Fix bug in Checkmodule when downwriting to Module version 12 or lower.

[deleriux]

Stumbled upon this issue attempting to port a module from Fedora 33 to EL6.

Steps to reproduce:

Try to build the following module then make a module from an older release:

module test 1.0.0;

require {
  type default_t;
}
attribute_role new_atrole;

Build

$ checkmodule -M -m -c 12 -o test.mod test.te
$ semodule_package -o test.pp -m test.mod
$ semodule_package:  Error while reading policy module from test.mod

With fix:

$ checkmodule -o test.mod -M -m -c12 test.te 
libsepol.policydb_write: Discarding role attribute rules
$ semodule_package -o test.pp -m test.mod

Failure occurs when the current module gets written out as the scope declaration remains intact.
semodule_package files correctly at policydb.c:3913 doing a hash table search on a scope key that is not
in the symbol table.

This patch fixes the problem by removing the hashtable entries and scope declarations properly prior to module write and emits a warning to the user of the unsupported statements.

Also altered hashtap_map slightly to allow it to be used for hashtab_remove calls in order to support the patch.

[bachradsusi]

This PR was somehow missed in past. Is it still relevant?

In order to get the patch reviewed and accepted, it's necessary to send it to selinux@vger.kernel.org mailing list. The best way is to use git send-email command, e.g.:

git send-email --from='Your Name <your@email.address>' --to=selinux@vger.kernel.org --smtp-server=my.smtp.server --confirm=auto -1

Please also note that the project moved the development to main branch - https://lore.kernel.org/selinux/CAHC9VhTo0LnHwfnF1kfNcosUDdB=MtBQePemR+ju81_GFSuGiA@mail.gmail.com/T/#u