326 lines
12 KiB
Plaintext
326 lines
12 KiB
Plaintext
1.27.10 2005-10-17
|
|
* Changed getseuserbyname to ignore empty lines and to handle
|
|
no matching entry in the same manner as no seusers file.
|
|
|
|
1.27.9 2005-10-13
|
|
* Changed selinux_mkload_policy to try downgrading the
|
|
latest policy version available to the kernel-supported version.
|
|
|
|
1.27.8 2005-10-11
|
|
* Changed selinux_mkload_policy to fall back to the maximum
|
|
policy version supported by libsepol if the kernel policy version
|
|
falls outside of the supported range.
|
|
|
|
1.27.7 2005-10-06
|
|
* Changed getseuserbyname to fall back to the Linux username and
|
|
NULL level if seusers config file doesn't exist unless
|
|
REQUIRESEUSERS=1 is set in /etc/selinux/config.
|
|
* Moved seusers.conf under $SELINUXTYPE and renamed to seusers.
|
|
|
|
1.27.6 2005-10-06
|
|
* Added selinux_init_load_policy() function as an even higher level
|
|
interface for the initial policy load by /sbin/init. This obsoletes
|
|
the load_policy() function in the sysvinit-selinux.patch.
|
|
|
|
1.27.5 2005-10-06
|
|
* Added selinux_mkload_policy() function as a higher level interface
|
|
for loading policy than the security_load_policy() interface.
|
|
|
|
1.27.4 2005-10-05
|
|
* Merged fix for matchpathcon (regcomp error checking) from Johan
|
|
Fischer. Also added use of regerror to obtain the error string
|
|
for inclusion in the error message.
|
|
|
|
1.27.3 2005-10-03
|
|
* Changed getseuserbyname to not require (and ignore if present)
|
|
the MLS level in seusers.conf if MLS is disabled, setting *level
|
|
to NULL in this case.
|
|
|
|
1.27.2 2005-09-30
|
|
* Merged getseuserbyname patch from Dan Walsh.
|
|
|
|
1.27.1 2005-09-19
|
|
* Merged STRIP_LEVEL patch for matchpathcon from Dan Walsh.
|
|
This allows file_contexts with MLS fields to be processed on
|
|
non-MLS-enabled systems with policies that are otherwise
|
|
identical (e.g. same type definitions).
|
|
* Merged get_ordered_context_list_with_level() function from
|
|
Dan Walsh, and added get_default_context_with_level().
|
|
This allows MLS level selection for users other than the
|
|
default level.
|
|
|
|
1.26 2005-09-06
|
|
* Updated version for release.
|
|
|
|
1.25.7 2005-09-01
|
|
* Merged modified form of patch to avoid dlopen/dlclose by
|
|
the static libselinux from Dan Walsh. Users of the static libselinux
|
|
will not have any context translation by default.
|
|
|
|
1.25.6 2005-08-31
|
|
* Added public functions to export context translation to
|
|
users of libselinux (selinux_trans_to_raw_context,
|
|
selinux_raw_to_trans_context).
|
|
|
|
1.25.5 2005-08-26
|
|
* Remove special definition for context_range_set; use
|
|
common code.
|
|
|
|
1.25.4 2005-08-25
|
|
* Hid translation-related symbols entirely and ensured that
|
|
raw functions have hidden definitions for internal use.
|
|
* Allowed setting NULL via context_set* functions.
|
|
* Allowed whitespace in MLS component of context.
|
|
* Changed rpm_execcon to use translated functions to workaround
|
|
lack of MLS level on upgraded systems.
|
|
|
|
1.25.3 2005-08-23
|
|
* Merged context translation patch, originally by TCS,
|
|
with modifications by Dan Walsh (Red Hat).
|
|
|
|
1.25.2 2005-08-11
|
|
* Merged several fixes for error handling paths in the
|
|
AVC sidtab, matchpathcon, booleans, context, and get_context_list
|
|
code from Serge Hallyn (IBM). Bugs found by Coverity.
|
|
|
|
1.25.1 2005-08-10
|
|
* Removed setupns; migrated to pam.
|
|
* Merged patches to rename checkPasswdAccess() from Joshua Brindle.
|
|
Original symbol is temporarily retained for compatibility until
|
|
all callers are updated.
|
|
|
|
1.24 2005-06-20
|
|
* Updated version for release.
|
|
|
|
1.23.12 2005-06-13
|
|
* Merged security_setupns() from Chad Sellers.
|
|
|
|
1.23.11 2005-05-19
|
|
* Merged avcstat and selinux man page from Dan Walsh.
|
|
* Changed security_load_booleans to process booleans.local
|
|
even if booleans file doesn't exist.
|
|
|
|
1.23.10 2005-04-29
|
|
* Merged set_selinuxmnt patch from Bill Nottingham (Red Hat).
|
|
|
|
1.23.9 2005-04-26
|
|
* Rewrote get_ordered_context_list and helpers, including
|
|
changing logic to allow variable MLS fields.
|
|
|
|
1.23.8 2005-04-25
|
|
* Merged matchpathcon and man page patch from Dan Walsh.
|
|
|
|
1.23.7 2005-04-12
|
|
* Changed boolean functions to return -1 with errno ENOENT
|
|
rather than assert on a NULL selinux_mnt (i.e. selinuxfs not
|
|
mounted).
|
|
|
|
1.23.6 2005-04-08
|
|
* Fixed bug in matchpathcon_filespec_destroy.
|
|
|
|
1.23.5 2005-04-05
|
|
* Fixed bug in rpm_execcon error handling path.
|
|
|
|
1.23.4 2005-04-04
|
|
* Merged fix for set_matchpathcon* functions from Andreas Steinmetz.
|
|
* Merged fix for getconlist utility from Andreas Steinmetz.
|
|
|
|
1.23.3 2005-03-29
|
|
* Merged security_set_boolean_list patch from Dan Walsh.
|
|
This introduces booleans.local support for setsebool.
|
|
|
|
1.23.2 2005-03-17
|
|
* Merged destructors patch from Tomas Mraz.
|
|
|
|
1.23.1 2005-03-16
|
|
* Added set_matchpathcon_flags() function for setting flags
|
|
controlling operation of matchpathcon. MATCHPATHCON_BASEONLY
|
|
means only process the base file_contexts file, not
|
|
file_contexts.homedirs or file_contexts.local, and is for use by
|
|
setfiles -c.
|
|
* Updated matchpathcon.3 man page.
|
|
|
|
1.22 2005-03-09
|
|
* Updated version for release.
|
|
|
|
1.21.13 2005-03-08
|
|
* Fixed bug in matchpathcon_filespec_add() - failure to clear fl_head.
|
|
|
|
1.21.12 2005-03-01
|
|
* Changed matchpathcon_common to ignore any non-format bits in the mode.
|
|
|
|
1.21.11 2005-02-22
|
|
* Merged several fixes from Ulrich Drepper.
|
|
|
|
1.21.10 2005-02-17
|
|
* Merged matchpathcon patch for file_contexts.homedir from Dan Walsh.
|
|
* Added selinux_users_path() for path to directory containing
|
|
system.users and local.users.
|
|
|
|
1.21.9 2005-02-09
|
|
* Changed relabel Makefile target to use restorecon.
|
|
|
|
1.21.8 2005-02-07
|
|
* Regenerated av_permissions.h.
|
|
|
|
1.21.7 2005-02-01
|
|
* Modified avc_dump_av to explicitly check for any permissions that
|
|
cannot be mapped to string names and display them as a hex value.
|
|
|
|
1.21.6 2005-01-31
|
|
* Regenerated av_permissions.h.
|
|
|
|
1.21.5 2005-01-28
|
|
* Generalized matchpathcon internals, exported more interfaces,
|
|
and moved additional code from setfiles into libselinux so that
|
|
setfiles can directly use matchpathcon.
|
|
|
|
1.21.4 2005-01-27
|
|
* Prevent overflow of spec array in matchpathcon.
|
|
|
|
1.21.3 2005-01-26
|
|
* Fixed several uses of internal functions to avoid relocations.
|
|
* Changed rpm_execcon to check is_selinux_enabled() and fallback to
|
|
a regular execve if not enabled (or unable to determine due to a lack
|
|
of /proc, e.g. chroot'd environment).
|
|
|
|
|
|
1.21.2 2005-01-24
|
|
* Merged minor fix for avcstat from Dan Walsh.
|
|
|
|
1.21.1 2005-01-19
|
|
* Merged patch from Dan Walsh, including:
|
|
- new is_context_customizable function
|
|
- changed matchpathcon to also use file_contexts.local if present
|
|
- man page cleanups
|
|
|
|
1.20 2005-01-04
|
|
* Changed matchpathcon to return -1 with errno ENOENT for
|
|
<<none>> entries, and also for an empty file_contexts configuration.
|
|
* Removed some trivial utils that were not useful or redundant.
|
|
* Changed BINDIR default to /usr/sbin to match change in Fedora.
|
|
* Added security_compute_member.
|
|
* Added man page for setcon.
|
|
* Merged more man pages from Dan Walsh.
|
|
* Merged avcstat from James Morris.
|
|
* Merged build fix for mips from Manoj Srivastava.
|
|
* Merged C++ support from John Ramsdell of MITRE.
|
|
* Merged setcon() function from Darrel Goeddel of TCS.
|
|
* Merged setsebool/togglesebool enhancement from Steve Grubb.
|
|
* Merged cleanup patches from Steve Grubb.
|
|
|
|
1.18 2004-11-01
|
|
* Merged cleanup patches from Steve Grubb.
|
|
* Added rpm_execcon.
|
|
* Merged setenforce and removable context patch from Dan Walsh.
|
|
* Merged build fix for alpha from Ulrich Drepper.
|
|
* Removed copyright/license from selinux_netlink.h - definitions only.
|
|
* Merged matchmediacon from Dan Walsh.
|
|
* Regenerated headers for new nscd permissions.
|
|
* Added get_default_context_with_role.
|
|
* Added set_matchpathcon_printf.
|
|
* Reworked av_inherit.h to allow easier re-use by kernel.
|
|
* Changed avc_has_perm_noaudit to not fail on netlink errors.
|
|
* Changed avc netlink code to check pid based on patch by Steve Grubb.
|
|
* Merged second optimization patch from Ulrich Drepper.
|
|
* Changed matchpathcon to skip invalid file_contexts entries.
|
|
* Made string tables private to libselinux.
|
|
* Merged strcat->stpcpy patch from Ulrich Drepper.
|
|
* Merged matchpathcon man page from Dan Walsh.
|
|
* Merged patch to eliminate PLTs for local syms from Ulrich Drepper.
|
|
* Autobind netlink socket.
|
|
* Dropped compatibility code from security_compute_user.
|
|
* Merged fix for context_range_set from Chad Hanson.
|
|
* Merged allocation failure checking patch from Chad Hanson.
|
|
* Merged avc netlink error message patch from Colin Walters.
|
|
|
|
1.16 2004-08-19
|
|
* Regenerated headers for nscd class.
|
|
* Merged man pages from Dan Walsh.
|
|
* Merged context_new bug fix for MLS ranges from Chad Hanson.
|
|
* Merged toggle_bool from Chris PeBenito, renamed to togglesebool.
|
|
* Renamed change_bool and show_bools to setsebool and getsebool.
|
|
* Merged security_load_booleans() function from Dan Walsh.
|
|
* Added selinux_booleans_path() function.
|
|
* Changed avc_init function prototype to use const.
|
|
* Regenerated headers for crontab permission.
|
|
* Added checkAccess from Dan Walsh.
|
|
* Merged getenforce patch from Dan Walsh.
|
|
* Regenerated headers for dbus classes.
|
|
|
|
1.14 2004-06-16
|
|
* Regenerated headers for fine-grained netlink classes.
|
|
* Merged selinux_config bug fix from Dan Walsh.
|
|
* Added userspace AVC man pages.
|
|
* Added man links for API calls to existing man pages documenting them.
|
|
* Replaced $HOME/.default_contexts support with /etc/selinux/contexts/users/$USER support.
|
|
* Merged patch to determine config file paths at runtime to support
|
|
reorganized layout.
|
|
* Regenerated flask headers with stable ordering.
|
|
* Merged patch for man pages from Russell Coker.
|
|
|
|
1.12 2004-05-10
|
|
* Updated flask files to include new SE-X security classes.
|
|
* Added security_disable function for runtime disable of SELinux prior
|
|
to initial policy load (for /sbin/init).
|
|
* Changed get_ordered_context_list to omit any reachable contexts
|
|
that are not explicitly listed in default_contexts, unless there
|
|
are no matches.
|
|
* Merged man pages from Russell Coker and Dan Walsh.
|
|
* Merged memory leak fixes from Dan Walsh.
|
|
* Merged policyvers errno patch from Chris PeBenito.
|
|
|
|
1.10 2004-04-05
|
|
* Merged getenforce patch from Dan Walsh.
|
|
* Fixed init_selinuxmnt to correctly handle use of "selinuxfs" as
|
|
the device specification, i.e. mount selinuxfs /selinux -t selinuxfs.
|
|
Based on a patch by Russell Coker.
|
|
* Merged matchpathcon buffer size fix from Dan Walsh.
|
|
|
|
1.8 2004-03-09
|
|
* Merged is_selinux_mls_enabled() from Chad Hanson of TCS.
|
|
* Added matchpathcon function.
|
|
* Updated userspace AVC to handle netlink selinux notifications.
|
|
|
|
1.6 2004-02-18
|
|
* Merged conditional policy extensions from Tresys Technology.
|
|
* Added userspace avc and SID table implementation.
|
|
* Fixed type on size in getpeercon per Thorsten Kukuk's advice.
|
|
* Fixed use of getpwnam_r per Thorsten Kukuk's advice.
|
|
* Changed to use getpwnam_r rather than getpwnam internally to
|
|
avoid clobbering any existing pwd struct obtained by the caller.
|
|
* Added getpeercon function to encapsulate getsockopt SO_PEERSEC
|
|
and handle allocation ala getfilecon.
|
|
* Changed is_selinux_enabled to return -1 on errors.
|
|
* Changed to discover selinuxfs mount point via /proc/mounts
|
|
so that the mount point can be changed without rebuilding.
|
|
|
|
1.4 2003-12-01
|
|
* Merged another cleanup patch from Bastian Blank and Joerg Hoh.
|
|
* Regenerate headers for new permissions.
|
|
* Merged static lib build patch from Bastian Blank and Joerg Hoh.
|
|
* Export SELINUXMNT definition, add SELINUXPOLICY definition.
|
|
* Add functions to provide access to enforce and policyvers.
|
|
* Changed is_selinux_enabled to check /proc/filesystems for selinuxfs.
|
|
* Fixed type for 'size' in *getfilecon.
|
|
* Dropped -lattr and changed #include's to <sys/xattr.h>
|
|
* Merged patch to move shared library to /lib from Dan Walsh.
|
|
* Changed get_ordered_context_list to support a failsafe context.
|
|
* Added selinuxenabled utility.
|
|
* Merged const patch from Thorsten Kukuk.
|
|
|
|
1.2 2003-09-30
|
|
* Change is_selinux_enabled to fail if policy isn't loaded.
|
|
* Changed Makefiles to allow non-root rpm builds.
|
|
* Added -lattr for libselinux.so to ensure proper binding.
|
|
|
|
1.1 2003-08-13
|
|
* Ensure that context strings are padded with a null byte
|
|
in case the kernel didn't include one.
|
|
* Regenerate headers, update helpers.c for code cleanup.
|
|
* Pass soname flag to linker (Colin Walters).
|
|
* Fixes for various items: add const as appropriate, handle missed OOM condition, clean up compile warnings (Colin Walters).
|
|
|
|
1.0 2003-07-11
|
|
* Initial public release.
|