Fix relabel target.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Richard Haines patch that allows us discover constraint violation information

Basically we need this information to allow audit2allow/audit2why to better
describe which constraint is being broken.
Laurent Bigonville patch to allow overriding PATH Definitions in Makefiles
handle-unknown should be an optional argument
Allow " " and ":" in file name transtions

We have added a couple of file name transtitions that required a space and a colon.
Laurent Bigonville patch to fix various minor manpage issues and correct section numbering.
Add missing man page for sefcontext_compile
Add selinux_set_policy_root sets an alternate policy root directory path

This allows us to specify under which the compiled policy file and context configuration
files exist. We can use this with matchpathcon to check the labels under alternate policies,
and we can use it for sepolicy manpage to build manpages during policy build.
Add selinux_systemd_contexts_path

systemd has some internal contexts like generated systemd unit files
that we want to allow it to check against processes trying to manage them.
define SELINUX_TRANS_DIR in selinux.h

I wanted to separate this directory out in order for a new patch to mcstransd to watch
this directory for newly created files, which it could then translate.

The idea is libvirt would write to /var/run/setrans/c0:c1,c2 with the contents of vm1, then
setrans could translate the processes to show system_u:system_r:svirt_t:vm1
This patch fixes python parsing.

Eliminates a potential memory leaks.
Patch to change *setfilecon to not return ENOSUP if context matches.

Tools like cp -A try to maintain the context of a program and call *setfilecon,
currently if the file system does not support XAttrs we return ENOSUPP.  We have
been requested to check if the context that is being set is the same to not return this
error.  So if I try to set the label on an nfs share to system_u:object_r:nfs_t:s0 and I get
ENOSUPP, it will not return an error.
Separate out the calling of local subs and dist subs in selabel_sub

We want to allow users to setup their substitions to run fist and then run
the distro subs second.  This fixes the problem where a user defines
a sub like /usr/local/foobar and we ignore it.  We need this for
software collections which is setting up local subs of /opt/src/foobar/root /
Support udev-197 and higher

The errno value was not set, causing wrong return notifications and
failing to have udev label things correctly.

See https://bugzilla.redhat.com/show_bug.cgi?id=909826#c24 and
see https://bugs.gentoo.org/show_bug.cgi?id=462626

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
Change get_context_list to return an error rather then guess at a match.

In the past pam_selinux would return a bogus login context if the login program
was running with the wrong context.  If you ran sshd as unconfined_t
you might get the login user loggin in as pam_oddjob_mkhomedir_t or some other bogus
type.  This change fixes the code to return an error if it can not return a good
match.
Add selinux_current_policy_path, which returns the a pointer to the loaded policy

Also change audit2why to look at the loaded policy rather then searching on disk for
the policy file.  It is more likely that you are examining the running policy.
Fix label substituion to work with the equiv path of "/"

Software collections are setting up equiv directories to the root directory.
Add decent constants for python for return of getenforce call.
Fixes for procattr calls to handle cache properly.

We were asked not to link to libpthread but to use gcc internals.
We were not handling properly the fact that a cache was UNSET, and this
patch fixes this.
Fix handling of temporary file in sefcontext_compile.c

This way if something goes wrong regex file will not be corrupt.