Merged upstream, so can be removed from the ifdef distro_gentoo
Add seutil_relabelto_bin_policy explicitly to all users

As we are going to move seutil_relabelto_bin_policy outside the
files_relabel_non_auth_files, we first add it to all the users
explicitly.

The move is needed because otherwise files_relabel_non_auth_files cannot
be used inside a tunable_policy statement.
Comment out seutil_relabelto_bin_policy

We comment out the use of the seutil_relabelto_bin_policy call in the
files_relabel_non_auth_files interface. This allows us to set this
interface in a tunable statement, like so:

  seutil_relabelto_bin_policy(foo_t)

  tunable_policy(`foo_relabel_non_auth_files',`
    files_relabel_non_auth_files(foo_t)
  ')

In larger entries, this allows us to have a minimalistic policy (a
domain only allowed to manage and relabel a certain set of file types)
and, through a boolean, enable it to manage and relabel a larger set of
types.
Introduce files_manage_non_security_file_type interface

This interface, similar to files_manage_non_auth_files, allows the
domain to manage and work on non-security related file types. No type
attributes are set so this can be used in a tunable_policy statement if
necessary.

Naming based on the attribute used (non_security_file_type).
Make SELinux configuration a security file type

The SELinux configuration should be considered a security-sensitive
configuration type and as such should not be made part of the
system-wide accesses towards regular files (non_auth/non_security).
Add files_relabel_non_security_file_type

This interface allows for relabel operations against all resources with
a type associated with the non_security_file_type attribute.
Apply different naming

The idea is that an interface that manages a whole set of types contains
the _all_ inside the name. When it does, then the next block should
contain the attribute name in its entirety, but plural.

So for non_security_file_type, this becomes
_all_non_security_file_types.
Introduce files_relabel_all_pidfiles

This interface can be used by domains needing wide relabel privileges
towards the *_var_run_t and var_run_t types.
Use files_relabel_all_non_security_file_types

Use the naming convention "_all_" + <attribute-name> + "s" (plural)
Allow resolvconf to configure dnsmasq

Resolvconf needs to be able to set which dns servers dnsmasq uses.
Bug #519240
Introduce init_relabelto_script_state
Introduce the tmpfiles_t domain

The tmpfiles application, as documented in [1], is used to prepare directory
structures in runtime, volatile locations (such as /var/run, /run and
perhaps even /tmp and /var/tmp).

[1] http://www.freedesktop.org/software/systemd/man/tmpfiles.d.html

The need for the tmpfiles application seems to came forward as systemd
service files ("unit files") are not the flexible shell scripts that are
used in init scripts (/etc/rc.d/init.d/* files). Whereas these init scripts
usually did the preparation of runtime directories, the systemd service
scripts do not (well, beyond the RuntimeDirectory= directive, that is).

Instead, services are required to create a tmpfiles configuration file
inside one of the following locations, informing the tmpfiles application to
create directories and files as needed:

(a.) /usr/lib/tmpfiles.d/ (*.conf) for packaged services (default settings)
(b.) /run/tmpfiles.d/ (*.conf) for dynamically generated overrides of (a.)
(c.) /etc/tmpfiles.d/ (*.conf) for local system administration overrides
     of (a.) and (b.)

These files declare what action to perform on a specific location (such as
create a directory) and which ownership to apply (similar to the install(1)
application it seems).

Both in systemd as well as OpenRC the tmpfiles application is SELinux-aware,
(re)setting the context of the target.

Signed-off-by: Jason Zaman <jason@perfinion.com>
Give kmod access to tmpfiles

Upon boot, the kmod application (running as insmod_t) can generate a
tmpfiles configuration file to allow tmpfiles to relabel and set the
required static device nodes for the kernel:

kmod static-nodes --format=tmpfiles --output=/run/tmpfiles.d/kmod.conf

This requires the insmod_t domain to have create/write privileges
towards the /run/tmpfiles.d location.

Signed-off-by: Jason Zaman <jason@perfinion.com>
New releases can now be based on live ebuilds
Add trailing slash for substitution, and set KEYWORDS when copying from live ebuilds to "regular" ones
Merge Gentoo upstream