b9f20bbf55
- Confine gnome-remote-desktop Resolves: RHEL-35877 - Allow virtqemud get attributes of a tmpfs filesystem Resolves: RHEL-40855 - Allow virtqemud get attributes of cifs files Resolves: RHEL-40855 - Allow virtqemud get attributes of filesystems with extended attributes Resolves: RHEL-39668 - Allow virtqemud get attributes of NFS filesystems Resolves: RHEL-40855 - Add support for secretmem anon inode Resolves: RHEL-40953 - Allow systemd-sleep read raw disk data Resolves: RHEL-49600 - Allow systemd-hwdb send messages to kernel unix datagram sockets Resolves: RHEL-50810 - Label /run/modprobe.d with modules_conf_t Resolves: RHEL-54591 - Allow setsebool_t relabel selinux data files Resolves: RHEL-55412 - Don't audit crontab_domain write attempts to user home Resolves: RHEL-56349 - Differentiate between staff and sysadm when executing crontab with sudo Resolves: RHEL-56349 - Add crontab_admin_domtrans interface Resolves: RHEL-56349 - Add crontab_domtrans interface Resolves: RHEL-56349 - Allow boothd connect to kernel over a unix socket Resolves: RHEL-58060 - Fix label of pseudoterminals created from sudodomain Resolves: RHEL-58068 - systemd: allow systemd_notify_t to send data to kernel_t datagram sockets Resolves: RHEL-58072 - Allow rsyslog read systemd-logind session files Resolves: RHEL-40961 - Label /dev/mmcblk0rpmb character device with removable_device_t Resolves: RHEL-55265 - Label /dev/hfi1_[0-9]+ devices Resolves: RHEL-62836 - Label /dev/papr-sysparm and /dev/papr-vpd Resolves: RHEL-56908 - Support SGX devices Resolves: RHEL-62354 - Suppress semodule's stderr Resolves: RHEL-59192 |
||
|---|---|---|
| .fmf | ||
| plans | ||
| tests | ||
| .gitignore | ||
| booleans-minimum.conf | ||
| booleans-mls.conf | ||
| booleans-targeted.conf | ||
| booleans.subs_dist | ||
| COPYING | ||
| customizable_types | ||
| file_contexts.subs_dist | ||
| gating.yaml | ||
| ifndefy.py | ||
| make-rhat-patches.sh | ||
| Makefile.devel | ||
| modules-minimum.conf | ||
| modules-mls-base.conf | ||
| modules-mls-contrib.conf | ||
| modules-targeted-base.conf | ||
| modules-targeted-contrib.conf | ||
| modules-targeted.conf | ||
| permissivedomains.cil | ||
| README.md | ||
| rpm.macros | ||
| securetty_types-minimum | ||
| securetty_types-mls | ||
| securetty_types-targeted | ||
| selinux-check-proper-disable.service | ||
| selinux-policy.conf | ||
| selinux-policy.spec | ||
| setrans-minimum.conf | ||
| setrans-mls.conf | ||
| setrans-targeted.conf | ||
| sources | ||
| users-minimum | ||
| users-mls | ||
| users-targeted | ||
| varrun-convert.sh | ||
Purpose
SELinux Fedora Policy is a fork of the SELinux reference policy. The fedora-selinux/selinux-policy repo makes Fedora packaging simpler and more transparent for packagers, upstream developers, and users. It is used for applying downstream Fedora fixes, for communication about proposed/committed changes, and for communication with upstream and the community. It reflects the upstream repository structure to make submitting patches to upstream easy.
Structure
GitHub
On GitHub, we have one repository containing the policy sources.
$ cd selinux-policy
$ git remote -v
origin git@github.com:fedora-selinux/selinux-policy.git (fetch)
$ git branch -r
origin/HEAD -> origin/master
origin/f27
origin/f28
origin/master
origin/rawhide
Note: As opposed to dist-git, the Rawhide content resides in the rawhide branch rather than master.
dist-git
Package sources in dist-git are composed from the selinux-policy repository snapshot tarball, container-selinux policy files snapshot, the macro-expander script snapshot, and from other config files.
Build process
-
Clone the fedora-selinux/selinux-policy repository.
$ cd ~/devel/github $ git clone git@github.com:fedora-selinux/selinux-policy.git $ cd selinux-policy -
Create, backport, or cherry-pick needed changes to a particular branch and push them.
-
Clone the selinux-policy dist-git repository.
$ cd ~/devel/dist-git $ fedpkg clone selinux-policy $ cd selinux-policy -
Download the latest snapshot from the selinux-policy GitHub repository.
$ ./make-rhat-patches.sh -
Add changes to the dist-git repository, bump release, create a changelog entry, commit, and push.
-
Build the package.
$ fedpkg build