import selinux-policy-3.14.3-79.el8
This commit is contained in:
CentOS Sources
Stepan Oksanichenko
parent
dca2cf68db
commit
410c78c03b
4
.gitignore
vendored
4
.gitignore
vendored
@ -1,3 +1,3 @@
|
||||
SOURCES/container-selinux.tgz
|
||||
SOURCES/selinux-policy-33fd484.tar.gz
|
||||
SOURCES/selinux-policy-contrib-4beb213.tar.gz
|
||||
SOURCES/selinux-policy-8f56f63.tar.gz
|
||||
SOURCES/selinux-policy-contrib-2a53cd0.tar.gz
|
||||
|
||||
@ -1,3 +1,3 @@
|
||||
99c5dc0dbb5f824b2cc29d18e8911401677e0bb1 SOURCES/container-selinux.tgz
|
||||
4da13e377b1e178962423475a04832ed39581394 SOURCES/selinux-policy-33fd484.tar.gz
|
||||
45d3dbd0265f43953376baacdbc070a566eb429b SOURCES/selinux-policy-contrib-4beb213.tar.gz
|
||||
0d1a0214195d9519327846c21d7ac90b7da218c1 SOURCES/container-selinux.tgz
|
||||
672cfe526149ad56c857a79856e769548d9ead8e SOURCES/selinux-policy-8f56f63.tar.gz
|
||||
6e84adfa8c88519a3c24f6f8426d59868bcd6050 SOURCES/selinux-policy-contrib-2a53cd0.tar.gz
|
||||
|
||||
@ -17,3 +17,4 @@
|
||||
/var/roothome /root
|
||||
/sbin /usr/sbin
|
||||
/sysroot/tmp /tmp
|
||||
/var/usrlocal /usr/local
|
||||
|
||||
@ -720,13 +720,6 @@ git = module
|
||||
#
|
||||
glance = module
|
||||
|
||||
# Layer: contrib
|
||||
# Module: glusterd
|
||||
#
|
||||
# policy for glusterd service
|
||||
#
|
||||
glusterd = module
|
||||
|
||||
# Layer: apps
|
||||
# Module: gnome
|
||||
#
|
||||
@ -2012,7 +2005,7 @@ timidity = off
|
||||
tmpreaper = module
|
||||
|
||||
# Layer: contrib
|
||||
# Module: glusterd
|
||||
# Module: tomcat
|
||||
#
|
||||
# policy for tomcat service
|
||||
#
|
||||
|
||||
@ -1,11 +1,11 @@
|
||||
# github repo with selinux-policy base sources
|
||||
%global git0 https://github.com/fedora-selinux/selinux-policy
|
||||
%global commit0 33fd4847deb2522105cfba82da5efb707025934c
|
||||
%global commit0 8f56f631a921d043bc8176f7c64a38cd77b48f66
|
||||
%global shortcommit0 %(c=%{commit0}; echo ${c:0:7})
|
||||
|
||||
# github repo with selinux-policy contrib sources
|
||||
%global git1 https://github.com/fedora-selinux/selinux-policy-contrib
|
||||
%global commit1 4beb213356f6020d4ea6635dda6842cef88fb357
|
||||
%global commit1 2a53cd02bd0d06568ecc549b15321f658d00babd
|
||||
%global shortcommit1 %(c=%{commit1}; echo ${c:0:7})
|
||||
|
||||
%define distro redhat
|
||||
@ -29,7 +29,7 @@
|
||||
Summary: SELinux policy configuration
|
||||
Name: selinux-policy
|
||||
Version: 3.14.3
|
||||
Release: 65%{?dist}
|
||||
Release: 79%{?dist}
|
||||
License: GPLv2+
|
||||
Source: %{git0}/archive/%{commit0}/%{name}-%{shortcommit0}.tar.gz
|
||||
Source29: %{git1}/archive/%{commit1}/%{name}-contrib-%{shortcommit1}.tar.gz
|
||||
@ -715,6 +715,220 @@ exit 0
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Fri Aug 27 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-79
|
||||
- Introduce xdm_manage_bootloader booelan
|
||||
Resolves: rhbz#1994096
|
||||
- Rename samba_exec() to samba_exec_net()
|
||||
Resolves: rhbz#1855215
|
||||
- Allow sssd to set samba setting
|
||||
Resolves: rhbz#1855215
|
||||
- Allow dirsrv read slapd tmpfs files
|
||||
Resolves: rhbz#1843238
|
||||
- Allow rhsmcertd to create cache file in /var/cache/cloud-what
|
||||
Resolves: rhbz#1994718
|
||||
|
||||
* Wed Aug 25 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-78
|
||||
- Label /usr/bin/Xwayland with xserver_exec_t
|
||||
Resolves: rhbz#1984584
|
||||
- Label /usr/libexec/gdm-runtime-config with xdm_exec_t
|
||||
Resolves: rhbz#1984584
|
||||
- Allow D-bus communication between avahi and sosreport
|
||||
Resolves: rhbz#1916397
|
||||
- Allow lldpad send to kdumpctl over a unix dgram socket
|
||||
Resolves: rhbz#1979121
|
||||
- Revert "Allow lldpad send to kdump over a unix dgram socket"
|
||||
Resolves: rhbz#1979121
|
||||
- Allow chronyc respond to a user chronyd instance
|
||||
Resolves: rhbz#1993104
|
||||
- Allow ptp4l respond to pmc
|
||||
Resolves: rhbz#1993104
|
||||
- Allow lldpad send to unconfined_t over a unix dgram socket
|
||||
Resolves: rhbz#1993270
|
||||
|
||||
* Thu Aug 12 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-77
|
||||
- Revert "update libs_filetrans_named_content() to have support for /usr/lib/debug directory"
|
||||
Resolves: rhbz#1887739
|
||||
- Allow sysadm to read/write scsi files and manage shadow
|
||||
Resolves: rhbz#1956302
|
||||
- Allow rhsmcertd execute gpg
|
||||
Resolves: rhbz#1887572
|
||||
- Allow lldpad send to kdump over a unix dgram socket
|
||||
Resolves: rhbz#1979121
|
||||
- Remove glusterd SELinux module from distribution policy
|
||||
Resolves: rhbz#1816718
|
||||
|
||||
* Tue Aug 10 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-76
|
||||
- Allow login_userdomain read and map /var/lib/systemd files
|
||||
Resolves: rhbz#1965251
|
||||
- Allow sysadm acces to kernel module resources
|
||||
Resolves: rhbz#1965251
|
||||
- Allow sysadm to read/write scsi files and manage shadow
|
||||
Resolves: rhbz#1965251
|
||||
- Allow sysadm access to files_unconfined and bind rpc ports
|
||||
Resolves: rhbz#1965251
|
||||
- Allow sysadm read and view kernel keyrings
|
||||
Resolves: rhbz#1965251
|
||||
- Allow bootloader to read tuned etc files
|
||||
Resolves: rhbz#1965251
|
||||
- Update the policy for systemd-journal-upload
|
||||
Resolves: rhbz#1913414
|
||||
- Allow journal mmap and read var lib files
|
||||
Resolves: rhbz#1965251
|
||||
- Allow tuned to read rhsmcertd config files
|
||||
Resolves: rhbz#1965251
|
||||
- Allow bootloader to read tuned etc files
|
||||
Resolves: rhbz#1965251
|
||||
- Confine rhsm service and rhsm-facts service as rhsmcertd_t
|
||||
Resolves: rhbz#1846081
|
||||
- Allow virtlogd_t read process state of user domains
|
||||
Resolves: rhbz#1797899
|
||||
- Allow cockpit_ws_t get attributes of fs_t filesystems
|
||||
Resolves: rhbz#1979182
|
||||
|
||||
* Thu Jul 29 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-75
|
||||
- Add the unconfined_dgram_send() interface
|
||||
Resolves: rhbz#1978562
|
||||
- Change dev_getattr_infiniband_dev() to use getattr_chr_files_pattern()
|
||||
Resolves: rhbz#1936522
|
||||
- Add checkpoint_restore cap2 capability
|
||||
Resolves: rhbz#1973325
|
||||
- Allow fcoemon talk with unconfined user over unix domain datagram socket
|
||||
Resolves: rhbz#1978562
|
||||
- Allow hostapd bind UDP sockets to the dhcpd port
|
||||
Resolves: rhbz#1977676
|
||||
- Allow NetworkManager read and write z90crypt device
|
||||
Resolves: rhbz#1938203
|
||||
- Allow abrt_domain read and write z90crypt device
|
||||
Resolves: rhbz#1938203
|
||||
- Label /usr/lib/pcs/pcs_snmp_agent with cluster_exec_t
|
||||
Resolves: rhbz#1937111
|
||||
- Allow mdadm read iscsi pid files
|
||||
Resolves: rhbz#1924716
|
||||
|
||||
* Fri Jul 16 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-74
|
||||
- Allow dyntransition from sshd_t to unconfined_t
|
||||
Resolves: rhbz#1947841
|
||||
|
||||
* Wed Jul 14 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-73
|
||||
- Removed adding to attribute unpriv_userdomain from userdom_unpriv_type template
|
||||
Resolves: rhbz#1947841
|
||||
- Allow transition from xdm domain to unconfined_t domain.
|
||||
Resolves: rhbz#1947841
|
||||
- Allow nftables read NetworkManager unnamed pipes
|
||||
Resolves: rhbz#1967857
|
||||
- Create a policy for systemd-journal-upload
|
||||
Resolves: rhbz#1913414
|
||||
- Add dev_getattr_infiniband_dev() interface.
|
||||
Resolves: rhbz#1972522
|
||||
- Allow tcpdump and nmap get attributes of infiniband_device_t
|
||||
Resolves: rhbz#1972522
|
||||
- Allow fcoemon create sysfs files
|
||||
Resolves: rhbz#1978562
|
||||
- Allow nftables read NetworkManager unnamed pipes
|
||||
Resolves: rhbz#1967857
|
||||
- Allow radius map its library files
|
||||
Resolves: rhbz#1854650
|
||||
- Allow arpwatch get attributes of infiniband_device_t devices
|
||||
Resolves: rhbz#1936522
|
||||
|
||||
* Tue Jun 29 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-72
|
||||
- Allow systemd-sleep get attributes of fixed disk device nodes
|
||||
Resolves: rhbz#1931460
|
||||
- Allow systemd-sleep create hardware state information files
|
||||
Resolves: rhbz#1968610
|
||||
- virtiofs supports Xattrs and SELinux
|
||||
Resolves: rhbz#1899703
|
||||
- Label 4460/tcp port as ntske_port_t
|
||||
Resolves: rhbz#1961207
|
||||
- Add the miscfiles_map_generic_certs macro to the sysnet_dns_name_resolve macro.
|
||||
Resolves: rhbz#1961207
|
||||
- Allow chronyd_t to accept and make NTS-KE connections
|
||||
Resolves: rhbz#1961207
|
||||
- Dontaudit NetworkManager write to initrc_tmp_t pipes
|
||||
Resolves: rhbz#1963162
|
||||
- Allow logrotate rotate container log files
|
||||
Resolves: rhbz#1892170
|
||||
- Allow rhsmd read process state of all domains and kernel threads
|
||||
Resolves: rhbz#1878020
|
||||
|
||||
* Tue Jun 15 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-71
|
||||
- Allow nmap create and use rdma socket
|
||||
Resolves: rhbz#1844530
|
||||
- Label /.k5identity file allow read of this file to rpc.gssd
|
||||
Resolves: rhbz#1951093
|
||||
- Label /var/lib/kdump with kdump_var_lib_t
|
||||
Resolves: rhbz#1965985
|
||||
- Label /run/libvirt/common with virt_common_var_run_t
|
||||
Resolves: rhbz#1966842
|
||||
|
||||
* Wed Jun 09 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-70
|
||||
- Allow using opencryptoki for ipsec
|
||||
Resolves: rhbz#1894132
|
||||
- Remove all kernel_getattr_proc() interface calls
|
||||
Resolves: rhbz#1967125
|
||||
- Allow domain stat /proc filesystem
|
||||
Resolves: rhbz#1967125
|
||||
- Allow pkcs-slotd create and use netlink_kobject_uevent_socket
|
||||
Resolves: rhbz#1969725
|
||||
- Label var.lib.opencryptoki.* files and create pkcs_tmpfs_filetrans()
|
||||
Resolves: rhbz#1894132
|
||||
- Allow using opencryptoki for certmonger
|
||||
Resolves: rhbz#1894132
|
||||
- install_t: Allow NoNewPriv transition from systemd
|
||||
Resolves: rhbz#1955547
|
||||
- Remove all kernel_getattr_proc() interface calls
|
||||
Resolves: rhbz#1967125
|
||||
- Allow httpd_sys_script_t read, write, and map hugetlbfs files
|
||||
Resolves: rhbz#1966133
|
||||
|
||||
* Wed Jun 02 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-69
|
||||
- Add /var/usrlocal equivalency rule
|
||||
Resolves: rhbz#1943381
|
||||
- Label '/var/usrlocal/(.*/)?sbin(/.*)?' as bin_t
|
||||
Resolves: rhbz#1943381
|
||||
- Label /dev/trng with random_device_t
|
||||
Resolves: rhbz#1934483
|
||||
- Allow systemd-sleep transition to sysstat_t
|
||||
Resolves: rhbz#1927551
|
||||
- Allow systemd-sleep transition to tlp_t
|
||||
Resolves: rhbz#1927551
|
||||
- Allow systemd-sleep transition to unconfined_service_t on bin_t executables
|
||||
Resolves: rhbz#1927551
|
||||
- Allow systemd-sleep execute generic programs
|
||||
Resolves: rhbz#1948070
|
||||
- Allow systemd-sleep execute shell
|
||||
Resolves: rhbz#1954358
|
||||
- Allow nsswitch_domain read init pid lnk_files
|
||||
Resolves: rhbz#1860924
|
||||
- Introduce logging_syslogd_list_non_security_dirs tunable
|
||||
Resolves: rhbz#1823669
|
||||
- Add sysstat_domtrans() to allow systemd-sleep transition to sysstat_t
|
||||
Resolves: rhbz#1927551
|
||||
- Change param description in cron interfaces to userdomain_prefix
|
||||
Resolves: rhbz#1801249
|
||||
- Add missing declaration in rpm_named_filetrans()
|
||||
Resolves: rhbz#1801249
|
||||
|
||||
* Thu May 20 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-68
|
||||
- Allow pluto IKEv2 / ESP over TCP
|
||||
Resolves: rhbz#1931848
|
||||
- Label SDC(scini) Dell Driver
|
||||
Resolves: rhbz#1936882
|
||||
- Add file context specification for /var/tmp/tmp-inst
|
||||
Resolves: rhbz#1919253
|
||||
- Allow virtlogd_t to create virt_var_lockd_t dir
|
||||
Resolves: rhbz#1941464
|
||||
- Allow cups-lpd read its private runtime socket files
|
||||
Resolves: rhbz#1919399
|
||||
|
||||
* Mon Mar 15 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-67
|
||||
- Allow systemd the audit_control capability conditionally
|
||||
Resolves: rhbz#1861771
|
||||
|
||||
* Thu Mar 04 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-66
|
||||
- Disallow user_t run su/sudo and staff_t run su
|
||||
Resolves: rhbz#1907517
|
||||
|
||||
* Mon Feb 22 2021 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-65
|
||||
- Relabel /usr/sbin/charon-systemd as ipsec_exec_t
|
||||
Resolves: rhbz#1889542
|
||||
|
||||
Loading…
Reference in New Issue
Block a user