The security_t file system can be at /sys/fs/selinux

Because it is no longer a top-level file system, we need to enhance some
of the interfaces with the appropriate rights towards sysfs_t.

First set to allow getattr rights on the file system, which now also
means getattr on the sysfs_t file system as well as search privileges in
sysfs_t.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
Dontaudit access on security_t file system at /sys/fs/selinux

Second part of the support of security_t under /sys/fs/selinux - when
asked not to audit getting attributes on the selinux file system, have
this propagate to the sysfs parts as well.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
Module version bump for /sys/fs/selinux support from Sven Vermeulen.
Label /etc/locale.alias as locale_t on Debian

On Debian, /usr/share/locale/locale.alias is a symlink to
/etc/locale.alias, properly label this file.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=707246
Allow hugetlbfs_t to be associated to /dev

Even if there is not FHS provision for this, systemd is using
/dev/hugepages to mount the hugetlbfs fs by default.

The needed file contexts are already present
Module version bump for fixes from Laurent Bigonville.
Label syslog-ng.pid as syslogd_var_run_t
filesystem: label cgroup symlinks

/sys/fs/cgroup is a tmpfs which contains cgroup mounts and symlinks such as
cpu and cpuacct.  Running restorecon makes this warning happen:

    restorecon:  Warning no default label for /sys/fs/cgroup/cpu

Declare a file context for every symlink in the cgroup tmpfs montpoint to
no longer have such warning.
Label /usr/lib/getconf as bin_t

On ArchLinux, glibc package installs /usr/bin/getconf as a hard link to a file
in /usr/lib/getconf/.  For example on a x86_64 machine:

    $ ls -i -l /usr/bin/getconf /usr/lib/getconf/XBS5_LP64_OFF64
    5900355 -rwxr-xr-x. 4 root root 22880 Feb 28 04:53 /usr/bin/getconf
    5900355 -rwxr-xr-x. 4 root root 22880 Feb 28 04:53 /usr/lib/getconf/XBS5_LP64_OFF64

Such configuration produces an instability when labeling the files with
"restorecon -Rv /":

    restorecon reset /usr/bin/getconf context unconfined_u:object_r:lib_t:s0->unconfined_u:object_r:bin_t:s0
    restorecon reset /usr/lib/getconf/XBS5_LP64_OFF64 context unconfined_u:object_r:bin_t:s0->unconfined_u:object_r:lib_t:s0

As /usr/lib/getconf directory only contains executable programs, this issue is
fixed by labeling this directory and its content "bin_t".
Label /usr/share/virtualbox/VBoxCreateUSBNode.sh as udev_helper_exec_t

VBoxCreateUSBNode.sh creates character special files in /dev/vboxusb each time
a new USB device appears.  This script is called by udev.

audit.log on a system in permissive mode before this patch contains:

    type=AVC msg=audit(1396889711.890:175): avc:  denied  { execute } for  pid=26284 comm="systemd-udevd" name="VBoxCreateUSBNode.sh" dev="sda5" ino=5899405 scontext=system_u:system_r:udev_t tcontext=unconfined_u:object_r:usr_t tclass=file
    type=AVC msg=audit(1396889711.890:175): avc:  denied  { execute_no_trans } for  pid=26284 comm="systemd-udevd" path="/usr/share/virtualbox/VBoxCreateUSBNode.sh" dev="sda5" ino=5899405 scontext=system_u:system_r:udev_t tcontext=unconfined_u:object_r:usr_t tclass=file
Module version bumps for fc fixes from Nicolas Iooss.
Merged upstream, so own def can be removed
Label /usr/sbin/ModemManager as modemmanager_exec_t

modem-manager executable has been renamed in recent versions (>= 0.7.990)
Upstream position for master
Module version bump for ModemManager fc entry from Laurent Bigonville.
Merger with upstream