PR#409: Implement bin-sbin merge - rpms/selinux-policy

rpms / selinux-policy

#409 Implement bin-sbin merge

Opened 23 days ago by zbyszek. Modified 23 days ago

rpms/ zbyszek/selinux-policy bin-sbin-merge into rawhide

Implement bin-sbin merge

Zbigniew Jędrzejewski-Szmek • 23 days ago

2448560

0001-Fix-bad-Python-regexp-escapes.patch

file added

+73

		`@@ -0,0 +1,73 @@`
		`+ From 59c7a140f0ef15e7956f6614017d920a99fe6013 Mon Sep 17 00:00:00 2001`
		`+ From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>`
		`+ Date: Mon, 15 Apr 2024 20:26:51 +0200`
		`+ Subject: [PATCH] Fix bad Python regexp escapes`
		`+`
		`+ Python 3.12 started warning about such escapes. Use r"" to suppress`
		`+ the warning.`
		`+ ---`
		`+ support/pyplate.py \| 16 ++++++++--------`
		`+ support/segenxml.py \| 6 +++---`
		`+ 2 files changed, 11 insertions(+), 11 deletions(-)`
		`+`
		`+ diff --git a/support/pyplate.py b/support/pyplate.py`
		`+ index 44b662ac37..168d0af3b5 100644`
		`+ --- a/support/pyplate.py`
		`+ +++ b/support/pyplate.py`
		`+ @@ -53,14 +53,14 @@ PyPlate defines the following directives:`
		`+ from __future__ import nested_scopes`
		`+ import sys, string, re, io`
		`+`
		`+ -re_directive = re.compile("\[\[(.*)\]\]")`
		`+ -re_for_loop = re.compile("for (.) in (.)")`
		`+ -re_if = re.compile("if (.*)")`
		`+ -re_elif = re.compile("elif (.*)")`
		`+ -re_def = re.compile("def (.?)$(.)$")`
		`+ -re_call = re.compile("call (.?)$(.)$")`
		`+ -re_exec = re.compile("exec (.*)")`
		`+ -re_comment = re.compile("#(.*)#")`
		`+ +re_directive = re.compile(r"\[\[(.*)\]\]")`
		`+ +re_for_loop = re.compile(r"for (.) in (.)")`
		`+ +re_if = re.compile(r"if (.*)")`
		`+ +re_elif = re.compile(r"elif (.*)")`
		`+ +re_def = re.compile(r"def (.?)$(.)$")`
		`+ +re_call = re.compile(r"call (.?)$(.)$")`
		`+ +re_exec = re.compile(r"exec (.*)")`
		`+ +re_comment = re.compile(r"#(.*)#")`
		`+`
		`+ ############################################################`
		`+ # Template parser`
		`+ diff --git a/support/segenxml.py b/support/segenxml.py`
		`+ index 5f4f7d0167..6c946e109b 100644`
		`+ --- a/support/segenxml.py`
		`+ +++ b/support/segenxml.py`
		`+ @@ -43,7 +43,7 @@ output_dir = ""`
		`+ # -> ("interface", "kernel_read_system_state")`
		+ # "template(`base_user_template',`"
		`+ # -> ("template", "base_user_template")`
		+ -INTERFACE = re.compile("^\s(interface\|template)\(`(\w)'")
		+ +INTERFACE = re.compile(r"^\s(interface\|template)\(`(\w)'")
		`+`
		`+ # Matches either a gen_bool or a gen_tunable statement. Will give the tuple:`
		`+ # ("tunable" or "bool", name, "true" or "false")`
		+ @@ -52,7 +52,7 @@ INTERFACE = re.compile("^\s(interface\|template)\(`(\w)'")
		`+ # -> ("bool", "secure_mode", "false")`
		`+ # "gen_tunable(allow_kerberos, false)"`
		`+ # -> ("tunable", "allow_kerberos", "false")`
		`+ -BOOLEAN = re.compile("^\sgen_(tunable\|bool)$\s(\w)\s,\s(true\|false)\s$")`
		`+ +BOOLEAN = re.compile(r"^\sgen_(tunable\|bool)$\s(\w)\s,\s(true\|false)\s$")`
		`+`
		`+ # Matches a XML comment in the policy, which is defined as any line starting`
		`+ # with two # and at least one character of white space. Will give the single`
		`+ @@ -63,7 +63,7 @@ BOOLEAN = re.compile("^\sgen_(tunable\|bool)$\s(\w)\s,\s(true\|false)\s$")`
		`+ # -> ("<summary>")`
		`+ # "## The domain allowed access. "`
		`+ # -> ("The domain allowed access.")`
		`+ -XML_COMMENT = re.compile("^##\s+(.?)\s$")`
		`+ +XML_COMMENT = re.compile(r"^##\s+(.?)\s$")`
		`+`
		`+`
		`+ # FUNCTIONS`
		`+ --`
		`+ 2.44.0`
		`+`

0002-Drop-duplicate-paths-for-usr-sbin.patch

file added

+874

		`@@ -0,0 +1,874 @@`
		`+ From 16d5f44c2692fc8b42bd2ad0b91c33380e253a30 Mon Sep 17 00:00:00 2001`
		`+ From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>`
		`+ Date: Thu, 11 Apr 2024 17:28:46 +0200`
		`+ Subject: [PATCH 2/4] Drop duplicate paths for /usr/sbin`
		`+`
		`+ Those rules were duplicated for /sbin and /usr/sbin. /sbin is aliased`
		`+ to /usr/sbin, so those duplicate entries should be completely`
		`+ redundant.`
		`+`
		`+ 8e678aa5945c502db1b9b3b6fe93b7211dc60c15 did something similar.`
		`+ ---`
		`+ policy/modules/admin/bootloader.fc \| 5 ---`
		`+ policy/modules/admin/consoletype.fc \| 3 --`
		`+ policy/modules/admin/netutils.fc \| 1 -`
		`+ policy/modules/contrib/acct.fc \| 2 -`
		`+ policy/modules/contrib/alsa.fc \| 3 --`
		`+ policy/modules/contrib/apcupsd.fc \| 2 -`
		`+ policy/modules/contrib/cachefilesd.fc \| 2 -`
		`+ policy/modules/contrib/ccs.fc \| 2 -`
		`+ policy/modules/contrib/cgroup.fc \| 4 --`
		`+ policy/modules/contrib/cpucontrol.fc \| 2 -`
		`+ policy/modules/contrib/drbd.fc \| 3 --`
		`+ policy/modules/contrib/iscsi.fc \| 3 +-`
		`+ policy/modules/contrib/kdump.fc \| 3 --`
		`+ policy/modules/contrib/nis.fc \| 2 -`
		`+ policy/modules/contrib/nut.fc \| 2 -`
		`+ policy/modules/contrib/pcmcia.fc \| 3 --`
		`+ policy/modules/contrib/plymouthd.fc \| 2 -`
		`+ policy/modules/contrib/portmap.fc \| 9 -----`
		`+ policy/modules/contrib/portreserve.fc \| 2 -`
		`+ policy/modules/contrib/ppp.fc \| 6 ---`
		`+ policy/modules/contrib/prelude.fc \| 2 -`
		`+ policy/modules/contrib/quota.fc \| 6 ---`
		`+ policy/modules/contrib/raid.fc \| 8 ----`
		`+ policy/modules/contrib/readahead.fc \| 2 -`
		`+ policy/modules/contrib/resmgr.fc \| 2 -`
		`+ policy/modules/contrib/rpc.fc \| 6 ---`
		`+ policy/modules/contrib/rpcbind.fc \| 2 -`
		`+ policy/modules/contrib/rpm.fc \| 2 +-`
		`+ policy/modules/contrib/shorewall.fc \| 3 --`
		`+ policy/modules/contrib/shutdown.fc \| 2 -`
		`+ policy/modules/contrib/usbmodules.fc \| 2 +-`
		`+ policy/modules/contrib/vpn.fc \| 5 ---`
		`+ policy/modules/contrib/zosremote.fc \| 2 +-`
		`+ policy/modules/system/authlogin.fc \| 11 ------`
		`+ policy/modules/system/clock.fc \| 2 -`
		`+ policy/modules/system/fstools.fc \| 42 --------------------`
		`+ policy/modules/system/getty.fc \| 2 -`
		`+ policy/modules/system/ipsec.fc \| 2 -`
		`+ policy/modules/system/libraries.fc \| 6 ---`
		`+ policy/modules/system/locallogin.fc \| 3 --`
		`+ policy/modules/system/logging.fc \| 11 ------`
		`+ policy/modules/system/lvm.fc \| 57 ---------------------------`
		`+ policy/modules/system/modutils.fc \| 8 ----`
		`+ policy/modules/system/mount.fc \| 3 --`
		`+ policy/modules/system/netlabel.fc \| 2 -`
		`+ policy/modules/system/selinuxutil.fc \| 7 ----`
		`+ policy/modules/system/setrans.fc \| 2 -`
		`+ policy/modules/system/sysnetwork.fc \| 19 ---------`
		`+ policy/modules/system/udev.fc \| 11 ------`
		`+ 49 files changed, 4 insertions(+), 289 deletions(-)`
		`+`
		`+ diff --git a/policy/modules/admin/bootloader.fc b/policy/modules/admin/bootloader.fc`
		`+ index 5745bb240e..5a5f23d7f9 100644`
		`+ --- a/policy/modules/admin/bootloader.fc`
		`+ +++ b/policy/modules/admin/bootloader.fc`
		`+ @@ -3,11 +3,6 @@`
		`+ /etc/yaboot\.conf.* gen_context(system_u:object_r:bootloader_etc_t,s0)`
		`+ /etc/zipl\.conf.* gen_context(system_u:object_r:bootloader_etc_t,s0)`
		`+`
		`+ -/sbin/grub.* -- gen_context(system_u:object_r:bootloader_exec_t,s0)`
		`+ -/sbin/lilo.* -- gen_context(system_u:object_r:bootloader_exec_t,s0)`
		`+ -/sbin/ybin.* -- gen_context(system_u:object_r:bootloader_exec_t,s0)`
		`+ -/sbin/zipl -- gen_context(system_u:object_r:bootloader_exec_t,s0)`
		`+ -`
		`+ /usr/sbin/grub.* -- gen_context(system_u:object_r:bootloader_exec_t,s0)`
		`+ /usr/sbin/lilo.* -- gen_context(system_u:object_r:bootloader_exec_t,s0)`
		`+ /usr/sbin/ybin.* -- gen_context(system_u:object_r:bootloader_exec_t,s0)`
		`+ diff --git a/policy/modules/admin/consoletype.fc b/policy/modules/admin/consoletype.fc`
		`+ index 5d4fc31883..c5190eef9e 100644`
		`+ --- a/policy/modules/admin/consoletype.fc`
		`+ +++ b/policy/modules/admin/consoletype.fc`
		`+ @@ -1,4 +1 @@`
		`+ -`
		`+ -/sbin/consoletype -- gen_context(system_u:object_r:consoletype_exec_t,s0)`
		`+ -`
		`+ /usr/sbin/consoletype -- gen_context(system_u:object_r:consoletype_exec_t,s0)`
		`+ diff --git a/policy/modules/admin/netutils.fc b/policy/modules/admin/netutils.fc`
		`+ index c6183fe172..f7cbc9df78 100644`
		`+ --- a/policy/modules/admin/netutils.fc`
		`+ +++ b/policy/modules/admin/netutils.fc`
		`+ @@ -5,7 +5,6 @@`
		`+ # regexp can't be used as fixfiles converts any quantifier early in the path to the`
		`+ # "/*" wildcard, effecting in complete filesystem restorecon on the package update`
		`+ /bin/arping -- gen_context(system_u:object_r:netutils_exec_t,s0)`
		`+ -/sbin/arping -- gen_context(system_u:object_r:netutils_exec_t,s0)`
		`+`
		`+ /usr/bin/arping -- gen_context(system_u:object_r:netutils_exec_t,s0)`
		`+ /usr/bin/lft -- gen_context(system_u:object_r:traceroute_exec_t,s0)`
		`+ diff --git a/policy/modules/contrib/acct.fc b/policy/modules/contrib/acct.fc`
		`+ index c6d17a2ff1..8a4f7efddf 100644`
		`+ --- a/policy/modules/contrib/acct.fc`
		`+ +++ b/policy/modules/contrib/acct.fc`
		`+ @@ -2,8 +2,6 @@`
		`+`
		`+ /etc/rc\.d/init\.d/psacct -- gen_context(system_u:object_r:acct_initrc_exec_t,s0)`
		`+`
		`+ -/sbin/accton -- gen_context(system_u:object_r:acct_exec_t,s0)`
		`+ -`
		`+ /usr/sbin/accton -- gen_context(system_u:object_r:acct_exec_t,s0)`
		`+`
		`+ /var/account(/.*)? gen_context(system_u:object_r:acct_data_t,s0)`
		`+ diff --git a/policy/modules/contrib/alsa.fc b/policy/modules/contrib/alsa.fc`
		`+ index e024892b2b..a261f9fcd3 100644`
		`+ --- a/policy/modules/contrib/alsa.fc`
		`+ +++ b/policy/modules/contrib/alsa.fc`
		+ @@ -11,9 +11,6 @@ ifdef(`distro_debian',`
		`+ /etc/asound(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0)`
		`+ /etc/asound\.state -- gen_context(system_u:object_r:alsa_etc_rw_t,s0)`
		`+`
		`+ -/sbin/alsactl -- gen_context(system_u:object_r:alsa_exec_t,s0)`
		`+ -/sbin/salsa -- gen_context(system_u:object_r:alsa_exec_t,s0)`
		`+ -`
		`+ /usr/bin/ainit -- gen_context(system_u:object_r:alsa_exec_t,s0)`
		`+ /usr/bin/alsaunmute -- gen_context(system_u:object_r:alsa_exec_t,s0)`
		`+`
		`+ diff --git a/policy/modules/contrib/apcupsd.fc b/policy/modules/contrib/apcupsd.fc`
		`+ index d9bfd6f4b2..8f66c0fb3c 100644`
		`+ --- a/policy/modules/contrib/apcupsd.fc`
		`+ +++ b/policy/modules/contrib/apcupsd.fc`
		`+ @@ -4,8 +4,6 @@`
		`+`
		`+ /usr/lib/systemd/system/apcupsd.* -- gen_context(system_u:object_r:apcupsd_unit_file_t,s0)`
		`+`
		`+ -/sbin/apcupsd -- gen_context(system_u:object_r:apcupsd_exec_t,s0)`
		`+ -`
		`+ /usr/sbin/apcupsd -- gen_context(system_u:object_r:apcupsd_exec_t,s0)`
		`+`
		`+ /run/lock/subsys/apcupsd -- gen_context(system_u:object_r:apcupsd_lock_t,s0)`
		`+ diff --git a/policy/modules/contrib/cachefilesd.fc b/policy/modules/contrib/cachefilesd.fc`
		`+ index 1cd191ca90..e91d67cfe4 100644`
		`+ --- a/policy/modules/contrib/cachefilesd.fc`
		`+ +++ b/policy/modules/contrib/cachefilesd.fc`
		`+ @@ -21,8 +21,6 @@`
		`+ # MLS sensitivity: s0`
		`+ # MCS categories: <none>`
		`+`
		`+ -/sbin/cachefilesd -- gen_context(system_u:object_r:cachefilesd_exec_t,s0)`
		`+ -`
		`+ /usr/sbin/cachefilesd -- gen_context(system_u:object_r:cachefilesd_exec_t,s0)`
		`+`
		`+ /var/cache/fscache(/.*)? gen_context(system_u:object_r:cachefiles_var_t,s0)`
		`+ diff --git a/policy/modules/contrib/ccs.fc b/policy/modules/contrib/ccs.fc`
		`+ index 86c73a7da6..4bf5e8f316 100644`
		`+ --- a/policy/modules/contrib/ccs.fc`
		`+ +++ b/policy/modules/contrib/ccs.fc`
		`+ @@ -2,8 +2,6 @@`
		`+`
		`+ /etc/rc\.d/init\.d/((ccs)\|(ccsd)) -- gen_context(system_u:object_r:ccs_initrc_exec_t,s0)`
		`+`
		`+ -/sbin/ccsd -- gen_context(system_u:object_r:ccs_exec_t,s0)`
		`+ -`
		`+ /usr/sbin/ccsd -- gen_context(system_u:object_r:ccs_exec_t,s0)`
		`+`
		`+ /var/lib/cluster/((ccs)\|(ccsd)).* gen_context(system_u:object_r:ccs_var_lib_t,s0)`
		`+ diff --git a/policy/modules/contrib/cgroup.fc b/policy/modules/contrib/cgroup.fc`
		`+ index a77ead6969..cfe6b48c0e 100644`
		`+ --- a/policy/modules/contrib/cgroup.fc`
		`+ +++ b/policy/modules/contrib/cgroup.fc`
		`+ @@ -7,10 +7,6 @@`
		`+ /etc/rc\.d/init\.d/cgconfig -- gen_context(system_u:object_r:cgconfig_initrc_exec_t,s0)`
		`+ /etc/rc\.d/init\.d/cgred -- gen_context(system_u:object_r:cgred_initrc_exec_t,s0)`
		`+`
		`+ -/sbin/cgconfigparser -- gen_context(system_u:object_r:cgconfig_exec_t,s0)`
		`+ -/sbin/cgrulesengd -- gen_context(system_u:object_r:cgred_exec_t,s0)`
		`+ -/sbin/cgclear -- gen_context(system_u:object_r:cgclear_exec_t,s0)`
		`+ -`
		`+ /usr/sbin/cgconfigparser -- gen_context(system_u:object_r:cgconfig_exec_t,s0)`
		`+ /usr/sbin/cgrulesengd -- gen_context(system_u:object_r:cgred_exec_t,s0)`
		`+ /usr/sbin/cgclear -- gen_context(system_u:object_r:cgclear_exec_t,s0)`
		`+ diff --git a/policy/modules/contrib/cpucontrol.fc b/policy/modules/contrib/cpucontrol.fc`
		`+ index e8129057b5..4a358d1b01 100644`
		`+ --- a/policy/modules/contrib/cpucontrol.fc`
		`+ +++ b/policy/modules/contrib/cpucontrol.fc`
		`+ @@ -1,7 +1,5 @@`
		`+ /etc/firmware/.* -- gen_context(system_u:object_r:cpucontrol_conf_t,s0)`
		`+`
		`+ -/sbin/microcode_ctl -- gen_context(system_u:object_r:cpucontrol_exec_t,s0)`
		`+ -`
		`+ /usr/libexec/microcode_ctl/reload_microcode -- gen_context(system_u:object_r:cpucontrol_exec_t,s0)`
		`+`
		`+ /usr/sbin/cpufreqd -- gen_context(system_u:object_r:cpuspeed_exec_t,s0)`
		`+ diff --git a/policy/modules/contrib/drbd.fc b/policy/modules/contrib/drbd.fc`
		`+ index 7a3e3b223c..6eb2c3c97b 100644`
		`+ --- a/policy/modules/contrib/drbd.fc`
		`+ +++ b/policy/modules/contrib/drbd.fc`
		`+ @@ -1,8 +1,5 @@`
		`+ /etc/rc\.d/init\.d/drbd -- gen_context(system_u:object_r:drbd_initrc_exec_t,s0)`
		`+`
		`+ -/sbin/drbdadm -- gen_context(system_u:object_r:drbd_exec_t,s0)`
		`+ -/sbin/drbdsetup -- gen_context(system_u:object_r:drbd_exec_t,s0)`
		`+ -`
		`+ /usr/lib/ocf/resource\.d/linbit/drbd -- gen_context(system_u:object_r:drbd_exec_t,s0)`
		`+`
		`+ /usr/sbin/drbdadm -- gen_context(system_u:object_r:drbd_exec_t,s0)`
		`+ diff --git a/policy/modules/contrib/iscsi.fc b/policy/modules/contrib/iscsi.fc`
		`+ index 48d1cb9c1e..da8f6533a3 100644`
		`+ --- a/policy/modules/contrib/iscsi.fc`
		`+ +++ b/policy/modules/contrib/iscsi.fc`
		`+ @@ -1,5 +1,4 @@`
		`+ -/sbin/iscsid -- gen_context(system_u:object_r:iscsid_exec_t,s0)`
		`+ -/sbin/iscsiuio -- gen_context(system_u:object_r:iscsid_exec_t,s0)`
		`+ +`
		`+`
		`+ /usr/sbin/iscsid -- gen_context(system_u:object_r:iscsid_exec_t,s0)`
		`+ /usr/sbin/iscsiuio -- gen_context(system_u:object_r:iscsid_exec_t,s0)`
		`+ diff --git a/policy/modules/contrib/kdump.fc b/policy/modules/contrib/kdump.fc`
		`+ index 5a38fc32c4..0be1b31083 100644`
		`+ --- a/policy/modules/contrib/kdump.fc`
		`+ +++ b/policy/modules/contrib/kdump.fc`
		`+ @@ -1,9 +1,6 @@`
		`+ /etc/kdump\.conf -- gen_context(system_u:object_r:kdump_etc_t,s0)`
		`+ /etc/rc\.d/init\.d/kdump -- gen_context(system_u:object_r:kdump_initrc_exec_t,s0)`
		`+`
		`+ -/sbin/kdump -- gen_context(system_u:object_r:kdump_exec_t,s0)`
		`+ -/sbin/kexec -- gen_context(system_u:object_r:kdump_exec_t,s0)`
		`+ -`
		`+`
		`+ /usr/lib/systemd/system/kdump\.service -- gen_context(system_u:object_r:kdump_unit_file_t,s0)`
		`+`
		`+ diff --git a/policy/modules/contrib/nis.fc b/policy/modules/contrib/nis.fc`
		`+ index 1391f372e5..45bd1f5d8b 100644`
		`+ --- a/policy/modules/contrib/nis.fc`
		`+ +++ b/policy/modules/contrib/nis.fc`
		`+ @@ -4,8 +4,6 @@`
		`+ /etc/rc\.d/init\.d/ypxfrd -- gen_context(system_u:object_r:nis_initrc_exec_t,s0)`
		`+ /etc/ypserv\.conf -- gen_context(system_u:object_r:ypserv_conf_t,s0)`
		`+`
		`+ -/sbin/ypbind -- gen_context(system_u:object_r:ypbind_exec_t,s0)`
		`+ -`
		`+ /usr/lib/yp/ypxfr -- gen_context(system_u:object_r:ypxfr_exec_t,s0)`
		`+`
		`+ /usr/sbin/rpc\.yppasswdd -- gen_context(system_u:object_r:yppasswdd_exec_t,s0)`
		`+ diff --git a/policy/modules/contrib/nut.fc b/policy/modules/contrib/nut.fc`
		`+ index d746f41598..fb8b7d838f 100644`
		`+ --- a/policy/modules/contrib/nut.fc`
		`+ +++ b/policy/modules/contrib/nut.fc`
		`+ @@ -1,7 +1,5 @@`
		`+ /etc/ups(/.*)? gen_context(system_u:object_r:nut_conf_t,s0)`
		`+`
		`+ -/sbin/upsdrvctl -- gen_context(system_u:object_r:nut_upsdrvctl_exec_t,s0)`
		`+ -`
		`+ /usr/lib/systemd/system/nut.* -- gen_context(system_u:object_r:nut_unit_file_t,s0)`
		`+`
		`+ /usr/sbin/upsd -- gen_context(system_u:object_r:nut_upsd_exec_t,s0)`
		`+ diff --git a/policy/modules/contrib/pcmcia.fc b/policy/modules/contrib/pcmcia.fc`
		`+ index e4538bc400..b508069e6d 100644`
		`+ --- a/policy/modules/contrib/pcmcia.fc`
		`+ +++ b/policy/modules/contrib/pcmcia.fc`
		`+ @@ -1,8 +1,5 @@`
		`+ /etc/apm/event\.d/pcmcia -- gen_context(system_u:object_r:cardmgr_exec_t,s0)`
		`+`
		`+ -/sbin/cardctl -- gen_context(system_u:object_r:cardctl_exec_t,s0)`
		`+ -/sbin/cardmgr -- gen_context(system_u:object_r:cardmgr_exec_t,s0)`
		`+ -`
		`+ /usr/sbin/cardctl -- gen_context(system_u:object_r:cardctl_exec_t,s0)`
		`+ /usr/sbin/cardmgr -- gen_context(system_u:object_r:cardmgr_exec_t,s0)`
		`+`
		`+ diff --git a/policy/modules/contrib/plymouthd.fc b/policy/modules/contrib/plymouthd.fc`
		`+ index 9367deac92..8f4ab4c37a 100644`
		`+ --- a/policy/modules/contrib/plymouthd.fc`
		`+ +++ b/policy/modules/contrib/plymouthd.fc`
		`+ @@ -1,7 +1,5 @@`
		`+ /bin/plymouth -- gen_context(system_u:object_r:plymouth_exec_t,s0)`
		`+`
		`+ -/sbin/plymouthd -- gen_context(system_u:object_r:plymouthd_exec_t,s0)`
		`+ -`
		`+ /usr/bin/plymouth -- gen_context(system_u:object_r:plymouth_exec_t,s0)`
		`+`
		`+ /var/lib/plymouth(/.*)? gen_context(system_u:object_r:plymouthd_var_lib_t,s0)`
		`+ diff --git a/policy/modules/contrib/portmap.fc b/policy/modules/contrib/portmap.fc`
		`+ index 659930db5b..d15c7072a0 100644`
		`+ --- a/policy/modules/contrib/portmap.fc`
		`+ +++ b/policy/modules/contrib/portmap.fc`
		`+ @@ -1,17 +1,8 @@`
		`+ /etc/rc\.d/init\.d/portmap -- gen_context(system_u:object_r:portmap_initrc_exec_t,s0)`
		`+`
		`+ -/sbin/pmap_dump -- gen_context(system_u:object_r:portmap_helper_exec_t,s0)`
		`+ -/sbin/pmap_set -- gen_context(system_u:object_r:portmap_helper_exec_t,s0)`
		`+ -/sbin/portmap -- gen_context(system_u:object_r:portmap_exec_t,s0)`
		`+ -`
		+ -ifdef(`distro_debian',`
		`+ -/sbin/pmap_dump -- gen_context(system_u:object_r:portmap_helper_exec_t,s0)`
		`+ -/sbin/pmap_set -- gen_context(system_u:object_r:portmap_helper_exec_t,s0)`
		+ -', `
		`+ /usr/sbin/pmap_dump -- gen_context(system_u:object_r:portmap_helper_exec_t,s0)`
		`+ /usr/sbin/pmap_set -- gen_context(system_u:object_r:portmap_helper_exec_t,s0)`
		`+ /usr/sbin/portmap -- gen_context(system_u:object_r:portmap_exec_t,s0)`
		`+ -')`
		`+`
		`+ /run/portmap\.upgrade-state -- gen_context(system_u:object_r:portmap_var_run_t,s0)`
		`+ /run/portmap_mapping -- gen_context(system_u:object_r:portmap_var_run_t,s0)`
		`+ diff --git a/policy/modules/contrib/portreserve.fc b/policy/modules/contrib/portreserve.fc`
		`+ index 909db68c79..2ba5c038e8 100644`
		`+ --- a/policy/modules/contrib/portreserve.fc`
		`+ +++ b/policy/modules/contrib/portreserve.fc`
		`+ @@ -2,8 +2,6 @@`
		`+`
		`+ /etc/rc\.d/init\.d/portreserve -- gen_context(system_u:object_r:portreserve_initrc_exec_t,s0)`
		`+`
		`+ -/sbin/portreserve -- gen_context(system_u:object_r:portreserve_exec_t,s0)`
		`+ -`
		`+ /usr/sbin/portreserve -- gen_context(system_u:object_r:portreserve_exec_t,s0)`
		`+`
		`+ /run/portreserve(/.*)? gen_context(system_u:object_r:portreserve_var_run_t,s0)`
		`+ diff --git a/policy/modules/contrib/ppp.fc b/policy/modules/contrib/ppp.fc`
		`+ index fe02008f29..135018c9dc 100644`
		`+ --- a/policy/modules/contrib/ppp.fc`
		`+ +++ b/policy/modules/contrib/ppp.fc`
		`+ @@ -15,12 +15,6 @@`
		`+`
		`+ /root/.ppprc -- gen_context(system_u:object_r:pppd_etc_t,s0)`
		`+`
		`+ -#`
		`+ -# /sbin`
		`+ -#`
		`+ -/sbin/pppoe-server -- gen_context(system_u:object_r:pppd_exec_t,s0)`
		`+ -/sbin/ppp-watch -- gen_context(system_u:object_r:pppd_exec_t,s0)`
		`+ -`
		`+ #`
		`+ # /usr`
		`+ #`
		`+ diff --git a/policy/modules/contrib/prelude.fc b/policy/modules/contrib/prelude.fc`
		`+ index 163532dd35..f8b65904c8 100644`
		`+ --- a/policy/modules/contrib/prelude.fc`
		`+ +++ b/policy/modules/contrib/prelude.fc`
		`+ @@ -4,8 +4,6 @@`
		`+ /etc/rc\.d/init\.d/prelude-lml -- gen_context(system_u:object_r:prelude_initrc_exec_t,s0)`
		`+ /etc/rc\.d/init\.d/prelude-manager -- gen_context(system_u:object_r:prelude_initrc_exec_t,s0)`
		`+`
		`+ -/sbin/audisp-prelude -- gen_context(system_u:object_r:prelude_audisp_exec_t,s0)`
		`+ -`
		`+ /usr/bin/prelude-correlator -- gen_context(system_u:object_r:prelude_correlator_exec_t,s0)`
		`+ /usr/bin/prelude-lml -- gen_context(system_u:object_r:prelude_lml_exec_t,s0)`
		`+ /usr/bin/prelude-manager -- gen_context(system_u:object_r:prelude_exec_t,s0)`
		`+ diff --git a/policy/modules/contrib/quota.fc b/policy/modules/contrib/quota.fc`
		`+ index 373bea70e4..e74bb65935 100644`
		`+ --- a/policy/modules/contrib/quota.fc`
		`+ +++ b/policy/modules/contrib/quota.fc`
		`+ @@ -7,8 +7,6 @@ HOME_DIR/a?quota\.(user\|group) -- gen_context(system_u:object_r:quota_db_t,s0)`
		`+`
		`+ /etc/a?quota\.(user\|group) -- gen_context(system_u:object_r:quota_db_t,s0)`
		`+`
		`+ -/sbin/quota(check\|on) -- gen_context(system_u:object_r:quota_exec_t,s0)`
		`+ -`
		`+ /usr/sbin/quota(check\|on) -- gen_context(system_u:object_r:quota_exec_t,s0)`
		`+`
		`+ /var/a?quota\.(user\|group) -- gen_context(system_u:object_r:quota_db_t,s0)`
		`+ @@ -16,11 +14,7 @@ HOME_DIR/a?quota\.(user\|group) -- gen_context(system_u:object_r:quota_db_t,s0)`
		`+ /var/spool/cron/a?quota\.(user\|group) -- gen_context(system_u:object_r:quota_db_t,s0)`
		`+ /var/spool/(.*/)?a?quota\.(user\|group) -- gen_context(system_u:object_r:quota_db_t,s0)`
		`+`
		+ -ifdef(`distro_redhat',`
		`+ /usr/sbin/convertquota -- gen_context(system_u:object_r:quota_exec_t,s0)`
		+ -',`
		`+ -/sbin/convertquota -- gen_context(system_u:object_r:quota_exec_t,s0)`
		`+ -')`
		`+`
		`+ /usr/sbin/quota_nld -- gen_context(system_u:object_r:quota_nld_exec_t,s0)`
		`+`
		`+ diff --git a/policy/modules/contrib/raid.fc b/policy/modules/contrib/raid.fc`
		`+ index 871870a534..59ee6d83a8 100644`
		`+ --- a/policy/modules/contrib/raid.fc`
		`+ +++ b/policy/modules/contrib/raid.fc`
		`+ @@ -9,14 +9,6 @@`
		`+ /usr/lib/systemd/system/mdmon@.* -- gen_context(system_u:object_r:mdadm_unit_file_t,s0)`
		`+ /usr/lib/systemd/system/mdmonitor.* -- gen_context(system_u:object_r:mdadm_unit_file_t,s0)`
		`+`
		`+ -/sbin/iprdump -- gen_context(system_u:object_r:mdadm_exec_t,s0)`
		`+ -/sbin/iprinit -- gen_context(system_u:object_r:mdadm_exec_t,s0)`
		`+ -/sbin/iprupdate -- gen_context(system_u:object_r:mdadm_exec_t,s0)`
		`+ -/sbin/mdadm -- gen_context(system_u:object_r:mdadm_exec_t,s0)`
		`+ -/sbin/mdmon -- gen_context(system_u:object_r:mdadm_exec_t,s0)`
		`+ -/sbin/mdmpd -- gen_context(system_u:object_r:mdadm_exec_t,s0)`
		`+ -/sbin/raid-check -- gen_context(system_u:object_r:mdadm_exec_t,s0)`
		`+ -`
		`+ /usr/sbin/iprdump -- gen_context(system_u:object_r:mdadm_exec_t,s0)`
		`+ /usr/sbin/iprinit -- gen_context(system_u:object_r:mdadm_exec_t,s0)`
		`+ /usr/sbin/iprupdate -- gen_context(system_u:object_r:mdadm_exec_t,s0)`
		`+ diff --git a/policy/modules/contrib/readahead.fc b/policy/modules/contrib/readahead.fc`
		`+ index f72b776e4f..74e6f7f98a 100644`
		`+ --- a/policy/modules/contrib/readahead.fc`
		`+ +++ b/policy/modules/contrib/readahead.fc`
		`+ @@ -1,6 +1,4 @@`
		`+ /dev/\.systemd/readahead(/.*)? gen_context(system_u:object_r:readahead_var_run_t,s0)`
		`+ -`
		`+ -/sbin/readahead.* -- gen_context(system_u:object_r:readahead_exec_t,s0)`
		`+ /usr/sbin/readahead.* -- gen_context(system_u:object_r:readahead_exec_t,s0)`
		`+`
		`+ /usr/lib/systemd/systemd-readahead.* -- gen_context(system_u:object_r:readahead_exec_t,s0)`
		`+ diff --git a/policy/modules/contrib/resmgr.fc b/policy/modules/contrib/resmgr.fc`
		`+ index 9dec87b40f..138f76e241 100644`
		`+ --- a/policy/modules/contrib/resmgr.fc`
		`+ +++ b/policy/modules/contrib/resmgr.fc`
		`+ @@ -2,8 +2,6 @@`
		`+`
		`+ /etc/rc\.d/init\.d/resmgr -- gen_context(system_u:object_r:resmgrd_initrc_exec_t,s0)`
		`+`
		`+ -/sbin/resmgrd -- gen_context(system_u:object_r:resmgrd_exec_t,s0)`
		`+ -`
		`+ /usr/sbin/resmgrd -- gen_context(system_u:object_r:resmgrd_exec_t,s0)`
		`+`
		`+ /run/\.resmgr_socket -s gen_context(system_u:object_r:resmgrd_var_run_t,s0)`
		`+ diff --git a/policy/modules/contrib/rpc.fc b/policy/modules/contrib/rpc.fc`
		`+ index 298dee7dbb..a8c479da57 100644`
		`+ --- a/policy/modules/contrib/rpc.fc`
		`+ +++ b/policy/modules/contrib/rpc.fc`
		`+ @@ -14,12 +14,6 @@`
		`+`
		`+ /usr/lib/systemd/system-generators/nfs.* -- gen_context(system_u:object_r:nfsd_exec_t,s0)`
		`+`
		`+ -#`
		`+ -# /sbin`
		`+ -#`
		`+ -/sbin/rpc\..* -- gen_context(system_u:object_r:rpcd_exec_t,s0)`
		`+ -/sbin/sm-notify -- gen_context(system_u:object_r:rpcd_exec_t,s0)`
		`+ -`
		`+ #`
		`+ # /usr`
		`+ #`
		`+ diff --git a/policy/modules/contrib/rpcbind.fc b/policy/modules/contrib/rpcbind.fc`
		`+ index 8987cc8c07..79ec9b463d 100644`
		`+ --- a/policy/modules/contrib/rpcbind.fc`
		`+ +++ b/policy/modules/contrib/rpcbind.fc`
		`+ @@ -1,8 +1,6 @@`
		`+ /etc/rc\.d/init\.d/rpcbind -- gen_context(system_u:object_r:rpcbind_initrc_exec_t,s0)`
		`+`
		`+ /usr/lib/systemd/system/rpcbind\.service -- gen_context(system_u:object_r:rpcbind_unit_file_t,s0)`
		`+ -`
		`+ -/sbin/rpcbind -- gen_context(system_u:object_r:rpcbind_exec_t,s0)`
		`+ /bin/rpcbind -- gen_context(system_u:object_r:rpcbind_exec_t,s0)`
		`+`
		`+ /usr/sbin/rpcbind -- gen_context(system_u:object_r:rpcbind_exec_t,s0)`
		`+ diff --git a/policy/modules/contrib/rpm.fc b/policy/modules/contrib/rpm.fc`
		`+ index 187946c21b..8b72f39b0c 100644`
		`+ --- a/policy/modules/contrib/rpm.fc`
		`+ +++ b/policy/modules/contrib/rpm.fc`
		+ @@ -90,5 +90,5 @@ ifdef(`distro_suse', `
		`+ ')`
		`+`
		+ ifdef(`enable_mls',`
		`+ -/sbin/cpio -- gen_context(system_u:object_r:rpm_exec_t,s0)`
		`+ +/usr/sbin/cpio -- gen_context(system_u:object_r:rpm_exec_t,s0)`
		`+ ')`
		`+ diff --git a/policy/modules/contrib/shorewall.fc b/policy/modules/contrib/shorewall.fc`
		`+ index e0441c51bd..b6c221c775 100644`
		`+ --- a/policy/modules/contrib/shorewall.fc`
		`+ +++ b/policy/modules/contrib/shorewall.fc`
		`+ @@ -4,9 +4,6 @@`
		`+ /etc/shorewall6(/.*)? gen_context(system_u:object_r:shorewall_etc_t,s0)`
		`+ /etc/shorewall-lite(/.*)? gen_context(system_u:object_r:shorewall_etc_t,s0)`
		`+`
		`+ -/sbin/shorewall6? -- gen_context(system_u:object_r:shorewall_exec_t,s0)`
		`+ -/sbin/shorewall-lite -- gen_context(system_u:object_r:shorewall_exec_t,s0)`
		`+ -`
		`+ /usr/sbin/shorewall6? -- gen_context(system_u:object_r:shorewall_exec_t,s0)`
		`+ /usr/sbin/shorewall-lite -- gen_context(system_u:object_r:shorewall_exec_t,s0)`
		`+`
		`+ diff --git a/policy/modules/contrib/shutdown.fc b/policy/modules/contrib/shutdown.fc`
		`+ index 46f22bb747..a2ef1020a9 100644`
		`+ --- a/policy/modules/contrib/shutdown.fc`
		`+ +++ b/policy/modules/contrib/shutdown.fc`
		`+ @@ -2,8 +2,6 @@`
		`+`
		`+ /lib/upstart/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)`
		`+`
		`+ -/sbin/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)`
		`+ -`
		`+ /usr/lib/upstart/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)`
		`+`
		`+ /usr/sbin/shutdown -- gen_context(system_u:object_r:shutdown_exec_t,s0)`
		`+ diff --git a/policy/modules/contrib/usbmodules.fc b/policy/modules/contrib/usbmodules.fc`
		`+ index 02d725317c..dc32cdb99d 100644`
		`+ --- a/policy/modules/contrib/usbmodules.fc`
		`+ +++ b/policy/modules/contrib/usbmodules.fc`
		`+ @@ -1,3 +1,3 @@`
		`+ -/sbin/usbmodules -- gen_context(system_u:object_r:usbmodules_exec_t,s0)`
		`+ +`
		`+`
		`+ /usr/sbin/usbmodules -- gen_context(system_u:object_r:usbmodules_exec_t,s0)`
		`+ diff --git a/policy/modules/contrib/vpn.fc b/policy/modules/contrib/vpn.fc`
		`+ index d1890bc2fb..f6fb91e2ff 100644`
		`+ --- a/policy/modules/contrib/vpn.fc`
		`+ +++ b/policy/modules/contrib/vpn.fc`
		`+ @@ -1,8 +1,3 @@`
		`+ -#`
		`+ -# sbin`
		`+ -#`
		`+ -/sbin/vpnc -- gen_context(system_u:object_r:vpnc_exec_t,s0)`
		`+ -`
		`+ #`
		`+ # /usr`
		`+ #`
		`+ diff --git a/policy/modules/contrib/zosremote.fc b/policy/modules/contrib/zosremote.fc`
		`+ index 7a7fc614d8..257b3e6ea8 100644`
		`+ --- a/policy/modules/contrib/zosremote.fc`
		`+ +++ b/policy/modules/contrib/zosremote.fc`
		`+ @@ -1,3 +1,3 @@`
		`+ -/sbin/audispd-zos-remote -- gen_context(system_u:object_r:zos_remote_exec_t,s0)`
		`+ +`
		`+`
		`+ /usr/sbin/audispd-zos-remote -- gen_context(system_u:object_r:zos_remote_exec_t,s0)`
		`+ diff --git a/policy/modules/system/authlogin.fc b/policy/modules/system/authlogin.fc`
		`+ index dc359e2e43..add1c6f2c5 100644`
		`+ --- a/policy/modules/system/authlogin.fc`
		`+ +++ b/policy/modules/system/authlogin.fc`
		`+ @@ -24,17 +24,6 @@ HOME_DIR/\.google_authenticator~ gen_context(system_u:object_r:auth_home_t,s0)`
		`+ /etc/ptmptmp -- gen_context(system_u:object_r:passwd_file_t,s0)`
		`+ /etc/group[-\+]? -- gen_context(system_u:object_r:passwd_file_t,s0)`
		`+`
		`+ -/sbin/pam_console_apply -- gen_context(system_u:object_r:pam_console_exec_t,s0)`
		`+ -/sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_timestamp_exec_t,s0)`
		`+ -/sbin/tcb_convert -- gen_context(system_u:object_r:updpwd_exec_t,s0)`
		`+ -/sbin/tcb_unconvert -- gen_context(system_u:object_r:updpwd_exec_t,s0)`
		`+ -/sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)`
		`+ -/sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0)`
		`+ -/sbin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0)`
		+ -ifdef(`distro_suse', `
		`+ -/sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0)`
		`+ -')`
		`+ -`
		`+ /usr/bin/login -- gen_context(system_u:object_r:login_exec_t,s0)`
		`+`
		`+ /usr/kerberos/sbin/login\.krb5 -- gen_context(system_u:object_r:login_exec_t,s0)`
		`+ diff --git a/policy/modules/system/clock.fc b/policy/modules/system/clock.fc`
		`+ index c9ddbeecad..d84938282b 100644`
		`+ --- a/policy/modules/system/clock.fc`
		`+ +++ b/policy/modules/system/clock.fc`
		`+ @@ -1,7 +1,5 @@`
		`+`
		`+ /etc/adjtime -- gen_context(system_u:object_r:adjtime_t,s0)`
		`+`
		`+ -/sbin/hwclock -- gen_context(system_u:object_r:hwclock_exec_t,s0)`
		`+ -`
		`+ /usr/sbin/hwclock -- gen_context(system_u:object_r:hwclock_exec_t,s0)`
		`+`
		`+ diff --git a/policy/modules/system/fstools.fc b/policy/modules/system/fstools.fc`
		`+ index 4f0d131b6b..fc90774b5e 100644`
		`+ --- a/policy/modules/system/fstools.fc`
		`+ +++ b/policy/modules/system/fstools.fc`
		`+ @@ -1,45 +1,3 @@`
		`+ -/sbin/blkid -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/blockdev -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/cfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/dosfsck -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/dump -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/dumpe2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/dump.exfat -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/e2mmpstatus -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/e2fsck -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/e4fsck -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/e2label -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/exfatlabel -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/fdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/findfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/fsck.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/hdparm -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/install-mbr -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/jfs_.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/losetup.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/lsraid -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/make_reiser4 -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/mkdosfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/mke2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/mke4fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/mkfs.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/mkreiserfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/raidautorun -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/raidstart -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/reiserfs(ck\|tune) -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/resize.*fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/scsi_info -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/sfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/swapoff -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/swapon.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/tune2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/tune.exfat -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -/sbin/xfs_growfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ -`
		`+ /usr/bin/partition_uuid -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ /usr/bin/raw -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ /usr/bin/scsi_unique_id -- gen_context(system_u:object_r:fsadm_exec_t,s0)`
		`+ diff --git a/policy/modules/system/getty.fc b/policy/modules/system/getty.fc`
		`+ index f899c8cf92..678da94821 100644`
		`+ --- a/policy/modules/system/getty.fc`
		`+ +++ b/policy/modules/system/getty.fc`
		`+ @@ -1,8 +1,6 @@`
		`+`
		`+ /etc/mgetty(/.*)? gen_context(system_u:object_r:getty_etc_t,s0)`
		`+`
		`+ -/sbin/.*getty -- gen_context(system_u:object_r:getty_exec_t,s0)`
		`+ -`
		`+ /usr/lib/systemd/system/[^/]getty. -- gen_context(system_u:object_r:getty_unit_file_t,s0)`
		`+`
		`+ /usr/sbin/.*getty -- gen_context(system_u:object_r:getty_exec_t,s0)`
		`+ diff --git a/policy/modules/system/ipsec.fc b/policy/modules/system/ipsec.fc`
		`+ index cc72c7c46d..0631d70b8b 100644`
		`+ --- a/policy/modules/system/ipsec.fc`
		`+ +++ b/policy/modules/system/ipsec.fc`
		`+ @@ -29,8 +29,6 @@`
		`+ /etc/ipsec\.d(/.*)? gen_context(system_u:object_r:ipsec_key_file_t,s0)`
		`+ /etc/strongswan/ipsec\.d(/.*)? gen_context(system_u:object_r:ipsec_key_file_t,s0)`
		`+`
		`+ -/sbin/setkey -- gen_context(system_u:object_r:setkey_exec_t,s0)`
		`+ -`
		`+ /usr/lib/ipsec/_plutoload -- gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0)`
		`+ /usr/lib/ipsec/_plutorun -- gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0)`
		`+ /usr/lib/ipsec/eroute -- gen_context(system_u:object_r:ipsec_exec_t,s0)`
		`+ diff --git a/policy/modules/system/libraries.fc b/policy/modules/system/libraries.fc`
		`+ index 2906c65f7f..682f35beda 100644`
		`+ --- a/policy/modules/system/libraries.fc`
		`+ +++ b/policy/modules/system/libraries.fc`
		+ @@ -98,12 +98,6 @@ ifdef(`distro_redhat',`
		`+ /opt/netbeans(./)?jdk./linux/.+\.so(\.[^/]) -- gen_context(system_u:object_r:textrel_shlib_t,s0)`
		`+ ')`
		`+`
		`+ -#`
		`+ -# /sbin`
		`+ -#`
		`+ -/sbin/ldconfig -- gen_context(system_u:object_r:ldconfig_exec_t,s0)`
		`+ -/sbin/sln -- gen_context(system_u:object_r:ldconfig_exec_t,s0)`
		`+ -`
		`+ #`
		`+ # /usr`
		`+ #`
		`+ diff --git a/policy/modules/system/locallogin.fc b/policy/modules/system/locallogin.fc`
		`+ index a5303e9202..2a675a49b7 100644`
		`+ --- a/policy/modules/system/locallogin.fc`
		`+ +++ b/policy/modules/system/locallogin.fc`
		`+ @@ -1,8 +1,5 @@`
		`+ HOME_DIR/\.hushlogin -- gen_context(system_u:object_r:local_login_home_t,s0)`
		`+ /root/\.hushlogin -- gen_context(system_u:object_r:local_login_home_t,s0)`
		`+`
		`+ -/sbin/sulogin -- gen_context(system_u:object_r:sulogin_exec_t,s0)`
		`+ -/sbin/sushell -- gen_context(system_u:object_r:sulogin_exec_t,s0)`
		`+ -`
		`+ /usr/sbin/sulogin -- gen_context(system_u:object_r:sulogin_exec_t,s0)`
		`+ /usr/sbin/sushell -- gen_context(system_u:object_r:sulogin_exec_t,s0)`
		`+ diff --git a/policy/modules/system/logging.fc b/policy/modules/system/logging.fc`
		`+ index 36220481d4..f76556b2a1 100644`
		`+ --- a/policy/modules/system/logging.fc`
		`+ +++ b/policy/modules/system/logging.fc`
		`+ @@ -10,17 +10,6 @@`
		`+ /usr/lib/systemd/system/auditd.* -- gen_context(system_u:object_r:auditd_unit_file_t,s0)`
		`+ /usr/lib/systemd/system/rsyslog.* -- gen_context(system_u:object_r:syslogd_unit_file_t,s0)`
		`+`
		`+ -/sbin/audispd -- gen_context(system_u:object_r:audisp_exec_t,s0)`
		`+ -/sbin/audisp-remote -- gen_context(system_u:object_r:audisp_remote_exec_t,s0)`
		`+ -/sbin/auditctl -- gen_context(system_u:object_r:auditctl_exec_t,s0)`
		`+ -/sbin/auditd -- gen_context(system_u:object_r:auditd_exec_t,s0)`
		`+ -/sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0)`
		`+ -/sbin/minilogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)`
		`+ -/sbin/rklogd -- gen_context(system_u:object_r:klogd_exec_t,s0)`
		`+ -/sbin/rsyslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)`
		`+ -/sbin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)`
		`+ -/sbin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0)`
		`+ -`
		`+ /opt/zimbra/log(/.*)? gen_context(system_u:object_r:var_log_t,s0)`
		`+ /opt/Symantec/scspagent/IDS/system(/.*)? gen_context(system_u:object_r:var_log_t,s0)`
		`+`
		`+ diff --git a/policy/modules/system/lvm.fc b/policy/modules/system/lvm.fc`
		`+ index c75b401527..92894711aa 100644`
		`+ --- a/policy/modules/system/lvm.fc`
		`+ +++ b/policy/modules/system/lvm.fc`
		+ @@ -35,63 +35,6 @@ ifdef(`distro_gentoo',`
		`+ #`
		`+ # /sbin`
		`+ #`
		`+ -/sbin/mount\.crypt -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/umount\.crypt -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/cryptsetup -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/dmraid -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/dmsetup -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/dmsetup\.static -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/e2fsadm -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/kpartx -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/lvchange -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/lvcreate -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/lvdisplay -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/lvextend -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/lvm -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/lvm\.static -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/lvmchange -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/lvmdiskscan -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/lvmetad -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/lvmiopversion -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/lvmsadc -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/lvmsar -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/lvmpolld -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/lvreduce -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/lvremove -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/lvrename -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/lvresize -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/lvs -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/lvscan -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/multipathd -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/multipath\.static -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/pvchange -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/pvcreate -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/pvdata -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/pvdisplay -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/pvmove -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/pvremove -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/pvs -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/pvscan -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/vgcfgbackup -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/vgcfgrestore -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/vgchange -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/vgchange\.static -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/vgck -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/vgcreate -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/vgdisplay -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/vgexport -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/vgextend -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/vgimport -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/vgmerge -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/vgmknodes -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/vgreduce -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/vgremove -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/vgrename -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/vgs -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/vgscan -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/vgscan\.static -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/vgsplit -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -/sbin/vgwrapper -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+`
		`+ #`
		`+ # /usr`
		`+ diff --git a/policy/modules/system/modutils.fc b/policy/modules/system/modutils.fc`
		`+ index 37a2f6c23d..04abd1c8b5 100644`
		`+ --- a/policy/modules/system/modutils.fc`
		`+ +++ b/policy/modules/system/modutils.fc`
		+ @@ -12,14 +12,6 @@ ifdef(`distro_gentoo',`
		`+`
		`+ /lib/modules/modprobe\.conf -- gen_context(system_u:object_r:modules_conf_t,s0)`
		`+`
		`+ -/sbin/depmod.* -- gen_context(system_u:object_r:kmod_exec_t,s0)`
		`+ -/sbin/generate-modprobe\.conf -- gen_context(system_u:object_r:kmod_exec_t,s0)`
		`+ -/sbin/insmod.* -- gen_context(system_u:object_r:kmod_exec_t,s0)`
		`+ -/sbin/modprobe.* -- gen_context(system_u:object_r:kmod_exec_t,s0)`
		`+ -/sbin/modules-update -- gen_context(system_u:object_r:kmod_exec_t,s0)`
		`+ -/sbin/rmmod.* -- gen_context(system_u:object_r:kmod_exec_t,s0)`
		`+ -/sbin/update-modules -- gen_context(system_u:object_r:kmod_exec_t,s0)`
		`+ -`
		`+ /usr/bin/kmod -- gen_context(system_u:object_r:kmod_exec_t,s0)`
		`+`
		`+ /usr/sbin/depmod.* -- gen_context(system_u:object_r:kmod_exec_t,s0)`
		`+ diff --git a/policy/modules/system/mount.fc b/policy/modules/system/mount.fc`
		`+ index be7840791f..9d29ff2acd 100644`
		`+ --- a/policy/modules/system/mount.fc`
		`+ +++ b/policy/modules/system/mount.fc`
		`+ @@ -4,9 +4,6 @@`
		`+`
		`+ /dev/\.mount(/.*)? gen_context(system_u:object_r:mount_var_run_t,s0)`
		`+`
		`+ -/sbin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0)`
		`+ -/sbin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0)`
		`+ -`
		`+ /usr/bin/fusermount[0-9]? -- gen_context(system_u:object_r:fusermount_exec_t,s0)`
		`+ /usr/bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0)`
		`+ /usr/bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0)`
		`+ diff --git a/policy/modules/system/netlabel.fc b/policy/modules/system/netlabel.fc`
		`+ index 15576ab83f..e81d5b3a56 100644`
		`+ --- a/policy/modules/system/netlabel.fc`
		`+ +++ b/policy/modules/system/netlabel.fc`
		`+ @@ -1,5 +1,3 @@`
		`+ -/sbin/netlabelctl -- gen_context(system_u:object_r:netlabel_mgmt_exec_t,s0)`
		`+ -`
		`+ /usr/lib/systemd/system/netlabel.* -- gen_context(system_u:object_r:netlabel_mgmt_unit_file_t,s0)`
		`+`
		`+ /usr/sbin/netlabelctl -- gen_context(system_u:object_r:netlabel_mgmt_exec_t,s0)`
		`+ diff --git a/policy/modules/system/selinuxutil.fc b/policy/modules/system/selinuxutil.fc`
		`+ index b7889c5c34..e28830f1f4 100644`
		`+ --- a/policy/modules/system/selinuxutil.fc`
		`+ +++ b/policy/modules/system/selinuxutil.fc`
		`+ @@ -21,13 +21,6 @@`
		`+ #`
		`+ /root/\.default_contexts -- gen_context(system_u:object_r:default_context_t,s0)`
		`+`
		`+ -#`
		`+ -# /sbin`
		`+ -#`
		`+ -/sbin/load_policy -- gen_context(system_u:object_r:load_policy_exec_t,s0)`
		`+ -/sbin/restorecon -- gen_context(system_u:object_r:setfiles_exec_t,s0)`
		`+ -/sbin/setfiles.* -- gen_context(system_u:object_r:setfiles_exec_t,s0)`
		`+ -`
		`+ #`
		`+ # /usr`
		`+ #`
		`+ diff --git a/policy/modules/system/setrans.fc b/policy/modules/system/setrans.fc`
		`+ index a3c22072c7..d9e00b6a8b 100644`
		`+ --- a/policy/modules/system/setrans.fc`
		`+ +++ b/policy/modules/system/setrans.fc`
		`+ @@ -1,7 +1,5 @@`
		`+ /etc/rc\.d/init\.d/mcstrans -- gen_context(system_u:object_r:setrans_initrc_exec_t,s0)`
		`+`
		`+ -/sbin/mcstransd -- gen_context(system_u:object_r:setrans_exec_t,s0)`
		`+ -`
		`+ /usr/sbin/mcstransd -- gen_context(system_u:object_r:setrans_exec_t,s0)`
		`+`
		`+ /run/setrans(/.*)? gen_context(system_u:object_r:setrans_var_run_t,mls_systemhigh)`
		`+ diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc`
		`+ index f813f23ba4..0dbd7a0deb 100644`
		`+ --- a/policy/modules/system/sysnetwork.fc`
		`+ +++ b/policy/modules/system/sysnetwork.fc`
		`+ @@ -1,4 +1,3 @@`
		`+ -`
		`+ #`
		`+ # /bin`
		`+ #`
		+ @@ -45,24 +44,6 @@ ifdef(`distro_redhat',`
		`+`
		`+ /run/cloud-init(/.*)? gen_context(system_u:object_r:net_conf_t,s0)`
		`+`
		`+ -#`
		`+ -# /sbin`
		`+ -#`
		`+ -/sbin/dhclient.* -- gen_context(system_u:object_r:dhcpc_exec_t,s0)`
		`+ -/sbin/dhcdbd -- gen_context(system_u:object_r:dhcpc_exec_t,s0)`
		`+ -/sbin/dhcpcd -- gen_context(system_u:object_r:dhcpc_exec_t,s0)`
		`+ -/sbin/ethtool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)`
		`+ -/sbin/ifconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0)`
		`+ -/sbin/ip -- gen_context(system_u:object_r:ifconfig_exec_t,s0)`
		`+ -/sbin/iw -- gen_context(system_u:object_r:ifconfig_exec_t,s0)`
		`+ -/sbin/ipx_configure -- gen_context(system_u:object_r:ifconfig_exec_t,s0)`
		`+ -/sbin/ipx_interface -- gen_context(system_u:object_r:ifconfig_exec_t,s0)`
		`+ -/sbin/ipx_internal_net -- gen_context(system_u:object_r:ifconfig_exec_t,s0)`
		`+ -/sbin/iwconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0)`
		`+ -/sbin/mii-tool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)`
		`+ -/sbin/pump -- gen_context(system_u:object_r:dhcpc_exec_t,s0)`
		`+ -/sbin/tc -- gen_context(system_u:object_r:ifconfig_exec_t,s0)`
		`+ -`
		`+ #`
		`+ # /usr`
		`+ #`
		`+ diff --git a/policy/modules/system/udev.fc b/policy/modules/system/udev.fc`
		`+ index 852e19e9be..a14cc508e5 100644`
		`+ --- a/policy/modules/system/udev.fc`
		`+ +++ b/policy/modules/system/udev.fc`
		+ @@ -18,17 +18,6 @@ ifdef(`distro_debian',`
		`+ /lib/udev/create_static_nodes -- gen_context(system_u:object_r:udev_exec_t,s0)`
		`+ ')`
		`+`
		`+ -/sbin/udev -- gen_context(system_u:object_r:udev_exec_t,s0)`
		`+ -/sbin/udevadm -- gen_context(system_u:object_r:udev_exec_t,s0)`
		`+ -/sbin/udevd -- gen_context(system_u:object_r:udev_exec_t,s0)`
		`+ -/sbin/udevsend -- gen_context(system_u:object_r:udev_exec_t,s0)`
		`+ -/sbin/udevstart -- gen_context(system_u:object_r:udev_exec_t,s0)`
		`+ -/sbin/wait_for_sysfs -- gen_context(system_u:object_r:udev_exec_t,s0)`
		`+ -`
		+ -ifdef(`distro_redhat',`
		`+ -/sbin/start_udev -- gen_context(system_u:object_r:udev_exec_t,s0)`
		`+ -')`
		`+ -`
		`+ /usr/bin/udevinfo -- gen_context(system_u:object_r:udev_exec_t,s0)`
		`+ /usr/bin/udevadm -- gen_context(system_u:object_r:udev_exec_t,s0)`
		`+`
		`+ --`
		`+ 2.44.0`
		`+`

0003-Alias-bin-usr-bin-and-remove-redundant-paths.patch

file added

+286

		`@@ -0,0 +1,286 @@`
		`+ From aad97690741cc611b83918b408047f6e91113304 Mon Sep 17 00:00:00 2001`
		`+ From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>`
		`+ Date: Thu, 11 Apr 2024 18:09:38 +0200`
		`+ Subject: [PATCH 3/4] =?UTF-8?q?Alias=20/bin=20=E2=86=92=20/usr/bin=20and?=`
		`+ =?UTF-8?q?=20remove=20redundant=20paths?=`
		`+ MIME-Version: 1.0`
		`+ Content-Type: text/plain; charset=UTF-8`
		`+ Content-Transfer-Encoding: 8bit`
		`+`
		`+ ---`
		`+ config/file_contexts.subs_dist \| 1 +`
		`+ policy/modules/admin/dmesg.fc \| 3 ---`
		`+ policy/modules/admin/netutils.fc \| 5 -----`
		`+ policy/modules/admin/su.fc \| 3 ---`
		`+ policy/modules/admin/usermanage.fc \| 4 ----`
		`+ policy/modules/contrib/alsa.fc \| 2 --`
		`+ policy/modules/contrib/dbus.fc \| 2 --`
		`+ policy/modules/contrib/loadkeys.fc \| 3 ---`
		`+ policy/modules/contrib/plymouthd.fc \| 2 --`
		`+ policy/modules/contrib/rpcbind.fc \| 1 -`
		`+ policy/modules/contrib/rpm.fc \| 3 ---`
		`+ policy/modules/system/authlogin.fc \| 2 --`
		`+ policy/modules/system/hostname.fc \| 3 ---`
		`+ policy/modules/system/init.fc \| 5 -----`
		`+ policy/modules/system/lvm.fc \| 7 -------`
		`+ policy/modules/system/modutils.fc \| 2 --`
		`+ policy/modules/system/mount.fc \| 4 ----`
		`+ policy/modules/system/sysnetwork.fc \| 5 -----`
		`+ policy/modules/system/systemd.fc \| 6 ------`
		`+ policy/modules/system/udev.fc \| 2 --`
		`+ 20 files changed, 1 insertion(+), 64 deletions(-)`
		`+`
		`+ diff --git a/config/file_contexts.subs_dist b/config/file_contexts.subs_dist`
		`+ index 4565e9b87a..c8a344a45a 100644`
		`+ --- a/config/file_contexts.subs_dist`
		`+ +++ b/config/file_contexts.subs_dist`
		`+ @@ -19,4 +19,5 @@`
		`+ /usr/local/lib64 /usr/lib`
		`+ /usr/local/lib /usr/lib`
		`+ /var/run/lock /var/lock`
		`+ +/bin /usr/bin`
		`+ /sbin /usr/sbin`
		`+ diff --git a/policy/modules/admin/dmesg.fc b/policy/modules/admin/dmesg.fc`
		`+ index 0685b190d9..e52fdfcf8a 100644`
		`+ --- a/policy/modules/admin/dmesg.fc`
		`+ +++ b/policy/modules/admin/dmesg.fc`
		`+ @@ -1,4 +1 @@`
		`+ -`
		`+ -/bin/dmesg -- gen_context(system_u:object_r:dmesg_exec_t,s0)`
		`+ -`
		`+ /usr/bin/dmesg -- gen_context(system_u:object_r:dmesg_exec_t,s0)`
		`+ diff --git a/policy/modules/admin/netutils.fc b/policy/modules/admin/netutils.fc`
		`+ index f7cbc9df78..98486c356c 100644`
		`+ --- a/policy/modules/admin/netutils.fc`
		`+ +++ b/policy/modules/admin/netutils.fc`
		`+ @@ -1,10 +1,5 @@`
		`+ -/bin/ping.* -- gen_context(system_u:object_r:ping_exec_t,s0)`
		`+ -/bin/tracepath.* -- gen_context(system_u:object_r:traceroute_exec_t,s0)`
		`+ -/bin/traceroute.* -- gen_context(system_u:object_r:traceroute_exec_t,s0)`
		`+ -`
		`+ # regexp can't be used as fixfiles converts any quantifier early in the path to the`
		`+ # "/*" wildcard, effecting in complete filesystem restorecon on the package update`
		`+ -/bin/arping -- gen_context(system_u:object_r:netutils_exec_t,s0)`
		`+`
		`+ /usr/bin/arping -- gen_context(system_u:object_r:netutils_exec_t,s0)`
		`+ /usr/bin/lft -- gen_context(system_u:object_r:traceroute_exec_t,s0)`
		`+ diff --git a/policy/modules/admin/su.fc b/policy/modules/admin/su.fc`
		`+ index 3d89250a69..3375c96922 100644`
		`+ --- a/policy/modules/admin/su.fc`
		`+ +++ b/policy/modules/admin/su.fc`
		`+ @@ -1,6 +1,3 @@`
		`+ -`
		`+ -/bin/su -- gen_context(system_u:object_r:su_exec_t,s0)`
		`+ -`
		`+ /usr/(local/)?bin/ksu -- gen_context(system_u:object_r:su_exec_t,s0)`
		`+ /usr/bin/kdesu -- gen_context(system_u:object_r:su_exec_t,s0)`
		`+ /usr/bin/su -- gen_context(system_u:object_r:su_exec_t,s0)`
		`+ diff --git a/policy/modules/admin/usermanage.fc b/policy/modules/admin/usermanage.fc`
		`+ index 7b8915d474..48580c0a78 100644`
		`+ --- a/policy/modules/admin/usermanage.fc`
		`+ +++ b/policy/modules/admin/usermanage.fc`
		`+ @@ -1,7 +1,3 @@`
		+ -ifdef(`distro_gentoo',`
		`+ -/bin/passwd -- gen_context(system_u:object_r:passwd_exec_t,s0)`
		`+ -')`
		`+ -`
		`+ /usr/bin/chage -- gen_context(system_u:object_r:passwd_exec_t,s0)`
		`+ /usr/bin/chfn -- gen_context(system_u:object_r:chfn_exec_t,s0)`
		`+ /usr/bin/chsh -- gen_context(system_u:object_r:chfn_exec_t,s0)`
		`+ diff --git a/policy/modules/contrib/alsa.fc b/policy/modules/contrib/alsa.fc`
		`+ index a261f9fcd3..8773870e07 100644`
		`+ --- a/policy/modules/contrib/alsa.fc`
		`+ +++ b/policy/modules/contrib/alsa.fc`
		+ @@ -4,8 +4,6 @@ ifdef(`distro_debian',`
		`+ /\.config(/.*)? gen_context(system_u:object_r:alsa_var_lib_t,s0)`
		`+ ')`
		`+`
		`+ -/bin/alsaunmute -- gen_context(system_u:object_r:alsa_exec_t,s0)`
		`+ -`
		`+ /etc/alsa/asound\.state -- gen_context(system_u:object_r:alsa_etc_rw_t,s0)`
		`+ /etc/alsa/pcm(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0)`
		`+ /etc/asound(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0)`
		`+ diff --git a/policy/modules/contrib/dbus.fc b/policy/modules/contrib/dbus.fc`
		`+ index 056964006d..9b10e41fc6 100644`
		`+ --- a/policy/modules/contrib/dbus.fc`
		`+ +++ b/policy/modules/contrib/dbus.fc`
		`+ @@ -1,7 +1,5 @@`
		`+ /etc/dbus-1(/.*)? gen_context(system_u:object_r:dbusd_etc_t,s0)`
		`+`
		`+ -/bin/dbus-daemon -- gen_context(system_u:object_r:dbusd_exec_t,s0)`
		`+ -`
		+ ifdef(`distro_redhat',`
		`+ /lib/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)`
		`+ /usr/lib/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)`
		`+ diff --git a/policy/modules/contrib/loadkeys.fc b/policy/modules/contrib/loadkeys.fc`
		`+ index e50749fe46..38f91fedce 100644`
		`+ --- a/policy/modules/contrib/loadkeys.fc`
		`+ +++ b/policy/modules/contrib/loadkeys.fc`
		`+ @@ -1,5 +1,2 @@`
		`+ -/bin/loadkeys -- gen_context(system_u:object_r:loadkeys_exec_t,s0)`
		`+ -/bin/unikeys -- gen_context(system_u:object_r:loadkeys_exec_t,s0)`
		`+ -`
		`+ /usr/bin/loadkeys -- gen_context(system_u:object_r:loadkeys_exec_t,s0)`
		`+ /usr/bin/unikeys -- gen_context(system_u:object_r:loadkeys_exec_t,s0)`
		`+ diff --git a/policy/modules/contrib/plymouthd.fc b/policy/modules/contrib/plymouthd.fc`
		`+ index 8f4ab4c37a..0d8f545434 100644`
		`+ --- a/policy/modules/contrib/plymouthd.fc`
		`+ +++ b/policy/modules/contrib/plymouthd.fc`
		`+ @@ -1,5 +1,3 @@`
		`+ -/bin/plymouth -- gen_context(system_u:object_r:plymouth_exec_t,s0)`
		`+ -`
		`+ /usr/bin/plymouth -- gen_context(system_u:object_r:plymouth_exec_t,s0)`
		`+`
		`+ /var/lib/plymouth(/.*)? gen_context(system_u:object_r:plymouthd_var_lib_t,s0)`
		`+ diff --git a/policy/modules/contrib/rpcbind.fc b/policy/modules/contrib/rpcbind.fc`
		`+ index 79ec9b463d..c672c31bd3 100644`
		`+ --- a/policy/modules/contrib/rpcbind.fc`
		`+ +++ b/policy/modules/contrib/rpcbind.fc`
		`+ @@ -1,7 +1,6 @@`
		`+ /etc/rc\.d/init\.d/rpcbind -- gen_context(system_u:object_r:rpcbind_initrc_exec_t,s0)`
		`+`
		`+ /usr/lib/systemd/system/rpcbind\.service -- gen_context(system_u:object_r:rpcbind_unit_file_t,s0)`
		`+ -/bin/rpcbind -- gen_context(system_u:object_r:rpcbind_exec_t,s0)`
		`+`
		`+ /usr/sbin/rpcbind -- gen_context(system_u:object_r:rpcbind_exec_t,s0)`
		`+ /usr/bin/rpcbind -- gen_context(system_u:object_r:rpcbind_exec_t,s0)`
		`+ diff --git a/policy/modules/contrib/rpm.fc b/policy/modules/contrib/rpm.fc`
		`+ index 8b72f39b0c..cff6af597e 100644`
		`+ --- a/policy/modules/contrib/rpm.fc`
		`+ +++ b/policy/modules/contrib/rpm.fc`
		`+ @@ -1,5 +1,4 @@`
		`+`
		`+ -/bin/rpm -- gen_context(system_u:object_r:rpm_exec_t,s0)`
		`+`
		`+ /usr/bin/anaconda-yum -- gen_context(system_u:object_r:rpm_exec_t,s0)`
		`+ /usr/bin/debuginfo-install -l gen_context(system_u:object_r:debuginfo_exec_t,s0)`
		`+ @@ -10,8 +9,6 @@`
		`+ /usr/bin/rpm -- gen_context(system_u:object_r:rpm_exec_t,s0)`
		`+ /usr/bin/rpmdb -- gen_context(system_u:object_r:rpmdb_exec_t,s0)`
		`+ /usr/bin/smart -- gen_context(system_u:object_r:rpm_exec_t,s0)`
		`+ -`
		`+ -/bin/yum-builddep -- gen_context(system_u:object_r:rpm_exec_t,s0)`
		`+ /usr/bin/yum -- gen_context(system_u:object_r:rpm_exec_t,s0)`
		`+ /usr/bin/yum-builddep -- gen_context(system_u:object_r:rpm_exec_t,s0)`
		`+ /usr/bin/yum-deprecated -- gen_context(system_u:object_r:rpm_exec_t,s0)`
		`+ diff --git a/policy/modules/system/authlogin.fc b/policy/modules/system/authlogin.fc`
		`+ index add1c6f2c5..3f2f91e2a3 100644`
		`+ --- a/policy/modules/system/authlogin.fc`
		`+ +++ b/policy/modules/system/authlogin.fc`
		`+ @@ -7,8 +7,6 @@ HOME_DIR/\.google_authenticator~ gen_context(system_u:object_r:auth_home_t,s0)`
		`+ /root/\.google_authenticator gen_context(system_u:object_r:auth_home_t,s0)`
		`+ /root/\.google_authenticator~ gen_context(system_u:object_r:auth_home_t,s0)`
		`+`
		`+ -/bin/login -- gen_context(system_u:object_r:login_exec_t,s0)`
		`+ -`
		`+ /etc/group\.lock -- gen_context(system_u:object_r:passwd_file_t,s0)`
		`+ /etc/gshadow.* -- gen_context(system_u:object_r:shadow_t,s0)`
		`+ /etc/nshadow.* -- gen_context(system_u:object_r:shadow_t,s0)`
		`+ diff --git a/policy/modules/system/hostname.fc b/policy/modules/system/hostname.fc`
		`+ index 6d00f5c136..83ddeb5730 100644`
		`+ --- a/policy/modules/system/hostname.fc`
		`+ +++ b/policy/modules/system/hostname.fc`
		`+ @@ -1,4 +1 @@`
		`+ -`
		`+ -/bin/hostname -- gen_context(system_u:object_r:hostname_exec_t,s0)`
		`+ -`
		`+ /usr/bin/hostname -- gen_context(system_u:object_r:hostname_exec_t,s0)`
		`+ diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc`
		`+ index ac0ed6cff4..5fd304eb5e 100644`
		`+ --- a/policy/modules/system/init.fc`
		`+ +++ b/policy/modules/system/init.fc`
		+ @@ -29,11 +29,6 @@ ifdef(`distro_gentoo', `
		`+ /lib/rc/init\.d(/.*)? gen_context(system_u:object_r:initrc_state_t,s0)`
		`+ ')`
		`+`
		`+ -#`
		`+ -# /bin`
		`+ -#`
		`+ -/bin/systemd -- gen_context(system_u:object_r:init_exec_t,s0)`
		`+ -`
		`+ #`
		`+ # /sbin`
		`+ #`
		`+ diff --git a/policy/modules/system/lvm.fc b/policy/modules/system/lvm.fc`
		`+ index 92894711aa..202657673c 100644`
		`+ --- a/policy/modules/system/lvm.fc`
		`+ +++ b/policy/modules/system/lvm.fc`
		`+ @@ -3,13 +3,6 @@`
		`+ # configure LVM to put lockfiles in /etc/lvm/lock instead`
		`+ # for this policy to work (unless you have no separate /var)`
		`+`
		`+ -#`
		`+ -# /bin`
		`+ -#`
		+ -ifdef(`distro_gentoo',`
		`+ -/bin/cryptsetup -- gen_context(system_u:object_r:lvm_exec_t,s0)`
		`+ -')`
		`+ -`
		`+ #`
		`+ # /etc`
		`+ #`
		`+ diff --git a/policy/modules/system/modutils.fc b/policy/modules/system/modutils.fc`
		`+ index 04abd1c8b5..9febb276ad 100644`
		`+ --- a/policy/modules/system/modutils.fc`
		`+ +++ b/policy/modules/system/modutils.fc`
		`+ @@ -1,5 +1,3 @@`
		`+ -/bin/kmod -- gen_context(system_u:object_r:kmod_exec_t,s0)`
		`+ -`
		`+ /etc/modules\.conf.* -- gen_context(system_u:object_r:modules_conf_t,s0)`
		`+ /etc/modprobe\.conf.* -- gen_context(system_u:object_r:modules_conf_t,s0)`
		`+ /etc/modprobe\.d(/.*)? gen_context(system_u:object_r:modules_conf_t,s0)`
		`+ diff --git a/policy/modules/system/mount.fc b/policy/modules/system/mount.fc`
		`+ index 9d29ff2acd..d4905d9a49 100644`
		`+ --- a/policy/modules/system/mount.fc`
		`+ +++ b/policy/modules/system/mount.fc`
		`+ @@ -1,7 +1,3 @@`
		`+ -/bin/fusermount[0-9]? -- gen_context(system_u:object_r:fusermount_exec_t,s0)`
		`+ -/bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0)`
		`+ -/bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0)`
		`+ -`
		`+ /dev/\.mount(/.*)? gen_context(system_u:object_r:mount_var_run_t,s0)`
		`+`
		`+ /usr/bin/fusermount[0-9]? -- gen_context(system_u:object_r:fusermount_exec_t,s0)`
		`+ diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc`
		`+ index 0dbd7a0deb..2870b4ff7e 100644`
		`+ --- a/policy/modules/system/sysnetwork.fc`
		`+ +++ b/policy/modules/system/sysnetwork.fc`
		`+ @@ -1,8 +1,3 @@`
		`+ -#`
		`+ -# /bin`
		`+ -#`
		`+ -/bin/ip -- gen_context(system_u:object_r:ifconfig_exec_t,s0)`
		`+ -`
		`+ #`
		`+ # /dev`
		`+ #`
		`+ diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc`
		`+ index 08bb872df4..d245150fc2 100644`
		`+ --- a/policy/modules/system/systemd.fc`
		`+ +++ b/policy/modules/system/systemd.fc`
		`+ @@ -6,12 +6,6 @@ HOME_DIR/\.config/systemd/user(/.*)? gen_context(system_u:object_r:systemd_unit`
		`+ /etc/machine-info -- gen_context(system_u:object_r:hostname_etc_t,s0)`
		`+ /etc/udev/.hwdb. -- gen_context(system_u:object_r:systemd_hwdb_etc_t,s0)`
		`+`
		`+ -/bin/systemd-notify -- gen_context(system_u:object_r:systemd_notify_exec_t,s0)`
		`+ -/bin/systemctl -- gen_context(system_u:object_r:systemd_systemctl_exec_t,s0)`
		`+ -/bin/systemd-tty-ask-password-agent -- gen_context(system_u:object_r:systemd_passwd_agent_exec_t,s0)`
		`+ -/bin/systemd-tmpfiles -- gen_context(system_u:object_r:systemd_tmpfiles_exec_t,s0)`
		`+ -/bin/systemd-coredump -- gen_context(system_u:object_r:systemd_coredump_exec_t,s0)`
		`+ -`
		`+ /usr/bin/systemctl -- gen_context(system_u:object_r:systemd_systemctl_exec_t,s0)`
		`+ /usr/bin/systemd-gnome-ask-password-agent -- gen_context(system_u:object_r:systemd_passwd_agent_exec_t,s0)`
		`+ /usr/bin/systemd-notify -- gen_context(system_u:object_r:systemd_notify_exec_t,s0)`
		`+ diff --git a/policy/modules/system/udev.fc b/policy/modules/system/udev.fc`
		`+ index a14cc508e5..5daa18779e 100644`
		`+ --- a/policy/modules/system/udev.fc`
		`+ +++ b/policy/modules/system/udev.fc`
		`+ @@ -1,5 +1,3 @@`
		`+ -/bin/udevadm -- gen_context(system_u:object_r:udev_exec_t,s0)`
		`+ -`
		`+ /dev/\.udev(/.*)? -- gen_context(system_u:object_r:udev_var_run_t,s0)`
		`+ /dev/\.udevdb -- gen_context(system_u:object_r:udev_var_run_t,s0)`
		`+ /dev/udev\.tbl -- gen_context(system_u:object_r:udev_var_run_t,s0)`
		`+ --`
		`+ 2.44.0`
		`+`

0004-Alias-usr-sbin-to-usr-bin-and-change-all-paths-to-us.patch

file added

+5182

The added file is too large to be shown here, see it at: 0004-Alias-usr-sbin-to-usr-bin-and-change-all-paths-to-us.patch

file_contexts.subs_dist

file modified

		`@@ -22,3 +22,4 @@`
		`/var/usrlocal /usr/local`
		`/var/mnt /mnt`
		`/bin /usr/bin`
		`+ /usr/sbin /usr/bin`

selinux-policy.spec

file modified

+10 -1

		`@@ -24,7 +24,7 @@`
		`Summary: SELinux policy configuration`
		`Name: selinux-policy`
		`Version: 40.16`
		`- Release: 1%{?dist}`
		`+ Release: 2%{?dist}`
		`License: GPL-2.0-or-later`
		`Source: %{giturl}/archive/%{commit}/%{name}-%{shortcommit}.tar.gz`
		`Source1: modules-targeted-base.conf`
		`@@ -51,6 +51,11 @@`
		`Source28: permissivedomains.cil`
		`Source30: booleans.subs_dist`

		`+ Patch: 0001-Fix-bad-Python-regexp-escapes.patch`
		`+ Patch: 0002-Drop-duplicate-paths-for-usr-sbin.patch`
		`+ Patch: 0003-Alias-bin-usr-bin-and-remove-redundant-paths.patch`
		`+ Patch: 0004-Alias-usr-sbin-to-usr-bin-and-change-all-paths-to-us.patch`
		`+`
		`# Tool helps during policy development, to expand system m4 macros to raw allow rules`
		`# Git repo: https://github.com/fedora-selinux/macro-expander.git`
		`Source33: macro-expander`
		`@@ -824,6 +829,10 @@`
		`%endif`

		`%changelog`
		`+ * Tue Apr 16 2024 Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> - 40.16-2`
		`+ - Implement the merge of /usr/sbin to /usr/bin`
		`+ (https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin)`
		`+`
		`* Tue Apr 09 2024 Zdenek Pytela <zpytela@redhat.com> - 40.16-1`
		`- Allow keyutils-dns-resolver connect to the system log service`
		`- Allow qemu-ga read vm sysctls`