Make support/policyvers.py compatible with Python 3

Add parenthesis around print statement, like in other Python scripts.
Make unconfined user run lvm programs in confined domain

When an unconfined user uses truecrypt to mount an encrypted file, dmsetup is
called to setup a new device.  This program works with udev to configure the
new device and uses SysV semaphores to synchronize states.  As udev runs
dmsetup in lvm_t domain, the first dmsetup process needs to create lvm_t
semaphores (not unconfined_t) and hence needs to run in lvm_t domain.

More details are available in the archives on the ML:
http://oss.tresys.com/pipermail/refpolicy/2014-May/007111.html
Module version bump for unconfined->lvm transition from Nicolas Iooss.
Need the __future__ import for python2 if using print().
Allow kern_unconfined domains to use syslog capability

When an unconfined_t root user runs dmesg, the kernel complains with
this message in its logs (when SELinux is in enforcing mode):

  dmesg (16289): Attempt to access syslog with CAP_SYS_ADMIN but no
  CAP_SYSLOG (deprecated).

audit.log contains following AVC:

  avc:  denied  { syslog } for  pid=16289 comm="dmesg" capability=34
  scontext=unconfined_u:unconfined_r:unconfined_t
  tcontext=unconfined_u:unconfined_r:unconfined_t tclass=capability2

Moreover, policy/modules/kernel/kernel.if defines
kernel_read_ring_buffer interface as:

  allow $1 self:capability2 syslog;
  allow $1 kernel_t:system syslog_read;

As domains with kern_unconfined attribute already have all
kernel_t:system permissions, this patch allows such domains to use
CAP_SYSLOG.
[NOT UPSTREAMABLE] Make scripts compatible with Python 3

Here are all the changes which are needed to make the script compatible with
Python 3 while keeping compatibility with Python 2.6 and 2.7:

* use sys.maxsize instead of sys.maxint,
* use print as a function,
* use "as" keyword in except statements.

--

There have been an issue on the first submission of this patch, concerning
support/genhomedircon.  This script will be removed in short future.
Please read http://oss.tresys.com/pipermail/refpolicy/2014-March/007027.html
for more details.
[NOT UPSTREAMABLE] Add build-time distribution detection to Makefile

When using the same policy on several hosts with different Linux distributions
the DISTRO variable can't be defined in the build.conf of the build directory
because this file is tracked with git.

Instead of maintaining a local patch per host to define DISTRO in build.conf
or of building using "make DISTRO=...", this commit introduces a DISTRO_DETECT
boolean in build.conf which automatically fills DISTRO with the name of the
distro of the building host.

DISTRO_DETECT definition is not copied in the installed build.conf file
(/usr/share/selinux/refpolicy/include/build.conf) because this file would have
the DISTRO variable set.

THIS PATCH HAS BEEN REJECTED BY UPSTREAM
http://oss.tresys.com/pipermail/refpolicy/2014-March/006969.html
[NOT UPSTREAMABLE] Customize build and README
[NOT UPSTREAMABLE] Make policy/modules/contrib a local submodule
[NOT UPSTREAMABLE] Make usage of deprecated interfaces fatal
xserver: add lightdm file contexts
Fix /var/run/syslog-ng.ctl label
Debian patch 4: Add additional interfaces and a boolean switch to access unconfined
Debian patch 8: Add pythonsupport policy
Debian patch 14: Debian nagios file locations and additional policy

This addresses distribution specific file locations, allows the nagios mail
plugin to run sudo for the purpose of directly searching postfix spools (more
policy needed for other MTAs), allows nrpe to create tmp files and do all
networking stuff, and to talk to database servers.
Debian patch 16: Debian specific changes for init_t
Debian patch 19: gpg.{fc,if,te}: Fixes so that gpg-agent starts up (also when
 launched by ssh-agent). Add interfaces to access to transition to
 gpg_agent_t. unprivuser.te, ssh.if: Make use of the new interfaces.
 userdomain.fc: Label user's .gnupg
Debian patch 25: files.if: Allow management of symlinks under /mnt; also add
 interface files_manage_pid_dirs which is not used in standard
 policy for local system administrator's use
Debian patch 30: Allow user_t and staff_t consolekit_dbus_chat() access so they can
 determine their session status - necessary to login in KDE
 sometimes.
Debian patch 44: Debian fixes for xserver policy