Commit Graph

4847 Commits

Author SHA1 Message Date
Dan Walsh
7bf1025fa8 Revert "Dropping support for snort since it was dropped from Fedora. Users should use nagios"
This reverts commit 76d9bfedb6.
2012-02-07 17:18:16 -05:00
Dan Walsh
5c28b0512d Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy 2012-02-07 17:17:54 -05:00
Dan Walsh
76d9bfedb6 Dropping support for snort since it was dropped from Fedora. Users should use nagios 2012-02-07 17:15:35 -05:00
Dan Walsh
d3a57c6cc7 Fedora no longer ships kerneloops, dropping policy 2012-02-07 17:09:23 -05:00
Miroslav Grepl
81894dfe50 - Add policy for grindengine MPI jobs 2012-02-07 18:18:07 +01:00
Miroslav Grepl
618ef7160b Add label for /etc/WebCalendar 2012-02-07 14:09:10 +01:00
Miroslav Grepl
80d21dc60a Revert "Simplify the build-docs target"
This reverts commit 01be486292.
2012-02-07 14:08:38 +01:00
Miroslav Grepl
3d8eaa7aa5 Fix typo 2012-02-07 00:25:01 +01:00
Miroslav Grepl
4689b08b49 - Add new sysadm_secadm.pp module
* contains secadm definition for sysadm_t
- Move user_mail_domain access out of the interface into the
- Allow httpd_t to create httpd_var_lib_t directories as wel
- Allow snmpd to connect to the ricci_modcluster stream
- Allow firewalld to read /etc/passwd
- Add auth_use_nsswitch for colord
- Allow smartd to read network state
- smartdnotify needs to read /etc/group
2012-02-06 23:20:13 +01:00
Dan Walsh
01be486292 Simplify the build-docs target 2012-02-06 15:33:48 -05:00
Dan Walsh
dc4ca7a142 Allow builder to skip build_docs 2012-02-06 12:13:56 -05:00
Miroslav
30ab254413 - Allow gpg and gpg_agent to store sock_file in gpg_secret_t directory
- lxdm startup scripts should be labeled bin_t, so confined users will work
- mcstransd now creates a pid, needs back port to F16
- qpidd should be allowed to connect to the amqp port
- Label devices 010-029 as usb devices
- ypserv packager says ypserv does not use tmp_t so removing selinux policy types
- Remove all ptrace commands that I believe are caused by the kernel/ps avcs
- Add initial Obex policy
- Add logging_syslogd_use_tty boolean
- Add polipo_connect_all_unreserved bolean
- Allow zabbix to connect to ftp port
- Allow systemd-logind to be able to switch VTs
- Allow apache to communicate with memcached through a sock_file
2012-02-03 10:57:34 +01:00
Dan Walsh
3515d8b4e7 Fix file_context.subs_dist for now to work with pre usrmove 2012-01-31 17:01:07 -05:00
Dan Walsh
9382499c6f Fix file_context.subs_dist for now to work with pre usrmove 2012-01-31 15:26:31 -05:00
Miroslav Grepl
fb431d4b29 - More /usr move fixes 2012-01-30 21:28:06 +01:00
Dan Walsh
cde75b4cef Remove /lib64 subs since this is not a link, swithc /lib/systemd to /usr/lib since the usrmove 2012-01-30 14:58:40 -05:00
Dan Walsh
191c435a9f POLY is no longer used 2012-01-30 10:27:14 -05:00
Miroslav Grepl
26f953d9f6 Fixes more typos 2012-01-27 10:44:46 +01:00
Dan Walsh
f53135cd92 Make sure /etc/passwd and /etc/group properly labeled 2012-01-26 17:45:12 -05:00
Miroslav
b9a6445e02 Fix typo 2012-01-26 20:37:24 +01:00
Miroslav
a9d343329b * Thu Jan 26 2012 Miroslav Grepl <mgrepl@redhat.com> 3.10.0-80
- Add zabbix_can_network boolean
- Add httpd_can_connect_zabbix boolean
- Prepare file context labeling for usrmove functions
- Allow system cronjobs to read kernel network state
- Add support for selinux_avcstat munin plugin
- Treat hearbeat with corosync policy
- Allow corosync to read and write to qpidd shared mem
-  mozilla_plugin is trying to run pulseaudio
- Fixes for new sshd patch for running priv sep domains as the users c
- Turn off dontaudit rules when turning on allow_ypbind
- udev now reads /etc/modules.d directory
2012-01-26 19:26:12 +01:00
Miroslav Grepl
0c0b390b07 - Turn on deny_ptrace boolean for the Rawhide run, so we can t
- Cups exchanges dbus messages with init
- udisk2 needs to send syslog messages
- certwatch needs to read /etc/passwd
2012-01-24 16:34:52 +01:00
Dan Walsh
a2e8b9ca5d Turn on deny_ptrace boolean for the Rawhide run, so we can test this out 2012-01-24 09:30:07 -05:00
Miroslav
75a7b93abc +- Add labeling for udisks2
+- Allow fsadmin to communicate with the systemd process
2012-01-23 22:35:48 +01:00
Miroslav Grepl
8cd443307d - Treat Bip with bitlbee policy
* Bip is an IRC proxy
- Add port definition for interwise port
- Add support for ipa_memcached socket
- systemd_jounald needs to getattr on all processes
- mdadmin fixes
     * uses getpw
- amavisd calls getpwnam()
- denyhosts calls getpwall()
2012-01-23 16:15:05 +01:00
Miroslav Grepl
de9114f624 - Setup labeling of /var/rsa and /var/lib/rsa to allow login programs to write there
- bluetooth says they do not use /tmp and want to remove the type
- Allow init to transition to colord
- Mongod needs to read /proc/sys/vm/zone_reclaim_mode
- Allow postfix_smtpd_t to connect to spamd
- Add boolean to allow ftp to connect to all ports > 1023
- Allow sendmain to write to inherited dovecot tmp files
2012-01-20 14:43:02 +01:00
Dan Walsh
291b1f5075 Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy 2012-01-19 09:44:28 -05:00
Dan Walsh
b80397b754 Remove Requires for bunzip2 and mktemp 2012-01-19 09:39:05 -05:00
Miroslav Grepl
153cc80f87 - Merge systemd patch
- systemd-tmpfiles wants to relabel /sys/devices/system/cpu/online
- Allow deltacloudd dac_override, setuid, setgid  caps
- Allow aisexec to execute shell
- Add use_nfs_home_dirs boolean for ssh-keygen
2012-01-16 10:56:19 +01:00
Dan Walsh
e9660551a3 Fixes to make rawhide boot in enforcing mode with latest systemd changes 2012-01-13 12:42:47 -05:00
Dan Walsh
cd25a7a613 Fixes to make rawhide boot in enforcing mode with latest systemd changes 2012-01-13 12:26:06 -05:00
Dan Walsh
ba7c7aec15 Add labeling for /var/run/systemd/journal/syslog
libvirt sends signals to ifconfig
Allow domains that read logind session files to list them
2012-01-13 11:51:57 -05:00
Dan Walsh
86d3f66092 Add labeling for /var/run/systemd/journal/syslog
libvirt sends signals to ifconfig
Allow domains that read logind session files to list them
2012-01-13 09:53:03 -05:00
Miroslav
9387d2ce08 Fix typo 2012-01-11 21:07:43 +01:00
Miroslav
68079f6d89 +- Add labeling for /var/run/systemd/journal/syslog
+- libvirt sends signals to ifconfig
+- Allow domains that read logind session files to list them
2012-01-11 20:37:45 +01:00
Miroslav
ecab259899 Fix typo in xserver_filetrans_admin_home_content() 2012-01-11 14:13:28 +01:00
Miroslav
0149a53fbb Fix typo in xserver_filetrans_home_content() 2012-01-11 13:42:28 +01:00
Miroslav
1b62e3889e use entropyd instead of entropy 2012-01-11 13:33:22 +01:00
Miroslav
69a8d0687a - Fixed destined form libvirt-sandbox
- Allow apps that list sysfs to also read sympolicy links in this filesystem
- Add ubac_constrained rules for chrome_sandbox
- Need interface to allow domains to use tmpfs_t files created by the kernel, used by libra
- Allow postgresql to be executed by the caller
- Standardize interfaces of daemons
- Add new labeling for mm-handler
- Allow all matahari domains to read network state and etc_runtime_t files
2012-01-11 13:13:07 +01:00
Dan Walsh
7cf580ebcc Rename audioentropy to entropy to match upstream 2012-01-06 11:52:44 -05:00
Miroslav
b3ef57fc19 - New fix for seunshare, requires seunshare_domains to be able to mounton /
- Allow systemctl running as logrotate_t to connect to private systemd socket
- Allow tmpwatch to read meminfo
- Allow rpc.svcgssd to read supported_krb5_enctype
- Allow zarafa domains to read /dev/random and /dev/urandom
- Allow snmpd to read dev_snmp6
- Allow procmail to talk with cyrus
- Add fixes for check_disk and check_nagios plugins
2012-01-04 15:58:41 +01:00
Dan Walsh
904f70ac64 Add Zoneminder policy 2011-12-22 19:26:50 +00:00
Dan Walsh
5a73fdc4ee Test if selinuxenabled correctly 2011-12-22 15:32:22 +00:00
Dan Walsh
d5b8b9ccf7 default trans rules for Rawhide policy
Make sure sound_devices controlC* are labeled correctly on creation
sssd now needs sys_admin
Allow snmp to read all proc_type
Allow to setup users homedir with quota.group
2011-12-21 13:48:04 +00:00
Miroslav Grepl
67539d56f8 - default trans rules for Rawhide policy
-  Make sure sound_devices controlC* are labeled correctly on creation
- sssd now needs sys_admin
- Allow snmp to read all proc_type
- Allow to setup users homedir with quota.group
2011-12-20 19:41:35 +01:00
Dan Walsh
bce4ec2b6e Update to handle labeling on /sys using systemd-tmpfiles, also support default_range transition rules 2011-12-20 17:20:23 +00:00
Dan Walsh
a9225830b4 Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy 2011-12-19 13:35:00 -05:00
Miroslav
cd251939af - Add httpd_can_connect_ldap() interface
- apcupsd_t needs to use seriel ports connected to usb devic
- Kde puts procmail mail directory under ~/.local/share
- nfsd_t can trigger sys_rawio on tests that involve too man
- Add labeling for /sbin/iscsiuio
2011-12-19 13:49:27 +01:00
Dan Walsh
49b3733c80 Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy
Conflicts:
	selinux-policy.spec
2011-12-15 16:29:52 -05:00
Dan Walsh
ad10efc1aa Committing my changes 2011-12-15 16:28:30 -05:00