From 71630391f1db29bb83d8eb0bb362be5098ed95c1 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Sat, 31 Jan 2026 18:49:49 -0800
Subject: [PATCH 01/13] checkpolicy: 3.8.1 -> 3.10

---
 pkgs/by-name/ch/checkpolicy/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ch/checkpolicy/package.nix b/pkgs/by-name/ch/checkpolicy/package.nix
index 326c37f8fb82..b2d6a59daedf 100644
--- a/pkgs/by-name/ch/checkpolicy/package.nix
+++ b/pkgs/by-name/ch/checkpolicy/package.nix
@@ -7,14 +7,14 @@
   libsepol,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "checkpolicy";
-  version = "3.8.1";
+  version = "3.10";
   inherit (libsepol) se_url;
 
   src = fetchurl {
-    url = "${se_url}/${version}/checkpolicy-${version}.tar.gz";
-    sha256 = "sha256-e0d8UW4mk9i2xRE4YyMXfx19tRwuBOttDejKKzYSDl0=";
+    url = "${finalAttrs.se_url}/${finalAttrs.version}/checkpolicy-${finalAttrs.version}.tar.gz";
+    hash = "sha256-LZKVHfywkNYXnnojhWYi4Py8Mr4Dvx5grOncnL2hHlk=";
   };
 
   nativeBuildInputs = [
@@ -37,4 +37,4 @@ stdenv.mkDerivation rec {
       description = "SELinux policy compiler";
       mainProgram = "checkpolicy";
     };
-}
+})

From a87d2613d078d7ef26775f61ba16db921ef61903 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Sat, 31 Jan 2026 18:50:15 -0800
Subject: [PATCH 02/13] libselinux: 3.8.1 -> 3.10

---
 .../li/libselinux/fix-build-32bit-lfs.patch   | 41 -------------------
 pkgs/by-name/li/libselinux/package.nix        | 30 +-------------
 2 files changed, 2 insertions(+), 69 deletions(-)
 delete mode 100644 pkgs/by-name/li/libselinux/fix-build-32bit-lfs.patch

diff --git a/pkgs/by-name/li/libselinux/fix-build-32bit-lfs.patch b/pkgs/by-name/li/libselinux/fix-build-32bit-lfs.patch
deleted file mode 100644
index ad9e91e652c8..000000000000
--- a/pkgs/by-name/li/libselinux/fix-build-32bit-lfs.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-diff --git libselinux/include/selinux/selinux.h libselinux/include/selinux/selinux.h
-index f3cf5a209..f64896b7a 100644
---- libselinux/include/selinux/selinux.h
-+++ libselinux/include/selinux/selinux.h
-@@ -537,7 +537,7 @@ extern int matchpathcon_index(const char *path,
-    with the same inode (e.g. due to multiple hard links).  If so, then
-    use the latter of the two specifications based on their order in the 
-    file contexts configuration.  Return the used specification index. */
--#if defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS == 64 && __BITS_PER_LONG < 64
-+#if defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS == 64 && defined(__INO64_T_TYPE) && !defined(__INO_T_MATCHES_INO64_T)
- #define matchpathcon_filespec_add matchpathcon_filespec_add64
- #endif
- extern int matchpathcon_filespec_add(ino_t ino, int specind, const char *file);
-diff --git libselinux/src/matchpathcon.c libselinux/src/matchpathcon.c
-index 51f0e4ff9..ab7c3090a 100644
---- libselinux/src/matchpathcon.c
-+++ libselinux/src/matchpathcon.c
-@@ -261,7 +261,7 @@ int matchpathcon_filespec_add(ino_t ino, int specind, const char *file)
- 	return -1;
- }
- 
--#if defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS == 64 && __BITS_PER_LONG < 64
-+#if (defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS == 64) && defined(__INO64_T_TYPE) && !defined(__INO_T_MATCHES_INO64_T)
- /* alias defined in the public header but we undefine it here */
- #undef matchpathcon_filespec_add
- 
-@@ -280,9 +280,13 @@ int matchpathcon_filespec_add(unsigned long ino, int specind,
- {
- 	return matchpathcon_filespec_add64(ino, specind, file);
- }
-+#elif (defined(_FILE_OFFSET_BITS) && _FILE_OFFSET_BITS == 64) || defined(__INO_T_MATCHES_INO64_T)
-+
-+static_assert(sizeof(uint64_t) == sizeof(ino_t), "inode size mismatch");
-+
- #else
- 
--static_assert(sizeof(unsigned long) == sizeof(ino_t), "inode size mismatch");
-+static_assert(sizeof(uint32_t) == sizeof(ino_t), "inode size mismatch");
- 
- #endif
- 
diff --git a/pkgs/by-name/li/libselinux/package.nix b/pkgs/by-name/li/libselinux/package.nix
index b893700936e3..6c97b376dc75 100644
--- a/pkgs/by-name/li/libselinux/package.nix
+++ b/pkgs/by-name/li/libselinux/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  buildPackages,
   pcre2,
   pkg-config,
   libsepol,
@@ -17,7 +16,7 @@ assert enablePython -> swig != null && python3 != null;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libselinux";
-  version = "3.8.1";
+  version = "3.10";
   inherit (libsepol) se_url;
 
   outputs = [
@@ -30,39 +29,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "${finalAttrs.se_url}/${finalAttrs.version}/libselinux-${finalAttrs.version}.tar.gz";
-    hash = "sha256-7C0nifkxFS0hwdsetLwgLOTszt402b6eNg47RSQ87iw=";
+    hash = "sha256-HvIWxbVvt+ClHNKQl4ehdaF+45HgRniUgHhzU56+dms=";
   };
 
   patches = [
-    # Make it possible to disable shared builds (for pkgsStatic).
-    #
-    # We can't use fetchpatch because it processes includes/excludes
-    # /after/ stripping the prefix, which wouldn't work here because
-    # there would be no way to distinguish between
-    # e.g. libselinux/src/Makefile and libsepol/src/Makefile.
-    #
-    # This is a static email, so we shouldn't have to worry about
-    # normalizing the patch.
-    (fetchurl {
-      url = "https://lore.kernel.org/selinux/20250211211651.1297357-3-hi@alyssa.is/raw";
-      hash = "sha256-a0wTSItj5vs8GhIkfD1OPSjGmAJlK1orptSE7T3Hx20=";
-      postFetch = ''
-        mv "$out" $TMPDIR/patch
-        ${buildPackages.patchutils_0_3_3}/bin/filterdiff \
-            -i 'a/libselinux/*' --strip 1 <$TMPDIR/patch >"$out"
-      '';
-    })
-
     (fetchurl {
       url = "https://git.yoctoproject.org/meta-selinux/plain/recipes-security/selinux/libselinux/0003-libselinux-restore-drop-the-obsolete-LSF-transitiona.patch?id=62b9c816a5000dc01b28e78213bde26b58cbca9d";
       hash = "sha256-RiEUibLVzfiRU6N/J187Cs1iPAih87gCZrlyRVI2abU=";
     })
-
-    # commit 5c3fcbd931b7f9752b5ce29cec3b6813991d61c0 plus an additional
-    # fix for a musl build regression caused by that commit:
-    # https://lore.kernel.org/selinux/20250426151356.7116-2-hi@alyssa.is/
-    # Fix build on 32-bit LFS platforms
-    ./fix-build-32bit-lfs.patch
   ];
 
   nativeBuildInputs = [

From 35c4ba2c71ac11a57f339bf77777446dc0a0fa87 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Sat, 31 Jan 2026 18:50:33 -0800
Subject: [PATCH 03/13] libsemanage: 3.8.1 -> 3.10

---
 pkgs/by-name/li/libsemanage/package.nix | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/li/libsemanage/package.nix b/pkgs/by-name/li/libsemanage/package.nix
index 9b97ce3d3b3b..c0423d7ef3e5 100644
--- a/pkgs/by-name/li/libsemanage/package.nix
+++ b/pkgs/by-name/li/libsemanage/package.nix
@@ -9,19 +9,19 @@
   libselinux,
   bzip2,
   audit,
-  enablePython ? true,
+  enablePython ? !stdenv.hostPlatform.isStatic,
   swig ? null,
   python3 ? null,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libsemanage";
-  version = "3.8.1";
+  version = "3.10";
   inherit (libsepol) se_url;
 
   src = fetchurl {
-    url = "${se_url}/${version}/libsemanage-${version}.tar.gz";
-    sha256 = "sha256-ezkSeyGcxwv9k1pK9rDyuoPUs1yRbyU8fpQsI6tJDwc=";
+    url = "${finalAttrs.se_url}/${finalAttrs.version}/libsemanage-${finalAttrs.version}.tar.gz";
+    hash = "sha256-GXiJTEFHaa13Q40miG6q4/t7t0V47ypa0xMMictcsf4=";
   };
 
   outputs = [
@@ -60,6 +60,9 @@ stdenv.mkDerivation rec {
     "PYPREFIX=python"
     "PYTHONLIBDIR=$(py)/${python3.sitePackages}"
     "DEFAULT_SEMANAGE_CONF_LOCATION=$(out)/etc/selinux/semanage.conf"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isStatic [
+    "DISABLE_SHARED=y"
   ];
 
   # The following turns the 'clobbered' error into a warning
@@ -80,4 +83,4 @@ stdenv.mkDerivation rec {
     description = "Policy management tools for SELinux";
     license = lib.licenses.lgpl21;
   };
-}
+})

From 9737927dc99ffef875a25dd0fc33fa1b0bb8d664 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Sat, 31 Jan 2026 18:50:48 -0800
Subject: [PATCH 04/13] libsepol: 3.8.1 -> 3.10

---
 pkgs/by-name/li/libsepol/package.nix | 20 +++++++++-----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/li/libsepol/package.nix b/pkgs/by-name/li/libsepol/package.nix
index 2fe6be3fa195..ea4f28237f2f 100644
--- a/pkgs/by-name/li/libsepol/package.nix
+++ b/pkgs/by-name/li/libsepol/package.nix
@@ -5,9 +5,9 @@
   flex,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libsepol";
-  version = "3.8.1";
+  version = "3.10";
   se_url = "https://github.com/SELinuxProject/selinux/releases/download";
 
   outputs = [
@@ -18,15 +18,10 @@ stdenv.mkDerivation rec {
   ];
 
   src = fetchurl {
-    url = "${se_url}/${version}/libsepol-${version}.tar.gz";
-    sha256 = "sha256-DnhwUwX5VavUwGVNN6VHfuJjSat0254rA6eGiJeuHd8=";
+    url = "${finalAttrs.se_url}/${finalAttrs.version}/libsepol-${finalAttrs.version}.tar.gz";
+    hash = "sha256-1VVYZ5f6nzg0RJbSp+wRR7bKrz/MRMQtjVFz7denmnE=";
   };
 
-  postPatch = lib.optionalString stdenv.hostPlatform.isStatic ''
-    substituteInPlace src/Makefile --replace 'all: $(LIBA) $(LIBSO)' 'all: $(LIBA)'
-    sed -i $'/^\t.*LIBSO/d' src/Makefile
-  '';
-
   nativeBuildInputs = [ flex ];
 
   makeFlags = [
@@ -37,13 +32,16 @@ stdenv.mkDerivation rec {
     "MAN3DIR=$(man)/share/man/man3"
     "MAN8DIR=$(man)/share/man/man8"
     "SHLIBDIR=$(out)/lib"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isStatic [
+    "DISABLE_SHARED=y"
   ];
 
   env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   enableParallelBuilding = true;
 
-  passthru = { inherit se_url; };
+  passthru = { inherit (finalAttrs) se_url; };
 
   meta = {
     description = "SELinux binary policy manipulation library";
@@ -56,4 +54,4 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl2Plus;
     pkgConfigModules = [ "libselinux" ];
   };
-}
+})

From 4036e50ebd9eb79b2cb6fc66bc810c196ff1e6b6 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Sat, 31 Jan 2026 18:51:23 -0800
Subject: [PATCH 05/13] policycoreutils: 3.8.1 -> 3.10

---
 pkgs/by-name/po/policycoreutils/package.nix | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/po/policycoreutils/package.nix b/pkgs/by-name/po/policycoreutils/package.nix
index e07df8b6c2c6..41b9919dcafd 100644
--- a/pkgs/by-name/po/policycoreutils/package.nix
+++ b/pkgs/by-name/po/policycoreutils/package.nix
@@ -7,16 +7,17 @@
   libselinux,
   libsemanage,
   libxcrypt,
+  pkg-config,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "policycoreutils";
-  version = "3.8.1";
+  version = "3.10";
   inherit (libsepol) se_url;
 
   src = fetchurl {
-    url = "${se_url}/${version}/policycoreutils-${version}.tar.gz";
-    hash = "sha256-7vIxlrUB0UHLlfX8Uu8acon0WbZeRBXqD+mu7cXYDvI=";
+    url = "${finalAttrs.se_url}/${finalAttrs.version}/policycoreutils-${finalAttrs.version}.tar.gz";
+    hash = "sha256-jb1Q2Gisv66dGpcva7slh/BsnsczCNEa9qyzpAHemDI=";
   };
 
   postPatch = ''
@@ -26,7 +27,10 @@ stdenv.mkDerivation rec {
     substituteInPlace newrole/Makefile --replace /usr/share /share
   '';
 
-  nativeBuildInputs = [ gettext ];
+  nativeBuildInputs = [
+    gettext
+    pkg-config
+  ];
   buildInputs = [
     libsepol
     libselinux
@@ -48,4 +52,4 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl2Only;
     inherit (libsepol.meta) homepage platforms maintainers;
   };
-}
+})

From 1d60a0069238fc3b7bdd1a946a464eb0fb3b7dc2 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Sat, 31 Jan 2026 18:51:42 -0800
Subject: [PATCH 06/13] selinux-python: 3.8.1 -> 3.10

---
 pkgs/by-name/se/selinux-python/package.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/se/selinux-python/package.nix b/pkgs/by-name/se/selinux-python/package.nix
index a792b7136e5b..786796d3a2fc 100644
--- a/pkgs/by-name/se/selinux-python/package.nix
+++ b/pkgs/by-name/se/selinux-python/package.nix
@@ -20,13 +20,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "selinux-python";
-  version = "3.8.1";
+  version = "3.10";
 
   inherit (libsepol) se_url;
 
   src = fetchurl {
     url = "${finalAttrs.se_url}/${finalAttrs.version}/selinux-python-${finalAttrs.version}.tar.gz";
-    hash = "sha256-dJAlv6SqDgCb8//EVdVloY1Ntxz+eWvkQFghcXIGwlo=";
+    hash = "sha256-nQpbafL7zOjlzNjg8X1W9x5gBadWOG+Ps2wx+UJBkaI=";
   };
 
   strictDeps = true;
@@ -82,6 +82,8 @@ stdenv.mkDerivation (finalAttrs: {
   doInstallCheck = true;
 
   installCheckPhase = ''
+    runHook preInstallCheck
+
     # Version hasn't changed in 17 years, if it suddenly does these tests deserve to break
     $out/bin/audit2allow --version | grep -Fm1 'audit2allow .1'
     $out/bin/audit2why --version | grep -Fm1 'audit2allow .1'
@@ -96,6 +98,8 @@ stdenv.mkDerivation (finalAttrs: {
 
     # Should at least run, even if we can't provide it a policy file and need to provide /dev/zero
     { $out/bin/sepolgen-ifgen-attr-helper test /dev/null 2>&1 || true; } | grep -Fm1 'error(s) encountered' >/dev/null
+
+    runHook postInstallCheck
   '';
 
   meta = {

From f1de0b56f4feb1a25dd97b817a63e26f8e2e47e5 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Sat, 31 Jan 2026 18:52:20 -0800
Subject: [PATCH 07/13] semodule-utils: 3.8.1 -> 3.10

---
 pkgs/by-name/se/semodule-utils/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/se/semodule-utils/package.nix b/pkgs/by-name/se/semodule-utils/package.nix
index 7b07203947ab..c4a98cd173d6 100644
--- a/pkgs/by-name/se/semodule-utils/package.nix
+++ b/pkgs/by-name/se/semodule-utils/package.nix
@@ -5,15 +5,15 @@
   libsepol,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "semodule-utils";
-  version = "3.8.1";
+  version = "3.10";
 
   inherit (libsepol) se_url;
 
   src = fetchurl {
-    url = "${se_url}/${version}/semodule-utils-${version}.tar.gz";
-    sha256 = "sha256-dwWw2wWcU6IdanfAtQ9sRn2RoOqS/4dfHJNSfNJ2I5U=";
+    url = "${finalAttrs.se_url}/${finalAttrs.version}/semodule-utils-${finalAttrs.version}.tar.gz";
+    hash = "sha256-HC8UzAmMu011kS0THF90fnAkbhBC5y8qtA4o9Tz0XBA=";
   };
 
   buildInputs = [ libsepol ];
@@ -29,4 +29,4 @@ stdenv.mkDerivation rec {
     inherit (libsepol.meta) homepage platforms;
     maintainers = with lib.maintainers; [ RossComputerGuy ];
   };
-}
+})

From 54b05ded6e3d2e98f4e72a06ab2c307f28a36eb7 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Sat, 31 Jan 2026 18:53:17 -0800
Subject: [PATCH 08/13] selinux-sandbox: 3.3 -> 3.10

---
 pkgs/by-name/se/selinux-sandbox/package.nix | 72 +++++++++++++--------
 1 file changed, 46 insertions(+), 26 deletions(-)

diff --git a/pkgs/by-name/se/selinux-sandbox/package.nix b/pkgs/by-name/se/selinux-sandbox/package.nix
index b4c624e5f26b..962bb3f59f36 100644
--- a/pkgs/by-name/se/selinux-sandbox/package.nix
+++ b/pkgs/by-name/se/selinux-sandbox/package.nix
@@ -2,34 +2,37 @@
   lib,
   stdenv,
   fetchurl,
+  gettext,
   bash,
   coreutils,
   python3,
+  python3Packages,
   libcap_ng,
   policycoreutils,
   selinux-python,
   dbus,
   xorg-server,
+  xwayland,
   openbox,
   xmodmap,
   libselinux,
+  setools,
 }:
 
-# this is python3 only as it depends on selinux-python
-
-with python3.pkgs;
-
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "selinux-sandbox";
-  version = "3.3";
+  version = "3.10";
   inherit (policycoreutils) se_url;
 
   src = fetchurl {
-    url = "${se_url}/${version}/selinux-sandbox-${version}.tar.gz";
-    sha256 = "0rw8pxfqhl6ww4w31fbf4hi3zilh1n3b1rfjm7ra76mm78wfyylj";
+    url = "${finalAttrs.se_url}/${finalAttrs.version}/selinux-sandbox-${finalAttrs.version}.tar.gz";
+    hash = "sha256-4r0T4YT3IYFVoz6pQygdAvRBwpcQQBW+69/G2Npv9cM=";
   };
 
-  nativeBuildInputs = [ wrapPython ];
+  nativeBuildInputs = [
+    gettext
+    python3Packages.wrapPython
+  ];
   buildInputs = [
     bash
     coreutils
@@ -43,29 +46,36 @@ stdenv.mkDerivation rec {
     libselinux
   ];
   propagatedBuildInputs = [
-    pygobject3
+    python3Packages.pygobject3
     selinux-python
   ];
+  pythonPath = [
+    python3Packages.libselinux
+    setools
+  ];
 
   postPatch = ''
     # Fix setuid install
-    substituteInPlace Makefile --replace "-m 4755" "-m 755"
+    substituteInPlace Makefile --replace-fail "-m 4755" "-m 755"
+    substituteInPlace po/Makefile --replace-fail /usr/bin/install install
     substituteInPlace sandboxX.sh \
-      --replace "#!/bin/sh" "#!${bash}/bin/sh" \
-      --replace "/usr/share/sandbox/start" "${placeholder "out"}/share/sandbox/start" \
-      --replace "/usr/bin/cut" "${coreutils}/bin/cut" \
-      --replace "/usr/bin/Xephyr" "${xorg-server}/bin/Xepyhr" \
-      --replace "secon" "${policycoreutils}/bin/secon"
+      --replace-fail "#!/bin/bash" "#!${bash}/bin/bash" \
+      --replace-fail "/usr/share/sandbox/start" "${placeholder "out"}/share/sandbox/start" \
+      --replace-fail "/usr/bin/cut" "${coreutils}/bin/cut" \
+      --replace-fail "/usr/bin/Xephyr" "${xorg-server}/bin/Xepyhr" \
+      --replace-fail "/usr/bin/Xwayland" "${xwayland}/bin/Xwayland" \
+      --replace-fail "secon" "${policycoreutils}/bin/secon"
     substituteInPlace sandbox \
-      --replace "/usr/sbin/seunshare" "$out/bin/seunshare" \
-      --replace "/usr/share/sandbox" "$out/share/sandbox" \
-      --replace "/usr/share/locale" "${policycoreutils}/share/locale" \
-      --replace "/usr/bin/openbox" "${openbox}/bin/openbox" \
-      --replace "#!/bin/sh" "#!${bash}/bin/sh" \
-      --replace "dbus-" "${dbus}/bin/dbus-" \
-      --replace "/usr/bin/xmodmap" "${xmodmap}/bin/xmodmap" \
-      --replace "/usr/bin/shred" "${coreutils}/bin/shred" \
-      --replace "/usr/bin/test" "${coreutils}/bin/test" \
+      --replace-fail "/usr/sbin/seunshare" "$out/bin/seunshare" \
+      --replace-fail "/usr/share/sandbox" "$out/share/sandbox" \
+      --replace-fail "/usr/share/locale" "${policycoreutils}/share/locale" \
+      --replace-fail "/usr/bin/openbox" "${openbox}/bin/openbox" \
+      --replace-fail "#!/bin/sh" "#!${bash}/bin/sh" \
+      --replace-fail "dbus-" "${dbus}/bin/dbus-" \
+      --replace-fail "/usr/bin/xmodmap" "${xmodmap}/bin/xmodmap" \
+      --replace-fail "/usr/bin/shred" "${coreutils}/bin/shred" \
+      --replace-fail "/usr/bin/test" "${coreutils}/bin/test"
+    patchShebangs --host sandboxX.sh sandbox start sandbox.init
   '';
 
   makeFlags = [
@@ -77,11 +87,21 @@ stdenv.mkDerivation rec {
     wrapPythonPrograms
   '';
 
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+    # "sandbox: Requires a SELinux enabled system" or help, which includes sandbox
+    { $out/bin/sandbox --help || true; } 2>&1 | grep -Fm1 'sandbox'
+    runHook postInstallCheck
+  '';
+
   meta = {
+    mainProgram = "sandbox";
     description = "SELinux sandbox utility";
     license = lib.licenses.gpl2Only;
     homepage = "https://selinuxproject.org";
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ RossComputerGuy ];
   };
-}
+})

From 58beeecb06655749fb9003edfac388f4ce4a6fcf Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Thu, 5 Feb 2026 13:26:44 -0800
Subject: [PATCH 09/13] setools: use finalAttrs

---
 pkgs/by-name/se/setools/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/se/setools/package.nix b/pkgs/by-name/se/setools/package.nix
index 0d769f3882b5..8fa713e48bca 100644
--- a/pkgs/by-name/se/setools/package.nix
+++ b/pkgs/by-name/se/setools/package.nix
@@ -8,7 +8,7 @@
   withGraphics ? false,
 }:
 
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "setools";
   version = "4.6.0";
   pyproject = true;
@@ -16,7 +16,7 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "SELinuxProject";
     repo = "setools";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-UZisEbHx3zO92gmRQSYsI8TmY9MjCP7AWNAESYklAkk=";
   };
 
@@ -60,7 +60,7 @@ python3Packages.buildPythonApplication rec {
   meta = {
     description = "SELinux Policy Analysis Tools";
     homepage = "https://github.com/SELinuxProject/setools";
-    changelog = "https://github.com/SELinuxProject/setools/blob/${version}/ChangeLog";
+    changelog = "https://github.com/SELinuxProject/setools/blob/${finalAttrs.version}/ChangeLog";
     license = with lib.licenses; [
       gpl2Only
       lgpl21Plus
@@ -68,4 +68,4 @@ python3Packages.buildPythonApplication rec {
     maintainers = [ ];
     platforms = lib.platforms.linux;
   };
-}
+})

From ee4924dc4aa79a28408e780ef2ac7a07aab06e86 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Sat, 31 Jan 2026 18:52:48 -0800
Subject: [PATCH 10/13] selinux-refpolicy: 2.20250213 -> 2.20250923

---
 pkgs/by-name/se/selinux-refpolicy/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/se/selinux-refpolicy/package.nix b/pkgs/by-name/se/selinux-refpolicy/package.nix
index 803f0ab75f1f..4eba28263afc 100644
--- a/pkgs/by-name/se/selinux-refpolicy/package.nix
+++ b/pkgs/by-name/se/selinux-refpolicy/package.nix
@@ -13,13 +13,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "selinux-refpolicy";
-  version = "2.20250213";
+  version = "2.20250923";
 
   src = fetchFromGitHub {
     owner = "SELinuxProject";
     repo = "refpolicy";
     tag = "RELEASE_${lib.versions.major finalAttrs.version}_${lib.versions.minor finalAttrs.version}";
-    hash = "sha256-VsQRqigGwSVJ52uqFj1L2xzQqbWwQ/YaFI5Rsn/HbP8=";
+    hash = "sha256-A7bC/44Swt1pe9qAubrOIVEJpsXeCkJUaftLHqq3EmM=";
   };
 
   nativeBuildInputs = [

From b326d093da322ff6d48f52c5444b4608bf558b31 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Wed, 4 Feb 2026 00:11:27 -0800
Subject: [PATCH 11/13] libselinux: fix cross with Python

---
 pkgs/by-name/li/libselinux/package.nix | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/li/libselinux/package.nix b/pkgs/by-name/li/libselinux/package.nix
index 6c97b376dc75..ec5541dfd304 100644
--- a/pkgs/by-name/li/libselinux/package.nix
+++ b/pkgs/by-name/li/libselinux/package.nix
@@ -12,7 +12,7 @@
   fts,
 }:
 
-assert enablePython -> swig != null && python3 != null;
+assert enablePython -> swig != null && python3 != null && !stdenv.hostPlatform.isStatic;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libselinux";
@@ -103,6 +103,19 @@ stdenv.mkDerivation (finalAttrs: {
   preFixup = lib.optionalString enablePython ''
     mv $out/${python3.sitePackages}/selinux/* $py/${python3.sitePackages}/selinux/
     rm -rf $out/lib/python*
+
+    # We need to fix this symlink so it's named correctly for cross compiles.
+    # e.g. the Makefile would put _selinux.cpython-313-x86_64-linux-gnu.so -> selinux/_selinux.cpython-313-x86_64-linux-gnu.so
+    # here on a cross compile for aarch64, but put the aarch64 file in the selinux directory
+    pushd .
+    cd $py/${python3.sitePackages}
+    [ -f "$(ls selinux/_selinux.*${stdenv.hostPlatform.extensions.sharedLibrary})" ] || {
+      echo "selinux shared library not found!" >&2
+      exit 1
+    }
+    rm -vf _selinux.*${stdenv.hostPlatform.extensions.sharedLibrary}
+    ln -vsf selinux/_selinux.*${stdenv.hostPlatform.extensions.sharedLibrary}
+    popd
   '';
 
   meta = removeAttrs libsepol.meta [ "outputsToInstall" ] // {

From 4c791d4c5ab96912d3034d3867e2f47a7788e026 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Sat, 31 Jan 2026 20:52:20 -0800
Subject: [PATCH 12/13] selinuxPackages: init

Collect all the SELinux packages from around nixpkgs into one package
set. This will ensure that we don't miss them for updates.
---
 pkgs/os-specific/linux/selinux/default.nix | 14 ++++++++++++++
 pkgs/top-level/all-packages.nix            |  2 ++
 2 files changed, 16 insertions(+)
 create mode 100644 pkgs/os-specific/linux/selinux/default.nix

diff --git a/pkgs/os-specific/linux/selinux/default.nix b/pkgs/os-specific/linux/selinux/default.nix
new file mode 100644
index 000000000000..2a539affbd35
--- /dev/null
+++ b/pkgs/os-specific/linux/selinux/default.nix
@@ -0,0 +1,14 @@
+{
+  checkpolicy,
+  libselinux,
+  libsemanage,
+  libsepol,
+  policycoreutils,
+  selinux-python,
+  selinux-refpolicy,
+  selinux-sandbox,
+  semodule-utils,
+  setools,
+}@packages:
+
+packages
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4518afadbda5..3aef73bb1576 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12855,6 +12855,8 @@ with pkgs;
 
   sane-frontends = callPackage ../applications/graphics/sane/frontends.nix { };
 
+  selinuxPackages = recurseIntoAttrs (callPackage ../os-specific/linux/selinux { });
+
   snscrape = with python3Packages; toPythonApplication snscrape;
 
   sourceAndTags = callPackage ../misc/source-and-tags {

From f9a2e0161171a0f20e99bf241350217073551c47 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Sat, 31 Jan 2026 18:57:15 -0800
Subject: [PATCH 13/13] selinux (all): unify maintainers

libsepol is the primary package for changing SELinux maintainers.
Move everything there.
---
 pkgs/by-name/li/libsepol/package.nix          | 1 +
 pkgs/by-name/se/selinux-python/package.nix    | 5 +----
 pkgs/by-name/se/selinux-refpolicy/package.nix | 2 +-
 pkgs/by-name/se/selinux-sandbox/package.nix   | 2 +-
 pkgs/by-name/se/semodule-utils/package.nix    | 3 +--
 pkgs/by-name/se/setools/package.nix           | 2 +-
 6 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/li/libsepol/package.nix b/pkgs/by-name/li/libsepol/package.nix
index ea4f28237f2f..9e06808644cf 100644
--- a/pkgs/by-name/li/libsepol/package.nix
+++ b/pkgs/by-name/li/libsepol/package.nix
@@ -47,6 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "SELinux binary policy manipulation library";
     homepage = "http://userspace.selinuxproject.org";
     platforms = lib.platforms.linux;
+    # Note: changing maintainers here changes maintainers for all SELinux-related libraries
     maintainers = with lib.maintainers; [
       RossComputerGuy
       numinit
diff --git a/pkgs/by-name/se/selinux-python/package.nix b/pkgs/by-name/se/selinux-python/package.nix
index 786796d3a2fc..168c10ad62a4 100644
--- a/pkgs/by-name/se/selinux-python/package.nix
+++ b/pkgs/by-name/se/selinux-python/package.nix
@@ -106,10 +106,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "SELinux policy core utilities written in Python";
     license = lib.licenses.gpl2Plus;
     homepage = "https://selinuxproject.org";
-    maintainers = with lib.maintainers; [
-      RossComputerGuy
-      numinit
-    ];
+    inherit (libsepol.meta) maintainers;
     platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/se/selinux-refpolicy/package.nix b/pkgs/by-name/se/selinux-refpolicy/package.nix
index 4eba28263afc..e57d9a84d808 100644
--- a/pkgs/by-name/se/selinux-refpolicy/package.nix
+++ b/pkgs/by-name/se/selinux-refpolicy/package.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "SELinux Reference Policy v2";
     homepage = "http://userspace.selinuxproject.org";
     platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ RossComputerGuy ];
+    inherit (semodule-utils.meta) maintainers;
     license = lib.licenses.gpl2Only;
   };
 })
diff --git a/pkgs/by-name/se/selinux-sandbox/package.nix b/pkgs/by-name/se/selinux-sandbox/package.nix
index 962bb3f59f36..060fb77ad612 100644
--- a/pkgs/by-name/se/selinux-sandbox/package.nix
+++ b/pkgs/by-name/se/selinux-sandbox/package.nix
@@ -102,6 +102,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl2Only;
     homepage = "https://selinuxproject.org";
     platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ RossComputerGuy ];
+    inherit (selinux-python.meta) maintainers;
   };
 })
diff --git a/pkgs/by-name/se/semodule-utils/package.nix b/pkgs/by-name/se/semodule-utils/package.nix
index c4a98cd173d6..e8364954b4d1 100644
--- a/pkgs/by-name/se/semodule-utils/package.nix
+++ b/pkgs/by-name/se/semodule-utils/package.nix
@@ -26,7 +26,6 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "SELinux policy core utilities (packaging additions)";
     license = lib.licenses.gpl2Only;
-    inherit (libsepol.meta) homepage platforms;
-    maintainers = with lib.maintainers; [ RossComputerGuy ];
+    inherit (libsepol.meta) homepage platforms maintainers;
   };
 })
diff --git a/pkgs/by-name/se/setools/package.nix b/pkgs/by-name/se/setools/package.nix
index 8fa713e48bca..2d73f3bc566f 100644
--- a/pkgs/by-name/se/setools/package.nix
+++ b/pkgs/by-name/se/setools/package.nix
@@ -65,7 +65,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
       gpl2Only
       lgpl21Plus
     ];
-    maintainers = [ ];
+    inherit (libsepol.meta) maintainers;
     platforms = lib.platforms.linux;
   };
 })