diff --git a/.github/workflows/portage-stable-packages-list b/.github/workflows/portage-stable-packages-list
index fb50818319c..5355ee35d3c 100644
--- a/.github/workflows/portage-stable-packages-list
+++ b/.github/workflows/portage-stable-packages-list
@@ -73,6 +73,7 @@ acct-user/tss
 app-admin/eselect
 app-admin/logrotate
 app-admin/perl-cleaner
+app-admin/setools
 app-admin/sudo
 
 app-alternatives/awk
@@ -336,6 +337,7 @@ dev-python/markupsafe
 dev-python/mdurl
 dev-python/more-itertools
 dev-python/msgpack
+dev-python/networkx
 dev-python/olefile
 dev-python/packaging
 dev-python/pathspec
@@ -568,13 +570,48 @@ scripts
 
 sec-keys/openpgp-keys-gentoo-release
 
+sec-policy/selinux-apache
+sec-policy/selinux-apm
 sec-policy/selinux-base
 sec-policy/selinux-base-policy
+sec-policy/selinux-bind
+sec-policy/selinux-brctl
+sec-policy/selinux-cdrecord
+sec-policy/selinux-chronyd
 sec-policy/selinux-container
 sec-policy/selinux-dbus
+sec-policy/selinux-dirmngr
+sec-policy/selinux-dnsmasq
+sec-policy/selinux-docker
+sec-policy/selinux-dracut
+sec-policy/selinux-git
+sec-policy/selinux-gpg
+sec-policy/selinux-kdump
+sec-policy/selinux-kerberos
+sec-policy/selinux-ldap
+sec-policy/selinux-loadkeys
+sec-policy/selinux-logrotate
+sec-policy/selinux-makewhatis
+sec-policy/selinux-mandb
+sec-policy/selinux-ntp
+sec-policy/selinux-pcscd
+sec-policy/selinux-podman
 sec-policy/selinux-policykit
+sec-policy/selinux-qemu
+sec-policy/selinux-quota
+sec-policy/selinux-rpc
+sec-policy/selinux-rpcbind
+sec-policy/selinux-samba
+sec-policy/selinux-sasl
+sec-policy/selinux-smartmon
 sec-policy/selinux-sssd
+sec-policy/selinux-sudo
+sec-policy/selinux-tcsd
 sec-policy/selinux-unconfined
+sec-policy/selinux-virt
+sec-policy/selinux-wireguard
+sec-policy/selinux-xfs
+sec-policy/selinux-zfs
 
 sys-apps/acl
 sys-apps/attr
@@ -617,10 +654,12 @@ sys-apps/nvme-cli
 sys-apps/pciutils
 sys-apps/pcsc-lite
 sys-apps/pkgcore
+sys-apps/policycoreutils
 sys-apps/portage
 sys-apps/pv
 sys-apps/sandbox
 sys-apps/sed
+sys-apps/selinux-python
 sys-apps/semodule-utils
 sys-apps/shadow
 sys-apps/smartmontools
@@ -698,6 +737,7 @@ sys-libs/libcap-ng
 sys-libs/libnvme
 sys-libs/libseccomp
 sys-libs/libselinux
+sys-libs/libsemanage
 sys-libs/libsepol
 sys-libs/libunwind
 sys-libs/liburing
diff --git a/bootstrap_sdk_container b/bootstrap_sdk_container
index 6384e69e49e..c197787179b 100755
--- a/bootstrap_sdk_container
+++ b/bootstrap_sdk_container
@@ -11,6 +11,7 @@ source sdk_lib/sdk_container_common.sh
 
 seed_version=""
 target_version=""
+logdir=''
 
 declare -a cleanup
 
@@ -30,6 +31,7 @@ usage() {
     echo "      -x <cleanup-script> - For each resource generated during build (container etc.)"
     echo "                             add a cleanup line to <script> which, when run, will free"
     echo "                             the resource. Useful for CI."
+    echo "      -l <directory>      - Gather build logs here."
     echo "      -h                  - Print this help."
     echo
 }
@@ -38,6 +40,7 @@ usage() {
 while [ 0 -lt $# ] ; do
     case "$1" in
     -h) usage; exit 0;;
+    -l) logdir=${2}; shift 2;;
     -x) cleanup=("-x" "$2"); shift; shift;;
     *)  if [ -z "$seed_version" ] ; then
             seed_version="$1"
@@ -72,8 +75,11 @@ if $official; then
 fi
 
 # bootstrap_sdk needs FLATCAR_SDK_VERSION set to the seed version
+failed=''
 ./run_sdk_container "${cleanup[@]}" -V "$seed_version" -v "$target_version" \
-          sudo -E ./bootstrap_sdk
+          sudo -E ./bootstrap_sdk || failed=x
 
 # Update versionfile to the actual SDK version
 create_versionfile "${target_version}"
+
+if [[ -n ${failed} ]]; then exit 1; fi
diff --git a/build_library/board_options.sh b/build_library/board_options.sh
index c454b47bcc6..baa18f8fd9f 100644
--- a/build_library/board_options.sh
+++ b/build_library/board_options.sh
@@ -14,17 +14,6 @@ ARCH=$(get_board_arch ${BOARD})
 # What cross-build are we targeting?
 . "${BOARD_ROOT}/etc/portage/make.conf" || die
 
-# check if any of the given use flags are enabled for a pkg
-pkg_use_enabled() {
-  local pkg="$1"
-  shift
-  # for every flag argument, turn it into `-e ^+flag` for grep
-  local grep_args="${@/#/-e ^+}"
-
-  equery-"${BOARD}" -q uses "${pkg}" | grep -q ${grep_args}
-  return $?
-}
-
 # Usage: pkg_version [installed|binary|ebuild] some-pkg/name
 # Prints: some-pkg/name-1.2.3
 # Note: returns 0 even if the package was not found.
diff --git a/build_library/break_dep_loop.sh b/build_library/break_dep_loop.sh
new file mode 100644
index 00000000000..599aa4cc9e1
--- /dev/null
+++ b/build_library/break_dep_loop.sh
@@ -0,0 +1,137 @@
+# Goo to attempt to resolve dependency loops on individual packages.
+# If this becomes insufficient we will need to move to a full multi-stage
+# bootstrap process like we do with the SDK via catalyst.
+#
+# Called like:
+#
+#     break_dep_loop [-v] [PKG_USE_PAIR]…
+#
+# Pass -v for verbose output.
+#
+# PKG_USE_PAIR consists of two arguments: a package name (for example:
+# sys-fs/lvm2), and a comma-separated list of USE flags to clear (for
+# example: udev,systemd).
+#
+# Env vars:
+#
+# BDL_ROOT, BDL_PORTAGEQ, BDL_EQUERY, BDL_EMERGE, BDL_INFO
+break_dep_loop() {
+    local bdl_root=${BDL_ROOT:-/}
+    local bdl_portageq=${BDL_PORTAGEQ:-portageq}
+    local bdl_equery=${BDL_EQUERY:-equery}
+    local bdl_emerge=${BDL_EMERGE:-emerge}
+    local bdl_info=${BDL_INFO:-echo}
+    local conf_dir="${bdl_root%/}/etc/portage"
+    local flag_file="${conf_dir}/package.use/break_dep_loop"
+    local force_flag_file="${conf_dir}/profile/package.use.force/break_dep_loop"
+
+    local verbose=
+    if [[ ${1:-} = '-v' ]]; then
+        verbose=x
+        shift
+    fi
+
+    # Be sure to clean up use flag hackery from previous failed runs
+    sudo rm -f "${flag_file}" "${force_flag_file}"
+
+    if [[ ${#} -eq 0 ]]; then
+        return 0
+    fi
+
+    function bdl_call() {
+        local output_var_name=${1}; shift
+        if [[ ${output_var_name} = '-' ]]; then
+            local throw_away
+            output_var_name=throw_away
+        fi
+        local -n output_ref=${output_var_name}
+        if [[ -n ${verbose} ]]; then
+            "${bdl_info}" "${*@Q}"
+        fi
+        local -i rv=0
+        output_ref=$("${@}") || rv=${?}
+        if [[ -n ${verbose} ]]; then
+            "${bdl_info}" "output: ${output_ref}"
+            "${bdl_info}" "exit status: ${rv}"
+        fi
+        return ${rv}
+    }
+
+    # Temporarily compile/install packages with flags disabled. If a binary
+    # package is available use it regardless of its version or use flags.
+    local pkg use_flags disabled_flags
+    local -a flags
+    local -a pkgs args flag_file_entries pkg_summaries
+    local -A per_pkg_flags=()
+    while [[ $# -gt 1 ]]; do
+        pkg=${1}
+        use_flags=${2}
+        shift 2
+
+        mapfile -t flags <<<"${use_flags//,/$'\n'}"
+        disabled_flags="${flags[*]/#/-}"
+
+        pkgs+=( "${pkg}" )
+        per_pkg_flags["${pkg}"]=${use_flags}
+        flag_file_entries+=( "${pkg} ${disabled_flags}" )
+        args+=( "--buildpkg-exclude=${pkg}" )
+        pkg_summaries+=( "${pkg}[${disabled_flags}]" )
+    done
+    unset pkg use_flags disabled_flags flags
+
+    # If packages are already installed we have nothing to do
+    local pkg any_package_uninstalled=
+    for pkg in "${pkgs[@]}"; do
+        if ! bdl_call - "${bdl_portageq}" has_version "${bdl_root}" "${pkg}"; then
+            any_package_uninstalled=x
+            break
+        fi
+    done
+    if [[ -z ${any_package_uninstalled} ]]; then
+        if [[ -n ${verbose} ]]; then
+            "${bdl_info}" "all packages (${pkgs[*]}) are installed already, skipping"
+        fi
+        return 0
+    fi
+    unset pkg any_package_uninstalled
+
+    # Likewise, nothing to do if the flags aren't actually enabled.
+    local pkg any_flag_enabled= equery_output flag flags_str
+    local -a flags grep_args
+    for pkg in "${pkgs[@]}"; do
+        bdl_call equery_output "${bdl_equery}" -q uses "${pkg}"
+        flags_str=${per_pkg_flags["${pkg}"]}
+        mapfile -t flags <<<"${flags_str//,/$'\n'}"
+        for flag in "${flags[@]}"; do
+            grep_args+=( -e "${flag/#/+}" )
+        done
+        if bdl_call - grep --quiet --line-regexp --fixed-strings "${grep_args[@]}" <<<"${equery_output}"; then
+            any_flag_enabled=x
+            break
+        fi
+    done
+    if [[ -z ${any_flag_enabled} ]]; then
+        if [[ -n ${verbose} ]]; then
+            "${bdl_info}" "all packages (${pkgs[*]}) has all the desired USE flags already disabled, skipping"
+        fi
+        return 0
+    fi
+    unset pkg any_flag_enabled equery_output flag flags_str flags grep_args
+
+    "${bdl_info}" "Merging ${pkg_summaries[*]}"
+    sudo mkdir -p "${flag_file%/*}" "${force_flag_file%/*}"
+    printf '%s\n' "${flag_file_entries[@]}" | sudo tee "${flag_file}" >/dev/null
+    cp -a "${flag_file}" "${force_flag_file}"
+    if [[ -n ${verbose} ]]; then
+        "${bdl_info}" "contents of ${flag_file@Q}:"
+        "${bdl_info}" "$(<"${flag_file}")"
+        "${bdl_info}" "${bdl_emerge}" --rebuild-if-unbuilt=n "${args[@]}" "${pkgs[@]}"
+    fi
+    # rebuild-if-unbuilt is disabled to prevent portage from needlessly
+    # rebuilding zlib for some unknown reason, in turn triggering more rebuilds.
+    "${bdl_emerge}" \
+         --rebuild-if-unbuilt=n \
+         "${args[@]}" "${pkgs[@]}"
+    sudo rm -f "${flag_file}" "${force_flag_file}"
+    unset bdl_call
+}
diff --git a/build_library/build_image_util.sh b/build_library/build_image_util.sh
index 3339b6ec0b2..3a66b973227 100755
--- a/build_library/build_image_util.sh
+++ b/build_library/build_image_util.sh
@@ -19,6 +19,7 @@ fi
 BUILD_DIR="${FLAGS_output_root}/${BOARD}/${IMAGE_SUBDIR}"
 OUTSIDE_OUTPUT_DIR="../build/images/${BOARD}/${IMAGE_SUBDIR}"
 
+source "${BUILD_LIBRARY_DIR}/pkg_util.sh" || exit 1
 source "${BUILD_LIBRARY_DIR}/reports_util.sh" || exit 1
 source "${BUILD_LIBRARY_DIR}/sbsign_util.sh" || exit 1
 
@@ -685,8 +686,13 @@ EOF
   fi
 
   # Build the selinux policy
-  if pkg_use_enabled coreos-base/coreos selinux; then
-      sudo chroot "${root_fs_dir}" bash -c "cd /usr/share/selinux/mcs && semodule -s mcs -i *.pp"
+  if is_selinux_enabled "${BOARD}"; then
+    info "Building selinux mcs policy"
+    sudo chroot "${root_fs_dir}" bash -s <<'EOF'
+cd /usr/share/selinux/mcs
+set -x
+semodule -s mcs -i *.pp
+EOF
   fi
 
   # Run tmpfiles once to make sure that /etc has everything in place before
@@ -720,12 +726,20 @@ EOF
   # SELinux: Label the root filesystem for using 'file_contexts'.
   # The labeling has to be done before moving /etc to /usr/share/flatcar/etc to prevent wrong labels for these files and as
   # the relabeling on boot would cause upcopies in the overlay.
-  if pkg_use_enabled coreos-base/coreos selinux; then
-    # TODO: Breaks the system:
-    # sudo setfiles -Dv -r "${root_fs_dir}" "${root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${root_fs_dir}"
-    # sudo setfiles -Dv -r "${root_fs_dir}" "${root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${root_fs_dir}"/usr
-    # For now we only try it with /etc
-    sudo setfiles -Dv -r "${root_fs_dir}" "${root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${root_fs_dir}"/etc
+  if is_selinux_enabled "${BOARD}"; then
+    # -D - set or update any directory SHA1 digests
+    # -E - treat conflicting specifications as errors
+    # -F - force reset of context to match file_context
+    # -r path - set root path
+    # -v - show changes in file labels
+    # -T 0 - use as many threads as there are cores
+    info "Relabeling the filesystem at ${root_fs_dir@Q}"
+    local path
+    # We do not run relabeling on /boot, it's FAT anyway, so no
+    # support for xattrs there.
+    for path in / /usr /oem; do
+      sudo setfiles -D -E -F -r "${root_fs_dir}" -v -T 0 "${root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${root_fs_dir}${path}"
+    done
   fi
 
   # Backup the /etc contents to /usr/share/flatcar/etc to serve as
diff --git a/build_library/catalyst_toolchains.sh b/build_library/catalyst_toolchains.sh
index 92d6e932136..db6c10e7520 100644
--- a/build_library/catalyst_toolchains.sh
+++ b/build_library/catalyst_toolchains.sh
@@ -3,6 +3,7 @@
 set -e
 source /tmp/chroot-functions.sh
 source /tmp/toolchain_util.sh
+source /tmp/break_dep_loop.sh
 
 # A note on packages:
 # The default PKGDIR is /usr/portage/packages
@@ -28,13 +29,81 @@ build_target_toolchain() {
     local ROOT="/build/${board}"
     local SYSROOT="/usr/$(get_board_chost "${board}")"
 
-    mkdir -p "${ROOT}/usr"
-    cp -at "${ROOT}" "${SYSROOT}"/lib*
-    cp -at "${ROOT}"/usr "${SYSROOT}"/usr/include "${SYSROOT}"/usr/lib*
+    function btt_emerge() {
+        # --root is required because run_merge overrides ROOT=
+        PORTAGE_CONFIGROOT="$ROOT" run_merge --root="$ROOT" --sysroot="$ROOT" "${@}"
+    }
 
-    # --root is required because run_merge overrides ROOT=
-    PORTAGE_CONFIGROOT="$ROOT" \
-        run_merge -u --root="$ROOT" --sysroot="$ROOT" "${TOOLCHAIN_PKGS[@]}"
+    # install baselayout first - with the selinux profile, this is
+    # pulled into the dependency chain
+    btt_emerge --oneshot --nodeps sys-apps/baselayout
+
+    # copy libraries from sysroot to root - sysroot seems to be
+    # split-usr, whereas root does not, so take this into account
+    (
+        shopt -s nullglob
+        local d f
+        local -a files
+        for d in "${SYSROOT}"/lib* "${SYSROOT}"/usr/lib*; do
+            if [[ ! -d ${d} ]]; then
+                continue
+            fi
+            files=( "${d}"/* )
+            if [[ ${#files[@]} -gt 0 ]]; then
+                f=${d##*/}
+                cp -at "${ROOT}/usr/${f}" "${files[@]}"
+            fi
+        done
+    )
+    cp -at "${ROOT}"/usr "${SYSROOT}"/usr/include
+
+    local -a args_for_bdl=()
+    if [[ -n ${clst_VERBOSE} ]]; then
+        args_for_bdl+=(-v)
+    fi
+    function btt_bdl_portageq() {
+        ROOT=${ROOT} SYSROOT=${ROOT} PORTAGE_CONFIGROOT=${ROOT} portageq "${@}"
+    }
+    function btt_bdl_equery() {
+        ROOT=${ROOT} SYSROOT=${ROOT} PORTAGE_CONFIGROOT=${ROOT} equery "${@}"
+    }
+    # Breaking the following loops here:
+    #
+    # glibc[nscd] -> libcap[pam] -> sys-libs/pam -> libcrypt -> libxcrypt[system] -> glibc
+    # glibc[nscd] -> audit[python] -> python -> libcrypt -> libxcrypt[system] -> glibc
+    # glibc[selinux] -> libselinux[python] -> python -> libcrypt -> libxcrypt[system] -> glibc
+    # systemd[cryptsetup] -> cryptsetup[udev] -> libudev[systemd] -> systemd
+    # systemd[cryptsetup] -> cryptsetup -> lvm2[udev] -> libudev[systemd] -> systemd
+    # systemd[cryptsetup] -> cryptsetup -> lvm2[lvm,systemd] -> systemd
+    # systemd[cryptsetup] -> cryptsetup -> tmpfiles[systemd] -> systemd
+    # systemd[curl] -> curl -> nghttp2[systemd] -> systemd
+    #     importd requires curl, so needs to be disabled too
+    # systemd[pam] -> pam[systemd] -> systemd
+    #     not dropping pam from sys-apps/systemd, otherwise we would
+    #     need to drop pam from sys-auth/pambase
+    # systemd[tpm] -> tpm2-tss -> tmpfiles[systemd] -> systemd
+    # util-linux[audit] -> audit[python] -> python -> util-linux
+    # util-linux[cryptsetup] -> cryptsetup -> util-linux
+    # util-linux[pam] -> sys-libs/pam[audit] -> sys-process/audit[python] -> python -> util-linux
+    #     su requires pam, so needs to be disabled too
+    # util-linux[selinux] -> libselinux[python] -> python -> util-linux
+    # util-linux[systemd] -> systemd -> util-linux
+    # util-linux[udev] -> libudev[systemd] -> systemd -> util-linux
+    args_for_bdl+=(
+        sys-apps/systemd cryptsetup,curl,importd,tpm
+        sys-apps/util-linux audit,cryptsetup,pam,selinux,su,systemd,udev
+        sys-libs/glibc nscd,selinux
+        sys-libs/pam systemd
+    )
+    BDL_ROOT=${ROOT} \
+    BDL_PORTAGEQ=btt_bdl_portageq \
+    BDL_EQUERY=btt_bdl_equery \
+    BDL_EMERGE=btt_emerge \
+        break_dep_loop "${args_for_bdl[@]}"
+    unset btt_bdl_portageq btt_bdl_equery
+
+    btt_emerge --changed-use --update --deep "${TOOLCHAIN_PKGS[@]}"
+    unset btt_emerge
 }
 
 configure_crossdev_overlay / /usr/local/portage/crossdev
diff --git a/build_library/extra_sysexts.sh b/build_library/extra_sysexts.sh
index 85ae7096fc3..0df112610a1 100644
--- a/build_library/extra_sysexts.sh
+++ b/build_library/extra_sysexts.sh
@@ -1,5 +1,4 @@
 EXTRA_SYSEXTS=(
-  "overlaybd|sys-fs/overlaybd,app-containers/accelerated-container-image"
   "incus|app-containers/incus"
   "nvidia-drivers-535|x11-drivers/nvidia-drivers:0/535|-kernel-open persistenced|amd64"
   "nvidia-drivers-535-open|x11-drivers/nvidia-drivers:0/535|kernel-open persistenced|amd64"
@@ -7,8 +6,10 @@ EXTRA_SYSEXTS=(
   "nvidia-drivers-550-open|x11-drivers/old-nvidia-drivers:0/550|kernel-open persistenced|amd64"
   "nvidia-drivers-570|x11-drivers/nvidia-drivers:0/570|-kernel-open persistenced|amd64"
   "nvidia-drivers-570-open|x11-drivers/nvidia-drivers:0/570|kernel-open persistenced|amd64"
+  "overlaybd|sys-fs/overlaybd,app-containers/accelerated-container-image"
   "podman|app-containers/podman,net-misc/passt"
   "python|dev-lang/python,dev-python/pip"
+  "selinux|sys-apps/policycoreutils,app-admin/setools"
   "zfs|sys-fs/zfs"
 )
 
diff --git a/build_library/pkg_util.sh b/build_library/pkg_util.sh
new file mode 100644
index 00000000000..4865ba73168
--- /dev/null
+++ b/build_library/pkg_util.sh
@@ -0,0 +1,30 @@
+# Copyright (c) 2025 The Flatcar Maintainers. All rights reserved.
+# Use of this source code is governed by the Apache 2.0 license.
+
+# check if any of the given use flags are enabled for a pkg
+pkg_use_enabled() {
+  local board=${1}; shift
+  local pkg=${1}; shift
+
+  # for every flag argument, turn it into a regexp that matches it as
+  # either '+${flag}' or '(+${flag})'
+  local -a grep_args=()
+  local flag
+  for flag; do
+    grep_args+=( -e '^(\?+'"${flag}"')\?$' )
+  done
+  local -i rv=0
+  local equery='equery'
+  if [[ -n ${board} ]]; then
+    equery+="-${board}"
+  fi
+
+  "${equery}" --quiet uses --forced-masked "${pkg}" | grep --quiet "${grep_args[@]}" || rv=$?
+  return ${rv}
+}
+
+is_selinux_enabled() {
+  local board=${1}; shift
+
+  pkg_use_enabled "${board}" coreos-base/coreos selinux
+}
diff --git a/build_library/prod_image_util.sh b/build_library/prod_image_util.sh
index 7463f26d402..0a81108ecf1 100755
--- a/build_library/prod_image_util.sh
+++ b/build_library/prod_image_util.sh
@@ -3,6 +3,8 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+source "${BUILD_LIBRARY_DIR}/pkg_util.sh" || exit 1
+
 # Lookup the current version of a binary package, downloading it if needed.
 # Usage: get_binary_pkg some-pkg/name
 # Prints: some-pkg/name-1.2.3
@@ -222,6 +224,14 @@ create_prod_tar() {
 create_prod_sysexts() {
   local image_name="$1"
   local image_sysext_base="${image_name%.bin}_sysext.squashfs"
+  local -a extra_args
+
+  local selinux=''
+  if is_selinux_enabled "${BOARD}"; then
+    selinux=x
+  fi
+
+  local sysext
   for sysext in "${EXTRA_SYSEXTS[@]}"; do
     local name pkgs useflags arches
     IFS="|" read -r name pkgs useflags arches <<< "$sysext"
@@ -230,9 +240,13 @@ create_prod_sysexts() {
     local arch_array=(${arches//,/ })
     local useflags_array=(${useflags//,/ })
 
+    extra_args=()
     local mangle_script="${BUILD_LIBRARY_DIR}/sysext_mangle_${name}"
-    if [[ ! -x "${mangle_script}" ]]; then
-      mangle_script=
+    if [[ -x "${mangle_script}" ]]; then
+      extra_args+=( --manglefs_script="${mangle_script}" )
+    fi
+    if [[ -n ${selinux} ]]; then
+      extra_args+=( --selinux )
     fi
 
     if [[ -n "$arches" ]]; then
@@ -248,8 +262,8 @@ create_prod_sysexts() {
     fi
 
     sudo rm -f "${BUILD_DIR}/${name}.raw" \
-	"${BUILD_DIR}/flatcar-test-update-${name}.gz" \
-	"${BUILD_DIR}/${name}_*"
+        "${BUILD_DIR}/flatcar-test-update-${name}.gz" \
+        "${BUILD_DIR}/${name}_*"
     # we use -E to pass the USE flags, but also MODULES_SIGN variables
     #
     # The --install_root_basename="${name}-extra-sysext-rootfs" flag
@@ -260,7 +274,8 @@ create_prod_sysexts() {
         --squashfs_base="${BUILD_DIR}/${image_sysext_base}" \
         --image_builddir="${BUILD_DIR}" \
         --install_root_basename="${name}-extra-sysext-rootfs" \
-        ${mangle_script:+--manglefs_script=${mangle_script}} \
+        --forbidden_packages='sec-policy/selinux-.*;selinux policy packages must be in base image' \
+        "${extra_args[@]}" \
         "${name}" "${pkg_array[@]}"
     delta_generator \
       -private_key "/usr/share/update_engine/update-payload-key.key.pem" \
diff --git a/build_library/sysext_prod_builder b/build_library/sysext_prod_builder
index d90fb4a1da2..1aa90022803 100755
--- a/build_library/sysext_prod_builder
+++ b/build_library/sysext_prod_builder
@@ -16,6 +16,7 @@ assert_inside_chroot
 switch_to_strict_mode
 
 . "${BUILD_LIBRARY_DIR}/build_image_util.sh" || exit 1
+. "${BUILD_LIBRARY_DIR}/pkg_util.sh" || exit 1
 
 # Create a sysext from a package and install it to the OS image.
 # Conventions:
@@ -54,6 +55,13 @@ create_prod_sysext() {
     msg="${msg}, FS mangle script 'sysext_mangle_${name}'"
   fi
 
+  if is_selinux_enabled "${BOARD}"; then
+    build_sysext_opts+=(
+      --selinux
+      --forbidden_packages='sec-policy/selinux-.*;selinux policy packages must be in base image'
+    )
+  fi
+
   info "${msg}."
 
   # Pass the build ID extracted from root FS to build_sysext. This prevents common.sh
@@ -63,6 +71,14 @@ create_prod_sysext() {
   # The --install_root_basename="${name}-base-sysext-rootfs" flag is
   # important - it sets the name of a rootfs directory, which is used
   # to determine the package target in coreos/base/profile.bashrc
+  echo sudo "FLATCAR_BUILD_ID=$FLATCAR_BUILD_ID" "${SCRIPTS_DIR}/build_sysext" \
+            --board="${BOARD}" \
+            --image_builddir="${workdir}/sysext-build" \
+            --squashfs_base="${base_sysext}" \
+            --generate_pkginfo \
+            --install_root_basename="${name}-base-sysext-rootfs" \
+            "${build_sysext_opts[@]}" \
+            "${name}" "${grp_pkg[@]}"
   sudo "FLATCAR_BUILD_ID=$FLATCAR_BUILD_ID" "${SCRIPTS_DIR}/build_sysext" \
             --board="${BOARD}" \
             --image_builddir="${workdir}/sysext-build" \
diff --git a/build_library/vm_image_util.sh b/build_library/vm_image_util.sh
index ac83929cfa6..7963de7de40 100644
--- a/build_library/vm_image_util.sh
+++ b/build_library/vm_image_util.sh
@@ -5,6 +5,8 @@
 # Format options. Each variable uses the form IMG_<type>_<opt>.
 # Default values use the format IMG_DEFAULT_<opt>.
 
+. "${BUILD_LIBRARY_DIR}/pkg_util.sh" || exit 1
+
 VALID_IMG_TYPES=(
     akamai
     ami
@@ -591,7 +593,11 @@ install_oem_sysext() {
         --image_builddir="${built_sysext_dir}"
         --metapkgs="${metapkg}"
         --install_root_basename="${VM_IMG_TYPE}-oem-sysext-rootfs"
+        --forbidden_packages='sec-policy/selinux-.*;selinux policy packages must be in base image' \
     )
+    if is_selinux_enabled "${BOARD}"; then
+        build_sysext_flags+=( --selinux )
+    fi
     local overlay_path mangle_fs
     overlay_path=$(portageq get_repo_path / coreos-overlay)
     mangle_fs="${overlay_path}/${metapkg}/files/manglefs.sh"
diff --git a/build_packages b/build_packages
index d300edff828..3777e74d963 100755
--- a/build_packages
+++ b/build_packages
@@ -174,89 +174,12 @@ if [[ ${#WORKON_PKGS[@]} -gt 0 ]]; then
   )
 fi
 
-# Goo to attempt to resolve dependency loops on individual packages.
-# If this becomes insufficient we will need to move to a full multi-stage
-# bootstrap process like we do with the SDK via catalyst.
-#
-# Called like:
-#
-#     break_dep_loop [PKG_USE_PAIR]…
-#
-# PKG_USE_PAIR consists of two arguments: a package name (for example:
-# sys-fs/lvm2), and a comma-separated list of USE flags to clear (for
-# example: udev,systemd).
-break_dep_loop() {
-  local -a pkgs
-  local -a all_flags
-  local -a args
-  local flag_file="${BOARD_ROOT}/etc/portage/package.use/break_dep_loop"
-  local -a flag_file_entries
-  local -a pkg_summaries
-
-  # Be sure to clean up use flag hackery from previous failed runs
-  sudo rm -f "${flag_file}"
-
-  if [[ $# -eq 0 ]]; then
-      return 0
-  fi
-
-  # Temporarily compile/install packages with flags disabled. If a binary
-  # package is available use it regardless of its version or use flags.
-  local pkg
-  local -a flags
-  local disabled_flags
-  while [[ $# -gt 0 ]]; do
-    pkg="${1}"
-    pkgs+=("${pkg}")
-    flags=( ${2//,/ } )
-    all_flags+=("${flags[@]}")
-    disabled_flags="${flags[@]/#/-}"
-    flag_file_entries+=("${pkg} ${disabled_flags}")
-    args+=("--buildpkg-exclude=${pkg}")
-    pkg_summaries+=("${pkg}[${disabled_flags}]")
-    shift 2
-  done
-
-  # If packages are already installed we have nothing to do
-  local any_package_uninstalled=0
-  for pkg in "${pkgs[@]}"; do
-    if ! portageq-"${BOARD}" has_version "${BOARD_ROOT}" "${pkgs[@]}"; then
-      any_package_uninstalled=1
-      break
-    fi
-  done
-  if [[ ${any_package_uninstalled} -eq 0 ]]; then
-    return 0
-  fi
-
-  # Likewise, nothing to do if the flags aren't actually enabled.
-  local any_flag_enabled=0
-  for pkg in "${pkgs[@]}"; do
-    if pkg_use_enabled "${pkg}" "${all_flags[@]}"; then
-      any_flag_enabled=1
-      break
-    fi
-  done
-  if [[ ${any_flag_enabled} -eq 0 ]]; then
-    return 0
-  fi
-
-  info "Merging ${pkg_summaries[@]}"
-  sudo mkdir -p "${flag_file%/*}"
-  sudo_clobber "${flag_file}" <<<"${flag_file_entries[0]}"
-  local entry
-  for entry in "${flag_file_entries[@]:1}"; do
-    sudo_append "${flag_file}" <<<"${entry}"
-  done
-  # rebuild-if-unbuilt is disabled to prevent portage from needlessly
-  # rebuilding zlib for some unknown reason, in turn triggering more rebuilds.
-  sudo -E "${EMERGE_CMD[@]}" "${EMERGE_FLAGS[@]}" \
-    --rebuild-if-unbuilt=n \
-    "${args[@]}" "${pkgs[@]}"
-  sudo rm -f "${flag_file}"
-}
-
 if [[ "${FLAGS_usepkgonly}" -eq "${FLAGS_FALSE}" ]]; then
+  . "${BUILD_LIBRARY_DIR}/break_dep_loop.sh" || exit 1
+
+  function bp_bdl_emerge() {
+    sudo -E "${EMERGE_CMD[@]}" "${EMERGE_FLAGS[@]}" "${@}"
+  }
   # Breaking the following loops here:
   #
   # util-linux[udev] -> virtual/udev -> systemd -> util-linux
@@ -271,13 +194,22 @@ if [[ "${FLAGS_usepkgonly}" -eq "${FLAGS_FALSE}" ]]; then
   # sys-libs/pam[systemd] -> sys-apps/system[pam] -> sys-libs/pam
   #   not dropping pam from sys-apps/systemd, otherwise we would need
   #   to drop pam from sys-auth/pambase
-  break_dep_loop sys-apps/util-linux udev,systemd,cryptsetup \
-                 sys-fs/cryptsetup udev \
-                 sys-fs/lvm2 udev,systemd \
-                 sys-apps/systemd cryptsetup,tpm \
-                 net-misc/curl http2 \
-                 net-libs/nghttp2 systemd \
-                 sys-libs/pam systemd
+  args_for_bdl=(
+      sys-apps/util-linux udev,systemd,cryptsetup
+      sys-fs/cryptsetup udev
+      sys-fs/lvm2 udev,systemd
+      sys-apps/systemd cryptsetup,tpm
+      net-misc/curl http2
+      net-libs/nghttp2 systemd
+      sys-libs/pam systemd
+  )
+  BDL_ROOT=${BOARD_ROOT} \
+  BDL_PORTAGEQ=portageq-"${BOARD}" \
+  BDL_EQUERY=equery-"${BOARD}" \
+  BDL_EMERGE=bp_bdl_emerge \
+  BDL_INFO=info \
+      break_dep_loop "${args_for_bdl[@]}"
+  unset bp_bdl_emerge args_for_bdl
 fi
 
 if [[ "${FLAGS_only_resolve_circular_deps}" -eq "${FLAGS_TRUE}" ]]; then
diff --git a/build_sdk_container_image b/build_sdk_container_image
index d1e4fce88da..464745b432b 100755
--- a/build_sdk_container_image
+++ b/build_sdk_container_image
@@ -34,6 +34,7 @@ arch="amd64"
 official="0"
 tarball=""
 os_version=""
+logdir=""
 
 keep="false"
 cleanup=""
@@ -57,6 +58,7 @@ usage() {
     echo "                     add a cleanup line to <script> which, when run, will free"
     echo "                     the resource. Useful for CI."
     echo "      -h           - Print this help."
+    echo "      -l <dir>     - Put logs in this directory"
     echo
 }
 
@@ -66,6 +68,7 @@ while [ 0 -lt $# ] ; do
     case "$1" in
     -h) usage; exit 0;;
     -k) keep="true";      shift;;
+    -l) logdir="${2}";    shift; shift;;
     -v) os_version="$2";  shift; shift;;
     -x) cleanup="$2";     shift; shift;;
     *)  if [ -z "$tarball" ] ;  then
@@ -102,6 +105,10 @@ else
     official="0"
 fi
 
+if [[ -n ${logdir} ]]; then
+    mkdir -p "${logdir}"
+fi
+
 # --
 
 # import tarball
@@ -170,8 +177,14 @@ else
     if [ -n "$cleanup" ] ; then
         echo "$docker container rm -f '${toolchains_container}'" >> "$cleanup"
     fi
+    failed=''
     ./run_sdk_container -C "${import_image}" -n "${toolchains_container}" \
-            sudo ./build_toolchains --seed_tarball="./${tarball}"
+            sudo ./build_toolchains --seed_tarball="./${tarball}" || failed=x
+
+    if [[ -n ${logdir} ]] && sudo test -d __build__/images/catalyst/log/coreos-toolchains; then
+        sudo cp -a __build__/images/catalyst/log/coreos-toolchains "${logdir}/coreos-toolchains"
+    fi
+    if [[ -n ${failed} ]]; then exit 1; fi
 
     # remove sdk tarball from scripts root so it's not part of the SDK container build context
     if [ -f "${tarball_copied}" ] ; then
@@ -216,6 +229,12 @@ else
                  .
 
     $docker stop "${binhost_container}"
+
+    if [[ -n ${logdir} ]]; then
+        $docker run --rm -v "${logdir}:/logdir" "${sdk_build_image}" ./sdk_lib/setup_boards.sh finish /logdir
+    else
+        $docker run --rm "${sdk_build_image}" ./sdk_lib/setup_boards.sh finish
+    fi
 fi
 
 # --
diff --git a/build_sysext b/build_sysext
index 92d6abc4009..df59689f9e8 100755
--- a/build_sysext
+++ b/build_sysext
@@ -43,6 +43,10 @@ DEFINE_boolean ignore_version_mismatch "${FLAGS_FALSE}" \
   "Ignore version mismatch between SDK board packages and base squashfs. DANGEROUS."
 DEFINE_string install_root_basename "${default_install_root_basename}" \
   "Name of a root directory where packages will be installed. ${default_install_root_basename@Q} by default."
+DEFINE_string forbidden_packages "" \
+  "Comma-separated list of pairs describing packages that are forbidden in the sysext. Every pair consist of regexp and message, separated with semicolon. The regexp is for matching a package name (<category>/<name>-<version>::<repo>), and message is printed if the regexp matched a package name. Be careful to not include commas in the regexp or message."
+DEFINE_boolean selinux "${FLAGS_FALSE}" \
+  "Relabel the files in sysext using policies installed in the base squashfs image."
 
 FLAGS_HELP="USAGE: build_sysext [flags] <sysext_name> <binary_package> [<binary_package> ...]
 
@@ -137,12 +141,24 @@ _get_sysext_arch() {
     fi
 }
 
+if [[ ${FLAGS_install_root_basename} = */* || ${FLAGS_install_root_basename} = . || ${FLAGS_install_root_basename} = .. ]]; then
+    die "Just use a normal install root basename like 'my-best-rootfs-with-no-slashes' instead of ${FLAGS_install_root_basename@Q}, will ya?!"
+fi
+
+# Put the custom install root directory inside the install-root
+# subdirectory of BUILD_DIR to avoid the accidental messing with other
+# directories we create inside directly inside BUILD_DIR.
+THE_INSTALL_ROOT=${BUILD_DIR}/install-root/${FLAGS_install_root_basename}
+
 cleanup() {
   local dirs=(
     "${BUILD_DIR}/fs-root"
-    "${BUILD_DIR}/${FLAGS_install_root_basename}"
+    "${THE_INSTALL_ROOT}"
     "${BUILD_DIR}/workdir"
     "${BUILD_DIR}/img-rootfs"
+    "${BUILD_DIR}/install-root"
+    "${BUILD_DIR}/selinux-root"
+    "${BUILD_DIR}/selinux-root-workdir"
   )
   umount "${dirs[@]}" 2>/dev/null || true
   rm -rf "${dirs[@]}" || true
@@ -183,9 +199,9 @@ fi
 
 mkdir "${BUILD_DIR}/fs-root"
 mount -rt squashfs -o loop,nodev "${FLAGS_squashfs_base}" "${BUILD_DIR}/fs-root"
-mkdir "${BUILD_DIR}/${FLAGS_install_root_basename}"
+mkdir -p "${THE_INSTALL_ROOT}"
 mkdir "${BUILD_DIR}/workdir"
-mount -t overlay overlay -o lowerdir="${BUILD_DIR}/fs-root${pkginfo_lowerdirs}",upperdir="${BUILD_DIR}/${FLAGS_install_root_basename}",workdir="${BUILD_DIR}/workdir" "${BUILD_DIR}/${FLAGS_install_root_basename}"
+mount -t overlay overlay -o lowerdir="${BUILD_DIR}/fs-root${pkginfo_lowerdirs}",upperdir="${THE_INSTALL_ROOT}",workdir="${BUILD_DIR}/workdir" "${THE_INSTALL_ROOT}"
 
 REPO_BUILD_ID=$(source "${REPO_MANIFESTS_DIR}/version.txt"; echo "$FLATCAR_BUILD_ID")
 REPO_FLATCAR_VERSION=$(source "${REPO_MANIFESTS_DIR}/version.txt"; echo "$FLATCAR_VERSION")
@@ -225,7 +241,7 @@ info "Building '${SYSEXTNAME}' squashfs with (meta-)packages '${@}' in '${BUILD_
 for package; do
   echo "Installing package into sysext image: $package"
   FEATURES="-ebuild-locks binpkg-multi-instance" emerge \
-    --root="${BUILD_DIR}/${FLAGS_install_root_basename}" \
+    --root="${THE_INSTALL_ROOT}" \
     --config-root="/build/${FLAGS_board}"  \
     --sysroot="/build/${FLAGS_board}"  \
     --usepkgonly \
@@ -239,22 +255,53 @@ done
 # Make squashfs generation more reproducible.
 export SOURCE_DATE_EPOCH=$(stat -c '%Y' "${BUILD_DIR}/fs-root/usr/lib/os-release")
 
-# Unmount in order to get rid of the overlay
-umount "${BUILD_DIR}/${FLAGS_install_root_basename}"
-umount "${BUILD_DIR}/fs-root"
+# Unmount in order to get rid of the overlay, but keep fs-root for
+# now, so we can use selinux file contexts.
+umount "${THE_INSTALL_ROOT}"
+if [[ ${FLAGS_selinux} = "${FLAGS_TRUE}" ]]; then
+    mkdir "${BUILD_DIR}/selinux-root"
+    mkdir "${BUILD_DIR}/selinux-root-workdir"
+    mount -t overlay overlay -o lowerdir="${BUILD_DIR}/fs-root${pkginfo_lowerdirs}",upperdir="${BUILD_DIR}/selinux-root",workdir="${BUILD_DIR}/selinux-root-workdir" "${BUILD_DIR}/selinux-root"
+else
+    umount "${BUILD_DIR}/fs-root"
+fi
 
 if [[ "$FLAGS_generate_pkginfo" = "${FLAGS_TRUE}" ]] ; then
   info "  Creating pkginfo squashfs '${BUILD_DIR}/${SYSEXTNAME}_pkginfo.raw'"
   mkdir -p "${BUILD_DIR}/img-pkginfo/var/db"
-  cp -R "${BUILD_DIR}/${FLAGS_install_root_basename}/var/db/pkg" "${BUILD_DIR}/img-pkginfo/var/db/"
+  cp -R "${THE_INSTALL_ROOT}/var/db/pkg" "${BUILD_DIR}/img-pkginfo/var/db/"
   mksquashfs "${BUILD_DIR}/img-pkginfo" "${BUILD_DIR}/${SYSEXTNAME}_pkginfo.raw" \
               -noappend -xattrs-exclude '^btrfs.' -comp "${FLAGS_compression}" ${FLAGS_mksquashfs_opts}
 fi
 
 info "Writing ${SYSEXTNAME}_packages.txt"
-ROOT="${BUILD_DIR}/${FLAGS_install_root_basename}" PORTAGE_CONFIGROOT="${BUILD_DIR}/${FLAGS_install_root_basename}" \
+ROOT="${THE_INSTALL_ROOT}" PORTAGE_CONFIGROOT="${THE_INSTALL_ROOT}" \
       equery --no-color list --format '$cpv::$repo' '*' > "${BUILD_DIR}/${SYSEXTNAME}_packages.txt"
 
+if [[ -n ${FLAGS_forbidden_packages} ]]; then
+    # Check if there are forbidden packages
+    mapfile -t pairs <<<"${FLAGS_forbidden_packages//,/$'\n'}"
+    declare -A re_msg_pairs=()
+    for pair in "${pairs[@]}"; do
+        re=${pair%%;*}
+        msg=${pair#.;}
+        re_msg_pairs["${re}"]="${msg}"
+    done
+
+    mapfile -t pkgs <"${BUILD_DIR}/${SYSEXTNAME}_packages.txt"
+    has_forbidden_pkg=
+    for pkg in "${pkgs[@]}"; do
+        for re in "${!re_msg_pairs[@]}"; do
+            if [[ ${pkg} =~ ${re} ]]; then
+                has_forbidden_pkg=x
+                error "Forbidden package ${pkg}: ${msg}"
+            fi
+        done
+    done
+    if [[ -n ${has_forbidden_pkg} ]]; then
+        die "Forbidden packages encountered"
+    fi
+fi
 
 if [[ "${FLAGS_strip_binaries}" = "${FLAGS_TRUE}" ]]; then
     chost="$("portageq-${BOARD}" envvar CHOST)"
@@ -263,7 +310,7 @@ if [[ "${FLAGS_strip_binaries}" = "${FLAGS_TRUE}" ]]; then
     info "Stripping all non-stripped binaries in sysext using '${strip}'"
 
     # Find all non-stripped binaries, remove ':' from filepath, and strip 'em
-    find "${BUILD_DIR}/${FLAGS_install_root_basename}" -exec file \{\} \; \
+    find "${THE_INSTALL_ROOT}" -exec file \{\} \; \
          | awk '/not stripped/ {print substr($1, 1, length($1)-1)}' \
          | while read bin; do
                 info "     ${strip} ${bin}"
@@ -275,40 +322,57 @@ if [[ -n "${FLAGS_manglefs_script}" ]]; then
   if [[ ! -x "${FLAGS_manglefs_script}" ]]; then
     die "${FLAGS_manglefs_script} is not executable"
   fi
-  "${FLAGS_manglefs_script}" "${BUILD_DIR}/${FLAGS_install_root_basename}"
+  "${FLAGS_manglefs_script}" "${THE_INSTALL_ROOT}"
 fi
 
 info "Removing non-/usr directories from sysext image"
-for entry in "${BUILD_DIR}/${FLAGS_install_root_basename}"/*; do
+for entry in "${THE_INSTALL_ROOT}"/*; do
   if [[ "${entry}" = */usr ]]; then
     continue
   fi
   info "  Removing ${entry##*/}"
   rm -rf "${entry}"
 done
-mkdir -p "${BUILD_DIR}/${FLAGS_install_root_basename}/usr/lib/extension-release.d"
+mkdir -p "${THE_INSTALL_ROOT}/usr/lib/extension-release.d"
 version_field="${VERSION_FIELD_OVERRIDE:-VERSION_ID=${FLATCAR_VERSION_ID}}"
 all_fields=(
   'ID=flatcar'
   "${version_field}"
   "ARCHITECTURE=${ARCH}"
 )
-printf '%s\n' "${all_fields[@]}" >"${BUILD_DIR}/${FLAGS_install_root_basename}/usr/lib/extension-release.d/extension-release.${SYSEXTNAME}"
+printf '%s\n' "${all_fields[@]}" >"${THE_INSTALL_ROOT}/usr/lib/extension-release.d/extension-release.${SYSEXTNAME}"
 
 info "Removing opaque directory markers to always merge all contents"
-find "${BUILD_DIR}/${FLAGS_install_root_basename}" -xdev -type d -exec sh -c 'if [ "$(attr -R -q -g overlay.opaque {} 2>/dev/null)" = y ]; then attr -R -r overlay.opaque {}; fi' \;
+find "${THE_INSTALL_ROOT}" -xdev -type d -exec sh -c 'if [ "$(attr -R -q -g overlay.opaque {} 2>/dev/null)" = y ]; then attr -R -r overlay.opaque {}; fi' \;
 
 info "Checking for invalid file ownership"
-invalid_files=$(find "${BUILD_DIR}/${FLAGS_install_root_basename}" -user sdk -or -group sdk)
+invalid_files=$(find "${THE_INSTALL_ROOT}" -user sdk -or -group sdk)
 if [[ -n "${invalid_files}" ]]; then
   die "Invalid file ownership: ${invalid_files}"
 fi
 
-mksquashfs "${BUILD_DIR}/${FLAGS_install_root_basename}" "${BUILD_DIR}/${SYSEXTNAME}.raw" \
+if [[ ${FLAGS_selinux} = "${FLAGS_TRUE}" ]]; then
+    info "Build temporary selinux modules"
+    chroot "${BUILD_DIR}/selinux-root" bash -s <<'EOF'
+cd /usr/share/selinux/mcs
+set -x
+semodule -s mcs -n -i *.pp
+EOF
+
+    info "Relabeling sysext contents"
+    spec_file="${BUILD_DIR}/selinux-root/etc/selinux/mcs/contexts/files/file_contexts"
+    setfiles -D -E -F -r "${THE_INSTALL_ROOT}" -v -T 0 "${spec_file}" "${THE_INSTALL_ROOT}"
+    ls -laRZ "${THE_INSTALL_ROOT}"
+    umount "${BUILD_DIR}/selinux-root"
+    umount "${BUILD_DIR}/fs-root"
+fi
+
+info "Creating squashfs image"
+mksquashfs "${THE_INSTALL_ROOT}" "${BUILD_DIR}/${SYSEXTNAME}.raw" \
                -noappend -xattrs-exclude '^btrfs.' -comp "${FLAGS_compression}" ${FLAGS_mksquashfs_opts}
 rm -rf "${BUILD_DIR}"/{fs-root,"${FLAGS_install_root_basename}",workdir}
 
-# Generate reports
+info "Generating reports"
 mkdir "${BUILD_DIR}/img-rootfs"
 mount -rt squashfs -o loop,nodev "${BUILD_DIR}/${SYSEXTNAME}.raw" "${BUILD_DIR}/img-rootfs"
 write_contents "${BUILD_DIR}/img-rootfs" "${BUILD_DIR}/${SYSEXTNAME}_contents.txt"
diff --git a/build_toolchains b/build_toolchains
index 8deb4524102..b5076d3f7c6 100755
--- a/build_toolchains
+++ b/build_toolchains
@@ -27,6 +27,7 @@ catalyst_stage_default 4
 }
 create_provenance_overlay() {
   local root_overlay="$1"
+  local f d scripts_hash
   while read f; do
     d="${f%/*}"
     mkdir -p "${root_overlay}${d}/"
@@ -48,9 +49,10 @@ catalyst_init "$@"
 
 ROOT_OVERLAY="${TEMPDIR}/stage4-${ARCH}-$FLAGS_version-overlay"
 
-# toolchain_util.sh is required by catalyst_toolchains.sh
+# toolchain_util.sh and break_dep_loop.sh are required by
+# catalyst_toolchains.sh
 mkdir -p "${ROOT_OVERLAY}/tmp"
-cp "${BUILD_LIBRARY_DIR}/toolchain_util.sh" "${ROOT_OVERLAY}/tmp"
+cp "${BUILD_LIBRARY_DIR}/toolchain_util.sh" "${BUILD_LIBRARY_DIR}/break_dep_loop.sh" "${ROOT_OVERLAY}/tmp"
 create_provenance_overlay "${ROOT_OVERLAY}"
 
 catalyst_build
diff --git a/ci-automation/ci_automation_common.sh b/ci-automation/ci_automation_common.sh
index 80d1ac4cd03..f516b10b24f 100644
--- a/ci-automation/ci_automation_common.sh
+++ b/ci-automation/ci_automation_common.sh
@@ -111,7 +111,40 @@ function copy_dir_from_buildcache() {
     rsync --partial -a -e "${sshcmd}" "${BUILDCACHE_USER}@${BUILDCACHE_SERVER}:${remote_path}" \
         "${local_path}"
 }
+# --
+
+# Returns true if the passed directory contains files that match any
+# of the passed glob strings. Remember to pass the glob as strings
+# (means: quote them, so globs are not resolved at the function
+# callsite).
+function dir_contains_globs() (
+    shopt -s nullglob
+
+    local dir=${1}; shift
+    # rest are globs
+
+    # this is in a subshell, so cd is safe - won't mess with working
+    # directory of the caller
+    cd "${dir}" 2>/dev/null || return 1
+    # for globs to be evaluated, we must not use quotes here
+    local -a files=( ${@} )
+
+    if [[ ${#files[@]} -gt 0 ]]; then
+        return 0
+    fi
+    return 1
+)
+# --
 
+function upload_fail_logs() {
+    if ! dir_contains_globs . 'debug-fail-logs-*.log'; then
+        return 0
+    fi
+
+    create_digests "${SIGNER}" debug-fail-logs-*.log
+    sign_artifacts "${SIGNER}" debug-fail-logs-*.log*
+    copy_to_buildcache "build-logs/${FLATCAR_SDK_VERSION}" debug-fail-logs-*.log*
+}
 # --
 
 function copy_to_buildcache() {
diff --git a/ci-automation/garbage_collect.sh b/ci-automation/garbage_collect.sh
index 058c0663816..9c7dfdf5677 100644
--- a/ci-automation/garbage_collect.sh
+++ b/ci-automation/garbage_collect.sh
@@ -152,6 +152,7 @@ function _garbage_collect_impl() {
         rmpat="${rmpat} ${BUILDCACHE_PATH_PREFIX}/containers/${os_docker_vernum}/flatcar-images-*"
         rmpat="${rmpat} ${BUILDCACHE_PATH_PREFIX}/images/*/${os_vernum}/"
         rmpat="${rmpat} ${BUILDCACHE_PATH_PREFIX}/testing/${os_vernum}/"
+        rmpat="${rmpat} ${BUILDCACHE_PATH_PREFIX}/build-logs/${os_vernum}/"
 
         echo "## The following files will be removed ##"
         $sshcmd "${BUILDCACHE_USER}@${BUILDCACHE_SERVER}" \
@@ -211,6 +212,7 @@ function _garbage_collect_impl() {
                 "images/amd64" \
                 "images/arm64" \
                 "testing" \
+                "build-logs" \
                 ; do
         local fullpath="${BUILDCACHE_PATH_PREFIX}/${dir}"
         echo
diff --git a/ci-automation/packages.sh b/ci-automation/packages.sh
index e6e984f7f38..9decf40fd28 100644
--- a/ci-automation/packages.sh
+++ b/ci-automation/packages.sh
@@ -80,22 +80,44 @@ function _packages_build_impl() {
     local vernum="${FLATCAR_VERSION}"
     local docker_vernum="$(vernum_to_docker_image_version "${vernum}")"
     local packages_container="flatcar-packages-${arch}-${docker_vernum}"
+    local logs_tarball="packages-${arch}-logs-$(date --utc '+%F-%H%M-%S').tar.xz"
 
     source sdk_lib/sdk_container_common.sh
 
+    logdir=__build__/packages-logs-to-upload
+    mkdir -p "${logdir}"
+
     apply_local_patches
     # Build packages; store packages in container
+    failed=''
     ./run_sdk_container -x ./ci-cleanup.sh  -n "${packages_container}" -v "${vernum}" \
         -C "${sdk_image}" \
-        ./build_packages --board="${arch}-usr"
+        ./build_packages --board="${arch}-usr" || failed=x
 
-    # run_sdk_container updates the version file, use that version from here on
-    source sdk_container/.repo/manifests/version.txt
-    local vernum="${FLATCAR_VERSION}"
-    local docker_vernum="$(vernum_to_docker_image_version "${vernum}")"
-    local packages_image="flatcar-packages-${arch}"
+    # Copy the build logs to a directory accessible for us.
+    ./run_sdk_container -n "${packages_container}" -v "${vernum}" -C "${sdk_image}" \
+        cp -a "/build/${arch}-usr/var/log/portage" "${logdir}" || :
+
+    if [[ -z ${failed} ]]; then
+        # run_sdk_container updates the version file, use that version from here on
+        source sdk_container/.repo/manifests/version.txt
+        local vernum="${FLATCAR_VERSION}"
+        local docker_vernum="$(vernum_to_docker_image_version "${vernum}")"
+        local packages_image="flatcar-packages-${arch}"
 
-    # generate image + push to build cache
-    docker_commit_to_buildcache "${packages_container}" "${packages_image}" "${docker_vernum}"
+        # generate image + push to build cache
+        docker_commit_to_buildcache "${packages_container}" "${packages_image}" "${docker_vernum}"
+    fi
+    if dir_contains_globs "${logdir}" '*'; then
+        (
+            cd "${logdir}"
+            tar -cJf "${logs_tarball}" *
+            create_digests "${SIGNER}" "${logs_tarball}"
+            sign_artifacts "${SIGNER}" "${logs_tarball}"*
+            copy_to_buildcache "build-logs/${FLATCAR_SDK_VERSION}" "${logs_tarball}"*
+        )
+    fi
+    upload_fail_logs
+    if [[ -n ${failed} ]]; then exit 1; fi
 }
 # --
diff --git a/ci-automation/sdk_bootstrap.sh b/ci-automation/sdk_bootstrap.sh
index 89d5b4bdc65..f629e0253ee 100644
--- a/ci-automation/sdk_bootstrap.sh
+++ b/ci-automation/sdk_bootstrap.sh
@@ -176,13 +176,17 @@ function _sdk_bootstrap_impl() {
     fi
     apply_local_patches
 
-    ./bootstrap_sdk_container -x ./ci-cleanup.sh "${seed_version}" "${vernum}"
+    local failed=''
+    local logdir='__build__/sdk-bootstrap-logs-to-upload/'
+    mkdir -p "${logdir}"
+    ./bootstrap_sdk_container -l "${logdir}" -x ./ci-cleanup.sh "${seed_version}" "${vernum}" || failed=x
 
     # push SDK tarball to buildcache
     # Get Flatcar version number format (separator is '+' instead of '-',
     # equal to $(strip_version_prefix "$version")
     source sdk_container/.repo/manifests/version.txt
     local dest_tarball="flatcar-sdk-${ARCH}-${FLATCAR_SDK_VERSION}.tar.bz2"
+    local logs_tarball="sdk-bootstrap-logs-${ARCH}-$(date --utc '+%F-%H%M-%S').tar.xz"
 
     # change the owner of the files and directories in __build__ back
     # to ourselves, otherwise we could fail to sign the artifacts as
@@ -193,11 +197,54 @@ function _sdk_bootstrap_impl() {
     uid=$(id --user)
     gid=$(id --group)
     sudo chown --recursive "${uid}:${gid}" __build__
-    (
-        cd "__build__/images/catalyst/builds/flatcar-sdk"
-        create_digests "${SIGNER}" "${dest_tarball}"
-        sign_artifacts "${SIGNER}" "${dest_tarball}"*
-        copy_to_buildcache "sdk/${ARCH}/${FLATCAR_SDK_VERSION}" "${dest_tarball}"*
-    )
+    if [[ -z ${failed} ]]; then
+        (
+            cd "__build__/images/catalyst/builds/flatcar-sdk"
+            create_digests "${SIGNER}" "${dest_tarball}"
+            sign_artifacts "${SIGNER}" "${dest_tarball}"*
+            copy_to_buildcache "sdk/${ARCH}/${FLATCAR_SDK_VERSION}" "${dest_tarball}"*
+        )
+    fi
+
+    # collect logs
+    local catalyst_log='__build__/images/catalyst/log/flatcar-sdk'
+    if dir_contains_globs "${catalyst_log}" 'stage*'; then
+        cp -a "${catalyst_log}/stage"* "${logdir}"
+    fi
+    mkdir -p "${logdir}/config-logs"
+    # TODO: Add more interesting files (meson logs, cmake logs)
+    local -a interesting_files=( config.log ) find_flags=()
+    for f in "${interesting_files[@]}"; do
+        if [[ ${#find_flags[@]} -ne 0 ]]; then
+            find_flags+=( '-o' )
+        fi
+        find_flags+=( '-name' "${f}" )
+    done
+    local catalyst_tmp='__build__/images/catalyst/tmp/flatcar-sdk'
+    local -a logs
+    local l d
+    mapfile -t logs < <(find "${catalyst_tmp}" "${find_flags[@]}")
+    for l in "${logs[@]}"; do
+        d=${l#"${catalyst_tmp}"}
+        d=${d#/}
+        if [[ ${d} = */* ]]; then
+            d=${d%/*}
+            mkdir -p "${logdir}/config-logs/${d}"
+        else
+            d='.'
+        fi
+        cp -a "${l}" "${logdir}/config-logs/${d}"
+    done
+    if dir_contains_globs "${logdir}" '*'; then
+        (
+            cd "${logdir}"
+            tar -cJf "${logs_tarball}" *
+            create_digests "${SIGNER}" "${logs_tarball}"
+            sign_artifacts "${SIGNER}" "${logs_tarball}"*
+            copy_to_buildcache "build-logs/${FLATCAR_SDK_VERSION}" "${logs_tarball}"*
+        )
+    fi
+    upload_fail_logs
+    if [[ -n ${failed} ]]; then exit 1; fi
 }
 # --
diff --git a/ci-automation/sdk_container.sh b/ci-automation/sdk_container.sh
index e3875581912..088826a3a7f 100644
--- a/ci-automation/sdk_container.sh
+++ b/ci-automation/sdk_container.sh
@@ -66,12 +66,35 @@ function _sdk_container_build_impl() {
 
 
     # This will update the SDK_VERSION in versionfile
-    ./build_sdk_container_image -x ./ci-cleanup.sh ./__build__/"${sdk_tarball}"
+    logdir=__build__/sdk-container-logs-to-upload
+    mkdir -p "${logdir}"
+    local failed=''
+    local logs_tarball="sdk-container-logs-${ARCH}-$(date --utc '+%F-%H%M-%S').tar.xz"
+    ./build_sdk_container_image -l "${PWD}/${logdir}" -x ./ci-cleanup.sh ./__build__/"${sdk_tarball}" || failed=x
 
-    # push artifacts to build cache
-    local docker_vernum="$(vernum_to_docker_image_version "${vernum}")"
-    docker_image_to_buildcache "${CONTAINER_REGISTRY}/flatcar-sdk-all" "${docker_vernum}"
-    docker_image_to_buildcache "${CONTAINER_REGISTRY}/flatcar-sdk-amd64" "${docker_vernum}"
-    docker_image_to_buildcache "${CONTAINER_REGISTRY}/flatcar-sdk-arm64" "${docker_vernum}"
+    if [[ -z ${failed} ]]; then
+        # push artifacts to build cache
+        local docker_vernum="$(vernum_to_docker_image_version "${vernum}")"
+        docker_image_to_buildcache "${CONTAINER_REGISTRY}/flatcar-sdk-all" "${docker_vernum}"
+        docker_image_to_buildcache "${CONTAINER_REGISTRY}/flatcar-sdk-amd64" "${docker_vernum}"
+        docker_image_to_buildcache "${CONTAINER_REGISTRY}/flatcar-sdk-arm64" "${docker_vernum}"
+    fi
+    local uid
+    local gid
+    uid=$(id --user)
+    gid=$(id --group)
+    sudo chown --recursive "${uid}:${gid}" "${logdir}"
+    chmod --recursive a+rX,u+w "${logdir}"
+    if dir_contains_globs "${logdir}" '*'; then
+        (
+            cd "${logdir}"
+            tar -cJf "${logs_tarball}" *
+            create_digests "${SIGNER}" "${logs_tarball}"
+            sign_artifacts "${SIGNER}" "${logs_tarball}"*
+            copy_to_buildcache "build-logs/${FLATCAR_SDK_VERSION}" "${logs_tarball}"*
+        )
+    fi
+    upload_fail_logs
+    if [[ -n ${failed} ]]; then exit 1; fi
 }
 # --
diff --git a/common.sh b/common.sh
index 3dbb8040dc3..882b9f92f7b 100644
--- a/common.sh
+++ b/common.sh
@@ -165,39 +165,26 @@ die_notrace() {
     error "${DIE_PREFIX}${line}"
   done
   if [[ ! -e "${SCRIPTS_DIR}/NO_DEBUG_OUTPUT_DELETE_ME" ]]; then
-      error "${DIE_PREFIX}!!!!!!!!!!!!!!!!!!!!!!!!!"
-      error "${DIE_PREFIX}!! BEGIN DEBUG OUTPUT: !!"
-      error "${DIE_PREFIX}!!!!!!!!!!!!!!!!!!!!!!!!!"
-      error
-      error "${DIE_PREFIX}== MOUNT =="
-      error "${DIE_PREFIX}==========="
-      error_command_output "${DIE_PREFIX}" mount
-      error
-      error "${DIE_PREFIX}== DF =="
-      error "${DIE_PREFIX}========"
-      error_command_output "${DIE_PREFIX}" df -h
-      error
-      error "${DIE_PREFIX}== DMESG =="
-      error "${DIE_PREFIX}==========="
-      error_command_output "${DIE_PREFIX}" sudo dmesg
-      error
-      error "${DIE_PREFIX}!!!!!!!!!!!!!!!!!!!!!!!"
-      error "${DIE_PREFIX}!! END DEBUG OUTPUT: !!"
-      error "${DIE_PREFIX}!!!!!!!!!!!!!!!!!!!!!!!"
+      local failfile="debug-fail-logs-$(date --utc '+%F-%H%M-%S').log"
+      error "${DIE_PREFIX}debug fail logs saved in ${failfile@Q}"
+      {
+          echo "== MOUNT =="
+          echo "==========="
+          sudo mount 2>&1
+          echo
+          echo "== DF =="
+          echo "========"
+          sudo df -h 2>&1
+          echo
+          echo "== DMESG =="
+          echo "==========="
+          sudo dmesg 2>&1
+      } >"${SCRIPTS_DIR}/${failfile}"
       touch "${SCRIPTS_DIR}/NO_DEBUG_OUTPUT_DELETE_ME"
   fi
   exit 1
 }
 
-error_command_output() {
-    local prefix=${1}; shift
-    # rest are a command to execute
-    local REPLY
-    while read -r; do
-        error "${prefix}${REPLY}"
-    done < <("${@}" 2>&1)
-}
-
 # Simple version comparison routine
 # Note: not a true semver comparison and build revisions are ignored
 cmp_ver() {
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1-r318.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1-r319.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1-r318.ebuild
rename to sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1-r319.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild
index 22564c301cc..676486a5db6 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild
@@ -78,6 +78,24 @@ RDEPEND="${RDEPEND}
 		app-emulation/xenstore
 	)"
 
+# Some SELinux base policies. Policies under "selinux?" are for
+# sysexts.
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-base
+	sec-policy/selinux-base-policy
+	sec-policy/selinux-container
+	sec-policy/selinux-dbus
+	sec-policy/selinux-policykit
+	sec-policy/selinux-unconfined
+	selinux? (
+		sec-policy/selinux-chronyd
+		sec-policy/selinux-dnsmasq
+		sec-policy/selinux-docker
+		sec-policy/selinux-podman
+		sec-policy/selinux-zfs
+	)
+"
+
 # sys-devel/gettext: it embeds 'envsubst' binary which is useful for simple file templating.
 RDEPEND="${RDEPEND}
 	app-admin/etcd-wrapper
@@ -145,12 +163,6 @@ RDEPEND="${RDEPEND}
 	net-misc/wget
 	net-misc/whois
 	net-vpn/wireguard-tools
-	sec-policy/selinux-base
-	sec-policy/selinux-base-policy
-	sec-policy/selinux-container
-	sec-policy/selinux-dbus
-	sec-policy/selinux-policykit
-	sec-policy/selinux-unconfined
 	sys-apps/acl
 	sys-apps/attr
 	sys-apps/azure-vm-utils
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-admin/sudo b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-admin/sudo
index 3bd9e65f866..c6dac3e8506 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-admin/sudo
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-admin/sudo
@@ -11,7 +11,4 @@ cros_post_src_install_flatcar_modifications() {
 
 # We don't ship OpenLDAP schemas (why?) and we provide sudo.conf
 # through baselayout.
-sudo_install_mask='/etc/openldap/schema /etc/sudo.conf'
-INSTALL_MASK+=" ${sudo_install_mask}"
-PKG_INSTALL_MASK+=" ${sudo_install_mask}"
-unset sudo_install_mask
+INSTALL_MASK+=' /etc/openldap/schema /etc/sudo.conf '
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-containers/syft b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-containers/syft
index 23f700402eb..74f5a47797f 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-containers/syft
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-containers/syft
@@ -1,5 +1,2 @@
 # there are only examples installed
-syft_install_mask=" /usr/share/syft/examples "
-INSTALL_MASK+="${syft_install_mask}"
-PKG_INSTALL_MASK+="${syft_install_mask}"
-unset syft_install_mask
+INSTALL_MASK+=' /usr/share/syft/examples '
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/dev-libs/glib b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/dev-libs/glib
index e6388c51ad1..be015877fb0 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/dev-libs/glib
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/dev-libs/glib
@@ -1,7 +1,4 @@
 # Do not install gobject-introspection binaries in production images.
 if [[ $(flatcar_target) != 'sdk' ]] ; then
-	glib_mask="/usr/bin/gi-* /usr/lib*/libgirepository-2.0*"
-	PKG_INSTALL_MASK+=" ${glib_mask}"
-	INSTALL_MASK+=" ${glib_mask}"
-	unset glib_mask
+	INSTALL_MASK+=" /usr/bin/gi-* /usr/lib*/libgirepository-2.0* "
 fi
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-dns/bind b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-dns/bind
index b7c8dd0b88e..1873ad91a04 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-dns/bind
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-dns/bind
@@ -1,5 +1,5 @@
 # Keep only tool binaries and libraries those binaries need.
-ndb_install_mask="
+INSTALL_MASK+="
         /etc
         /var
         /usr/bin/arpaname
@@ -13,11 +13,6 @@ ndb_install_mask="
         /usr/sbin
 "
 
-INSTALL_MASK+="${ndb_install_mask}"
-PKG_INSTALL_MASK+="${ndb_install_mask}"
-
-unset ndb_install_mask
-
 # Override fowners to ignore changing owner or group to named. The
 # only files that this happens for are files that we have put into
 # {PKG_,}INSTALL_MASK. This will help us avoid installing
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-fs/nfs-utils b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-fs/nfs-utils
index e073862b5b9..d632a7f99d0 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-fs/nfs-utils
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-fs/nfs-utils
@@ -1,7 +1,4 @@
-nfs_utils_install_mask=" /etc/exports /etc/exports.d "
-INSTALL_MASK+=${nfs_utils_install_mask}
-PKG_INSTALL_MASK+=${nfs_utils_install_mask}
-unset nfs_utils_install_mask
+INSTALL_MASK+=" /etc/exports /etc/exports.d "
 
 cros_post_src_install_nfs_utils_flatcar_modifications() {
     (
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/ntp b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/ntp
index bc72eb5c0a1..ea84736a5af 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/ntp
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/ntp
@@ -1,15 +1,12 @@
-ntp_install_mask=''
-# Do not install ntpdate or sntp systemd files in /etc.
-ntp_install_mask+=" /etc/systemd"
-# Do not install the default ntp.conf, we provide our own in
-# coreos-base/misc-files.
-ntp_install_mask+=" /etc/ntp.conf"
-# Do not install perl scripts to /usr/bin.
-ntp_install_mask+=" /usr/bin/calc_tickadj /usr/bin/ntp-wait /usr/bin/ntptrace /usr/bin/update-leap"
-# Do not install perl package to /usr/share/ntp.
-ntp_install_mask+=" /usr/share/ntp"
-
-ntp_install_mask+=' '
-INSTALL_MASK+=${ntp_install_mask}
-PKG_INSTALL_MASK+=${ntp_install_mask}
-unset ntp_install_mask
+# Do not install:
+#
+# - ntpdate or sntp systemd files in /etc,
+# - the default ntp.conf, we provide our own in coreos-base/misc-files,
+# - perl scripts to /usr/bin,
+# - perl package to /usr/share/ntp
+INSTALL_MASK+="
+        /etc/systemd
+        /etc/ntp.conf
+        /usr/bin/calc_tickadj /usr/bin/ntp-wait /usr/bin/ntptrace /usr/bin/update-leap
+        /usr/share/ntp
+"
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh
index 77a32cfa39c..2f5c00289d5 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh
@@ -3,10 +3,7 @@
 # Do not install the config snippet that defines a subsystem. We have
 # our own definition in coreos-init.
 if [[ $(flatcar_target) != 'sdk' ]] ; then
-	openssh_mask=" /usr/lib*/misc/ssh-keysign /etc/ssh/sshd_config.d/*gentoo-subsystem.conf "
-	PKG_INSTALL_MASK+="${openssh_mask}"
-	INSTALL_MASK+="${openssh_mask}"
-	unset openssh_mask
+	INSTALL_MASK+=" /usr/lib*/misc/ssh-keysign /etc/ssh/sshd_config.d/*gentoo-subsystem.conf "
 fi
 
 cros_post_src_install_vendorize_pam() {
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/lsb-release b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/lsb-release
index 3f4831cb457..3418a654ad2 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/lsb-release
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/lsb-release
@@ -1,4 +1 @@
-lsb_release_install_mask=" /etc/lsb-release "
-INSTALL_MASK+="${lsb_release_install_mask}"
-PKG_INSTALL_MASK+="${lsb_release_install_mask}"
-unset lsb_release_install_mask
+INSTALL_MASK+=" /etc/lsb-release "
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/policycoreutils b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/policycoreutils
index 8b6c1ef2cdd..22d367edc19 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/policycoreutils
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/policycoreutils
@@ -18,3 +18,15 @@ cros_post_src_install_set_up_var_lib_selinux() {
 cros_post_src_install_vendorize_pam() {
     vendorize_pam_files
 }
+
+# Do not install python stuff in prod images.
+if [[ $(flatcar_target) = 'generic-prod' ]]; then
+    INSTALL_MASK+=" /usr/lib/python-exec "
+fi
+
+# INSTALL_MASK does not work on symlinks.
+cros_post_pkg_postinst_drop_rlpkg_symlink() {
+    if [[ $(flatcar_target) = 'generic-prod' ]]; then
+        rm -f "${ROOT}"/usr/sbin/rlpkg
+    fi
+}
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/systemd b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/systemd
index defe7e8d0ba..00e127fec25 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/systemd
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/systemd
@@ -91,10 +91,13 @@ cros_post_src_install_flatcar_stuff() {
         # with our own.
         newpamd - "systemd-user" <<'EOF'
 account include system-auth
+session required pam_selinux.so close
+session required pam_selinux.so nottys open
 session include system-login
 EOF
         newpamd - "systemd-run0" <<'EOF'
 account include system-auth
+session include system-selinux
 session include system-login
 EOF
 
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-boot/grub b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-boot/grub
index 932b56a9431..b8d7d082f52 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-boot/grub
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-boot/grub
@@ -48,9 +48,6 @@ cros_post_src_install_sbat() {
 	EOF
 }
 
-# Flatcar does not use grub-install or grub-mkconfig. All the files under /etc
-# relate to grub-mkconfig.
-grub_install_mask=" ${EPREFIX}/etc/ *grub-install* *mkconfig* "
-INSTALL_MASK+="${grub_install_mask}"
-PKG_INSTALL_MASK+="${grub_install_mask}"
-unset grub_install_mask
+# Flatcar does not use grub-install or grub-mkconfig. All the files
+# under /etc relate to grub-mkconfig.
+INSTALL_MASK+=" ${EPREFIX}/etc/ *grub-install* *mkconfig* "
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libselinux b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libselinux
new file mode 100644
index 00000000000..5bd252142b1
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libselinux
@@ -0,0 +1,3 @@
+if [[ $(flatcar_target) = 'generic-prod' ]]; then
+    INSTALL_MASK+=" /usr/lib/python* "
+fi
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libsemanage b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libsemanage
new file mode 100644
index 00000000000..b2c9deab5bb
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libsemanage
@@ -0,0 +1,17 @@
+# A hack to modify semanage.conf before it gets copied by
+# multilib_copy_sources.
+if declare -pf multilib_copy_sources >/dev/null 2>/dev/null; then
+    if ! declare -pf flatcar_hacked_multilib_copy_sources >/dev/null 2>&1; then
+        eval "$(echo 'flatcar_hacked_multilib_copy_sources()'; declare -pf multilib_copy_sources | tail -n +2)"
+    fi
+    multilib_copy_sources() {
+        # Enable compression in semanage.conf
+        sed -i \
+            -e 's/^\(bzip-blocksize\)=0/\1=1/' \
+            "${S}/src/semanage.conf"
+        flatcar_hacked_multilib_copy_sources "${@}"
+    }
+fi
+if [[ $(flatcar_target) = 'generic-prod' ]]; then
+    INSTALL_MASK+=" /usr/lib/python* "
+fi
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit
index 52fc0e0aad4..22abec26e00 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit
@@ -1,7 +1,8 @@
 # Do not install Gentoo-provided audit rules, we will install our own
 # in coreos-base/misc-files. Also skip installing legacy initscripts
 # stuff in /usr/libexec.
-audit_install_mask=" /etc/audit/audit.rules* /usr/libexec "
-INSTALL_MASK+="${audit_install_mask}"
-PKG_INSTALL_MASK+="${audit_install_mask}"
-unset audit_install_mask
+INSTALL_MASK+=" /etc/audit/audit.rules* /usr/libexec "
+# Skip installing python stuff in production images
+if [[ $(flatcar_target) = 'generic-prod' ]]; then
+    INSTALL_MASK+=" /usr/lib/python* "
+fi
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/flatcar-selinux-patches/0001-Flatcar-modifications.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/flatcar-selinux-patches/0001-Flatcar-modifications.patch
index cd57e4dff7a..3c3c1e71701 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/flatcar-selinux-patches/0001-Flatcar-modifications.patch
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/flatcar-selinux-patches/0001-Flatcar-modifications.patch
@@ -1,4 +1,4 @@
-From 9398464fe4d29cb3e9ad3c04c2c749747438fb65 Mon Sep 17 00:00:00 2001
+From 0bb1c5df7cc2066c59d2a15562d6e011c2faef2a Mon Sep 17 00:00:00 2001
 From: Krzesimir Nowak <knowak@microsoft.com>
 Date: Mon, 4 Dec 2023 12:17:25 +0100
 Subject: [PATCH] Flatcar modifications
@@ -11,10 +11,12 @@ Subject: [PATCH] Flatcar modifications
  policy/modules/kernel/kernel.te         | 125 +++++++++++++++++
  policy/modules/services/container.fc    |   6 +
  policy/modules/services/container.te    | 170 +++++++++++++++++++++++-
+ policy/modules/services/ssh.fc          |   1 +
  policy/modules/system/init.te           |   8 ++
  policy/modules/system/locallogin.te     |   9 +-
  policy/modules/system/logging.te        |   9 ++
- 10 files changed, 427 insertions(+), 3 deletions(-)
+ policy/modules/system/systemd.fc        |  12 ++
+ 12 files changed, 440 insertions(+), 3 deletions(-)
 
 diff --git a/refpolicy/policy/modules/admin/netutils.te b/refpolicy/policy/modules/admin/netutils.te
 index 63d2f9cb8..62dff5f94 100644
@@ -512,6 +514,18 @@ index c71ae54f4..a231f7664 100644
 +# avc:  denied  { read } for  pid=[0-9]* comm="echo, sleep, whatever" path="/lib64/libc.so.6" dev="vda9" ino=[0-9]* scontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tcontext=system_u:object_r:tmp_t:s0 tclass=file permissive=0
 +#
 +allow container_t tmp_t:file { read };
+diff --git a/refpolicy/policy/modules/services/ssh.fc b/refpolicy/policy/modules/services/ssh.fc
+index 93bfa8d26..aaa2e12ac 100644
+--- a/refpolicy/policy/modules/services/ssh.fc
++++ b/refpolicy/policy/modules/services/ssh.fc
+@@ -8,6 +8,7 @@ HOME_DIR/\.ssh(/.*)?			gen_context(system_u:object_r:ssh_home_t,s0)
+ /usr/bin/ssh-keygen		--	gen_context(system_u:object_r:ssh_keygen_exec_t,s0)
+ /usr/bin/sshd			--	gen_context(system_u:object_r:sshd_exec_t,s0)
+ 
++/usr/lib/misc/sshd-auth		--	gen_context(system_u:object_r:sshd_exec_t,s0)
+ /usr/lib/misc/sshd-session	--	gen_context(system_u:object_r:sshd_exec_t,s0)
+ /usr/lib/openssh/ssh-keysign	--	gen_context(system_u:object_r:ssh_keysign_exec_t,s0)
+ /usr/lib/openssh/sshd-session	--	gen_context(system_u:object_r:sshd_exec_t,s0)
 diff --git a/refpolicy/policy/modules/system/init.te b/refpolicy/policy/modules/system/init.te
 index 1320f7aae..61ead9795 100644
 --- a/refpolicy/policy/modules/system/init.te
@@ -568,6 +582,29 @@ index 14d3132be..ce40abc52 100644
  	allow syslogd_t self:capability audit_control;
  	allow syslogd_t self:netlink_audit_socket connected_socket_perms;
  	allow syslogd_t self:capability2 audit_read;
+diff --git a/refpolicy/policy/modules/system/systemd.fc b/refpolicy/policy/modules/system/systemd.fc
+index c648266c1..e19e1d07a 100644
+--- a/refpolicy/policy/modules/system/systemd.fc
++++ b/refpolicy/policy/modules/system/systemd.fc
+@@ -123,6 +123,18 @@ HOME_ROOT/.+\.home	--	gen_context(system_u:object_r:systemd_homed_storage_t,s0)
+ /run/systemd/seats(/.*)?	gen_context(system_u:object_r:systemd_sessions_runtime_t,s0)
+ /run/systemd/sessions(/.*)?	gen_context(system_u:object_r:systemd_sessions_runtime_t,s0)
+ /run/systemd/shutdown(/.*)?	gen_context(system_u:object_r:systemd_logind_runtime_t,s0)
++#
++# FLATCAR:
++#
++# This is to fix a label of a merged filesystem.
++#
++/run/systemd/sysext/meta/usr	-d	gen_context(system_u:object_r:usr_t,s0)
++/run/systemd/sysext/meta/opt	-d	gen_context(system_u:object_r:usr_t,s0)
++/run/systemd/sysext/usr	-d	gen_context(system_u:object_r:usr_t,s0)
++/run/systemd/sysext/opt	-d	gen_context(system_u:object_r:usr_t,s0)
++/var/lib/extensions.mutable/usr	-d	gen_context(system_u:object_r:usr_t,s0)
++/var/lib/extensions.mutable/opt	-d	gen_context(system_u:object_r:usr_t,s0)
++
+ /run/systemd/users(/.*)?	gen_context(system_u:object_r:systemd_logind_runtime_t,s0)
+ /run/systemd/userdb(/.*)?	gen_context(system_u:object_r:systemd_userdbd_runtime_t,s0)
+ /run/systemd/inhibit(/.*)?	gen_context(system_u:object_r:systemd_logind_inhibit_runtime_t,s0)
 -- 
 2.49.1
 
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-apache b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-apache
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-apache
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-apm b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-apm
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-apm
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-bind b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-bind
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-bind
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-brctl b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-brctl
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-brctl
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-cdrecord b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-cdrecord
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-cdrecord
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-chronyd b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-chronyd
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-chronyd
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-dirmngr b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-dirmngr
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-dirmngr
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-dnsmasq b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-dnsmasq
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-dnsmasq
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-docker b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-docker
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-docker
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-dracut b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-dracut
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-dracut
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-git b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-git
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-git
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-gpg b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-gpg
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-gpg
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-kdump b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-kdump
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-kdump
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-kerberos b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-kerberos
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-kerberos
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-ldap b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-ldap
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-ldap
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-loadkeys b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-loadkeys
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-loadkeys
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-logrotate b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-logrotate
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-logrotate
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-makewhatis b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-makewhatis
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-makewhatis
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-mandb b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-mandb
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-mandb
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-ntp b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-ntp
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-ntp
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-pcscd b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-pcscd
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-pcscd
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-podman b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-podman
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-podman
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-qemu b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-qemu
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-qemu
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-quota b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-quota
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-quota
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-rpc b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-rpc
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-rpc
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-rpcbind b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-rpcbind
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-rpcbind
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-samba b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-samba
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-samba
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-sasl b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-sasl
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-sasl
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-smartmon b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-smartmon
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-smartmon
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-sudo b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-sudo
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-sudo
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-tcsd b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-tcsd
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-tcsd
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-virt b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-virt
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-virt
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-wireguard b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-wireguard
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-wireguard
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-xfs b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-xfs
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-xfs
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-zfs b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-zfs
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-zfs
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0001-wait-online-set-any-by-default.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0001-wait-online-set-any-by-default.patch
index 1ba8f645005..843b442bded 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0001-wait-online-set-any-by-default.patch
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0001-wait-online-set-any-by-default.patch
@@ -1,7 +1,7 @@
 From 83043596b6cc74b6f049999fa660afd983dc493a Mon Sep 17 00:00:00 2001
 From: David Michael <dm0@redhat.com>
 Date: Tue, 16 Apr 2019 02:44:51 +0000
-Subject: [PATCH 1/8] wait-online: set --any by default
+Subject: [PATCH 1/6] wait-online: set --any by default
 
 The systemd-networkd-wait-online command would normally continue
 waiting after a network interface is usable if other interfaces are
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0002-needs-update-don-t-require-strictly-newer-usr.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0002-needs-update-don-t-require-strictly-newer-usr.patch
index ad1045e8b1d..14bfaaea009 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0002-needs-update-don-t-require-strictly-newer-usr.patch
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0002-needs-update-don-t-require-strictly-newer-usr.patch
@@ -1,7 +1,7 @@
 From 3d6bfde35c8ce5c21ca55104852a319246a92bb8 Mon Sep 17 00:00:00 2001
 From: Alex Crawford <alex.crawford@coreos.com>
 Date: Wed, 2 Mar 2016 10:46:33 -0800
-Subject: [PATCH 2/8] needs-update: don't require strictly newer usr
+Subject: [PATCH 2/6] needs-update: don't require strictly newer usr
 
 Updates should be triggered whenever usr changes, not only when it is newer.
 ---
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0003-core-use-max-for-DefaultTasksMax.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0003-core-use-max-for-DefaultTasksMax.patch
index c5c316fe6ad..223828de299 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0003-core-use-max-for-DefaultTasksMax.patch
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0003-core-use-max-for-DefaultTasksMax.patch
@@ -1,7 +1,7 @@
 From 6f691278df570cc87cb863a98fe320a1997c6dad Mon Sep 17 00:00:00 2001
 From: Adrian Vladu <avladu@cloudbasesolutions.com>
 Date: Fri, 16 Feb 2024 11:22:08 +0000
-Subject: [PATCH 3/8] core: use max for DefaultTasksMax
+Subject: [PATCH 3/6] core: use max for DefaultTasksMax
 
 Since systemd v228, systemd has a DefaultTasksMax which defaulted
 to 512, later 15% of the system's maximum number of PIDs.  This
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0004-systemd-Disable-SELinux-permissions-checks.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0004-systemd-Disable-SELinux-permissions-checks.patch
deleted file mode 100644
index 6949d9fc5e6..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0004-systemd-Disable-SELinux-permissions-checks.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 78b2d8b1a6df073003d64cffa532c3a320e96ad4 Mon Sep 17 00:00:00 2001
-From: Matthew Garrett <mjg59@coreos.com>
-Date: Tue, 20 Dec 2016 16:43:22 +0000
-Subject: [PATCH 4/8] systemd: Disable SELinux permissions checks
-
-We don't care about the interaction between systemd and SELinux policy, so
-let's just disable these checks rather than having to incorporate policy
-support. This has no impact on our SELinux use-case, which is purely intended
-to limit containers and not anything running directly on the host.
----
- src/core/selinux-access.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c
-index a67a520a3b..3365b920eb 100644
---- a/src/core/selinux-access.c
-+++ b/src/core/selinux-access.c
-@@ -2,7 +2,7 @@
- 
- #include "selinux-access.h"
- 
--#if HAVE_SELINUX
-+#if 0
- 
- #include <errno.h>
- #include <selinux/avc.h>
--- 
-2.51.0
-
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0006-units-Keep-using-old-journal-file-format.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0004-units-Keep-using-old-journal-file-format.patch
similarity index 92%
rename from sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0006-units-Keep-using-old-journal-file-format.patch
rename to sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0004-units-Keep-using-old-journal-file-format.patch
index 9a3456cc510..5b04e4f1d5c 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0006-units-Keep-using-old-journal-file-format.patch
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0004-units-Keep-using-old-journal-file-format.patch
@@ -1,7 +1,7 @@
-From c2924cc57c9e4aa836021ec2567c0fdbebecf944 Mon Sep 17 00:00:00 2001
+From 5fd281e6cf3b1d5fdd4943a5629e67572391d4bc Mon Sep 17 00:00:00 2001
 From: Adrian Vladu <avladu@cloudbasesolutions.com>
 Date: Fri, 16 Feb 2024 11:29:04 +0000
-Subject: [PATCH 6/8] units: Keep using old journal file format
+Subject: [PATCH 4/6] units: Keep using old journal file format
 
 Systemd 252 made an incompatible change in journal file format. Temporarily
 force journald to use the old journal format to give logging containers more
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0005-Revert-getty-Pass-tty-to-use-by-agetty-via-stdin.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0005-Revert-getty-Pass-tty-to-use-by-agetty-via-stdin.patch
deleted file mode 100644
index d380b96a9cc..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0005-Revert-getty-Pass-tty-to-use-by-agetty-via-stdin.patch
+++ /dev/null
@@ -1,95 +0,0 @@
-From 8064e1544a2b89f8389c0469ed4879a287a045a7 Mon Sep 17 00:00:00 2001
-From: Sayan Chowdhury <schowdhury@microsoft.com>
-Date: Fri, 16 Dec 2022 16:28:26 +0530
-Subject: [PATCH 5/8] Revert "getty: Pass tty to use by agetty via stdin"
-
-This reverts commit b4bf9007cbee7dc0b1356897344ae2a7890df84c.
-
-This is to work around a SELinux denial that happens when setting up standard
-input for serial consoles (which is used for SSH connections).
-
-Signed-off-by: Sayan Chowdhury <schowdhury@microsoft.com>
----
- units/console-getty.service.in    | 4 +---
- units/container-getty@.service.in | 4 +---
- units/getty@.service.in           | 4 +---
- units/serial-getty@.service.in    | 4 +---
- 4 files changed, 4 insertions(+), 12 deletions(-)
-
-diff --git a/units/console-getty.service.in b/units/console-getty.service.in
-index 33e6368db1..1f2d8b910f 100644
---- a/units/console-getty.service.in
-+++ b/units/console-getty.service.in
-@@ -22,12 +22,10 @@ ConditionPathExists=/dev/console
- [Service]
- # The '-o' option value tells agetty to replace 'login' arguments with '--' for
- # safety, and then the entered username.
--ExecStart=-/sbin/agetty -o '-- \\u' --noreset --noclear --keep-baud 115200,57600,38400,9600 - ${TERM}
-+ExecStart=-/sbin/agetty -o '-- \\u' --noreset --noclear --keep-baud 115200,57600,38400,9600 console ${TERM}
- Type=idle
- Restart=always
- UtmpIdentifier=cons
--StandardInput=tty
--StandardOutput=tty
- TTYPath=/dev/console
- TTYReset=yes
- TTYVHangup=yes
-diff --git a/units/container-getty@.service.in b/units/container-getty@.service.in
-index 7573532d6d..5f27653d1f 100644
---- a/units/container-getty@.service.in
-+++ b/units/container-getty@.service.in
-@@ -27,13 +27,11 @@ Before=rescue.service
- [Service]
- # The '-o' option value tells agetty to replace 'login' arguments with '--' for
- # safety, and then the entered username.
--ExecStart=-/sbin/agetty -o '-- \\u' --noreset --noclear - ${TERM}
-+ExecStart=-/sbin/agetty -o '-- \\u' --noreset --noclear pts/%I ${TERM}
- Type=idle
- Restart=always
- RestartSec=0
- UtmpIdentifier=pts/%I
--StandardInput=tty
--StandardOutput=tty
- TTYPath=/dev/pts/%I
- TTYReset=yes
- TTYVHangup=yes
-diff --git a/units/getty@.service.in b/units/getty@.service.in
-index f30bba406d..1819627d1c 100644
---- a/units/getty@.service.in
-+++ b/units/getty@.service.in
-@@ -36,13 +36,11 @@ ConditionPathExists=/dev/tty0
- [Service]
- # The '-o' option value tells agetty to replace 'login' arguments with '--' for
- # safety, and then the entered username.
--ExecStart=-/sbin/agetty -o '-- \\u' --noreset --noclear - ${TERM}
-+ExecStart=-/sbin/agetty -o '-- \\u' --noreset --noclear %I ${TERM}
- Type=idle
- Restart=always
- RestartSec=0
- UtmpIdentifier=%I
--StandardInput=tty
--StandardOutput=tty
- TTYPath=/dev/%I
- TTYReset=yes
- TTYVHangup=yes
-diff --git a/units/serial-getty@.service.in b/units/serial-getty@.service.in
-index 20a5eb2754..ba4cbc0edb 100644
---- a/units/serial-getty@.service.in
-+++ b/units/serial-getty@.service.in
-@@ -32,12 +32,10 @@ Before=rescue.service
- [Service]
- # The '-o' option value tells agetty to replace 'login' arguments with '--' for
- # safety, and then the entered username.
--ExecStart=-/sbin/agetty -o '-- \\u' --noreset --noclear --keep-baud 115200,57600,38400,9600 - ${TERM}
-+ExecStart=-/sbin/agetty -o '-- \\u' --noreset --noclear --keep-baud 115200,57600,38400,9600 %I ${TERM}
- Type=idle
- Restart=always
- UtmpIdentifier=%I
--StandardInput=tty
--StandardOutput=tty
- TTYPath=/dev/%I
- TTYReset=yes
- TTYVHangup=yes
--- 
-2.51.0
-
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0007-tmpfiles.d-Fix-DNS-issues-with-default-k8s-configura.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0005-tmpfiles.d-Fix-DNS-issues-with-default-k8s-configura.patch
similarity index 91%
rename from sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0007-tmpfiles.d-Fix-DNS-issues-with-default-k8s-configura.patch
rename to sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0005-tmpfiles.d-Fix-DNS-issues-with-default-k8s-configura.patch
index ec1ef720251..0a73bc38680 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0007-tmpfiles.d-Fix-DNS-issues-with-default-k8s-configura.patch
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0005-tmpfiles.d-Fix-DNS-issues-with-default-k8s-configura.patch
@@ -1,7 +1,7 @@
-From 7ee314dc08ea65e6951c7007a5f872fd32f0399a Mon Sep 17 00:00:00 2001
+From 90d58a22d1be1629c36ad7fc0826c1a163b20262 Mon Sep 17 00:00:00 2001
 From: Krzesimir Nowak <knowak@microsoft.com>
 Date: Wed, 22 Oct 2025 10:39:42 +0200
-Subject: [PATCH 7/8] tmpfiles.d: Fix DNS issues with default k8s configuration
+Subject: [PATCH 5/6] tmpfiles.d: Fix DNS issues with default k8s configuration
 
 The Kubelet takes /etc/resolv.conf for, e.g., CoreDNS which has dnsPolicy
 "default", but unless the kubelet `--resolv-conf` flag is set to point to
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0008-units-Make-multi-user.target-the-default-target.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0006-units-Make-multi-user.target-the-default-target.patch
similarity index 90%
rename from sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0008-units-Make-multi-user.target-the-default-target.patch
rename to sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0006-units-Make-multi-user.target-the-default-target.patch
index de0aa6eb46e..92e782b60ae 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0008-units-Make-multi-user.target-the-default-target.patch
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0006-units-Make-multi-user.target-the-default-target.patch
@@ -1,7 +1,7 @@
-From f0ab1c6c59056afe1650f749d1af6ecc6ee8f5ec Mon Sep 17 00:00:00 2001
+From e8dd05237ac4a454a5b6c89be895f0d17540efc2 Mon Sep 17 00:00:00 2001
 From: Krzesimir Nowak <knowak@microsoft.com>
 Date: Fri, 24 Oct 2025 11:06:57 +0200
-Subject: [PATCH 8/8] units: Make multi-user.target the default target
+Subject: [PATCH 6/6] units: Make multi-user.target the default target
 
 Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
 ---
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/README.md b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/README.md
index 643b45fdafc..8bbdeb9e987 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/README.md
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/README.md
@@ -6,15 +6,9 @@ Most of these patches are not really upstreamable.
   - trigger updates only when /usr changes
 - `0003-core-use-max-for-DefaultTasksMax.patch`
   - increase the too-low limits
-- `0004-systemd-Disable-SELinux-permissions-checks.patch`
-  - disable interactions between systemd and SELinux policies
-  - this will be dropped when we increase SELinux coverage also to a host system
-- `0005-Revert-getty-Pass-tty-to-use-by-agetty-via-stdin.patch`
-  - SELinux denial workaround
-  - this will be dropped when we increase SELinux coverage also to a host system
-- `0006-units-Keep-using-old-journal-file-format.patch`
+- `0004-units-Keep-using-old-journal-file-format.patch`
   - backward compat stuff
-- `0007-tmpfiles.d-Fix-DNS-issues-with-default-k8s-configura.patch`
+- `0005-tmpfiles.d-Fix-DNS-issues-with-default-k8s-configura.patch`
   - workaround for issues with default k8s coredns config
-- `0008-units-Make-multi-user.target-the-default-target.patch`
+- `0006-units-Make-multi-user.target-the-default-target.patch`
   - change default.target to a suitable symlink for Flatcar
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-devel/crossdev/0001-Mask-selinux-when-building-glibc.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-devel/crossdev/0001-Mask-selinux-when-building-glibc.patch
new file mode 100644
index 00000000000..506f34b7c09
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-devel/crossdev/0001-Mask-selinux-when-building-glibc.patch
@@ -0,0 +1,33 @@
+From dbd686eb40a1d7e8ac1daeb46d1deab32214fcac Mon Sep 17 00:00:00 2001
+From: Krzesimir Nowak <knowak@microsoft.com>
+Date: Mon, 8 Sep 2025 14:02:29 +0200
+Subject: [PATCH] Mask selinux when building glibc
+
+Disabling selinux via USE=-selinux may not work, if the profile forces
+it.
+---
+ crossdev | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/crossdev b/crossdev
+index 1e5c4ac..e150d30 100755
+--- a/crossdev
++++ b/crossdev
+@@ -1585,6 +1585,14 @@ for f in package.{accept_keywords,env,mask,use} env/${CROSSDEV_OVERLAY_CATEGORY}
+ 	rm -f "${f}/${CROSSDEV_OVERLAY_CATEGORY}"
+ done
+ 
++# selinux won't work in bootstrap environment - libselinux may not be
++# available, need to mask selinux since it could be forced by the
++# profile
++if [[ ${LPKG} = 'glibc' ]]; then
++    LMASK+=" selinux"
++    LFORCE+=" -selinux"
++fi
++
+ pkglist=( K L )
+ if [[ ${LLVM} == "yes" ]] ; then
+ 	pkglist+=( R C )
+-- 
+2.49.1
+
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-devel/crossdev/README.md b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-devel/crossdev/README.md
new file mode 100644
index 00000000000..3a2d259c70c
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-devel/crossdev/README.md
@@ -0,0 +1,2 @@
+This patch should be upstreamed when we can confirm that it works with
+our modification to the glibc ebuild.
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-libs/libsemanage/README.md b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-libs/libsemanage/README.md
deleted file mode 100644
index a3e6280660b..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-libs/libsemanage/README.md
+++ /dev/null
@@ -1,4 +0,0 @@
-We have a patch that modifies the semanage.conf file that is
-previously modified by the Gentoo ebuild. The patch enables the
-SELinux module compression to save some disk space (the modules went
-from 33MB to 3MB).
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-libs/libsemanage/compress-modules.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-libs/libsemanage/compress-modules.patch
deleted file mode 100644
index 488f44555d9..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-libs/libsemanage/compress-modules.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -r -u libsemanage-3.6-patched/src/semanage.conf libsemanage-3.6-flatcar/src/semanage.conf
---- libsemanage-3.6-patched/src/semanage.conf	2024-02-21 14:33:06.055611733 +0100
-+++ libsemanage-3.6-flatcar/src/semanage.conf	2024-02-21 14:42:13.566991009 +0100
-@@ -58,7 +58,7 @@
- # 1-9 when compressing.  The higher the number,
- # the more memory is traded off for disk space.
- # Set to 0 to disable bzip2 compression.
--bzip-blocksize=0
-+bzip-blocksize=1
- 
- # Reduce memory usage for bzip2 compression and
- # decompression of modules in the module store.
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/amd64/parent b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/amd64/parent
index c51b3b68255..26708967162 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/amd64/parent
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/amd64/parent
@@ -1,2 +1,2 @@
-portage-stable:default/linux/amd64/23.0/no-multilib/hardened/systemd
+portage-stable:default/linux/amd64/23.0/no-multilib/hardened/selinux/systemd
 :coreos/base
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/parent b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/parent
index f0a79704e37..64e1b58501b 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/parent
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/parent
@@ -1,3 +1,2 @@
-portage-stable:default/linux/arm64/23.0/hardened
-portage-stable:targets/systemd
+portage-stable:default/linux/arm64/23.0/hardened/selinux/systemd
 :coreos/base
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
index 658fee2f8d7..9841f7047b0 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
@@ -45,7 +45,7 @@ BOOTSTRAP_USE="${BOOTSTRAP_USE} curl_ssl_openssl ssl"
 BOOTSTRAP_USE="${BOOTSTRAP_USE} xml"
 
 # Set SELinux policy
-POLICY_TYPES="targeted mcs mls"
+POLICY_TYPES="mcs"
 
 # Disable packages or optional features with distribution issues.
 ACCEPT_RESTRICT="* -bindist"
@@ -93,10 +93,6 @@ INSTALL_MASK="
   /usr/share/portage/config/repos.conf
 "
 
-# Prevent binaries from being installed to rootfs from binary packages
-PKG_INSTALL_MASK="
-"
-
 # Keep the default languages small.
 # (not many things respect this though)
 LINGUAS="en"
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.provided b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.provided
index 3bcb7981d2f..8a8430c5c5c 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.provided
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.provided
@@ -18,8 +18,3 @@ sys-devel/bpf-toolchain-14.2.0_p1
 # Pulled by app-crypt/sbsigntools - we never needed it and it pulls a
 # ton of other packages.
 dev-perl/Locale-gettext-1.70.0_p20181130
-
-# Pulled in by sys-apps/systemd, breaks the build - the image stage
-# fails with "Failed to resolve typeattributeset statement at
-# /var/lib/selinux/mcs/tmp/modules/400/ntp/cil:120"
-sec-policy/selinux-ntp-2.20250618-r1
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
index b4f6832f414..b7b2312bff0 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
@@ -29,8 +29,8 @@ dev-vcs/git -perl -iconv
 app-admin/sudo -sendmail
 
 # disable hybrid cgroup as we use the unified mode now
-# use lzma which is the default on non-gentoo systems, enable selinux,
-sys-apps/systemd -cgroup-hybrid curl idn lzma selinux tpm
+# use lzma which is the default on non-gentoo systems,
+sys-apps/systemd -cgroup-hybrid curl idn lzma tpm
 net-libs/libmicrohttpd -ssl
 
 # disable kernel config detection and module building
@@ -59,7 +59,7 @@ sys-libs/glibc nscd
 dev-libs/cyrus-sasl kerberos -gdbm
 
 # don't build manpages for sssd
-sys-auth/sssd -python samba kerberos gssapi ssh selinux
+sys-auth/sssd -python samba kerberos gssapi ssh
 
 # enable logging command-line options in update_engine
 dev-cpp/glog gflags
@@ -72,20 +72,7 @@ sys-fs/quota rpc
 sys-apps/portage -xattr -rsync-verify
 
 # Enable -M and -Z flags; -M is used by mayday
-sys-process/lsof rpc selinux
-
-# Enable SELinux for all targets
-coreos-base/coreos          selinux
-sys-apps/dbus               selinux
-
-# Enable SELinux for coreutils
-sys-apps/coreutils          selinux
-
-# Enable SELinux for tar
-app-arch/tar                selinux
-
-# Enable SELinux for runc
-app-containers/runc selinux
+sys-process/lsof rpc
 
 # enable regular expression processing in jq
 app-misc/jq oniguruma
@@ -137,9 +124,6 @@ dev-libs/libpcre2 -pcre16 -pcre32 unicode
 # smi and ssl, no clue.
 net-analyzer/tcpdump -ssl -smi -samba
 
-# selinux: to find files with a particular SElinux label
-sys-apps/findutils selinux
-
 # Flatcar defaults formerly defined in coreos-overlay ebuilds
 app-containers/containerd btrfs device-mapper
 app-containers/docker btrfs overlay seccomp
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask
index 721bd1be2f6..70fc58b0779 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask
@@ -15,9 +15,6 @@ python_single_target_python3_12
 python_targets_python3_13
 python_single_target_python3_13
 
-# Unmask selinux so it can be enabled selectively in package.use
--selinux
-
 # We don't care about i10n, takes too much space, pulls in too many
 # extra dependencies.
 nls
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
index aa39f4a3838..27e23616a4b 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
@@ -10,23 +10,20 @@ app-editors/vim-core	minimal
 # Install our modifications and compatibility symlinks for ssh and ntp
 #
 # Install a SELinux policy directory symlink
-coreos-base/misc-files audit ntp openssh policycoreutils
+coreos-base/misc-files ntp openssh policycoreutils
 
 dev-lang/python		gdbm
 dev-libs/dbus-glib	tools
 dev-libs/elfutils	-utils
 dev-libs/openssl	pkcs11
-dev-util/perf		-perl -python
 net-misc/dhcp	        -server
-net-misc/ntp            caps
-sys-apps/smartmontools	-daemon -update-drivedb -systemd
+sys-apps/smartmontools	-caps -daemon -update-drivedb -systemd
 sys-block/parted        device-mapper
 sys-fs/lvm2		-readline thin lvm
 sys-libs/ncurses	minimal
-sys-libs/pam		audit
 
 # enable journal gateway, bootctl and container features
-sys-apps/systemd audit elfutils gnuefi http importd iptables
+sys-apps/systemd elfutils gnuefi http importd iptables
 
 # epoll is needed for systemd-journal-remote to work. coreos/bugs#919
 net-libs/libmicrohttpd epoll
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use.mask
index 0251dc55915..4482d1b6105 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use.mask
@@ -1,2 +1,14 @@
-# Only needed by Catalyst in the SDK, requires dev-lang/python-exec.
-sys-apps/util-linux python
+# Selinux profile force-enables USE=caps, but we don't need it for
+# smartmontools - it is only relevant for smartd daemon, which we do
+# not build.
+sys-apps/smartmontools caps
+
+# Allow USE=python for sys-libs/libselinux - it is needed by portage
+# with USE=selinux. For production images, we will filter python files
+# out with an install mask.
+sys-libs/libselinux -python
+
+# Allow USE=python for sys-process/audit - it is needed by
+# policycoreutils. For production images, we will filter python files
+# out with an install mask.
+sys-process/audit -python
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/make.defaults b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/make.defaults
index dbec72a5523..ca019b5934a 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/make.defaults
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/make.defaults
@@ -52,3 +52,5 @@ INSTALL_MASK="${INSTALL_MASK}
   /sbin/ebtables-save
   /sbin/xfs_scrub_all
 "
+
+# TODO: Add libselinux python stuff to install mask here.
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.mask
index 7f198c44e90..3a1bb203885 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.mask
@@ -3,8 +3,10 @@
 
 # We don't want to support interpreted languages, changes/updates we make
 # would have a high risk of breaking users.
+#
+# This includes python, which is not listed here. Python is added to
+# package.provided for selinux reasons.
 dev-lang/perl
-dev-lang/python
 dev-lang/ruby
 
 # We do not configure/install grub like other distros so shipping the user
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.provided b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.provided
new file mode 100644
index 00000000000..eb5a1b9c13b
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.provided
@@ -0,0 +1,7 @@
+# Mark python as provided for selinux stuff. We have put all the
+# python stuff into install masks by now.
+dev-lang/python-3.11.12
+
+# Pulled in by sys-apps/policycoreutils, python stuff.
+app-admin/setools-4.5.1
+sys-apps/selinux-python-3.8.1
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/use.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/use.mask
new file mode 100644
index 00000000000..a0ce76ef076
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/use.mask
@@ -0,0 +1,3 @@
+# Disable anything that pulls those interpreters into generic images.
+perl
+python
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/package.use.force b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/package.use.force
new file mode 100644
index 00000000000..6f5e10a0a61
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/package.use.force
@@ -0,0 +1,4 @@
+# Needed during bootstrap - systemd pulls dbus, which pulls dbus
+# selinux policies, which pull policycoreutils, which pulls
+# selinux-python, which needs libsepol with static libs.
+sys-libs/libsepol static-libs
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/policycoreutils/policycoreutils-3.8.1.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-apps/policycoreutils/policycoreutils-3.8.1.ebuild
deleted file mode 100644
index bbd002d1079..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/sys-apps/policycoreutils/policycoreutils-3.8.1.ebuild
+++ /dev/null
@@ -1,210 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-PYTHON_COMPAT=( python3_{10..13} )
-PYTHON_REQ_USE="xml(+)"
-
-inherit python-r1 toolchain-funcs bash-completion-r1
-
-MY_PV="${PV//_/-}"
-MY_P="${PN}-${MY_PV}"
-EXTRAS_VER="1.37"
-
-DESCRIPTION="SELinux core utilities"
-HOMEPAGE="https://github.com/SELinuxProject/selinux/wiki"
-
-if [[ ${PV} == 9999 ]]; then
-	inherit git-r3
-	EGIT_REPO_URI="https://github.com/SELinuxProject/selinux.git"
-	SRC_URI="!vanilla? ( https://dev.gentoo.org/~perfinion/distfiles/policycoreutils-extra-${EXTRAS_VER}.tar.bz2 )"
-	S1="${WORKDIR}/${P}/${PN}"
-	S2="${WORKDIR}/policycoreutils-extra"
-	S="${S1}"
-else
-	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz
-		!vanilla? ( https://dev.gentoo.org/~perfinion/distfiles/policycoreutils-extra-${EXTRAS_VER}.tar.bz2 )"
-	KEYWORDS="amd64 arm arm64 x86"
-	S1="${WORKDIR}/${MY_P}"
-	S2="${WORKDIR}/policycoreutils-extra"
-	S="${S1}"
-fi
-
-LICENSE="GPL-2"
-SLOT="0"
-IUSE="audit pam split-usr vanilla +python"
-REQUIRED_USE="
-	!vanilla? ( python ${PYTHON_REQUIRED_USE} )
-"
-
-DEPEND="
-	python? (
-		>=sys-libs/libselinux-${PV}:=[python,${PYTHON_USEDEP}]
-		>=sys-libs/libsemanage-${PV}:=[python(+),${PYTHON_USEDEP}]
-		audit? ( >=sys-process/audit-1.5.1[python,${PYTHON_USEDEP}] )
-		${PYTHON_DEPS}
-	)
-	!python? (
-		>=sys-libs/libselinux-${PV}:=
-		>=sys-libs/libsemanage-${PV}:=
-		audit? ( >=sys-process/audit-1.5.1 )
-	)
-	>=sys-libs/libsepol-${PV}:=
-	sys-libs/libcap-ng:=
-	pam? ( sys-libs/pam:= )
-	!vanilla? (
-		>=app-admin/setools-4.2.0[${PYTHON_USEDEP}]
-	)
-"
-
-# Avoid dependency loop in the cross-compile case, bug #755173
-# (Still exists in native)
-BDEPEND="sys-devel/gettext"
-
-# pax-utils for scanelf used by rlpkg
-RDEPEND="${DEPEND}
-	app-misc/pax-utils"
-
-PDEPEND="sys-apps/semodule-utils
-	python? ( sys-apps/selinux-python )"
-
-src_unpack() {
-	# Override default one because we need the SRC_URI ones even in case of 9999 ebuilds
-	default
-	if [[ ${PV} == 9999 ]] ; then
-		git-r3_src_unpack
-	fi
-}
-
-src_prepare() {
-	S="${S1}"
-	cd "${S}" || die "Failed to switch to ${S}"
-	if [[ ${PV} != 9999 ]] ; then
-		# If needed for live ebuilds please use /etc/portage/patches
-		eapply "${FILESDIR}/policycoreutils-3.1-0001-newrole-not-suid.patch"
-	fi
-
-	if ! use vanilla; then
-		# rlpkg is more useful than fixfiles
-		sed -i -e '/^all/s/fixfiles//' "${S}/scripts/Makefile" \
-			|| die "fixfiles sed 1 failed"
-		sed -i -e '/fixfiles/d' "${S}/scripts/Makefile" \
-			|| die "fixfiles sed 2 failed"
-	fi
-
-	eapply_user
-
-	sed -i 's/-Werror//g' "${S1}"/*/Makefile || die "Failed to remove Werror"
-
-	if ! use vanilla; then
-		python_copy_sources
-		# Our extra code is outside the regular directory, so set it to the extra
-		# directory. We really should optimize this as it is ugly, but the extra
-		# code is needed for Gentoo at the same time that policycoreutils is present
-		# (so we cannot use an additional package for now).
-		S="${S2}"
-		python_copy_sources
-	fi
-}
-
-src_compile() {
-	building() {
-		local build_dir=${1}
-		emake -C "${build_dir}" \
-			AUDIT_LOG_PRIVS="y" \
-			AUDITH="$(usex audit y n)" \
-			PAMH="$(usex pam y n)" \
-			SESANDBOX="n" \
-			CC="$(tc-getCC)" \
-			LIBDIR="\$(PREFIX)/$(get_libdir)"
-	}
-	if ! use vanilla; then
-		building_with_python() {
-			building "${BUILD_DIR}"
-		}
-		S="${S1}" # Regular policycoreutils
-		python_foreach_impl building_with_python
-		S="${S2}" # Extra set
-		python_foreach_impl building_with_python
-		unset -f building_with_python
-	else
-		S="${S1}" # Regular policycoreutils
-		building "${S}"
-	fi
-	unset -f building
-}
-
-src_install() {
-	installation-policycoreutils-base() {
-		local build_dir=${1}
-		einfo "Installing policycoreutils"
-		emake -C "${build_dir}" DESTDIR="${D}" \
-			AUDIT_LOG_PRIVS="y" \
-			AUDITH="$(usex audit y n)" \
-			PAMH="$(usex pam y n)" \
-			SESANDBOX="n" \
-			CC="$(tc-getCC)" \
-			LIBDIR="\$(PREFIX)/$(get_libdir)" \
-			install
-	}
-
-	if ! use vanilla; then
-		# Python scripts are present in many places. There are no extension modules.
-		installation-policycoreutils() {
-			installation-policycoreutils-base "${BUILD_DIR}"
-			python_optimize
-		}
-
-		installation-extras() {
-			einfo "Installing policycoreutils-extra"
-			emake -C "${BUILD_DIR}" \
-				DESTDIR="${D}" \
-				install
-			python_optimize
-		}
-
-		S="${S1}" # policycoreutils
-		python_foreach_impl installation-policycoreutils
-		S="${S2}" # extras
-		python_foreach_impl installation-extras
-		S="${S1}" # back for later
-		unset -f installation-extras installation-policycoreutils
-	else
-		S="${S1}" # policycoreutils
-		installation-policycoreutils-base "${S}"
-	fi
-	unset -f installation-policycoreutils-base
-
-	# remove redhat-style init script
-	rm -fR "${D}/etc/rc.d" || die
-
-	# compatibility symlinks
-	if use split-usr; then
-		dosym ../../sbin/setfiles /usr/sbin/setfiles
-	else
-		# remove sestatus symlink
-		rm -f "${D}"/usr/sbin/sestatus || die
-	fi
-
-	bashcomp_alias setsebool getsebool
-
-	# location for policy definitions
-	dodir /var/lib/selinux
-	keepdir /var/lib/selinux
-
-	if ! use vanilla; then
-		# Set version-specific scripts
-		for pyscript in rlpkg; do
-			python_replicate_script "${ED}/usr/sbin/${pyscript}"
-		done
-	fi
-}
-
-pkg_postinst() {
-	for POLICY_TYPE in ${POLICY_TYPES} ; do
-		# There have been some changes to the policy store, rebuilding now.
-		# https://marc.info/?l=selinux&m=143757277819717&w=2
-		einfo "Rebuilding store ${POLICY_TYPE} in '${ROOT:-/}' (without re-loading)."
-		semodule -p "${ROOT:-/}" -s "${POLICY_TYPE}" -n -B || die "Failed to rebuild policy store ${POLICY_TYPE}"
-	done
-}
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-libs/libsemanage/files/libsemanage-extra-config.patch b/sdk_container/src/third_party/coreos-overlay/sys-libs/libsemanage/files/libsemanage-extra-config.patch
deleted file mode 100644
index ecd0ffd9202..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/sys-libs/libsemanage/files/libsemanage-extra-config.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-diff -r -u libsemanage-3.6/src/semanage.conf libsemanage-3.6-patched/src/semanage.conf
---- libsemanage-3.6/src/semanage.conf	2023-12-13 15:46:22.000000000 +0100
-+++ libsemanage-3.6-patched/src/semanage.conf	2024-02-21 14:33:06.055611733 +0100
-@@ -40,3 +40,26 @@
- # By default, semanage will generate policies for the SELinux target.
- # To build policies for Xen, uncomment the following line.
- #target-platform = xen
-+
-+# Set this to true to save the linked policy.
-+# This is normally only useful for analysis
-+# or debugging of policy.
-+save-linked=false
-+
-+# Set this to 0 to disable assertion checking.
-+# This should speed up building the kernel policy
-+# from policy modules, but may leave you open to
-+# dangerous rules which assertion checking
-+# would catch.
-+expand-check=1
-+
-+# Modules in the module store can be compressed
-+# with bzip2.  Set this to the bzip2 blocksize
-+# 1-9 when compressing.  The higher the number,
-+# the more memory is traded off for disk space.
-+# Set to 0 to disable bzip2 compression.
-+bzip-blocksize=0
-+
-+# Reduce memory usage for bzip2 compression and
-+# decompression of modules in the module store.
-+bzip-small=true
diff --git a/sdk_container/src/third_party/portage-stable/app-admin/setools/Manifest b/sdk_container/src/third_party/portage-stable/app-admin/setools/Manifest
new file mode 100644
index 00000000000..cddf08f12d6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-admin/setools/Manifest
@@ -0,0 +1 @@
+DIST setools-4.5.1.tar.bz2 264998 BLAKE2B 479cec6f541c1e7125d641928ba49aee949e538612a478840cec2d70106dcf9f7fa5b8049c9d18c560587670ee624a3a744714667d52b99cff24c51e72026db7 SHA512 1045c223423fcb056ffbc2f93c4dc0ccc6ae078ce7d2acbe3a3c65de19440fe801b5b9f71038cde62bf9851f52d868c845aafbe33691ee531cf9854217e061d8
diff --git a/sdk_container/src/third_party/portage-stable/app-admin/setools/files/setools-4.5.1-remove-gui.patch b/sdk_container/src/third_party/portage-stable/app-admin/setools/files/setools-4.5.1-remove-gui.patch
new file mode 100644
index 00000000000..efb7ae76e49
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-admin/setools/files/setools-4.5.1-remove-gui.patch
@@ -0,0 +1,21 @@
+diff --git a/setup.py b/setup.py
+index 05aac33..c685791 100644
+--- a/setup.py
++++ b/setup.py
+@@ -70,13 +70,10 @@ setup(name='setools',
+       author='Chris PeBenito',
+       author_email='pebenito@ieee.org',
+       url='https://github.com/SELinuxProject/setools',
+-      packages=['setools', 'setools.checker', 'setools.diff', 'setoolsgui', 'setoolsgui.widgets',
+-                'setoolsgui.widgets.criteria', 'setoolsgui.widgets.details',
+-                'setoolsgui.widgets.models', 'setoolsgui.widgets.views'],
+-      scripts=['apol', 'sediff', 'seinfo', 'seinfoflow', 'sesearch', 'sedta', 'sechecker'],
++      packages=['setools', 'setools.checker', 'setools.diff'],
++      scripts=['sediff', 'seinfo', 'seinfoflow', 'sesearch', 'sedta', 'sechecker'],
+       data_files=installed_data,
+-      package_data={'': ['*.css', '*.html'],
+-                    'setools': ['perm_map', 'policyrep.pyi', 'py.typed']},
++      package_data={'setools': ['perm_map', 'policyrep.pyi', 'py.typed']},
+       ext_modules=cythonize(ext_py_mods, include_path=['setools/policyrep'],
+                             annotate=cython_annotate,
+                             compiler_directives={"language_level": 3,
diff --git a/sdk_container/src/third_party/portage-stable/app-admin/setools/metadata.xml b/sdk_container/src/third_party/portage-stable/app-admin/setools/metadata.xml
new file mode 100644
index 00000000000..2367a4105f5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-admin/setools/metadata.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+	<upstream>
+		<remote-id type="github">SELinuxProject/setools</remote-id>
+	</upstream>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/app-admin/setools/setools-4.5.1.ebuild b/sdk_container/src/third_party/portage-stable/app-admin/setools/setools-4.5.1.ebuild
new file mode 100644
index 00000000000..9f8c4678938
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-admin/setools/setools-4.5.1.ebuild
@@ -0,0 +1,60 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{10..13} )
+
+inherit distutils-r1
+
+DESCRIPTION="Policy Analysis Tools for SELinux"
+HOMEPAGE="https://github.com/SELinuxProject/setools/wiki"
+
+if [[ ${PV} == *9999* ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/setools.git"
+	S="${WORKDIR}/${P}"
+else
+	SRC_URI="https://github.com/SELinuxProject/setools/releases/download/${PV}/${P}.tar.bz2"
+	KEYWORDS="amd64 arm arm64 ~riscv x86"
+	S="${WORKDIR}/${PN}"
+fi
+
+LICENSE="GPL-2 LGPL-2.1"
+SLOT="0"
+IUSE="gui test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="${PYTHON_DEPS}
+	>=dev-python/networkx-2.6[${PYTHON_USEDEP}]
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	>=sys-libs/libsepol-3.2:=
+	>=sys-libs/libselinux-3.2:=
+	gui? (
+		dev-python/pyqt6[gui,widgets,${PYTHON_USEDEP}]
+		dev-python/pygraphviz[${PYTHON_USEDEP}]
+	)"
+DEPEND="${RDEPEND}"
+BDEPEND=">=dev-python/cython-0.29.14[${PYTHON_USEDEP}]
+	test? (
+		dev-python/pyqt6[gui,testlib,widgets,${PYTHON_USEDEP}]
+		dev-python/pytest-qt[${PYTHON_USEDEP}]
+		sys-apps/checkpolicy
+	)"
+
+distutils_enable_tests pytest
+
+python_prepare_all() {
+	sed -i "s@^lib_dirs = .*@lib_dirs = ['${ROOT:-/}usr/$(get_libdir)']@" "${S}"/setup.py || \
+		die "failed to set lib_dirs"
+
+	use gui || PATCHES+=( "${FILESDIR}"/${P}-remove-gui.patch )
+	distutils-r1_python_prepare_all
+}
+
+python_test() {
+	rm -rf setools || die
+	epytest
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-admin/setools/setools-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-admin/setools/setools-9999.ebuild
new file mode 100644
index 00000000000..052075285d7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-admin/setools/setools-9999.ebuild
@@ -0,0 +1,60 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{10..13} )
+
+inherit distutils-r1
+
+DESCRIPTION="Policy Analysis Tools for SELinux"
+HOMEPAGE="https://github.com/SELinuxProject/setools/wiki"
+
+if [[ ${PV} == *9999* ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/setools.git"
+	S="${WORKDIR}/${P}"
+else
+	SRC_URI="https://github.com/SELinuxProject/setools/releases/download/${PV}/${P}.tar.bz2"
+	KEYWORDS="~amd64 ~arm ~arm64 ~riscv ~x86"
+	S="${WORKDIR}/${PN}"
+fi
+
+LICENSE="GPL-2 LGPL-2.1"
+SLOT="0"
+IUSE="gui test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="${PYTHON_DEPS}
+	>=dev-python/networkx-2.6[${PYTHON_USEDEP}]
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	>=sys-libs/libsepol-3.2:=
+	>=sys-libs/libselinux-3.2:=
+	gui? (
+		dev-python/pyqt6[gui,widgets,${PYTHON_USEDEP}]
+		dev-python/pygraphviz[${PYTHON_USEDEP}]
+	)"
+DEPEND="${RDEPEND}"
+BDEPEND=">=dev-python/cython-0.29.14[${PYTHON_USEDEP}]
+	test? (
+		dev-python/pyqt6[gui,testlib,widgets,${PYTHON_USEDEP}]
+		dev-python/pytest-qt[${PYTHON_USEDEP}]
+		sys-apps/checkpolicy
+	)"
+
+distutils_enable_tests pytest
+
+python_prepare_all() {
+	sed -i "s@^lib_dirs = .*@lib_dirs = ['${ROOT:-/}usr/$(get_libdir)']@" "${S}"/setup.py || \
+		die "failed to set lib_dirs"
+
+	use gui || PATCHES+=( "${FILESDIR}"/${PN}-4.5.1-remove-gui.patch )
+	distutils-r1_python_prepare_all
+}
+
+python_test() {
+	rm -rf setools || die
+	epytest
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/networkx/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/networkx/Manifest
new file mode 100644
index 00000000000..02eac09370d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/networkx/Manifest
@@ -0,0 +1 @@
+DIST networkx-3.5.tar.gz 2471065 BLAKE2B 575ac0a6e9741f0ad23396ff089cb360d43fc80f1c5a1fcb69e824c3673aba1aae5c2413020b049bcfecb68045984452eb02aefce1d523bd00d589eb26d8ae0f SHA512 9c060385913cfe67126e71eb9e53c032faa51c9609336ce78333d22e5f73078eb5b4826e0709cae0bd448fef2a5b2fb6f4c29be28c70d34a936d1cf6a00e83a1
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/networkx/files/networkx-3.5-py314.patch b/sdk_container/src/third_party/portage-stable/dev-python/networkx/files/networkx-3.5-py314.patch
new file mode 100644
index 00000000000..4b109fd9acd
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/networkx/files/networkx-3.5-py314.patch
@@ -0,0 +1,53 @@
+From 5487e923e39f526fe12a74d7399e5153f06698a4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20G=C3=B3rny?= <mgorny@gentoo.org>
+Date: Tue, 3 Jun 2025 09:54:33 +0200
+Subject: [PATCH] Use type checks in `generators/lattice.py` for Py3.14 compat
+
+Replace the `TypeError` catching in `networkx/generators/lattice.py`
+with explicit type checks to make the code more reliable and fix it for
+Python 3.14.  Catching the exception immediately does not work
+in the second instance, because the code is constructing a generator,
+and apparently Python 3.14 does not evaluate the `p in periodic`
+expression until the generator is actually iterated over.  Given that
+the function expects either an iterable or a `bool`, explicitly checking
+for `bool` should both be more readable and more reliable.
+
+The alternative would be to replace the generator with a list
+comprehension that would be evaluated immediately.  However,
+the explicit type check seems to be a cleaner solution to the problem.
+---
+ networkx/generators/lattice.py | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/networkx/generators/lattice.py b/networkx/generators/lattice.py
+index 95e520d2c..3b0900ea1 100644
+--- a/networkx/generators/lattice.py
++++ b/networkx/generators/lattice.py
+@@ -67,10 +67,10 @@ def grid_2d_graph(m, n, periodic=False, create_using=None):
+     G.add_edges_from(((i, j), (pi, j)) for pi, i in pairwise(rows) for j in cols)
+     G.add_edges_from(((i, j), (i, pj)) for i in rows for pj, j in pairwise(cols))
+ 
+-    try:
+-        periodic_r, periodic_c = periodic
+-    except TypeError:
++    if isinstance(periodic, bool):
+         periodic_r = periodic_c = periodic
++    else:
++        periodic_r, periodic_c = periodic
+ 
+     if periodic_r and len(rows) > 2:
+         first = rows[0]
+@@ -129,10 +129,10 @@ def grid_graph(dim, periodic=False):
+     if not dim:
+         return empty_graph(0)
+ 
+-    try:
+-        func = (cycle_graph if p else path_graph for p in periodic)
+-    except TypeError:
++    if isinstance(periodic, bool):
+         func = repeat(cycle_graph if periodic else path_graph)
++    else:
++        func = (cycle_graph if p else path_graph for p in periodic)
+ 
+     G = next(func)(dim[0])
+     for current_dim in dim[1:]:
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/networkx/metadata.xml b/sdk_container/src/third_party/portage-stable/dev-python/networkx/metadata.xml
new file mode 100644
index 00000000000..226da59e47e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/networkx/metadata.xml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="project">
+    <email>python@gentoo.org</email>
+    <name>Python</name>
+  </maintainer>
+  <longdescription lang="en">
+  NetworkX is a Python-based package for the creation, manipulation, and
+  study of the structure, dynamics, and functions of complex networks.
+  The structure of a graph or network is encoded in the edges (connections,
+  links, ties, arcs, bonds) between nodes (vertices, sites, actors). If
+  unqualified, by graph we mean a simple undirected graph, i.e. no
+  self-loops and no multiple edges are allowed. By a network we usually
+  mean a graph with weights (fields, properties) on nodes and/or edges.
+  The potential audience for NetworkX includes: mathematicians, physicists,
+  biologists, computer scientists, social scientists.
+  </longdescription>
+  <stabilize-allarches/>
+  <upstream>
+    <remote-id type="pypi">networkx</remote-id>
+    <remote-id type="github">networkx/networkx</remote-id>
+  </upstream>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/networkx/networkx-3.5-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/networkx/networkx-3.5-r1.ebuild
new file mode 100644
index 00000000000..a62129e17ab
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/networkx/networkx-3.5-r1.ebuild
@@ -0,0 +1,64 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_FULLY_TESTED=( python3_{11..13} )
+PYTHON_COMPAT=( "${PYTHON_FULLY_TESTED[@]}" python3_14 )
+
+inherit distutils-r1 optfeature pypi virtualx
+
+DESCRIPTION="Python tools to manipulate graphs and complex networks"
+HOMEPAGE="
+	https://networkx.org/
+	https://github.com/networkx/networkx/
+	https://pypi.org/project/networkx/
+"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="amd64 arm arm64 ~loong ~ppc64 ~riscv ~sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+
+BDEPEND="
+	test? (
+		>=dev-python/lxml-4.6[${PYTHON_USEDEP}]
+		$(python_gen_cond_dep '
+			>=dev-python/matplotlib-3.8[${PYTHON_USEDEP}]
+			>=dev-python/numpy-1.25[${PYTHON_USEDEP}]
+			>=dev-python/scipy-1.11.2[${PYTHON_USEDEP}]
+		' "${PYTHON_FULLY_TESTED[@]}")
+	)
+"
+
+EPYTEST_XDIST=1
+distutils_enable_tests pytest
+
+PATCHES=(
+	# minimal fix for https://github.com/networkx/networkx/issues/8091
+	"${FILESDIR}/${P}-py314.patch"
+)
+
+src_test() {
+	virtx distutils-r1_src_test
+}
+
+python_test() {
+	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
+	# virtx implies nonfatal
+	nonfatal epytest || die
+}
+
+src_install() {
+	distutils-r1_src_install
+	# those examples use various assets and pre-compressed files
+	docompress -x /usr/share/doc/${PF}/examples
+}
+
+pkg_postinst() {
+	optfeature "recommended dependencies" "dev-python/matplotlib dev-python/numpy dev-python/pandas dev-python/scipy"
+	optfeature "graph drawing and graph layout algorithms" "dev-python/pygraphviz dev-python/pydot"
+	optfeature "YAML format reading and writing" "dev-python/pyyaml"
+	optfeature "shapefile format reading and writing" "sci-libs/gdal[python]"
+	optfeature "GraphML XML format" "dev-python/lxml"
+}
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/selinux-apache-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/selinux-apache-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..a37739cbeb5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/selinux-apache-2.20250213-r1.ebuild
@@ -0,0 +1,20 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="apache"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for apache"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
+DEPEND="${DEPEND}
+	sec-policy/selinux-kerberos
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-kerberos
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/selinux-apache-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/selinux-apache-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..e2d81876428
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/selinux-apache-2.20250618-r1.ebuild
@@ -0,0 +1,20 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="apache"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for apache"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+DEPEND="${DEPEND}
+	sec-policy/selinux-kerberos
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-kerberos
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/selinux-apache-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/selinux-apache-9999.ebuild
new file mode 100644
index 00000000000..4173f043f1b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/selinux-apache-9999.ebuild
@@ -0,0 +1,20 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="apache"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for apache"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+DEPEND="${DEPEND}
+	sec-policy/selinux-kerberos
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-kerberos
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/selinux-apm-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/selinux-apm-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..12cc0942d3a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/selinux-apm-2.20250213-r1.ebuild
@@ -0,0 +1,35 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="acpi"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for acpi"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
+
+pkg_postinst() {
+	# "apm" module got renamed to "acpi", must remove apm first
+	# the contexts are okay even tho the modules are not
+	# replaced in the same command (doesnt become unlabeled_t)
+	for i in ${POLICY_TYPES}; do
+		if semodule -s "${i}" -l | grep apm >/dev/null 2>&1; then
+			semodule -s "${i}" -r apm
+		fi
+	done
+	selinux-policy-2_pkg_postinst
+}
+
+pkg_postrm() {
+	for i in ${POLICY_TYPES}; do
+		if semodule -s "${i}" -l | grep apm >/dev/null 2>&1; then
+			semodule -s "${i}" -r apm
+		fi
+	done
+	selinux-policy-2_pkg_postrm
+}
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/selinux-apm-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/selinux-apm-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..1df1044fc81
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/selinux-apm-2.20250618-r1.ebuild
@@ -0,0 +1,35 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="acpi"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for acpi"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+
+pkg_postinst() {
+	# "apm" module got renamed to "acpi", must remove apm first
+	# the contexts are okay even tho the modules are not
+	# replaced in the same command (doesnt become unlabeled_t)
+	for i in ${POLICY_TYPES}; do
+		if semodule -s "${i}" -l | grep apm >/dev/null 2>&1; then
+			semodule -s "${i}" -r apm
+		fi
+	done
+	selinux-policy-2_pkg_postinst
+}
+
+pkg_postrm() {
+	for i in ${POLICY_TYPES}; do
+		if semodule -s "${i}" -l | grep apm >/dev/null 2>&1; then
+			semodule -s "${i}" -r apm
+		fi
+	done
+	selinux-policy-2_pkg_postrm
+}
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/selinux-apm-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/selinux-apm-9999.ebuild
new file mode 100644
index 00000000000..261f6989972
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/selinux-apm-9999.ebuild
@@ -0,0 +1,35 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="acpi"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for acpi"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+
+pkg_postinst() {
+	# "apm" module got renamed to "acpi", must remove apm first
+	# the contexts are okay even tho the modules are not
+	# replaced in the same command (doesnt become unlabeled_t)
+	for i in ${POLICY_TYPES}; do
+		if semodule -s "${i}" -l | grep apm >/dev/null 2>&1; then
+			semodule -s "${i}" -r apm
+		fi
+	done
+	selinux-policy-2_pkg_postinst
+}
+
+pkg_postrm() {
+	for i in ${POLICY_TYPES}; do
+		if semodule -s "${i}" -l | grep apm >/dev/null 2>&1; then
+			semodule -s "${i}" -r apm
+		fi
+	done
+	selinux-policy-2_pkg_postrm
+}
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/selinux-bind-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/selinux-bind-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..02b95339e9a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/selinux-bind-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="bind"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for bind"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/selinux-bind-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/selinux-bind-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..6208043f785
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/selinux-bind-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="bind"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for bind"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/selinux-bind-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/selinux-bind-9999.ebuild
new file mode 100644
index 00000000000..fc61ea28bf7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/selinux-bind-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="bind"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for bind"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/selinux-brctl-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/selinux-brctl-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..76cef6f99ed
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/selinux-brctl-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="brctl"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for brctl"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/selinux-brctl-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/selinux-brctl-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..7902bc6d205
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/selinux-brctl-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="brctl"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for brctl"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/selinux-brctl-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/selinux-brctl-9999.ebuild
new file mode 100644
index 00000000000..ecdab7d7904
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/selinux-brctl-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="brctl"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for brctl"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/selinux-cdrecord-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/selinux-cdrecord-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..c3d8d423cd5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/selinux-cdrecord-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="cdrecord"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for cdrecord"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/selinux-cdrecord-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/selinux-cdrecord-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..b2da23c074c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/selinux-cdrecord-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="cdrecord"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for cdrecord"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/selinux-cdrecord-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/selinux-cdrecord-9999.ebuild
new file mode 100644
index 00000000000..09b68e2cee1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/selinux-cdrecord-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="cdrecord"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for cdrecord"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/selinux-chronyd-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/selinux-chronyd-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..1d2bddea1f7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/selinux-chronyd-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="chronyd"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for chronyd"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/selinux-chronyd-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/selinux-chronyd-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..e5bfbda885f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/selinux-chronyd-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="chronyd"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for chronyd"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/selinux-chronyd-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/selinux-chronyd-9999.ebuild
new file mode 100644
index 00000000000..60cce44d22d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/selinux-chronyd-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="chronyd"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for chronyd"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/selinux-dirmngr-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/selinux-dirmngr-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..ec317c4ea74
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/selinux-dirmngr-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="dirmngr"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for dirmngr"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/selinux-dirmngr-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/selinux-dirmngr-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..23f0c911ab5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/selinux-dirmngr-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="dirmngr"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for dirmngr"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/selinux-dirmngr-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/selinux-dirmngr-9999.ebuild
new file mode 100644
index 00000000000..b60935e3560
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/selinux-dirmngr-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="dirmngr"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for dirmngr"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/selinux-dnsmasq-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/selinux-dnsmasq-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..557f27a39e9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/selinux-dnsmasq-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="dnsmasq"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for dnsmasq"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/selinux-dnsmasq-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/selinux-dnsmasq-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..b6ec8f990eb
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/selinux-dnsmasq-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="dnsmasq"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for dnsmasq"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/selinux-dnsmasq-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/selinux-dnsmasq-9999.ebuild
new file mode 100644
index 00000000000..2a289049542
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/selinux-dnsmasq-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="dnsmasq"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for dnsmasq"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..46f1cb9dbe5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20250213-r1.ebuild
@@ -0,0 +1,21 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="docker"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for docker"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
+
+DEPEND="${DEPEND}
+	sec-policy/selinux-container
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-container
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..41a33049640
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20250618-r1.ebuild
@@ -0,0 +1,21 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="docker"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for docker"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+
+DEPEND="${DEPEND}
+	sec-policy/selinux-container
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-container
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-9999.ebuild
new file mode 100644
index 00000000000..2c75223af5a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-9999.ebuild
@@ -0,0 +1,21 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="docker"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for docker"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+
+DEPEND="${DEPEND}
+	sec-policy/selinux-container
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-container
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/selinux-dracut-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/selinux-dracut-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..e90235d5a31
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/selinux-dracut-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="dracut"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for dracut"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/selinux-dracut-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/selinux-dracut-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..8609bd21866
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/selinux-dracut-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="dracut"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for dracut"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/selinux-dracut-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/selinux-dracut-9999.ebuild
new file mode 100644
index 00000000000..283065c96ea
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/selinux-dracut-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="dracut"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for dracut"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/selinux-git-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/selinux-git-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..6a09776a257
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/selinux-git-2.20250213-r1.ebuild
@@ -0,0 +1,21 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="git"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for git"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
+
+DEPEND="${DEPEND}
+	sec-policy/selinux-apache
+"
+RDEPEND="${DEPEND}
+	sec-policy/selinux-apache
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/selinux-git-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/selinux-git-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..fd08b0979e7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/selinux-git-2.20250618-r1.ebuild
@@ -0,0 +1,21 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="git"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for git"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+
+DEPEND="${DEPEND}
+	sec-policy/selinux-apache
+"
+RDEPEND="${DEPEND}
+	sec-policy/selinux-apache
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/selinux-git-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/selinux-git-9999.ebuild
new file mode 100644
index 00000000000..4ae8751c59b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/selinux-git-9999.ebuild
@@ -0,0 +1,21 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="git"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for git"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+
+DEPEND="${DEPEND}
+	sec-policy/selinux-apache
+"
+RDEPEND="${DEPEND}
+	sec-policy/selinux-apache
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/selinux-gpg-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/selinux-gpg-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..ba568ee8e1d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/selinux-gpg-2.20250213-r1.ebuild
@@ -0,0 +1,21 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="gpg"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for gpg"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
+
+DEPEND="${DEPEND}
+	sec-policy/selinux-dirmngr
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-dirmngr
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/selinux-gpg-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/selinux-gpg-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..ef389faa6cc
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/selinux-gpg-2.20250618-r1.ebuild
@@ -0,0 +1,21 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="gpg"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for gpg"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+
+DEPEND="${DEPEND}
+	sec-policy/selinux-dirmngr
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-dirmngr
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/selinux-gpg-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/selinux-gpg-9999.ebuild
new file mode 100644
index 00000000000..f33e311087f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/selinux-gpg-9999.ebuild
@@ -0,0 +1,21 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="gpg"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for gpg"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+
+DEPEND="${DEPEND}
+	sec-policy/selinux-dirmngr
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-dirmngr
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/selinux-kdump-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/selinux-kdump-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..6fa46c8908f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/selinux-kdump-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="kdump"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for kdump"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 ~riscv x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/selinux-kdump-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/selinux-kdump-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..e1edeaf6c91
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/selinux-kdump-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="kdump"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for kdump"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~riscv ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/selinux-kdump-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/selinux-kdump-9999.ebuild
new file mode 100644
index 00000000000..f2ed1bfe454
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/selinux-kdump-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="kdump"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for kdump"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~riscv ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/selinux-kerberos-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/selinux-kerberos-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..b7c799c7926
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/selinux-kerberos-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="kerberos"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for kerberos"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/selinux-kerberos-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/selinux-kerberos-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..5a41889e20d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/selinux-kerberos-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="kerberos"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for kerberos"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/selinux-kerberos-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/selinux-kerberos-9999.ebuild
new file mode 100644
index 00000000000..9646065ecb9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/selinux-kerberos-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="kerberos"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for kerberos"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/selinux-ldap-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/selinux-ldap-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..ba4ee395e53
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/selinux-ldap-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="ldap"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for ldap"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/selinux-ldap-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/selinux-ldap-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..efa1a19fd87
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/selinux-ldap-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="ldap"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for ldap"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/selinux-ldap-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/selinux-ldap-9999.ebuild
new file mode 100644
index 00000000000..89423fba9d9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/selinux-ldap-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="ldap"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for ldap"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/selinux-loadkeys-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/selinux-loadkeys-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..03441d1075e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/selinux-loadkeys-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="loadkeys"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for loadkeys"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/selinux-loadkeys-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/selinux-loadkeys-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..a4d91535682
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/selinux-loadkeys-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="loadkeys"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for loadkeys"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/selinux-loadkeys-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/selinux-loadkeys-9999.ebuild
new file mode 100644
index 00000000000..689c0c9a920
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/selinux-loadkeys-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="loadkeys"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for loadkeys"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/selinux-logrotate-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/selinux-logrotate-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..bff65e7f811
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/selinux-logrotate-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="logrotate"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for logrotate"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/selinux-logrotate-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/selinux-logrotate-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..8de02296253
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/selinux-logrotate-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="logrotate"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for logrotate"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/selinux-logrotate-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/selinux-logrotate-9999.ebuild
new file mode 100644
index 00000000000..9616700227b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/selinux-logrotate-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="logrotate"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for logrotate"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/selinux-makewhatis-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/selinux-makewhatis-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..e5b69e05eb2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/selinux-makewhatis-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="makewhatis"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for makewhatis"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/selinux-makewhatis-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/selinux-makewhatis-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..f8b5bc1e5ec
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/selinux-makewhatis-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="makewhatis"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for makewhatis"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/selinux-makewhatis-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/selinux-makewhatis-9999.ebuild
new file mode 100644
index 00000000000..29909e9f467
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/selinux-makewhatis-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="makewhatis"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for makewhatis"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/selinux-mandb-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/selinux-mandb-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..020af804585
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/selinux-mandb-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="mandb"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for mandb"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/selinux-mandb-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/selinux-mandb-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..7ee8bb6bf8a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/selinux-mandb-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="mandb"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for mandb"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/selinux-mandb-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/selinux-mandb-9999.ebuild
new file mode 100644
index 00000000000..cefbe518f24
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/selinux-mandb-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="mandb"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for mandb"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/selinux-ntp-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/selinux-ntp-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..bd306f34a39
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/selinux-ntp-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="ntp"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for ntp"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/selinux-ntp-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/selinux-ntp-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..c81bffe2a6b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/selinux-ntp-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="ntp"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for ntp"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/selinux-ntp-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/selinux-ntp-9999.ebuild
new file mode 100644
index 00000000000..6117039bb92
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/selinux-ntp-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="ntp"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for ntp"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/selinux-pcscd-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/selinux-pcscd-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..e89a88b5dd9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/selinux-pcscd-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="pcscd"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for pcscd"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/selinux-pcscd-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/selinux-pcscd-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..ccc78c94d33
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/selinux-pcscd-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="pcscd"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for pcscd"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/selinux-pcscd-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/selinux-pcscd-9999.ebuild
new file mode 100644
index 00000000000..d126a38ec41
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/selinux-pcscd-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="pcscd"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for pcscd"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/selinux-podman-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/selinux-podman-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..d6e9ee43f03
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/selinux-podman-2.20250213-r1.ebuild
@@ -0,0 +1,21 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="podman"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for podman"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
+
+DEPEND="${DEPEND}
+	sec-policy/selinux-container
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-container
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/selinux-podman-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/selinux-podman-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..44a20d137c5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/selinux-podman-2.20250618-r1.ebuild
@@ -0,0 +1,21 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="podman"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for podman"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+
+DEPEND="${DEPEND}
+	sec-policy/selinux-container
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-container
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/selinux-podman-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/selinux-podman-9999.ebuild
new file mode 100644
index 00000000000..7d594d7d1ba
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/selinux-podman-9999.ebuild
@@ -0,0 +1,21 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="podman"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for podman"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+
+DEPEND="${DEPEND}
+	sec-policy/selinux-container
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-container
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/selinux-qemu-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/selinux-qemu-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..939cafc2195
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/selinux-qemu-2.20250213-r1.ebuild
@@ -0,0 +1,20 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="qemu"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for qemu"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
+DEPEND="${DEPEND}
+	sec-policy/selinux-virt
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-virt
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/selinux-qemu-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/selinux-qemu-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..2f6f8a0c498
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/selinux-qemu-2.20250618-r1.ebuild
@@ -0,0 +1,20 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="qemu"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for qemu"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+DEPEND="${DEPEND}
+	sec-policy/selinux-virt
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-virt
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/selinux-qemu-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/selinux-qemu-9999.ebuild
new file mode 100644
index 00000000000..7d24ef14c3d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/selinux-qemu-9999.ebuild
@@ -0,0 +1,20 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="qemu"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for qemu"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+DEPEND="${DEPEND}
+	sec-policy/selinux-virt
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-virt
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/selinux-quota-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/selinux-quota-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..4fa09f430cd
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/selinux-quota-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="quota"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for quota"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/selinux-quota-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/selinux-quota-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..d6851e9da0e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/selinux-quota-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="quota"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for quota"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/selinux-quota-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/selinux-quota-9999.ebuild
new file mode 100644
index 00000000000..0b3a3b59a33
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/selinux-quota-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="quota"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for quota"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/selinux-rpc-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/selinux-rpc-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..8426cdb1096
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/selinux-rpc-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="rpc"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for rpc"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/selinux-rpc-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/selinux-rpc-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..d08cfafe34a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/selinux-rpc-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="rpc"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for rpc"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/selinux-rpc-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/selinux-rpc-9999.ebuild
new file mode 100644
index 00000000000..89df85f4678
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/selinux-rpc-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="rpc"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for rpc"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/selinux-rpcbind-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/selinux-rpcbind-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..4d4d194af86
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/selinux-rpcbind-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="rpcbind"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for rpcbind"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/selinux-rpcbind-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/selinux-rpcbind-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..81c3318e808
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/selinux-rpcbind-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="rpcbind"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for rpcbind"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/selinux-rpcbind-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/selinux-rpcbind-9999.ebuild
new file mode 100644
index 00000000000..7299855d6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/selinux-rpcbind-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="rpcbind"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for rpcbind"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/selinux-samba-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/selinux-samba-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..5597a1ef4c6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/selinux-samba-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="samba"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for samba"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/selinux-samba-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/selinux-samba-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..3dafff45ddd
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/selinux-samba-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="samba"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for samba"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/selinux-samba-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/selinux-samba-9999.ebuild
new file mode 100644
index 00000000000..406127c2789
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/selinux-samba-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="samba"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for samba"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/selinux-sasl-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/selinux-sasl-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..cfc894439de
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/selinux-sasl-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="sasl"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for sasl"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/selinux-sasl-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/selinux-sasl-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..1fff82f85fb
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/selinux-sasl-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="sasl"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for sasl"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/selinux-sasl-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/selinux-sasl-9999.ebuild
new file mode 100644
index 00000000000..88a2e5386d2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/selinux-sasl-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="sasl"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for sasl"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/selinux-smartmon-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/selinux-smartmon-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..30e90aab9e1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/selinux-smartmon-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="smartmon"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for smartmon"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/selinux-smartmon-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/selinux-smartmon-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..0e91a5ae7bf
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/selinux-smartmon-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="smartmon"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for smartmon"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/selinux-smartmon-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/selinux-smartmon-9999.ebuild
new file mode 100644
index 00000000000..6789f8e6f25
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/selinux-smartmon-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="smartmon"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for smartmon"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/selinux-sudo-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/selinux-sudo-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..13f17a3052f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/selinux-sudo-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="sudo"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for sudo"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/selinux-sudo-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/selinux-sudo-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..88d298d8af9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/selinux-sudo-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="sudo"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for sudo"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/selinux-sudo-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/selinux-sudo-9999.ebuild
new file mode 100644
index 00000000000..6c60764cceb
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/selinux-sudo-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="sudo"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for sudo"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/selinux-tcsd-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/selinux-tcsd-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..c3dbdd303ad
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/selinux-tcsd-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="tcsd"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for tcsd"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/selinux-tcsd-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/selinux-tcsd-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..04859331292
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/selinux-tcsd-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="tcsd"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for tcsd"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/selinux-tcsd-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/selinux-tcsd-9999.ebuild
new file mode 100644
index 00000000000..66516eaac8d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/selinux-tcsd-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="tcsd"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for tcsd"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/selinux-virt-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/selinux-virt-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..9866fa9b134
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/selinux-virt-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="virt"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for virt"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/selinux-virt-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/selinux-virt-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..0707292ad19
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/selinux-virt-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="virt"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for virt"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/selinux-virt-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/selinux-virt-9999.ebuild
new file mode 100644
index 00000000000..38aee6d364b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/selinux-virt-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="virt"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for virt"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/selinux-wireguard-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/selinux-wireguard-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..cf4de2fdb58
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/selinux-wireguard-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="wireguard"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for wireguard"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/selinux-wireguard-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/selinux-wireguard-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..1b0350880f0
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/selinux-wireguard-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="wireguard"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for wireguard"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/selinux-wireguard-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/selinux-wireguard-9999.ebuild
new file mode 100644
index 00000000000..0d90ff1977c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/selinux-wireguard-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="wireguard"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for wireguard"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/selinux-xfs-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/selinux-xfs-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..7d8a44bd107
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/selinux-xfs-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="xfs"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for xfs"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/selinux-xfs-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/selinux-xfs-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..113cd052876
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/selinux-xfs-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="xfs"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for xfs"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/selinux-xfs-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/selinux-xfs-9999.ebuild
new file mode 100644
index 00000000000..41cb94fd990
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/selinux-xfs-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="xfs"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for xfs"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/selinux-zfs-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/selinux-zfs-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..bf8ad8ee4b3
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/selinux-zfs-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="zfs"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for zfs"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/selinux-zfs-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/selinux-zfs-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..bce81db0ba9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/selinux-zfs-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="zfs"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for zfs"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/selinux-zfs-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/selinux-zfs-9999.ebuild
new file mode 100644
index 00000000000..f30ef5b5264
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/selinux-zfs-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="zfs"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for zfs"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/policycoreutils/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/Manifest
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-apps/policycoreutils/Manifest
rename to sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/Manifest
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/policycoreutils/files/policycoreutils-3.1-0001-newrole-not-suid.patch b/sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/files/policycoreutils-3.1-0001-newrole-not-suid.patch
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-apps/policycoreutils/files/policycoreutils-3.1-0001-newrole-not-suid.patch
rename to sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/files/policycoreutils-3.1-0001-newrole-not-suid.patch
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/policycoreutils/metadata.xml b/sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/metadata.xml
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-apps/policycoreutils/metadata.xml
rename to sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/metadata.xml
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/policycoreutils-3.8.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/policycoreutils-3.8.1.ebuild
new file mode 100644
index 00000000000..ca22fcccce9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/policycoreutils-3.8.1.ebuild
@@ -0,0 +1,168 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_REQ_USE="xml(+)"
+
+inherit python-r1 toolchain-funcs bash-completion-r1
+
+MY_PV="${PV//_/-}"
+MY_P="${PN}-${MY_PV}"
+EXTRAS_VER="1.37"
+
+DESCRIPTION="SELinux core utilities"
+HOMEPAGE="https://github.com/SELinuxProject/selinux/wiki"
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/selinux.git"
+	SRC_URI="https://dev.gentoo.org/~perfinion/distfiles/policycoreutils-extra-${EXTRAS_VER}.tar.bz2"
+	S1="${WORKDIR}/${P}/${PN}"
+	S2="${WORKDIR}/policycoreutils-extra"
+	S="${S1}"
+else
+	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz
+		https://dev.gentoo.org/~perfinion/distfiles/policycoreutils-extra-${EXTRAS_VER}.tar.bz2"
+	KEYWORDS="amd64 arm arm64 ~riscv x86"
+	S1="${WORKDIR}/${MY_P}"
+	S2="${WORKDIR}/policycoreutils-extra"
+	S="${S1}"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="audit pam split-usr"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+DEPEND=">=sys-libs/libselinux-${PV}:=[python,${PYTHON_USEDEP}]
+	>=sys-libs/libsemanage-${PV}:=[python(+),${PYTHON_USEDEP}]
+	>=sys-libs/libsepol-${PV}:=
+	sys-libs/libcap-ng:=
+	>=app-admin/setools-4.2.0[${PYTHON_USEDEP}]
+	audit? ( >=sys-process/audit-1.5.1[python,${PYTHON_USEDEP}] )
+	pam? ( sys-libs/pam:= )
+	${PYTHON_DEPS}"
+
+# Avoid dependency loop in the cross-compile case, bug #755173
+# (Still exists in native)
+BDEPEND="sys-devel/gettext"
+
+# pax-utils for scanelf used by rlpkg
+RDEPEND="${DEPEND}
+	app-misc/pax-utils"
+
+PDEPEND="sys-apps/semodule-utils
+	sys-apps/selinux-python"
+
+src_unpack() {
+	# Override default one because we need the SRC_URI ones even in case of 9999 ebuilds
+	default
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	fi
+}
+
+src_prepare() {
+	S="${S1}"
+	cd "${S}" || die "Failed to switch to ${S}"
+	if [[ ${PV} != 9999 ]] ; then
+		# If needed for live ebuilds please use /etc/portage/patches
+		eapply "${FILESDIR}/policycoreutils-3.1-0001-newrole-not-suid.patch"
+	fi
+
+	# rlpkg is more useful than fixfiles
+	sed -i -e '/^all/s/fixfiles//' "${S}/scripts/Makefile" \
+		|| die "fixfiles sed 1 failed"
+	sed -i -e '/fixfiles/d' "${S}/scripts/Makefile" \
+		|| die "fixfiles sed 2 failed"
+
+	eapply_user
+
+	sed -i 's/-Werror//g' "${S1}"/*/Makefile || die "Failed to remove Werror"
+
+	python_copy_sources
+	# Our extra code is outside the regular directory, so set it to the extra
+	# directory. We really should optimize this as it is ugly, but the extra
+	# code is needed for Gentoo at the same time that policycoreutils is present
+	# (so we cannot use an additional package for now).
+	S="${S2}"
+	python_copy_sources
+}
+
+src_compile() {
+	building() {
+		emake -C "${BUILD_DIR}" \
+			AUDIT_LOG_PRIVS="y" \
+			AUDITH="$(usex audit y n)" \
+			PAMH="$(usex pam y n)" \
+			SESANDBOX="n" \
+			CC="$(tc-getCC)" \
+			LIBDIR="\$(PREFIX)/$(get_libdir)"
+	}
+	S="${S1}" # Regular policycoreutils
+	python_foreach_impl building
+	S="${S2}" # Extra set
+	python_foreach_impl building
+}
+
+src_install() {
+	# Python scripts are present in many places. There are no extension modules.
+	installation-policycoreutils() {
+		einfo "Installing policycoreutils"
+		emake -C "${BUILD_DIR}" DESTDIR="${D}" \
+			AUDIT_LOG_PRIVS="y" \
+			AUDITH="$(usex audit y n)" \
+			PAMH="$(usex pam y n)" \
+			SESANDBOX="n" \
+			CC="$(tc-getCC)" \
+			LIBDIR="\$(PREFIX)/$(get_libdir)" \
+			install
+		python_optimize
+	}
+
+	installation-extras() {
+		einfo "Installing policycoreutils-extra"
+		emake -C "${BUILD_DIR}" \
+			DESTDIR="${D}" \
+			install
+		python_optimize
+	}
+
+	S="${S1}" # policycoreutils
+	python_foreach_impl installation-policycoreutils
+	S="${S2}" # extras
+	python_foreach_impl installation-extras
+	S="${S1}" # back for later
+
+	# remove redhat-style init script
+	rm -fR "${D}/etc/rc.d" || die
+
+	# compatibility symlinks
+	if use split-usr; then
+		dosym ../../sbin/setfiles /usr/sbin/setfiles
+	else
+		# remove sestatus symlink
+		rm -f "${D}"/usr/sbin/sestatus || die
+	fi
+
+	bashcomp_alias setsebool getsebool
+
+	# location for policy definitions
+	dodir /var/lib/selinux
+	keepdir /var/lib/selinux
+
+	# Set version-specific scripts
+	for pyscript in rlpkg; do
+	  python_replicate_script "${ED}/usr/sbin/${pyscript}"
+	done
+}
+
+pkg_postinst() {
+	for POLICY_TYPE in ${POLICY_TYPES} ; do
+		# There have been some changes to the policy store, rebuilding now.
+		# https://marc.info/?l=selinux&m=143757277819717&w=2
+		einfo "Rebuilding store ${POLICY_TYPE} in '${ROOT:-/}' (without re-loading)."
+		semodule -p "${ROOT:-/}" -s "${POLICY_TYPE}" -n -B || die "Failed to rebuild policy store ${POLICY_TYPE}"
+	done
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/policycoreutils-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/policycoreutils-9999.ebuild
new file mode 100644
index 00000000000..452cc194cdc
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/policycoreutils-9999.ebuild
@@ -0,0 +1,168 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_REQ_USE="xml(+)"
+
+inherit python-r1 toolchain-funcs bash-completion-r1
+
+MY_PV="${PV//_/-}"
+MY_P="${PN}-${MY_PV}"
+EXTRAS_VER="1.37"
+
+DESCRIPTION="SELinux core utilities"
+HOMEPAGE="https://github.com/SELinuxProject/selinux/wiki"
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/selinux.git"
+	SRC_URI="https://dev.gentoo.org/~perfinion/distfiles/policycoreutils-extra-${EXTRAS_VER}.tar.bz2"
+	S1="${WORKDIR}/${P}/${PN}"
+	S2="${WORKDIR}/policycoreutils-extra"
+	S="${S1}"
+else
+	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz
+		https://dev.gentoo.org/~perfinion/distfiles/policycoreutils-extra-${EXTRAS_VER}.tar.bz2"
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+	S1="${WORKDIR}/${MY_P}"
+	S2="${WORKDIR}/policycoreutils-extra"
+	S="${S1}"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="audit pam split-usr"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+DEPEND=">=sys-libs/libselinux-${PV}:=[python,${PYTHON_USEDEP}]
+	>=sys-libs/libsemanage-${PV}:=[python(+),${PYTHON_USEDEP}]
+	>=sys-libs/libsepol-${PV}:=
+	sys-libs/libcap-ng:=
+	>=app-admin/setools-4.2.0[${PYTHON_USEDEP}]
+	audit? ( >=sys-process/audit-1.5.1[python,${PYTHON_USEDEP}] )
+	pam? ( sys-libs/pam:= )
+	${PYTHON_DEPS}"
+
+# Avoid dependency loop in the cross-compile case, bug #755173
+# (Still exists in native)
+BDEPEND="sys-devel/gettext"
+
+# pax-utils for scanelf used by rlpkg
+RDEPEND="${DEPEND}
+	app-misc/pax-utils"
+
+PDEPEND="sys-apps/semodule-utils
+	sys-apps/selinux-python"
+
+src_unpack() {
+	# Override default one because we need the SRC_URI ones even in case of 9999 ebuilds
+	default
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	fi
+}
+
+src_prepare() {
+	S="${S1}"
+	cd "${S}" || die "Failed to switch to ${S}"
+	if [[ ${PV} != 9999 ]] ; then
+		# If needed for live ebuilds please use /etc/portage/patches
+		eapply "${FILESDIR}/policycoreutils-3.1-0001-newrole-not-suid.patch"
+	fi
+
+	# rlpkg is more useful than fixfiles
+	sed -i -e '/^all/s/fixfiles//' "${S}/scripts/Makefile" \
+		|| die "fixfiles sed 1 failed"
+	sed -i -e '/fixfiles/d' "${S}/scripts/Makefile" \
+		|| die "fixfiles sed 2 failed"
+
+	eapply_user
+
+	sed -i 's/-Werror//g' "${S1}"/*/Makefile || die "Failed to remove Werror"
+
+	python_copy_sources
+	# Our extra code is outside the regular directory, so set it to the extra
+	# directory. We really should optimize this as it is ugly, but the extra
+	# code is needed for Gentoo at the same time that policycoreutils is present
+	# (so we cannot use an additional package for now).
+	S="${S2}"
+	python_copy_sources
+}
+
+src_compile() {
+	building() {
+		emake -C "${BUILD_DIR}" \
+			AUDIT_LOG_PRIVS="y" \
+			AUDITH="$(usex audit y n)" \
+			PAMH="$(usex pam y n)" \
+			SESANDBOX="n" \
+			CC="$(tc-getCC)" \
+			LIBDIR="\$(PREFIX)/$(get_libdir)"
+	}
+	S="${S1}" # Regular policycoreutils
+	python_foreach_impl building
+	S="${S2}" # Extra set
+	python_foreach_impl building
+}
+
+src_install() {
+	# Python scripts are present in many places. There are no extension modules.
+	installation-policycoreutils() {
+		einfo "Installing policycoreutils"
+		emake -C "${BUILD_DIR}" DESTDIR="${D}" \
+			AUDIT_LOG_PRIVS="y" \
+			AUDITH="$(usex audit y n)" \
+			PAMH="$(usex pam y n)" \
+			SESANDBOX="n" \
+			CC="$(tc-getCC)" \
+			LIBDIR="\$(PREFIX)/$(get_libdir)" \
+			install
+		python_optimize
+	}
+
+	installation-extras() {
+		einfo "Installing policycoreutils-extra"
+		emake -C "${BUILD_DIR}" \
+			DESTDIR="${D}" \
+			install
+		python_optimize
+	}
+
+	S="${S1}" # policycoreutils
+	python_foreach_impl installation-policycoreutils
+	S="${S2}" # extras
+	python_foreach_impl installation-extras
+	S="${S1}" # back for later
+
+	# remove redhat-style init script
+	rm -fR "${D}/etc/rc.d" || die
+
+	# compatibility symlinks
+	if use split-usr; then
+		dosym ../../sbin/setfiles /usr/sbin/setfiles
+	else
+		# remove sestatus symlink
+		rm -f "${D}"/usr/sbin/sestatus || die
+	fi
+
+	bashcomp_alias setsebool getsebool
+
+	# location for policy definitions
+	dodir /var/lib/selinux
+	keepdir /var/lib/selinux
+
+	# Set version-specific scripts
+	for pyscript in rlpkg; do
+	  python_replicate_script "${ED}/usr/sbin/${pyscript}"
+	done
+}
+
+pkg_postinst() {
+	for POLICY_TYPE in ${POLICY_TYPES} ; do
+		# There have been some changes to the policy store, rebuilding now.
+		# https://marc.info/?l=selinux&m=143757277819717&w=2
+		einfo "Rebuilding store ${POLICY_TYPE} in '${ROOT:-/}' (without re-loading)."
+		semodule -p "${ROOT:-/}" -s "${POLICY_TYPE}" -n -B || die "Failed to rebuild policy store ${POLICY_TYPE}"
+	done
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/Manifest
new file mode 100644
index 00000000000..4583aae05dd
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/Manifest
@@ -0,0 +1,2 @@
+DIST selinux-python-3.7.tar.gz 3652377 BLAKE2B 59fd7cab0034c175f42f6120ba665701945adcbd4e8af97a0dc2a1c79688a596b199528886ceea079a3f7a969258611fb660449d313d9e893de381293e786381 SHA512 036bc1f0e64cbbaade592dc7899a92765a0bac426140d7d3960f73bad6eb5f95d79d91e0f0e1604f88a991ebf59c4c90ccaaa4158f5dc4d3275ca2aed1673b09
+DIST selinux-python-3.8.1.tar.gz 3652823 BLAKE2B dde6081f55d646a6993083a000524b4ce834718f7cd555c8be88574f227f3d8ed24f390dc4568f3f66c1f3643a606779b6350ad28dfbfe2a1bd9d5a6798c37e0 SHA512 bad791411cff373cf749302d44205495a9d100ca6140ea895cb87a85f5d0b0cfaaf4b7418fca661fb3233d14951755d1c2d85961c731243c92622fdfb343734a
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/metadata.xml b/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/metadata.xml
new file mode 100644
index 00000000000..47d3a0861dd
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/metadata.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+	<longdescription>
+		selinux-python contains the core python selinux utilities and libraries
+		that are required for basic operation of a SELinux system. These
+		include semanage, sepolicy and sepolgen.
+	</longdescription>
+	<upstream>
+		<remote-id type="github">SELinuxProject/selinux</remote-id>
+	</upstream>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/selinux-python-3.7-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/selinux-python-3.7-r1.ebuild
new file mode 100644
index 00000000000..7d61f76ceb7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/selinux-python-3.7-r1.ebuild
@@ -0,0 +1,117 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_REQ_USE="xml(+)"
+
+inherit python-r1 toolchain-funcs
+
+MY_PV="${PV//_/-}"
+MY_P="${PN}-${MY_PV}"
+
+DESCRIPTION="SELinux core utilities"
+HOMEPAGE="https://github.com/SELinuxProject/selinux/wiki"
+
+if [[ ${PV} == 9999 ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/selinux.git"
+	S="${WORKDIR}/${P}/${PN#selinux-}"
+else
+	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
+	KEYWORDS="amd64 arm arm64 ~riscv x86"
+	S="${WORKDIR}/${MY_P}"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="test"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+RDEPEND=">=sys-libs/libselinux-${PV}:=[python]
+	>=sys-libs/libsemanage-${PV}:=[python(+)]
+	>=sys-libs/libsepol-${PV}:=[static-libs(+)]
+	>=app-admin/setools-4.2.0[${PYTHON_USEDEP}]
+	>=sys-process/audit-1.5.1[python,${PYTHON_USEDEP}]
+	${PYTHON_DEPS}"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	test? (
+		${RDEPEND}
+		>=sys-apps/secilc-${PV}
+	)"
+
+src_prepare() {
+	default
+	sed -i 's/-Werror//g' "${S}"/*/Makefile || die "Failed to remove Werror"
+
+	python_copy_sources
+}
+
+src_compile() {
+	building() {
+		emake -C "${BUILD_DIR}" \
+			CC="$(tc-getCC)" \
+			LIBDIR="\$(PREFIX)/$(get_libdir)"
+	}
+	python_foreach_impl building
+}
+
+src_test() {
+	testing() {
+		# The different subprojects have some interproject dependencies:
+		# - audit2allow depens on sepolgen
+		# - chcat depends on semanage
+		# and maybe others.
+		# Add all the modules of the individual subprojects to the
+		# PYTHONPATH, so they get actually found and used. In
+		# particular, already installed versions on the system are not
+		# used.
+		for dir in audit2allow chcat semanage sepolgen/src sepolicy ; do
+			PYTHONPATH="${BUILD_DIR}/${dir}:${PYTHONPATH}"
+		done
+		PYTHONPATH=${PYTHONPATH} \
+			emake -C "${BUILD_DIR}" \
+				test
+	}
+	python_foreach_impl testing
+}
+
+src_install() {
+	installation() {
+		emake -C "${BUILD_DIR}" \
+			DESTDIR="${D}" \
+			LIBDIR="\$(PREFIX)/$(get_libdir)" \
+			install
+		python_optimize
+	}
+	python_foreach_impl installation
+
+	# Set version-specific scripts
+	for pyscript in audit2allow sepolgen-ifgen sepolicy chcat; do
+		python_replicate_script "${ED}/usr/bin/${pyscript}"
+	done
+	for pyscript in semanage; do
+		python_replicate_script "${ED}/usr/sbin/${pyscript}"
+	done
+
+	# Create sepolgen.conf with different devel location definition
+	mkdir -p "${D}"/etc/selinux || die "Failed to create selinux directory";
+	if [[ -f /etc/selinux/config ]];
+	then
+		local selinuxtype=$(awk -F'=' '/^SELINUXTYPE/ {print $2}' /etc/selinux/config);
+		echo "SELINUX_DEVEL_PATH=/usr/share/selinux/${selinuxtype}/include:/usr/share/selinux/${selinuxtype}" \
+			> "${D}"/etc/selinux/sepolgen.conf || die "Failed to generate sepolgen"
+	else
+		local selinuxtype="${POLICY_TYPES%% *}";
+		if [[ -n "${selinuxtype}" ]];
+		then
+			echo "SELINUX_DEVEL_PATH=/usr/share/selinux/${selinuxtype}/include:/usr/share/selinux/${selinuxtype}" \
+				> "${D}"/etc/selinux/sepolgen.conf || die "Failed to generate sepolgen"
+		else
+			echo "SELINUX_DEVEL_PATH=/usr/share/selinux/strict/include:/usr/share/selinux/strict" \
+				> "${D}"/etc/selinux/sepolgen.conf || die "Failed to generate sepolgen"
+		fi
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/selinux-python-3.8.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/selinux-python-3.8.1.ebuild
new file mode 100644
index 00000000000..ee0f8382df2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/selinux-python-3.8.1.ebuild
@@ -0,0 +1,117 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_REQ_USE="xml(+)"
+
+inherit python-r1 toolchain-funcs
+
+MY_PV="${PV//_/-}"
+MY_P="${PN}-${MY_PV}"
+
+DESCRIPTION="SELinux core utilities"
+HOMEPAGE="https://github.com/SELinuxProject/selinux/wiki"
+
+if [[ ${PV} == 9999 ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/selinux.git"
+	S="${WORKDIR}/${P}/${PN#selinux-}"
+else
+	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
+	KEYWORDS="amd64 arm arm64 x86"
+	S="${WORKDIR}/${MY_P}"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="test"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+RDEPEND=">=sys-libs/libselinux-${PV}:=[python]
+	>=sys-libs/libsemanage-${PV}:=[python(+)]
+	>=sys-libs/libsepol-${PV}:=[static-libs(+)]
+	>=app-admin/setools-4.2.0[${PYTHON_USEDEP}]
+	>=sys-process/audit-1.5.1[python,${PYTHON_USEDEP}]
+	${PYTHON_DEPS}"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	test? (
+		${RDEPEND}
+		>=sys-apps/secilc-${PV}
+	)"
+
+src_prepare() {
+	default
+	sed -i 's/-Werror//g' "${S}"/*/Makefile || die "Failed to remove Werror"
+
+	python_copy_sources
+}
+
+src_compile() {
+	building() {
+		emake -C "${BUILD_DIR}" \
+			CC="$(tc-getCC)" \
+			LIBDIR="\$(PREFIX)/$(get_libdir)"
+	}
+	python_foreach_impl building
+}
+
+src_test() {
+	testing() {
+		# The different subprojects have some interproject dependencies:
+		# - audit2allow depens on sepolgen
+		# - chcat depends on semanage
+		# and maybe others.
+		# Add all the modules of the individual subprojects to the
+		# PYTHONPATH, so they get actually found and used. In
+		# particular, already installed versions on the system are not
+		# used.
+		for dir in audit2allow chcat semanage sepolgen/src sepolicy ; do
+			PYTHONPATH="${BUILD_DIR}/${dir}:${PYTHONPATH}"
+		done
+		PYTHONPATH=${PYTHONPATH} \
+			emake -C "${BUILD_DIR}" \
+				test
+	}
+	python_foreach_impl testing
+}
+
+src_install() {
+	installation() {
+		emake -C "${BUILD_DIR}" \
+			DESTDIR="${D}" \
+			LIBDIR="\$(PREFIX)/$(get_libdir)" \
+			install
+		python_optimize
+	}
+	python_foreach_impl installation
+
+	# Set version-specific scripts
+	for pyscript in audit2allow sepolgen-ifgen sepolicy chcat; do
+		python_replicate_script "${ED}/usr/bin/${pyscript}"
+	done
+	for pyscript in semanage; do
+		python_replicate_script "${ED}/usr/sbin/${pyscript}"
+	done
+
+	# Create sepolgen.conf with different devel location definition
+	mkdir -p "${D}"/etc/selinux || die "Failed to create selinux directory";
+	if [[ -f /etc/selinux/config ]];
+	then
+		local selinuxtype=$(awk -F'=' '/^SELINUXTYPE/ {print $2}' /etc/selinux/config);
+		echo "SELINUX_DEVEL_PATH=/usr/share/selinux/${selinuxtype}/include:/usr/share/selinux/${selinuxtype}" \
+			> "${D}"/etc/selinux/sepolgen.conf || die "Failed to generate sepolgen"
+	else
+		local selinuxtype="${POLICY_TYPES%% *}";
+		if [[ -n "${selinuxtype}" ]];
+		then
+			echo "SELINUX_DEVEL_PATH=/usr/share/selinux/${selinuxtype}/include:/usr/share/selinux/${selinuxtype}" \
+				> "${D}"/etc/selinux/sepolgen.conf || die "Failed to generate sepolgen"
+		else
+			echo "SELINUX_DEVEL_PATH=/usr/share/selinux/strict/include:/usr/share/selinux/strict" \
+				> "${D}"/etc/selinux/sepolgen.conf || die "Failed to generate sepolgen"
+		fi
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/selinux-python-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/selinux-python-9999.ebuild
new file mode 100644
index 00000000000..e9776921c2c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/selinux-python-9999.ebuild
@@ -0,0 +1,117 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_REQ_USE="xml(+)"
+
+inherit python-r1 toolchain-funcs
+
+MY_PV="${PV//_/-}"
+MY_P="${PN}-${MY_PV}"
+
+DESCRIPTION="SELinux core utilities"
+HOMEPAGE="https://github.com/SELinuxProject/selinux/wiki"
+
+if [[ ${PV} == 9999 ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/selinux.git"
+	S="${WORKDIR}/${P}/${PN#selinux-}"
+else
+	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+	S="${WORKDIR}/${MY_P}"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="test"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+RDEPEND=">=sys-libs/libselinux-${PV}:=[python]
+	>=sys-libs/libsemanage-${PV}:=[python(+)]
+	>=sys-libs/libsepol-${PV}:=[static-libs(+)]
+	>=app-admin/setools-4.2.0[${PYTHON_USEDEP}]
+	>=sys-process/audit-1.5.1[python,${PYTHON_USEDEP}]
+	${PYTHON_DEPS}"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	test? (
+		${RDEPEND}
+		>=sys-apps/secilc-${PV}
+	)"
+
+src_prepare() {
+	default
+	sed -i 's/-Werror//g' "${S}"/*/Makefile || die "Failed to remove Werror"
+
+	python_copy_sources
+}
+
+src_compile() {
+	building() {
+		emake -C "${BUILD_DIR}" \
+			CC="$(tc-getCC)" \
+			LIBDIR="\$(PREFIX)/$(get_libdir)"
+	}
+	python_foreach_impl building
+}
+
+src_test() {
+	testing() {
+		# The different subprojects have some interproject dependencies:
+		# - audit2allow depens on sepolgen
+		# - chcat depends on semanage
+		# and maybe others.
+		# Add all the modules of the individual subprojects to the
+		# PYTHONPATH, so they get actually found and used. In
+		# particular, already installed versions on the system are not
+		# used.
+		for dir in audit2allow chcat semanage sepolgen/src sepolicy ; do
+			PYTHONPATH="${BUILD_DIR}/${dir}:${PYTHONPATH}"
+		done
+		PYTHONPATH=${PYTHONPATH} \
+			emake -C "${BUILD_DIR}" \
+				test
+	}
+	python_foreach_impl testing
+}
+
+src_install() {
+	installation() {
+		emake -C "${BUILD_DIR}" \
+			DESTDIR="${D}" \
+			LIBDIR="\$(PREFIX)/$(get_libdir)" \
+			install
+		python_optimize
+	}
+	python_foreach_impl installation
+
+	# Set version-specific scripts
+	for pyscript in audit2allow sepolgen-ifgen sepolicy chcat; do
+		python_replicate_script "${ED}/usr/bin/${pyscript}"
+	done
+	for pyscript in semanage; do
+		python_replicate_script "${ED}/usr/sbin/${pyscript}"
+	done
+
+	# Create sepolgen.conf with different devel location definition
+	mkdir -p "${D}"/etc/selinux || die "Failed to create selinux directory";
+	if [[ -f /etc/selinux/config ]];
+	then
+		local selinuxtype=$(awk -F'=' '/^SELINUXTYPE/ {print $2}' /etc/selinux/config);
+		echo "SELINUX_DEVEL_PATH=/usr/share/selinux/${selinuxtype}/include:/usr/share/selinux/${selinuxtype}" \
+			> "${D}"/etc/selinux/sepolgen.conf || die "Failed to generate sepolgen"
+	else
+		local selinuxtype="${POLICY_TYPES%% *}";
+		if [[ -n "${selinuxtype}" ]];
+		then
+			echo "SELINUX_DEVEL_PATH=/usr/share/selinux/${selinuxtype}/include:/usr/share/selinux/${selinuxtype}" \
+				> "${D}"/etc/selinux/sepolgen.conf || die "Failed to generate sepolgen"
+		else
+			echo "SELINUX_DEVEL_PATH=/usr/share/selinux/strict/include:/usr/share/selinux/strict" \
+				> "${D}"/etc/selinux/sepolgen.conf || die "Failed to generate sepolgen"
+		fi
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.42-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.42-r2.ebuild
index cb76363880e..af1071b7114 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.42-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.42-r2.ebuild
@@ -1038,24 +1038,6 @@ glibc_do_configure() {
 
 	myconf+=( --enable-kernel=${MIN_KERN_VER} )
 
-	# Since SELinux support is only required for nscd, only enable it if:
-	# 1. USE selinux
-	# 2. only for the primary ABI on multilib systems
-	# 3. Not a crosscompile
-	if ! is_crosscompile && use selinux ; then
-		if use multilib ; then
-			if is_final_abi ; then
-				myconf+=( --with-selinux )
-			else
-				myconf+=( --without-selinux )
-			fi
-		else
-			myconf+=( --with-selinux )
-		fi
-	else
-		myconf+=( --without-selinux )
-	fi
-
 	# Force a few tests where we always know the answer but
 	# configure is incapable of finding it.
 	if is_crosscompile ; then
@@ -1065,6 +1047,7 @@ glibc_do_configure() {
 	fi
 
 	myconf+=(
+		$(use_with selinux)
 		--disable-werror
 		--enable-bind-now
 		--enable-fortify-source
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-libs/libsemanage/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/Manifest
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-libs/libsemanage/Manifest
rename to sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/Manifest
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-libs/libsemanage/libsemanage-3.8.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/libsemanage-3.8.1.ebuild
similarity index 50%
rename from sdk_container/src/third_party/coreos-overlay/sys-libs/libsemanage/libsemanage-3.8.1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/libsemanage-3.8.1.ebuild
index 77ad22f80ff..1d2144d8846 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-libs/libsemanage/libsemanage-3.8.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/libsemanage-3.8.1.ebuild
@@ -24,36 +24,50 @@ fi
 
 LICENSE="GPL-2"
 SLOT="0/2"
-IUSE="+python"
-REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
 
-RDEPEND="
-	app-arch/bzip2[${MULTILIB_USEDEP}]
+RDEPEND="app-arch/bzip2[${MULTILIB_USEDEP}]
 	>=sys-libs/libsepol-${PV}:=[${MULTILIB_USEDEP}]
 	>=sys-libs/libselinux-${PV}:=[${MULTILIB_USEDEP}]
 	>=sys-process/audit-2.2.2[${MULTILIB_USEDEP}]
-	python? ( ${PYTHON_DEPS} )
-"
+	${PYTHON_DEPS}"
 DEPEND="${RDEPEND}"
-BDEPEND="
+BDEPEND=">=dev-lang/swig-2.0.4-r1
 	app-alternatives/yacc
 	app-alternatives/lex
-	python? (
-		>=dev-lang/swig-2.0.4-r1
-		virtual/pkgconfig
-	)
-"
+	virtual/pkgconfig"
 
 # tests are not meant to be run outside of the
 # full SELinux userland repo
 RESTRICT="test"
 
-PATCHES=(
-    "${FILESDIR}/libsemanage-extra-config.patch"
-)
-
 src_prepare() {
-	default
+	eapply_user
+
+	echo >> "${S}/src/semanage.conf"
+	echo "# Set this to true to save the linked policy." >> "${S}/src/semanage.conf"
+	echo "# This is normally only useful for analysis" >> "${S}/src/semanage.conf"
+	echo "# or debugging of policy." >> "${S}/src/semanage.conf"
+	echo "save-linked=false" >> "${S}/src/semanage.conf"
+	echo >> "${S}/src/semanage.conf"
+	echo "# Set this to 0 to disable assertion checking." >> "${S}/src/semanage.conf"
+	echo "# This should speed up building the kernel policy" >> "${S}/src/semanage.conf"
+	echo "# from policy modules, but may leave you open to" >> "${S}/src/semanage.conf"
+	echo "# dangerous rules which assertion checking" >> "${S}/src/semanage.conf"
+	echo "# would catch." >> "${S}/src/semanage.conf"
+	echo "expand-check=1" >> "${S}/src/semanage.conf"
+	echo >> "${S}/src/semanage.conf"
+	echo "# Modules in the module store can be compressed" >> "${S}/src/semanage.conf"
+	echo "# with bzip2.  Set this to the bzip2 blocksize" >> "${S}/src/semanage.conf"
+	echo "# 1-9 when compressing.  The higher the number," >> "${S}/src/semanage.conf"
+	echo "# the more memory is traded off for disk space." >> "${S}/src/semanage.conf"
+	echo "# Set to 0 to disable bzip2 compression." >> "${S}/src/semanage.conf"
+	echo "bzip-blocksize=0" >> "${S}/src/semanage.conf"
+	echo >> "${S}/src/semanage.conf"
+	echo "# Reduce memory usage for bzip2 compression and" >> "${S}/src/semanage.conf"
+	echo "# decompression of modules in the module store." >> "${S}/src/semanage.conf"
+	echo "bzip-small=true" >> "${S}/src/semanage.conf"
+
 	multilib_copy_sources
 }
 
@@ -66,7 +80,7 @@ multilib_src_compile() {
 		LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
 		all
 
-	if use python && multilib_is_native_abi; then
+	if multilib_is_native_abi; then
 		building_py() {
 			emake \
 				AR="$(tc-getAR)" \
@@ -85,7 +99,7 @@ multilib_src_install() {
 		LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
 		DESTDIR="${ED}" install
 
-	if use python && multilib_is_native_abi; then
+	if multilib_is_native_abi; then
 		installation_py() {
 			emake DESTDIR="${ED}" \
 				LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
@@ -98,8 +112,6 @@ multilib_src_install() {
 }
 
 multiib_src_install_all() {
-	if use python; then
-		python_setup
-		python_fix_shebang "${ED}"/usr/libexec/selinux/semanage_migrate_store
-	fi
+	python_setup
+	python_fix_shebang "${ED}"/usr/libexec/selinux/semanage_migrate_store
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/libsemanage-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/libsemanage-9999.ebuild
new file mode 100644
index 00000000000..f272a120b74
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/libsemanage-9999.ebuild
@@ -0,0 +1,117 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+PYTHON_COMPAT=( python3_{10..13} )
+
+inherit python-r1 toolchain-funcs multilib-minimal
+
+MY_PV="${PV//_/-}"
+MY_P="${PN}-${MY_PV}"
+
+DESCRIPTION="SELinux kernel and policy management library"
+HOMEPAGE="https://github.com/SELinuxProject/selinux/wiki"
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/selinux.git"
+	S="${WORKDIR}/${P}/${PN}"
+else
+	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
+	KEYWORDS="~amd64 ~arm ~arm64 ~mips ~riscv ~x86"
+	S="${WORKDIR}/${MY_P}"
+fi
+
+LICENSE="GPL-2"
+SLOT="0/2"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+RDEPEND="app-arch/bzip2[${MULTILIB_USEDEP}]
+	>=sys-libs/libsepol-${PV}:=[${MULTILIB_USEDEP}]
+	>=sys-libs/libselinux-${PV}:=[${MULTILIB_USEDEP}]
+	>=sys-process/audit-2.2.2[${MULTILIB_USEDEP}]
+	${PYTHON_DEPS}"
+DEPEND="${RDEPEND}"
+BDEPEND=">=dev-lang/swig-2.0.4-r1
+	app-alternatives/yacc
+	app-alternatives/lex
+	virtual/pkgconfig"
+
+# tests are not meant to be run outside of the
+# full SELinux userland repo
+RESTRICT="test"
+
+src_prepare() {
+	eapply_user
+
+	echo >> "${S}/src/semanage.conf"
+	echo "# Set this to true to save the linked policy." >> "${S}/src/semanage.conf"
+	echo "# This is normally only useful for analysis" >> "${S}/src/semanage.conf"
+	echo "# or debugging of policy." >> "${S}/src/semanage.conf"
+	echo "save-linked=false" >> "${S}/src/semanage.conf"
+	echo >> "${S}/src/semanage.conf"
+	echo "# Set this to 0 to disable assertion checking." >> "${S}/src/semanage.conf"
+	echo "# This should speed up building the kernel policy" >> "${S}/src/semanage.conf"
+	echo "# from policy modules, but may leave you open to" >> "${S}/src/semanage.conf"
+	echo "# dangerous rules which assertion checking" >> "${S}/src/semanage.conf"
+	echo "# would catch." >> "${S}/src/semanage.conf"
+	echo "expand-check=1" >> "${S}/src/semanage.conf"
+	echo >> "${S}/src/semanage.conf"
+	echo "# Modules in the module store can be compressed" >> "${S}/src/semanage.conf"
+	echo "# with bzip2.  Set this to the bzip2 blocksize" >> "${S}/src/semanage.conf"
+	echo "# 1-9 when compressing.  The higher the number," >> "${S}/src/semanage.conf"
+	echo "# the more memory is traded off for disk space." >> "${S}/src/semanage.conf"
+	echo "# Set to 0 to disable bzip2 compression." >> "${S}/src/semanage.conf"
+	echo "bzip-blocksize=0" >> "${S}/src/semanage.conf"
+	echo >> "${S}/src/semanage.conf"
+	echo "# Reduce memory usage for bzip2 compression and" >> "${S}/src/semanage.conf"
+	echo "# decompression of modules in the module store." >> "${S}/src/semanage.conf"
+	echo "bzip-small=true" >> "${S}/src/semanage.conf"
+
+	multilib_copy_sources
+}
+
+multilib_src_compile() {
+	local -x CFLAGS="${CFLAGS} -fno-semantic-interposition"
+
+	emake \
+		AR="$(tc-getAR)" \
+		CC="$(tc-getCC)" \
+		LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
+		all
+
+	if multilib_is_native_abi; then
+		building_py() {
+			emake \
+				AR="$(tc-getAR)" \
+				CC="$(tc-getCC)" \
+				PKG_CONFIG="$(tc-getPKG_CONFIG)" \
+				LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
+				"$@"
+		}
+		python_foreach_impl building_py swigify
+		python_foreach_impl building_py pywrap
+	fi
+}
+
+multilib_src_install() {
+	emake \
+		LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
+		DESTDIR="${ED}" install
+
+	if multilib_is_native_abi; then
+		installation_py() {
+			emake DESTDIR="${ED}" \
+				LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
+				PKG_CONFIG="$(tc-getPKG_CONFIG)" \
+				install-pywrap
+			python_optimize # bug 531638
+		}
+		python_foreach_impl installation_py
+	fi
+}
+
+multiib_src_install_all() {
+	python_setup
+	python_fix_shebang "${ED}"/usr/libexec/selinux/semanage_migrate_store
+}
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-libs/libsemanage/metadata.xml b/sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/metadata.xml
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-libs/libsemanage/metadata.xml
rename to sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/metadata.xml
diff --git a/sdk_lib/Dockerfile.sdk-build b/sdk_lib/Dockerfile.sdk-build
index 25aa6e333f8..3c3ae884b33 100644
--- a/sdk_lib/Dockerfile.sdk-build
+++ b/sdk_lib/Dockerfile.sdk-build
@@ -7,13 +7,7 @@ ARG OFFICIAL=0
 # mark build as official where appropriate
 RUN echo "export COREOS_OFFICIAL=$OFFICIAL" > /mnt/host/source/.env
 
-RUN /home/sdk/sdk_entry.sh ./setup_board --board="arm64-usr" --binhost="${BINHOST}/arm64-usr"
-RUN /home/sdk/sdk_entry.sh ./setup_board --board="arm64-usr" --regen_configs
-RUN /home/sdk/sdk_entry.sh ./build_packages --board="arm64-usr" --only_resolve_circular_deps
-
-RUN /home/sdk/sdk_entry.sh ./setup_board --board="amd64-usr" --binhost="${BINHOST}/amd64-usr"
-RUN /home/sdk/sdk_entry.sh ./setup_board --board="amd64-usr" --regen_configs
-RUN /home/sdk/sdk_entry.sh ./build_packages --board="amd64-usr" --only_resolve_circular_deps
+RUN /home/sdk/sdk_entry.sh ./sdk_lib/setup_boards.sh start "${BINHOST}"
 
 RUN rm /mnt/host/source/.env
 RUN rm -rf /home/sdk/toolchain-pkgs
diff --git a/sdk_lib/setup_boards.sh b/sdk_lib/setup_boards.sh
new file mode 100755
index 00000000000..87bcf8f6269
--- /dev/null
+++ b/sdk_lib/setup_boards.sh
@@ -0,0 +1,48 @@
+#!/bin/bash
+
+# Script used in Dockerfile.sdk-build. The failure is indicated by the
+# BUILD_PACKAGES_FAILED file in the scripts directory in the built
+# docker image. We do it to be able to recover the build logs from
+# failed builds too.
+
+set -euo pipefail
+
+phase=${1}; shift
+case ${phase} in
+
+    start)
+        binhost=${1}; shift
+        if ! ( ./setup_board --board="arm64-usr" --binhost="${binhost}/arm64-usr" && \
+                   ./setup_board --board="arm64-usr" --regen_configs && \
+                   ./build_packages --board="arm64-usr" --only_resolve_circular_deps && \
+                   \
+                   ./setup_board --board="amd64-usr" --binhost="${binhost}/amd64-usr" && \
+                   ./setup_board --board="amd64-usr" --regen_configs && \
+                   ./build_packages --board="amd64-usr" --only_resolve_circular_deps ); then
+            touch BUILD_PACKAGES_FAILED
+        fi
+        exit 0
+        ;;
+
+    finish)
+        logdir=''
+        if [[ ${#} -gt 0 ]]; then
+            logdir=${1}; shift
+        fi
+        if [[ -n ${logdir} ]]; then
+            for arch in amd64 arm64; do
+                cp -a "/build/${arch}-usr/var/log/portage" "${logdir}/${arch}-package-logs"
+            done
+        fi
+        if [[ -e BUILD_PACKAGES_FAILED ]]; then
+            exit 1
+        fi
+        exit 0
+        ;;
+
+    *)
+        echo "wrong phase ${phase@Q}" >&2
+        exit 1
+        ;;
+
+esac