selinux: also try the netlink-based fallback and continue on permission error

Fedora Rawhide still has the old policy, so selinux prevents our selinux code
from checking if selinux is enabled. But it seems smart to fall back to the old
API anyway.

Follow-up for fd5e402fa9.

Both the reference policy [1] and Fedora selinux policy [2] needed to be
updated, so it's likely that this will impact other distros too.

[1] https://github.com/SELinuxProject/refpolicy/pull/308
[2] https://github.com/fedora-selinux/selinux-policy/pull/464

hwdb.d/60-autosuspend.hwdb

@@ -5,8 +5,8 @@
 # Match string formats:
 # <subsystem>:<modalias>
 #
-# pci:v<vendor>d<device>:
+# pci:v<vendor>d<device>
-# usb:v<vendor>p<product>:
+# usb:v<vendor>p<product>
 #
 # To add local entries, create a new file
 #   /etc/udev/hwdb.d/61-autosuspend-local.hwdb
@@ -24,8 +24,6 @@
 #
 # Allowed properties are:
 #    ID_AUTOSUSPEND=1
-#
-# All matches should end in ':*' to allow future expansions of the match key.
 
 # Sort by brand, model
 
@@ -34,7 +32,7 @@
 #########################################
 
 # AU9540 Smartcard Reader
-usb:v058Fp9540:*
+usb:v058Fp9540*
  ID_AUTOSUSPEND=1
 
 #########################################
@@ -42,9 +40,9 @@ usb:v058Fp9540:*
 #########################################
 
 # X1C8 Touchscreen
-usb:v04F3p2B7C:*
+usb:v04F3p2B7C*
 # T14 Gen 1 Touchscreen
-usb:v04F3p2ACC:*
+usb:v04F3p2ACC*
  ID_AUTOSUSPEND=1
 
 #########################################
@@ -52,14 +50,14 @@ usb:v04F3p2ACC:*
 #########################################
 
 # Emulated USB HID devices
-usb:v0627p0001:*QEMU USB Keyboard*:*
+usb:v0627p0001:*QEMU USB Keyboard*
-usb:v0627p0001:*QEMU USB Mouse*:*
+usb:v0627p0001:*QEMU USB Mouse*
-usb:v0627p0001:*QEMU USB Tablet*:*
+usb:v0627p0001:*QEMU USB Tablet*
  ID_AUTOSUSPEND=1
 
 #########################################
 # Wacom
 #########################################
 
-usb:v056Ap51A0:*
+usb:v056Ap51A0*
  ID_AUTOSUSPEND=1

hwdb.d/60-evdev.hwdb

@@ -35,8 +35,6 @@
 # the struct input_absinfo as listed in linux/input.h. If a field is missing
 # the field will be left as-is. Not all fields need to be present. e.g. ::45
 # sets the resolution to 45 units/mm.
-#
-# All matches should end in ':*' to allow future expansions of the match key.
 
 # Sort by brand, model
 
@@ -45,9 +43,9 @@
 #########################################
 
 # Hyperpen 12000U
-evdev:input:b0003v08CAp0010:*
+evdev:input:b0003v08CAp0010*
 # Hyperpen 6000U
-evdev:input:b0003v08CAp0020:*
+evdev:input:b0003v08CAp0020*
  EVDEV_ABS_00=::20
  EVDEV_ABS_01=::20
 
@@ -56,48 +54,48 @@ evdev:input:b0003v08CAp0020:*
 #########################################
 
 # Macbook2,1 (late 2006), single-button touchpad
-evdev:input:b0003v05ACp021B:*
+evdev:input:b0003v05ACp021B*
 # Macbook4,1
-evdev:input:b0003v05ACp0229:*
+evdev:input:b0003v05ACp0229*
-evdev:input:b0003v05ACp022A:*
+evdev:input:b0003v05ACp022A*
  EVDEV_ABS_00=256:1471:12
  EVDEV_ABS_01=256:831:12
 
 # Macbook5,1 (unibody), aka wellspring3
-evdev:input:b0003v05ACp0236:*
+evdev:input:b0003v05ACp0236*
-evdev:input:b0003v05ACp0237:*
+evdev:input:b0003v05ACp0237*
-evdev:input:b0003v05ACp0238:*
+evdev:input:b0003v05ACp0238*
  EVDEV_ABS_00=::92
  EVDEV_ABS_01=::90
  EVDEV_ABS_35=::92
  EVDEV_ABS_36=::90
 
 # Macbook8 (unibody, March 2011)
-evdev:input:b0003v05ACp0245:*
+evdev:input:b0003v05ACp0245*
-evdev:input:b0003v05ACp0246:*
+evdev:input:b0003v05ACp0246*
-evdev:input:b0003v05ACp0247:*
+evdev:input:b0003v05ACp0247*
  EVDEV_ABS_00=::92
  EVDEV_ABS_01=::91
  EVDEV_ABS_35=::92
  EVDEV_ABS_36=::91
 
 # Macbook8,2 (unibody)
-evdev:input:b0003v05ACp0252:*
+evdev:input:b0003v05ACp0252*
-evdev:input:b0003v05ACp0253:*
+evdev:input:b0003v05ACp0253*
-evdev:input:b0003v05ACp0254:*
+evdev:input:b0003v05ACp0254*
  EVDEV_ABS_00=::94
  EVDEV_ABS_01=::92
  EVDEV_ABS_35=::94
  EVDEV_ABS_36=::92
 
 # MacbookPro10,1 (unibody, June 2012)
-evdev:input:b0003v05ACp0262:*
+evdev:input:b0003v05ACp0262*
-evdev:input:b0003v05ACp0263:*
+evdev:input:b0003v05ACp0263*
-evdev:input:b0003v05ACp0264:*
+evdev:input:b0003v05ACp0264*
 # MacbookPro10,2 (unibody, October 2012)
-evdev:input:b0003v05ACp0259:*
+evdev:input:b0003v05ACp0259*
-evdev:input:b0003v05ACp025A:*
+evdev:input:b0003v05ACp025A*
-evdev:input:b0003v05ACp025B:*
+evdev:input:b0003v05ACp025B*
  EVDEV_ABS_00=::94
  EVDEV_ABS_01=::92
  EVDEV_ABS_35=::94
@@ -294,7 +292,7 @@ evdev:name:AlpsPS/2 ALPS GlidePoint:dmi:bvn*:bvr*:bd*:svnDellInc.:pnXPSM1530:*
 #####
 
 # Fujitsu Component - USB Touch Panel
-evdev:input:b0003v0430p0530:*
+evdev:input:b0003v0430p0530*
  EVDEV_ABS_00=0:4096:16
  EVDEV_ABS_01=0:4096:16
 
@@ -446,7 +444,7 @@ evdev:name:Synaptics TM3289-002:dmi:*svnLENOVO*:pvrThinkPadX1Carbon5th:*
  EVDEV_ABS_36=::19
 
 # Lenovo Thinkpad X1 Tablet Gen3
-evdev:input:b0003v17EFp60B5:*
+evdev:input:b0003v17EFp60B5*
  EVDEV_ABS_00=::12
  EVDEV_ABS_01=::11
  EVDEV_ABS_35=::12
@@ -639,7 +637,7 @@ evdev:name:SynPS/2 Synaptics TouchPad:dmi:*svnTOSHIBA:pnSATELLITER830:*
 #########################################
 
 # Trust Flex Graphics Tablet
-evdev:input:b0003v2179p0004:*
+evdev:input:b0003v2179p0004*
  EVDEV_ABS_00=::234
  EVDEV_ABS_01=::328
 
@@ -648,11 +646,11 @@ evdev:input:b0003v2179p0004:*
 #########################################
 
 # WALTOP International Corp. Slim Tablet
-evdev:input:b0003v172Fp0031:*
+evdev:input:b0003v172Fp0031*
  EVDEV_ABS_00=0:10000:400
  EVDEV_ABS_01=0:6250:400
 
 #WALTOP International Corp. Graphics Tablet
-evdev:input:b0003v172Fp0047:*
+evdev:input:b0003v172Fp0047*
  EVDEV_ABS_00=0:20000:80
  EVDEV_ABS_01=0:12500:80

hwdb.d/60-input-id.hwdb

@@ -9,7 +9,7 @@
 # ABI.
 #
 # Match string formats:
-# id-input:modalias:<modalias pattern>
+# id-input:modalias:<modalias>
 #
 # To add local entries, create a new file
 #   /etc/udev/hwdb.d/61-input-id-local.hwdb
@@ -48,28 +48,27 @@
 # NOT allowed in this file are:
 #    ID_INPUT_WIDTH_MM, ID_INPUT_HEIGHT_MM, ID_INPUT_TOUCHPAD_INTEGRATION
 #
-# All matches should end in ':*' to allow future expansions of the match key.
 
 # Example:
-# id-input:modalias:input:b0003v1234pABCD:*
+# id-input:modalias:input:b0003v1234pABCD*
 #  ID_INPUT_TOUCHPAD=1
 #  ID_INPUT=1
 
 # Sort by brand, model
 
 # UC-Logic TABLET 1060N Pad
-id-input:modalias:input:b0003v5543p0081:*
+id-input:modalias:input:b0003v5543p0081*
  ID_INPUT_TABLET=1
  ID_INPUT_TABLET_PAD=1
 
 # XP-PEN STAR 06
-id-input:modalias:input:b0003v28bdp0078:*
+id-input:modalias:input:b0003v28bdp0078*
  ID_INPUT_TABLET=1
 
 # Lite-On Tech IBM USB Travel Keyboard with Ultra Nav Mouse
-id-input:modalias:input:b0003v04B3p301Ee0100-e0,1,2,4*:*
+id-input:modalias:input:b0003v04B3p301Ee0100-e0,1,2,4*
  ID_INPUT_POINTINGSTICK=1
 
 # Logitech Ultrathin Touch Mouse
-id-input:modalias:input:b0005v046DpB00De0700:*
+id-input:modalias:input:b0005v046DpB00De0700*
  ID_INPUT_MOUSE=1

hwdb.d/60-keyboard.hwdb

@@ -47,8 +47,6 @@
 #    /sys/class/input/input?/capabilities/ev" and <vendor> is the
 #    firmware-provided string exported by the kernel DMI modalias,
 #    see /sys/class/dmi/id/modalias
-#
-# All matches should end in ':*' to allow future expansions of the match key.
 
 # ######################### KEY MAPPING ######################################
 #
@@ -230,7 +228,7 @@ evdev:name:Asus Laptop extra buttons:dmi:bvn*:bvr*:bd*:svnASUS*:pn*:*
  KEYBOARD_KEY_6b=f21                                    # Touchpad Toggle
 
 # USB keyboard in Asus FX503VD
-evdev:input:b0003v0B05p1869:*
+evdev:input:b0003v0B05p1869*
  KEYBOARD_KEY_ff31007c=f20                              # Remap micmute to f20
 
 ###########################################################
@@ -268,7 +266,7 @@ evdev:atkbd:dmi:bvn*:bvr*:bd*:svnCompaq*:pn*Evo*N*:*
  KEYBOARD_KEY_9e=email
  KEYBOARD_KEY_9f=homepage
 
-evdev:input:b0003v049Fp0051:*
+evdev:input:b0003v049Fp0051*
  KEYBOARD_KEY_0c0011=presentation
  KEYBOARD_KEY_0c0012=addressbook
  KEYBOARD_KEY_0c0013=info
@@ -465,7 +463,7 @@ evdev:atkbd:dmi:bvn*:bvr*:bd*:svnGeminiDevices:pnNC14V1006:*
 ###########################################################
 
 # Slimstar 320
-evdev:input:b0003v0458p0708:*
+evdev:input:b0003v0458p0708*
  KEYBOARD_KEY_0900f0=scrollup
  KEYBOARD_KEY_0900f1=scrolldown
  KEYBOARD_KEY_0900f3=back
@@ -715,7 +713,7 @@ evdev:name:ThinkPad Extra Buttons:dmi:bvn*:bvr*:bd*:svnIBM*:pn*:*
  KEYBOARD_KEY_17=prog1                                  # ThinkPad/ThinkVantage button (high keycode: "vendor")
 
 # IBM Thinkpad USB Keyboard Trackpoint
-evdev:input:b0003v04B3p301[89]:*
+evdev:input:b0003v04B3p301[89]*
  KEYBOARD_KEY_900f0=screenlock
  KEYBOARD_KEY_900f1=wlan
  KEYBOARD_KEY_900f2=switchvideomode
@@ -759,7 +757,7 @@ evdev:name:ThinkPad Extra Buttons:dmi:bvn*:bvr*:bd*:svnLENOVO*:pn*:*
  KEYBOARD_KEY_45=bookmarks
 
 # ThinkPad Keyboard with TrackPoint
-evdev:input:b0003v17EFp6009:*
+evdev:input:b0003v17EFp6009*
  KEYBOARD_KEY_090012=screenlock                         # Fn+F2
  KEYBOARD_KEY_090013=battery                            # Fn+F3
  KEYBOARD_KEY_090014=wlan                               # Fn+F5
@@ -866,7 +864,7 @@ evdev:name:Microphone Mute Button:dmi:bvn*:bvr*:bd*:svnLENOVO*:pn*:*
  KEYBOARD_KEY_00=f20
 
 # enhanced USB keyboard
-evdev:input:b0003v04B3p301B:*
+evdev:input:b0003v04B3p301B*
  KEYBOARD_KEY_90001=prog1 # ThinkVantage
  KEYBOARD_KEY_90002=screenlock
  KEYBOARD_KEY_90003=file
@@ -884,7 +882,7 @@ evdev:input:b0003v04B3p301B:*
 # 27MHz wireless keyboards, these all have a PID of 00?? and all send c10xx
 # logitech custom consumer usage-page codes. The mappings below are the most
 # common, but some mapping may differ, especially the Fn F1-F12 mappings
-evdev:input:b0003v046Dp00??:*
+evdev:input:b0003v046Dp00*
  KEYBOARD_KEY_c0183=media           # HUT:config, kbd:Media/Music player button
  KEYBOARD_KEY_c1001=chat            # Messenger button
  KEYBOARD_KEY_c1002=camera          # Webcam button
@@ -934,7 +932,7 @@ evdev:input:b0003v046Dp00??:*
  KEYBOARD_KEY_c104c=prog4           # Smartkey D (Fn + F12) → XF86Launch4
 
 # Cordless Access Keyboard (27 MHz, modelnumber Y-RH35)
-evdev:input:b0003v046Dp0042:*
+evdev:input:b0003v046Dp0042*
  KEYBOARD_KEY_c1041=new
  KEYBOARD_KEY_c1042=reply
  KEYBOARD_KEY_c1043=forward
@@ -949,7 +947,7 @@ evdev:input:b0003v046Dp0042:*
  KEYBOARD_KEY_c104c=audio
 
 # "Cordless Rechargeable Desktop" keyboard (27 MHz, modelnumber Y-RK49)
-evdev:input:b0003v046Dp0045:*
+evdev:input:b0003v046Dp0045*
  KEYBOARD_KEY_c1041=new
  KEYBOARD_KEY_c1042=reply
  KEYBOARD_KEY_c1043=forward
@@ -960,7 +958,7 @@ evdev:input:b0003v046Dp0045:*
  KEYBOARD_KEY_c104c=audio
 
 # S510 keyboard (27 MHz, modelnumber Y-RAK73)
-evdev:input:b0003v046Dp0056:*
+evdev:input:b0003v046Dp0056*
  KEYBOARD_KEY_c1041=battery      # Battery icon (Fn + F1)
 
 # MX3000 keyboard (27 MHz, modelnumber Y-RAM74)
@@ -969,7 +967,7 @@ evdev:input:b0003v046Dp0056:*
 # Note if the "Special Button Function" in the HID++ features register gets
 # cleared then the scroll-wheel events for these buttons go away and then
 # tilting the scrollwheel left/right starts sending c1022 / c1024 events
-evdev:input:b0003v046Dp0057:*
+evdev:input:b0003v046Dp0057*
  KEYBOARD_KEY_c1041=battery      # Battery icon (Fn + F1)
 
 #KEYBOARD_KEY_c101d=scrolldown   # Button below scrollwheel (see note above)
@@ -978,7 +976,7 @@ evdev:input:b0003v046Dp0057:*
 #KEYBOARD_KEY_c1024=scrollright  # Right click on scroll-wheel (see note above)
 
 # MX3200 keyboard (27 MHz, modelnumber Y-RAV80)
-evdev:input:b0003v046Dp005C:*
+evdev:input:b0003v046Dp005C*
  KEYBOARD_KEY_c1001=phone           # VOIP button
  KEYBOARD_KEY_c1016=record          # Record button
  KEYBOARD_KEY_c1041=wordprocessor   # Word icon (Fn + F1)
@@ -991,13 +989,13 @@ evdev:input:b0003v046Dp005C:*
  KEYBOARD_KEY_c1048=prog4           # Smartkey D (Fn + F8) → XF86Launch4
 
 # EX100 keyboard (27 MHz, modelnumber Y-RBH94)
-evdev:input:b0003v046Dp0065:*
+evdev:input:b0003v046Dp0065*
  KEYBOARD_KEY_c104b=battery         # Battery icon (Fn + F11)
  KEYBOARD_KEY_c104c=ejectcd         # Eject icon (Fn + F12)
 
 # S520 keyboard (27 MHz, modelnumber Y-RBA97)
 # Note this one uses non-standard codes for FN + F9 - Fn + F12?
-evdev:input:b0003v046Dp0066:*
+evdev:input:b0003v046Dp0066*
  KEYBOARD_KEY_c100e=prog4           # Smartkey D (Fn + F12) → XF86Launch4
  KEYBOARD_KEY_c1019=prog1           # Smartkey A (Fn + F9)  → XF86Launch1
  KEYBOARD_KEY_c101a=prog2           # Smartkey B (Fn + F10) → XF86Launch2
@@ -1013,12 +1011,12 @@ evdev:input:b0003v046Dp0066:*
  KEYBOARD_KEY_c106f=battery         # Battery icon
 
 # S510 remote control (27 MHz)
-evdev:input:b0003v046Dp00FE:*
+evdev:input:b0003v046Dp00FE*
  KEYBOARD_KEY_c1018=media           # Media button
 
 # MX5000 keyboard (HID proxy mode and bluetooth matches)
-evdev:input:b0003v046DpB305:*
+evdev:input:b0003v046DpB305*
-evdev:input:b0005v046DpB305:*
+evdev:input:b0005v046DpB305*
  KEYBOARD_KEY_c0230=zoomreset	# HUT says fullscreen, kbd says 100%
  KEYBOARD_KEY_c1004=send	# Send and receive / sync button
  KEYBOARD_KEY_c1006=coffee	# Status (online/away) button
@@ -1033,8 +1031,8 @@ evdev:input:b0005v046DpB305:*
  KEYBOARD_KEY_c103b=prog4	# Smartkey D → XF86Launch4
 
 # MX5500 keyboard (HID proxy mode and bluetooth matches)
-evdev:input:b0003v046DpB30B:*
+evdev:input:b0003v046DpB30B*
-evdev:input:b0005v046DpB30B:*
+evdev:input:b0005v046DpB30B*
  KEYBOARD_KEY_c0183=media	# HUT says consumer control configuration, kbd says Media Center
  KEYBOARD_KEY_c100e=images      # Camera icon, "Photo Gallery"
  KEYBOARD_KEY_c100f=config      # Window with gear icon
@@ -1044,12 +1042,12 @@ evdev:input:b0005v046DpB30B:*
  KEYBOARD_KEY_c103b=prog4	# Smartkey D → XF86Launch4
 
 # Logitech K811
-evdev:input:b0005v046DpB317:*
+evdev:input:b0005v046DpB317*
  KEYBOARD_KEY_70047=brightnessdown
  KEYBOARD_KEY_70048=brightnessup
 
 # iTouch
-evdev:input:b0003v046DpC308:*
+evdev:input:b0003v046DpC308*
  KEYBOARD_KEY_90001=shop                                # Shopping
  KEYBOARD_KEY_90002=config                              # iTouch
  KEYBOARD_KEY_90003=finance                             # Finance
@@ -1058,12 +1056,12 @@ evdev:input:b0003v046DpC308:*
  KEYBOARD_KEY_c0183=media                               # Media
 
 # Cordless Desktop S510
-evdev:input:b0003v046DpC50C:*
+evdev:input:b0003v046DpC50C*
  KEYBOARD_KEY_d4=up                                     # zoomin
  KEYBOARD_KEY_cc=down                                   # zoomout
 
 # Wave cordless
-evdev:input:b0003v046DpC317:*
+evdev:input:b0003v046DpC317*
  KEYBOARD_KEY_9001c=scale                               # expo
  KEYBOARD_KEY_9001f=down                                # zoomout
  KEYBOARD_KEY_90020=up                                  # zoomin
@@ -1082,7 +1080,7 @@ evdev:input:b0003v046DpC317:*
  KEYBOARD_KEY_9004c=ejectclosecd
 
 # Wave cordless
-evdev:input:b0003v046DpC517:*
+evdev:input:b0003v046DpC517*
  KEYBOARD_KEY_c101f=down                                # zoomout
  KEYBOARD_KEY_c1020=up                                  # zoomin
  KEYBOARD_KEY_c1005=camera
@@ -1098,7 +1096,7 @@ evdev:input:b0003v046DpC517:*
  KEYBOARD_KEY_c104c=ejectclosecd
 
 # Cordless Wave Pro
-evdev:input:b0003v046DpC529:*
+evdev:input:b0003v046DpC529*
  KEYBOARD_KEY_0c01b6=camera
  KEYBOARD_KEY_0c0183=media
  KEYBOARD_KEY_0c0184=wordprocessor
@@ -1113,13 +1111,13 @@ evdev:input:b0003v046DpC529:*
  KEYBOARD_KEY_0c022e=down                               # zoomout
 
 # Logitech Presenter R400
-evdev:input:b0003v046DpC52D:*
+evdev:input:b0003v046DpC52D*
  KEYBOARD_KEY_070029=presentation
  KEYBOARD_KEY_07003e=presentation
  KEYBOARD_KEY_070037=displaytoggle
 
 # Internet Navigator
-evdev:input:b0003v046DpC309:*
+evdev:input:b0003v046DpC309*
  KEYBOARD_KEY_90001=chat         # Messenger/SMS
  KEYBOARD_KEY_90002=camera       # webcam
  KEYBOARD_KEY_90003=prog1        # iTouch
@@ -1191,12 +1189,12 @@ evdev:atkbd:dmi:bvn*:bvr*:bd*:svnMedion*:pnErazer*:*
 ###########################################################
 
 # Microsoft Natural Ergonomic Keyboard 4000
-evdev:input:b0003v045Ep00DB:*
+evdev:input:b0003v045Ep00DB*
  KEYBOARD_KEY_c022d=up                                  # zoomin
  KEYBOARD_KEY_c022e=down                                # zoomout
 
 # Microsoft (Razer produced) Reclusa keyboard
-evdev:input:b0003v1532p0200:*
+evdev:input:b0003v1532p0200*
  KEYBOARD_KEY_c01c9=shuffle
  KEYBOARD_KEY_c01ca=up                                  # zoomin
  KEYBOARD_KEY_c01cb=down                                # zoomout
@@ -1259,7 +1257,7 @@ evdev:name:MSI Laptop hotkeys:dmi:bvn*:bvr*:bd*:svn*:pnM[iI][cC][rR][oO]-S[tT][a
 ###########################################################
 
 # Teres-I
-evdev:input:b0003v15BAp003C:*
+evdev:input:b0003v15BAp003C*
  KEYBOARD_KEY_70066=sleep                               # Fn+F1
  KEYBOARD_KEY_700f6=wlan                                # Fn+F2
  KEYBOARD_KEY_700c7=f21                                 # Fn+F3 touchpad toggle
@@ -1371,7 +1369,7 @@ evdev:atkbd:dmi:bvn*:bvr*:bd*:svnOQO*Inc.*:pnOQO*Model*2*:*
 # The key code identifiers used below exactly match the text
 # labels on the keys/buttons (or standard icons on the buttons
 # that have no text labels), except as noted.
-evdev:input:b0003v05A4p9735:*
+evdev:input:b0003v05A4p9735*
  KEYBOARD_KEY_c0015=back
  KEYBOARD_KEY_c0012=forward
  KEYBOARD_KEY_c000c=stop
@@ -1402,7 +1400,7 @@ evdev:input:b0003v05A4p9735:*
 ###########################################################
 
 # Plantronics .Audio 626 DSP
-evdev:input:b0003v047FpC006:*
+evdev:input:b0003v047FpC006*
  KEYBOARD_KEY_b002f=f20                                # Microphone mute button; should be micmute
 
 ###########################################################
@@ -1699,7 +1697,7 @@ evdev:atkbd:dmi:bvn*:bvr*:bd*:svnZepto:pnZnote*6615WD:*
 ##########################################
 
 # Ideazon Zboard Merc
-evdev:input:b0003v1038p0210:*
+evdev:input:b0003v1038p0210*
  KEYBOARD_KEY_c0227=q
  KEYBOARD_KEY_c0223=w
  KEYBOARD_KEY_c0221=e
@@ -1737,7 +1735,7 @@ evdev:input:b0003v1038p0210:*
  KEYBOARD_KEY_70079=f6
 
 # Ideazon Zboard Fang
-evdev:input:b0003v1038p0310:*
+evdev:input:b0003v1038p0310*
  KEYBOARD_KEY_70059=1
  KEYBOARD_KEY_7005b=3
  KEYBOARD_KEY_70040=equal
@@ -1789,13 +1787,13 @@ evdev:atkbd:dmi:bvn*:bvr*:bd*:svnDIXONSP:pnDIXON*:*
 # with an accompanying variant (defined with XKB_FIXED_VARIANT) if necessary.
 
 # Yubico Yubico Yubikey II"
-evdev:input:b0003v1050p0010:*
+evdev:input:b0003v1050p0010*
 # Yubico Yubikey NEO OTP+CCID
-evdev:input:b0003v1050p0111:*
+evdev:input:b0003v1050p0111*
 # Yubico Yubikey NEO OTP+U2F+CCID
-evdev:input:b0003v1050p0116:*
+evdev:input:b0003v1050p0116*
 # OKE Electron Company USB barcode reader
-evdev:input:b0003v05FEp1010:*
+evdev:input:b0003v05FEp1010*
  XKB_FIXED_LAYOUT=us
  XKB_FIXED_VARIANT=
 
@@ -1808,12 +1806,12 @@ evdev:input:b0003v05FEp1010:*
 # Presence of a LED is implicit when the property is absent.
 
 # Logitech K750
-evdev:input:b0003v046Dp4002:*
+evdev:input:b0003v046Dp4002*
  KEYBOARD_LED_NUMLOCK=0
  KEYBOARD_LED_CAPSLOCK=0
 
 # PFU Limited HHKB Professional JP
-evdev:input:b0003v04FEp000D:*
+evdev:input:b0003v04FEp000D*
  KEYBOARD_LED_NUMLOCK=0
  KEYBOARD_LED_CAPSLOCK=0
 

hwdb.d/60-sensor.hwdb

@@ -67,8 +67,6 @@
 # or 'display'. The default, when unset, is equivalent to:
 #    ACCEL_LOCATION=display
 #
-# All matches should end in ':*' to allow future expansions of the match key.
-
 # Sort by brand, model
 
 #########################################

hwdb.d/70-joystick.hwdb

@@ -36,8 +36,6 @@
 #
 #   If the property is missing, user-space can assume:
 #   ID_INPUT_JOYSTICK_INTEGRATION=external
-#
-# All matches should end in ':*' to allow future expansions of the match key.
 
 joystick:bluetooth:*
  ID_INPUT_JOYSTICK_INTEGRATION=external
@@ -47,6 +45,6 @@ joystick:bluetooth:*
 ###########################################################
 
 # GPD Win, Classic and XBox 360 compat modes
-joystick:usb:v11c5p5507:*
+joystick:usb:v11c5p5507*
-joystick:usb:v045ep028e:*
+joystick:usb:v045ep028e*
  ID_INPUT_JOYSTICK_INTEGRATION=internal

hwdb.d/70-pointingstick.hwdb

@@ -13,7 +13,7 @@
 #
 # Supported hardware matches are:
 #  - Generic input devices match:
-#      evdev:input:bZZZZvYYYYpXXXXeWWWW-VVVV:*
+#      evdev:input:bZZZZvYYYYpXXXXeWWWW-VVVV
 #    This matches on the kernel modalias of the input-device, mainly:
 #    ZZZZ is the bus-id (see /usr/include/linux/input.h BUS_*), YYYY, XXXX and
 #    WWW are the 4-digit hex uppercase vendor, product and version ID and VVVV
@@ -27,8 +27,6 @@
 #    <vendor> is the firmware-provided string from the kernel DMI modalias,
 #    see /sys/class/dmi/id/modalias
 #
-# All matches should end in ':*' to allow future expansions of the match key.
-#
 # To add local entries, create a new file
 #   /etc/udev/hwdb.d/71-pointingstick-local.hwdb
 # and add your rules there. To load the new rules execute (as root):
@@ -157,6 +155,6 @@ evdev:name:TPPS/2 IBM TrackPoint:dmi:bvn*:bvr*:bd*:svnLENOVO:pn*:pvrThinkPadX20?
  POINTINGSTICK_CONST_ACCEL=1.25
 
 # Lenovo UltraNav SK-8845 (USB keyboard)
-evdev:input:b0003v06CBp0009:*
+evdev:input:b0003v06CBp0009*
  POINTINGSTICK_CONST_ACCEL=2.5
  POINTINGSTICK_SENSITIVITY=200

hwdb.d/70-touchpad.hwdb

@@ -15,8 +15,6 @@
 #
 # vid/pid as 4-digit hex lowercase vendor/product
 #
-# All matches should end in ':*' to allow future expansions of the match key.
-#
 # To add local entries, create a new file
 #   /etc/udev/hwdb.d/71-touchpad-local.hwdb
 # and add your rules there. To load the new rules execute (as root):
@@ -61,11 +59,11 @@ touchpad:usb:v044ep1221:*
 ###########################################################
 # Logitech
 ###########################################################
-touchpad:usb:v046dp????:*
+touchpad:usb:v046d*
  ID_INPUT_TOUCHPAD_INTEGRATION=external
 
 ###########################################################
 # Wacom
 ###########################################################
-touchpad:usb:v056ap????:*
+touchpad:usb:v056a*
  ID_INPUT_TOUCHPAD_INTEGRATION=external

hwdb.d/parse_hwdb.py

@@ -202,9 +202,8 @@ def check_matches(groups):
             except ParseBaseException as e:
                 error('Pattern {!r} is invalid: {}', rest, e)
                 continue
-
+            if rest[-1] not in '*:':
-        if not rest.endswith(':*'):
+                error('pattern {} does not end with "*" or ":"', match)
-            error("pattern {!r} does not end with ':*'", match)
 
     matches.sort()
     prev = None

man/udev_device_get_syspath.xml

@@ -173,7 +173,7 @@
       <citerefentry><refentrytitle>udev_enumerate_new</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
       <citerefentry><refentrytitle>udev_monitor_new_from_netlink</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
       <citerefentry><refentrytitle>udev_list_entry</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
-      <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+      <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
     </para>
   </refsect1>
 

src/basic/selinux-util.c

@@ -133,6 +133,7 @@ static int open_label_db(void) {
 int mac_selinux_init(void) {
 #if HAVE_SELINUX
         int r;
+        bool have_status_page = false;
 
         if (initialized)
                 return 0;
@@ -140,9 +141,15 @@ int mac_selinux_init(void) {
         if (!mac_selinux_use())
                 return 0;
 
-        r = selinux_status_open(/* no netlink fallback */ 0);
+        r = selinux_status_open(/* netlink fallback */ 1);
-        if (r < 0)
+        if (r < 0) {
+                if (!ERRNO_IS_PRIVILEGE(errno))
                         return log_enforcing_errno(errno, "Failed to open SELinux status page: %m");
+                log_warning_errno(errno, "selinux_status_open() with netlink fallback failed, not checking for policy reloads: %m");
+        } else if (r == 1)
+                log_warning("selinux_status_open() failed to open the status page, using the netlink fallback.");
+        else
+                have_status_page = true;
 
         r = open_label_db();
         if (r < 0) {
@@ -150,12 +157,13 @@ int mac_selinux_init(void) {
                 return r;
         }
 
-        /* save the current policyload sequence number, so `mac_selinux_maybe_reload()` does
+        /* Save the current policyload sequence number, so mac_selinux_maybe_reload() does not trigger on
-           not trigger on first call without any actual change */
+         * first call without any actual change. */
         last_policyload = selinux_status_policyload();
 
-        /* now that the SELinux status page has been successfully opened,
+        if (have_status_page)
-           retrieve the enforcing status over it (to avoid system calls in `security_getenforce()`) */
+                /* Now that the SELinux status page has been successfully opened, retrieve the enforcing
+                 * status over it (to avoid system calls in security_getenforce()). */
                 enforcing_status_func = selinux_status_getenforce;
 
         initialized = true;

src/basic/signal-util.c

@@ -49,16 +49,7 @@ static int sigaction_many_ap(const struct sigaction *sa, int sig, va_list ap) {
         int r = 0;
 
         /* negative signal ends the list. 0 signal is skipped. */
-
+        for (; sig >= 0; sig = va_arg(ap, int)) {
-        if (sig < 0)
-                return 0;
-
-        if (sig > 0) {
-                if (sigaction(sig, sa, NULL) < 0)
-                        r = -errno;
-        }
-
-        while ((sig = va_arg(ap, int)) >= 0) {
 
                 if (sig == 0)
                         continue;

src/basic/string-util.c

@@ -145,57 +145,32 @@ char *strnappend(const char *s, const char *suffix, size_t b) {
 
 char *strjoin_real(const char *x, ...) {
         va_list ap;
-        size_t l;
+        size_t l = 1;
         char *r, *p;
 
         va_start(ap, x);
-
+        for (const char *t = x; t; t = va_arg(ap, const char *)) {
-        if (x) {
-                l = strlen(x);
-
-                for (;;) {
-                        const char *t;
                 size_t n;
 
-                        t = va_arg(ap, const char *);
-                        if (!t)
-                                break;
-
                 n = strlen(t);
-                        if (n > ((size_t) -1) - l) {
+                if (n > SIZE_MAX - l) {
                         va_end(ap);
                         return NULL;
                 }
-
                 l += n;
         }
-        } else
-                l = 0;
-
         va_end(ap);
 
-        r = new(char, l+1);
+        p = r = new(char, l);
         if (!r)
                 return NULL;
 
-        if (x) {
-                p = stpcpy(r, x);
-
         va_start(ap, x);
-
+        for (const char *t = x; t; t = va_arg(ap, const char *))
-                for (;;) {
-                        const char *t;
-
-                        t = va_arg(ap, const char *);
-                        if (!t)
-                                break;
-
                 p = stpcpy(p, t);
-                }
-
         va_end(ap);
-        } else
+
-                r[0] = 0;
+        *p = 0;
 
         return r;
 }

src/basic/strv.c

@@ -123,7 +123,6 @@ size_t strv_length(char * const *l) {
 }
 
 char **strv_new_ap(const char *x, va_list ap) {
-        const char *s;
         _cleanup_strv_free_ char **a = NULL;
         size_t n = 0, i = 0;
         va_list aq;
@@ -133,34 +132,20 @@ char **strv_new_ap(const char *x, va_list ap) {
          * STRV_IFNOTNULL() macro to include possibly NULL strings in
          * the string list. */
 
-        if (x) {
-                n = x == STRV_IGNORE ? 0 : 1;
-
         va_copy(aq, ap);
-                while ((s = va_arg(aq, const char*))) {
+        for (const char *s = x; s; s = va_arg(aq, const char*)) {
                 if (s == STRV_IGNORE)
                         continue;
 
                 n++;
         }
-
         va_end(aq);
-        }
 
         a = new(char*, n+1);
         if (!a)
                 return NULL;
 
-        if (x) {
+        for (const char *s = x; s; s = va_arg(ap, const char*)) {
-                if (x != STRV_IGNORE) {
-                        a[i] = strdup(x);
-                        if (!a[i])
-                                return NULL;
-                        i++;
-                }
-
-                while ((s = va_arg(ap, const char*))) {
-
                 if (s == STRV_IGNORE)
                         continue;
 
@@ -170,7 +155,6 @@ char **strv_new_ap(const char *x, va_list ap) {
 
                 i++;
         }
-        }
 
         a[i] = NULL;
 

src/libsystemd/sd-login/sd-login.c

@@ -355,7 +355,7 @@ _public_ int sd_uid_is_on_seat(uid_t uid, int require_active, const char *seat)
         char t[DECIMAL_STR_MAX(uid_t)];
         xsprintf(t, UID_FMT, uid);
 
-        return string_contains_word(content, ",", t);
+        return string_contains_word(content, NULL, t);
 }
 
 static int uid_get_array(uid_t uid, const char *variable, char ***array) {

src/resolve/resolved-dns-answer.c

@@ -11,6 +11,9 @@
 DnsAnswer *dns_answer_new(size_t n) {
         DnsAnswer *a;
 
+        if (n > UINT16_MAX) /* We can only place 64K RRs in an answer at max */
+                n = UINT16_MAX;
+
         a = malloc0(offsetof(DnsAnswer, items) + sizeof(DnsAnswerItem) * n);
         if (!a)
                 return NULL;
@@ -624,12 +627,16 @@ int dns_answer_reserve(DnsAnswer **a, size_t n_free) {
                         return -EBUSY;
 
                 ns = (*a)->n_rrs + n_free;
+                if (ns > UINT16_MAX) /* Maximum number of RRs we can stick into a DNS packet section */
+                        ns = UINT16_MAX;
 
                 if ((*a)->n_allocated >= ns)
                         return 0;
 
                 /* Allocate more than we need */
                 ns *= 2;
+                if (ns > UINT16_MAX)
+                        ns = UINT16_MAX;
 
                 n = realloc(*a, offsetof(DnsAnswer, items) + sizeof(DnsAnswerItem) * ns);
                 if (!n)
@@ -706,7 +713,7 @@ void dns_answer_dump(DnsAnswer *answer, FILE *f) {
                         fputs("\t;", f);
 
                 if (ifindex != 0)
-                        printf(" ifindex=%i", ifindex);
+                        fprintf(f, " ifindex=%i", ifindex);
                 if (flags & DNS_ANSWER_AUTHENTICATED)
                         fputs(" authenticated", f);
                 if (flags & DNS_ANSWER_CACHEABLE)

src/resolve/resolved-dns-dnssec.c

@@ -1813,6 +1813,8 @@ int dnssec_nsec_test(DnsAnswer *answer, DnsResourceKey *key, DnssecNsecResult *r
 
                 /* The following checks only make sense for NSEC RRs that are not expanded from a wildcard */
                 r = dns_resource_record_is_synthetic(rr);
+                if (r == -ENODATA) /* No signing RR known. */
+                        continue;
                 if (r < 0)
                         return r;
                 if (r > 0)

src/resolve/resolved-dns-question.c

@@ -8,7 +8,8 @@
 DnsQuestion *dns_question_new(size_t n) {
         DnsQuestion *q;
 
-        assert(n > 0);
+        if (n > UINT16_MAX) /* We can only place 64K key in an question section at max */
+                n = UINT16_MAX;
 
         q = malloc0(offsetof(DnsQuestion, keys) + sizeof(DnsResourceKey*) * n);
         if (!q)

src/resolve/resolved-dns-rr.c

@@ -1650,7 +1650,7 @@ DnsResourceRecord *dns_resource_record_copy(DnsResourceRecord *rr) {
                         return NULL;
                 copy->nsec3.salt_size = rr->nsec3.salt_size;
                 copy->nsec3.next_hashed_name = memdup(rr->nsec3.next_hashed_name, rr->nsec3.next_hashed_name_size);
-                if (!copy->nsec3.next_hashed_name_size)
+                if (!copy->nsec3.next_hashed_name)
                         return NULL;
                 copy->nsec3.next_hashed_name_size = rr->nsec3.next_hashed_name_size;
                 copy->nsec3.types = bitmap_copy(rr->nsec3.types);

src/resolve/resolved-dns-scope.c

@@ -1156,12 +1156,16 @@ bool dns_scope_name_wants_search_domain(DnsScope *s, const char *name) {
 bool dns_scope_network_good(DnsScope *s) {
         /* Checks whether the network is in good state for lookups on this scope. For mDNS/LLMNR/Classic DNS scopes
          * bound to links this is easy, as they don't even exist if the link isn't in a suitable state. For the global
-         * DNS scope we check whether there are any links that are up and have an address. */
+         * DNS scope we check whether there are any links that are up and have an address.
+         *
+         * Note that Linux routing is complex and even systems that superficially have no IPv4 address might
+         * be able to route IPv4 (and similar for IPv6), hence let's make a check here independent of address
+         * family. */
 
         if (s->link)
                 return true;
 
-        return manager_routable(s->manager, AF_UNSPEC);
+        return manager_routable(s->manager);
 }
 
 int dns_scope_ifindex(DnsScope *s) {

src/resolve/resolved-manager.c

@@ -1418,15 +1418,15 @@ void manager_dnssec_verdict(Manager *m, DnssecVerdict verdict, const DnsResource
         m->n_dnssec_verdict[verdict]++;
 }
 
-bool manager_routable(Manager *m, int family) {
+bool manager_routable(Manager *m) {
         Link *l;
 
         assert(m);
 
-        /* Returns true if the host has at least one interface with a routable address of the specified type */
+        /* Returns true if the host has at least one interface with a routable address (regardless if IPv4 or IPv6) */
 
         HASHMAP_FOREACH(l, m->links)
-                if (link_relevant(l, family, false))
+                if (link_relevant(l, AF_UNSPEC, false))
                         return true;
 
         return false;

src/resolve/resolved-manager.h

@@ -185,7 +185,7 @@ DnsOverTlsMode manager_get_dns_over_tls_mode(Manager *m);
 
 void manager_dnssec_verdict(Manager *m, DnssecVerdict verdict, const DnsResourceKey *key);
 
-bool manager_routable(Manager *m, int family);
+bool manager_routable(Manager *m);
 
 void manager_flush_caches(Manager *m);
 void manager_reset_server_features(Manager *m);

src/shared/seccomp-util.c

@@ -383,7 +383,6 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
                 "clock_settime\0"
                 "clock_settime64\0"
                 "settimeofday\0"
-                "stime\0"
         },
         [SYSCALL_FILTER_SET_CPU_EMULATION] = {
                 .name = "@cpu-emulation",
@@ -639,6 +638,7 @@ const SyscallFilterSet syscall_filter_sets[_SYSCALL_FILTER_SET_MAX] = {
                 "security\0"
                 "sgetmask\0"
                 "ssetmask\0"
+                "stime\0"
                 "stty\0"
                 "sysfs\0"
                 "tuxcall\0"

tools/make-autosuspend-rules.py

@@ -7,18 +7,18 @@
 
 import chromiumos.gen_autosuspend_rules
 
-print('# pci:v<00VENDOR>d<00DEVICE>:* (8 uppercase hexadecimal digits twice)')
+print('# pci:v<00VENDOR>d<00DEVICE> (8 uppercase hexadecimal digits twice)')
 for entry in chromiumos.gen_autosuspend_rules.PCI_IDS:
     vendor, device = entry.split(':')
     vendor = int(vendor, 16)
     device = int(device, 16)
-    print('pci:v{:08X}d{:08X}:*'.format(vendor, device))
+    print('pci:v{:08X}d{:08X}*'.format(vendor, device))
 
-print('# usb:v<VEND>p<PROD>:* (4 uppercase hexadecimal digits twice)')
+print('# usb:v<VEND>p<PROD> (4 uppercase hexadecimal digits twice)')
 for entry in chromiumos.gen_autosuspend_rules.USB_IDS:
     vendor, product = entry.split(':')
     vendor = int(vendor, 16)
     product = int(product, 16)
-    print('usb:v{:04X}p{:04X}:*'.format(vendor, product))
+    print('usb:v{:04X}p{:04X}*'.format(vendor, product))
 
 print(' ID_AUTOSUSPEND=1')