rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity
153 Commits 9 Branches 105 Tags 34 MiB
df730c18c8
Commit Graph

124 Commits

Author SHA1 Message Date
Nikola Knazekova
d5d3e43046 Update source branches to build a new package for RHEL 9.2.0 
Resolves: rhbz#2134827
 2022-11-04 14:46:24 +01:00
Nikola Knazekova
9da9be36e0 * Thu Nov 03 2022 Nikola Knazekova <nknazeko@redhat.com> - 34.1.45-1 
- Add watch_sb interfaces
Resolves: rhbz#2139363
- Add watch interfaces
Resolves: rhbz#2139363
- Allow dhcpd bpf capability to run bpf programs
Resolves: rhbz#2134827
- Allow netutils and traceroute bpf capability to run bpf programs
Resolves: rhbz#2134827
- Allow pkcs_slotd_t bpf capability to run bpf programs
Resolves: rhbz#2134827
- Allow xdm bpf capability to run bpf programs
Resolves: rhbz#2134827
- Allow pcscd bpf capability to run bpf programs
Resolves: rhbz#2134827
- Allow lldpad bpf capability to run bpf programs
Resolves: rhbz#2134827
- Allow keepalived bpf capability to run bpf programs
Resolves: rhbz#2134827
- Allow ipsec bpf capability to run bpf programs
Resolves: rhbz#2134827
- Allow fprintd bpf capability to run bpf programs
Resolves: rhbz#2134827
- Allow iptables list cgroup directories
Resolves: rhbz#2134829
- Allow dirsrv_snmp_t to manage dirsrv_config_t & dirsrv_var_run_t files
Resolves: rhbz#2042515
- Dontaudit dirsrv search filesystem sysctl directories
Resolves: rhbz#2134726
 2022-11-03 18:43:25 +01:00
Nikola Knazekova
7825dbb2e4 Thu Oct 13 2022 Nikola Knazekova <nknazeko@redhat.com> - 34.1.44-1 
- Allow insights-client domtrans on unix_chkpwd execution
Resolves: rhbz#2126091
- Allow insights-client connect to postgresql with a unix socket
Resolves: rhbz#2126091
- Allow insights-client send null signal to rpm and system cronjob
Resolves: rhbz#2126091
- Allow insights-client manage samba var dirs
Resolves: rhbz#2126091
- Allow rhcd compute selinux access vector
Resolves: rhbz#2126091
- Add file context entries for insights-client and rhc
Resolves: rhbz#2126161
- Allow pulseaudio create gnome content (~/.config)
Resolves: rhbz#2132942
- Allow rhsmcertd execute gpg
Resolves: rhbz#2130204
- Label ports 10161-10162 tcp/udp with snmp
Resolves: rhbz#2133221
- Allow lldpad send to unconfined_t over a unix dgram socket
Resolves: rhbz#2112044
- Label port 15354/tcp and 15354/udp with opendnssec
Resolves: rhbz#2057501
- Allow aide to connect to systemd_machined with a unix socket.
Resolves: bz#2062936
- Allow ftpd map ftpd_var_run files
Resolves: bz#2124943
- Allow ptp4l respond to pmc
Resolves: rhbz#2131689
- Allow radiusd connect to the radacct port
Resolves: rhbz#2132424
- Allow xdm execute gnome-atspi services
Resolves: rhbz#2132244
- Allow ptp4l_t name_bind ptp_event_port_t
Resolves: rhbz#2130170
- Allow targetclid to manage tmp files
Resolves: rhbz#2127408
- Allow sbd the sys_ptrace capability
Resolves: rhbz#2124695
 2022-10-14 11:51:22 +02:00
Zdenek Pytela
da1accb7ff * Thu Sep 08 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.43-1 
- Update rhcd policy for executing additional commands 5
Resolves: rhbz#2119351
- Update rhcd policy for executing additional commands 4
Resolves: rhbz#2119351
- Allow rhcd create rpm hawkey logs with correct label
Resolves: rhbz#2119351
- Update rhcd policy for executing additional commands 3
Resolves: rhbz#2119351
- Allow sssd to set samba setting
Resolves: rhbz#2121125
- Allow journalctl read rhcd fifo files
Resolves: rhbz#2119351
- Update insights-client policy for additional commands execution 5
Resolves: rhbz#2121125
- Confine insights-client systemd unit
Resolves: rhbz#2121125
- Update insights-client policy for additional commands execution 4
Resolves: rhbz#2121125
- Update insights-client policy for additional commands execution 3
Resolves: rhbz#2121125
- Allow rhcd execute all executables
Resolves: rhbz#2119351
- Update rhcd policy for executing additional commands 2
Resolves: rhbz#2119351
- Update insights-client policy for additional commands execution 2
Resolves: rhbz#2121125
 2022-09-08 19:13:31 +02:00
Zdenek Pytela
781039be23 * Mon Aug 29 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.42-1 
- Label /var/log/rhc-worker-playbook with rhcd_var_log_t
Resolves: rhbz#2119351
- Update insights-client policy (auditctl, gpg, journal)
Resolves: rhbz#2107363
 2022-08-29 15:12:23 +02:00
Nikola Knazekova
d1c3472797 * Thu Aug 25 2022 Nikola Knazekova <nknazeko@redhat.com> - 34.1.41-1 
- Allow unconfined domains to bpf all other domains
Resolves: RHBZ#2112014
- Allow stalld get and set scheduling policy of all domains.
Resolves: rhbz#2105038
- Allow unconfined_t transition to targetclid_home_t
Resolves: RHBZ#2106360
- Allow samba-bgqd to read a printer list
Resolves: rhbz#2118977
- Allow system_dbusd ioctl kernel with a unix stream sockets
Resolves: rhbz#2085392
- Allow chronyd bind UDP sockets to ptp_event ports.
Resolves: RHBZ#2118631
- Update tor_bind_all_unreserved_ports interface
Resolves: RHBZ#2089486
- Remove permissive domain for rhcd_t
Resolves: rhbz#2119351
- Allow unconfined and sysadm users transition for /root/.gnupg
Resolves: rhbz#2121125
- Add gpg_filetrans_admin_home_content() interface
Resolves: rhbz#2121125
- Update rhcd policy for executing additional commands
Resolves: rhbz#2119351
- Update insights-client policy for additional commands execution
Resolves: rhbz#2119507
- Add rpm setattr db files macro
Resolves: rhbz#2119507
- Add userdom_view_all_users_keys() interface
Resolves: rhbz#2119507
- Allow gpg read and write generic pty type
Resolves: rhbz#2119507
- Allow chronyc read and write generic pty type
Resolves: rhbz#2119507
 2022-08-25 18:10:43 +02:00
Nikola Knazekova
0fcafaead6 Update POLICYCOREUTILSVER to 3.4-1 
Resolves: rhbz#2095688
 2022-08-25 17:10:53 +02:00
Nikola Knazekova
48cb3e3e93 * Wed Aug 10 2022 Nikola Knazekova <nknazeko@redhat.com> - 34.1.40-1 
- Allow systemd-modules-load write to /dev/kmsg and send a message to syslogd
Resolves: RHBZ#2088257
- Allow systemd_hostnamed label /run/systemd/* as hostnamed_etc_t
Resolves: RHBZ#1976684
- Allow samba-bgqd get a printer list
Resolves: rhbz#2112395
- Allow networkmanager to signal unconfined process
Resolves: RHBZ#2074414
- Update NetworkManager-dispatcher policy
Resolves: RHBZ#2101910
- Allow openvswitch search tracefs dirs
Resolves: rhbz#1988164
- Allow openvswitch use its private tmpfs files and dirs
Resolves: rhbz#1988164
- Allow openvswitch fsetid capability
Resolves: rhbz#1988164
 2022-08-10 17:49:53 +02:00
Nikola Knazekova
3bda17335b * Tue Aug 02 2022 Nikola Knazekova <nknazeko@redhat.com> - 34.1.39-1 
- Add support for systemd-network-generator
Resolves: RHBZ#2111069
- Allow systemd work with install_t unix stream sockets
Resolves: rhbz#2111206
- Allow sa-update to get init status and start systemd files
Resolves: RHBZ#2061844
 2022-08-02 23:00:38 +02:00
Nikola Knazekova
91720b42e6 * Fri Jul 15 2022 Nikola Knazekova <nknazeko@redhat.com> - 34.1.38-1 
- Allow some domains use sd_notify()
Resolves: rhbz#2056565
- Revert "Allow rabbitmq to use systemd notify"
Resolves: rhbz#2056565
- Update winbind_rpcd_t
Resolves: rhbz#2102084
- Update chronyd_pid_filetrans() to allow create dirs
Resolves: rhbz#2101910
- Allow keepalived read the contents of the sysfs filesystem
Resolves: rhbz#2098130
- Define LIBSEPOL version 3.4-1
Resolves: rhbz#2095688
 2022-07-15 16:25:14 +02:00
Nikola Knazekova
1478384cd2 Define LIBSEPOL version 3.4-1 
Resolves: rhbz#2095688
 2022-07-15 09:46:27 +02:00
Zdenek Pytela
ab0fff6428 * Wed Jun 29 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.37-1 
- Allow targetclid read /var/target files
Resolves: rhbz#2020169
- Update samba-dcerpcd policy for kerberos usage 2
Resolves: rhbz#2096521
- Allow samba-dcerpcd work with sssd
Resolves: rhbz#2096521
- Allow stalld set scheduling policy of kernel threads
Resolves: rhbz#2102224
 2022-06-29 16:10:16 +02:00
Zdenek Pytela
8d1d780d0b * Tue Jun 28 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.36-1 
- Allow targetclid read generic SSL certificates (fixed)
Resolves: rhbz#2020169
- Fix file context pattern for /var/target
Resolves: rhbz#2020169
- Use insights_client_etc_t in insights_search_config()
Resolves: rhbz#1965013
 2022-06-28 19:30:35 +02:00
Zdenek Pytela
64a29f1839 * Fri Jun 24 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.35-1 
-Add the corecmd_watch_bin_dirs() interface
Resolves: rhbz#1965013
- Update rhcd policy
Resolves: rhbz#1965013
- Allow rhcd search insights configuration directories
Resolves: rhbz#1965013
- Add the kernel_read_proc_files() interface
Resolves: rhbz#1965013
- Update insights_client_filetrans_named_content()
Resolves: rhbz#2081425
- Allow transition to insights_client named content
Resolves: rhbz#2081425
- Add the insights_client_filetrans_named_content() interface
Resolves: rhbz#2081425
- Update policy for insights-client to run additional commands 3
Resolves: rhbz#2081425
- Allow insights-client execute its private memfd: objects
Resolves: rhbz#2081425
- Update policy for insights-client to run additional commands 2
Resolves: rhbz#2081425
- Use insights_client_tmp_t instead of insights_client_var_tmp_t
Resolves: rhbz#2081425
- Change space indentation to tab in insights-client
Resolves: rhbz#2081425
- Use socket permissions sets in insights-client
Resolves: rhbz#2081425
- Update policy for insights-client to run additional commands
Resolves: rhbz#2081425
- Allow init_t to rw insights_client unnamed pipe
Resolves: rhbz#2081425
- Fix insights client
Resolves: rhbz#2081425
- Update kernel_read_unix_sysctls() for sysctl_net_unix_t handling
Resolves: rhbz#2081425
- Do not let system_cronjob_t create redhat-access-insights.log with var_log_t
Resolves: rhbz#2081425
- Allow stalld get scheduling policy of kernel threads
Resolves: rhbz#2096776
- Update samba-dcerpcd policy for kerberos usage
Resolves: rhbz#2096521
- Allow winbind_rpcd_t connect to self over a unix_stream_socket
Resolves: rhbz#2096255
- Allow dlm_controld send a null signal to a cluster daemon
Resolves: rhbz#2095884
- Allow dhclient manage pid files used by chronyd
The chronyd_manage_pid_files() interface was added.
- Resolves: rhbz#2094155
Allow install_t nnp_domtrans to setfiles_mac_t
- Resolves: rhbz#2073010
- Allow rabbitmq to use systemd notify
Resolves: rhbz#2056565
- Allow ksmctl create hardware state information files
Resolves: rhbz#2021131
- Label /var/target with targetd_var_t
Resolves: rhbz#2020169
- Allow targetclid read generic SSL certificates
Resolves: rhbz#2020169
 2022-06-24 23:45:04 +02:00
Zdenek Pytela
14f9935fa0 * Thu Jun 09 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.34-1 
- Allow stalld setsched and sys_nice
Resolves: rhbz#2092864
- Allow rhsmcertd to create cache file in /var/cache/cloud-what
Resolves: rhbz#2092333
- Update policy for samba-dcerpcd
Resolves: rhbz#2083509
- Add support for samba-dcerpcd
Resolves: rhbz#2083509
- Allow rabbitmq to access its private memfd: objects
Resolves: rhbz#2056565
- Confine targetcli
Resolves: rhbz#2020169
- Add policy for wireguard
Resolves: 1964862
- Label /var/cache/insights with insights_client_cache_t
Resolves: rhbz#2062136
- Allow ctdbd nlmsg_read on netlink_tcpdiag_socket
Resolves: rhbz#2094489
- Allow auditd_t noatsecure for a transition to audisp_remote_t
Resolves: rhbz#2081907
 2022-06-09 16:26:59 +02:00
Petr Lautrbach
1cc1f4ddfc Connect triggerin to pcre2 instead of pcre 
Resolves: rhbz#2090269
 2022-06-09 16:11:31 +02:00
Zdenek Pytela
b3c14aca87 * Fri May 27 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.33-1 
- Allow insights-client manage gpg admin home content
Resolves: rhbz#2062136
- Add the gpg_manage_admin_home_content() interface
Resolves: rhbz#2062136
- Add rhcd policy
Resolves: bz#1965013
- Allow svirt connectto virtlogd
Resolves: rhbz#2000881
- Add ksm service to ksmtuned
Resolves: rhbz#2021131
- Allow nm-privhelper setsched permission and send system logs
Resolves: rhbz#2053639
- Update the policy for systemd-journal-upload
Resolves: rhbz#2085369
- Allow systemd-journal-upload watch logs and journal
Resolves: rhbz#2085369
- Create a policy for systemd-journal-upload
Resolves: rhbz#2085369
- Allow insights-client create and use unix_dgram_socket
Resolves: rhbz#2087765
- Allow insights-client search gconf homedir
Resolves: rhbz#2087765
 2022-05-27 17:19:07 +02:00
Zdenek Pytela
29a520ae24 * Wed May 11 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.32-1 
- Dontaudit guest attempts to dbus chat with systemd domains
Resolves: rhbz#2062740
- Dontaudit guest attempts to dbus chat with system bus types
Resolves: rhbz#2062740
- Fix users for SELinux userspace 3.4
Resolves: rhbz#2079290
- Removed adding to attribute unpriv_userdomain from userdom_unpriv_type template
Resolves: rhbz#2076681
- Allow systemd-sleep get removable devices attributes
Resolves: rhbz#2082404
- Allow systemd-sleep tlp_filetrans_named_content()
Resolves: rhbz#2082404
- Allow systemd-sleep execute generic programs
Resolves: rhbz#2082404
- Allow systemd-sleep execute shell
Resolves: rhbz#2082404
- Allow systemd-sleep transition to sysstat_t
Resolves: rhbz#2082404
- Allow systemd-sleep transition to tlp_t
Resolves: rhbz#2082404
- Allow systemd-sleep transition to unconfined_service_t on bin_t executables
Resolves: rhbz#2082404
- allow systemd-sleep to set timer for suspend-then-hibernate
Resolves: rhbz#2082404
- Add default fc specifications for patterns in /opt
Resolves: rhbz#2081059
- Use a named transition in systemd_hwdb_manage_config()
Resolves: rhbz#2061725
 2022-05-11 20:55:03 +02:00
Nikola Knazekova
5fd82ec867 * Wed May 04 2022 Nikola Knazekova <nknazeko@redhat.com> - 34.1.31-2 
- Remove letter v from version
Related: rhbz#2061680
 2022-05-04 10:53:54 +02:00
Nikola Knazekova
e67d11e38d Mon May 02 2022 Nikola Knazekova <nknazeko@redhat.com> - v34.1.31-1 
- Label /var/run/machine-id as machineid_t
Resolves: rhbz#2061680
- Allow insights-client create_socket_perms for tcp/udp sockets
Resolves: rhbz#2077377
- Allow insights-client read rhnsd config files
Resolves: rhbz#2077377
- Allow rngd drop privileges via setuid/setgid/setcap
Resolves: rhbz#2076642
- Allow tmpreaper the sys_ptrace userns capability
Resolves: rhbz#2062823
- Add stalld to modules.conf
Resolves: rhbz#2042614
- New policy for stalld
Resolves: rhbz#2042614
- Label new utility of NetworkManager nm-priv-helper
Resolves: rhbz#2053639
- Exclude container.if from selinux-policy-devel
Resolves: rhbz#1861968
 2022-05-02 14:19:14 +02:00
Nikola Knazekova
d5d18f13f7 Exclude container.if from selinux-policy-devel 
The container-selinux has been separated from selinux-policy,
but selinux-policy still contains the interface in selinux-policy-devel
subpackage, which can result in errors like

  $ make -f /usr/share/selinux/devel/Makefile init_t_audit_control.pp
/usr/share/selinux/devel/include/services/container.if:13:
Error: duplicate definition of container_runtime_domtrans(). Original definition on 13.

These errors are harmless as long as the content is the same, but
not packaging the interface in selinux-policy can entirely prevent these
errors from appearing.

Resolves: rhbz#2055890
 2022-05-02 13:59:29 +02:00
Zdenek Pytela
98a41b6a2c * Tue Apr 19 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.30-2 
- Update source branches to build a new package for RHEL 9.1.0
Resolves: rhbz#2070982
 2022-04-19 18:47:26 +02:00
Nikola Knazekova
5d8c009a98 Tue Apr 12 2022 Nikola Knazekova <nknazeko@redhat.com> - 34.1.30-1 
- Allow administrative users the bpf capability
Resolves: RHBZ#2070982

- Allow NetworkManager talk with unconfined user over unix domain dgram socket
Resolves: rhbz#2064688

- Allow hostapd talk with unconfined user over unix domain dgram socket
Resolves: rhbz#2064688

- Allow fprintd read and write hardware state information
Resolves: rhbz#2062911

- Allow fenced read kerberos key tables
Resolves: RHBZ#2060722

- Allow init watch and watch_reads user ttys
Resolves: rhbz#2060289

- Allow systemd watch and watch_reads console devices
Resolves: rhbz#2060289

- Allow nmap create and use rdma socket
Resolves: RHBZ#2059603
 2022-04-13 16:04:11 +02:00
Zdenek Pytela
d16a3024e0 * Thu Mar 31 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.29-1 
- Allow qemu-kvm create and use netlink rdma sockets
Resolves: rhbz#2070569
- Label corosync-cfgtool with cluster_exec_t
Resolves: rhbz#2067501
 2022-04-11 11:32:30 +02:00
Zdenek Pytela
cab4d847c2 * Thu Mar 24 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.28-1 
- Allow logrotate a domain transition to cluster administrative domain
Resolves: rhbz#2061277
- Change the selinuxuser_execstack boolean value to true
Resolves: rhbz#2064274
 2022-04-07 12:24:20 +02:00
Zdenek Pytela
f60c51e134 * Thu Feb 24 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.27-1 
- Allow ModemManager connect to the unconfined user domain
Resolves: rhbz#2000196
- Label /dev/wwan.+ with modem_manager_t
Resolves: rhbz#2000196
- Allow systemd-coredump userns capabilities and root mounton
Resolves: rhbz#2057435
- Allow systemd-coredump read and write usermodehelper state
Resolves: rhbz#2057435
- Allow sysadm_passwd_t to relabel passwd and group files
Resolves: rhbz#2053458
- Allow systemd-sysctl read the security state information
Resolves: rhbz#2056999
- Remove unnecessary /etc file transitions for insights-client
Resolves: rhbz#2055823
- Label all content in /var/lib/insights with insights_client_var_lib_t
Resolves: rhbz#2055823
- Update insights-client policy
Resolves: rhbz#2055823
- Update insights-client: fc pattern, motd, writing to etc
Resolves: rhbz#2055823
- Update specfile to buildrequire policycoreutils-devel >= 3.3-5
- Add modules_checksum to %files
 2022-02-24 15:23:20 +01:00
Zdenek Pytela
8a1fd2d0a4 * Thu Feb 17 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.26-1 
- Remove permissive domain for insights_client_t
Resolves: rhbz#2055823
- New policy for insight-client
Resolves: rhbz#2055823
- Allow confined sysadmin to use tool vipw
Resolves: rhbz#2053458
- Allow chage domtrans to sssd
Resolves: rhbz#2054657
- Remove label for /usr/sbin/bgpd
Resolves: rhbz#2055578
- Dontaudit pkcsslotd sys_admin capability
Resolves: rhbz#2055639
- Do not change selinuxuser_execmod and selinuxuser_execstack
Resolves: rhbz#2055822
- Allow tuned to read rhsmcertd config files
Resolves: rhbz#2055823
 2022-02-17 22:30:58 +01:00
Zdenek Pytela
34edc3e97a * Mon Feb 14 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.25-1 
- Allow systemd watch unallocated ttys
Resolves: rhbz#2054150
- Allow alsa bind mixer controls to led triggers
Resolves: rhbz#2049732
- Allow alsactl set group Process ID of a process
Resolves: rhbz#2049732
- Allow unconfined to run virtd bpf
Resolves: rhbz#2033504
 2022-02-14 15:33:14 +01:00
Zdenek Pytela
93570f083c * Fri Feb 04 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.24-1 
- Allow tumblerd write to session_dbusd tmp socket files
Resolves: rhbz#2000039
- Allow login_userdomain write to session_dbusd tmp socket files
Resolves: rhbz#2000039
- Allow login_userdomain create session_dbusd tmp socket files
Resolves: rhbz#2000039
- Allow gkeyringd_domain write to session_dbusd tmp socket files
Resolves: rhbz#2000039
- Allow systemd-logind delete session_dbusd tmp socket files
Resolves: rhbz#2000039
- Allow gdm-x-session write to session dbus tmp sock files
Resolves: rhbz#2000039
- Allow sysadm_t nnp_domtrans to systemd_tmpfiles_t
Resolves: rhbz#2039453
- Label exFAT utilities at /usr/sbin
Resolves: rhbz#1972225
 2022-02-04 17:43:05 +01:00
Zdenek Pytela
4d21d7d728 * Wed Feb 02 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.23-1 
- Allow systemd nnp_transition to login_userdomain
Resolves: rhbz#2039453
- Label /var/run/user/%{USERID}/dbus with session_dbusd_tmp_t
Resolves: rhbz#2000039
- Change /run/user/[0-9]+ to /run/user/%{USERID} for proper labeling
Resolves: rhbz#2000039
- Allow scripts to enter LUKS password
Resolves: rhbz#2048521
- Allow system_mail_t read inherited apache system content rw files
Resolves: rhbz#2049372
- Add apache_read_inherited_sys_content_rw_files() interface
Related: rhbz#2049372
- Allow sanlock get attributes of filesystems with extended attributes
Resolves: rhbz#2047811
- Associate stratisd_data_t with device filesystem
Resolves: rhbz#2039974
- Allow init read stratis data symlinks
Resolves: rhbz#2039974
- Label /run/stratisd with stratisd_var_run_t
Resolves: rhbz#2039974
- Allow domtrans to sssd_t and role access to sssd
Resolves: rhbz#2039757
- Creating interface sssd_run_sssd()
Resolves: rhbz#2039757
- Fix badly indented used interfaces
Resolves: rhbz#2039757
- Allow domain transition to sssd_t
Resolves: rhbz#2039757
- Label /dev/nvme-fabrics with fixed_disk_device_t
Resolves: rhbz#2039759
- Allow local_login_t nnp_transition to login_userdomain
Resolves: rhbz#2039453
- Allow xdm_t nnp_transition to login_userdomain
Resolves: rhbz#2039453
- Make cupsd_lpd_t a daemon
Resolves: rhbz#2039449
- Label utilities for exFAT filesystems with fsadm_exec_t
Resolves: rhbz#1972225
- Dontaudit sfcbd sys_ptrace cap_userns
Resolves: rhbz#2040311
 2022-02-02 21:35:46 +01:00
Zdenek Pytela
c264d943f0 * Tue Jan 11 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.22-1 
- Allow sshd read filesystem sysctl files
Resolves: rhbz#2036585
- Revert "Allow sshd read sysctl files"
Resolves: rhbz#2036585
 2022-01-11 16:16:07 +01:00
Zdenek Pytela
38bdf8abba * Mon Jan 10 2022 Zdenek Pytela <zpytela@redhat.com> - 34.1.21-1 
- Remove the lockdown class from the policy
Resolves: rhbz#2017848
- Revert "define lockdown class and access"
Resolves: rhbz#2017848
- Allow gssproxy access to various system files.
Resolves: rhbz#2026974
- Allow gssproxy read, write, and map ica tmpfs files
Resolves: rhbz#2026974
- Allow gssproxy read and write z90crypt device
Resolves: rhbz#2026974
- Allow sssd_kcm read and write z90crypt device
Resolves: rhbz#2026974
- Allow abrt_domain read and write z90crypt device
Resolves: rhbz#2026974
- Allow NetworkManager read and write z90crypt device
Resolves: rhbz#2026974
- Allow smbcontrol read the network state information
Resolves: rhbz#2038157
- Allow virt_domain map vhost devices
Resolves: rhbz#2035702
- Allow fcoemon request the kernel to load a module
Resolves: rhbz#2034463
- Allow lldpd connect to snmpd with a unix domain stream socket
Resolves: rhbz#2033315
- Allow ModemManager create a qipcrtr socket
Resolves: rhbz#2036582
- Allow ModemManager request to load a kernel module
Resolves: rhbz#2036582
- Allow sshd read sysctl files
Resolves: rhbz#2036585
 2022-01-10 21:09:15 +01:00
Zdenek Pytela
6bc3bd6ac4 * Wed Dec 15 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.20-1 
- Allow dnsmasq watch /etc/dnsmasq.d directories
Resolves: rhbz#2029866
- Label /usr/lib/pcs/pcs_snmp_agent with cluster_exec_t
Resolves: rhbz#2029316
- Allow lldpd use an snmp subagent over a tcp socket
Resolves: rhbz#2028561
- Allow smbcontrol use additional socket types
Resolves: rhbz#2027751
- Add write permisson to userfaultfd_anon_inode_perms
Resolves: rhbz#2027660
- Allow xdm_t watch generic directories in /lib
Resolves: rhbz#1960010
- Allow xdm_t watch fonts directories
Resolves: rhbz#1960010
- Label /dev/ngXnY and /dev/nvme-subsysX with fixed_disk_device_t
Resolves: rhbz#2027994
- Add hwtracing_device_t type for hardware-level tracing and debugging
Resolves: rhbz#2029392
- Change dev_getattr_infiniband_dev() to use getattr_chr_files_pattern()
Resolves: rhbz#2028791
- Allow arpwatch get attributes of infiniband_device_t devices
Resolves: rhbz#2028791
- Allow tcpdump and nmap get attributes of infiniband_device_t
Resolves: rhbz#2028791
 2021-12-15 17:27:25 +01:00
Zdenek Pytela
470eea63e8 * Mon Nov 29 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.19-1 
- Allow redis get attributes of filesystems with extended attributes
Resolves: rhbz#2014611
- Allow dirsrv read slapd tmpfs files
Resolves: rhbz#2015928
- Revert "Label /dev/shm/dirsrv/ with dirsrv_tmpfs_t label"
Resolves: rhbz#2015928
- Allow login_userdomain open/read/map system journal
Resolves: rhbz#2017838
- Allow login_userdomain read and map /var/lib/systemd files
Resolves: rhbz#2017838
- Allow nftables read NetworkManager unnamed pipes
Resolves: rhbz#2023456
- Allow xdm watch generic directories in /var/lib
Resolves: rhbz#1960010
- Allow xdm_t watch generic pid directories
Resolves: rhbz#1960010
 2021-11-29 15:31:44 +01:00
Zdenek Pytela
89586f9eb1 * Mon Nov 01 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.18-1 
- Allow fetchmail search cgroup directories
Resolves: rhbz#2015118
- Add the auth_read_passwd_file() interface
Resolves: rhbz#2014611
- Allow redis-sentinel execute a notification script
Resolves: rhbz#2014611
- Support new PING_CHECK health checker in keepalived
Resolves: rhbz#2014423
 2021-11-01 11:51:58 +01:00
Zdenek Pytela
16d5820b15 * Thu Oct 14 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.17-1 
- Label /usr/sbin/virtproxyd as virtd_exec_t
Resolves: rhbz#2002143
- Allow at-spi-bus-launcher read and map xdm pid files
Resolves: rhbz#2011772
- Remove references to init_watch_path_type attribute
Resolves: rhbz#2007960
- Remove all redundant watch permissions for systemd
Resolves: rhbz#2007960
- Allow systemd watch non_security_file_type dirs, files, lnk_files
Resolves: rhbz#2007960
- Allow systemd-resolved watch /run/systemd
Resolves: rhbz#1992461
- Allow sssd watch /run/systemd
Resolves: rhbz#1992461
 2021-10-14 09:46:11 +02:00
Zdenek Pytela
5ad9abab43 * Thu Sep 23 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.16-1 
- Allow fprintd install a sleep delay inhibitor
Resolves: rhbz#1999537
- Update mount_manage_pid_files() to use manage_files_pattern
Resolves: rhbz#1999997
- Allow gnome at-spi processes create and use stream sockets
Resolves: rhbz#2004885
- Allow haproxy list the sysfs directories content
Resolves: rhbz#1986823
- Allow virtlogd_t read process state of user domains
Resolves: rhbz#1994592
- Support hitless reloads feature in haproxy
Resolves: rhbz#1997182
- Allow firewalld load kernel modules
Resolves: rhbz#1999152
- Allow communication between at-spi and gdm processes
Resolves: rhbz#2003037
 2021-09-24 09:21:09 +02:00
Zdenek Pytela
ddedf0d0b5 * Mon Aug 30 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.15-1 
- Update ica_filetrans_named_content() with create_file_perms
Resolves: rhbz#1976180
- Allow various domains work with ICA crypto accelerator
Resolves: rhbz#1976180
- Add ica module
Resolves: rhbz#1976180
- Revert "Support using ICA crypto accelerator on s390x arch"
Resolves: rhbz#1976180
- Fix the gnome_atspi_domtrans() interface summary
Resolves: rhbz#1972655
- Add support for at-spi
Resolves: rhbz#1972655
- Add permissions for system dbus processes
Resolves: rhbz#1972655
- Allow /tmp file transition for dbus-daemon also for sock_file
Resolves: rhbz#1972655
 2021-08-30 16:13:54 +02:00
Zdenek Pytela
b42446e02d * Wed Aug 25 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.14-1 
- Support using ICA crypto accelerator on s390x arch
Resolves: rhbz#1976180
- Allow systemd delete /run/systemd/default-hostname
Resolves: rhbz#1978507
- Label /usr/bin/Xwayland with xserver_exec_t
Resolves: rhbz#1993151
- Label /usr/libexec/gdm-runtime-config with xdm_exec_t
Resolves: rhbz#1993151
- Allow tcpdump read system state information in /proc
Resolves: rhbz#1972577
- Allow firewalld drop capabilities
Resolves: rhbz#1989641
 2021-08-25 18:48:38 +02:00
Zdenek Pytela
cf60736fb6 * Thu Aug 12 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.13-1 
- Add "/" at the beginning of dev/shm/var\.lib\.opencryptoki.* regexp
Resolves: rhbz#1977915
- Set default file context for /sys/firmware/efi/efivars
Resolves: rhbz#1972372
- Allow tcpdump run as a systemd service
Resolves: rhbz#1972577
- Allow nmap create and use netlink generic socket
Resolves: rhbz#1985212
- Allow nscd watch system db files in /var/db
Resolves: rhbz#1989416
- Allow systemd-gpt-auto-generator read udev pid files
Resolves: rhbz#1992638
 2021-08-12 16:15:32 +02:00
Zdenek Pytela
991febef9c * Tue Aug 10 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.12-1 
- Revert "update libs_filetrans_named_content() to have support for /usr/lib/debug directory"
Resolves: rhbz#1990813
- Label /dev/crypto/nx-gzip with accelerator_device_t
Resolves: rhbz#1973953
- Label /usr/bin/qemu-storage-daemon with virtd_exec_t
Resolves: rhbz#1977245
- Allow systemd-machined stop generic service units
Resolves: rhbz#1979522
- Label /.k5identity file allow read of this file to rpc.gssd
Resolves: rhbz#1980610
 2021-08-10 16:28:03 +02:00
Mohan Boddu
57b195c83b Rebuilt for IMA sigs, glibc 2.34, aarch64 flags 
Related: rhbz#1991688
Signed-off-by: Mohan Boddu <mboddu@redhat.com>
 2021-08-10 00:49:40 +00:00
Zdenek Pytela
4548b66f2e * Thu Jul 29 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.11-1 
- Allow hostapd bind UDP sockets to the dhcpd port
Resolves: rhbz#1979968
- Allow mdadm read iscsi pid files
Resolves: rhbz#1976073
- Unconfined domains should not be confined
Resolves: rhbz#1977986
- Allow NetworkManager_t to watch /etc
Resolves: rhbz#1980000
- Allow using opencryptoki for ipsec
Resolves: rhbz#1977915
 2021-07-29 17:11:36 +02:00
Zdenek Pytela
c0ea3a13a7 * Wed Jul 14 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.10-1 
- Allow bacula get attributes of cgroup filesystems
Resolves: rhbz#1976917
- Label /dev/wmi/dell-smbios as acpi_device_t
Resolves: rhbz#1972382
- Add the lockdown integrity permission to dev_map_userio_dev()
Resolves: rhbz#1966758
- Allow virtlogd_t to create virt_var_lockd_t dir
Resolves: rhbz#1974875
 2021-07-14 16:11:07 +02:00
Zdenek Pytela
37bcc175cd * Tue Jun 22 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.9-1 
- Allow systemd-coredump getattr nsfs files and net_admin capability
Resolves: rhbz#1965372
- Label /run/libvirt/common with virt_common_var_run_t
Resolves: rhbz#1969209
- Label /usr/bin/arping plain file with netutils_exec_t
Resolves: rhbz#1952515
- Make usbmuxd_t a daemon
Resolves: rhbz#1965411
- Allow usbmuxd get attributes of cgroup filesystems
Resolves: rhbz#1965411
- Label /dev/dma_heap/* char devices with dma_device_t
- Revert "Label /dev/dma_heap/* char devices with dma_device_t"
- Revert "Label /dev/dma_heap with dma_device_dir_t"
- Revert "Associate dma_device_dir_t with device filesystem"
Resolves: rhbz#1967818
- Label /var/lib/kdump with kdump_var_lib_t
Resolves: rhbz#1965989
- Allow systemd-timedated watch runtime dir and its parent
Resolves: rhbz#1970865
- Label /run/fsck with fsadm_var_run_t
Resolves: rhbz#1970911
 2021-06-22 14:41:30 +02:00
Zdenek Pytela
042fffd52c * Thu Jun 10 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.8-1 
- Associate dma_device_dir_t with device filesystem
Resolves: rhbz#1954116
- Add default file context specification for dnf log files
Resolves: rhbz#1955223
- Allow using opencryptoki for certmonger
Resolves: rhbz#1961756
- Label var.lib.opencryptoki.* files and create pkcs_tmpfs_filetrans()
Resolves: rhbz#1961756
- Allow httpd_sys_script_t read, write, and map hugetlbfs files
Resolves: rhbz#1964890
- Dontaudit daemon open and read init_t file
Resolves: rhbz#1965412
- Allow sanlock get attributes of cgroup filesystems
Resolves: rhbz#1965217
 2021-06-10 23:07:44 +02:00
Zdenek Pytela
5d2a514c72 * Tue Jun 08 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.7-1 
- Set default file context for /var/run/systemd instead of /run/systemd
Resolves: rhbz#1966492
 2021-06-08 19:26:12 +02:00
Zdenek Pytela
a0031a1fc3 * Mon Jun 07 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.6-1 
- Label /dev/dma_heap with dma_device_dir_t
Resolves: rhbz#1954116
- Allow pkcs-slotd create and use netlink_kobject_uevent_socket
Resolves: rhbz#1963252
- Label /run/systemd/default-hostname with hostname_etc_t
Resolves: rhbz#1966492
 2021-06-07 16:34:34 +02:00
Zdenek Pytela
14a2757535 * Thu May 27 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.5-1 
- Label /dev/trng with random_device_t
Resolves: rhbz#1962260
- Label /dev/zram[0-9]+ block device files with fixed_disk_device_t
Resolves: rhbz#1954116
- Label /dev/udmabuf character device with dma_device_t
Resolves: rhbz#1954116
- Label /dev/dma_heap/* char devices with dma_device_t
Resolves: rhbz#1954116
- Label /dev/acpi_thermal_rel char device with acpi_device_t
Resolves: rhbz#1954116
- Allow fcoemon create sysfs files
Resolves: rhbz#1952292
 2021-05-27 14:57:41 +02:00
Zdenek Pytela
61280fbdd0 * Wed May 12 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.4-1 
- Allow sysadm_t dbus chat with tuned
Resolves: rhbz#1953643
- Allow tuned write profile files with file transition
Resolves: rhbz#1953643
- Allow tuned manage perf_events
Resolves: rhbz#1953643
- Make domains use kernel_write_perf_event() and kernel_manage_perf_event()
Resolves: rhbz#1953643
- Add kernel_write_perf_event() and kernel_manage_perf_event()
Resolves: rhbz#1953643
- Allow syslogd_t watch root and var directories
Resolves: rhbz#1957792
- Allow tgtd create and use rdma socket
Resolves: rhbz#1955559
- Allow aide connect to init with a unix socket
Resolves: rhbz#1926343
 2021-05-12 15:45:13 +02:00
Zdenek Pytela
997ca10921 * Wed Apr 28 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.3-1 
- Allow domain create anonymous inodes
Resolves: rhbz#1954145
- Add anon_inode class to the policy
Resolves: rhbz#1954145
- Allow pluto IKEv2 / ESP over TCP
Resolves: rhbz#1951471
- Add brltty new permissions required by new upstream version
Resolves: rhbz#1947842
- Label /var/lib/brltty with brltty_var_lib_t
Resolves: rhbz#1947842
- Allow login_userdomain create cgroup files
Resolves: rhbz#1951114
- Allow aide connect to systemd-userdbd with a unix socket
Resolves: rhbz#1926343
- Allow cups-lpd read its private runtime socket files
Resolves: rhbz#1947397
- Label /etc/redis as redis_conf_t
Resolves: rhbz#1947874
- Add file context specification for /usr/libexec/realmd
Resolves: rhbz#1946495
 2021-04-28 15:25:09 +02:00
Zdenek Pytela
d48e2527dc * Thu Apr 22 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.2-1 
- Further update make-rhat-patches.sh for RHEL 9.0 beta
- Add file context specification for /var/tmp/tmp-inst
Resolves: rhbz#1924656
 2021-04-22 13:47:13 +02:00
Zdenek Pytela
40e9a7fb1f * Wed Apr 21 2021 Zdenek Pytela <zpytela@redhat.com> - 34.1.1-1 
- Update selinux-policy.spec and make-rhat-patches.sh for RHEL 9.0 beta
- Allow unconfined_service_t confidentiality and integrity lockdown
Resolves: rhbz#1950267
 2021-04-21 21:27:35 +02:00
Mohan Boddu
b8bce4d7d2 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 
Signed-off-by: Mohan Boddu <mboddu@redhat.com>
 2021-04-16 05:35:15 +00:00
DistroBaker
0c7d2cb554 Merged update from upstream sources 
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/selinux-policy.git#b599883a670d1bbd3ee0d8a4386b917f0ba3781d
 2021-04-04 19:30:25 +00:00
DistroBaker
e671ae4028 Merged update from upstream sources 
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/selinux-policy.git#9e9c1b67b363a55618c218f648491cd9c4830e8d
 2021-03-31 18:45:22 +00:00
DistroBaker
ba2607aba9 Merged update from upstream sources 
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/selinux-policy.git#2b6e9bd08f688cf6ad39a2dbad7531164a22fff5
 2021-03-28 20:10:28 +00:00
DistroBaker
d69f76993a Merged update from upstream sources 
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/selinux-policy.git#8c7a9eaa8cb01c7fbadd4104c2e1cafb819f0a89
 2021-03-15 19:41:15 +00:00
DistroBaker
4508ded93f Merged update from upstream sources 
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/selinux-policy.git#7d544924d94f99f4e8c9ee3c995d131c8c6be206
 2021-02-20 17:32:55 +00:00
DistroBaker
0d835ab10a Merged update from upstream sources 
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/selinux-policy.git#912df6d5ff592ea23f7d034ac8eede8c24c6b985
 2021-02-17 08:17:18 +00:00
DistroBaker
f521412d05 Merged update from upstream sources 
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/selinux-policy.git#ad33d7979e1d6eb8cb76a1176222778f981b4c4e
 2021-02-13 00:52:48 +00:00
DistroBaker
ece0d0b7b5 Merged update from upstream sources 
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/selinux-policy.git#942c59859e64bf268aaf0f161f26fe50d188dc4b
 2021-02-12 06:32:55 +00:00
DistroBaker
eea0ee325a Merged update from upstream sources 
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/selinux-policy.git#c7e90bc1966a5ae10e5353dcd8f6ce95b89a4074
 2021-02-09 04:48:56 +00:00
DistroBaker
8e575c9c13 Merged update from upstream sources 
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/selinux-policy.git#c2d5ebb406c8c797f8649613eea182f482be67fe
 2021-02-05 19:32:49 +00:00
DistroBaker
ed75dbd813 Merged update from upstream sources 
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/selinux-policy.git#f38b38e51ef448ce19c0a0407ad298d3efab23b9
 2021-01-22 10:21:40 +00:00
DistroBaker
0397c4c5ec Merged update from upstream sources 
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/selinux-policy.git#d76e0b4040478d5497587132b1c5aba5af644aed
 2021-01-09 09:21:37 +00:00
DistroBaker
a2fc5fba64 Merged update from upstream sources 
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/selinux-policy.git#d5b79a1cb725b8d95cc6140a4eb965fea7374ece
 2020-12-17 21:38:57 +00:00
DistroBaker
7cee52182d Merged update from upstream sources 
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/selinux-policy.git#fa72125856bf3148d227f294213f8a446fe75cd0
 2020-12-17 03:03:39 +00:00
DistroBaker
14735eb5eb Merged update from upstream sources 
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/selinux-policy.git#e94a380d324949b0fc1f903c7b11c1e44e5fe442
 2020-12-01 19:27:05 +00:00
DistroBaker
cafbcb567e Merged update from upstream sources 
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/selinux-policy.git#595a6449f5abcc3114363c116e7553287deaebee
 2020-11-25 16:25:36 +00:00
Troy Dawson
2fc3743e24 RHEL 9.0.0 Alpha bootstrap 
The content of this branch was automatically imported from Fedora ELN
with the following as its source:
https://src.fedoraproject.org/rpms/selinux-policy#05fb517c90ca63c44475836508d3946a4eb6c232
 2020-11-16 14:01:44 -08:00
DistroBaker
c0c357c156 Merged update from upstream sources 
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/selinux-policy.git#e88945f82ad9e3f5a742fcaf10fe1fa36603c4c2
 2020-11-06 00:43:32 +00:00
DistroBaker
478f57b9e8 Merged update from upstream sources 
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/selinux-policy.git#4da7d1152a950e9266b347d74ef778c0e899c8dc
 2020-10-27 22:21:32 +01:00
Troy Dawson
7975d49f67 RHEL 9.0.0 Alpha bootstrap 
The content of this branch was automatically imported from Fedora ELN
with the following as its source:
https://src.fedoraproject.org/rpms/selinux-policy#fe20768333d6dfa8183364a04e3c4327c8185427
 2020-10-15 09:28:03 -07:00