From 6b8e6231cf27721392268f78b59dc791c6c95f29 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 11 Sep 2025 15:29:09 +0200
Subject: [PATCH 01/92] save logs

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 bootstrap_sdk_container               |  8 +++-
 build_sdk_container_image             | 21 ++++++++-
 ci-automation/ci_automation_common.sh | 33 +++++++++++++++
 ci-automation/garbage_collect.sh      |  2 +
 ci-automation/packages.sh             | 38 +++++++++++++----
 ci-automation/sdk_bootstrap.sh        | 61 ++++++++++++++++++++++++---
 ci-automation/sdk_container.sh        | 35 ++++++++++++---
 common.sh                             | 43 +++++++------------
 sdk_lib/Dockerfile.sdk-build          |  8 +---
 sdk_lib/setup_boards.sh               | 48 +++++++++++++++++++++
 10 files changed, 239 insertions(+), 58 deletions(-)
 create mode 100755 sdk_lib/setup_boards.sh

diff --git a/bootstrap_sdk_container b/bootstrap_sdk_container
index 6384e69e49e..c197787179b 100755
--- a/bootstrap_sdk_container
+++ b/bootstrap_sdk_container
@@ -11,6 +11,7 @@ source sdk_lib/sdk_container_common.sh
 
 seed_version=""
 target_version=""
+logdir=''
 
 declare -a cleanup
 
@@ -30,6 +31,7 @@ usage() {
     echo "      -x <cleanup-script> - For each resource generated during build (container etc.)"
     echo "                             add a cleanup line to <script> which, when run, will free"
     echo "                             the resource. Useful for CI."
+    echo "      -l <directory>      - Gather build logs here."
     echo "      -h                  - Print this help."
     echo
 }
@@ -38,6 +40,7 @@ usage() {
 while [ 0 -lt $# ] ; do
     case "$1" in
     -h) usage; exit 0;;
+    -l) logdir=${2}; shift 2;;
     -x) cleanup=("-x" "$2"); shift; shift;;
     *)  if [ -z "$seed_version" ] ; then
             seed_version="$1"
@@ -72,8 +75,11 @@ if $official; then
 fi
 
 # bootstrap_sdk needs FLATCAR_SDK_VERSION set to the seed version
+failed=''
 ./run_sdk_container "${cleanup[@]}" -V "$seed_version" -v "$target_version" \
-          sudo -E ./bootstrap_sdk
+          sudo -E ./bootstrap_sdk || failed=x
 
 # Update versionfile to the actual SDK version
 create_versionfile "${target_version}"
+
+if [[ -n ${failed} ]]; then exit 1; fi
diff --git a/build_sdk_container_image b/build_sdk_container_image
index d1e4fce88da..464745b432b 100755
--- a/build_sdk_container_image
+++ b/build_sdk_container_image
@@ -34,6 +34,7 @@ arch="amd64"
 official="0"
 tarball=""
 os_version=""
+logdir=""
 
 keep="false"
 cleanup=""
@@ -57,6 +58,7 @@ usage() {
     echo "                     add a cleanup line to <script> which, when run, will free"
     echo "                     the resource. Useful for CI."
     echo "      -h           - Print this help."
+    echo "      -l <dir>     - Put logs in this directory"
     echo
 }
 
@@ -66,6 +68,7 @@ while [ 0 -lt $# ] ; do
     case "$1" in
     -h) usage; exit 0;;
     -k) keep="true";      shift;;
+    -l) logdir="${2}";    shift; shift;;
     -v) os_version="$2";  shift; shift;;
     -x) cleanup="$2";     shift; shift;;
     *)  if [ -z "$tarball" ] ;  then
@@ -102,6 +105,10 @@ else
     official="0"
 fi
 
+if [[ -n ${logdir} ]]; then
+    mkdir -p "${logdir}"
+fi
+
 # --
 
 # import tarball
@@ -170,8 +177,14 @@ else
     if [ -n "$cleanup" ] ; then
         echo "$docker container rm -f '${toolchains_container}'" >> "$cleanup"
     fi
+    failed=''
     ./run_sdk_container -C "${import_image}" -n "${toolchains_container}" \
-            sudo ./build_toolchains --seed_tarball="./${tarball}"
+            sudo ./build_toolchains --seed_tarball="./${tarball}" || failed=x
+
+    if [[ -n ${logdir} ]] && sudo test -d __build__/images/catalyst/log/coreos-toolchains; then
+        sudo cp -a __build__/images/catalyst/log/coreos-toolchains "${logdir}/coreos-toolchains"
+    fi
+    if [[ -n ${failed} ]]; then exit 1; fi
 
     # remove sdk tarball from scripts root so it's not part of the SDK container build context
     if [ -f "${tarball_copied}" ] ; then
@@ -216,6 +229,12 @@ else
                  .
 
     $docker stop "${binhost_container}"
+
+    if [[ -n ${logdir} ]]; then
+        $docker run --rm -v "${logdir}:/logdir" "${sdk_build_image}" ./sdk_lib/setup_boards.sh finish /logdir
+    else
+        $docker run --rm "${sdk_build_image}" ./sdk_lib/setup_boards.sh finish
+    fi
 fi
 
 # --
diff --git a/ci-automation/ci_automation_common.sh b/ci-automation/ci_automation_common.sh
index 80d1ac4cd03..f516b10b24f 100644
--- a/ci-automation/ci_automation_common.sh
+++ b/ci-automation/ci_automation_common.sh
@@ -111,7 +111,40 @@ function copy_dir_from_buildcache() {
     rsync --partial -a -e "${sshcmd}" "${BUILDCACHE_USER}@${BUILDCACHE_SERVER}:${remote_path}" \
         "${local_path}"
 }
+# --
+
+# Returns true if the passed directory contains files that match any
+# of the passed glob strings. Remember to pass the glob as strings
+# (means: quote them, so globs are not resolved at the function
+# callsite).
+function dir_contains_globs() (
+    shopt -s nullglob
+
+    local dir=${1}; shift
+    # rest are globs
+
+    # this is in a subshell, so cd is safe - won't mess with working
+    # directory of the caller
+    cd "${dir}" 2>/dev/null || return 1
+    # for globs to be evaluated, we must not use quotes here
+    local -a files=( ${@} )
+
+    if [[ ${#files[@]} -gt 0 ]]; then
+        return 0
+    fi
+    return 1
+)
+# --
 
+function upload_fail_logs() {
+    if ! dir_contains_globs . 'debug-fail-logs-*.log'; then
+        return 0
+    fi
+
+    create_digests "${SIGNER}" debug-fail-logs-*.log
+    sign_artifacts "${SIGNER}" debug-fail-logs-*.log*
+    copy_to_buildcache "build-logs/${FLATCAR_SDK_VERSION}" debug-fail-logs-*.log*
+}
 # --
 
 function copy_to_buildcache() {
diff --git a/ci-automation/garbage_collect.sh b/ci-automation/garbage_collect.sh
index 058c0663816..9c7dfdf5677 100644
--- a/ci-automation/garbage_collect.sh
+++ b/ci-automation/garbage_collect.sh
@@ -152,6 +152,7 @@ function _garbage_collect_impl() {
         rmpat="${rmpat} ${BUILDCACHE_PATH_PREFIX}/containers/${os_docker_vernum}/flatcar-images-*"
         rmpat="${rmpat} ${BUILDCACHE_PATH_PREFIX}/images/*/${os_vernum}/"
         rmpat="${rmpat} ${BUILDCACHE_PATH_PREFIX}/testing/${os_vernum}/"
+        rmpat="${rmpat} ${BUILDCACHE_PATH_PREFIX}/build-logs/${os_vernum}/"
 
         echo "## The following files will be removed ##"
         $sshcmd "${BUILDCACHE_USER}@${BUILDCACHE_SERVER}" \
@@ -211,6 +212,7 @@ function _garbage_collect_impl() {
                 "images/amd64" \
                 "images/arm64" \
                 "testing" \
+                "build-logs" \
                 ; do
         local fullpath="${BUILDCACHE_PATH_PREFIX}/${dir}"
         echo
diff --git a/ci-automation/packages.sh b/ci-automation/packages.sh
index e6e984f7f38..9decf40fd28 100644
--- a/ci-automation/packages.sh
+++ b/ci-automation/packages.sh
@@ -80,22 +80,44 @@ function _packages_build_impl() {
     local vernum="${FLATCAR_VERSION}"
     local docker_vernum="$(vernum_to_docker_image_version "${vernum}")"
     local packages_container="flatcar-packages-${arch}-${docker_vernum}"
+    local logs_tarball="packages-${arch}-logs-$(date --utc '+%F-%H%M-%S').tar.xz"
 
     source sdk_lib/sdk_container_common.sh
 
+    logdir=__build__/packages-logs-to-upload
+    mkdir -p "${logdir}"
+
     apply_local_patches
     # Build packages; store packages in container
+    failed=''
     ./run_sdk_container -x ./ci-cleanup.sh  -n "${packages_container}" -v "${vernum}" \
         -C "${sdk_image}" \
-        ./build_packages --board="${arch}-usr"
+        ./build_packages --board="${arch}-usr" || failed=x
 
-    # run_sdk_container updates the version file, use that version from here on
-    source sdk_container/.repo/manifests/version.txt
-    local vernum="${FLATCAR_VERSION}"
-    local docker_vernum="$(vernum_to_docker_image_version "${vernum}")"
-    local packages_image="flatcar-packages-${arch}"
+    # Copy the build logs to a directory accessible for us.
+    ./run_sdk_container -n "${packages_container}" -v "${vernum}" -C "${sdk_image}" \
+        cp -a "/build/${arch}-usr/var/log/portage" "${logdir}" || :
+
+    if [[ -z ${failed} ]]; then
+        # run_sdk_container updates the version file, use that version from here on
+        source sdk_container/.repo/manifests/version.txt
+        local vernum="${FLATCAR_VERSION}"
+        local docker_vernum="$(vernum_to_docker_image_version "${vernum}")"
+        local packages_image="flatcar-packages-${arch}"
 
-    # generate image + push to build cache
-    docker_commit_to_buildcache "${packages_container}" "${packages_image}" "${docker_vernum}"
+        # generate image + push to build cache
+        docker_commit_to_buildcache "${packages_container}" "${packages_image}" "${docker_vernum}"
+    fi
+    if dir_contains_globs "${logdir}" '*'; then
+        (
+            cd "${logdir}"
+            tar -cJf "${logs_tarball}" *
+            create_digests "${SIGNER}" "${logs_tarball}"
+            sign_artifacts "${SIGNER}" "${logs_tarball}"*
+            copy_to_buildcache "build-logs/${FLATCAR_SDK_VERSION}" "${logs_tarball}"*
+        )
+    fi
+    upload_fail_logs
+    if [[ -n ${failed} ]]; then exit 1; fi
 }
 # --
diff --git a/ci-automation/sdk_bootstrap.sh b/ci-automation/sdk_bootstrap.sh
index 89d5b4bdc65..f629e0253ee 100644
--- a/ci-automation/sdk_bootstrap.sh
+++ b/ci-automation/sdk_bootstrap.sh
@@ -176,13 +176,17 @@ function _sdk_bootstrap_impl() {
     fi
     apply_local_patches
 
-    ./bootstrap_sdk_container -x ./ci-cleanup.sh "${seed_version}" "${vernum}"
+    local failed=''
+    local logdir='__build__/sdk-bootstrap-logs-to-upload/'
+    mkdir -p "${logdir}"
+    ./bootstrap_sdk_container -l "${logdir}" -x ./ci-cleanup.sh "${seed_version}" "${vernum}" || failed=x
 
     # push SDK tarball to buildcache
     # Get Flatcar version number format (separator is '+' instead of '-',
     # equal to $(strip_version_prefix "$version")
     source sdk_container/.repo/manifests/version.txt
     local dest_tarball="flatcar-sdk-${ARCH}-${FLATCAR_SDK_VERSION}.tar.bz2"
+    local logs_tarball="sdk-bootstrap-logs-${ARCH}-$(date --utc '+%F-%H%M-%S').tar.xz"
 
     # change the owner of the files and directories in __build__ back
     # to ourselves, otherwise we could fail to sign the artifacts as
@@ -193,11 +197,54 @@ function _sdk_bootstrap_impl() {
     uid=$(id --user)
     gid=$(id --group)
     sudo chown --recursive "${uid}:${gid}" __build__
-    (
-        cd "__build__/images/catalyst/builds/flatcar-sdk"
-        create_digests "${SIGNER}" "${dest_tarball}"
-        sign_artifacts "${SIGNER}" "${dest_tarball}"*
-        copy_to_buildcache "sdk/${ARCH}/${FLATCAR_SDK_VERSION}" "${dest_tarball}"*
-    )
+    if [[ -z ${failed} ]]; then
+        (
+            cd "__build__/images/catalyst/builds/flatcar-sdk"
+            create_digests "${SIGNER}" "${dest_tarball}"
+            sign_artifacts "${SIGNER}" "${dest_tarball}"*
+            copy_to_buildcache "sdk/${ARCH}/${FLATCAR_SDK_VERSION}" "${dest_tarball}"*
+        )
+    fi
+
+    # collect logs
+    local catalyst_log='__build__/images/catalyst/log/flatcar-sdk'
+    if dir_contains_globs "${catalyst_log}" 'stage*'; then
+        cp -a "${catalyst_log}/stage"* "${logdir}"
+    fi
+    mkdir -p "${logdir}/config-logs"
+    # TODO: Add more interesting files (meson logs, cmake logs)
+    local -a interesting_files=( config.log ) find_flags=()
+    for f in "${interesting_files[@]}"; do
+        if [[ ${#find_flags[@]} -ne 0 ]]; then
+            find_flags+=( '-o' )
+        fi
+        find_flags+=( '-name' "${f}" )
+    done
+    local catalyst_tmp='__build__/images/catalyst/tmp/flatcar-sdk'
+    local -a logs
+    local l d
+    mapfile -t logs < <(find "${catalyst_tmp}" "${find_flags[@]}")
+    for l in "${logs[@]}"; do
+        d=${l#"${catalyst_tmp}"}
+        d=${d#/}
+        if [[ ${d} = */* ]]; then
+            d=${d%/*}
+            mkdir -p "${logdir}/config-logs/${d}"
+        else
+            d='.'
+        fi
+        cp -a "${l}" "${logdir}/config-logs/${d}"
+    done
+    if dir_contains_globs "${logdir}" '*'; then
+        (
+            cd "${logdir}"
+            tar -cJf "${logs_tarball}" *
+            create_digests "${SIGNER}" "${logs_tarball}"
+            sign_artifacts "${SIGNER}" "${logs_tarball}"*
+            copy_to_buildcache "build-logs/${FLATCAR_SDK_VERSION}" "${logs_tarball}"*
+        )
+    fi
+    upload_fail_logs
+    if [[ -n ${failed} ]]; then exit 1; fi
 }
 # --
diff --git a/ci-automation/sdk_container.sh b/ci-automation/sdk_container.sh
index e3875581912..088826a3a7f 100644
--- a/ci-automation/sdk_container.sh
+++ b/ci-automation/sdk_container.sh
@@ -66,12 +66,35 @@ function _sdk_container_build_impl() {
 
 
     # This will update the SDK_VERSION in versionfile
-    ./build_sdk_container_image -x ./ci-cleanup.sh ./__build__/"${sdk_tarball}"
+    logdir=__build__/sdk-container-logs-to-upload
+    mkdir -p "${logdir}"
+    local failed=''
+    local logs_tarball="sdk-container-logs-${ARCH}-$(date --utc '+%F-%H%M-%S').tar.xz"
+    ./build_sdk_container_image -l "${PWD}/${logdir}" -x ./ci-cleanup.sh ./__build__/"${sdk_tarball}" || failed=x
 
-    # push artifacts to build cache
-    local docker_vernum="$(vernum_to_docker_image_version "${vernum}")"
-    docker_image_to_buildcache "${CONTAINER_REGISTRY}/flatcar-sdk-all" "${docker_vernum}"
-    docker_image_to_buildcache "${CONTAINER_REGISTRY}/flatcar-sdk-amd64" "${docker_vernum}"
-    docker_image_to_buildcache "${CONTAINER_REGISTRY}/flatcar-sdk-arm64" "${docker_vernum}"
+    if [[ -z ${failed} ]]; then
+        # push artifacts to build cache
+        local docker_vernum="$(vernum_to_docker_image_version "${vernum}")"
+        docker_image_to_buildcache "${CONTAINER_REGISTRY}/flatcar-sdk-all" "${docker_vernum}"
+        docker_image_to_buildcache "${CONTAINER_REGISTRY}/flatcar-sdk-amd64" "${docker_vernum}"
+        docker_image_to_buildcache "${CONTAINER_REGISTRY}/flatcar-sdk-arm64" "${docker_vernum}"
+    fi
+    local uid
+    local gid
+    uid=$(id --user)
+    gid=$(id --group)
+    sudo chown --recursive "${uid}:${gid}" "${logdir}"
+    chmod --recursive a+rX,u+w "${logdir}"
+    if dir_contains_globs "${logdir}" '*'; then
+        (
+            cd "${logdir}"
+            tar -cJf "${logs_tarball}" *
+            create_digests "${SIGNER}" "${logs_tarball}"
+            sign_artifacts "${SIGNER}" "${logs_tarball}"*
+            copy_to_buildcache "build-logs/${FLATCAR_SDK_VERSION}" "${logs_tarball}"*
+        )
+    fi
+    upload_fail_logs
+    if [[ -n ${failed} ]]; then exit 1; fi
 }
 # --
diff --git a/common.sh b/common.sh
index 3dbb8040dc3..882b9f92f7b 100644
--- a/common.sh
+++ b/common.sh
@@ -165,39 +165,26 @@ die_notrace() {
     error "${DIE_PREFIX}${line}"
   done
   if [[ ! -e "${SCRIPTS_DIR}/NO_DEBUG_OUTPUT_DELETE_ME" ]]; then
-      error "${DIE_PREFIX}!!!!!!!!!!!!!!!!!!!!!!!!!"
-      error "${DIE_PREFIX}!! BEGIN DEBUG OUTPUT: !!"
-      error "${DIE_PREFIX}!!!!!!!!!!!!!!!!!!!!!!!!!"
-      error
-      error "${DIE_PREFIX}== MOUNT =="
-      error "${DIE_PREFIX}==========="
-      error_command_output "${DIE_PREFIX}" mount
-      error
-      error "${DIE_PREFIX}== DF =="
-      error "${DIE_PREFIX}========"
-      error_command_output "${DIE_PREFIX}" df -h
-      error
-      error "${DIE_PREFIX}== DMESG =="
-      error "${DIE_PREFIX}==========="
-      error_command_output "${DIE_PREFIX}" sudo dmesg
-      error
-      error "${DIE_PREFIX}!!!!!!!!!!!!!!!!!!!!!!!"
-      error "${DIE_PREFIX}!! END DEBUG OUTPUT: !!"
-      error "${DIE_PREFIX}!!!!!!!!!!!!!!!!!!!!!!!"
+      local failfile="debug-fail-logs-$(date --utc '+%F-%H%M-%S').log"
+      error "${DIE_PREFIX}debug fail logs saved in ${failfile@Q}"
+      {
+          echo "== MOUNT =="
+          echo "==========="
+          sudo mount 2>&1
+          echo
+          echo "== DF =="
+          echo "========"
+          sudo df -h 2>&1
+          echo
+          echo "== DMESG =="
+          echo "==========="
+          sudo dmesg 2>&1
+      } >"${SCRIPTS_DIR}/${failfile}"
       touch "${SCRIPTS_DIR}/NO_DEBUG_OUTPUT_DELETE_ME"
   fi
   exit 1
 }
 
-error_command_output() {
-    local prefix=${1}; shift
-    # rest are a command to execute
-    local REPLY
-    while read -r; do
-        error "${prefix}${REPLY}"
-    done < <("${@}" 2>&1)
-}
-
 # Simple version comparison routine
 # Note: not a true semver comparison and build revisions are ignored
 cmp_ver() {
diff --git a/sdk_lib/Dockerfile.sdk-build b/sdk_lib/Dockerfile.sdk-build
index 25aa6e333f8..3c3ae884b33 100644
--- a/sdk_lib/Dockerfile.sdk-build
+++ b/sdk_lib/Dockerfile.sdk-build
@@ -7,13 +7,7 @@ ARG OFFICIAL=0
 # mark build as official where appropriate
 RUN echo "export COREOS_OFFICIAL=$OFFICIAL" > /mnt/host/source/.env
 
-RUN /home/sdk/sdk_entry.sh ./setup_board --board="arm64-usr" --binhost="${BINHOST}/arm64-usr"
-RUN /home/sdk/sdk_entry.sh ./setup_board --board="arm64-usr" --regen_configs
-RUN /home/sdk/sdk_entry.sh ./build_packages --board="arm64-usr" --only_resolve_circular_deps
-
-RUN /home/sdk/sdk_entry.sh ./setup_board --board="amd64-usr" --binhost="${BINHOST}/amd64-usr"
-RUN /home/sdk/sdk_entry.sh ./setup_board --board="amd64-usr" --regen_configs
-RUN /home/sdk/sdk_entry.sh ./build_packages --board="amd64-usr" --only_resolve_circular_deps
+RUN /home/sdk/sdk_entry.sh ./sdk_lib/setup_boards.sh start "${BINHOST}"
 
 RUN rm /mnt/host/source/.env
 RUN rm -rf /home/sdk/toolchain-pkgs
diff --git a/sdk_lib/setup_boards.sh b/sdk_lib/setup_boards.sh
new file mode 100755
index 00000000000..87bcf8f6269
--- /dev/null
+++ b/sdk_lib/setup_boards.sh
@@ -0,0 +1,48 @@
+#!/bin/bash
+
+# Script used in Dockerfile.sdk-build. The failure is indicated by the
+# BUILD_PACKAGES_FAILED file in the scripts directory in the built
+# docker image. We do it to be able to recover the build logs from
+# failed builds too.
+
+set -euo pipefail
+
+phase=${1}; shift
+case ${phase} in
+
+    start)
+        binhost=${1}; shift
+        if ! ( ./setup_board --board="arm64-usr" --binhost="${binhost}/arm64-usr" && \
+                   ./setup_board --board="arm64-usr" --regen_configs && \
+                   ./build_packages --board="arm64-usr" --only_resolve_circular_deps && \
+                   \
+                   ./setup_board --board="amd64-usr" --binhost="${binhost}/amd64-usr" && \
+                   ./setup_board --board="amd64-usr" --regen_configs && \
+                   ./build_packages --board="amd64-usr" --only_resolve_circular_deps ); then
+            touch BUILD_PACKAGES_FAILED
+        fi
+        exit 0
+        ;;
+
+    finish)
+        logdir=''
+        if [[ ${#} -gt 0 ]]; then
+            logdir=${1}; shift
+        fi
+        if [[ -n ${logdir} ]]; then
+            for arch in amd64 arm64; do
+                cp -a "/build/${arch}-usr/var/log/portage" "${logdir}/${arch}-package-logs"
+            done
+        fi
+        if [[ -e BUILD_PACKAGES_FAILED ]]; then
+            exit 1
+        fi
+        exit 0
+        ;;
+
+    *)
+        echo "wrong phase ${phase@Q}" >&2
+        exit 1
+        ;;
+
+esac

From d46957e21728e3c5410f66f826bc6d50a2680026 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 21 Aug 2025 16:57:19 +0200
Subject: [PATCH 02/92] overlay coreos/config, profiles: Drop PKG_INSTALL_MASK

PKG_INSTALL_MASK is for binary packages like INSTALL_MASK is for
${ROOT} - whatever is added to PKG_INSTALL_MASK will be absent from
binary packages. But we may want to install different content to
different kind of images using the same binary packages. For example,
we may want to install some python selinux scripts to developer
container, but not to production image.

I started adding PKG_INSTALL_MASK before, because of a
misunderstanding - I thought that PKG_INSTALL_MASK is about filtering
files that are installed to ${ROOT} from binary packages. So in
reality, PKG_INSTALL_MASK is really unnecessary.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../coreos/config/env/app-admin/sudo          |  5 +---
 .../coreos/config/env/app-containers/syft     |  5 +---
 .../coreos/config/env/dev-libs/glib           |  5 +---
 .../coreos/config/env/net-dns/bind            |  7 +----
 .../coreos/config/env/net-fs/nfs-utils        |  5 +---
 .../coreos/config/env/net-misc/ntp            | 27 +++++++++----------
 .../coreos/config/env/net-misc/openssh        |  5 +---
 .../coreos/config/env/sys-apps/lsb-release    |  5 +---
 .../coreos/config/env/sys-boot/grub           |  9 +++----
 .../coreos/config/env/sys-process/audit       |  5 +---
 .../profiles/coreos/base/make.defaults        |  4 ---
 11 files changed, 23 insertions(+), 59 deletions(-)

diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-admin/sudo b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-admin/sudo
index 3bd9e65f866..c6dac3e8506 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-admin/sudo
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-admin/sudo
@@ -11,7 +11,4 @@ cros_post_src_install_flatcar_modifications() {
 
 # We don't ship OpenLDAP schemas (why?) and we provide sudo.conf
 # through baselayout.
-sudo_install_mask='/etc/openldap/schema /etc/sudo.conf'
-INSTALL_MASK+=" ${sudo_install_mask}"
-PKG_INSTALL_MASK+=" ${sudo_install_mask}"
-unset sudo_install_mask
+INSTALL_MASK+=' /etc/openldap/schema /etc/sudo.conf '
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-containers/syft b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-containers/syft
index 23f700402eb..74f5a47797f 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-containers/syft
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-containers/syft
@@ -1,5 +1,2 @@
 # there are only examples installed
-syft_install_mask=" /usr/share/syft/examples "
-INSTALL_MASK+="${syft_install_mask}"
-PKG_INSTALL_MASK+="${syft_install_mask}"
-unset syft_install_mask
+INSTALL_MASK+=' /usr/share/syft/examples '
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/dev-libs/glib b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/dev-libs/glib
index e6388c51ad1..be015877fb0 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/dev-libs/glib
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/dev-libs/glib
@@ -1,7 +1,4 @@
 # Do not install gobject-introspection binaries in production images.
 if [[ $(flatcar_target) != 'sdk' ]] ; then
-	glib_mask="/usr/bin/gi-* /usr/lib*/libgirepository-2.0*"
-	PKG_INSTALL_MASK+=" ${glib_mask}"
-	INSTALL_MASK+=" ${glib_mask}"
-	unset glib_mask
+	INSTALL_MASK+=" /usr/bin/gi-* /usr/lib*/libgirepository-2.0* "
 fi
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-dns/bind b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-dns/bind
index b7c8dd0b88e..1873ad91a04 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-dns/bind
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-dns/bind
@@ -1,5 +1,5 @@
 # Keep only tool binaries and libraries those binaries need.
-ndb_install_mask="
+INSTALL_MASK+="
         /etc
         /var
         /usr/bin/arpaname
@@ -13,11 +13,6 @@ ndb_install_mask="
         /usr/sbin
 "
 
-INSTALL_MASK+="${ndb_install_mask}"
-PKG_INSTALL_MASK+="${ndb_install_mask}"
-
-unset ndb_install_mask
-
 # Override fowners to ignore changing owner or group to named. The
 # only files that this happens for are files that we have put into
 # {PKG_,}INSTALL_MASK. This will help us avoid installing
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-fs/nfs-utils b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-fs/nfs-utils
index e073862b5b9..d632a7f99d0 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-fs/nfs-utils
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-fs/nfs-utils
@@ -1,7 +1,4 @@
-nfs_utils_install_mask=" /etc/exports /etc/exports.d "
-INSTALL_MASK+=${nfs_utils_install_mask}
-PKG_INSTALL_MASK+=${nfs_utils_install_mask}
-unset nfs_utils_install_mask
+INSTALL_MASK+=" /etc/exports /etc/exports.d "
 
 cros_post_src_install_nfs_utils_flatcar_modifications() {
     (
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/ntp b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/ntp
index bc72eb5c0a1..ea84736a5af 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/ntp
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/ntp
@@ -1,15 +1,12 @@
-ntp_install_mask=''
-# Do not install ntpdate or sntp systemd files in /etc.
-ntp_install_mask+=" /etc/systemd"
-# Do not install the default ntp.conf, we provide our own in
-# coreos-base/misc-files.
-ntp_install_mask+=" /etc/ntp.conf"
-# Do not install perl scripts to /usr/bin.
-ntp_install_mask+=" /usr/bin/calc_tickadj /usr/bin/ntp-wait /usr/bin/ntptrace /usr/bin/update-leap"
-# Do not install perl package to /usr/share/ntp.
-ntp_install_mask+=" /usr/share/ntp"
-
-ntp_install_mask+=' '
-INSTALL_MASK+=${ntp_install_mask}
-PKG_INSTALL_MASK+=${ntp_install_mask}
-unset ntp_install_mask
+# Do not install:
+#
+# - ntpdate or sntp systemd files in /etc,
+# - the default ntp.conf, we provide our own in coreos-base/misc-files,
+# - perl scripts to /usr/bin,
+# - perl package to /usr/share/ntp
+INSTALL_MASK+="
+        /etc/systemd
+        /etc/ntp.conf
+        /usr/bin/calc_tickadj /usr/bin/ntp-wait /usr/bin/ntptrace /usr/bin/update-leap
+        /usr/share/ntp
+"
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh
index 77a32cfa39c..2f5c00289d5 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh
@@ -3,10 +3,7 @@
 # Do not install the config snippet that defines a subsystem. We have
 # our own definition in coreos-init.
 if [[ $(flatcar_target) != 'sdk' ]] ; then
-	openssh_mask=" /usr/lib*/misc/ssh-keysign /etc/ssh/sshd_config.d/*gentoo-subsystem.conf "
-	PKG_INSTALL_MASK+="${openssh_mask}"
-	INSTALL_MASK+="${openssh_mask}"
-	unset openssh_mask
+	INSTALL_MASK+=" /usr/lib*/misc/ssh-keysign /etc/ssh/sshd_config.d/*gentoo-subsystem.conf "
 fi
 
 cros_post_src_install_vendorize_pam() {
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/lsb-release b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/lsb-release
index 3f4831cb457..3418a654ad2 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/lsb-release
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/lsb-release
@@ -1,4 +1 @@
-lsb_release_install_mask=" /etc/lsb-release "
-INSTALL_MASK+="${lsb_release_install_mask}"
-PKG_INSTALL_MASK+="${lsb_release_install_mask}"
-unset lsb_release_install_mask
+INSTALL_MASK+=" /etc/lsb-release "
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-boot/grub b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-boot/grub
index 932b56a9431..b8d7d082f52 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-boot/grub
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-boot/grub
@@ -48,9 +48,6 @@ cros_post_src_install_sbat() {
 	EOF
 }
 
-# Flatcar does not use grub-install or grub-mkconfig. All the files under /etc
-# relate to grub-mkconfig.
-grub_install_mask=" ${EPREFIX}/etc/ *grub-install* *mkconfig* "
-INSTALL_MASK+="${grub_install_mask}"
-PKG_INSTALL_MASK+="${grub_install_mask}"
-unset grub_install_mask
+# Flatcar does not use grub-install or grub-mkconfig. All the files
+# under /etc relate to grub-mkconfig.
+INSTALL_MASK+=" ${EPREFIX}/etc/ *grub-install* *mkconfig* "
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit
index 52fc0e0aad4..198fa84ebf8 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit
@@ -1,7 +1,4 @@
 # Do not install Gentoo-provided audit rules, we will install our own
 # in coreos-base/misc-files. Also skip installing legacy initscripts
 # stuff in /usr/libexec.
-audit_install_mask=" /etc/audit/audit.rules* /usr/libexec "
-INSTALL_MASK+="${audit_install_mask}"
-PKG_INSTALL_MASK+="${audit_install_mask}"
-unset audit_install_mask
+INSTALL_MASK+=" /etc/audit/audit.rules* /usr/libexec "
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
index 658fee2f8d7..69f6d2631ac 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
@@ -93,10 +93,6 @@ INSTALL_MASK="
   /usr/share/portage/config/repos.conf
 "
 
-# Prevent binaries from being installed to rootfs from binary packages
-PKG_INSTALL_MASK="
-"
-
 # Keep the default languages small.
 # (not many things respect this though)
 LINGUAS="en"

From 2bc498e982f5a3fe3caab88fb42c51e6767b5b3e Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Wed, 23 Apr 2025 15:42:28 +0200
Subject: [PATCH 03/92] overlay profiles: Switch to hardened/selinux/systemd
 profiles

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../third_party/coreos-overlay/profiles/coreos/amd64/parent    | 2 +-
 .../third_party/coreos-overlay/profiles/coreos/arm64/parent    | 3 +--
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/amd64/parent b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/amd64/parent
index c51b3b68255..26708967162 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/amd64/parent
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/amd64/parent
@@ -1,2 +1,2 @@
-portage-stable:default/linux/amd64/23.0/no-multilib/hardened/systemd
+portage-stable:default/linux/amd64/23.0/no-multilib/hardened/selinux/systemd
 :coreos/base
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/parent b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/parent
index f0a79704e37..64e1b58501b 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/parent
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/arm64/parent
@@ -1,3 +1,2 @@
-portage-stable:default/linux/arm64/23.0/hardened
-portage-stable:targets/systemd
+portage-stable:default/linux/arm64/23.0/hardened/selinux/systemd
 :coreos/base

From e0d9c41ad44ea44164eb54d743e67e5461d50ac1 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:37 +0200
Subject: [PATCH 04/92] sec-policy/selinux-apache: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-apache/Manifest        |  4 ++++
 .../sec-policy/selinux-apache/metadata.xml    |  8 ++++++++
 .../selinux-apache-2.20250213-r1.ebuild       | 20 +++++++++++++++++++
 .../selinux-apache-2.20250618-r1.ebuild       | 20 +++++++++++++++++++
 .../selinux-apache/selinux-apache-9999.ebuild | 20 +++++++++++++++++++
 5 files changed, 72 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/selinux-apache-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/selinux-apache-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/selinux-apache-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/selinux-apache-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/selinux-apache-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..a37739cbeb5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/selinux-apache-2.20250213-r1.ebuild
@@ -0,0 +1,20 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="apache"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for apache"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
+DEPEND="${DEPEND}
+	sec-policy/selinux-kerberos
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-kerberos
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/selinux-apache-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/selinux-apache-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..e2d81876428
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/selinux-apache-2.20250618-r1.ebuild
@@ -0,0 +1,20 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="apache"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for apache"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+DEPEND="${DEPEND}
+	sec-policy/selinux-kerberos
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-kerberos
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/selinux-apache-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/selinux-apache-9999.ebuild
new file mode 100644
index 00000000000..4173f043f1b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apache/selinux-apache-9999.ebuild
@@ -0,0 +1,20 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="apache"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for apache"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+DEPEND="${DEPEND}
+	sec-policy/selinux-kerberos
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-kerberos
+"

From fd4bcaba6d5417983a2d73ea8ce9c940df4f6d6b Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:38 +0200
Subject: [PATCH 05/92] sec-policy/selinux-apm: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-apm/Manifest           |  4 +++
 .../sec-policy/selinux-apm/metadata.xml       |  8 +++++
 .../selinux-apm-2.20250213-r1.ebuild          | 35 +++++++++++++++++++
 .../selinux-apm-2.20250618-r1.ebuild          | 35 +++++++++++++++++++
 .../selinux-apm/selinux-apm-9999.ebuild       | 35 +++++++++++++++++++
 5 files changed, 117 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/selinux-apm-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/selinux-apm-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/selinux-apm-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/selinux-apm-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/selinux-apm-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..12cc0942d3a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/selinux-apm-2.20250213-r1.ebuild
@@ -0,0 +1,35 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="acpi"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for acpi"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
+
+pkg_postinst() {
+	# "apm" module got renamed to "acpi", must remove apm first
+	# the contexts are okay even tho the modules are not
+	# replaced in the same command (doesnt become unlabeled_t)
+	for i in ${POLICY_TYPES}; do
+		if semodule -s "${i}" -l | grep apm >/dev/null 2>&1; then
+			semodule -s "${i}" -r apm
+		fi
+	done
+	selinux-policy-2_pkg_postinst
+}
+
+pkg_postrm() {
+	for i in ${POLICY_TYPES}; do
+		if semodule -s "${i}" -l | grep apm >/dev/null 2>&1; then
+			semodule -s "${i}" -r apm
+		fi
+	done
+	selinux-policy-2_pkg_postrm
+}
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/selinux-apm-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/selinux-apm-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..1df1044fc81
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/selinux-apm-2.20250618-r1.ebuild
@@ -0,0 +1,35 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="acpi"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for acpi"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+
+pkg_postinst() {
+	# "apm" module got renamed to "acpi", must remove apm first
+	# the contexts are okay even tho the modules are not
+	# replaced in the same command (doesnt become unlabeled_t)
+	for i in ${POLICY_TYPES}; do
+		if semodule -s "${i}" -l | grep apm >/dev/null 2>&1; then
+			semodule -s "${i}" -r apm
+		fi
+	done
+	selinux-policy-2_pkg_postinst
+}
+
+pkg_postrm() {
+	for i in ${POLICY_TYPES}; do
+		if semodule -s "${i}" -l | grep apm >/dev/null 2>&1; then
+			semodule -s "${i}" -r apm
+		fi
+	done
+	selinux-policy-2_pkg_postrm
+}
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/selinux-apm-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/selinux-apm-9999.ebuild
new file mode 100644
index 00000000000..261f6989972
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-apm/selinux-apm-9999.ebuild
@@ -0,0 +1,35 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="acpi"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for acpi"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+
+pkg_postinst() {
+	# "apm" module got renamed to "acpi", must remove apm first
+	# the contexts are okay even tho the modules are not
+	# replaced in the same command (doesnt become unlabeled_t)
+	for i in ${POLICY_TYPES}; do
+		if semodule -s "${i}" -l | grep apm >/dev/null 2>&1; then
+			semodule -s "${i}" -r apm
+		fi
+	done
+	selinux-policy-2_pkg_postinst
+}
+
+pkg_postrm() {
+	for i in ${POLICY_TYPES}; do
+		if semodule -s "${i}" -l | grep apm >/dev/null 2>&1; then
+			semodule -s "${i}" -r apm
+		fi
+	done
+	selinux-policy-2_pkg_postrm
+}

From 1546535b3d4723eab7df6c2b3914a1532edeae7e Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:38 +0200
Subject: [PATCH 06/92] sec-policy/selinux-bind: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-bind/Manifest               |  4 ++++
 .../sec-policy/selinux-bind/metadata.xml           |  8 ++++++++
 .../selinux-bind/selinux-bind-2.20250213-r1.ebuild | 14 ++++++++++++++
 .../selinux-bind/selinux-bind-2.20250618-r1.ebuild | 14 ++++++++++++++
 .../selinux-bind/selinux-bind-9999.ebuild          | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/selinux-bind-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/selinux-bind-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/selinux-bind-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/selinux-bind-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/selinux-bind-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..02b95339e9a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/selinux-bind-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="bind"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for bind"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/selinux-bind-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/selinux-bind-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..6208043f785
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/selinux-bind-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="bind"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for bind"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/selinux-bind-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/selinux-bind-9999.ebuild
new file mode 100644
index 00000000000..fc61ea28bf7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-bind/selinux-bind-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="bind"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for bind"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From e950fee42731c823160997458eb17cae1a27d23b Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:38 +0200
Subject: [PATCH 07/92] sec-policy/selinux-brctl: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-brctl/Manifest              |  4 ++++
 .../sec-policy/selinux-brctl/metadata.xml          |  8 ++++++++
 .../selinux-brctl-2.20250213-r1.ebuild             | 14 ++++++++++++++
 .../selinux-brctl-2.20250618-r1.ebuild             | 14 ++++++++++++++
 .../selinux-brctl/selinux-brctl-9999.ebuild        | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/selinux-brctl-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/selinux-brctl-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/selinux-brctl-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/selinux-brctl-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/selinux-brctl-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..76cef6f99ed
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/selinux-brctl-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="brctl"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for brctl"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/selinux-brctl-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/selinux-brctl-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..7902bc6d205
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/selinux-brctl-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="brctl"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for brctl"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/selinux-brctl-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/selinux-brctl-9999.ebuild
new file mode 100644
index 00000000000..ecdab7d7904
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-brctl/selinux-brctl-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="brctl"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for brctl"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From 7e73b4f77321526989f86fe13ecdc6923437612c Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:39 +0200
Subject: [PATCH 08/92] sec-policy/selinux-cdrecord: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-cdrecord/Manifest           |  4 ++++
 .../sec-policy/selinux-cdrecord/metadata.xml       |  8 ++++++++
 .../selinux-cdrecord-2.20250213-r1.ebuild          | 14 ++++++++++++++
 .../selinux-cdrecord-2.20250618-r1.ebuild          | 14 ++++++++++++++
 .../selinux-cdrecord/selinux-cdrecord-9999.ebuild  | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/selinux-cdrecord-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/selinux-cdrecord-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/selinux-cdrecord-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/selinux-cdrecord-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/selinux-cdrecord-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..c3d8d423cd5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/selinux-cdrecord-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="cdrecord"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for cdrecord"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/selinux-cdrecord-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/selinux-cdrecord-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..b2da23c074c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/selinux-cdrecord-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="cdrecord"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for cdrecord"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/selinux-cdrecord-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/selinux-cdrecord-9999.ebuild
new file mode 100644
index 00000000000..09b68e2cee1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-cdrecord/selinux-cdrecord-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="cdrecord"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for cdrecord"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From 31e44c44abfdb6940d7801bdf343ca4f951dcd40 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:39 +0200
Subject: [PATCH 09/92] sec-policy/selinux-chronyd: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-chronyd/Manifest            |  4 ++++
 .../sec-policy/selinux-chronyd/metadata.xml        |  8 ++++++++
 .../selinux-chronyd-2.20250213-r1.ebuild           | 14 ++++++++++++++
 .../selinux-chronyd-2.20250618-r1.ebuild           | 14 ++++++++++++++
 .../selinux-chronyd/selinux-chronyd-9999.ebuild    | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/selinux-chronyd-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/selinux-chronyd-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/selinux-chronyd-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/selinux-chronyd-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/selinux-chronyd-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..1d2bddea1f7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/selinux-chronyd-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="chronyd"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for chronyd"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/selinux-chronyd-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/selinux-chronyd-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..e5bfbda885f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/selinux-chronyd-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="chronyd"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for chronyd"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/selinux-chronyd-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/selinux-chronyd-9999.ebuild
new file mode 100644
index 00000000000..60cce44d22d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-chronyd/selinux-chronyd-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="chronyd"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for chronyd"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From aa96182e3199d619770b8dd34060ccbdedc7453c Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:39 +0200
Subject: [PATCH 10/92] sec-policy/selinux-dirmngr: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-dirmngr/Manifest            |  4 ++++
 .../sec-policy/selinux-dirmngr/metadata.xml        |  8 ++++++++
 .../selinux-dirmngr-2.20250213-r1.ebuild           | 14 ++++++++++++++
 .../selinux-dirmngr-2.20250618-r1.ebuild           | 14 ++++++++++++++
 .../selinux-dirmngr/selinux-dirmngr-9999.ebuild    | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/selinux-dirmngr-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/selinux-dirmngr-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/selinux-dirmngr-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/selinux-dirmngr-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/selinux-dirmngr-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..ec317c4ea74
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/selinux-dirmngr-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="dirmngr"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for dirmngr"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/selinux-dirmngr-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/selinux-dirmngr-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..23f0c911ab5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/selinux-dirmngr-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="dirmngr"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for dirmngr"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/selinux-dirmngr-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/selinux-dirmngr-9999.ebuild
new file mode 100644
index 00000000000..b60935e3560
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dirmngr/selinux-dirmngr-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="dirmngr"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for dirmngr"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From a39e76d9b9fd722f99cffff4eca6f795ca0aa7da Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:40 +0200
Subject: [PATCH 11/92] sec-policy/selinux-dnsmasq: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-dnsmasq/Manifest            |  4 ++++
 .../sec-policy/selinux-dnsmasq/metadata.xml        |  8 ++++++++
 .../selinux-dnsmasq-2.20250213-r1.ebuild           | 14 ++++++++++++++
 .../selinux-dnsmasq-2.20250618-r1.ebuild           | 14 ++++++++++++++
 .../selinux-dnsmasq/selinux-dnsmasq-9999.ebuild    | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/selinux-dnsmasq-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/selinux-dnsmasq-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/selinux-dnsmasq-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/selinux-dnsmasq-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/selinux-dnsmasq-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..557f27a39e9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/selinux-dnsmasq-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="dnsmasq"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for dnsmasq"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/selinux-dnsmasq-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/selinux-dnsmasq-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..b6ec8f990eb
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/selinux-dnsmasq-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="dnsmasq"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for dnsmasq"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/selinux-dnsmasq-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/selinux-dnsmasq-9999.ebuild
new file mode 100644
index 00000000000..2a289049542
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dnsmasq/selinux-dnsmasq-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="dnsmasq"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for dnsmasq"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From daddac0ec9dd164b517e255b118cc35c47de5146 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:40 +0200
Subject: [PATCH 12/92] sec-policy/selinux-docker: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-docker/Manifest        |  4 ++++
 .../sec-policy/selinux-docker/metadata.xml    |  8 +++++++
 .../selinux-docker-2.20250213-r1.ebuild       | 21 +++++++++++++++++++
 .../selinux-docker-2.20250618-r1.ebuild       | 21 +++++++++++++++++++
 .../selinux-docker/selinux-docker-9999.ebuild | 21 +++++++++++++++++++
 5 files changed, 75 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..46f1cb9dbe5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20250213-r1.ebuild
@@ -0,0 +1,21 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="docker"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for docker"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
+
+DEPEND="${DEPEND}
+	sec-policy/selinux-container
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-container
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..41a33049640
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20250618-r1.ebuild
@@ -0,0 +1,21 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="docker"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for docker"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+
+DEPEND="${DEPEND}
+	sec-policy/selinux-container
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-container
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-9999.ebuild
new file mode 100644
index 00000000000..2c75223af5a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-9999.ebuild
@@ -0,0 +1,21 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="docker"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for docker"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+
+DEPEND="${DEPEND}
+	sec-policy/selinux-container
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-container
+"

From b952361734a1fcf7a641de6e9eec2d596517140a Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:40 +0200
Subject: [PATCH 13/92] sec-policy/selinux-dracut: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-dracut/Manifest             |  4 ++++
 .../sec-policy/selinux-dracut/metadata.xml         |  8 ++++++++
 .../selinux-dracut-2.20250213-r1.ebuild            | 14 ++++++++++++++
 .../selinux-dracut-2.20250618-r1.ebuild            | 14 ++++++++++++++
 .../selinux-dracut/selinux-dracut-9999.ebuild      | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/selinux-dracut-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/selinux-dracut-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/selinux-dracut-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/selinux-dracut-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/selinux-dracut-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..e90235d5a31
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/selinux-dracut-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="dracut"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for dracut"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/selinux-dracut-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/selinux-dracut-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..8609bd21866
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/selinux-dracut-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="dracut"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for dracut"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/selinux-dracut-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/selinux-dracut-9999.ebuild
new file mode 100644
index 00000000000..283065c96ea
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-dracut/selinux-dracut-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="dracut"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for dracut"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From e9c0dbe01238295048068e912a7c6e88795e91cd Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:41 +0200
Subject: [PATCH 14/92] sec-policy/selinux-git: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-git/Manifest           |  4 ++++
 .../sec-policy/selinux-git/metadata.xml       |  8 +++++++
 .../selinux-git-2.20250213-r1.ebuild          | 21 +++++++++++++++++++
 .../selinux-git-2.20250618-r1.ebuild          | 21 +++++++++++++++++++
 .../selinux-git/selinux-git-9999.ebuild       | 21 +++++++++++++++++++
 5 files changed, 75 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/selinux-git-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/selinux-git-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/selinux-git-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/selinux-git-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/selinux-git-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..6a09776a257
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/selinux-git-2.20250213-r1.ebuild
@@ -0,0 +1,21 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="git"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for git"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
+
+DEPEND="${DEPEND}
+	sec-policy/selinux-apache
+"
+RDEPEND="${DEPEND}
+	sec-policy/selinux-apache
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/selinux-git-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/selinux-git-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..fd08b0979e7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/selinux-git-2.20250618-r1.ebuild
@@ -0,0 +1,21 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="git"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for git"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+
+DEPEND="${DEPEND}
+	sec-policy/selinux-apache
+"
+RDEPEND="${DEPEND}
+	sec-policy/selinux-apache
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/selinux-git-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/selinux-git-9999.ebuild
new file mode 100644
index 00000000000..4ae8751c59b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-git/selinux-git-9999.ebuild
@@ -0,0 +1,21 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="git"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for git"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+
+DEPEND="${DEPEND}
+	sec-policy/selinux-apache
+"
+RDEPEND="${DEPEND}
+	sec-policy/selinux-apache
+"

From 7d8c982e4062efe95cf6430caa6134e132a34bb2 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:41 +0200
Subject: [PATCH 15/92] sec-policy/selinux-gpg: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-gpg/Manifest           |  4 ++++
 .../sec-policy/selinux-gpg/metadata.xml       |  8 +++++++
 .../selinux-gpg-2.20250213-r1.ebuild          | 21 +++++++++++++++++++
 .../selinux-gpg-2.20250618-r1.ebuild          | 21 +++++++++++++++++++
 .../selinux-gpg/selinux-gpg-9999.ebuild       | 21 +++++++++++++++++++
 5 files changed, 75 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/selinux-gpg-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/selinux-gpg-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/selinux-gpg-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/selinux-gpg-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/selinux-gpg-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..ba568ee8e1d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/selinux-gpg-2.20250213-r1.ebuild
@@ -0,0 +1,21 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="gpg"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for gpg"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
+
+DEPEND="${DEPEND}
+	sec-policy/selinux-dirmngr
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-dirmngr
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/selinux-gpg-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/selinux-gpg-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..ef389faa6cc
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/selinux-gpg-2.20250618-r1.ebuild
@@ -0,0 +1,21 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="gpg"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for gpg"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+
+DEPEND="${DEPEND}
+	sec-policy/selinux-dirmngr
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-dirmngr
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/selinux-gpg-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/selinux-gpg-9999.ebuild
new file mode 100644
index 00000000000..f33e311087f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-gpg/selinux-gpg-9999.ebuild
@@ -0,0 +1,21 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="gpg"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for gpg"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+
+DEPEND="${DEPEND}
+	sec-policy/selinux-dirmngr
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-dirmngr
+"

From 0b5533b848231d84158bcb4112a88c2370f6d6f7 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:41 +0200
Subject: [PATCH 16/92] sec-policy/selinux-kdump: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-kdump/Manifest              |  4 ++++
 .../sec-policy/selinux-kdump/metadata.xml          |  8 ++++++++
 .../selinux-kdump-2.20250213-r1.ebuild             | 14 ++++++++++++++
 .../selinux-kdump-2.20250618-r1.ebuild             | 14 ++++++++++++++
 .../selinux-kdump/selinux-kdump-9999.ebuild        | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/selinux-kdump-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/selinux-kdump-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/selinux-kdump-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/selinux-kdump-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/selinux-kdump-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..6fa46c8908f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/selinux-kdump-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="kdump"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for kdump"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 ~riscv x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/selinux-kdump-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/selinux-kdump-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..e1edeaf6c91
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/selinux-kdump-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="kdump"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for kdump"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~riscv ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/selinux-kdump-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/selinux-kdump-9999.ebuild
new file mode 100644
index 00000000000..f2ed1bfe454
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kdump/selinux-kdump-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="kdump"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for kdump"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~riscv ~x86"
+fi

From 2c4e7bcb4455acf2c43b0a5696f28b294f4edcf7 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:42 +0200
Subject: [PATCH 17/92] sec-policy/selinux-kerberos: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-kerberos/Manifest           |  4 ++++
 .../sec-policy/selinux-kerberos/metadata.xml       |  8 ++++++++
 .../selinux-kerberos-2.20250213-r1.ebuild          | 14 ++++++++++++++
 .../selinux-kerberos-2.20250618-r1.ebuild          | 14 ++++++++++++++
 .../selinux-kerberos/selinux-kerberos-9999.ebuild  | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/selinux-kerberos-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/selinux-kerberos-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/selinux-kerberos-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/selinux-kerberos-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/selinux-kerberos-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..b7c799c7926
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/selinux-kerberos-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="kerberos"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for kerberos"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/selinux-kerberos-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/selinux-kerberos-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..5a41889e20d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/selinux-kerberos-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="kerberos"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for kerberos"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/selinux-kerberos-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/selinux-kerberos-9999.ebuild
new file mode 100644
index 00000000000..9646065ecb9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-kerberos/selinux-kerberos-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="kerberos"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for kerberos"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From 92518e7fe6e60740b3179835c5bf66772fd94c66 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:42 +0200
Subject: [PATCH 18/92] sec-policy/selinux-ldap: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-ldap/Manifest               |  4 ++++
 .../sec-policy/selinux-ldap/metadata.xml           |  8 ++++++++
 .../selinux-ldap/selinux-ldap-2.20250213-r1.ebuild | 14 ++++++++++++++
 .../selinux-ldap/selinux-ldap-2.20250618-r1.ebuild | 14 ++++++++++++++
 .../selinux-ldap/selinux-ldap-9999.ebuild          | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/selinux-ldap-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/selinux-ldap-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/selinux-ldap-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/selinux-ldap-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/selinux-ldap-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..ba4ee395e53
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/selinux-ldap-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="ldap"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for ldap"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/selinux-ldap-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/selinux-ldap-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..efa1a19fd87
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/selinux-ldap-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="ldap"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for ldap"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/selinux-ldap-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/selinux-ldap-9999.ebuild
new file mode 100644
index 00000000000..89423fba9d9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ldap/selinux-ldap-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="ldap"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for ldap"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From f5e48c5a0e58a7caba020e16b7ac775d596a12ee Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:42 +0200
Subject: [PATCH 19/92] sec-policy/selinux-loadkeys: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-loadkeys/Manifest           |  4 ++++
 .../sec-policy/selinux-loadkeys/metadata.xml       |  8 ++++++++
 .../selinux-loadkeys-2.20250213-r1.ebuild          | 14 ++++++++++++++
 .../selinux-loadkeys-2.20250618-r1.ebuild          | 14 ++++++++++++++
 .../selinux-loadkeys/selinux-loadkeys-9999.ebuild  | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/selinux-loadkeys-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/selinux-loadkeys-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/selinux-loadkeys-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/selinux-loadkeys-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/selinux-loadkeys-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..03441d1075e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/selinux-loadkeys-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="loadkeys"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for loadkeys"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/selinux-loadkeys-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/selinux-loadkeys-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..a4d91535682
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/selinux-loadkeys-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="loadkeys"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for loadkeys"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/selinux-loadkeys-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/selinux-loadkeys-9999.ebuild
new file mode 100644
index 00000000000..689c0c9a920
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-loadkeys/selinux-loadkeys-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="loadkeys"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for loadkeys"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From ec1c30ffceb66a0d5b69421c2a921390116021a5 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:43 +0200
Subject: [PATCH 20/92] sec-policy/selinux-logrotate: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-logrotate/Manifest          |  4 ++++
 .../sec-policy/selinux-logrotate/metadata.xml      |  8 ++++++++
 .../selinux-logrotate-2.20250213-r1.ebuild         | 14 ++++++++++++++
 .../selinux-logrotate-2.20250618-r1.ebuild         | 14 ++++++++++++++
 .../selinux-logrotate-9999.ebuild                  | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/selinux-logrotate-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/selinux-logrotate-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/selinux-logrotate-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/selinux-logrotate-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/selinux-logrotate-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..bff65e7f811
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/selinux-logrotate-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="logrotate"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for logrotate"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/selinux-logrotate-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/selinux-logrotate-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..8de02296253
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/selinux-logrotate-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="logrotate"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for logrotate"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/selinux-logrotate-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/selinux-logrotate-9999.ebuild
new file mode 100644
index 00000000000..9616700227b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-logrotate/selinux-logrotate-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="logrotate"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for logrotate"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From 0d16bb0906c0e2ddef131a868b7bf21b654ba656 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:43 +0200
Subject: [PATCH 21/92] sec-policy/selinux-makewhatis: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-makewhatis/Manifest         |  4 ++++
 .../sec-policy/selinux-makewhatis/metadata.xml     |  8 ++++++++
 .../selinux-makewhatis-2.20250213-r1.ebuild        | 14 ++++++++++++++
 .../selinux-makewhatis-2.20250618-r1.ebuild        | 14 ++++++++++++++
 .../selinux-makewhatis-9999.ebuild                 | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/selinux-makewhatis-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/selinux-makewhatis-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/selinux-makewhatis-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/selinux-makewhatis-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/selinux-makewhatis-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..e5b69e05eb2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/selinux-makewhatis-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="makewhatis"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for makewhatis"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/selinux-makewhatis-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/selinux-makewhatis-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..f8b5bc1e5ec
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/selinux-makewhatis-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="makewhatis"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for makewhatis"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/selinux-makewhatis-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/selinux-makewhatis-9999.ebuild
new file mode 100644
index 00000000000..29909e9f467
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-makewhatis/selinux-makewhatis-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="makewhatis"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for makewhatis"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From 199ef7f0d0434bd5635b60bbce1a4aaf74646f5a Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:43 +0200
Subject: [PATCH 22/92] sec-policy/selinux-mandb: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-mandb/Manifest              |  4 ++++
 .../sec-policy/selinux-mandb/metadata.xml          |  8 ++++++++
 .../selinux-mandb-2.20250213-r1.ebuild             | 14 ++++++++++++++
 .../selinux-mandb-2.20250618-r1.ebuild             | 14 ++++++++++++++
 .../selinux-mandb/selinux-mandb-9999.ebuild        | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/selinux-mandb-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/selinux-mandb-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/selinux-mandb-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/selinux-mandb-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/selinux-mandb-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..020af804585
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/selinux-mandb-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="mandb"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for mandb"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/selinux-mandb-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/selinux-mandb-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..7ee8bb6bf8a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/selinux-mandb-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="mandb"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for mandb"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/selinux-mandb-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/selinux-mandb-9999.ebuild
new file mode 100644
index 00000000000..cefbe518f24
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-mandb/selinux-mandb-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="mandb"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for mandb"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From 3a34fb99ef9f6b3aa9dc53551bd7a466e79cc628 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:44 +0200
Subject: [PATCH 23/92] sec-policy/selinux-ntp: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../portage-stable/sec-policy/selinux-ntp/Manifest |  4 ++++
 .../sec-policy/selinux-ntp/metadata.xml            |  8 ++++++++
 .../selinux-ntp/selinux-ntp-2.20250213-r1.ebuild   | 14 ++++++++++++++
 .../selinux-ntp/selinux-ntp-2.20250618-r1.ebuild   | 14 ++++++++++++++
 .../sec-policy/selinux-ntp/selinux-ntp-9999.ebuild | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/selinux-ntp-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/selinux-ntp-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/selinux-ntp-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/selinux-ntp-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/selinux-ntp-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..bd306f34a39
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/selinux-ntp-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="ntp"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for ntp"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/selinux-ntp-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/selinux-ntp-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..c81bffe2a6b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/selinux-ntp-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="ntp"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for ntp"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/selinux-ntp-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/selinux-ntp-9999.ebuild
new file mode 100644
index 00000000000..6117039bb92
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-ntp/selinux-ntp-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="ntp"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for ntp"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From 06c7f47ba0666e284d03fc01fbad3b033e530092 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:44 +0200
Subject: [PATCH 24/92] sec-policy/selinux-pcscd: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-pcscd/Manifest              |  4 ++++
 .../sec-policy/selinux-pcscd/metadata.xml          |  8 ++++++++
 .../selinux-pcscd-2.20250213-r1.ebuild             | 14 ++++++++++++++
 .../selinux-pcscd-2.20250618-r1.ebuild             | 14 ++++++++++++++
 .../selinux-pcscd/selinux-pcscd-9999.ebuild        | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/selinux-pcscd-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/selinux-pcscd-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/selinux-pcscd-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/selinux-pcscd-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/selinux-pcscd-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..e89a88b5dd9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/selinux-pcscd-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="pcscd"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for pcscd"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/selinux-pcscd-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/selinux-pcscd-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..ccc78c94d33
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/selinux-pcscd-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="pcscd"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for pcscd"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/selinux-pcscd-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/selinux-pcscd-9999.ebuild
new file mode 100644
index 00000000000..d126a38ec41
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-pcscd/selinux-pcscd-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="pcscd"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for pcscd"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From 932d9ed5f539e1f8114dcf35368be6d3a5c19e83 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:44 +0200
Subject: [PATCH 25/92] sec-policy/selinux-podman: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-podman/Manifest        |  4 ++++
 .../sec-policy/selinux-podman/metadata.xml    |  8 +++++++
 .../selinux-podman-2.20250213-r1.ebuild       | 21 +++++++++++++++++++
 .../selinux-podman-2.20250618-r1.ebuild       | 21 +++++++++++++++++++
 .../selinux-podman/selinux-podman-9999.ebuild | 21 +++++++++++++++++++
 5 files changed, 75 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/selinux-podman-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/selinux-podman-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/selinux-podman-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/selinux-podman-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/selinux-podman-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..d6e9ee43f03
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/selinux-podman-2.20250213-r1.ebuild
@@ -0,0 +1,21 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="podman"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for podman"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
+
+DEPEND="${DEPEND}
+	sec-policy/selinux-container
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-container
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/selinux-podman-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/selinux-podman-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..44a20d137c5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/selinux-podman-2.20250618-r1.ebuild
@@ -0,0 +1,21 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="podman"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for podman"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+
+DEPEND="${DEPEND}
+	sec-policy/selinux-container
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-container
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/selinux-podman-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/selinux-podman-9999.ebuild
new file mode 100644
index 00000000000..7d594d7d1ba
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-podman/selinux-podman-9999.ebuild
@@ -0,0 +1,21 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="podman"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for podman"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+
+DEPEND="${DEPEND}
+	sec-policy/selinux-container
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-container
+"

From b4a6318f6ab06acd8f2a6afbe641f007493cf77d Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:45 +0200
Subject: [PATCH 26/92] sec-policy/selinux-qemu: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-qemu/Manifest          |  4 ++++
 .../sec-policy/selinux-qemu/metadata.xml      |  8 ++++++++
 .../selinux-qemu-2.20250213-r1.ebuild         | 20 +++++++++++++++++++
 .../selinux-qemu-2.20250618-r1.ebuild         | 20 +++++++++++++++++++
 .../selinux-qemu/selinux-qemu-9999.ebuild     | 20 +++++++++++++++++++
 5 files changed, 72 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/selinux-qemu-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/selinux-qemu-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/selinux-qemu-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/selinux-qemu-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/selinux-qemu-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..939cafc2195
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/selinux-qemu-2.20250213-r1.ebuild
@@ -0,0 +1,20 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="qemu"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for qemu"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
+DEPEND="${DEPEND}
+	sec-policy/selinux-virt
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-virt
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/selinux-qemu-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/selinux-qemu-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..2f6f8a0c498
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/selinux-qemu-2.20250618-r1.ebuild
@@ -0,0 +1,20 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="qemu"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for qemu"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+DEPEND="${DEPEND}
+	sec-policy/selinux-virt
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-virt
+"
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/selinux-qemu-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/selinux-qemu-9999.ebuild
new file mode 100644
index 00000000000..7d24ef14c3d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-qemu/selinux-qemu-9999.ebuild
@@ -0,0 +1,20 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="qemu"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for qemu"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
+DEPEND="${DEPEND}
+	sec-policy/selinux-virt
+"
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-virt
+"

From 58f0b86c188d4427407a8776a28cf35a1774ddef Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:45 +0200
Subject: [PATCH 27/92] sec-policy/selinux-quota: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-quota/Manifest              |  4 ++++
 .../sec-policy/selinux-quota/metadata.xml          |  8 ++++++++
 .../selinux-quota-2.20250213-r1.ebuild             | 14 ++++++++++++++
 .../selinux-quota-2.20250618-r1.ebuild             | 14 ++++++++++++++
 .../selinux-quota/selinux-quota-9999.ebuild        | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/selinux-quota-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/selinux-quota-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/selinux-quota-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/selinux-quota-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/selinux-quota-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..4fa09f430cd
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/selinux-quota-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="quota"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for quota"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/selinux-quota-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/selinux-quota-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..d6851e9da0e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/selinux-quota-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="quota"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for quota"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/selinux-quota-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/selinux-quota-9999.ebuild
new file mode 100644
index 00000000000..0b3a3b59a33
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-quota/selinux-quota-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="quota"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for quota"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From 951d3a21480968ddaaa64f9a87e677311fef4e0d Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:45 +0200
Subject: [PATCH 28/92] sec-policy/selinux-rpc: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../portage-stable/sec-policy/selinux-rpc/Manifest |  4 ++++
 .../sec-policy/selinux-rpc/metadata.xml            |  8 ++++++++
 .../selinux-rpc/selinux-rpc-2.20250213-r1.ebuild   | 14 ++++++++++++++
 .../selinux-rpc/selinux-rpc-2.20250618-r1.ebuild   | 14 ++++++++++++++
 .../sec-policy/selinux-rpc/selinux-rpc-9999.ebuild | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/selinux-rpc-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/selinux-rpc-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/selinux-rpc-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/selinux-rpc-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/selinux-rpc-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..8426cdb1096
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/selinux-rpc-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="rpc"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for rpc"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/selinux-rpc-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/selinux-rpc-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..d08cfafe34a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/selinux-rpc-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="rpc"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for rpc"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/selinux-rpc-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/selinux-rpc-9999.ebuild
new file mode 100644
index 00000000000..89df85f4678
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpc/selinux-rpc-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="rpc"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for rpc"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From 9b4f0980842bb67ee4be322af5a24de039b88be4 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:46 +0200
Subject: [PATCH 29/92] sec-policy/selinux-rpcbind: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-rpcbind/Manifest            |  4 ++++
 .../sec-policy/selinux-rpcbind/metadata.xml        |  8 ++++++++
 .../selinux-rpcbind-2.20250213-r1.ebuild           | 14 ++++++++++++++
 .../selinux-rpcbind-2.20250618-r1.ebuild           | 14 ++++++++++++++
 .../selinux-rpcbind/selinux-rpcbind-9999.ebuild    | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/selinux-rpcbind-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/selinux-rpcbind-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/selinux-rpcbind-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/selinux-rpcbind-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/selinux-rpcbind-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..4d4d194af86
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/selinux-rpcbind-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="rpcbind"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for rpcbind"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/selinux-rpcbind-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/selinux-rpcbind-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..81c3318e808
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/selinux-rpcbind-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="rpcbind"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for rpcbind"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/selinux-rpcbind-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/selinux-rpcbind-9999.ebuild
new file mode 100644
index 00000000000..7299855d6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-rpcbind/selinux-rpcbind-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="rpcbind"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for rpcbind"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From f939c6b1a477cc44ba4b12af2a86e22d5c5ce96a Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:46 +0200
Subject: [PATCH 30/92] sec-policy/selinux-samba: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-samba/Manifest              |  4 ++++
 .../sec-policy/selinux-samba/metadata.xml          |  8 ++++++++
 .../selinux-samba-2.20250213-r1.ebuild             | 14 ++++++++++++++
 .../selinux-samba-2.20250618-r1.ebuild             | 14 ++++++++++++++
 .../selinux-samba/selinux-samba-9999.ebuild        | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/selinux-samba-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/selinux-samba-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/selinux-samba-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/selinux-samba-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/selinux-samba-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..5597a1ef4c6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/selinux-samba-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="samba"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for samba"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/selinux-samba-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/selinux-samba-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..3dafff45ddd
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/selinux-samba-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="samba"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for samba"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/selinux-samba-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/selinux-samba-9999.ebuild
new file mode 100644
index 00000000000..406127c2789
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-samba/selinux-samba-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="samba"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for samba"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From bfe7ac2068eb306135da78754ba10f0d0b8a1a21 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:46 +0200
Subject: [PATCH 31/92] sec-policy/selinux-sasl: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-sasl/Manifest               |  4 ++++
 .../sec-policy/selinux-sasl/metadata.xml           |  8 ++++++++
 .../selinux-sasl/selinux-sasl-2.20250213-r1.ebuild | 14 ++++++++++++++
 .../selinux-sasl/selinux-sasl-2.20250618-r1.ebuild | 14 ++++++++++++++
 .../selinux-sasl/selinux-sasl-9999.ebuild          | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/selinux-sasl-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/selinux-sasl-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/selinux-sasl-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/selinux-sasl-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/selinux-sasl-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..cfc894439de
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/selinux-sasl-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="sasl"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for sasl"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/selinux-sasl-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/selinux-sasl-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..1fff82f85fb
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/selinux-sasl-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="sasl"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for sasl"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/selinux-sasl-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/selinux-sasl-9999.ebuild
new file mode 100644
index 00000000000..88a2e5386d2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sasl/selinux-sasl-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="sasl"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for sasl"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From e954399f6dc2f05f8898f3e7cc426958cda01c4f Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:47 +0200
Subject: [PATCH 32/92] sec-policy/selinux-smartmon: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-smartmon/Manifest           |  4 ++++
 .../sec-policy/selinux-smartmon/metadata.xml       |  8 ++++++++
 .../selinux-smartmon-2.20250213-r1.ebuild          | 14 ++++++++++++++
 .../selinux-smartmon-2.20250618-r1.ebuild          | 14 ++++++++++++++
 .../selinux-smartmon/selinux-smartmon-9999.ebuild  | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/selinux-smartmon-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/selinux-smartmon-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/selinux-smartmon-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/selinux-smartmon-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/selinux-smartmon-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..30e90aab9e1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/selinux-smartmon-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="smartmon"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for smartmon"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/selinux-smartmon-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/selinux-smartmon-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..0e91a5ae7bf
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/selinux-smartmon-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="smartmon"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for smartmon"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/selinux-smartmon-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/selinux-smartmon-9999.ebuild
new file mode 100644
index 00000000000..6789f8e6f25
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-smartmon/selinux-smartmon-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="smartmon"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for smartmon"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From 44cbaec204c215489551def72cca2c63640deba9 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:47 +0200
Subject: [PATCH 33/92] sec-policy/selinux-sudo: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-sudo/Manifest               |  4 ++++
 .../sec-policy/selinux-sudo/metadata.xml           |  8 ++++++++
 .../selinux-sudo/selinux-sudo-2.20250213-r1.ebuild | 14 ++++++++++++++
 .../selinux-sudo/selinux-sudo-2.20250618-r1.ebuild | 14 ++++++++++++++
 .../selinux-sudo/selinux-sudo-9999.ebuild          | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/selinux-sudo-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/selinux-sudo-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/selinux-sudo-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/selinux-sudo-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/selinux-sudo-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..13f17a3052f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/selinux-sudo-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="sudo"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for sudo"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/selinux-sudo-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/selinux-sudo-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..88d298d8af9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/selinux-sudo-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="sudo"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for sudo"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/selinux-sudo-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/selinux-sudo-9999.ebuild
new file mode 100644
index 00000000000..6c60764cceb
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-sudo/selinux-sudo-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="sudo"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for sudo"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From a4c78017537db1804c6274c913c1e9d39ace72de Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:47 +0200
Subject: [PATCH 34/92] sec-policy/selinux-tcsd: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-tcsd/Manifest               |  4 ++++
 .../sec-policy/selinux-tcsd/metadata.xml           |  8 ++++++++
 .../selinux-tcsd/selinux-tcsd-2.20250213-r1.ebuild | 14 ++++++++++++++
 .../selinux-tcsd/selinux-tcsd-2.20250618-r1.ebuild | 14 ++++++++++++++
 .../selinux-tcsd/selinux-tcsd-9999.ebuild          | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/selinux-tcsd-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/selinux-tcsd-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/selinux-tcsd-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/selinux-tcsd-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/selinux-tcsd-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..c3dbdd303ad
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/selinux-tcsd-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="tcsd"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for tcsd"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/selinux-tcsd-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/selinux-tcsd-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..04859331292
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/selinux-tcsd-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="tcsd"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for tcsd"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/selinux-tcsd-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/selinux-tcsd-9999.ebuild
new file mode 100644
index 00000000000..66516eaac8d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-tcsd/selinux-tcsd-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="tcsd"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for tcsd"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From 8e11316320278afbb7f9b09b24d4805b80f663aa Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:48 +0200
Subject: [PATCH 35/92] sec-policy/selinux-virt: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-virt/Manifest               |  4 ++++
 .../sec-policy/selinux-virt/metadata.xml           |  8 ++++++++
 .../selinux-virt/selinux-virt-2.20250213-r1.ebuild | 14 ++++++++++++++
 .../selinux-virt/selinux-virt-2.20250618-r1.ebuild | 14 ++++++++++++++
 .../selinux-virt/selinux-virt-9999.ebuild          | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/selinux-virt-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/selinux-virt-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/selinux-virt-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/selinux-virt-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/selinux-virt-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..9866fa9b134
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/selinux-virt-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="virt"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for virt"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/selinux-virt-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/selinux-virt-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..0707292ad19
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/selinux-virt-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="virt"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for virt"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/selinux-virt-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/selinux-virt-9999.ebuild
new file mode 100644
index 00000000000..38aee6d364b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-virt/selinux-virt-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="virt"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for virt"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From 343df29cf4fbe253f4e3acb0372450ee99fa227a Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:48 +0200
Subject: [PATCH 36/92] sec-policy/selinux-wireguard: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sec-policy/selinux-wireguard/Manifest          |  4 ++++
 .../sec-policy/selinux-wireguard/metadata.xml      |  8 ++++++++
 .../selinux-wireguard-2.20250213-r1.ebuild         | 14 ++++++++++++++
 .../selinux-wireguard-2.20250618-r1.ebuild         | 14 ++++++++++++++
 .../selinux-wireguard-9999.ebuild                  | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/selinux-wireguard-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/selinux-wireguard-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/selinux-wireguard-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/selinux-wireguard-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/selinux-wireguard-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..cf4de2fdb58
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/selinux-wireguard-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="wireguard"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for wireguard"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/selinux-wireguard-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/selinux-wireguard-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..1b0350880f0
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/selinux-wireguard-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="wireguard"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for wireguard"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/selinux-wireguard-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/selinux-wireguard-9999.ebuild
new file mode 100644
index 00000000000..0d90ff1977c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-wireguard/selinux-wireguard-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="wireguard"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for wireguard"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From 09ef5e64ec1154d8865db347bf8cc2cfc45384a3 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:48 +0200
Subject: [PATCH 37/92] sec-policy/selinux-xfs: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../portage-stable/sec-policy/selinux-xfs/Manifest |  4 ++++
 .../sec-policy/selinux-xfs/metadata.xml            |  8 ++++++++
 .../selinux-xfs/selinux-xfs-2.20250213-r1.ebuild   | 14 ++++++++++++++
 .../selinux-xfs/selinux-xfs-2.20250618-r1.ebuild   | 14 ++++++++++++++
 .../sec-policy/selinux-xfs/selinux-xfs-9999.ebuild | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/selinux-xfs-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/selinux-xfs-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/selinux-xfs-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/selinux-xfs-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/selinux-xfs-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..7d8a44bd107
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/selinux-xfs-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="xfs"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for xfs"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/selinux-xfs-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/selinux-xfs-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..113cd052876
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/selinux-xfs-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="xfs"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for xfs"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/selinux-xfs-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/selinux-xfs-9999.ebuild
new file mode 100644
index 00000000000..41cb94fd990
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-xfs/selinux-xfs-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="xfs"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for xfs"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From 5badd1be77da75690ed9c51e4d08bf069d8261b5 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 18 Sep 2025 15:58:49 +0200
Subject: [PATCH 38/92] sec-policy/selinux-zfs: Add from Gentoo

It's from Gentoo commit 4d7080a9766d886cd15cdf4fa75890677c6266b1.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../portage-stable/sec-policy/selinux-zfs/Manifest |  4 ++++
 .../sec-policy/selinux-zfs/metadata.xml            |  8 ++++++++
 .../selinux-zfs/selinux-zfs-2.20250213-r1.ebuild   | 14 ++++++++++++++
 .../selinux-zfs/selinux-zfs-2.20250618-r1.ebuild   | 14 ++++++++++++++
 .../sec-policy/selinux-zfs/selinux-zfs-9999.ebuild | 14 ++++++++++++++
 5 files changed, 54 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/selinux-zfs-2.20250213-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/selinux-zfs-2.20250618-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/selinux-zfs-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/Manifest
new file mode 100644
index 00000000000..dc0c6d3942a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/Manifest
@@ -0,0 +1,4 @@
+DIST patchbundle-selinux-base-policy-2.20250213-r1.tar.bz2 276621 BLAKE2B 5a4b0c5fe017fd6c59c3f5d3a1af97e31485bd4325b10a2769883091e5ea6fd205ad42f346c06e6d443aeed9e46bf962febc177f58241c4633058918db6b7fb6 SHA512 1098cfb396d56dfc4f0c2b3ff90dcb9de3bf0b081f1d0c21d793fccc78e48d35a93883bb7fd54a0acd5fa2b06edc8965cbfe72e2b8f3ea325bbee18a8c8e7163
+DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616
+DIST refpolicy-2.20250213.tar.bz2 627837 BLAKE2B 64d64549bf1fcfc33107e8f4c842af4e3279a856c3a140d05749bae687ffadfe25e4b7383bef3618b13bbd553046d162fcd48b713500d3fd59073b5bece91008 SHA512 cbaf65dfe6d7cc886674bb37160170dac060265d5cf241bfac0c0e5ef45744f057107d81c933f01411c5cd538c95755b7a92331197e2b97b995efc4d6f266895
+DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/metadata.xml
new file mode 100644
index 00000000000..781bc07e6d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/selinux-zfs-2.20250213-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/selinux-zfs-2.20250213-r1.ebuild
new file mode 100644
index 00000000000..bf8ad8ee4b3
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/selinux-zfs-2.20250213-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="zfs"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for zfs"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="amd64 arm arm64 x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/selinux-zfs-2.20250618-r1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/selinux-zfs-2.20250618-r1.ebuild
new file mode 100644
index 00000000000..bce81db0ba9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/selinux-zfs-2.20250618-r1.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="zfs"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for zfs"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi
diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/selinux-zfs-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/selinux-zfs-9999.ebuild
new file mode 100644
index 00000000000..f30ef5b5264
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-zfs/selinux-zfs-9999.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+MODS="zfs"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for zfs"
+
+if [[ ${PV} != 9999* ]] ; then
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+fi

From 62e600e2c5394824d755c0cb06fb53179cf62407 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Wed, 23 Apr 2025 16:23:33 +0200
Subject: [PATCH 39/92] overlay coreos/user-patches: Add symlinks for newly
 added policy packages

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../coreos-overlay/coreos/user-patches/sec-policy/selinux-apache | 1 +
 .../coreos-overlay/coreos/user-patches/sec-policy/selinux-apm    | 1 +
 .../coreos-overlay/coreos/user-patches/sec-policy/selinux-bind   | 1 +
 .../coreos-overlay/coreos/user-patches/sec-policy/selinux-brctl  | 1 +
 .../coreos/user-patches/sec-policy/selinux-cdrecord              | 1 +
 .../coreos/user-patches/sec-policy/selinux-chronyd               | 1 +
 .../coreos/user-patches/sec-policy/selinux-dirmngr               | 1 +
 .../coreos/user-patches/sec-policy/selinux-dnsmasq               | 1 +
 .../coreos-overlay/coreos/user-patches/sec-policy/selinux-docker | 1 +
 .../coreos-overlay/coreos/user-patches/sec-policy/selinux-dracut | 1 +
 .../coreos-overlay/coreos/user-patches/sec-policy/selinux-git    | 1 +
 .../coreos-overlay/coreos/user-patches/sec-policy/selinux-gpg    | 1 +
 .../coreos-overlay/coreos/user-patches/sec-policy/selinux-kdump  | 1 +
 .../coreos/user-patches/sec-policy/selinux-kerberos              | 1 +
 .../coreos-overlay/coreos/user-patches/sec-policy/selinux-ldap   | 1 +
 .../coreos/user-patches/sec-policy/selinux-loadkeys              | 1 +
 .../coreos/user-patches/sec-policy/selinux-logrotate             | 1 +
 .../coreos/user-patches/sec-policy/selinux-makewhatis            | 1 +
 .../coreos-overlay/coreos/user-patches/sec-policy/selinux-mandb  | 1 +
 .../coreos-overlay/coreos/user-patches/sec-policy/selinux-ntp    | 1 +
 .../coreos-overlay/coreos/user-patches/sec-policy/selinux-pcscd  | 1 +
 .../coreos-overlay/coreos/user-patches/sec-policy/selinux-podman | 1 +
 .../coreos-overlay/coreos/user-patches/sec-policy/selinux-qemu   | 1 +
 .../coreos-overlay/coreos/user-patches/sec-policy/selinux-quota  | 1 +
 .../coreos-overlay/coreos/user-patches/sec-policy/selinux-rpc    | 1 +
 .../coreos/user-patches/sec-policy/selinux-rpcbind               | 1 +
 .../coreos-overlay/coreos/user-patches/sec-policy/selinux-samba  | 1 +
 .../coreos-overlay/coreos/user-patches/sec-policy/selinux-sasl   | 1 +
 .../coreos/user-patches/sec-policy/selinux-smartmon              | 1 +
 .../coreos-overlay/coreos/user-patches/sec-policy/selinux-sudo   | 1 +
 .../coreos-overlay/coreos/user-patches/sec-policy/selinux-tcsd   | 1 +
 .../coreos-overlay/coreos/user-patches/sec-policy/selinux-virt   | 1 +
 .../coreos/user-patches/sec-policy/selinux-wireguard             | 1 +
 .../coreos-overlay/coreos/user-patches/sec-policy/selinux-xfs    | 1 +
 .../coreos-overlay/coreos/user-patches/sec-policy/selinux-zfs    | 1 +
 35 files changed, 35 insertions(+)
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-apache
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-apm
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-bind
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-brctl
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-cdrecord
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-chronyd
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-dirmngr
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-dnsmasq
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-docker
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-dracut
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-git
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-gpg
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-kdump
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-kerberos
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-ldap
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-loadkeys
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-logrotate
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-makewhatis
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-mandb
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-ntp
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-pcscd
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-podman
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-qemu
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-quota
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-rpc
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-rpcbind
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-samba
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-sasl
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-smartmon
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-sudo
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-tcsd
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-virt
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-wireguard
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-xfs
 create mode 120000 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-zfs

diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-apache b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-apache
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-apache
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-apm b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-apm
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-apm
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-bind b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-bind
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-bind
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-brctl b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-brctl
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-brctl
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-cdrecord b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-cdrecord
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-cdrecord
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-chronyd b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-chronyd
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-chronyd
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-dirmngr b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-dirmngr
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-dirmngr
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-dnsmasq b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-dnsmasq
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-dnsmasq
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-docker b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-docker
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-docker
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-dracut b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-dracut
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-dracut
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-git b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-git
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-git
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-gpg b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-gpg
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-gpg
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-kdump b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-kdump
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-kdump
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-kerberos b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-kerberos
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-kerberos
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-ldap b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-ldap
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-ldap
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-loadkeys b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-loadkeys
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-loadkeys
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-logrotate b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-logrotate
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-logrotate
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-makewhatis b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-makewhatis
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-makewhatis
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-mandb b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-mandb
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-mandb
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-ntp b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-ntp
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-ntp
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-pcscd b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-pcscd
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-pcscd
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-podman b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-podman
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-podman
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-qemu b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-qemu
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-qemu
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-quota b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-quota
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-quota
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-rpc b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-rpc
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-rpc
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-rpcbind b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-rpcbind
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-rpcbind
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-samba b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-samba
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-samba
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-sasl b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-sasl
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-sasl
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-smartmon b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-smartmon
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-smartmon
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-sudo b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-sudo
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-sudo
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-tcsd b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-tcsd
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-tcsd
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-virt b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-virt
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-virt
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-wireguard b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-wireguard
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-wireguard
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-xfs b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-xfs
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-xfs
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-zfs b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-zfs
new file mode 120000
index 00000000000..283011aeaff
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-zfs
@@ -0,0 +1 @@
+flatcar-selinux-patches
\ No newline at end of file

From c2b7b4101034a306b172cc0fa93a96828e7e53b7 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Wed, 23 Apr 2025 16:24:36 +0200
Subject: [PATCH 40/92] .github: Add newly added policy packages to automation

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../workflows/portage-stable-packages-list    | 35 +++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/.github/workflows/portage-stable-packages-list b/.github/workflows/portage-stable-packages-list
index fb50818319c..ad70bff048a 100644
--- a/.github/workflows/portage-stable-packages-list
+++ b/.github/workflows/portage-stable-packages-list
@@ -568,13 +568,48 @@ scripts
 
 sec-keys/openpgp-keys-gentoo-release
 
+sec-policy/selinux-apache
+sec-policy/selinux-apm
 sec-policy/selinux-base
 sec-policy/selinux-base-policy
+sec-policy/selinux-bind
+sec-policy/selinux-brctl
+sec-policy/selinux-cdrecord
+sec-policy/selinux-chronyd
 sec-policy/selinux-container
 sec-policy/selinux-dbus
+sec-policy/selinux-dirmngr
+sec-policy/selinux-dnsmasq
+sec-policy/selinux-docker
+sec-policy/selinux-dracut
+sec-policy/selinux-git
+sec-policy/selinux-gpg
+sec-policy/selinux-kdump
+sec-policy/selinux-kerberos
+sec-policy/selinux-ldap
+sec-policy/selinux-loadkeys
+sec-policy/selinux-logrotate
+sec-policy/selinux-makewhatis
+sec-policy/selinux-mandb
+sec-policy/selinux-ntp
+sec-policy/selinux-pcscd
+sec-policy/selinux-podman
 sec-policy/selinux-policykit
+sec-policy/selinux-qemu
+sec-policy/selinux-quota
+sec-policy/selinux-rpc
+sec-policy/selinux-rpcbind
+sec-policy/selinux-samba
+sec-policy/selinux-sasl
+sec-policy/selinux-smartmon
 sec-policy/selinux-sssd
+sec-policy/selinux-sudo
+sec-policy/selinux-tcsd
 sec-policy/selinux-unconfined
+sec-policy/selinux-virt
+sec-policy/selinux-wireguard
+sec-policy/selinux-xfs
+sec-policy/selinux-zfs
 
 sys-apps/acl
 sys-apps/attr

From ce5a0474170357e97b80cb941e42aca2585e4b6e Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Wed, 23 Apr 2025 18:01:32 +0200
Subject: [PATCH 41/92] overlay profiles: Clean up selinux enabling

Not needed given that we have switched to selinux profile, which
enables selinux USE.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../profiles/coreos/base/package.use          | 24 ++++---------------
 .../profiles/coreos/base/use.mask             |  3 ---
 2 files changed, 4 insertions(+), 23 deletions(-)

diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
index b4f6832f414..b7b2312bff0 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
@@ -29,8 +29,8 @@ dev-vcs/git -perl -iconv
 app-admin/sudo -sendmail
 
 # disable hybrid cgroup as we use the unified mode now
-# use lzma which is the default on non-gentoo systems, enable selinux,
-sys-apps/systemd -cgroup-hybrid curl idn lzma selinux tpm
+# use lzma which is the default on non-gentoo systems,
+sys-apps/systemd -cgroup-hybrid curl idn lzma tpm
 net-libs/libmicrohttpd -ssl
 
 # disable kernel config detection and module building
@@ -59,7 +59,7 @@ sys-libs/glibc nscd
 dev-libs/cyrus-sasl kerberos -gdbm
 
 # don't build manpages for sssd
-sys-auth/sssd -python samba kerberos gssapi ssh selinux
+sys-auth/sssd -python samba kerberos gssapi ssh
 
 # enable logging command-line options in update_engine
 dev-cpp/glog gflags
@@ -72,20 +72,7 @@ sys-fs/quota rpc
 sys-apps/portage -xattr -rsync-verify
 
 # Enable -M and -Z flags; -M is used by mayday
-sys-process/lsof rpc selinux
-
-# Enable SELinux for all targets
-coreos-base/coreos          selinux
-sys-apps/dbus               selinux
-
-# Enable SELinux for coreutils
-sys-apps/coreutils          selinux
-
-# Enable SELinux for tar
-app-arch/tar                selinux
-
-# Enable SELinux for runc
-app-containers/runc selinux
+sys-process/lsof rpc
 
 # enable regular expression processing in jq
 app-misc/jq oniguruma
@@ -137,9 +124,6 @@ dev-libs/libpcre2 -pcre16 -pcre32 unicode
 # smi and ssl, no clue.
 net-analyzer/tcpdump -ssl -smi -samba
 
-# selinux: to find files with a particular SElinux label
-sys-apps/findutils selinux
-
 # Flatcar defaults formerly defined in coreos-overlay ebuilds
 app-containers/containerd btrfs device-mapper
 app-containers/docker btrfs overlay seccomp
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask
index 721bd1be2f6..70fc58b0779 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/use.mask
@@ -15,9 +15,6 @@ python_single_target_python3_12
 python_targets_python3_13
 python_single_target_python3_13
 
-# Unmask selinux so it can be enabled selectively in package.use
--selinux
-
 # We don't care about i10n, takes too much space, pulls in too many
 # extra dependencies.
 nls

From f70ef73282e56e4237c4c5f164e19c3879bd436e Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 24 Apr 2025 10:16:18 +0200
Subject: [PATCH 42/92] overlay profiles: Mask python and perl USE flags for
 generic images

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../coreos-overlay/profiles/coreos/targets/generic/package.use | 1 -
 .../profiles/coreos/targets/generic/package.use.mask           | 2 --
 .../coreos-overlay/profiles/coreos/targets/generic/use.mask    | 3 +++
 3 files changed, 3 insertions(+), 3 deletions(-)
 delete mode 100644 sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use.mask
 create mode 100644 sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/use.mask

diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
index aa39f4a3838..a9e25525fa3 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
@@ -16,7 +16,6 @@ dev-lang/python		gdbm
 dev-libs/dbus-glib	tools
 dev-libs/elfutils	-utils
 dev-libs/openssl	pkcs11
-dev-util/perf		-perl -python
 net-misc/dhcp	        -server
 net-misc/ntp            caps
 sys-apps/smartmontools	-daemon -update-drivedb -systemd
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use.mask
deleted file mode 100644
index 0251dc55915..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use.mask
+++ /dev/null
@@ -1,2 +0,0 @@
-# Only needed by Catalyst in the SDK, requires dev-lang/python-exec.
-sys-apps/util-linux python
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/use.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/use.mask
new file mode 100644
index 00000000000..a0ce76ef076
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/use.mask
@@ -0,0 +1,3 @@
+# Disable anything that pulls those interpreters into generic images.
+perl
+python

From b823b13e8a16f52ba841eafe1a069b3132089c3b Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 24 Apr 2025 10:18:14 +0200
Subject: [PATCH 43/92] overlay profiles: Drop enabling caps and audit USE
 flags for specific packages

selinux profile enables the USE flags for all of them.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../profiles/coreos/targets/generic/package.use             | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
index a9e25525fa3..5b81b02c1b5 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
@@ -10,22 +10,20 @@ app-editors/vim-core	minimal
 # Install our modifications and compatibility symlinks for ssh and ntp
 #
 # Install a SELinux policy directory symlink
-coreos-base/misc-files audit ntp openssh policycoreutils
+coreos-base/misc-files ntp openssh policycoreutils
 
 dev-lang/python		gdbm
 dev-libs/dbus-glib	tools
 dev-libs/elfutils	-utils
 dev-libs/openssl	pkcs11
 net-misc/dhcp	        -server
-net-misc/ntp            caps
 sys-apps/smartmontools	-daemon -update-drivedb -systemd
 sys-block/parted        device-mapper
 sys-fs/lvm2		-readline thin lvm
 sys-libs/ncurses	minimal
-sys-libs/pam		audit
 
 # enable journal gateway, bootctl and container features
-sys-apps/systemd audit elfutils gnuefi http importd iptables
+sys-apps/systemd elfutils gnuefi http importd iptables
 
 # epoll is needed for systemd-journal-remote to work. coreos/bugs#919
 net-libs/libmicrohttpd epoll

From 0728f71076d98fbad75e62936cd268a4b2687fb2 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 24 Apr 2025 16:51:44 +0200
Subject: [PATCH 44/92] overlay profiles: Disable caps for smartmontools

The USE=caps is only relevant for smartd, which we are not building
anyway.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../profiles/coreos/targets/generic/package.use               | 2 +-
 .../profiles/coreos/targets/generic/package.use.mask          | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)
 create mode 100644 sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use.mask

diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
index 5b81b02c1b5..27e23616a4b 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
@@ -17,7 +17,7 @@ dev-libs/dbus-glib	tools
 dev-libs/elfutils	-utils
 dev-libs/openssl	pkcs11
 net-misc/dhcp	        -server
-sys-apps/smartmontools	-daemon -update-drivedb -systemd
+sys-apps/smartmontools	-caps -daemon -update-drivedb -systemd
 sys-block/parted        device-mapper
 sys-fs/lvm2		-readline thin lvm
 sys-libs/ncurses	minimal
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use.mask
new file mode 100644
index 00000000000..88e0387df9f
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use.mask
@@ -0,0 +1,4 @@
+# Selinux profile force-enables USE=caps, but we don't need it for
+# smartmontools - it is only relevant for smartd daemon, which we do
+# not build.
+sys-apps/smartmontools caps

From 7bfd9727ae47ec89efa76cf8e143c4ba0746cdac Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 24 Apr 2025 18:09:49 +0200
Subject: [PATCH 45/92] overlay profiles: Allow python for sys-libs/libselinux

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../profiles/coreos/targets/generic/package.use.mask         | 5 +++++
 .../profiles/coreos/targets/generic/prod/make.defaults       | 2 ++
 2 files changed, 7 insertions(+)

diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use.mask
index 88e0387df9f..138ee5a3990 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use.mask
@@ -2,3 +2,8 @@
 # smartmontools - it is only relevant for smartd daemon, which we do
 # not build.
 sys-apps/smartmontools caps
+
+# Allow USE=python for sys-libs/libselinux - it is needed by portage
+# with USE=selinux. For production images, we will filter python files
+# out with an install mask.
+sys-libs/libselinux -python
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/make.defaults b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/make.defaults
index dbec72a5523..ca019b5934a 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/make.defaults
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/make.defaults
@@ -52,3 +52,5 @@ INSTALL_MASK="${INSTALL_MASK}
   /sbin/ebtables-save
   /sbin/xfs_scrub_all
 "
+
+# TODO: Add libselinux python stuff to install mask here.

From ce6c13333f9ca53afbb775135579e0704dce9b62 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Fri, 25 Apr 2025 10:45:31 +0200
Subject: [PATCH 46/92] overlay coreos/config: Add Flatcar modifications for
 sys-libs/libsemanage

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../coreos/config/env/sys-libs/libsemanage      | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libsemanage

diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libsemanage b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libsemanage
new file mode 100644
index 00000000000..b2c9deab5bb
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libsemanage
@@ -0,0 +1,17 @@
+# A hack to modify semanage.conf before it gets copied by
+# multilib_copy_sources.
+if declare -pf multilib_copy_sources >/dev/null 2>/dev/null; then
+    if ! declare -pf flatcar_hacked_multilib_copy_sources >/dev/null 2>&1; then
+        eval "$(echo 'flatcar_hacked_multilib_copy_sources()'; declare -pf multilib_copy_sources | tail -n +2)"
+    fi
+    multilib_copy_sources() {
+        # Enable compression in semanage.conf
+        sed -i \
+            -e 's/^\(bzip-blocksize\)=0/\1=1/' \
+            "${S}/src/semanage.conf"
+        flatcar_hacked_multilib_copy_sources "${@}"
+    }
+fi
+if [[ $(flatcar_target) = 'generic-prod' ]]; then
+    INSTALL_MASK+=" /usr/lib/python* "
+fi

From 329c6f46b77285c6a4ee1b8f878f9de74845bd67 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Fri, 25 Apr 2025 10:47:01 +0200
Subject: [PATCH 47/92] overlay sys-libs/libsemanage: Move to portage-stable

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sys-libs/libsemanage/Manifest                                 | 0
 .../sys-libs/libsemanage/files/libsemanage-extra-config.patch     | 0
 .../sys-libs/libsemanage/libsemanage-3.8.1.ebuild                 | 0
 .../sys-libs/libsemanage/metadata.xml                             | 0
 4 files changed, 0 insertions(+), 0 deletions(-)
 rename sdk_container/src/third_party/{coreos-overlay => portage-stable}/sys-libs/libsemanage/Manifest (100%)
 rename sdk_container/src/third_party/{coreos-overlay => portage-stable}/sys-libs/libsemanage/files/libsemanage-extra-config.patch (100%)
 rename sdk_container/src/third_party/{coreos-overlay => portage-stable}/sys-libs/libsemanage/libsemanage-3.8.1.ebuild (100%)
 rename sdk_container/src/third_party/{coreos-overlay => portage-stable}/sys-libs/libsemanage/metadata.xml (100%)

diff --git a/sdk_container/src/third_party/coreos-overlay/sys-libs/libsemanage/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/Manifest
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-libs/libsemanage/Manifest
rename to sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/Manifest
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-libs/libsemanage/files/libsemanage-extra-config.patch b/sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/files/libsemanage-extra-config.patch
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-libs/libsemanage/files/libsemanage-extra-config.patch
rename to sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/files/libsemanage-extra-config.patch
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-libs/libsemanage/libsemanage-3.8.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/libsemanage-3.8.1.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-libs/libsemanage/libsemanage-3.8.1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/libsemanage-3.8.1.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-libs/libsemanage/metadata.xml b/sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/metadata.xml
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-libs/libsemanage/metadata.xml
rename to sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/metadata.xml

From d6880b577f37ef030ef2a333e90a14616d19fe13 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Tue, 1 Jul 2025 16:52:14 +0200
Subject: [PATCH 48/92] sys-libs/libsemanage: Sync with Gentoo

It's from Gentoo commit 2a36cce420348509e5c8a75d75647c200f39b2bc.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../files/libsemanage-extra-config.patch      |  30 -----
 .../libsemanage/libsemanage-3.8.1.ebuild      |  58 +++++----
 .../libsemanage/libsemanage-9999.ebuild       | 117 ++++++++++++++++++
 3 files changed, 152 insertions(+), 53 deletions(-)
 delete mode 100644 sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/files/libsemanage-extra-config.patch
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/libsemanage-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/files/libsemanage-extra-config.patch b/sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/files/libsemanage-extra-config.patch
deleted file mode 100644
index ecd0ffd9202..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/files/libsemanage-extra-config.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-diff -r -u libsemanage-3.6/src/semanage.conf libsemanage-3.6-patched/src/semanage.conf
---- libsemanage-3.6/src/semanage.conf	2023-12-13 15:46:22.000000000 +0100
-+++ libsemanage-3.6-patched/src/semanage.conf	2024-02-21 14:33:06.055611733 +0100
-@@ -40,3 +40,26 @@
- # By default, semanage will generate policies for the SELinux target.
- # To build policies for Xen, uncomment the following line.
- #target-platform = xen
-+
-+# Set this to true to save the linked policy.
-+# This is normally only useful for analysis
-+# or debugging of policy.
-+save-linked=false
-+
-+# Set this to 0 to disable assertion checking.
-+# This should speed up building the kernel policy
-+# from policy modules, but may leave you open to
-+# dangerous rules which assertion checking
-+# would catch.
-+expand-check=1
-+
-+# Modules in the module store can be compressed
-+# with bzip2.  Set this to the bzip2 blocksize
-+# 1-9 when compressing.  The higher the number,
-+# the more memory is traded off for disk space.
-+# Set to 0 to disable bzip2 compression.
-+bzip-blocksize=0
-+
-+# Reduce memory usage for bzip2 compression and
-+# decompression of modules in the module store.
-+bzip-small=true
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/libsemanage-3.8.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/libsemanage-3.8.1.ebuild
index 77ad22f80ff..1d2144d8846 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/libsemanage-3.8.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/libsemanage-3.8.1.ebuild
@@ -24,36 +24,50 @@ fi
 
 LICENSE="GPL-2"
 SLOT="0/2"
-IUSE="+python"
-REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
 
-RDEPEND="
-	app-arch/bzip2[${MULTILIB_USEDEP}]
+RDEPEND="app-arch/bzip2[${MULTILIB_USEDEP}]
 	>=sys-libs/libsepol-${PV}:=[${MULTILIB_USEDEP}]
 	>=sys-libs/libselinux-${PV}:=[${MULTILIB_USEDEP}]
 	>=sys-process/audit-2.2.2[${MULTILIB_USEDEP}]
-	python? ( ${PYTHON_DEPS} )
-"
+	${PYTHON_DEPS}"
 DEPEND="${RDEPEND}"
-BDEPEND="
+BDEPEND=">=dev-lang/swig-2.0.4-r1
 	app-alternatives/yacc
 	app-alternatives/lex
-	python? (
-		>=dev-lang/swig-2.0.4-r1
-		virtual/pkgconfig
-	)
-"
+	virtual/pkgconfig"
 
 # tests are not meant to be run outside of the
 # full SELinux userland repo
 RESTRICT="test"
 
-PATCHES=(
-    "${FILESDIR}/libsemanage-extra-config.patch"
-)
-
 src_prepare() {
-	default
+	eapply_user
+
+	echo >> "${S}/src/semanage.conf"
+	echo "# Set this to true to save the linked policy." >> "${S}/src/semanage.conf"
+	echo "# This is normally only useful for analysis" >> "${S}/src/semanage.conf"
+	echo "# or debugging of policy." >> "${S}/src/semanage.conf"
+	echo "save-linked=false" >> "${S}/src/semanage.conf"
+	echo >> "${S}/src/semanage.conf"
+	echo "# Set this to 0 to disable assertion checking." >> "${S}/src/semanage.conf"
+	echo "# This should speed up building the kernel policy" >> "${S}/src/semanage.conf"
+	echo "# from policy modules, but may leave you open to" >> "${S}/src/semanage.conf"
+	echo "# dangerous rules which assertion checking" >> "${S}/src/semanage.conf"
+	echo "# would catch." >> "${S}/src/semanage.conf"
+	echo "expand-check=1" >> "${S}/src/semanage.conf"
+	echo >> "${S}/src/semanage.conf"
+	echo "# Modules in the module store can be compressed" >> "${S}/src/semanage.conf"
+	echo "# with bzip2.  Set this to the bzip2 blocksize" >> "${S}/src/semanage.conf"
+	echo "# 1-9 when compressing.  The higher the number," >> "${S}/src/semanage.conf"
+	echo "# the more memory is traded off for disk space." >> "${S}/src/semanage.conf"
+	echo "# Set to 0 to disable bzip2 compression." >> "${S}/src/semanage.conf"
+	echo "bzip-blocksize=0" >> "${S}/src/semanage.conf"
+	echo >> "${S}/src/semanage.conf"
+	echo "# Reduce memory usage for bzip2 compression and" >> "${S}/src/semanage.conf"
+	echo "# decompression of modules in the module store." >> "${S}/src/semanage.conf"
+	echo "bzip-small=true" >> "${S}/src/semanage.conf"
+
 	multilib_copy_sources
 }
 
@@ -66,7 +80,7 @@ multilib_src_compile() {
 		LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
 		all
 
-	if use python && multilib_is_native_abi; then
+	if multilib_is_native_abi; then
 		building_py() {
 			emake \
 				AR="$(tc-getAR)" \
@@ -85,7 +99,7 @@ multilib_src_install() {
 		LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
 		DESTDIR="${ED}" install
 
-	if use python && multilib_is_native_abi; then
+	if multilib_is_native_abi; then
 		installation_py() {
 			emake DESTDIR="${ED}" \
 				LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
@@ -98,8 +112,6 @@ multilib_src_install() {
 }
 
 multiib_src_install_all() {
-	if use python; then
-		python_setup
-		python_fix_shebang "${ED}"/usr/libexec/selinux/semanage_migrate_store
-	fi
+	python_setup
+	python_fix_shebang "${ED}"/usr/libexec/selinux/semanage_migrate_store
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/libsemanage-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/libsemanage-9999.ebuild
new file mode 100644
index 00000000000..f272a120b74
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libsemanage/libsemanage-9999.ebuild
@@ -0,0 +1,117 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+PYTHON_COMPAT=( python3_{10..13} )
+
+inherit python-r1 toolchain-funcs multilib-minimal
+
+MY_PV="${PV//_/-}"
+MY_P="${PN}-${MY_PV}"
+
+DESCRIPTION="SELinux kernel and policy management library"
+HOMEPAGE="https://github.com/SELinuxProject/selinux/wiki"
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/selinux.git"
+	S="${WORKDIR}/${P}/${PN}"
+else
+	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
+	KEYWORDS="~amd64 ~arm ~arm64 ~mips ~riscv ~x86"
+	S="${WORKDIR}/${MY_P}"
+fi
+
+LICENSE="GPL-2"
+SLOT="0/2"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+RDEPEND="app-arch/bzip2[${MULTILIB_USEDEP}]
+	>=sys-libs/libsepol-${PV}:=[${MULTILIB_USEDEP}]
+	>=sys-libs/libselinux-${PV}:=[${MULTILIB_USEDEP}]
+	>=sys-process/audit-2.2.2[${MULTILIB_USEDEP}]
+	${PYTHON_DEPS}"
+DEPEND="${RDEPEND}"
+BDEPEND=">=dev-lang/swig-2.0.4-r1
+	app-alternatives/yacc
+	app-alternatives/lex
+	virtual/pkgconfig"
+
+# tests are not meant to be run outside of the
+# full SELinux userland repo
+RESTRICT="test"
+
+src_prepare() {
+	eapply_user
+
+	echo >> "${S}/src/semanage.conf"
+	echo "# Set this to true to save the linked policy." >> "${S}/src/semanage.conf"
+	echo "# This is normally only useful for analysis" >> "${S}/src/semanage.conf"
+	echo "# or debugging of policy." >> "${S}/src/semanage.conf"
+	echo "save-linked=false" >> "${S}/src/semanage.conf"
+	echo >> "${S}/src/semanage.conf"
+	echo "# Set this to 0 to disable assertion checking." >> "${S}/src/semanage.conf"
+	echo "# This should speed up building the kernel policy" >> "${S}/src/semanage.conf"
+	echo "# from policy modules, but may leave you open to" >> "${S}/src/semanage.conf"
+	echo "# dangerous rules which assertion checking" >> "${S}/src/semanage.conf"
+	echo "# would catch." >> "${S}/src/semanage.conf"
+	echo "expand-check=1" >> "${S}/src/semanage.conf"
+	echo >> "${S}/src/semanage.conf"
+	echo "# Modules in the module store can be compressed" >> "${S}/src/semanage.conf"
+	echo "# with bzip2.  Set this to the bzip2 blocksize" >> "${S}/src/semanage.conf"
+	echo "# 1-9 when compressing.  The higher the number," >> "${S}/src/semanage.conf"
+	echo "# the more memory is traded off for disk space." >> "${S}/src/semanage.conf"
+	echo "# Set to 0 to disable bzip2 compression." >> "${S}/src/semanage.conf"
+	echo "bzip-blocksize=0" >> "${S}/src/semanage.conf"
+	echo >> "${S}/src/semanage.conf"
+	echo "# Reduce memory usage for bzip2 compression and" >> "${S}/src/semanage.conf"
+	echo "# decompression of modules in the module store." >> "${S}/src/semanage.conf"
+	echo "bzip-small=true" >> "${S}/src/semanage.conf"
+
+	multilib_copy_sources
+}
+
+multilib_src_compile() {
+	local -x CFLAGS="${CFLAGS} -fno-semantic-interposition"
+
+	emake \
+		AR="$(tc-getAR)" \
+		CC="$(tc-getCC)" \
+		LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
+		all
+
+	if multilib_is_native_abi; then
+		building_py() {
+			emake \
+				AR="$(tc-getAR)" \
+				CC="$(tc-getCC)" \
+				PKG_CONFIG="$(tc-getPKG_CONFIG)" \
+				LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
+				"$@"
+		}
+		python_foreach_impl building_py swigify
+		python_foreach_impl building_py pywrap
+	fi
+}
+
+multilib_src_install() {
+	emake \
+		LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
+		DESTDIR="${ED}" install
+
+	if multilib_is_native_abi; then
+		installation_py() {
+			emake DESTDIR="${ED}" \
+				LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
+				PKG_CONFIG="$(tc-getPKG_CONFIG)" \
+				install-pywrap
+			python_optimize # bug 531638
+		}
+		python_foreach_impl installation_py
+	fi
+}
+
+multiib_src_install_all() {
+	python_setup
+	python_fix_shebang "${ED}"/usr/libexec/selinux/semanage_migrate_store
+}

From 7e689dfdd75a98bb145c5455cc2bf340853c2dc5 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Fri, 25 Apr 2025 10:49:20 +0200
Subject: [PATCH 49/92] .github: Add sys-libs/libsemanage to automation

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .github/workflows/portage-stable-packages-list | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/portage-stable-packages-list b/.github/workflows/portage-stable-packages-list
index ad70bff048a..5966860b401 100644
--- a/.github/workflows/portage-stable-packages-list
+++ b/.github/workflows/portage-stable-packages-list
@@ -733,6 +733,7 @@ sys-libs/libcap-ng
 sys-libs/libnvme
 sys-libs/libseccomp
 sys-libs/libselinux
+sys-libs/libsemanage
 sys-libs/libsepol
 sys-libs/libunwind
 sys-libs/liburing

From 0a362e6417a03b168f663b654bcbb4295edc6954 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Tue, 29 Apr 2025 13:24:57 +0200
Subject: [PATCH 50/92] overlay sys-apps/policycoreutils: Move to
 portage-stable

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sys-apps/policycoreutils/Manifest                             | 0
 .../files/policycoreutils-3.1-0001-newrole-not-suid.patch         | 0
 .../sys-apps/policycoreutils/metadata.xml                         | 0
 .../sys-apps/policycoreutils/policycoreutils-3.8.1.ebuild         | 0
 4 files changed, 0 insertions(+), 0 deletions(-)
 rename sdk_container/src/third_party/{coreos-overlay => portage-stable}/sys-apps/policycoreutils/Manifest (100%)
 rename sdk_container/src/third_party/{coreos-overlay => portage-stable}/sys-apps/policycoreutils/files/policycoreutils-3.1-0001-newrole-not-suid.patch (100%)
 rename sdk_container/src/third_party/{coreos-overlay => portage-stable}/sys-apps/policycoreutils/metadata.xml (100%)
 rename sdk_container/src/third_party/{coreos-overlay => portage-stable}/sys-apps/policycoreutils/policycoreutils-3.8.1.ebuild (100%)

diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/policycoreutils/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/Manifest
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-apps/policycoreutils/Manifest
rename to sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/Manifest
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/policycoreutils/files/policycoreutils-3.1-0001-newrole-not-suid.patch b/sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/files/policycoreutils-3.1-0001-newrole-not-suid.patch
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-apps/policycoreutils/files/policycoreutils-3.1-0001-newrole-not-suid.patch
rename to sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/files/policycoreutils-3.1-0001-newrole-not-suid.patch
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/policycoreutils/metadata.xml b/sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/metadata.xml
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-apps/policycoreutils/metadata.xml
rename to sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/metadata.xml
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/policycoreutils/policycoreutils-3.8.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/policycoreutils-3.8.1.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-apps/policycoreutils/policycoreutils-3.8.1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/policycoreutils-3.8.1.ebuild

From a79373dbeafd3d1f7a99c94033c540eaaa74529e Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Tue, 1 Jul 2025 16:53:31 +0200
Subject: [PATCH 51/92] sys-apps/policycoreutils: Sync with Gentoo

It's from Gentoo commit ef1013be87a2c4ede3d16c2557881505b93c3996.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../policycoreutils-3.8.1.ebuild              | 142 ++++++---------
 .../policycoreutils-9999.ebuild               | 168 ++++++++++++++++++
 2 files changed, 218 insertions(+), 92 deletions(-)
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/policycoreutils-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/policycoreutils-3.8.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/policycoreutils-3.8.1.ebuild
index bbd002d1079..ca22fcccce9 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/policycoreutils-3.8.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/policycoreutils-3.8.1.ebuild
@@ -17,14 +17,14 @@ HOMEPAGE="https://github.com/SELinuxProject/selinux/wiki"
 if [[ ${PV} == 9999 ]]; then
 	inherit git-r3
 	EGIT_REPO_URI="https://github.com/SELinuxProject/selinux.git"
-	SRC_URI="!vanilla? ( https://dev.gentoo.org/~perfinion/distfiles/policycoreutils-extra-${EXTRAS_VER}.tar.bz2 )"
+	SRC_URI="https://dev.gentoo.org/~perfinion/distfiles/policycoreutils-extra-${EXTRAS_VER}.tar.bz2"
 	S1="${WORKDIR}/${P}/${PN}"
 	S2="${WORKDIR}/policycoreutils-extra"
 	S="${S1}"
 else
 	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz
-		!vanilla? ( https://dev.gentoo.org/~perfinion/distfiles/policycoreutils-extra-${EXTRAS_VER}.tar.bz2 )"
-	KEYWORDS="amd64 arm arm64 x86"
+		https://dev.gentoo.org/~perfinion/distfiles/policycoreutils-extra-${EXTRAS_VER}.tar.bz2"
+	KEYWORDS="amd64 arm arm64 ~riscv x86"
 	S1="${WORKDIR}/${MY_P}"
 	S2="${WORKDIR}/policycoreutils-extra"
 	S="${S1}"
@@ -32,30 +32,17 @@ fi
 
 LICENSE="GPL-2"
 SLOT="0"
-IUSE="audit pam split-usr vanilla +python"
-REQUIRED_USE="
-	!vanilla? ( python ${PYTHON_REQUIRED_USE} )
-"
-
-DEPEND="
-	python? (
-		>=sys-libs/libselinux-${PV}:=[python,${PYTHON_USEDEP}]
-		>=sys-libs/libsemanage-${PV}:=[python(+),${PYTHON_USEDEP}]
-		audit? ( >=sys-process/audit-1.5.1[python,${PYTHON_USEDEP}] )
-		${PYTHON_DEPS}
-	)
-	!python? (
-		>=sys-libs/libselinux-${PV}:=
-		>=sys-libs/libsemanage-${PV}:=
-		audit? ( >=sys-process/audit-1.5.1 )
-	)
+IUSE="audit pam split-usr"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+DEPEND=">=sys-libs/libselinux-${PV}:=[python,${PYTHON_USEDEP}]
+	>=sys-libs/libsemanage-${PV}:=[python(+),${PYTHON_USEDEP}]
 	>=sys-libs/libsepol-${PV}:=
 	sys-libs/libcap-ng:=
+	>=app-admin/setools-4.2.0[${PYTHON_USEDEP}]
+	audit? ( >=sys-process/audit-1.5.1[python,${PYTHON_USEDEP}] )
 	pam? ( sys-libs/pam:= )
-	!vanilla? (
-		>=app-admin/setools-4.2.0[${PYTHON_USEDEP}]
-	)
-"
+	${PYTHON_DEPS}"
 
 # Avoid dependency loop in the cross-compile case, bug #755173
 # (Still exists in native)
@@ -66,7 +53,7 @@ RDEPEND="${DEPEND}
 	app-misc/pax-utils"
 
 PDEPEND="sys-apps/semodule-utils
-	python? ( sys-apps/selinux-python )"
+	sys-apps/selinux-python"
 
 src_unpack() {
 	# Override default one because we need the SRC_URI ones even in case of 9999 ebuilds
@@ -84,33 +71,28 @@ src_prepare() {
 		eapply "${FILESDIR}/policycoreutils-3.1-0001-newrole-not-suid.patch"
 	fi
 
-	if ! use vanilla; then
-		# rlpkg is more useful than fixfiles
-		sed -i -e '/^all/s/fixfiles//' "${S}/scripts/Makefile" \
-			|| die "fixfiles sed 1 failed"
-		sed -i -e '/fixfiles/d' "${S}/scripts/Makefile" \
-			|| die "fixfiles sed 2 failed"
-	fi
+	# rlpkg is more useful than fixfiles
+	sed -i -e '/^all/s/fixfiles//' "${S}/scripts/Makefile" \
+		|| die "fixfiles sed 1 failed"
+	sed -i -e '/fixfiles/d' "${S}/scripts/Makefile" \
+		|| die "fixfiles sed 2 failed"
 
 	eapply_user
 
 	sed -i 's/-Werror//g' "${S1}"/*/Makefile || die "Failed to remove Werror"
 
-	if ! use vanilla; then
-		python_copy_sources
-		# Our extra code is outside the regular directory, so set it to the extra
-		# directory. We really should optimize this as it is ugly, but the extra
-		# code is needed for Gentoo at the same time that policycoreutils is present
-		# (so we cannot use an additional package for now).
-		S="${S2}"
-		python_copy_sources
-	fi
+	python_copy_sources
+	# Our extra code is outside the regular directory, so set it to the extra
+	# directory. We really should optimize this as it is ugly, but the extra
+	# code is needed for Gentoo at the same time that policycoreutils is present
+	# (so we cannot use an additional package for now).
+	S="${S2}"
+	python_copy_sources
 }
 
 src_compile() {
 	building() {
-		local build_dir=${1}
-		emake -C "${build_dir}" \
+		emake -C "${BUILD_DIR}" \
 			AUDIT_LOG_PRIVS="y" \
 			AUDITH="$(usex audit y n)" \
 			PAMH="$(usex pam y n)" \
@@ -118,27 +100,17 @@ src_compile() {
 			CC="$(tc-getCC)" \
 			LIBDIR="\$(PREFIX)/$(get_libdir)"
 	}
-	if ! use vanilla; then
-		building_with_python() {
-			building "${BUILD_DIR}"
-		}
-		S="${S1}" # Regular policycoreutils
-		python_foreach_impl building_with_python
-		S="${S2}" # Extra set
-		python_foreach_impl building_with_python
-		unset -f building_with_python
-	else
-		S="${S1}" # Regular policycoreutils
-		building "${S}"
-	fi
-	unset -f building
+	S="${S1}" # Regular policycoreutils
+	python_foreach_impl building
+	S="${S2}" # Extra set
+	python_foreach_impl building
 }
 
 src_install() {
-	installation-policycoreutils-base() {
-		local build_dir=${1}
+	# Python scripts are present in many places. There are no extension modules.
+	installation-policycoreutils() {
 		einfo "Installing policycoreutils"
-		emake -C "${build_dir}" DESTDIR="${D}" \
+		emake -C "${BUILD_DIR}" DESTDIR="${D}" \
 			AUDIT_LOG_PRIVS="y" \
 			AUDITH="$(usex audit y n)" \
 			PAMH="$(usex pam y n)" \
@@ -146,34 +118,22 @@ src_install() {
 			CC="$(tc-getCC)" \
 			LIBDIR="\$(PREFIX)/$(get_libdir)" \
 			install
+		python_optimize
 	}
 
-	if ! use vanilla; then
-		# Python scripts are present in many places. There are no extension modules.
-		installation-policycoreutils() {
-			installation-policycoreutils-base "${BUILD_DIR}"
-			python_optimize
-		}
-
-		installation-extras() {
-			einfo "Installing policycoreutils-extra"
-			emake -C "${BUILD_DIR}" \
-				DESTDIR="${D}" \
-				install
-			python_optimize
-		}
-
-		S="${S1}" # policycoreutils
-		python_foreach_impl installation-policycoreutils
-		S="${S2}" # extras
-		python_foreach_impl installation-extras
-		S="${S1}" # back for later
-		unset -f installation-extras installation-policycoreutils
-	else
-		S="${S1}" # policycoreutils
-		installation-policycoreutils-base "${S}"
-	fi
-	unset -f installation-policycoreutils-base
+	installation-extras() {
+		einfo "Installing policycoreutils-extra"
+		emake -C "${BUILD_DIR}" \
+			DESTDIR="${D}" \
+			install
+		python_optimize
+	}
+
+	S="${S1}" # policycoreutils
+	python_foreach_impl installation-policycoreutils
+	S="${S2}" # extras
+	python_foreach_impl installation-extras
+	S="${S1}" # back for later
 
 	# remove redhat-style init script
 	rm -fR "${D}/etc/rc.d" || die
@@ -192,12 +152,10 @@ src_install() {
 	dodir /var/lib/selinux
 	keepdir /var/lib/selinux
 
-	if ! use vanilla; then
-		# Set version-specific scripts
-		for pyscript in rlpkg; do
-			python_replicate_script "${ED}/usr/sbin/${pyscript}"
-		done
-	fi
+	# Set version-specific scripts
+	for pyscript in rlpkg; do
+	  python_replicate_script "${ED}/usr/sbin/${pyscript}"
+	done
 }
 
 pkg_postinst() {
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/policycoreutils-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/policycoreutils-9999.ebuild
new file mode 100644
index 00000000000..452cc194cdc
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/policycoreutils/policycoreutils-9999.ebuild
@@ -0,0 +1,168 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_REQ_USE="xml(+)"
+
+inherit python-r1 toolchain-funcs bash-completion-r1
+
+MY_PV="${PV//_/-}"
+MY_P="${PN}-${MY_PV}"
+EXTRAS_VER="1.37"
+
+DESCRIPTION="SELinux core utilities"
+HOMEPAGE="https://github.com/SELinuxProject/selinux/wiki"
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/selinux.git"
+	SRC_URI="https://dev.gentoo.org/~perfinion/distfiles/policycoreutils-extra-${EXTRAS_VER}.tar.bz2"
+	S1="${WORKDIR}/${P}/${PN}"
+	S2="${WORKDIR}/policycoreutils-extra"
+	S="${S1}"
+else
+	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz
+		https://dev.gentoo.org/~perfinion/distfiles/policycoreutils-extra-${EXTRAS_VER}.tar.bz2"
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+	S1="${WORKDIR}/${MY_P}"
+	S2="${WORKDIR}/policycoreutils-extra"
+	S="${S1}"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="audit pam split-usr"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+DEPEND=">=sys-libs/libselinux-${PV}:=[python,${PYTHON_USEDEP}]
+	>=sys-libs/libsemanage-${PV}:=[python(+),${PYTHON_USEDEP}]
+	>=sys-libs/libsepol-${PV}:=
+	sys-libs/libcap-ng:=
+	>=app-admin/setools-4.2.0[${PYTHON_USEDEP}]
+	audit? ( >=sys-process/audit-1.5.1[python,${PYTHON_USEDEP}] )
+	pam? ( sys-libs/pam:= )
+	${PYTHON_DEPS}"
+
+# Avoid dependency loop in the cross-compile case, bug #755173
+# (Still exists in native)
+BDEPEND="sys-devel/gettext"
+
+# pax-utils for scanelf used by rlpkg
+RDEPEND="${DEPEND}
+	app-misc/pax-utils"
+
+PDEPEND="sys-apps/semodule-utils
+	sys-apps/selinux-python"
+
+src_unpack() {
+	# Override default one because we need the SRC_URI ones even in case of 9999 ebuilds
+	default
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	fi
+}
+
+src_prepare() {
+	S="${S1}"
+	cd "${S}" || die "Failed to switch to ${S}"
+	if [[ ${PV} != 9999 ]] ; then
+		# If needed for live ebuilds please use /etc/portage/patches
+		eapply "${FILESDIR}/policycoreutils-3.1-0001-newrole-not-suid.patch"
+	fi
+
+	# rlpkg is more useful than fixfiles
+	sed -i -e '/^all/s/fixfiles//' "${S}/scripts/Makefile" \
+		|| die "fixfiles sed 1 failed"
+	sed -i -e '/fixfiles/d' "${S}/scripts/Makefile" \
+		|| die "fixfiles sed 2 failed"
+
+	eapply_user
+
+	sed -i 's/-Werror//g' "${S1}"/*/Makefile || die "Failed to remove Werror"
+
+	python_copy_sources
+	# Our extra code is outside the regular directory, so set it to the extra
+	# directory. We really should optimize this as it is ugly, but the extra
+	# code is needed for Gentoo at the same time that policycoreutils is present
+	# (so we cannot use an additional package for now).
+	S="${S2}"
+	python_copy_sources
+}
+
+src_compile() {
+	building() {
+		emake -C "${BUILD_DIR}" \
+			AUDIT_LOG_PRIVS="y" \
+			AUDITH="$(usex audit y n)" \
+			PAMH="$(usex pam y n)" \
+			SESANDBOX="n" \
+			CC="$(tc-getCC)" \
+			LIBDIR="\$(PREFIX)/$(get_libdir)"
+	}
+	S="${S1}" # Regular policycoreutils
+	python_foreach_impl building
+	S="${S2}" # Extra set
+	python_foreach_impl building
+}
+
+src_install() {
+	# Python scripts are present in many places. There are no extension modules.
+	installation-policycoreutils() {
+		einfo "Installing policycoreutils"
+		emake -C "${BUILD_DIR}" DESTDIR="${D}" \
+			AUDIT_LOG_PRIVS="y" \
+			AUDITH="$(usex audit y n)" \
+			PAMH="$(usex pam y n)" \
+			SESANDBOX="n" \
+			CC="$(tc-getCC)" \
+			LIBDIR="\$(PREFIX)/$(get_libdir)" \
+			install
+		python_optimize
+	}
+
+	installation-extras() {
+		einfo "Installing policycoreutils-extra"
+		emake -C "${BUILD_DIR}" \
+			DESTDIR="${D}" \
+			install
+		python_optimize
+	}
+
+	S="${S1}" # policycoreutils
+	python_foreach_impl installation-policycoreutils
+	S="${S2}" # extras
+	python_foreach_impl installation-extras
+	S="${S1}" # back for later
+
+	# remove redhat-style init script
+	rm -fR "${D}/etc/rc.d" || die
+
+	# compatibility symlinks
+	if use split-usr; then
+		dosym ../../sbin/setfiles /usr/sbin/setfiles
+	else
+		# remove sestatus symlink
+		rm -f "${D}"/usr/sbin/sestatus || die
+	fi
+
+	bashcomp_alias setsebool getsebool
+
+	# location for policy definitions
+	dodir /var/lib/selinux
+	keepdir /var/lib/selinux
+
+	# Set version-specific scripts
+	for pyscript in rlpkg; do
+	  python_replicate_script "${ED}/usr/sbin/${pyscript}"
+	done
+}
+
+pkg_postinst() {
+	for POLICY_TYPE in ${POLICY_TYPES} ; do
+		# There have been some changes to the policy store, rebuilding now.
+		# https://marc.info/?l=selinux&m=143757277819717&w=2
+		einfo "Rebuilding store ${POLICY_TYPE} in '${ROOT:-/}' (without re-loading)."
+		semodule -p "${ROOT:-/}" -s "${POLICY_TYPE}" -n -B || die "Failed to rebuild policy store ${POLICY_TYPE}"
+	done
+}

From ebfca802f795fe007d24632d95d5f85f552a1c49 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Tue, 29 Apr 2025 13:28:43 +0200
Subject: [PATCH 52/92] .github: Add sys-apps/policycoreutils to automation

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .github/workflows/portage-stable-packages-list | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/portage-stable-packages-list b/.github/workflows/portage-stable-packages-list
index 5966860b401..4e09f5e913d 100644
--- a/.github/workflows/portage-stable-packages-list
+++ b/.github/workflows/portage-stable-packages-list
@@ -652,6 +652,7 @@ sys-apps/nvme-cli
 sys-apps/pciutils
 sys-apps/pcsc-lite
 sys-apps/pkgcore
+sys-apps/policycoreutils
 sys-apps/portage
 sys-apps/pv
 sys-apps/sandbox

From 948da5d253061c252ce5c2660eff347ed2686ff9 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 8 May 2025 15:11:17 +0200
Subject: [PATCH 53/92] overlay coreos/config: Add python stuff to install mask
 for prod images

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../coreos-overlay/coreos/config/env/sys-libs/libselinux       | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libselinux

diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libselinux b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libselinux
new file mode 100644
index 00000000000..5bd252142b1
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libselinux
@@ -0,0 +1,3 @@
+if [[ $(flatcar_target) = 'generic-prod' ]]; then
+    INSTALL_MASK+=" /usr/lib/python* "
+fi

From 62aab267c95c9063adb19a9f1967444ecdfda14d Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 8 May 2025 16:22:51 +0200
Subject: [PATCH 54/92] overlay coreos/user-patches: Drop a patch for
 sys-libs/libsemanage

We apply the fix in a different way.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../user-patches/sys-libs/libsemanage/README.md      |  4 ----
 .../sys-libs/libsemanage/compress-modules.patch      | 12 ------------
 2 files changed, 16 deletions(-)
 delete mode 100644 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-libs/libsemanage/README.md
 delete mode 100644 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-libs/libsemanage/compress-modules.patch

diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-libs/libsemanage/README.md b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-libs/libsemanage/README.md
deleted file mode 100644
index a3e6280660b..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-libs/libsemanage/README.md
+++ /dev/null
@@ -1,4 +0,0 @@
-We have a patch that modifies the semanage.conf file that is
-previously modified by the Gentoo ebuild. The patch enables the
-SELinux module compression to save some disk space (the modules went
-from 33MB to 3MB).
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-libs/libsemanage/compress-modules.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-libs/libsemanage/compress-modules.patch
deleted file mode 100644
index 488f44555d9..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-libs/libsemanage/compress-modules.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -r -u libsemanage-3.6-patched/src/semanage.conf libsemanage-3.6-flatcar/src/semanage.conf
---- libsemanage-3.6-patched/src/semanage.conf	2024-02-21 14:33:06.055611733 +0100
-+++ libsemanage-3.6-flatcar/src/semanage.conf	2024-02-21 14:42:13.566991009 +0100
-@@ -58,7 +58,7 @@
- # 1-9 when compressing.  The higher the number,
- # the more memory is traded off for disk space.
- # Set to 0 to disable bzip2 compression.
--bzip-blocksize=0
-+bzip-blocksize=1
- 
- # Reduce memory usage for bzip2 compression and
- # decompression of modules in the module store.

From 6e98ea342b81201607fda141b489e5a7495423d8 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 8 May 2025 16:29:05 +0200
Subject: [PATCH 55/92] app-admin/setools: Add from Gentoo

It's from Gentoo commit dd8f1e13525265315752f252be7515f18e80334a.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../portage-stable/app-admin/setools/Manifest |  1 +
 .../files/setools-4.5.1-remove-gui.patch      | 21 +++++++
 .../app-admin/setools/metadata.xml            | 11 ++++
 .../app-admin/setools/setools-4.5.1.ebuild    | 60 +++++++++++++++++++
 .../app-admin/setools/setools-9999.ebuild     | 60 +++++++++++++++++++
 5 files changed, 153 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/app-admin/setools/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/app-admin/setools/files/setools-4.5.1-remove-gui.patch
 create mode 100644 sdk_container/src/third_party/portage-stable/app-admin/setools/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/app-admin/setools/setools-4.5.1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/app-admin/setools/setools-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/app-admin/setools/Manifest b/sdk_container/src/third_party/portage-stable/app-admin/setools/Manifest
new file mode 100644
index 00000000000..cddf08f12d6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-admin/setools/Manifest
@@ -0,0 +1 @@
+DIST setools-4.5.1.tar.bz2 264998 BLAKE2B 479cec6f541c1e7125d641928ba49aee949e538612a478840cec2d70106dcf9f7fa5b8049c9d18c560587670ee624a3a744714667d52b99cff24c51e72026db7 SHA512 1045c223423fcb056ffbc2f93c4dc0ccc6ae078ce7d2acbe3a3c65de19440fe801b5b9f71038cde62bf9851f52d868c845aafbe33691ee531cf9854217e061d8
diff --git a/sdk_container/src/third_party/portage-stable/app-admin/setools/files/setools-4.5.1-remove-gui.patch b/sdk_container/src/third_party/portage-stable/app-admin/setools/files/setools-4.5.1-remove-gui.patch
new file mode 100644
index 00000000000..efb7ae76e49
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-admin/setools/files/setools-4.5.1-remove-gui.patch
@@ -0,0 +1,21 @@
+diff --git a/setup.py b/setup.py
+index 05aac33..c685791 100644
+--- a/setup.py
++++ b/setup.py
+@@ -70,13 +70,10 @@ setup(name='setools',
+       author='Chris PeBenito',
+       author_email='pebenito@ieee.org',
+       url='https://github.com/SELinuxProject/setools',
+-      packages=['setools', 'setools.checker', 'setools.diff', 'setoolsgui', 'setoolsgui.widgets',
+-                'setoolsgui.widgets.criteria', 'setoolsgui.widgets.details',
+-                'setoolsgui.widgets.models', 'setoolsgui.widgets.views'],
+-      scripts=['apol', 'sediff', 'seinfo', 'seinfoflow', 'sesearch', 'sedta', 'sechecker'],
++      packages=['setools', 'setools.checker', 'setools.diff'],
++      scripts=['sediff', 'seinfo', 'seinfoflow', 'sesearch', 'sedta', 'sechecker'],
+       data_files=installed_data,
+-      package_data={'': ['*.css', '*.html'],
+-                    'setools': ['perm_map', 'policyrep.pyi', 'py.typed']},
++      package_data={'setools': ['perm_map', 'policyrep.pyi', 'py.typed']},
+       ext_modules=cythonize(ext_py_mods, include_path=['setools/policyrep'],
+                             annotate=cython_annotate,
+                             compiler_directives={"language_level": 3,
diff --git a/sdk_container/src/third_party/portage-stable/app-admin/setools/metadata.xml b/sdk_container/src/third_party/portage-stable/app-admin/setools/metadata.xml
new file mode 100644
index 00000000000..2367a4105f5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-admin/setools/metadata.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+	<upstream>
+		<remote-id type="github">SELinuxProject/setools</remote-id>
+	</upstream>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/app-admin/setools/setools-4.5.1.ebuild b/sdk_container/src/third_party/portage-stable/app-admin/setools/setools-4.5.1.ebuild
new file mode 100644
index 00000000000..9f8c4678938
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-admin/setools/setools-4.5.1.ebuild
@@ -0,0 +1,60 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{10..13} )
+
+inherit distutils-r1
+
+DESCRIPTION="Policy Analysis Tools for SELinux"
+HOMEPAGE="https://github.com/SELinuxProject/setools/wiki"
+
+if [[ ${PV} == *9999* ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/setools.git"
+	S="${WORKDIR}/${P}"
+else
+	SRC_URI="https://github.com/SELinuxProject/setools/releases/download/${PV}/${P}.tar.bz2"
+	KEYWORDS="amd64 arm arm64 ~riscv x86"
+	S="${WORKDIR}/${PN}"
+fi
+
+LICENSE="GPL-2 LGPL-2.1"
+SLOT="0"
+IUSE="gui test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="${PYTHON_DEPS}
+	>=dev-python/networkx-2.6[${PYTHON_USEDEP}]
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	>=sys-libs/libsepol-3.2:=
+	>=sys-libs/libselinux-3.2:=
+	gui? (
+		dev-python/pyqt6[gui,widgets,${PYTHON_USEDEP}]
+		dev-python/pygraphviz[${PYTHON_USEDEP}]
+	)"
+DEPEND="${RDEPEND}"
+BDEPEND=">=dev-python/cython-0.29.14[${PYTHON_USEDEP}]
+	test? (
+		dev-python/pyqt6[gui,testlib,widgets,${PYTHON_USEDEP}]
+		dev-python/pytest-qt[${PYTHON_USEDEP}]
+		sys-apps/checkpolicy
+	)"
+
+distutils_enable_tests pytest
+
+python_prepare_all() {
+	sed -i "s@^lib_dirs = .*@lib_dirs = ['${ROOT:-/}usr/$(get_libdir)']@" "${S}"/setup.py || \
+		die "failed to set lib_dirs"
+
+	use gui || PATCHES+=( "${FILESDIR}"/${P}-remove-gui.patch )
+	distutils-r1_python_prepare_all
+}
+
+python_test() {
+	rm -rf setools || die
+	epytest
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-admin/setools/setools-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-admin/setools/setools-9999.ebuild
new file mode 100644
index 00000000000..052075285d7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-admin/setools/setools-9999.ebuild
@@ -0,0 +1,60 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{10..13} )
+
+inherit distutils-r1
+
+DESCRIPTION="Policy Analysis Tools for SELinux"
+HOMEPAGE="https://github.com/SELinuxProject/setools/wiki"
+
+if [[ ${PV} == *9999* ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/setools.git"
+	S="${WORKDIR}/${P}"
+else
+	SRC_URI="https://github.com/SELinuxProject/setools/releases/download/${PV}/${P}.tar.bz2"
+	KEYWORDS="~amd64 ~arm ~arm64 ~riscv ~x86"
+	S="${WORKDIR}/${PN}"
+fi
+
+LICENSE="GPL-2 LGPL-2.1"
+SLOT="0"
+IUSE="gui test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="${PYTHON_DEPS}
+	>=dev-python/networkx-2.6[${PYTHON_USEDEP}]
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	>=sys-libs/libsepol-3.2:=
+	>=sys-libs/libselinux-3.2:=
+	gui? (
+		dev-python/pyqt6[gui,widgets,${PYTHON_USEDEP}]
+		dev-python/pygraphviz[${PYTHON_USEDEP}]
+	)"
+DEPEND="${RDEPEND}"
+BDEPEND=">=dev-python/cython-0.29.14[${PYTHON_USEDEP}]
+	test? (
+		dev-python/pyqt6[gui,testlib,widgets,${PYTHON_USEDEP}]
+		dev-python/pytest-qt[${PYTHON_USEDEP}]
+		sys-apps/checkpolicy
+	)"
+
+distutils_enable_tests pytest
+
+python_prepare_all() {
+	sed -i "s@^lib_dirs = .*@lib_dirs = ['${ROOT:-/}usr/$(get_libdir)']@" "${S}"/setup.py || \
+		die "failed to set lib_dirs"
+
+	use gui || PATCHES+=( "${FILESDIR}"/${PN}-4.5.1-remove-gui.patch )
+	distutils-r1_python_prepare_all
+}
+
+python_test() {
+	rm -rf setools || die
+	epytest
+}

From 81920cc3bfde521fc27e1559ccf06014bd0d8257 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 8 May 2025 16:31:20 +0200
Subject: [PATCH 56/92] .github: Add app-admin/setools to automation

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .github/workflows/portage-stable-packages-list | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/portage-stable-packages-list b/.github/workflows/portage-stable-packages-list
index 4e09f5e913d..1df75342d65 100644
--- a/.github/workflows/portage-stable-packages-list
+++ b/.github/workflows/portage-stable-packages-list
@@ -73,6 +73,7 @@ acct-user/tss
 app-admin/eselect
 app-admin/logrotate
 app-admin/perl-cleaner
+app-admin/setools
 app-admin/sudo
 
 app-alternatives/awk

From a7329ecd072b20769055bcf5a6ec2d3829fb1157 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 8 May 2025 16:33:43 +0200
Subject: [PATCH 57/92] overlay profiles: Do not pull app-admin/setools into
 prod images

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../profiles/coreos/targets/generic/package.provided          | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.provided b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.provided
index 3f972f10203..1d4e66b6d4a 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.provided
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.provided
@@ -29,3 +29,7 @@ dev-lang/perl-5.40.2
 dev-libs/icu-76.1-r1
 dev-perl/Parse-Yapp-1.210.0-r1
 dev-perl/JSON-4.100.0
+
+# Pulled in by sys-apps/policycoreutils, python stuff.
+app-admin/setools-4.5.1
+sys-apps/selinux-python-3.7-r1

From 27fddb5d7614b4c89cf94676e8babb17e4d64972 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Tue, 1 Jul 2025 16:54:31 +0200
Subject: [PATCH 58/92] sys-apps/selinux-python: Add from Gentoo

It's from Gentoo commit 1a36dbcbfd45b1906c67e57a2640dca52f3370cb.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sys-apps/selinux-python/Manifest          |   2 +
 .../sys-apps/selinux-python/metadata.xml      |  16 +++
 .../selinux-python-3.7-r1.ebuild              | 117 ++++++++++++++++++
 .../selinux-python-3.8.1.ebuild               | 117 ++++++++++++++++++
 .../selinux-python/selinux-python-9999.ebuild | 117 ++++++++++++++++++
 5 files changed, 369 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/selinux-python-3.7-r1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/selinux-python-3.8.1.ebuild
 create mode 100644 sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/selinux-python-9999.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/Manifest
new file mode 100644
index 00000000000..4583aae05dd
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/Manifest
@@ -0,0 +1,2 @@
+DIST selinux-python-3.7.tar.gz 3652377 BLAKE2B 59fd7cab0034c175f42f6120ba665701945adcbd4e8af97a0dc2a1c79688a596b199528886ceea079a3f7a969258611fb660449d313d9e893de381293e786381 SHA512 036bc1f0e64cbbaade592dc7899a92765a0bac426140d7d3960f73bad6eb5f95d79d91e0f0e1604f88a991ebf59c4c90ccaaa4158f5dc4d3275ca2aed1673b09
+DIST selinux-python-3.8.1.tar.gz 3652823 BLAKE2B dde6081f55d646a6993083a000524b4ce834718f7cd555c8be88574f227f3d8ed24f390dc4568f3f66c1f3643a606779b6350ad28dfbfe2a1bd9d5a6798c37e0 SHA512 bad791411cff373cf749302d44205495a9d100ca6140ea895cb87a85f5d0b0cfaaf4b7418fca661fb3233d14951755d1c2d85961c731243c92622fdfb343734a
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/metadata.xml b/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/metadata.xml
new file mode 100644
index 00000000000..47d3a0861dd
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/metadata.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>selinux@gentoo.org</email>
+		<name>SELinux Team</name>
+	</maintainer>
+	<longdescription>
+		selinux-python contains the core python selinux utilities and libraries
+		that are required for basic operation of a SELinux system. These
+		include semanage, sepolicy and sepolgen.
+	</longdescription>
+	<upstream>
+		<remote-id type="github">SELinuxProject/selinux</remote-id>
+	</upstream>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/selinux-python-3.7-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/selinux-python-3.7-r1.ebuild
new file mode 100644
index 00000000000..7d61f76ceb7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/selinux-python-3.7-r1.ebuild
@@ -0,0 +1,117 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_REQ_USE="xml(+)"
+
+inherit python-r1 toolchain-funcs
+
+MY_PV="${PV//_/-}"
+MY_P="${PN}-${MY_PV}"
+
+DESCRIPTION="SELinux core utilities"
+HOMEPAGE="https://github.com/SELinuxProject/selinux/wiki"
+
+if [[ ${PV} == 9999 ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/selinux.git"
+	S="${WORKDIR}/${P}/${PN#selinux-}"
+else
+	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
+	KEYWORDS="amd64 arm arm64 ~riscv x86"
+	S="${WORKDIR}/${MY_P}"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="test"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+RDEPEND=">=sys-libs/libselinux-${PV}:=[python]
+	>=sys-libs/libsemanage-${PV}:=[python(+)]
+	>=sys-libs/libsepol-${PV}:=[static-libs(+)]
+	>=app-admin/setools-4.2.0[${PYTHON_USEDEP}]
+	>=sys-process/audit-1.5.1[python,${PYTHON_USEDEP}]
+	${PYTHON_DEPS}"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	test? (
+		${RDEPEND}
+		>=sys-apps/secilc-${PV}
+	)"
+
+src_prepare() {
+	default
+	sed -i 's/-Werror//g' "${S}"/*/Makefile || die "Failed to remove Werror"
+
+	python_copy_sources
+}
+
+src_compile() {
+	building() {
+		emake -C "${BUILD_DIR}" \
+			CC="$(tc-getCC)" \
+			LIBDIR="\$(PREFIX)/$(get_libdir)"
+	}
+	python_foreach_impl building
+}
+
+src_test() {
+	testing() {
+		# The different subprojects have some interproject dependencies:
+		# - audit2allow depens on sepolgen
+		# - chcat depends on semanage
+		# and maybe others.
+		# Add all the modules of the individual subprojects to the
+		# PYTHONPATH, so they get actually found and used. In
+		# particular, already installed versions on the system are not
+		# used.
+		for dir in audit2allow chcat semanage sepolgen/src sepolicy ; do
+			PYTHONPATH="${BUILD_DIR}/${dir}:${PYTHONPATH}"
+		done
+		PYTHONPATH=${PYTHONPATH} \
+			emake -C "${BUILD_DIR}" \
+				test
+	}
+	python_foreach_impl testing
+}
+
+src_install() {
+	installation() {
+		emake -C "${BUILD_DIR}" \
+			DESTDIR="${D}" \
+			LIBDIR="\$(PREFIX)/$(get_libdir)" \
+			install
+		python_optimize
+	}
+	python_foreach_impl installation
+
+	# Set version-specific scripts
+	for pyscript in audit2allow sepolgen-ifgen sepolicy chcat; do
+		python_replicate_script "${ED}/usr/bin/${pyscript}"
+	done
+	for pyscript in semanage; do
+		python_replicate_script "${ED}/usr/sbin/${pyscript}"
+	done
+
+	# Create sepolgen.conf with different devel location definition
+	mkdir -p "${D}"/etc/selinux || die "Failed to create selinux directory";
+	if [[ -f /etc/selinux/config ]];
+	then
+		local selinuxtype=$(awk -F'=' '/^SELINUXTYPE/ {print $2}' /etc/selinux/config);
+		echo "SELINUX_DEVEL_PATH=/usr/share/selinux/${selinuxtype}/include:/usr/share/selinux/${selinuxtype}" \
+			> "${D}"/etc/selinux/sepolgen.conf || die "Failed to generate sepolgen"
+	else
+		local selinuxtype="${POLICY_TYPES%% *}";
+		if [[ -n "${selinuxtype}" ]];
+		then
+			echo "SELINUX_DEVEL_PATH=/usr/share/selinux/${selinuxtype}/include:/usr/share/selinux/${selinuxtype}" \
+				> "${D}"/etc/selinux/sepolgen.conf || die "Failed to generate sepolgen"
+		else
+			echo "SELINUX_DEVEL_PATH=/usr/share/selinux/strict/include:/usr/share/selinux/strict" \
+				> "${D}"/etc/selinux/sepolgen.conf || die "Failed to generate sepolgen"
+		fi
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/selinux-python-3.8.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/selinux-python-3.8.1.ebuild
new file mode 100644
index 00000000000..ee0f8382df2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/selinux-python-3.8.1.ebuild
@@ -0,0 +1,117 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_REQ_USE="xml(+)"
+
+inherit python-r1 toolchain-funcs
+
+MY_PV="${PV//_/-}"
+MY_P="${PN}-${MY_PV}"
+
+DESCRIPTION="SELinux core utilities"
+HOMEPAGE="https://github.com/SELinuxProject/selinux/wiki"
+
+if [[ ${PV} == 9999 ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/selinux.git"
+	S="${WORKDIR}/${P}/${PN#selinux-}"
+else
+	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
+	KEYWORDS="amd64 arm arm64 x86"
+	S="${WORKDIR}/${MY_P}"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="test"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+RDEPEND=">=sys-libs/libselinux-${PV}:=[python]
+	>=sys-libs/libsemanage-${PV}:=[python(+)]
+	>=sys-libs/libsepol-${PV}:=[static-libs(+)]
+	>=app-admin/setools-4.2.0[${PYTHON_USEDEP}]
+	>=sys-process/audit-1.5.1[python,${PYTHON_USEDEP}]
+	${PYTHON_DEPS}"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	test? (
+		${RDEPEND}
+		>=sys-apps/secilc-${PV}
+	)"
+
+src_prepare() {
+	default
+	sed -i 's/-Werror//g' "${S}"/*/Makefile || die "Failed to remove Werror"
+
+	python_copy_sources
+}
+
+src_compile() {
+	building() {
+		emake -C "${BUILD_DIR}" \
+			CC="$(tc-getCC)" \
+			LIBDIR="\$(PREFIX)/$(get_libdir)"
+	}
+	python_foreach_impl building
+}
+
+src_test() {
+	testing() {
+		# The different subprojects have some interproject dependencies:
+		# - audit2allow depens on sepolgen
+		# - chcat depends on semanage
+		# and maybe others.
+		# Add all the modules of the individual subprojects to the
+		# PYTHONPATH, so they get actually found and used. In
+		# particular, already installed versions on the system are not
+		# used.
+		for dir in audit2allow chcat semanage sepolgen/src sepolicy ; do
+			PYTHONPATH="${BUILD_DIR}/${dir}:${PYTHONPATH}"
+		done
+		PYTHONPATH=${PYTHONPATH} \
+			emake -C "${BUILD_DIR}" \
+				test
+	}
+	python_foreach_impl testing
+}
+
+src_install() {
+	installation() {
+		emake -C "${BUILD_DIR}" \
+			DESTDIR="${D}" \
+			LIBDIR="\$(PREFIX)/$(get_libdir)" \
+			install
+		python_optimize
+	}
+	python_foreach_impl installation
+
+	# Set version-specific scripts
+	for pyscript in audit2allow sepolgen-ifgen sepolicy chcat; do
+		python_replicate_script "${ED}/usr/bin/${pyscript}"
+	done
+	for pyscript in semanage; do
+		python_replicate_script "${ED}/usr/sbin/${pyscript}"
+	done
+
+	# Create sepolgen.conf with different devel location definition
+	mkdir -p "${D}"/etc/selinux || die "Failed to create selinux directory";
+	if [[ -f /etc/selinux/config ]];
+	then
+		local selinuxtype=$(awk -F'=' '/^SELINUXTYPE/ {print $2}' /etc/selinux/config);
+		echo "SELINUX_DEVEL_PATH=/usr/share/selinux/${selinuxtype}/include:/usr/share/selinux/${selinuxtype}" \
+			> "${D}"/etc/selinux/sepolgen.conf || die "Failed to generate sepolgen"
+	else
+		local selinuxtype="${POLICY_TYPES%% *}";
+		if [[ -n "${selinuxtype}" ]];
+		then
+			echo "SELINUX_DEVEL_PATH=/usr/share/selinux/${selinuxtype}/include:/usr/share/selinux/${selinuxtype}" \
+				> "${D}"/etc/selinux/sepolgen.conf || die "Failed to generate sepolgen"
+		else
+			echo "SELINUX_DEVEL_PATH=/usr/share/selinux/strict/include:/usr/share/selinux/strict" \
+				> "${D}"/etc/selinux/sepolgen.conf || die "Failed to generate sepolgen"
+		fi
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/selinux-python-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/selinux-python-9999.ebuild
new file mode 100644
index 00000000000..e9776921c2c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/selinux-python/selinux-python-9999.ebuild
@@ -0,0 +1,117 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_REQ_USE="xml(+)"
+
+inherit python-r1 toolchain-funcs
+
+MY_PV="${PV//_/-}"
+MY_P="${PN}-${MY_PV}"
+
+DESCRIPTION="SELinux core utilities"
+HOMEPAGE="https://github.com/SELinuxProject/selinux/wiki"
+
+if [[ ${PV} == 9999 ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/selinux.git"
+	S="${WORKDIR}/${P}/${PN#selinux-}"
+else
+	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
+	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+	S="${WORKDIR}/${MY_P}"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="test"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+RDEPEND=">=sys-libs/libselinux-${PV}:=[python]
+	>=sys-libs/libsemanage-${PV}:=[python(+)]
+	>=sys-libs/libsepol-${PV}:=[static-libs(+)]
+	>=app-admin/setools-4.2.0[${PYTHON_USEDEP}]
+	>=sys-process/audit-1.5.1[python,${PYTHON_USEDEP}]
+	${PYTHON_DEPS}"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	test? (
+		${RDEPEND}
+		>=sys-apps/secilc-${PV}
+	)"
+
+src_prepare() {
+	default
+	sed -i 's/-Werror//g' "${S}"/*/Makefile || die "Failed to remove Werror"
+
+	python_copy_sources
+}
+
+src_compile() {
+	building() {
+		emake -C "${BUILD_DIR}" \
+			CC="$(tc-getCC)" \
+			LIBDIR="\$(PREFIX)/$(get_libdir)"
+	}
+	python_foreach_impl building
+}
+
+src_test() {
+	testing() {
+		# The different subprojects have some interproject dependencies:
+		# - audit2allow depens on sepolgen
+		# - chcat depends on semanage
+		# and maybe others.
+		# Add all the modules of the individual subprojects to the
+		# PYTHONPATH, so they get actually found and used. In
+		# particular, already installed versions on the system are not
+		# used.
+		for dir in audit2allow chcat semanage sepolgen/src sepolicy ; do
+			PYTHONPATH="${BUILD_DIR}/${dir}:${PYTHONPATH}"
+		done
+		PYTHONPATH=${PYTHONPATH} \
+			emake -C "${BUILD_DIR}" \
+				test
+	}
+	python_foreach_impl testing
+}
+
+src_install() {
+	installation() {
+		emake -C "${BUILD_DIR}" \
+			DESTDIR="${D}" \
+			LIBDIR="\$(PREFIX)/$(get_libdir)" \
+			install
+		python_optimize
+	}
+	python_foreach_impl installation
+
+	# Set version-specific scripts
+	for pyscript in audit2allow sepolgen-ifgen sepolicy chcat; do
+		python_replicate_script "${ED}/usr/bin/${pyscript}"
+	done
+	for pyscript in semanage; do
+		python_replicate_script "${ED}/usr/sbin/${pyscript}"
+	done
+
+	# Create sepolgen.conf with different devel location definition
+	mkdir -p "${D}"/etc/selinux || die "Failed to create selinux directory";
+	if [[ -f /etc/selinux/config ]];
+	then
+		local selinuxtype=$(awk -F'=' '/^SELINUXTYPE/ {print $2}' /etc/selinux/config);
+		echo "SELINUX_DEVEL_PATH=/usr/share/selinux/${selinuxtype}/include:/usr/share/selinux/${selinuxtype}" \
+			> "${D}"/etc/selinux/sepolgen.conf || die "Failed to generate sepolgen"
+	else
+		local selinuxtype="${POLICY_TYPES%% *}";
+		if [[ -n "${selinuxtype}" ]];
+		then
+			echo "SELINUX_DEVEL_PATH=/usr/share/selinux/${selinuxtype}/include:/usr/share/selinux/${selinuxtype}" \
+				> "${D}"/etc/selinux/sepolgen.conf || die "Failed to generate sepolgen"
+		else
+			echo "SELINUX_DEVEL_PATH=/usr/share/selinux/strict/include:/usr/share/selinux/strict" \
+				> "${D}"/etc/selinux/sepolgen.conf || die "Failed to generate sepolgen"
+		fi
+	fi
+}

From bacbcd60776a9f4288f2a80c5428260c4918f7f0 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 8 May 2025 16:40:01 +0200
Subject: [PATCH 59/92] .github: Add sys-apps/selinux-python to automation

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .github/workflows/portage-stable-packages-list | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/portage-stable-packages-list b/.github/workflows/portage-stable-packages-list
index 1df75342d65..cbedd2558ce 100644
--- a/.github/workflows/portage-stable-packages-list
+++ b/.github/workflows/portage-stable-packages-list
@@ -658,6 +658,7 @@ sys-apps/portage
 sys-apps/pv
 sys-apps/sandbox
 sys-apps/sed
+sys-apps/selinux-python
 sys-apps/semodule-utils
 sys-apps/shadow
 sys-apps/smartmontools

From 7a3c33cb41c90a24147e121557884034a0f9aef1 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Tue, 1 Jul 2025 16:55:24 +0200
Subject: [PATCH 60/92] dev-python/networkx: Add from Gentoo

It's from Gentoo commit e5712a8fc3d0d429407ee9db8450b5c573041019.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../dev-python/networkx/Manifest              |  1 +
 .../networkx/files/networkx-3.5-py314.patch   | 53 +++++++++++++++
 .../dev-python/networkx/metadata.xml          | 24 +++++++
 .../networkx/networkx-3.5-r1.ebuild           | 64 +++++++++++++++++++
 4 files changed, 142 insertions(+)
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/networkx/Manifest
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/networkx/files/networkx-3.5-py314.patch
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/networkx/metadata.xml
 create mode 100644 sdk_container/src/third_party/portage-stable/dev-python/networkx/networkx-3.5-r1.ebuild

diff --git a/sdk_container/src/third_party/portage-stable/dev-python/networkx/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/networkx/Manifest
new file mode 100644
index 00000000000..02eac09370d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/networkx/Manifest
@@ -0,0 +1 @@
+DIST networkx-3.5.tar.gz 2471065 BLAKE2B 575ac0a6e9741f0ad23396ff089cb360d43fc80f1c5a1fcb69e824c3673aba1aae5c2413020b049bcfecb68045984452eb02aefce1d523bd00d589eb26d8ae0f SHA512 9c060385913cfe67126e71eb9e53c032faa51c9609336ce78333d22e5f73078eb5b4826e0709cae0bd448fef2a5b2fb6f4c29be28c70d34a936d1cf6a00e83a1
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/networkx/files/networkx-3.5-py314.patch b/sdk_container/src/third_party/portage-stable/dev-python/networkx/files/networkx-3.5-py314.patch
new file mode 100644
index 00000000000..4b109fd9acd
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/networkx/files/networkx-3.5-py314.patch
@@ -0,0 +1,53 @@
+From 5487e923e39f526fe12a74d7399e5153f06698a4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20G=C3=B3rny?= <mgorny@gentoo.org>
+Date: Tue, 3 Jun 2025 09:54:33 +0200
+Subject: [PATCH] Use type checks in `generators/lattice.py` for Py3.14 compat
+
+Replace the `TypeError` catching in `networkx/generators/lattice.py`
+with explicit type checks to make the code more reliable and fix it for
+Python 3.14.  Catching the exception immediately does not work
+in the second instance, because the code is constructing a generator,
+and apparently Python 3.14 does not evaluate the `p in periodic`
+expression until the generator is actually iterated over.  Given that
+the function expects either an iterable or a `bool`, explicitly checking
+for `bool` should both be more readable and more reliable.
+
+The alternative would be to replace the generator with a list
+comprehension that would be evaluated immediately.  However,
+the explicit type check seems to be a cleaner solution to the problem.
+---
+ networkx/generators/lattice.py | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/networkx/generators/lattice.py b/networkx/generators/lattice.py
+index 95e520d2c..3b0900ea1 100644
+--- a/networkx/generators/lattice.py
++++ b/networkx/generators/lattice.py
+@@ -67,10 +67,10 @@ def grid_2d_graph(m, n, periodic=False, create_using=None):
+     G.add_edges_from(((i, j), (pi, j)) for pi, i in pairwise(rows) for j in cols)
+     G.add_edges_from(((i, j), (i, pj)) for i in rows for pj, j in pairwise(cols))
+ 
+-    try:
+-        periodic_r, periodic_c = periodic
+-    except TypeError:
++    if isinstance(periodic, bool):
+         periodic_r = periodic_c = periodic
++    else:
++        periodic_r, periodic_c = periodic
+ 
+     if periodic_r and len(rows) > 2:
+         first = rows[0]
+@@ -129,10 +129,10 @@ def grid_graph(dim, periodic=False):
+     if not dim:
+         return empty_graph(0)
+ 
+-    try:
+-        func = (cycle_graph if p else path_graph for p in periodic)
+-    except TypeError:
++    if isinstance(periodic, bool):
+         func = repeat(cycle_graph if periodic else path_graph)
++    else:
++        func = (cycle_graph if p else path_graph for p in periodic)
+ 
+     G = next(func)(dim[0])
+     for current_dim in dim[1:]:
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/networkx/metadata.xml b/sdk_container/src/third_party/portage-stable/dev-python/networkx/metadata.xml
new file mode 100644
index 00000000000..226da59e47e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/networkx/metadata.xml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="project">
+    <email>python@gentoo.org</email>
+    <name>Python</name>
+  </maintainer>
+  <longdescription lang="en">
+  NetworkX is a Python-based package for the creation, manipulation, and
+  study of the structure, dynamics, and functions of complex networks.
+  The structure of a graph or network is encoded in the edges (connections,
+  links, ties, arcs, bonds) between nodes (vertices, sites, actors). If
+  unqualified, by graph we mean a simple undirected graph, i.e. no
+  self-loops and no multiple edges are allowed. By a network we usually
+  mean a graph with weights (fields, properties) on nodes and/or edges.
+  The potential audience for NetworkX includes: mathematicians, physicists,
+  biologists, computer scientists, social scientists.
+  </longdescription>
+  <stabilize-allarches/>
+  <upstream>
+    <remote-id type="pypi">networkx</remote-id>
+    <remote-id type="github">networkx/networkx</remote-id>
+  </upstream>
+</pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/networkx/networkx-3.5-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/networkx/networkx-3.5-r1.ebuild
new file mode 100644
index 00000000000..a62129e17ab
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/networkx/networkx-3.5-r1.ebuild
@@ -0,0 +1,64 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_FULLY_TESTED=( python3_{11..13} )
+PYTHON_COMPAT=( "${PYTHON_FULLY_TESTED[@]}" python3_14 )
+
+inherit distutils-r1 optfeature pypi virtualx
+
+DESCRIPTION="Python tools to manipulate graphs and complex networks"
+HOMEPAGE="
+	https://networkx.org/
+	https://github.com/networkx/networkx/
+	https://pypi.org/project/networkx/
+"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="amd64 arm arm64 ~loong ~ppc64 ~riscv ~sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+
+BDEPEND="
+	test? (
+		>=dev-python/lxml-4.6[${PYTHON_USEDEP}]
+		$(python_gen_cond_dep '
+			>=dev-python/matplotlib-3.8[${PYTHON_USEDEP}]
+			>=dev-python/numpy-1.25[${PYTHON_USEDEP}]
+			>=dev-python/scipy-1.11.2[${PYTHON_USEDEP}]
+		' "${PYTHON_FULLY_TESTED[@]}")
+	)
+"
+
+EPYTEST_XDIST=1
+distutils_enable_tests pytest
+
+PATCHES=(
+	# minimal fix for https://github.com/networkx/networkx/issues/8091
+	"${FILESDIR}/${P}-py314.patch"
+)
+
+src_test() {
+	virtx distutils-r1_src_test
+}
+
+python_test() {
+	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
+	# virtx implies nonfatal
+	nonfatal epytest || die
+}
+
+src_install() {
+	distutils-r1_src_install
+	# those examples use various assets and pre-compressed files
+	docompress -x /usr/share/doc/${PF}/examples
+}
+
+pkg_postinst() {
+	optfeature "recommended dependencies" "dev-python/matplotlib dev-python/numpy dev-python/pandas dev-python/scipy"
+	optfeature "graph drawing and graph layout algorithms" "dev-python/pygraphviz dev-python/pydot"
+	optfeature "YAML format reading and writing" "dev-python/pyyaml"
+	optfeature "shapefile format reading and writing" "sci-libs/gdal[python]"
+	optfeature "GraphML XML format" "dev-python/lxml"
+}

From 6f23172254926e7df075e35955d2724bce613b80 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 8 May 2025 16:43:04 +0200
Subject: [PATCH 61/92] .github: Add dev-python/networkx to automation

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .github/workflows/portage-stable-packages-list | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/portage-stable-packages-list b/.github/workflows/portage-stable-packages-list
index cbedd2558ce..5355ee35d3c 100644
--- a/.github/workflows/portage-stable-packages-list
+++ b/.github/workflows/portage-stable-packages-list
@@ -337,6 +337,7 @@ dev-python/markupsafe
 dev-python/mdurl
 dev-python/more-itertools
 dev-python/msgpack
+dev-python/networkx
 dev-python/olefile
 dev-python/packaging
 dev-python/pathspec

From 508633f7c691074c75f622bce639ee3b1146ab67 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 8 May 2025 16:51:26 +0200
Subject: [PATCH 62/92] overlay coreos/config: Add further modifications to
 sys-process/audit

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../coreos-overlay/coreos/config/env/sys-process/audit        | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit
index 198fa84ebf8..22abec26e00 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit
@@ -2,3 +2,7 @@
 # in coreos-base/misc-files. Also skip installing legacy initscripts
 # stuff in /usr/libexec.
 INSTALL_MASK+=" /etc/audit/audit.rules* /usr/libexec "
+# Skip installing python stuff in production images
+if [[ $(flatcar_target) = 'generic-prod' ]]; then
+    INSTALL_MASK+=" /usr/lib/python* "
+fi

From a383a6da4cb52db884664b338d24f677f7ee6325 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 8 May 2025 17:04:01 +0200
Subject: [PATCH 63/92] overlay profiles: Allow python for sys-process/audit

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../profiles/coreos/targets/generic/package.use.mask         | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use.mask
index 138ee5a3990..4482d1b6105 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use.mask
@@ -7,3 +7,8 @@ sys-apps/smartmontools caps
 # with USE=selinux. For production images, we will filter python files
 # out with an install mask.
 sys-libs/libselinux -python
+
+# Allow USE=python for sys-process/audit - it is needed by
+# policycoreutils. For production images, we will filter python files
+# out with an install mask.
+sys-process/audit -python

From 87645d8c6e6a9656b08bb3140d4d8d0b5dcc4f6e Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 8 May 2025 17:12:17 +0200
Subject: [PATCH 64/92] overlay coreos/config: Add further Flatcar
 modifications for sys-apps/policycoreutils

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../coreos/config/env/sys-apps/policycoreutils       | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/policycoreutils b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/policycoreutils
index 8b6c1ef2cdd..22d367edc19 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/policycoreutils
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/policycoreutils
@@ -18,3 +18,15 @@ cros_post_src_install_set_up_var_lib_selinux() {
 cros_post_src_install_vendorize_pam() {
     vendorize_pam_files
 }
+
+# Do not install python stuff in prod images.
+if [[ $(flatcar_target) = 'generic-prod' ]]; then
+    INSTALL_MASK+=" /usr/lib/python-exec "
+fi
+
+# INSTALL_MASK does not work on symlinks.
+cros_post_pkg_postinst_drop_rlpkg_symlink() {
+    if [[ $(flatcar_target) = 'generic-prod' ]]; then
+        rm -f "${ROOT}"/usr/sbin/rlpkg
+    fi
+}

From 3c517ece1f1ee82533c2df6cc3fd742f8c0bdc4f Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Fri, 9 May 2025 12:42:21 +0200
Subject: [PATCH 65/92] overlay profiles: Force static-libs on
 sys-libs/libsepol to fix bootstrap

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../profiles/coreos/targets/sdk/package.use.force             | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/package.use.force

diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/package.use.force b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/package.use.force
new file mode 100644
index 00000000000..6f5e10a0a61
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/package.use.force
@@ -0,0 +1,4 @@
+# Needed during bootstrap - systemd pulls dbus, which pulls dbus
+# selinux policies, which pull policycoreutils, which pulls
+# selinux-python, which needs libsepol with static libs.
+sys-libs/libsepol static-libs

From 1fa86605e33b460474ceeeae66d163f5d84eb2e0 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 15 May 2025 16:36:09 +0200
Subject: [PATCH 66/92] build_toolchain: Do not leak variables

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 build_toolchains | 1 +
 1 file changed, 1 insertion(+)

diff --git a/build_toolchains b/build_toolchains
index 8deb4524102..9fe99c19470 100755
--- a/build_toolchains
+++ b/build_toolchains
@@ -27,6 +27,7 @@ catalyst_stage_default 4
 }
 create_provenance_overlay() {
   local root_overlay="$1"
+  local f d scripts_hash
   while read f; do
     d="${f%/*}"
     mkdir -p "${root_overlay}${d}/"

From e7c794667eccdd3d97b157dd2cd4a2859b57cee4 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Tue, 13 May 2025 13:46:08 +0200
Subject: [PATCH 67/92] build_toolchains: Break dep loop and handle more
 dependencies

Switching to a selinux profile caused more USE flags to be enabled
(selinux, audit, caps), thus more dependencies to be pulled. More
dependencies caused two things:

- cyclic dependencies appeared
- sys-apps/baselayout is being pulled in

Cyclic dependencies need to be handled in a similar way it was done in
build_packages, thus factor out the code doing it into a separate and
reusable part.

The dependency on baselayout needs to be handled by installing the
package as a first thing in $ROOT, followed by a more careful way of
copying things from $SYSROOT to $ROOT (due to split-usr differences),
followed by installing the rest of the packages.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 build_library/break_dep_loop.sh      | 137 +++++++++++++++++++++++++++
 build_library/catalyst_toolchains.sh |  81 ++++++++++++++--
 build_packages                       | 110 ++++-----------------
 build_toolchains                     |   5 +-
 4 files changed, 236 insertions(+), 97 deletions(-)
 create mode 100644 build_library/break_dep_loop.sh

diff --git a/build_library/break_dep_loop.sh b/build_library/break_dep_loop.sh
new file mode 100644
index 00000000000..599aa4cc9e1
--- /dev/null
+++ b/build_library/break_dep_loop.sh
@@ -0,0 +1,137 @@
+# Goo to attempt to resolve dependency loops on individual packages.
+# If this becomes insufficient we will need to move to a full multi-stage
+# bootstrap process like we do with the SDK via catalyst.
+#
+# Called like:
+#
+#     break_dep_loop [-v] [PKG_USE_PAIR]…
+#
+# Pass -v for verbose output.
+#
+# PKG_USE_PAIR consists of two arguments: a package name (for example:
+# sys-fs/lvm2), and a comma-separated list of USE flags to clear (for
+# example: udev,systemd).
+#
+# Env vars:
+#
+# BDL_ROOT, BDL_PORTAGEQ, BDL_EQUERY, BDL_EMERGE, BDL_INFO
+break_dep_loop() {
+    local bdl_root=${BDL_ROOT:-/}
+    local bdl_portageq=${BDL_PORTAGEQ:-portageq}
+    local bdl_equery=${BDL_EQUERY:-equery}
+    local bdl_emerge=${BDL_EMERGE:-emerge}
+    local bdl_info=${BDL_INFO:-echo}
+    local conf_dir="${bdl_root%/}/etc/portage"
+    local flag_file="${conf_dir}/package.use/break_dep_loop"
+    local force_flag_file="${conf_dir}/profile/package.use.force/break_dep_loop"
+
+    local verbose=
+    if [[ ${1:-} = '-v' ]]; then
+        verbose=x
+        shift
+    fi
+
+    # Be sure to clean up use flag hackery from previous failed runs
+    sudo rm -f "${flag_file}" "${force_flag_file}"
+
+    if [[ ${#} -eq 0 ]]; then
+        return 0
+    fi
+
+    function bdl_call() {
+        local output_var_name=${1}; shift
+        if [[ ${output_var_name} = '-' ]]; then
+            local throw_away
+            output_var_name=throw_away
+        fi
+        local -n output_ref=${output_var_name}
+        if [[ -n ${verbose} ]]; then
+            "${bdl_info}" "${*@Q}"
+        fi
+        local -i rv=0
+        output_ref=$("${@}") || rv=${?}
+        if [[ -n ${verbose} ]]; then
+            "${bdl_info}" "output: ${output_ref}"
+            "${bdl_info}" "exit status: ${rv}"
+        fi
+        return ${rv}
+    }
+
+    # Temporarily compile/install packages with flags disabled. If a binary
+    # package is available use it regardless of its version or use flags.
+    local pkg use_flags disabled_flags
+    local -a flags
+    local -a pkgs args flag_file_entries pkg_summaries
+    local -A per_pkg_flags=()
+    while [[ $# -gt 1 ]]; do
+        pkg=${1}
+        use_flags=${2}
+        shift 2
+
+        mapfile -t flags <<<"${use_flags//,/$'\n'}"
+        disabled_flags="${flags[*]/#/-}"
+
+        pkgs+=( "${pkg}" )
+        per_pkg_flags["${pkg}"]=${use_flags}
+        flag_file_entries+=( "${pkg} ${disabled_flags}" )
+        args+=( "--buildpkg-exclude=${pkg}" )
+        pkg_summaries+=( "${pkg}[${disabled_flags}]" )
+    done
+    unset pkg use_flags disabled_flags flags
+
+    # If packages are already installed we have nothing to do
+    local pkg any_package_uninstalled=
+    for pkg in "${pkgs[@]}"; do
+        if ! bdl_call - "${bdl_portageq}" has_version "${bdl_root}" "${pkg}"; then
+            any_package_uninstalled=x
+            break
+        fi
+    done
+    if [[ -z ${any_package_uninstalled} ]]; then
+        if [[ -n ${verbose} ]]; then
+            "${bdl_info}" "all packages (${pkgs[*]}) are installed already, skipping"
+        fi
+        return 0
+    fi
+    unset pkg any_package_uninstalled
+
+    # Likewise, nothing to do if the flags aren't actually enabled.
+    local pkg any_flag_enabled= equery_output flag flags_str
+    local -a flags grep_args
+    for pkg in "${pkgs[@]}"; do
+        bdl_call equery_output "${bdl_equery}" -q uses "${pkg}"
+        flags_str=${per_pkg_flags["${pkg}"]}
+        mapfile -t flags <<<"${flags_str//,/$'\n'}"
+        for flag in "${flags[@]}"; do
+            grep_args+=( -e "${flag/#/+}" )
+        done
+        if bdl_call - grep --quiet --line-regexp --fixed-strings "${grep_args[@]}" <<<"${equery_output}"; then
+            any_flag_enabled=x
+            break
+        fi
+    done
+    if [[ -z ${any_flag_enabled} ]]; then
+        if [[ -n ${verbose} ]]; then
+            "${bdl_info}" "all packages (${pkgs[*]}) has all the desired USE flags already disabled, skipping"
+        fi
+        return 0
+    fi
+    unset pkg any_flag_enabled equery_output flag flags_str flags grep_args
+
+    "${bdl_info}" "Merging ${pkg_summaries[*]}"
+    sudo mkdir -p "${flag_file%/*}" "${force_flag_file%/*}"
+    printf '%s\n' "${flag_file_entries[@]}" | sudo tee "${flag_file}" >/dev/null
+    cp -a "${flag_file}" "${force_flag_file}"
+    if [[ -n ${verbose} ]]; then
+        "${bdl_info}" "contents of ${flag_file@Q}:"
+        "${bdl_info}" "$(<"${flag_file}")"
+        "${bdl_info}" "${bdl_emerge}" --rebuild-if-unbuilt=n "${args[@]}" "${pkgs[@]}"
+    fi
+    # rebuild-if-unbuilt is disabled to prevent portage from needlessly
+    # rebuilding zlib for some unknown reason, in turn triggering more rebuilds.
+    "${bdl_emerge}" \
+         --rebuild-if-unbuilt=n \
+         "${args[@]}" "${pkgs[@]}"
+    sudo rm -f "${flag_file}" "${force_flag_file}"
+    unset bdl_call
+}
diff --git a/build_library/catalyst_toolchains.sh b/build_library/catalyst_toolchains.sh
index 92d6e932136..db6c10e7520 100644
--- a/build_library/catalyst_toolchains.sh
+++ b/build_library/catalyst_toolchains.sh
@@ -3,6 +3,7 @@
 set -e
 source /tmp/chroot-functions.sh
 source /tmp/toolchain_util.sh
+source /tmp/break_dep_loop.sh
 
 # A note on packages:
 # The default PKGDIR is /usr/portage/packages
@@ -28,13 +29,81 @@ build_target_toolchain() {
     local ROOT="/build/${board}"
     local SYSROOT="/usr/$(get_board_chost "${board}")"
 
-    mkdir -p "${ROOT}/usr"
-    cp -at "${ROOT}" "${SYSROOT}"/lib*
-    cp -at "${ROOT}"/usr "${SYSROOT}"/usr/include "${SYSROOT}"/usr/lib*
+    function btt_emerge() {
+        # --root is required because run_merge overrides ROOT=
+        PORTAGE_CONFIGROOT="$ROOT" run_merge --root="$ROOT" --sysroot="$ROOT" "${@}"
+    }
 
-    # --root is required because run_merge overrides ROOT=
-    PORTAGE_CONFIGROOT="$ROOT" \
-        run_merge -u --root="$ROOT" --sysroot="$ROOT" "${TOOLCHAIN_PKGS[@]}"
+    # install baselayout first - with the selinux profile, this is
+    # pulled into the dependency chain
+    btt_emerge --oneshot --nodeps sys-apps/baselayout
+
+    # copy libraries from sysroot to root - sysroot seems to be
+    # split-usr, whereas root does not, so take this into account
+    (
+        shopt -s nullglob
+        local d f
+        local -a files
+        for d in "${SYSROOT}"/lib* "${SYSROOT}"/usr/lib*; do
+            if [[ ! -d ${d} ]]; then
+                continue
+            fi
+            files=( "${d}"/* )
+            if [[ ${#files[@]} -gt 0 ]]; then
+                f=${d##*/}
+                cp -at "${ROOT}/usr/${f}" "${files[@]}"
+            fi
+        done
+    )
+    cp -at "${ROOT}"/usr "${SYSROOT}"/usr/include
+
+    local -a args_for_bdl=()
+    if [[ -n ${clst_VERBOSE} ]]; then
+        args_for_bdl+=(-v)
+    fi
+    function btt_bdl_portageq() {
+        ROOT=${ROOT} SYSROOT=${ROOT} PORTAGE_CONFIGROOT=${ROOT} portageq "${@}"
+    }
+    function btt_bdl_equery() {
+        ROOT=${ROOT} SYSROOT=${ROOT} PORTAGE_CONFIGROOT=${ROOT} equery "${@}"
+    }
+    # Breaking the following loops here:
+    #
+    # glibc[nscd] -> libcap[pam] -> sys-libs/pam -> libcrypt -> libxcrypt[system] -> glibc
+    # glibc[nscd] -> audit[python] -> python -> libcrypt -> libxcrypt[system] -> glibc
+    # glibc[selinux] -> libselinux[python] -> python -> libcrypt -> libxcrypt[system] -> glibc
+    # systemd[cryptsetup] -> cryptsetup[udev] -> libudev[systemd] -> systemd
+    # systemd[cryptsetup] -> cryptsetup -> lvm2[udev] -> libudev[systemd] -> systemd
+    # systemd[cryptsetup] -> cryptsetup -> lvm2[lvm,systemd] -> systemd
+    # systemd[cryptsetup] -> cryptsetup -> tmpfiles[systemd] -> systemd
+    # systemd[curl] -> curl -> nghttp2[systemd] -> systemd
+    #     importd requires curl, so needs to be disabled too
+    # systemd[pam] -> pam[systemd] -> systemd
+    #     not dropping pam from sys-apps/systemd, otherwise we would
+    #     need to drop pam from sys-auth/pambase
+    # systemd[tpm] -> tpm2-tss -> tmpfiles[systemd] -> systemd
+    # util-linux[audit] -> audit[python] -> python -> util-linux
+    # util-linux[cryptsetup] -> cryptsetup -> util-linux
+    # util-linux[pam] -> sys-libs/pam[audit] -> sys-process/audit[python] -> python -> util-linux
+    #     su requires pam, so needs to be disabled too
+    # util-linux[selinux] -> libselinux[python] -> python -> util-linux
+    # util-linux[systemd] -> systemd -> util-linux
+    # util-linux[udev] -> libudev[systemd] -> systemd -> util-linux
+    args_for_bdl+=(
+        sys-apps/systemd cryptsetup,curl,importd,tpm
+        sys-apps/util-linux audit,cryptsetup,pam,selinux,su,systemd,udev
+        sys-libs/glibc nscd,selinux
+        sys-libs/pam systemd
+    )
+    BDL_ROOT=${ROOT} \
+    BDL_PORTAGEQ=btt_bdl_portageq \
+    BDL_EQUERY=btt_bdl_equery \
+    BDL_EMERGE=btt_emerge \
+        break_dep_loop "${args_for_bdl[@]}"
+    unset btt_bdl_portageq btt_bdl_equery
+
+    btt_emerge --changed-use --update --deep "${TOOLCHAIN_PKGS[@]}"
+    unset btt_emerge
 }
 
 configure_crossdev_overlay / /usr/local/portage/crossdev
diff --git a/build_packages b/build_packages
index d300edff828..3777e74d963 100755
--- a/build_packages
+++ b/build_packages
@@ -174,89 +174,12 @@ if [[ ${#WORKON_PKGS[@]} -gt 0 ]]; then
   )
 fi
 
-# Goo to attempt to resolve dependency loops on individual packages.
-# If this becomes insufficient we will need to move to a full multi-stage
-# bootstrap process like we do with the SDK via catalyst.
-#
-# Called like:
-#
-#     break_dep_loop [PKG_USE_PAIR]…
-#
-# PKG_USE_PAIR consists of two arguments: a package name (for example:
-# sys-fs/lvm2), and a comma-separated list of USE flags to clear (for
-# example: udev,systemd).
-break_dep_loop() {
-  local -a pkgs
-  local -a all_flags
-  local -a args
-  local flag_file="${BOARD_ROOT}/etc/portage/package.use/break_dep_loop"
-  local -a flag_file_entries
-  local -a pkg_summaries
-
-  # Be sure to clean up use flag hackery from previous failed runs
-  sudo rm -f "${flag_file}"
-
-  if [[ $# -eq 0 ]]; then
-      return 0
-  fi
-
-  # Temporarily compile/install packages with flags disabled. If a binary
-  # package is available use it regardless of its version or use flags.
-  local pkg
-  local -a flags
-  local disabled_flags
-  while [[ $# -gt 0 ]]; do
-    pkg="${1}"
-    pkgs+=("${pkg}")
-    flags=( ${2//,/ } )
-    all_flags+=("${flags[@]}")
-    disabled_flags="${flags[@]/#/-}"
-    flag_file_entries+=("${pkg} ${disabled_flags}")
-    args+=("--buildpkg-exclude=${pkg}")
-    pkg_summaries+=("${pkg}[${disabled_flags}]")
-    shift 2
-  done
-
-  # If packages are already installed we have nothing to do
-  local any_package_uninstalled=0
-  for pkg in "${pkgs[@]}"; do
-    if ! portageq-"${BOARD}" has_version "${BOARD_ROOT}" "${pkgs[@]}"; then
-      any_package_uninstalled=1
-      break
-    fi
-  done
-  if [[ ${any_package_uninstalled} -eq 0 ]]; then
-    return 0
-  fi
-
-  # Likewise, nothing to do if the flags aren't actually enabled.
-  local any_flag_enabled=0
-  for pkg in "${pkgs[@]}"; do
-    if pkg_use_enabled "${pkg}" "${all_flags[@]}"; then
-      any_flag_enabled=1
-      break
-    fi
-  done
-  if [[ ${any_flag_enabled} -eq 0 ]]; then
-    return 0
-  fi
-
-  info "Merging ${pkg_summaries[@]}"
-  sudo mkdir -p "${flag_file%/*}"
-  sudo_clobber "${flag_file}" <<<"${flag_file_entries[0]}"
-  local entry
-  for entry in "${flag_file_entries[@]:1}"; do
-    sudo_append "${flag_file}" <<<"${entry}"
-  done
-  # rebuild-if-unbuilt is disabled to prevent portage from needlessly
-  # rebuilding zlib for some unknown reason, in turn triggering more rebuilds.
-  sudo -E "${EMERGE_CMD[@]}" "${EMERGE_FLAGS[@]}" \
-    --rebuild-if-unbuilt=n \
-    "${args[@]}" "${pkgs[@]}"
-  sudo rm -f "${flag_file}"
-}
-
 if [[ "${FLAGS_usepkgonly}" -eq "${FLAGS_FALSE}" ]]; then
+  . "${BUILD_LIBRARY_DIR}/break_dep_loop.sh" || exit 1
+
+  function bp_bdl_emerge() {
+    sudo -E "${EMERGE_CMD[@]}" "${EMERGE_FLAGS[@]}" "${@}"
+  }
   # Breaking the following loops here:
   #
   # util-linux[udev] -> virtual/udev -> systemd -> util-linux
@@ -271,13 +194,22 @@ if [[ "${FLAGS_usepkgonly}" -eq "${FLAGS_FALSE}" ]]; then
   # sys-libs/pam[systemd] -> sys-apps/system[pam] -> sys-libs/pam
   #   not dropping pam from sys-apps/systemd, otherwise we would need
   #   to drop pam from sys-auth/pambase
-  break_dep_loop sys-apps/util-linux udev,systemd,cryptsetup \
-                 sys-fs/cryptsetup udev \
-                 sys-fs/lvm2 udev,systemd \
-                 sys-apps/systemd cryptsetup,tpm \
-                 net-misc/curl http2 \
-                 net-libs/nghttp2 systemd \
-                 sys-libs/pam systemd
+  args_for_bdl=(
+      sys-apps/util-linux udev,systemd,cryptsetup
+      sys-fs/cryptsetup udev
+      sys-fs/lvm2 udev,systemd
+      sys-apps/systemd cryptsetup,tpm
+      net-misc/curl http2
+      net-libs/nghttp2 systemd
+      sys-libs/pam systemd
+  )
+  BDL_ROOT=${BOARD_ROOT} \
+  BDL_PORTAGEQ=portageq-"${BOARD}" \
+  BDL_EQUERY=equery-"${BOARD}" \
+  BDL_EMERGE=bp_bdl_emerge \
+  BDL_INFO=info \
+      break_dep_loop "${args_for_bdl[@]}"
+  unset bp_bdl_emerge args_for_bdl
 fi
 
 if [[ "${FLAGS_only_resolve_circular_deps}" -eq "${FLAGS_TRUE}" ]]; then
diff --git a/build_toolchains b/build_toolchains
index 9fe99c19470..b5076d3f7c6 100755
--- a/build_toolchains
+++ b/build_toolchains
@@ -49,9 +49,10 @@ catalyst_init "$@"
 
 ROOT_OVERLAY="${TEMPDIR}/stage4-${ARCH}-$FLAGS_version-overlay"
 
-# toolchain_util.sh is required by catalyst_toolchains.sh
+# toolchain_util.sh and break_dep_loop.sh are required by
+# catalyst_toolchains.sh
 mkdir -p "${ROOT_OVERLAY}/tmp"
-cp "${BUILD_LIBRARY_DIR}/toolchain_util.sh" "${ROOT_OVERLAY}/tmp"
+cp "${BUILD_LIBRARY_DIR}/toolchain_util.sh" "${BUILD_LIBRARY_DIR}/break_dep_loop.sh" "${ROOT_OVERLAY}/tmp"
 create_provenance_overlay "${ROOT_OVERLAY}"
 
 catalyst_build

From 3afbc28d9fef32e73cbc7b196fc79bf485557265 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Mon, 19 May 2025 08:45:04 +0200
Subject: [PATCH 68/92] overlay profiles: Move python from package.mask to
 package.provided for prod

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../profiles/coreos/targets/generic/prod/package.mask         | 4 +++-
 .../profiles/coreos/targets/generic/prod/package.provided     | 3 +++
 2 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.provided

diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.mask
index 7f198c44e90..3a1bb203885 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.mask
@@ -3,8 +3,10 @@
 
 # We don't want to support interpreted languages, changes/updates we make
 # would have a high risk of breaking users.
+#
+# This includes python, which is not listed here. Python is added to
+# package.provided for selinux reasons.
 dev-lang/perl
-dev-lang/python
 dev-lang/ruby
 
 # We do not configure/install grub like other distros so shipping the user
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.provided b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.provided
new file mode 100644
index 00000000000..d9bc0a067f5
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.provided
@@ -0,0 +1,3 @@
+# Mark python as provided for selinux stuff. We have put all the
+# python stuff into install masks by now.
+dev-lang/python-3.11.12

From 554a12a8992de5a24348bdf48639adaeaee2a9c1 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 4 Sep 2025 15:28:40 +0200
Subject: [PATCH 69/92] build_library: Building selinux policy

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 build_library/build_image_util.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/build_library/build_image_util.sh b/build_library/build_image_util.sh
index 3339b6ec0b2..d3fa47cc441 100755
--- a/build_library/build_image_util.sh
+++ b/build_library/build_image_util.sh
@@ -686,7 +686,12 @@ EOF
 
   # Build the selinux policy
   if pkg_use_enabled coreos-base/coreos selinux; then
-      sudo chroot "${root_fs_dir}" bash -c "cd /usr/share/selinux/mcs && semodule -s mcs -i *.pp"
+    info "Building selinux mcs policy"
+    sudo chroot "${root_fs_dir}" bash -s <<'EOF'
+cd /usr/share/selinux/mcs
+set -x
+semodule -s mcs -i *.pp
+EOF
   fi
 
   # Run tmpfiles once to make sure that /etc has everything in place before

From a84f53071ccd9a524a727eb6caeff94c24e17566 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 4 Sep 2025 17:03:13 +0200
Subject: [PATCH 70/92] build_library: Fix pkg_use_enabled

"equery uses" ignores forced or masked USE flags by default. In our
case, the selinux USE flag is forced, so stop ignoring it with
--forced-masked flag. Update the regexp to catch the forced USE flags
too and modernize the function a bit.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 build_library/board_options.sh | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/build_library/board_options.sh b/build_library/board_options.sh
index c454b47bcc6..efe70954a82 100644
--- a/build_library/board_options.sh
+++ b/build_library/board_options.sh
@@ -16,13 +16,19 @@ ARCH=$(get_board_arch ${BOARD})
 
 # check if any of the given use flags are enabled for a pkg
 pkg_use_enabled() {
-  local pkg="$1"
-  shift
-  # for every flag argument, turn it into `-e ^+flag` for grep
-  local grep_args="${@/#/-e ^+}"
+  local pkg="${1}"; shift
 
-  equery-"${BOARD}" -q uses "${pkg}" | grep -q ${grep_args}
-  return $?
+  # for every flag argument, turn it into a regexp that matches it as
+  # either '+${flag}' or '(+${flag})'
+  local -a grep_args=()
+  local flag
+  for flag; do
+      grep_args+=( -e '^(\?+'"${flag}"')\?$' )
+  done
+  local -i rv=0
+
+  equery-"${BOARD}" --quiet uses --forced-masked "${pkg}" | grep --quiet "${grep_args[@]}" || rv=$?
+  return ${rv}
 }
 
 # Usage: pkg_version [installed|binary|ebuild] some-pkg/name

From 32dece91a29bb587a81d3f104d18af2b78c3e11c Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Fri, 5 Sep 2025 15:53:51 +0200
Subject: [PATCH 71/92] build_library: Relabel the whole filesystem

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 build_library/build_image_util.sh | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/build_library/build_image_util.sh b/build_library/build_image_util.sh
index d3fa47cc441..2153c4162c1 100755
--- a/build_library/build_image_util.sh
+++ b/build_library/build_image_util.sh
@@ -726,11 +726,19 @@ EOF
   # The labeling has to be done before moving /etc to /usr/share/flatcar/etc to prevent wrong labels for these files and as
   # the relabeling on boot would cause upcopies in the overlay.
   if pkg_use_enabled coreos-base/coreos selinux; then
-    # TODO: Breaks the system:
-    # sudo setfiles -Dv -r "${root_fs_dir}" "${root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${root_fs_dir}"
-    # sudo setfiles -Dv -r "${root_fs_dir}" "${root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${root_fs_dir}"/usr
-    # For now we only try it with /etc
-    sudo setfiles -Dv -r "${root_fs_dir}" "${root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${root_fs_dir}"/etc
+    # -D - set or update any directory SHA1 digests
+    # -E - treat conflicting specifications as errors
+    # -F - force reset of context to match file_context
+    # -r path - set root path
+    # -v - show changes in file labels
+    # -T 0 - use as many threads as there are cores
+    info "Relabeling the filesystem at ${root_fs_dir@Q}"
+    local path
+    # We do not run relabeling on /boot, it's FAT anyway, so no
+    # support for xattrs there.
+    for path in / /usr /oem; do
+      sudo setfiles -D -E -F -r "${root_fs_dir}" -v -T 0 "${root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${root_fs_dir}${path}"
+    done
   fi
 
   # Backup the /etc contents to /usr/share/flatcar/etc to serve as

From ac702e60b0333c784fd258606e8d72657edd7e4f Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Fri, 5 Sep 2025 15:54:48 +0200
Subject: [PATCH 72/92] build_sysext: Allow specifying forbidden packages in
 sysexts

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 build_sysext | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/build_sysext b/build_sysext
index 92d6abc4009..4a866b11d5d 100755
--- a/build_sysext
+++ b/build_sysext
@@ -43,6 +43,8 @@ DEFINE_boolean ignore_version_mismatch "${FLAGS_FALSE}" \
   "Ignore version mismatch between SDK board packages and base squashfs. DANGEROUS."
 DEFINE_string install_root_basename "${default_install_root_basename}" \
   "Name of a root directory where packages will be installed. ${default_install_root_basename@Q} by default."
+DEFINE_string forbidden_packages "" \
+  "Comma-separated list of pairs describing packages that are forbidden in the sysext. Every pair consist of regexp and message, separated with semicolon. The regexp is for matching a package name (<category>/<name>-<version>::<repo>), and message is printed if the regexp matched a package name. Be careful to not include commas in the regexp or message."
 
 FLAGS_HELP="USAGE: build_sysext [flags] <sysext_name> <binary_package> [<binary_package> ...]
 
@@ -255,6 +257,28 @@ info "Writing ${SYSEXTNAME}_packages.txt"
 ROOT="${BUILD_DIR}/${FLAGS_install_root_basename}" PORTAGE_CONFIGROOT="${BUILD_DIR}/${FLAGS_install_root_basename}" \
       equery --no-color list --format '$cpv::$repo' '*' > "${BUILD_DIR}/${SYSEXTNAME}_packages.txt"
 
+# Check if there are forbidden packages
+mapfile -t pairs <<<"${FLAGS_forbidden_packages//,/$'\n'}"
+declare -A re_msg_pairs=()
+for pair in "${pairs[@]}"; do
+    re=${pair%%;*}
+    msg=${pair#.;}
+    re_msg_pairs["${re}"]="${msg}"
+done
+
+mapfile -t pkgs <"${BUILD_DIR}/${SYSEXTNAME}_packages.txt"
+has_forbidden_pkg=
+for pkg in "${pkgs[@]}"; do
+    for re in "${!re_msg_pairs[@]}"; do
+        if [[ ${pkg} =~ ${re} ]]; then
+            has_forbidden_pkg=x
+            error "Forbidden package ${pkg}: ${msg}"
+        fi
+    done
+done
+if [[ -n ${has_forbidden_pkg} ]]; then
+    die "Forbidden packages encountered"
+fi
 
 if [[ "${FLAGS_strip_binaries}" = "${FLAGS_TRUE}" ]]; then
     chost="$("portageq-${BOARD}" envvar CHOST)"

From bb97c80cf2fba67e53c5fa3b38441cee093de85e Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Fri, 5 Sep 2025 15:55:28 +0200
Subject: [PATCH 73/92] build_library: Forbid SELinux policy packages in
 sysexts

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 build_library/prod_image_util.sh  | 1 +
 build_library/sysext_prod_builder | 1 +
 build_library/vm_image_util.sh    | 1 +
 3 files changed, 3 insertions(+)

diff --git a/build_library/prod_image_util.sh b/build_library/prod_image_util.sh
index 7463f26d402..ed06fc6e42b 100755
--- a/build_library/prod_image_util.sh
+++ b/build_library/prod_image_util.sh
@@ -261,6 +261,7 @@ create_prod_sysexts() {
         --image_builddir="${BUILD_DIR}" \
         --install_root_basename="${name}-extra-sysext-rootfs" \
         ${mangle_script:+--manglefs_script=${mangle_script}} \
+        --forbidden_packages='sec-policy/selinux-.*;selinux policy packages must be in base image' \
         "${name}" "${pkg_array[@]}"
     delta_generator \
       -private_key "/usr/share/update_engine/update-payload-key.key.pem" \
diff --git a/build_library/sysext_prod_builder b/build_library/sysext_prod_builder
index d90fb4a1da2..dd4e81d0dc0 100755
--- a/build_library/sysext_prod_builder
+++ b/build_library/sysext_prod_builder
@@ -69,6 +69,7 @@ create_prod_sysext() {
             --squashfs_base="${base_sysext}" \
             --generate_pkginfo \
             --install_root_basename="${name}-base-sysext-rootfs" \
+            --forbidden_packages='sec-policy/selinux-.*;selinux policy packages must be in base image' \
             "${build_sysext_opts[@]}" \
             "${name}" "${grp_pkg[@]}"
 
diff --git a/build_library/vm_image_util.sh b/build_library/vm_image_util.sh
index ac83929cfa6..3fd855b568e 100644
--- a/build_library/vm_image_util.sh
+++ b/build_library/vm_image_util.sh
@@ -591,6 +591,7 @@ install_oem_sysext() {
         --image_builddir="${built_sysext_dir}"
         --metapkgs="${metapkg}"
         --install_root_basename="${VM_IMG_TYPE}-oem-sysext-rootfs"
+        --forbidden_packages='sec-policy/selinux-.*;selinux policy packages must be in base image' \
     )
     local overlay_path mangle_fs
     overlay_path=$(portageq get_repo_path / coreos-overlay)

From d36b4fe64aad552365e3f28c0b4e998bd86dcca1 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Fri, 5 Sep 2025 16:02:37 +0200
Subject: [PATCH 74/92] overlay coreos-base/coreos: Add more selinux policy
 packages

Some of those policies are pulled in by sysext packages. We want the
policies to be in the base image, so we can build them and be
applicable for sysext contents.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 ...1-r318.ebuild => coreos-0.0.1-r319.ebuild} |  0
 .../coreos-base/coreos/coreos-0.0.1.ebuild    | 24 ++++++++++++++-----
 2 files changed, 18 insertions(+), 6 deletions(-)
 rename sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/{coreos-0.0.1-r318.ebuild => coreos-0.0.1-r319.ebuild} (100%)

diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1-r318.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1-r319.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1-r318.ebuild
rename to sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1-r319.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild
index 22564c301cc..676486a5db6 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild
@@ -78,6 +78,24 @@ RDEPEND="${RDEPEND}
 		app-emulation/xenstore
 	)"
 
+# Some SELinux base policies. Policies under "selinux?" are for
+# sysexts.
+RDEPEND="${RDEPEND}
+	sec-policy/selinux-base
+	sec-policy/selinux-base-policy
+	sec-policy/selinux-container
+	sec-policy/selinux-dbus
+	sec-policy/selinux-policykit
+	sec-policy/selinux-unconfined
+	selinux? (
+		sec-policy/selinux-chronyd
+		sec-policy/selinux-dnsmasq
+		sec-policy/selinux-docker
+		sec-policy/selinux-podman
+		sec-policy/selinux-zfs
+	)
+"
+
 # sys-devel/gettext: it embeds 'envsubst' binary which is useful for simple file templating.
 RDEPEND="${RDEPEND}
 	app-admin/etcd-wrapper
@@ -145,12 +163,6 @@ RDEPEND="${RDEPEND}
 	net-misc/wget
 	net-misc/whois
 	net-vpn/wireguard-tools
-	sec-policy/selinux-base
-	sec-policy/selinux-base-policy
-	sec-policy/selinux-container
-	sec-policy/selinux-dbus
-	sec-policy/selinux-policykit
-	sec-policy/selinux-unconfined
 	sys-apps/acl
 	sys-apps/attr
 	sys-apps/azure-vm-utils

From b6a3829469fe65b130a15b6df20989242d07b9d7 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Fri, 5 Sep 2025 16:27:33 +0200
Subject: [PATCH 75/92] HACK: sys-libs/glibc: Enable selinux even when
 cross-compiling

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../sys-libs/glibc/glibc-2.42-r2.ebuild       | 19 +------------------
 1 file changed, 1 insertion(+), 18 deletions(-)

diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.42-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.42-r2.ebuild
index cb76363880e..af1071b7114 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.42-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/glibc/glibc-2.42-r2.ebuild
@@ -1038,24 +1038,6 @@ glibc_do_configure() {
 
 	myconf+=( --enable-kernel=${MIN_KERN_VER} )
 
-	# Since SELinux support is only required for nscd, only enable it if:
-	# 1. USE selinux
-	# 2. only for the primary ABI on multilib systems
-	# 3. Not a crosscompile
-	if ! is_crosscompile && use selinux ; then
-		if use multilib ; then
-			if is_final_abi ; then
-				myconf+=( --with-selinux )
-			else
-				myconf+=( --without-selinux )
-			fi
-		else
-			myconf+=( --with-selinux )
-		fi
-	else
-		myconf+=( --without-selinux )
-	fi
-
 	# Force a few tests where we always know the answer but
 	# configure is incapable of finding it.
 	if is_crosscompile ; then
@@ -1065,6 +1047,7 @@ glibc_do_configure() {
 	fi
 
 	myconf+=(
+		$(use_with selinux)
 		--disable-werror
 		--enable-bind-now
 		--enable-fortify-source

From 6a28911f6bec0c29c1a4794165d623c4ad8843a7 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Mon, 15 Sep 2025 13:27:35 +0200
Subject: [PATCH 76/92] overlay coreos/user-patches: Add a patch for crossdev

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 ...001-Mask-selinux-when-building-glibc.patch | 33 +++++++++++++++++++
 .../user-patches/sys-devel/crossdev/README.md |  2 ++
 2 files changed, 35 insertions(+)
 create mode 100644 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-devel/crossdev/0001-Mask-selinux-when-building-glibc.patch
 create mode 100644 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-devel/crossdev/README.md

diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-devel/crossdev/0001-Mask-selinux-when-building-glibc.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-devel/crossdev/0001-Mask-selinux-when-building-glibc.patch
new file mode 100644
index 00000000000..506f34b7c09
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-devel/crossdev/0001-Mask-selinux-when-building-glibc.patch
@@ -0,0 +1,33 @@
+From dbd686eb40a1d7e8ac1daeb46d1deab32214fcac Mon Sep 17 00:00:00 2001
+From: Krzesimir Nowak <knowak@microsoft.com>
+Date: Mon, 8 Sep 2025 14:02:29 +0200
+Subject: [PATCH] Mask selinux when building glibc
+
+Disabling selinux via USE=-selinux may not work, if the profile forces
+it.
+---
+ crossdev | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/crossdev b/crossdev
+index 1e5c4ac..e150d30 100755
+--- a/crossdev
++++ b/crossdev
+@@ -1585,6 +1585,14 @@ for f in package.{accept_keywords,env,mask,use} env/${CROSSDEV_OVERLAY_CATEGORY}
+ 	rm -f "${f}/${CROSSDEV_OVERLAY_CATEGORY}"
+ done
+ 
++# selinux won't work in bootstrap environment - libselinux may not be
++# available, need to mask selinux since it could be forced by the
++# profile
++if [[ ${LPKG} = 'glibc' ]]; then
++    LMASK+=" selinux"
++    LFORCE+=" -selinux"
++fi
++
+ pkglist=( K L )
+ if [[ ${LLVM} == "yes" ]] ; then
+ 	pkglist+=( R C )
+-- 
+2.49.1
+
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-devel/crossdev/README.md b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-devel/crossdev/README.md
new file mode 100644
index 00000000000..3a2d259c70c
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-devel/crossdev/README.md
@@ -0,0 +1,2 @@
+This patch should be upstreamed when we can confirm that it works with
+our modification to the glibc ebuild.

From 87e558310d895e53c13bf03ae5a481e498b0fe64 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 13 Nov 2025 13:05:03 +0100
Subject: [PATCH 77/92] overlay coreos/user-patches: Drop systemd patches
 related to SELinux issues

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../0001-wait-online-set-any-by-default.patch |  2 +-
 ...ate-don-t-require-strictly-newer-usr.patch |  2 +-
 ...003-core-use-max-for-DefaultTasksMax.patch |  2 +-
 ...d-Disable-SELinux-permissions-checks.patch | 29 ------
 ...-Keep-using-old-journal-file-format.patch} |  4 +-
 ...-Pass-tty-to-use-by-agetty-via-stdin.patch | 95 -------------------
 ...S-issues-with-default-k8s-configura.patch} |  4 +-
 ...ulti-user.target-the-default-target.patch} |  4 +-
 .../user-patches/sys-apps/systemd/README.md   | 12 +--
 9 files changed, 12 insertions(+), 142 deletions(-)
 delete mode 100644 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0004-systemd-Disable-SELinux-permissions-checks.patch
 rename sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/{0006-units-Keep-using-old-journal-file-format.patch => 0004-units-Keep-using-old-journal-file-format.patch} (92%)
 delete mode 100644 sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0005-Revert-getty-Pass-tty-to-use-by-agetty-via-stdin.patch
 rename sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/{0007-tmpfiles.d-Fix-DNS-issues-with-default-k8s-configura.patch => 0005-tmpfiles.d-Fix-DNS-issues-with-default-k8s-configura.patch} (91%)
 rename sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/{0008-units-Make-multi-user.target-the-default-target.patch => 0006-units-Make-multi-user.target-the-default-target.patch} (90%)

diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0001-wait-online-set-any-by-default.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0001-wait-online-set-any-by-default.patch
index 1ba8f645005..843b442bded 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0001-wait-online-set-any-by-default.patch
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0001-wait-online-set-any-by-default.patch
@@ -1,7 +1,7 @@
 From 83043596b6cc74b6f049999fa660afd983dc493a Mon Sep 17 00:00:00 2001
 From: David Michael <dm0@redhat.com>
 Date: Tue, 16 Apr 2019 02:44:51 +0000
-Subject: [PATCH 1/8] wait-online: set --any by default
+Subject: [PATCH 1/6] wait-online: set --any by default
 
 The systemd-networkd-wait-online command would normally continue
 waiting after a network interface is usable if other interfaces are
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0002-needs-update-don-t-require-strictly-newer-usr.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0002-needs-update-don-t-require-strictly-newer-usr.patch
index ad1045e8b1d..14bfaaea009 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0002-needs-update-don-t-require-strictly-newer-usr.patch
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0002-needs-update-don-t-require-strictly-newer-usr.patch
@@ -1,7 +1,7 @@
 From 3d6bfde35c8ce5c21ca55104852a319246a92bb8 Mon Sep 17 00:00:00 2001
 From: Alex Crawford <alex.crawford@coreos.com>
 Date: Wed, 2 Mar 2016 10:46:33 -0800
-Subject: [PATCH 2/8] needs-update: don't require strictly newer usr
+Subject: [PATCH 2/6] needs-update: don't require strictly newer usr
 
 Updates should be triggered whenever usr changes, not only when it is newer.
 ---
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0003-core-use-max-for-DefaultTasksMax.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0003-core-use-max-for-DefaultTasksMax.patch
index c5c316fe6ad..223828de299 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0003-core-use-max-for-DefaultTasksMax.patch
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0003-core-use-max-for-DefaultTasksMax.patch
@@ -1,7 +1,7 @@
 From 6f691278df570cc87cb863a98fe320a1997c6dad Mon Sep 17 00:00:00 2001
 From: Adrian Vladu <avladu@cloudbasesolutions.com>
 Date: Fri, 16 Feb 2024 11:22:08 +0000
-Subject: [PATCH 3/8] core: use max for DefaultTasksMax
+Subject: [PATCH 3/6] core: use max for DefaultTasksMax
 
 Since systemd v228, systemd has a DefaultTasksMax which defaulted
 to 512, later 15% of the system's maximum number of PIDs.  This
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0004-systemd-Disable-SELinux-permissions-checks.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0004-systemd-Disable-SELinux-permissions-checks.patch
deleted file mode 100644
index 6949d9fc5e6..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0004-systemd-Disable-SELinux-permissions-checks.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 78b2d8b1a6df073003d64cffa532c3a320e96ad4 Mon Sep 17 00:00:00 2001
-From: Matthew Garrett <mjg59@coreos.com>
-Date: Tue, 20 Dec 2016 16:43:22 +0000
-Subject: [PATCH 4/8] systemd: Disable SELinux permissions checks
-
-We don't care about the interaction between systemd and SELinux policy, so
-let's just disable these checks rather than having to incorporate policy
-support. This has no impact on our SELinux use-case, which is purely intended
-to limit containers and not anything running directly on the host.
----
- src/core/selinux-access.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c
-index a67a520a3b..3365b920eb 100644
---- a/src/core/selinux-access.c
-+++ b/src/core/selinux-access.c
-@@ -2,7 +2,7 @@
- 
- #include "selinux-access.h"
- 
--#if HAVE_SELINUX
-+#if 0
- 
- #include <errno.h>
- #include <selinux/avc.h>
--- 
-2.51.0
-
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0006-units-Keep-using-old-journal-file-format.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0004-units-Keep-using-old-journal-file-format.patch
similarity index 92%
rename from sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0006-units-Keep-using-old-journal-file-format.patch
rename to sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0004-units-Keep-using-old-journal-file-format.patch
index 9a3456cc510..5b04e4f1d5c 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0006-units-Keep-using-old-journal-file-format.patch
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0004-units-Keep-using-old-journal-file-format.patch
@@ -1,7 +1,7 @@
-From c2924cc57c9e4aa836021ec2567c0fdbebecf944 Mon Sep 17 00:00:00 2001
+From 5fd281e6cf3b1d5fdd4943a5629e67572391d4bc Mon Sep 17 00:00:00 2001
 From: Adrian Vladu <avladu@cloudbasesolutions.com>
 Date: Fri, 16 Feb 2024 11:29:04 +0000
-Subject: [PATCH 6/8] units: Keep using old journal file format
+Subject: [PATCH 4/6] units: Keep using old journal file format
 
 Systemd 252 made an incompatible change in journal file format. Temporarily
 force journald to use the old journal format to give logging containers more
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0005-Revert-getty-Pass-tty-to-use-by-agetty-via-stdin.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0005-Revert-getty-Pass-tty-to-use-by-agetty-via-stdin.patch
deleted file mode 100644
index d380b96a9cc..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0005-Revert-getty-Pass-tty-to-use-by-agetty-via-stdin.patch
+++ /dev/null
@@ -1,95 +0,0 @@
-From 8064e1544a2b89f8389c0469ed4879a287a045a7 Mon Sep 17 00:00:00 2001
-From: Sayan Chowdhury <schowdhury@microsoft.com>
-Date: Fri, 16 Dec 2022 16:28:26 +0530
-Subject: [PATCH 5/8] Revert "getty: Pass tty to use by agetty via stdin"
-
-This reverts commit b4bf9007cbee7dc0b1356897344ae2a7890df84c.
-
-This is to work around a SELinux denial that happens when setting up standard
-input for serial consoles (which is used for SSH connections).
-
-Signed-off-by: Sayan Chowdhury <schowdhury@microsoft.com>
----
- units/console-getty.service.in    | 4 +---
- units/container-getty@.service.in | 4 +---
- units/getty@.service.in           | 4 +---
- units/serial-getty@.service.in    | 4 +---
- 4 files changed, 4 insertions(+), 12 deletions(-)
-
-diff --git a/units/console-getty.service.in b/units/console-getty.service.in
-index 33e6368db1..1f2d8b910f 100644
---- a/units/console-getty.service.in
-+++ b/units/console-getty.service.in
-@@ -22,12 +22,10 @@ ConditionPathExists=/dev/console
- [Service]
- # The '-o' option value tells agetty to replace 'login' arguments with '--' for
- # safety, and then the entered username.
--ExecStart=-/sbin/agetty -o '-- \\u' --noreset --noclear --keep-baud 115200,57600,38400,9600 - ${TERM}
-+ExecStart=-/sbin/agetty -o '-- \\u' --noreset --noclear --keep-baud 115200,57600,38400,9600 console ${TERM}
- Type=idle
- Restart=always
- UtmpIdentifier=cons
--StandardInput=tty
--StandardOutput=tty
- TTYPath=/dev/console
- TTYReset=yes
- TTYVHangup=yes
-diff --git a/units/container-getty@.service.in b/units/container-getty@.service.in
-index 7573532d6d..5f27653d1f 100644
---- a/units/container-getty@.service.in
-+++ b/units/container-getty@.service.in
-@@ -27,13 +27,11 @@ Before=rescue.service
- [Service]
- # The '-o' option value tells agetty to replace 'login' arguments with '--' for
- # safety, and then the entered username.
--ExecStart=-/sbin/agetty -o '-- \\u' --noreset --noclear - ${TERM}
-+ExecStart=-/sbin/agetty -o '-- \\u' --noreset --noclear pts/%I ${TERM}
- Type=idle
- Restart=always
- RestartSec=0
- UtmpIdentifier=pts/%I
--StandardInput=tty
--StandardOutput=tty
- TTYPath=/dev/pts/%I
- TTYReset=yes
- TTYVHangup=yes
-diff --git a/units/getty@.service.in b/units/getty@.service.in
-index f30bba406d..1819627d1c 100644
---- a/units/getty@.service.in
-+++ b/units/getty@.service.in
-@@ -36,13 +36,11 @@ ConditionPathExists=/dev/tty0
- [Service]
- # The '-o' option value tells agetty to replace 'login' arguments with '--' for
- # safety, and then the entered username.
--ExecStart=-/sbin/agetty -o '-- \\u' --noreset --noclear - ${TERM}
-+ExecStart=-/sbin/agetty -o '-- \\u' --noreset --noclear %I ${TERM}
- Type=idle
- Restart=always
- RestartSec=0
- UtmpIdentifier=%I
--StandardInput=tty
--StandardOutput=tty
- TTYPath=/dev/%I
- TTYReset=yes
- TTYVHangup=yes
-diff --git a/units/serial-getty@.service.in b/units/serial-getty@.service.in
-index 20a5eb2754..ba4cbc0edb 100644
---- a/units/serial-getty@.service.in
-+++ b/units/serial-getty@.service.in
-@@ -32,12 +32,10 @@ Before=rescue.service
- [Service]
- # The '-o' option value tells agetty to replace 'login' arguments with '--' for
- # safety, and then the entered username.
--ExecStart=-/sbin/agetty -o '-- \\u' --noreset --noclear --keep-baud 115200,57600,38400,9600 - ${TERM}
-+ExecStart=-/sbin/agetty -o '-- \\u' --noreset --noclear --keep-baud 115200,57600,38400,9600 %I ${TERM}
- Type=idle
- Restart=always
- UtmpIdentifier=%I
--StandardInput=tty
--StandardOutput=tty
- TTYPath=/dev/%I
- TTYReset=yes
- TTYVHangup=yes
--- 
-2.51.0
-
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0007-tmpfiles.d-Fix-DNS-issues-with-default-k8s-configura.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0005-tmpfiles.d-Fix-DNS-issues-with-default-k8s-configura.patch
similarity index 91%
rename from sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0007-tmpfiles.d-Fix-DNS-issues-with-default-k8s-configura.patch
rename to sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0005-tmpfiles.d-Fix-DNS-issues-with-default-k8s-configura.patch
index ec1ef720251..0a73bc38680 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0007-tmpfiles.d-Fix-DNS-issues-with-default-k8s-configura.patch
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0005-tmpfiles.d-Fix-DNS-issues-with-default-k8s-configura.patch
@@ -1,7 +1,7 @@
-From 7ee314dc08ea65e6951c7007a5f872fd32f0399a Mon Sep 17 00:00:00 2001
+From 90d58a22d1be1629c36ad7fc0826c1a163b20262 Mon Sep 17 00:00:00 2001
 From: Krzesimir Nowak <knowak@microsoft.com>
 Date: Wed, 22 Oct 2025 10:39:42 +0200
-Subject: [PATCH 7/8] tmpfiles.d: Fix DNS issues with default k8s configuration
+Subject: [PATCH 5/6] tmpfiles.d: Fix DNS issues with default k8s configuration
 
 The Kubelet takes /etc/resolv.conf for, e.g., CoreDNS which has dnsPolicy
 "default", but unless the kubelet `--resolv-conf` flag is set to point to
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0008-units-Make-multi-user.target-the-default-target.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0006-units-Make-multi-user.target-the-default-target.patch
similarity index 90%
rename from sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0008-units-Make-multi-user.target-the-default-target.patch
rename to sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0006-units-Make-multi-user.target-the-default-target.patch
index de0aa6eb46e..92e782b60ae 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0008-units-Make-multi-user.target-the-default-target.patch
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/0006-units-Make-multi-user.target-the-default-target.patch
@@ -1,7 +1,7 @@
-From f0ab1c6c59056afe1650f749d1af6ecc6ee8f5ec Mon Sep 17 00:00:00 2001
+From e8dd05237ac4a454a5b6c89be895f0d17540efc2 Mon Sep 17 00:00:00 2001
 From: Krzesimir Nowak <knowak@microsoft.com>
 Date: Fri, 24 Oct 2025 11:06:57 +0200
-Subject: [PATCH 8/8] units: Make multi-user.target the default target
+Subject: [PATCH 6/6] units: Make multi-user.target the default target
 
 Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
 ---
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/README.md b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/README.md
index 643b45fdafc..8bbdeb9e987 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/README.md
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/systemd/README.md
@@ -6,15 +6,9 @@ Most of these patches are not really upstreamable.
   - trigger updates only when /usr changes
 - `0003-core-use-max-for-DefaultTasksMax.patch`
   - increase the too-low limits
-- `0004-systemd-Disable-SELinux-permissions-checks.patch`
-  - disable interactions between systemd and SELinux policies
-  - this will be dropped when we increase SELinux coverage also to a host system
-- `0005-Revert-getty-Pass-tty-to-use-by-agetty-via-stdin.patch`
-  - SELinux denial workaround
-  - this will be dropped when we increase SELinux coverage also to a host system
-- `0006-units-Keep-using-old-journal-file-format.patch`
+- `0004-units-Keep-using-old-journal-file-format.patch`
   - backward compat stuff
-- `0007-tmpfiles.d-Fix-DNS-issues-with-default-k8s-configura.patch`
+- `0005-tmpfiles.d-Fix-DNS-issues-with-default-k8s-configura.patch`
   - workaround for issues with default k8s coredns config
-- `0008-units-Make-multi-user.target-the-default-target.patch`
+- `0006-units-Make-multi-user.target-the-default-target.patch`
   - change default.target to a suitable symlink for Flatcar

From 5735ecb4ab4677e156f6e96c6c2e511b544ddf0e Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 13 Nov 2025 13:05:24 +0100
Subject: [PATCH 78/92] overlay profiles: Drop sec-policy/selinux-ntp from
 package.provided

We have pulled enough policies for the build problem to go away.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../coreos-overlay/profiles/coreos/base/package.provided     | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.provided b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.provided
index 3bcb7981d2f..8a8430c5c5c 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.provided
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.provided
@@ -18,8 +18,3 @@ sys-devel/bpf-toolchain-14.2.0_p1
 # Pulled by app-crypt/sbsigntools - we never needed it and it pulls a
 # ton of other packages.
 dev-perl/Locale-gettext-1.70.0_p20181130
-
-# Pulled in by sys-apps/systemd, breaks the build - the image stage
-# fails with "Failed to resolve typeattributeset statement at
-# /var/lib/selinux/mcs/tmp/modules/400/ntp/cil:120"
-sec-policy/selinux-ntp-2.20250618-r1

From f9811bacb6ffd8588f874a02f3d8f8afce4056fa Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 13 Nov 2025 13:14:06 +0100
Subject: [PATCH 79/92] overlay coreos/config: Add pam_selinux to systemd PAM
 configs

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../coreos-overlay/coreos/config/env/sys-apps/systemd          | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/systemd b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/systemd
index defe7e8d0ba..00e127fec25 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/systemd
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/systemd
@@ -91,10 +91,13 @@ cros_post_src_install_flatcar_stuff() {
         # with our own.
         newpamd - "systemd-user" <<'EOF'
 account include system-auth
+session required pam_selinux.so close
+session required pam_selinux.so nottys open
 session include system-login
 EOF
         newpamd - "systemd-run0" <<'EOF'
 account include system-auth
+session include system-selinux
 session include system-login
 EOF
 

From 44d32656345253ce6b46d6b82056bacf65fbe044 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 25 Sep 2025 17:05:21 +0200
Subject: [PATCH 80/92] build_sysexts: Relabel sysexts too

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 build_sysext | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/build_sysext b/build_sysext
index 4a866b11d5d..b8a6e8aa2b6 100755
--- a/build_sysext
+++ b/build_sysext
@@ -241,9 +241,9 @@ done
 # Make squashfs generation more reproducible.
 export SOURCE_DATE_EPOCH=$(stat -c '%Y' "${BUILD_DIR}/fs-root/usr/lib/os-release")
 
-# Unmount in order to get rid of the overlay
+# Unmount in order to get rid of the overlay, but keep fs-root for
+# now, so we can use selinux file contexts.
 umount "${BUILD_DIR}/${FLAGS_install_root_basename}"
-umount "${BUILD_DIR}/fs-root"
 
 if [[ "$FLAGS_generate_pkginfo" = "${FLAGS_TRUE}" ]] ; then
   info "  Creating pkginfo squashfs '${BUILD_DIR}/${SYSEXTNAME}_pkginfo.raw'"
@@ -328,11 +328,16 @@ if [[ -n "${invalid_files}" ]]; then
   die "Invalid file ownership: ${invalid_files}"
 fi
 
+info "Relabeling sysext contents"
+setfiles -D -E -F -r "${BUILD_DIR}/${FLAGS_install_root_basename}" -v -T 0 "${BUILD_DIR}/fs-root/usr/share/flatcar/etc/selinux/mcs/contexts/files/file_contexts" "${BUILD_DIR}/${FLAGS_install_root_basename}"
+umount "${BUILD_DIR}/fs-root"
+
+info "Creating squashfs image"
 mksquashfs "${BUILD_DIR}/${FLAGS_install_root_basename}" "${BUILD_DIR}/${SYSEXTNAME}.raw" \
                -noappend -xattrs-exclude '^btrfs.' -comp "${FLAGS_compression}" ${FLAGS_mksquashfs_opts}
 rm -rf "${BUILD_DIR}"/{fs-root,"${FLAGS_install_root_basename}",workdir}
 
-# Generate reports
+info "Generating reports"
 mkdir "${BUILD_DIR}/img-rootfs"
 mount -rt squashfs -o loop,nodev "${BUILD_DIR}/${SYSEXTNAME}.raw" "${BUILD_DIR}/img-rootfs"
 write_contents "${BUILD_DIR}/img-rootfs" "${BUILD_DIR}/${SYSEXTNAME}_contents.txt"

From 83715f7ca52d16c77b01d12b3008f6a3315225c2 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Fri, 26 Sep 2025 14:55:11 +0200
Subject: [PATCH 81/92] build_sysext: Factor out install root to a variable

Made it easier to change its path.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 build_sysext | 42 ++++++++++++++++++++++++++----------------
 1 file changed, 26 insertions(+), 16 deletions(-)

diff --git a/build_sysext b/build_sysext
index b8a6e8aa2b6..bbe2abd8002 100755
--- a/build_sysext
+++ b/build_sysext
@@ -139,12 +139,22 @@ _get_sysext_arch() {
     fi
 }
 
+if [[ ${FLAGS_install_root_basename} = */* || ${FLAGS_install_root_basename} = . || ${FLAGS_install_root_basename} = .. ]]; then
+    die "Just use a normal install root basename like 'my-best-rootfs-with-no-slashes' instead of ${FLAGS_install_root_basename@Q}, will ya?!"
+fi
+
+# Put the custom install root directory inside the install-root
+# subdirectory of BUILD_DIR to avoid the accidental messing with other
+# directories we create inside directly inside BUILD_DIR.
+THE_INSTALL_ROOT=${BUILD_DIR}/install-root/${FLAGS_install_root_basename}
+
 cleanup() {
   local dirs=(
     "${BUILD_DIR}/fs-root"
-    "${BUILD_DIR}/${FLAGS_install_root_basename}"
+    "${THE_INSTALL_ROOT}"
     "${BUILD_DIR}/workdir"
     "${BUILD_DIR}/img-rootfs"
+    "${BUILD_DIR}/install-root"
   )
   umount "${dirs[@]}" 2>/dev/null || true
   rm -rf "${dirs[@]}" || true
@@ -185,9 +195,9 @@ fi
 
 mkdir "${BUILD_DIR}/fs-root"
 mount -rt squashfs -o loop,nodev "${FLAGS_squashfs_base}" "${BUILD_DIR}/fs-root"
-mkdir "${BUILD_DIR}/${FLAGS_install_root_basename}"
+mkdir -p "${THE_INSTALL_ROOT}"
 mkdir "${BUILD_DIR}/workdir"
-mount -t overlay overlay -o lowerdir="${BUILD_DIR}/fs-root${pkginfo_lowerdirs}",upperdir="${BUILD_DIR}/${FLAGS_install_root_basename}",workdir="${BUILD_DIR}/workdir" "${BUILD_DIR}/${FLAGS_install_root_basename}"
+mount -t overlay overlay -o lowerdir="${BUILD_DIR}/fs-root${pkginfo_lowerdirs}",upperdir="${THE_INSTALL_ROOT}",workdir="${BUILD_DIR}/workdir" "${THE_INSTALL_ROOT}"
 
 REPO_BUILD_ID=$(source "${REPO_MANIFESTS_DIR}/version.txt"; echo "$FLATCAR_BUILD_ID")
 REPO_FLATCAR_VERSION=$(source "${REPO_MANIFESTS_DIR}/version.txt"; echo "$FLATCAR_VERSION")
@@ -227,7 +237,7 @@ info "Building '${SYSEXTNAME}' squashfs with (meta-)packages '${@}' in '${BUILD_
 for package; do
   echo "Installing package into sysext image: $package"
   FEATURES="-ebuild-locks binpkg-multi-instance" emerge \
-    --root="${BUILD_DIR}/${FLAGS_install_root_basename}" \
+    --root="${THE_INSTALL_ROOT}" \
     --config-root="/build/${FLAGS_board}"  \
     --sysroot="/build/${FLAGS_board}"  \
     --usepkgonly \
@@ -243,18 +253,18 @@ export SOURCE_DATE_EPOCH=$(stat -c '%Y' "${BUILD_DIR}/fs-root/usr/lib/os-release
 
 # Unmount in order to get rid of the overlay, but keep fs-root for
 # now, so we can use selinux file contexts.
-umount "${BUILD_DIR}/${FLAGS_install_root_basename}"
+umount "${THE_INSTALL_ROOT}"
 
 if [[ "$FLAGS_generate_pkginfo" = "${FLAGS_TRUE}" ]] ; then
   info "  Creating pkginfo squashfs '${BUILD_DIR}/${SYSEXTNAME}_pkginfo.raw'"
   mkdir -p "${BUILD_DIR}/img-pkginfo/var/db"
-  cp -R "${BUILD_DIR}/${FLAGS_install_root_basename}/var/db/pkg" "${BUILD_DIR}/img-pkginfo/var/db/"
+  cp -R "${THE_INSTALL_ROOT}/var/db/pkg" "${BUILD_DIR}/img-pkginfo/var/db/"
   mksquashfs "${BUILD_DIR}/img-pkginfo" "${BUILD_DIR}/${SYSEXTNAME}_pkginfo.raw" \
               -noappend -xattrs-exclude '^btrfs.' -comp "${FLAGS_compression}" ${FLAGS_mksquashfs_opts}
 fi
 
 info "Writing ${SYSEXTNAME}_packages.txt"
-ROOT="${BUILD_DIR}/${FLAGS_install_root_basename}" PORTAGE_CONFIGROOT="${BUILD_DIR}/${FLAGS_install_root_basename}" \
+ROOT="${THE_INSTALL_ROOT}" PORTAGE_CONFIGROOT="${THE_INSTALL_ROOT}" \
       equery --no-color list --format '$cpv::$repo' '*' > "${BUILD_DIR}/${SYSEXTNAME}_packages.txt"
 
 # Check if there are forbidden packages
@@ -287,7 +297,7 @@ if [[ "${FLAGS_strip_binaries}" = "${FLAGS_TRUE}" ]]; then
     info "Stripping all non-stripped binaries in sysext using '${strip}'"
 
     # Find all non-stripped binaries, remove ':' from filepath, and strip 'em
-    find "${BUILD_DIR}/${FLAGS_install_root_basename}" -exec file \{\} \; \
+    find "${THE_INSTALL_ROOT}" -exec file \{\} \; \
          | awk '/not stripped/ {print substr($1, 1, length($1)-1)}' \
          | while read bin; do
                 info "     ${strip} ${bin}"
@@ -299,41 +309,41 @@ if [[ -n "${FLAGS_manglefs_script}" ]]; then
   if [[ ! -x "${FLAGS_manglefs_script}" ]]; then
     die "${FLAGS_manglefs_script} is not executable"
   fi
-  "${FLAGS_manglefs_script}" "${BUILD_DIR}/${FLAGS_install_root_basename}"
+  "${FLAGS_manglefs_script}" "${THE_INSTALL_ROOT}"
 fi
 
 info "Removing non-/usr directories from sysext image"
-for entry in "${BUILD_DIR}/${FLAGS_install_root_basename}"/*; do
+for entry in "${THE_INSTALL_ROOT}"/*; do
   if [[ "${entry}" = */usr ]]; then
     continue
   fi
   info "  Removing ${entry##*/}"
   rm -rf "${entry}"
 done
-mkdir -p "${BUILD_DIR}/${FLAGS_install_root_basename}/usr/lib/extension-release.d"
+mkdir -p "${THE_INSTALL_ROOT}/usr/lib/extension-release.d"
 version_field="${VERSION_FIELD_OVERRIDE:-VERSION_ID=${FLATCAR_VERSION_ID}}"
 all_fields=(
   'ID=flatcar'
   "${version_field}"
   "ARCHITECTURE=${ARCH}"
 )
-printf '%s\n' "${all_fields[@]}" >"${BUILD_DIR}/${FLAGS_install_root_basename}/usr/lib/extension-release.d/extension-release.${SYSEXTNAME}"
+printf '%s\n' "${all_fields[@]}" >"${THE_INSTALL_ROOT}/usr/lib/extension-release.d/extension-release.${SYSEXTNAME}"
 
 info "Removing opaque directory markers to always merge all contents"
-find "${BUILD_DIR}/${FLAGS_install_root_basename}" -xdev -type d -exec sh -c 'if [ "$(attr -R -q -g overlay.opaque {} 2>/dev/null)" = y ]; then attr -R -r overlay.opaque {}; fi' \;
+find "${THE_INSTALL_ROOT}" -xdev -type d -exec sh -c 'if [ "$(attr -R -q -g overlay.opaque {} 2>/dev/null)" = y ]; then attr -R -r overlay.opaque {}; fi' \;
 
 info "Checking for invalid file ownership"
-invalid_files=$(find "${BUILD_DIR}/${FLAGS_install_root_basename}" -user sdk -or -group sdk)
+invalid_files=$(find "${THE_INSTALL_ROOT}" -user sdk -or -group sdk)
 if [[ -n "${invalid_files}" ]]; then
   die "Invalid file ownership: ${invalid_files}"
 fi
 
 info "Relabeling sysext contents"
-setfiles -D -E -F -r "${BUILD_DIR}/${FLAGS_install_root_basename}" -v -T 0 "${BUILD_DIR}/fs-root/usr/share/flatcar/etc/selinux/mcs/contexts/files/file_contexts" "${BUILD_DIR}/${FLAGS_install_root_basename}"
+setfiles -D -E -F -r "${THE_INSTALL_ROOT}" -v -T 0 "${BUILD_DIR}/fs-root/usr/share/flatcar/etc/selinux/mcs/contexts/files/file_contexts" "${THE_INSTALL_ROOT}"
 umount "${BUILD_DIR}/fs-root"
 
 info "Creating squashfs image"
-mksquashfs "${BUILD_DIR}/${FLAGS_install_root_basename}" "${BUILD_DIR}/${SYSEXTNAME}.raw" \
+mksquashfs "${THE_INSTALL_ROOT}" "${BUILD_DIR}/${SYSEXTNAME}.raw" \
                -noappend -xattrs-exclude '^btrfs.' -comp "${FLAGS_compression}" ${FLAGS_mksquashfs_opts}
 rm -rf "${BUILD_DIR}"/{fs-root,"${FLAGS_install_root_basename}",workdir}
 

From 46a76f1832d55cdfdabec5de7e04140183ad50e2 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Tue, 30 Sep 2025 14:14:23 +0200
Subject: [PATCH 82/92] overlay coreos/user-patches: Update patch for selinux
 policies

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../0001-Flatcar-modifications.patch          | 28 +++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/flatcar-selinux-patches/0001-Flatcar-modifications.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/flatcar-selinux-patches/0001-Flatcar-modifications.patch
index cd57e4dff7a..e7e3c32bd55 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/flatcar-selinux-patches/0001-Flatcar-modifications.patch
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/flatcar-selinux-patches/0001-Flatcar-modifications.patch
@@ -1,4 +1,4 @@
-From 9398464fe4d29cb3e9ad3c04c2c749747438fb65 Mon Sep 17 00:00:00 2001
+From 776730b89903c93a405dcfec2dbda27e012f99df Mon Sep 17 00:00:00 2001
 From: Krzesimir Nowak <knowak@microsoft.com>
 Date: Mon, 4 Dec 2023 12:17:25 +0100
 Subject: [PATCH] Flatcar modifications
@@ -14,7 +14,8 @@ Subject: [PATCH] Flatcar modifications
  policy/modules/system/init.te           |   8 ++
  policy/modules/system/locallogin.te     |   9 +-
  policy/modules/system/logging.te        |   9 ++
- 10 files changed, 427 insertions(+), 3 deletions(-)
+ policy/modules/system/systemd.fc        |  12 ++
+ 11 files changed, 439 insertions(+), 3 deletions(-)
 
 diff --git a/refpolicy/policy/modules/admin/netutils.te b/refpolicy/policy/modules/admin/netutils.te
 index 63d2f9cb8..62dff5f94 100644
@@ -568,6 +569,29 @@ index 14d3132be..ce40abc52 100644
  	allow syslogd_t self:capability audit_control;
  	allow syslogd_t self:netlink_audit_socket connected_socket_perms;
  	allow syslogd_t self:capability2 audit_read;
+diff --git a/refpolicy/policy/modules/system/systemd.fc b/refpolicy/policy/modules/system/systemd.fc
+index c648266c1..e19e1d07a 100644
+--- a/refpolicy/policy/modules/system/systemd.fc
++++ b/refpolicy/policy/modules/system/systemd.fc
+@@ -123,6 +123,18 @@ HOME_ROOT/.+\.home	--	gen_context(system_u:object_r:systemd_homed_storage_t,s0)
+ /run/systemd/seats(/.*)?	gen_context(system_u:object_r:systemd_sessions_runtime_t,s0)
+ /run/systemd/sessions(/.*)?	gen_context(system_u:object_r:systemd_sessions_runtime_t,s0)
+ /run/systemd/shutdown(/.*)?	gen_context(system_u:object_r:systemd_logind_runtime_t,s0)
++#
++# FLATCAR:
++#
++# This is to fix a label of a merged filesystem.
++#
++/run/systemd/sysext/meta/usr	-d	gen_context(system_u:object_r:usr_t,s0)
++/run/systemd/sysext/meta/opt	-d	gen_context(system_u:object_r:usr_t,s0)
++/run/systemd/sysext/usr	-d	gen_context(system_u:object_r:usr_t,s0)
++/run/systemd/sysext/opt	-d	gen_context(system_u:object_r:usr_t,s0)
++/var/lib/extensions.mutable/usr	-d	gen_context(system_u:object_r:usr_t,s0)
++/var/lib/extensions.mutable/opt	-d	gen_context(system_u:object_r:usr_t,s0)
++
+ /run/systemd/users(/.*)?	gen_context(system_u:object_r:systemd_logind_runtime_t,s0)
+ /run/systemd/userdb(/.*)?	gen_context(system_u:object_r:systemd_userdbd_runtime_t,s0)
+ /run/systemd/inhibit(/.*)?	gen_context(system_u:object_r:systemd_logind_inhibit_runtime_t,s0)
 -- 
 2.49.1
 

From 794152e7e818ddb24fff100aa3f7f503ef0747d8 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 13 Nov 2025 12:41:20 +0100
Subject: [PATCH 83/92] build_library: Move and fix pkg_use_enabled into

There were two problems with pkg_use_enabled:

1. It did not detect force-enabled or masked USE flags correctly -
   selinux USE flag is force-enabled and is shown in the output inside
   parentheses.

2. It was defined in board_options.sh which injects some command line
   flags and globals that are not related to the function.

Since pkg_use_enabled was only used so far for checking the selinux
USE flags, add a function is_selinux_enabled and use the newly added
function in the currently only user of pkg_use_enabled.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 build_library/board_options.sh    | 17 -----------------
 build_library/build_image_util.sh |  5 +++--
 build_library/pkg_util.sh         | 30 ++++++++++++++++++++++++++++++
 3 files changed, 33 insertions(+), 19 deletions(-)
 create mode 100644 build_library/pkg_util.sh

diff --git a/build_library/board_options.sh b/build_library/board_options.sh
index efe70954a82..baa18f8fd9f 100644
--- a/build_library/board_options.sh
+++ b/build_library/board_options.sh
@@ -14,23 +14,6 @@ ARCH=$(get_board_arch ${BOARD})
 # What cross-build are we targeting?
 . "${BOARD_ROOT}/etc/portage/make.conf" || die
 
-# check if any of the given use flags are enabled for a pkg
-pkg_use_enabled() {
-  local pkg="${1}"; shift
-
-  # for every flag argument, turn it into a regexp that matches it as
-  # either '+${flag}' or '(+${flag})'
-  local -a grep_args=()
-  local flag
-  for flag; do
-      grep_args+=( -e '^(\?+'"${flag}"')\?$' )
-  done
-  local -i rv=0
-
-  equery-"${BOARD}" --quiet uses --forced-masked "${pkg}" | grep --quiet "${grep_args[@]}" || rv=$?
-  return ${rv}
-}
-
 # Usage: pkg_version [installed|binary|ebuild] some-pkg/name
 # Prints: some-pkg/name-1.2.3
 # Note: returns 0 even if the package was not found.
diff --git a/build_library/build_image_util.sh b/build_library/build_image_util.sh
index 2153c4162c1..3a66b973227 100755
--- a/build_library/build_image_util.sh
+++ b/build_library/build_image_util.sh
@@ -19,6 +19,7 @@ fi
 BUILD_DIR="${FLAGS_output_root}/${BOARD}/${IMAGE_SUBDIR}"
 OUTSIDE_OUTPUT_DIR="../build/images/${BOARD}/${IMAGE_SUBDIR}"
 
+source "${BUILD_LIBRARY_DIR}/pkg_util.sh" || exit 1
 source "${BUILD_LIBRARY_DIR}/reports_util.sh" || exit 1
 source "${BUILD_LIBRARY_DIR}/sbsign_util.sh" || exit 1
 
@@ -685,7 +686,7 @@ EOF
   fi
 
   # Build the selinux policy
-  if pkg_use_enabled coreos-base/coreos selinux; then
+  if is_selinux_enabled "${BOARD}"; then
     info "Building selinux mcs policy"
     sudo chroot "${root_fs_dir}" bash -s <<'EOF'
 cd /usr/share/selinux/mcs
@@ -725,7 +726,7 @@ EOF
   # SELinux: Label the root filesystem for using 'file_contexts'.
   # The labeling has to be done before moving /etc to /usr/share/flatcar/etc to prevent wrong labels for these files and as
   # the relabeling on boot would cause upcopies in the overlay.
-  if pkg_use_enabled coreos-base/coreos selinux; then
+  if is_selinux_enabled "${BOARD}"; then
     # -D - set or update any directory SHA1 digests
     # -E - treat conflicting specifications as errors
     # -F - force reset of context to match file_context
diff --git a/build_library/pkg_util.sh b/build_library/pkg_util.sh
new file mode 100644
index 00000000000..4865ba73168
--- /dev/null
+++ b/build_library/pkg_util.sh
@@ -0,0 +1,30 @@
+# Copyright (c) 2025 The Flatcar Maintainers. All rights reserved.
+# Use of this source code is governed by the Apache 2.0 license.
+
+# check if any of the given use flags are enabled for a pkg
+pkg_use_enabled() {
+  local board=${1}; shift
+  local pkg=${1}; shift
+
+  # for every flag argument, turn it into a regexp that matches it as
+  # either '+${flag}' or '(+${flag})'
+  local -a grep_args=()
+  local flag
+  for flag; do
+    grep_args+=( -e '^(\?+'"${flag}"')\?$' )
+  done
+  local -i rv=0
+  local equery='equery'
+  if [[ -n ${board} ]]; then
+    equery+="-${board}"
+  fi
+
+  "${equery}" --quiet uses --forced-masked "${pkg}" | grep --quiet "${grep_args[@]}" || rv=$?
+  return ${rv}
+}
+
+is_selinux_enabled() {
+  local board=${1}; shift
+
+  pkg_use_enabled "${board}" coreos-base/coreos selinux
+}

From c87aa5932a15e0216732c3a3fd59577c83f47183 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 13 Nov 2025 12:50:57 +0100
Subject: [PATCH 84/92] build_sysext: Fix a crash when there were no forbidden
 packages

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 build_sysext | 40 +++++++++++++++++++++-------------------
 1 file changed, 21 insertions(+), 19 deletions(-)

diff --git a/build_sysext b/build_sysext
index bbe2abd8002..78ff9fc2b35 100755
--- a/build_sysext
+++ b/build_sysext
@@ -267,27 +267,29 @@ info "Writing ${SYSEXTNAME}_packages.txt"
 ROOT="${THE_INSTALL_ROOT}" PORTAGE_CONFIGROOT="${THE_INSTALL_ROOT}" \
       equery --no-color list --format '$cpv::$repo' '*' > "${BUILD_DIR}/${SYSEXTNAME}_packages.txt"
 
-# Check if there are forbidden packages
-mapfile -t pairs <<<"${FLAGS_forbidden_packages//,/$'\n'}"
-declare -A re_msg_pairs=()
-for pair in "${pairs[@]}"; do
-    re=${pair%%;*}
-    msg=${pair#.;}
-    re_msg_pairs["${re}"]="${msg}"
-done
+if [[ -n ${FLAGS_forbidden_packages} ]]; then
+    # Check if there are forbidden packages
+    mapfile -t pairs <<<"${FLAGS_forbidden_packages//,/$'\n'}"
+    declare -A re_msg_pairs=()
+    for pair in "${pairs[@]}"; do
+        re=${pair%%;*}
+        msg=${pair#.;}
+        re_msg_pairs["${re}"]="${msg}"
+    done
 
-mapfile -t pkgs <"${BUILD_DIR}/${SYSEXTNAME}_packages.txt"
-has_forbidden_pkg=
-for pkg in "${pkgs[@]}"; do
-    for re in "${!re_msg_pairs[@]}"; do
-        if [[ ${pkg} =~ ${re} ]]; then
-            has_forbidden_pkg=x
-            error "Forbidden package ${pkg}: ${msg}"
-        fi
+    mapfile -t pkgs <"${BUILD_DIR}/${SYSEXTNAME}_packages.txt"
+    has_forbidden_pkg=
+    for pkg in "${pkgs[@]}"; do
+        for re in "${!re_msg_pairs[@]}"; do
+            if [[ ${pkg} =~ ${re} ]]; then
+                has_forbidden_pkg=x
+                error "Forbidden package ${pkg}: ${msg}"
+            fi
+        done
     done
-done
-if [[ -n ${has_forbidden_pkg} ]]; then
-    die "Forbidden packages encountered"
+    if [[ -n ${has_forbidden_pkg} ]]; then
+        die "Forbidden packages encountered"
+    fi
 fi
 
 if [[ "${FLAGS_strip_binaries}" = "${FLAGS_TRUE}" ]]; then

From 613843ea8c3ef492de4141eb9d27696ada78f2ca Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 13 Nov 2025 12:51:40 +0100
Subject: [PATCH 85/92] build_sysext: Add --selinux flag and use it to build
 policies

For built-in sysext, we may not have yet any policies built, so the
relabeling won't work. To fix the situation, so we need to temporarily
build them ourselves.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 build_sysext | 29 ++++++++++++++++++++++++++---
 1 file changed, 26 insertions(+), 3 deletions(-)

diff --git a/build_sysext b/build_sysext
index 78ff9fc2b35..df59689f9e8 100755
--- a/build_sysext
+++ b/build_sysext
@@ -45,6 +45,8 @@ DEFINE_string install_root_basename "${default_install_root_basename}" \
   "Name of a root directory where packages will be installed. ${default_install_root_basename@Q} by default."
 DEFINE_string forbidden_packages "" \
   "Comma-separated list of pairs describing packages that are forbidden in the sysext. Every pair consist of regexp and message, separated with semicolon. The regexp is for matching a package name (<category>/<name>-<version>::<repo>), and message is printed if the regexp matched a package name. Be careful to not include commas in the regexp or message."
+DEFINE_boolean selinux "${FLAGS_FALSE}" \
+  "Relabel the files in sysext using policies installed in the base squashfs image."
 
 FLAGS_HELP="USAGE: build_sysext [flags] <sysext_name> <binary_package> [<binary_package> ...]
 
@@ -155,6 +157,8 @@ cleanup() {
     "${BUILD_DIR}/workdir"
     "${BUILD_DIR}/img-rootfs"
     "${BUILD_DIR}/install-root"
+    "${BUILD_DIR}/selinux-root"
+    "${BUILD_DIR}/selinux-root-workdir"
   )
   umount "${dirs[@]}" 2>/dev/null || true
   rm -rf "${dirs[@]}" || true
@@ -254,6 +258,13 @@ export SOURCE_DATE_EPOCH=$(stat -c '%Y' "${BUILD_DIR}/fs-root/usr/lib/os-release
 # Unmount in order to get rid of the overlay, but keep fs-root for
 # now, so we can use selinux file contexts.
 umount "${THE_INSTALL_ROOT}"
+if [[ ${FLAGS_selinux} = "${FLAGS_TRUE}" ]]; then
+    mkdir "${BUILD_DIR}/selinux-root"
+    mkdir "${BUILD_DIR}/selinux-root-workdir"
+    mount -t overlay overlay -o lowerdir="${BUILD_DIR}/fs-root${pkginfo_lowerdirs}",upperdir="${BUILD_DIR}/selinux-root",workdir="${BUILD_DIR}/selinux-root-workdir" "${BUILD_DIR}/selinux-root"
+else
+    umount "${BUILD_DIR}/fs-root"
+fi
 
 if [[ "$FLAGS_generate_pkginfo" = "${FLAGS_TRUE}" ]] ; then
   info "  Creating pkginfo squashfs '${BUILD_DIR}/${SYSEXTNAME}_pkginfo.raw'"
@@ -340,9 +351,21 @@ if [[ -n "${invalid_files}" ]]; then
   die "Invalid file ownership: ${invalid_files}"
 fi
 
-info "Relabeling sysext contents"
-setfiles -D -E -F -r "${THE_INSTALL_ROOT}" -v -T 0 "${BUILD_DIR}/fs-root/usr/share/flatcar/etc/selinux/mcs/contexts/files/file_contexts" "${THE_INSTALL_ROOT}"
-umount "${BUILD_DIR}/fs-root"
+if [[ ${FLAGS_selinux} = "${FLAGS_TRUE}" ]]; then
+    info "Build temporary selinux modules"
+    chroot "${BUILD_DIR}/selinux-root" bash -s <<'EOF'
+cd /usr/share/selinux/mcs
+set -x
+semodule -s mcs -n -i *.pp
+EOF
+
+    info "Relabeling sysext contents"
+    spec_file="${BUILD_DIR}/selinux-root/etc/selinux/mcs/contexts/files/file_contexts"
+    setfiles -D -E -F -r "${THE_INSTALL_ROOT}" -v -T 0 "${spec_file}" "${THE_INSTALL_ROOT}"
+    ls -laRZ "${THE_INSTALL_ROOT}"
+    umount "${BUILD_DIR}/selinux-root"
+    umount "${BUILD_DIR}/fs-root"
+fi
 
 info "Creating squashfs image"
 mksquashfs "${THE_INSTALL_ROOT}" "${BUILD_DIR}/${SYSEXTNAME}.raw" \

From a1ca8a74db02856b28f473645afc57b121842a25 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 13 Nov 2025 12:54:20 +0100
Subject: [PATCH 86/92] build_library: Pass --selinux flag to build_sysext

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 build_library/prod_image_util.sh  | 24 +++++++++++++++++++-----
 build_library/sysext_prod_builder |  9 ++++++++-
 build_library/vm_image_util.sh    |  5 +++++
 3 files changed, 32 insertions(+), 6 deletions(-)

diff --git a/build_library/prod_image_util.sh b/build_library/prod_image_util.sh
index ed06fc6e42b..0a81108ecf1 100755
--- a/build_library/prod_image_util.sh
+++ b/build_library/prod_image_util.sh
@@ -3,6 +3,8 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+source "${BUILD_LIBRARY_DIR}/pkg_util.sh" || exit 1
+
 # Lookup the current version of a binary package, downloading it if needed.
 # Usage: get_binary_pkg some-pkg/name
 # Prints: some-pkg/name-1.2.3
@@ -222,6 +224,14 @@ create_prod_tar() {
 create_prod_sysexts() {
   local image_name="$1"
   local image_sysext_base="${image_name%.bin}_sysext.squashfs"
+  local -a extra_args
+
+  local selinux=''
+  if is_selinux_enabled "${BOARD}"; then
+    selinux=x
+  fi
+
+  local sysext
   for sysext in "${EXTRA_SYSEXTS[@]}"; do
     local name pkgs useflags arches
     IFS="|" read -r name pkgs useflags arches <<< "$sysext"
@@ -230,9 +240,13 @@ create_prod_sysexts() {
     local arch_array=(${arches//,/ })
     local useflags_array=(${useflags//,/ })
 
+    extra_args=()
     local mangle_script="${BUILD_LIBRARY_DIR}/sysext_mangle_${name}"
-    if [[ ! -x "${mangle_script}" ]]; then
-      mangle_script=
+    if [[ -x "${mangle_script}" ]]; then
+      extra_args+=( --manglefs_script="${mangle_script}" )
+    fi
+    if [[ -n ${selinux} ]]; then
+      extra_args+=( --selinux )
     fi
 
     if [[ -n "$arches" ]]; then
@@ -248,8 +262,8 @@ create_prod_sysexts() {
     fi
 
     sudo rm -f "${BUILD_DIR}/${name}.raw" \
-	"${BUILD_DIR}/flatcar-test-update-${name}.gz" \
-	"${BUILD_DIR}/${name}_*"
+        "${BUILD_DIR}/flatcar-test-update-${name}.gz" \
+        "${BUILD_DIR}/${name}_*"
     # we use -E to pass the USE flags, but also MODULES_SIGN variables
     #
     # The --install_root_basename="${name}-extra-sysext-rootfs" flag
@@ -260,8 +274,8 @@ create_prod_sysexts() {
         --squashfs_base="${BUILD_DIR}/${image_sysext_base}" \
         --image_builddir="${BUILD_DIR}" \
         --install_root_basename="${name}-extra-sysext-rootfs" \
-        ${mangle_script:+--manglefs_script=${mangle_script}} \
         --forbidden_packages='sec-policy/selinux-.*;selinux policy packages must be in base image' \
+        "${extra_args[@]}" \
         "${name}" "${pkg_array[@]}"
     delta_generator \
       -private_key "/usr/share/update_engine/update-payload-key.key.pem" \
diff --git a/build_library/sysext_prod_builder b/build_library/sysext_prod_builder
index dd4e81d0dc0..727987ae280 100755
--- a/build_library/sysext_prod_builder
+++ b/build_library/sysext_prod_builder
@@ -16,6 +16,7 @@ assert_inside_chroot
 switch_to_strict_mode
 
 . "${BUILD_LIBRARY_DIR}/build_image_util.sh" || exit 1
+. "${BUILD_LIBRARY_DIR}/pkg_util.sh" || exit 1
 
 # Create a sysext from a package and install it to the OS image.
 # Conventions:
@@ -54,6 +55,13 @@ create_prod_sysext() {
     msg="${msg}, FS mangle script 'sysext_mangle_${name}'"
   fi
 
+  if is_selinux_enabled "${BOARD}"; then
+    build_sysext_opts+=(
+      --selinux
+      --forbidden_packages='sec-policy/selinux-.*;selinux policy packages must be in base image'
+    )
+  fi
+
   info "${msg}."
 
   # Pass the build ID extracted from root FS to build_sysext. This prevents common.sh
@@ -69,7 +77,6 @@ create_prod_sysext() {
             --squashfs_base="${base_sysext}" \
             --generate_pkginfo \
             --install_root_basename="${name}-base-sysext-rootfs" \
-            --forbidden_packages='sec-policy/selinux-.*;selinux policy packages must be in base image' \
             "${build_sysext_opts[@]}" \
             "${name}" "${grp_pkg[@]}"
 
diff --git a/build_library/vm_image_util.sh b/build_library/vm_image_util.sh
index 3fd855b568e..7963de7de40 100644
--- a/build_library/vm_image_util.sh
+++ b/build_library/vm_image_util.sh
@@ -5,6 +5,8 @@
 # Format options. Each variable uses the form IMG_<type>_<opt>.
 # Default values use the format IMG_DEFAULT_<opt>.
 
+. "${BUILD_LIBRARY_DIR}/pkg_util.sh" || exit 1
+
 VALID_IMG_TYPES=(
     akamai
     ami
@@ -593,6 +595,9 @@ install_oem_sysext() {
         --install_root_basename="${VM_IMG_TYPE}-oem-sysext-rootfs"
         --forbidden_packages='sec-policy/selinux-.*;selinux policy packages must be in base image' \
     )
+    if is_selinux_enabled "${BOARD}"; then
+        build_sysext_flags+=( --selinux )
+    fi
     local overlay_path mangle_fs
     overlay_path=$(portageq get_repo_path / coreos-overlay)
     mangle_fs="${overlay_path}/${metapkg}/files/manglefs.sh"

From 06c41c97c96dc3c587f202a70c7434a0ceecf06f Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 13 Nov 2025 12:54:42 +0100
Subject: [PATCH 87/92] DEBUG

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 build_library/sysext_prod_builder | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/build_library/sysext_prod_builder b/build_library/sysext_prod_builder
index 727987ae280..1aa90022803 100755
--- a/build_library/sysext_prod_builder
+++ b/build_library/sysext_prod_builder
@@ -71,6 +71,14 @@ create_prod_sysext() {
   # The --install_root_basename="${name}-base-sysext-rootfs" flag is
   # important - it sets the name of a rootfs directory, which is used
   # to determine the package target in coreos/base/profile.bashrc
+  echo sudo "FLATCAR_BUILD_ID=$FLATCAR_BUILD_ID" "${SCRIPTS_DIR}/build_sysext" \
+            --board="${BOARD}" \
+            --image_builddir="${workdir}/sysext-build" \
+            --squashfs_base="${base_sysext}" \
+            --generate_pkginfo \
+            --install_root_basename="${name}-base-sysext-rootfs" \
+            "${build_sysext_opts[@]}" \
+            "${name}" "${grp_pkg[@]}"
   sudo "FLATCAR_BUILD_ID=$FLATCAR_BUILD_ID" "${SCRIPTS_DIR}/build_sysext" \
             --board="${BOARD}" \
             --image_builddir="${workdir}/sysext-build" \

From 42917da21ea2723014e113f4120246433bef90ae Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Wed, 8 Oct 2025 12:19:38 +0200
Subject: [PATCH 88/92] build_library/extra_sysexts.sh: Sort entries

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 build_library/extra_sysexts.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build_library/extra_sysexts.sh b/build_library/extra_sysexts.sh
index 85ae7096fc3..145e1afa3ae 100644
--- a/build_library/extra_sysexts.sh
+++ b/build_library/extra_sysexts.sh
@@ -1,5 +1,4 @@
 EXTRA_SYSEXTS=(
-  "overlaybd|sys-fs/overlaybd,app-containers/accelerated-container-image"
   "incus|app-containers/incus"
   "nvidia-drivers-535|x11-drivers/nvidia-drivers:0/535|-kernel-open persistenced|amd64"
   "nvidia-drivers-535-open|x11-drivers/nvidia-drivers:0/535|kernel-open persistenced|amd64"
@@ -7,6 +6,7 @@ EXTRA_SYSEXTS=(
   "nvidia-drivers-550-open|x11-drivers/old-nvidia-drivers:0/550|kernel-open persistenced|amd64"
   "nvidia-drivers-570|x11-drivers/nvidia-drivers:0/570|-kernel-open persistenced|amd64"
   "nvidia-drivers-570-open|x11-drivers/nvidia-drivers:0/570|kernel-open persistenced|amd64"
+  "overlaybd|sys-fs/overlaybd,app-containers/accelerated-container-image"
   "podman|app-containers/podman,net-misc/passt"
   "python|dev-lang/python,dev-python/pip"
   "zfs|sys-fs/zfs"

From 76ef983a658e2e5f6fea5c8e9d450ba3adbbeb5e Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Wed, 8 Oct 2025 12:20:06 +0200
Subject: [PATCH 89/92] build_library/extra_sysexts.sh: Add selinux sysext

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 build_library/extra_sysexts.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/build_library/extra_sysexts.sh b/build_library/extra_sysexts.sh
index 145e1afa3ae..0df112610a1 100644
--- a/build_library/extra_sysexts.sh
+++ b/build_library/extra_sysexts.sh
@@ -9,6 +9,7 @@ EXTRA_SYSEXTS=(
   "overlaybd|sys-fs/overlaybd,app-containers/accelerated-container-image"
   "podman|app-containers/podman,net-misc/passt"
   "python|dev-lang/python,dev-python/pip"
+  "selinux|sys-apps/policycoreutils,app-admin/setools"
   "zfs|sys-fs/zfs"
 )
 

From 8239d4dc3fe9fafdcdfd867a565f84f5d92107dd Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Wed, 8 Oct 2025 12:20:44 +0200
Subject: [PATCH 90/92] overlay coreos/user-patches: Update refpolicy patch

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../0001-Flatcar-modifications.patch            | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/flatcar-selinux-patches/0001-Flatcar-modifications.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/flatcar-selinux-patches/0001-Flatcar-modifications.patch
index e7e3c32bd55..3c3c1e71701 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/flatcar-selinux-patches/0001-Flatcar-modifications.patch
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/flatcar-selinux-patches/0001-Flatcar-modifications.patch
@@ -1,4 +1,4 @@
-From 776730b89903c93a405dcfec2dbda27e012f99df Mon Sep 17 00:00:00 2001
+From 0bb1c5df7cc2066c59d2a15562d6e011c2faef2a Mon Sep 17 00:00:00 2001
 From: Krzesimir Nowak <knowak@microsoft.com>
 Date: Mon, 4 Dec 2023 12:17:25 +0100
 Subject: [PATCH] Flatcar modifications
@@ -11,11 +11,12 @@ Subject: [PATCH] Flatcar modifications
  policy/modules/kernel/kernel.te         | 125 +++++++++++++++++
  policy/modules/services/container.fc    |   6 +
  policy/modules/services/container.te    | 170 +++++++++++++++++++++++-
+ policy/modules/services/ssh.fc          |   1 +
  policy/modules/system/init.te           |   8 ++
  policy/modules/system/locallogin.te     |   9 +-
  policy/modules/system/logging.te        |   9 ++
  policy/modules/system/systemd.fc        |  12 ++
- 11 files changed, 439 insertions(+), 3 deletions(-)
+ 12 files changed, 440 insertions(+), 3 deletions(-)
 
 diff --git a/refpolicy/policy/modules/admin/netutils.te b/refpolicy/policy/modules/admin/netutils.te
 index 63d2f9cb8..62dff5f94 100644
@@ -513,6 +514,18 @@ index c71ae54f4..a231f7664 100644
 +# avc:  denied  { read } for  pid=[0-9]* comm="echo, sleep, whatever" path="/lib64/libc.so.6" dev="vda9" ino=[0-9]* scontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tcontext=system_u:object_r:tmp_t:s0 tclass=file permissive=0
 +#
 +allow container_t tmp_t:file { read };
+diff --git a/refpolicy/policy/modules/services/ssh.fc b/refpolicy/policy/modules/services/ssh.fc
+index 93bfa8d26..aaa2e12ac 100644
+--- a/refpolicy/policy/modules/services/ssh.fc
++++ b/refpolicy/policy/modules/services/ssh.fc
+@@ -8,6 +8,7 @@ HOME_DIR/\.ssh(/.*)?			gen_context(system_u:object_r:ssh_home_t,s0)
+ /usr/bin/ssh-keygen		--	gen_context(system_u:object_r:ssh_keygen_exec_t,s0)
+ /usr/bin/sshd			--	gen_context(system_u:object_r:sshd_exec_t,s0)
+ 
++/usr/lib/misc/sshd-auth		--	gen_context(system_u:object_r:sshd_exec_t,s0)
+ /usr/lib/misc/sshd-session	--	gen_context(system_u:object_r:sshd_exec_t,s0)
+ /usr/lib/openssh/ssh-keysign	--	gen_context(system_u:object_r:ssh_keysign_exec_t,s0)
+ /usr/lib/openssh/sshd-session	--	gen_context(system_u:object_r:sshd_exec_t,s0)
 diff --git a/refpolicy/policy/modules/system/init.te b/refpolicy/policy/modules/system/init.te
 index 1320f7aae..61ead9795 100644
 --- a/refpolicy/policy/modules/system/init.te

From 603e4df1c76a5abd3bd494245c6bd4606da2563e Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Wed, 8 Oct 2025 12:21:08 +0200
Subject: [PATCH 91/92] overlay profiles: Build only the mcs SELinux policy

Building multiple policies is pointless - changing the policy at
runtime would require relabeling the filesystem, which will not work,
because /usr is read-only.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../coreos-overlay/profiles/coreos/base/make.defaults           | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
index 69f6d2631ac..9841f7047b0 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
@@ -45,7 +45,7 @@ BOOTSTRAP_USE="${BOOTSTRAP_USE} curl_ssl_openssl ssl"
 BOOTSTRAP_USE="${BOOTSTRAP_USE} xml"
 
 # Set SELinux policy
-POLICY_TYPES="targeted mcs mls"
+POLICY_TYPES="mcs"
 
 # Disable packages or optional features with distribution issues.
 ACCEPT_RESTRICT="* -bindist"

From d73530e799519505170e2e331b2bb60c2ad69e6a Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 13 Nov 2025 13:02:38 +0100
Subject: [PATCH 92/92] overlay profiles: Move python packages as provided to
 the prod profile

We want to install some SELinux tools written in python to the selinux
sysext. Sysexts use the generic profile, so the entries for those
packages need to be moved into generic/prod profile.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
---
 .../profiles/coreos/targets/generic/package.provided          | 4 ----
 .../profiles/coreos/targets/generic/prod/package.provided     | 4 ++++
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.provided b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.provided
index 1d4e66b6d4a..3f972f10203 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.provided
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.provided
@@ -29,7 +29,3 @@ dev-lang/perl-5.40.2
 dev-libs/icu-76.1-r1
 dev-perl/Parse-Yapp-1.210.0-r1
 dev-perl/JSON-4.100.0
-
-# Pulled in by sys-apps/policycoreutils, python stuff.
-app-admin/setools-4.5.1
-sys-apps/selinux-python-3.7-r1
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.provided b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.provided
index d9bc0a067f5..eb5a1b9c13b 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.provided
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/prod/package.provided
@@ -1,3 +1,7 @@
 # Mark python as provided for selinux stuff. We have put all the
 # python stuff into install masks by now.
 dev-lang/python-3.11.12
+
+# Pulled in by sys-apps/policycoreutils, python stuff.
+app-admin/setools-4.5.1
+sys-apps/selinux-python-3.8.1