2028 Commits

Author	SHA1	Message	Date
Dan Walsh	b4b0268a28	Remove qemu.pp, everything should use svirt_t or stay in its current domain	2011-10-26 15:42:29 -04:00
Dan Walsh	084f9557dc	Allow policykit to talk to the systemd via dbus ... Move chrome_sandbox_nacl_t to permissive domains Additional rules for chrome_sandbox_nacl	2011-10-26 08:49:22 -04:00
Dan Walsh	fa26d89bd5	Change bootstrap name to nacl ... Chrome still needs execmem Missing role for chrome_sandbox_bootstrap Add boolean to remove execmem and execstack from virtual machines Dontaudit xdm_t doing an access_check on etc_t directories	2011-10-25 13:27:37 -04:00
Dan Walsh	44066bd77a	Allow named to connect to dirsrv by default ... add ldapmap1_0 as a krb5_host_rcache_t file Google chrome developers asked me to add bootstrap policy for nacl stuff Allow rhev_agentd_t to getattr on mountpoints Postfix_smtpd_t needs access to milters and cleanup seems to read/write postfix_smtpd_t unix_stream_sockets	2011-10-25 09:12:49 -04:00
Dan Walsh	3dcddab74d	Allow firewallgui to read /etc/selinux/config	2011-10-24 13:39:32 -04:00
Miroslav	b6ae8086ef	- Fixes for cloudform policies which need to connect to random ports ... - Make sure if an admin creates modules content it creates them with the correct label - Add port 8953 as a dns port used by unbound - Fix file name transition for alsa and confined users	2011-10-24 10:57:01 +02:00
Dan Walsh	1a2b4d14f1	Turn on mock_t and thumb_t for unconfined domains	2011-10-21 16:44:31 -04:00
Dan Walsh	f875d285bd	Turn on mock_t and thumb_t for unconfined domains	2011-10-21 16:37:11 -04:00
Dan Walsh	e1f17eb990	Policy update should not modify local contexts	2011-10-21 09:42:14 -04:00
Dan Walsh	052e175084	Remove ada policy	2011-10-20 14:33:31 -04:00
Dan Walsh	b01657ac51	Remove ada policy	2011-10-20 14:21:03 -04:00
Dan Walsh	61fa8d555e	Remove tzdata policy ... Remove ada policy Add labeling for udev Add cloudform policy Fixes for bootloader policy	2011-10-20 12:30:06 -04:00
Dan Walsh	8214f7881a	Remove tzdata policy ... Remove ada domain	2011-10-20 12:24:32 -04:00
Miroslav	1944b1a36e	Remove tzdata policy	2011-10-20 18:00:51 +02:00
Dan Walsh	087aaea152	Remove tzdata domain, only necessary to make sure stuff is labeled correctly.	2011-10-20 11:43:18 -04:00
Dan Walsh	a56e13e7b8	Add policies for nova openstack	2011-10-19 08:31:34 -04:00
Dan Walsh	4dba2eb895	Allow svirt_lxc_domain to chr_file and blk_file devices if they are in the domain ... Allow init process to setrlimit on itself Take away transition rules for users executing ssh-keygen Allow setroubleshoot_fixit_t to read /dev/urand Allow sshd to relbale tunnel sockets Allow fail2ban domtrans to shorewall in the same way as with iptables Add support for lnk files in the /var/lib/sssd directory Allow system mail to connect to courier-authdaemon over an unix stream socket	2011-10-19 08:29:33 -04:00
Dan Walsh	1414f9f3a7	Allow svirt_lxc_domain to chr_file and blk_file devices if they are in the domain ... Allow init process to setrlimit on itself Take away transition rules for users executing ssh-keygen Allow setroubleshoot_fixit_t to read /dev/urand Allow sshd to relbale tunnel sockets Allow fail2ban domtrans to shorewall in the same way as with iptables Add support for lnk files in the /var/lib/sssd directory Allow system mail to connect to courier-authdaemon over an unix stream socket	2011-10-18 10:12:22 -04:00
Dan Walsh	9bf3aa2c96	Add passwd_file_t for /etc/ptmptmp	2011-10-17 15:51:24 -04:00
Dan Walsh	e29441a5cc	Dontaudit access checks for all executables, gnome-shell is doing access(EXEC, X_OK) ... Make corosync to be able to relabelto cluster lib fies Allow samba domains to search /var/run/nmbd Allow dirsrv to use pam Allow thumb to call getuid chrome less likely to get mmap_zero bug so removing dontaudit gimp help-browser has built in javascript Best guess is that devices named /dev/bsr4096 should be labeled as cpu_device_t Re-write glance policy	2011-10-14 09:50:55 -04:00
Dan Walsh	2453975e3d	Move dontaudit sys_ptrace line from permissive.te to domain.te ... Remove policy for hal, it no longer exists	2011-10-13 15:43:15 -04:00
Dan Walsh	042e3a325f	Don't check md5 size or mtime on certain config files	2011-10-12 15:42:07 -04:00
Dan Walsh	2f4dfeb425	Remove allow_ptrace and replace it with deny_ptrace, which will remove all ... ptrace from the system Remove 2000 dontaudit rules between confined domains on transition and replace with single dontaudit domain domain:process { noatsecure siginh rlimitinh } ;	2011-10-12 10:13:18 -04:00
Dan Walsh	6554bb3cca	Remove allow_ptrace and replace it with deny_ptrace, which will remove all ... ptrace from the system Remove 2000 dontaudit rules between confined domains on transition and replace with single dontaudit domain domain:process { noatsecure siginh rlimitinh } ;	2011-10-11 16:46:26 -04:00
Dan Walsh	2a89dffbb5	Shrink size of policy through use of attributes for userdomain and apache	2011-10-06 10:53:27 -04:00
Miroslav	1000555932	Fix spec file	2011-10-05 23:57:40 +02:00
Miroslav	54943f9472	- Allow virsh to read xenstored pid file ... - Backport corenetwork fixes from upstream - Do not audit attempts by thumb to search config_home_t dirs (~/.config) - label ~/.cache/telepathy/logger telepathy_logger_cache_home_t - allow thumb to read generic data home files (mime.type)	2011-10-05 23:48:25 +02:00
Dan Walsh	859ba0c85a	Allow nmbd to manage sock file in /var/run/nmbd ... ricci_modservice send syslog msgs Stop transitioning from unconfined_t to ldconfig_t, but make sure /etc/ld.so.cache is labeled correctly Allow systemd_logind_t to manage /run/USER/dconf/user	2011-10-05 17:14:02 -04:00
Dan Walsh	14d7aac744	Fix missing patch from F16	2011-10-04 11:34:14 -04:00
Dan Walsh	f1bc73d0ef	Allow logrotate setuid and setgid since logrotate is supposed to do it ... Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t	2011-10-04 10:50:39 -04:00
Dan Walsh	e15ae4fa84	Fixes caused by the labeling of /etc/passwd ... Add thumb.patch to transition unconfined_t to thumb_t for Rawhide	2011-09-30 10:22:41 -04:00
Dan Walsh	a004ca8c3a	Fixes caused by the labeling of /etc/passwd	2011-09-29 13:50:39 -04:00
Miroslav	0247247d56	+- Add support for Clustered Samba commands ... +- Allow ricci_modrpm_t to send log msgs +- move permissive virt_qmf_t from virt.te to permissivedomains.te +- Allow ssh_t to use kernel keyrings +- Add policy for libvirt-qmf and more fixes for linux containers +- Initial Polipo +- Sanlock needs to run ranged in order to kill svirt processes +- Allow smbcontrol to stream connect to ctdbd	2011-09-29 16:25:09 +02:00
Dan Walsh	4d24861bc2	Add label for /etc/passwd	2011-09-28 16:18:43 -04:00
Miroslav	1b20a51a85	Add grub.patch	2011-09-28 01:09:22 +02:00
Dan Walsh	24b80bf8d9	Make unconfined domains permissive for rawhide ... Add definition for ephermeral ports	2011-09-27 10:16:54 -04:00
Miroslav	02a8a402a1	- Make mta_role() active ... - Allow asterisk to connect to jabber client port - Allow procmail to read utmp - Add NIS support for systemd_logind_t - Allow systemd_logind_t to manage /run/user/$USER/dconf dir which is labeled a - Fix systemd_manage_unit_dirs() interface - Allow ssh_t to manage directories passed into it - init needs to be able to create and delete unit file directories - Fix typo in apache_exec_sys_script - Add ability for logrotate to transition to awstat domain	2011-09-26 12:32:44 +02:00
Miroslav Grepl	1aafd0f4bc	Fix spec file	2011-09-23 17:59:34 +02:00
Miroslav Grepl	031161f80b	Fix spec file	2011-09-23 17:58:45 +02:00
Miroslav	f9c350238c	+- Change screen to use screen_domain attribute and allow screen_domains to read all process domain state ... +- Add SELinux support for ssh pre-auth net process in F17 +- Add logging_syslogd_can_sendmail boolean	2011-09-23 13:57:44 +02:00
Dan Walsh	747b715541	Add definition for ephemeral ports ... Define user_tty_device_t as a customizable_type	2011-09-21 08:39:14 -04:00
Miroslav	dec0110c4c	- Needs to require a new version of checkpolicy ... - Interface fixes	2011-09-20 16:24:24 +02:00
Miroslav	40af2abfd0	- Allow sanlock to manage virt lib files ... - Add virt_use_sanlock booelan - ksmtuned is trying to resolve uids - Make sure .gvfs is labeled user_home_t in the users home directory - Sanlock sends kill signals and needs the kill capability - Allow mockbuild to work on nfs homedirs - Fix kerberos_manage_host_rcache() interface - Allow exim to read system state	2011-09-16 15:09:15 +02:00
Dan Walsh	a59df1059d	Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy	2011-09-15 08:58:51 -04:00
Dan Walsh	9c4a933844	Make seusers config noreplace	2011-09-15 08:58:37 -04:00
Miroslav	b3edab31fb	- Allow systemd-tmpfiles to set the correct labels on /var/run, /tmp and other files ... - We want any file type that is created in /tmp by a process running as initrc_t to be labeled initrc_tmp_t	2011-09-14 16:11:08 +02:00
Miroslav	e8563b3245	+- Allow collectd to read hardware state information ... +- Add loop_control_device_t +- Allow mdadm to request kernel to load module +- Allow domains that start other domains via systemctl to search unit dir +- systemd_tmpfiles, needs to list any file systems mounted on /tmp +- No one can explain why radius is listing the contents of /tmp, so we will dontaudit +- If I can manage etc_runtime files, I should be able to read the links +- Dontaudit hostname writing to mock library chr_files +- Have gdm_t setup labeling correctly in users home dir +- Label content unde /var/run/user/NAME/dconf as config_home_t +- Allow sa-update to execute shell +- Make ssh-keygen working with fips_enabled +- Make mock work for staff_t user +- Tighten security on mock_t	2011-09-13 16:17:16 +02:00
Miroslav	b1448b79b1	Fix typo in spec file	2011-09-09 13:31:15 +02:00
Miroslav	116a117fba	- removing unconfined_notrans_t no longer necessary ... - Clean up handling of secure_mode_insmod and secure_mode_policyload - Remove unconfined_mount_t	2011-09-09 13:28:28 +02:00
Miroslav	5b0c573864	- Add exim_exec_t label for /usr/sbin/exim_tidydb ... - Call init_dontaudit_rw_stream_socket() interface in mta policy - sssd need to search /var/cache/krb5rcache directory - Allow corosync to relabel own tmp files - Allow zarafa domains to send system log messages - Allow ssh to do tunneling - Allow initrc scripts to sendto init_t unix_stream_socket - Changes to make sure dmsmasq and virt directories are labeled corr - Changes needed to allow sysadm_t to manage systemd unit files - init is passing file descriptors to dbus and on to system daemons - Allow sulogin additional access Reported by dgrift and Jeremy Mill - Steve Grubb believes that wireshark does not need this access - Fix /var/run/initramfs to stop restorecon from looking at - pki needs another port - Add more labels for cluster scripts - Allow apps that manage cgroup_files to manage cgroup link files - Fix label on nfs-utils scripts directories - Allow gatherd to read /dev/rand and /dev/urand	2011-09-06 13:51:30 +02:00
Miroslav	392fd7310f	- pki needs another port ... - Add more labels for cluster scripts - Fix label on nfs-utils scripts directories - Fixes for cluster - Allow gatherd to read /dev/rand and /dev/urand - abrt leaks fifo files	2011-08-31 22:51:47 +02:00
Dan Walsh	e6877a0621	Add glance policy ... Allow mdadm setsched /var/run/initramfs should not be relabeled with a restorecon run memcache can be setup to override sys_resource Allow httpd_t to read tetex data Allow systemd_tmpfiles to delete kernel modules left in /tmp directory.	2011-08-31 09:25:39 -04:00
Miroslav	1c136fe943	- Allow Postfix to deliver to Dovecot LMTP socket ... - Ignore bogus sys_module for lldpad - Allow chrony and gpsd to send dgrams, gpsd needs to write to the real time clock - systemd_logind_t sets the attributes on usb devices - Allow hddtemp_t to read etc_t files - Add permissivedomains module - Move all permissive domains calls to permissivedomain.te - Allow pegasis to send kill signals to other UIDs	2011-08-29 14:07:18 +02:00
Miroslav	2f3d113f19	- Allow insmod_t to use fds leaked from devicekit ... - dontaudit getattr between insmod_t and init_t unix_stream_sockets - Change sysctl unit file interfaces to use systemctl - Add support for chronyd unit file - Allow mozilla_plugin to read gnome_usr_config - Add policy for new gpsd - Allow cups to create kerberos rhost cache files - Add authlogin_filetrans_named_content, to unconfined_t to make sure shadow and other log files get labeled correctly	2011-08-24 10:24:46 +02:00
Dan Walsh	22a1cfd7d6	Make users_extra and seusers.final into config(noreplace) so semanage users and login does not get overwritten	2011-08-23 13:59:04 -04:00
Dan Walsh	ba2e58cd41	Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy	2011-08-23 13:54:26 -04:00
Dan Walsh	39eb9ea8c1	Make users_extra and seusers.final into config no replace so semanage users and semanage login files do not get overwritten	2011-08-23 13:54:16 -04:00
Miroslav	24041fb3a0	- Add policy for sa-update being run out of cron jobs ... - Add create perms to postgresql_manage_db - ntpd using a gps has to be able to read/write generic tty_device_t - If you disable unconfined and unconfineduser, rpm needs more privs to ma - fix spec file - Remove qemu_domtrans_unconfined() interface - Make passenger working together with puppet - Add init_dontaudit_rw_stream_socket interface - Fixes for wordpress	2011-08-23 11:03:30 +02:00
Dan Walsh	5d837b2d13	Do not do preinstall if there is not previous install	2011-08-22 16:30:00 -04:00
Miroslav	8d13f53c05	- Turn on allow_domain_fd_use boolean on F16 ... - Allow syslog to manage all log files - Add use_fusefs_home_dirs boolean for chrome - Make vdagent working with confined users - Add abrt_handle_event_t domain for ABRT event scripts - Labeled /usr/sbin/rhnreg_ks as rpm_exec_t and added changes related to this change - Allow httpd_git_script_t to read passwd data - Allow openvpn to set its process priority when the nice parameter is used	2011-08-11 16:50:01 +02:00
Dan Walsh	10f0de0090	livecd fixes ... spec file fixes	2011-08-10 14:00:28 -04:00
Dan Walsh	8a78e8623e	Cleanup spec file to remove rpmnew files	2011-08-05 16:16:08 -04:00
Miroslav	913fabe1c8	- fetchmail can use kerberos ... - ksmtuned reads in shell programs - gnome_systemctl_t reads the process state of ntp - dnsmasq_t asks the kernel to load multiple kernel mod - Add rules for domains executing systemctl - Bogus text within fc file	2011-08-04 22:32:55 +02:00
Dan Walsh	41a18182a5	storage should be in base	2011-08-03 16:21:21 -04:00
Dan Walsh	8becfd3523	Add cfengine policy	2011-08-03 10:22:38 -04:00
Miroslav	2aa62d446f	- Add abrt_domain attribute ... - Allow corosync to manage cluster lib files - Allow corosync to connect to the system DBUS	2011-08-02 21:35:30 +02:00
Miroslav	58f5509584	- More fixes of rules which cause an explosion in rules by Dan Walsh	2011-07-29 14:18:40 +02:00
Miroslav	0c240d9a87	- Allow rcsmcertd to perform DNS name resolution ... - Add dirsrvadmin_unconfined_script_t domain type for 389-ds admin scripts - Allow tmux to run as screen - New policy for collectd - Allow gkeyring_t to interact with all user apps - Add rules to allow firstboot to run on machines with the unconfined.pp module	2011-07-26 17:21:09 +02:00
Miroslav	f5593ed9be	- Allow systemd_logind to send dbus messages with users ... - allow accountsd to read wtmp file - Allow dhcpd to get and set capabilities	2011-07-23 09:10:19 +02:00
Miroslav	6e9c2276f7	- Fix oracledb_port definition ... - Allow mount to mounton the selinux file system - Allow users to list /var directories	2011-07-22 12:37:49 +02:00
Miroslav	273e934611	systemd fixes	2011-07-21 17:22:47 +02:00
Miroslav	2ed5289fc9	- Add initial policy for abrt_dump_oops_t ... - xtables-multi wants to getattr of the proc fs - Smoltclient is connecting to abrt - Dontaudit leaked file descriptors to postdrop - Allow abrt_dump_oops to look at kernel sysctls - Abrt_dump_oops_t reads kernel ring buffer - Allow mysqld to request the kernel to load modules - systemd-login needs fowner - Allow postfix_cleanup_t to searh maildrop	2011-07-19 17:44:23 +02:00
Miroslav Grepl	805cc3bcdf	- Initial systemd_logind policy ... - Add policy for systemd_logger and additional proivs for systemd_logind - More fixes for systemd policies	2011-07-18 08:17:03 +02:00
Miroslav Grepl	2b7c0552d7	- Allow setsched for virsh ... - Systemd needs to impersonate cups, which means it needs to create tcp_sock - iptables: the various /sbin/ip6?tables.* are now symlinks for /sbin/xtables-mult	2011-07-14 18:49:37 +02:00
Miroslav Grepl	50f07b8abf	Fix spec file	2011-07-12 14:59:13 +02:00
Miroslav Grepl	330eac5848	- A lot of users are running yum -y update while in /root which is causing ldc ... - Allow colord to interact with the users through the tmpfs file system - Since we changed the label on deferred, we need to allow postfix_qmgr_t to b - Add label for /var/log/mcelog - Allow asterisk to read /dev/random if it uses TLS - Allow colord to read ini files which are labeled as bin_t - Allow dirsrvadmin sys_resource and setrlimit to use ulimit - Systemd needs to be able to create sock_files for every label in /var/run di - Also lists /var and /var/spool directories - Add openl2tpd to l2tpd policy - qpidd is reading the sysfs file	2011-07-12 09:44:07 +02:00
Dan Walsh	fb5b77fade	Fully path the semodule command	2011-07-01 06:35:11 -04:00
Miroslav Grepl	975370d58e	- Change usbmuxd_t to dontaudit attempts to read chr_file ... - Add mysld_safe_exec_t for libra domains to be able to start private mysql dom - Allow pppd to search /var/lock dir - Add rhsmcertd policy	2011-06-30 17:55:41 +02:00
Miroslav Grepl	ade486af72	Update to upstream	2011-06-27 18:02:16 +02:00
Miroslav Grepl	2885bf8a6e	- More fixes ... * http://git.fedorahosted.org/git/?p=selinux-policy.git	2011-06-27 08:43:05 +02:00
Dan Walsh	7e1b615aa4	Next attempt at getting selinux-policy-* to work without rebuilding policy.	2011-06-16 12:01:25 -04:00
Dan Walsh	cf012ea57e	Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy	2011-06-16 08:58:41 -04:00
Dan Walsh	8782a92ced	Change required policycoreutils and libsemanage	2011-06-16 08:58:19 -04:00
Miroslav Grepl	4fb7b43f62	- Add dspam policy ... - Add lldpad policy - dovecot auth wants to search statfs #713555 - Allow systemd passwd apps to read init fifo_file - Allow prelink to use inherited terminals - Run cherokee in the httpd_t domain - Allow mcs constraints on node connections - Implement pyicqt policy - Fixes for zarafa policy - Allow cobblerd to send syslog messages	2011-06-16 10:42:42 +02:00
Dan Walsh	857c813190	Eliminate olpc stuff and other no longer needed files. Update to new system to build policy.* file within payload.	2011-06-09 22:36:45 -04:00
Dan Walsh	d0597c1c15	apply merge	2011-06-08 12:17:39 -04:00
Miroslav Grepl	183e54f534	Old passanger module needs to be removed in spec file	2011-06-08 17:41:02 +02:00
Miroslav Grepl	d8b121329f	- Fixes for zabbix ... - init script needs to be able to manage sanlock_var_run_... - Allow sandlock and wdmd to create /var/run directories... - mixclip.so has been compiled correctly - Fix passenger policy module name	2011-06-08 17:32:27 +02:00
Dan Walsh	5253d49ee9	Update from git	2011-06-07 14:43:31 -04:00
Miroslav Grepl	94cdbacbd8	- Add mailscanner policy from dgrift ... - Allow chrome to optionally be transitioned to - Zabbix needs these rules when starting the zabbix_server_mysql - Implement a type for freedesktop openicc standard (~/.local/share/icc) - Allow system_dbusd_t to read inherited icc_data_home_t files. - Allow colord_t to read icc_data_home_t content. #706975 - Label stuff under /usr/lib/debug as if it was labeled under /	2011-06-07 18:12:04 +02:00
Dan Walsh	0535650520	Allow policy.VERSION and modules to ship with package	2011-06-07 11:09:32 -04:00
Miroslav Grepl	0e70f655b4	Fix spec file	2011-06-02 15:17:47 +02:00
Miroslav Grepl	a56fb9fa8f	- Fixes for sanlock policy ... - Fixes for colord policy - Other fixes * http://git.fedorahosted.org/git/?p=selinux-policy.git;a=log	2011-06-02 15:16:46 +02:00
Miroslav Grepl	a8e065be61	- Add rhev policy module to modules-targeted.conf	2011-05-26 14:16:59 +02:00
Miroslav Grepl	ace25237f9	- Lot of fixes ... * http://git.fedorahosted.org/git/?p=selinux-policy.git;a=log	2011-05-24 16:38:28 +02:00
Dan Walsh	d97c92c34b	New policy patch requires updated checkpolicy package	2011-05-23 18:27:11 -04:00
Miroslav Grepl	cb71de50e9	- Allow logrotate to execute systemctl ... - Allow nsplugin_t to getattr on gpmctl - Fix dev_getattr_all_chr_files() interface - Allow shorewall to use inherited terms - Allow userhelper to getattr all chr_file devices - sandbox domains should be able to getattr and dontaudit search of sysctl_kernel_t - Fix labeling for ABRT Retrace Server	2011-05-19 18:12:32 +02:00
Dan Walsh	7fbbd6f924	Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy	2011-05-09 14:40:43 -04:00
Miroslav Grepl	27bf70c04e	- Dontaudit sys_module for ifconfig ... - Make telepathy and gkeyringd daemon working with confined users - colord wants to read files in users homedir - Remote login should be creating user_tmp_t not its own tmp files	2011-05-09 20:39:25 +00:00
Dan Walsh	ff120d7be5	Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy	2011-05-06 10:51:56 -04:00
Miroslav Grepl	cfc00b53cb	- Fix label for /usr/share/munin/plugins/munin_* plugins ... - Add support for zarafa-indexer - Fix boolean description - Allow colord to getattr on /proc/scsi/scsi - Add label for /lib/upstart/init - Colord needs to list /mnt	2011-05-05 14:39:44 +00:00
Dan Walsh	e81c7996c4	Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy	2011-05-03 16:37:04 -04:00
Miroslav Grepl	6347ee7725	- Forard port changes from F15 for telepathy ... - NetworkManager should be allowed to use /dev/rfkill - Fix dontaudit messages to say Domain to not audit - Allow telepathy domains to read/write gnome_cache files - Allow telepathy domains to call getpw - Fixes for colord and vnstatd policy	2011-05-03 19:46:26 +00:00
Miroslav Grepl	b02295db9b	- Allow init_t getcap and setcap ... - Allow namespace_init_t to use nsswitch - aisexec will execute corosync - colord tries to read files off noxattr file systems - Allow init_t getcap and setcap	2011-04-27 16:15:38 +00:00
Dan Walsh	99b2fe91aa	Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy	2011-04-27 11:06:38 -04:00
Dan Walsh	402e7b8a4a	Default telepath to allow it to connect to network ports	2011-04-21 18:26:23 -04:00
Miroslav Grepl	a8c63d7e69	- Add support for ABRT retrace server ... - Allow user_t and staff_t access to generic scsi to handle locally plugged in scanners - Allow telepath_msn_t to read /proc/PARENT/cmdline - ftpd needs kill capability - Allow telepath_msn_t to connect to sip port - keyring daemon does not work on nfs homedirs - Allow $1_sudo_t to read default SELinux context - Add label for tgtd sock file in /var/run/ - Add apache_exec_rotatelogs interface - allow all zaraha domains to signal themselves, server writes to /tmp - Allow syslog to read the process state - Add label for /usr/lib/chromium-browser/chrome - Remove the telepathy transition from unconfined_t - Dontaudit sandbox domains trying to mounton sandbox_file_t, this is caused by fuse mounts - Allow initrc_t domain to manage abrt pid files - Add support for AEOLUS project - Virt_admin should be allowed to manage images and processes - Allow plymountd to send signals to init - Change labeling of fping6	2011-04-21 16:35:40 +00:00
Dan Walsh	ff64d9c354	Accidently checked in my test spec file	2011-04-21 10:07:57 -04:00
Dan Walsh	bd16f8dd70	Readd my patch	2011-04-19 11:36:13 -04:00
Dan Walsh	9bd1686ff7	Move to version 26 of policy	2011-04-19 11:34:24 -04:00
Miroslav Grepl	a357639bb0	- Fixes for zarafa policy ... - Add support for AEOLUS project - Change labeling of fping6 - Allow plymountd to send signals to init - Allow initrc_t domain to manage abrt pid files - Virt_admin should be allowed to manage images and processes	2011-04-19 13:53:55 +00:00
Dan Walsh	637b33d9f3	Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy ... Conflicts: selinux-policy.spec	2011-04-15 14:24:32 -04:00
Miroslav Grepl	6ac26422cc	- xdm_t needs getsession for switch user ... - Every app that used to exec init is now execing systemdctl - Allow squid to manage krb5_host_rcache_t files - Allow foghorn to connect to agentx port - Fixes for colord policy	2011-04-15 09:08:10 +00:00
Dan Walsh	e935d25737	Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy ... Conflicts: selinux-policy.spec	2011-04-12 10:57:09 -04:00
Dan Walsh	826311d497	Testing	2011-04-11 17:06:55 -04:00
Miroslav Grepl	1b7c8fcdf6	- Add Dan's patch to remove 64 bit variants ... - Allow colord to use unix_dgram_socket - Allow apps that search pids to read /var/run if it is a lnk_file - iscsid_t creates its own directory - Allow init to list var_lock_t dir - apm needs to verify user accounts auth_use_nsswitch - Add labeling for systemd unit files - Allow gnomeclok to enable ntpd service using systemctl - systemd_syst - Add label for matahari-broker.pid file - We want to remove untrustedmcsprocess from ability to read /proc/pid - Fixes for matahari policy - Allow system_tmpfiles_t to delete user_home_t files in the /tmp dir - Allow sshd to transition to sysadm_t if ssh_sysadm_login is turned on	2011-04-11 07:58:00 +00:00
Dan Walsh	86354fa4cc	Remove lib64 mapping and use subs. change subs name to file_context.subs_dist	2011-04-05 15:30:24 -04:00
Miroslav Grepl	2130480ad3	- Fix typo	2011-04-05 09:38:41 +00:00
Miroslav Grepl	397c1e2d5c	- Add /var/run/lock /var/lock definition to file_contexts.subs ... - nslcd_t is looking for kerberos cc files - SSH_USE_STRONG_RNG is 1 which requires /dev/random - Fix auth_rw_faillog definition - Allow sysadm_t to set attributes on fixed disks - allow user domains to execute lsof and look at application sockets - prelink_cron job calls telinit -u if init is rewritten - Fixes to run qemu_t from staff_t	2011-04-04 23:41:02 +00:00
Dan Walsh	568f781d20	Update to latest versions and change policy version	2011-04-04 16:50:06 -04:00
Miroslav Grepl	81c96b1880	comment out the sepolgen line	2011-04-04 20:43:56 +00:00
Miroslav Grepl	aaa0ee57f3	comment out the sepolgen line	2011-04-04 20:33:32 +00:00
Miroslav Grepl	68129209ed	comment out the sepolgen line	2011-04-04 20:16:34 +00:00
Miroslav Grepl	fb7e97f251	- Fix label for /var/run/udev to udev_var_run_t ... - Mock needs to be able to read network state	2011-04-04 17:35:35 +00:00
Miroslav Grepl	a7705c54e1	- Add file_contexts.subs to handle /run and /run/lock ... - Add other fixes relating to /run changes from F15 policy	2011-04-01 16:12:27 +00:00
Miroslav Grepl	36d3f31dcf	- Allow $1_sudo_t and $1_su_t open access to user terminals ... - Allow initrc_t to use generic terminals - Make Makefile/Rules.modular run sepolgen-ifgen during build to check if files for bugs -systemd is going to be useing /run and /run/lock for early bootup files. - Fix some comments in rlogin.if - Add policy for KDE backlighthelper - sssd needs to read ~/.k5login in nfs, cifs or fusefs file systems - sssd wants to read .k5login file in users homedir - setroubleshoot reads executables to see if they have TEXTREL - Add /var/spool/audit support for new version of audit - Remove kerberos_connect_524() interface calling - Combine kerberos_master_port_t and kerberos_port_t - systemd has setup /dev/kmsg as stderr for apps it executes - Need these access so that init can impersonate sockets on unix_dgram_socket	2011-03-25 14:54:13 +00:00
Miroslav Grepl	47d5c167a8	- Remove some unconfined domains ... - Remove permissive domains - Add policy-term.patch from Dan	2011-03-23 23:53:27 +00:00
Miroslav Grepl	7c23cf73df	Fix multiple specification for boot.log	2011-03-17 16:01:12 +00:00
Miroslav Grepl	f5eb99f70b	- devicekit leaks file descriptors to setfiles_t ... - Change all all_nodes to generic_node and all_if to generic_if - Should not use deprecated interface - Switch from using all_nodes to generic_node and from all_if to generic_if - Add support for xfce4-notifyd - Fix file context to show several labels as SystemHigh - seunshare needs to be able to mounton nfs/cifs/fusefs homedirs - Add etc_runtime_t label for /etc/securetty - Fixes to allow xdm_t to start gkeyringd_USERTYPE_t directly - login.krb needs to be able to write user_tmp_t - dirsrv needs to bind to port 7390 for dogtag - Fix a bug in gpg policy - gpg sends audit messages - Allow qpid to manage matahari files	2011-03-17 15:46:18 +00:00
Miroslav Grepl	af4c0d3f1e	- Initial policy for matahari ... - Add dev_read_watchdog - Allow clamd to connect clamd port - Add support for kcmdatetimehelper - Allow shutdown to setrlimit and sys_nice - Allow systemd_passwd to talk to /dev/log before udev or syslog is runni - Purge chr_file and blk files on /tmp - Fixes for pads - Fixes for piranha-pulse - gpg_t needs to be able to encyprt anything owned by the user	2011-03-15 20:59:57 +00:00
Miroslav Grepl	f7f5ca9228	+- mozilla_plugin_tmp_t needs to be treated as user tmp files ... +- More dontaudits of writes from readahead +- Dontaudit readahead_t file_type:dir write, to cover up kernel bug +- systemd_tmpfiles needs to relabel faillog directory as well as the file +- Allow hostname and consoletype to r/w inherited initrc_tmp_t files handline hostname >> /tmp/myhost	2011-03-10 22:02:46 +00:00
Miroslav Grepl	8d54634624	- Add policykit fixes from Tim Waugh ... - dontaudit sandbox domains sandbox_file_t:dir mounton - Add new dontaudit rules for sysadm_dbusd_t - Change label for /var/run/faillock	2011-03-10 12:46:20 +00:00
Miroslav Grepl	9b89d85005	Fix minimum policy	2011-03-08 18:36:28 +00:00
Miroslav Grepl	6726024e43	Update to upstream	2011-03-08 18:28:56 +00:00
Miroslav Grepl	781f349e05	- gpg_t needs to talk to gnome-keyring ... - nscd wants to read /usr/tmp->/var/tmp to generate randomziation in unixchkpwd - enforce MCS labeling on nodes - Allow arpwatch to read meminfo - Allow gnomeclock to send itself signals - init relabels /dev/.udev files on boot - gkeyringd has to transition back to staff_t when it runs commands in bin_t or shell_ - nautilus checks access on /media directory before mounting usb sticks, dontaudit acc - dnsmasq can run as a dbus service, needs acquire service - mysql_admin should be allowed to connect to mysql service - virt creates monitor sockets in the users home dir	2011-03-01 17:08:45 +00:00
Miroslav Grepl	c34a0c5248	- Allow usbhid-ups to read hardware state information ... - systemd-tmpfiles has moved - Allo cgroup to sys_tty_config - For some reason prelink is attempting to read gconf settings - Add allow_daemons_use_tcp_wrapper boolean - Add label for ~/.cache/wocky to make telepathy work in enforcing mode - Add label for char devices /dev/dasd* - Fix for apache_role - Allow amavis to talk to nslcd - allow all sandbox to read selinux poilcy config files - Allow cluster domains to use the system bus and send each other dbus messages	2011-02-21 21:46:58 +00:00
Miroslav Grepl	7288282fd4	- Update to upstream	2011-02-16 18:45:08 +00:00
Dennis Gilmore	60e174d11c	- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild	2011-02-09 07:08:32 -06:00
Dan Walsh	d3861ceab3	- Update to ref policy ... - cgred needs chown capability - Add /dev/crash crash_dev_t - systemd-readahead wants to use fanotify which means readahead_t needs sys_admin capability	2011-02-08 18:00:22 -05:00
Dan Walsh	812781becc	- Update to ref policy ... - cgred needs chown capability - Add /dev/crash crash_dev_t	2011-02-08 17:50:40 -05:00
Miroslav Grepl	f12703ea7e	- New labeling for postfmulti #675654 ... - dontaudit xdm_t listing noxattr file systems - dovecot-auth needs to be able to connect to mysqld via the network as well as locally - shutdown is passed stdout to a xdm_log_t file - smartd creates a fixed disk device - dovecot_etc_t contains a lnk_file that domains need to read - mount needs to be able to read etc_runtim_t:lnk_file since in rawhide this is a link created at boot	2011-02-08 12:43:56 +00:00
Miroslav Grepl	19cd669e5e	- syslog_t needs syslog capability ... - dirsrv needs to be able to create /var/lib/snmp - Fix labeling for dirsrv - Fix for dirsrv policy missing manage_dirs_pattern - corosync needs to delete clvm_tmpfs_t files - qdiskd needs to list hugetlbfs - Move setsched to sandbox_x_domain, so firefox can run without network access - Allow hddtemp to read removable devices - Adding syslog and read_policy permissions to policy * syslog Allow unconfined, sysadm_t, secadm_t, logadm_t * read_policy allow unconfined, sysadm_t, secadm_t, staff_t on Targeted allow sysadm_t (optionally), secadm_t on MLS - mdadm application will write into /sys/.../uevent whenever arrays are assembled or disassembled.	2011-02-03 18:30:25 +00:00
Dan Walsh	731e693460	- Add tcsd policy	2011-02-01 16:45:17 -05:00
Dan Walsh	0e793cf10b	Merge branches 'master', 'master', 'master' and 'master' of ssh://pkgs.fedoraproject.org/selinux-policy	2011-02-01 16:08:31 -05:00
Miroslav Grepl	ebce355dea	- ricci_modclusterd_t needs to bind to rpc ports 500-1023 ... - Allow dbus to use setrlimit to increase resoueces - Mozilla_plugin is leaking to sandbox - Allow confined users to connect to lircd over unix domain stream socket whic - Allow awstats to read squid logs - seunshare needs to manage tmp_t - apcupsd cgi scripts have a new directory	2011-02-01 18:30:35 +00:00
Dan Walsh	6b3837d6e4	stop relabeling /var/lib	2011-01-27 14:29:13 -05:00
Miroslav Grepl	73e5debe55	- Fix xserver_dontaudit_read_xdm_pid ... - Change oracle_port_t to oracledb_port_t to prevent conflict with satellite - Allow dovecot_deliver_t to read/write postfix_master_t:fifo_file. * These fifo_file is passed from postfix_master_t to postfix_local_t to dovecot_deliver_t - Allow readahead to manage readahead pid dirs - Allow readahead to read all mcs levels - Allow mozilla_plugin_t to use nfs or samba homedirs	2011-01-27 18:13:11 +00:00
Miroslav Grepl	3c70739f2c	- Allow nagios plugin to read /proc/meminfo ... - Fix for mozilla_plugin - Allow samba_net_t to create /etc/keytab - pppd_t setting up vpns needs to run unix_chkpwd, setsched its process and write wt - nslcd can read user credentials - Allow nsplugin to delete mozilla_plugin_tmpfs_t - abrt tries to create dir in rpm_var_lib_t - virt relabels fifo_files - sshd needs to manage content in fusefs homedir - mock manages link files in cache dir	2011-01-25 17:44:14 +00:00
Miroslav Grepl	0ababf8492	- nslcd needs setsched and to read /usr/tmp ... - Invalid call in likewise policy ends up creating a bogus role - Cannon puts content into /var/lib/bjlib that cups needs to be able to write - Allow screen to create screen_home_t in /root - dirsrv sends syslog messages - pinentry reads stuff in .kde directory - Add labels for .kde directory in homedir - Treat irpinit, iprupdate, iprdump services with raid policy	2011-01-21 17:24:28 +00:00
Miroslav Grepl	408ea919b7	- NetworkManager wants to read consolekit_var_run_t ... - Allow readahead to create /dev/.systemd/readahead - Remove permissive domains - Allow newrole to run namespace_init	2011-01-19 18:43:03 +00:00
Miroslav Grepl	ac028b8413	Fix release	2011-01-18 11:00:30 +00:00
Miroslav Grepl	a34c78a0fd	- Add sepgsql_contexts file	2011-01-18 10:28:56 +00:00
Miroslav Grepl	86b1f12f92	- Update to upstream	2011-01-17 18:42:12 +00:00
Miroslav Grepl	f16c69cb48	- Add oracle ports and allow apache to connect to them if the connect_db boole ... - Add puppetmaster_use_db boolean - Fixes for zarafa policy - Fixes for gnomeclock poliy - Fix systemd-tmpfiles to use auth_use_nsswitch	2011-01-17 17:47:06 +00:00
Miroslav Grepl	116d73139a	- gnomeclock executes a shell ... - Update for screen policy to handle pipe in homedir - Fixes for polyinstatiated homedir - Fixes for namespace policy and other fixes related to polyinstantiation - Add namespace policy - Allow dovecot-deliver transition to sendmail which is needed by sieve scri - Fixes for init, psad policy which relate with confined users - Do not audit bootloader attempts to read devicekit pid files - Allow nagios service plugins to read /proc	2011-01-14 17:48:34 +00:00
Miroslav Grepl	b1863350de	- Add firewalld policy ... - Allow vmware_host to read samba config - Kernel wants to read /proc Fix duplicate grub def in cobbler - Chrony sends mail, executes shell, uses fifo_file and reads /proc - devicekitdisk getattr all file systems - sambd daemon writes wtmp file - libvirt transitions to dmidecode	2011-01-11 13:44:47 +00:00
Miroslav Grepl	b559c4ec49	- Add initial policy for system-setup-keyboard which is now daemon ... - Label /var/lock/subsys/shorewall as shorewall_lock_t - Allow users to communicate with the gpg_agent_t - Dontaudit mozilla_plugin_t using the inherited terminal - Allow sambagui to read files in /usr - webalizer manages squid log files - Allow unconfined domains to bind ports to raw_ip_sockets - Allow abrt to manage rpm logs when running yum - Need labels for /var/run/bittlebee - Label .ssh under amanda - Remove unused genrequires for virt_domain_template - Allow virt_domain to use fd inherited from virtd_t - Allow iptables to read shorewall config	2011-01-05 10:08:57 +00:00
Dan Walsh	b96903aaa0	- Gnome apps list config_home_t ... - mpd creates lnk files in homedir - apache leaks write to mail apps on tmp files - /var/stockmaniac/templates_cache contains log files - Abrt list the connects of mount_tmp_t dirs - passwd agent reads files under /dev and reads utmp file - squid apache script connects to the squid port - fix name of plymouth log file - teamviewer is a wine app - allow dmesg to read system state - Stop labeling files under /var/lib/mock so restorecon will not go into this - nsplugin needs to read network state for google talk	2010-12-28 15:41:30 -05:00
Dan Walsh	ef836a9861	- New labels for ghc http content ... - nsplugin_config needs to read urand, lvm now calls setfscreate to create dev - pm-suspend now creates log file for append access so we remove devicekit_wri - Change authlogin_use_sssd to authlogin_nsswitch_use_ldap - Fixes for greylist_milter policy	2010-12-22 16:12:41 -05:00
Miroslav Grepl	d980545506	- Update to upstream ... - Fixes for systemd policy - Fixes for passenger policy - Allow staff users to run mysqld in the staff_t domain, akonadi needs this - Add bin_t label for /usr/share/kde4/apps/kajongg/kajongg.py - auth_use_nsswitch does not need avahi to read passwords,needed for resolving data - Dontaudit (xdm_t) gok attempting to list contents of /var/account - Telepathy domains need to read urand - Need interface to getattr all file classes in a mock library for setroubleshoot	2010-12-21 09:32:36 +00:00
Miroslav Grepl	d6c5f3679b	Update to upstream	2010-12-20 17:43:48 +00:00
Dan Walsh	f3f61efb0b	- Update selinux policy to handle new /usr/share/sandbox/start script	2010-12-16 11:25:39 -05:00
Miroslav Grepl	0ba6b243f7	- Update to upstream ... - Fix version of policy in spec file	2010-12-15 11:03:25 +00:00
Miroslav Grepl	1adb28c6ec	- Allow sandbox to run on nfs partitions, fixes for systemd_tmpfs ... - remove per sandbox domains devpts types - Allow dkim-milter sending signal to itself	2010-12-14 19:49:10 +00:00
Dan Walsh	25660bf875	- Allow domains that transition to ping or traceroute, kill them ... - Allow user_t to conditionally transition to ping_t and traceroute_t - Add fixes to systemd- tools, including new labeling for systemd-fsck, systemd-cryptsetup	2010-12-13 17:11:28 -05:00
Miroslav Grepl	3c0b9eac8c	- Turn on systemd policy ... - mozilla_plugin needs to read certs in the homedir. - Dontaudit leaked file descriptors from devicekit - Fix ircssi to use auth_use_nsswitch - Change to use interface without param in corenet to disable unlabelednet - Allow init to relabel sockets and fifo files in /dev - certmonger needs dac* capabilities to manage cert files not owned by root - dovecot needs fsetid to change group membership on mail - plymouthd removes /var/log/boot.log - systemd is creating symlinks in /dev - Change label on /etc/httpd/alias to be all cert_t	2010-12-13 18:56:13 +00:00
Miroslav Grepl	b04a855a22	- Fixes for clamscan and boinc policy ... - Add boinc_project_t setpgid - Allow alsa to create tmp files in /tmp	2010-12-10 13:55:11 +00:00
Miroslav Grepl	c2ad3681fa	- Push fixes to allow disabling of unlabeled_t packet access ... - Enable unlabelednet policy	2010-12-07 17:51:16 +00:00
Miroslav Grepl	7b62a83f6b	- Fixes for lvm to work with systemd	2010-12-07 15:10:29 +00:00
Miroslav Grepl	151160499d	- Fix the label for wicd log ... - plymouthd creates force-display-on-active-vt file - Allow avahi to request the kernel to load a module - Dontaudit hal leaks - Fix gnome_manage_data interface - Add new interface corenet_packet to define a type as being an packet_type. - Removed general access to packet_type from icecast and squid. - Allow mpd to read alsa config - Fix the label for wicd log - Add systemd policy	2010-12-06 19:08:04 +00:00
Miroslav Grepl	a4f1f54302	- Fix gnome_manage_data interface ... - Dontaudit sys_ptrace capability for iscsid - Fixes for nagios plugin policy	2010-12-03 17:07:37 +00:00
Miroslav Grepl	09460452b6	- Fix cron to run ranged when started by init ... - Fix devicekit to use log files - Dontaudit use of devicekit_var_run_t for fstools - Allow init to setattr on logfile directories	2010-12-02 18:21:58 +01:00
Dan Walsh	5bcd7aa5b3	- Fix up handling of dnsmasq_t creating /var/run/libvirt/network ... - Turn on sshd_forward_ports boolean by default - Allow sysadmin to dbus chat with rpm - Add interface for rw_tpm_dev - Allow cron to execute bin - fsadm needs to write sysfs - Dontaudit consoletype reading /var/run/pm-utils - Lots of new privs fro mozilla_plugin_t running java app, make mozilla_plugin - certmonger needs to manage dirsrv data - /var/run/pm-utils should be labeled as devicekit_var_run_t	2010-11-30 16:24:01 -05:00
Miroslav Grepl	954ef8ad92	- fixes to allow /var/run and /var/lock as tmpfs ... - Allow chrome sandbox to connect to web ports - Allow dovecot to listem on lmtp and sieve ports - Allov ddclient to search sysctl_net_t - Transition back to original domain if you execute the shell	2010-11-30 11:39:40 +00:00
Miroslav Grepl	b63541e55b	- Remove duplicate declaration	2010-11-25 16:53:58 +00:00
Miroslav Grepl	05f913e88b	- Update to upstream ... - Cleanup for sandbox - Add attribute to be able to select sandbox types	2010-11-25 12:21:34 +00:00
Miroslav Grepl	3daa6c760b	- Allow ddclient to fix file mode bits of ddclient conf file ... - init leaks file descriptors to daemons - Add labels for /etc/lirc/ and - Allow amavis_t to exec shell - Add label for gssd_tmp_t for /var/tmp/nfs_0	2010-11-22 12:12:57 +01:00
Dan Walsh	d6719f6ecb	- Put back in lircd_etc_t so policy will install	2010-11-18 16:27:30 -05:00
Miroslav Grepl	4eb45ebeaa	- Turn on allow_postfix_local_write_mail_spool ... - Allow initrc_t to transition to shutdown_t - Allow logwatch and cron to mls_read_to_clearance for MLS boxes - Allow wm to send signull to all applications and receive them from users - lircd patch from field - Login programs have to read /etc/samba - New programs under /lib/systemd - Abrt needs to read config files	2010-11-18 17:37:29 +01:00
Miroslav Grepl	582d2c5d2c	- Update to upstream ... - Dontaudit leaked sockets from userdomains to user domains - Fixes for mcelog to handle scripts - Apply patch from Ruben Kerkhof - Allow syslog to search spool dirs	2010-11-16 09:46:19 +01:00
Miroslav Grepl	cbb8d59931	- Allow nagios plugins to read usr files ... - Allow mysqld-safe to send system log messages - Fixes fpr ddclient policy - Fix sasl_admin interface - Allow apache to search zarafa config - Allow munin plugins to search /var/lib directory - Allow gpsd to read sysfs_t - Fix labels on /etc/mcelog/triggers to bin_t	2010-11-15 18:27:23 +01:00
Dan Walsh	763342ad3a	- Remove saslauthd_tmp_t and transition tmp files to krb5_host_rcache_t ... - Allow saslauthd_t to create krb5_host_rcache_t files in /tmp - Fix xserver interface - Fix definition of /var/run/lxdm	2010-11-12 11:08:35 -05:00
Dan Walsh	519b05a70f	- Remove saslauthd_tmp_t and transition tmp files to krb5_host_rcache_t	2010-11-12 10:59:01 -05:00
Dan Walsh	50dacaca09	- kdump leaks kdump_etc_t to ifconfig, add dontaudit ... - uux needs to transition to uucpd_t - More init fixes relabels man,faillog - Remove maxima defs in libraries.fc - insmod needs to be able to create tmpfs_t files - ping needs setcap - init executes mcelog, initrc_t needs to manage faillog. - fix xserver_ralabel_xdm_tmp_dirs - Allow dovecot_deliver_t to list dovecot_etc_t - Run acroread as execmem_t	2010-11-12 09:56:06 -05:00
Miroslav Grepl	9238df00c5	- Turn on mediawiki policy ... - kdump leaks kdump_etc_t to ifconfig, add dontaudit - uux needs to transition to uucpd_t - More init fixes relabels man,faillog - Remove maxima defs in libraries.fc - insmod needs to be able to create tmpfs_t files - ping needs setcap	2010-11-12 13:47:15 +01:00
Dan Walsh	7297a334b4	- Fix init to be able to relabel wtmp, tmp files	2010-11-10 14:39:23 -05:00
Miroslav Grepl	5d168a352b	- Allow groupd transition to fenced domain when executes fence_node ... - Fixes for rchs policy - Allow mpd to be able to read samba/nfs files	2010-11-10 11:04:39 +01:00
Dan Walsh	ded1efb9d8	- Fix up corecommands.fc to match upstream ... - Make sure /lib/systemd/* is labeled init_exec_t - mount wants to setattr on all mountpoints - dovecot auth wants to read dovecot etc files - nscd daemon looks at the exe file of the comunicating daemon - openvpn wants to read utmp file - postfix apps now set sys_nice and lower limits - remote_login (telnetd/login) wants to use telnetd_devpts_t and user_devpts_t to work correctly - Also resolves nsswitch - Fix labels on /etc/hosts.* - Cleanup to make upsteam patch work - allow abrt to read etc_runtime_t	2010-11-09 17:41:15 -05:00
Dan Walsh	fc9bf2f03d	- Add conflicts for dirsrv package	2010-11-09 07:55:52 -05:00
Dan Walsh	3e0b7834a6	- Update to upstream ... - Add vlock policy	2010-11-05 14:22:36 -04:00
Dan Walsh	6e50b74774	- Update to upstream ... - Add vlock policy	2010-11-05 12:40:49 -04:00
Dan Walsh	06262c1566	- Update to upstream ... - Add vlock policy	2010-11-05 12:40:07 -04:00
Dan Walsh	c52856e6d8	- Fix sandbox to work on nfs homedirs ... - Allow cdrecord to setrlimit - Allow mozilla_plugin to read xauth - Change label on systemd-logger to syslogd_exec_t - Install dirsrv policy from dirsrv package	2010-11-05 07:32:45 -04:00
Dan Walsh	9896599663	-	2010-11-02 17:07:21 -04:00
Dan Walsh	9754f472c7	- Allow NetworkManager to read openvpn_etc_t ... - Dontaudit hplip to write of /usr dirs - Allow system_mail_t to create /root/dead.letter as mail_home_t - Add vdagent policy for spice agent daemon	2010-11-01 14:37:25 -04:00
Dan Walsh	7a208696f9	- Dontaudit sandbox sending sigkill to all user domains ... - Add policy for rssh_chroot_helper - Add missing flask definitions - Allow udev to relabelto removable_t - Fix label on /var/log/wicd.log - Transition to initrc_t from init when executing bin_t - Add audit_access permissions to file - Make removable_t a device_node - Fix label on /lib/systemd/*	2010-10-28 15:55:48 -04:00
Dan Walsh	2bb6181f15	- Fixes for systemd to manage /var/run ... - Dontaudit leaks by firstboot	2010-10-22 16:35:00 -04:00
Dan Walsh	bac270827d	- Allow chome to create netlink_route_socket ... - Add additional MATHLAB file context - Define nsplugin as an application_domain - Dontaudit sending signals from sandboxed domains to other domains - systemd requires init to build /tmp /var/auth and /var/lock dirs - mount wants to read devicekit_power /proc/ entries - mpd wants to connect to soundd port - Openoffice causes a setattr on a lib_t file for normal users, add dontaudit - Treat lib_t and textrel_shlib_t directories the same - Allow mount read access on virtual images	2010-10-22 08:26:00 -04:00
Dan Walsh	4da7659056	- Allow sandbox_x_domains to work with nfs/cifs/fusefs home dirs.	2010-10-18 13:18:55 -04:00
Dan Walsh	c849c84305	- Allow cobblerd to list cobler appache content	2010-10-15 11:35:17 -04:00
Dan Walsh	d33e644851	- Fixup for the latest version of upowed ... - Dontaudit sandbox sending SIGNULL to desktop apps	2010-10-15 10:26:39 -04:00
Dan Walsh	618ed7aec9	- Update to upstream	2010-10-13 10:00:44 -04:00
Dan Walsh	5a152bc135	- Update to upstream	2010-10-12 16:47:46 -04:00
Dan Walsh	f0a56ee31d	-Mount command from a confined user generates setattr on /etc/mtab file, need to dontaudit this access ... - dovecot-auth_t needs ipc_lock - gpm needs to use the user terminal - Allow system_mail_t to append ~/dead.letter - Allow NetworkManager to edit /etc/NetworkManager/NetworkManager.conf - Add pid file to vnstatd - Allow mount to communicate with gfs_controld - Dontaudit hal leaks in setfiles	2010-10-12 16:10:57 -04:00
Dan Walsh	dd20c25744	Rebuild with latest code	2010-10-08 17:00:50 -04:00
Dan Walsh	6f934680a8	- Allow smbd to use sys_admin ... - Remove duplicate file context for tcfmgr - Update to upstream	2010-10-07 14:55:49 -04:00
Dan Walsh	6f256d240d	- Allow smbd to use sys_admin ... - Remove duplicate file context for tcfmgr	2010-10-07 09:59:45 -04:00
Dan Walsh	0daa8b731a	- Fix fusefs handling ... - Do not allow sandbox to manage nsplugin_rw_t - Allow mozilla_plugin_t to connecto its parent - Allow init_t to connect to plymouthd running as kernel_t - Add mediawiki policy - dontaudit sandbox sending signals to itself. This can happen when they are running at different mcs. - Disable transition from dbus_session_domain to telepathy for F14 - Allow boinc_project to use shm - Allow certmonger to search through directories that contain certs - Allow fail2ban the DAC Override so it can read log files owned by non root users	2010-10-07 09:19:43 -04:00
Dan Walsh	b1cbbd0768	- Start adding support for use_fusefs_home_dirs ... - Add /var/lib/syslog directory file context - Add /etc/localtime as locale file context	2010-10-04 14:50:39 -04:00
Dan Walsh	fbd9ca071a	- Turn off default transition to mozilla_plugin and telepathy domains from unconfined user ... - Turn off iptables from unconfined user - Allow sudo to send signals to any domains the user could have transitioned to. - Passwd in single user mode needs to talk to console_device_t - Mozilla_plugin_t needs to connect to web ports, needs to write to video device, and read alsa_home_t alsa setsup pulseaudio - locate tried to read a symbolic link, will dontaudit - New labels for telepathy-sunshine content in homedir - Google is storing other binaries under /opt/google/talkplugin - bluetooth/kernel is creating unlabeled_t socket that I will allow it to use until kernel fixes bug - Add boolean for unconfined_t transition to mozilla_plugin_t and telepathy domains, turned off in F14 on in F15 - modemmanger and bluetooth send dbus messages to devicekit_power - Samba needs to getquota on filesystems labeld samba_share_t	2010-10-01 12:06:09 -04:00
Dan Walsh	5ae8fb66d8	- Dontaudit attempts by xdm_t to write to bin_t for kdm ... - Allow initrc_t to manage system_conf_t	2010-09-30 09:50:49 -04:00
Dan Walsh	7c487e9739	- Fixes to allow mozilla_plugin_t to create nsplugin_home_t directory. ... - Allow mozilla_plugin_t to create tcp/udp/netlink_route sockets - Allow confined users to read xdm_etc_t files - Allow xdm_t to transition to xauth_t for lxdm program	2010-09-27 10:31:36 -04:00
Dan Walsh	e25799116a	- Pull in cleanups from dgrift ... - Allow mozilla_plugin_t to execute mozilla_home_t - Allow rpc.quota to do quotamod	2010-09-24 12:03:50 -04:00
Dan Walsh	42c814d215	- Cleanup policy via dgrift ... - Allow dovecot_deliver to append to inherited log files - Lots of fixes for consolehelper	2010-09-23 17:40:24 -04:00
Dan Walsh	1d153ea0ea	- Fix up Xguest policy	2010-09-22 18:36:47 -04:00
Dan Walsh	ea3b7b5dff	- Add vnstat policy ... - allow libvirt to send audit messages - Allow chrome-sandbox to search nfs_t	2010-09-16 18:00:00 -04:00
Dan Walsh	a24e6a6700	- Update to upstream	2010-09-16 07:59:03 -04:00
Dan Walsh	ba8c31f5cd	- Allow all domains that can use cgroups to search tmpfs_t directory ... - Allow init to send audit messages	2010-09-14 16:16:56 -04:00
Dan Walsh	a0e8efd42c	- Update to upstream	2010-09-13 16:17:15 -04:00
Dan Walsh	30a7d17203	- Add policy for ajaxterm	2010-09-09 09:58:12 -04:00
Dan Walsh	6e2d7f3a82	- Handle /var/db/sudo ... - Allow pulseaudio to read alsa config - Allow init to send initrc_t dbus messages	2010-09-08 21:24:49 -04:00
Dan Walsh	64d84cf8ec	Allow iptables to read shorewall tmp files ... Change chfn and passwd to use auth_use_pam so they can send dbus messages to fpr intd label vlc as an execmem_exec_t Lots of fixes for mozilla_plugin to run google vidio chat Allow telepath_msn to execute ldconfig and its own tmp files Fix labels on hugepages Allow mdadm to read files on /dev Remove permissive domains and change back to unconfined Allow freshclam to execute shell and bin_t Allow devicekit_power to transition to dhcpc Add boolean to allow icecast to connect to any port	2010-09-08 14:17:07 -04:00
Dan Walsh	482c9f3ad9	- Merge upstream fix of mmap_zero ... - Allow mount to write files in debugfs_t - Allow corosync to communicate with clvmd via tmpfs - Allow certmaster to read usr_t files - Allow dbus system services to search cgroup_t - Define rlogind_t as a login pgm	2010-09-02 13:43:28 -04:00
Dan Walsh	a7a2367a59	- Merge with upstream	2010-08-30 17:34:52 -04:00
Dan Walsh	6578cf7413	- More access needed for devicekit ... - Add dbadm policy	2010-08-30 11:58:36 -04:00
Dan Walsh	ba77266a14	- Merge with upstream	2010-08-26 20:35:53 -04:00
Dan Walsh	370d04ed3c	- Allow seunshare to fowner	2010-08-25 09:45:26 -04:00
Dan Walsh	cc138e86b5	- Allow cron to look at user_cron_spool links ... - Lots of fixes for mozilla_plugin_t - Add sysv file system - Turn unconfined domains to permissive to find additional avcs	2010-08-24 22:48:06 -04:00
Dan Walsh	63265668f0	- Update policy for mozilla_plugin_t	2010-08-23 18:01:46 -04:00
Dan Walsh	eee39f9d8e	- Allow clamscan to read proc_t ... - Allow mount_t to write to debufs_t dir - Dontaudit mount_t trying to write to security_t dir	2010-08-23 17:29:52 -04:00
Dan Walsh	19988ca76d	- Allow clamscan_t execmem if clamd_use_jit set ... - Add policy for firefox plugin-container	2010-08-20 09:36:56 -04:00
Dan Walsh	3798ee962a	- label dead.letter as mail_home_t	2010-08-17 07:22:11 -04:00
Dan Walsh	922cd61e83	* Tue Aug 10 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-12 ... - Fix devicekit_power bug - Allow policykit_auth_t more access.	2010-08-11 07:55:04 -04:00
Daniel J Walsh	d4bb132c2e	- Merge in fixes from dgrift repository	2010-07-27 20:34:21 +00:00
Daniel J Walsh	7f5d8f30d0	- Update boinc policy ... - Fix sysstat policy to allow sys_admin - Change failsafe_context to unconfined_r:unconfined_t:s0	2010-07-27 17:28:04 +00:00
Daniel J Walsh	a1ef703492	- New paths for upstart	2010-07-26 21:46:12 +00:00
Daniel J Walsh	8d55a410dc	- New permissions for syslog ... - New labels for /lib/upstart	2010-07-26 20:32:18 +00:00
Daniel J Walsh	f3fc10528f	- Allow systemd to setsockcon on sockets to immitate other services	2010-07-22 16:58:58 +00:00
Daniel J Walsh	9f811efbbb	- Remove debugfs label	2010-07-21 14:57:11 +00:00
Daniel J Walsh	d66bec6356	- Update to latest policy	2010-07-20 17:48:36 +00:00
Daniel J Walsh	1df2fc2bba	- Fix eclipse labeling from IBMSupportAssasstant packageing	2010-07-19 21:16:41 +00:00
Daniel J Walsh	3f1005a67d	- Make boot with systemd in enforcing mode	2010-07-15 20:04:35 +00:00
Daniel J Walsh	0f2ae00c61	- Update to upstream	2010-07-15 13:11:25 +00:00
Daniel J Walsh	9c1bcc22e3	- Add boolean to turn off port forwarding in sshd.	2010-07-12 21:15:05 +00:00
Miroslav Grepl	be922a1fae	- Add support for ebtables ... - Fixes for rhcs and corosync policy	2010-07-09 15:28:31 +00:00
Daniel J Walsh	6c42218d9d	-Update to upstream	2010-06-28 17:19:34 +00:00
Daniel J Walsh	fa98e0ec52	-Update to upstream	2010-06-21 14:31:26 +00:00
Daniel J Walsh	5f371acada	-Update to upstream	2010-06-18 20:14:28 +00:00
Daniel J Walsh	7c727a891e	- Add Zarafa policy	2010-06-16 20:19:22 +00:00
Daniel J Walsh	f2403c5b4f	- Cleanup of aiccu policy ... - initial mock policy	2010-06-11 15:39:46 +00:00
Daniel J Walsh	f651bb6fdc	- Lots of random fixes	2010-06-09 21:31:42 +00:00
Daniel J Walsh	b39ccca147	- Update to upstream	2010-06-08 21:23:21 +00:00
Daniel J Walsh	632048ceb1	- Update to upstream ... - Allow prelink script to signal itself - Cobbler fixes	2010-06-07 21:15:35 +00:00
Daniel J Walsh	bca242c772	- Add xdm_var_run_t to xserver_stream_connect_xdm ... - Add cmorrord and mpd policy from Miroslav Grepl	2010-06-02 19:36:11 +00:00
Daniel J Walsh	e51284403f	- Fix sshd creation of krb cc files for users to be user_tmp_t	2010-06-01 20:56:58 +00:00
Daniel J Walsh	4abfc011a4	- Fixes for accountsdialog ... - Fixes for boinc	2010-05-28 12:39:05 +00:00
Daniel J Walsh	65c6e4c421	- Fix label on /var/lib/dokwiki ... - Change permissive domains to enforcing - Fix libvirt policy to allow it to run on mls	2010-05-27 16:14:50 +00:00
Daniel J Walsh	bc4089cfaa	- Update to upstream	2010-05-26 21:15:42 +00:00
Daniel J Walsh	a72c31df34	- Update to upstream	2010-03-18 15:47:35 +00:00
Daniel J Walsh	add957370e	- Merge with upstream	2010-02-16 22:10:14 +00:00
Daniel J Walsh	3c551b85fe	- Allow sandbox to work with MLS	2010-02-11 21:54:06 +00:00
Daniel J Walsh	43c7f5f787	- Make Chrome work with staff user	2010-02-10 22:26:52 +00:00
Daniel J Walsh	487de6f251	- Add icecast policy ... - Cleanup spec file	2010-02-08 22:06:23 +00:00
Daniel J Walsh	30c21992cb	- Add mcelog policy	2010-02-03 20:52:58 +00:00
Daniel J Walsh	a62c6405cc	- Lots of fixes found in F12	2010-02-02 16:41:03 +00:00
Daniel J Walsh	b2f6b0698f	- Fix rpm_dontaudit_leaks	2010-01-28 15:44:39 +00:00
Daniel J Walsh	4d67b40db1	- Add getsched to hald_t ... - Add file context for Fedora/Redhat Directory Server	2010-01-27 21:54:00 +00:00
Daniel J Walsh	b0f36568e1	- Allow abrt_helper to getattr on all filesystems ... - Add label for /opt/real/RealPlayer/plugins/oggfformat\.so	2010-01-27 17:08:59 +00:00
Daniel J Walsh	b65afa2940	- Add gstreamer_home_t for ~/.gstreamer	2010-01-22 15:26:39 +00:00
Daniel J Walsh	faec5c2a14	- Update to upstream	2010-01-18 22:40:25 +00:00
Daniel J Walsh	3b54668c40	Update spec file to suck in the correct version of selinux-policy packages	2010-01-15 21:39:39 +00:00
Daniel J Walsh	89ad5ea38f	- Turn on puppet policy ... - Update to dgrift git policy	2010-01-14 21:49:18 +00:00
Daniel J Walsh	fc05ac0660	- Move users file to selection by spec file. ... - Allow vncserver to run as unconfined_u:unconfined_r:unconfined_t	2010-01-11 22:06:55 +00:00
Daniel J Walsh	352dafd046	- Update to upstream	2010-01-07 21:59:22 +00:00
Daniel J Walsh	6049e24424	- Remove most of the permissive domains from F12.	2010-01-06 21:57:07 +00:00
Daniel J Walsh	485ded565a	- Add cobbler policy from dgrift	2010-01-05 22:09:02 +00:00
Daniel J Walsh	1e86f3f158	- add usbmon device ... - Add allow rulse for devicekit_disk	2010-01-04 21:31:54 +00:00
Daniel J Walsh	4478a9a993	- Lots of fixes found in F12, fixes from Tom London	2009-12-30 14:44:54 +00:00
Daniel J Walsh	08b890455e	- Cleanups from dgrift	2009-12-23 18:39:12 +00:00
Daniel J Walsh	daebd59668	- Cleanups from dgrift	2009-12-23 18:37:23 +00:00
Daniel J Walsh	e2f53dfaec	- Cleanups from dgrift	2009-12-23 13:02:27 +00:00
Daniel J Walsh	550cc5f4f4	- Add back xserver_manage_home_fonts	2009-12-22 17:25:13 +00:00
Daniel J Walsh	7d40583319	- Dontaudit sandbox trying to read nscd and sssd	2009-12-21 22:53:07 +00:00
Daniel J Walsh	b4675412e2	- Update to upstream	2009-12-18 21:18:10 +00:00
Daniel J Walsh	6ca563ec01	- Rename udisks-daemon back to devicekit_disk_t policy	2009-12-17 19:36:22 +00:00
Daniel J Walsh	e54cc7c3e4	- Fixes for abrt calls	2009-12-16 23:01:00 +00:00
Daniel J Walsh	9c90ba7e8e	- Add tgtd policy	2009-12-16 13:30:38 +00:00
Daniel J Walsh	755e2d6934	- Add tgtd policy	2009-12-11 20:18:55 +00:00
Daniel J Walsh	9eef358da0	- Update to upstream release	2009-12-10 19:20:14 +00:00
Daniel J Walsh	f2a1dcd3d4	- Add asterisk policy back in ... - Update to upstream release 2.20091117	2009-11-25 20:19:12 +00:00
Daniel J Walsh	ee88b050c5	- Add asterisk policy back in	2009-11-20 16:55:54 +00:00
Daniel J Walsh	ce8c76d673	- Add asterisk policy back in	2009-11-20 16:31:54 +00:00
Daniel J Walsh	55acbfd715	- Update to upstream release 2.20091117	2009-11-18 22:22:56 +00:00
Daniel J Walsh	5e44eb8657	- Update to upstream	2009-11-14 05:18:01 +00:00
Daniel J Walsh	32594a1112	- Allow vpnc request the kernel to load modules	2009-10-02 15:15:36 +00:00
Daniel J Walsh	aaf52ff041	- Add plymouth policy	2009-09-30 18:50:23 +00:00
Daniel J Walsh	d976a83a17	- Allow cupsd_config to read user tmp ... - Allow snmpd_t to signal itself - Allow sysstat_t to makedir in sysstat_log_t	2009-09-30 17:37:44 +00:00
Daniel J Walsh	8b10e3abd7	- Update rhcs policy	2009-09-29 12:38:58 +00:00
Daniel J Walsh	85582d623f	- Allow users to exec restorecond	2009-09-25 18:47:07 +00:00
Daniel J Walsh	f5a104d238	- Allow sendmail to request kernel modules load	2009-09-24 23:30:16 +00:00
Daniel J Walsh	4c2f298bf2	- Fix all kernel_request_load_module domains	2009-09-22 12:49:53 +00:00
Daniel J Walsh	405a74c394	- Fix all kernel_request_load_module domains	2009-09-21 13:55:41 +00:00
Daniel J Walsh	41f8e385a1	- Remove allow_exec* booleans for confined users. Only available for ... unconfined_t	2009-09-20 14:32:30 +00:00
Daniel J Walsh	8323d545c4	- More fixes for sandbox_web_t	2009-09-19 02:03:03 +00:00
Daniel J Walsh	ab462917cf	- Allow sshd to create .ssh directory and content	2009-09-18 22:12:25 +00:00
Daniel J Walsh	d53d158d2b	- Fix request_module line to module_request	2009-09-18 20:44:00 +00:00
Daniel J Walsh	1fb0a98434	- Fix sandbox policy to allow it to run under firefox. ... - Dont audit leaks.	2009-09-18 16:20:05 +00:00
Daniel J Walsh	9de7033708	- Fixes for sandbox	2009-09-17 21:41:30 +00:00
Daniel J Walsh	69290fd9df	- Update to upstream ... - Dontaudit nsplugin search /root - Dontaudit nsplugin sys_nice	2009-09-16 17:50:32 +00:00
Daniel J Walsh	23e7082b4b	- Fix label on /usr/bin/notepad, /usr/sbin/vboxadd-service ... - Remove policycoreutils-python requirement except for minimum	2009-09-15 21:45:12 +00:00
Daniel J Walsh	6b7b0c1cdc	- Fix devicekit_disk_t to getattr on all domains sockets and fifo_files ... - Conflicts seedit (You can not use selinux-policy-targeted and seedit at the same time.)	2009-09-15 18:26:13 +00:00
Daniel J Walsh	e20e351e10	- Add wordpress/wp-content/uploads label ... - Fixes for sandbox when run from staff_t	2009-09-11 21:15:35 +00:00
Daniel J Walsh	ddc8588081	- Update to upstream ... - Fixes for devicekit_disk	2009-09-10 15:38:44 +00:00
Daniel J Walsh	ab8f807545	- More fixes	2009-09-09 21:08:02 +00:00
Daniel J Walsh	b8498d1e5b	- More fixes	2009-09-08 23:55:31 +00:00
Daniel J Walsh	123ae9957d	- Lots of fixes for initrc and other unconfined domains	2009-09-08 14:30:36 +00:00
Daniel J Walsh	72bc25da0e	- Allow xserver to use netlink_kobject_uevent_socket	2009-09-07 01:29:07 +00:00
Daniel J Walsh	1a2981be4a	- Dontaudit setroubleshootfix looking at /root directory	2009-09-02 13:33:15 +00:00
Daniel J Walsh	65c3f9a0a8	- Update to upsteam	2009-08-31 21:27:50 +00:00
Daniel J Walsh	cb5670ca1b	- Allow gssd to send signals to users ... - Fix duplicate label for apache content	2009-08-31 13:39:37 +00:00
Daniel J Walsh	faf9cbbc4b	- Update to upstream	2009-08-28 20:55:16 +00:00
Daniel J Walsh	38d427a08f	- Remove polkit_auth on upgrades	2009-08-28 18:56:15 +00:00
Daniel J Walsh	42f9effee7	- Add back in unconfined.pp and unconfineduser.pp ... - Add Sandbox unshare	2009-08-26 20:19:02 +00:00
Daniel J Walsh	07c04f81b6	- Add back in unconfined.pp and unconfineduser.pp	2009-08-26 14:02:27 +00:00
Daniel J Walsh	89e3546337	- Fixes for cdrecord, mdadm, and others	2009-08-26 12:12:39 +00:00
Daniel J Walsh	080ce6f2c8	- Add capability setting to dhcpc and gpm	2009-08-23 13:55:48 +00:00
Daniel J Walsh	8e64d7d393	- Allow cronjobs to read exim_spool_t	2009-08-22 11:51:13 +00:00
Daniel J Walsh	c5f5b5dbcb	- Add ABRT policy	2009-08-21 22:58:28 +00:00
Daniel J Walsh	e3dd4912ce	- Fix system-config-services policy	2009-08-20 17:48:51 +00:00
Daniel J Walsh	fc8ff2feac	- Allow libvirt to change user componant of virt_domain	2009-08-20 00:02:37 +00:00
Daniel J Walsh	40243d944f	- Allow cupsd_config_t to be started by dbus ... - Add smoltclient policy	2009-08-18 22:43:34 +00:00
Daniel J Walsh	9c270225e5	- Add policycoreutils-python to pre install	2009-08-18 12:34:26 +00:00
Daniel J Walsh	b2c5e72a15	- Make all unconfined_domains permissive so we can see what AVC's happen	2009-08-13 22:33:07 +00:00
Daniel J Walsh	7fe210d864	- Add pt_chown policy	2009-08-12 20:10:51 +00:00
Daniel J Walsh	867473ac62	- Add kdump policy for Miroslav Grepl ... - Turn off execstack boolean	2009-08-10 18:22:10 +00:00
Bill Nottingham	ac7bbfa65a	- Turn on execstack on a temporary basis (#512845)	2009-08-07 19:36:54 +00:00
Daniel J Walsh	4de3826dbf	- Allow nsplugin to connecto the session bus ... - Allow samba_net to write to coolkey data	2009-08-07 11:51:54 +00:00
Daniel J Walsh	e21330348f	- Allow devicekit_disk to list inotify	2009-08-05 21:31:17 +00:00
Daniel J Walsh	4816e90c52	- Allow svirt images to create sock_file in svirt_var_run_t	2009-08-05 20:37:39 +00:00
Daniel J Walsh	4673269d66	- Allow exim to getattr on mountpoints ... - Fixes for pulseaudio	2009-08-04 11:32:06 +00:00
Daniel J Walsh	947b439e10	- Allow svirt_t to stream_connect to virtd_t	2009-07-31 19:05:34 +00:00
Daniel J Walsh	af4fa8266c	- Allod hald_dccm_t to create sock_files in /tmp	2009-07-31 11:02:24 +00:00
Daniel J Walsh	abd1536931	- More fixes from upstream	2009-07-30 20:30:26 +00:00
Daniel J Walsh	c6e2224c70	- Fix polkit label ... - Remove hidebrokensymptoms for nss_ldap fix - Add modemmanager policy - Lots of merges from upstream - Begin removing textrel_shlib_t labels, from fixed libraries	2009-07-30 04:31:53 +00:00
Daniel J Walsh	3750561a72	- Update to upstream	2009-07-28 19:08:17 +00:00
Daniel J Walsh	9160520a0e	- Allow certmaster to override dac permissions	2009-07-27 22:09:57 +00:00
Daniel J Walsh	df7055d5b3	- Update to upstream	2009-07-23 21:47:41 +00:00
Daniel J Walsh	8da0248476	- Fix context for VirtualBox	2009-07-19 16:04:30 +00:00
Daniel J Walsh	2360ff9f3f	- Update to upstream	2009-07-15 19:12:04 +00:00
Daniel J Walsh	a88b486824	- Fixes for xguest	2009-07-08 15:37:57 +00:00
Daniel J Walsh	819f419b33	- fix multiple directory ownership of mandirs	2009-07-07 21:06:52 +00:00
Tom Callaway	a85aeff615	fix duplicate directory ownership with filesystem, policycoreutils	2009-07-07 15:41:05 +00:00
Daniel J Walsh	d9676a6ada	- Update to upstream	2009-07-06 21:16:26 +00:00
Daniel J Walsh	bcc53daced	- Add rules for rtkit-daemon	2009-06-30 11:46:56 +00:00
Daniel J Walsh	7b16d569d8	- Update to upstream ... - Fix nlscd_stream_connect	2009-06-26 20:13:04 +00:00
Daniel J Walsh	221642f17f	- Add rtkit policy	2009-06-25 21:43:36 +00:00
Daniel J Walsh	d399fb4d25	- Allow rpcd_t to stream connect to rpcbind	2009-06-24 20:45:26 +00:00
Daniel J Walsh	9850f4d30d	- Allow kpropd to create tmp files	2009-06-24 13:15:55 +00:00
Daniel J Walsh	93dc66eaeb	- Fix last duplicate /var/log/rpmpkgs	2009-06-23 13:23:52 +00:00
Daniel J Walsh	a9f0953822	- Update to upstream ... add sssd	2009-06-22 22:27:58 +00:00
Daniel J Walsh	8866315d40	- Update to upstream ... cleanup Fri Jun 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.17-1 - Update to upstream - Additional mail ports - Add virt_use_usb boolean for svirt	2009-06-20 13:59:00 +00:00
Daniel J Walsh	6071093529	- Update to upstream ... - Additional mail ports - Add virt_use_usb boolean for svirt	2009-06-19 11:41:44 +00:00
Daniel J Walsh	9386d6f55f	- Fix mcs rules to include chr_file and blk_file	2009-06-18 20:01:47 +00:00
Daniel J Walsh	e3bf6793cb	- Add label for udev-acl	2009-06-18 14:42:34 +00:00
Daniel J Walsh	f8df9e54c4	- Additional rules for consolekit/udev, privoxy and various other fixes	2009-06-15 20:04:07 +00:00
Daniel J Walsh	49883e898d	- New version for upstream	2009-06-15 15:26:20 +00:00
Daniel J Walsh	d3ae977ab7	- New version for upstream	2009-06-12 18:59:09 +00:00
Daniel J Walsh	6b838056a8	- Allow NetworkManager to read inotifyfs	2009-06-11 21:26:42 +00:00
Daniel J Walsh	aa7b9cbc5e	- Allow setroubleshoot to run mlocate	2009-06-10 17:50:55 +00:00
Daniel J Walsh	8197718634	- Update to upstream	2009-06-08 21:47:04 +00:00
Daniel J Walsh	9ee63df41a	- New log file for vmware ... - Allow xdm to setattr on user_tmp_t	2009-05-26 16:57:59 +00:00
Daniel J Walsh	ef7416c2b8	- Upgrade to upstream	2009-05-22 14:37:43 +00:00
Daniel J Walsh	eead2a6f25	- Allow fprintd to access sys_ptrace ... - Add sandbox policy	2009-05-20 17:28:24 +00:00
Daniel J Walsh	7b6c105887	- Add varnishd policy	2009-05-18 18:49:15 +00:00
Daniel J Walsh	f72bd44737	- Fixes for kpropd	2009-05-14 18:53:40 +00:00
Daniel J Walsh	fcb4418ad5	- Allow brctl to r/w tun_tap_device_t	2009-05-14 14:37:43 +00:00
Daniel J Walsh	62cfafdcb7	- Add /usr/share/selinux/packages ... - Turn on nsplugin boolean	2009-05-12 18:10:29 +00:00
Daniel J Walsh	0f6b92d1fa	- Allow rpcd_t to send signals to kernel threads	2009-05-11 13:11:03 +00:00
Daniel J Walsh	992419431e	- Fix upgrade for F10 to F11	2009-05-08 19:43:27 +00:00
Daniel J Walsh	a2098a521f	- Add policy for /var/lib/fprint	2009-05-07 19:09:40 +00:00
Daniel J Walsh	8a0604e919	-Remove duplicate line	2009-05-06 12:51:59 +00:00
Daniel J Walsh	959ab94100	- Allow svirt to manage pci and other sysfs device data	2009-05-05 20:48:39 +00:00
Daniel J Walsh	0e31a0e8ca	- Fix package selection handling	2009-05-04 19:37:29 +00:00
Daniel J Walsh	c32d79e2c3	- Fix /sbin/ip6tables-save context ... - Allod udev to transition to mount - Fix loading of mls policy file	2009-05-04 18:20:29 +00:00
Daniel J Walsh	5dd89f3819	- Fix /sbin/ip6tables-save context	2009-05-02 11:52:13 +00:00
Daniel J Walsh	37ebfc9102	- Add shorewall policy	2009-04-30 22:22:00 +00:00
Daniel J Walsh	21b13fca45	- Additional rules for fprintd and sssd	2009-04-30 11:51:07 +00:00
Daniel J Walsh	40d8f60dd7	- Allow nsplugin to unix_read unix_write sem for unconfined_java	2009-04-28 20:09:21 +00:00
Daniel J Walsh	b3ac4a052b	- Fix uml files to be owned by users	2009-04-28 15:49:42 +00:00
Daniel J Walsh	e080bbd4f6	- Fix Upgrade path to install unconfineduser.pp when unocnfined package is ... 3.0.0 or less	2009-04-28 15:13:35 +00:00
Daniel J Walsh	b11dbbb323	- Allow confined users to manace virt_content_t, since this is home dir ... content - Allow all domains to read rpm_script_tmp_t which is what shell creates on redirection	2009-04-27 18:56:58 +00:00
Daniel J Walsh	b0991a2dfd	- Fix labeling on /var/lib/misc/prelink* ... - Allow xserver to rw_shm_perms with all x_clients - Allow prelink to execute files in the users home directory	2009-04-27 14:45:15 +00:00
Daniel J Walsh	89c9c9ae6a	- Allow initrc_t to delete dev_null ... - Allow readahead to configure auditing - Fix milter policy - Add /var/lib/readahead	2009-04-24 19:28:35 +00:00
Daniel J Walsh	eaaf2ab923	- Allow initrc_t to delete dev_null ... - Allow readahead to configure auditing - Fix milter policy - Add /var/lib/readahead	2009-04-24 17:50:36 +00:00
Daniel J Walsh	dac8380cd0	- Allow initrc_t to delete dev_null ... - Allow readahead to configure auditing	2009-04-24 13:17:08 +00:00
Daniel J Walsh	db0dafaaeb	- Update to latest milter code from Paul Howarth	2009-04-24 11:53:55 +00:00
Daniel J Walsh	cd0a396413	- Update to latest milter code from Paul Howarth	2009-04-24 11:42:43 +00:00
Daniel J Walsh	5ce1c49771	- Additional perms for readahead	2009-04-24 04:09:22 +00:00
Daniel J Walsh	4d5adb716e	- Allow pulseaudio to acquire_svc on session bus ... - Fix readahead labeling	2009-04-23 14:48:46 +00:00
Daniel J Walsh	3c498a780b	- Allow sshd to read var_lib symlinks for freenx	2009-04-22 19:18:30 +00:00
Daniel J Walsh	a32a1594b6	- Allow nsplugin unix_read and write on users shm and sem ... - Allow sysadm_t to execute su	2009-04-21 20:31:51 +00:00
Daniel J Walsh	d982e7e091	- Fixes for podsleuth	2009-04-18 12:13:36 +00:00
Daniel J Walsh	dc00fc32b6	*** empty log message ***	2009-04-17 14:19:17 +00:00
Daniel J Walsh	6203f422e2	- Allow cupsd_t to create link files in print_spool_t	2009-04-16 15:14:26 +00:00
Daniel J Walsh	4a0aac139f	- Allow audioentroy to read etc files	2009-04-15 12:03:09 +00:00
Daniel J Walsh	685032cae2	- Add fail2ban_var_lib_t ... - Fixes for devicekit_power_t	2009-04-14 11:02:35 +00:00
Daniel J Walsh	d4af172a64	- Separate out the ucnonfined user from the unconfined.pp package	2009-04-11 12:30:22 +00:00
Daniel J Walsh	90e4193775	- Make sure unconfined_java_t and unconfined_mono_t create user_tmpfs_t.	2009-04-08 13:18:20 +00:00
Daniel J Walsh	25a47636ae	- Upgrade to latest upstream ... - Allow devicekit_disk sys_rawio	2009-04-08 00:59:46 +00:00
Daniel J Walsh	510c2a3987	- Dontaudit binds to ports < 1024 for named ... - Upgrade to latest upstream	2009-04-06 17:07:59 +00:00
Daniel J Walsh	04b6828096	- Allow podsleuth to use tmpfs files	2009-04-03 21:27:39 +00:00
Daniel J Walsh	80beeee40e	- Add customizable_types for svirt	2009-04-03 19:25:21 +00:00
Daniel J Walsh	f49c57d5e6	- Allow setroubelshoot exec* privs to prevent crash from bad libraries ... - add cpufreqselector	2009-04-03 14:45:58 +00:00
Daniel J Walsh	90ea5b3fef	- Dontaudit listing of /root directory for cron system jobs	2009-04-02 15:23:58 +00:00
Daniel J Walsh	3434a9be73	- Fix missing ld.so.cache label	2009-03-30 16:06:48 +00:00
Daniel J Walsh	c0158a8c68	- Add label for ~/.forward and /root/.forward	2009-03-27 19:48:17 +00:00
Daniel J Walsh	6130d52b7c	- Fixes for svirt	2009-03-27 00:01:52 +00:00
Daniel J Walsh	9ca87fc9d8	- Fixes to allow svirt read iso files in homedir	2009-03-24 19:45:02 +00:00
Daniel J Walsh	ec9800856c	- Add xenner and wine fixes from mgrepl	2009-03-24 14:33:05 +00:00
Daniel J Walsh	5dce3c12f7	- Add xenner and wine fixes from mgrepl	2009-03-20 18:42:38 +00:00
Daniel J Walsh	bfc78b6af9	- Allow mdadm to read/write mls override	2009-03-18 19:34:57 +00:00
Daniel J Walsh	095146a89d	- Change to svirt to only access svirt_image_t	2009-03-17 19:52:35 +00:00
Daniel J Walsh	d4b8dcf968	- Fix libvirt policy	2009-03-16 16:02:20 +00:00
Daniel J Walsh	b12011f2ab	- Upgrade to latest upstream	2009-03-12 15:48:51 +00:00
Daniel J Walsh	c240b604f6	- Fixes for iscsid and sssd ... - More cleanups for upgrade from F10 to Rawhide.	2009-03-11 20:25:16 +00:00
Daniel J Walsh	e72f55aac0	- Add pulseaudio, sssd policy ... - Allow networkmanager to exec udevadm	2009-03-09 21:58:08 +00:00
Daniel J Walsh	0c34c69a38	- Add pulseaudio context	2009-03-09 16:18:51 +00:00
Daniel J Walsh	a67a1c12aa	- Upgrade to latest patches	2009-03-05 21:05:47 +00:00
Daniel J Walsh	0a03cce02d	- Fixes for libvirt	2009-03-04 19:41:16 +00:00
Daniel J Walsh	8c3a31a48a	- Update to Latest upstream	2009-03-03 20:10:30 +00:00
Daniel J Walsh	496752533e	- Further confinement of qemu images via svirt	2009-02-27 21:22:47 +00:00
Jesse Keating	150ff59c76	- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild	2009-02-26 00:27:53 +00:00
Daniel J Walsh	52cbcb4196	- Allow NetworkManager to manage /etc/NetworkManager/system-connections	2009-02-20 01:07:59 +00:00
Daniel J Walsh	de67749970	- add virtual_image_context and virtual_domain_context files	2009-02-18 19:45:29 +00:00
Daniel J Walsh	8f6e4365ca	- Allow rpcd_t to send signal to mount_t ... - Allow libvirtd to run ranged	2009-02-18 14:27:36 +00:00
Daniel J Walsh	8c2b68a3e1	- Fix sysnet/net_conf_t	2009-02-17 16:21:42 +00:00
Daniel J Walsh	81794767c6	- Fix squidGuard labeling	2009-02-17 14:07:10 +00:00
Daniel J Walsh	2eec438a0b	- Re-add corenet_in_generic_if(unlabeled_t)	2009-02-16 22:54:22 +00:00
Daniel J Walsh	e46e005f04		2009-02-11 20:40:13 +00:00
Daniel J Walsh	d43c255c87	UPdate policycorutils version	2009-02-10 16:10:28 +00:00
Daniel J Walsh	1d1c058a4e	- Add git web policy	2009-02-10 16:08:36 +00:00
Daniel J Walsh	bd0db4f147	- Add setrans contains from upstream	2009-02-09 22:07:20 +00:00
Daniel J Walsh	4ed140a4b7	- Allow xdm to create user_tmp_t sockets for switch user to work	2009-02-09 14:23:24 +00:00
Daniel J Walsh	bc861e624e	- Fix staff_t domain	2009-02-06 17:48:29 +00:00
Daniel J Walsh	73fe81bbab	- Grab remainder of network_peer_controls patch	2009-02-05 13:44:44 +00:00
Daniel J Walsh	659e96fa65	- More fixes for devicekit	2009-02-04 16:24:43 +00:00
Daniel J Walsh	c957c38343	- Upgrade to latest upstream	2009-02-04 04:02:17 +00:00
Daniel J Walsh	574cab47f1	- Add boolean to disallow unconfined_t login	2009-02-03 15:26:10 +00:00
Daniel J Walsh	0554a10b80	- Add back transition from xguest to mozilla	2009-01-30 16:49:11 +00:00
Daniel J Walsh	ab3e55d79a	- Add virt_content_ro_t and labeling for isos directory	2009-01-30 15:06:44 +00:00
Daniel J Walsh	2fbeb784fa	- Fixes for wicd daemon	2009-01-28 22:23:18 +00:00
Daniel J Walsh	f899107d92	- Fixes for wicd daemon	2009-01-28 17:23:17 +00:00
Daniel J Walsh	48adbeae08	- More mls/rpm fixes	2009-01-26 16:21:59 +00:00
Daniel J Walsh	14c9b9cdc6	- Add policy to make dbus/nm-applet work	2009-01-23 20:35:45 +00:00
Daniel J Walsh	40dd24d39b	- Remove polgen-ifgen from post and add trigger to policycoreutils-python	2009-01-22 20:10:48 +00:00
Daniel J Walsh	6f8856e9d4	- Add wm policy ... - Make mls work in graphics mode	2009-01-21 22:49:23 +00:00
Daniel J Walsh	6cf32a1e8b	- Add wm policy ... - Make mls work in graphics mode	2009-01-21 21:22:11 +00:00
Daniel J Walsh	1b94a1375f	- Add wm policy	2009-01-21 20:39:17 +00:00
Daniel J Walsh	2a4bdae89c	- Fixed for DeviceKit	2009-01-21 16:17:40 +00:00
Daniel J Walsh	acc137684b	- Add devicekit policy	2009-01-19 22:34:56 +00:00
Daniel J Walsh	1d72fb031f	- Update to upstream	2009-01-19 17:35:43 +00:00
Daniel J Walsh	7b146db852	- Define openoffice as an x_domain	2009-01-19 14:28:24 +00:00
Daniel J Walsh	eacea1d45d	- Define openoffice as an x_domain	2009-01-16 21:32:59 +00:00
Daniel J Walsh	339bf3bba8	- Fixes for reading xserver_tmp_t	2009-01-13 16:22:47 +00:00
Daniel J Walsh	87fb15321a	- Allow cups_pdf_t write to nfs_t	2009-01-12 16:59:00 +00:00
Daniel J Walsh	2ed2ff46f8	- Remove audio_entropy policy	2009-01-06 14:46:21 +00:00
Daniel J Walsh	292c49cacc	- Update to upstream	2009-01-05 22:55:20 +00:00
Daniel J Walsh	5df2628335	- Allow hal_acl_t to getattr/setattr fixed_disk	2009-01-04 19:45:03 +00:00
Daniel J Walsh	32363900ec	- Change userdom_read_all_users_state to include reading symbolic links in ... /proc	2008-12-27 13:06:14 +00:00
Daniel J Walsh	cf8fd9f0cc	- Fix dbus reading /proc information	2008-12-22 22:51:28 +00:00
Daniel J Walsh	bae2e9888e	- Add missing alias for home directory content	2008-12-22 19:35:46 +00:00
Daniel J Walsh	33c7eab541	- Fixes for IBM java location	2008-12-17 21:15:08 +00:00
Daniel J Walsh	dcd0c96f34	- Allow unconfined_r unconfined_java_t	2008-12-11 15:21:57 +00:00
Daniel J Walsh	fd2b62ea68	- Add cron_role back to user domains	2008-12-09 21:04:28 +00:00
Daniel J Walsh	9a43d2b055	- Fix sudo setting of user keys	2008-12-08 22:00:56 +00:00
Daniel J Walsh	163db10557	- Allow iptables to talk to terminals ... - Fixes for policy kit - lots of fixes for booting.	2008-12-08 16:38:09 +00:00
Daniel J Walsh	2ae1615a14	- Allow iptables to talk to terminals ... - Fixes for policy kit - lots of fixes for booting.	2008-12-04 21:43:55 +00:00
Daniel J Walsh	c136db3296	- Allow iptables to talk to terminals	2008-12-04 20:36:26 +00:00
Daniel J Walsh	01ce3df8a6	- Allow iptables to talk to terminals	2008-12-04 18:47:26 +00:00
Daniel J Walsh	bcb1922de7	- Cleanup policy	2008-12-03 23:40:18 +00:00
Daniel J Walsh	739db21a4a	- Cleanup policy	2008-12-03 22:18:31 +00:00
Ignacio Vazquez-Abrams	23d6844939	Rebuild for Python 2.6	2008-12-01 15:00:41 +00:00
Daniel J Walsh	02d888c766	- Fix labeling on /var/spool/rsyslog	2008-11-25 19:18:01 +00:00
Daniel J Walsh	0d6e623017	- Allow postgresl to bind to udp nodes	2008-11-06 17:47:54 +00:00
Daniel J Walsh	2a650ea1aa	- Allow lvm to dbus chat with hal ... - Allow rlogind to read nfs_t	2008-11-05 22:21:30 +00:00
Daniel J Walsh	074b12f275	- Fix cyphesis file context	2008-11-05 20:34:06 +00:00
Daniel J Walsh	6a09cfb688	- Allow hal/pm-utils to look at /var/run/video.rom ... - Add ulogd policy	2008-11-05 18:26:36 +00:00
Daniel J Walsh	411a424e1c	- Additional fixes for cyphesis ... - Fix certmaster file context - Add policy for system-config-samba	2008-11-04 15:40:31 +00:00
Daniel J Walsh	333ebd64df	- Allow dhcpc to restart ypbind ... - Fixup labeling in /var/run	2008-11-03 21:09:40 +00:00
Daniel J Walsh	1bc89b8d4c	- Fix confined users ... - Allow xguest to read/write xguest_dbusd_t	2008-10-29 20:45:55 +00:00
Daniel J Walsh	2362056f7a	- Fix confined users ... - Allow xguest to read/write xguest_dbusd_t	2008-10-29 17:12:16 +00:00
Daniel J Walsh	812930ae8d	- Allow openoffice execstack/execmem privs	2008-10-28 23:22:15 +00:00
Daniel J Walsh	d8e5d05b6e	- Allow openoffice execstack/execmem privs	2008-10-28 20:06:14 +00:00
Daniel J Walsh	a3e038c1a1	- Allow openoffice execstack/execmem privs	2008-10-27 21:07:05 +00:00
Daniel J Walsh	4fa9db787c	- Allow mozilla to run with unconfined_execmem_t	2008-10-25 11:14:56 +00:00
Daniel J Walsh	798a73de69	- Dontaudit domains trying to write to .xsession-errors	2008-10-24 13:41:09 +00:00
Daniel J Walsh	3281238148	- Allow nsplugin to look at autofs_t directory	2008-10-24 12:14:54 +00:00
Daniel J Walsh	de61cc7d10	- Allow kerneloops to create tmp files	2008-10-23 12:59:31 +00:00
Daniel J Walsh	ae68d97fe5	- More alias for fastcgi	2008-10-22 13:34:13 +00:00
Daniel J Walsh	236d3cc19a	- Remove mod_fcgid-selinux package	2008-10-21 18:31:38 +00:00
Daniel J Walsh	b9e15d9766	- Fix dovecot access	2008-10-20 19:53:30 +00:00
Daniel J Walsh	49f48f4a99	- Policy cleanup	2008-10-17 22:03:34 +00:00
Daniel J Walsh	b4cab5a3eb	- Remove Multiple spec ... - Add include - Fix makefile to not call per_role_expansion	2008-10-16 19:56:59 +00:00
Daniel J Walsh	6115689216	- Remove Multiple spec ... - Add include - Fix makefile to not call per_role_expansion	2008-10-16 17:28:39 +00:00
Daniel J Walsh	4b4392dd08	- Fix labeling of libGL	2008-10-15 21:32:30 +00:00
Daniel J Walsh	4125702a20	- Update to upstream	2008-10-14 23:50:08 +00:00
Daniel J Walsh	b6cc6a84e9	- Update to upstream	2008-10-11 23:57:43 +00:00
Daniel J Walsh	675bbabe24	- Update to upstream policy	2008-10-09 03:10:32 +00:00
Daniel J Walsh	1062bd3849	- Fixes for confined xwindows and xdm_t	2008-10-06 19:10:48 +00:00
Daniel J Walsh	86369ef439	- Allow confined users and xdm to exec wm ... - Allow nsplugin to talk to fifo files on nfs	2008-10-03 20:11:22 +00:00
Daniel J Walsh	f1a8278899	- Allow NetworkManager to transition to avahi and iptables ... - Allow domains to search other domains keys, coverup kernel bug	2008-10-03 15:49:44 +00:00
Daniel J Walsh	b42a1eddf9	- Allow domains to search other domains keys, coverup kernel bug	2008-10-03 15:07:40 +00:00
Daniel J Walsh	094ef3d610	- Fix labeling for oracle	2008-10-01 19:15:34 +00:00
Daniel J Walsh	2ede4ec7ba	- Allow nsplugin to comminicate with xdm_tmp_t sock_file	2008-10-01 12:27:11 +00:00
Daniel J Walsh	99873745bf	- Change all user tmpfs_t files to be labeled user_tmpfs_t ... - Allow radiusd to create sock_files	2008-09-30 14:39:16 +00:00
Daniel J Walsh	b709ffd738	- Upgrade to upstream	2008-09-25 18:54:16 +00:00
Daniel J Walsh	ed32c64290	- Allow confined users to login with dbus	2008-09-23 20:14:47 +00:00
Daniel J Walsh	a80e7ac6a3	- Fix transition to nsplugin	2008-09-23 15:14:53 +00:00
Daniel J Walsh	d86efe56b9	- Fix transition to nsplugin	2008-09-22 20:07:59 +00:00
Daniel J Walsh	f0375d509e	- Add file context for /dev/mspblk.*	2008-09-22 17:55:56 +00:00
Daniel J Walsh	f77dd2c9db	- Fix transition to nsplugin ' ... Thu Sep 18 2008 Dan Walsh <dwalsh@redhat.com> 3.5.8-3 - Fix labeling on new pm*log - Allow ssh to bind to all nodes	2008-09-22 12:33:03 +00:00
Daniel J Walsh	11ef2470b7	- Fix labeling on new pm*log ... - Allow ssh to bind to all nodes	2008-09-18 21:02:12 +00:00
Daniel J Walsh	530772ab58	- Fix labeling on new pm*log ... - Allow ssh to bind to all nodes	2008-09-18 19:34:12 +00:00
Daniel J Walsh	16c3ff1596	- Merge upstream changes ... - Add Xavier Toth patches	2008-09-12 14:21:05 +00:00
Daniel J Walsh	aca77a6f2d	- Remove gamin policy	2008-09-08 21:01:42 +00:00
Daniel J Walsh	d0d3073e2f	- Add tinyxs-max file system support	2008-09-04 20:59:27 +00:00
Daniel J Walsh	0a219fe07b	- Update to upstream ... - New handling of init scripts	2008-09-03 20:16:35 +00:00
Daniel J Walsh	3ad3552b8a	- Allow audit dispatcher to kill his children	2008-08-29 20:54:34 +00:00
Daniel J Walsh	cd8bee594b	- Update to upstream ... - Fix crontab use by unconfined user	2008-08-29 19:29:23 +00:00
Daniel J Walsh	7638e78556	- Allow ifconfig_t to read dhcpc_state_t	2008-08-26 14:46:43 +00:00
Daniel J Walsh	eb7e6dca5e	- Allow ifconfig_t to read dhcpc_state_t	2008-08-13 19:24:36 +00:00
Daniel J Walsh	57ae10cc0d	- Update to upstream	2008-08-12 15:06:36 +00:00
Daniel J Walsh	1a0f642074	- Update to upstream	2008-08-11 21:19:25 +00:00
Daniel J Walsh	b5d09d1532	- Update to upstream	2008-08-07 20:05:57 +00:00
Daniel J Walsh	0f1bd620e5	- Allow system-config-selinux to work with policykit	2008-08-07 12:22:07 +00:00
Daniel J Walsh	174291bc3e	- Fix novel labeling	2008-08-05 20:49:34 +00:00
Daniel J Walsh	170fa29709	- Fix novel labeling	2008-08-01 16:38:49 +00:00
Daniel J Walsh	07bd5c4abb	- Consolodate pyzor,spamassassin, razor into one security domain ... - Fix xdm requiring additional perms.	2008-07-30 13:48:03 +00:00
Daniel J Walsh	8f2532e249	- Fixes for logrotate, alsa	2008-07-25 11:53:34 +00:00
Daniel J Walsh	f12d5b90db	- Eliminate vbetool duplicate entry	2008-07-25 04:24:01 +00:00
Daniel J Walsh	0b05335dd6	- Fix xguest -> xguest_mozilla_t -> xguest_openiffice_t ... - Change dhclient to be able to red networkmanager_var_run	2008-07-24 18:19:05 +00:00
Daniel J Walsh	feefeee019	- Fix xguest -> xguest_mozilla_t -> xguest_openiffice_t	2008-07-17 19:53:32 +00:00
Daniel J Walsh	078ad09a44	- Update to latest refpolicy ... - Fix libsemanage initial install bug	2008-07-15 20:06:55 +00:00
Daniel J Walsh	6ed8533082	- Update to latest refpolicy	2008-07-15 15:22:39 +00:00
Daniel J Walsh	df6220163f	- Add inotify support to nscd	2008-07-10 15:28:32 +00:00
Daniel J Walsh	6db69f086d	Add nscd inotify fix	2008-07-09 13:05:54 +00:00
Daniel J Walsh	43f9fcec3e	- Allow unconfined_t to setfcap	2008-07-08 20:14:39 +00:00
Daniel J Walsh	273a44c689	- Allow amanda to read tape ... - Allow prewikka cgi to use syslog, allow audisp_t to signal cgi - Add support for netware file systems	2008-07-07 17:56:28 +00:00
Daniel J Walsh	258b00e5b7	- Allow ypbind apps to net_bind_service	2008-07-03 20:14:23 +00:00
Daniel J Walsh	75edec44e7	- Allow all system domains and application domains to append to any log ... file	2008-07-02 20:45:43 +00:00
Daniel J Walsh	cd60b64c83	- Allow gdm to read rpm database ... - Allow nsplugin to read mplayer config files	2008-06-30 21:12:23 +00:00
Daniel J Walsh	c18681476b	- Allow vpnc to run ifconfig	2008-06-26 12:12:35 +00:00
Daniel J Walsh	f86ed5a437	- Allow confined users to use postgres ... - Allow system_mail_t to exec other mail clients - Label mogrel_rails as an apache server	2008-06-24 11:14:04 +00:00
Daniel J Walsh	547aa2a382	- Apply unconfined_execmem_exec_t to haskell programs	2008-06-23 12:20:04 +00:00
Daniel J Walsh	6959e0bb76	- Fix prelude file context	2008-06-23 00:55:21 +00:00
Daniel J Walsh	fe0d467c2b	- allow hplip to talk dbus ... - Fix context on ~/.local dir	2008-06-22 12:22:25 +00:00
Daniel J Walsh	f4ff8bb944	- Prevent applications from reading x_device	2008-06-12 19:57:12 +00:00
Daniel J Walsh	5608a9da69	- Add /var/lib/selinux context	2008-06-12 18:44:52 +00:00
Daniel J Walsh	af0f735167	- Update to upstream	2008-06-12 14:50:00 +00:00
Daniel J Walsh	c5c253fae5	- Update to upstream	2008-06-11 19:01:26 +00:00
Daniel J Walsh	f513c7b90b	- Add livecd policy	2008-06-10 19:34:59 +00:00
Daniel J Walsh	15f71c5d61	- Add livecd policy	2008-06-04 17:26:52 +00:00
Daniel J Walsh	91ec07f1df	- Dontaudit search of admin_home for init_system_domain ... - Rewrite of xace interfaces - Lots of new fs_list_inotify - Allow livecd to transition to setfiles_mac	2008-06-04 12:57:43 +00:00
Daniel J Walsh	80e0b808d5	- Begin XAce integration	2008-06-03 20:27:28 +00:00
Daniel J Walsh	081b6ac47e	- Merge Upstream	2008-06-02 18:56:05 +00:00
Daniel J Walsh	2e33f7ba70	- Merge Upstream	2008-06-02 17:10:33 +00:00
Daniel J Walsh	4b7f030014	Update for rawhide	2008-05-19 13:02:56 +00:00
Daniel J Walsh	993c27dacb	- Allow amanada to create data files	2008-05-07 19:10:59 +00:00
Daniel J Walsh	6c25b428ce	- Remove dmesg boolean ... - Allow user domains to read/write game data	2008-05-06 17:01:42 +00:00
Daniel J Walsh	86881dd93f	- Change unconfined_t to transition to unconfined_mono_t when running mono ... - Change XXX_mono_t to transition to XXX_t when executing bin_t files, so gnome-do will work	2008-04-29 16:05:11 +00:00
Daniel J Walsh	2d8ff5157a	- Remove old booleans from targeted-booleans.conf file	2008-04-28 21:24:59 +00:00
Daniel J Walsh	b4e933120a	- Don't run crontab from unconfined_t	2008-04-24 21:08:32 +00:00
Daniel J Walsh	ef5e600999	- Don't run crontab from unconfined_t	2008-04-24 19:41:22 +00:00
Daniel J Walsh	4b1d56da14	- Change etc files to config files to allow users to read them	2008-04-23 14:15:54 +00:00
Daniel J Walsh	a6a82aec79	- dontaudit mrtg reading /proc ... - Allow iscsi to signal itself - Allow gnomeclock sys_ptrace	2008-04-15 20:27:09 +00:00
Daniel J Walsh	5896bad9cf		2008-04-14 20:01:48 +00:00
Daniel J Walsh	bb36d75512		2008-04-11 18:58:08 +00:00
Daniel J Walsh	06686c20a2	- Allow dhcpd to read kernel network state	2008-04-10 19:45:47 +00:00
Daniel J Walsh	41625a26ea	- Label /var/run/gdm correctly ... - Fix unconfined_u user creation	2008-04-10 14:37:57 +00:00
Daniel J Walsh	254e3c7af3	- Allow transition from initrc_t to getty_t	2008-04-08 20:14:36 +00:00
Daniel J Walsh	5a576e06f0	- Allow passwd to communicate with user sockets to change gnome-keyring	2008-04-08 19:17:28 +00:00
Daniel J Walsh	7f851af8d9	- Fix initial install	2008-04-08 03:17:46 +00:00
Daniel J Walsh	c3c4a525c2	-	2008-04-06 12:06:47 +00:00
Daniel J Walsh	27943de6a0	- Allow radvd to use fifo_file ... - dontaudit setfiles reading links - allow semanage sys_resource - add allow_httpd_mod_auth_ntlm_winbind boolean - Allow privhome apps including dovecot read on nfs and cifs home dirs if the boolean is set	2008-04-05 10:39:06 +00:00
Daniel J Walsh	c66f2bc425	- Allow nsplugin to read /etc/mozpluggerrc, user_fonts ... - Allow syslog to manage innd logs. - Allow procmail to ioctl spamd_exec_t	2008-04-01 09:21:21 +00:00
Daniel J Walsh	294ea7a213	- Allow initrc_t to dbus chat with consolekit.	2008-03-29 18:36:09 +00:00
Daniel J Walsh	e54cb216a8	- Additional access for nsplugin ... - Allow xdm setcap/getcap until pulseaudio is fixed	2008-03-28 22:07:45 +00:00
Daniel J Walsh	f70afcdd9e	- Allow mount to mkdir on tmpfs ... - Allow ifconfig to search debugfs	2008-03-26 06:17:27 +00:00
Daniel J Walsh	bf3d39e959	- Fix file context for MATLAB ... - Fixes for xace	2008-03-21 23:24:11 +00:00
Daniel J Walsh	5ea3f10caf	- Allow stunnel to transition to inetd children domains ... - Make unconfined_dbusd_t an unconfined domain	2008-03-20 16:11:16 +00:00
Daniel J Walsh	94b7be909e		2008-03-18 21:10:02 +00:00
Daniel J Walsh	ba9e5e8244	- Fixes for qemu/virtd	2008-03-17 21:42:05 +00:00
Daniel J Walsh	97081dcb9d	- Fix bug in mozilla policy to allow xguest transition ... - This will fix the	2008-03-14 21:17:21 +00:00
Daniel J Walsh	a6e1280791	- Fix bug in mozilla policy to allow xguest transition ... - This will fix the	2008-03-14 21:13:24 +00:00
Daniel J Walsh	d593d26c1d	- Allow nsplugin to run acroread	2008-03-14 15:59:07 +00:00
Daniel J Walsh	987b10f86d	- Add cups_pdf policy ... - Add openoffice policy to run in xguest	2008-03-14 00:25:00 +00:00
Daniel J Walsh	7f811bf534	- prewika needs to contact mysql ... - Allow syslog to read system_map files	2008-03-13 12:58:25 +00:00
Daniel J Walsh	ceda8feb68	- Change init_t to an unconfined_domain	2008-03-12 12:39:48 +00:00
Daniel J Walsh	0879f489ab	- Allow init to transition to initrc_t on shell exec. ... - Fix init to be able to sendto init_t. - Allow syslog to connect to mysql - Allow lvm to manage its own fifo_files - Allow bugzilla to use ldap - More mls fixes	2008-03-12 01:10:44 +00:00
Bill Nottingham	110bce3a29	fixes for init, rhgb. also, fix the build	2008-03-11 22:46:00 +00:00
Daniel J Walsh	2041ac3d49	- Additional changes for MLS policy	2008-03-10 20:58:06 +00:00
Daniel J Walsh	1bf67d57ed	- Fix initrc_context generation for MLS	2008-03-06 22:25:06 +00:00
Daniel J Walsh	dc57e68eff	- Fixes for libvirt	2008-03-05 23:11:52 +00:00
Daniel J Walsh	5947905ef9	- Allow bitlebee to read locale_t	2008-03-04 21:38:18 +00:00
Daniel J Walsh	d8c160273b	- More xselinux rules	2008-02-29 22:33:22 +00:00
Daniel J Walsh	9a0f35b9ad	- Change httpd_$1_script_r*_t to httpd_$1_content_r*_t	2008-02-29 22:18:30 +00:00
Daniel J Walsh	338714fc7f	-	2008-02-28 21:51:10 +00:00
Daniel J Walsh	b7229ad8bb	- Prepare policy for beta release ... - Change some of the system domains back to unconfined - Turn on some of the booleans	2008-02-28 05:01:51 +00:00
Daniel J Walsh	40ce26840e	- Prepare policy for beta release ... - Change some of the system domains back to unconfined - Turn on some of the booleans	2008-02-28 04:35:56 +00:00
Daniel J Walsh	533c755e4d	- Allow nsplugin_config execstack/execmem ... - Allow nsplugin_t to read alsa config - Change apache to use user content	2008-02-28 03:32:23 +00:00
Daniel J Walsh	c092cc1478	- Add cyphesis policy	2008-02-26 23:02:51 +00:00
Daniel J Walsh	063999dd85		2008-02-26 19:24:53 +00:00
Daniel J Walsh	27b2b09ffe	-	2008-02-26 16:15:00 +00:00
Daniel J Walsh	f75033d612	- Update to upstream fixes	2008-02-26 13:45:23 +00:00
Daniel J Walsh	5ca2ff99b6	- Add xace support	2008-02-22 20:32:52 +00:00
Daniel J Walsh	8bd036a289	- Add fusectl file system	2008-02-21 19:43:52 +00:00
Daniel J Walsh	541ba8edec	- Fixes from yum-cron ... - Update to latest upstream	2008-02-20 18:52:50 +00:00
Daniel J Walsh	e5acebe58c		2008-02-20 18:30:31 +00:00
Daniel J Walsh	306393505f	- Fix userdom_list_user_files	2008-02-19 22:20:15 +00:00
Daniel J Walsh	eb3e9fbc68	- Merge with upstream	2008-02-18 21:31:18 +00:00
Daniel J Walsh	7e1e7bed89	- Allow udev to send audit messages	2008-02-14 21:05:32 +00:00
Daniel J Walsh	9870c64ba7	- Add additional login users interfaces ... - userdom_admin_login_user_template(staff)	2008-02-13 22:13:58 +00:00
Daniel J Walsh	49295b262f	- More fixes for polkit	2008-02-12 18:41:35 +00:00
Daniel J Walsh	ebe074be56	- More fixes for polkit	2008-02-11 22:53:26 +00:00
Daniel J Walsh	57ac1cab83	- Update to upstream	2008-02-06 21:47:42 +00:00
Daniel J Walsh	4637b67d50	- Fixes for staff_t	2008-02-05 21:25:09 +00:00
Daniel J Walsh	b53db53c9f	- Add policy for kerneloops ... - Add policy for gnomeclock	2008-02-05 18:31:25 +00:00
Daniel J Walsh	881d64a16e	- Fixes for libvirt	2008-02-04 21:41:59 +00:00
Daniel J Walsh	60c693e546	- Fixes for nsplugin	2008-02-03 13:39:47 +00:00
Daniel J Walsh	11ac4bcde1	- Additional ports for vnc and allow qemu and libvirt to search all ... directories	2008-02-02 15:42:44 +00:00
Daniel J Walsh	b19d470cd4	- Update to upstream ... - Add libvirt policy - add qemu policy	2008-02-02 06:30:04 +00:00
Daniel J Walsh	e1060e24d5	- Allow fail2ban to create a socket in /var/run	2008-02-01 13:49:05 +00:00
Daniel J Walsh	59d6fbb642	- Allow allow_httpd_mod_auth_pam to work	2008-01-31 20:59:05 +00:00
Daniel J Walsh	7c124f5e42	- Allow allow_httpd_mod_auth_pam to work	2008-01-31 19:32:51 +00:00
Daniel J Walsh	f18a882ba5	- Add audisp policy and prelude	2008-01-30 21:34:13 +00:00
Daniel J Walsh	0f70114e58	- Allow all user roles to executae samba net command	2008-01-30 13:56:22 +00:00
Daniel J Walsh	7c2be34d14	- Allow usertypes to read/write noxattr file systems	2008-01-28 16:48:49 +00:00
Daniel J Walsh	7c7d59935b	- Fix nsplugin to allow flashplugin to work in enforcing mode	2008-01-24 18:12:25 +00:00
Daniel J Walsh	0939872058	- Allow pam_selinux_permit to kill all processes	2008-01-23 18:24:12 +00:00
Daniel J Walsh	cc5bb89ef0	- Allow ptrace or user processes by users of same type ... - Add boolean for transition to nsplugin	2008-01-22 19:46:50 +00:00
Daniel J Walsh	ef19b75773	- Allow nsplugin sys_nice, getsched, setsched	2008-01-22 17:35:34 +00:00
Daniel J Walsh	b3c8a04083	- Allow login programs to talk dbus to oddjob	2008-01-21 21:42:26 +00:00
Daniel J Walsh	98f84cb0ed	- Add procmail_log support ... - Lots of fixes for munin	2008-01-21 15:57:25 +00:00
Daniel J Walsh	e26fef9ac3	- Allow setroubleshoot to read policy config and send audit messages	2008-01-15 20:43:04 +00:00
Daniel J Walsh	8a40d69539	- Allow users to execute all files in homedir, if boolean set ... - Allow mount to read samba config	2008-01-14 19:47:11 +00:00
Daniel J Walsh	27c7d85aab	- Fixes for xguest to run java plugin	2008-01-13 14:01:50 +00:00
Daniel J Walsh	4be3ba520d	- dontaudit pam_t and dbusd writing to user_home_t	2008-01-11 19:45:47 +00:00
Daniel J Walsh	5baf53aabd	- Update gpg to allow reading of inotify	2008-01-08 19:58:56 +00:00
Daniel J Walsh	a502c55197	- Change user and staff roles to work correctly with varied perms	2008-01-03 22:13:09 +00:00
Daniel J Walsh	c64ec27caa	- Fix munin log, ... - Eliminate duplicate mozilla file context - fix wpa_supplicant spec	2007-12-31 21:47:39 +00:00
Daniel J Walsh	88ae3f5e0c	- Fix role transition from unconfined_r to system_r when running rpm ... - Allow unconfined_domains to communicate with user dbus instances	2007-12-30 15:12:11 +00:00
Daniel J Walsh	5d13344539	- Fix role transition fro unconfined_r to system_r when running rpm	2007-12-24 12:01:17 +00:00
Daniel J Walsh	0ec33db4ff	- Let all uncofined domains communicate with dbus unconfined	2007-12-21 07:58:04 +00:00
Daniel J Walsh	673eaaeafb	- Run rpm in system_r	2007-12-20 21:26:31 +00:00
Daniel J Walsh	5615fe1b3d	- Zero out customizable types	2007-12-19 21:45:51 +00:00
Daniel J Walsh	9a2cf87457	- Fix definiton of admin_home_t	2007-12-19 10:42:06 +00:00
Daniel J Walsh	2f257cb996	- Fix munin file context	2007-12-19 09:27:15 +00:00
Daniel J Walsh	91c2fa9d31	- Allow cron to run unconfined apps	2007-12-18 13:59:31 +00:00
Daniel J Walsh	99d3676891	- Modify default login to unconfined_u	2007-12-17 22:49:08 +00:00
Daniel J Walsh	4d59c29e33	- Dontaudit dbus user client search of /root	2007-12-14 12:40:39 +00:00
Daniel J Walsh	5928688f61	- Dontaudit dbus user client search of /root	2007-12-13 22:42:22 +00:00
Daniel J Walsh	76e3401243	- Update to upstream	2007-12-13 18:44:18 +00:00
Daniel J Walsh	4c6f2dd6a3	- Fixes for polkit ... - Allow xserver to ptrace	2007-12-12 14:53:07 +00:00
Daniel J Walsh	7dfe3eb3ef	- Add polkit policy ... - Symplify userdom context, remove automatic per_role changes	2007-12-11 06:08:33 +00:00
Daniel J Walsh	a1341a85df	- Update to upstream ... - Allow httpd_sys_script_t to search users homedirs	2007-12-06 21:37:36 +00:00
Daniel J Walsh	02654b8fb4	- Update to upstream ... - Allow httpd_sys_script_t to search users homedirs	2007-12-05 03:19:13 +00:00
Daniel J Walsh	d195fc7e87	- Update to upstreamddddddddddddd ... - Allow httpd_sys_script_t to search users homedirs	2007-12-05 03:11:46 +00:00
Daniel J Walsh	320f3e6459	- Allow rpm_script to transition to unconfined_execmem_t	2007-12-04 00:15:27 +00:00
Daniel J Walsh	3b47cb03b7	Fri Nov 30 2007 Dan Walsh <dwalsh@redhat.com> 3.2.1-1 ... - Remove user based home directory separation	2007-12-03 00:15:23 +00:00
Daniel J Walsh	9186dc57d9	- Remove user based home directory separation	2007-11-30 22:33:18 +00:00
Daniel J Walsh	3a54e4809f	- Remove user specific crond_t	2007-11-28 16:56:57 +00:00
Daniel J Walsh	0fffbad8de	- Merge with upstream ... - Allow xsever to read hwdata_t - Allow login programs to setkeycreate	2007-11-26 15:40:45 +00:00
Daniel J Walsh	ddf4ec413f	- Update to upstream	2007-11-19 20:09:32 +00:00
Daniel J Walsh	7330e86b90	- Update to upstream	2007-11-10 14:14:41 +00:00
Daniel J Walsh	36404444a8	- Update to upstream	2007-11-07 19:42:24 +00:00
Daniel J Walsh	fa0d1c8884	- Update to upstream	2007-10-23 23:13:09 +00:00
Daniel J Walsh	d0649e9167	- Allow XServer to read /proc/self/cmdline	2007-10-22 14:27:29 +00:00
Daniel J Walsh	30dfdc7f05	- Fixes for hald_mac ... - Treat unconfined_home_dir_t as a home dir - dontaudit rhgb writes to fonts and root	2007-10-19 21:21:40 +00:00
Daniel J Walsh	3375c34d9a	- Fix dnsmasq ... - Allow rshd full login privs	2007-10-19 15:01:30 +00:00
Daniel J Walsh	6455c9d6b5	- Allow rshd to connect to ports > 1023	2007-10-18 22:33:41 +00:00
Daniel J Walsh	953fd14b2e	- Fix vpn to bind to port 4500 ... - Allow ssh to create shm - Allow rshd to bind to ports > 1023 - Add Kismet policy	2007-10-18 22:00:35 +00:00
Daniel J Walsh	ccf8a72ae3	- Fix vpn to bind to port 4500 ... - Allow ssh to create shm - Allow rshd to bind to ports > 1023	2007-10-18 21:33:00 +00:00
Daniel J Walsh	b4ed6dbce0	- Allow rpm to chat with networkmanager	2007-10-17 03:51:04 +00:00
Daniel J Walsh	9185bf2fee	- Pass the UNK_PERMS param to makefile ... - Fix gdm location	2007-10-13 14:15:08 +00:00
Daniel J Walsh	c27b2bd6ae	- Make alsa work	2007-10-11 18:57:00 +00:00
Daniel J Walsh	28021c8d41	- Fixes for consolekit and startx sessions	2007-10-09 20:53:38 +00:00
Daniel J Walsh	7a91e89abe	- Dontaudit consoletype talking to unconfined_t	2007-10-08 15:32:19 +00:00
Daniel J Walsh	8fd9df6414	- Remove homedir_template	2007-10-05 19:47:10 +00:00
Daniel J Walsh	922f646a26	- Remove homedir_template	2007-10-05 11:43:46 +00:00
Daniel J Walsh	24ccb8b103	- Check asound.state	2007-10-04 14:34:02 +00:00
Daniel J Walsh	492612d339	- Fix exim policy	2007-10-01 21:20:16 +00:00
Daniel J Walsh	1ffa684823	- Allow tmpreadper to read man_t ... - Allow racoon to bind to all nodes - Fixes for finger print reader	2007-10-01 17:03:12 +00:00
Daniel J Walsh	7c1c1729f9	- Allow xdm to talk to input device (fingerprint reader) ... - Allow octave to run as java	2007-09-26 22:01:27 +00:00
Daniel J Walsh	d770c53fe9	- Allow login programs to set ioctl on /proc	2007-09-25 15:03:25 +00:00
Daniel J Walsh	fb11ad6653	- Allow nsswitch apps to read samba_var_t	2007-09-25 13:30:08 +00:00
Daniel J Walsh	f5018f18f8	- Fix maxima	2007-09-24 20:26:12 +00:00
Daniel J Walsh	d83ea801ac	- Eliminate rpm_t:fifo_file avcs ... - Fix dbus path for helper app	2007-09-24 14:18:57 +00:00
Daniel J Walsh	6c319e4011	- Fix service start stop terminal avc's	2007-09-22 12:15:13 +00:00
Daniel J Walsh	ec4fb1ce99	- Allow also to search var_lib ... - New context for dbus launcher	2007-09-21 23:46:18 +00:00
Daniel J Walsh	347ff1a0c3	- Allow cupsd_config_t to read/write usb_device_t ... - Support for finger print reader, - Many fixes for clvmd - dbus starting networkmanager	2007-09-21 20:21:36 +00:00
Daniel J Walsh	07e28d136d	- Fix java and mono to run in xguest account	2007-09-20 22:30:51 +00:00
Daniel J Walsh	a9d4b80f50	- Fix to add xguest account when inititial install ... - Allow mono, java, wine to run in userdomains	2007-09-20 17:21:13 +00:00
Daniel J Walsh	c67a1217e2	- Fix to add xguest account when inititial install	2007-09-20 14:58:12 +00:00
Daniel J Walsh	d90a3db27d	- Allow xserver to search devpts_t ... - Dontaudit ldconfig output to homedir	2007-09-20 14:39:14 +00:00
Daniel J Walsh	21c534bcb9	- Allow xserver to search devpts_t ... - Dontaudit ldconfig output to homedir	2007-09-19 17:40:59 +00:00
Daniel J Walsh	7ff410d3bc	- Remove hplip_etc_t change back to etc_t.	2007-09-19 01:11:31 +00:00
Daniel J Walsh	1a3fe36b5c	- Allow cron to search nfs and samba homedirs	2007-09-17 23:26:58 +00:00
Daniel J Walsh	babb3641bd	- Allow NetworkManager to dbus chat with yum-updated	2007-09-11 20:05:08 +00:00
Daniel J Walsh	bf7f975f77	- Allow xfs to bind to port 7100	2007-09-11 16:07:47 +00:00
Daniel J Walsh	25d586808d	- Allow newalias/sendmail dac_override ... - Allow bind to bind to all udp ports	2007-09-10 22:02:06 +00:00
Daniel J Walsh	4eaf5c6dc6	- Turn off direct transition	2007-09-07 20:26:11 +00:00
Daniel J Walsh	c7e443c95c	- Allow wine to run in system role	2007-09-07 19:03:11 +00:00
Daniel J Walsh	37d6a1ce3f	- Fix java labeling	2007-09-06 23:34:02 +00:00
Daniel J Walsh	07b8680835	- Define user_home_type as home_type	2007-09-06 15:00:00 +00:00
Daniel J Walsh	601f0f04ee	- Allow sendmail to create etc_aliases_t	2007-09-06 02:24:18 +00:00
Daniel J Walsh	bea5486254	- Allow sendmail to create etc_aliases_t	2007-09-05 21:30:18 +00:00
Daniel J Walsh	bc85a6bb23	- Allow login programs to read symlinks on homedirs	2007-08-28 15:35:11 +00:00
Daniel J Walsh	e8b5993e52	- Update an readd modules	2007-08-27 21:43:05 +00:00
Daniel J Walsh	7f9951d4d3	- Cleanup spec file	2007-08-24 21:38:11 +00:00
Daniel J Walsh	d9f447990b	- Cleanup spec file	2007-08-24 21:30:17 +00:00
Daniel J Walsh	b865b8b32e	- Cleanup spec file	2007-08-24 21:21:56 +00:00
Daniel J Walsh	53f81916e1	- Cleanup spec file	2007-08-24 21:09:44 +00:00
Daniel J Walsh	3012ab200b	- Cleanup spec file	2007-08-24 20:44:19 +00:00
Daniel J Walsh	d83af23b7d	- Cleanup spec file	2007-08-24 19:52:40 +00:00
Daniel J Walsh	3b13a834c7	- Allow xserver to be started by unconfined process and talk to tty	2007-08-24 14:20:35 +00:00
Daniel J Walsh	95bbe5cff0	- Upgrade to upstream to grab postgressql changes	2007-08-23 14:07:25 +00:00
Daniel J Walsh	77a22067be	- Add setransd for mls policy	2007-08-22 14:46:21 +00:00
Daniel J Walsh	c77aca56ae	- Add setransd for mls policy	2007-08-21 20:08:22 +00:00
Daniel J Walsh	4f23c46830	- Add ldconfig_cache_t	2007-08-20 23:02:30 +00:00
Daniel J Walsh	b4ae7d845a	- Allow sshd to write to proc_t for afs login	2007-08-20 22:15:46 +00:00
Daniel J Walsh	f012074e0f	- Allow xserver access to urand	2007-08-18 11:54:11 +00:00
Daniel J Walsh	7f6883ca6e	- allow dovecot to search mountpoints	2007-08-15 00:55:49 +00:00
Daniel J Walsh	0354c22269	- Fix Makefile for building policy modules	2007-08-11 11:18:09 +00:00
Daniel J Walsh	60a9ef60f0	- Fix dhcpc startup of service	2007-08-10 20:04:48 +00:00
Daniel J Walsh	bf33202534	- Fix dbus chat to not happen for xguest and guest users	2007-08-10 16:10:27 +00:00
Daniel J Walsh	d44a393484	- Fix nagios cgi ... - allow squid to communicate with winbind	2007-08-09 19:18:57 +00:00
Daniel J Walsh	1a12c251ca	- Fixes for ldconfig	2007-08-06 21:33:36 +00:00
Daniel J Walsh	d8c8b2b904	- Update from upstream	2007-08-03 20:38:28 +00:00
Daniel J Walsh	f9778219aa	- Update from upstream	2007-08-03 19:53:44 +00:00
Daniel J Walsh	25a75469ff	- Update from upstream	2007-08-03 19:26:04 +00:00
Daniel J Walsh	4ce75b7cd5	- Fix new usb devices and dmfm	2007-08-01 17:13:35 +00:00
Daniel J Walsh	8239a93362	- Fix new usb devices and dmfm	2007-08-01 16:03:23 +00:00
Daniel J Walsh	6d2e7d5ebb	- Eliminate mount_ntfs_t policy, merge into mount_t	2007-07-31 20:51:43 +00:00
Daniel J Walsh	47a35fa722	- Eliminate mount_ntfs_t policy, merge into mount_t	2007-07-31 17:53:29 +00:00
Daniel J Walsh	07351eb493	- Allow xserver to write to ramfs mounted by rhgb	2007-07-30 14:37:54 +00:00
Daniel J Walsh	9c038630bf	- Add context for dbus machine id	2007-07-27 18:21:35 +00:00
Daniel J Walsh	2fac1d6655	- Update with latest changes from upstream	2007-07-26 17:54:24 +00:00
Daniel J Walsh	24acabce75	- Fix prelink to handle execmod	2007-07-24 20:47:24 +00:00
Daniel J Walsh	0f8f545d1a	- Fix prelink to handle execmod	2007-07-24 14:39:01 +00:00
Daniel J Walsh	e0ae206813	- Add ntpd_key_t to handle secret data	2007-07-23 20:34:22 +00:00
Daniel J Walsh	2ced404c55	- Add anon_inodefs ... - Allow unpriv user exec pam_exec_t - Fix trigger	2007-07-23 16:00:09 +00:00
Daniel J Walsh	779d23c7e4	- Allow cups to use generic usb ... - fix inetd to be able to run random apps (git)	2007-07-20 15:13:37 +00:00
Daniel J Walsh	908512cccc	- Add proper contexts for rsyslogd	2007-07-19 20:55:20 +00:00
Daniel J Walsh	297dd1a900	- Allow execution of gconf	2007-07-19 14:45:16 +00:00
Daniel J Walsh	1d03199c5e	- Fix moilscanner update problem	2007-07-14 12:56:45 +00:00
Daniel J Walsh	7e3506426b	- Begin adding policy to separate setsebool from semanage ... - Fix xserver.if definition to not break sepolgen.if	2007-07-12 21:37:30 +00:00
Daniel J Walsh	16d9531977	- Fix xserver.if definition to not break sepolgen.if	2007-07-12 14:44:32 +00:00
Daniel J Walsh	2796de2a45	- Add new devices	2007-07-11 20:45:02 +00:00
Daniel J Walsh	154d8231c3	- Add brctl policy	2007-07-11 19:44:56 +00:00
Daniel J Walsh	501a17b8b2	- Fix root login to include system_r	2007-07-06 19:23:20 +00:00
Daniel J Walsh	35e7f77fea	- Allow prelink to read kernel sysctls	2007-07-06 19:09:19 +00:00
Daniel J Walsh	af677794a8	- Default to user_u:system_r:unconfined_t	2007-07-03 19:20:47 +00:00
Daniel J Walsh	b267b6f201	- Default to user_u:system_r:unconfined_t	2007-07-02 20:32:38 +00:00
Daniel J Walsh	b529ed6a06	- Default to user_u:system_r:unconfined_t	2007-07-02 15:00:50 +00:00
Daniel J Walsh	2fdb5fd7c6	- fix squid ... - Fix rpm running as uid	2007-07-02 01:58:41 +00:00
Daniel J Walsh	b786a2b04a	- Fix syslog declaration	2007-06-27 19:48:33 +00:00
Daniel J Walsh	7f44213c00	- Allow avahi to access inotify ... - Remove a lot of bogus security_t:filesystem avcs	2007-06-27 18:12:03 +00:00
Daniel J Walsh	269acb5ee8	- Remove ifdef strict policy from upstream	2007-06-26 12:09:30 +00:00
Daniel J Walsh	a4ec9b75e1	- Remove ifdef strict policy from upstream	2007-06-22 19:21:00 +00:00
Daniel J Walsh	56187c2f8a	- Remove ifdef strict policy from upstream	2007-05-31 18:40:35 +00:00
Daniel J Walsh	bdb830255c	- Fix for amands ... - Allow semanage to read pp files - Allow rhgb to read xdm_xserver_tmp	2007-05-23 18:35:37 +00:00
Daniel J Walsh	346d2dccfd		2007-05-21 18:54:40 +00:00
Daniel J Walsh	9ffb88eba3	- allow alsactl to read kernel state	2007-05-17 17:16:26 +00:00
Daniel J Walsh	fc35770056	- More fixes for alsactl ... - Transition from hal and modutils - Fixes for suspend resume. - insmod domtrans to alsactl - insmod writes to hal log	2007-05-16 22:13:23 +00:00
Daniel J Walsh	88c8465c87	- More fixes for alsactl	2007-05-16 21:48:52 +00:00
Daniel J Walsh	cf806ebda9	- Fixes for suspend resume. ... - insmod domtrans to alsactl - insmod writes to hal log	2007-05-16 21:09:41 +00:00
Daniel J Walsh	7c3dcb3584	- Allow unconfined_t to transition to NetworkManager_t ... - Fix netlabel policy	2007-05-16 19:31:34 +00:00
Daniel J Walsh	810e69636e	- Update to latest from upstream	2007-05-14 19:54:57 +00:00
Daniel J Walsh	8cd496f1d6	- Update to latest from upstream	2007-05-14 18:10:58 +00:00
Daniel J Walsh	057603fbda	- Update to latest from upstream	2007-05-07 18:07:26 +00:00
Daniel J Walsh	daa6abe9e1	- Update to latest from upstream	2007-05-04 17:30:10 +00:00
Daniel J Walsh	a615d5b893	- Update to latest from upstream	2007-05-02 02:53:14 +00:00
Daniel J Walsh	8fea836859	- Update to latest from upstream	2007-05-01 20:53:29 +00:00
Daniel J Walsh	6821c3df97	-	2007-04-27 17:23:49 +00:00
Daniel J Walsh	77d25ebf92	- Fixes for unix_update ... - Fix logwatch to be able to search all dirs	2007-04-25 18:31:32 +00:00
Daniel J Walsh	8396b2dbd2	- Upstream bumped the version	2007-04-23 17:00:48 +00:00
Daniel J Walsh	61947fac0a	- Allow consolekit to syslog ... - Allow ntfs to work with hal	2007-04-20 20:13:07 +00:00
Daniel J Walsh	2db3c1e86a	- Allow iptbales to read etc_runtime_t	2007-04-19 18:24:08 +00:00
Daniel J Walsh	4661767044	- MLS Fixes	2007-04-19 13:58:54 +00:00
Daniel J Walsh	53b22295eb	- MLS Fixes	2007-04-19 13:40:31 +00:00
Daniel J Walsh	883a0252b0	- Fix path of /etc/lvm/cache directory ... - Fixes for alsactl and pppd_t - Fixes for consolekit	2007-04-18 21:00:52 +00:00
Daniel J Walsh	ab59becfc6	- Fixes for alsactl and pppd_t	2007-04-18 20:50:02 +00:00
Daniel J Walsh	32b18f8ae9	- Fixes for consolekit	2007-04-18 20:45:20 +00:00
Daniel J Walsh	7671cee047	- Allow insmod_t to mount kvmfs_t filesystems	2007-04-17 20:42:32 +00:00
Daniel J Walsh	9fc00bcbda	- Rwho policy ... - Fixes for consolekit	2007-04-17 19:28:14 +00:00
Daniel J Walsh	e6f3cfbe2d	- fixes for fusefs	2007-04-16 17:11:45 +00:00
Daniel J Walsh	8c912ab526	- Fix samba_net to allow it to view samba_var_t	2007-04-12 21:09:34 +00:00
Daniel J Walsh	a3b1a2c522	- Update to upstream	2007-04-11 20:55:28 +00:00
Daniel J Walsh	5d5caebf83	- Fix Sonypic backlight ... - Allow snmp to look at squid_conf_t	2007-04-10 15:20:50 +00:00
Daniel J Walsh	7f1bd869ee	- Fixes for pyzor, cyrus, consoletype on everything installs	2007-04-09 20:47:56 +00:00
Daniel J Walsh	0b3279dee5	- Fix hald_acl_t to be able to getattr/setattr on usb devices ... - Dontaudit write to unconfined_pipes for load_policy	2007-04-09 18:36:06 +00:00
Daniel J Walsh	21029bf045	- Allow bluetooth to read inotifyfs	2007-04-07 11:35:20 +00:00
Daniel J Walsh	e6b9e29195	- Fixes for samba domain controller. ... - Allow ConsoleKit to look at ttys	2007-04-04 20:46:07 +00:00
Daniel J Walsh	f9f9ddcde1	- Fix interface call	2007-04-04 19:44:58 +00:00
Daniel J Walsh	89d3de7112	- Allow syslog-ng to read /var ... - Allow locate to getattr on all filesystems - nscd needs setcap	2007-04-03 19:25:58 +00:00
Daniel J Walsh	2528fa0969	- Update to upstream	2007-04-02 21:06:47 +00:00
Daniel J Walsh	8e5289e20b	- Update to upstream	2007-04-02 19:53:16 +00:00
Daniel J Walsh	ce7f30a258	- Update to upstream	2007-04-02 15:17:45 +00:00
Daniel J Walsh	f040ac5fd3	- Allow samba to run groupadd	2007-03-23 15:42:50 +00:00
Daniel J Walsh	f634733f95	- Update to upstream	2007-03-23 14:32:31 +00:00
Daniel J Walsh	281f5f5a50	- Fix labeling on udev.tbl dirs	2007-03-22 10:40:53 +00:00
Daniel J Walsh	552645bad0	- Fixes for logwatch	2007-03-21 03:39:06 +00:00
Daniel J Walsh	593fb16ef5	- Add fusermount and mount_ntfs policy	2007-03-20 20:45:45 +00:00
Daniel J Walsh	9d59ec430e	- Update to upstream ... - Allow saslauthd to use kerberos keytabs	2007-03-20 16:22:25 +00:00
Daniel J Walsh	d3aabaedb4		2007-03-20 15:01:28 +00:00
Daniel J Walsh	741e816e8e	- Fixes for samba_var_t	2007-03-19 19:33:06 +00:00
Daniel J Walsh	db4f0ec7b9	- Remove disable_trans booleans ... - hald_acl_t needs to talk to nscd	2007-03-19 14:51:28 +00:00
Daniel J Walsh	2823e28d58	- Remove enable_audit booleans ... - hald_acl_t needs to talk to nscd	2007-03-19 14:42:08 +00:00
Daniel J Walsh	2f82eed685	- Fix prelink to be able to manage usr dirs.	2007-03-16 03:14:13 +00:00
Daniel J Walsh	9468a641a6	- Allow insmod to launch init scripts	2007-03-14 12:48:09 +00:00
Daniel J Walsh	271752a5ca	- Remove setsebool policy	2007-03-13 17:46:34 +00:00
Daniel J Walsh	bdb7f99f00	- Fix handling of unlabled_t packets	2007-03-12 14:51:29 +00:00
Daniel J Walsh	2a9b648b37	- More of my patches from upstream	2007-03-11 05:19:36 +00:00
Daniel J Walsh	1fed4c745c	- Update to latest from upstream ... - Add fail2ban policy	2007-03-01 21:57:47 +00:00
Daniel J Walsh	9a8202d585	- Update to latest from upstream ... - Add fail2ban policy	2007-03-01 16:30:20 +00:00
Daniel J Walsh	5ad70cf38c	- Update to remove security_t:filesystem getattr problems	2007-02-28 21:23:19 +00:00
Daniel J Walsh	13893ed688	- Policy for consolekit	2007-02-27 18:34:08 +00:00
Daniel J Walsh	af8af9caee		2007-02-26 15:06:22 +00:00
Daniel J Walsh	cc1be2260f	- Revert Nemiver change ... - Set sudo as a corecmd so prelink will work, remove sudoedit mapping, since this will not work, it does not transition. - Allow samba to execute useradd	2007-02-23 15:35:01 +00:00
Daniel J Walsh	b0861172ab	- Add sepolgen support ... - Add bugzilla policy	2007-02-20 21:37:52 +00:00
Daniel J Walsh	b7da3b9e3e	- Add sepolgen support ... - Add bugzilla policy	2007-02-20 17:35:59 +00:00
Daniel J Walsh	2fa5bb00e9	- Add sepolgen support ... - Add bugzilla policy	2007-02-16 19:55:48 +00:00
Daniel J Walsh	e10e57a4a6	THu Feb 15 2007 Dan Walsh <dwalsh@redhat.com> 2.5.3-3 ... - Add sepolgen support - Add bugzilla policy	2007-02-15 20:46:02 +00:00
Daniel J Walsh	07dcdf7654	- Fix file context for nemiver	2007-02-15 20:29:48 +00:00
Daniel J Walsh	1a24735d8f	- Fix file context for nemiver	2007-02-15 00:19:30 +00:00
Daniel J Walsh	df0bef9ac0	-	2007-02-12 16:27:42 +00:00
Daniel J Walsh	9aff35b779	-	2007-02-12 16:18:31 +00:00
Daniel J Walsh	39b6cecaf2	- Allow mozilla, evolution and thunderbird to read dev_random. Resolves: ... #227002 - Allow spamd to connect to smtp port Resolves: #227184 - Fixes to make ypxfr work Resolves: #227237	2007-02-06 16:54:13 +00:00
Daniel J Walsh	33501ce93f	- Fix ssh_agent to be marked as an executable ... - Allow Hal to rw sound device	2007-02-04 12:42:16 +00:00
Daniel J Walsh	de0b364127	- Fix spamassisin so crond can update spam files ... - Fixes to allow kpasswd to work - Fixes for bluetooth	2007-02-01 21:40:50 +00:00
Daniel J Walsh	3902fd87fd	- Remove some targeted diffs in file context file	2007-01-31 22:18:10 +00:00
Daniel J Walsh	edd045d7c0	- Fix squid cachemgr labeling	2007-01-26 16:12:32 +00:00
Daniel J Walsh	e45f5d36d0	- Add ability to generate webadm_t policy ... - Lots of new interfaces for httpd - Allow sshd to login as unconfined_t	2007-01-25 19:07:00 +00:00
Daniel J Walsh	cc7c06a0d1	- Continue fixing, additional user domains	2007-01-23 01:08:45 +00:00
Daniel J Walsh	f86e42306e	- Begin adding user confinement to targeted policy	2007-01-22 16:52:18 +00:00
Daniel J Walsh	45478192f4	- Fixes for prelink, ktalkd, netlabel	2007-01-17 19:58:32 +00:00
Daniel J Walsh	ee095f5817	- Fixes for prelink, ktalkd, netlabel	2007-01-11 22:43:22 +00:00
Daniel J Walsh	b6ed674a00	- Fixes for prelink, ktalkd, netlabel	2007-01-10 22:05:57 +00:00
Daniel J Walsh	ae5ace1a7e	- Fixes for prelink, ktalkd, netlabel	2007-01-10 22:01:29 +00:00
Daniel J Walsh	9e0fa4fef3	- Allow prelink when run from rpm to create tmp files Resolves: #221865 ... - Remove file_context for exportfs Resolves: #221181 - Allow spamassassin to create ~/.spamassissin Resolves: #203290 - Allow ssh access to the krb tickets - Allow sshd to change passwd - Stop newrole -l from working on non securetty Resolves: #200110 - Fixes to run prelink in MLS machine Resolves: #221233 - Allow spamassassin to read var_lib_t dir Resolves: #219234	2007-01-09 15:26:56 +00:00