Commit Graph

5203 Commits

Author SHA1 Message Date
Miroslav Grepl
e0c1a1b49f Turn on mirrormanager policy 2013-12-19 21:10:46 +01:00
Miroslav Grepl
a8441cafab Fix userdom_manage_home_texlive() interface 2013-12-16 14:10:25 +01:00
Miroslav Grepl
b305c2adc0 Fix mozilla.te 2013-12-16 13:42:56 +01:00
Miroslav Grepl
fa3915aa88 Additional fixes for docker.te 2013-12-16 12:38:58 +01:00
Miroslav Grepl
1fe4113ea7 Fix docker policy 2013-12-16 12:25:11 +01:00
Miroslav Grepl
c9394c3ea7 Add selinux/minimum/contexts/users/sysadm_u also for minimum policy 2013-12-16 12:05:05 +01:00
Miroslav Grepl
74b303ea26 Fix spec file 2013-12-13 15:10:55 +01:00
Miroslav Grepl
2397102af8 - Allow freeipmi_ipmidetectd_t to use freeipmi port
- Update freeipmi_domain_template()
- Allow journalctl running as ABRT to read /run/log/journal
- Allow NM to read dispatcher.d directory
- Update freeipmi policy
- Type transitions with a filename not allowed inside conditionals
- Allow tor to bind to hplip port
- Make new type to texlive files in homedir
- Allow zabbix_agent to transition to dmidecode
- Add rules for docker
- Allow sosreport to send signull to unconfined_t
- Add virt_noatsecure and virt_rlimitinh interfaces
- Fix labeling in thumb.fc to add support for /usr/lib64/tumbler-1/tumblerddd support for freeipm
- Add sysadm_u_default_contexts
- Add logging_read_syslog_pid()
- Fix userdom_manage_home_texlive() interface
- Make new type to texlive files in homedir
- Add filename transitions for /run and /lock links
- Allow virtd to inherit rlimit information
2013-12-12 17:23:54 +01:00
Lukas Vrabec
0dc67d04d6 Added vmtools to modules-targeted-contrib.conf 2013-12-10 11:26:08 +01:00
Miroslav Grepl
4b8334da4c - DRM master and input event devices are used by the TakeDevice API
- Clean up bumblebee policy
- Update pegasus_openlmi_storage_t policy
- opensm policy clean up
- openwsman policy clean up
- ninfod policy clean up
- Allow conman to connect to freeipmi services and clean up conman policy
- Allow conmand just bind on 7890 port
- Add freeipmi_stream_connect() interface
- Allow logwatch read madm.conf to support RAID setup
- Add raid_read_conf_files() interface
- Allow up2date running as rpm_t create up2date log file with rpm_log_t labeling
- add rpm_named_filetrans_log_files() interface
- Added policy for conmand
- Allow dkim-milter to create files/dirs in /tmp
- update freeipmi policy
- Add policy for freeipmi services
- Added rdisc_admin and rdisc_systemctl interfaces
- Fix aliases in pegasus.te
- Allow chrome sandbox to read generic cache files in homedir
- Dontaudit mandb searching all mountpoints
- Make sure wine domains create .wine with the correct label
- Add proper aliases for pegasus_openlmi_services_exec_t and pegasus_openlmi_services_t
- Allow windbind the kill capability
- DRM master and input event devices are used by  the TakeDevice API
- add dev_rw_inherited_dri() and dev_rw_inherited_input_dev()
- Added support for default conman port
- Add interfaces for ipmi devices
- Make sure wine domains create .wine with the correct label
- Allow manage dirs in kernel_manage_debugfs interface.
- Allow systemctl running in ipsec_mgmt_t to access /usr/lib/systemd/system/ipsec.service
- Label /usr/lib/systemd/system/ipsec.service as ipsec_mgmt_unit_file_t
- Fix userdom_confined_admin_template()
- Add back exec_content boolean for secadm, logadm, auditadm
- Fix files_filetrans_system_db_named_files() interface
- Allow sulogin to getattr on /proc/kcore
- Add filename transition also for servicelog.db-journal
- Add files_dontaudit_access_check_root()
- Add lvm_dontaudit_access_check_lock() interface
2013-12-09 08:16:07 +01:00
Lukas Vrabec
5689bdb03b Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy 2013-12-06 11:18:21 +01:00
Lukas Vrabec
d487bf5144 Added conman to modules-targeted-contrib.conf 2013-12-06 11:17:48 +01:00
Miroslav Grepl
6de8b20964 Add freeipmi policy 2013-12-06 10:00:23 +01:00
Lukas Vrabec
65289ba44b Added ninfod and openwsman to modules-targeted-contrib.conf 2013-12-05 15:43:22 +01:00
Miroslav Grepl
676f0e4eb9 - Add back fixes for gnome_role_template()
- Label /usr/sbin/htcacheclean as httpd_exec_t
- Add missing alias for pegasus_openlmi_service_exec_t
- Added support for rdisc unit file
- Added new policy for ninfod
- Added new policy for openwsman
- Add antivirus_db_t labeling for /var/lib/clamav-unofficial-sigs
- Allow runuser running as logrotate connections to system DBUS
- Add connectto perm for NM unix stream socket
- Allow watchdog to be executed from cron
- Allow cloud_init to transition to rpm_script_t
- Allow lsmd_plugin_t send system log messages
- Label /var/log/up2date as rpm_log_t and allow sosreport to manage rpm log/pid/cache files which is a part of ABRT polic
- Added new capabilities for mip6d policy
- Label bcache devices as fixed_disk_device_t
- Allow systemctl running in ipsec_mgmt_t to access /usr/lib/systemd/system/ipsec.service
- label /usr/lib/systemd/system/ipsec.service as ipsec_mgmt_unit_file_t
2013-12-03 22:01:54 +01:00
Miroslav Grepl
d61adff49b - Add lsmd_plugin_t for lsm plugins
- Allow dovecot-deliver to search mountpoints
- Add labeling for /etc/mdadm.conf
- Allow opelmi admin providers to dbus chat with init_t
- Allow sblim domain to read /dev/urandom and /dev/random
- Add back exec_content boolean for secadm, logadm, auditadm
- Allow sulogin to getattr on /proc/kcore
2013-11-26 18:41:01 +01:00
Miroslav Grepl
04c55cf070 Add glusterd_brick_t type 2013-11-26 13:12:08 +01:00
Miroslav Grepl
c9b9ed2c4d - Add filename transition also for servicelog.db-journal
- Add files_dontaudit_access_check_root()
- Add lvm_dontaudit_access_check_lock() interface
- Allow mount to manage mount_var_run_t files/dirs
- Allow updapwd_t to ignore mls levels for writign shadow_t at a lower level
- Make sure boot.log is created with the correct label
- call logging_relabel_all_log_dirs() in systemd.te
- Allow systemd_tmpfiles to relabel log directories
- Allow staff_t to run frequency command
- Allow staff_t to read xserver_log file
- This reverts commit c0f9f125291f189271cbbca033f87131dab1e22f.
- Label hsperfdata_root as tmp_t
- Add plymouthd_create_log()
- Dontaudit leaks from openshift domains into mail domains, needs back port to RHEL6
- Allow sssd to request the kernel loads modules
- Allow gpg_agent to use ssh-add
- Allow gpg_agent to use ssh-add
- Dontaudit access check on /root for myslqd_safe_t
- Add glusterd_brick_t files type
- Allow ctdb to getattr on al filesystems
- Allow abrt to stream connect to syslog
- Allow dnsmasq to list dnsmasq.d directory
- Watchdog opens the raw socket
- Allow watchdog to read network state info
- Dontaudit access check on lvm lock dir
- Allow sosreport to send signull to setroubleshootd
- Add setroubleshoot_signull() interface
- Fix ldap_read_certs() interface
- Allow sosreport all signal perms
- Allow sosreport to run systemctl
- Allow sosreport to dbus chat with rpm
- Allow zabbix_agentd to read all domain state
- Allow sblim_sfcbd_t to read from /dev/random and /dev/urandom
- Allow smoltclient to execute ldconfig
- Allow sosreport to request the kernel to load a module
- Clean up rtas.if
- Clean up docker.if
- drop /var/lib/glpi/files labeling in cron.fc
- Added new policy for rasdaemon
2013-11-26 11:42:42 +01:00
Miroslav Grepl
6789507ff9 Turn on docker policy 2013-11-22 11:42:15 +01:00
Lukas Vrabec
a2db29cc4f Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy 2013-11-21 17:36:29 +01:00
Lukas Vrabec
3e4e5fbcd1 Added rasdaemon module to modules-targeted-contrib.conf 2013-11-21 17:35:26 +01:00
Dan Walsh
ae07faa147 Turn off F20 permissive domains, add docker 2013-11-21 09:20:24 -05:00
Lukas Vrabec
8fd86ca941 Added new policies to permissivedomains.te 2013-11-21 12:07:26 +01:00
Lukas Vrabec
ba211c8644 Added new policies to modules-targeted-contrib.conf 2013-11-21 11:13:23 +01:00
Miroslav Grepl
3abf0519c2 * Mon Nov 18 2013 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-5
- Add back /dev/shm labeling
2013-11-18 16:59:45 +01:00
Miroslav Grepl
d20212ac4f * Mon Nov 18 2013 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-4
- Fix gnome_role_template() interface
2013-11-18 15:25:06 +01:00
Miroslav Grepl
4fc70e284d - Add policy-rawhide-contrib-apache-content.patch to re-write apache_content_template() by dwalsh 2013-11-14 22:05:22 +01:00
Dan Walsh
164fa392ee Fix config.tgz to include lxc_contexts and systemd_contexts 2013-11-14 11:05:22 -05:00
Dan Walsh
025a8d6267 Add back correct lxc_contexts and systemd_contexts 2013-11-14 11:03:00 -05:00
Miroslav Grepl
269ef098f1 * Wed Nov 13 2013 Miroslav Grepl <mgrepl@redhat.com> 3.13.1-1
- Update to upstream
2013-11-13 16:05:06 +01:00
Miroslav Grepl
0f9b0de389 Upload new upstream sources 2013-11-13 15:27:57 +01:00
Miroslav Grepl
73ec2c3819 - Fix passenger_stream_connect interface
- setroubleshoot_fixit wants to read network state
- Allow procmail_t to connect to dovecot stream sockets
- Allow cimprovagt service providers to read network states
- Add labeling for /var/run/mariadb
- pwauth uses lastlog() to update system's lastlog
- Allow account provider to read login records
- Add support for texlive2013
- More fixes for user config files to make crond_t running in userdomain
- Add back disable/reload/enable permissions for system class
- Fix manage_service_perms macro
- Allow passwd_t to connect to gnome keyring to change password
- Update mls config files to have cronjobs in the user domains
- Remove access checks that systemd does not actually do
2013-11-12 12:26:06 +01:00
Miroslav Grepl
e4104d9fc0 Upload updated config.tgz 2013-11-12 12:22:03 +01:00
Miroslav Grepl
73e97a2955 Rebuild permissivedomains.pp with correct selinux-policy-devel pkg 2013-11-12 11:42:46 +01:00
Miroslav Grepl
9637dbab40 Rebuild permisivedomains.pp 2013-11-12 10:09:09 +01:00
Miroslav Grepl
2918baa1a7 Update config.tgz to make cronjob running in userdomain on MLS system 2013-11-11 22:09:41 +01:00
Miroslav Grepl
90f92647e0 * Fri Nov 8 2013 Miroslav Grepl <mgrepl@redhat.com> 3.12.1-99
- Add support for yubikey in homedir
- Add support for upd/3052 port
- Allow apcupsd to use PowerChute Network Shutdown
- Allow lsmd to execute various lsmplugins
- Add labeling also for /etc/watchdog\.d where are watchdog scripts located too
- Update gluster_export_all_rw boolean to allow relabel all base file types
- Allow x86_energy_perf  tool to modify the MSR
- Fix /var/lib/dspam/data labeling
2013-11-08 21:39:31 +01:00
Miroslav Grepl
c872e59953 - Add files_relabel_base_file_types() interface
- Allow netlabel-config to read passwd
- update gluster_export_all_rw boolean to allow relabel all base file types caused by lsetxattr()
- Allow x86_energy_perf  tool to modify the MSR
- Fix /var/lib/dspam/data labeling
- Allow pegasus to domtrans to mount_t
- Add labeling for unconfined scripts in /usr/libexec/watchdog/scripts
- Add support for unconfined watchdog scripts
- Allow watchdog to manage own log files
2013-11-06 23:12:50 +01:00
Miroslav Grepl
c5e7e5bb30 - Add label only for redhat.repo instead of /etc/yum.repos.d. But probably we will need to switch for the directory.
- Label /etc/yum.repos.d as system_conf_t
- Use sysnet_filetrans_named_content in udev.te instead of generic transition for net_conf_t
- Allow dac_override for sysadm_screen_t
- Allow init_t to read ipsec_conf_t as we had it for initrc_t. Needed by ipsec unit file.
- Allow netlabel-config to read meminfo
- Add interface to allow docker to mounton file_t
- Add new interface to exec unlabeled files
- Allow lvm to use docker semaphores
- Setup transitons for .xsessions-errors.old
- Change labels of files in /var/lib/*/.ssh to transition properly
- Allow staff_t and user_t to look at logs using journalctl
- pluto wants to manage own log file
- Allow pluto running as ipsec_t to create pluto.log
- Fix alias decl in corenetwork.te.in
- Add support for fuse.glusterfs
- Allow dmidecode to read/write /run/lock/subsys/rhsmcertd
- Allow rhsmcertd to manage redhat.repo which is now labeled as system.conf. Allow rhsmcertd to manage all log files.
- Additional access for docker
- Added more rules to sblim policy
- Fix kdumpgui_run_bootloader boolean
- Allow dspam to connect to lmtp port
- Included sfcbd service into sblim policy
- rhsmcertd wants to manaage /etc/pki/consumer dir
- Add kdumpgui_run_bootloader boolean
- Add support for /var/cache/watchdog
- Remove virt_domain attribute for virt_qemu_ga_unconfined_t
- Fixes for handling libvirt containes
- Dontaudit attempts by mysql_safe to write content into /
- Dontaudit attempts by system_mail to modify network config
- Allow dspam to bind to lmtp ports
- Add new policy to allow staff_t and user_t to look at logs using journalctl
- Allow apache cgi scripts to list sysfs
- Dontaudit attempts to write/delete user_tmp_t files
2013-11-06 09:11:46 +01:00
Miroslav Grepl
47a93c4a0b Add journalctl to modules-targeted-contrib 2013-11-05 23:04:20 +01:00
Miroslav Grepl
6bf18ad4aa Fix spec file 2013-11-01 19:29:49 +01:00
Miroslav Grepl
18a1acac8d * Fri Oct 1 2013 Miroslav Grepl <mgrepl@redhat.com> 3.12.1-96
- Add missing permission checks for nscd
2013-11-01 19:24:30 +01:00
Dan Walsh
d11521e32b Do remove regardless. Update config.tgz with new labels for virt. 2013-11-01 12:09:39 -04:00
Miroslav Grepl
cd5d972925 scratch build 2013-10-30 20:24:38 +01:00
Dan Walsh
af7d966e90 Add new labels for qemu and kvm processes to lxc_contexts file 2013-10-29 13:27:31 -04:00
Miroslav Grepl
d4e55c7b7a Fix spec file to use systemd_context instead of sytemd_context 2013-10-28 12:03:32 +01:00
Miroslav Grepl
bf4990489d - Allow sysadm_t to read login information
- Allow systemd_tmpfiles to setattr on var_log_t directories
- Udpdate Makefile to include systemd_contexts
- Add systemd_contexts
- Add fs_exec_hugetlbfs_files() interface
- Add daemons_enable_cluster_mode boolean
- Fix rsync_filetrans_named_content()
- Add rhcs_read_cluster_pid_files() interface
- Update rhcs.if with additional interfaces from RHEL6
- Fix rhcs_domain_template() to not create run dirs with cluster_var_run_t
- Allow glusterd_t to mounton glusterd_tmp_t
- Allow glusterd to unmout al filesystems
- Allow xenstored to read virt config
- Add label for swift_server.lock and make add filetrans_named_content to make sure content gets created with the correct lab
- Allow mozilla_plugin_t to mmap hugepages as an executable
2013-10-28 10:06:40 +01:00
Miroslav Grepl
4f67cf89e1 Add fix to place sytemd_contexts 2013-10-25 12:59:16 +02:00
Miroslav Grepl
d483b64c69 Add systemd_contexts to config.tgz 2013-10-25 10:19:17 +02:00
Miroslav Grepl
bb6a1f3c7f * Thu Oct 24 2013 Miroslav Grepl <mgrepl@redhat.com> 3.12.1-93
- Add back userdom_security_admin_template() interface and use it for sysadm_t if sysadm_secadm.pp
2013-10-24 11:31:47 +02:00