!94 [sync] PR-90: 【openEuler-22.03-LTS】Backport patch from upstream to avoid unsigned integer underflow

From: @openeuler-sync-bot 
Reviewed-by: @HuaxinLuGitee 
Signed-off-by: @HuaxinLuGitee

backport-newrole-silence-compiler-warnings.patch

@@ -0,0 +1,156 @@
+From 29e167a448eff9aaee13d3c51c56641959d4ca7f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
+Date: Tue, 22 Feb 2022 14:51:41 +0100
+Subject: [PATCH] newrole: silence compiler warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+    newrole.c:636:12: warning: function declaration isn’t a prototype [-Wstrict-prototypes]
+      636 | static int transition_to_caller_uid()
+          |            ^~~~~~~~~~~~~~~~~~~~~~~~
+
+    newrole.c:103:9: warning: macro is not used [-Wunused-macros]
+    #define DEFAULT_CONTEXT_SIZE 255        /* first guess at context size */
+            ^
+
+    newrole.c:862:4: warning: 'break' will never be executed [-Wunreachable-code-break]
+                            break;
+                            ^~~~~
+
+    newrole.c:168:13: warning: no previous extern declaration for non-static variable 'service_name' [-Wmissing-variable-declarations]
+    const char *service_name = "newrole";
+                ^
+
+    hashtab.c:53:11: warning: implicit conversion changes signedness: 'unsigned int' to 'int' [-Wsign-conversion]
+            hvalue = h->hash_value(h, key);
+                   ~ ^~~~~~~~~~~~~~~~~~~~~
+    hashtab.c:92:11: warning: implicit conversion changes signedness: 'unsigned int' to 'int' [-Wsign-conversion]
+            hvalue = h->hash_value(h, key);
+                   ~ ^~~~~~~~~~~~~~~~~~~~~
+    hashtab.c:124:11: warning: implicit conversion changes signedness: 'unsigned int' to 'int' [-Wsign-conversion]
+            hvalue = h->hash_value(h, key);
+                   ~ ^~~~~~~~~~~~~~~~~~~~~
+    hashtab.c:172:10: warning: implicit conversion changes signedness: 'int' to 'unsigned int' [-Wsign-conversion]
+                            ret = apply(cur->key, cur->datum, args);
+                                ~ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    hashtab.c:174:12: warning: implicit conversion changes signedness: 'unsigned int' to 'int' [-Wsign-conversion]
+                                    return ret;
+                                    ~~~~~~ ^~~
+
+Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
+---
+ policycoreutils/newrole/hashtab.c |  9 +++++----
+ policycoreutils/newrole/newrole.c | 15 ++++++---------
+ 2 files changed, 11 insertions(+), 13 deletions(-)
+
+diff --git a/policycoreutils/newrole/hashtab.c b/policycoreutils/newrole/hashtab.c
+index bc502836..26d4f4c7 100644
+--- a/policycoreutils/newrole/hashtab.c
++++ b/policycoreutils/newrole/hashtab.c
+@@ -44,7 +44,7 @@ hashtab_t hashtab_create(unsigned int (*hash_value) (hashtab_t h,
+ 
+ int hashtab_insert(hashtab_t h, hashtab_key_t key, hashtab_datum_t datum)
+ {
+-	int hvalue;
++	unsigned int hvalue;
+ 	hashtab_ptr_t prev, cur, newnode;
+ 
+ 	if (!h)
+@@ -83,7 +83,7 @@ int hashtab_remove(hashtab_t h, hashtab_key_t key,
+ 		   void (*destroy) (hashtab_key_t k,
+ 				    hashtab_datum_t d, void *args), void *args)
+ {
+-	int hvalue;
++	unsigned int hvalue;
+ 	hashtab_ptr_t cur, last;
+ 
+ 	if (!h)
+@@ -115,7 +115,7 @@ int hashtab_remove(hashtab_t h, hashtab_key_t key,
+ hashtab_datum_t hashtab_search(hashtab_t h, const_hashtab_key_t key)
+ {
+ 
+-	int hvalue;
++	unsigned int hvalue;
+ 	hashtab_ptr_t cur;
+ 
+ 	if (!h)
+@@ -160,8 +160,9 @@ int hashtab_map(hashtab_t h,
+ 		int (*apply) (hashtab_key_t k,
+ 			      hashtab_datum_t d, void *args), void *args)
+ {
+-	unsigned int i, ret;
++	unsigned int i;
+ 	hashtab_ptr_t cur;
++	int ret;
+ 
+ 	if (!h)
+ 		return HASHTAB_SUCCESS;
+diff --git a/policycoreutils/newrole/newrole.c b/policycoreutils/newrole/newrole.c
+index 9d68b6ab..c9989863 100644
+--- a/policycoreutils/newrole/newrole.c
++++ b/policycoreutils/newrole/newrole.c
+@@ -100,7 +100,6 @@
+ #endif
+ 
+ #define DEFAULT_PATH "/usr/bin:/bin"
+-#define DEFAULT_CONTEXT_SIZE 255	/* first guess at context size */
+ 
+ extern char **environ;
+ 
+@@ -115,7 +114,7 @@ extern char **environ;
+  *
+  * Returns malloc'd memory
+  */
+-static char *build_new_range(char *newlevel, const char *range)
++static char *build_new_range(const char *newlevel, const char *range)
+ {
+ 	char *newrangep = NULL;
+ 	const char *tmpptr;
+@@ -166,7 +165,7 @@ static char *build_new_range(char *newlevel, const char *range)
+ #include <security/pam_appl.h>	/* for PAM functions */
+ #include <security/pam_misc.h>	/* for misc_conv PAM utility function */
+ 
+-const char *service_name = "newrole";
++static const char *service_name = "newrole";
+ 
+ /* authenticate_via_pam()
+  *
+@@ -230,14 +229,13 @@ static int free_hashtab_entry(hashtab_key_t key, hashtab_datum_t d,
+ 
+ static unsigned int reqsymhash(hashtab_t h, const_hashtab_key_t key)
+ {
+-	char *p, *keyp;
++	const char *p;
+ 	size_t size;
+ 	unsigned int val;
+ 
+ 	val = 0;
+-	keyp = (char *)key;
+-	size = strlen(keyp);
+-	for (p = keyp; ((size_t) (p - keyp)) < size; p++)
++	size = strlen(key);
++	for (p = key; ((size_t) (p - key)) < size; p++)
+ 		val =
+ 		    (val << 4 | (val >> (8 * sizeof(unsigned int) - 4))) ^ (*p);
+ 	return val & (h->size - 1);
+@@ -623,7 +621,7 @@ static inline int drop_capabilities(__attribute__ ((__unused__)) int full)
+  * This function will set the uid values to be that of caller's uid, and
+  * will drop any privilege which may have been raised.
+  */
+-static int transition_to_caller_uid()
++static int transition_to_caller_uid(void)
+ {
+ 	uid_t uid = getuid();
+ 
+@@ -850,7 +848,6 @@ static int parse_command_line_arguments(int argc, char **argv, char *ttyn,
+ 		case 'V':
+ 			printf("newrole: %s version %s\n", PACKAGE, VERSION);
+ 			exit(0);
+-			break;
+ 		case 'p':
+ 			*preserve_environment = 1;
+ 			break;
+-- 
+2.33.0
+

backport-newrole-use-DJB2a-string-hash-function.patch

@@ -0,0 +1,53 @@
+From 3089f1f2fd92684372e8141f1f5dbfd97b859983 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
+Date: Wed, 16 Aug 2023 14:38:45 +0200
+Subject: [PATCH] newrole: use DJB2a string hash function
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The hash table implementation uses `& (h->size - 1)` to truncate
+generated hashes to the number of buckets.  This operation is equal to
+`% h->size` if and only if the size is a power of two (which seems to be
+always the case).  One property of the binary and with a power of two
+(and probably a small one <=2048) is all higher bits are discarded.
+Thus a hash function is needed with a good avalanche effect, which the
+current one is not.
+
+Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
+Acked-by: James Carter <jwcart2@gmail.com>
+---
+ policycoreutils/newrole/newrole.c | 17 +++++++----------
+ 1 file changed, 7 insertions(+), 10 deletions(-)
+
+diff --git a/policycoreutils/newrole/newrole.c b/policycoreutils/newrole/newrole.c
+index d9efa68a..5a1a1129 100644
+--- a/policycoreutils/newrole/newrole.c
++++ b/policycoreutils/newrole/newrole.c
+@@ -229,16 +229,13 @@ static int free_hashtab_entry(hashtab_key_t key, hashtab_datum_t d,
+ 
+ static unsigned int reqsymhash(hashtab_t h, const_hashtab_key_t key)
+ {
+-	const char *p;
+-	size_t size;
+-	unsigned int val;
+-
+-	val = 0;
+-	size = strlen(key);
+-	for (p = key; ((size_t) (p - key)) < size; p++)
+-		val =
+-		    (val << 4 | (val >> (8 * sizeof(unsigned int) - 4))) ^ (*p);
+-	return val & (h->size - 1);
++	unsigned int hash = 5381;
++	unsigned char c;
++
++	while ((c = *(unsigned const char *)key++))
++		hash = ((hash << 5) + hash) ^ c;
++
++	return hash & (h->size - 1);
+ }
+ 
+ static int reqsymcmp(hashtab_t h
+-- 
+2.33.0
+

backport-python-Harden-more-tools-against-rogue-modules.patch

@@ -0,0 +1,98 @@
+From 94389f21022be68cb048b4b76d32c0f2440b15ee Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Wed, 6 Dec 2023 15:31:51 +0100
+Subject: [PATCH] python: Harden more tools against "rogue" modules
+
+Python scripts present in the same directory as the tool
+override regular modules.
+
+Fixes:
+      #cat > /usr/bin/signal.py <<EOF
+      import sys
+      print("BAD GUY!", file=sys.stderr)
+      sys.exit(1)
+      EOF
+      #sandbox date
+      BAD GUY!
+
+Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
+Acked-by: James Carter <jwcart2@gmail.com>
+---
+ dbus/selinux_server.py       | 2 +-
+ gui/polgengui.py             | 2 +-
+ gui/system-config-selinux.py | 6 +++---
+ sandbox/sandbox              | 2 +-
+ sandbox/start                | 2 +-
+ 5 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/dbus/selinux_server.py b/dbus/selinux_server.py
+index a969f226..469c526f 100644
+--- a/dbus/selinux_server.py
++++ b/dbus/selinux_server.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python3
++#!/usr/bin/python3 -EsI
+ 
+ import dbus
+ import dbus.service
+diff --git a/gui/polgengui.py b/gui/polgengui.py
+index 16116ba6..9c151a11 100644
+--- a/gui/polgengui.py
++++ b/gui/polgengui.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python3 -Es
++#!/usr/bin/python3 -EsI
+ #
+ # polgengui.py - GUI for SELinux Config tool in system-config-selinux
+ #
+diff --git a/gui/system-config-selinux.py b/gui/system-config-selinux.py
+index 9f53b7fe..0b6ba4b5 100644
+--- a/gui/system-config-selinux.py
++++ b/gui/system-config-selinux.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python3 -Es
++#!/usr/bin/python3 -EsI
+ #
+ # system-config-selinux.py - GUI for SELinux Config tool in system-config-selinux
+ #
+@@ -32,6 +32,8 @@ except RuntimeError as e:
+     print("This is a graphical application and requires DISPLAY to be set.")
+     sys.exit(1)
+ 
++sys.path.append('/usr/share/system-config-selinux')
++
+ from gi.repository import GObject
+ import statusPage
+ import booleansPage
+@@ -66,8 +68,6 @@ except:
+ 
+ version = "1.0"
+ 
+-sys.path.append('/usr/share/system-config-selinux')
+-
+ 
+ ##
+ ## Pull in the Glade file
+diff --git a/sandbox/sandbox b/sandbox/sandbox
+index a2762a7d..fe631a92 100644
+--- a/sandbox/sandbox
++++ b/sandbox/sandbox
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python3 -Es
++#!/usr/bin/python3 -EsI
+ # Authors: Dan Walsh <dwalsh@redhat.com>
+ # Authors: Thomas Liu <tliu@fedoraproject.org>
+ # Authors: Josh Cogliati
+diff --git a/sandbox/start b/sandbox/start
+index 4ed3cb5c..3c1a1783 100644
+--- a/sandbox/start
++++ b/sandbox/start
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python3 -Es
++#!/usr/bin/python3 -EsI
+ try:
+     from subprocess import getstatusoutput
+ except ImportError:
+-- 
+2.33.0
+

backport-python-Use-isinstance-instead-of-type.patch

@@ -0,0 +1,35 @@
+From f6dc6acfa00707ce25c6357169111937f12512dd Mon Sep 17 00:00:00 2001
+From: James Carter <jwcart2@gmail.com>
+Date: Thu, 3 Aug 2023 09:40:24 -0400
+Subject: [PATCH] python: Use isinstance() instead of type()
+
+CI testing fails while running flake8 on python scripts with the
+message "./python/semanage/seobject.py:250:16: E721 do not compare
+types, for exact checks use `is` / `is not`, for instance checks use
+`isinstance()`"
+
+Use "isinstance(args, str)" instead of "type(args) == str"
+
+Signed-off-by: James Carter <jwcart2@gmail.com>
+
+Reference:https://github.com/SELinuxProject/selinux/commit/f6dc6acfa00707ce25c6357169111937f12512dd
+Conflict:NA
+---
+ python/semanage/seobject.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
+index 361205d1..cc944ae2 100644
+--- a/python/semanage/seobject.py
++++ b/python/semanage/seobject.py
+@@ -247,7 +247,7 @@ class semanageRecords:
+         global handle
+         if args:
+             # legacy code - args was store originally
+-            if type(args) == str:
++            if isinstance(args, str):
+                 self.store = args
+             else:
+                 self.args = args
+-- 
+2.23.0

backport-restorecond-add-check-for-strdup-in-strings_list_add.patch

@@ -0,0 +1,31 @@
+From 8730e0762e36ae214932e2a2a84aedd573462357 Mon Sep 17 00:00:00 2001
+From: Huaxin Lu <luhuaxin1@huawei.com>
+Date: Tue, 11 Jul 2023 06:49:33 +0800
+Subject: [PATCH] restorecond: add check for strdup in strings_list_add
+
+Check the return value of strdup() to avoid null pointer reference.
+
+Signed-off-by: Huaxin Lu <luhuaxin1@huawei.com>
+Acked-by: James Carter <jwcart2@gmail.com>
+
+Reference:https://github.com/SELinuxProject/selinux/commit/8730e0762e36ae214932e2a2a84aedd573462357
+Conflict:NA
+---
+ restorecond/stringslist.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/restorecond/stringslist.c b/restorecond/stringslist.c
+index f9404b1e..a76542a7 100644
+--- a/restorecond/stringslist.c
++++ b/restorecond/stringslist.c
+@@ -48,6 +48,8 @@ void strings_list_add(struct stringsList **list, const char *string)
+ 	if (!newptr)
+ 		exitApp("Out of Memory");
+ 	newptr->string = strdup(string);
++	if (!newptr->string)
++		exitApp("Out of Memory");
+ 	newptr->next = ptr;
+ 	if (prev)
+ 		prev->next = newptr;
+-- 
+2.23.0

backport-restorecond-compatible-with-the-use-of-EUID.patch

@@ -0,0 +1,34 @@
+From ca76a8813e9ac9536f09b5611b09b2b21064f984 Mon Sep 17 00:00:00 2001
+From: Huizhao Wang <wanghuizhao1@huawei.com>
+Date: Sat, 5 Aug 2023 15:06:50 +0800
+Subject: [PATCH] restorecond: compatible with the use of EUID
+
+The `EUID` does not exist in some shell environments. To ensure compatibility,
+use `id -u` instead of `EUID` when `EUID` does not exist.
+
+Signed-off-by: Huizhao Wang <wanghuizhao1@huawei.com>
+Acked-by: Petr Lautrbach <lautrbach@redhat.com>
+---
+ restorecond/restorecond.init | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/restorecond/restorecond.init b/restorecond/restorecond.init
+index c1cbb247..4e71a2c6 100644
+--- a/restorecond/restorecond.init
++++ b/restorecond/restorecond.init
+@@ -29,7 +29,11 @@ PATH=/sbin:/bin:/usr/bin:/usr/sbin
+ [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled || exit 7
+ 
+ # Check that we are root ... so non-root users stop here
+-test $EUID = 0  || exit 4
++if [ $EUID  ]; then
++	test $EUID = 0  || exit 4
++else
++	test `id -u` = 0  || exit 4
++fi
+ 
+ test -x /usr/sbin/restorecond  || exit 5
+ test -f /etc/selinux/restorecond.conf  || exit 6
+-- 
+2.27.0
+

backport-sepolicy-manpage.py-make-output-deterministic.patch

@@ -0,0 +1,37 @@
+From 84e0884260c550ef840de6d09573444d93fb209a Mon Sep 17 00:00:00 2001
+From: Cathy Hu <cahu@suse.de>
+Date: Wed, 25 Oct 2023 15:18:58 +0200
+Subject: [PATCH] sepolicy/manpage.py: make output deterministic
+
+The list entries in the alphabetically grouped dict are
+not sorted, which results in non-deterministic output for
+index.html.
+
+Sort entries of those lists to make the output deterministic
+to be able to have reproducible builds.
+
+See https://reproducible-builds.org/ for reasoning.
+This patch was done while working on reproducible builds for openSUSE.
+
+Signed-off-by: Cathy Hu <cahu@suse.de>
+Acked-by: Petr Lautrbach <lautrbach@redhat.com>
+---
+ python/sepolicy/sepolicy/manpage.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/python/sepolicy/sepolicy/manpage.py b/python/sepolicy/sepolicy/manpage.py
+index a488dcbf..62999019 100755
+--- a/python/sepolicy/sepolicy/manpage.py
++++ b/python/sepolicy/sepolicy/manpage.py
+@@ -156,7 +156,7 @@ def get_alphabet_manpages(manpage_list):
+             if j.split("/")[-1][0] == i:
+                 temp.append(j.split("/")[-1])
+ 
+-        alphabet_manpages[i] = temp
++        alphabet_manpages[i] = sorted(temp)
+ 
+     return alphabet_manpages
+ 
+-- 
+2.27.0
+

backport-setfiles-avoid-unsigned-integer-underflow.patch

@@ -0,0 +1,53 @@
+From fc2e9318d0a1b2ec331f6af25e70358f130d003b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
+Date: Tue, 19 Dec 2023 17:09:33 +0100
+Subject: [PATCH] setfiles: avoid unsigned integer underflow
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+While well-defined unsigned integer underflow might signal a logic
+mistake or processing of unchecked user input.  Please Clang's undefined
+behavior sanitizer:
+
+restore.c:91:37: runtime error: unsigned integer overflow: 1 - 2 cannot
+be represented in type 'unsigned long'
+
+Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
+Acked-by: James Carter <jwcart2@gmail.com>
+---
+ policycoreutils/setfiles/restore.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/policycoreutils/setfiles/restore.c b/policycoreutils/setfiles/restore.c
+index 9d688c6..612cc21 100644
+--- a/policycoreutils/setfiles/restore.c
++++ b/policycoreutils/setfiles/restore.c
+@@ -75,8 +75,8 @@ void restore_finish(void)
+ int process_glob(char *name, struct restore_opts *opts)
+ {
+ 	glob_t globbuf;
+-	size_t i = 0;
+-	int len, rc, errors;
++	size_t i, len;
++	int rc, errors;
+ 
+ 	memset(&globbuf, 0, sizeof(globbuf));
+ 
+@@ -86,10 +86,10 @@ int process_glob(char *name, struct restore_opts *opts)
+ 		return errors;
+ 
+ 	for (i = 0; i < globbuf.gl_pathc; i++) {
+-		len = strlen(globbuf.gl_pathv[i]) - 2;
+-		if (len > 0 && strcmp(&globbuf.gl_pathv[i][len--], "/.") == 0)
++		len = strlen(globbuf.gl_pathv[i]);
++		if (len > 2 && strcmp(&globbuf.gl_pathv[i][len - 2], "/.") == 0)
+ 			continue;
+-		if (len > 0 && strcmp(&globbuf.gl_pathv[i][len], "/..") == 0)
++		if (len > 3 && strcmp(&globbuf.gl_pathv[i][len - 3], "/..") == 0)
+ 			continue;
+ 		rc = selinux_restorecon(globbuf.gl_pathv[i],
+ 					opts->restorecon_flags);
+-- 
+2.33.0
+

policycoreutils.spec

@@ -3,7 +3,7 @@
 
 Name:      policycoreutils
 Version:   3.3
-Release:   6
+Release:   11
 Summary:   Policy core utilities of selinux
 License:   GPLv2
 URL:       https://github.com/SELinuxProject
@@ -29,6 +29,15 @@ Patch6008:    backport-sepolicy-Call-os.makedirs-with-exist_ok-True.patch
 Patch6009:    backport-policycoreutils-fix-potential-NULL-reference-in-load_checks.patch
 Patch6010:    backport-python-sepolicy-add-missing-booleans-to-man-pages.patch
 Patch6011:    backport-python-sepolicy-Cache-conditional-rule-queries.patch
+Patch6012:    backport-restorecond-add-check-for-strdup-in-strings_list_add.patch
+Patch6013:    backport-python-Use-isinstance-instead-of-type.patch
+Patch6014:    backport-restorecond-compatible-with-the-use-of-EUID.patch
+Patch6015:    backport-sepolicy-manpage.py-make-output-deterministic.patch
+Patch6016:    restorecond-remove-dependency-of-glib2.patch
+Patch6017:    backport-newrole-silence-compiler-warnings.patch
+Patch6018:    backport-newrole-use-DJB2a-string-hash-function.patch
+Patch6019:    backport-python-Harden-more-tools-against-rogue-modules.patch
+Patch6020:    backport-setfiles-avoid-unsigned-integer-underflow.patch
 
 BuildRequires: gcc
 BuildRequires: pam-devel libsepol-static >= 3.3 libsemanage-static >= 3.3 libselinux-devel >= 3.3  libcap-devel audit-libs-devel  gettext
@@ -269,6 +278,21 @@ find %{buildroot}%{python3_sitelib} %{buildroot}%{python3_sitearch} \
 %{_mandir}/*
 
 %changelog
+* Wed Mar 20 2024 yixiangzhike <yixiangzhike007@163.com> -3.3-11
+- backport patch from upstream to avoid unsigned integer underflow
+
+* Wed Jan 31 2024 zhangruifang <zhangruifang1@h-partners.com> -3.3-10
+- backport patches from upstream
+
+* Tue Dec 26 2023 wanghuizhao <wanghuizhao1@huawei.com> -3.3-9
+- submit self-developed patch
+
+* Thu Dec 14 2023 yixiangzhike <yixiangzhike007@163.com> -3.3-8
+- backport patches from upstream
+
+* Mon Sep 11 2023 zhangguangzhi <zhangguangzhi3@huawei.com> -3.3-7
+- backport patches from upstream
+
 * Wed Mar 22 2023 zhangguangzhi <zhangguangzhi3@huawei.com> -3.3-6
 - backport patches from upstream
 

restorecond-remove-dependency-of-glib2.patch

@@ -0,0 +1,136 @@
+From 2eb9db473adf885dc0361b1967edd1781ff13b1e Mon Sep 17 00:00:00 2001
+From: wanghuizhao <wanghuizhao1@huawei.com>
+Date: Sun, 24 Dec 2023 23:23:55 +0800
+Subject: [PATCH] restorecond: remove dependency of glib2
+
+In order to remove the dependency of glib2, and in some scenarios, it is
+not necessary to use the user mode, remove the user related option.
+
+Signed-off-by: wanghuizhao <wanghuizhao1@huawei.com>
+---
+ .../restorecond/Makefile                      | 21 +++++++++++++++++++
+ .../restorecond/restorecond.c                 | 14 +++++++++++++
+ 2 files changed, 35 insertions(+)
+
+diff --git a/restorecond/Makefile b/restorecond/Makefile
+index 8e9a5ef..bebd39e 100644
+--- a/restorecond/Makefile
++++ b/restorecond/Makefile
+@@ -13,21 +13,37 @@ SYSTEMDUSERUNITDIR ?= $(shell $(PKG_CONFIG) --variable=systemduserunitdir system
+ autostart_DATA = sealertauto.desktop
+ INITDIR ?= /etc/rc.d/init.d
+ SELINUXDIR = /etc/selinux
++CONFIG_NO_GLIB2 ?= n
+ 
++ifeq ($(CONFIG_NO_GLIB2),n)
+ GIO_CFLAGS = -DHAVE_DBUS $(shell $(PKG_CONFIG) --cflags gio-2.0)
+ GIO_LIBS = $(shell $(PKG_CONFIG) --libs gio-2.0)
++endif
+ 
+ CFLAGS ?= -g -Werror -Wall -W
++
++ifeq ($(CONFIG_NO_GLIB2),y)
++	override CFLAGS += -DCONFIG_NO_GLIB2
++	override LDLIBS += -lselinux
++else
+ override CFLAGS += $(GIO_CFLAGS)
+ 
+ override LDLIBS += -lselinux $(GIO_LIBS)
++endif
+ 
+ all: restorecond
+ 
++ifeq ($(CONFIG_NO_GLIB2),y)
++restorecond.o utmpwatcher.o stringslist.o watch.o: restorecond.h
++
++restorecond:  restore.o restorecond.o utmpwatcher.o stringslist.o watch.o
++	$(CC) $(LDFLAGS) -o $@ $^ $(LDLIBS)
++else
+ restorecond.o utmpwatcher.o stringslist.o user.o watch.o: restorecond.h
+ 
+ restorecond:  restore.o restorecond.o utmpwatcher.o stringslist.o user.o watch.o
+ 	$(CC) $(LDFLAGS) -o $@ $^ $(LDLIBS)
++endif
+ 
+ install: all
+ 	[ -d $(DESTDIR)$(MANDIR)/man8 ] || mkdir -p $(DESTDIR)$(MANDIR)/man8
+@@ -44,15 +60,20 @@ install: all
+ 	install -m 755 restorecond.init $(DESTDIR)$(INITDIR)/restorecond
+ 	-mkdir -p $(DESTDIR)$(SELINUXDIR)
+ 	install -m 644 restorecond.conf $(DESTDIR)$(SELINUXDIR)/restorecond.conf
++ifeq ($(CONFIG_NO_GLIB2),n)
+ 	install -m 644 restorecond_user.conf $(DESTDIR)$(SELINUXDIR)/restorecond_user.conf
+ 	-mkdir -p $(DESTDIR)$(AUTOSTARTDIR)
+ 	install -m 644 restorecond.desktop $(DESTDIR)$(AUTOSTARTDIR)/restorecond.desktop
+ 	-mkdir -p $(DESTDIR)$(DBUSSERVICEDIR)
+ 	install -m 644 org.selinux.Restorecond.service  $(DESTDIR)$(DBUSSERVICEDIR)/org.selinux.Restorecond.service
++endif
+ 	-mkdir -p $(DESTDIR)$(SYSTEMDSYSTEMUNITDIR)
+ 	install -m 644 restorecond.service $(DESTDIR)$(SYSTEMDSYSTEMUNITDIR)
++ifeq ($(CONFIG_NO_GLIB2),n)
+ 	-mkdir -p $(DESTDIR)$(SYSTEMDUSERUNITDIR)
+ 	install -m 644 restorecond_user.service $(DESTDIR)$(SYSTEMDUSERUNITDIR)
++endif
++
+ relabel: install
+ 	/sbin/restorecon $(DESTDIR)$(SBINDIR)/restorecond 
+ 
+diff --git a/restorecond/restorecond.c b/restorecond/restorecond.c
+index d5f70fc..fc0594b 100644
+--- a/restorecond/restorecond.c
++++ b/restorecond/restorecond.c
+@@ -124,7 +124,11 @@ static void term_handler(int s __attribute__ ((unused)))
+ 
+ static void usage(char *program)
+ {
++#ifndef CONFIG_NO_GLIB2
+ 	printf("%s [-d] [-f restorecond_file ] [-u] [-v] \n", program);
++#else
++    printf("%s [-d] [-f restorecond_file ] [-v] \n", program);
++#endif
+ }
+ 
+ void exitApp(const char *msg)
+@@ -165,7 +169,11 @@ int main(int argc, char **argv)
+ 	sigaction(SIGTERM, &sa, NULL);
+ 
+ 	atexit( done );
++#ifndef CONFIG_NO_GLIB2
+ 	while ((opt = getopt(argc, argv, "hdf:uv")) > 0) {
++#else
++	while ((opt = getopt(argc, argv, "hdf:v")) > 0) {
++#endif
+ 		switch (opt) {
+ 		case 'd':
+ 			debug_mode = 1;
+@@ -173,9 +181,11 @@ int main(int argc, char **argv)
+ 		case 'f':
+ 			watch_file = optarg;
+ 			break;
++#ifndef CONFIG_NO_GLIB2
+ 		case 'u':
+ 			run_as_user = 1;
+ 			break;
++#endif
+ 		case 'h':
+ 			usage(argv[0]);
+ 			exit(0);
+@@ -200,11 +210,15 @@ int main(int argc, char **argv)
+ 
+ 	homedir = pwd->pw_dir;
+ 	if (uid != 0) {
++#ifndef CONFIG_NO_GLIB2
+ 		if (run_as_user)
+ 			return server(master_fd, user_watch_file);
+ 		if (start() != 0)
+ 			return server(master_fd, user_watch_file);
+ 		return 0;
++#else
++		exitApp("root_only");
++#endif
+ 	}
+ 
+ 	read_config(master_fd, watch_file);
+-- 
+2.21.0
+