selinux-policy/Changelog

458 lines
13 KiB
Plaintext
Raw Normal View History

- Association polmatch MLS constraint making unlabeled_t an exception
is no longer needed, patch from Venkat Yekkirala.
- Context contains checking for PAM and cron from James Antill.
- Add a reload target to Modules.devel and change the load
target to only insert modules that were changed.
- Allow semanage to read from /root on strict non-MLS for
local policy modules.
- Gentoo init script fixes for udev.
- Allow udev to read kernel modules.inputmap.
- Dnsmasq fixes from testing.
- Allow kernel NFS server to getattr filesystems so df can work
on clients.
- Patch from Matt Anderson for a MLS constraint exemption on a
file that can be written to from a subject whose range is
within the object's range.
- Enhanced setransd support from Darrel Goeddel.
- Patches from Dan Walsh:
Tue, 24 Oct 2006
- Added modules:
2006-11-16 20:56:24 +00:00
aide (Matt Anderson)
ccs (Dan Walsh)
iscsi (Dan Walsh)
2006-11-16 20:56:24 +00:00
ricci (Dan Walsh)
2006-10-18 20:26:45 +00:00
* Wed Oct 18 2006 Chris PeBenito <selinux@tresys.com> - 20061018
- Patch from Russell Coker Thu, 5 Oct 2006
- Move range transitions to modules.
- Make number of MLS sensitivities, and number of MLS and MCS
categories configurable as build options.
2006-09-06 22:07:25 +00:00
- Add role infrastructure.
- Debian updates from Erich Schubert.
- Add nscd_socket_use() to auth_use_nsswitch().
2006-08-15 20:00:58 +00:00
- Remove old selopt rules.
2006-08-07 17:25:46 +00:00
- Full support for netfilter_contexts.
- MRTG patch for daemon operation from Stefan.
- Add authlogin interface to abstract common access for login programs.
- Remove setbool auditallow, except for RHEL4.
- Change eventpollfs to task SID labeling.
2006-06-21 21:02:49 +00:00
- Add key support from Michael LeMay.
2006-06-13 18:17:34 +00:00
- Add ftpdctl domain to ftp, from Paul Howarth.
- Fix build system to not move type declarations out of optionals.
2006-05-29 14:16:22 +00:00
- Add gcc-config domain to portage.
2006-05-23 18:31:02 +00:00
- Add packet object class and support in corenetwork.
- Add a copy of genhomedircon for monolithic policy building, so that a
policycoreutils package update is not required for RHEL4 systems.
2006-05-04 20:42:06 +00:00
- Add appletalk sockets for use in cups.
- Add Make target to validate module linking.
- Make duplicate template and interface declarations a fatal error.
- Patch to stabilize modules.conf `make conf` output, from Erich Schubert.
2006-04-06 19:27:41 +00:00
- Move xconsole_device_t from devices to xserver since it is
not actually a device, it is a named pipe.
- Handle nonexistant .fc and .if files in devel Makefile by
automatically creating empty files.
2006-04-06 15:14:11 +00:00
- Remove unused devfs_control_t.
2006-03-31 14:28:45 +00:00
- Add rhel4 distro, which also implies redhat distro.
2006-03-30 14:58:16 +00:00
- Remove unneeded range_transition for su_exec_t and move the
type declaration back to the su module.
- Constrain transitions in MCS so unconfined_t cannot have
arbitrary category sets.
2006-03-29 14:53:58 +00:00
- Change reiserfs from xattr filesystem to genfscon as it's xattrs
are currently nonfunctional.
2006-03-29 19:55:30 +00:00
- Change files and filesystem modules to use their own interfaces.
2006-03-28 18:29:52 +00:00
- Add user fonts to xserver.
- Additional interfaces in corecommands, miscfiles, and userdomain
from Joy Latten.
- Miscellaneous fixes from Thomas Bleher.
- Deprecate module name as first parameter of optional_policy()
now that optionals are allowed everywhere.
2006-03-23 21:07:57 +00:00
- Enable optional blocks in base module and monolithic policy.
This requires checkpolicy 1.30.1.
2006-03-23 19:59:36 +00:00
- Fix vpn module declaration.
- Numerous fixes from Dan Walsh.
- Change build order to preserve m4 line number information so policy
compile errors are useful again.
- Additional MLS interfaces from Chad Hanson.
- Move some rules out of domain_type() and domain_base_type()
to the TE file, to use the domain attribute to take advantage
of space savings from attribute use.
- Add global stack smashing protector rule for urandom access from
Petre Rodan.
- Fix temporary rules at the bottom of portmap.
2006-03-13 15:36:38 +00:00
- Updated comments in mls file from Chad Hanson.
2006-06-21 19:07:32 +00:00
- Patches from Dan Walsh:
Fri, 17 Mar 2006
Wed, 29 Mar 2006
Tue, 11 Apr 2006
Fri, 14 Apr 2006
Tue, 18 Apr 2006
Thu, 20 Apr 2006
Tue, 02 May 2006
Mon, 15 May 2006
Thu, 18 May 2006
Tue, 06 Jun 2006
Mon, 12 Jun 2006
Tue, 20 Jun 2006
2006-08-02 19:56:32 +00:00
Wed, 26 Jul 2006
Wed, 23 Aug 2006
Thu, 31 Aug 2006
Fri, 01 Sep 2006
Tue, 05 Sep 2006
Wed, 20 Sep 2006
Fri, 22 Sep 2006
Mon, 25 Sep 2006
2006-03-07 18:07:15 +00:00
- Added modules:
2006-05-05 17:53:45 +00:00
afs
amavis (Erich Schubert)
2006-03-08 18:43:05 +00:00
apt (Erich Schubert)
2006-04-18 13:44:07 +00:00
asterisk
2006-03-21 18:50:58 +00:00
audioentropy
2006-04-27 18:11:26 +00:00
authbind
2006-04-24 18:58:46 +00:00
backup
2006-03-21 20:12:24 +00:00
calamaris
2006-03-24 19:22:19 +00:00
cipe
clamav (Erich Schubert)
2006-05-08 14:16:10 +00:00
clockspeed (Petre Rodan)
2006-04-11 20:47:56 +00:00
courier
2006-03-31 22:09:27 +00:00
dante
2006-05-04 17:44:26 +00:00
dcc
2006-04-25 17:50:31 +00:00
ddclient
2006-03-08 18:43:05 +00:00
dpkg (Erich Schubert)
2006-04-25 14:45:14 +00:00
dnsmasq
2006-03-14 21:54:26 +00:00
ethereal
2006-03-13 21:36:49 +00:00
evolution
2006-03-21 18:07:53 +00:00
games
2006-04-18 20:35:09 +00:00
gatekeeper
2006-04-24 20:21:27 +00:00
gift
This patch adds a GConf policy to refpolicy. This policy is much tighter than the GConf policy from the old example policy. It only allows gconfd to access configuration data stored by GConf. Users can modify configuration data using gconftool-2 or gconf-editor, both of which use gconfd. GConf manages multiple configuration sources, so gconfd should be used to make any changes anyway. Normal users who aren't trying to directly edit the configuration data of GConf won't notice anything different. There is also a difference between this policy and the old example policy in handling directories in /tmp. The old example policy labeled /tmp/gconfd-USER with ROLE_gconfd_tmp_t, but, since there was no use of the file_type_auto_trans macro, if that directory was deleted gconfd would create one labeled as tmp_t. This policy uses the files_tmp-filetrans macro to cause a directory in /tmp created by gconfd to be labeled as $1_tmp_t. It is not labeled with $1_gconf_tmp_t, because if /tmp/orbit-USER is deleted, gconfd will create it (through use of ORBit) and it would get the $1_gconf_tmp_t label. By having gconfd create $1_tmp_t directories in /tmp and $1_gconf_tmp_t files and directories in directories labeled with $1_tmp_t, it can control its data without requiring any future bonobo or Gnome policies to have access to $1_gconf_tmp_t. This patch is related to work that I am doing in making gconfd an userspace object manager. If any user program can modify the configuration data that GConf stores, than making gconfd an userspace object manager would be useless. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2006-10-02 15:22:48 +00:00
gnome (James Carter)
2006-04-25 15:33:44 +00:00
imaze
2006-04-28 19:23:17 +00:00
ircd
2006-04-12 20:10:47 +00:00
jabber
2006-05-01 19:45:30 +00:00
monop
2006-03-13 19:24:52 +00:00
mozilla
2006-03-09 20:28:51 +00:00
mplayer
2006-04-28 15:50:06 +00:00
munin
2006-04-06 15:03:23 +00:00
nagios
2006-04-05 20:27:25 +00:00
nessus
netlabel (Paul Moore)
2006-04-27 19:41:35 +00:00
nsd
2006-04-18 13:44:07 +00:00
ntop
2006-05-09 15:12:17 +00:00
nx
2006-05-02 19:42:04 +00:00
oav
oddjob (Dan Walsh)
2006-05-02 17:42:41 +00:00
openca
2006-04-14 20:07:01 +00:00
openvpn (Petre Rodan)
2006-04-12 19:24:21 +00:00
perdition
2006-05-05 18:51:42 +00:00
portslave
2006-04-05 18:07:51 +00:00
postgrey
2006-04-05 19:31:34 +00:00
pxe
pyzor (Dan Walsh)
2006-04-05 15:32:38 +00:00
qmail (Petre Rodan)
2006-05-05 19:26:50 +00:00
razor
2006-04-14 19:13:17 +00:00
resmgr
2006-03-09 19:02:29 +00:00
rhgb
2006-04-25 19:17:43 +00:00
rssh
2006-04-05 18:53:26 +00:00
snort
2006-04-25 15:13:59 +00:00
soundserver
2006-04-12 18:22:54 +00:00
speedtouch
2006-05-01 20:36:13 +00:00
sxid
2006-03-08 20:09:42 +00:00
thunderbird
2006-03-07 18:07:15 +00:00
tor (Erich Schubert)
2006-04-12 18:02:55 +00:00
transproxy
2006-04-24 18:00:32 +00:00
tripwire
2006-04-12 17:41:28 +00:00
uptime
2006-04-07 19:37:16 +00:00
uwimap
2006-04-26 18:18:29 +00:00
vmware
2006-04-28 20:20:40 +00:00
watchdog
xen (Dan Walsh)
2006-04-07 20:53:39 +00:00
xprint
2006-04-28 18:30:02 +00:00
yam
2006-03-07 18:07:15 +00:00
2006-03-07 14:29:51 +00:00
* Tue Mar 07 2006 Chris PeBenito <selinux@tresys.com> - 20060307
- Make all interface parameters required.
- Move boot_t, system_map_t, and modules_object_t to files module,
and move bootloader to admin layer.
- Add semanage policy for semodule from Dan Walsh.
- Remove allow_execmem from targeted policy domain_base_type().
2006-02-15 21:58:41 +00:00
- Add users_extra and seusers support.
2006-02-14 20:55:45 +00:00
- Postfix fixes from Serge Hallyn.
2006-02-13 20:06:05 +00:00
- Run python and shell directly to interpret scripts so policy
sources need not be executable.
- Add desc tag XML to booleans and tunables, and add summary
to param XML tag, to make future translations possible.
2006-02-03 16:21:06 +00:00
- Remove unused lvm_vg_t.
2006-02-01 14:20:36 +00:00
- Many interface renames to improve naming consistency.
2006-01-30 22:51:35 +00:00
- Merge xdm into xserver.
- Remove kernel module reversed interfaces.
- Add filename attribute to module XML tag and lineno attribute to
interface XML tag.
- Changed QUIET build option to a yes or no option.
- Add a Makefile used for compiling loadable modules in a
user's development environment, building against policy headers.
- Add Make target for installing policy headers.
- Separate per-userdomain template expansion from the userdomain
module and add infrastructure to expand templates in the modules
that own the template.
- Enable secadm only for MLS policies.
2006-01-25 19:40:21 +00:00
- Remove role change rules in su and sudo since this functionality has been
removed from these programs.
- Add ctags Make target from Thomas Bleher.
- Collapse commands with grep piped to sed into one sed command.
2006-01-20 22:05:40 +00:00
- Fix type_change bug in term_user_pty().
2006-01-20 19:36:54 +00:00
- Move ice_tmp_t from miscfiles to xserver.
2006-01-19 22:47:40 +00:00
- Login fixes from Serge Hallyn.
2006-01-19 22:01:48 +00:00
- Move xserver_log_t from xdm to xserver.
2006-01-18 22:26:26 +00:00
- Add lpr per-userdomain policy to lpd.
2006-01-18 18:45:23 +00:00
- Miscellaneous fixes from Dan Walsh.
- Change initrc_var_run_t interface noun from script_pid to utmp,
for greater clarity.
2006-01-17 23:01:14 +00:00
- Added modules:
2006-01-18 19:09:48 +00:00
certwatch
mono (Dan Walsh)
2006-01-31 21:43:09 +00:00
mrtg
2006-01-18 14:48:24 +00:00
portage
2006-02-01 15:11:43 +00:00
tvtime
2006-01-18 16:40:04 +00:00
userhelper
2006-01-17 23:01:14 +00:00
usernetctl
wine (Dan Walsh)
2006-01-19 22:01:48 +00:00
xserver
2006-01-17 23:01:14 +00:00
2006-01-17 20:16:16 +00:00
* Tue Jan 17 2006 Chris PeBenito <selinux@tresys.com> - 20060117
2006-01-16 18:48:57 +00:00
- Adds support for generating corenetwork interfaces based on attributes
in addition to types.
- Permits the listing of multiple nodes in a network_node() that will be
given the same type.
- Add two new permission sets for stream sockets.
- Rename file type transition interfaces verb from create to
filetrans to differentiate it from create interfaces without
type transitions.
- Fix expansion of interfaces from disabled modules.
- Rsync can be long running from init,
added rules to allow this.
2006-01-10 21:03:16 +00:00
- Add polyinstantiation build option.
- Add setcontext to the association object class.
2005-12-12 21:47:43 +00:00
- Add apache relay and db connect tunables.
- Rename texrel_shlib_t to textrel_shlib_t.
- Add swat to samba module.
2006-01-11 23:20:28 +00:00
- Numerous miscellaneous fixes from Dan Walsh.
2005-12-08 15:01:57 +00:00
- Added modules:
2006-01-12 16:00:55 +00:00
alsa
2005-12-09 20:08:10 +00:00
automount
2006-01-12 23:23:22 +00:00
cdrecord
daemontools (Petre Rodan)
2006-01-04 16:29:11 +00:00
ddcprobe
djbdns (Petre Rodan)
2005-12-08 15:58:12 +00:00
fetchmail
2006-01-06 19:46:44 +00:00
irc
2006-01-12 22:26:46 +00:00
java
2006-01-11 20:18:56 +00:00
lockdev
2006-01-10 14:39:21 +00:00
logwatch (Dan Walsh)
2006-01-04 18:32:22 +00:00
openct
2006-01-11 23:20:28 +00:00
prelink (Dan Walsh)
publicfile (Petre Rodan)
2006-01-04 19:31:53 +00:00
readahead
2006-01-11 20:03:21 +00:00
roundup
2006-01-11 18:10:49 +00:00
screen
2006-01-16 14:58:58 +00:00
slocate (Dan Walsh)
2006-01-04 20:44:30 +00:00
slrnpull
2006-01-04 15:26:42 +00:00
smartmon
2005-12-08 15:01:57 +00:00
sysstat
ucspitcp (Petre Rodan)
2006-01-11 18:28:57 +00:00
usbmodules
vbetool (Dan Walsh)
2005-12-08 15:01:57 +00:00
2005-12-07 15:44:05 +00:00
* Wed Dec 07 2005 Chris PeBenito <selinux@tresys.com> - 20051207
2005-12-07 16:38:24 +00:00
- Add unlabeled IPSEC association rule to domains with
networking permissions.
2005-12-05 20:31:54 +00:00
- Merge systemuser back in to users, as these files
do not need to be split.
- Add check for duplicate interface/template definitions.
- Move domain, files, and corecommands modules to kernel
layer to resolve some layering inconsistencies.
- Move policy build options out of Makefile into build.conf.
2005-11-28 16:44:51 +00:00
- Add yppasswd to nis module.
- Change optional_policy() to refer to the module name
rather than modulename.te.
2005-11-22 22:07:12 +00:00
- Fix labeling targets to use installed file_contexts rather
than partial file_contexts in the policy source directory.
- Fix build process to use make's internal vpath functions
to detect modules rather than using subshells and find.
- Add install target for modular policy.
- Add load target for modular policy.
- Add appconfig dependency to the load target.
2005-11-22 17:56:53 +00:00
- Miscellaneous fixes from Dan Walsh.
- Fix corenetwork gen_context()'s to expand during the policy
build phase instead of during the generation phase.
- Added policies:
2005-10-22 19:58:58 +00:00
amanda
2005-11-09 17:12:34 +00:00
avahi
2005-10-21 16:39:28 +00:00
canna
2005-10-21 16:18:11 +00:00
cyrus
2005-10-22 21:18:03 +00:00
dbskk
2005-10-21 15:38:22 +00:00
dovecot
distcc
2005-12-01 18:50:00 +00:00
i18n_input
2005-11-28 19:06:22 +00:00
irqbalance
2005-10-22 21:09:03 +00:00
lpd
2005-10-22 17:44:04 +00:00
networkmanager
2005-10-22 21:55:39 +00:00
pegasus
2005-10-23 20:18:36 +00:00
postfix
2005-11-15 20:17:18 +00:00
procmail
2005-10-22 22:51:14 +00:00
radius
2005-11-28 17:46:29 +00:00
rdisc
2005-10-24 01:53:13 +00:00
rpc
2005-10-22 23:50:23 +00:00
spamassassin
2005-11-28 18:29:03 +00:00
timidity
2005-10-21 17:55:15 +00:00
xdm
2005-11-25 19:09:08 +00:00
xfs
2005-10-19 21:18:25 +00:00
* Wed Oct 19 2005 Chris PeBenito <selinux@tresys.com> - 20051019
2005-10-19 20:18:21 +00:00
- Many fixes to make loadable modules build.
2005-10-12 19:13:49 +00:00
- Add targets for sechecker.
- Updated to sedoctool to read bool files and tunable
files separately.
- Changed the xml tag of <boolean> to <bool> to be consistent
with gen_bool().
- Modified the implementation of segenxml to use regular
expressions.
- Rename context_template() to gen_context() to clarify
that its not a Reference Policy template, but a support
macro.
2005-09-27 20:17:50 +00:00
- Add disable_*_trans bool support for targeted policy.
2005-09-26 20:26:32 +00:00
- Add MLS module to handle MLS constraint exceptions,
such as reading up and writing down.
2005-09-22 21:59:50 +00:00
- Fix errors uncovered by sediff.
2005-09-23 19:38:34 +00:00
- Added policies:
2005-09-23 22:15:04 +00:00
anaconda
2005-10-17 17:55:38 +00:00
apache
apm
arpwatch
2005-10-07 21:45:04 +00:00
bluetooth
2005-09-27 21:24:01 +00:00
dmidecode
2005-10-07 21:45:04 +00:00
finger
2005-10-05 19:52:53 +00:00
ftp
2005-09-23 19:38:34 +00:00
kudzu
2005-10-11 15:36:53 +00:00
mailman
2005-10-14 20:00:07 +00:00
ppp
radvd
2005-10-10 18:50:08 +00:00
sasl
webalizer
2005-09-22 21:59:50 +00:00
2005-09-22 19:05:26 +00:00
* Thu Sep 22 2005 Chris PeBenito <selinux@tresys.com> - 20050922
2005-09-21 14:49:41 +00:00
- Make logrotate, sendmail, sshd, and rpm policies
unconfined in the targeted policy so no special
modules.conf is required.
2005-09-16 13:36:26 +00:00
- Add experimental MCS support.
2005-09-20 14:20:02 +00:00
- Add appconfig for MLS.
2005-09-15 21:03:29 +00:00
- Add equivalents for old can_resolve(), can_ldap(), and
can_portmap() to sysnetwork.
2005-09-12 15:58:44 +00:00
- Fix base module compile issues.
2005-09-08 13:42:13 +00:00
- Added policies:
2005-09-20 18:15:35 +00:00
cpucontrol
2005-09-20 18:49:13 +00:00
cvs
2005-09-08 13:42:13 +00:00
ktalk
2005-09-08 17:12:38 +00:00
portmap
2005-09-19 21:17:45 +00:00
postgresql
2005-09-20 17:11:53 +00:00
rlogin
2005-09-14 18:33:53 +00:00
samba
2005-09-16 14:54:36 +00:00
snmp
2005-09-20 13:47:36 +00:00
stunnel
2005-09-20 17:11:53 +00:00
telnet
2005-09-16 15:18:09 +00:00
tftp
2005-09-22 16:27:52 +00:00
uucp
2005-09-19 21:17:45 +00:00
vpn
zebra
2005-09-08 13:42:13 +00:00
2005-09-07 16:15:51 +00:00
* Wed Sep 07 2005 Chris PeBenito <selinux@tresys.com> - 20050907
2005-09-02 20:55:17 +00:00
- Fix errors uncovered by sediff.
- Doc tool will explicitly say a module does not have interfaces
or templates on the module page.
- Added policies:
comsat
2005-08-31 20:58:12 +00:00
dbus
2005-09-02 19:18:43 +00:00
dhcp
2005-09-02 20:50:54 +00:00
dictd
2005-09-02 20:29:52 +00:00
hal
2005-09-06 18:37:27 +00:00
inn
2005-09-05 16:47:19 +00:00
ntp
2005-09-02 19:11:07 +00:00
squid
2005-08-26 15:02:23 +00:00
* Fri Aug 26 2005 Chris PeBenito <selinux@tresys.com> - 20050826
2005-08-24 20:18:06 +00:00
- Add Makefile support for building loadable modules.
- Add genclassperms.py tool to add require blocks
for loadable modules.
- Change sedoctool to make required modules part of base
by default, otherwise make as modules, in modules.conf.
- Fix segenxml to handle modules with no interfaces.
- Rename ipsec connect interface for consistency.
- Add missing parts of unix stream socket connect interface
of ipsec.
- Rename inetd connect interface for consistency.
- Rename interface for purging contents of tmp, for clarity,
since it allows deletion of classes other than file.
- Misc. cleanups.
- Added policies:
acct
bind
firstboot
gpm
howl
ldap
loadkeys
mysql
privoxy
quota
rshd
rsync
su
sudo
tcpd
tmpreaper
updfstab
2005-08-24 20:18:06 +00:00
* Tue Aug 2 2005 Chris PeBenito <selinux@tresys.com> - 20050802
- Fix comparison bug in fc_sort.
- Fix handling of ordered and unordered HTML lists.
- Corenetwork now supports multiple network interfaces having the
same type.
- Doc tool now creates pages for global Booleans and global tunables.
- Doc tool now links directly to the interface/template in the
module page when it is selected in the interface/template index.
- Added support for layer summaries.
- Added policies:
ipsec
nscd
pcmcia
raid
2005-08-24 20:18:06 +00:00
* Thu Jul 7 2005 Chris PeBenito <selinux@tresys.com> - 20050707
- Changed xml to have modules encapsulated by layer tags, rather
than putting layer="foo" in the module tags. Also in the future
we can put a summary and description for each layer.
- Added tool to infer interface, module, and layer tags. This will
now list all interfaces, even if they are missing xml docs.
- Shortened xml tag names.
- Added macros to declare interfaces and templates.
- Added interface call trace.
- Updated all xml documentation for shorter and inferred tags.
- Doc tool now displays templates in the web pages.
- Doc tool retains the user's settings in modules.conf and
tunables.conf if the files already exist.
- Modules.conf behavior has been changed to be a list of all
available modules, and the user can specify if the module is
built as a loadable module, included in the monolithic policy,
or excluded.
- Added policies:
fstools (fsck, mkfs, swapon, etc. tools)
logrotate
inetd
kerberos
nis (ypbind and ypserv)
ssh (server, client, and agent)
unconfined
- Added infrastructure for targeted policy support, only missing
transition boolean support.
2005-07-07 17:13:17 +00:00
2005-08-24 20:18:06 +00:00
* Wed Jun 15 2005 Chris PeBenito <selinux@tresys.com> - 20050615
- Initial release