forked from SELinuxProject/refpolicy
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Changelog
2451 lines (2288 loc) · 110 KB
/
Changelog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
* Tue Aug 18 2020 Chris PeBenito <pebenito@ieee.org> - 2.20200818
Alexander Miroshnichenko (2):
openvpn: more versatile file context regex for ipp.txt
openvpn: update file context regex for ipp.txt
Chris PeBenito (153):
Makefile: Warn if policy.xml xmllint check does not run.
networkmanager: Fix interface commenting.
Makefile: Remove shell brace expansion in ctags target.
dbus: Rename tunable to dbus_pass_tuntap_fd.
spamassassin: Move systemd interfaces.
spamassassin: Rename systemd interfaces.
spamassassin: Add missing class requires in systemd interfaces.
spamassassin: Remove unnecessary brackets in type alias.
pulseaudio: Drop call to nonexistant interface.
genhomedircon: Drop Python 2 compatibility code.
systemd: Merge generator domains.
.travis.yml: Add CI tests with no unconfined.
Rename "pid" interfaces to "runtime" interfaces.
Update callers for "pid" to "runtime" interface rename.
Move user definitions to the right place during compilation.
Makefile: Give a value to build options so they can be used in ifelse.
init: Revise init_startstop_service() build option blocks.
kernel: Drop unlabeled_t as a files_mountpoint().
selinuxuntil, userdomain: Restore relabelfrom access for unlabeled files.
files: Restore mounton access to files_mounton_all_mountpoints().
filesystem: Create a filesystem image concept.
kernel, fstools, lvm, mount: Update to use filesystem image interfaces.
Bump module versions for release.
Christian Göttsche (29):
Rules: allow the usage of class sets in context_defaults
Correct estimate kernel version for polcap genfs_seclabel_symlinks
Makefile: generate temporary documentation files in separate directory
Ignore temporary documentation file directory in git
Override old all_interfaces.conf.tmp file
samba: fix wrong interface context smbd_runtime_t
chromium: drop dead conditional block
example: use module name matching file name
consolesetup: drop unused requires
unconfined: clarify unconfined_t stub usage in unconfined_domain_noaudit()
portage: drop bizarre conditional TODO blocks
init/systemd: move systemd_manage_all_units to init_manage_all_units
tpm2: small fixes
files/logging: move var_run_t filecontext to defining module
files/miscfiles: move usr_t filecontext to defining module
chromium/libraries: move lib_t filecontext to defining module
apache: use correct content types in apache_manage_all_user_content()
can_exec(): move from misc_macros to misc_patterns
Makefile: remove obsolete .SUFFIXES
Makefile: add target build-interface-db
devices/storage: quote arguments to tunable_policy
apache: quote gen_tunable name argument
Correct some misspellings
Fix several misspellings
whitespace cleanup
travis-ci: add SELint
work on SELint issues
files/modutils: unify modules_object_t usage into files module
travis: resolve Linter tags
Daniel Burgener (10):
Add dnl to end of interface declaration. This reduces the number of blank
lines in intermediate files and matches the way templates are defined.
Allow systemd-coredump to stat mountpoints.
Change incorrect template definitions into interface definitions
Add divert to generated_definitions creation, and fix all_interfaces.conf
divert creation.
Fix mismatches between object class and permission macro.
Switch pipe reading on domtrans to inherited only
Simplify collection of ssh rules to domtrans_pattern macro
Fix a few places where command line applications were only granted one of
tty or pty permissions and could be used from either
Remove the second copy of a permission in instances where the exact same
permission is repeated twice in a row
Remove out of date "hack" from stunnel. The underlying problem needing a
require was fixed back in 2011, so using corenet_tcp_bind_stunnel_port
would be an option now, but stunnel_t already has
corenet_tcp_bind_all_ports, so this access is redundant.
Dave Sugar (8):
Add interface to read/write /dev/ipmi
Update labeling in /dev/
Setup generic generator attribute and change generator types.
fix require from 5b78c1c86bedf322fa6a08e5d68e7e8a6b85f026
Setup domain for tpm2_* binaries
Interfaces needed to support IMA/EVM keys
Resolve neverallow failure introduced in #273
Interfaces for tpm2
David Sommerseth (1):
dbus: Add tunable - dbus_can_pass_tuntap_fd
Florian Schmidt (1):
corenetwork: fix winshadow port number
Guido Trentalancia (5):
This patch improves a previous commit by restricting down the permissions
to write the wireless device in order to prevent a possible Denial of
Service (DoS) attack from an unprivileged process bringing down the
wireless interfaces.
mozilla: add watch perms
wm: add watch perms
getty: add watch perms
userdomain: add watch perms
Laurent Bigonville (5):
Add an interface to allow the specified domain to mmap the general network
configuration files
Add policy for apt-cacher-ng
Add policy for acngtool
Label bluetooth daemon as bluetooth_exec_t
Label /usr/libexec/packagekitd as apt_exec_t on debian
McSim85 (1):
add rule for the management socket file fixed comments from @bauen1
Nicolas Iooss (5):
Vagrantfile: remove older installed modules before "make install"
systemd: make systemd --user run generators without transition
systemd: allow sd-executor to manage its memfd files
devices: label /dev/sysdig0
sysnetwork: allow using "ip netns"
Russell Coker (2):
pulseaudio patch
latest ver of trivial mail server patch
Topi Miettinen (13):
Make raw memory access tunable
Add usbguard
Don't allow creating regular files in /dev
Python string fix
gennetfilter: generate nft tables with --nft
gennetfilter: handle port ranges
Allow systemd-networkd to handle ICMP and DHCP packets
gennetfilter: add rules for ICMP/ICMPv6 packets
wm: add KWin
Build and install Netfilter rules
bootloader: add rEFInd and systemd-boot
netutils: allow ping to send and receive ICMP packets
Remove unlabeled packet access
Vilgot (1):
Portage update
Vilgot Fredenberg (1):
Remove old exception
Yi Zhao (2):
Remove duplicated rules
xserver: allow xserver_t to connect to resmgrd
bauen1 (59):
logging: allow syslogd to remove stale socket file
systemd-user-runtime-dir: add required permissions
mozilla: allow firefox to use user namespaces for sandboxing
modutils: allow init to execute kmod with nnp
fix unescaped dot introduced by 47b44a0fc720cecf6df576e274f610514203a5da
allow init_t access to own keyring
allow init_t to link kernel_t key
allow normal users to use 'systemd-run'
ssh: fix for debian wrapper script
bird: fixes for bird 2.0
apache: add nginx to policy
ntpd: fixes for systemd-timesyncd after linux 5.4
define lockdown class and access
dirmngr: allow to probe for tor
dirmngr: also requires access to /dev/urandom
dirmngr: ~/.gnupg/crls.d might not exist
application: applications can be executed from ssh without pty
systemd: allow regular users to run systemd-analyze
quota: allow quota to modify /aquota even if immutable
init: read default context during boot
lvm: create /etc/lvm/archive if it doesn't exist
corecommands: fix atrild label
systemd-fstab-generator needs to know about all mountpoints
semanage: create directories for new policies
dnsmasq: watch for new dns resolvers
init: allow systemd to setup mount namespaces
init: make initrc_t a init_domain to simplify the policy
init: allow systemd to activate journald-audit.socket
setrans: allow label translation for all domains.
files: add files_watch_etc_symlinks interface
init: watch /etc/localtime even if it's a symlink
corecommands: proper label for unattended-upgrades helpers
filesystem: pathcon for matching tracefs mount
lvm-activation-generator also needs to execute lvm
systemd: allow systemd-user-runtime-dir to do its job
init: fix init_manage_pid_symlinks to grant more than just create
permissions
init: replace call to init_domtrans_script
systemd-sysusers: add policy
allow most common permissions for systemd sandboxing options
terminal: cleanup term_create interfaces
logrotate.service sandbox required permissions
udev.service sandbox required permissions
systemd-timesyncd.service sandbox requried permissions
systemd-logind.service sandbox required permissions
init: fix systemd boot
postfix: add filetrans for sendmail and postfix for aliases db operations
systemd: fixed systemd_rfkill_t denial spam
thunderbird: label files under /tmp
init: systemd will run chkpwd to start user@1000
authlogin: unix_chkpwd is linked to libselinux
systemd: maintain /memfd:systemd-state
dpkg: allow dpkg frontends to acquire lock by labeling it correctly
systemd: systemd --user add essential permissions
dpkg: dpkg scripts are part of dpkg and therefor also an application
domain
gpg: don't allow gpg-agent to read /proc/kcore
corecommands: correct label for debian ssh-agent helper script
systemd: systemd-tempfiles will relabel tmpfs if mounted over e.g. /tmp
Remove the ada module, it is unecessary and not touched since ~2008
dpkg: domaintrans to sysusers if necessary
* Sat Feb 29 2020 Chris PeBenito <pebenito@ieee.org> - 2.20200229
Alexander Miroshnichenko (1):
Add knot module
Chris PeBenito (174):
knot: Whitespace changes.
knot: Move lines.
devices, storage: Add fc entries for mtd char devices and ndctl devices.
devices: Add types for trusted execution environment interfaces.
ulogd: Rename ulogd_var_run_t to ulogd_runtime_t.
INSTALL: Fix build requirements.
fishilico/systemd-read-netlink_kobject_uevent_socket
Rename *_var_run_t types to *_runtime_t.
Reorder declarations based on *_runtime_t renaming.
Remove old aliases.
fishilico/filesystem-fs_rw_cgroup_files-follow-symlink
fc_sort.py: Use "==" for comparing integers.
xserver: Remove duplicate colord rule.
xserver: Move XDM dbus chats under main dbus optional.
Move open, audit_access, and execmod to file common.
Add file and filesystem watch access vectors.
Fix file common ordering and kernel version from previous commit.
init: Whitespace change.
unconfined: Add namespaced capabilities.
unconfined: Fix systemd --user rule.
Remove incorrect usages of "is" operator from Python scripts.
logging: Reorder lines.
systemd: Logind removes /run/user/* user temp files.
unconfined: Add watch permission for files.
systemd: Add filesystem watches.
dbus: Add directory watches.
udev: Watch devices.
init: Revise systemd bind mounts.
Add perf_event access vectors.
systemd: Whitespace fix.
logging: Whitespace fix.
Bump module versions for release.
Christian Göttsche (6):
fix Makefile for policy-module directories with same ending
segenxml.py: fix format usage in warning message
travis: force the use of python3.5
travis: run check_fc_files linter with python 3.7
re-implement fc_sort in python
Add genfs_seclabel_symlinks policy capability
Daniel Burgener (4):
Add requires to interfaces that reference types or attributes without
requiring them
Remove uneeded types from interfaces where types were added
Fix situations where require blocks in interfaces listed types not
actually referenced by that interface
Remove unneeded semicolons after interface and macro calls
Dominick Grift (2):
domain: unconfined access to bpf
Remove shell automatic domain transitions to unconfined_t from various pam
login programs
Guido Trentalancia (4):
Update the pulseaudio application module with a few user domain file read
and management permissions.
Allow userdomain to read and write the wireless devices (for example for
querying their state, enabling and/or disabling them using userspace
tools such as "rfkill" from util-linux).
Add an interface to allow watch permission on generic device directories.
Allow pulseaudio to watch generic device directories.
Jason Zaman (16):
udev: Allow udevadm access to udev_tbl_t
xserver: ICEauthority can be in /run/user
devicekit: udisks needs access to /run/mount/utab.lock
dirmngr: accept unix stream socket
chromium: allow dbus chat to inhibit power
virt: Add unix socket for virtlogd/virtlockd
virt: allow lvm_control access
fstools: add zfs-auto-snapshot
udev: Add watch perms
accountsd: Add watch perms
cron: watch cron spool
colord: add watch perms
policykit devicekit: Add watch perms
dbus: add watch perms
chromium: watch etc dirs
gpg: add watch perms for agent
Laurent Bigonville (9):
Makefile: Avoid regenerating the iftemplates at everyrun
Allow systemd_modules_load_t to module_request and map modules_object_t
files
Allow udevadm to read files in /run/udev/data
Allow udevadm_t to use dac_read_search capability
Allow the systemd dbus-daemon to talk to systemd
Allow geoclue to log in syslog
Allow realmd_t to read localization files
Allow alsa_t to create alsa_runtime_t file as well
Allow alsa_t to set scheduling priority and send signal to itself
Luca Boccassi (2):
journald: allow to remove /run/log/journal
logging: add interface to start/stop syslog units
Nicolas Iooss (75):
ulogd: add Debian's log directory
ulogd: allow creating a netlink-netfilter socket
ulogd: allow starting on a Debian system
entropyd: label the unit file of haveged
entropyd: allow haveged to create a Unix socket to received commands
ulogd: fix pattern for /run/ulog directory
monit: use s0 instead of s9
java: reduce the scope of the pattern in for java entry points
libraries: match a digit in Adobe Reader directories
drbd: fix pattern for /usr/lib/ocf/resource.d/linbit/drbd
rpcbind: remove redundant file context for /run/rpc.statd.pid
files: reduce the scope of the pattern matching /usr/include
Remove unescaped single dot from the policy
Fix use of buggy pattern (.*)?
libraries: drop a pattern specific to Python 2.4
systemd: introduce an interface for services using PrivateDevices=yes
Vagrantfile: upgrade VM to Fedora 30
Allow Debian to generate a dynamic motd when users log in
entropyd: haveged service uses PrivateDevices=yes
Check the .fc files for common typos
corecommands: no longer use \d
libraries: fix some misspellings in patterns
java: remove unnecessary parentheses in pattern
cups: add a slash to match /opt/brother/Printers/
Vagrantfile: build and install refpolicy on Fedora VM
Vagrantfile: add a Debian virtual machine
ntp: allow systemd-timesyncd to read network status
cups: use ([^/]+/)? to match a subdirectory of CUPS configuration
portage: really make consoletype module optional
Label programs in /usr/bin like /usr/sbin
apt: allow transition from apt_t to dpkg_t with NNP
apt: allow preventing shutdown by calling a systemd-logind D-Bus method
authlogin: label utempter correctly on Debian
irc: add WeeChat policy
systemd: allow systemd --user to receive messages from
netlink_kobject_uevent_socket
Add a policy module for WireGuard VPN
modutils: allow depmod to read /boot/System.map
modutils: allow depmod and modprobe to use the I/O provided by apt
systemd: allow systemd-modules-load.service to read sysfs
sudo: allow using use_pty flag
Allow using /([^/]+/)? and (/[^/]+)?/ in patterns
ulogd: adjust policy for Debian
bitlbee: allow using GetDynamicUser on Debian
chromium: remove distro-specific ifdef
systemd-networkd: allow creating a generic netlink socket
systemd-networkd: allow communicating with hostnamed
sudo: allow transmitting SIGWINCH to its child
sudo: allow using CAP_KILL for SIGWINCH
systemd: allow detecting Windows Subsystem for Linux
systemd: allow more accesses to systemd --user
systemd: remove unnecessary init_write_runtime_socket()
.travis.yml: update distro to Ubuntu 18.04 LTS (Bionic Beaver)
filesystem: allow following symlinks with fs_rw_cgroup_files()
systemd: allow user environment helpers to communicate with systemd --user
.travis.yml: check the .fc files in CI
systemd: make the kernel spawn systemd-coredump with a context transition
gpg: allow gpg-agent to read crypto.fips_enabled sysctl
testing/check_fc_files: allow @ character in file context patterns
mount: allow callers of mount to search /usr/bin
sysadm: allow using hostnamectl
init: allow systemd to mount over /dev/kmsg and /proc/kmsg
Add policy for CryFS, encfs and gocryptfs
Vagrantfile: fix configuration
Vagrantfile: remove sudo
Vagrantfile: add a specific SELinux policy module
systemd: allow reading options from EFI variable SystemdOptions
virt: allow more accesses to libvirt_leaseshelper
systemd-logind: allow using BootLoaderEntries DBUS property
storage: introduce storage_raw_read_fixed_disk_cond
Vagrantfile: allow unconfined and sysadm SSH login
Vagrant: allow VirtualBox provisionning to use dhclient and ip
Associate role unconfined_r to wine_t
systemd: add an interface to use nss-systemd
usermanage: allow groupadd to lookup dynamic users from systemd
mount: label fusermount3 like fusermount
Peter Morrow (1):
systemd_tmpfiles_t: Allow systemd_tempfiles_t to change permissions in
sysfs
Petr Lautrbach (1):
newrole: allow newrole to use setcap to drop capabilities
Stephen Smalley (4):
access_vectors: Remove unused permissions
access_vectors: Remove entrypoint and execute_no_trans from chr_file
access_vectors: remove flow_in and flow_out permissions from packet class
Rename obsolete netlink_firewall_socket and netlink_ip6fw_socket classes
Sugar, David (13):
grant rpm permission to map rpm_var_lib_t
grant permission for rpm to write to audit log
grant rpm permissions to map locale_t
Allow rpm to map file contexts
Allow rpm scripts to alter systemd services
grant rpm_t permission to map security_t
Module for tpm2
Add missing gen_require for init_t in init_script_domain
resolve syslog imuxsock denial
Add interface to read efivarfs_t directory
Fix indent to match the rest of the file (space -> tab)
Allow systemd to getattr all files
audit daemon can halt system, allow this to happen.
Topi Miettinen (2):
Consider jitterentropy to belong to entropyd family
Consider iwd equivalent to NetworkManager etc.
Vilgot Fredenberg (1):
Remove obsolete gentoo specific rule
bauen1 (16):
fix: sudo can't determine default type for sysadm_r
fix ifupdown2 executable mislabeled as lib_t
added bpf_t filesystem label
netutils: allow mtr to communicate with mtr-packet
kernel/corecommands: fix the label of xfce4 helpers (on debian)
systemd: remove whitespace
init: add interfaces for managing /run/systemd
systemd: add policy for systemd-fstab-generator
udev: remove console-setup
consolesetup: add policy for console-setup
udev: run consolesetup
loadkeys: remove redundant ifdef
init: split init_create_pid_files interface
ntp: watch systemd networkd runtime dirs This is required for correct
function after linux 5.4
systemd-user-runtime-dir: add policy
sysadm: add sysadm_allow_rw_inherited_fifo tunable to allow writing to
fifo_files inherited from domains allowed to change role to sysadm_r.
* Sun Jun 09 2019 Chris PeBenito <pebenito@ieee.org> - 2.20190609
Chris PeBenito (70):
systemd: Module version bump.
Merge branch 'sysadm-dynamic-users' of
git://github.com/fishilico/selinux-refpolicy
sysadm: Module version bump.
Merge branch 'stubby-daemon' of
git://github.com/fishilico/selinux-refpolicy
corenetwork: Module version bump.
systemd: Remove unnecessary brackets.
init, systemd, cdrecord: Module version bump.
logging, miscfiles, authlogin: Module version bump.
Merge branch 'systemd-journald-signull' of
git://github.com/fishilico/selinux-refpolicy
Merge branch 'restorecond-no-read-all' of
git://github.com/fishilico/selinux-refpolicy
logging, selinuxutil: Module version bump.
Merge branch 'systemd-update-done' of
git://github.com/fishilico/selinux-refpolicy
systemd: Module version bump.
aide, clamav: Module version bump.
filesystem, cron, authlogin: Module version bump.
Remove incorrect comment about capability2:mac_admin.
usermanage: Move kernel_dgram_send(passwd_t) to systemd block.
systemd, udev, usermanage: Module version bump.
genhomedircon.py: Fix top-level exception handling.
udev: Whitespace fix.
udev: Move one line and remove a redundant line.
sysadm, udev: Module version bump.
Merge pull request #35 from pebenito/master
systemd: Drop unconfined kernel access for systemd_nspawn.
udev: Drop write by udev to its executable.
init: Remove duplicate setenforce rule for init scripts.
authlogin, dbus, ntp: Module version bump.
ntp, init, lvm: Module version bump.
Merge pull request #37 from pebenito/master
kernel, init, systemd, udev: Module version bump.
init: Revise conditions in init_startstop_service().
Merge pull request #39 from pebenito/revise-init-stopstart
init: Module version bump.
kernel: Module version bump.
Merge pull request #40 from gtrentalancia/master
xserver: Module version bump.
various: Module version bump
apache: Make MTA optional.
systemd: Remove unnecessary names in systemd-update-done filetrans.
Merge pull request #42 from dsugar100/master
kernel, devices, plymouthd, xserver: Module version bump.
storage: Label /dev/mmcblk* character nodes.
devices: Label /dev/tpmrm[0-9].
devices: Add type for GPIO chips, /dev/gpiochip[0-9]
devices: Change netcontrol devices to pmqos.
systemd: Add initial policy for systemd --user.
Merge pull request #43 from pebenito/various-device-labels
Merge pull request #44 from pebenito/http-mta-optional
Merge pull request #45 from pebenito/systemd-update-done-tweak
Merge pull request #46 from pebenito/systemd-user
various: Module version bump.
Merge pull request #47 from dsugar100/master
Merge pull request #48 from bigon/dovecot_lmtp
Merge pull request #49 from bigon/fail2ban_logrotate
dovecot, logrotate: Module version bump.
logrotate: Make MTA optional.
Merge pull request #51 from pebenito/logrotate-optional-mta
Merge pull request #53 from WOnder93/makefile-fix
logrotate: Module version bump.
init: Add systemd block to init_script_domain().
systemd: modules-load updates.
apache: Web content rules simplification.
storage: Add fc entry for /dev/pmem*
devices: Add type for /dev/daxX.Y.
Merge pull request #54 from pebenito/init-script-systemd
Merge pull request #55 from pebenito/modules-load
Merge pull request #56 from pebenito/apache-simplify
Merge pull request #57 from pebenito/pmem-dax
various: Module version bump.
Bump module versions for release.
Dave Sugar (3):
Allow xdm (lightdm) start plymouth
Changes to support plymouth working in enforcing
create interfaces for NetworkManager units
Guido Trentalancia (1):
The Qt library version 5 requires to write xserver_tmp_t files upon
starting up applications (tested on version 5.12.1).
Laurent Bigonville (2):
Add dovecot to listen to LMTP port
Allow logrotate to execute fail2ban-client
Lukas Vrabec (1):
Label /sys/kernel/ns_last_pid as sysctl_kernel_ns_last_pid_t
Nicolas Iooss (6):
sysadm: allow resolving dynamic users
Add policy for stubby DNS resolver
Allow systemd-journald to use kill(pid, 0) on its clients
Allow restorecond to read customizable_types
Remove a broad read-files rule for restorecond
Update systemd-update-done policy
Ondrej Mosnacek (1):
Fix find commands in Makefiles
Sugar, David (26):
Allow systemd-networkd to get IP address from dhcp server
Separate domain for systemd-modules-load
Allow init_t to read net_conf_t
Allow systemd-hostnamed to set the hostname
Add interface to run cdrecord in caller domain
Add interface to get status of rsyslog service
New interface to dontaudit access to cert_t
Fix incorrect type in clamav_enableddisable_clamd interface
Allow freshclam to read sysctl_crypto_t
Add interfaces to run freshclam
Allow AIDE to sendto kernel datagram socket
Allow AIDE to read kernel sysctl_crypto_t
Allow AIDE to mmap files
Add interface to allow relabeling of iso 9660 filesystems.
Update cron use to pam interface
Allow additional map permission when reading hwdb
Resolve denial while changing password
Separate out udevadm into a new domain
Add interface ntp_dbus_chat
Allow ntpd to update chronyd service
Allow ntpd to update timezone symlink
Resolve denial about logging to journal from chkpwd
Resolve denial about logging to journal from dbus
Allow ntpd to read unit files
Denial of cryptsetup reading cracklib database
Add kernel_dgram_send() into logging_send_syslog_msg()
* Fri Feb 01 2019 Chris PeBenito <pebenito@ieee.org> - 2.20190201
Alexander Miroshnichenko (16):
Add signal_perms setpgid setsched permissions to syncthing_t.
Add corecmd_exec_bin permissions to syncthing_t.
Allow syncthing_t to read network state.
Allow syncthing_t to execute ifconfig/iproute2.
Add required permissions for nsd_t to be able running.
Add nsd_admin interface to sysadm.te.
Add map permission to lvm_t on lvm_metadata_t.
Add comment for map on lvm_metadata_t.
Remove syncthing tunable_policy.
Remove unneeded braces from nsd.te.
Add new interface fs_rmw_hugetlbfs_files.
Add map permission for postgresql_t to postgresql_tmp_t files.
Add dovecot_can_connect_db boolean.
fs_mmap_rw_hugetlbfs_files is a more appropriate name for the interface
Add hostapd service module
minor updates redis module to be able to start the app
Chris PeBenito (85):
mozilla, devices, selinux, xserver, init, iptables: Module version bump.
devices: Module version bump.
misc_patterns.spt: Remove unnecessary brackets.
ipsec: Module version bump.
fstools: Module version bump.
corecommands: Module version bump.
xserver: Module version bump.
Merge pull request #1 from bigon/fix-sepolgen-ifgen
Remove unused translate permission in context userspace class.
logrotate: Module version bump.
miscfiles: Module version bump.
Merge pull request #3 from bigon/xdp-socket
obj_perm_sets.spt: Add xdp_socket to socket_class_set.
clamav, ssh, init: Module version bump.
amavis, apache, clamav, exim, mta, udev: Module version bump.
dnsmasq: Whitespace fix in file contexts.
dnsmasq: Reorder lines in file contexts.
Merge branch 'master' of https://github.com/bigon/refpolicy
Merge branch 'resolved' of https://github.com/bigon/refpolicy
Merge branch 'iscsi' of https://github.com/bigon/refpolicy
Various modules: Version bump.
dnsmasq: Module version bump.
Merge branch 'minissdpd' of https://github.com/bigon/refpolicy
cron, minissdpd, ntp, systemd: Module version bump.
dbus, xserver, init, logging, modutils: Module version bump.
Merge branch 'syncthing' of https://github.com/alexminder/refpolicy
syncthing: Whitespace change
Merge branch 'lvm' of https://github.com/alexminder/refpolicy
lvm, syncthing: Module version bump.
sigrok: Remove extra comments.
networkmanager: Add ICMPv6 comment
sysnetwork: Move optional block in sysnet_dns_name_resolve().
sysnetwork: Move lines.
dpkg: Rename dpkg_read_script_tmp_links().
apt, rpm: Remove and move lines to fix fc conflicts.
sudo: Whitespace fix.
many: Module version bumps for changes from Russell Coker.
systemd: Rename systemd_list_netif() to systemd_list_networkd_runtime().
init: Remove inadvertent merge.
Merge branch 'nsd' of https://github.com/alexminder/refpolicy
nsd: Merge two rules into one.
Merge branch 'ssh_dac_read_search' of
git://github.com/fishilico/selinux-refpolicy
Merge branch 'restorecond_getattr_cgroupfs' of
git://github.com/fishilico/selinux-refpolicy
Merge branch 'systemd-logind-getutxent' of
git://github.com/fishilico/selinux-refpolicy
various: Module version bump.
iptables: Module version bump.
Add CONTRIBUTING file.
kernel, systemd: Move lines.
kernel, jabber, ntp, init, logging, systemd: Module version bump.
Merge branch 'systemd-journald_units_symlinks' of
git://github.com/fishilico/selinux-refpolicy
init, logging: Module version bump.
Merge branch 'services_single_usr_bin' of
git://github.com/fishilico/selinux-refpolicy
Merge branch 'init_rename_pid_interfaces' of
git://github.com/fishilico/selinux-refpolicy
various: Module name bump.
Merge branch 'systemd-rfkill' of
git://github.com/fishilico/selinux-refpolicy
systemd: Whitespace change
systemd: Module version bump.
Merge branch 'restorecond-symlinks' of
git://github.com/fishilico/selinux-refpolicy
Merge branch 'add_comment' of git://github.com/DefenSec/refpolicy
usermanage, cron, selinuxutil: Module version bump.
logging, sysnetwork, systemd: Module version bump.
Merge branch 'restorecond-dontaudit-symlinks' of
git://github.com/fishilico/selinux-refpolicy
selinuxutil: Module version bump.
Merge branch 'dbus-dynamic-uid' of
git://github.com/fishilico/selinux-refpolicy
xserver: Move line
systemd: Move interface implementation.
various: Module version bump.
dpkg: Rename dpkg_nnp_transition() to dpkg_nnp_domtrans().
dpkg: Move interface implementations.
init: Rename init_read_generic_units_links() to
init_read_generic_units_symlinks().
init: Drop unnecessary userspace class dependence in
init_read_generic_units_symlinks().
chromium: Whitespace fixes.
chromium: Move line.
Merge branch 'dovecot' of git://github.com/alexminder/refpolicy
dovecot: Move lines.
various: Module version bump.
Merge branch 'postgres' of git://github.com/alexminder/refpolicy
filesystem, postgresql: Module version bump.
hostapd: Whitespace change.
hostapd: Move line.
various: Module version bump.
redis: Move line.
redis: Module version bump.
corecommands, staff, unprivuser, ssh, locallogin, systemd: Module version
bump.
Bump module versions for release.
David Sugar (15):
Interface to allow reading of virus signature files.
Update CUSTOM_BUILDOPT
Add interface udev_run_domain
Allow clamd_t to read /proc/sys/crypt/fips_enabled
Interface to add domain allowed to be read by ClamAV for scanning.
Add interfaces to control clamav_unit_t systemd services
Allow clamd to use sent file descriptor
Add interfaces to control ntpd_unit_t systemd services
interface to enable/disable systemd_networkd service
Interface to read cron_system_spool_t
Allow X (xserver_t) to read /proc/sys/crypto/fips_enabled
Allow kmod to read /proc/sys/crypto/fips_enabled
Allow dbus to access /proc/sys/crypto/fips_enabled
Add missing require for 'daemon' attribute.
Allow auditctl_t to read bin_t symlinks.
Dominick Grift (1):
unconfined: add a note about DBUS
Guido Trentalancia (1):
Add sigrok contrib module
Jagannathan Raman (1):
vhost: Add /dev/vhost-scsi device of type vhost_device_t.
Jason Zaman (10):
selinux: compute_access_vector requires creating netlink_selinux_sockets
mozilla: xdg updates
xserver: label .cache/fontconfig as user_fonts_cache_t
Allow map xserver_misc_device_t for nvidia driver
iptables: fcontexts for 1.8.0
devices: introduce dev_dontaudit_read_sysfs
files: introduce files_dontaudit_read_etc_files
kernel: introduce kernel_dontaudit_read_kernel_sysctl
userdomain: introduce userdom_user_home_dir_filetrans_user_cert
Add chromium policy upstreamed from Gentoo
Laurent Bigonville (10):
policy/support/obj_perm_sets.spt: modify indentation of mmap_file_perms to
make sepolgen-ifgen happy
Add xdp_socket security class and access vectors
irqbalance now creates an abstract socket
Allow semanage_t to connect to system D-Bus bus
Allow ntpd_t to read init state
Add systemd_dbus_chat_resolved() interface
Allow sysnet_dns_name_resolve() to use resolved to resolve DNS names
Allow systemd_resolved_t to bind to port 53 and use net_raw
Allow iscsid_t to create a netlink_iscsi_socket
Allow minissdpd_t to create a unix_stream_socket
Luis Ressel (7):
corecommands: Fix /usr/share/apr* fc
xserver: Allow user fonts (and caches) to be mmap()ed.
Add fc for /var/lib/misc/logrotate.status
Realign logrotate.fc, remove an obvious comment
miscfiles: Label /usr/share/texmf*/fonts/ as fonts_t
services/ssh: Don't audit accesses from ssh_t to /dev/random
system/init: Give init_spec_daemon_domain()s the "daemon" attribute
Lukas Vrabec (1):
Improve domain_transition_pattern to allow mmap entrypoint bin file.
Nicolas Iooss (11):
fstools: label e2mmpstatus as fsadm_exec_t
ssh: use dac_read_search instead of dac_override
selinuxutil: allow restorecond to try counting the number of files in
cgroup fs
systemd: allow systemd-logind to use getutxent()
Allow systemd-journald to read systemd unit symlinks
Label service binaries in /usr/bin like /usr/sbin
init: rename *_pid_* interfaces to use "runtime"
systemd: add policy for systemd-rfkill
selinuxutil: allow restorecond to read symlinks
selinuxutil: restorecond is buggy when it dereferencies symlinks
dbus: allow using dynamic UID
Petr Vorel (1):
dnsmasq: Require log files to have .log suffix
Russell Coker (19):
misc services patches
misc interfaces
last misc stuff
systemd related interfaces
systemd misc
missing from previous
cron trivial
mls stuff
logging
some little stuff
trivial system cronjob
another trivial
more tiny stuff
map systemd private dirs
tiny stuff for today
yet more tiny stuff
yet another little patch
chromium
more misc stuff
Sugar, David (9):
Allow greeter to start dbus
pam_faillock creates files in /run/faillock
Add interface to get status of iptables service
Add interface to start/stop iptables service
label journald configuraiton files syslog_conf_t
Interface with systemd_hostnamed over dbus to set hostname
Modify type for /etc/hostname
Add interface clamav_run
Add interface to read journal files
Yuli Khodorkovskiy (1):
ipsec: add missing permissions for pluto
* Sun Jul 01 2018 Chris PeBenito <pebenito@ieee.org> - 2.20180701
Chris PeBenito (28):
Enable cgroup_seclabel and nnp_nosuid_transition.
Misc dbus fixes from Russell Coker.
Simple map patch from Russell Coker.
another trivial dbus patch from Russell Coker.
Merge branch 'xtable-proc' of https://github.com/bigon/refpolicy
iptables: Module version bump.
Update contrib.
.travis.yml: Change to master branch for sctp support.
corenetwork, init: Module version bump.
Module version bumps for patches from James Carter.
Update contrib.
init, logging, sysnetwork, systemd, udev: Module version bump.
sysnetwork: Move lines in sysnet_read_config().
sysnetwork: Module version bump.
init: Module version bump.
Remove deprecated flask.py script.
Switch all remaining Python references to the Python 3 interpreter.
systemd: Move lines.
corecommands: Module version bump.
Makefile: Tweak cli output.
XDG: Module version bump.
Remove refpolicy-contrib submodule.
Re-add policy modules from old refpolicy-contrib submodule.
Move all files out of the old contrib directory.
Changelog.contrib: Add note about refpolicy-contrib removal.
sysnetwork: Module version bump.
xdg, xserver, mplayer, games: Module version bump.
Bump module versions for release.
Christian Göttsche (1):
add definition of bpf class and systemd perms
Dave Sugar (8):
Fix problems booting with fips=1
Interface to read /run/systemd/resolve/resolv.conf
Allow systemd-resolved to read sysctl
Allow systemd_resolved to read systemd_networkd runtime files
Allow systemd-resolved to connect to system dbusd
systemd-resolved uses notify to indicate status
policy for systemd-update-done
policy for systemd-hwdb
James Carter (8):
Removed unnecessary semicolons
Mark unused parameters as unused
Move the use of var_log_t from authlogin.fc to logging.fc
Move the use of initrc_var_run_t from files.fc to init.fc
Move use of systemd_unit_t from systemd.fc to init.fc
Move use of user_devpts_t from terminal.fc to userdomain.fc
Remove undeclared identifiers from interfaces
Remove undeclared identifiers from xserver interface
Jason Zaman (9):
sysnetwork: put systemd_read_resolved_runtime in an ifdef
init: Add filetrans for /run/initctl
corecommands: adjust gcc fcontext to also work on musl
userdom: remove filetrans from userdom_user_content_access_template
xdg: Add map perms, also make lnk_file, dirs consistent
xdg: filetrans should not add filetrans from user_home_dir
xdg: Introduce xdg_search_cache_dirs
xserver: Add mesa_shader_cache for GLSL in ~/.cache/mesa_shader_cache/
apps: rw mesa_shader_cache
Laurent Bigonville (1):
Label /etc/hosts.allow as net_conf_t
Miroslav Grepl (1):
xtables-multi wants to getattr of the proc fs
Richard Haines (1):
refpolicy: Update for kernel sctp support
Sven Vermeulen (7):
Add gentemplates.sh to extract template content
Update segenxml to include support for templated booleans and tunables
Generate template code and update genxml call for documentation generation
freedesktop location support
Allow X server users to manage all xdg resources
helper interfaces to read/manage all user content
tunable-managed user content access template
* Sun Jan 14 2018 Chris PeBenito <pebenito@ieee.org> - 2.20180114
Adam Duskett (1):
fix regex escape sequence error.
Anthony PERARD (1):
Update for Xen 4.7
Chad Hanson (1):
Fix implementation of MLS file relabel attributes
Chris PeBenito (74):
Module version bump for patches from Guido Trentalancia and Anthony
PERARD.
Rules.modular: Fix file context verification.
Remove deprecated interfaces older than one year old.
.travis.yml: Use git tag instead of release tarball for selinux userspace.
kernel: Module version bump for patch from Nicolas Iooss.
Remove complement and wildcard in allow rules.
logging: Move line.
Module version bump for patches from Nicolas Iooss.
Module version bump for fixes from Nicolas Iooss.
Update contrib.
dbus: move comments out of the file context definitions
Update contrib.
systemd, udev: Module version bump.
systemd: Whitespace fix.
Module version bump for patches from Nicolas Iooss.
init: Move fc lines.
init: Module version bump for patch from Dave Sugar.
files: Move files_check_write_pid_dirs interface.
terminal: Rename term_create_devpts.
Several module version bumps.
init: Move init_spec_daemon_domain implementation.
Module version bumps.
init: Rename init_rlimit_inherit to init_inherit_rlimit.
init: Whitespace fix.
Module version bumps.
spamassassin: Fix build error.
init: Fix XML error.
spamassassin: Add missing requirement in spamassassin_admin().
sysadm,fstools: Module version bump.
authlogin, logging, udev: Module version bump.
init: Remove sm-notify.pid fc entry which collides with the rpc module.
corecommands, xserver, systemd, userdomain: Version bumps.
Update contrib.
Update contrib.
corecommands: Module version bump.
init: Module version bump.
Merge pull request #125 from lalozano/master
devices: Module version bump.
Module version bumps.
Merge branch 'master' of git://github.com/davidgraz/refpolicy
ipsec: Module version bump.
Merge branch 'master' of git://github.com/aduskett/refpolicy
init: Clean up line placement in init_systemd blocks.
files: Whitespace fix.
Merge branch 'systemd-networkd'
files, init, sysnetwork, systemd: Module version bumps.
Merge pull request #128 from williamcroberts/fc-sort-fixups
Update contrib.
files, netutils: Module version bump.
miscfiles: Module version bump.
Update contrib.
files, userdomain: Module version bump.
kernel, mls, sysadm, ssh, xserver, authlogin, locallogin, userdomain:
Module version bumps.
Several module version bumps.
Module version bumps.
dmesg, locallogin, modutils: Module version bump.
loadable_module.spt: Add debugging comments for tunable_policy blocks.
networkmanager: Grant access to unlabeled PKeys
filesystem: Rename fs_relabel_cgroup_lnk_files.
corcmd, fs, xserver, init, systemd, userdomain: Module version bump.
xserver, sysnetwork, systemd: Module version bump.
xserver: Module version bump.
init: Module version bump.
Update contrib.
mls, xserver, systemd, userdomain: Module version bump.
storage, userdomain: Module version bump.
Add new mmap permission set and pattern support macros.
Add missing mmap_*_files_pattern macros.
Revise mmap_file_perms deprecation warning message.
Update contrib.
hostname: Module version bump.
Update contrib.
init: Module version bump.
Bump module versions for release.
Christian Göttsche (6):
update travis
rkhunter: add interfaces for var_run and lock dir access check
dphysswapfile: add interfaces and sysadm access
hostname: cmdline usage + signal perms sort
filesystem: add fs_rw_inherited_hugetlbfs_files for apache module
init: add init_rw_inherited_stream_socket
David Graziano (1):
system/ipsec: Add signull access for strongSwan