diff --git a/SOURCES/0001-Fix-selinux-man-page-to-refer-seinfo-and-sesearch-to.patch b/SOURCES/0001-Fix-selinux-man-page-to-refer-seinfo-and-sesearch-to.patch
index f68a699..f6343b4 100644
--- a/SOURCES/0001-Fix-selinux-man-page-to-refer-seinfo-and-sesearch-to.patch
+++ b/SOURCES/0001-Fix-selinux-man-page-to-refer-seinfo-and-sesearch-to.patch
@@ -1,7 +1,7 @@
From f71fc47524bef3c4cd8a412e43d13daebd1c418b Mon Sep 17 00:00:00 2001
From: Miroslav Grepl <mgrepl@redhat.com>
Date: Wed, 16 Jul 2014 08:28:03 +0200
-Subject: [PATCH 1/5] Fix selinux man page to refer seinfo and sesearch tools.
+Subject: [PATCH] Fix selinux man page to refer seinfo and sesearch tools.
---
libselinux/man/man8/selinux.8 | 4 +++-
diff --git a/SOURCES/0002-Verify-context-input-to-funtions-to-make-sure-the-co.patch b/SOURCES/0002-Verify-context-input-to-funtions-to-make-sure-the-co.patch
index 7a0a001..24f28e6 100644
--- a/SOURCES/0002-Verify-context-input-to-funtions-to-make-sure-the-co.patch
+++ b/SOURCES/0002-Verify-context-input-to-funtions-to-make-sure-the-co.patch
@@ -1,7 +1,7 @@
From ad3d3a0bf819f5895a6884357c2d0e18ea1ef314 Mon Sep 17 00:00:00 2001
From: Dan Walsh <dwalsh@redhat.com>
Date: Mon, 23 Dec 2013 09:50:54 -0500
-Subject: [PATCH 2/5] Verify context input to funtions to make sure the context
+Subject: [PATCH] Verify context input to funtions to make sure the context
field is not null.
Return errno EINVAL, to prevent segfault.
diff --git a/SOURCES/0003-libselinux-Allow-to-override-OVERRIDE_GETTID-from-co.patch b/SOURCES/0003-libselinux-Allow-to-override-OVERRIDE_GETTID-from-co.patch
index 0c8d92c..9a11fa7 100644
--- a/SOURCES/0003-libselinux-Allow-to-override-OVERRIDE_GETTID-from-co.patch
+++ b/SOURCES/0003-libselinux-Allow-to-override-OVERRIDE_GETTID-from-co.patch
@@ -1,8 +1,8 @@
-From 431f72836d6c02450725cf6ffb1c7223b9fa6acc Mon Sep 17 00:00:00 2001
+From a6e839be2c5a77c22a8c72cad001e3f87eaedf2e Mon Sep 17 00:00:00 2001
From: Petr Lautrbach <plautrba@redhat.com>
Date: Mon, 11 Mar 2019 15:26:43 +0100
-Subject: [PATCH 3/5] libselinux: Allow to override OVERRIDE_GETTID from
- command line
+Subject: [PATCH] libselinux: Allow to override OVERRIDE_GETTID from command
+ line
$ make CFLAGS="$CFLAGS -DOVERRIDE_GETTID=0" ...
diff --git a/SOURCES/0004-Bring-some-old-permission-and-flask-constants-back-t.patch b/SOURCES/0004-Bring-some-old-permission-and-flask-constants-back-t.patch
index c0d7f6a..f238dd0 100644
--- a/SOURCES/0004-Bring-some-old-permission-and-flask-constants-back-t.patch
+++ b/SOURCES/0004-Bring-some-old-permission-and-flask-constants-back-t.patch
@@ -1,8 +1,8 @@
-From dca54ca1a8ab0b256e7834f7f5e97375427fbfd9 Mon Sep 17 00:00:00 2001
+From be420729fbf4adc8b32ca3722fa6ca46bb51413d Mon Sep 17 00:00:00 2001
From: Petr Lautrbach <plautrba@redhat.com>
Date: Wed, 27 Feb 2019 09:37:17 +0100
-Subject: [PATCH 4/5] Bring some old permission and flask constants back to
- Python bindings
+Subject: [PATCH] Bring some old permission and flask constants back to Python
+ bindings
---
libselinux/src/selinuxswig.i | 4 ++++
diff --git a/SOURCES/0005-libselinux-add-missing-av_permission-values.patch b/SOURCES/0005-libselinux-add-missing-av_permission-values.patch
index 721e127..34acc85 100644
--- a/SOURCES/0005-libselinux-add-missing-av_permission-values.patch
+++ b/SOURCES/0005-libselinux-add-missing-av_permission-values.patch
@@ -1,7 +1,7 @@
-From 8384ffa7a371c8845c145951363da5d978ab98b5 Mon Sep 17 00:00:00 2001
+From 903c54bf62ffba3c95e22e74c9c43838cd3935a0 Mon Sep 17 00:00:00 2001
From: Vit Mojzis <vmojzis@redhat.com>
Date: Tue, 28 Feb 2017 16:12:43 +0100
-Subject: [PATCH 5/5] libselinux: add missing av_permission values
+Subject: [PATCH] libselinux: add missing av_permission values
Add missing av_permission values to av_permissions.h for the sake of
completeness (this interface is obsolete - these values are now
diff --git a/SOURCES/0006-libselinux-Use-Python-distutils-to-install-SELinux-p.patch b/SOURCES/0006-libselinux-Use-Python-distutils-to-install-SELinux-p.patch
index d239d93..b4306d8 100644
--- a/SOURCES/0006-libselinux-Use-Python-distutils-to-install-SELinux-p.patch
+++ b/SOURCES/0006-libselinux-Use-Python-distutils-to-install-SELinux-p.patch
@@ -1,8 +1,8 @@
From 67d490a38a319126f371eaf66a5fc922d7005b1f Mon Sep 17 00:00:00 2001
From: Petr Lautrbach <plautrba@redhat.com>
Date: Thu, 16 May 2019 15:01:59 +0200
-Subject: [PATCH 6/6] libselinux: Use Python distutils to install SELinux
- python bindings
+Subject: [PATCH] libselinux: Use Python distutils to install SELinux python
+ bindings
SWIG-4.0 changed its behavior so that it uses: from . import _selinux which
looks for _selinux module in the same directory as where __init__.py is -
@@ -173,5 +173,5 @@ index 00000000..b12e7869
+ ],
+)
--
-2.22.0
+2.21.0
diff --git a/SOURCES/0007-libselinux-Do-not-use-SWIG_CFLAGS-when-Python-bindin.patch b/SOURCES/0007-libselinux-Do-not-use-SWIG_CFLAGS-when-Python-bindin.patch
index 044ffac..a064418 100644
--- a/SOURCES/0007-libselinux-Do-not-use-SWIG_CFLAGS-when-Python-bindin.patch
+++ b/SOURCES/0007-libselinux-Do-not-use-SWIG_CFLAGS-when-Python-bindin.patch
@@ -1,8 +1,8 @@
From 6ec8116ee64a25a0c5eb543f0b12ed25f1348c45 Mon Sep 17 00:00:00 2001
From: Petr Lautrbach <plautrba@redhat.com>
Date: Thu, 27 Jun 2019 11:17:13 +0200
-Subject: [PATCH 7/7] libselinux: Do not use SWIG_CFLAGS when Python bindings
- are built
+Subject: [PATCH] libselinux: Do not use SWIG_CFLAGS when Python bindings are
+ built
Fixes:
https://rpmdiff.engineering.redhat.com/run/410372/7/
@@ -40,5 +40,5 @@ index 826c830c..f64f23a8 100644
rubywrap: all $(SWIGRUBYSO)
--
-2.22.0
+2.21.0
diff --git a/SOURCES/0008-Fix-mcstrans-secolor-examples.patch b/SOURCES/0008-Fix-mcstrans-secolor-examples.patch
new file mode 100644
index 0000000..d2c91ef
--- /dev/null
+++ b/SOURCES/0008-Fix-mcstrans-secolor-examples.patch
@@ -0,0 +1,66 @@
+From 90a4f2b9a5194a2d1ab4c45b7a90bbb6c8099a68 Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Tue, 2 Jul 2019 14:09:05 +0200
+Subject: [PATCH] Fix mcstrans secolor examples
+
+According to "check_dominance" function:
+Range defined as "s15:c0.c1023" does not dominate any other range than
+ "s15:c0.c1023" (does not dominate "s15", "s15:c0.c200", etc.).
+While range defined as "s15-s15:c0.c1023" dominates all of the above.
+
+This is either a bug, or "s15:c0.c1023" should not be used in the
+examples.
+
+Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
+---
+ libselinux/man/man5/secolor.conf.5 | 4 ++--
+ libselinux/man/ru/man5/secolor.conf.5 | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/libselinux/man/man5/secolor.conf.5 b/libselinux/man/man5/secolor.conf.5
+index b834577a..a3bf2da1 100644
+--- a/libselinux/man/man5/secolor.conf.5
++++ b/libselinux/man/man5/secolor.conf.5
+@@ -123,7 +123,7 @@ range s7\-s7:c0.c1023 = black red
+ .br
+ range s9\-s9:c0.c1023 = black orange
+ .br
+-range s15:c0.c1023 = black yellow
++range s15\-s15:c0.c1023 = black yellow
+ .RE
+
+ .sp
+@@ -165,7 +165,7 @@ type xguest_t = black green
+ .br
+ user sysadm_u = white black
+ .br
+-range s0:c0.c1023 = black white
++range s0-s0:c0.c1023 = black white
+ .br
+ user * = black white
+ .br
+diff --git a/libselinux/man/ru/man5/secolor.conf.5 b/libselinux/man/ru/man5/secolor.conf.5
+index 4c1236ae..bcae80c1 100644
+--- a/libselinux/man/ru/man5/secolor.conf.5
++++ b/libselinux/man/ru/man5/secolor.conf.5
+@@ -121,7 +121,7 @@ range s7\-s7:c0.c1023 = black red
+ .br
+ range s9\-s9:c0.c1023 = black orange
+ .br
+-range s15:c0.c1023 = black yellow
++range s15\-s15:c0.c1023 = black yellow
+ .RE
+
+ .sp
+@@ -163,7 +163,7 @@ type xguest_t = black green
+ .br
+ user sysadm_u = white black
+ .br
+-range s0:c0.c1023 = black white
++range s0\-s0:c0.c1023 = black white
+ .br
+ user * = black white
+ .br
+--
+2.21.0
+
diff --git a/SPECS/libselinux.spec b/SPECS/libselinux.spec
index 2a1eff5..83af24c 100644
--- a/SPECS/libselinux.spec
+++ b/SPECS/libselinux.spec
@@ -6,7 +6,7 @@
%endif
%define libsepolver 2.9-1
-%define libselinuxrelease 2.1
+%define libselinuxrelease 3
Summary: SELinux library and simple utilities
Name: libselinux
@@ -26,6 +26,7 @@ Patch0004: 0004-Bring-some-old-permission-and-flask-constants-back-t.patch
Patch0005: 0005-libselinux-add-missing-av_permission-values.patch
Patch0006: 0006-libselinux-Use-Python-distutils-to-install-SELinux-p.patch
Patch0007: 0007-libselinux-Do-not-use-SWIG_CFLAGS-when-Python-bindin.patch
+Patch0008: 0008-Fix-mcstrans-secolor-examples.patch
BuildRequires: gcc
%if 0%{?with_ruby}
@@ -273,6 +274,9 @@ rm -f %{buildroot}%{_mandir}/man8/togglesebool*
%endif
%changelog
+* Fri Nov 08 2019 Vit Mojzis <vmojzis@redhat.com> - 2.9-3
+- Fix mcstrans secolor examples in secolor.conf man page (#1770270)
+
* Mon Jun 24 2019 Petr Lautrbach <plautrba@redhat.com> - 2.9-2.1
- Use Python distutils to install SELinux python bindings (#1719771)
- Move sefcontext_compile to -utils package (#1612518)