forked from SELinuxProject/refpolicy
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathChangelog
2001 lines (1871 loc) · 89.5 KB
/
Changelog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
* Sun Jun 09 2019 Chris PeBenito <[email protected]> - 2.20190609
Chris PeBenito (70):
systemd: Module version bump.
Merge branch 'sysadm-dynamic-users' of
git://github.com/fishilico/selinux-refpolicy
sysadm: Module version bump.
Merge branch 'stubby-daemon' of
git://github.com/fishilico/selinux-refpolicy
corenetwork: Module version bump.
systemd: Remove unnecessary brackets.
init, systemd, cdrecord: Module version bump.
logging, miscfiles, authlogin: Module version bump.
Merge branch 'systemd-journald-signull' of
git://github.com/fishilico/selinux-refpolicy
Merge branch 'restorecond-no-read-all' of
git://github.com/fishilico/selinux-refpolicy
logging, selinuxutil: Module version bump.
Merge branch 'systemd-update-done' of
git://github.com/fishilico/selinux-refpolicy
systemd: Module version bump.
aide, clamav: Module version bump.
filesystem, cron, authlogin: Module version bump.
Remove incorrect comment about capability2:mac_admin.
usermanage: Move kernel_dgram_send(passwd_t) to systemd block.
systemd, udev, usermanage: Module version bump.
genhomedircon.py: Fix top-level exception handling.
udev: Whitespace fix.
udev: Move one line and remove a redundant line.
sysadm, udev: Module version bump.
Merge pull request #35 from pebenito/master
systemd: Drop unconfined kernel access for systemd_nspawn.
udev: Drop write by udev to its executable.
init: Remove duplicate setenforce rule for init scripts.
authlogin, dbus, ntp: Module version bump.
ntp, init, lvm: Module version bump.
Merge pull request #37 from pebenito/master
kernel, init, systemd, udev: Module version bump.
init: Revise conditions in init_startstop_service().
Merge pull request #39 from pebenito/revise-init-stopstart
init: Module version bump.
kernel: Module version bump.
Merge pull request #40 from gtrentalancia/master
xserver: Module version bump.
various: Module version bump
apache: Make MTA optional.
systemd: Remove unnecessary names in systemd-update-done filetrans.
Merge pull request #42 from dsugar100/master
kernel, devices, plymouthd, xserver: Module version bump.
storage: Label /dev/mmcblk* character nodes.
devices: Label /dev/tpmrm[0-9].
devices: Add type for GPIO chips, /dev/gpiochip[0-9]
devices: Change netcontrol devices to pmqos.
systemd: Add initial policy for systemd --user.
Merge pull request #43 from pebenito/various-device-labels
Merge pull request #44 from pebenito/http-mta-optional
Merge pull request #45 from pebenito/systemd-update-done-tweak
Merge pull request #46 from pebenito/systemd-user
various: Module version bump.
Merge pull request #47 from dsugar100/master
Merge pull request #48 from bigon/dovecot_lmtp
Merge pull request #49 from bigon/fail2ban_logrotate
dovecot, logrotate: Module version bump.
logrotate: Make MTA optional.
Merge pull request #51 from pebenito/logrotate-optional-mta
Merge pull request #53 from WOnder93/makefile-fix
logrotate: Module version bump.
init: Add systemd block to init_script_domain().
systemd: modules-load updates.
apache: Web content rules simplification.
storage: Add fc entry for /dev/pmem*
devices: Add type for /dev/daxX.Y.
Merge pull request #54 from pebenito/init-script-systemd
Merge pull request #55 from pebenito/modules-load
Merge pull request #56 from pebenito/apache-simplify
Merge pull request #57 from pebenito/pmem-dax
various: Module version bump.
Bump module versions for release.
Dave Sugar (3):
Allow xdm (lightdm) start plymouth
Changes to support plymouth working in enforcing
create interfaces for NetworkManager units
Guido Trentalancia (1):
The Qt library version 5 requires to write xserver_tmp_t files upon
starting up applications (tested on version 5.12.1).
Laurent Bigonville (2):
Add dovecot to listen to LMTP port
Allow logrotate to execute fail2ban-client
Lukas Vrabec (1):
Label /sys/kernel/ns_last_pid as sysctl_kernel_ns_last_pid_t
Nicolas Iooss (6):
sysadm: allow resolving dynamic users
Add policy for stubby DNS resolver
Allow systemd-journald to use kill(pid, 0) on its clients
Allow restorecond to read customizable_types
Remove a broad read-files rule for restorecond
Update systemd-update-done policy
Ondrej Mosnacek (1):
Fix find commands in Makefiles
Sugar, David (26):
Allow systemd-networkd to get IP address from dhcp server
Separate domain for systemd-modules-load
Allow init_t to read net_conf_t
Allow systemd-hostnamed to set the hostname
Add interface to run cdrecord in caller domain
Add interface to get status of rsyslog service
New interface to dontaudit access to cert_t
Fix incorrect type in clamav_enableddisable_clamd interface
Allow freshclam to read sysctl_crypto_t
Add interfaces to run freshclam
Allow AIDE to sendto kernel datagram socket
Allow AIDE to read kernel sysctl_crypto_t
Allow AIDE to mmap files
Add interface to allow relabeling of iso 9660 filesystems.
Update cron use to pam interface
Allow additional map permission when reading hwdb
Resolve denial while changing password
Separate out udevadm into a new domain
Add interface ntp_dbus_chat
Allow ntpd to update chronyd service
Allow ntpd to update timezone symlink
Resolve denial about logging to journal from chkpwd
Resolve denial about logging to journal from dbus
Allow ntpd to read unit files
Denial of cryptsetup reading cracklib database
Add kernel_dgram_send() into logging_send_syslog_msg()
* Fri Feb 01 2019 Chris PeBenito <[email protected]> - 2.20190201
Alexander Miroshnichenko (16):
Add signal_perms setpgid setsched permissions to syncthing_t.
Add corecmd_exec_bin permissions to syncthing_t.
Allow syncthing_t to read network state.
Allow syncthing_t to execute ifconfig/iproute2.
Add required permissions for nsd_t to be able running.
Add nsd_admin interface to sysadm.te.
Add map permission to lvm_t on lvm_metadata_t.
Add comment for map on lvm_metadata_t.
Remove syncthing tunable_policy.
Remove unneeded braces from nsd.te.
Add new interface fs_rmw_hugetlbfs_files.
Add map permission for postgresql_t to postgresql_tmp_t files.
Add dovecot_can_connect_db boolean.
fs_mmap_rw_hugetlbfs_files is a more appropriate name for the interface
Add hostapd service module
minor updates redis module to be able to start the app
Chris PeBenito (85):
mozilla, devices, selinux, xserver, init, iptables: Module version bump.
devices: Module version bump.
misc_patterns.spt: Remove unnecessary brackets.
ipsec: Module version bump.
fstools: Module version bump.
corecommands: Module version bump.
xserver: Module version bump.
Merge pull request #1 from bigon/fix-sepolgen-ifgen
Remove unused translate permission in context userspace class.
logrotate: Module version bump.
miscfiles: Module version bump.
Merge pull request #3 from bigon/xdp-socket
obj_perm_sets.spt: Add xdp_socket to socket_class_set.
clamav, ssh, init: Module version bump.
amavis, apache, clamav, exim, mta, udev: Module version bump.
dnsmasq: Whitespace fix in file contexts.
dnsmasq: Reorder lines in file contexts.
Merge branch 'master' of https://github.com/bigon/refpolicy
Merge branch 'resolved' of https://github.com/bigon/refpolicy
Merge branch 'iscsi' of https://github.com/bigon/refpolicy
Various modules: Version bump.
dnsmasq: Module version bump.
Merge branch 'minissdpd' of https://github.com/bigon/refpolicy
cron, minissdpd, ntp, systemd: Module version bump.
dbus, xserver, init, logging, modutils: Module version bump.
Merge branch 'syncthing' of https://github.com/alexminder/refpolicy
syncthing: Whitespace change
Merge branch 'lvm' of https://github.com/alexminder/refpolicy
lvm, syncthing: Module version bump.
sigrok: Remove extra comments.
networkmanager: Add ICMPv6 comment
sysnetwork: Move optional block in sysnet_dns_name_resolve().
sysnetwork: Move lines.
dpkg: Rename dpkg_read_script_tmp_links().
apt, rpm: Remove and move lines to fix fc conflicts.
sudo: Whitespace fix.
many: Module version bumps for changes from Russell Coker.
systemd: Rename systemd_list_netif() to systemd_list_networkd_runtime().
init: Remove inadvertent merge.
Merge branch 'nsd' of https://github.com/alexminder/refpolicy
nsd: Merge two rules into one.
Merge branch 'ssh_dac_read_search' of
git://github.com/fishilico/selinux-refpolicy
Merge branch 'restorecond_getattr_cgroupfs' of
git://github.com/fishilico/selinux-refpolicy
Merge branch 'systemd-logind-getutxent' of
git://github.com/fishilico/selinux-refpolicy
various: Module version bump.
iptables: Module version bump.
Add CONTRIBUTING file.
kernel, systemd: Move lines.
kernel, jabber, ntp, init, logging, systemd: Module version bump.
Merge branch 'systemd-journald_units_symlinks' of
git://github.com/fishilico/selinux-refpolicy
init, logging: Module version bump.
Merge branch 'services_single_usr_bin' of
git://github.com/fishilico/selinux-refpolicy
Merge branch 'init_rename_pid_interfaces' of
git://github.com/fishilico/selinux-refpolicy
various: Module name bump.
Merge branch 'systemd-rfkill' of
git://github.com/fishilico/selinux-refpolicy
systemd: Whitespace change
systemd: Module version bump.
Merge branch 'restorecond-symlinks' of
git://github.com/fishilico/selinux-refpolicy
Merge branch 'add_comment' of git://github.com/DefenSec/refpolicy
usermanage, cron, selinuxutil: Module version bump.
logging, sysnetwork, systemd: Module version bump.
Merge branch 'restorecond-dontaudit-symlinks' of
git://github.com/fishilico/selinux-refpolicy
selinuxutil: Module version bump.
Merge branch 'dbus-dynamic-uid' of
git://github.com/fishilico/selinux-refpolicy
xserver: Move line
systemd: Move interface implementation.
various: Module version bump.
dpkg: Rename dpkg_nnp_transition() to dpkg_nnp_domtrans().
dpkg: Move interface implementations.
init: Rename init_read_generic_units_links() to
init_read_generic_units_symlinks().
init: Drop unnecessary userspace class dependence in
init_read_generic_units_symlinks().
chromium: Whitespace fixes.
chromium: Move line.
Merge branch 'dovecot' of git://github.com/alexminder/refpolicy
dovecot: Move lines.
various: Module version bump.
Merge branch 'postgres' of git://github.com/alexminder/refpolicy
filesystem, postgresql: Module version bump.
hostapd: Whitespace change.
hostapd: Move line.
various: Module version bump.
redis: Move line.
redis: Module version bump.
corecommands, staff, unprivuser, ssh, locallogin, systemd: Module version
bump.
Bump module versions for release.
David Sugar (15):
Interface to allow reading of virus signature files.
Update CUSTOM_BUILDOPT
Add interface udev_run_domain
Allow clamd_t to read /proc/sys/crypt/fips_enabled
Interface to add domain allowed to be read by ClamAV for scanning.
Add interfaces to control clamav_unit_t systemd services
Allow clamd to use sent file descriptor
Add interfaces to control ntpd_unit_t systemd services
interface to enable/disable systemd_networkd service
Interface to read cron_system_spool_t
Allow X (xserver_t) to read /proc/sys/crypto/fips_enabled
Allow kmod to read /proc/sys/crypto/fips_enabled
Allow dbus to access /proc/sys/crypto/fips_enabled
Add missing require for 'daemon' attribute.
Allow auditctl_t to read bin_t symlinks.
Dominick Grift (1):
unconfined: add a note about DBUS
Guido Trentalancia (1):
Add sigrok contrib module
Jagannathan Raman (1):
vhost: Add /dev/vhost-scsi device of type vhost_device_t.
Jason Zaman (10):
selinux: compute_access_vector requires creating netlink_selinux_sockets
mozilla: xdg updates
xserver: label .cache/fontconfig as user_fonts_cache_t
Allow map xserver_misc_device_t for nvidia driver
iptables: fcontexts for 1.8.0
devices: introduce dev_dontaudit_read_sysfs
files: introduce files_dontaudit_read_etc_files
kernel: introduce kernel_dontaudit_read_kernel_sysctl
userdomain: introduce userdom_user_home_dir_filetrans_user_cert
Add chromium policy upstreamed from Gentoo
Laurent Bigonville (10):
policy/support/obj_perm_sets.spt: modify indentation of mmap_file_perms to
make sepolgen-ifgen happy
Add xdp_socket security class and access vectors
irqbalance now creates an abstract socket
Allow semanage_t to connect to system D-Bus bus
Allow ntpd_t to read init state
Add systemd_dbus_chat_resolved() interface
Allow sysnet_dns_name_resolve() to use resolved to resolve DNS names
Allow systemd_resolved_t to bind to port 53 and use net_raw
Allow iscsid_t to create a netlink_iscsi_socket
Allow minissdpd_t to create a unix_stream_socket
Luis Ressel (7):
corecommands: Fix /usr/share/apr* fc
xserver: Allow user fonts (and caches) to be mmap()ed.
Add fc for /var/lib/misc/logrotate.status
Realign logrotate.fc, remove an obvious comment
miscfiles: Label /usr/share/texmf*/fonts/ as fonts_t
services/ssh: Don't audit accesses from ssh_t to /dev/random
system/init: Give init_spec_daemon_domain()s the "daemon" attribute
Lukas Vrabec (1):
Improve domain_transition_pattern to allow mmap entrypoint bin file.
Nicolas Iooss (11):
fstools: label e2mmpstatus as fsadm_exec_t
ssh: use dac_read_search instead of dac_override
selinuxutil: allow restorecond to try counting the number of files in
cgroup fs
systemd: allow systemd-logind to use getutxent()
Allow systemd-journald to read systemd unit symlinks
Label service binaries in /usr/bin like /usr/sbin
init: rename *_pid_* interfaces to use "runtime"
systemd: add policy for systemd-rfkill
selinuxutil: allow restorecond to read symlinks
selinuxutil: restorecond is buggy when it dereferencies symlinks
dbus: allow using dynamic UID
Petr Vorel (1):
dnsmasq: Require log files to have .log suffix
Russell Coker (19):
misc services patches
misc interfaces
last misc stuff
systemd related interfaces
systemd misc
missing from previous
cron trivial
mls stuff
logging
some little stuff
trivial system cronjob
another trivial
more tiny stuff
map systemd private dirs
tiny stuff for today
yet more tiny stuff
yet another little patch
chromium
more misc stuff
Sugar, David (9):
Allow greeter to start dbus
pam_faillock creates files in /run/faillock
Add interface to get status of iptables service
Add interface to start/stop iptables service
label journald configuraiton files syslog_conf_t
Interface with systemd_hostnamed over dbus to set hostname
Modify type for /etc/hostname
Add interface clamav_run
Add interface to read journal files
Yuli Khodorkovskiy (1):
ipsec: add missing permissions for pluto
* Sun Jul 01 2018 Chris PeBenito <[email protected]> - 2.20180701
Chris PeBenito (28):
Enable cgroup_seclabel and nnp_nosuid_transition.
Misc dbus fixes from Russell Coker.
Simple map patch from Russell Coker.
another trivial dbus patch from Russell Coker.
Merge branch 'xtable-proc' of https://github.com/bigon/refpolicy
iptables: Module version bump.
Update contrib.
.travis.yml: Change to master branch for sctp support.
corenetwork, init: Module version bump.
Module version bumps for patches from James Carter.
Update contrib.
init, logging, sysnetwork, systemd, udev: Module version bump.
sysnetwork: Move lines in sysnet_read_config().
sysnetwork: Module version bump.
init: Module version bump.
Remove deprecated flask.py script.
Switch all remaining Python references to the Python 3 interpreter.
systemd: Move lines.
corecommands: Module version bump.
Makefile: Tweak cli output.
XDG: Module version bump.
Remove refpolicy-contrib submodule.
Re-add policy modules from old refpolicy-contrib submodule.
Move all files out of the old contrib directory.
Changelog.contrib: Add note about refpolicy-contrib removal.
sysnetwork: Module version bump.
xdg, xserver, mplayer, games: Module version bump.
Bump module versions for release.
Christian Göttsche (1):
add definition of bpf class and systemd perms
Dave Sugar (8):
Fix problems booting with fips=1
Interface to read /run/systemd/resolve/resolv.conf
Allow systemd-resolved to read sysctl
Allow systemd_resolved to read systemd_networkd runtime files
Allow systemd-resolved to connect to system dbusd
systemd-resolved uses notify to indicate status
policy for systemd-update-done
policy for systemd-hwdb
James Carter (8):
Removed unnecessary semicolons
Mark unused parameters as unused
Move the use of var_log_t from authlogin.fc to logging.fc
Move the use of initrc_var_run_t from files.fc to init.fc
Move use of systemd_unit_t from systemd.fc to init.fc
Move use of user_devpts_t from terminal.fc to userdomain.fc
Remove undeclared identifiers from interfaces
Remove undeclared identifiers from xserver interface
Jason Zaman (9):
sysnetwork: put systemd_read_resolved_runtime in an ifdef
init: Add filetrans for /run/initctl
corecommands: adjust gcc fcontext to also work on musl
userdom: remove filetrans from userdom_user_content_access_template
xdg: Add map perms, also make lnk_file, dirs consistent
xdg: filetrans should not add filetrans from user_home_dir
xdg: Introduce xdg_search_cache_dirs
xserver: Add mesa_shader_cache for GLSL in ~/.cache/mesa_shader_cache/
apps: rw mesa_shader_cache
Laurent Bigonville (1):
Label /etc/hosts.allow as net_conf_t
Miroslav Grepl (1):
xtables-multi wants to getattr of the proc fs
Richard Haines (1):
refpolicy: Update for kernel sctp support
Sven Vermeulen (7):
Add gentemplates.sh to extract template content
Update segenxml to include support for templated booleans and tunables
Generate template code and update genxml call for documentation generation
freedesktop location support
Allow X server users to manage all xdg resources
helper interfaces to read/manage all user content
tunable-managed user content access template
* Sun Jan 14 2018 Chris PeBenito <[email protected]> - 2.20180114
Adam Duskett (1):
fix regex escape sequence error.
Anthony PERARD (1):
Update for Xen 4.7
Chad Hanson (1):
Fix implementation of MLS file relabel attributes
Chris PeBenito (74):
Module version bump for patches from Guido Trentalancia and Anthony
PERARD.
Rules.modular: Fix file context verification.
Remove deprecated interfaces older than one year old.
.travis.yml: Use git tag instead of release tarball for selinux userspace.
kernel: Module version bump for patch from Nicolas Iooss.
Remove complement and wildcard in allow rules.
logging: Move line.
Module version bump for patches from Nicolas Iooss.
Module version bump for fixes from Nicolas Iooss.
Update contrib.
dbus: move comments out of the file context definitions
Update contrib.
systemd, udev: Module version bump.
systemd: Whitespace fix.
Module version bump for patches from Nicolas Iooss.
init: Move fc lines.
init: Module version bump for patch from Dave Sugar.
files: Move files_check_write_pid_dirs interface.
terminal: Rename term_create_devpts.
Several module version bumps.
init: Move init_spec_daemon_domain implementation.
Module version bumps.
init: Rename init_rlimit_inherit to init_inherit_rlimit.
init: Whitespace fix.
Module version bumps.
spamassassin: Fix build error.
init: Fix XML error.
spamassassin: Add missing requirement in spamassassin_admin().
sysadm,fstools: Module version bump.
authlogin, logging, udev: Module version bump.
init: Remove sm-notify.pid fc entry which collides with the rpc module.
corecommands, xserver, systemd, userdomain: Version bumps.
Update contrib.
Update contrib.
corecommands: Module version bump.
init: Module version bump.
Merge pull request #125 from lalozano/master
devices: Module version bump.
Module version bumps.
Merge branch 'master' of git://github.com/davidgraz/refpolicy
ipsec: Module version bump.
Merge branch 'master' of git://github.com/aduskett/refpolicy
init: Clean up line placement in init_systemd blocks.
files: Whitespace fix.
Merge branch 'systemd-networkd'
files, init, sysnetwork, systemd: Module version bumps.
Merge pull request #128 from williamcroberts/fc-sort-fixups
Update contrib.
files, netutils: Module version bump.
miscfiles: Module version bump.
Update contrib.
files, userdomain: Module version bump.
kernel, mls, sysadm, ssh, xserver, authlogin, locallogin, userdomain:
Module version bumps.
Several module version bumps.
Module version bumps.
dmesg, locallogin, modutils: Module version bump.
loadable_module.spt: Add debugging comments for tunable_policy blocks.
networkmanager: Grant access to unlabeled PKeys
filesystem: Rename fs_relabel_cgroup_lnk_files.
corcmd, fs, xserver, init, systemd, userdomain: Module version bump.
xserver, sysnetwork, systemd: Module version bump.
xserver: Module version bump.
init: Module version bump.
Update contrib.
mls, xserver, systemd, userdomain: Module version bump.
storage, userdomain: Module version bump.
Add new mmap permission set and pattern support macros.
Add missing mmap_*_files_pattern macros.
Revise mmap_file_perms deprecation warning message.
Update contrib.
hostname: Module version bump.
Update contrib.
init: Module version bump.
Bump module versions for release.
Christian Göttsche (6):
update travis
rkhunter: add interfaces for var_run and lock dir access check
dphysswapfile: add interfaces and sysadm access
hostname: cmdline usage + signal perms sort
filesystem: add fs_rw_inherited_hugetlbfs_files for apache module
init: add init_rw_inherited_stream_socket
David Graziano (1):
system/ipsec: Add signull access for strongSwan
David Sugar (20):
Strip spaces from NAME
Separate read and write interface for tun_tap_device_t
Label RHEL specific systemd binaries
Label /etc/rsyslog.d as syslog_conf_t
Add init_spec_daemon_domain interface
Add status into init_startstop_service interface
Add int_rlimit_inherit interface
remove interface init_inherit_rlimit
Fix problem labeling /run/log/journal/*
Denial relabeling /run/systemd/private
policy for systemd-networkd
Label /var/lib/lightdm-data
Change label for ~/.xsession-errors
Work around systemd-logind patch not in RHEL 7.x yet
RHEL 7.4 has moved the location of /usr/libexec/sesh to
/usr/libexec/sudo/sesh
Create interfaces to write to inherited xserver log files.
label systemd-shutdown so shutdown works
Make an attribute for objects in /run/user/%{USERID}/*
Make xdm directories created in /run/user/%{USERID}/ xdm_runtime_t
(user_runtime_content_type)
Allow systemd_logind to delete user_runtime_content_type files
David Sugar via refpolicy (2):
label /etc/mcelog/mcelog.setup correctly (for RHEL)
Allow xdm_t to read /proc/sys/crypto/fips_enabled
Guido Trentalancia (4):
userdomain: allow netlink_kobject_uvent_socket creation
xserver: do not audit ioctl operations on log files
fc_sort: memory leakages
base: create a type for SSL private keys
Jason Zaman (8):
Allow sysadm to map all non auth files
userdomain: allow admin to rw tape storage
files: fcontext for /etc/zfs/zpool.cache
mls mcs: Add constraints for key class
Add key interfaces and perms
gssproxy: Allow others to stream connect
userdomain: Allow public content access
storage: Add fcontexts for NVMe disks
Jason Zaman via refpolicy (3):
udev: map module objects to load kernel modules
syslog: allow map persist file
sudo: add fcontext for /run/sudo/ts/USERNAME
Konrad Rzeszutek Wilk (2):
kernel/xen: Update for Xen 4.6
kernel/xen: Add map permission to the dev_rw_xen
Krzysztof Nowicki (2):
Add policy for systemd GPT generator
Allow systemd to relabel cgroupfs legacy symlinks
Laurent Bigonville (2):
Allow domains using sysnet_dns_name_resolve() interface to access NSS
mymachines files
Add private type for systemd logind inhibit files and pipes
Luis A. Lozano (1):
Avoid memory leak warning.
Luis Ressel (15):
modutils: libkmod mmap()s modules.dep and *.ko's
libraries: ldconfig maps its "aux-cache" during cache updates
userdomain: Add various interfaces granting the map permission
files: Create files_map_usr_files interface
selinuxutil: Add map permissions neccessary for semanage
kernel: Add map permission to the dev_{read, write}_sound* interfaces
miscfiles: Allow libfontconfig consumers to map the fonts cache
userdomain: man-db needs to map its 'index.db' cache
logging: Various audit tools (auditctl, ausearch, etc) map their config
and logs
Grant all permissions neccessary for Xorg and basic X clients
libraries: Add fc entry for musl's ld.so config
xserver: Allow xdm_t to map usr_t files
locallogin: Grant local_login_t the dac_read_search capability
dmesg: Grant read access to /usr/share/terminfo
modutils: Dontaudit CAP_SYS_ADMIN checks for modprobe
Luis Ressel via refpolicy (2):
kernel/files.if: files_list_kernel_modules should grant read perms for
symlinks
netutils: Grant netutils_t map perms for the packet_socket class
Nicolas Iooss (9):
Add module_load permission to self when loading modules is allowed
audit: allow reading /etc/localtime
corecommands: label dhcpcd hook scripts bin_t
Add "/usr/(.*/)?bin(/.*)?" pattern back
Allow dhcpcd to use generic netlink and raw IP sockets
corecommands: label Arch Linux pacman's scripts as bin_t
init: allow systemd to create /dev/pts as devpts_t
init: allow systemd to relabel /dev and /run
corecommands: label systemd script directories bin_t
Nicolas Iooss via refpolicy (1):
terminal: /dev/pts exists in /dev filesystem
Russell Coker (4):
systemd nspawn and backlight
udev and dhcpd
minor nspawn, dnsmasq, and mon patches
refpolicy and certs
William Roberts (1):
fc_sort: use calloc instead of malloc
* Sat Aug 05 2017 Chris PeBenito <[email protected]> - 2.20170805
Chris PeBenito (134):
Create / to /usr equivalence for bin, sbin, and lib, from Russell Coker.
usrmerge FC fixes from Russell Coker.
Systemd tmpfiles fix for kmod.conf from Russell Coker.
Update contrib.
mon policy from Russell Coker.
Fix contrib commit.
Revert "bootloader: stricter permissions and more tailored file contexts"
Module version bump for bootloader patch revert. Plus compat alias.
Update contrib.
Sort capabilities permissions from Russell Coker.
Update contrib.
Little misc patches from Russell Coker.
Implement WERROR build option to treat warnings as errors.
Fix Travis-CI WERROR support.
Travis-CI: Terminate build immediately on error.
mon: Fix deprecated interface usage.
Merge branch 'setfiles_getattr' of git://github.com/cgzones/refpolicy
Merge branch 'sysadm_fixes' of git://github.com/cgzones/refpolicy
Merge branch 'corecmd_module' of git://github.com/cgzones/refpolicy
Merge branch 'var_and_run' of git://github.com/cgzones/refpolicy
Module version bump for changes from cgzones.
Merge pull request #98 from cgzones/admin_process_pattern
Merge branch 'hostname_module' of git://github.com/cgzones/refpolicy
Module version bump for hostname fix from cgzones.
Only display the WERROR notice if there actually are errors.
Merge branch 'master' of github.com:TresysTechnology/refpolicy
dpkg: Updates from Russell Coker.
Monit policy from Russell Coker and cgzones.
monit: Fix build error.
fetchmail, mysql, tor: Misc fixes from Russell Coker.
Merge branch 'systemd_transient' of git://github.com/cgzones/refpolicy
Merge branch 'selinuxutil_module' of git://github.com/cgzones/refpolicy
Module version bump for selinuxutil and systmd changes from cgzones.
Merge branch 'cgroups_fix' of git://github.com/cgzones/refpolicy
Module version bump for cgroups systemd fix from cgzones.
alsa, vnstat: Updates from cgzones.
Merge branch 'init_ntp_interface' of git://github.com/cgzones/refpolicy
Module version bump for ntp fixes from cgzones.
Systemd fixes from Russell Coker.
Fix CI errors.
Module version bump for CI fixes.
Xen fixes from Russell Coker.
mailman: Fixes from Russell Coker.
init: Rename init_search_pid_dirs() to init_search_pids().
init: Move interface and whitespace change.
systemd: Further revisions from Russell Coker.
Fix typo in README.
Network daemon patches from Russell Coker.
apache: Fix CI error.
devices: Fix docs for dev_write_generic_sock_files().
Merge branch 'su_module' of git://github.com/cgzones/refpolicy
Merge branch 'newrole_fixes' of git://github.com/cgzones/refpolicy
auth: Move optional out of auth_use_pam_systemd() to callers.
Merge branch 'locallogin_module' of git://github.com/cgzones/refpolicy
Module version bump for patches from cgzones.
Merge branch 'userdom_terminals_permit_open' of
git://github.com/cgzones/refpolicy
Module version bump for user terminal improvments from cgzones.
Merge branch 'monit_depend' of git://github.com/cgzones/refpolicy
Module version bump for misc fixes from cgzones.
Merge pull request #103 from fishilico/validate_modular_fc
Merge branch 'getty_module' of git://github.com/cgzones/refpolicy
Module version bump for getty patch from cgzones.
Merge branch 'modutils_module' of git://github.com/cgzones/refpolicy
Merge branch 'fix_usr_bin_merge' of git://github.com/cgzones/refpolicy
Module version bumps for fixes from cgzones.
Merge branch 'lvm' of git://github.com/cgzones/refpolicy
Merge branch 'macros' of git://github.com/cgzones/refpolicy
Module version bump for fixes from cgzones.
Module version bump for fixes from cgzones.
dontaudit net_admin for SO_SNDBUFFORCE
/var/run -> /run again
Merge branch 'var_run' of git://github.com/cgzones/refpolicy
Module version bump from /var/run fixes from cgzones.
Merge branch 'monit' of git://github.com/cgzones/refpolicy
Module version bump for monit patch from cgzones
another version of systemd cgroups hostnamed and logind
Merge pull request #109 from cgzones/python3
systemd-resolvd, sessions, and tmpfiles take2
systemd-nspawn again
Merge pull request #112 from cgzones/remove_support/pyplate
Misc fc changes from Russell Coker.
Systemd-related changes from Russell Coker.
Merge pull request #115 from fishilico/python_raw_strings
Module version bump for misc fixes from Guido Trentalancia.
systemd init from Russell Coker
more systemd stuff from Russell Coker
misc daemons from Russell Coker.
bootloader from Russell Coker.
kmod, lvm, brctl patches from Russell Coker
devicekit, mount, xserver, and selinuxutil from Russell Coker
another bootloader patch from Russell Coker
some userdomain patches from Russell Coker
corecommands: Add fc escaping for previous patch.
Module version bump for patch from Guido Trentalancia
Module version bump from fixes from Guido Trentalancia.
xdm sigchld interface from Russell Coker.
Further strict systemd fixes from Russell Coker.
Update contrib.
locallogin: Move two sulogin lines.
Login take 4 from Russell Coker.
Rename apm to acpi from Russell Coker.
Module version bump for patches from Russell Coker and Guido Trentalancia.
some little misc things from Russell Coker.
apt/dpkg strict patches from Russell Coker.
little misc strict from Russell Coker.
locallogin: Move one line.
Module version bump for locallogin patch from Guido Trentalancia.
Module version bump for minor fixes from Guido Trentalancia.
Merge branch 'usr_bin_fc' of
git://github.com/fishilico/selinux-refpolicy-patched
Module version bump for /usr/bin fc fixes from Nicolas Iooss.
Module version bump for changes from Jason Zaman and Luis Ressel.
init: add comment for ProtectSystem.
Module version bump for systemd fix from Krzysztof Nowicki.
Update contrib
Module version bump for libmtp from Guido Trentalancia.
corenet/sysadm: Move lines.
Module version bump for infiniband policy from Daniel Jurgens.
Module version bump for mmap fixes from Stephen Smalley.
Update contrib.
Module version bumps for patches from Jason Zaman.
filesystem: Fix error in fs_cgroup_filetrans().
Module version bumps for patches from Jason Zaman.
gpg: Module version bump for patch from Guido Trentalancia.
miscfiles: Module version bump for patch from Luis Ressel.
Module version bump for patches from cgzones.
Module version bump for patches from cgzones.
netutils: Module version bump for patch from Luis Ressel.
README: Update build requirements.
travis-ci: Update to 2.7 userspace release.
Enable extended_socket_class policy capability;
Add nnp_nosuid_transition policycap and related class/perm definitions.
Add cgroup_seclabel policycap.
init: Add NoNewPerms support for systemd.
Bump module versions for release.
Daniel Jurgens (1):
refpolicy: Infiniband pkeys and endports
Guido Trentalancia (8):
userdomain: do not audit netlink socket creation attempts
corecommands: new file contexts for Gnome applications
locallogin: fix the sulogin submodule (emergency shell!)
locallogin: fine tune DAC override permissions
kernel: low-priority update
init: smoother system boot
base: role changes for the new libmtp module
fc_sort: avoid compiler warning/error
Guido Trentalancia via refpolicy (1):
xserver: fix iceauth_home_t file context creation
Jason Zaman (6):
authlogin: put interface properly inside optional
libraries: update wildcard /usr/lib fcontext
appconfig: Add openrc_contexts file
corecommands: add consolekit fcontexts
dirmngr: add to roles
filesystem: introduce fs_cgroup_filetrans interface
Krzysztof Nowicki (1):
Enable /etc directory protection using ProtectSystem
Luis Ressel (5):
system/selinuxutil: Allow semanage to execute its tmp files
system/miscfiles: Generalize the man_t fc's
netutils: Mix nmap perms in with the other traceroute_t perms
netutils: Add some permissions required by nmap to traceroute_t
netutils: Allow tcpdump to reduce its capability bounding set
Nicolas Iooss (5):
Make "validate" target verify file contexts
devices: fix Debian file contexts
Use raw strings in regular expressions
Synchronize file patterns for /usr/bin/mount... and /usr/sbin/mount...
Support systems with a single /usr/bin directory
Russell Coker (4):
inherited file and fifo perms
tiny mon patch
rw_inherited_file_perms
new init interfaces for systemd
Stephen Smalley (3):
refpolicy: Define getrlimit permission for class process
refpolicy: Define smc_socket security class
refpolicy: Define and allow map permission
cgzones (40):
systemd: label /run/systemd/transient as systemd_unit_t
setfiles: allow getattr to kernel pseudo fs
sysadm: fix denials
hostname: small adjustments
selinuxutil: adjustments
corecommands: label some binaries as bin_t
files: no default types for /run and /var/lock
add admin_process_pattern macro
systemd_cgroups_t: fix denials
locallogin: adjustments
authlogin: introduce auth_use_pam_systemd
su: some adjustments
newrole: fix denials
add corecmd_check_exec_bin_files()
add fs_getattr_dos_dirs()
update init_ACTION_all_units
add init_daemon_lock_file()
improve documentation for user_user_(inherited_)?user_terminals
getty: overlook module
modutils: format filecontexts
modutils: adjust interfaces after recent binaries merge
systemd-tmpfiles: refactor runtime configs
corecommands: fix corecmd_*_bin() for usr merged systems
corecmd_read_bin_symlinks(): remove deprecated and redundant calls
modutils: adopt callers to new interfaces
m4 errprint: add __program__ info
domtrans_pattern: use inherited fifo perms
sysadm: add monit admin permissions
lvm: small adjustments
convert build scripts to python3
travis: run make xml, html and install(-.*)? targets
fix travis and genhomedircon
remove /var/run file context leftovers
travis: move after_success tests into script section
clean up python3 cache on make bare
rkhunter: add interfaces for rkhunter module and sysadm permit
iptables: align file contexts
chkrootkit: add interfaces and sysadm permit
netutils: update
iptables: update
* Sat Feb 04 2017 Chris PeBenito <[email protected]> - 2.20170204
Chris PeBenito (55):
Module version bumps for patches from Guido Trentalancia.
Update contrib.
Remove unneeded system_u seusers mapping.
Update contrib.
Merge pull request #45 from cgzones/travis2
Merge pull request #46 from cgzones/update_readme
Merge pull request #47 from cgzones/spelling
Module version bump for xserver patch from Guido Trentalancia
Update contrib.
Merge pull request #50 from cgzones/macros
Merge pull request #48 from cgzones/makefile
xserver: Rearrange lines
Module version bump for xserver changes from Guido Trentalancia.
Merge branch 'dhcp_avahi' of https://github.com/cgzones/refpolicy
Module version bumps for patches from cgzones.
Update contrib.
Merge branch 'syslogd' of git://github.com/cgzones/refpolicy
Module version bump for journald fixes from cgzones.
Merge pull request #57 from cgzones/trailing_whitespaces
modutils: Move lines.
Module version bumps for openoffice patches from Guido Trentalancia.
Module version bump for kernel sysctl patch from Luis Ressel
Update contrib.
Module version bump for netutils patch from Luis Ressel.
Module version bump for xserver patch from Guido Trentalancia.
Module version bumps for patches from Guido Trentalancia.
rtkit: enable dbus chat with xdm
xserver: Move interface definition.
Module version bump for patches from Guido Trentalancia.
Module version bump for xscreensaver patch from Guido Trentalancia.
Merge branch 'run_transition' of git://github.com/cgzones/refpolicy
Module version bumps for /run fc changes from cgzones.
Module version bump for patches from Guido Trentalancia.
Merge branch '2016-12-27_systemd' of
git://github.com/fishilico/selinux-refpolicy-patched
Module version bump for systemd patch from Nicolas Iooss.
Merge branch 'usr-fc' of
git://github.com/fishilico/selinux-refpolicy-patched
Module version bump for fc updates from Nicolas Iooss.
Module version bump for patches from Guido Trentalancia.
xserver: Update from Russell Coker for boinc.
Module version bump for patches from Guido Trentalancia.
Merge pull request #62 from cgzones/fix_permission_segenxml
Merge pull request #94 from cgzones/travis
Merge branch 'corenetork_module' of git://github.com/cgzones/refpolicy
Merge branch 'mount_module' of git://github.com/cgzones/refpolicy
Merge branch 'terminal_module' of git://github.com/cgzones/refpolicy
Merge branch 'files_search_src' of git://github.com/cgzones/refpolicy
Merge branch 'unconfined_module' of git://github.com/cgzones/refpolicy
Merge branch 'auditd_fixes' of git://github.com/cgzones/refpolicy
Module version bumps for patches from cgzones.
Module version bump for cpu_online genfscon from Laurent Bigonville.
Update contrib.
Fix contrib.
Module version bump for cups patch from Guido Trentalancia.
Module version bump for xkb fix from Jason Zaman.
Bump module versions for release.
Guido Trentalancia (19):
xserver: remove unneeded user content permissions
xserver: remove unneeded user content permissions
Apache OpenOffice module (base policy part)
xserver: enable dbus messaging with devicekit power
authlogin: indentation/whitespace fix
wm: update the window manager (wm) module and enable its role template
(v7)
userdomain: separate optional conditionals for gnome and wm role templates
udev: manage tmpfs files and directories
udev: always enable kernel module loading
base: enable the xscreensaver role
bootloader: stricter permissions and more tailored file contexts
modutils: update to run in confined mode
base: use new genhomedircon template for username
kernel: missing permissions for confined execution
xserver: introduce new fc and interface to manage X session logs
kernel: add missing plymouth interface
xserver: restrict executable memory permissions
init: support sysvinit
udev: execute HPLIP applications in their own domain
Guido Trentalancia via refpolicy (4):
Let users read/manage symlinks on fs that do not support xattr
Let unprivileged users list mounted filesystems
Let the user list noxattr fs directories
sysadm: add the shutdown role
Jason Zaman (1):
xserver: allow X roles to read xkb libs to set keymaps
Laurent Bigonville (1):
Use genfscon to label /sys/devices/system/cpu/online as cpu_online_t
Luis Ressel (3):
system/modutils: Add kernel_search_key(kmod_t)
kernel.if: Allow listing /proc/sys/net/unix
netutils: Label iptstate as netutils_t
Nicolas Iooss (4):
systemd: add systemd-backlight policy
systemd: add systemd-binfmt policy
Allow searching /proc/sys/fs when using /proc/sys/fs/binfmt_misc
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib
Russell Coker (1):
single binary modutils