This repository has been archived by the owner on Jul 2, 2018. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 28
/
Changelog
2210 lines (2123 loc) · 101 KB
/
Changelog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
* Sun Jan 14 2018 Chris PeBenito <pebenito@ieee.org> - 2.20180114
Chad Hanson (1):
Allow rpm to relabel files at all levels
Chris PeBenito (46):
Remove deprecated interfaces more than one year old.
Remove complement and wildcard in allow rules.
Merge branch 'master' of git://github.com/teg/refpolicy-contrib
dbus: Module version bump for dbus-broker patch from Tom Gundersen.
Module version bump for patches from Guido Trentalancia.
Module version bumps for patches from David Sugar.
dhcp, logrotate: Module version bump.
Module version bumps for chkrootkit, dkim, dmidecode, portage, and
rkhunter.
Module version bumps.
spamassassin: Move lines.
mandb, spamassassin: Module version bumps.
spamassassin: Fix build error.
spamassassin: Add missing requirement in spamassassin_admin().
dphysswapfile: Module version bump.
gpg, pulseaudio, rpc: Module version bump.
dnsmasq, gnome, mon, mta, openoffice, pulseaudio, wm: Version bumps.
Revert "postfix: Some table drivers (notably cdb) need to mmap() their
databases"
java, mozilla, mta, postfix: Module version bump.
portage: Fix usr_t map interface usage.
apache, portage: Module version bump.
dbus, policykit, wm: Module version bump.
dbus: Add comment.
Merge branch 'nm_audit' of git://github.com/bigon/refpolicy-contrib
networkmanager: Module version bump.
virt: Move a line.
alsa, mon, virt: Module version bump.
gpg, mozilla, rpc: Module version bump.
Several module version bumps.
blueman, evolution, gpg, mozilla, openoffice, thunderbird, wireshark, wm:
Module version bump.
wm: Module version bump.
networkmanager: Move line.
networkmanager: Module version bump.
Merge branch 'pkcs' of https://github.com/dodys/refpolicy-contrib
pkcs: Rename pkcs_slotd_unit_file_t.
pkcs: Module version bump.
accountsd, policykit: Module version bump.
dbus, devicekit, modemmanager, networkmanager, virt: Module version bump.
modemmanager: Move lines.
rpm: Module version bump.
cachefilesd, dbus, dirmngr, gnome, gpg, pulseaudio: Module version bump.
Replace deprecated mmap perm sets and pattern usage.
gssproxy: Module version bump.
monit: Module version bump.
apache, dkim, monit: Module version bump.
spamassassin: Module version bump.
Bump module versions for release.
Christian Göttsche (20):
dkim: align filecontexts
dkim: update
milter: align filecontexts
apache: align filecontexts
dmidecode: use userdom_use_inherited_user_terminals
spamassassin: align filecontexts
chkrootkit: update
rkhunter: add several missing permission
fakehwclock: update
milter: update
mandb: fixes for systemd timer and /usr/local/man label
spamassassin: update
dphysswapfile: fix swapfile creation
apache: update
monit: update
dkim: align file contexts
dkim: update
apache: update
monit: read /usr/share/ca-certificates for cert verification
spamassassin: fix missing perms
Daniel Jurgens (1):
networkmanager: Grant access to unlabeled PKeys
David Sugar (5):
mon: move rpc_* into optional
wm: consolidate networkmanger interface calls into single optional
cron: optional_policy for mta_* interfaces
Label /usr/bin/mutter
Allow to read /proc/sys/crypto/fips_enabled
Eduardo Barretto (2):
Update pkcs policy to include pkccsslotd.service
Update missing permissions for pkcs
Guido Trentalancia (13):
libmtp: read symlinks in user home directories
spamassassin: update rules for the Bayesian classifier trainer
wm: let gnome-shell start properly
gnome: keyring daemon dbus policy update
gnome: keyring daemon read SELinux config
openoffice: improve temporary directories' operations
pulseaudio: general update
wm: gnome-shell SELinux integration
mozilla: run Java Web Start applications
wm: run PolicyKit
dbus: read user home content files
mozilla: read generic SSL certificates
contrib: use the new SSL private keys type (was: "let the mozilla and
other domains read generic SSL certificates")
Jason Zaman (12):
cgmanager: Apply auth_use_nsswitch interface
alsa: needs to map its tmpfs files
virt: add policy for virtlogd
virt: updated perms for starting guests
gssproxy: add policy
rpc: Allow stream connect to gssproxy
gpg: search dir when connecting to agent socket
dirmngr: allow filetrans in gpg_runtime_t
gpg: Add gpg_agent_use_card boolean for OpenPGP cards
cachefilesd: make cachefilesd_cache_t a mountpoint
Set user_runtime_content_type for all remaining types in /run/user/%{UID}/
gssproxy: allow writing kerberos rcache
Jason Zaman via refpolicy (3):
pulseaudio: Add neccessary map permissions
gpg: add fcontexts for user runtime sockets
rpc: add sm-notify pid fcontext
Laurent Bigonville (2):
Allow NetworkManager to write to audit
Call systemd_write_inherited_logind_inhibit_pipes() where needed
Luis Ressel (12):
portage: Allow portage_t and portage_sandbox_t to access locale_t
postfix: Some table drivers (notably cdb) need to mmap() their databases
portage: Grant the map permissions neccessary for git and install
alsa: alsactl needs to map its configuration
mozilla: Add neccessary map permissions
mandb: man-db needs to map its 'index.db' cache
portage: Remove nonsensical dontaudit of an allowed permission
portage: Transition to ldconfig_t when calling ldconfig
postfix: Some table drivers (notably cdb) need to mmap() their databases
postfix: Silence cap_dac_read_search denials
portage: Grant portage the map permission on usr_t
Allow gtk apps to map usr_t files
Nicolas Iooss (2):
dbus: move comments out of the file context definitions
logrotate: allow systemd to start logrotate
Russell Coker (3):
udev and dhcpd
minor nspawn, dnsmasq, and mon patches
refpolicy and certs
Tom Gundersen (1):
dbus: add policy for dbus-broker
* Sat Aug 05 2017 Chris PeBenito <pebenito@ieee.org> - 2.20170805
Chris PeBenito (82):
Create / to /usr equivalence for bin, sbin, and lib, from Russell Coker.
Module version bump for usrmerge FC fixes from Jason Zaman.
mon policy from Russell Coker.
Module version bump for cups patches from Guido Trentalancia.
Module version bump for tbird and mozilla printing from Guido
Trentalancia.
Revert "cups/lpd: read permission for cupsd_var_run_t socket files"
Module version bump for cups revert.
Sort capabilities permissions from Russell Coker.
Little misc patch from Russell Coker.
mon: Fix deprecated interface usage.
dpkg: Updates from Russell Coker.
Monit policy from Russell Coker and cgzones.
monit: Fix build error.
fetchmail, mysql, tor: Misc fixes from Russell Coker.
Merge branch 'alsa_module' of git://github.com/cgzones/refpolicy-contrib
Merge branch 'vnstat_module' of git://github.com/cgzones/refpolicy-contrib
Module version bump for alsa and vnstatd fixes from cgzones.
Merge branch 'ntp_module' of git://github.com/cgzones/refpolicy-contrib
Module version bump for ntp fixes from cgzones.
samba: A few line moves.
Module version bump for samba patch from Russell Coker.
Systemd fixes from Russell Coker.
Xen fixes from Russell Coker.
mailman: Fixes from Russell Coker.
MTA fixes from Russell Coker.
Network daemon patches from Russell Coker.
apache: Fix CI error.
Merge branch 'modutils_adapt_interfaces' of
git://github.com/cgzones/refpolicy-contrib
Merge branch 'corecmd_read_bin_symlinks' of
git://github.com/cgzones/refpolicy-contrib
Module version bumps for fixes from cgzones.
Merge branch 'mandb' of git://github.com/cgzones/refpolicy-contrib
Merge branch 'dphysswapfile' of git://github.com/cgzones/refpolicy-contrib
Module version bump for dphysswapfile and mandb fixes from cgzones.
Merge branch 'var_run_filecontext' of
git://github.com/cgzones/refpolicy-contrib
Merge branch 'vnstatd' of git://github.com/cgzones/refpolicy-contrib
Module version bump for fixes from cgzones.
dontaudit net_admin for SO_SNDBUFFORCE
/var/run -> /run again
Merge branch 'monit' of git://github.com/cgzones/refpolicy-contrib
Module version bump for monit patch from cgzones.
systemd-resolvd, sessions, and tmpfiles take2
Misc fc changes from Russell Coker.
Systemd-related changes from Russell Coker.
networkmanager: adjust interface docs format.
wm: interface docs adjustment.
Module version bump for misc fixes from Guido Trentalancia.
systemd init from Russell Coker
misc daemons from Russell Coker.
logging patches from Russell Coker
kmod, lvm, brctl patches from Russell Coker
devicekit, mount, xserver, and selinuxutil from Russell Coker
some userdomain patches from Russell Coker
Module version bump for gnome fix from Guido Trentalancia.
apache: Move blocks. No rule changes.
Module version bump for changes from Sven Vermeulen and Guido
Trentalancia.
login take 4 from Russell Coker.
Rename apm to acpi from Russell Coker.
Module version bump for patches from Russell Coker.
some little misc things from Russell Coker.
apt/dpkg strict patches from Russell Coker.
Module version bump for minor fixes from Guido Trentalancia.
Merge branch 'usr_bin_fc' of
git://github.com/fishilico/selinux-refpolicy-contrib
Module version bump for /usr/bin fc fixes from Nicolas Iooss.
Module version bump for chronyd changes from Luis Ressel.
openoffice: Move ooffice_rw_tmp_files() implementation.
Module version bump for openoffice fix from Guido Trentalancia.
libmtp: move lines
Module version bump for fixes from Guido Trentalancia.
Module version bump for mmap fixes from Stephen Smalley.
Module version bump for misc patches from Guido Trentalancia.
gpg: Fix overspecified dependencies in gpg_agent_tmp_filetrans.
dirmngr: Whitespace fixes.
Module version bumps for patches from Jason Zaman.
cgmanager: Move lines
Module version bumps for patches from Jason Zaman.
gpg: Module version bump for patch from Guido Trentalancia.
mozilla: Module version bump for patch from Luis Ressel.
rkhunter: Fix module version and move lines.
Module version bump for patches from cgzones.
chkrootkit: Fix module version.
Module version bump for patches from cgzones.
Bump module versions for release.
Guido Trentalancia (28):
cups: read permission for cupsd_var_run_t socket files in
cups_stream_connect()
cups/lpd: read permission for cupsd_var_run_t socket files
thunderbird: allow stream connections to cups so that it can print
mozilla: allow stream connections to cups so that it can print
java: enable interactive use
evolution: add dbus acquire service permission
evolution: do not audit kernel read state
evolution: add some critical permissions
mozilla: read hardware state information
mozilla: add a permission
wm: load the NetworkManager applet
wm: interactive start
Gnome and Evolution dbus chat permissions
openoffice: support starting it from the window manager
evolution: minor fixes and updates
java: error messages terminal printout
loadkeys: use init fds (system bootup)
plymouth: pid interface usability
shutdown: send msg to syslog
openoffice: open files retrieved using mozilla
contrib: new libmtp module
openoffice: minor update
gnome: improved integration with openoffice
cups: let hplip read udev pid files
dbus: let session bus daemon manage user runtime dirs
zabbix: Grant zabbix_agent_t to call setrlimit on self
ntp: fix the drift file context and transition
gpg: manage user runtime socket files and directories
Jason Zaman (12):
usrmerge: Add missed /usr fcontexts
java: update fcontexts for new versions of icedtea
dirmngr: add to roles and allow gpg to domtrans
gpg dirmngr: create and connect to socket
dirmngr: fcontext for ~/.gnupg/crls.d/
dirmngr: Network rules to connect to keyserver
cgmanager: add policy from gentoo
consolekit: Add support for consolekit2
consolekit: allow purging tmp
consolekit: introduce consolekit_use_inhibit_lock interface
dbus: use consolekit inhibit locks
networkmanager: use consolekit inhibit locks
Luis Ressel (3):
chronyd: Re-align fc file
chronyd: Allow init scripts to create /run/chrony
mozilla: Add fc for the files used by the firefox addon "vimperator"
Nicolas Iooss (1):
Support systems with a single /usr/bin directory
Russell Coker (1):
patch for samba
Stephen Smalley (1):
contrib: allow map permission where needed
Sven Vermeulen (1):
rpc_* interfaces should be wrapped by optional_policy()
cgzones (16):
update ntp module
update alsa module
vnstatd: update module
corecmd_read_bin_symlinks(): remove deprecated and redundant calls
modutils: adopt calls to new interfaces
vnstatd: update
dphysswapfile: update
monit: update
mandb: update
logrotate: reload monit after log rotation
remove /var/run file context lefovers, add dbus exception
monit: add syslog access and support for monit systemd service
rkhunter: add policy module
arpwatch: align file contexts
chkrootkit: add policy module
arpwatch: update
* Sat Feb 04 2017 Chris PeBenito <pebenito@ieee.org> - 2.20170204
Chris PeBenito (41):
Module version bump for patches from Jason Zaman.
authbind: Remove dead policy.
Module version bump for cups patch from Guido Trentalancia.
Merge pull request #29 from cgzones/deprecated_macros
Module version bump for Debian fprintd fc entry from Laurent Bigonville.
Module version bumps for openoffice patches from Guido Trentalancia.
Module version bumps for patches from Guido Trentalancia.
Merge pull request #30 from cgzones/trailing_whitespaces
Module version bumps for mozilla and gpg patches from Luis Ressel.
Module version bump for patches from Guido Trentalancia.
Module version bump for patches from Guido Trentalancia.
rtkit, wm: Remove calls to nonexistant interfaces.
Module version bumps for patches from Guido Trentalancia.
rtkit: enable dbus chat with xdm
Module version bump for patches from Guido Trentalancia.
Module version bump for xscreensaver patch from Guido Trentalancia.
Merge branch 'run_transition' of
git://github.com/cgzones/refpolicy-contrib
Module version bumps for /run fc changes from cgzones.
Module version bump for openoffice and wm patches from Guido Trentalancia.
Module version bump for patches from Guido Trentalancia.
Module version bump for wm patch from Guido Trentalancia.
Merge branch 'usr-fc' of
git://github.com/fishilico/selinux-refpolicy-contrib
Module version bump for fc updates from Nicolas Iooss.
Module version bump for patches from Guido Trentalancia.
Module version bump for capability2 fixes from Guido Trentalancia.
Module version bump for plymouth fix from Guido Trentalancia.
boinc: Update from Russell Coker.
Module version bump for mozilla update from Guido Trentalancia.
Merge pull request #47 from cgzones/dphysswap_module
Merge pull request #40 from cgzones/fakehwclock_module
Merge branch 'gpg_module' of git://github.com/cgzones/refpolicy-contrib
Merge branch 'irqbalance_module' of
git://github.com/cgzones/refpolicy-contrib
Merge branch 'loadkeys_module' of
git://github.com/cgzones/refpolicy-contrib
Module version bumps for patches from cgzones.
Merge branch 'exim_module' of git://github.com/cgzones/refpolicy-contrib
Merge branch 'screen_module' of git://github.com/cgzones/refpolicy-contrib
Module version bump for screen and exim changes from cgzones.
screen: Revert broken interface call.
cups: Move hplip_domtrans interface.
Module version bump for cups patch from Guido Trentalancia.
Bump module versions for release.
Dominick Grift (1):
Re-add raid fc spec that must have been removed earlier by mistake
Guido Trentalancia (29):
cups: descend "rw" directories when reading configuration files
Apache OpenOffice module (contrib policy part)
openoffice: rename two interfaces in openoffice and evolution
mozilla: extend dbus connection permissions
openoffice: permission to read user temporary files
xguest: restrict ability to execute files on noxattr filesystems
pulseaudio: update server and client permissions
mozilla: remove redundant pulseaudio interface calls
networkmanager: read user certs not user content (was enable
userdom_read_user_certs() throughout the policy)
Make several calls to mta interfaces optional
wm: update the window manager (wm) module and enable its role template
(v7)
rtkit: enable dbus chat with xdm
networkmanager: enable dbus chat with xdm
policykit: enable dbus chat with xdm
games: general update and improved pulseaudio integration
wm: improved integration with games
xscreensaver: update the module so that it can be effectively used
wm: properly set domain entrypoint in wm_application_domain()
openoffice: add writer support for sending email directly to multiple
recipients
contrib: use new genhomedircon template for username
contrib: extend wm ability to launch confined graphical applications
contrib: support the new interface to manage X session logs
networkmanager: dbus chat with cups
cups: add cups-browsed executable fc
devicekit: add new wake_alarm permission (capability2)
networkmanager: add new wake_alarm permission (capability2)
plymouth: use the correct running domain for the client
mozilla: execute evolution to send emails
cups: new interface to execute HPLIP applications in their own domain
Jason Zaman (4):
pcscd: dbus and domain lookup
devicekit: fcontext for udisks2
gnome: add gkeyring rules and fcontext
gpg: add new socket paths
Laurent Bigonville (1):
Add debian path for fprintd daemon
Luis Ressel (3):
gpg: Add filetrans for scdaemon socket and gpg-agent extra sockets
gpg.fc: Adjust whitespace
mozilla: Add miscfiles_dontaudit_setattr_fonts_cache_dirs()
Nicolas Iooss (1):
Add file contexts for files in /usr/{lib,sbin}
cgzones (10):
use domain_auto_transition_pattern instead of domain_auto_trans
remove trailing whitespaces
transition file contexts to /run
update loadkeys module
add fakehwclock module
add dphysswapfile module
update gpg module
update screen module
update irqbalance module
update exim module
* Sun Oct 23 2016 Chris PeBenito <pebenito@ieee.org> - 2.20161023
Adam Tkac (2):
varnishncsa (varnishlog_t) reads localization files
Grant certmonger "chown" capability
Chris PeBenito (42):
Merge branch 'bigon-geoclue'
Add additional comments in geoclue.
Merge branch 'bigon-virt-1'
Merge branch 'nm-1' of git://github.com/bigon/refpolicy-contrib into
bigon-nm-1
Merge branch 'bigon-nm-1'
Module version bump for virt and networkmanager patches from Laurent
Bigonville.
Merge branch 'master' of git://github.com/bigon/refpolicy-contrib
Module version bump for firewalld updates from Laurent Bigonville.
Module version bump for collectd update from Jason Zaman.
Module version bumps for user runtime fixes from Jason Zaman.
Boinc updates from Russell Coker.
rpcbind: Read /sys/devices/system/cpu/online from Russell Coker.
watchdog: Move line.
Module version bump for watchdog pidfile option from Russell Coker.
Systemd units from Russell Coker.
Module version bump for pulseaudio fc fix from Jason Zaman.
cpucontrol: revise cpucontrol_conf_t labeling, from Guido Trentalancia.
Module version bumps for patches from Guido Trentalancia.
Update the telepathy module:
Update the alsa module so that the alsa_etc_t file context (previously
alsa_etc_rw_t) is widened to the whole alsa share directory, instead of
just a couple of files.
alsa: Add compatibility alias for alsa_etc_rw_t.
Update the sysnetwork module to add some permissions needed by the dhcp
client (another separate patch makes changes to the ifconfig part).
Module version bump for various patches from Guido Trentalancia.
pulseaudio: Fix compile errors.
Merge branch 'master' of
https://github.com/SeanPlacchetti/refpolicy-contrib
Module version bump for webalizer dead type removal from Sean Placchetti.
Module version bump for Evolution SSL fix from Guido Trentalancia.
evolution: Read user certs from Guido Trentalancia.
cups: Move can_exec() line.
cups: Module version bump for hplip patch from Guido Trentalancia
pulseaudio: Move interface definitions.
Module version bump for mozilla patch from Guido Trentalancia.
Module version bump for gnome patch from Guido Trentalancia.
Module version bump for evolution patch from Guido Trentalancia.
gpg: Whitespace fix.
Merge branch 'feature/fix-networkmanager-varrun-macro' of
https://github.com/rfkrocktk/refpolicy-contrib
Module version bump for networkmanager fix from Naftuli Tzvi Kay.
Merge branch 'rfkrocktk-feature/syncthing'
Rearrange lines in syncthing.
webalizer: Rearrange a couple lines.
Module version bump for webalizer patch from Russell Coker.
Bump module versions for release.
Dominick Grift (18):
Module version bump for changes to the geoclue module by Laurent
Bigonville.
Module version bump for changes to various modules from Laurent
Bigonville.
geoclue: move kernel interface call to the appropriate position
Actually associate mailmain_domain attribute with mailman domains
Module version bumps for changes to various modules by Nicolas Iooss
Module version bump for changes to the cron module by Jason Zaman
Module version bump for changes to the redis module by Grant Ridder
Module version bump for changes to the raid module by Laurent Bigonville
Module version bump for changes to the networkmanager module by Laurent
Bigonville.
Module version bump for changes to the redis module by Grant Ridder.
Module version bump for changes to the mozilla module by Laurent
Bigonville.
Module version bump for changes to the geoclue module by Nicolas Iooss.
Add hwloc-dump-hwdata SELinux policy
Module version bump for changes to the varnishd module by Robert Moucha
Module version bump for changes to the puppet module by Thomas Mueller
Module version bump for changes to the varnishd module by Adam Tkac
Module version bump for changes to the certmonger module by Adam Tkac
Revert "dbus: allow system, and session bus clients to answer to dbus
unconfined domains"
Grant Ridder (2):
Add read/write perms for redis-sentinel
Allow tcp_connect to redis_port_t for redis_t
Guido Trentalancia (7):
Policykit module: add fs_getattr_xattr_fs()
Update the policy for module apm
Let gpg disable core dumps
Update the rtkit module
Update the pulseaudio module for usability and ORC support
cups: update permissions for HP printers (load firmware)
gpg: public key signature verification in evolution
Guido Trentalancia via refpolicy (3):
evolution: read SSL certificates
mozilla: let mozilla play audio
gnome: add support for the OIL Runtime Compiler (ORC) optimized code
execution
Jason Zaman (10):
cron: Allow locks to be lnk_files
collectd: update policy for 5.5
consolekit: allow managing user runtime
pulseaudio: fcontext and filetrans for runtime
ftp: Add filetrans from user_runtime
gnome: Add filetrans from user_runtime
mplayer: Add filetrans from user_runtime
userhelper: Add filetrans from user_runtime
wm: Add filetrans from user_runtime
pulseaudio: fix user runtime fcontext
Laurent Bigonville (13):
Add initial geoclue 2 module
Properly escape dot in the path to the geoclue daemon
Use auth_use_nsswitch() as we need DNS resolving and access nsswitch.conf
virt.fc: Add some debian contexts
networkmanager.fc: nm-dispatcher.action has been renamed to nm-dispatcher
Allow some domain to read sysctl_vm_overcommit_t
Allow mdadm read efivarfs files
Allow /var/run/firewalld/ directory to transition to firewalld_var_run_t
Add an interface to allow a domain to read firewalld_var_run_t files
Allow firewalld to create firewalld_var_run_t directory.
dontaudit firewalld attempt to relabel its own config files
Allow NM to execute arping
Debian now ships firefox-esr, properly label the executable
Luis Ressel (1):
New policy for tboot utilities
Naftuli Tzvi Kay (2):
Fix NetworkManager Read Pid Files Macro
Syncthing Policy
Nicolas Iooss (3):
Describe _initrc_domtrans interfaces differently from the _domtrans ones
Fix typos in several interfaces
Add Arch Linux path for geoclue module
Robert Moucha (1):
Fix trivial typo in varnishncsa name
Russell Coker (2):
watchdog reads pid files
named reads vm sysctls
Russell Coker via refpolicy (1):
webalizer patch for inclusion
Sean Placchetti (1):
-Remove unused declarations from webalizer type enforcement file
Thomas Mueller (1):
Allow puppet_t transtition to shorewall_t
doverride (3):
Merge pull request #8 from bigon/geoclue
Merge pull request #11 from bigon/overcommit-1
Merge pull request #12 from fishilico/typos
* Tue Dec 08 2015 Chris PeBenito <selinux@tresys.com> - 2.20151208
Alexander Wetzel (1):
add vfio support for libvirt
Chas Williams - CONTRACTOR (1):
afs: update labels, file contexts and allow access to urandom
Chris PeBenito (14):
Module version bump for hadoop_admin() fix from Jazon Zaman.
Module version bump for fc typo in radius from Sven Vermeulen.
Module version bump for patches from Jason Zaman.
Module version bump for init_startstop_service from Jason Zaman.
Module version bump for cron_admin interface from Jason Zaman.
Comment/whitespace fix in virt.te.
Module version bump for vfio support for libvirt from Alexander Wetzel.
Add systemd unit types.
Add systemd socket activations.
Merge branch 'pebenito-master'
Module version bump for systemd additions.
Merge branch 'bigon-systemd'
Module version bump for dbus systemd patch from Laurent Bigonville.
Bump module versions for release.
Dominick Grift (16):
Module version bump for courier fixes from Sven Vermeulen.
Module version bump for afs fixes from Chas Williams.
Redundant rules and afs_files_t is not a filesystem type
Various samhain fixes
Cachefilesd module updates
Module version bump for changes to the dnsmasq policy module by Jason
Zaman
Module version bump for changes to the snmp policy module by Jason Zaman
Module version bump for changes to the pulseaudio policy module by Jason
Zaman
cachefiles: It is cachefilesd_cache_t
Module version bump for update to the networkmanager policy module by
Stephen Smalley.
Module version bumps for "Remove run interface calls from admin
interfaces" changes by Jason Zaman.
Module version bump for changes to the pulseaudio module by Niklas Haas.
Changes to the git, hadoop and rsync modules by Jason Zaman.
Module version bump for changes to the virt module by Jason Zaman
Module version bump for changes to the mozilla module from Laurent
Bigonville.
Module version bump for changes to the wine module by Nicolas Iooss
Jason Zaman (19):
hadoop: remove _role from _admin interface
rpcbind: typo fix
git: make inetd interface optional
rpc: introduce allow_gssd_write_tmp boolean
rpc: allow setgid capability
virt: add virt_tmpfs_t type and permissions
introduce virt_leaseshelper_t
dnsmasq: allow exec shell for scripts
snmp: missing fcontext for snmpd
pulseaudio: filetrans for autospawn.lock
Use init_startstop_service in admin interfaces A-M
Use init_startstop_service in admin interfaces N-Z
Remove _run() interfaces from _admin()
Introduce cron_admin interface
rsync: remove rsync_run from admin interface
git: allow git_system_t to listen on tcp_sockets
hadoop: init_startstop_service() can not take attributes
virt: Allow creating qemu guest agent socket
virt: Add policy for virtlockd the Virtual machine lock manager
Laurent Bigonville (2):
Transition D-Bus system service out of the init_t domain when PID1 is
systemd
Label iceweasel plugin-container executable as mozilla_plugin_exec_t
Nicolas Iooss (1):
wine: remove use of nonexisting interface
Niklas Haas (1):
pulse: don't give pulseaudio_client full access to user_home_t
Stephen Smalley (1):
contrib: networkmanager: allow netlink_generic_socket access
Sven Vermeulen (6):
Locate authdaemon socket and communicate with authdaemon
Allow authdaemon to access selinux fs to check SELinux state
Grant setuid/setgid to courier_pop_t
Execute courier helper script after authentication
Courier IMAP needs to manage the users' maildir
Fix typo for radiusd /var/lib location
doverride (2):
Merge pull request #3 from haasn/pulse-nohome
Merge pull request #6 from bigon/mozilla-1
* Wed Dec 03 2014 Chris PeBenito <selinux@tresys.com> - 2.20141203
Chris PeBenito (26):
Whitespace fix in ntp.fc.
Module version bump for ntp fc entries from Laurent Bigonville.
Whitespace fix in shibboleth.te.
Module version bump for new shibboleth module from Martin Lang.
Module version bump for apt fix from Nicolas Iooss.
Module version bump for dnsmasq MTU fix from Sven Vermeulen.
Module version bump for apache content interfaces from Sven Vermeulen.
Module version bump for gitweb fc entry on Debian and ArchLinux from
Nicolas Iooss.
Module version bump for fc regex fixes from Nicolas Iooss.
Module version bump for various fixes from Laurent Bigonville.
Module version bump for ModemManager fc entry from Laurent Bigonville.
Add missing cron_admin_role() dependency.
Move sock_file filetrans to fcron_crond conditional.
Module version bump for cron and snort updates from Sven Vermeulen.
Module version bump for java icedtea fc entries from Sven Vermeulen.
Module version bump for apache/mlogc patch from Elia Pinto.
Remove name from ntp-kod ntp_drift_t filetrans.
Module version bump for ntp-kod file support from Jason Zaman.
Module version bump for init_daemon_pid_file use from Sven Vermeulen.
Module version bump for alsa and hiawatha fixes from Sven Vermeulen.
Module version bump for ftp and tftp fixes from Nicolas Iooss.
Move irc exec lines.
Module version bump for irc re-exec itself patch from Luis Ressel.
Module version bump for NetworkManager fc fix for ArchLinux from Nicolas
Iooss.
Module version bump for _admin fixes from Jason Zaman.
Bump module versions for release.
Dominick Grift (3):
Module version bump for changes to the loadkeys module by Nicolas Iooss
cron: that boolean identifier does not exist also require it
Module version bump for changes to the networkmanager modules by Lubomir
Rintel
Elia Pinto (1):
apache.te: Add labelling support for /var/log/mlogc
Jason Zaman (20):
Add filetrans for ntp-kod file
ccs: syntax errors in ccs_admin interface
condor: syntax error in condor_admin
distcc: syntax error in distcc_admin
ftp: syntax error in ftp_admin
kerberos: syntax error in kerberos_admin
kismet: syntax error in kismet_admin
nut: syntax error in nut_admin
prelude: syntax error in prelude_admin
psad: syntax error in psad_admin
quota: syntax error in quota_admin
rpcbind: syntax error in rpcbind_admin
rpm: syntax error in rpm_admin
systemtap: syntax error in stapserver_admin
svnserve: syntax error in svnserve_admin
uptime: syntax error in uptime_admin
zabbix: syntax error in zabbix_admin
remove pyzor_role() from pyzor_admin()
remove spamassassin_role() from spamassassin_admin()
rsync: syntax error in rsync_admin
Laurent Bigonville (7):
Add several fcontext for debian specific paths for ntp
Fix dbus_all_session_domain(), session_bus_type is an attribute
Allow gconfd to be started by the session bus
Fix the usage of dbus_spec_session_domain() interface
Properly label exim4 initscript under Debian
Add new gnome_spec_domtrans_all_gkeyringd() interface
Label /usr/sbin/ModemManager as modemmanager_exec_t
Lubomir Rintel (1):
Allow NetworkManager to create Bluetooth SDP sockets
Luis Ressel (1):
irc.te: Allow irssi to re-execute itself
Martin Lang (1):
Add a policy module for shibboleth authentication
Nicolas Iooss (7):
apt: remove non-existing permission set write_dir_perms
Label /usr/share/gitweb/static as httpd_git_content_t
Fix strange file patterns
ftp: fix labels in /var/lock/subsys/
Label /usr/bin/tftpd as tftpd_exec_t
Label /usr/lib/networkmanager/ like /usr/lib/NetworkManager/
Allow loadkeys to read usr_t files
Sven Vermeulen (17):
dnsmasq reads MTU sysctl
Support read/append/manage functions for various httpd content
Snort policy updates
fcron socket support
Fix typo in dnsmasq.if
Mark icedtea binaries as java_exec_t
Use init_daemon_pid_file for contrib modules
Enable asound.state.lock support
Add support for Hiawatha web server
Use logging_search_logs, not logging_search_log
Use logging_search_logs, not logging_search_log
Use files_search_etc, not logging_search_etc
Use files_search_etc, not logging_search_etc
Use files_search_etc, not files_search_config
Use corecmd_search_bin, not corecmd_searh_bin
Use fs_search_tmpfs, not files_search_tmpfs
Use domain_auto_trans, not auto_trans
* Tue Mar 11 2014 Chris PeBenito <selinux@tresys.com> - 2.20140311
Chris PeBenito (17):
Minor rearrangement of minidlna lines.
Module version bump for openvpn tmp files from Sven Vermeulen.
Update modules for file_t merge into unlabeled_t.
Module version bump for postfix showq fc from Laurent Bigonville.
Rename gpg_agent_connect to gpg_stream_connect_agent.
Module version bump for gpg agent interface from Luis Ressel.
Whitespace fixes in git.fc.
Module version bump for debian git fc entries from Laurent Bigonville.
Move bin_t fc to corecommands.
Move exec/transition lines in couchdb.
Add comment about couchdb_js policy.
Module version bump for couchdb updates from Luis Ressel.
Module version bump for pcscd fix from Luis Ressel.
Move screen dontaudit rule.
Module version bump for screen fix from Luis Ressel.
Module version bump for git fc fix from Nicolas Iooss.
Bump module versions for release.
Dan Walsh (28):
Allow irc_t to use tcp sockets
Add labels for apache logs under miq package
Allow smbcontrol to create content in /var/lib/samba
Allow ktalkd to bind to the ktalkd_port
Allow memcache to read sysfs data
Allow mdadm to getattr any file system
Allow cupsd_lpd_t to bind to the printer port
Allow rlogind to bind to the rlogin_port
Allow cvs to bind to the cvs_port
svirt domains neeed to create kobject_uevint_sockets
Lots of new access required for sosreport
Allow tgtd_t to connect to isns ports
openct needs to be able to create netlink_object_uevent_sockets
Allow glusterd to create sock_file in /run
Add support for tmp directories to openvswitch
Allow virt_domain with USB devices to look at dos file systems
Additional access for MLS
Additional access for MLS window manager
Additional access for MLS window manager
Additional access for MLS window manager
Allow rpcbind to use nsswitch
Allow gpg_agent to use ssh-add
Add apache labeling for glpi
Allow pegasus to transition to dmidecode
Allow mcelog to use the /dev/cpu device
Allow apmd to request the kernel load modules
Allow postfix programs to getattr on all executables
label mate-keyring-daemon with gkeyringd_exec_t
Dominick Grift (126):
Typo fix in ksmtuned_admin() by Shintaro Fujiwara
Fix monolithic built
Change file context spec for aide log files to catch suffixes
Module version bumps for changes in various policy modules by Sven
Vermeulen
Squid: Use a single pattern for brevity
Irc was already allowed to create tcp sockets, it only needed an
additional accept, and listen to be able to act as a proxy
Its probably a better idea to use the httpd_sys_ra_content_t type sid
for logs in these locations
Module version bump for changes to the tcsd policy module by Lukas
Vrabec
Module version bump for changes to various policy modules by Miroslav
Grepl
Module version bump for changes to the samba policy module by Dan Walsh
Module version bump for changes to the telepathy policy module by
Miroslav Grepl
We do not have a boinc domain type attribute Change boolean
description a bit
Additional rabbitmq couchdb support
Module version bumps for changes to various policy modules by Miroslav
Grepl
Additional git tcp networking rules
Additional ktalkd udp networking rules
Module version bump for changes to various policy modules by Dan Walsh
Addtional cups ldp tcp networking rules
Should be server packets because it is binding, and not connecting
Clean up telnet, and rlogin networking rules
Additional cvs tcp networking rules
Module version bump for changes to various policy modules by Dan Walsh
Addtional tgtd tcp networking rules
Additional polipo tcp networking rules
Fix asterisk files_spool_filetrans()
Module version bump for changes to the networkmanager policy module by
Lukas Vrabec
Additional fs_tmpfs_filetrans() for munin service plugin content on
tmpfs
Module version bump for changes to various policy modules by Miroslav
Grepl
Support rlogind, and telnetd as init daemon domains ( i think fedora is
campaigning to get rid of (x)?inetd )
Support mariadb logging, file context specification for mariadb specific
config location
Change logwatch boolean identifier to something more self-documenting.
Additional tcp networking rules
Module version bump for changes to various policy modules by Miroslav
Grepl
Fix inconsistencies in the pkcs policy module
Fix fetchmail inconsistencies
Module version bump for changes in various policy modules by Dan Walsh
Support for window managers to stream socket connect to pulseaudio
Logwatch does not need to be able to bind tcp sockets to generic nodes
since its only connecting
Adds userhelper_exec_consolehelper for window managers
Remove duplicate rules due to addition of auth_use_nsswitch()
We dont use the arbt domain types template. Use a more uniform boolean
discription
Clean up libstoragemngmt policy module We do not yet support systemd
Change type from etc_rw to conf for readability admin access to
condor_conf_t
Hit by a nasty optional policy nesting issue
We will find another way to run pa as a system server
Module version bump for changes to various policy modules by Miroslav
Grepl
Clean up hypervkvp policy module (seems incomplete)
Clean up initial redis policy module
Additional openvpn tcp networking rules
redis: allow redis to bind tcp sockets to redis_port_t type ports
bluetooth: bluetooth_t acquires org.bluez service on dbus system bus
wm: associate wm_exec_t to core command executable files so that initrc_t
(/sbin/start-stop-daemon) can access it (metacity)
logrotate restarts syslogd via init script in Debian
This file is called just man-db in Debian.
exim: exim owns directory /var/lib/exim4
accountsd: accounts-daemon lists /var/log
alsa: alsactl listing /dev/shm alsa: alsactl reading /dev/urandom alsa:
alsactl getting attributes of devtmpfs / (/dev) alsa: alsactl maintains
a pulseaudio tmpfs file
Cron: /sbin/runlevel reads /run/utmp cron: anacron (system_cronjob_t)
reading, writing inherited random crond tmp files (/tmp/tmpfk1VT2O)
dbus: allow system, and session bus clients to answer to dbus unconfined
domains
apt: Run apt system cronjobs in the apt_t domain apt: apt system cronjob
creates dpkg.status.* files in /var/backup
devicekit: upowerd reads own unix stream socket devicekit:
devicekit_power_t (runlevel) read /run/utmp
mandb: Make the man-db cronjob work on Debian
rtkit: traverse /proc to get to process state files
networkmanager: NetworkManager reads /run/udev/data/n2 file
avahi: create a avahi_initrc_domtrans for udev_t: udev runs a avahi dns
check script which does, i guess, a dns check. If needed it starts, or
stops avahi via its init script. I also created a
avahi_manage_pid_files() for udev_t because the script manages a file
called "checked_nameservers.*" in /run/avahi-daemon
Cleanups of various modules with regard to regular expressions and white
space
apt: As it turns out the /var/backups directory is labeled in the backup
module (which i incidentally did not have installed earlier). Instead
of creating this file with a file type transition to
apt_var_cache_t, allow apt_t to manage backup_store files
mta: this needs to be verified again, it should just have been running
in exim_t. I might have taken this from old logs
mandb: /etc/cron.daily/man-db executes dpkg, reads dpkg db on Debian
slocate: catch /usr/bin/updatedb.mlocate, and /etc/cron.daily/mlocate on
Debian
dpkg: catch /etc/cron.daily/dpkg on Debian dpkg: allow
/etc/cron.daily/dpkg to manage backup store files on Debian
cron: consistent usage of regular expressions cron: prelink no longer
runs in the system cronjob domain
alsa: alsactl wants to associate pulse-shm-.* to device_t type
filesystems. This happens early on but i do not understand how that
(/dev) relates to /dev/shm in this regard
devicekit: reads udev pid files modemmanager: reads udev pid files
vdagent: spice-vdagentd uses /dev/vport1p1 virtio console
tmpreaper: mountall-bootcl in the tmpreaper_t domain reads, writes
/dev/pts/0 inherited from init script
revert regular expressions
wm: allow $1_wm_t to stream connect to $1_gkeyringd_t
mta: allow system_mail_t (user_mail_domains) to read kernel sysctls and
to read exim var lib files.
mta: These are duplicates because system_mail_t is a user_mail_domain,
as it is based off of the mta_base_mail_template() which assigns that
type attribute
locate: extra rules needed by debian /etc/cron.daily/locate script
backup: in Debian /etc/cron.daily/passwd backs-up shadow, passwd etc to
/var/backups
avahi: create interfaces that will allow calles to create avahi pid dirs
and create specifc avahi pid objects with a type transition (for
udev, which runs: /usr/lib/avahi/avahi-daemon-check-dns.sh in
Debian
Initial gdomap policy module
Initial minissdpd policy module
alsa: due to a bug in gnome 3.4, in debian, alsactl does all kinds of
weird things related to pulseaudio
various: revert regex fixes: fcsort does not want this now
gdomap: gdomap_port_t is now available, gdomap binds tcp, and udp socket
to it
alsa: make alsa_t and pulseaudio_client so that pulseaudio_client rules
apply to it. alsactl does not actually run pulseaudio it seems though.
pulseaudio: allow all pulseaudio_client to send null signals to
unconfined_t, since unconfined_t is not actually a pulseaudio_client (
unconfined_t runs pulseaudio without a domain transition)
avahi: create avahi_setattr_pid_dirs() for udev (avahi dns check script
run by udev in Debian)
These { read write } tty_device_t chr files on boot up in Debian
colord: colord executable file locations in Debian
colord: reads /proc/1, reads /run/udev files