodule-Don-t-forget-to-munmap-data.patch
@ -0,0 +1,32 @@
+From 61f05b6d26063e1ebdc06609c29a067d44579b41 Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Tue, 23 Nov 2021 17:38:51 +0100
+Subject: [PATCH] semodule: Don't forget to munmap() data
+
+semanage_module_extract() mmap()'s the module raw data but it leaves on
+the caller to munmap() them.
+
+Reported-by: Ondrej Mosnacek <omosnace@redhat.com>
+Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
+Acked-by: James Carter <jwcart2@gmail.com>
+---
+ policycoreutils/semodule/semodule.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c
+index c677cc4f1d81..dc227058b073 100644
+--- a/policycoreutils/semodule/semodule.c
+++ b/policycoreutils/semodule/semodule.c
+@@ -393,6 +393,9 @@ static char *hash_module_data(const char *module_name, const int prio) {
+ 	sha256_buf[i * 2] = 0;
+ 
+ cleanup_extract:
+	if (data_len > 0) {
+		munmap(data, data_len);
+	}
+ 	semanage_module_info_destroy(sh, extract_info);
+ 	free(extract_info);
+ 	semanage_module_key_destroy(sh, modkey);
+-- 
+2.33.1
+
--- a/SOURCES/0044-policycoreutils-Improve-error-message-when-selabel_o.patch
+++ b/SOURCES/0044-policycoreutils-Improve-error-message-when-selabel_o.patch
@ -0,0 +1,41 @@
+From 69da6239d8505a9d6ca547187f71a351df17f157 Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Mon, 10 Jan 2022 18:35:27 +0100
+Subject: [PATCH] policycoreutils: Improve error message when selabel_open
+ fails
+
+When selabel_open fails to locate file_context files and
+selabel_opt_path is not specified (e.g. when the policy type is
+missconfigured in /etc/selinux/config), perror only prints
+"No such file or directory".
+This can be confusing in case of "restorecon" since it's
+not apparent that the issue is in policy store.
+
+Before:
+  \# restorecon -v /tmp/foo.txt
+  No such file or directory
+After:
+  \# restorecon -v /tmp/foo.txt
+  /etc/selinux/yolo/contexts/files/file_contexts: No such file or directory
+
+Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
+---
+ policycoreutils/setfiles/restore.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/policycoreutils/setfiles/restore.c b/policycoreutils/setfiles/restore.c
+index d3335d1a..ba2668b3 100644
+--- a/policycoreutils/setfiles/restore.c
+++ b/policycoreutils/setfiles/restore.c
+@@ -29,7 +29,7 @@ void restore_init(struct restore_opts *opts)
+ 
+ 	opts->hnd = selabel_open(SELABEL_CTX_FILE, selinux_opts, 3);
+ 	if (!opts->hnd) {
+-		perror(opts->selabel_opt_path);
+		perror(opts->selabel_opt_path ? opts->selabel_opt_path : selinux_file_context_path());
+ 		exit(1);
+ 	}
+ 
+-- 
+2.30.2
+
--- a/SOURCES/0045-semodule-libsemanage-move-module-hashing-into-libsem.patch
+++ b/SOURCES/0045-semodule-libsemanage-move-module-hashing-into-libsem.patch
@ -0,0 +1,539 @@
+From 066007029b3dd250305d7fac0bfd53aa1e4543cf Mon Sep 17 00:00:00 2001
+From: Ondrej Mosnacek <omosnace@redhat.com>
+Date: Thu, 3 Feb 2022 17:53:23 +0100
+Subject: [PATCH] semodule,libsemanage: move module hashing into libsemanage
+
+The main goal of this move is to have the SHA-256 implementation under
+libsemanage, since upcoming patches will make use of SHA-256 for a
+different (but similar) purpose in libsemanage. Having the hashing code
+in libsemanage will reduce code duplication and allow for easier hash
+algorithm upgrade in the future.
+
+Note that libselinux currently also contains a hash function
+implementation (for yet another different purpose). This patch doesn't
+make any effort to address that duplicity yet.
+
+This patch also changes the format of the hash string printed by
+semodule to include the name of the hash. The intent is to avoid
+ambiguity and potential collisions when the algorithm is potentially
+changed in the future.
+
+Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
+---
+ policycoreutils/semodule/Makefile   |   2 +-
+ policycoreutils/semodule/semodule.c |  53 ++---
+ policycoreutils/semodule/sha256.c   | 294 ----------------------------
+ policycoreutils/semodule/sha256.h   |  89 ---------
+ 4 files changed, 17 insertions(+), 421 deletions(-)
+ delete mode 100644 policycoreutils/semodule/sha256.c
+ delete mode 100644 policycoreutils/semodule/sha256.h
+
+diff --git a/policycoreutils/semodule/Makefile b/policycoreutils/semodule/Makefile
+index 9875ac38..73801e48 100644
+--- a/policycoreutils/semodule/Makefile
+++ b/policycoreutils/semodule/Makefile
+@@ -6,7 +6,7 @@ MANDIR = $(PREFIX)/share/man
+ 
+ CFLAGS ?= -Werror -Wall -W
+ override LDLIBS += -lsepol -lselinux -lsemanage
+-SEMODULE_OBJS = semodule.o sha256.o
+SEMODULE_OBJS = semodule.o
+ 
+ all: semodule genhomedircon
+ 
+diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c
+index dc227058..243b1add 100644
+--- a/policycoreutils/semodule/semodule.c
+++ b/policycoreutils/semodule/semodule.c
+@@ -24,8 +24,6 @@
+ 
+ #include <semanage/modules.h>
+ 
+-#include "sha256.h"
+-
+ enum client_modes {
+ 	NO_MODE, INSTALL_M, REMOVE_M, EXTRACT_M, CIL_M, HLL_M,
+ 	LIST_M, RELOAD, PRIORITY_M, ENABLE_M, DISABLE_M
+@@ -347,60 +345,38 @@ static void parse_command_line(int argc, char **argv)
+ 
+ /* Get module checksum */
+ static char *hash_module_data(const char *module_name, const int prio) {
+-	semanage_module_info_t *extract_info = NULL;
+ 	semanage_module_key_t *modkey = NULL;
+-	Sha256Context context;
+-	uint8_t sha256_hash[SHA256_HASH_SIZE];
+-	char *sha256_buf = NULL;
+-	void *data;
+-	size_t data_len = 0, i;
+	char *hash_str = NULL;
+	void *hash = NULL;
+	size_t hash_len = 0;
+ 	int result;
+ 
+ 	result = semanage_module_key_create(sh, &modkey);
+ 	if (result != 0) {
+-		goto cleanup_extract;
+		goto cleanup;
+ 	}
+ 
+ 	result = semanage_module_key_set_name(sh, modkey, module_name);
+ 	if (result != 0) {
+-		goto cleanup_extract;
+		goto cleanup;
+ 	}
+ 
+ 	result = semanage_module_key_set_priority(sh, modkey, prio);
+ 	if (result != 0) {
+-		goto cleanup_extract;
+		goto cleanup;
+ 	}
+ 
+-	result = semanage_module_extract(sh, modkey, 1, &data, &data_len,
+-									 &extract_info);
+	result = semanage_module_compute_checksum(sh, modkey, 1, &hash_str,
+						  &hash_len);
+ 	if (result != 0) {
+-		goto cleanup_extract;
+-	}
+-
+-	Sha256Initialise(&context);
+-	Sha256Update(&context, data, data_len);
+-
+-	Sha256Finalise(&context, (SHA256_HASH *)sha256_hash);
+-
+-	sha256_buf = calloc(1, SHA256_HASH_SIZE * 2 + 1);
+-
+-	if (sha256_buf == NULL)
+-		goto cleanup_extract;
+-
+-	for (i = 0; i < SHA256_HASH_SIZE; i++) {
+-		sprintf((&sha256_buf[i * 2]), "%02x", sha256_hash[i]);
+		goto cleanup;
+ 	}
+-	sha256_buf[i * 2] = 0;
+ 
+-cleanup_extract:
+-	if (data_len > 0) {
+-		munmap(data, data_len);
+-	}
+-	semanage_module_info_destroy(sh, extract_info);
+-	free(extract_info);
+cleanup:
+	free(hash);
+ 	semanage_module_key_destroy(sh, modkey);
+ 	free(modkey);
+-	return sha256_buf;
+	return hash_str;
+ }
+ 
+ int main(int argc, char *argv[])
+@@ -667,7 +643,10 @@ cleanup_extract:
+ 					/* fixed width columns */
+ 					column[0] = sizeof("000") - 1;
+ 					column[3] = sizeof("disabled") - 1;
+-					column[4] = 64; /* SHA256_HASH_SIZE * 2 */
+
+					result = semanage_module_compute_checksum(sh, NULL, 0, NULL,
+										  &column[4]);
+					if (result != 0) goto cleanup_list;
+ 
+ 					/* variable width columns */
+ 					const char *tmp = NULL;
+diff --git a/policycoreutils/semodule/sha256.c b/policycoreutils/semodule/sha256.c
+deleted file mode 100644
+index fe2aeef0..00000000
+--- a/policycoreutils/semodule/sha256.c
+++ /dev/null
+@@ -1,294 +0,0 @@
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-//  WjCryptLib_Sha256
+-//
+-//  Implementation of SHA256 hash function.
+-//  Original author: Tom St Denis, tomstdenis@gmail.com, http://libtom.org
+-//  Modified by WaterJuice retaining Public Domain license.
+-//
+-//  This is free and unencumbered software released into the public domain - June 2013 waterjuice.org
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-//  IMPORTS
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-
+-#include "sha256.h"
+-#include <memory.h>
+-
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-//  MACROS
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-
+-#define ror(value, bits) (((value) >> (bits)) | ((value) << (32 - (bits))))
+-
+-#define MIN(x, y) ( ((x)<(y))?(x):(y) )
+-
+-#define STORE32H(x, y)                                                                     \
+-     { (y)[0] = (uint8_t)(((x)>>24)&255); (y)[1] = (uint8_t)(((x)>>16)&255);   \
+-       (y)[2] = (uint8_t)(((x)>>8)&255); (y)[3] = (uint8_t)((x)&255); }
+-
+-#define LOAD32H(x, y)                            \
+-     { x = ((uint32_t)((y)[0] & 255)<<24) | \
+-           ((uint32_t)((y)[1] & 255)<<16) | \
+-           ((uint32_t)((y)[2] & 255)<<8)  | \
+-           ((uint32_t)((y)[3] & 255)); }
+-
+-#define STORE64H(x, y)                                                                     \
+-   { (y)[0] = (uint8_t)(((x)>>56)&255); (y)[1] = (uint8_t)(((x)>>48)&255);     \
+-     (y)[2] = (uint8_t)(((x)>>40)&255); (y)[3] = (uint8_t)(((x)>>32)&255);     \
+-     (y)[4] = (uint8_t)(((x)>>24)&255); (y)[5] = (uint8_t)(((x)>>16)&255);     \
+-     (y)[6] = (uint8_t)(((x)>>8)&255); (y)[7] = (uint8_t)((x)&255); }
+-
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-//  CONSTANTS
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-
+-// The K array
+-static const uint32_t K[64] = {
+-    0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL, 0x3956c25bUL,
+-    0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL, 0xd807aa98UL, 0x12835b01UL,
+-    0x243185beUL, 0x550c7dc3UL, 0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL,
+-    0xc19bf174UL, 0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL,
+-    0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL, 0x983e5152UL,
+-    0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL, 0xc6e00bf3UL, 0xd5a79147UL,
+-    0x06ca6351UL, 0x14292967UL, 0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL,
+-    0x53380d13UL, 0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL,
+-    0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL, 0xd192e819UL,
+-    0xd6990624UL, 0xf40e3585UL, 0x106aa070UL, 0x19a4c116UL, 0x1e376c08UL,
+-    0x2748774cUL, 0x34b0bcb5UL, 0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL,
+-    0x682e6ff3UL, 0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL,
+-    0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL
+-};
+-
+-#define BLOCK_SIZE          64
+-
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-//  INTERNAL FUNCTIONS
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-
+-// Various logical functions
+-#define Ch( x, y, z )     (z ^ (x & (y ^ z)))
+-#define Maj( x, y, z )    (((x | y) & z) | (x & y))
+-#define S( x, n )         ror((x),(n))
+-#define R( x, n )         (((x)&0xFFFFFFFFUL)>>(n))
+-#define Sigma0( x )       (S(x, 2) ^ S(x, 13) ^ S(x, 22))
+-#define Sigma1( x )       (S(x, 6) ^ S(x, 11) ^ S(x, 25))
+-#define Gamma0( x )       (S(x, 7) ^ S(x, 18) ^ R(x, 3))
+-#define Gamma1( x )       (S(x, 17) ^ S(x, 19) ^ R(x, 10))
+-
+-#define Sha256Round( a, b, c, d, e, f, g, h, i )       \
+-     t0 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i];   \
+-     t1 = Sigma0(a) + Maj(a, b, c);                    \
+-     d += t0;                                          \
+-     h  = t0 + t1;
+-
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-//  TransformFunction
+-//
+-//  Compress 512-bits
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-static
+-void
+-    TransformFunction
+-    (
+-        Sha256Context*      Context,
+-        uint8_t const*      Buffer
+-    )
+-{
+-    uint32_t    S[8];
+-    uint32_t    W[64];
+-    uint32_t    t0;
+-    uint32_t    t1;
+-    uint32_t    t;
+-    int         i;
+-
+-    // Copy state into S
+-    for( i=0; i<8; i++ )
+-    {
+-        S[i] = Context->state[i];
+-    }
+-
+-    // Copy the state into 512-bits into W[0..15]
+-    for( i=0; i<16; i++ )
+-    {
+-        LOAD32H( W[i], Buffer + (4*i) );
+-    }
+-
+-    // Fill W[16..63]
+-    for( i=16; i<64; i++ )
+-    {
+-        W[i] = Gamma1( W[i-2]) + W[i-7] + Gamma0( W[i-15] ) + W[i-16];
+-    }
+-
+-    // Compress
+-    for( i=0; i<64; i++ )
+-    {
+-        Sha256Round( S[0], S[1], S[2], S[3], S[4], S[5], S[6], S[7], i );
+-        t = S[7];
+-        S[7] = S[6];
+-        S[6] = S[5];
+-        S[5] = S[4];
+-        S[4] = S[3];
+-        S[3] = S[2];
+-        S[2] = S[1];
+-        S[1] = S[0];
+-        S[0] = t;
+-    }
+-
+-    // Feedback
+-    for( i=0; i<8; i++ )
+-    {
+-        Context->state[i] = Context->state[i] + S[i];
+-    }
+-}
+-
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-//  PUBLIC FUNCTIONS
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-//  Sha256Initialise
+-//
+-//  Initialises a SHA256 Context. Use this to initialise/reset a context.
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-void
+-    Sha256Initialise
+-    (
+-        Sha256Context*      Context         // [out]
+-    )
+-{
+-    Context->curlen = 0;
+-    Context->length = 0;
+-    Context->state[0] = 0x6A09E667UL;
+-    Context->state[1] = 0xBB67AE85UL;
+-    Context->state[2] = 0x3C6EF372UL;
+-    Context->state[3] = 0xA54FF53AUL;
+-    Context->state[4] = 0x510E527FUL;
+-    Context->state[5] = 0x9B05688CUL;
+-    Context->state[6] = 0x1F83D9ABUL;
+-    Context->state[7] = 0x5BE0CD19UL;
+-}
+-
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-//  Sha256Update
+-//
+-//  Adds data to the SHA256 context. This will process the data and update the internal state of the context. Keep on
+-//  calling this function until all the data has been added. Then call Sha256Finalise to calculate the hash.
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-void
+-    Sha256Update
+-    (
+-        Sha256Context*      Context,        // [in out]
+-        void const*         Buffer,         // [in]
+-        uint32_t            BufferSize      // [in]
+-    )
+-{
+-    uint32_t n;
+-
+-    if( Context->curlen > sizeof(Context->buf) )
+-    {
+-       return;
+-    }
+-
+-    while( BufferSize > 0 )
+-    {
+-        if( Context->curlen == 0 && BufferSize >= BLOCK_SIZE )
+-        {
+-           TransformFunction( Context, (uint8_t*)Buffer );
+-           Context->length += BLOCK_SIZE * 8;
+-           Buffer = (uint8_t*)Buffer + BLOCK_SIZE;
+-           BufferSize -= BLOCK_SIZE;
+-        }
+-        else
+-        {
+-           n = MIN( BufferSize, (BLOCK_SIZE - Context->curlen) );
+-           memcpy( Context->buf + Context->curlen, Buffer, (size_t)n );
+-           Context->curlen += n;
+-           Buffer = (uint8_t*)Buffer + n;
+-           BufferSize -= n;
+-           if( Context->curlen == BLOCK_SIZE )
+-           {
+-              TransformFunction( Context, Context->buf );
+-              Context->length += 8*BLOCK_SIZE;
+-              Context->curlen = 0;
+-           }
+-       }
+-    }
+-}
+-
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-//  Sha256Finalise
+-//
+-//  Performs the final calculation of the hash and returns the digest (32 byte buffer containing 256bit hash). After
+-//  calling this, Sha256Initialised must be used to reuse the context.
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-void
+-    Sha256Finalise
+-    (
+-        Sha256Context*      Context,        // [in out]
+-        SHA256_HASH*        Digest          // [out]
+-    )
+-{
+-    int i;
+-
+-    if( Context->curlen >= sizeof(Context->buf) )
+-    {
+-       return;
+-    }
+-
+-    // Increase the length of the message
+-    Context->length += Context->curlen * 8;
+-
+-    // Append the '1' bit
+-    Context->buf[Context->curlen++] = (uint8_t)0x80;
+-
+-    // if the length is currently above 56 bytes we append zeros
+-    // then compress.  Then we can fall back to padding zeros and length
+-    // encoding like normal.
+-    if( Context->curlen > 56 )
+-    {
+-        while( Context->curlen < 64 )
+-        {
+-            Context->buf[Context->curlen++] = (uint8_t)0;
+-        }
+-        TransformFunction(Context, Context->buf);
+-        Context->curlen = 0;
+-    }
+-
+-    // Pad up to 56 bytes of zeroes
+-    while( Context->curlen < 56 )
+-    {
+-        Context->buf[Context->curlen++] = (uint8_t)0;
+-    }
+-
+-    // Store length
+-    STORE64H( Context->length, Context->buf+56 );
+-    TransformFunction( Context, Context->buf );
+-
+-    // Copy output
+-    for( i=0; i<8; i++ )
+-    {
+-        STORE32H( Context->state[i], Digest->bytes+(4*i) );
+-    }
+-}
+-
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-//  Sha256Calculate
+-//
+-//  Combines Sha256Initialise, Sha256Update, and Sha256Finalise into one function. Calculates the SHA256 hash of the
+-//  buffer.
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-void
+-    Sha256Calculate
+-    (
+-        void  const*        Buffer,         // [in]
+-        uint32_t            BufferSize,     // [in]
+-        SHA256_HASH*        Digest          // [in]
+-    )
+-{
+-    Sha256Context context;
+-
+-    Sha256Initialise( &context );
+-    Sha256Update( &context, Buffer, BufferSize );
+-    Sha256Finalise( &context, Digest );
+-}
+diff --git a/policycoreutils/semodule/sha256.h b/policycoreutils/semodule/sha256.h
+deleted file mode 100644
+index 406ed869..00000000
+--- a/policycoreutils/semodule/sha256.h
+++ /dev/null
+@@ -1,89 +0,0 @@
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-//  WjCryptLib_Sha256
+-//
+-//  Implementation of SHA256 hash function.
+-//  Original author: Tom St Denis, tomstdenis@gmail.com, http://libtom.org
+-//  Modified by WaterJuice retaining Public Domain license.
+-//
+-//  This is free and unencumbered software released into the public domain - June 2013 waterjuice.org
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-
+-#pragma once
+-
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-//  IMPORTS
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-
+-#include <stdint.h>
+-#include <stdio.h>
+-
+-typedef struct
+-{
+-    uint64_t    length;
+-    uint32_t    state[8];
+-    uint32_t    curlen;
+-    uint8_t     buf[64];
+-} Sha256Context;
+-
+-#define SHA256_HASH_SIZE           ( 256 / 8 )
+-
+-typedef struct
+-{
+-    uint8_t      bytes [SHA256_HASH_SIZE];
+-} SHA256_HASH;
+-
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-//  PUBLIC FUNCTIONS
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-//  Sha256Initialise
+-//
+-//  Initialises a SHA256 Context. Use this to initialise/reset a context.
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-void
+-    Sha256Initialise
+-    (
+-        Sha256Context*      Context         // [out]
+-    );
+-
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-//  Sha256Update
+-//
+-//  Adds data to the SHA256 context. This will process the data and update the internal state of the context. Keep on
+-//  calling this function until all the data has been added. Then call Sha256Finalise to calculate the hash.
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-void
+-    Sha256Update
+-    (
+-        Sha256Context*      Context,        // [in out]
+-        void const*         Buffer,         // [in]
+-        uint32_t            BufferSize      // [in]
+-    );
+-
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-//  Sha256Finalise
+-//
+-//  Performs the final calculation of the hash and returns the digest (32 byte buffer containing 256bit hash). After
+-//  calling this, Sha256Initialised must be used to reuse the context.
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-void
+-    Sha256Finalise
+-    (
+-        Sha256Context*      Context,        // [in out]
+-        SHA256_HASH*        Digest          // [out]
+-    );
+-
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-//  Sha256Calculate
+-//
+-//  Combines Sha256Initialise, Sha256Update, and Sha256Finalise into one function. Calculates the SHA256 hash of the
+-//  buffer.
+-////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+-void
+-    Sha256Calculate
+-    (
+-        void  const*        Buffer,         // [in]
+-        uint32_t            BufferSize,     // [in]
+-        SHA256_HASH*        Digest          // [in]
+-    );
+-- 
+2.30.2
+
--- a/SOURCES/0046-semodule-add-command-line-option-to-detect-module-ch.patch
+++ b/SOURCES/0046-semodule-add-command-line-option-to-detect-module-ch.patch
@ -0,0 +1,144 @@
+From e3fc737e43561ecadcb977ce4c9a1db44be636ae Mon Sep 17 00:00:00 2001
+From: Ondrej Mosnacek <omosnace@redhat.com>
+Date: Thu, 3 Feb 2022 17:53:27 +0100
+Subject: [PATCH] semodule: add command-line option to detect module changes
+
+Add a new command-line option "--rebuild-if-modules-changed" to control
+the newly introduced check_ext_changes libsemanage flag.
+
+For example, running `semodule --rebuild-if-modules-changed` will ensure
+that any externally added/removed modules (e.g. by an RPM transaction)
+are reflected in the compiled policy, while skipping the most expensive
+part of the rebuild if no module change was deteceted since the last
+libsemanage transaction.
+
+Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
+---
+ policycoreutils/semodule/semodule.8 |  7 +++++++
+ policycoreutils/semodule/semodule.c | 32 ++++++++++++++++++++++-------
+ 2 files changed, 32 insertions(+), 7 deletions(-)
+
+diff --git a/policycoreutils/semodule/semodule.8 b/policycoreutils/semodule/semodule.8
+index 3a2fb21c..d1735d21 100644
+--- a/policycoreutils/semodule/semodule.8
+++ b/policycoreutils/semodule/semodule.8
+@@ -23,6 +23,13 @@ force a reload of policy
+ .B \-B, \-\-build
+ force a rebuild of policy (also reloads unless \-n is used)
+ .TP
+.B \-\-rebuild-if-modules-changed
+Force a rebuild of the policy if any changes to module content are detected
+(by comparing with checksum from the last transaction).  One can use this
+instead of \-B to ensure that any changes to the module store done by an
+external tool (e.g. a package manager) are applied, while automatically
+skipping the rebuild if there are no new changes.
+.TP
+ .B \-D, \-\-disable_dontaudit
+ Temporarily remove dontaudits from policy.  Reverts whenever policy is rebuilt
+ .TP
+diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c
+index 243b1add..22a42a75 100644
+--- a/policycoreutils/semodule/semodule.c
+++ b/policycoreutils/semodule/semodule.c
+@@ -46,6 +46,7 @@ static int verbose;
+ static int reload;
+ static int no_reload;
+ static int build;
+static int check_ext_changes;
+ static int disable_dontaudit;
+ static int preserve_tunables;
+ static int ignore_module_cache;
+@@ -148,6 +149,9 @@ static void usage(char *progname)
+ 	printf("  -c, --cil extract module as cil. This only affects module extraction.\n");
+ 	printf("  -H, --hll extract module as hll. This only affects module extraction.\n");
+ 	printf("  -m, --checksum   print module checksum (SHA256).\n");
+	printf("      --rebuild-if-modules-changed\n"
+	       "                   force policy rebuild if module content changed since\n"
+	       "                   last rebuild (based on checksum)\n");
+ }
+ 
+ /* Sets the global mode variable to new_mode, but only if no other
+@@ -179,6 +183,7 @@ static void set_mode(enum client_modes new_mode, char *arg)
+ static void parse_command_line(int argc, char **argv)
+ {
+ 	static struct option opts[] = {
+		{"rebuild-if-modules-changed", 0, NULL, '\0'},
+ 		{"store", required_argument, NULL, 's'},
+ 		{"base", required_argument, NULL, 'b'},
+ 		{"help", 0, NULL, 'h'},
+@@ -206,15 +211,26 @@ static void parse_command_line(int argc, char **argv)
+ 	};
+ 	int extract_selected = 0;
+ 	int cil_hll_set = 0;
+-	int i;
+	int i, longind;
+ 	verbose = 0;
+ 	reload = 0;
+ 	no_reload = 0;
+	check_ext_changes = 0;
+ 	priority = 400;
+ 	while ((i =
+-		getopt_long(argc, argv, "s:b:hi:l::vr:u:RnNBDCPX:e:d:p:S:E:cHm", opts,
+-			    NULL)) != -1) {
+		getopt_long(argc, argv, "s:b:hi:l::vr:u:RnNBDCPX:e:d:p:S:E:cHm",
+			    opts, &longind)) != -1) {
+ 		switch (i) {
+		case '\0':
+			switch(longind) {
+			case 0: /* --rebuild-if-modules-changed */
+				check_ext_changes = 1;
+				break;
+			default:
+				usage(argv[0]);
+				exit(1);
+			}
+			break;
+ 		case 'b':
+ 			fprintf(stderr, "The --base option is deprecated. Use --install instead.\n");
+ 			set_mode(INSTALL_M, optarg);
+@@ -299,13 +315,13 @@ static void parse_command_line(int argc, char **argv)
+ 			}
+ 		}
+ 	}
+-	if ((build || reload) && num_commands) {
+	if ((build || reload || check_ext_changes) && num_commands) {
+ 		fprintf(stderr,
+ 			"build or reload should not be used with other commands\n");
+ 		usage(argv[0]);
+ 		exit(1);
+ 	}
+-	if (num_commands == 0 && reload == 0 && build == 0) {
+	if (num_commands == 0 && reload == 0 && build == 0 && check_ext_changes == 0) {
+ 		fprintf(stderr, "At least one mode must be specified.\n");
+ 		usage(argv[0]);
+ 		exit(1);
+@@ -392,7 +408,7 @@ int main(int argc, char *argv[])
+ 	}
+ 	parse_command_line(argc, argv);
+ 
+-	if (build)
+	if (build || check_ext_changes)
+ 		commit = 1;
+ 
+ 	sh = semanage_handle_create();
+@@ -431,7 +447,7 @@ int main(int argc, char *argv[])
+ 		}
+ 	}
+ 
+-	if (build) {
+	if (build || check_ext_changes) {
+ 		if ((result = semanage_begin_transaction(sh)) < 0) {
+ 			fprintf(stderr, "%s:  Could not begin transaction:  %s\n",
+ 				argv[0], errno ? strerror(errno) : "");
+@@ -805,6 +821,8 @@ cleanup_disable:
+ 			semanage_set_reload(sh, 0);
+ 		if (build)
+ 			semanage_set_rebuild(sh, 1);
+		if (check_ext_changes)
+			semanage_set_check_ext_changes(sh, 1);
+ 		if (disable_dontaudit)
+ 			semanage_set_disable_dontaudit(sh, 1);
+ 		else if (build)
+-- 
+2.30.2
+
--- a/SOURCES/0047-python-Split-semanage-import-into-two-transactions.patch
+++ b/SOURCES/0047-python-Split-semanage-import-into-two-transactions.patch
@ -0,0 +1,64 @@
+From 09c944561c76146b1fc11e99e95b6a674366cddf Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Mon, 30 May 2022 14:20:21 +0200
+Subject: [PATCH] python: Split "semanage import" into two transactions
+
+First transaction applies all deletion operations, so that there are no
+collisions when applying the rest of the changes.
+
+Fixes:
+  # semanage port -a -t http_cache_port_t -r s0 -p tcp 3024
+  # semanage export | semanage import
+  ValueError: Port tcp/3024 already defined
+
+Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
+---
+ python/semanage/semanage | 21 +++++++++++++++++++--
+ 1 file changed, 19 insertions(+), 2 deletions(-)
+
+diff --git a/python/semanage/semanage b/python/semanage/semanage
+index ebb93ea5..b8842d28 100644
+--- a/python/semanage/semanage
+++ b/python/semanage/semanage
+@@ -841,10 +841,29 @@ def handleImport(args):
+     trans = seobject.semanageRecords(args)
+     trans.start()
+ 
+    deleteCommands = []
+    commands = []
+    # separate commands for deletion from the rest so they can be
+    # applied in a separate transaction
+     for l in sys.stdin.readlines():
+         if len(l.strip()) == 0:
+             continue
+        if "-d" in l or "-D" in l:
+            deleteCommands.append(l)
+        else:
+            commands.append(l)
+
+    if deleteCommands:
+        importHelper(deleteCommands)
+        trans.finish()
+        trans.start()
+
+    importHelper(commands)
+    trans.finish()
+ 
+
+def importHelper(commands):
+    for l in commands:
+         try:
+             commandParser = createCommandParser()
+             args = commandParser.parse_args(mkargv(l))
+@@ -858,8 +877,6 @@ def handleImport(args):
+         except KeyboardInterrupt:
+             sys.exit(0)
+ 
+-    trans.finish()
+-
+ 
+ def setupImportParser(subparsers):
+     importParser = subparsers.add_parser('import', help=_('Import local customizations'))
+-- 
+2.35.3
+
--- a/SOURCES/0048-semodule-rename-rebuild-if-modules-changed-to-refres.patch
+++ b/SOURCES/0048-semodule-rename-rebuild-if-modules-changed-to-refres.patch
@ -0,0 +1,81 @@
+From c0ca652dce6b1d5d11e697cc3a4695d87944f9ad Mon Sep 17 00:00:00 2001
+From: Ondrej Mosnacek <omosnace@redhat.com>
+Date: Wed, 8 Jun 2022 19:09:54 +0200
+Subject: [PATCH] semodule: rename --rebuild-if-modules-changed to --refresh
+
+After the last commit this option's name and description no longer
+matches the semantic, so give it a new one and update the descriptions.
+The old name is still recognized and aliased to the new one for
+backwards compatibility.
+
+Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
+Acked-by: Nicolas Iooss <nicolas.iooss@m4x.org>
+---
+ policycoreutils/semodule/semodule.8 | 12 ++++++------
+ policycoreutils/semodule/semodule.c | 13 ++++++++++---
+ 2 files changed, 16 insertions(+), 9 deletions(-)
+
+diff --git a/policycoreutils/semodule/semodule.8 b/policycoreutils/semodule/semodule.8
+index d1735d21..c56e580f 100644
+--- a/policycoreutils/semodule/semodule.8
+++ b/policycoreutils/semodule/semodule.8
+@@ -23,12 +23,12 @@ force a reload of policy
+ .B \-B, \-\-build
+ force a rebuild of policy (also reloads unless \-n is used)
+ .TP
+-.B \-\-rebuild-if-modules-changed
+-Force a rebuild of the policy if any changes to module content are detected
+-(by comparing with checksum from the last transaction).  One can use this
+-instead of \-B to ensure that any changes to the module store done by an
+-external tool (e.g. a package manager) are applied, while automatically
+-skipping the rebuild if there are no new changes.
+.B \-\-refresh
+Like \-\-build, but reuses existing linked policy if no changes to module
+files are detected (by comparing with checksum from the last transaction).
+One can use this instead of \-B to ensure that any changes to the module
+store done by an external tool (e.g. a package manager) are applied, while
+automatically skipping the module re-linking if there are no module changes.
+ .TP
+ .B \-D, \-\-disable_dontaudit
+ Temporarily remove dontaudits from policy.  Reverts whenever policy is rebuilt
+diff --git a/policycoreutils/semodule/semodule.c b/policycoreutils/semodule/semodule.c
+index 22a42a75..324ec9fb 100644
+--- a/policycoreutils/semodule/semodule.c
+++ b/policycoreutils/semodule/semodule.c
+@@ -149,9 +149,12 @@ static void usage(char *progname)
+ 	printf("  -c, --cil extract module as cil. This only affects module extraction.\n");
+ 	printf("  -H, --hll extract module as hll. This only affects module extraction.\n");
+ 	printf("  -m, --checksum   print module checksum (SHA256).\n");
+-	printf("      --rebuild-if-modules-changed\n"
+-	       "                   force policy rebuild if module content changed since\n"
+-	       "                   last rebuild (based on checksum)\n");
+	printf("      --refresh    like --build, but reuses existing linked policy if no\n"
+	       "                   changes to module files are detected (via checksum)\n");
+	printf("Deprecated options:\n");
+	printf("  -b,--base	   same as --install\n");
+	printf("  --rebuild-if-modules-changed\n"
+	       "                   same as --refresh\n");
+ }
+ 
+ /* Sets the global mode variable to new_mode, but only if no other
+@@ -184,6 +187,7 @@ static void parse_command_line(int argc, char **argv)
+ {
+ 	static struct option opts[] = {
+ 		{"rebuild-if-modules-changed", 0, NULL, '\0'},
+		{"refresh", 0, NULL, '\0'},
+ 		{"store", required_argument, NULL, 's'},
+ 		{"base", required_argument, NULL, 'b'},
+ 		{"help", 0, NULL, 'h'},
+@@ -224,6 +228,9 @@ static void parse_command_line(int argc, char **argv)
+ 		case '\0':
+ 			switch(longind) {
+ 			case 0: /* --rebuild-if-modules-changed */
+				fprintf(stderr, "The --rebuild-if-modules-changed option is deprecated. Use --refresh instead.\n");
+				/* fallthrough */
+			case 1: /* --refresh */
+ 				check_ext_changes = 1;
+ 				break;
+ 			default:
+-- 
+2.35.3
+
--- a/SOURCES/0049-python-Harden-tools-against-rogue-modules.patch
+++ b/SOURCES/0049-python-Harden-tools-against-rogue-modules.patch
@ -0,0 +1,79 @@
+From 72c7e9123980b003a21d51e2805529a3e90b2460 Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Thu, 13 Oct 2022 17:33:18 +0200
+Subject: [PATCH] python: Harden tools against "rogue" modules
+
+Python scripts present in "/usr/sbin" override regular modules.
+Make sure /usr/sbin is not present in PYTHONPATH.
+
+Fixes:
+  #cat > /usr/sbin/audit.py <<EOF
+  import sys
+  print("BAD GUY!", file=sys.stderr)
+  sys.exit(1)
+  EOF
+  #semanage boolean -l
+  BAD GUY!
+
+Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
+---
+ python/audit2allow/audit2allow    | 2 +-
+ python/audit2allow/sepolgen-ifgen | 2 +-
+ python/chcat/chcat                | 2 +-
+ python/semanage/semanage          | 2 +-
+ python/sepolicy/sepolicy.py       | 2 +-
+ 5 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/python/audit2allow/audit2allow b/python/audit2allow/audit2allow
+index 09b06f66..eafeea88 100644
+--- a/python/audit2allow/audit2allow
+++ b/python/audit2allow/audit2allow
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python3 -Es
+#!/usr/bin/python3 -EsI
+ # Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
+ # Authors: Dan Walsh <dwalsh@redhat.com>
+ #
+diff --git a/python/audit2allow/sepolgen-ifgen b/python/audit2allow/sepolgen-ifgen
+index be2d093b..f25f8af1 100644
+--- a/python/audit2allow/sepolgen-ifgen
+++ b/python/audit2allow/sepolgen-ifgen
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python3 -Es
+#!/usr/bin/python3 -EsI
+ #
+ # Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
+ #
+diff --git a/python/chcat/chcat b/python/chcat/chcat
+index df2509f2..5671cec6 100755
+--- a/python/chcat/chcat
+++ b/python/chcat/chcat
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python3 -Es
+#!/usr/bin/python3 -EsI
+ # Copyright (C) 2005 Red Hat
+ # see file 'COPYING' for use and warranty information
+ #
+diff --git a/python/semanage/semanage b/python/semanage/semanage
+index b8842d28..1f170f60 100644
+--- a/python/semanage/semanage
+++ b/python/semanage/semanage
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python3 -Es
+#!/usr/bin/python3 -EsI
+ # Copyright (C) 2012-2013 Red Hat
+ # AUTHOR: Miroslav Grepl <mgrepl@redhat.com>
+ # AUTHOR: David Quigley <selinux@davequigley.com>
+diff --git a/python/sepolicy/sepolicy.py b/python/sepolicy/sepolicy.py
+index 8bd6a579..0c1d9641 100755
+--- a/python/sepolicy/sepolicy.py
+++ b/python/sepolicy/sepolicy.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python3 -Es
+#!/usr/bin/python3 -EsI
+ # Copyright (C) 2012 Red Hat
+ # AUTHOR: Dan Walsh <dwalsh@redhat.com>
+ # see file 'COPYING' for use and warranty information
+-- 
+2.37.3
+
--- a/SOURCES/0050-python-Do-not-query-the-local-database-if-the-fconte.patch
+++ b/SOURCES/0050-python-Do-not-query-the-local-database-if-the-fconte.patch
@ -0,0 +1,65 @@
+From f33e40265d192e5d725e7b82e5f14f603e1fba48 Mon Sep 17 00:00:00 2001
+From: James Carter <jwcart2@gmail.com>
+Date: Wed, 19 Oct 2022 14:20:11 -0400
+Subject: [PATCH] python: Do not query the local database if the fcontext is
+ non-local
+
+Vit Mojzis reports that an error message is produced when modifying
+a non-local fcontext.
+
+He gives the following example:
+  # semanage fcontext -f f -m -t passwd_file_t /etc/security/opasswd
+  libsemanage.dbase_llist_query: could not query record value (No such file or directory).
+
+When modifying an fcontext, the non-local database is checked for the
+key and then, if it is not found there, the local database is checked.
+If the key doesn't exist, then an error is raised. If the key exists
+then the local database is queried first and, if that fails, the non-
+local database is queried.
+
+The error is from querying the local database when the fcontext is in
+the non-local database.
+
+Instead, if the fcontext is in the non-local database, just query
+the non-local database. Only query the local database if the
+fcontext was found in it.
+
+Reported-by: Vit Mojzis <vmojzis@redhat.com>
+Signed-off-by: James Carter <jwcart2@gmail.com>
+---
+ python/semanage/seobject.py | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
+index 70ebfd08..0e923a0d 100644
+--- a/python/semanage/seobject.py
+++ b/python/semanage/seobject.py
+@@ -2490,16 +2490,19 @@ class fcontextRecords(semanageRecords):
+         (rc, exists) = semanage_fcontext_exists(self.sh, k)
+         if rc < 0:
+             raise ValueError(_("Could not check if file context for %s is defined") % target)
+-        if not exists:
+        if exists:
+            try:
+                (rc, fcontext) = semanage_fcontext_query(self.sh, k)
+            except OSError:
+                raise ValueError(_("Could not query file context for %s") % target)
+        else:
+             (rc, exists) = semanage_fcontext_exists_local(self.sh, k)
+            if rc < 0:
+                raise ValueError(_("Could not check if file context for %s is defined") % target)
+             if not exists:
+                 raise ValueError(_("File context for %s is not defined") % target)
+-
+-        try:
+-            (rc, fcontext) = semanage_fcontext_query_local(self.sh, k)
+-        except OSError:
+             try:
+-                (rc, fcontext) = semanage_fcontext_query(self.sh, k)
+                (rc, fcontext) = semanage_fcontext_query_local(self.sh, k)
+             except OSError:
+                 raise ValueError(_("Could not query file context for %s") % target)
+ 
+-- 
+2.37.3
+
--- a/SOURCES/0051-python-sepolicy-add-missing-booleans-to-man-pages.patch
+++ b/SOURCES/0051-python-sepolicy-add-missing-booleans-to-man-pages.patch
@ -0,0 +1,112 @@
+From f3ddbd8220d9646072c9a4c9ed37f2dff998a53c Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Tue, 10 Jan 2023 11:37:26 +0100
+Subject: [PATCH] python/sepolicy: add missing booleans to man pages
+
+get_bools should return a list of booleans that can affect given type,
+but it did not handle non trivial conditional statements properly
+(returning the whole conditional statement instead of a list of booleans
+in the statement).
+
+e.g. for
+allow httpd_t spamc_t:process transition; [ httpd_can_check_spam && httpd_can_sendmail ]:True
+get_bools used to return [("httpd_can_check_spam && httpd_can_sendmail", False)] instead of
+[("httpd_can_check_spam", False), ("httpd_can_sendmail", False)]
+
+- rename "boolean" in sepolicy rule dictionary to "booleans" to suggest
+  it can contain multiple values and make sure it is populated correctly
+- add "conditional" key to the rule dictionary to accommodate
+  get_conditionals, which requires the whole conditional statement
+- extend get_bools search to dontaudit rules so that it covers booleans
+  like httpd_dontaudit_search_dirs
+
+Note: get_bools uses security_get_boolean_active to get the boolean
+      value, but the value is later used to represent the default.
+      Not ideal, but I'm not aware of a way to get the actual defaults.
+
+Fixes:
+        "sepolicy manpage" generates man pages that are missing booleans
+        which are included in non trivial conditional expressions
+        e.g. httpd_selinux(8) does not include httpd_can_check_spam,
+        httpd_tmp_exec, httpd_unified, or httpd_use_gpg
+
+        This fix, however, also adds some not strictly related booleans
+        to some man pages. e.g. use_nfs_home_dirs and
+        use_samba_home_dirs are added to httpd_selinux(8)
+
+Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
+Acked-by: Jason Zaman <jason@perfinion.com>
+---
+ python/sepolicy/sepolicy/__init__.py | 21 +++++++++++++--------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py
+index b6ca57c3..0f51174d 100644
+--- a/python/sepolicy/sepolicy/__init__.py
+++ b/python/sepolicy/sepolicy/__init__.py
+@@ -324,7 +324,12 @@ def _setools_rule_to_dict(rule):
+         pass
+ 
+     try:
+-        d['boolean'] = [(str(rule.conditional), enabled)]
+        d['booleans'] = [(str(b), b.state) for b in rule.conditional.booleans]
+    except AttributeError:
+        pass
+
+    try:
+        d['conditional'] = str(rule.conditional)
+     except AttributeError:
+         pass
+ 
+@@ -426,12 +431,12 @@ def get_conditionals(src, dest, tclass, perm):
+                 x['source'] in src_list and
+                 x['target'] in dest_list and
+                 set(perm).issubset(x[PERMS]) and
+-                'boolean' in x,
+                'conditional' in x,
+                 get_all_allow_rules()))
+ 
+     try:
+         for i in allows:
+-            tdict.update({'source': i['source'], 'boolean': i['boolean']})
+            tdict.update({'source': i['source'], 'conditional': (i['conditional'], i['enabled'])})
+             if tdict not in tlist:
+                 tlist.append(tdict)
+                 tdict = {}
+@@ -445,10 +450,10 @@ def get_conditionals_format_text(cond):
+ 
+     enabled = False
+     for x in cond:
+-        if x['boolean'][0][1]:
+        if x['conditional'][1]:
+             enabled = True
+             break
+-    return _("-- Allowed %s [ %s ]") % (enabled, " || ".join(set(map(lambda x: "%s=%d" % (x['boolean'][0][0], x['boolean'][0][1]), cond))))
+    return _("-- Allowed %s [ %s ]") % (enabled, " || ".join(set(map(lambda x: "%s=%d" % (x['conditional'][0], x['conditional'][1]), cond))))
+ 
+ 
+ def get_types_from_attribute(attribute):
+@@ -703,9 +708,9 @@ def get_boolean_rules(setype, boolean):
+     boollist = []
+     permlist = search([ALLOW], {'source': setype})
+     for p in permlist:
+-        if "boolean" in p:
+        if "booleans" in p:
+             try:
+-                for b in p["boolean"]:
+                for b in p["booleans"]:
+                     if boolean in b:
+                         boollist.append(p)
+             except:
+@@ -1124,7 +1129,7 @@ def get_bools(setype):
+     bools = []
+     domainbools = []
+     domainname, short_name = gen_short_name(setype)
+-    for i in map(lambda x: x['boolean'], filter(lambda x: 'boolean' in x and x['source'] == setype, get_all_allow_rules())):
+    for i in map(lambda x: x['booleans'], filter(lambda x: 'booleans' in x and x['source'] == setype, search([ALLOW, DONTAUDIT]))):
+         for b in i:
+             if not isinstance(b, tuple):
+                 continue
+-- 
+2.37.3
+
--- a/SOURCES/0052-python-sepolicy-Cache-conditional-rule-queries.patch
+++ b/SOURCES/0052-python-sepolicy-Cache-conditional-rule-queries.patch
@ -0,0 +1,73 @@
+From 25373db5cac520b85350db91b8a7ed0737d3316c Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Tue, 24 Jan 2023 21:05:05 +0100
+Subject: [PATCH] python/sepolicy: Cache conditional rule queries
+
+Commit 7506771e4b630fe0ab853f96574e039055cb72eb
+"add missing booleans to man pages" dramatically slowed down
+"sepolicy manpage -a" by removing caching of setools rule query.
+Re-add said caching and update the query to only return conditional
+rules.
+
+Before commit 7506771e:
+ #time sepolicy manpage -a
+ real	1m43.153s
+ # time sepolicy manpage -d httpd_t
+ real	0m4.493s
+
+After commit 7506771e:
+ #time sepolicy manpage -a
+ real   1h56m43.153s
+ # time sepolicy manpage -d httpd_t
+ real	0m8.352s
+
+After this commit:
+ #time sepolicy manpage -a
+ real	1m41.074s
+ # time sepolicy manpage -d httpd_t
+ real	0m7.358s
+
+Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
+---
+ python/sepolicy/sepolicy/__init__.py | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/python/sepolicy/sepolicy/__init__.py b/python/sepolicy/sepolicy/__init__.py
+index 0f51174d..f48231e9 100644
+--- a/python/sepolicy/sepolicy/__init__.py
+++ b/python/sepolicy/sepolicy/__init__.py
+@@ -114,6 +114,7 @@ all_attributes = None
+ booleans = None
+ booleans_dict = None
+ all_allow_rules = None
+all_bool_rules = None
+ all_transitions = None
+ 
+ 
+@@ -1119,6 +1120,14 @@ def get_all_allow_rules():
+         all_allow_rules = search([ALLOW])
+     return all_allow_rules
+ 
+def get_all_bool_rules():
+    global all_bool_rules
+    if not all_bool_rules:
+        q = setools.TERuleQuery(_pol, boolean=".*", boolean_regex=True,
+                                ruletype=[ALLOW, DONTAUDIT])
+        all_bool_rules = [_setools_rule_to_dict(x) for x in q.results()]
+    return all_bool_rules
+
+ def get_all_transitions():
+     global all_transitions
+     if not all_transitions:
+@@ -1129,7 +1138,7 @@ def get_bools(setype):
+     bools = []
+     domainbools = []
+     domainname, short_name = gen_short_name(setype)
+-    for i in map(lambda x: x['booleans'], filter(lambda x: 'booleans' in x and x['source'] == setype, search([ALLOW, DONTAUDIT]))):
+    for i in map(lambda x: x['booleans'], filter(lambda x: 'booleans' in x and x['source'] == setype, get_all_bool_rules())):
+         for b in i:
+             if not isinstance(b, tuple):
+                 continue
+-- 
+2.37.3
+
--- a/SOURCES/0053-python-Harden-more-tools-against-rogue-modules.patch
+++ b/SOURCES/0053-python-Harden-more-tools-against-rogue-modules.patch
@ -0,0 +1,98 @@
+From 7aef364bc6607953a34cb9e8fe9ea51c88379a5c Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Wed, 6 Dec 2023 15:31:51 +0100
+Subject: [PATCH] python: Harden more tools against "rogue" modules
+
+Python scripts present in the same directory as the tool
+override regular modules.
+
+Fixes:
+      #cat > /usr/bin/signal.py <<EOF
+      import sys
+      print("BAD GUY!", file=sys.stderr)
+      sys.exit(1)
+      EOF
+      #sandbox date
+      BAD GUY!
+
+Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
+Acked-by: James Carter <jwcart2@gmail.com>
+---
+ dbus/selinux_server.py       | 2 +-
+ gui/polgengui.py             | 2 +-
+ gui/system-config-selinux.py | 6 +++---
+ sandbox/sandbox              | 2 +-
+ sandbox/start                | 2 +-
+ 5 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/dbus/selinux_server.py b/dbus/selinux_server.py
+index 97bf91ba..eae38de5 100644
+--- a/dbus/selinux_server.py
+++ b/dbus/selinux_server.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python3
+#!/usr/bin/python3 -EsI
+ 
+ import dbus
+ import dbus.service
+diff --git a/gui/polgengui.py b/gui/polgengui.py
+index 46a1bd2c..0402e82c 100644
+--- a/gui/polgengui.py
+++ b/gui/polgengui.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python3 -Es
+#!/usr/bin/python3 -EsI
+ #
+ # polgengui.py - GUI for SELinux Config tool in system-config-selinux
+ #
+diff --git a/gui/system-config-selinux.py b/gui/system-config-selinux.py
+index 1e0d5eb1..c344c076 100644
+--- a/gui/system-config-selinux.py
+++ b/gui/system-config-selinux.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python3 -Es
+#!/usr/bin/python3 -EsI
+ #
+ # system-config-selinux.py - GUI for SELinux Config tool in system-config-selinux
+ #
+@@ -32,6 +32,8 @@ except RuntimeError as e:
+     print("This is a graphical application and requires DISPLAY to be set.")
+     sys.exit(1)
+ 
+sys.path.append('/usr/share/system-config-selinux')
+
+ from gi.repository import GObject
+ import statusPage
+ import booleansPage
+@@ -65,8 +67,6 @@ except:
+ 
+ version = "1.0"
+ 
+-sys.path.append('/usr/share/system-config-selinux')
+-
+ 
+ ##
+ ## Pull in the Glade file
+diff --git a/sandbox/sandbox b/sandbox/sandbox
+index 707959a6..e276e594 100644
+--- a/sandbox/sandbox
+++ b/sandbox/sandbox
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python3 -Es
+#!/usr/bin/python3 -EsI
+ # Authors: Dan Walsh <dwalsh@redhat.com>
+ # Authors: Thomas Liu <tliu@fedoraproject.org>
+ # Authors: Josh Cogliati
+diff --git a/sandbox/start b/sandbox/start
+index 4ed3cb5c..3c1a1783 100644
+--- a/sandbox/start
+++ b/sandbox/start
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python3 -Es
+#!/usr/bin/python3 -EsI
+ try:
+     from subprocess import getstatusoutput
+ except ImportError:
+-- 
+2.43.0
+
--- a/SOURCES/0054-sepolicy-port-to-dnf4-python-API.patch
+++ b/SOURCES/0054-sepolicy-port-to-dnf4-python-API.patch
@ -0,0 +1,95 @@
+From ea93da38a16eb44307b522f8a26f2d8f967fcc01 Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <lautrbach@redhat.com>
+Date: Wed, 22 Nov 2023 12:29:43 +0100
+Subject: [PATCH] sepolicy: port to dnf4 python API
+
+yum module is not available since RHEL 7.
+
+Drop -systemd related code as it's obsoleted these days - only 2
+packages ship their .service in -systemd subpackage
+
+Signed-off-by: Petr Lautrbach <lautrbach@redhat.com>
+Acked-by: James Carter <jwcart2@gmail.com>
+Acked-by: Ondrej Mosnacek <omosnace@redhat.com>
+---
+ python/sepolicy/sepolicy/generate.py | 56 +++++++++++++---------------
+ 1 file changed, 25 insertions(+), 31 deletions(-)
+
+diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py
+index 93caedee..c841a499 100644
+--- a/python/sepolicy/sepolicy/generate.py
+++ b/python/sepolicy/sepolicy/generate.py
+@@ -1265,24 +1265,20 @@ allow %s_t %s_t:%s_socket name_%s;
+         return fcfile
+ 
+     def __extract_rpms(self):
+-        import yum
+-        yb = yum.YumBase()
+-        yb.setCacheDir()
+-
+-        for pkg in yb.rpmdb.searchProvides(self.program):
+-            self.rpms.append(pkg.name)
+-            for fname in pkg.dirlist + pkg.filelist + pkg.ghostlist:
+-                for b in self.DEFAULT_DIRS:
+-                    if b == "/etc":
+-                        continue
+-                    if fname.startswith(b):
+-                        if os.path.isfile(fname):
+-                            self.add_file(fname)
+-                        else:
+-                            self.add_dir(fname)
+        import dnf
+
+        with dnf.Base() as base:
+            base.read_all_repos()
+            base.fill_sack(load_system_repo=True)
+
+            query = base.sack.query()
+ 
+-            for bpkg in yb.rpmdb.searchNames([pkg.base_package_name]):
+-                for fname in bpkg.dirlist + bpkg.filelist + bpkg.ghostlist:
+            pq = query.available()
+            pq = pq.filter(file=self.program)
+
+            for pkg in pq:
+                self.rpms.append(pkg.name)
+                for fname in pkg.files:
+                     for b in self.DEFAULT_DIRS:
+                         if b == "/etc":
+                             continue
+@@ -1291,20 +1287,18 @@ allow %s_t %s_t:%s_socket name_%s;
+                                 self.add_file(fname)
+                             else:
+                                 self.add_dir(fname)
+-
+-        # some packages have own systemd subpackage
+-        # tor-systemd for example
+-        binary_name = self.program.split("/")[-1]
+-        for bpkg in yb.rpmdb.searchNames(["%s-systemd" % binary_name]):
+-            for fname in bpkg.filelist + bpkg.ghostlist + bpkg.dirlist:
+-                for b in self.DEFAULT_DIRS:
+-                    if b == "/etc":
+-                        continue
+-                    if fname.startswith(b):
+-                        if os.path.isfile(fname):
+-                            self.add_file(fname)
+-                        else:
+-                            self.add_dir(fname)
+                sq = query.available()
+                sq = sq.filter(provides=pkg.source_name)
+                for bpkg in sq:
+                    for fname in bpkg.files:
+                        for b in self.DEFAULT_DIRS:
+                            if b == "/etc":
+                                continue
+                            if fname.startswith(b):
+                                if os.path.isfile(fname):
+                                    self.add_file(fname)
+                                else:
+                                    self.add_dir(fname)
+ 
+     def gen_writeable(self):
+         try:
+-- 
+2.43.0
+
--- a/SOURCES/selinux-autorelabel
+++ b/SOURCES/selinux-autorelabel
@ -0,0 +1,73 @@
+#!/bin/bash
+#
+# Do automatic relabelling
+#
+
+# . /etc/init.d/functions
+
+# If the user has this (or similar) UEFI boot order:
+#
+#             Windows | grub | Linux
+#
+# And decides to boot into grub/Linux, then the reboot at the end of autorelabel
+# would cause the system to boot into Windows again, if the autorelabel was run.
+#
+# This function restores the UEFI boot order, so the user will boot into the
+# previously set (and expected) partition.
+efi_set_boot_next() {
+    # NOTE: The [ -x /usr/sbin/efibootmgr ] test is not sufficent -- it could
+    #       succeed even on system which is not EFI-enabled...
+    if ! efibootmgr > /dev/null 2>&1; then
+        return
+    fi
+
+    # NOTE: It it possible that some other services might be setting the
+    #       'BootNext' item for any reasons, and we shouldn't override it if so.
+    if ! efibootmgr | grep --quiet -e 'BootNext'; then
+        CURRENT_BOOT="$(efibootmgr | grep -e 'BootCurrent' | sed -re 's/(^.+:[[:space:]]*)([[:xdigit:]]+)/\2/')"
+        efibootmgr -n "${CURRENT_BOOT}" > /dev/null 2>&1
+    fi
+}
+
+relabel_selinux() {
+    # if /sbin/init is not labeled correctly this process is running in the
+    # wrong context, so a reboot will be required after relabel
+    AUTORELABEL=
+    . /etc/selinux/config
+    echo "0" > /sys/fs/selinux/enforce
+    [ -x /bin/plymouth ] && plymouth --quit
+
+    if [ "$AUTORELABEL" = "0" ]; then
+	echo
+	echo $"*** Warning -- SELinux ${SELINUXTYPE} policy relabel is required. "
+	echo $"*** /etc/selinux/config indicates you want to manually fix labeling"
+	echo $"*** problems. Dropping you to a shell; the system will reboot"
+	echo $"*** when you leave the shell."
+	sulogin
+
+    else
+	echo
+	echo $"*** Warning -- SELinux ${SELINUXTYPE} policy relabel is required."
+	echo $"*** Relabeling could take a very long time, depending on file"
+	echo $"*** system size and speed of hard drives."
+
+	FORCE=`cat /.autorelabel`
+        [ -x "/usr/sbin/quotaoff" ] && /usr/sbin/quotaoff -aug
+	/sbin/fixfiles $FORCE restore
+    fi
+
+    rm -f  /.autorelabel
+    /usr/lib/dracut/dracut-initramfs-restore
+    efi_set_boot_next
+    if [ -x /usr/bin/grub2-editenv ]; then
+        grub2-editenv - incr boot_indeterminate >/dev/null 2>&1
+    fi
+    sync
+    systemctl reboot
+}
+
+# Check to see if a full relabel is needed
+if [ "$READONLY" != "yes" ]; then
+    restorecon $(awk '!/^#/ && $4 !~ /noauto/ && $2 ~ /^\// { print $2 }' /etc/fstab) >/dev/null 2>&1
+    relabel_selinux
+fi
--- a/SOURCES/selinux-autorelabel-generator.sh
+++ b/SOURCES/selinux-autorelabel-generator.sh
@ -0,0 +1,29 @@
+#!/bin/sh
+
+# This systemd.generator(7) detects if SELinux is running and if the
+# user requested an autorelabel, and if so sets the default target to
+# selinux-autorelabel.target, which will cause the filesystem to be
+# relabelled and then the system will reboot again and boot into the
+# real default target.
+
+PATH=/usr/sbin:$PATH
+unitdir=/usr/lib/systemd/system
+
+# If invoked with no arguments (for testing) write to /tmp.
+earlydir="/tmp"
+if [ -n "$2" ]; then
+    earlydir="$2"
+fi
+
+set_target ()
+{
+    ln -sf "$unitdir/selinux-autorelabel.target" "$earlydir/default.target"
+}
+
+if selinuxenabled; then
+    if test -f /.autorelabel; then
+        set_target
+    elif grep -sqE "\bautorelabel\b" /proc/cmdline; then
+        set_target
+    fi
+fi
--- a/SOURCES/selinux-autorelabel-mark.service
+++ b/SOURCES/selinux-autorelabel-mark.service
@ -0,0 +1,18 @@
+[Unit]
+Description=Mark the need to relabel after reboot
+DefaultDependencies=no
+Requires=local-fs.target
+Conflicts=shutdown.target
+After=local-fs.target
+Before=sysinit.target shutdown.target
+ConditionSecurity=!selinux
+ConditionPathIsDirectory=/etc/selinux
+ConditionPathExists=!/.autorelabel
+
+[Service]
+ExecStart=-/bin/touch /.autorelabel
+Type=oneshot
+RemainAfterExit=yes
+
+[Install]
+WantedBy=sysinit.target
--- a/SOURCES/selinux-autorelabel.service
+++ b/SOURCES/selinux-autorelabel.service
@ -0,0 +1,14 @@
+[Unit]
+Description=Relabel all filesystems
+DefaultDependencies=no
+Conflicts=shutdown.target
+After=sysinit.target
+Before=shutdown.target
+ConditionSecurity=selinux
+
+[Service]
+ExecStart=/usr/libexec/selinux/selinux-autorelabel
+Type=oneshot
+TimeoutSec=0
+RemainAfterExit=yes
+StandardOutput=journal+console
--- a/SOURCES/selinux-autorelabel.target
+++ b/SOURCES/selinux-autorelabel.target
@ -0,0 +1,7 @@
+[Unit]
+Description=Relabel all filesystems and reboot
+DefaultDependencies=no
+Requires=sysinit.target selinux-autorelabel.service
+Conflicts=shutdown.target
+After=sysinit.target selinux-autorelabel.service
+ConditionSecurity=selinux
--- a/SPECS/policycoreutils.spec
+++ b/SPECS/policycoreutils.spec