Re: [PATCH] 2026-04-07-selinux-policy-eapi-8: add news item

Sam James <[email protected]> Wed, 08 Apr 2026 01:29:45 +0100
Newsgroups	gmane.linux.gentoo.devel
Organization	Gentoo
Message-ID	<[email protected]>
Rahul Sandhu <[email protected]> writes:

> Signed-off-by: Rahul Sandhu <[email protected]>
> ---
>  .../2026-04-07-selinux-policy-eapi-8.en.txt   | 107 ++++++++++++++++++
>  1 file changed, 107 insertions(+)
>  create mode 100644 2026-04-07-selinux-policy-eapi-8/2026-04-07-selinux-policy-eapi-8.en.txt
>
> diff --git a/2026-04-07-selinux-policy-eapi-8/2026-04-07-selinux-policy-eapi-8.en.txt b/2026-04-07-selinux-policy-eapi-8/2026-04-07-selinux-policy-eapi-8.en.txt
> new file mode 100644
> index 0000000..b39647d
> --- /dev/null
> +++ b/2026-04-07-selinux-policy-eapi-8/2026-04-07-selinux-policy-eapi-8.en.txt
> @@ -0,0 +1,107 @@
> +Title: SELinux Policy EAPI 8 Migration
> +Author: Rahul Sandhu <[email protected]>
> +Posted: 2026-04-07
> +Revision: 1
> +News-Item-Format: 2.0
> +Display-If-Installed: sec-policy/selinux-base
> +Display-If-Profile: default/linux/amd64/17.0/hardened/selinux
> +Display-If-Profile: default/linux/amd64/17.0/musl/hardened/selinux
> +Display-If-Profile: default/linux/amd64/17.0/no-multilib/hardened/selinux
> +Display-If-Profile: default/linux/amd64/17.0/selinux
> +Display-If-Profile: default/linux/amd64/17.1/hardened/selinux
> +Display-If-Profile: default/linux/amd64/17.1/no-multilib/hardened/selinux
> +Display-If-Profile: default/linux/amd64/17.1/no-multilib/systemd/selinux
> +Display-If-Profile: default/linux/amd64/17.1/selinux
> +Display-If-Profile: default/linux/amd64/17.1/systemd/selinux
> +Display-If-Profile: default/linux/amd64/23.0/hardened/selinux
> +Display-If-Profile: default/linux/amd64/23.0/musl/hardened/selinux
> +Display-If-Profile: default/linux/amd64/23.0/no-multilib/hardened/selinux
> +Display-If-Profile: default/linux/amd64/23.0/split-usr/hardened/selinux
> +Display-If-Profile: default/linux/amd64/23.0/split-usr/musl/hardened/selinux
> +Display-If-Profile: default/linux/amd64/23.0/split-usr/no-multilib/hardened/selinux
> +Display-If-Profile: default/linux/amd64/23.0/split-usr/no-multilib/selinux
> +Display-If-Profile: default/linux/arm/17.0/armv4t/selinux
> +Display-If-Profile: default/linux/arm/17.0/armv5te/selinux
> +Display-If-Profile: default/linux/arm/17.0/armv6j/hardened/selinux
> +Display-If-Profile: default/linux/arm/17.0/armv6j/selinux
> +Display-If-Profile: default/linux/arm/17.0/armv7a/hardened/selinux
> +Display-If-Profile: default/linux/arm/17.0/armv7a/selinux
> +Display-If-Profile: default/linux/arm/17.0/musl/armv6j/hardened/selinux
> +Display-If-Profile: default/linux/arm/17.0/musl/armv7a/hardened/selinux
> +Display-If-Profile: default/linux/arm/23.0/armv4t/selinux
> +Display-If-Profile: default/linux/arm/23.0/armv5te/selinux
> +Display-If-Profile: default/linux/arm/23.0/armv6j_hf/hardened/selinux
> +Display-If-Profile: default/linux/arm/23.0/armv6j_hf/musl/hardened/selinux
> +Display-If-Profile: default/linux/arm/23.0/armv6j_sf/hardened/selinux
> +Display-If-Profile: default/linux/arm/23.0/armv7a_hf/hardened/selinux
> +Display-If-Profile: default/linux/arm/23.0/armv7a_hf/musl/hardened/selinux
> +Display-If-Profile: default/linux/arm/23.0/armv7a_sf/hardened/selinux
> +Display-If-Profile: default/linux/arm/23.0/split-usr/armv4t/selinux
> +Display-If-Profile: default/linux/arm/23.0/split-usr/armv5te/selinux
> +Display-If-Profile: default/linux/arm/23.0/split-usr/armv6j_hf/hardened/selinux
> +Display-If-Profile: default/linux/arm/23.0/split-usr/armv6j_hf/musl/hardened/selinux
> +Display-If-Profile: default/linux/arm/23.0/split-usr/armv6j_sf/hardened/selinux
> +Display-If-Profile: default/linux/arm/23.0/split-usr/armv6j_sf/selinux
> +Display-If-Profile: default/linux/arm/23.0/split-usr/armv7a_hf/hardened/selinux
> +Display-If-Profile: default/linux/arm/23.0/split-usr/armv7a_hf/musl/hardened/selinux
> +Display-If-Profile: default/linux/arm/23.0/split-usr/armv7a_sf/hardened/selinux
> +Display-If-Profile: default/linux/arm/23.0/time64/armv5te/selinux
> +Display-If-Profile: default/linux/arm/23.0/time64/armv6j_hf/hardened/selinux
> +Display-If-Profile: default/linux/arm/23.0/time64/armv6j_sf/hardened/selinux
> +Display-If-Profile: default/linux/arm/23.0/time64/armv7a_hf/hardened/selinux
> +Display-If-Profile: default/linux/arm/23.0/time64/armv7a_sf/hardened/selinux
> +Display-If-Profile: default/linux/arm/23.0/time64/split-usr/armv5te/selinux
> +Display-If-Profile: default/linux/arm/23.0/time64/split-usr/armv6j_hf/hardened/selinux
> +Display-If-Profile: default/linux/arm/23.0/time64/split-usr/armv6j_sf/hardened/selinux
> +Display-If-Profile: default/linux/arm/23.0/time64/split-usr/armv6j_sf/selinux
> +Display-If-Profile: default/linux/arm/23.0/time64/split-usr/armv7a_hf/hardened/selinux
> +Display-If-Profile: default/linux/arm/23.0/time64/split-usr/armv7a_sf/hardened/selinux
> +Display-If-Profile: default/linux/arm64/17.0/hardened/selinux
> +Display-If-Profile: default/linux/arm64/17.0/musl/hardened/selinux
> +Display-If-Profile: default/linux/arm64/17.0/selinux
> +Display-If-Profile: default/linux/arm64/17.0/systemd/selinux
> +Display-If-Profile: default/linux/arm64/23.0/hardened/selinux
> +Display-If-Profile: default/linux/arm64/23.0/musl/hardened/selinux
> +Display-If-Profile: default/linux/arm64/23.0/split-usr/hardened/selinux
> +Display-If-Profile: default/linux/arm64/23.0/split-usr/musl/hardened/selinux
> +Display-If-Profile: default/linux/x86/17.0/hardened/selinux
> +Display-If-Profile: default/linux/x86/17.0/musl/selinux
> +Display-If-Profile: default/linux/x86/17.0/selinux
> +Display-If-Profile: default/linux/x86/23.0/i486/hardened/selinux
> +Display-If-Profile: default/linux/x86/23.0/i486/musl/selinux
> +Display-If-Profile: default/linux/x86/23.0/i486/split-usr/hardened/selinux
> +Display-If-Profile: default/linux/x86/23.0/i486/split-usr/musl/selinux
> +Display-If-Profile: default/linux/x86/23.0/i486/time64/hardened/selinux
> +Display-If-Profile: default/linux/x86/23.0/i486/time64/split-usr/hardened/selinux
> +Display-If-Profile: default/linux/x86/23.0/i686/hardened/selinux
> +Display-If-Profile: default/linux/x86/23.0/i686/musl/selinux
> +Display-If-Profile: default/linux/x86/23.0/i686/split-usr/hardened/selinux
> +Display-If-Profile: default/linux/x86/23.0/i686/split-usr/musl/selinux
> +Display-If-Profile: default/linux/x86/23.0/i686/time64/hardened/selinux
> +Display-If-Profile: default/linux/x86/23.0/i686/time64/split-usr/hardened/selinux
> +
> +What Changed
> +============
> +
> +The SELinux policy and associated packages have all been bumped to
> EAPI 8.

"... have all been modernised to use a standard way of expressing
dependencies which fixes several bugs."

> +
> +POLICY_TYPES has become the USE expand SELINUX_POLICY_TYPES. As such,
> it may be


POLICY_TYPES, which used to be an environment variable, is now a
USE_EXPAND named SELINUX_POLICY_TYPES.

> +set in package.use now, like any other USE expand. However, it is recommended
> +to keep POLICY_TYPES both set, if done so previously, and in sync with the USE
> +expand set for sec-policy/selinux-base.

> +
> +User Action Required
> +====================
> +
> +Some user intervention may be needed due to changes in selinux-policy-2 eclass
> +variable names.
> +
> +If POLICY_TYPES is set, the SELINUX_POLICY_TYPES USE expand should be set to
> +match POLICY_TYPES' contents.

Say what the default is, say how users can verify they do or don't need
to do anything.

> +
> +Future Changes
> +==============
> +
> +EAPI 7 policy packages will continue to work in the short term whilst the final
> +touches for the migration take place. However, overlays should look to migrate
> +to EAPI 8 as soon as possible.

IMO the EAPI 7 discussion isn't relevant to this. People following the
ML will pick up on that anyway. Users shouldn't need to worry about what
an EAPI is.
signature.asc (application/pgp-signature, 418 B)