Commit Graph

4855 Commits

Author SHA1 Message Date
Miroslav Grepl
3dd200bfa4 * Thu Jun 7 2012 Miroslav Grepl <mgrepl@redhat.com> 3.11.0-1
- Mass merge with upstream
  * new policy topology to include contrib policy modules
  * we have now two base policy patches
2012-06-07 00:42:18 +02:00
Miroslav Grepl
e392eca2af Upload new sources 2012-06-06 16:09:49 +02:00
Miroslav Grepl
24c1488494 Update modules-* files 2012-06-06 15:43:16 +02:00
Miroslav Grepl
4daeee80d1 Add permissivedomains module
* sync with F17
2012-06-06 15:26:24 +02:00
Miroslav Grepl
4a27edfbeb Sync master with F17 2012-06-06 15:25:27 +02:00
Dan Walsh
05c3d969d7 Add lxc context definitions 2012-04-17 13:07:16 -04:00
Miroslav
de69336bd3 +* Mon Feb 13 2012 Miroslav Grepl <mgrepl@redhat.com> 3.10.0-
+- Allow firewalld to read urand
+- Alias java, execmem_mono to bin_t to allow third parties
+- Add label for kmod
+- /etc/redhat-lsb contains binaries
+- Add boolean to allow gitosis to send mail
+- Add filename transition also for "event20"
+- Allow systemd_tmpfiles_t to delete all file types
+- Allow collectd to ipc_lock
2012-02-13 22:28:38 +01:00
Dan Walsh
4066cfa00d Add dnssec policy and go back to unconfined domains versus permissive domains 2012-02-09 17:38:44 -05:00
Dan Walsh
7bf1025fa8 Revert "Dropping support for snort since it was dropped from Fedora. Users should use nagios"
This reverts commit 76d9bfedb6.
2012-02-07 17:18:16 -05:00
Dan Walsh
5c28b0512d Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy 2012-02-07 17:17:54 -05:00
Dan Walsh
76d9bfedb6 Dropping support for snort since it was dropped from Fedora. Users should use nagios 2012-02-07 17:15:35 -05:00
Dan Walsh
d3a57c6cc7 Fedora no longer ships kerneloops, dropping policy 2012-02-07 17:09:23 -05:00
Miroslav Grepl
81894dfe50 - Add policy for grindengine MPI jobs 2012-02-07 18:18:07 +01:00
Miroslav Grepl
618ef7160b Add label for /etc/WebCalendar 2012-02-07 14:09:10 +01:00
Miroslav Grepl
80d21dc60a Revert "Simplify the build-docs target"
This reverts commit 01be486292.
2012-02-07 14:08:38 +01:00
Miroslav Grepl
3d8eaa7aa5 Fix typo 2012-02-07 00:25:01 +01:00
Miroslav Grepl
4689b08b49 - Add new sysadm_secadm.pp module
* contains secadm definition for sysadm_t
- Move user_mail_domain access out of the interface into the
- Allow httpd_t to create httpd_var_lib_t directories as wel
- Allow snmpd to connect to the ricci_modcluster stream
- Allow firewalld to read /etc/passwd
- Add auth_use_nsswitch for colord
- Allow smartd to read network state
- smartdnotify needs to read /etc/group
2012-02-06 23:20:13 +01:00
Dan Walsh
01be486292 Simplify the build-docs target 2012-02-06 15:33:48 -05:00
Dan Walsh
dc4ca7a142 Allow builder to skip build_docs 2012-02-06 12:13:56 -05:00
Miroslav
30ab254413 - Allow gpg and gpg_agent to store sock_file in gpg_secret_t directory
- lxdm startup scripts should be labeled bin_t, so confined users will work
- mcstransd now creates a pid, needs back port to F16
- qpidd should be allowed to connect to the amqp port
- Label devices 010-029 as usb devices
- ypserv packager says ypserv does not use tmp_t so removing selinux policy types
- Remove all ptrace commands that I believe are caused by the kernel/ps avcs
- Add initial Obex policy
- Add logging_syslogd_use_tty boolean
- Add polipo_connect_all_unreserved bolean
- Allow zabbix to connect to ftp port
- Allow systemd-logind to be able to switch VTs
- Allow apache to communicate with memcached through a sock_file
2012-02-03 10:57:34 +01:00
Dan Walsh
3515d8b4e7 Fix file_context.subs_dist for now to work with pre usrmove 2012-01-31 17:01:07 -05:00
Dan Walsh
9382499c6f Fix file_context.subs_dist for now to work with pre usrmove 2012-01-31 15:26:31 -05:00
Miroslav Grepl
fb431d4b29 - More /usr move fixes 2012-01-30 21:28:06 +01:00
Dan Walsh
cde75b4cef Remove /lib64 subs since this is not a link, swithc /lib/systemd to /usr/lib since the usrmove 2012-01-30 14:58:40 -05:00
Dan Walsh
191c435a9f POLY is no longer used 2012-01-30 10:27:14 -05:00
Miroslav Grepl
26f953d9f6 Fixes more typos 2012-01-27 10:44:46 +01:00
Dan Walsh
f53135cd92 Make sure /etc/passwd and /etc/group properly labeled 2012-01-26 17:45:12 -05:00
Miroslav
b9a6445e02 Fix typo 2012-01-26 20:37:24 +01:00
Miroslav
a9d343329b * Thu Jan 26 2012 Miroslav Grepl <mgrepl@redhat.com> 3.10.0-80
- Add zabbix_can_network boolean
- Add httpd_can_connect_zabbix boolean
- Prepare file context labeling for usrmove functions
- Allow system cronjobs to read kernel network state
- Add support for selinux_avcstat munin plugin
- Treat hearbeat with corosync policy
- Allow corosync to read and write to qpidd shared mem
-  mozilla_plugin is trying to run pulseaudio
- Fixes for new sshd patch for running priv sep domains as the users c
- Turn off dontaudit rules when turning on allow_ypbind
- udev now reads /etc/modules.d directory
2012-01-26 19:26:12 +01:00
Miroslav Grepl
0c0b390b07 - Turn on deny_ptrace boolean for the Rawhide run, so we can t
- Cups exchanges dbus messages with init
- udisk2 needs to send syslog messages
- certwatch needs to read /etc/passwd
2012-01-24 16:34:52 +01:00
Dan Walsh
a2e8b9ca5d Turn on deny_ptrace boolean for the Rawhide run, so we can test this out 2012-01-24 09:30:07 -05:00
Miroslav
75a7b93abc +- Add labeling for udisks2
+- Allow fsadmin to communicate with the systemd process
2012-01-23 22:35:48 +01:00
Miroslav Grepl
8cd443307d - Treat Bip with bitlbee policy
* Bip is an IRC proxy
- Add port definition for interwise port
- Add support for ipa_memcached socket
- systemd_jounald needs to getattr on all processes
- mdadmin fixes
     * uses getpw
- amavisd calls getpwnam()
- denyhosts calls getpwall()
2012-01-23 16:15:05 +01:00
Miroslav Grepl
de9114f624 - Setup labeling of /var/rsa and /var/lib/rsa to allow login programs to write there
- bluetooth says they do not use /tmp and want to remove the type
- Allow init to transition to colord
- Mongod needs to read /proc/sys/vm/zone_reclaim_mode
- Allow postfix_smtpd_t to connect to spamd
- Add boolean to allow ftp to connect to all ports > 1023
- Allow sendmain to write to inherited dovecot tmp files
2012-01-20 14:43:02 +01:00
Dan Walsh
291b1f5075 Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy 2012-01-19 09:44:28 -05:00
Dan Walsh
b80397b754 Remove Requires for bunzip2 and mktemp 2012-01-19 09:39:05 -05:00
Miroslav Grepl
153cc80f87 - Merge systemd patch
- systemd-tmpfiles wants to relabel /sys/devices/system/cpu/online
- Allow deltacloudd dac_override, setuid, setgid  caps
- Allow aisexec to execute shell
- Add use_nfs_home_dirs boolean for ssh-keygen
2012-01-16 10:56:19 +01:00
Dan Walsh
e9660551a3 Fixes to make rawhide boot in enforcing mode with latest systemd changes 2012-01-13 12:42:47 -05:00
Dan Walsh
cd25a7a613 Fixes to make rawhide boot in enforcing mode with latest systemd changes 2012-01-13 12:26:06 -05:00
Dan Walsh
ba7c7aec15 Add labeling for /var/run/systemd/journal/syslog
libvirt sends signals to ifconfig
Allow domains that read logind session files to list them
2012-01-13 11:51:57 -05:00
Dan Walsh
86d3f66092 Add labeling for /var/run/systemd/journal/syslog
libvirt sends signals to ifconfig
Allow domains that read logind session files to list them
2012-01-13 09:53:03 -05:00
Miroslav
9387d2ce08 Fix typo 2012-01-11 21:07:43 +01:00
Miroslav
68079f6d89 +- Add labeling for /var/run/systemd/journal/syslog
+- libvirt sends signals to ifconfig
+- Allow domains that read logind session files to list them
2012-01-11 20:37:45 +01:00
Miroslav
ecab259899 Fix typo in xserver_filetrans_admin_home_content() 2012-01-11 14:13:28 +01:00
Miroslav
0149a53fbb Fix typo in xserver_filetrans_home_content() 2012-01-11 13:42:28 +01:00
Miroslav
1b62e3889e use entropyd instead of entropy 2012-01-11 13:33:22 +01:00
Miroslav
69a8d0687a - Fixed destined form libvirt-sandbox
- Allow apps that list sysfs to also read sympolicy links in this filesystem
- Add ubac_constrained rules for chrome_sandbox
- Need interface to allow domains to use tmpfs_t files created by the kernel, used by libra
- Allow postgresql to be executed by the caller
- Standardize interfaces of daemons
- Add new labeling for mm-handler
- Allow all matahari domains to read network state and etc_runtime_t files
2012-01-11 13:13:07 +01:00
Dan Walsh
7cf580ebcc Rename audioentropy to entropy to match upstream 2012-01-06 11:52:44 -05:00
Miroslav
b3ef57fc19 - New fix for seunshare, requires seunshare_domains to be able to mounton /
- Allow systemctl running as logrotate_t to connect to private systemd socket
- Allow tmpwatch to read meminfo
- Allow rpc.svcgssd to read supported_krb5_enctype
- Allow zarafa domains to read /dev/random and /dev/urandom
- Allow snmpd to read dev_snmp6
- Allow procmail to talk with cyrus
- Add fixes for check_disk and check_nagios plugins
2012-01-04 15:58:41 +01:00
Dan Walsh
904f70ac64 Add Zoneminder policy 2011-12-22 19:26:50 +00:00