[gentoo-hardened] Update on selinux-policy-2 eclass

[Sven Vermeulen]

Hi *

To allow for more manageable patching on our selinux policies (since Matthew
will bombard me anyhow with things to fix ;-) and not to clutter the files/
directory in the Portage tree, I've been meaning to update the
selinux-policy-2 eclass to support reusing the patchbundles offered by the
selinux-base-policy releases. The result can currently be seen at
http://bit.ly/owGhAs but, unless people object, I'll be pushing this eclass
to the hardened-dev overlay tomorrow (in an eclass/ directory) without
changing the eclass name ("bumping") since it doesn't change anything for
existing ebuilds.

The changes made to the eclass are:
- support for the BASEPOL version (reuse of patch bundles)
- (fix) apply patches before copying sources
- add the necessary eclass documentation comments
- define the eclass variables (including POLICY_TYPES)
- support higher-level EAPIs (0 - 4 currently)

Below more information about these changes for those interested.

This change is part of a larger change coming up, namely to update the
SELinux policy packages to 2.20110726. Since I'll make these be EAPI=4 this
eclass update is a prerequisite.

Wkr,
	Sven Vermeulen

Support for the BASEPOL version (reuse of patch bundles)
========================================================

We introduce a new eclass variable called BASEPOL which can be used by an
ebuild to declare that the module depends on a particular
selinux-base-policy as well as needs to be patched with the patches in the
patchbundle (that is available with the selinux-base-policy).

If BASEPOL isn't set, the old behaviour is kept (i.e. not applying the
patchbundle). Also, the POLICY_PATCH variable is still used so no changes
there. The main difference is that, if BASEPOL is used, then the
POLICY_PATCH provided patches need to be relative to this BASEPOL version
(and not the main upstream version).

An example:
	MODS="gpg"
	BASEPOL="2.20110726-r1"

	inherit selinux-policy-2

Previously, we had to do something like this:
	MODS="gpg"
	DEPEND=">=sec-policy/selinux-base-policy-2.20110726-r1"
	POLICY_PATCH="${FILESDIR}/fix-apps-gpg-r1.patch"

	inherit selinux-policy-2

where the fix in POLICY_PATCH was still available in the patchbundle as
well. This led to duplicate patch management efforts and increased the
number of files we had in our various "files/" locations.


(Fix) Apply patches before copying sources
==========================================

In our current selinux-policy-2 eclass, we copy the reference policy sources
to several source directories, labeled after their target policy (targeted,
strict, mcs, mls) after which we applied the (same) patches to each source
directory. This we can of course optimize, so the new eclass patches the
sources before copying them to the respective source directories.

Add the necessary eclass documentation comments
===============================================

Gentoo requires that the eclasses are properly documented using specific
tags in the eclass comments, allowing for automated eclass documentation
generation. An example of such automatically generated document can be found
at http://devmanual.gentoo.org/eclass-reference/mysql.eclass/index.html

For the selinux-policy-2 eclass, no such document exists yet since our
eclass wasn't properly documented. The new eclass contains the proper
documentation tags.


Define the eclass variables (including POLICY_TYPES)
====================================================

Part of the eclass documentation effort is to streamline the variable
declarations. One variable that we currently use is POLICY_TYPES, where we
did many of the following calls:
	[ -z "${POLICY_TYPES} ] && local POLICY_TYPES="strict targeted mls mcs"

By declaring the variables with a default fallback value, all these calls
aren't necessary anymore. 


Support higher-level EAPIs (0 - 4 currently)
============================================

Higher level EAPIs (more than 1 ;-) introduce specific phase functions to
streamline the build process (src_prepare & src_configure). The new eclass
update supports these, but if the EAPI isn't sufficiently high, the old
behaviour is retained (for instance, src_unpack then calls src_prepare
itself).

This also allows for sec-policy/* to be fully EAPI=4 defined, which will be
the case for the 2.20110726 version(s) of the policies.