[meta-selinux] selinux: upgrade 3.10 -> 3.11

From: Chen Qi <chenqi_hycx@cetc.com.cn>

From: Chen Qi <chenqi_hycx@cetc.com.cn>

All recipes come from the same SELinuxProject/selinux checkout, so they
are upgraded together.

ChangeLog:
https://github.com/SELinuxProject/selinux/releases/tag/3.11

* Several security improvements in libselinux, dbus, gui, mcstrans and
  sandbox
* Rewrote libselinux selinux_restorecon(3) to eliminate TOCTOU issues in
  file relabeling
* Rewrote restorecond and sandbox/seunshare to eliminate TOCTOU issues on
  their path-based operations
* restorecon only logs an error on a read-only filesystem instead of
  failing, allowing relabeling with read-only BTRFS subvolumes
* Added setfiles -A option to disable SELINUX_RESTORECON_ADD_ASSOC
* Added SELINUX_RESTORECON_SKIP_MULTILINK flag to selinux_restorecon(3)
  and made restorecond always pass it to avoid mislabeling hard links
* Improved restorecond.service to use the new restorecond -F option to
  run in the foreground
* Added secilcheck program to check CIL neverallows against binary
  policies
* Dropped legacy fscon statement support from checkpolicy
* Fixed checkpolicy handling of out-of-range and complement at range
  boundaries for xperm rules
* Fixed sandbox/seunshare remounting of /tmp and /var/tmp within the
  sandbox, its getopt flags and its interactive prompt for saving files
* Dropped sandbox/seunshare -k/--kill support
* Added a cache size cap, max client cap, receive timeout and maxbit cap
  to mcstrans to reduce the risk of DoS from misbehaving clients
* Fixed mcstrans UAF on SIGHUP reload of its configuration files
* Fixed semanage audit fd creation to avoid hitting RLIMIT_NOFILE on
  large semanage import operations
* Fixed libsepol generation of constraint expressions with a list of
  names when writing policy.conf from CIL
* Fixed libsepol to generate constrain/validatetrans instead of
  mlsconstrain/mlsvalidatetrans when converting a module to CIL
* Fixed libsepol selection of tunableif or booleanif, CIL source file
  info reporting, xperm rule permission linking and an off-by-one error
  in cats_ebitmap_len()
* Fixed libselinux constructor to not clobber errno
* Fixed libselinux selabel_partial_match(3) to correctly find partial
  matches
* Fixed libselinux selinux_init_policy_load() to still try to mount
  selinuxfs when the mount of sysfs on /sys fails
* Dropped Python 2 support from audit2why
* Reformatted entire tree based on .clang-format
* Updated pywrap and sepolicy build targets to use the Python3 build
  module
* Fixed build errors with glibc 2.43, non-pthread and uclibc builds
* Fixed multiple musl/llvm-based build issues
* Bug fixes

Recipe changes:

* Drop the patches that are upstream now: the libselinux LSF
  transitional API removal and the sepolicy releasever workaround.  The
  libselinux recipe has no patches left, so its recipe-local
  FILESEXTRAPATHS goes away too.
* Refresh the remaining patches for the reformatted sources.  No
  functional change.
* pywrap and sepolicy now build wheels with "python3 -m build
  --no-isolation", so libselinux-python and selinux-python depend on
  python3-build-native and python3-wheel-native.

Assisted-by: Codewhale:deepseek-v4-flash
Signed-off-by: Chen Qi <chenqi_hycx@cetc.com.cn>
---
 ...heckpolicy_3.10.bb => checkpolicy_3.11.bb} |  0
 ...thon_3.10.bb => libselinux-python_3.11.bb} |  4 +-
 ...hon-modules-install-path-for-multili.patch | 11 ++--
 ...T-and-rely-on-the-installed-file-nam.patch | 10 +--
 ...re-drop-the-obsolete-LSF-transitiona.patch | 40 ------------
 ...{libselinux_3.10.bb => libselinux_3.11.bb} |  5 --
 ...anage-Fix-execve-segfaults-on-Ubuntu.patch |  9 +--
 ...anage-allow-to-disable-audit-support.patch | 46 +++++++-------
 ...ibsemanage_3.10.bb => libsemanage_3.11.bb} |  0
 .../{libsepol_3.10.bb => libsepol_3.11.bb}    |  0
 .../{mcstrans_3.10.bb => mcstrans_3.11.bb}    |  0
 ...eutils_3.10.bb => policycoreutils_3.11.bb} |  0
 ...estorecond_3.10.bb => restorecond_3.11.bb} |  0
 .../{secilc_3.10.bb => secilc_3.11.bb}        |  0
 ...inux-dbus_3.10.bb => selinux-dbus_3.11.bb} |  0
 ...elinux-gui_3.10.bb => selinux-gui_3.11.bb} |  0
 ...stall-path-for-new-pymodule-sepolicy.patch | 13 ++--
 ...f.substitutions-releasever-to-empty-.patch | 61 -------------------
 ...-python_3.10.bb => selinux-python_3.11.bb} |  4 +-
 ...andbox_3.10.bb => selinux-sandbox_3.11.bb} |  0
 recipes-security/selinux/selinux_common.inc   |  2 +-
 ...e-utils_3.10.bb => semodule-utils_3.11.bb} |  0
 22 files changed, 41 insertions(+), 164 deletions(-)
 rename recipes-security/selinux/{checkpolicy_3.10.bb => checkpolicy_3.11.bb} (100%)
 rename recipes-security/selinux/{libselinux-python_3.10.bb => libselinux-python_3.11.bb} (94%)
 delete mode 100644 recipes-security/selinux/libselinux/0003-libselinux-restore-drop-the-obsolete-LSF-transitiona.patch
 rename recipes-security/selinux/{libselinux_3.10.bb => libselinux_3.11.bb} (86%)
 rename recipes-security/selinux/{libsemanage_3.10.bb => libsemanage_3.11.bb} (100%)
 rename recipes-security/selinux/{libsepol_3.10.bb => libsepol_3.11.bb} (100%)
 rename recipes-security/selinux/{mcstrans_3.10.bb => mcstrans_3.11.bb} (100%)
 rename recipes-security/selinux/{policycoreutils_3.10.bb => policycoreutils_3.11.bb} (100%)
 rename recipes-security/selinux/{restorecond_3.10.bb => restorecond_3.11.bb} (100%)
 rename recipes-security/selinux/{secilc_3.10.bb => secilc_3.11.bb} (100%)
 rename recipes-security/selinux/{selinux-dbus_3.10.bb => selinux-dbus_3.11.bb} (100%)
 rename recipes-security/selinux/{selinux-gui_3.10.bb => selinux-gui_3.11.bb} (100%)
 delete mode 100644 recipes-security/selinux/selinux-python/0002-sepolicy-set-conf.substitutions-releasever-to-empty-.patch
 rename recipes-security/selinux/{selinux-python_3.10.bb => selinux-python_3.11.bb} (96%)
 rename recipes-security/selinux/{selinux-sandbox_3.10.bb => selinux-sandbox_3.11.bb} (100%)
 rename recipes-security/selinux/{semodule-utils_3.10.bb => semodule-utils_3.11.bb} (100%)

Message ID	20261101072005.762131-1-chenqi_hycx@cetc.com.cn
State	New
Headers	show Received: from cetc.com.cn (cetc.com.cn [220.181.39.39]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.11002.1793517617599759634 for <yocto-patches@lists.yoctoproject.org>; Sun, 01 Nov 2026 00:20:18 -0700 ip: 220.181.39.39, mailfrom: chenqi_hycx@cetc.com.cn) From: chenqi_hycx@cetc.com.cn To: yocto-patches@lists.yoctoproject.org Cc: chen_q07@163.com Subject: [meta-selinux][PATCH] selinux: upgrade 3.10 -> 3.11 Date: Sun, 1 Nov 2026 15:20:05 +0800 Message-ID: <20261101072005.762131-1-chenqi_hycx@cetc.com.cn> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="utf-8"
Series	[meta-selinux] selinux: upgrade 3.10 -> 3.11 \| expand [meta-selinux] selinux: upgrade 3.10 -> 3.11

[meta-selinux] selinux: upgrade 3.10 -> 3.11

Commit Message

Patch