[gentoo-commits] proj/hardened-dev:master commit in: sec-policy/selinux-mozilla/files/, sec-policy/selinux-mozilla/, ...

[Sven Vermeulen]

commit:     e67dd39d2a05726d5dde9f9086c1cad1dd918038
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Tue Aug  2 19:54:06 2011 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Tue Aug  2 19:54:06 2011 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-dev.git;a=commit;h=e67dd39d

Update on 2.20101213 policy

---
 sec-policy/selinux-base-policy/ChangeLog           |  550 ++++++++++++++++++++
 sec-policy/selinux-base-policy/files/config        |   15 +
 sec-policy/selinux-base-policy/files/modules.conf  |   49 ++
 ...ndle-selinux-base-policy-2.20101213-r22.tar.bz2 |  Bin 0 -> 20236 bytes
 sec-policy/selinux-base-policy/metadata.xml        |   14 +
 .../selinux-base-policy-2.20101213-r22.ebuild      |  147 ++++++
 sec-policy/selinux-mozilla/ChangeLog               |   40 ++
 .../files/fix-apps-mozilla-r4.patch                |   82 +++
 sec-policy/selinux-mozilla/metadata.xml            |    6 +
 .../selinux-mozilla-2.20101213-r4.ebuild           |   15 +
 sec-policy/selinux-pan/ChangeLog                   |   33 ++
 sec-policy/selinux-pan/files/fix-apps-pan-r1.patch |  110 ++++
 sec-policy/selinux-pan/metadata.xml                |    6 +
 .../selinux-pan/selinux-pan-2.20101213-r1.ebuild   |   16 +
 sec-policy/selinux-skype/ChangeLog                 |   33 ++
 .../selinux-skype/files/fix-apps-skype-r3.patch    |  120 +++++
 sec-policy/selinux-skype/metadata.xml              |    6 +
 .../selinux-skype-2.20101213-r3.ebuild             |   16 +
 18 files changed, 1258 insertions(+), 0 deletions(-)

diff --git a/sec-policy/selinux-base-policy/ChangeLog b/sec-policy/selinux-base-policy/ChangeLog
new file mode 100644
index 0000000..bb333fb
--- /dev/null
+++ b/sec-policy/selinux-base-policy/ChangeLog
@@ -0,0 +1,550 @@
+# ChangeLog for sec-policy/selinux-base-policy
+# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-base-policy/ChangeLog,v 1.80 2011/07/11 01:59:36 blueness Exp $
+
+*selinux-base-policy-2.20101213-r22 (02 Aug 2011)
+
+  02 Aug 2011; <swift@g.o> +selinux-base-policy-2.20101213-r22.ebuild,
+  +files/patchbundle-selinux-base-policy-2.20101213-r22.tar.bz2, +files/config,
+  +files/modules.conf, +metadata.xml:
+  Support cron-triggered portage administration tasks, add pan policy
+
+*selinux-base-policy-2.20101213-r20 (19 Jul 2011)
+
+  19 Jul 2011; <swift@g.o> -selinux-base-policy-2.20101213-r19.ebuild,
+  +selinux-base-policy-2.20101213-r20.ebuild,
+  -files/patchbundle-selinux-base-policy-2.20101213-r19.tar.bz2,
+  +files/patchbundle-selinux-base-policy-2.20101213-r20.tar.bz2:
+  Start with -r20 series
+
+  11 Jul 2011; Anthony G. Basile <blueness@g.o>
+  -files/selinux-base-policy-20070329.diff,
+  -selinux-base-policy-20080525.ebuild,
+  -selinux-base-policy-20080525-r1.ebuild, -files/modules.conf.strict,
+  -files/modules.conf.strict.20070928, -files/modules.conf.strict.20080525,
+  -files/modules.conf.targeted, -files/modules.conf.targeted.20070928,
+  -files/modules.conf.targeted.20080525:
+  Removed all pre 2.20xx base policies
+
+*selinux-base-policy-2.20101213-r18 (10 Jul 2011)
+
+  10 Jul 2011; Anthony G. Basile <blueness@g.o>
+  +selinux-base-policy-2.20101213-r18.ebuild:
+  Bump to r18, improve support for openrc, allow portage to work with
+  NFS-mounted locations, fix firefox plugin support, fix postgres init
+  script support, fix syslog startup issue
+
+  03 Jul 2011; Anthony G. Basile <blueness@g.o>
+  selinux-base-policy-2.20101213-r16.ebuild,
+  selinux-base-policy-2.20101213-r17.ebuild,
+  -files/patchbundle-selinux-base-policy-2.20101213-r16.tar.bz2,
+  -files/patchbundle-selinux-base-policy-2.20101213-r17.tar.bz2:
+  Moved patchbundles out of ${FILESDIR}, bug #370927
+
+  30 Jun 2011; Anthony G. Basile <blueness@g.o>
+  -selinux-base-policy-2.20101213-r11.ebuild,
+  -selinux-base-policy-2.20101213-r12.ebuild,
+  -files/patchbundle-selinux-base-policy-2.20101213-r11.tar.bz2,
+  -files/patchbundle-selinux-base-policy-2.20101213-r12.tar.bz2:
+  Removed deprecated versions
+
+*selinux-base-policy-2.20101213-r17 (30 Jun 2011)
+
+  30 Jun 2011; Anthony G. Basile <blueness@g.o>
+  +selinux-base-policy-2.20101213-r17.ebuild,
+  +files/patchbundle-selinux-base-policy-2.20101213-r17.tar.bz2:
+  Add support for zabbix
+
+  02 Jun 2011; Anthony G. Basile <blueness@g.o>
+  selinux-base-policy-2.20101213-r16.ebuild:
+  Stable amd64 x86
+
+  20 May 2011; Anthony G. Basile <blueness@g.o>
+  -selinux-base-policy-2.20101213-r5.ebuild,
+  -selinux-base-policy-2.20101213-r6.ebuild,
+  -selinux-base-policy-2.20101213-r7.ebuild,
+  -selinux-base-policy-2.20101213-r9.ebuild,
+  -selinux-base-policy-2.20101213-r10.ebuild,
+  -files/patchbundle-selinux-base-policy-2.20101213-r10.tar.bz2,
+  -files/patchbundle-selinux-base-policy-2.20101213-r5.tar.bz2,
+  -files/patchbundle-selinux-base-policy-2.20101213-r6.tar.bz2,
+  -files/patchbundle-selinux-base-policy-2.20101213-r7.tar.bz2,
+  -files/patchbundle-selinux-base-policy-2.20101213-r9.tar.bz2:
+  Removed deprecated revisions of base policy 2.20101213
+
+*selinux-base-policy-2.20101213-r16 (20 May 2011)
+
+  20 May 2011; Anthony G. Basile <blueness@g.o>
+  +selinux-base-policy-2.20101213-r16.ebuild,
+  +files/patchbundle-selinux-base-policy-2.20101213-r16.tar.bz2, metadata.xml:
+  Drop obsoleted policy builds, add openrc support (rc-update, rc-status),
+  correct file contexts for /lib64, make UBAC optional (#257111 and #306393),
+  use portage_srcrepo_t for live ebuilds and match mdadm policy with upstream
+
+*selinux-base-policy-2.20101213-r12 (16 Apr 2011)
+*selinux-base-policy-2.20101213-r11 (16 Apr 2011)
+
+  16 Apr 2011; Anthony G. Basile <blueness@g.o>
+  +selinux-base-policy-2.20101213-r11.ebuild,
+  +selinux-base-policy-2.20101213-r12.ebuild,
+  +files/patchbundle-selinux-base-policy-2.20101213-r11.tar.bz2,
+  +files/patchbundle-selinux-base-policy-2.20101213-r12.tar.bz2:
+  Added new patchbundles for rev bumps to base policy 2.20101213
+
+*selinux-base-policy-2.20101213-r10 (07 Mar 2011)
+*selinux-base-policy-2.20101213-r9 (07 Mar 2011)
+
+  07 Mar 2011; Anthony G. Basile <blueness@g.o>
+  +selinux-base-policy-2.20101213-r9.ebuild,
+  +selinux-base-policy-2.20101213-r10.ebuild,
+  +files/patchbundle-selinux-base-policy-2.20101213-r10.tar.bz2,
+  +files/patchbundle-selinux-base-policy-2.20101213-r9.tar.bz2:
+  Added new patchbundles for rev bumps to base policy 2.20101213
+
+  05 Feb 2011; Anthony G. Basile <blueness@g.o>
+  +files/patchbundle-selinux-base-policy-2.20101213-r5.tar.bz2,
+  +files/patchbundle-selinux-base-policy-2.20101213-r6.tar.bz2,
+  +files/patchbundle-selinux-base-policy-2.20101213-r7.tar.bz2:
+  Added patchbundle for base policy 2.20101213.
+
+*selinux-base-policy-2.20101213-r7 (05 Feb 2011)
+*selinux-base-policy-2.20101213-r6 (05 Feb 2011)
+*selinux-base-policy-2.20101213-r5 (05 Feb 2011)
+
+  05 Feb 2011; Anthony G. Basile <blueness@g.o>
+  +selinux-base-policy-2.20101213-r5.ebuild,
+  +selinux-base-policy-2.20101213-r6.ebuild,
+  +selinux-base-policy-2.20101213-r7.ebuild:
+  New upstream policy.
+
+*selinux-base-policy-2.20091215 (16 Dec 2009)
+
+  16 Dec 2009; Chris PeBenito <pebenito@g.o>
+  +selinux-base-policy-2.20091215.ebuild:
+  New upstream release.
+
+*selinux-base-policy-20080525-r1 (14 Sep 2009)
+
+  14 Sep 2009; Chris PeBenito <pebenito@g.o>
+  +selinux-base-policy-20080525-r1.ebuild:
+  Update old base policy to support ext4.
+
+  14 Aug 2009; Chris PeBenito <pebenito@g.o>
+  -selinux-base-policy-20070329.ebuild,
+  -selinux-base-policy-20070928.ebuild, selinux-base-policy-20080525.ebuild:
+  Mark 20080525 stable, clear old ebuilds.
+
+*selinux-base-policy-2.20090814 (14 Aug 2009)
+
+  14 Aug 2009; Chris PeBenito <pebenito@g.o>
+  +selinux-base-policy-2.20090814.ebuild:
+  Git version of refpolicy for misc fixes including some cron problems.
+
+*selinux-base-policy-2.20090730 (03 Aug 2009)
+
+  03 Aug 2009; Chris PeBenito <pebenito@g.o>
+  +selinux-base-policy-2.20090730.ebuild:
+  New upstream release.
+
+  18 Jul 2009; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20070329.ebuild, selinux-base-policy-20070928.ebuild,
+  selinux-base-policy-20080525.ebuild:
+  Drop alpha, mips, ppc, sparc selinux support.
+
+*selinux-base-policy-20080525 (25 May 2008)
+
+  25 May 2008; Chris PeBenito <pebenito@g.o>
+  +selinux-base-policy-20080525.ebuild:
+  New SVN snapshot.
+
+  16 Mar 2008; Chris PeBenito <pebenito@g.o>
+  -selinux-base-policy-20051022-r1.ebuild,
+  -selinux-base-policy-20061114.ebuild:
+  Remove old ebuilds.
+
+  03 Feb 2008; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20070928.ebuild:
+  Mark stable.
+
+*selinux-base-policy-20070928 (26 Nov 2007)
+
+  26 Nov 2007; Chris PeBenito <pebenito@g.o>
+  +selinux-base-policy-20070928.ebuild:
+  New SVN snapshot.
+
+  04 Jun 2007; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20070329.ebuild:
+  Mark stable.
+
+  30 Mar 2007; Chris PeBenito <pebenito@g.o>
+  +files/selinux-base-policy-20070329.diff,
+  selinux-base-policy-20070329.ebuild:
+  Compile fix.
+
+*selinux-base-policy-20070329 (29 Mar 2007)
+
+  29 Mar 2007; Chris PeBenito <pebenito@g.o>
+  +selinux-base-policy-20070329.ebuild:
+  New SVN snapshot.
+
+  22 Feb 2007; Markus Ullmann <jokey@g.o> ChangeLog:
+  Redigest for Manifest2
+
+*selinux-base-policy-20061114 (15 Nov 2006)
+
+  15 Nov 2006; Chris PeBenito <pebenito@g.o>
+  +selinux-base-policy-20061114.ebuild:
+  New SVN snapshot.
+
+  25 Oct 2006; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20061015.ebuild:
+  Fix to have default POLICY_TYPES if it is empty.
+
+  21 Oct 2006; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20061015.ebuild:
+  Fix xml generation failure to die.
+
+*selinux-base-policy-20061015 (15 Oct 2006)
+
+  15 Oct 2006; Chris PeBenito <pebenito@g.o>
+  -selinux-base-policy-20061008.ebuild,
+  +selinux-base-policy-20061015.ebuild:
+  Update for testing fixes.
+
+*selinux-base-policy-20061008 (08 Oct 2006)
+
+  08 Oct 2006; Chris PeBenito <pebenito@g.o> -files/semanage.conf,
+  +selinux-base-policy-20061008.ebuild,
+  -selinux-base-policy-99999999.ebuild:
+  First mainstream reference policy testing release.
+
+  29 Sep 2006; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-99999999.ebuild:
+  Fix for new SVN location.  Fixes 147781.
+
+  22 Feb 2006; Stephen Bennett <spb@g.o>
+  selinux-base-policy-20051022-r1.ebuild:
+  Alpha stable
+
+*selinux-base-policy-99999999 (02 Feb 2006)
+
+  02 Feb 2006; Chris PeBenito <pebenito@g.o> +files/config,
+  +files/modules.conf.strict, +files/modules.conf.targeted,
+  +files/semanage.conf, +selinux-base-policy-99999999.ebuild:
+  Add experimental policy for testing reference policy. Requires portage fix
+  from bug #110857.
+
+  02 Feb 2006; Chris PeBenito <pebenito@g.o>
+  -selinux-base-policy-20050322.ebuild,
+  -selinux-base-policy-20050618.ebuild,
+  -selinux-base-policy-20050821.ebuild,
+  -selinux-base-policy-20051022.ebuild:
+  Clean out old ebuilds.
+
+  14 Jan 2006; Stephen Bennett <spb@g.o>
+  selinux-base-policy-20051022-r1.ebuild:
+  Added ~alpha
+
+*selinux-base-policy-20051022-r1 (08 Dec 2005)
+
+  08 Dec 2005; Chris PeBenito <pebenito@g.o>
+  +selinux-base-policy-20051022-r1.ebuild:
+  Change to use compatability genhomedircon. Newer policycoreutils (1.28)
+  breaks the backwards compatability this policy uses.
+
+*selinux-base-policy-20051022 (22 Oct 2005)
+
+  22 Oct 2005; Chris PeBenito <pebenito@g.o>
+  +selinux-base-policy-20051022.ebuild:
+  Very trivial fixes.
+
+  08 Sep 2005; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20050821.ebuild:
+  Mark stable.
+
+*selinux-base-policy-20050821 (21 Aug 2005)
+
+  21 Aug 2005; Chris PeBenito <pebenito@g.o>
+  +selinux-base-policy-20050821.ebuild:
+  Minor updates for 2.6.12.
+
+  21 Jun 2005; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20050618.ebuild:
+  Mark stable.
+
+*selinux-base-policy-20050618 (18 Jun 2005)
+
+  18 Jun 2005; Chris PeBenito <pebenito@g.o>
+  -selinux-base-policy-20041123.ebuild,
+  -selinux-base-policy-20050306.ebuild,
+  +selinux-base-policy-20050618.ebuild:
+  New release to support 2.6.12 features.
+
+  10 May 2005; Stephen Bennett <spb@g.o>
+  selinux-base-policy-20050322.ebuild:
+  mips stable
+
+  01 May 2005; Stephen Bennett <spb@g.o>
+  selinux-base-policy-20050322.ebuild:
+  Added ~mips.
+
+*selinux-base-policy-20050322 (23 Mar 2005)
+
+  23 Mar 2005; Chris PeBenito <pebenito@g.o>
+  +selinux-base-policy-20050322.ebuild:
+  New release.
+
+*selinux-base-policy-20050306 (06 Mar 2005)
+
+  06 Mar 2005; Chris PeBenito <pebenito@g.o>
+  +selinux-base-policy-20050306.ebuild:
+  Fix bad samba_domain dummy macro.  Add policies needed for udev support.
+
+*selinux-base-policy-20050224 (24 Feb 2005)
+
+  24 Feb 2005; Chris PeBenito <pebenito@g.o>
+  +selinux-base-policy-20050224.ebuild:
+  New release.
+
+  19 Jan 2005; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20041123.ebuild:
+  Mark stable.
+
+*selinux-base-policy-20041123 (23 Nov 2004)
+
+  23 Nov 2004; Chris PeBenito <pebenito@g.o>
+  +selinux-base-policy-20041123.ebuild:
+  New release with 1.18 merge.
+
+*selinux-base-policy-20041023 (23 Oct 2004)
+
+  23 Oct 2004; Chris PeBenito <pebenito@g.o>
+  +selinux-base-policy-20041023.ebuild:
+  New release with 1.16 merge. Tcpd and inetd have been deprecated since they
+  are not in the base system anymore, and probably no one uses them anyway.
+
+*selinux-base-policy-20040906 (06 Sep 2004)
+
+  06 Sep 2004; Chris PeBenito <pebenito@g.o>
+  +selinux-base-policy-20040906.ebuild:
+  New release with 1.14 merge, which has policy 18 (fine-grained netlink)
+  features.
+
+  05 Sep 2004; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20040225.ebuild, -selinux-base-policy-20040509.ebuild,
+  -selinux-base-policy-20040604.ebuild, selinux-base-policy-20040629.ebuild,
+  selinux-base-policy-20040702.ebuild:
+  Remove old builds, switch to epause and ebeep in remaining builds.
+
+*selinux-base-policy-20040702 (02 Jul 2004)
+
+  02 Jul 2004; Chris PeBenito <pebenito@g.o>
+  +selinux-base-policy-20040702.ebuild:
+  Same as 20040629, except with updated flask headers, which will come out in
+  2.6.8.
+
+*selinux-base-policy-20040629 (29 Jun 2004)
+
+  29 Jun 2004; Chris PeBenito <pebenito@g.o>
+  +selinux-base-policy-20040629.ebuild:
+  Large sysadmfile cleanup: disable admin_separation to give sysadm_r back its
+  ablility to modify all files. Minor fixes: portage_r works again, syslog-ng
+  breakage fixed, put back manual PaX policy for pageexec/segmexec.
+
+  16 Jun 2004; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20040604.ebuild:
+  Mark stable.
+
+  10 Jun 2004; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20040225.ebuild, selinux-base-policy-20040509.ebuild,
+  selinux-base-policy-20040604.ebuild:
+  Add src_compile() stub
+
+*selinux-base-policy-20040604 (04 Jun 2004)
+
+  04 Jun 2004; Chris PeBenito <pebenito@g.o>
+  +selinux-base-policy-20040604.ebuild:
+  New release including 1.12 NSA policy, and experimental sesandbox.
+
+  15 May 2004; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20040509.ebuild:
+  Mark stable.
+
+*selinux-base-policy-20040509 (09 May 2004)
+
+  09 May 2004; Chris PeBenito <pebenito@g.o>
+  +selinux-base-policy-20040509.ebuild:
+  A few small cleanups. Make PaX non exec pages macro based on arch. Large
+  portage update, get rid of portage_exec_fetch_t, portage will setexec. Add
+  global_ssp tunable.
+
+*selinux-base-policy-20040418 (18 Apr 2004)
+
+  18 Apr 2004; Chris PeBenito <pebenito@g.o>
+  +selinux-base-policy-20040418.ebuild:
+  New release for checkpolicy 1.10
+
+*selinux-base-policy-20040414 (14 Apr 2004)
+
+  14 Apr 2004; Chris PeBenito <pebenito@g.o>
+  -selinux-base-policy-20040408.ebuild, +selinux-base-policy-20040414.ebuild:
+  Minor updates
+
+*selinux-base-policy-20040408 (08 Apr 2004)
+
+  08 Apr 2004; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20040408.ebuild:
+  New update. Users.fc is now deprecated, as the contexts for user directories
+  is now automatically generated. Portage fetching of distfiles now has a
+  subdomain, for dropping priviledges.
+
+  28 Feb 2004; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20040225.ebuild:
+  Mark stable.
+
+*selinux-base-policy-20040225 (25 Feb 2004)
+
+  25 Feb 2004; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20040225.ebuild:
+  New support for PaX ACL hooks. Addition of tunable.te for configurable policy
+  options. Rewrite of portage.te. Now auto-transition for sysadm is default, can
+  reenable portage_r by tunable.te. Makefile update from NSA CVS.
+
+*selinux-base-policy-20040209 (09 Feb 2004)
+
+  09 Feb 2004; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20040209.ebuild:
+  Minor revision to add XFS labeling and policy for integrated
+  runscript-run_init.
+
+  07 Feb 2004; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20040202.ebuild:
+  Mark x86 stable.
+
+*selinux-base-policy-20040202 (02 Feb 2004)
+
+  02 Feb 2004; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20040202.ebuild:
+  A few misc fixes. Allow portage to update bootloader code, such as in lilo or
+  grub postinst. This requires checkpolicy 1.4-r1.
+
+*selinux-base-policy-20031225 (25 Dec 2003)
+
+  25 Dec 2003; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20031225.ebuild:
+  New release, with merged NSA 1.4 policy. One critical note, this policy
+  requires pam 0.77. Much work has been done to minimize access to /etc/shadow,
+  and one requirement is in the patch for pam 0.77. If you do not use this pam
+  version or newer, you will be unable to authenticate in enforcing. Since
+  devfs no longer is usable in SELinux, it's policy has been removed. You
+  should merge the changes, remove the devfsd policy (devfsd.te and devfsd.fc),
+  load the policy, and relabel.
+
+  27 Nov 2003; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20031010-r1.ebuild:
+  Mark stable.  Add build USE flag for stage building.
+
+*selinux-base-policy-20031010-r1 (12 Nov 2003)
+
+  12 Nov 2003; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20031010-r1.ebuild,
+  files/selinux-base-policy-20031010-cvs.diff:
+  Add fixes from policy cvs for compilers, so non x86 and ppc compilers can
+  work. Also portage update as a side effect of updated setfiles code in
+  portage, from bug 31748.
+
+  28 Oct 2003; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20031010.ebuild:
+  Mark stable
+
+*selinux-base-policy-20031010 (10 Oct 2003)
+
+  10 Oct 2003; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20031010.ebuild:
+  New release for new API.  Massive cleanups all over the place.
+
+*selinux-base-policy-20030817 (17 Aug 2003)
+
+  17 Aug 2003; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20030817.ebuild:
+  Initial commit of new API policy
+
+  10 Aug 2003; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20030729-r1.ebuild:
+  Mark stable
+
+*selinux-base-policy-20030729-r1 (31 Jul 2003)
+
+  31 Jul 2003; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20030729-r1.ebuild:
+  New rev that handles an empty POLICYDIR sanely.
+
+*selinux-base-policy-20030729 (29 Jul 2003)
+
+  29 Jul 2003; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20030729.ebuild:
+  Make the ebuild use POLICYDIR. Important fix so portage can load policy so
+  selinux-policy.eclass works. update_modules_t cleanup. Fix for an access when
+  merging baselayout.
+
+*selinux-base-policy-20030720 (20 Jul 2003)
+
+  20 Jul 2003; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20030720.ebuild:
+  Many fixes, including the syslog fix. File contexts have changed, so a relabel
+  is needed. You may encounter problems relabeling /usr/portage, as its file
+  context has changed, as files should not have the same type as a domain.
+  Relabelling in permissive will fix this, or temporarily give portage_t a
+  file_type attribute. Tightened the can_exec_any() macro. Moved staff.fc to
+  users.fc, since all users with SELinux identities should have their home
+  directories have the correct identity, not the generic identity.
+
+  06 Jun 2003; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20030604.ebuild:
+  Mark stable
+
+*selinux-base-policy-20030604 (04 Jun 2003)
+
+  04 Jun 2003; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20030604.ebuild:
+  Fix broken 20030603
+
+  04 Jun 2003; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20030603.ebuild:
+  Pulling 20030603, as there are problems, 20030604 later today
+
+*selinux-base-policy-20030603 (03 Jun 2003)
+
+  03 Jun 2003; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20030603.ebuild:
+  Numerous various fixes. Added staff role. Removed ipsec, gpm and gpg policies
+  as they are not appropriate for the base policy, and untested.
+
+*selinux-base-policy-20030522 (22 May 2003)
+
+  22 May 2003; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20030522.ebuild:
+  The policy is in pretty good shape now. I've been able to run in enforcing mode
+  with little problem. I've also been able to successfully merge and unmerge
+  packages in enforcing mode, with few exceptions (why does mysql need to run ps
+  during configure?).
+
+*selinux-base-policy-20030514 (14 May 2003)
+
+  14 May 2003; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20030514.ebuild:
+  Many improvements in many areas. Of note, rlogind policies were removed. Klogd
+  is being merged into syslogd. The portage policy is much more complete, but
+  still needs work. Its suggested that all changes be merged in, policy
+  reloaded, then relabel.
+
+*selinux-base-policy-20030419 (19 Apr 2003)
+
+  23 Apr 2003; Chris PeBenito <pebenito@g.o>
+  selinux-base-policy-20030419.ebuild:
+  Marking stable for selinux-small stable usage
+
+  19 Apr 2003; Chris PeBenito <pebenito@g.o> Manifest,
+  selinux-base-policy-20030419.ebuild:
+  Initial commit.  Base policies for SELinux, with Gentoo-specifics
+

diff --git a/sec-policy/selinux-base-policy/files/config b/sec-policy/selinux-base-policy/files/config
new file mode 100644
index 0000000..55933ea
--- /dev/null
+++ b/sec-policy/selinux-base-policy/files/config
@@ -0,0 +1,15 @@
+# This file controls the state of SELinux on the system on boot.
+
+# SELINUX can take one of these three values:
+#	enforcing - SELinux security policy is enforced.
+#	permissive - SELinux prints warnings instead of enforcing.
+#	disabled - No SELinux policy is loaded.
+SELINUX=permissive
+
+# SELINUXTYPE can take one of these four values:
+#	targeted - Only targeted network daemons are protected.
+#	strict   - Full SELinux protection.
+#	mls      - Full SELinux protection with Multi-Level Security
+#	mcs      - Full SELinux protection with Multi-Category Security 
+#	           (mls, but only one sensitivity level)
+SELINUXTYPE=strict

diff --git a/sec-policy/selinux-base-policy/files/modules.conf b/sec-policy/selinux-base-policy/files/modules.conf
new file mode 100644
index 0000000..fcb3fd8
--- /dev/null
+++ b/sec-policy/selinux-base-policy/files/modules.conf
@@ -0,0 +1,49 @@
+application = base
+authlogin = base
+bootloader = base
+clock = base
+consoletype = base
+corecommands = base
+corenetwork = base
+cron = base
+devices = base
+dmesg = base
+domain = base
+files = base
+filesystem = base
+fstools = base
+getty = base
+hostname = base
+hotplug = base
+init = base
+iptables = base
+kernel = base
+libraries = base
+locallogin = base
+logging = base
+lvm = base
+miscfiles = base
+mcs = base
+mls = base
+modutils = base
+mount = base
+mta = base
+netutils = base
+nscd = base
+portage = base
+raid = base
+rsync = base
+selinux = base
+selinuxutil = base
+ssh = base
+staff = base
+storage = base
+su = base
+sysadm = base
+sysnetwork = base
+terminal = base
+ubac = base
+udev = base
+userdomain = base
+usermanage = base
+unprivuser = base

diff --git a/sec-policy/selinux-base-policy/files/patchbundle-selinux-base-policy-2.20101213-r22.tar.bz2 b/sec-policy/selinux-base-policy/files/patchbundle-selinux-base-policy-2.20101213-r22.tar.bz2
new file mode 100644
index 0000000..c530e0e
Binary files /dev/null and b/sec-policy/selinux-base-policy/files/patchbundle-selinux-base-policy-2.20101213-r22.tar.bz2 differ

diff --git a/sec-policy/selinux-base-policy/metadata.xml b/sec-policy/selinux-base-policy/metadata.xml
new file mode 100644
index 0000000..393f3bb
--- /dev/null
+++ b/sec-policy/selinux-base-policy/metadata.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<herd>selinux</herd>
+	<longdescription>
+		Gentoo SELinux base policy.  This contains policy for a system at the end of system installation.
+		There is no extra policy in this package.
+	</longdescription>
+	<use>
+		<flag name='peer_perms'>Enable the labeled networking peer permissions (SELinux policy capability).</flag>
+		<flag name='open_perms'>Enable the open permissions for file object classes (SELinux policy capability).</flag>
+		<flag name='ubac'>Enable User Based Access Control (UBAC) in the SELinux policy</flag>
+	</use>
+</pkgmetadata>

diff --git a/sec-policy/selinux-base-policy/selinux-base-policy-2.20101213-r22.ebuild b/sec-policy/selinux-base-policy/selinux-base-policy-2.20101213-r22.ebuild
new file mode 100644
index 0000000..96d033e
--- /dev/null
+++ b/sec-policy/selinux-base-policy/selinux-base-policy-2.20101213-r22.ebuild
@@ -0,0 +1,147 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-base-policy/selinux-base-policy-2.20101213-r18.ebuild,v 1.1 2011/07/10 02:30:17 blueness Exp $
+
+EAPI="1"
+IUSE="+peer_perms +open_perms +ubac"
+
+inherit eutils
+
+PATCHBUNDLE="${FILESDIR}/patchbundle-${PF}.tar.bz2"
+#PATCHBUNDLE="${DISTDIR}/patchbundle-${PF}.tar.bz2"
+DESCRIPTION="Gentoo base policy for SELinux"
+HOMEPAGE="http://www.gentoo.org/proj/en/hardened/selinux/"
+SRC_URI="http://oss.tresys.com/files/refpolicy/refpolicy-${PV}.tar.bz2"
+#SRC_URI="http://oss.tresys.com/files/refpolicy/refpolicy-${PV}.tar.bz2
+#	http://dev.gentoo.org/~blueness/patchbundle-selinux-base-policy/patchbundle-${PF}.tar.bz2"
+LICENSE="GPL-2"
+SLOT="0"
+
+KEYWORDS="~amd64 ~x86"
+
+RDEPEND=">=sys-apps/policycoreutils-1.30.30
+	>=sys-fs/udev-151"
+DEPEND="${RDEPEND}
+	sys-devel/m4
+	>=sys-apps/checkpolicy-1.30.12"
+
+S=${WORKDIR}/
+
+src_unpack() {
+	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs"
+
+	unpack ${A}
+
+	cd "${S}"
+	epatch "${PATCHBUNDLE}"
+	cd "${S}/refpolicy"
+	# Fix bug 257111
+	sed -i -e 's:system_crond_t:system_cronjob_t:g' \
+		"${S}/refpolicy/config/appconfig-standard/default_contexts"
+	sed -i -e 's|system_r:cronjob_t|system_r:system_cronjob_t|g' \
+		"${S}/refpolicy/config/appconfig-mls/default_contexts"
+	sed -i -e 's|system_r:cronjob_t|system_r:system_cronjob_t|g' \
+		"${S}/refpolicy/config/appconfig-mcs/default_contexts"
+
+	if ! use peer_perms; then
+		sed -i -e '/network_peer_controls/d' \
+			"${S}/refpolicy/policy/policy_capabilities"
+	fi
+
+	if ! use open_perms; then
+		sed -i -e '/open_perms/d' \
+			"${S}/refpolicy/policy/policy_capabilities"
+	fi
+
+	for i in ${POLICY_TYPES}; do
+		cp -a "${S}/refpolicy" "${S}/${i}"
+
+		cd "${S}/${i}";
+		make conf || die "Make conf in ${i} failed"
+
+		# Define what we see as "base" and what we want to remain modular
+		cp "${FILESDIR}/modules.conf" \
+			"${S}/${i}/policy/modules.conf" \
+			|| die "failed to set up modules.conf"
+		if [[ "${i}" == "targeted" ]];
+		then
+			echo "unconfined = base" >> "${S}/${i}/policy/modules.conf"
+		fi
+		sed -i -e '/^QUIET/s/n/y/' -e '/^MONOLITHIC/s/y/n/' \
+			-e "/^NAME/s/refpolicy/$i/" "${S}/${i}/build.conf" \
+			|| die "build.conf setup failed."
+
+		if [[ "${i}" == "mls" ]] || [[ "${i}" == "mcs" ]];
+		then
+			# MCS/MLS require additional settings
+			sed -i -e "/^TYPE/s/standard/${i}/" "${S}/${i}/build.conf" \
+				|| die "failed to set type to mls"
+		fi
+
+		if ! use ubac; then
+			sed -i -e 's:^UBAC = y:UBAC = n:g' "${S}/${i}/build.conf"
+		fi
+
+		echo "DISTRO = gentoo" >> "${S}/${i}/build.conf"
+
+		if [ "${i}" == "targeted" ]; then
+			sed -i -e '/root/d' -e 's/user_u/unconfined_u/' \
+			"${S}/${i}/config/appconfig-standard/seusers" \
+			|| die "targeted seusers setup failed."
+		fi
+	done
+}
+
+src_compile() {
+	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs"
+
+	for i in ${POLICY_TYPES}; do
+		cd "${S}/${i}"
+		make base || die "${i} compile failed"
+	done
+}
+
+src_install() {
+	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs"
+
+	for i in ${POLICY_TYPES}; do
+		cd "${S}/${i}"
+
+		make DESTDIR="${D}" install \
+			|| die "${i} install failed."
+
+		make DESTDIR="${D}" install-headers \
+			|| die "${i} headers install failed."
+
+		echo "run_init_t" > "${D}/etc/selinux/${i}/contexts/run_init_type"
+
+		echo "textrel_shlib_t" >> "${D}/etc/selinux/${i}/contexts/customizable_types"
+
+		# libsemanage won't make this on its own
+		keepdir "/etc/selinux/${i}/policy"
+	done
+
+	dodoc doc/Makefile.example doc/example.{te,fc,if}
+
+	insinto /etc/selinux
+	doins "${FILESDIR}/config"
+}
+
+pkg_preinst() {
+	has_version "<${CATEGORY}/${PN}-2.20101213-r13"
+	previous_less_than_r13=$?
+}
+
+pkg_postinst() {
+	[ -z "${POLICY_TYPES}" ] && local POLICY_TYPES="targeted strict mls mcs"
+
+	for i in ${POLICY_TYPES}; do
+		einfo "Inserting base module into ${i} module store."
+
+		cd "/usr/share/selinux/${i}"
+		semodule -s "${i}" -b base.pp || die "Could not load in new base policy"
+	done
+	elog "Updates on policies might require you to relabel files. If you, after"
+	elog "installing new SELinux policies, get 'permission denied' errors,"
+	elog "relabelling your system using 'rlpkg -a -r' might resolve the issues."
+}

diff --git a/sec-policy/selinux-mozilla/ChangeLog b/sec-policy/selinux-mozilla/ChangeLog
new file mode 100644
index 0000000..dba730c
--- /dev/null
+++ b/sec-policy/selinux-mozilla/ChangeLog
@@ -0,0 +1,40 @@
+# ChangeLog for sec-policy/selinux-mozilla
+# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mozilla/ChangeLog,v 1.5 2011/07/10 02:34:32 blueness Exp $
+
+*selinux-mozilla-2.20101213-r4 (02 Aug 2011)
+
+  02 Aug 2011; <swift@g.o> +files/fix-apps-mozilla-r4.patch,
+  +selinux-mozilla-2.20101213-r4.ebuild, +metadata.xml:
+  Allow mozilla to read ~/.local
+
+*selinux-mozilla-2.20101213-r3 (10 Jul 2011)
+
+  10 Jul 2011; Anthony G. Basile <blueness@g.o>
+  +files/fix-apps-mozilla-r3.patch, +selinux-mozilla-2.20101213-r3.ebuild:
+  Support proxy plugins and tor
+
+  04 Jun 2011; Anthony G. Basile <blueness@g.o>
+  -selinux-mozilla-2.20101213.ebuild, -selinux-mozilla-2.20101213-r1.ebuild:
+  Removed deprecated policies
+
+  02 Jun 2011; Anthony G. Basile <blueness@g.o>
+  selinux-mozilla-2.20101213-r2.ebuild:
+  Stable amd64 x86
+
+*selinux-mozilla-2.20101213-r2 (20 May 2011)
+
+  20 May 2011; Anthony G. Basile <blueness@g.o>
+  +files/fix-apps-mozilla-r2.patch, +selinux-mozilla-2.20101213-r2.ebuild:
+  Remove obsolete privileges
+
+  05 Feb 2011; Anthony G. Basile <blueness@g.o> ChangeLog:
+  Initial commit to portage.
+
+*selinux-mozilla-2.20101213-r1 (22 Jan 2011)
+
+  22 Jan 2011; <swift@g.o> +selinux-mozilla-2.20101213-r1.ebuild,
+  files/fix-mozilla.patch:
+  Support binary firefox, add call to alsa interface and support tmp type
+  for mozilla
+

diff --git a/sec-policy/selinux-mozilla/files/fix-apps-mozilla-r4.patch b/sec-policy/selinux-mozilla/files/fix-apps-mozilla-r4.patch
new file mode 100644
index 0000000..beef75d
--- /dev/null
+++ b/sec-policy/selinux-mozilla/files/fix-apps-mozilla-r4.patch
@@ -0,0 +1,82 @@
+--- apps/mozilla.te	2010-12-13 15:11:01.000000000 +0100
++++ apps/mozilla.te	2011-07-24 16:48:16.221000672 +0200
+@@ -33,6 +33,10 @@
+ files_tmpfs_file(mozilla_tmpfs_t)
+ ubac_constrained(mozilla_tmpfs_t)
+ 
++type mozilla_tmp_t;
++files_tmp_file(mozilla_tmp_t)
++ubac_constrained(mozilla_tmp_t)
++
+ ########################################
+ #
+ # Local policy
+@@ -68,6 +72,10 @@
+ manage_sock_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t)
+ fs_tmpfs_filetrans(mozilla_t, mozilla_tmpfs_t, { file lnk_file sock_file fifo_file })
+ 
++manage_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t)
++manage_dirs_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t)
++files_tmp_filetrans(mozilla_t, mozilla_tmp_t, { file dir } )
++
+ kernel_read_kernel_sysctls(mozilla_t)
+ kernel_read_network_state(mozilla_t)
+ # Access /proc, sysctl
+@@ -89,15 +97,18 @@
+ corenet_raw_sendrecv_generic_node(mozilla_t)
+ corenet_tcp_sendrecv_http_port(mozilla_t)
+ corenet_tcp_sendrecv_http_cache_port(mozilla_t)
++corenet_tcp_sendrecv_tor_port(mozilla_t)
+ corenet_tcp_sendrecv_ftp_port(mozilla_t)
+ corenet_tcp_sendrecv_ipp_port(mozilla_t)
+ corenet_tcp_connect_http_port(mozilla_t)
+ corenet_tcp_connect_http_cache_port(mozilla_t)
++corenet_tcp_connect_tor_port(mozilla_t)
+ corenet_tcp_connect_ftp_port(mozilla_t)
+ corenet_tcp_connect_ipp_port(mozilla_t)
+ corenet_tcp_connect_generic_port(mozilla_t)
+ corenet_tcp_connect_soundd_port(mozilla_t)
+ corenet_sendrecv_http_client_packets(mozilla_t)
++corenet_sendrecv_tor_client_packets(mozilla_t)
+ corenet_sendrecv_http_cache_client_packets(mozilla_t)
+ corenet_sendrecv_ftp_client_packets(mozilla_t)
+ corenet_sendrecv_ipp_client_packets(mozilla_t)
+@@ -143,6 +154,7 @@
+ 
+ userdom_use_user_ptys(mozilla_t)
+ 
++
+ xserver_user_x_domain_template(mozilla, mozilla_t, mozilla_tmpfs_t)
+ xserver_dontaudit_read_xdm_tmp_files(mozilla_t)
+ xserver_dontaudit_getattr_xdm_tmp_sockets(mozilla_t)
+@@ -193,6 +205,7 @@
+ 	userdom_list_user_tmp(mozilla_t)
+ 	userdom_read_user_tmp_files(mozilla_t)
+ 	userdom_read_user_tmp_symlinks(mozilla_t)
++	userdom_list_user_home_content(mozilla_t)
+ 	userdom_read_user_home_content_files(mozilla_t)
+ 	userdom_read_user_home_content_symlinks(mozilla_t)
+ 
+@@ -266,3 +279,7 @@
+ optional_policy(`
+ 	thunderbird_domtrans(mozilla_t)
+ ')
++
++optional_policy(`
++	alsa_read_rw_config(mozilla_t)
++')
+--- apps/mozilla.fc	2010-08-03 15:11:03.000000000 +0200
++++ apps/mozilla.fc	2011-07-21 10:08:43.909000256 +0200
+@@ -27,3 +27,12 @@
+ /usr/lib(64)?/[^/]*firefox[^/]*/firefox-bin -- gen_context(system_u:object_r:mozilla_exec_t,s0)
+ /usr/lib/[^/]*firefox[^/]*/firefox --	gen_context(system_u:object_r:mozilla_exec_t,s0)
+ /usr/lib64/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0)
++
++ifdef(`distro_gentoo',`
++/usr/bin/firefox-bin	--	gen_context(system_u:object_r:mozilla_exec_t,s0)
++/opt/firefox/libxul\.so	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
++/opt/firefox/firefox	--	gen_context(system_u:object_r:mozilla_exec_t,s0)
++/opt/firefox/run-mozilla.sh	--	gen_context(system_u:object_r:mozilla_exec_t,s0)
++/opt/firefox/firefox-bin	--	gen_context(system_u:object_r:mozilla_exec_t,s0)
++/opt/firefox/plugin-container	--	gen_context(system_u:object_r:mozilla_exec_t,s0)
++')

diff --git a/sec-policy/selinux-mozilla/metadata.xml b/sec-policy/selinux-mozilla/metadata.xml
new file mode 100644
index 0000000..d718f1b
--- /dev/null
+++ b/sec-policy/selinux-mozilla/metadata.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<herd>selinux</herd>
+	<longdescription>Gentoo SELinux policy for mozilla</longdescription>
+</pkgmetadata>

diff --git a/sec-policy/selinux-mozilla/selinux-mozilla-2.20101213-r4.ebuild b/sec-policy/selinux-mozilla/selinux-mozilla-2.20101213-r4.ebuild
new file mode 100644
index 0000000..1a87091
--- /dev/null
+++ b/sec-policy/selinux-mozilla/selinux-mozilla-2.20101213-r4.ebuild
@@ -0,0 +1,15 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mozilla/selinux-mozilla-2.20101213-r3.ebuild,v 1.1 2011/07/10 02:34:32 blueness Exp $
+
+IUSE=""
+
+MODS="mozilla"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for general applications"
+
+KEYWORDS="~amd64 ~x86"
+
+POLICY_PATCH="${FILESDIR}/fix-apps-mozilla-r4.patch"

diff --git a/sec-policy/selinux-pan/ChangeLog b/sec-policy/selinux-pan/ChangeLog
new file mode 100644
index 0000000..39e044f
--- /dev/null
+++ b/sec-policy/selinux-pan/ChangeLog
@@ -0,0 +1,33 @@
+# ChangeLog for sec-policy/selinux-pan
+# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-skype/ChangeLog,v 1.3 2011/06/04 18:10:53 blueness Exp $
+
+*selinux-pan-2.20101213-r1 (02 Aug 2011)
+
+  02 Aug 2011; <swift@g.o> +files/fix-apps-pan-r1.patch,
+  +selinux-pan-2.20101213-r1.ebuild, +metadata.xml:
+  Initial policy for pan
+
+  04 Jun 2011; Anthony G. Basile <blueness@g.o>
+  -selinux-skype-2.20101213.ebuild, -selinux-skype-2.20101213-r1.ebuild:
+  Removed deprecated policies
+
+  02 Jun 2011; Anthony G. Basile <blueness@g.o>
+  selinux-skype-2.20101213-r2.ebuild:
+  Stable amd64 x86
+
+  05 Feb 2011; Anthony G. Basile <blueness@g.o> ChangeLog:
+  Initial commit to portage.
+
+*selinux-skype-2.20101213-r2 (31 Jan 2011)
+
+  31 Jan 2011; <swift@g.o> +files/add-apps-skype-r2.patch,
+  +selinux-skype-2.20101213-r2.ebuild:
+  Allow userhome access, set some dontaudits etc.
+
+*selinux-skype-2.20101213-r1 (22 Jan 2011)
+
+  22 Jan 2011; <swift@g.o> +selinux-skype-2.20101213-r1.ebuild,
+  +files/add-apps-skype.patch:
+  Update skype module to 'comply' with suggested approach for domains
+

diff --git a/sec-policy/selinux-pan/files/fix-apps-pan-r1.patch b/sec-policy/selinux-pan/files/fix-apps-pan-r1.patch
new file mode 100644
index 0000000..af477bf
--- /dev/null
+++ b/sec-policy/selinux-pan/files/fix-apps-pan-r1.patch
@@ -0,0 +1,110 @@
+--- apps/pan.te	1970-01-01 01:00:00.000000000 +0100
++++ apps/pan.te	2011-07-24 18:31:32.760000849 +0200
+@@ -0,0 +1,102 @@
++policy_module(pan, 1.0)
++
++########################################
++#
++# Declarations
++#
++
++type pan_t;
++type pan_exec_t;
++application_domain(pan_t, pan_exec_t)
++ubac_constrained(pan_t)
++
++type pan_home_t;
++userdom_user_home_content(pan_home_t)
++
++#type pan_tmp_t;
++#files_tmp_file(pan_tmp_t)
++#ubac_constrained(pan_tmp_t)
++
++type pan_tmpfs_t;
++files_tmpfs_file(pan_tmpfs_t)
++ubac_constrained(pan_tmpfs_t)
++
++########################################
++#
++# Pan local policy
++#
++allow pan_t self:process { getsched signal };
++allow pan_t self:fifo_file rw_fifo_file_perms;
++allow pan_t pan_tmpfs_t:file { read write };
++
++# Allow pan to work with its ~/.pan2 location
++manage_dirs_pattern(pan_t, pan_home_t, pan_home_t)
++manage_files_pattern(pan_t, pan_home_t, pan_home_t)
++manage_lnk_files_pattern(pan_t, pan_home_t, pan_home_t)
++
++# Support for shared memory
++fs_tmpfs_filetrans(pan_t, pan_tmpfs_t, file)
++
++## Kernel layer calls
++#
++kernel_dontaudit_read_system_state(pan_t)
++files_read_etc_files(pan_t)
++files_read_usr_files(pan_t)
++corenet_all_recvfrom_unlabeled(pan_t)
++corenet_all_recvfrom_netlabel(pan_t)
++corenet_tcp_connect_innd_port(pan_t)
++corenet_tcp_sendrecv_generic_if(pan_t)
++corenet_tcp_sendrecv_generic_node(pan_t)
++corenet_tcp_sendrecv_innd_port(pan_t)
++corenet_sendrecv_innd_client_packets(pan_t)
++
++## System layer calls
++#
++miscfiles_read_localization(pan_t)
++sysnet_dns_name_resolve(pan_t)
++userdom_manage_user_home_content_dirs(pan_t)
++userdom_manage_user_home_content_files(pan_t)
++
++## Other yayer calls
++#
++xserver_user_x_domain_template(pan, pan_t, pan_tmpfs_t)
++
++tunable_policy(`use_nfs_home_dirs',`
++	fs_manage_nfs_dirs(pan_t)
++	fs_manage_nfs_files(pan_t)
++	fs_manage_nfs_symlinks(pan_t)
++')
++
++tunable_policy(`use_samba_home_dirs',`
++	fs_manage_cifs_dirs(pan_t)
++	fs_manage_cifs_files(pan_t)
++	fs_manage_cifs_symlinks(pan_t)
++')
++
++optional_policy(`
++	cups_read_rw_config(pan_t)
++')
++
++optional_policy(`
++	dbus_system_bus_client(pan_t)
++	dbus_session_bus_client(pan_t)
++')
++
++optional_policy(`
++	gnome_stream_connect_gconf(pan_t)
++')
++
++optional_policy(`
++	gpg_domtrans(pan_t)
++	gpg_signal(pan_t)
++')
++
++optional_policy(`
++	lpd_domtrans_lpr(pan_t)
++')
++
++optional_policy(`
++	mozilla_read_user_home_files(pan_t)
++	mozilla_domtrans(pan_t)
++')
++
+--- apps/pan.fc	1970-01-01 01:00:00.000000000 +0100
++++ apps/pan.fc	2011-07-24 17:56:50.338000789 +0200
+@@ -0,0 +1,2 @@
++/usr/bin/pan		--	gen_context(system_u:object_r:pan_exec_t,s0)
++HOME_DIR/\.pan2(/.*)?		gen_context(system_u:object_r:pan_home_t,s0)

diff --git a/sec-policy/selinux-pan/metadata.xml b/sec-policy/selinux-pan/metadata.xml
new file mode 100644
index 0000000..95a7e9f
--- /dev/null
+++ b/sec-policy/selinux-pan/metadata.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<herd>selinux</herd>
+	<longdescription>Gentoo SELinux policy for pan</longdescription>
+</pkgmetadata>

diff --git a/sec-policy/selinux-pan/selinux-pan-2.20101213-r1.ebuild b/sec-policy/selinux-pan/selinux-pan-2.20101213-r1.ebuild
new file mode 100644
index 0000000..5b30d33
--- /dev/null
+++ b/sec-policy/selinux-pan/selinux-pan-2.20101213-r1.ebuild
@@ -0,0 +1,16 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-skype/selinux-skype-2.20101213-r2.ebuild,v 1.2 2011/06/02 12:56:29 blueness Exp $
+
+IUSE=""
+
+MODS="pan"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for general applications"
+
+KEYWORDS="~amd64 ~x86"
+
+POLICY_PATCH="${FILESDIR}/fix-apps-pan-r1.patch"
+RDEPEND=">=sec-policy/selinux-base-policy-2.20101213-r22"

diff --git a/sec-policy/selinux-skype/ChangeLog b/sec-policy/selinux-skype/ChangeLog
new file mode 100644
index 0000000..e89dec5
--- /dev/null
+++ b/sec-policy/selinux-skype/ChangeLog
@@ -0,0 +1,33 @@
+# ChangeLog for sec-policy/selinux-skype
+# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-skype/ChangeLog,v 1.3 2011/06/04 18:10:53 blueness Exp $
+
+*selinux-skype-2.20101213-r3 (02 Aug 2011)
+
+  02 Aug 2011; <swift@g.o> +files/fix-apps-skype-r3.patch,
+  +selinux-skype-2.20101213-r3.ebuild, +metadata.xml:
+  Improve policy style, do not require libs_use_ld_so
+
+  04 Jun 2011; Anthony G. Basile <blueness@g.o>
+  -selinux-skype-2.20101213.ebuild, -selinux-skype-2.20101213-r1.ebuild:
+  Removed deprecated policies
+
+  02 Jun 2011; Anthony G. Basile <blueness@g.o>
+  selinux-skype-2.20101213-r2.ebuild:
+  Stable amd64 x86
+
+  05 Feb 2011; Anthony G. Basile <blueness@g.o> ChangeLog:
+  Initial commit to portage.
+
+*selinux-skype-2.20101213-r2 (31 Jan 2011)
+
+  31 Jan 2011; <swift@g.o> +files/add-apps-skype-r2.patch,
+  +selinux-skype-2.20101213-r2.ebuild:
+  Allow userhome access, set some dontaudits etc.
+
+*selinux-skype-2.20101213-r1 (22 Jan 2011)
+
+  22 Jan 2011; <swift@g.o> +selinux-skype-2.20101213-r1.ebuild,
+  +files/add-apps-skype.patch:
+  Update skype module to 'comply' with suggested approach for domains
+

diff --git a/sec-policy/selinux-skype/files/fix-apps-skype-r3.patch b/sec-policy/selinux-skype/files/fix-apps-skype-r3.patch
new file mode 100644
index 0000000..337f395
--- /dev/null
+++ b/sec-policy/selinux-skype/files/fix-apps-skype-r3.patch
@@ -0,0 +1,120 @@
+--- apps/skype.te	1970-01-01 01:00:00.000000000 +0100
++++ apps/skype.te	2011-07-24 17:24:40.996000734 +0200
+@@ -0,0 +1,111 @@
++policy_module(skype, 0.0.2)
++
++############################
++# 
++# Declarations
++#
++
++type skype_t;
++type skype_exec_t;
++application_domain(skype_t, skype_exec_t)
++
++type skype_home_t;
++
++type skype_tmpfs_t;
++files_tmpfs_file(skype_tmpfs_t)
++ubac_constrained(skype_tmpfs_t)
++
++############################
++#
++# Policy
++#
++
++allow skype_t self:process { getsched setsched execmem signal };
++allow skype_t self:fifo_file rw_fifo_file_perms;
++allow skype_t self:unix_stream_socket create_socket_perms;
++allow skype_t self:sem create_sem_perms;
++allow skype_t self:tcp_socket create_stream_socket_perms;
++
++# Allow skype to work with its ~/.skype location
++manage_dirs_pattern(skype_t, skype_home_t, skype_home_t)
++manage_files_pattern(skype_t, skype_home_t, skype_home_t)
++manage_lnk_files_pattern(skype_t, skype_home_t, skype_home_t)
++
++# Needed for supporting X11 & shared memory
++manage_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t)
++manage_lnk_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t)
++manage_fifo_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t)
++manage_sock_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t)
++fs_tmpfs_filetrans(skype_t, skype_tmpfs_t, { file lnk_file sock_file fifo_file })
++
++# In Gentoo, the skype script calls skype binary. To keep the
++# number of privileges for the user domain sufficiently manageable,
++# we already label the script as skype_exec_t. Hence, the script
++# needs to be able to execute skype_exec_t files too.
++can_exec(skype_t, skype_exec_t)
++
++## Kernel layer calls
++#
++kernel_dontaudit_search_sysctl(skype_t)
++kernel_read_system_state(skype_t)
++
++corecmd_exec_bin(skype_t)
++corecmd_exec_shell(skype_t)
++
++corenet_all_recvfrom_netlabel(skype_t)
++corenet_all_recvfrom_unlabeled(skype_t)
++corenet_sendrecv_http_client_packets(skype_t)
++corenet_tcp_bind_generic_node(skype_t)
++corenet_tcp_bind_generic_port(skype_t) 
++corenet_tcp_connect_generic_port(skype_t)
++corenet_tcp_connect_http_port(skype_t)
++corenet_tcp_sendrecv_http_port(skype_t)
++corenet_udp_bind_generic_node(skype_t)
++corenet_udp_bind_generic_port(skype_t) 
++
++dev_read_sound(skype_t)
++dev_read_video_dev(skype_t)
++dev_write_sound(skype_t)
++dev_write_video_dev(skype_t)
++
++# Needed to debug skype (start through commandline)
++domain_use_interactive_fds(skype_t)
++
++files_read_etc_files(skype_t)
++files_read_usr_files(skype_t)
++
++## System layer calls
++#
++auth_use_nsswitch(skype_t)
++miscfiles_dontaudit_setattr_fonts_dirs(skype_t)
++miscfiles_read_localization(skype_t)
++userdom_manage_user_home_content_dirs(skype_t)
++userdom_manage_user_home_content_files(skype_t)
++userdom_use_user_terminals(skype_t)
++userdom_user_home_dir_filetrans(skype_t, skype_home_t, dir)
++userdom_user_home_content(skype_home_t)
++
++## Other calls
++#
++xserver_user_x_domain_template(skype, skype_t, skype_tmpfs_t)
++
++tunable_policy(`gentoo_try_dontaudit',`
++	dev_dontaudit_search_sysfs(skype_t)
++	fs_dontaudit_getattr_xattr_fs(skype_t)
++')
++
++optional_policy(`
++	tunable_policy(`gentoo_try_dontaudit',`
++		mozilla_dontaudit_manage_user_home_files(skype_t)
++	')
++')
++
++optional_policy(`
++	alsa_read_rw_config(skype_t)
++')
++
++optional_policy(`
++	dbus_system_bus_client(skype_t)
++	dbus_session_bus_client(skype_t)
++')
++
+--- apps/skype.fc	1970-01-01 01:00:00.000000000 +0100
++++ apps/skype.fc	2011-07-21 10:08:43.824000256 +0200
+@@ -0,0 +1,3 @@
++/usr/bin/skype         -- gen_context(system_u:object_r:skype_exec_t,s0)
++/opt/skype/skype       -- gen_context(system_u:object_r:skype_exec_t,s0)
++HOME_DIR/\.Skype(/.*)?    gen_context(system_u:object_r:skype_home_t,s0)

diff --git a/sec-policy/selinux-skype/metadata.xml b/sec-policy/selinux-skype/metadata.xml
new file mode 100644
index 0000000..810b563
--- /dev/null
+++ b/sec-policy/selinux-skype/metadata.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<herd>selinux</herd>
+	<longdescription>Gentoo SELinux policy for skype</longdescription>
+</pkgmetadata>

diff --git a/sec-policy/selinux-skype/selinux-skype-2.20101213-r3.ebuild b/sec-policy/selinux-skype/selinux-skype-2.20101213-r3.ebuild
new file mode 100644
index 0000000..663bd97
--- /dev/null
+++ b/sec-policy/selinux-skype/selinux-skype-2.20101213-r3.ebuild
@@ -0,0 +1,16 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-skype/selinux-skype-2.20101213-r2.ebuild,v 1.2 2011/06/02 12:56:29 blueness Exp $
+
+IUSE=""
+
+MODS="skype"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for general applications"
+
+KEYWORDS="~amd64 ~x86"
+
+POLICY_PATCH="${FILESDIR}/fix-apps-skype-r3.patch"
+RDEPEND=">=sec-policy/selinux-base-policy-2.20101213-r20"