rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity
5,864 Commits 9 Branches 105 Tags 34 MiB
9a1d06b5aa
Commit Graph

5864 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Lukas Vrabec
a73b2e2ece Fix broken build 2017-09-14 09:55:54 +02:00
Lukas Vrabec
d781e6d8fd Fix broken build 2017-09-14 09:30:02 +02:00
Lukas Vrabec
83eed32c03 * Thu Sep 14 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-284 
- Allow mozilla_plugins_t domain mmap mozilla_plugin_tmpfs_t files
- Allow automount domain to manage mount pid files
- Allow stunnel_t domain setsched
- Add keepalived domain setpgid capability
- Merge pull request #24 from teg/rawhide
- Merge pull request #28 from lslebodn/revert_1e8403055
- Allow sysctl_irq_t assciate with proc_t
- Enable cgourp sec labeling
- Allow sshd_t domain to send signull to xdm_t processes
 2017-09-14 09:11:13 +02:00
Lukas Vrabec
21c53d34a6 Use %{_sbindir} macro instead of full path 2017-09-14 09:02:59 +02:00
Lukas Vrabec
76e1d24391 Add /var/lib/sepolgen/interface_info to %files section in selinux-policy-devel 2017-09-13 13:15:22 +02:00
Lukas Vrabec
c3f53c2a7e * Tue Sep 12 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-283 
- Allow passwd_t domain mmap /etc/shadow and /etc/passwd
- Allow pulseaudio_t domain to map user tmp files
- Allow mozilla plugin to mmap mozilla tmpfs files
 2017-09-12 14:05:47 +02:00
Lukas Vrabec
63dd04bba8 Fix typobug in mandb interface file 2017-09-12 09:24:40 +02:00
Lukas Vrabec
4dfc5f64ab * Mon Sep 11 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-282 
- Add new bunch of map rules
- Merge pull request #25 from NetworkManager/nm-ovs
- Make working webadm_t userdomain
- Allow redis domain to execute shell scripts.
- Allow system_cronjob_t to create redhat-access-insights.log with var_log_t
- Add couple capabilities to keepalived domain and allow get attributes of all domains
- Allow dmidecode read rhsmcertd lock files
- Add new interface rhsmcertd_rw_lock_files()
- Add new bunch of map rules
- Merge pull request #199 from mscherer/add_conntrackd
- Add support labeling for vmci and vsock device
- Add userdom_dontaudit_manage_admin_files() interface
 2017-09-11 22:04:43 +02:00
Lukas Vrabec
65f16bbe30 * Mon Sep 11 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-281 
- Allow domains reading raw memory also use mmap.
 2017-09-11 09:50:18 +02:00
Lukas Vrabec
b9bc43a953 * Thu Sep 07 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-280 
- Add rules fixing installing ipa-server-install with SELinux in Enforcing. BZ(1488404)
- Fix denials during ipa-server-install process on F27+
- Allow httpd_t to mmap cert_t
- Add few rules to make tlp_t domain working in enforcing mode
- Allow cloud_init_t to dbus chat with systemd_timedated_t
- Allow logrotate_t to write to kmsg
- Add capability kill to rhsmcertd_t
- Allow winbind to manage smbd_tmp_t files
- Allow groupadd_t domain to dbus chat with systemd.BZ(1488404)
- Add interface miscfiles_map_generic_certs()
 2017-09-07 13:32:34 +02:00
Lukas Vrabec
fcebe07f6c * Tue Sep 05 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-279 
- Allow abrt_dump_oops_t to read sssd_public_t files
- Allow cockpit_ws_t to mmap usr_t files
- Allow systemd to read/write dri devices.
 2017-09-05 09:36:30 +02:00
Lukas Vrabec
313e17b74e * Thu Aug 31 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-278 
- Add couple rules related to map permissions
- Allow ddclient use nsswitch BZ(1456241)
- Allow thumb_t domain getattr fixed_disk device. BZ(1379137)
- Add interface dbus_manage_session_tmp_dirs()
- Dontaudit useradd_t sys_ptrace BZ(1480121)
- Allow ipsec_t can exec ipsec_exec_t
- Allow systemd_logind_t to mamange session_dbusd_tmp_t dirs
 2017-08-31 17:55:58 +02:00
Lukas Vrabec
0c6eef95d3 * Mon Aug 28 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-277 
- Allow cupsd_t to execute ld_so_cache
- Add cgroup_seclabel policycap.
- Allow xdm_t to read systemd hwdb
- Add new interface systemd_hwdb_mmap_config()
- Allow auditd_t domain to mmap conf files labeled as auditd_etc_t BZ(1485050)
 2017-08-28 18:08:50 +02:00
Lukas Vrabec
2b14b695c4 * Sat Aug 26 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-276 
- Allow couple map rules
 2017-08-26 13:17:21 +02:00
Lukas Vrabec
c1ce08ecb5 * Wed Aug 23 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-275 
- Make confined users working
- Allow ipmievd_t domain to load kernel modules
- Allow logrotate to reload transient systemd unit
 2017-08-23 23:17:38 +02:00
Lukas Vrabec
b7314cadde * Wed Aug 23 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-274 
- Allow postgrey to execute bin_t files and add postgrey into nsswitch_domain
- Allow nscd_t domain to search network sysctls
- Allow iscsid_t domain to read mount pid files
- Allow ksmtuned_t domain manage sysfs_t files/dirs
- Allow keepalived_t domain domtrans into iptables_t
- Allow rshd_t domain reads net sysctls
- Allow systemd to create syslog netlink audit socket
- Allow ifconfig_t domain unmount fs_t
- Label /dev/gpiochip* devices as gpio_device_t
 2017-08-23 16:49:48 +02:00
Lukas Vrabec
681ffa2e20 * Tue Aug 22 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-273 
- Allow dirsrv_t domain use mmap on files labeled as dirsrv_var_run_t BZ(1483170)
- Allow just map permission insead of using mmap_file_pattern because mmap_files_pattern allows also executing objects.
- Label /var/run/agetty.reload as getty_var_run_t
- Add missing filecontext for sln binary
- Allow systemd to read/write to event_device_t BZ(1471401)
 2017-08-22 14:47:56 +02:00
Lukas Vrabec
b2ee09aa09 Fix broken gnome module 2017-08-15 16:41:58 +02:00
Lukas Vrabec
284401b055 * Tue Aug 15 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-272 
- Allow sssd_t domain to map sssd_var_lib_t files
- allow map permission where needed
- contrib: allow map permission where needed
- Allow syslogd_t to map syslogd_var_run_t files
- allow map permission where needed
 2017-08-15 16:29:24 +02:00
Lukas Vrabec
c6aaaee231 Remove temporary fix labeling cockpit binary 2017-08-15 16:27:40 +02:00
Troy Dawson
d76574db8d Update .gitignore 2017-08-14 14:16:34 -07:00
Troy Dawson
59617829f2 Update .gitignore 2017-08-14 14:12:18 -07:00
Lukas Vrabec
be2df80e69 * Mon Aug 14 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-271 
- Allow tomcat_t domain couple capabilities to make working tomcat-jsvc
- Label /usr/libexec/sudo/sesh as shell_exec_t
 2017-08-14 16:11:30 +02:00
Lukas Vrabec
7a49a1c8c7 * Thu Aug 10 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-270 
- refpolicy: Infiniband pkeys and endport
 2017-08-10 23:27:06 +02:00
Lukas Vrabec
5f4424a65d Fix dbus SELinux module 2017-08-10 14:29:31 +02:00
Lukas Vrabec
7e4fe9b0e2 Merge branch 'master' of ssh://pkgs.fedoraproject.org/rpms/selinux-policy 2017-08-10 13:17:09 +02:00
Lukas Vrabec
ca40d14c20 Fix syntax error after merge with upstream 2017-08-10 13:16:37 +02:00
Lukas Vrabec
5953456a78 Fix syntax error after merge with upstream 2017-08-10 13:05:38 +02:00
Lukas Vrabec
9a31f2128c Merge branch 'master' of ssh://pkgs.fedoraproject.org/rpms/selinux-policy 2017-08-10 11:25:56 +02:00
Lukas Vrabec
ff3605a078 * Thu Aug 10 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-269 
- Allow osad make executable an anonymous mapping or private file mapping that is writable BZ(1425524)
- After fix in kernel where LSM hooks for dac_override and dac_search_read capability was swaped we need to fix it also in policy
- refpolicy: Define and allow map permission
- init: Add NoNewPerms support for systemd.
- Add nnp_nosuid_transition policycap and related class/perm definitions.
 2017-08-10 11:25:41 +02:00
Petr Lautrbach
cf21eb3fa5 Fix bogus date for 3.13.1-267 changelog entry 
warning: bogus date in %changelog: Fri Aug 07 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-267
 2017-08-10 09:12:56 +02:00
Petr Lautrbach
b65295347f * Mon Aug 07 2017 Petr Lautrbach <plautrba@redhat.com> - 3.13.1-268 
- Update for SELinux userspace release 20170804 / 2.7
- Omit precompiled regular expressions from file_contexts.bin files
 2017-08-07 18:05:24 +02:00
Lukas Vrabec
631f95b1cf * Fri Aug 07 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-267 
- After fix in kernel where LSM hooks for dac_override and dac_search_read capability was swaped we need to fix it also in policy
 2017-08-07 16:17:01 +02:00
Petr Lautrbach
0eccbd957d Revert "Temporary fix while creating manpages using sepolicy is broken." 
This reverts commit fbdb6e98da.

Since policycoreutils-2.6-7, 'sepolicy manpage' should be again
reasonable fast.
 2017-08-03 08:01:21 +02:00
Fedora Release Engineering
f0d7feb11d - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild 2017-07-27 18:25:45 +00:00
Lukas Vrabec
4696e7ec09 * Fri Jul 21 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-265 
- Allow llpdad send dgram to libvirt
- Allow abrt_t domain dac_read_search capability
- Allow init_t domain mounton dirs labeled as init_var_lib_t BZ(1471476)
- Allow xdm_t domain read unique machine-id generated during system installation. BZ(1467036)
 2017-07-21 14:21:02 +02:00
Lukas Vrabec
3622c01896 * Mon Jul 17 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-264 
- Dontaudit xdm_t to setattr lib_t dirs. BZ(#1458518)
 2017-07-17 14:32:35 +02:00
Lukas Vrabec
ab9bb05673 * Tue Jul 11 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-263 
- Add new boolean gluster_use_execmem
 2017-07-11 18:01:45 +02:00
Lukas Vrabec
37cf7d764b Backport new selinux-policy rpm macros from github repo: 
https://github.com/fedora-selinux/selinux-policy-macros.git

Main point of this change is to allow set SELinux Module priority in
selinux_modules_(u)install() macros.
 2017-07-11 17:56:49 +02:00
Lukas Vrabec
6fc6359b10 * Mon Jul 10 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-262 
- Allow cluster_t and glusterd_t domains to dbus chat with ganesha service
- Allow iptables to read container runtime files
 2017-07-10 09:27:35 +02:00
Lukas Vrabec
959229d1e3 * Fri Jun 23 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-261 
- Allow boinc_t nsswitch
- Dontaudit firewalld to write to lib_t dirs
- Allow modemmanager_t domain to write to raw_ip file labeled as sysfs_t
- Allow thumb_t domain to allow create dgram sockets
- Disable mysqld_safe_t secure mode environment cleansing
- Allow couple rules needed to start targetd daemon with SELinux in enforcing mode
- Allow dirsrv domain setrlimit
- Dontaudit staff_t user read admin_home_t files.
- Add interface lvm_manage_metadata
- Add permission open to files_read_inherited_tmp_files() interface
 2017-06-23 17:16:37 +02:00
Lukas Vrabec
c8dc4505f7 Fix commands how to create downstream patches 2017-06-20 17:00:14 +02:00
Lukas Vrabec
8c093f225c * Mon Jun 19 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-260 
- Allow sssd_t to read realmd lib files.
- Fix init interface file. init_var_run_t is type not attribute
 2017-06-19 16:52:54 +02:00
Lukas Vrabec
fa95f253bf * Mon Jun 19 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-258 
- Allow rpcbind_t to execute systemd_tmpfiles_exec_t binary files.
- Merge branch 'rawhide' of github.com:wrabcak/selinux-policy-contrib into rawhide
- Allow qemu to authenticate SPICE connections with SASL GSSAPI when SSSD is in use
- Fix dbus_dontaudit_stream_connect_system_dbusd() interface to require TYPE rather than ATTRIBUTE for systemd_dbusd_t.
- Allow httpd_t to read realmd_var_lib_t files
- Allow unconfined_t user all user namespace capabilties.
- Add interface systemd_tmpfiles_exec()
- Add interface libs_dontaudit_setattr_lib_files()
- Dontaudit xdm_t domain to setattr on lib_t dirs
- Allow sysadm_r role to jump into dirsrv_t
 2017-06-19 10:01:33 +02:00
Lukas Vrabec
7ac1cbb003 * Thu Jun 08 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-257 
- Merge pull request #10 from mscherer/fix_tor_dac
- Merge pull request #9 from rhatdan/rawhide
- Merge pull request #13 from vinzent/allow_zabbix_t_to_kill_zabbix_script_t
- Allow kdumpgui to read removable disk device
- Allow systemd_dbusd_t domain read/write to nvme devices
- Allow udisks2 domain to read removable devices BZ(1443981)
- Allow virtlogd_t to execute itself
- Allow keepalived to read/write usermodehelper state
- Allow named_t to bind on udp 4321 port
- Fix interface tlp_manage_pid_files()
- Allow collectd domain read lvm config files. BZ(1459097)
- Merge branch 'rawhide' of github.com:wrabcak/selinux-policy-contrib into rawhide
- Allow samba_manage_home_dirs boolean to manage user content
- Merge pull request #14 from lemenkov/rabbitmq_systemd_notify
- Allow pki_tomcat_t execute ldconfig.
- Merge pull request #191 from rhatdan/udev
- Allow systemd_modules_load_t to load modules
 2017-06-08 12:25:29 +02:00
Lukas Vrabec
941d5af493 * Mon Jun 05 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-256 
- Allow keepalived domain connect to squid tcp port
- Allow krb5kdc_t domain read realmd lib files.
- Allow tomcat to connect on all unreserved ports
- Allow keepalived domain connect to squid tcp port
- Allow krb5kdc_t domain read realmd lib files.
- Allow tomcat to connect on all unreserved ports
- Allow ganesha to connect to all rpc ports
- Update ganesha with few allow rules
- Update rpc_read_nfs_state_data() interface to allow read also lnk_files.
- virt_use_glusterd boolean should be in optional block
- Add new boolean virt_use_glusterd
- Add capability sys_boot for sbd_t domain Allow sbd_t domain to create rpc sysctls.
- Allow ganesha_t domain to manage glusterd_var_run_t pid files.
- Create new interface: glusterd_read_lib_files() Allow ganesha read glusterd lib files. Allow ganesha read network sysctls
- Add few allow rules to ganesha module
- Allow condor_master_t to read sysctls.
- Add dac_override cap to ctdbd_t domain
- Add ganesha_use_fusefs boolean.
- Allow httpd_t reading kerberos kdc config files
- Allow tomcat_t domain connect to ibm_dt_2 tcp port.
- Allow stream connect to initrc_t domains
- Add pki_exec_common_files() interface
- Allow  dnsmasq_t domain to read systemd-resolved pid files.
- Allow tomcat domain name_bind on tcp bctp_port_t
- Allow smbd_t domain generate debugging files under /var/run/gluster. These files are created through the libgfapi.so library that provides integration of a GlusterFS client in the Samba (vfs_glusterfs) process.
- Allow condor_master_t write to sysctl_net_t
- Allow nagios check disk plugin read /sys/kernel/config/
- Allow pcp_pmie_t domain execute systemctl binary
- Allow nagios to connect to stream sockets. Allow nagios start httpd via systemctl
- xdm_t should view kernel keys
- Hide broken symptoms when machine is configured with network bounding.
- Label 8750 tcp/udp port as dey_keyneg_port_t
- Label tcp/udp port 1792 as ibm_dt_2_port_t
- Add interface fs_read_configfs_dirs()
- Add interface fs_read_configfs_files()
- Fix systemd_resolved_read_pid interface
- Add interface systemd_resolved_read_pid()
- Allow sshd_net_t domain read/write into crypto devices
- Label 8999 tcp/udp as bctp_port_t
 2017-06-05 13:25:12 +02:00
Lukas Vrabec
6c0472a324 * Thu May 18 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-255 
- Dontaudit net_admin capability for domains postfix_master_t and postfix_qmgr_t
- Add interface pki_manage_common_files()
- Allow rngd domain read sysfs_t
- Allow tomcat_t domain to manage pki_common_t files and dirs
- Merge pull request #3 from rhatdan/devicekit
- Merge pull request #12 from lslebodn/sssd_sockets_fc
- Allow certmonger reads httpd_config_t files
- Allow keepalived_t domain creating netlink_netfilter_socket.
- Use stricter fc rules for sssd sockets in /var/run
- Allow tomcat domain read rpm_var_lib_t files Allow tomcat domain exec rpm_exec_t files Allow tomcat domain name connect on oracle_port_t Allow tomcat domain read cobbler_var_lib_t files.
- Allow sssd_t domain creating sock files labeled as sssd_var_run_t in /var/run/
- Allow svirt_t to read raw fixed_disk_device_t to make working blockcommit
- ejabberd small fixes
- Update targetd policy to accommodate changes in the service
- Allow tomcat_domain connect to    * postgresql_port_t    * amqp_port_t Allow tomcat_domain read network sysctls
- Allow virt_domain to read raw fixed_disk_device_t to make working blockcommit
- Dontaudit net_admin capability for useradd_t domain
- Allow systemd_localed_t and systemd_timedated_t create files in /etc with label locate_t BZ(1443723)
- Make able deply overcloud via neutron_t to label nsfs as fs_t
- Add fs_manage_configfs_lnk_files() interface
 2017-05-18 16:44:30 +02:00
Lukas Vrabec
c1e28f68d8 * Mon May 15 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-254 
- Allow svirt_t to read raw fixed_disk_device_t to make working blockcommit
- ejabberd small fixes
- Update targetd policy to accommodate changes in the service
- Allow tomcat_domain connect to    * postgresql_port_t    * amqp_port_t Allow tomcat_domain read network sysctls
- Allow virt_domain to read raw fixed_disk_device_t to make working blockcommit
- Allow glusterd_t domain start ganesha service
- Made few cosmetic changes in sssd SELinux module
- Merge pull request #11 from lslebodn/sssd_kcm
- Update virt_rw_stream_sockets_svirt() interface to allow confined users set socket options.
- Allow keepalived_t domain read usermodehelper_t
- Allow radius domain stream connec to postgresql
- Merge pull request #8 from bowlofeggs/142-rawhide
- Add fs_manage_configfs_lnk_files() interface
 2017-05-15 22:07:43 +02:00
Lukas Vrabec
52a7727e8d Make active ejabberd SELinux module 2017-05-15 22:03:01 +02:00
Lukas Vrabec
dfee3bea84 * Fri May 12 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-253 
- auth_use_nsswitch can call only domain not attribute
- Dontaudit net_admin cap for winbind_t
- Allow tlp_t domain to stream connect to system bus
- Allow tomcat_t domain read pki_common_t files
- Add interface pki_read_common_files()
- Fix broken cermonger module
- Fix broken apache module
- Allow hypervkvp_t domain execute hostname
- Dontaudit sssd_selinux_manager_t use of net_admin capability
- Allow tomcat_t stream connect to pki_common_t
- Dontaudit xguest_t's attempts to listen to its tcp_socket
- Allow sssd_selinux_manager_t to ioctl init_t sockets
- Improve ipa_cert_filetrans_named_content() interface to also allow caller domain manage ipa_cert_t type.
- Allow pki_tomcat_t domain read /etc/passwd.
- Allow tomcat_t domain read ipa_tmp_t files
- Label new path for ipa-otpd
- Allow radiusd_t domain stream connect to postgresql_t
- Allow rhsmcertd_t to execute hostname_exec_t binaries.
- Allow virtlogd to append nfs_t files when virt_use_nfs=1
- Allow httpd_t domain read also httpd_user_content_type lnk_files.
- Allow httpd_t domain create /etc/httpd/alias/ipaseesion.key with label ipa_cert_t
- Dontaudit <user>_gkeyringd_t stream connect to system_dbusd_t
- Label /var/www/html/nextcloud/data as httpd_sys_rw_content_t
- Add interface ipa_filetrans_named_content()
- Allow tomcat use nsswitch
- Allow certmonger_t start/status generic services
- Allow dirsrv read cgroup files.
- Allow ganesha_t domain read/write infiniband devices.
- Allow sendmail_t domain sysctl_net_t files
- Allow targetd_t domain read network state and getattr on loop_control_device_t
- Allow condor_schedd_t domain send mails.
- Allow ntpd to creating sockets. BZ(1434395)
- Alow certmonger to create own systemd unit files.
- Add kill namespace capability to xdm_t domain
- Revert "su using libselinux and creating netlink_selinux socket is needed to allow libselinux initialization."
- Revert "Allow <role>_su_t to create netlink_selinux_socket"
- Allow <role>_su_t to create netlink_selinux_socket
- Allow unconfined_t to module_load any file
- Allow staff to systemctl virt server when staff_use_svirt=1
- Allow unconfined_t create /tmp/ca.p12 file with ipa_tmp_t context
- Allow netutils setpcap capability
- Dontaudit leaked file descriptor happening in setfiles_t domain BZ(1388124)
 2017-05-12 17:03:36 +02:00