7b45c2b424
Add rhcd module to modules-targeted-contrib.conf
...
Resolves: rhbz#1965013
2022-05-27 16:58:53 +02:00
29a520ae24
* Wed May 11 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.32-1
...
- Dontaudit guest attempts to dbus chat with systemd domains
Resolves: rhbz#2062740
- Dontaudit guest attempts to dbus chat with system bus types
Resolves: rhbz#2062740
- Fix users for SELinux userspace 3.4
Resolves: rhbz#2079290
- Removed adding to attribute unpriv_userdomain from userdom_unpriv_type template
Resolves: rhbz#2076681
- Allow systemd-sleep get removable devices attributes
Resolves: rhbz#2082404
- Allow systemd-sleep tlp_filetrans_named_content()
Resolves: rhbz#2082404
- Allow systemd-sleep execute generic programs
Resolves: rhbz#2082404
- Allow systemd-sleep execute shell
Resolves: rhbz#2082404
- Allow systemd-sleep transition to sysstat_t
Resolves: rhbz#2082404
- Allow systemd-sleep transition to tlp_t
Resolves: rhbz#2082404
- Allow systemd-sleep transition to unconfined_service_t on bin_t executables
Resolves: rhbz#2082404
- allow systemd-sleep to set timer for suspend-then-hibernate
Resolves: rhbz#2082404
- Add default fc specifications for patterns in /opt
Resolves: rhbz#2081059
- Use a named transition in systemd_hwdb_manage_config()
Resolves: rhbz#2061725
2022-05-11 20:55:03 +02:00
527e11b6c8
Users have to be generated is policy/users to make 3.4 userspace happy
...
Resolves: rhbz#2079290
2022-05-11 20:41:36 +02:00
5fd82ec867
* Wed May 04 2022 Nikola Knazekova <nknazeko@redhat.com> - 34.1.31-2
...
- Remove letter v from version
Related: rhbz#2061680
2022-05-04 10:53:54 +02:00
e67d11e38d
Mon May 02 2022 Nikola Knazekova <nknazeko@redhat.com> - v34.1.31-1
...
- Label /var/run/machine-id as machineid_t
Resolves: rhbz#2061680
- Allow insights-client create_socket_perms for tcp/udp sockets
Resolves: rhbz#2077377
- Allow insights-client read rhnsd config files
Resolves: rhbz#2077377
- Allow rngd drop privileges via setuid/setgid/setcap
Resolves: rhbz#2076642
- Allow tmpreaper the sys_ptrace userns capability
Resolves: rhbz#2062823
- Add stalld to modules.conf
Resolves: rhbz#2042614
- New policy for stalld
Resolves: rhbz#2042614
- Label new utility of NetworkManager nm-priv-helper
Resolves: rhbz#2053639
- Exclude container.if from selinux-policy-devel
Resolves: rhbz#1861968
2022-05-02 14:19:14 +02:00
637873d5ad
Add stalld module to modules-targeted-contrib.conf
...
Resolves: rhbz#2042614
2022-05-02 14:10:20 +02:00
d5d18f13f7
Exclude container.if from selinux-policy-devel
...
The container-selinux has been separated from selinux-policy,
but selinux-policy still contains the interface in selinux-policy-devel
subpackage, which can result in errors like
$ make -f /usr/share/selinux/devel/Makefile init_t_audit_control.pp
/usr/share/selinux/devel/include/services/container.if:13:
Error: duplicate definition of container_runtime_domtrans(). Original definition on 13.
These errors are harmless as long as the content is the same, but
not packaging the interface in selinux-policy can entirely prevent these
errors from appearing.
Resolves: rhbz#2055890
2022-05-02 13:59:29 +02:00
98a41b6a2c
* Tue Apr 19 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.30-2
...
- Update source branches to build a new package for RHEL 9.1.0
Resolves: rhbz#2070982
2022-04-19 18:47:26 +02:00
5d8c009a98
Tue Apr 12 2022 Nikola Knazekova <nknazeko@redhat.com> - 34.1.30-1
...
- Allow administrative users the bpf capability
Resolves: RHBZ#2070982
- Allow NetworkManager talk with unconfined user over unix domain dgram socket
Resolves: rhbz#2064688
- Allow hostapd talk with unconfined user over unix domain dgram socket
Resolves: rhbz#2064688
- Allow fprintd read and write hardware state information
Resolves: rhbz#2062911
- Allow fenced read kerberos key tables
Resolves: RHBZ#2060722
- Allow init watch and watch_reads user ttys
Resolves: rhbz#2060289
- Allow systemd watch and watch_reads console devices
Resolves: rhbz#2060289
- Allow nmap create and use rdma socket
Resolves: RHBZ#2059603
2022-04-13 16:04:11 +02:00
d16a3024e0
* Thu Mar 31 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.29-1
...
- Allow qemu-kvm create and use netlink rdma sockets
Resolves: rhbz#2070569
- Label corosync-cfgtool with cluster_exec_t
Resolves: rhbz#2067501
2022-04-11 11:32:30 +02:00
cab4d847c2
* Thu Mar 24 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.28-1
...
- Allow logrotate a domain transition to cluster administrative domain
Resolves: rhbz#2061277
- Change the selinuxuser_execstack boolean value to true
Resolves: rhbz#2064274
2022-04-07 12:24:20 +02:00
d0c8cc2186
Change the selinuxuser_execstack boolean value to true
...
With the d5bb233ea2
2022-04-07 12:24:08 +02:00
f60c51e134
* Thu Feb 24 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.27-1
...
- Allow ModemManager connect to the unconfined user domain
Resolves: rhbz#2000196
- Label /dev/wwan.+ with modem_manager_t
Resolves: rhbz#2000196
- Allow systemd-coredump userns capabilities and root mounton
Resolves: rhbz#2057435
- Allow systemd-coredump read and write usermodehelper state
Resolves: rhbz#2057435
- Allow sysadm_passwd_t to relabel passwd and group files
Resolves: rhbz#2053458
- Allow systemd-sysctl read the security state information
Resolves: rhbz#2056999
- Remove unnecessary /etc file transitions for insights-client
Resolves: rhbz#2055823
- Label all content in /var/lib/insights with insights_client_var_lib_t
Resolves: rhbz#2055823
- Update insights-client policy
Resolves: rhbz#2055823
- Update insights-client: fc pattern, motd, writing to etc
Resolves: rhbz#2055823
- Update specfile to buildrequire policycoreutils-devel >= 3.3-5
- Add modules_checksum to %files
2022-02-24 15:23:20 +01:00
8a1fd2d0a4
* Thu Feb 17 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.26-1
...
- Remove permissive domain for insights_client_t
Resolves: rhbz#2055823
- New policy for insight-client
Resolves: rhbz#2055823
- Allow confined sysadmin to use tool vipw
Resolves: rhbz#2053458
- Allow chage domtrans to sssd
Resolves: rhbz#2054657
- Remove label for /usr/sbin/bgpd
Resolves: rhbz#2055578
- Dontaudit pkcsslotd sys_admin capability
Resolves: rhbz#2055639
- Do not change selinuxuser_execmod and selinuxuser_execstack
Resolves: rhbz#2055822
- Allow tuned to read rhsmcertd config files
Resolves: rhbz#2055823
2022-02-17 22:30:58 +01:00
d5bb233ea2
Do not change selinuxuser_execmod and selinuxuser_execstack
...
The selinuxuser_execmod and selinuxuser_execstack booleans are off
by default in the selinux-policy repository, but custom build
configuration changed it to the "on" value.
Since this commit, the booleans will keep their default value.
Resolves: rhbz#2055822
2022-02-17 22:02:29 +01:00
be2e9e731d
Add the insights_client module
...
Resolves: rhbz#2055823
2022-02-17 22:02:02 +01:00
34edc3e97a
* Mon Feb 14 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.25-1
...
- Allow systemd watch unallocated ttys
Resolves: rhbz#2054150
- Allow alsa bind mixer controls to led triggers
Resolves: rhbz#2049732
- Allow alsactl set group Process ID of a process
Resolves: rhbz#2049732
- Allow unconfined to run virtd bpf
Resolves: rhbz#2033504
2022-02-14 15:33:14 +01:00
93570f083c
* Fri Feb 04 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.24-1
...
- Allow tumblerd write to session_dbusd tmp socket files
Resolves: rhbz#2000039
- Allow login_userdomain write to session_dbusd tmp socket files
Resolves: rhbz#2000039
- Allow login_userdomain create session_dbusd tmp socket files
Resolves: rhbz#2000039
- Allow gkeyringd_domain write to session_dbusd tmp socket files
Resolves: rhbz#2000039
- Allow systemd-logind delete session_dbusd tmp socket files
Resolves: rhbz#2000039
- Allow gdm-x-session write to session dbus tmp sock files
Resolves: rhbz#2000039
- Allow sysadm_t nnp_domtrans to systemd_tmpfiles_t
Resolves: rhbz#2039453
- Label exFAT utilities at /usr/sbin
Resolves: rhbz#1972225
2022-02-04 17:43:05 +01:00
4d21d7d728
* Wed Feb 02 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.23-1
...
- Allow systemd nnp_transition to login_userdomain
Resolves: rhbz#2039453
- Label /var/run/user/%{USERID}/dbus with session_dbusd_tmp_t
Resolves: rhbz#2000039
- Change /run/user/[0-9]+ to /run/user/%{USERID} for proper labeling
Resolves: rhbz#2000039
- Allow scripts to enter LUKS password
Resolves: rhbz#2048521
- Allow system_mail_t read inherited apache system content rw files
Resolves: rhbz#2049372
- Add apache_read_inherited_sys_content_rw_files() interface
Related: rhbz#2049372
- Allow sanlock get attributes of filesystems with extended attributes
Resolves: rhbz#2047811
- Associate stratisd_data_t with device filesystem
Resolves: rhbz#2039974
- Allow init read stratis data symlinks
Resolves: rhbz#2039974
- Label /run/stratisd with stratisd_var_run_t
Resolves: rhbz#2039974
- Allow domtrans to sssd_t and role access to sssd
Resolves: rhbz#2039757
- Creating interface sssd_run_sssd()
Resolves: rhbz#2039757
- Fix badly indented used interfaces
Resolves: rhbz#2039757
- Allow domain transition to sssd_t
Resolves: rhbz#2039757
- Label /dev/nvme-fabrics with fixed_disk_device_t
Resolves: rhbz#2039759
- Allow local_login_t nnp_transition to login_userdomain
Resolves: rhbz#2039453
- Allow xdm_t nnp_transition to login_userdomain
Resolves: rhbz#2039453
- Make cupsd_lpd_t a daemon
Resolves: rhbz#2039449
- Label utilities for exFAT filesystems with fsadm_exec_t
Resolves: rhbz#1972225
- Dontaudit sfcbd sys_ptrace cap_userns
Resolves: rhbz#2040311
2022-02-02 21:35:46 +01:00
c264d943f0
* Tue Jan 11 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.22-1
...
- Allow sshd read filesystem sysctl files
Resolves: rhbz#2036585
- Revert "Allow sshd read sysctl files"
Resolves: rhbz#2036585
2022-01-11 16:16:07 +01:00
38bdf8abba
* Mon Jan 10 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.21-1
...
- Remove the lockdown class from the policy
Resolves: rhbz#2017848
- Revert "define lockdown class and access"
Resolves: rhbz#2017848
- Allow gssproxy access to various system files.
Resolves: rhbz#2026974
- Allow gssproxy read, write, and map ica tmpfs files
Resolves: rhbz#2026974
- Allow gssproxy read and write z90crypt device
Resolves: rhbz#2026974
- Allow sssd_kcm read and write z90crypt device
Resolves: rhbz#2026974
- Allow abrt_domain read and write z90crypt device
Resolves: rhbz#2026974
- Allow NetworkManager read and write z90crypt device
Resolves: rhbz#2026974
- Allow smbcontrol read the network state information
Resolves: rhbz#2038157
- Allow virt_domain map vhost devices
Resolves: rhbz#2035702
- Allow fcoemon request the kernel to load a module
Resolves: rhbz#2034463
- Allow lldpd connect to snmpd with a unix domain stream socket
Resolves: rhbz#2033315
- Allow ModemManager create a qipcrtr socket
Resolves: rhbz#2036582
- Allow ModemManager request to load a kernel module
Resolves: rhbz#2036582
- Allow sshd read sysctl files
Resolves: rhbz#2036585
2022-01-10 21:09:15 +01:00
6bc3bd6ac4
* Wed Dec 15 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.20-1
...
- Allow dnsmasq watch /etc/dnsmasq.d directories
Resolves: rhbz#2029866
- Label /usr/lib/pcs/pcs_snmp_agent with cluster_exec_t
Resolves: rhbz#2029316
- Allow lldpd use an snmp subagent over a tcp socket
Resolves: rhbz#2028561
- Allow smbcontrol use additional socket types
Resolves: rhbz#2027751
- Add write permisson to userfaultfd_anon_inode_perms
Resolves: rhbz#2027660
- Allow xdm_t watch generic directories in /lib
Resolves: rhbz#1960010
- Allow xdm_t watch fonts directories
Resolves: rhbz#1960010
- Label /dev/ngXnY and /dev/nvme-subsysX with fixed_disk_device_t
Resolves: rhbz#2027994
- Add hwtracing_device_t type for hardware-level tracing and debugging
Resolves: rhbz#2029392
- Change dev_getattr_infiniband_dev() to use getattr_chr_files_pattern()
Resolves: rhbz#2028791
- Allow arpwatch get attributes of infiniband_device_t devices
Resolves: rhbz#2028791
- Allow tcpdump and nmap get attributes of infiniband_device_t
Resolves: rhbz#2028791
2021-12-15 17:27:25 +01:00
470eea63e8
* Mon Nov 29 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.19-1
...
- Allow redis get attributes of filesystems with extended attributes
Resolves: rhbz#2014611
- Allow dirsrv read slapd tmpfs files
Resolves: rhbz#2015928
- Revert "Label /dev/shm/dirsrv/ with dirsrv_tmpfs_t label"
Resolves: rhbz#2015928
- Allow login_userdomain open/read/map system journal
Resolves: rhbz#2017838
- Allow login_userdomain read and map /var/lib/systemd files
Resolves: rhbz#2017838
- Allow nftables read NetworkManager unnamed pipes
Resolves: rhbz#2023456
- Allow xdm watch generic directories in /var/lib
Resolves: rhbz#1960010
- Allow xdm_t watch generic pid directories
Resolves: rhbz#1960010
2021-11-29 15:31:44 +01:00
89586f9eb1
* Mon Nov 01 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.18-1
...
- Allow fetchmail search cgroup directories
Resolves: rhbz#2015118
- Add the auth_read_passwd_file() interface
Resolves: rhbz#2014611
- Allow redis-sentinel execute a notification script
Resolves: rhbz#2014611
- Support new PING_CHECK health checker in keepalived
Resolves: rhbz#2014423
2021-11-01 11:51:58 +01:00
16d5820b15
* Thu Oct 14 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.17-1
...
- Label /usr/sbin/virtproxyd as virtd_exec_t
Resolves: rhbz#2002143
- Allow at-spi-bus-launcher read and map xdm pid files
Resolves: rhbz#2011772
- Remove references to init_watch_path_type attribute
Resolves: rhbz#2007960
- Remove all redundant watch permissions for systemd
Resolves: rhbz#2007960
- Allow systemd watch non_security_file_type dirs, files, lnk_files
Resolves: rhbz#2007960
- Allow systemd-resolved watch /run/systemd
Resolves: rhbz#1992461
- Allow sssd watch /run/systemd
Resolves: rhbz#1992461
2021-10-14 09:46:11 +02:00
5ad9abab43
* Thu Sep 23 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.16-1
...
- Allow fprintd install a sleep delay inhibitor
Resolves: rhbz#1999537
- Update mount_manage_pid_files() to use manage_files_pattern
Resolves: rhbz#1999997
- Allow gnome at-spi processes create and use stream sockets
Resolves: rhbz#2004885
- Allow haproxy list the sysfs directories content
Resolves: rhbz#1986823
- Allow virtlogd_t read process state of user domains
Resolves: rhbz#1994592
- Support hitless reloads feature in haproxy
Resolves: rhbz#1997182
- Allow firewalld load kernel modules
Resolves: rhbz#1999152
- Allow communication between at-spi and gdm processes
Resolves: rhbz#2003037
2021-09-24 09:21:09 +02:00
c024fd84d4
Remove "ipa = module" from modules-targeted-contrib.conf
...
Resolves: rhbz#2006039
2021-09-23 21:19:26 +02:00
ddedf0d0b5
* Mon Aug 30 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.15-1
...
- Update ica_filetrans_named_content() with create_file_perms
Resolves: rhbz#1976180
- Allow various domains work with ICA crypto accelerator
Resolves: rhbz#1976180
- Add ica module
Resolves: rhbz#1976180
- Revert "Support using ICA crypto accelerator on s390x arch"
Resolves: rhbz#1976180
- Fix the gnome_atspi_domtrans() interface summary
Resolves: rhbz#1972655
- Add support for at-spi
Resolves: rhbz#1972655
- Add permissions for system dbus processes
Resolves: rhbz#1972655
- Allow /tmp file transition for dbus-daemon also for sock_file
Resolves: rhbz#1972655
2021-08-30 16:13:54 +02:00
b42446e02d
* Wed Aug 25 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.14-1
...
- Support using ICA crypto accelerator on s390x arch
Resolves: rhbz#1976180
- Allow systemd delete /run/systemd/default-hostname
Resolves: rhbz#1978507
- Label /usr/bin/Xwayland with xserver_exec_t
Resolves: rhbz#1993151
- Label /usr/libexec/gdm-runtime-config with xdm_exec_t
Resolves: rhbz#1993151
- Allow tcpdump read system state information in /proc
Resolves: rhbz#1972577
- Allow firewalld drop capabilities
Resolves: rhbz#1989641
2021-08-25 18:48:38 +02:00
cf60736fb6
* Thu Aug 12 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.13-1
...
- Add "/" at the beginning of dev/shm/var\.lib\.opencryptoki.* regexp
Resolves: rhbz#1977915
- Set default file context for /sys/firmware/efi/efivars
Resolves: rhbz#1972372
- Allow tcpdump run as a systemd service
Resolves: rhbz#1972577
- Allow nmap create and use netlink generic socket
Resolves: rhbz#1985212
- Allow nscd watch system db files in /var/db
Resolves: rhbz#1989416
- Allow systemd-gpt-auto-generator read udev pid files
Resolves: rhbz#1992638
2021-08-12 16:15:32 +02:00
991febef9c
* Tue Aug 10 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.12-1
...
- Revert "update libs_filetrans_named_content() to have support for /usr/lib/debug directory"
Resolves: rhbz#1990813
- Label /dev/crypto/nx-gzip with accelerator_device_t
Resolves: rhbz#1973953
- Label /usr/bin/qemu-storage-daemon with virtd_exec_t
Resolves: rhbz#1977245
- Allow systemd-machined stop generic service units
Resolves: rhbz#1979522
- Label /.k5identity file allow read of this file to rpc.gssd
Resolves: rhbz#1980610
2021-08-10 16:28:03 +02:00
57b195c83b
Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
...
Related: rhbz#1991688
Signed-off-by: Mohan Boddu <mboddu@redhat.com>
2021-08-10 00:49:40 +00:00
4548b66f2e
* Thu Jul 29 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.11-1
...
- Allow hostapd bind UDP sockets to the dhcpd port
Resolves: rhbz#1979968
- Allow mdadm read iscsi pid files
Resolves: rhbz#1976073
- Unconfined domains should not be confined
Resolves: rhbz#1977986
- Allow NetworkManager_t to watch /etc
Resolves: rhbz#1980000
- Allow using opencryptoki for ipsec
Resolves: rhbz#1977915
2021-07-29 17:11:36 +02:00
c0ea3a13a7
* Wed Jul 14 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.10-1
...
- Allow bacula get attributes of cgroup filesystems
Resolves: rhbz#1976917
- Label /dev/wmi/dell-smbios as acpi_device_t
Resolves: rhbz#1972382
- Add the lockdown integrity permission to dev_map_userio_dev()
Resolves: rhbz#1966758
- Allow virtlogd_t to create virt_var_lockd_t dir
Resolves: rhbz#1974875
2021-07-14 16:11:07 +02:00
86f64b8b19
gating.yaml: add missing '}'
2021-07-07 10:46:03 +02:00
52a5aa8d34
Add gating.yaml to enable functional gating tests
2021-06-30 12:07:25 +02:00
37bcc175cd
* Tue Jun 22 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.9-1
...
- Allow systemd-coredump getattr nsfs files and net_admin capability
Resolves: rhbz#1965372
- Label /run/libvirt/common with virt_common_var_run_t
Resolves: rhbz#1969209
- Label /usr/bin/arping plain file with netutils_exec_t
Resolves: rhbz#1952515
- Make usbmuxd_t a daemon
Resolves: rhbz#1965411
- Allow usbmuxd get attributes of cgroup filesystems
Resolves: rhbz#1965411
- Label /dev/dma_heap/* char devices with dma_device_t
- Revert "Label /dev/dma_heap/* char devices with dma_device_t"
- Revert "Label /dev/dma_heap with dma_device_dir_t"
- Revert "Associate dma_device_dir_t with device filesystem"
Resolves: rhbz#1967818
- Label /var/lib/kdump with kdump_var_lib_t
Resolves: rhbz#1965989
- Allow systemd-timedated watch runtime dir and its parent
Resolves: rhbz#1970865
- Label /run/fsck with fsadm_var_run_t
Resolves: rhbz#1970911
2021-06-22 14:41:30 +02:00
042fffd52c
* Thu Jun 10 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.8-1
...
- Associate dma_device_dir_t with device filesystem
Resolves: rhbz#1954116
- Add default file context specification for dnf log files
Resolves: rhbz#1955223
- Allow using opencryptoki for certmonger
Resolves: rhbz#1961756
- Label var.lib.opencryptoki.* files and create pkcs_tmpfs_filetrans()
Resolves: rhbz#1961756
- Allow httpd_sys_script_t read, write, and map hugetlbfs files
Resolves: rhbz#1964890
- Dontaudit daemon open and read init_t file
Resolves: rhbz#1965412
- Allow sanlock get attributes of cgroup filesystems
Resolves: rhbz#1965217
2021-06-10 23:07:44 +02:00
5d2a514c72
* Tue Jun 08 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.7-1
...
- Set default file context for /var/run/systemd instead of /run/systemd
Resolves: rhbz#1966492
2021-06-08 19:26:12 +02:00
a0031a1fc3
* Mon Jun 07 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.6-1
...
- Label /dev/dma_heap with dma_device_dir_t
Resolves: rhbz#1954116
- Allow pkcs-slotd create and use netlink_kobject_uevent_socket
Resolves: rhbz#1963252
- Label /run/systemd/default-hostname with hostname_etc_t
Resolves: rhbz#1966492
2021-06-07 16:34:34 +02:00
14a2757535
* Thu May 27 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.5-1
...
- Label /dev/trng with random_device_t
Resolves: rhbz#1962260
- Label /dev/zram[0-9]+ block device files with fixed_disk_device_t
Resolves: rhbz#1954116
- Label /dev/udmabuf character device with dma_device_t
Resolves: rhbz#1954116
- Label /dev/dma_heap/* char devices with dma_device_t
Resolves: rhbz#1954116
- Label /dev/acpi_thermal_rel char device with acpi_device_t
Resolves: rhbz#1954116
- Allow fcoemon create sysfs files
Resolves: rhbz#1952292
2021-05-27 14:57:41 +02:00
61280fbdd0
* Wed May 12 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.4-1
...
- Allow sysadm_t dbus chat with tuned
Resolves: rhbz#1953643
- Allow tuned write profile files with file transition
Resolves: rhbz#1953643
- Allow tuned manage perf_events
Resolves: rhbz#1953643
- Make domains use kernel_write_perf_event() and kernel_manage_perf_event()
Resolves: rhbz#1953643
- Add kernel_write_perf_event() and kernel_manage_perf_event()
Resolves: rhbz#1953643
- Allow syslogd_t watch root and var directories
Resolves: rhbz#1957792
- Allow tgtd create and use rdma socket
Resolves: rhbz#1955559
- Allow aide connect to init with a unix socket
Resolves: rhbz#1926343
2021-05-12 15:45:13 +02:00
997ca10921
* Wed Apr 28 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.3-1
...
- Allow domain create anonymous inodes
Resolves: rhbz#1954145
- Add anon_inode class to the policy
Resolves: rhbz#1954145
- Allow pluto IKEv2 / ESP over TCP
Resolves: rhbz#1951471
- Add brltty new permissions required by new upstream version
Resolves: rhbz#1947842
- Label /var/lib/brltty with brltty_var_lib_t
Resolves: rhbz#1947842
- Allow login_userdomain create cgroup files
Resolves: rhbz#1951114
- Allow aide connect to systemd-userdbd with a unix socket
Resolves: rhbz#1926343
- Allow cups-lpd read its private runtime socket files
Resolves: rhbz#1947397
- Label /etc/redis as redis_conf_t
Resolves: rhbz#1947874
- Add file context specification for /usr/libexec/realmd
Resolves: rhbz#1946495
2021-04-28 15:25:09 +02:00
d48e2527dc
* Thu Apr 22 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.2-1
...
- Further update make-rhat-patches.sh for RHEL 9.0 beta
- Add file context specification for /var/tmp/tmp-inst
Resolves: rhbz#1924656
2021-04-22 13:47:13 +02:00
40e9a7fb1f
* Wed Apr 21 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.1-1
...
- Update selinux-policy.spec and make-rhat-patches.sh for RHEL 9.0 beta
- Allow unconfined_service_t confidentiality and integrity lockdown
Resolves: rhbz#1950267
2021-04-21 21:27:35 +02:00
b8bce4d7d2
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
...
Signed-off-by: Mohan Boddu <mboddu@redhat.com>
2021-04-16 05:35:15 +00:00
0c7d2cb554
Merged update from upstream sources
...
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.
Source: https://src.fedoraproject.org/rpms/selinux-policy.git#b599883a670d1bbd3ee0d8a4386b917f0ba3781d
2021-04-04 19:30:25 +00:00
e671ae4028
Merged update from upstream sources
...
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.
Source: https://src.fedoraproject.org/rpms/selinux-policy.git#9e9c1b67b363a55618c218f648491cd9c4830e8d
2021-03-31 18:45:22 +00:00
ba2607aba9
Merged update from upstream sources
...
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.
Source: https://src.fedoraproject.org/rpms/selinux-policy.git#2b6e9bd08f688cf6ad39a2dbad7531164a22fff5
2021-03-28 20:10:28 +00:00
d69f76993a
Merged update from upstream sources
...
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.
Source: https://src.fedoraproject.org/rpms/selinux-policy.git#8c7a9eaa8cb01c7fbadd4104c2e1cafb819f0a89
2021-03-15 19:41:15 +00:00
Zdenek Pytela
Petr Lautrbach
Nikola Knazekova
Mohan Boddu
DistroBaker