refpolicy git: rebase patches with code base

During forward-port of these patches from refpolicy 20140311,
requires rebase with the refpolicy git repos head master
code base,in order to resolve the patch conflicts.

Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>

5 files changed, 74 insertions, 77 deletions

diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-fstools.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-fstools.patch
index 38c96c4..9c45694 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-fstools.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-fstools.patch
@@ -1,4 +1,4 @@
-From 7fdfd2ef8764ddfaeb43e53a756af83d42d8ac8b Mon Sep 17 00:00:00 2001
+From b420621f7bacdb803bfd104686e9b1785d7a6309 Mon Sep 17 00:00:00 2001
 From: Wenzong Fan <wenzong.fan@windriver.com>
 Date: Mon, 27 Jan 2014 03:54:01 -0500
 Subject: [PATCH] refpolicy: fix real path for fstools
@@ -7,59 +7,64 @@ Upstream-Status: Inappropriate [configuration]
 
 Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
 Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
+Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com>
 ---
- policy/modules/system/fstools.fc |   11 +++++++++++
- 1 file changed, 11 insertions(+)
+ policy/modules/system/fstools.fc |    9 +++++++++
+ 1 file changed, 9 insertions(+)
 
+diff --git a/policy/modules/system/fstools.fc b/policy/modules/system/fstools.fc
+index d10368d..f22761a 100644
 --- a/policy/modules/system/fstools.fc
 +++ b/policy/modules/system/fstools.fc
 @@ -1,6 +1,8 @@
  /sbin/badblocks                --      gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/blkid            --      gen_context(system_u:object_r:fsadm_exec_t,s0)
-+/sbin/blkid\.util-linux        --      gen_context(system_u:object_r:fsadm_exec_t,s0)
++/sbin/blkid/.util-linux                --      gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/blockdev         --      gen_context(system_u:object_r:fsadm_exec_t,s0)
-+/sbin/blockdev\.util-linux     --      gen_context(system_u:object_r:fsadm_exec_t,s0)
++/sbin/blockdev/.util-linux             --      gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/cfdisk           --      gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/dosfsck          --      gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/dump             --      gen_context(system_u:object_r:fsadm_exec_t,s0)
-@@ -9,9 +11,11 @@
+@@ -9,9 +11,12 @@
  /sbin/e4fsck           --      gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/e2label          --      gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/fdisk            --      gen_context(system_u:object_r:fsadm_exec_t,s0)
-+/sbin/fdisk\.util-linux        --      gen_context(system_u:object_r:fsadm_exec_t,s0)
++/sbin/fdisk/.util-linux                --      gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/findfs           --      gen_context(system_u:object_r:fsadm_exec_t,s0)
++/usr/sbin/findfs               --      gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/fsck.*           --      gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/hdparm           --      gen_context(system_u:object_r:fsadm_exec_t,s0)
-+/sbin/hdparm\.hdparm   --      gen_context(system_u:object_r:fsadm_exec_t,s0)
++/sbin/hdparm/.util-linux               --      gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/install-mbr      --      gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/jfs_.*           --      gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/losetup.*                --      gen_context(system_u:object_r:fsadm_exec_t,s0)
-@@ -24,6 +28,7 @@
+@@ -24,6 +29,7 @@
  /sbin/mkraid           --      gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/mkreiserfs       --      gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/mkswap           --      gen_context(system_u:object_r:fsadm_exec_t,s0)
-+/sbin/mkswap\.util-linux       --      gen_context(system_u:object_r:fsadm_exec_t,s0)
++/sbin/mkswap/.util-linux               --      gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/parted           --      gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/partprobe                --      gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/partx            --      gen_context(system_u:object_r:fsadm_exec_t,s0)
-@@ -34,6 +39,7 @@
+@@ -32,8 +38,10 @@
+ /sbin/reiserfs(ck|tune)        --      gen_context(system_u:object_r:fsadm_exec_t,s0)
+ /sbin/resize.*fs       --      gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/scsi_info                --      gen_context(system_u:object_r:fsadm_exec_t,s0)
++/usr/sbin/sfdisk               --      gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/sfdisk           --      gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/swapoff          --      gen_context(system_u:object_r:fsadm_exec_t,s0)
-+/sbin/swapoff\.util-linux      --      gen_context(system_u:object_r:fsadm_exec_t,s0)
++/sbin/swapoff/.util-linux              --      gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/swapon.*         --      gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/tune2fs          --      gen_context(system_u:object_r:fsadm_exec_t,s0)
  /sbin/zdb              --      gen_context(system_u:object_r:fsadm_exec_t,s0)
-@@ -50,7 +56,12 @@
+@@ -45,6 +53,7 @@
  
- /usr/sbin/clubufflush  --      gen_context(system_u:object_r:fsadm_exec_t,s0)
- /usr/sbin/fatsort      --      gen_context(system_u:object_r:fsadm_exec_t,s0)
-+/usr/sbin/findfs               --      gen_context(system_u:object_r:fsadm_exec_t,s0)
- /usr/sbin/parted       --      gen_context(system_u:object_r:fsadm_exec_t,s0)
-+/usr/sbin/partprobe            --      gen_context(system_u:object_r:fsadm_exec_t,s0)
-+/usr/sbin/partx                --      gen_context(system_u:object_r:fsadm_exec_t,s0)
+ /usr/bin/partition_uuid        --      gen_context(system_u:object_r:fsadm_exec_t,s0)
+ /usr/bin/raw           --      gen_context(system_u:object_r:fsadm_exec_t,s0)
 +/usr/sbin/raw          --      gen_context(system_u:object_r:fsadm_exec_t,s0)
-+/usr/sbin/sfdisk               --      gen_context(system_u:object_r:fsadm_exec_t,s0)
- /usr/sbin/smartctl     --      gen_context(system_u:object_r:fsadm_exec_t,s0)
+ /usr/bin/scsi_unique_id        --      gen_context(system_u:object_r:fsadm_exec_t,s0)
+ /usr/bin/syslinux      --      gen_context(system_u:object_r:fsadm_exec_t,s0)
  
- /var/log/fsck(/.*)?            gen_context(system_u:object_r:fsadm_log_t,s0)
+-- 
+1.7.9.5
+
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-fc-sysnetwork.patch b/recipes-security/refpolicy/refpolicy-git/poky-fc-sysnetwork.patch
index e0af6a1..64f497d 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-fc-sysnetwork.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-fc-sysnetwork.patch
@@ -1,41 +1,46 @@
+From 56ec3e527f2a03d217d5f07ebb708e6e26fa26ff Mon Sep 17 00:00:00 2001
+From: Xin Ouyang <Xin.Ouyang@windriver.com>
+Date: Tue, 9 Jun 2015 21:22:52 +0530
 Subject: [PATCH] refpolicy: fix real path for sysnetwork
 
 Upstream-Status: Inappropriate [configuration]
 
 Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
+Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
 ---
- policy/modules/system/sysnetwork.fc | 4 ++++
+ policy/modules/system/sysnetwork.fc |    4 ++++
  1 file changed, 4 insertions(+)
 
 diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc
-index dec8632..2e602e4 100644
+index fbb935c..a194622 100644
 --- a/policy/modules/system/sysnetwork.fc
 +++ b/policy/modules/system/sysnetwork.fc
-@@ -3,6 +3,7 @@
- # /bin
+@@ -4,6 +4,7 @@
  #
+ /bin/ifconfig          --      gen_context(system_u:object_r:ifconfig_exec_t,s0)
  /bin/ip                        --      gen_context(system_u:object_r:ifconfig_exec_t,s0)
-+/sbin/ip\.iproute2     --      gen_context(system_u:object_r:ifconfig_exec_t,s0)
++/sbin/ip\.iproute2 --  gen_context(system_u:object_r:ifconfig_exec_t,s0)
  
  #
  # /dev
-@@ -43,13 +44,16 @@ ifdef(`distro_redhat',`
+@@ -43,7 +44,9 @@ ifdef(`distro_redhat',`
  /sbin/dhcdbd           --      gen_context(system_u:object_r:dhcpc_exec_t,s0)
  /sbin/dhcpcd           --      gen_context(system_u:object_r:dhcpc_exec_t,s0)
  /sbin/ethtool          --      gen_context(system_u:object_r:ifconfig_exec_t,s0)
-+/usr/sbin/ethtool      --      gen_context(system_u:object_r:ifconfig_exec_t,s0)
++/usr/sbin/ethtool  --  gen_context(system_u:object_r:ifconfig_exec_t,s0)
  /sbin/ifconfig         --      gen_context(system_u:object_r:ifconfig_exec_t,s0)
-+/sbin/ifconfig\.net-tools      --      gen_context(system_u:object_r:ifconfig_exec_t,s0)
++/sbin/ifconfig\.net-tools  --  gen_context(system_u:object_r:ifconfig_exec_t,s0)
  /sbin/ip               --      gen_context(system_u:object_r:ifconfig_exec_t,s0)
  /sbin/ipx_configure    --      gen_context(system_u:object_r:ifconfig_exec_t,s0)
  /sbin/ipx_interface    --      gen_context(system_u:object_r:ifconfig_exec_t,s0)
- /sbin/ipx_internal_net --      gen_context(system_u:object_r:ifconfig_exec_t,s0)
+@@ -51,6 +54,7 @@ ifdef(`distro_redhat',`
+ /sbin/iw               --      gen_context(system_u:object_r:ifconfig_exec_t,s0)
  /sbin/iwconfig         --      gen_context(system_u:object_r:ifconfig_exec_t,s0)
  /sbin/mii-tool         --      gen_context(system_u:object_r:ifconfig_exec_t,s0)
-+/sbin/mii-tool\.net-tools      --      gen_context(system_u:object_r:ifconfig_exec_t,s0)
++/sbin/mii-tool\.net-tools  --  gen_context(system_u:object_r:ifconfig_exec_t,s0)
  /sbin/pump             --      gen_context(system_u:object_r:dhcpc_exec_t,s0)
  /sbin/tc               --      gen_context(system_u:object_r:ifconfig_exec_t,s0)
  
 -- 
-1.7.11.7
+1.7.9.5
 
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-setfiles_t-to-read-symlinks.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-setfiles_t-to-read-symlinks.patch
index 71497fb..9ef61b4 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-setfiles_t-to-read-symlinks.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-allow-setfiles_t-to-read-symlinks.patch
@@ -1,29 +1,30 @@
-From 22cd030a8118faae37c0835eb7875e482efe5dc1 Mon Sep 17 00:00:00 2001
+From 87b6daf87a07350a58c1724db8fc0a99b849818a Mon Sep 17 00:00:00 2001
 From: Xin Ouyang <Xin.Ouyang@windriver.com>
 Date: Thu, 22 Aug 2013 13:37:23 +0800
 Subject: [PATCH] fix setfiles_t to read symlinks
 
-Upstream-Status: Pending 
+Upstream-Status: Pending
 
 Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
+Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
 ---
  policy/modules/system/selinuxutil.te |    3 +++
- 1 files changed, 3 insertions(+), 0 deletions(-)
+ 1 file changed, 3 insertions(+)
 
 diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
-index ec01d0b..45ed81b 100644
+index 9058dd8..f998491 100644
 --- a/policy/modules/system/selinuxutil.te
 +++ b/policy/modules/system/selinuxutil.te
-@@ -553,6 +553,9 @@ files_list_all(setfiles_t)
- files_relabel_all_files(setfiles_t)
+@@ -552,6 +552,9 @@ files_relabel_all_files(setfiles_t)
  files_read_usr_symlinks(setfiles_t)
+ files_dontaudit_read_all_symlinks(setfiles_t)
  
 +# needs to be able to read symlinks to make restorecon on symlink working
 +files_read_all_symlinks(setfiles_t)
 +
- fs_getattr_xattr_fs(setfiles_t)
+ fs_getattr_all_xattr_fs(setfiles_t)
  fs_list_all(setfiles_t)
  fs_search_auto_mountpoints(setfiles_t)
 -- 
-1.7.5.4
+1.7.9.5
 
diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-setfiles-statvfs-get-file-count.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-setfiles-statvfs-get-file-count.patch
index 90efbd8..0b8cc5d 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-setfiles-statvfs-get-file-count.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-fix-setfiles-statvfs-get-file-count.patch
@@ -1,4 +1,4 @@
-From 4d2c4c358602b246881210889756f229730505d3 Mon Sep 17 00:00:00 2001
+From f4e034d6996c5b1f88a9262828dac2ad6ee09b7b Mon Sep 17 00:00:00 2001
 From: Xin Ouyang <Xin.Ouyang@windriver.com>
 Date: Fri, 23 Aug 2013 14:38:53 +0800
 Subject: [PATCH] fix setfiles statvfs to get file count
@@ -9,19 +9,20 @@ file_system_count() to get file count of filesystems.
 Upstream-Status: pending
 
 Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
+Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
 ---
  policy/modules/system/selinuxutil.te |    2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
-index 45ed81b..12c3d2e 100644
+index f998491..1a4e565 100644
 --- a/policy/modules/system/selinuxutil.te
 +++ b/policy/modules/system/selinuxutil.te
-@@ -556,7 +556,7 @@ files_read_usr_symlinks(setfiles_t)
+@@ -555,7 +555,7 @@ files_dontaudit_read_all_symlinks(setfiles_t)
  # needs to be able to read symlinks to make restorecon on symlink working
  files_read_all_symlinks(setfiles_t)
  
--fs_getattr_xattr_fs(setfiles_t)
+-fs_getattr_all_xattr_fs(setfiles_t)
 +fs_getattr_all_fs(setfiles_t)
  fs_list_all(setfiles_t)
  fs_search_auto_mountpoints(setfiles_t)
diff --git a/recipes-security/refpolicy/refpolicy-git/refpolicy-update-for_systemd.patch b/recipes-security/refpolicy/refpolicy-git/refpolicy-update-for_systemd.patch
index 80b420c..9693345 100644
--- a/recipes-security/refpolicy/refpolicy-git/refpolicy-update-for_systemd.patch
+++ b/recipes-security/refpolicy/refpolicy-git/refpolicy-update-for_systemd.patch
@@ -1,41 +1,22 @@
-refpolicy: update for systemd
- 
-It provides the systemd support for refpolicy 
-and related allow rules. 
-The restorecon provides systemd init labeled 
-as init_exec_t.
+From 07553727dca51631c93bca482442da8d0c50ac94 Mon Sep 17 00:00:00 2001
+From: Shrikant Bobade <shrikant_bobade@mentor.com>
+Date: Fri, 12 Jun 2015 19:37:52 +0530
+Subject: [PATCH] refpolicy: update for systemd related allow rules
 
-Upstream-Status: Pending
+It provide, the systemd support related allow rules
 
+Upstream-Status: Pending
 
-Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
+Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com>
+---
+ policy/modules/system/init.te |    5 +++++
+ 1 file changed, 5 insertions(+)
 
---- a/policy/modules/contrib/shutdown.fc
-+++ b/policy/modules/contrib/shutdown.fc
-@@ -5,6 +5,9 @@
- /sbin/shutdown --      gen_context(system_u:object_r:shutdown_exec_t,s0)
- /sbin/shutdown\.sysvinit       --      gen_context(system_u:object_r:shutdown_exec_t,s0)
- 
-+# systemd support
-+/bin/systemctl --      gen_context(system_u:object_r:shutdown_exec_t,s0)
-+
- /usr/lib/upstart/shutdown      --      gen_context(system_u:object_r:shutdown_exec_t,s0)
- 
- /usr/sbin/shutdown     --      gen_context(system_u:object_r:shutdown_exec_t,s0)
---- a/policy/modules/system/init.fc
-+++ b/policy/modules/system/init.fc
-@@ -31,6 +31,8 @@
- #
- /sbin/init(ng)?                --      gen_context(system_u:object_r:init_exec_t,s0)
- /sbin/init\.sysvinit   --      gen_context(system_u:object_r:init_exec_t,s0)
-+# systemd support
-+/lib/systemd/systemd   --      gen_context(system_u:object_r:init_exec_t,s0)
- # because nowadays, /sbin/init is often a symlink to /sbin/upstart
- /sbin/upstart          --      gen_context(system_u:object_r:init_exec_t,s0)
- 
+diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
+index c8f007d..a9675f6 100644
 --- a/policy/modules/system/init.te
 +++ b/policy/modules/system/init.te
-@@ -913,3 +913,8 @@
+@@ -929,3 +929,8 @@ optional_policy(`
  optional_policy(`
         zebra_read_config(initrc_t)
  ')
@@ -44,3 +25,7 @@ Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
 +allow kernel_t init_t:process dyntransition;
 +allow devpts_t device_t:filesystem associate;
 +allow init_t self:capability2 block_suspend;
+\ No newline at end of file
+-- 
+1.7.9.5
+