* Tue Jun 12 2018 Lukas Vrabec <lvrabec@redhat.com> - 3.14.2-24 - /usr/libexec/bluetooth/obexd should have only obexd_exec_t instead of bluetoothd_exec_t type - Allow ntop_t domain to create/map various sockets/files. - Enable the dictd to communicate via D-bus. - Allow inetd_child process to chat via dbus with abrt - Allow zabbix_agent_t domain to connect to redis_port_t - Allow rhsmcertd_t domain to read xenfs_t files - Allow zabbix_agent_t to run zabbix scripts - Fix openvswith SELinux module - Fix wrong path in tlp context file BZ(1586329) - Update brltty SELinux module - Allow rabbitmq_t domain to create own tmp files/dirs - Allow policykit_t mmap policykit_auth_exec_t files - Allow ipmievd_t domain to read general certs - Add sys_ptrace capability to pcp_pmie_t domain - Allow squid domain to exec ldconfig - Update gpg SELinux policy module - Allow mailman_domain to read system network state - Allow openvswitch_t domain to read neutron state and read/write fixed disk devices - Allow antivirus_domain to read all domain system state - Allow targetd_t domain to red gconf_home_t files/dirs - Label /usr/libexec/bluetooth/obexd as obexd_exec_t - Add interface nagios_unconfined_signull() - Fix typos in zabbix.te file - Add missing requires - Allow tomcat domain sends email - Fix typo in sge policy - Merge pull request #214 from wrabcak/fb-dhcpc - Allow dhcpc_t creating own socket files inside /var/run/ Allow dhcpc_t creating netlink_kobject_uevent_socket, netlink_generic_socket, rawip_socket BZ(1585971) - Allow confined users get AFS tokens - Allow sysadm_t domain to chat via dbus - Associate sysctl_kernel_t type with filesystem attribute - Allow syslogd_t domain to send signull to nagios_unconfined_plugin_t - Fix typo in netutils.te file
Lukas Vrabec
2018-06-12 14:22:02 +0200
* Thu Apr 12 2018 Lukas Vrabec <lvrabec@redhat.com> - 3.14.2-13 - refpolicy: Update for kernel sctp support - Allow smbd_t send to nmbd_t via dgram sockets BZ(1563791) - Allow antivirus domain to be client for system dbus BZ(1562457) - Dontaudit requesting tlp_t domain kernel modules, its a kernel bug BZ(1562383) - Add new boolean: colord_use_nfs() BZ(1562818) - Allow pcp_pmcd_t domain to check access to mdadm BZ(1560317) - Allow colord_t to mmap gconf_home_t files - Add new boolean redis_enable_notify() - Label /var/log/shibboleth-www(/.*) as httpd_sys_rw_content_t - Add new label for vmtools scripts and label it as vmtools_unconfined_t stored in /etc/vmware-tools/ - Remove labeling for /etc/vmware-tools to bin_t it should be vmtools_unconfined_exec_t
Lukas Vrabec
2018-04-12 12:51:18 +0200
* Sat Apr 07 2018 Lukas Vrabec <lvrabec@redhat.com> - 3.14.2-12 - Add new boolean redis_enable_notify() - Label /var/log/shibboleth-www(/.*) as httpd_sys_rw_content_t - Add new label for vmtools scripts and label it as vmtools_unconfined_t stored in /etc/vmware-tools/ - Allow svnserve_t domain to manage kerberos rcache and read krb5 keytab - Add dac_override and dac_read_search capability to hypervvssd_t domain - Label /usr/lib/systemd/systemd-fence_sanlockd as fenced_exec_t - Allow samba to create /tmp/host_0 as krb5_host_rcache_t - Add dac_override capability to fsdaemon_t BZ(1564143) - Allow abrt_t domain to map dos files BZ(1564193) - Add dac_override capability to automount_t domain - Allow keepalived_t domain to connect to system dbus bus - Allow nfsd_t to read nvme block devices BZ(1562554) - Allow lircd_t domain to execute bin_t files BZ(1562835) - Allow l2tpd_t domain to read sssd public files BZ(1563355) - Allow logrotate_t domain to do dac_override BZ(1539327) - Remove labeling for /etc/vmware-tools to bin_t it should be vmtools_unconfined_exec_t - Add capability sys_resource to systemd_sysctl_t domain - Label all /dev/rbd* devices as fixed_disk_device_t - Allow xdm_t domain to mmap xserver_log_t files BZ(1564469) - Allow local_login_t domain to rread udev db - Allow systemd_gpt_generator_t to read /dev/random device - add definition of bpf class and systemd perms
Lukas Vrabec
2018-04-07 20:34:23 +0200
Fedora Atomic host using for temp files /sysroot/tmp patch, we should label same as /tmp adding file context equivalence BZ(1559531)
Lukas Vrabec
2018-03-26 15:47:13 +0200
In Fedora 28, ganesha SELinux module is removed, for proper upgrade this modules needs to be removed before SELinux policy for F28 is installed.
Lukas Vrabec
2018-03-25 00:55:02 +0100
* Thu Mar 15 2018 Lukas Vrabec <lvrabec@redhat.com> - 3.14.2-6 - Allow rpcd_t domain dac override - Allow rpm domain to mmap rpm_var_lib_t files - Allow arpwatch domain to create bluetooth sockets - Allow secadm_t domain to mmap audit config and log files - Update init_abstract_socket_activation() to allow also creating tcp sockets - getty_t should be ranged in MLS. Then also local_login_t runs as ranged domain. - Add SELinux support for systemd-importd - Create new type bpf_t and label /sys/fs/bpf with this type
Lukas Vrabec
2018-03-15 20:41:40 +0100
e9c4389283* Tue Jan 30 2018 Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-4 - rpm: Label /usr/share/rpm usr_t (ostree/Atomic systems) - Update dbus_role_template() BZ(1536218) - Allow lldpad_t domain to mmap own tmpfs files BZ(1534119) - Allow blueman_t dbus chat with policykit_t BZ(1470501) - Expand virt_read_lib_files() interface to allow list dirs with label virt_var_lib_t BZ(1507110) - Allow postfix_master_t and postfix_local_t to connect to system dbus. BZ(1530275) - Allow system_munin_plugin_t domain to read sssd public files and allow stream connect to ssd daemon BZ(1528471) - Allow rkt_t domain to bind on rkt_port_t tcp BZ(1534636) - Allow jetty_t domain to mmap own temp files BZ(1534628) - Allow sslh_t domain to read sssd public files and stream connect to sssd. BZ(1534624) - Consistently label usr_t for kernel/initrd in /usr - kernel/files.fc: Label /usr/lib/sysimage as usr_t - Allow iptables sysctl load list support with SELinux enforced - Label HOME_DIR/.config/systemd/user/* user unit files as systemd_unit_file_t BZ(1531864)
Lukas Vrabec
2018-01-30 12:57:41 +0100
e7bae02f22* Fri Jan 19 2018 Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-3 - Merge pull request #45 from jlebon/pr/rot-sd-dbus-rawhide - Allow virt_domains to acces infiniband pkeys. - Allow systemd to relabelfrom tmpfs_t link files in /var/run/systemd/units/ BZ(1535180) - Label /usr/libexec/ipsec/addconn as ipsec_exec_t to run this script as ipsec_t instead of init_t - Allow audisp_remote_t domain write to files on all levels
Lukas Vrabec
2018-01-19 12:48:25 +0100
72b2cda3a5* Mon Jan 15 2018 Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-2 - Allow aide to mmap usr_t files BZ(1534182) - Allow ypserv_t domain to connect to tcp ports BZ(1534245) - Allow vmtools_t domain creating vmware_log_t files - Allow openvswitch_t domain to acces infiniband devices - Allow dirsrv_t domain to create tmp link files - Allow pcp_pmie_t domain to exec itself. BZ(153326) - Update openvswitch SELinux module - Allow virtd_t to create also sock_files with label virt_var_run_t - Allow chronyc_t domain to manage chronyd_keys_t files. - Allow logwatch to exec journal binaries BZ(1403463) - Allow sysadm_t and staff_t roles to manage user systemd services BZ(1531864) - Update logging_read_all_logs to allow mmap all logfiles BZ(1403463) - Add Label systemd_unit_file_t for /var/run/systemd/units/
Lukas Vrabec
2018-01-15 17:33:37 +0100
22c9764fc4Update new sources to reflect changes related to python3 dependency
Lukas Vrabec
2018-01-08 18:44:57 +0100
51dc83b2d4Commit removes big SELinux policy patches against tresys refpolicy.
Lukas Vrabec
2017-12-24 14:31:11 +0100
b9923641ff* Mon Jan 08 2018 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-310 - Use python3 package in BuildRequires to ensure python version 3 will be used for compiling SELinux policy
Lukas Vrabec
2018-01-08 12:28:09 +0100
af863d8251* Fri Jan 05 2018 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-309 - auth_use_nsswitch() interface cannot be used for attributes fixing munin policy - Allow git_script_t to mmap git_user_content_t files BZ(1530937) - Allow certmonger domain to create temp files BZ(1530795) - Improve interface mock_read_lib_files() to include also symlinks. BZ(1530563) - Allow fsdaemon_t to read nvme devices BZ(1530018) - Dontaudit fsdaemon_t to write to admin homedir. BZ(153030) - Update munin plugin policy BZ(1528471) - Allow sendmail_t domain to be system dbusd client BZ(1478735) - Allow amanda_t domain to getattr on tmpfs filesystem BZ(1527645) - Allow named file transition to create rpmrebuilddb dir with proper SELinux context BZ(1461313) - Dontaudit httpd_passwd_t domain to read state of systemd BZ(1522672) - Allow thumb_t to mmap non security files BZ(1517393) - Allow smbd_t to mmap files with label samba_share_t BZ(1530453) - Fix broken sysnet_filetrans_named_content() interface - Allow init_t to create tcp sockets for unconfined services BZ(1366968) - Allow xdm_t to getattr on xserver_t process files BZ(1506116) - Allow domains which can create resolv.conf file also create it in systemd_resolved_var_run_t dir BZ(1530297) - Allow X userdomains to send dgram msgs to xserver_t BZ(1515967) - Add interface files_map_non_security_files()
Lukas Vrabec
2018-01-05 15:16:17 +0100
46f9f9c36a* Thu Jan 04 2018 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-308 - Make working SELinux sandbox with Wayland. BZ(1474082) - Allow postgrey_t domain to mmap postgrey_spool_t files BZ(1529169) - Allow dspam_t to mmap dspam_rw_content_t files BZ(1528723) - Allow collectd to connect to lmtp_port_t BZ(1304029) - Allow httpd_t to mmap httpd_squirrelmail_t files BZ(1528776) - Allow thumb_t to mmap removable_t files. BZ(1522724) - Allow sssd_t and login_pgm attribute to mmap auth_cache_t files BZ(1530118) - Add interface fs_mmap_removable_files()
Lukas Vrabec
2018-01-04 13:06:00 +0100
d319e75862sandbox SELinux module is part ofd distribution policy and should have 100 priority
Lukas Vrabec
2018-01-04 11:45:11 +0100
73d7285c92* Tue Dec 19 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-307 - Allow crond_t to read pcp lib files BZ(1525420) - Allow mozilla plugin domain to mmap user_home_t files BZ(1452783) - Allow certwatch_t to mmap generic certs. BZ(1527173) - Allow dspam_t to manage dspam_rw_conent_t objects. BZ(1290876) - Add interface userdom_map_user_home_files() - Sytemd introduced new feature when journald(syslogd_t) is trying to read symlinks to unit files in /run/systemd/units. This commit label /run/systemd/units/* as systemd_unit_file_t and allow syslogd_t to read this content. BZ(1527202) - Allow xdm_t dbus chat with modemmanager_t BZ(1526722) - All domains accessing home_cert_t objects should also mmap it. BZ(1519810)
Lukas Vrabec
2017-12-19 16:18:46 +0100
66de8d371dDon't own %{_rpmconfigdir}
Jonathan Lebon
2017-12-14 20:09:54 +0000
270b6479cd* Wed Dec 13 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-306 - Allow thumb_t domain to dosfs_t BZ(1517720) - Allow gssd_t to read realmd_var_lib_t files BZ(1521125) - Allow domain transition from logrotate_t to chronyc_t BZ(1436013) - Allow git_script_t to mmap git_sys_content_t BZ(1517541) - Label /usr/bin/mysqld_safe_helper as mysqld_exec_t instead of bin_t BZ(1464803) - Label /run/openvpn-server/ as openvpn_var_run_t BZ(1478642) - Allow colord_t to mmap xdm pid files BZ(1518382) - Allow arpwatch to mmap usbmon device BZ(152456) - Allow mandb_t to read public sssd files BZ(1514093) - Allow ypbind_t stream connect to rpcbind_t domain BZ(1508659) - Allow qpid to map files. - Allow plymouthd_t to mmap firamebuf device BZ(1517405) - Dontaudit pcp_pmlogger_t to sys_ptrace capability BZ(1416611) - Update mta_manage_spool() interface to allow caller domain also mmap mta_spool_t files BZ(1517449) - Allow antivirus_t domain to mmap antivirus_db_t files BZ(1516816) - Allow cups_pdf_t domain to read cupd_etc_t dirs BZ(1516282) - Allow openvpn_t domain to relabel networkmanager tun device BZ(1436048) - Allow mysqld_t to mmap mysqld_tmp_t files BZ(1516899) - Update samba_manage_var_files() interface by adding map permission. BZ(1517125) - Allow pcp_pmlogger_t domain to execute itself. BZ(1517395) - Dontaudit sys_ptrace capability for mdadm_t BZ(1515849) - Allow pulseaudio_t domain to mmap pulseaudio_home_t files BZ(1515956) - Allow bugzilla_script_t domain to create netlink route sockets and udp sockets BZ(1427019) - Add interface fs_map_dos_files() - Update interface userdom_manage_user_home_content_files() to allow caller domain to mmap user_home_t files. BZ(1519729) - Add interface xserver_map_xdm_pid() BZ(1518382) - Add new interface dev_map_usbmon_dev() BZ(1524256) - Update miscfiles_read_fonts() interface to allow also mmap fonts_cache_t for caller domains BZ(1521137) - Allow ipsec_t to mmap cert_t and home_cert_t files BZ(1519810) - Fix typo in filesystem.if - Add interface dev_map_framebuffer() - Allow chkpwd command to mmap /etc/shadow BZ(1513704) - Fix systemd-resolved to run properly with SELinux in enforcing state BZ(1517529) - Allow thumb_t domain to mmap fusefs_t files BZ(1517517) - Allow userdom_home_reader_type attribute to mmap cifs_t files BZ(1517125) - Add interface fs_map_cifs_files() - Merge pull request #207 from rhatdan/labels - Merge pull request #208 from rhatdan/logdir - Allow domains that manage logfiles to man logdirs
Lukas Vrabec
2017-12-13 08:39:02 +0100
a0b507db50Remove ganesha module from active modules
Lukas Vrabec
2017-12-06 10:11:13 +0100
e55ea9eb7amake-rhat-patches.sh - Ignore submodules when generating diff
Petr Lautrbach
2017-12-06 09:56:06 +0100
617ff7d328* Fri Nov 24 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-305 - Make ganesha nfs server
Lukas Vrabec
2017-11-24 18:20:55 +0100
723bc03d9aAdd new rpm macro %{selinux_requires}
Lukas Vrabec
2017-11-23 15:48:40 +0100
64b72debbe* Tue Nov 21 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-304 - Add interface raid_relabel_mdadm_var_run_content() - Fix iscsi SELinux module - Allow spamc_t domain to read home mail content BZ(1414366) - Allow sendmail_t to list postfix config dirs BZ(1514868) - Allow dovecot_t domain to mmap mail content in homedirs BZ(1513153) - Allow iscsid_t domain to requesting loading kernel modules BZ(1448877) - Allow svirt_t domain to mmap svirt_tmpfs_t files BZ(1515304) - Allow cupsd_t domain to localization BZ(1514350) - Allow antivirus_t nnp domain transition because of systemd security features. BZ(1514451) - Allow tlp_t domain transition to systemd_rfkill_t domain BZ(1416301) - Allow abrt_t domain to mmap fusefs_t files BZ(1515169) - Allow memcached_t domain nnp_transition becuase of systemd security features BZ(1514867) - Allow httpd_t domain to mmap all httpd content type BZ(1514866) - Allow mandb_t to read /etc/passwd BZ(1514903) - Allow mandb_t domain to mmap files with label mandb_cache_t BZ(1514093) - Allow abrt_t domain to mmap files with label syslogd_var_run_t BZ(1514975) - Allow nnp transition for systemd-networkd daemon to run in proper SELinux domain BZ(1507263) - Allow systemd to read/write to mount_var_run_t files BZ(1515373) - Allow systemd to relabel mdadm_var_run_t sock files BZ(1515373) - Allow home managers to mmap nfs_t files BZ(1514372) - Add interface fs_mmap_nfs_files() - Allow systemd-mount to create new directory for mountpoint BZ(1514880) - Allow getty to use usbttys - Add interface systemd_rfkill_domtrans() - Allow syslogd_t to mmap files with label syslogd_var_lib_t BZ(1513403) - Add interface fs_mmap_fusefs_files() - Allow ipsec_t domain to mmap files with label ipsec_key_file_t BZ(1514251)
Lukas Vrabec
2017-11-21 16:42:21 +0100
2d6f40abe4* Thu Nov 16 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-303 - Allow pcp_pmlogger to send logs to journal BZ(1512367) - Merge pull request #40 from lslebodn/kcm_kerberos - Allow services to use kerberos KCM BZ(1512128) - Allow system_mail_t domain to be system_dbus_client BZ(1512476) - Allow aide domain to stream connect to sssd_t BZ(1512500) - Allow squid_t domain to mmap files with label squid_tmpfs_t BZ(1498809) - Allow nsd_t domain to mmap files with labels nsd_tmp_t and nsd_zone_t BZ(1511269) - Include cupsd_config_t domain into cups_execmem boolean. BZ(1417584) - Allow samba_net_t domain to mmap samba_var_t files BZ(1512227) - Allow lircd_t domain to execute shell BZ(1512787) - Allow thumb_t domain to setattr on cache_home_t dirs BZ(1487814) - Allow redis to creating tmp files with own label BZ(1513518) - Create new interface thumb_nnp_domtrans allowing domaintransition with NoNewPrivs. This interface added to thumb_run() BZ(1509502) - Allow httpd_t to mmap httpd_tmp_t files BZ(1502303) - Add map permission to samba_rw_var_files interface. BZ(1513908) - Allow cluster_t domain creating bundles directory with label var_log_t instead of cluster_var_log_t - Add dac_read_search and dac_override capabilities to ganesha - Allow ldap_t domain to manage also slapd_tmp_t lnk files - Allow snapperd_t domain to relabeling from snapperd_data_t BZ(1510584) - Add dac_override capability to dhcpd_t doamin BZ(1510030) - Allow snapperd_t to remove old snaps BZ(1510862) - Allow chkpwd_t domain to mmap system_db_t files and be dbus system client BZ(1513704) - Allow xdm_t send signull to all xserver unconfined types BZ(1499390) - Allow fs associate for sysctl_vm_t BZ(1447301) - Label /etc/init.d/vboxdrv as bin_t to run virtualbox as unconfined_service_t BZ(1451479) - Allow xdm_t domain to read usermodehelper_t state BZ(1412609) - Allow dhcpc_t domain to stream connect to userdomain domains BZ(1511948) - Allow systemd to mmap kernel modules BZ(1513399) - Allow userdomains to mmap fifo_files BZ(1512242) - Merge pull request #205 from rhatdan/labels - Add map permission to init_domtrans() interface BZ(1513832) - Allow xdm_t domain to mmap and execute files in xdm_var_run_t BZ(1513883) - Unconfined domains, need to create content with the correct labels - Container runtimes are running iptables within a different user namespace - Add interface files_rmdir_all_dirs()
Lukas Vrabec
2017-11-16 15:30:31 +0100
6730963181Drop all binary files from selinux-policy package which are depended on build arch.
Lukas Vrabec
2017-11-16 15:28:19 +0100
ebb4e5ec53* Mon Nov 06 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-302 - Allow jabber domains to connect to postgresql ports - Dontaudit slapd_t to block suspend system - Allow spamc_t to stream connect to cyrys. - Allow passenger to connect to mysqld_port_t - Allow ipmievd to use nsswitch - Allow chronyc_t domain to use user_ptys - Label all files /var/log/opensm.* as opensm_log_t because opensm creating new log files with name opensm-subnet.lst - Fix typo bug in tlp module - Allow userdomain gkeyringd domain to create stream socket with userdomain
Lukas Vrabec
2017-11-06 16:54:47 +0100
4c1c744cdd* Fri Nov 03 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-301 - Merge pull request #37 from milosmalik/rawhide - Allow mozilla_plugin_t domain to dbus chat with devicekit - Dontaudit leaked logwatch pipes - Label /usr/bin/VGAuthService as vmtools_exec_t to confine this daemon. - Allow httpd_t domain to execute hugetlbfs_t files BZ(1444546) - Allow chronyd daemon to execute chronyc. BZ(1507478) - Allow pdns to read network system state BZ(1507244) - Allow gssproxy to read network system state Resolves: rhbz#1507191 - Allow nfsd_t domain to read configfs_t files/dirs - Allow tgtd_t domain to read generic certs - Allow ptp4l to send msgs via dgram socket to unprivileged user domains - Allow dirsrv_snmp_t to use inherited user ptys and read system state - Allow glusterd_t domain to create own tmpfs dirs/files - Allow keepalived stream connect to snmp
Lukas Vrabec
2017-11-03 13:17:33 +0100
deccccdaf1Do not own /etc/selinux/<policytype>/file_contexts.homedirs.bin
Petr Lautrbach
2017-10-27 15:44:49 +0200
59afa60b46* Thu Oct 26 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-300 - Allow zabbix_t domain to change its resource limits - Add new boolean nagios_use_nfs - Allow system_mail_t to search network sysctls - Hide all allow rules with ptrace inside deny_ptrace boolean - Allow nagios_script_t to read nagios_spool_t files - Allow sbd_t to create own sbd_tmpfs_t dirs/files - Allow firewalld and networkmanager to chat with hypervkvp via dbus - Allow dmidecode to read rhsmcert_log_t files - Allow mail system to connect mariadb sockets. - Allow nmbd_t domain to mmap files labeled as samba_var_t. BZ(1505877) - Make user account setup in gnome-initial-setup working in Workstation Live system. BZ(1499170) - Allow iptables_t to run setfiles to restore context on system - Updatre unconfined_dontaudit_read_state() interface to dontaudit also acess to files. BZ(1503466)
Lukas Vrabec
2017-10-26 20:18:18 +0200
7911257b23* Tue Oct 24 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-299 - Label /usr/libexec/bluetooth/obexd as bluetoothd_exec_t to run process as bluetooth_t - Allow chronyd_t do request kernel module and block_suspend capability - Allow system_cronjob_t to create /var/lib/letsencrypt dir with right label - Allow slapd_t domain to mmap files labeled as slpad_db_t BZ(1505414) - Allow dnssec_trigger_t domain to execute binaries with dnssec_trigeer_exec_t BZ(1487912) - Allow l2tpd_t domain to send SIGKILL to ipsec_mgmt_t domains BZ(1505220) - Allow thumb_t creating thumb_home_t files in user_home_dir_t direcotry BZ(1474110) - Allow httpd_t also read httpd_user_content_type dirs when httpd_enable_homedirs is enables - Allow svnserve to use kerberos - Allow conman to use ptmx. Add conman_use_nfs boolean - Allow nnp transition for amavis and tmpreaper SELinux domains - Allow chronyd_t to mmap chronyc_exec_t binary files - Add dac_read_search capability to openvswitch_t domain - Allow svnserve to manage own svnserve_log_t files/dirs - Allow keepalived_t to search network sysctls - Allow puppetagent_t domain dbus chat with rhsmcertd_t domain - Add kill capability to openvswitch_t domain - Label also compressed logs in /var/log for different services - Allow inetd_child_t and system_cronjob_t to run chronyc. - Allow chrony to create netlink route sockets - Add SELinux support for chronyc - Add support for running certbot(letsencrypt) in crontab - Allow nnp trasintion for unconfined_service_t - Allow unpriv user domains and unconfined_service_t to use chronyc
Lukas Vrabec
2017-10-24 21:29:48 +0200
1014cb1eee* Sun Oct 22 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-298 - Drop *.lst files from file list - Ship file_contexts.homedirs in store - Allow proper transition when systems starting pdns to pdns_t domain. BZ(1305522) - Allow haproxy daemon to reexec itself. BZ(1447800) - Allow conmand to use usb ttys. - Allow systemd_machined to read mock lib files. BZ(1504493) - Allow systemd_resolved_t to dbusd chat with NetworkManager_t BZ(1505081)
Lukas Vrabec
2017-10-22 15:56:04 +0200
b442d09884Drop *.lst files from file list
Petr Lautrbach
2017-10-20 16:08:32 +0200
9e91a2824bShip file_contexts.homedirs in store
Petr Lautrbach
2017-10-20 16:05:16 +0200
465d71cd8d* Fri Oct 20 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-297 - Fix typo in virt file contexts file - allow ipa_dnskey_t to read /proc/net/unix file - Allow openvswitch to run setfiles in setfiles_t domain. - Allow openvswitch_t domain to read process data of neutron_t domains - Fix typo in ipa_cert_filetrans_named_content() interface - Fix typo bug in summary of xguest SELinux module - Allow virtual machine with svirt_t label to stream connect to openvswitch. - Label qemu-pr-helper script as virt_exec_t so this script won't run as unconfined_service_t
Lukas Vrabec
2017-10-20 11:27:02 +0200
107eb82b3e* Tue Oct 17 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-296 - Merge pull request #19 from RodrigoQuesadaDev/snapper-fix-1 - Allow httpd_t domain to mmap httpd_user_content_t files. BZ(1494852) - Add nnp transition rule for services using NoNewPrivileges systemd feature - Add map permission into dev_rw_infiniband_dev() interface to allow caller domain mmap infiniband chr device BZ(1500923) - Add init_nnp_daemon_domain interface - Allow nnp transition capability - Merge pull request #204 from konradwilk/rhbz1484908 - Label postgresql-check-db-dir as postgresql_exec_t
Lukas Vrabec
2017-10-17 15:29:08 +0200
67f96cfe2cMake conntrackd policy active
Lukas Vrabec
2017-10-16 14:41:30 +0200
c862e95fd2Fix order of installing selinux-policy-sandbox, because of depedencied in sandbox module, selinux-policy-targeted needs to be installed before selinux-policy-sandbox
Lukas Vrabec
2017-10-12 13:53:04 +0200
d7e304ffbfMerge #4Disable SELinux on a policy type subpackage uninstall
Lukas Vrabec
2017-10-12 08:44:30 +0000
2b83a4bd1d* Tue Oct 10 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-295 - Allow boinc_t to mmap files with label boinc_project_var_lib_t BZ(1500088) - Allow fail2ban_t domain to mmap journals. BZ(1500089) - Add dac_override to abrt_t domain BZ(1499860) - Allow pppd domain to mmap own pid files BZ(1498587) - Allow webserver services to mmap files with label httpd_sys_content_t BZ(1498451) - Allow tlp domain to read sssd public files Allow tlp domain to mmap kernel modules - Allow systemd to read sysfs sym links. BZ(1499327) - Allow systemd to mmap systemd_networkd_exec_t files BZ(1499863) - Make systemd_networkd_var_run as mountpoint BZ(1499862) - Allow noatsecure for java-based unconfined services. BZ(1358476) - Allow systemd_modules_load_t domain to mmap kernel modules. BZ(1490015)
Lukas Vrabec
2017-10-10 12:31:41 +0200
f2424e7390* Mon Oct 09 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-294 - Allow cloud-init to create content in /var/run/cloud-init - Dontaudit VM to read gnome-boxes process data BZ(1415975) - Allow winbind_t domain mmap samba_var_t files - Allow cupsd_t to execute ld_so_cache_t BZ(1478602) - Update dev_rw_xserver_misc() interface to allo source domains to mmap xserver devices BZ(1334035) - Add dac_override capability to groupadd_t domain BZ(1497091) - Allow unconfined_service_t to start containers
Lukas Vrabec
2017-10-09 10:09:01 +0200
7f40329c8bDisable SELinux on a policy type subpackage uninstall
Petr Lautrbach
2017-10-08 21:33:17 +0200
dba350c6e0Do not ship file_contexts.bin file
Petr Lautrbach
2017-10-08 20:52:07 +0200
918bddec38* Sun Oct 08 2017 Petr Lautrbach <plautrba@redhat.com> - 3.13.1-293 - Drop policyhelp utility BZ(1498429)
Petr Lautrbach
2017-10-08 10:29:32 +0200
00cdacfa6aDrop policyhelp utility
Petr Lautrbach
2017-10-05 08:58:45 +0200
75b1898128* Tue Oct 03 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-292 - Allow cupsd_t to execute ld_so_cache_t BZ(1478602) - Allow firewalld_t domain to change object identity because of relabeling after using firewall-cmd BZ(1469806) - Allow postfix_cleanup_t domain to stream connect to all milter sockets BZ(1436026) - Allow nsswitch_domain to read virt_var_lib_t files, because of libvirt NSS plugin. BZ(1487531) - Add unix_stream_socket recvfrom perm for init_t domain BZ(1496318) - Allow systemd to maange sysfs BZ(1471361)
Lukas Vrabec
2017-10-03 17:11:40 +0200
65c1dc9f4d* Tue Oct 03 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-291 - Switch default value of SELinux boolean httpd_graceful_shutdown to off.
Lukas Vrabec
2017-10-03 14:19:31 +0200
c5099d17b0Switch default value of SELinux boolean httpd_graceful_shutdown to off.
Lukas Vrabec
2017-10-03 14:17:18 +0200
Lukas Vrabec
Fedora Release Engineering
Jason Tibbitts
Jan Pokorný
Petr Lautrbach
Lukas Vrabec
Igor Gnatenko
Jonathan Lebon
Colin Walters