rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity
76 Commits 9 Branches 105 Tags 34 MiB
1478384cd2
Commit Graph

76 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Nikola Knazekova
1478384cd2 Define LIBSEPOL version 3.4-1 
Resolves: rhbz#2095688
 2022-07-15 09:46:27 +02:00
Zdenek Pytela
ab0fff6428 * Wed Jun 29 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.37-1 
- Allow targetclid read /var/target files
Resolves: rhbz#2020169
- Update samba-dcerpcd policy for kerberos usage 2
Resolves: rhbz#2096521
- Allow samba-dcerpcd work with sssd
Resolves: rhbz#2096521
- Allow stalld set scheduling policy of kernel threads
Resolves: rhbz#2102224
 2022-06-29 16:10:16 +02:00
Zdenek Pytela
8d1d780d0b * Tue Jun 28 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.36-1 
- Allow targetclid read generic SSL certificates (fixed)
Resolves: rhbz#2020169
- Fix file context pattern for /var/target
Resolves: rhbz#2020169
- Use insights_client_etc_t in insights_search_config()
Resolves: rhbz#1965013
 2022-06-28 19:30:35 +02:00
Zdenek Pytela
64a29f1839 * Fri Jun 24 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.35-1 
-Add the corecmd_watch_bin_dirs() interface
Resolves: rhbz#1965013
- Update rhcd policy
Resolves: rhbz#1965013
- Allow rhcd search insights configuration directories
Resolves: rhbz#1965013
- Add the kernel_read_proc_files() interface
Resolves: rhbz#1965013
- Update insights_client_filetrans_named_content()
Resolves: rhbz#2081425
- Allow transition to insights_client named content
Resolves: rhbz#2081425
- Add the insights_client_filetrans_named_content() interface
Resolves: rhbz#2081425
- Update policy for insights-client to run additional commands 3
Resolves: rhbz#2081425
- Allow insights-client execute its private memfd: objects
Resolves: rhbz#2081425
- Update policy for insights-client to run additional commands 2
Resolves: rhbz#2081425
- Use insights_client_tmp_t instead of insights_client_var_tmp_t
Resolves: rhbz#2081425
- Change space indentation to tab in insights-client
Resolves: rhbz#2081425
- Use socket permissions sets in insights-client
Resolves: rhbz#2081425
- Update policy for insights-client to run additional commands
Resolves: rhbz#2081425
- Allow init_t to rw insights_client unnamed pipe
Resolves: rhbz#2081425
- Fix insights client
Resolves: rhbz#2081425
- Update kernel_read_unix_sysctls() for sysctl_net_unix_t handling
Resolves: rhbz#2081425
- Do not let system_cronjob_t create redhat-access-insights.log with var_log_t
Resolves: rhbz#2081425
- Allow stalld get scheduling policy of kernel threads
Resolves: rhbz#2096776
- Update samba-dcerpcd policy for kerberos usage
Resolves: rhbz#2096521
- Allow winbind_rpcd_t connect to self over a unix_stream_socket
Resolves: rhbz#2096255
- Allow dlm_controld send a null signal to a cluster daemon
Resolves: rhbz#2095884
- Allow dhclient manage pid files used by chronyd
The chronyd_manage_pid_files() interface was added.
- Resolves: rhbz#2094155
Allow install_t nnp_domtrans to setfiles_mac_t
- Resolves: rhbz#2073010
- Allow rabbitmq to use systemd notify
Resolves: rhbz#2056565
- Allow ksmctl create hardware state information files
Resolves: rhbz#2021131
- Label /var/target with targetd_var_t
Resolves: rhbz#2020169
- Allow targetclid read generic SSL certificates
Resolves: rhbz#2020169
 2022-06-24 23:45:04 +02:00
Zdenek Pytela
14f9935fa0 * Thu Jun 09 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.34-1 
- Allow stalld setsched and sys_nice
Resolves: rhbz#2092864
- Allow rhsmcertd to create cache file in /var/cache/cloud-what
Resolves: rhbz#2092333
- Update policy for samba-dcerpcd
Resolves: rhbz#2083509
- Add support for samba-dcerpcd
Resolves: rhbz#2083509
- Allow rabbitmq to access its private memfd: objects
Resolves: rhbz#2056565
- Confine targetcli
Resolves: rhbz#2020169
- Add policy for wireguard
Resolves: 1964862
- Label /var/cache/insights with insights_client_cache_t
Resolves: rhbz#2062136
- Allow ctdbd nlmsg_read on netlink_tcpdiag_socket
Resolves: rhbz#2094489
- Allow auditd_t noatsecure for a transition to audisp_remote_t
Resolves: rhbz#2081907
 2022-06-09 16:26:59 +02:00
Petr Lautrbach
1cc1f4ddfc Connect triggerin to pcre2 instead of pcre 
Resolves: rhbz#2090269
 2022-06-09 16:11:31 +02:00
Zdenek Pytela
e59ad3159d Add wireguard module to modules-targeted-contrib.conf 
Resolves: rhbz#1964862
 2022-06-09 16:01:15 +02:00
Zdenek Pytela
b3c14aca87 * Fri May 27 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.33-1 
- Allow insights-client manage gpg admin home content
Resolves: rhbz#2062136
- Add the gpg_manage_admin_home_content() interface
Resolves: rhbz#2062136
- Add rhcd policy
Resolves: bz#1965013
- Allow svirt connectto virtlogd
Resolves: rhbz#2000881
- Add ksm service to ksmtuned
Resolves: rhbz#2021131
- Allow nm-privhelper setsched permission and send system logs
Resolves: rhbz#2053639
- Update the policy for systemd-journal-upload
Resolves: rhbz#2085369
- Allow systemd-journal-upload watch logs and journal
Resolves: rhbz#2085369
- Create a policy for systemd-journal-upload
Resolves: rhbz#2085369
- Allow insights-client create and use unix_dgram_socket
Resolves: rhbz#2087765
- Allow insights-client search gconf homedir
Resolves: rhbz#2087765
 2022-05-27 17:19:07 +02:00
Zdenek Pytela
7b45c2b424 Add rhcd module to modules-targeted-contrib.conf 
Resolves: rhbz#1965013
 2022-05-27 16:58:53 +02:00
Zdenek Pytela
29a520ae24 * Wed May 11 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.32-1 
- Dontaudit guest attempts to dbus chat with systemd domains
Resolves: rhbz#2062740
- Dontaudit guest attempts to dbus chat with system bus types
Resolves: rhbz#2062740
- Fix users for SELinux userspace 3.4
Resolves: rhbz#2079290
- Removed adding to attribute unpriv_userdomain from userdom_unpriv_type template
Resolves: rhbz#2076681
- Allow systemd-sleep get removable devices attributes
Resolves: rhbz#2082404
- Allow systemd-sleep tlp_filetrans_named_content()
Resolves: rhbz#2082404
- Allow systemd-sleep execute generic programs
Resolves: rhbz#2082404
- Allow systemd-sleep execute shell
Resolves: rhbz#2082404
- Allow systemd-sleep transition to sysstat_t
Resolves: rhbz#2082404
- Allow systemd-sleep transition to tlp_t
Resolves: rhbz#2082404
- Allow systemd-sleep transition to unconfined_service_t on bin_t executables
Resolves: rhbz#2082404
- allow systemd-sleep to set timer for suspend-then-hibernate
Resolves: rhbz#2082404
- Add default fc specifications for patterns in /opt
Resolves: rhbz#2081059
- Use a named transition in systemd_hwdb_manage_config()
Resolves: rhbz#2061725
 2022-05-11 20:55:03 +02:00
Petr Lautrbach
527e11b6c8 Users have to be generated is policy/users to make 3.4 userspace happy 
Resolves: rhbz#2079290
 2022-05-11 20:41:36 +02:00
Nikola Knazekova
5fd82ec867 * Wed May 04 2022 Nikola Knazekova <nknazeko@redhat.com> - 34.1.31-2 
- Remove letter v from version
Related: rhbz#2061680
 2022-05-04 10:53:54 +02:00
Nikola Knazekova
e67d11e38d Mon May 02 2022 Nikola Knazekova <nknazeko@redhat.com> - v34.1.31-1 
- Label /var/run/machine-id as machineid_t
Resolves: rhbz#2061680
- Allow insights-client create_socket_perms for tcp/udp sockets
Resolves: rhbz#2077377
- Allow insights-client read rhnsd config files
Resolves: rhbz#2077377
- Allow rngd drop privileges via setuid/setgid/setcap
Resolves: rhbz#2076642
- Allow tmpreaper the sys_ptrace userns capability
Resolves: rhbz#2062823
- Add stalld to modules.conf
Resolves: rhbz#2042614
- New policy for stalld
Resolves: rhbz#2042614
- Label new utility of NetworkManager nm-priv-helper
Resolves: rhbz#2053639
- Exclude container.if from selinux-policy-devel
Resolves: rhbz#1861968
 2022-05-02 14:19:14 +02:00
Nikola Knazekova
637873d5ad Add stalld module to modules-targeted-contrib.conf 
Resolves: rhbz#2042614
 2022-05-02 14:10:20 +02:00
Nikola Knazekova
d5d18f13f7 Exclude container.if from selinux-policy-devel 
The container-selinux has been separated from selinux-policy,
but selinux-policy still contains the interface in selinux-policy-devel
subpackage, which can result in errors like

  $ make -f /usr/share/selinux/devel/Makefile init_t_audit_control.pp
/usr/share/selinux/devel/include/services/container.if:13:
Error: duplicate definition of container_runtime_domtrans(). Original definition on 13.

These errors are harmless as long as the content is the same, but
not packaging the interface in selinux-policy can entirely prevent these
errors from appearing.

Resolves: rhbz#2055890
 2022-05-02 13:59:29 +02:00
Zdenek Pytela
98a41b6a2c * Tue Apr 19 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.30-2 
- Update source branches to build a new package for RHEL 9.1.0
Resolves: rhbz#2070982
 2022-04-19 18:47:26 +02:00
Nikola Knazekova
5d8c009a98 Tue Apr 12 2022 Nikola Knazekova <nknazeko@redhat.com> - 34.1.30-1 
- Allow administrative users the bpf capability
Resolves: RHBZ#2070982

- Allow NetworkManager talk with unconfined user over unix domain dgram socket
Resolves: rhbz#2064688

- Allow hostapd talk with unconfined user over unix domain dgram socket
Resolves: rhbz#2064688

- Allow fprintd read and write hardware state information
Resolves: rhbz#2062911

- Allow fenced read kerberos key tables
Resolves: RHBZ#2060722

- Allow init watch and watch_reads user ttys
Resolves: rhbz#2060289

- Allow systemd watch and watch_reads console devices
Resolves: rhbz#2060289

- Allow nmap create and use rdma socket
Resolves: RHBZ#2059603
 2022-04-13 16:04:11 +02:00
Zdenek Pytela
d16a3024e0 * Thu Mar 31 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.29-1 
- Allow qemu-kvm create and use netlink rdma sockets
Resolves: rhbz#2070569
- Label corosync-cfgtool with cluster_exec_t
Resolves: rhbz#2067501
 2022-04-11 11:32:30 +02:00
Zdenek Pytela
cab4d847c2 * Thu Mar 24 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.28-1 
- Allow logrotate a domain transition to cluster administrative domain
Resolves: rhbz#2061277
- Change the selinuxuser_execstack boolean value to true
Resolves: rhbz#2064274
 2022-04-07 12:24:20 +02:00
Zdenek Pytela
d0c8cc2186 Change the selinuxuser_execstack boolean value to true 
With the d5bb233ea2 ("Do not change selinuxuser_execmod and
selinuxuser_execstack") commit, the default "off" value of
selinuxuser_execmod and selinuxuser_execstack booleans stopped
being switched to "on" by the selinux-policy package build configuration
to keep their default "off" value.

It turned out subsequently the execstack permission is required by some
tools like virt-v2v or when packages like glibc or binutils are rebuilt.
It is also needed by many 3rd party software packages.
As a result, the value of selinuxuser_execstack needs to be changed
to "on" again.

Resolves: rhbz#2064274
 2022-04-07 12:24:08 +02:00
Zdenek Pytela
f60c51e134 * Thu Feb 24 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.27-1 
- Allow ModemManager connect to the unconfined user domain
Resolves: rhbz#2000196
- Label /dev/wwan.+ with modem_manager_t
Resolves: rhbz#2000196
- Allow systemd-coredump userns capabilities and root mounton
Resolves: rhbz#2057435
- Allow systemd-coredump read and write usermodehelper state
Resolves: rhbz#2057435
- Allow sysadm_passwd_t to relabel passwd and group files
Resolves: rhbz#2053458
- Allow systemd-sysctl read the security state information
Resolves: rhbz#2056999
- Remove unnecessary /etc file transitions for insights-client
Resolves: rhbz#2055823
- Label all content in /var/lib/insights with insights_client_var_lib_t
Resolves: rhbz#2055823
- Update insights-client policy
Resolves: rhbz#2055823
- Update insights-client: fc pattern, motd, writing to etc
Resolves: rhbz#2055823
- Update specfile to buildrequire policycoreutils-devel >= 3.3-5
- Add modules_checksum to %files
 2022-02-24 15:23:20 +01:00
Zdenek Pytela
8a1fd2d0a4 * Thu Feb 17 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.26-1 
- Remove permissive domain for insights_client_t
Resolves: rhbz#2055823
- New policy for insight-client
Resolves: rhbz#2055823
- Allow confined sysadmin to use tool vipw
Resolves: rhbz#2053458
- Allow chage domtrans to sssd
Resolves: rhbz#2054657
- Remove label for /usr/sbin/bgpd
Resolves: rhbz#2055578
- Dontaudit pkcsslotd sys_admin capability
Resolves: rhbz#2055639
- Do not change selinuxuser_execmod and selinuxuser_execstack
Resolves: rhbz#2055822
- Allow tuned to read rhsmcertd config files
Resolves: rhbz#2055823
 2022-02-17 22:30:58 +01:00
Zdenek Pytela
d5bb233ea2 Do not change selinuxuser_execmod and selinuxuser_execstack 
The selinuxuser_execmod and selinuxuser_execstack booleans are off
by default in the selinux-policy repository, but custom build
configuration changed it to the "on" value.
Since this commit, the booleans will keep their default value.

Resolves: rhbz#2055822
 2022-02-17 22:02:29 +01:00
Zdenek Pytela
be2e9e731d Add the insights_client module 
Resolves: rhbz#2055823
 2022-02-17 22:02:02 +01:00
Zdenek Pytela
34edc3e97a * Mon Feb 14 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.25-1 
- Allow systemd watch unallocated ttys
Resolves: rhbz#2054150
- Allow alsa bind mixer controls to led triggers
Resolves: rhbz#2049732
- Allow alsactl set group Process ID of a process
Resolves: rhbz#2049732
- Allow unconfined to run virtd bpf
Resolves: rhbz#2033504
 2022-02-14 15:33:14 +01:00
Zdenek Pytela
93570f083c * Fri Feb 04 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.24-1 
- Allow tumblerd write to session_dbusd tmp socket files
Resolves: rhbz#2000039
- Allow login_userdomain write to session_dbusd tmp socket files
Resolves: rhbz#2000039
- Allow login_userdomain create session_dbusd tmp socket files
Resolves: rhbz#2000039
- Allow gkeyringd_domain write to session_dbusd tmp socket files
Resolves: rhbz#2000039
- Allow systemd-logind delete session_dbusd tmp socket files
Resolves: rhbz#2000039
- Allow gdm-x-session write to session dbus tmp sock files
Resolves: rhbz#2000039
- Allow sysadm_t nnp_domtrans to systemd_tmpfiles_t
Resolves: rhbz#2039453
- Label exFAT utilities at /usr/sbin
Resolves: rhbz#1972225
 2022-02-04 17:43:05 +01:00
Zdenek Pytela
4d21d7d728 * Wed Feb 02 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.23-1 
- Allow systemd nnp_transition to login_userdomain
Resolves: rhbz#2039453
- Label /var/run/user/%{USERID}/dbus with session_dbusd_tmp_t
Resolves: rhbz#2000039
- Change /run/user/[0-9]+ to /run/user/%{USERID} for proper labeling
Resolves: rhbz#2000039
- Allow scripts to enter LUKS password
Resolves: rhbz#2048521
- Allow system_mail_t read inherited apache system content rw files
Resolves: rhbz#2049372
- Add apache_read_inherited_sys_content_rw_files() interface
Related: rhbz#2049372
- Allow sanlock get attributes of filesystems with extended attributes
Resolves: rhbz#2047811
- Associate stratisd_data_t with device filesystem
Resolves: rhbz#2039974
- Allow init read stratis data symlinks
Resolves: rhbz#2039974
- Label /run/stratisd with stratisd_var_run_t
Resolves: rhbz#2039974
- Allow domtrans to sssd_t and role access to sssd
Resolves: rhbz#2039757
- Creating interface sssd_run_sssd()
Resolves: rhbz#2039757
- Fix badly indented used interfaces
Resolves: rhbz#2039757
- Allow domain transition to sssd_t
Resolves: rhbz#2039757
- Label /dev/nvme-fabrics with fixed_disk_device_t
Resolves: rhbz#2039759
- Allow local_login_t nnp_transition to login_userdomain
Resolves: rhbz#2039453
- Allow xdm_t nnp_transition to login_userdomain
Resolves: rhbz#2039453
- Make cupsd_lpd_t a daemon
Resolves: rhbz#2039449
- Label utilities for exFAT filesystems with fsadm_exec_t
Resolves: rhbz#1972225
- Dontaudit sfcbd sys_ptrace cap_userns
Resolves: rhbz#2040311
 2022-02-02 21:35:46 +01:00
Zdenek Pytela
c264d943f0 * Tue Jan 11 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.22-1 
- Allow sshd read filesystem sysctl files
Resolves: rhbz#2036585
- Revert "Allow sshd read sysctl files"
Resolves: rhbz#2036585
 2022-01-11 16:16:07 +01:00
Zdenek Pytela
38bdf8abba * Mon Jan 10 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.21-1 
- Remove the lockdown class from the policy
Resolves: rhbz#2017848
- Revert "define lockdown class and access"
Resolves: rhbz#2017848
- Allow gssproxy access to various system files.
Resolves: rhbz#2026974
- Allow gssproxy read, write, and map ica tmpfs files
Resolves: rhbz#2026974
- Allow gssproxy read and write z90crypt device
Resolves: rhbz#2026974
- Allow sssd_kcm read and write z90crypt device
Resolves: rhbz#2026974
- Allow abrt_domain read and write z90crypt device
Resolves: rhbz#2026974
- Allow NetworkManager read and write z90crypt device
Resolves: rhbz#2026974
- Allow smbcontrol read the network state information
Resolves: rhbz#2038157
- Allow virt_domain map vhost devices
Resolves: rhbz#2035702
- Allow fcoemon request the kernel to load a module
Resolves: rhbz#2034463
- Allow lldpd connect to snmpd with a unix domain stream socket
Resolves: rhbz#2033315
- Allow ModemManager create a qipcrtr socket
Resolves: rhbz#2036582
- Allow ModemManager request to load a kernel module
Resolves: rhbz#2036582
- Allow sshd read sysctl files
Resolves: rhbz#2036585
 2022-01-10 21:09:15 +01:00
Zdenek Pytela
6bc3bd6ac4 * Wed Dec 15 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.20-1 
- Allow dnsmasq watch /etc/dnsmasq.d directories
Resolves: rhbz#2029866
- Label /usr/lib/pcs/pcs_snmp_agent with cluster_exec_t
Resolves: rhbz#2029316
- Allow lldpd use an snmp subagent over a tcp socket
Resolves: rhbz#2028561
- Allow smbcontrol use additional socket types
Resolves: rhbz#2027751
- Add write permisson to userfaultfd_anon_inode_perms
Resolves: rhbz#2027660
- Allow xdm_t watch generic directories in /lib
Resolves: rhbz#1960010
- Allow xdm_t watch fonts directories
Resolves: rhbz#1960010
- Label /dev/ngXnY and /dev/nvme-subsysX with fixed_disk_device_t
Resolves: rhbz#2027994
- Add hwtracing_device_t type for hardware-level tracing and debugging
Resolves: rhbz#2029392
- Change dev_getattr_infiniband_dev() to use getattr_chr_files_pattern()
Resolves: rhbz#2028791
- Allow arpwatch get attributes of infiniband_device_t devices
Resolves: rhbz#2028791
- Allow tcpdump and nmap get attributes of infiniband_device_t
Resolves: rhbz#2028791
 2021-12-15 17:27:25 +01:00
Zdenek Pytela
470eea63e8 * Mon Nov 29 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.19-1 
- Allow redis get attributes of filesystems with extended attributes
Resolves: rhbz#2014611
- Allow dirsrv read slapd tmpfs files
Resolves: rhbz#2015928
- Revert "Label /dev/shm/dirsrv/ with dirsrv_tmpfs_t label"
Resolves: rhbz#2015928
- Allow login_userdomain open/read/map system journal
Resolves: rhbz#2017838
- Allow login_userdomain read and map /var/lib/systemd files
Resolves: rhbz#2017838
- Allow nftables read NetworkManager unnamed pipes
Resolves: rhbz#2023456
- Allow xdm watch generic directories in /var/lib
Resolves: rhbz#1960010
- Allow xdm_t watch generic pid directories
Resolves: rhbz#1960010
 2021-11-29 15:31:44 +01:00
Zdenek Pytela
89586f9eb1 * Mon Nov 01 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.18-1 
- Allow fetchmail search cgroup directories
Resolves: rhbz#2015118
- Add the auth_read_passwd_file() interface
Resolves: rhbz#2014611
- Allow redis-sentinel execute a notification script
Resolves: rhbz#2014611
- Support new PING_CHECK health checker in keepalived
Resolves: rhbz#2014423
 2021-11-01 11:51:58 +01:00
Zdenek Pytela
16d5820b15 * Thu Oct 14 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.17-1 
- Label /usr/sbin/virtproxyd as virtd_exec_t
Resolves: rhbz#2002143
- Allow at-spi-bus-launcher read and map xdm pid files
Resolves: rhbz#2011772
- Remove references to init_watch_path_type attribute
Resolves: rhbz#2007960
- Remove all redundant watch permissions for systemd
Resolves: rhbz#2007960
- Allow systemd watch non_security_file_type dirs, files, lnk_files
Resolves: rhbz#2007960
- Allow systemd-resolved watch /run/systemd
Resolves: rhbz#1992461
- Allow sssd watch /run/systemd
Resolves: rhbz#1992461
 2021-10-14 09:46:11 +02:00
Zdenek Pytela
5ad9abab43 * Thu Sep 23 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.16-1 
- Allow fprintd install a sleep delay inhibitor
Resolves: rhbz#1999537
- Update mount_manage_pid_files() to use manage_files_pattern
Resolves: rhbz#1999997
- Allow gnome at-spi processes create and use stream sockets
Resolves: rhbz#2004885
- Allow haproxy list the sysfs directories content
Resolves: rhbz#1986823
- Allow virtlogd_t read process state of user domains
Resolves: rhbz#1994592
- Support hitless reloads feature in haproxy
Resolves: rhbz#1997182
- Allow firewalld load kernel modules
Resolves: rhbz#1999152
- Allow communication between at-spi and gdm processes
Resolves: rhbz#2003037
 2021-09-24 09:21:09 +02:00
Zdenek Pytela
c024fd84d4 Remove "ipa = module" from modules-targeted-contrib.conf 
Resolves: rhbz#2006039
 2021-09-23 21:19:26 +02:00
Zdenek Pytela
ddedf0d0b5 * Mon Aug 30 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.15-1 
- Update ica_filetrans_named_content() with create_file_perms
Resolves: rhbz#1976180
- Allow various domains work with ICA crypto accelerator
Resolves: rhbz#1976180
- Add ica module
Resolves: rhbz#1976180
- Revert "Support using ICA crypto accelerator on s390x arch"
Resolves: rhbz#1976180
- Fix the gnome_atspi_domtrans() interface summary
Resolves: rhbz#1972655
- Add support for at-spi
Resolves: rhbz#1972655
- Add permissions for system dbus processes
Resolves: rhbz#1972655
- Allow /tmp file transition for dbus-daemon also for sock_file
Resolves: rhbz#1972655
 2021-08-30 16:13:54 +02:00
Zdenek Pytela
b42446e02d * Wed Aug 25 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.14-1 
- Support using ICA crypto accelerator on s390x arch
Resolves: rhbz#1976180
- Allow systemd delete /run/systemd/default-hostname
Resolves: rhbz#1978507
- Label /usr/bin/Xwayland with xserver_exec_t
Resolves: rhbz#1993151
- Label /usr/libexec/gdm-runtime-config with xdm_exec_t
Resolves: rhbz#1993151
- Allow tcpdump read system state information in /proc
Resolves: rhbz#1972577
- Allow firewalld drop capabilities
Resolves: rhbz#1989641
 2021-08-25 18:48:38 +02:00
Zdenek Pytela
cf60736fb6 * Thu Aug 12 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.13-1 
- Add "/" at the beginning of dev/shm/var\.lib\.opencryptoki.* regexp
Resolves: rhbz#1977915
- Set default file context for /sys/firmware/efi/efivars
Resolves: rhbz#1972372
- Allow tcpdump run as a systemd service
Resolves: rhbz#1972577
- Allow nmap create and use netlink generic socket
Resolves: rhbz#1985212
- Allow nscd watch system db files in /var/db
Resolves: rhbz#1989416
- Allow systemd-gpt-auto-generator read udev pid files
Resolves: rhbz#1992638
 2021-08-12 16:15:32 +02:00
Zdenek Pytela
991febef9c * Tue Aug 10 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.12-1 
- Revert "update libs_filetrans_named_content() to have support for /usr/lib/debug directory"
Resolves: rhbz#1990813
- Label /dev/crypto/nx-gzip with accelerator_device_t
Resolves: rhbz#1973953
- Label /usr/bin/qemu-storage-daemon with virtd_exec_t
Resolves: rhbz#1977245
- Allow systemd-machined stop generic service units
Resolves: rhbz#1979522
- Label /.k5identity file allow read of this file to rpc.gssd
Resolves: rhbz#1980610
 2021-08-10 16:28:03 +02:00
Mohan Boddu
57b195c83b Rebuilt for IMA sigs, glibc 2.34, aarch64 flags 
Related: rhbz#1991688
Signed-off-by: Mohan Boddu <mboddu@redhat.com>
 2021-08-10 00:49:40 +00:00
Zdenek Pytela
4548b66f2e * Thu Jul 29 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.11-1 
- Allow hostapd bind UDP sockets to the dhcpd port
Resolves: rhbz#1979968
- Allow mdadm read iscsi pid files
Resolves: rhbz#1976073
- Unconfined domains should not be confined
Resolves: rhbz#1977986
- Allow NetworkManager_t to watch /etc
Resolves: rhbz#1980000
- Allow using opencryptoki for ipsec
Resolves: rhbz#1977915
 2021-07-29 17:11:36 +02:00
Zdenek Pytela
c0ea3a13a7 * Wed Jul 14 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.10-1 
- Allow bacula get attributes of cgroup filesystems
Resolves: rhbz#1976917
- Label /dev/wmi/dell-smbios as acpi_device_t
Resolves: rhbz#1972382
- Add the lockdown integrity permission to dev_map_userio_dev()
Resolves: rhbz#1966758
- Allow virtlogd_t to create virt_var_lockd_t dir
Resolves: rhbz#1974875
 2021-07-14 16:11:07 +02:00
Zdenek Pytela
86f64b8b19 gating.yaml: add missing '}' 2021-07-07 10:46:03 +02:00
Zdenek Pytela
52a5aa8d34 Add gating.yaml to enable functional gating tests 2021-06-30 12:07:25 +02:00
Zdenek Pytela
37bcc175cd * Tue Jun 22 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.9-1 
- Allow systemd-coredump getattr nsfs files and net_admin capability
Resolves: rhbz#1965372
- Label /run/libvirt/common with virt_common_var_run_t
Resolves: rhbz#1969209
- Label /usr/bin/arping plain file with netutils_exec_t
Resolves: rhbz#1952515
- Make usbmuxd_t a daemon
Resolves: rhbz#1965411
- Allow usbmuxd get attributes of cgroup filesystems
Resolves: rhbz#1965411
- Label /dev/dma_heap/* char devices with dma_device_t
- Revert "Label /dev/dma_heap/* char devices with dma_device_t"
- Revert "Label /dev/dma_heap with dma_device_dir_t"
- Revert "Associate dma_device_dir_t with device filesystem"
Resolves: rhbz#1967818
- Label /var/lib/kdump with kdump_var_lib_t
Resolves: rhbz#1965989
- Allow systemd-timedated watch runtime dir and its parent
Resolves: rhbz#1970865
- Label /run/fsck with fsadm_var_run_t
Resolves: rhbz#1970911
 2021-06-22 14:41:30 +02:00
Zdenek Pytela
042fffd52c * Thu Jun 10 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.8-1 
- Associate dma_device_dir_t with device filesystem
Resolves: rhbz#1954116
- Add default file context specification for dnf log files
Resolves: rhbz#1955223
- Allow using opencryptoki for certmonger
Resolves: rhbz#1961756
- Label var.lib.opencryptoki.* files and create pkcs_tmpfs_filetrans()
Resolves: rhbz#1961756
- Allow httpd_sys_script_t read, write, and map hugetlbfs files
Resolves: rhbz#1964890
- Dontaudit daemon open and read init_t file
Resolves: rhbz#1965412
- Allow sanlock get attributes of cgroup filesystems
Resolves: rhbz#1965217
 2021-06-10 23:07:44 +02:00
Zdenek Pytela
5d2a514c72 * Tue Jun 08 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.7-1 
- Set default file context for /var/run/systemd instead of /run/systemd
Resolves: rhbz#1966492
 2021-06-08 19:26:12 +02:00
Zdenek Pytela
a0031a1fc3 * Mon Jun 07 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.6-1 
- Label /dev/dma_heap with dma_device_dir_t
Resolves: rhbz#1954116
- Allow pkcs-slotd create and use netlink_kobject_uevent_socket
Resolves: rhbz#1963252
- Label /run/systemd/default-hostname with hostname_etc_t
Resolves: rhbz#1966492
 2021-06-07 16:34:34 +02:00
Zdenek Pytela
14a2757535 * Thu May 27 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.5-1 
- Label /dev/trng with random_device_t
Resolves: rhbz#1962260
- Label /dev/zram[0-9]+ block device files with fixed_disk_device_t
Resolves: rhbz#1954116
- Label /dev/udmabuf character device with dma_device_t
Resolves: rhbz#1954116
- Label /dev/dma_heap/* char devices with dma_device_t
Resolves: rhbz#1954116
- Label /dev/acpi_thermal_rel char device with acpi_device_t
Resolves: rhbz#1954116
- Allow fcoemon create sysfs files
Resolves: rhbz#1952292
 2021-05-27 14:57:41 +02:00
Zdenek Pytela
61280fbdd0 * Wed May 12 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.4-1 
- Allow sysadm_t dbus chat with tuned
Resolves: rhbz#1953643
- Allow tuned write profile files with file transition
Resolves: rhbz#1953643
- Allow tuned manage perf_events
Resolves: rhbz#1953643
- Make domains use kernel_write_perf_event() and kernel_manage_perf_event()
Resolves: rhbz#1953643
- Add kernel_write_perf_event() and kernel_manage_perf_event()
Resolves: rhbz#1953643
- Allow syslogd_t watch root and var directories
Resolves: rhbz#1957792
- Allow tgtd create and use rdma socket
Resolves: rhbz#1955559
- Allow aide connect to init with a unix socket
Resolves: rhbz#1926343
 2021-05-12 15:45:13 +02:00