Moving to USE flag triggered alsa support
Move alsa_domain calls into USE triggered definition
Explicitly mention attribute, otherwise self becomes the domain
Qemu socket support

The VDE switch implementation in Qemu, depending on how it is called
command-line, requires Qemu to create a socket through which network
communication is to be handled.

Without this, qemu fails to start.
fc_sort: fix typos in comments
fc_sort: initialize allocated memory to fix execution on an empty file

When running fc_sort on an empty context file, this program uses uninitialized
pointers when accessing to the elements of a list.  On my system, it goes in a
very long loop (maybe infinite) because uninitialized fields in malloc'ed
structures happen to contain valid pointers in the heap.

This patch fixes this bug by initializing ->next and ->data fields before they
may be read.
fc_sort: make outfile argument optional

When working on fc_sort to try to understand why using /usr/s?bin/... file
contexts has been reported not to work properly [1], I found it frustrating not
to be able to do "tmp/fc_sort my_filecontexts.fc" and see the result printed on
the screen.  This patch implements this behavior by making optional the second
argument of fc_sort.

[1] commit 36e2216f8 of contrib repository,
http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=36e2216f82192660d063012e69281f27ba20864b
userdomain: no longer allow unprivileged users to read kernel symbols

Unprivileged users don't need to read kallsyms and /boot/System.map.

This allow rule was introduced in the initial revision of userdomain.if in
2005, with commit b16c6b8c32a631a2e66265f6f60b664222760972:

    # cjp: why?
    bootloader_read_kernel_symbol_table($1_t)
Module version bump for userdomain kernel symbol table fix from Nicolas Iooss.
Hide getattr denials upon sudo invocation

When sudo is invoked (sudo -i) the audit log gets quite a lot of denials
related to the getattr permission against tty_device_t:chr_file for the
*_sudo_t domain. However, no additional logging (that would hint at a
need) by sudo, nor any functional issues come up.

Hence the dontaudit call.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
Support /sys/devices/system/cpu/online

In glibc, the get_nprocs method reads /sys/devices/system/cpu/online, so
we need to grant most domains read access to this file. As we don't want
them to have read access on sysfs_t by default, create a new type
(cpu_online_t) and assign it to the file, and grant domains read access
to the file.

This does require systems to relabel the file upon every boot, something
distributions do in their bootup scripts, as /sys devices don't keep
their context.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
Module version bump for 2 Gentoo patches from Sven Vermeulen.
Remove merged code, reshuffle gentoo specific ones
Add a policy module for shibboleth authentication

Signed-off-by: Martin Lang <lang@automata.rwth-aachen.de>
Whitespace fix in shibboleth.te.
Module version bump for new shibboleth module from Martin Lang.

Reduces shibboleth to 1.0.0, as it is the initial refpolicy version.
apt: remove non-existing permission set write_dir_perms

write_dir_perms doesn't exist in policy/support/obj_perm_sets.spt so this
patch removes the buggy dontaudit statement from apt_read_cache.
Module version bump for apt fix from Nicolas Iooss.
dnsmasq reads MTU sysctl

The dnsmasq application reads in the value of the
/proc/sys/net/ipv6/conf/*/mtu values.

This is confirmed through looking at the source code of dnsmasq, in
src/radv.c.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
Module version bump for dnsmasq MTU fix from Sven Vermeulen.