Commit Graph

6183 Commits

Author SHA1 Message Date
Colin Walters
3fed54cdcc Use Requires(meta): (rpm-plugin-selinux if rpm-libs)
We support two ways to update the operating system:

- `/usr/bin/rpm` (and `dnf` etc.) where SELinux labels are
  computed and written client side
- ostree (and other image-based systems) where SELinux labels
  were computed server side.

In the ostree case, I'd like the ability to generate smaller
images that do not even have `rpm` installed.

This hard dependency from `selinux-policy` -> `rpm` is one of
the only main blockers.

RPM supports these "alternative" conditionals, it's easy to do.

Related: RHEL-54303
2024-11-14 17:16:04 +01:00
Ondrej Mosnacek
ac73ffca09 Drop obsolete modules from config
Remove modules for packages retired from Fedora that are not present in
refpolicy sources. There is no need to ship or build them as the
associated software is not supported on Fedora nor RHEL (I checked).

References:
https://src.fedoraproject.org/rpms/Ajaxterm
https://src.fedoraproject.org/rpms/authconfig
https://docs.fedoraproject.org/en-US/quick-docs/bumblebee/
https://src.fedoraproject.org/rpms/389-admin
https://src.fedoraproject.org/rpms/kmscon
mip6d - not much info can be found, seems to predate RHEL-7
https://src.fedoraproject.org/rpms/mirrormanager
naemon - https://bugzilla.redhat.com/show_bug.cgi?id=1069988
https://src.fedoraproject.org/rpms/piranha
pkcs11proxyd - https://src.fedoraproject.org/rpms/caml-crush
https://src.fedoraproject.org/rpms/rkt
https://src.fedoraproject.org/rpms/rolekit
sge - https://src.fedoraproject.org/rpms/gridengine
smsd - https://src.fedoraproject.org/rpms/smstools
https://src.fedoraproject.org/rpms/timedatex

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

Related: RHEL-54303
2024-11-14 17:16:04 +01:00
Petr Lautrbach
53fd0a7aa2 Install dnf protected files only when policy is built
If an user builds package with `%bcond mls 0` it ended with
    RPM build errors:
    error: Installed (but unpackaged) file(s) found:
       /etc/dnf/protected.d/selinux-policy-mls.conf
        Installed (but unpackaged) file(s) found:
       /etc/dnf/protected.d/selinux-policy-mls.conf

With this change, dnf procted files for a policy is installed only when
the policy is built.

[skip changelog]

Related: RHEL-54303
2024-11-14 17:16:04 +01:00
Zbigniew Jędrzejewski-Szmek
488e7b1b79 Also relabel files under /usr/sbin
I forgot that this needs to apply to pre-sbin-merge systems too. Let's
cover those too.

Related: RHEL-54303
2024-11-14 17:16:04 +01:00
Zbigniew Jędrzejewski-Szmek
5e1af34521 Relabel files under /usr/bin to fix stale context after sbin merge
Related: RHEL-54303
2024-11-14 17:16:04 +01:00
Petr Lautrbach
fc93f2b404 Merge -base and -contrib
Contrib was merged to main repo long time ago.

Makes the build process simpler.

Modules enabled in minimum lives in
%{_datadir}/selinux/minimum/modules.lst now.

Fixes:
RPM build warnings:
    File listed twice: /var/lib/selinux/mls/active/modules/100/unprivuser
    File listed twice: /var/lib/selinux/mls/active/modules/100/unprivuser/cil
    File listed twice: /var/lib/selinux/mls/active/modules/100/unprivuser/hll
    File listed twice: /var/lib/selinux/mls/active/modules/100/unprivuser/lang_ext

[skip changelog]

Related: RHEL-54303
2024-11-14 17:16:04 +01:00
Zdenek Pytela
4b190446b9 Include "mode" in the %verify-not configuration for extra_varrun
rpm-verify reports the following problem:
.M.......  g /var/lib/selinux/targeted/active/modules/400/extra_varrun
.M.......  g /var/lib/selinux/targeted/active/modules/400/extra_varrun/cil
.M.......  g /var/lib/selinux/targeted/active/modules/400/extra_varrun/lang_ext

Related: RHEL-54303
2024-11-14 17:16:04 +01:00
Zdenek Pytela
43237dfd47 Rearrange file context equivalency for systemd generators
/run/systemd/generator is no longer equivalent to /usr/lib/systemd/system.
It has its own rules in the policy now, so instead
/run/systemd/generator.early and /run/systemd/generator.late
are equivalent to /run/systemd/generator.

Related: RHEL-54303
2024-11-14 17:16:04 +01:00
Zdenek Pytela
f98e465740 Use /usr/bin/bash in scripts as shebang
Related: RHEL-54303
2024-11-14 17:16:04 +01:00
Zdenek Pytela
2468f6a593 Install configuration files with 644 mode
Related: RHEL-54303
2024-11-14 17:16:04 +01:00
Ondrej Mosnáček
3d9c5beb8f Use RPM's build conditionals to control which policy types to build
Instead of plain macros, use `%bcond ...` and `%{with ...}`, which will
allow controlling which policy types to build using the --with/--without
command-line arguments when calling `rpmbuild` or `mock`.

See also:
https://rpm-software-management.github.io/rpm/manual/conditionalbuilds.html

Note that the BUILD_DOC macro is removed without replacement as it's
unused. (The builds of the -doc and -devel subpackages overlap too much
for the macro to be useful, anyway.)

Signed-off-by: Ondrej Mosnáček <omosnacek@gmail.com>

Related: RHEL-54303
2024-11-14 17:16:04 +01:00
Zdenek Pytela
d0e15905f2 Trim changelog so that it starts at F40 time
Related: RHEL-54303
2024-11-14 17:16:04 +01:00
Petr Lautrbach
a6a5f1a3aa Drop removeVarrunModule macro
- use only removeVarrunModuleLua
- drop unknown %triggerpostin triggers

[skip changelog]

Related: RHEL-54303
2024-11-14 17:16:04 +01:00
Petr Lautrbach
f5ea95981c Move changelog to changelog and use %autochangelog
https://docs.pagure.org/Fedora-Infra.rpmautospec/autochangelog.html

`rpmautospec generate-changelog` can be used to preview how the
generated changelog will look

[skip changelog]

Related: RHEL-54303
2024-11-14 17:15:59 +01:00
Zdenek Pytela
3c4abec1be Replace '%%' with '%' in the files section
Related: RHEL-54303
2024-11-14 17:14:03 +01:00
Zdenek Pytela
c9eca3f2d7 Protect the targeted and mls subpackages
Protect the targeted and mls subpackages from uninstallation by dnf
when conditional dependencies may suggest so.

Related: RHEL-54303
2024-11-14 17:14:03 +01:00
Zdenek Pytela
579a5b4d7e Disable rpm verification for the extra_varrun module directory
The extra_varrun module is generated dynamically on packages updates,
based on the current state in the policy.

Related: RHEL-54303
2024-11-14 17:14:03 +01:00
Zbigniew Jędrzejewski-Szmek
bbd4056045 Call binaries without full path
As part of https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin, programs
are moved from /usr/sbin/alternatives to /usr/bin/alternatives. Provisions
have been made to create a compat symlink on traditional systems, so that both
paths work and packages that use paths under /usr/sbin do not need to be
rebuilt. Unfortunately, on ostree systems, the compat symlinks are missing, so
using absolute paths causes problems
(https://bodhi.fedoraproject.org/updates/FEDORA-2024-3aafcac6a8).

There is no reason for or benefit from specifying the full path to binaries in
scriptlets because the scriptlets are called with a well-defined $PATH. When
we drop the full path, they work fine no matter where exactly the binary is
installed.

An additional problem with full paths is that they are specified using macros,
and the macro works fine within a package, but they is no guarantee that
different builds of different packages at different times use the same
definition of %_sbindir.

I also changed /bin/echo → echo. The shell builtin is good enough, we don't need
to spawn a separate process.

Related: RHEL-54303
2024-11-14 17:14:03 +01:00
Petr Lautrbach
bc2b5706de varrun-convert.sh: Backport changes from Rawhide
- Update varrun-convert.sh script to check for existing duplicate
  entries
- Remove incorrect "local" usage in varrun-convert.sh
- Use /usr/bin/bash in scripts as shebang

Related: RHEL-54303
2024-11-14 17:14:03 +01:00
Zdenek Pytela
278c1ad453 * Tue Nov 12 2024 Zdenek Pytela <zpytela@redhat.com> - 40.13.13-1
- Revert "Allow unconfined_t execute kmod in the kmod domain"
Resolves: RHEL-65190
- Add policy for /usr/libexec/samba/samba-bgqd
Resolves: RHEL-64908
- Label samba certificates with samba_cert_t
Resolves: RHEL-64908
- Label /usr/bin/samba-gpupdate with samba_gpupdate_exec_t
Resolves: RHEL-64908
- Allow rpcd read network sysctls
Resolves: RHEL-64737
- Label all semanage store files in /etc as semanage_store_t
Resolves: RHEL-65864
2024-11-12 17:01:30 +01:00
Troy Dawson
27a5e6df40 Bump release for October 2024 mass rebuild:
Resolves: RHEL-64018
2024-10-29 09:13:57 -07:00
Zdenek Pytela
f4aa9187f8 * Thu Oct 24 2024 Zdenek Pytela <zpytela@redhat.com> - 40.13.12-1
- Dontaudit subscription manager setfscreate and read file contexts
Resolves: RHEL-58009
- Allow the sysadm user use the secretmem API
Resolves: RHEL-40953
- Allow sudodomain list files in /var
Resolves: RHEL-58068
- Allow gnome-remote-desktop watch /etc directory
Resolves: RHEL-35877
- Allow journalctl connect to systemd-userdbd over a unix socket
Resolves: RHEL-58072
- systemd: allow sys_admin capability for systemd_notify_t
Resolves: RHEL-58072
- Allow some confined users send to lldpad over a unix dgram socket
Resolves: RHEL-61634
- Allow lldpad send to sysadm_t over a unix dgram socket
Resolves: RHEL-61634
- Allow lldpd connect to systemd-machined over a unix socket
Resolves: RHEL-61634
2024-10-24 22:27:53 +02:00
Zdenek Pytela
04fa3da045 Add the pcm module
Resolves: RHEL-52838
2024-10-23 22:33:28 +02:00
Zdenek Pytela
6c1a8e76be Add the iiosensorproxy module
Resolves: RHEL-62355
2024-10-23 22:33:18 +02:00
Zdenek Pytela
3c47586a8a Add the gnome_remote_desktop module
Resolves: RHEL-35877
2024-10-23 22:28:31 +02:00
Zdenek Pytela
c615292dfa * Wed Oct 23 2024 Zdenek Pytela <zpytela@redhat.com> - 40.13.11-1
- Allow ping_t read network sysctls
Resolves: RHEL-54299
- Label /usr/lib/node_modules/npm/bin with bin_t
Resolves: RHEL-56350
- Label /run/sssd with sssd_var_run_t
Resolves: RHEL-57065
- Allow virtqemud read virtd_t files
Resolves: RHEL-57713
- Allow wdmd read hardware state information
Resolves: RHEL-57982
- Allow wdmd list the contents of the sysfs directories
Resolves: RHEL-57982
- Label /etc/sysctl.d and /run/sysctl.d with system_conf_t
Resolves: RHEL-58380
- Allow dirsrv read network sysctls
Resolves: RHEL-58381
- Allow lldpad create and use netlink_generic_socket
Resolves: RHEL-61634
- Allow unconfined_t execute kmod in the kmod domain
Resolves: RHEL-61755
- Confine the pcm service
Resolves: RHEL-52838
- Allow iio-sensor-proxy the bpf capability
Resolves: RHEL-62355
- Confine iio-sensor-proxy
Resolves: RHEL-62355
2024-10-23 22:23:35 +02:00
Zdenek Pytela
b9f20bbf55 * Wed Oct 16 2024 Zdenek Pytela <zpytela@redhat.com> - 40.13.10-1
- Confine gnome-remote-desktop
Resolves: RHEL-35877
- Allow virtqemud get attributes of a tmpfs filesystem
Resolves: RHEL-40855
- Allow virtqemud get attributes of cifs files
Resolves: RHEL-40855
- Allow virtqemud get attributes of filesystems with extended attributes
Resolves: RHEL-39668
- Allow virtqemud get attributes of NFS filesystems
Resolves: RHEL-40855
- Add support for secretmem anon inode
Resolves: RHEL-40953
- Allow systemd-sleep read raw disk data
Resolves: RHEL-49600
- Allow systemd-hwdb send messages to kernel unix datagram sockets
Resolves: RHEL-50810
- Label /run/modprobe.d with modules_conf_t
Resolves: RHEL-54591
- Allow setsebool_t relabel selinux data files
Resolves: RHEL-55412
- Don't audit crontab_domain write attempts to user home
Resolves: RHEL-56349
- Differentiate between staff and sysadm when executing crontab with sudo
Resolves: RHEL-56349
- Add crontab_admin_domtrans interface
Resolves: RHEL-56349
- Add crontab_domtrans interface
Resolves: RHEL-56349
- Allow boothd connect to kernel over a unix socket
Resolves: RHEL-58060
- Fix label of pseudoterminals created from sudodomain
Resolves: RHEL-58068
- systemd: allow systemd_notify_t to send data to kernel_t datagram sockets
Resolves: RHEL-58072
- Allow rsyslog read systemd-logind session files
Resolves: RHEL-40961
- Label /dev/mmcblk0rpmb character device with removable_device_t
Resolves: RHEL-55265
- Label /dev/hfi1_[0-9]+ devices
Resolves: RHEL-62836
- Label /dev/papr-sysparm and /dev/papr-vpd
Resolves: RHEL-56908
- Support SGX devices
Resolves: RHEL-62354
- Suppress semodule's stderr
Resolves: RHEL-59192
2024-10-16 16:41:17 +02:00
Petr Lautrbach
0c8f629e44 Suppress semodule's stderr
Since libsemanage commit d96f27bf7cb91 ("libsemanage: Preserve file context
and ownership in policy store"), libsemanage tries to preserve file
contexts during SELinux policy rebuild. If the underline fs does not
support any operation used, it prints warnings on stderr. Given that
it's not a fatal error, it's reasonable to suppress them.

Fixes:

    $ podman run --pull=newer --rm -ti quay.io/fedora/fedora:rawhide
    [root@3a1e072c5559 /]# dnf4 install selinux-policy-targeted
    ...
    Could not set context for /var/lib/selinux/targeted/tmp/modules/100/zosremote/cil:  Operation not supported
    Could not set context for /var/lib/selinux/targeted/tmp/modules/100/zosremote/hll:  Operation not supported
    Could not set context for /var/lib/selinux/targeted/tmp/modules/100/zosremote/lang_ext:  Operation not supported
    ...
    Could not set context for /etc/selinux/targeted/contexts/files/file_contexts.homedirs.bin:  Operation not supported
    Could not set context for /etc/selinux/targeted/policy/policy.33:  Operation not supported
    Could not set context for /etc/selinux/targeted/seusers:  Operation not supported

[skip changelog]

Resolves: RHEL-59192
2024-10-10 09:35:08 +02:00
Zdenek Pytela
52526cb202 * Mon Aug 26 2024 Zdenek Pytela <zpytela@redhat.com> - 40.13.9-1
- Allow virtqemud relabelfrom also for file and sock_file
Resolves: RHEL-49763
- Allow virtqemud relabel user tmp files and socket files
Resolves: RHEL-49763
- Update virtqemud policy for libguestfs usage
Resolves: RHEL-49763
- Label /run/libvirt/qemu/channel with virtqemud_var_run_t
Resolves: RHEL-47274
2024-08-26 19:42:36 +02:00
Zdenek Pytela
926debbc11 * Tue Aug 13 2024 Zdenek Pytela <zpytela@redhat.com> - 40.13.8-1
- Add virt_create_log() and virt_write_log() interfaces
Resolves: RHEL-47274
- Update libvirt policy
Resolves: RHEL-45464
Resolves: RHEL-49763
- Allow svirt_tcg_t map svirt_image_t files
Resolves: RHEL-47274
- Allow svirt_tcg_t read vm sysctls
Resolves: RHEL-47274
- Additional updates stalld policy for bpf usage
Resolves: RHEL-50356
2024-08-13 19:32:48 +02:00
Zdenek Pytela
f5b3d7b772 * Thu Aug 08 2024 Zdenek Pytela <zpytela@redhat.com> - 40.13.7-1
- Add the swtpm.if interface file for interactions with other domains
Resolves: RHEL-47274
- Allow virtproxyd create and use its private tmp files
Resolves: RHEL-40499
- Allow virtproxyd read network state
Resolves: RHEL-40499
- Allow virtqemud domain transition on swtpm execution
Resolves: RHEL-47274
Resolves: RHEL-49763
- Allow virtqemud relabel virt_var_run_t directories
Resolves: RHEL-47274
Resolves: RHEL-45464
Resolves: RHEL-49763
- Allow virtqemud domain transition on passt execution
Resolves: RHEL-45464
- Allow virt_driver_domain create and use log files in /var/log
Resolves: RHEL-40239
- Allow virt_driver_domain connect to systemd-userdbd over a unix socket
Resolves: RHEL-44932
Resolves: RHEL-44898
- Update stalld policy for bpf usage
Resolves: RHEL-50356
- Allow boothd connect to systemd-userdbd over a unix socket
Resolves: RHEL-45907
- Allow linuxptp configure phc2sys and chronyd over a unix domain socket
Resolves: RHEL-46011
- Allow systemd-machined manage runtime sockets
Resolves: RHEL-49567
- Allow ip command write to ipsec's logs
Resolves: RHEL-41222
- Allow init_t nnp domain transition to firewalld_t
Resolves: RHEL-52481
- Update qatlib policy for v24.02 with new features
Resolves: RHEL-50377
- Allow postfix_domain map postfix_etc_t files
Resolves: RHEL-46327
2024-08-08 18:12:12 +02:00
Zdenek Pytela
6ebbf22125 * Thu Jul 25 2024 Zdenek Pytela <zpytela@redhat.com> - 40.13.6-1
- Allow virtnodedevd run udev with a domain transition
Resolves: RHEL-39890
- Allow virtnodedev_t create and use virtnodedev_lock_t
Resolves: RHEL-39890
- Allow svirt attach_queue to a virtqemud tun_socket
Resolves: RHEL-44312
- Label /run/systemd/machine with systemd_machined_var_run_t
Resolves: RHEL-49567
2024-07-25 21:02:39 +00:00
Milos Malik
b9a8e2c7de do not run tests which require EPEL repo
There is no EPEL repo for RHEL-10 or CentOS stream 10. It makes
no sense to run tests which require this repo, because they would
fail. Once the EPEL repo becomes available, the part of filter
can be removed.
2024-07-19 08:46:59 +00:00
Zdenek Pytela
85e80ce5b4 * Tue Jul 16 2024 Zdenek Pytela <zpytela@redhat.com> - 40.13.5-1
- Allow to create and delete socket files created by rhsm.service
Resolves: RHEL-40857
- Allow svirt read virtqemud fifo files
Resolves: RHEL-40350
- Allow virt_dbus_t connect to virtqemud_t over a unix stream socket
Resolves: RHEL-37822
- Allow virtqemud read virt-dbus process state
Resolves: RHEL-37822
- Allow virtqemud run ssh client with a transition
Resolves: RHEL-43215
- Allow virtnetworkd exec shell when virt_hooks_unconfined is on
Resolves: RHEL-41168
- Allow NetworkManager the sys_ptrace capability in user namespace
Resolves: RHEL-46717
- Update keyutils policy
Resolves: RHEL-38920
- Allow ip the setexec permission
Resolves: RHEL-41182
2024-07-16 19:27:49 +02:00
Zdenek Pytela
cbb1ba3beb * Fri Jun 28 2024 Zdenek Pytela <zpytela@redhat.com> - 40.13.4-1
- Confine libvirt-dbus
Resolves: RHEL-37822
- Allow sssd create and use io_uring
Resolves: RHEL-43448
- Allow virtqemud the kill capability in user namespace
Resolves: RHEL-44996
- Allow login_userdomain execute systemd-tmpfiles in the caller domain
Resolves: RHEL-44191
- Allow virtqemud read vm sysctls
Resolves: RHEL-40938
- Allow svirt_t read vm sysctls
Resolves: RHEL-40938
- Allow rshim get options of the netlink class for KOBJECT_UEVENT family
Resolves: RHEL-40859
- Allow systemd-hostnamed read the vsock device
Resolves: RHEL-45309
- Allow systemd (PID 1) manage systemd conf files
Resolves: RHEL-45304
- Allow journald read systemd config files and directories
Resolves: RHEL-45304
- Allow systemd_domain read systemd_conf_t dirs
Resolves: RHEL-45304
- Label systemd configuration files with systemd_conf_t
Resolves: RHEL-45304
- Allow dhcpcd the kill capability
Resolves: RHEL-43417
- Add support for libvirt hooks
Resolves: RHEL-41168
2024-06-28 23:24:45 +02:00
Troy Dawson
c4cc684f3c Bump release for June 2024 mass rebuild 2024-06-24 09:24:07 -07:00
Zdenek Pytela
b2c25500b4 * Tue Jun 18 2024 Zdenek Pytela <zpytela@redhat.com> - 40.13.3-1
- Allow virtqemud manage nfs files when virt_use_nfs boolean is on
Resolves: RHEL-40205
- Allow virt_driver_domain read files labeled unconfined_t
Resolves: RHEL-40262
- Allow virt_driver_domain dbus chat with policykit
Resolves: RHEL-40346
- Escape "interface" as a file name in a virt filetrans pattern
Resolves: RHEL-34769
- Allow setroubleshootd get attributes of all sysctls
Resolves: RHEL-40923
- Allow qemu-ga read vm sysctls
Resolves: RHEL-40829
- Allow sbd to trace processes in user namespace
Resolves: RHEL-39989
- Allow request-key execute scripts
Resolves: RHEL-38920
- Update policy for haproxyd
Resolves: RHEL-40877
2024-06-18 17:27:30 +02:00
Zdenek Pytela
1dacbf26a9 * Fri Jun 07 2024 Zdenek Pytela <zpytela@redhat.com> - 40.13.2-1
- Allow all domains read and write z90crypt device
Resolves: RHEL-28539
- Allow dhcpc read /run/netns files
Resolves: RHEL-39510
- Allow bootupd search efivarfs dirs
Resolves: RHEL-39514
2024-06-07 20:11:48 +02:00
Petr Lautrbach
51ba4f33dc Drop baseos-ci gating
Support for STI and workflow-tomorrow based test executions has been
discontinued.
2024-05-21 11:09:54 +02:00
Zdenek Pytela
9359be591b * Fri May 17 2024 Zdenek Pytela <zpytela@redhat.com> - 40.19-1
- Allow postfix smtpd map aliases file
- Ensure dbus communication is allowed bidirectionally
- Label systemd configuration files with systemd_conf_t
- Label /run/systemd/machine with systemd_machined_var_run_t
- Allow systemd-hostnamed read the vsock device
- Allow sysadm execute dmidecode using sudo
- Allow sudodomain list files in /var
- Allow setroubleshootd get attributes of all sysctls
- Allow various services read and write z90crypt device
- Allow nfsidmap connect to systemd-homed
- Allow sandbox_x_client_t dbus chat with accountsd
- Allow system_cronjob_t dbus chat with avahi_t
- Allow staff_t the io_uring sqpoll permission
- Allow staff_t use the io_uring API
- Add support for secretmem anon inode
- Backport /var/run change related improvements
2024-05-18 22:13:10 +00:00
Zdenek Pytela
fd660a4dde Correct some errors in the RPM macro changes from -2
The commands should always end || : , because by policy we should
ensure RPM scriptlets always exit 0:
https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_syntax
Also, rm is in _bindir, not _sbindir.

This seems to have caused a failed test for an nbdkit update:
https://openqa.fedoraproject.org/tests/2628713#
the live image build failed because of a scriptlet error that
seems to be caused by this:

INFO:anaconda.modules.payloads.payload.dnf.transaction_progress:Configuring (running scriptlet for): nbdkit-selinux-1.39.6-1.fc41.noarch 1715870254 02561380439e4e22473970fa46db331b277dc254650fdcb96130a056cadaf02f
INFO:dnf.rpm:/var/tmp/rpm-tmp.ycmrWv: line 10: /usr/sbin/rm: No such file or directory
warning: %post(nbdkit-selinux-1.39.6-1.fc41.noarch) scriptlet failed, exit status 1
ERROR:dnf.rpm:Error in POSTIN scriptlet in rpm package nbdkit-selinux

Signed-off-by: Adam Williamson <awilliam@redhat.com>
2024-05-18 22:13:10 +00:00
Zdenek Pytela
befd3d6c81 Update rpm configuration for the /var/run equivalency change
Various updating and installing scenarios are now supported:
- using rpm triggers for other packages in selinux-policy
- inside the selinux_modules_install and selinux_modules_uninstall
  rpm macros when selinux subpackages are being built
2024-05-18 22:13:10 +00:00
Zdenek Pytela
f05cd533e6 Update repository link and branches names for c10s
Now the fedora-selinux/selinux-policy repository is used
for policy sources and both git and dist-git use the c10s branch.

Related: RHEL-33844
2024-05-18 22:13:10 +00:00
Milos Malik
7cad329921 enable the gating
By adding the gating.yaml file the gating should be enabled.
2024-04-10 08:27:53 +02:00
Zdenek Pytela
0a14f83579 * Mon Feb 12 2024 Zdenek Pytela <zpytela@redhat.com> - 40.13-1
- Only allow confined user domains to login locally without unconfined_login
- Add userdom_spec_domtrans_confined_admin_users interface
- Only allow admindomain to execute shell via ssh with ssh_sysadm_login
- Add userdom_spec_domtrans_admin_users interface
- Move ssh dyntrans to unconfined inside unconfined_login tunable policy
- Update ssh_role_template() for user ssh-agent type
- Allow init to inherit system DBus file descriptors
- Allow init to inherit fds from syslogd
- Allow any domain to inherit fds from rpm-ostree
- Update afterburn policy
- Allow init_t nnp domain transition to abrtd_t
2024-02-12 12:26:33 +01:00
Zdenek Pytela
6dd5c78a95 * Tue Feb 06 2024 Zdenek Pytela <zpytela@redhat.com> - 40.12-1
- Rename all /var/lock file context entries to /run/lock
- Rename all /var/run file context entries to /run
- Invert the "/var/run = /run" equivalency
2024-02-06 14:25:48 +01:00
Zdenek Pytela
0ec128677b * Mon Feb 05 2024 Zdenek Pytela <zpytela@redhat.com> - 40.11-1
- Replace init domtrans rule for confined users to allow exec init
- Update dbus_role_template() to allow user service status
- Allow polkit status all systemd services
- Allow setroubleshootd create and use inherited io_uring
- Allow load_policy read and write generic ptys
- Allow gpg manage rpm cache
- Allow login_userdomain name_bind to howl and xmsg udp ports
- Allow rules for confined users logged in plasma
- Label /dev/iommu with iommu_device_t
- Remove duplicate file context entries in /run
- Dontaudit getty and plymouth the checkpoint_restore capability
- Allow su domains write login records
- Revert "Allow su domains write login records"
- Allow login_userdomain delete session dbusd tmp socket files
- Allow unix dgram sendto between exim processes
- Allow su domains write login records
- Allow smbd_t to watch user_home_dir_t if samba_enable_home_dirs is on
2024-02-05 16:57:20 +01:00
Zdenek Pytela
ac73b2b07b * Wed Jan 24 2024 Zdenek Pytela <zpytela@redhat.com> - 40.10-1
- Allow chronyd-restricted read chronyd key files
- Allow conntrackd_t to use bpf capability2
- Allow systemd-networkd manage its runtime socket files
- Allow init_t nnp domain transition to colord_t
- Allow polkit status systemd services
- nova: Fix duplicate declarations
- Allow httpd work with PrivateTmp
- Add interfaces for watching and reading ifconfig_var_run_t
- Allow collectd read raw fixed disk device
- Allow collectd read udev pid files
- Set correct label on /etc/pki/pki-tomcat/kra
- Allow systemd domains watch system dbus pid socket files
- Allow certmonger read network sysctls
- Allow mdadm list stratisd data directories
- Allow syslog to run unconfined scripts conditionally
- Allow syslogd_t nnp_transition to syslogd_unconfined_script_t
- Allow qatlib set attributes of vfio device files
2024-01-24 21:28:05 +01:00
Zdenek Pytela
443b716de1 * Tue Jan 09 2024 Zdenek Pytela <zpytela@redhat.com> - 40.9-1
- Allow systemd-sleep set attributes of efivarfs files
- Allow samba-dcerpcd read public files
- Allow spamd_update_t the sys_ptrace capability in user namespace
- Allow bluetooth devices work with alsa
- Allow alsa get attributes filesystems with extended attributes
2024-01-09 20:59:16 +01:00
Yaakov Selkowitz
e46b929e63 Limit %selinux_requires to version, not release
Using exact NVR dependencies works well within RPMS from a single SRPM,
but otherwise relies on assumptions which do not always hold out.
Because %release includes %dist, this is particularly fragile in the
context of the Rawhide->ELN->c10s build pipeline.  For instance, if a
package which uses %selinux_requires gets built for ELN with the rawhide
selinux-policy, then .fcNN will be hardcoded into the ELN build, and the
ELN build with .elnNNN will never meet the condition (since f > e).
2024-01-02 11:15:16 -05:00