Commit Graph

78 Commits

Author SHA1 Message Date
Dan Walsh
1b0e0923f8 Cleanup related to init_domain()+inetd_domain fixes
- Use just init_domain instead of init_daemon_domain in inetd_core_service_domain
- svirt domains neeed to create kobject_uevint_sockets
- Lots of new access required for sosreport
- Allow tgtd_t to connect to isns ports
- Allow init_t to transition to all inetd domains:
- openct needs to be able to create netlink_object_uevent_sockets
- Dontaudit leaks into ldconfig_t
- Dontaudit su domains getattr on /dev devices, move su domains to attribute based calls
- Move kernel_stream_connect into all Xwindow using users
- Dontaudit inherited lock files in ifconfig o dhcpc_t
2013-09-05 09:40:37 -04:00
Miroslav Grepl
d618dfb7db Add oracleasm policy 2013-08-07 10:06:23 +02:00
Miroslav Grepl
9bbfec8ce7 Activate watchdog policy 2013-08-06 15:08:02 +02:00
Miroslav Grepl
faa2916cd9 Activate openhpid policy 2013-07-10 10:48:34 +02:00
Dan Walsh
d3c6b2620c Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy 2013-07-08 12:26:37 -04:00
Miroslav Grepl
d1027c54b9 - Add prosody policy written by Michael Scherer
- Allow nagios plugins to read /sys info
- ntpd needs to manage own log files
- Add support for HOME_DIR/.IBMERS
- Allow iptables commands to read firewalld config
- Allow consolekit_t to read utmp
- Fix filename transitions on .razor directory
- Add additional fixes to make DSPAM with LDA working
- Allow snort to read /etc/passwd
- Allow fail2ban to communicate with firewalld over dbus
- Dontaudit openshift_cgreoup_file_t read/write leaked dev
- Allow nfsd to use mountd port
- Call th proper interface
- Allow openvswitch to read sys and execute plymouth
- Allow tmpwatch to read /var/spool/cups/tmp
- Add support for /usr/libexec/telepathy-rakia
- Add systemd support for zoneminder
- Allow mysql to create files/directories under /var/log/mysql
- Allow zoneminder apache scripts to rw zoneminder tmpfs
- Allow httpd to manage zoneminder lib files
- Add zoneminder_run_sudo boolean to allow to start zoneminder
- Allow zoneminder to send mails
- gssproxy_t sock_file can be under /var/lib
- Allow web domains to connect to whois port.
- Allow sandbox_web_type to connect to the same ports as mozilla_plugin_t.
- We really need to add an interface to corenet to define what a web_client_domain i
- then define chrome_sandbox_t, mozilla_plugin_t and sandbox_web_type to that domain
- Add labeling for cmpiLMI_LogicalFile-cimprovagt
- Also make pegasus_openlmi_logicalfile_t as unconfined to have unconfined_domain at
- Update policy rules for pegasus_openlmi_logicalfile_t
- Add initial types for logicalfile/unconfined OpenLMI providers
- mailmanctl needs to read own log
- Allow logwatch manage own lock files
- Allow nrpe to read meminfo
- Allow httpd to read certs located in pki-ca
- Add pki_read_tomcat_cert() interface
- Add support for nagios openshift plugins
- Add port definition for redis port
- fix selinuxuser_use_ssh_chroot boolean
2013-07-08 09:18:11 +02:00
Miroslav Grepl
961ad881ae Activate nsd policy 2013-07-01 13:35:39 +02:00
Dan Walsh
4fa797e9d8 Add prosody policy 2013-07-01 07:19:11 -04:00
Miroslav Grepl
634d39b171 - Allow lvm_t to create default targets for filesystem handling
- Fix labeling for razor-lightdm binaries
- Allow insmod_t to read any file labeled var_lib_t
- Add policy for pesign
- Activate policy for cmpiLMI_Account-cimprovagt
- Allow isnsd syscall=listen
- /usr/libexec/pegasus/cimprovagt needs setsched caused by sched_setschedule
- Allow ctdbd to use udp/4379
- gatherd wants sys_nice and setsched
- Add support for texlive2012
- Allow NM to read file_t (usb stick with no labels used to transfer keys fo
- Allow cobbler to execute apache with domain transition
2013-06-24 23:12:23 +02:00
Dan Walsh
88eb5b40ad Add gssproxy policy 2013-05-31 17:24:35 -04:00
Miroslav Grepl
59421a6c70 Remove rgmanager,pacemaker,aisexec,pacemaker policies which have been merge to rhcs.pp as cluster_t 2013-03-01 14:05:44 +01:00
Dan Walsh
3460d4cd12 Remove shutdown policy. Shutdown is now a symlink to systemctl. 2013-02-20 06:31:55 +01:00
Dan Walsh
13b7212ad0 add openstack swift domain 2013-02-04 17:03:20 -05:00
Miroslav Grepl
4c3676d47a clamav and amavis has been merge to antivirus policy 2013-01-25 14:17:56 +01:00
Dan Walsh
c14302d03d Rename gnomeclock to systemd_timedated 2013-01-15 18:54:56 -05:00
Dan Walsh
7846a149ab Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy 2013-01-15 11:56:41 -05:00
Dan Walsh
afbf138ed9 Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy
Conflicts:
	selinux-policy.spec
2013-01-15 11:54:07 -05:00
Miroslav Grepl
0c265c3817 Add back consolekit but we keep just consolekit.te and .fc was commented 2013-01-11 14:33:08 +01:00
Miroslav Grepl
23a9442e40 * Wed Jan 9 2013 Miroslav Grepl <mgrepl@redhat.com> 3.12.1-1
- Mass merge with upstream
2013-01-09 13:16:35 +01:00
Miroslav Grepl
fdeb413467 Revert "Upstream uses ctdb instead of ctdbd policy"
This reverts commit 1871109735.
2013-01-07 14:54:40 +01:00
Miroslav Grepl
c57639b449 Revert "Upstream change:"
This reverts commit 098e5a0968.
2013-01-07 14:54:27 +01:00
Miroslav Grepl
1a1e004154 Revert "Upstream change:"
This reverts commit 7316889d21.
2013-01-07 14:54:15 +01:00
Miroslav Grepl
6e9f07d2e3 Revert "Upstream change:"
This reverts commit 0368b4c345.
2013-01-07 14:54:04 +01:00
Miroslav Grepl
0368b4c345 Upstream change:
-isnsd = module
+isns = module
2013-01-07 14:32:26 +01:00
Miroslav Grepl
7316889d21 Upstream change:
-glusterd =  module
+glusterfs =  module
2013-01-07 12:43:02 +01:00
Miroslav Grepl
098e5a0968 Upstream change:
-fcoemon = module
+fcoe = module
2013-01-07 09:44:43 +01:00
Miroslav Grepl
1871109735 Upstream uses ctdb instead of ctdbd policy 2013-01-07 00:11:42 +01:00
Miroslav Grepl
003088b3f0 Add modules-*.conf files 2012-12-17 17:22:13 +01:00