!114 backport libsepol/cil: Optionally allow duplicate role declarations

From: @chang111111 
Reviewed-by: @mailofzxf 
Signed-off-by: @mailofzxf

backport-libsepol-cil-Optionally-allow-duplicate-role-declaration.patch

@@ -0,0 +1,40 @@
+From ae3c44c2d44b5e2f1c87b4b095d522a7f11add7a Mon Sep 17 00:00:00 2001
+From: changhan <changhan@xfusion.com>
+Date: Mon, 21 Apr 2025 11:34:35 +0800
+Subject: [PATCH] libsepol-cil-Optionally-allow-duplicate-role-declarations
+
+Reference:https://github.com/SELinuxProject/selinux/commit/7492632a6b6a1081d0c057a2ecfc193be9989515
+
+---
+ libsepol/cil/src/cil_build_ast.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/libsepol/cil/src/cil_build_ast.c b/libsepol/cil/src/cil_build_ast.c
+index 4177c9f..8264984 100644
+--- a/libsepol/cil/src/cil_build_ast.c
++++ b/libsepol/cil/src/cil_build_ast.c
+@@ -92,6 +92,7 @@ static int cil_allow_multiple_decls(struct cil_db *db, enum cil_flavor f_new, en
+ 	switch (f_new) {
+ 	case CIL_TYPE:
+ 	case CIL_TYPEATTRIBUTE:
++	case CIL_ROLE:
+ 		if (db->multiple_decls) {
+ 			return CIL_TRUE;
+ 		}
+@@ -1750,7 +1751,12 @@ int cil_gen_role(struct cil_db *db, struct cil_tree_node *parse_current, struct
+ 
+ 	rc = cil_gen_node(db, ast_node, (struct cil_symtab_datum*)role, (hashtab_key_t)key, CIL_SYM_ROLES, CIL_ROLE);
+ 	if (rc != SEPOL_OK) {
+-		goto exit;
++		if (rc == SEPOL_EEXIST) {
++ 			cil_destroy_role(role);
++ 			role = NULL;
++ 		} else {
++ 			goto exit;
++ 		}
+ 	}
+ 
+ 	return SEPOL_OK;
+-- 
+2.33.0
+

libsepol.spec

@@ -1,6 +1,6 @@
 Name:           libsepol
 Version:        3.5
-Release:        5
+Release:        6
 Summary:        SELinux binary policy manipulation library
 License:        LGPLv2+
 URL:            https://github.com/SELinuxProject/selinux/wiki/Releases
@@ -40,6 +40,7 @@ Patch0031:      backport-libsepol-Initialize-strs-on-declaration.patch
 Patch0032:      backport-libsepol-mls-Do-not-destroy-context-on-memory-error.patch
 Patch0033:      backport-libsepol-cil-cil_post-Initialize-tmp-on-declaration.patch
 Patch0034:      backport-libsepol-cil-Initialize-avtab_datum-on-declaration.patch
+Patch0035:      backport-libsepol-cil-Optionally-allow-duplicate-role-declaration.patch
 
 BuildRequires:  gcc flex
 
@@ -100,6 +101,9 @@ make DESTDIR="%{buildroot}" LIBDIR="%{_libdir}" SHLIBDIR="%{_libdir}" install
 %{_mandir}/man3/*
 
 %changelog
+* Mon Apr 21 2025 changhan <changhan@xfusion.com>  - 3.5-6
+- backport libsepol/cil: Optionally allow duplicate role declarations
+
 * Tue Mar 18 2025 Linux_zhang <zhangruifang@h-partners.com> - 3.5-5
 - backport patches from upstream