-
Notifications
You must be signed in to change notification settings - Fork 126
/
Changelog
2236 lines (2089 loc) · 100 KB
/
Changelog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
* Sat Feb 29 2020 Chris PeBenito <[email protected]> - 2.20200229
Alexander Miroshnichenko (1):
Add knot module
Chris PeBenito (174):
knot: Whitespace changes.
knot: Move lines.
devices, storage: Add fc entries for mtd char devices and ndctl devices.
devices: Add types for trusted execution environment interfaces.
ulogd: Rename ulogd_var_run_t to ulogd_runtime_t.
INSTALL: Fix build requirements.
fishilico/systemd-read-netlink_kobject_uevent_socket
Rename *_var_run_t types to *_runtime_t.
Reorder declarations based on *_runtime_t renaming.
Remove old aliases.
fishilico/filesystem-fs_rw_cgroup_files-follow-symlink
fc_sort.py: Use "==" for comparing integers.
xserver: Remove duplicate colord rule.
xserver: Move XDM dbus chats under main dbus optional.
Move open, audit_access, and execmod to file common.
Add file and filesystem watch access vectors.
Fix file common ordering and kernel version from previous commit.
init: Whitespace change.
unconfined: Add namespaced capabilities.
unconfined: Fix systemd --user rule.
Remove incorrect usages of "is" operator from Python scripts.
logging: Reorder lines.
systemd: Logind removes /run/user/* user temp files.
unconfined: Add watch permission for files.
systemd: Add filesystem watches.
dbus: Add directory watches.
udev: Watch devices.
init: Revise systemd bind mounts.
Add perf_event access vectors.
systemd: Whitespace fix.
logging: Whitespace fix.
Bump module versions for release.
Christian Göttsche (6):
fix Makefile for policy-module directories with same ending
segenxml.py: fix format usage in warning message
travis: force the use of python3.5
travis: run check_fc_files linter with python 3.7
re-implement fc_sort in python
Add genfs_seclabel_symlinks policy capability
Daniel Burgener (4):
Add requires to interfaces that reference types or attributes without
requiring them
Remove uneeded types from interfaces where types were added
Fix situations where require blocks in interfaces listed types not
actually referenced by that interface
Remove unneeded semicolons after interface and macro calls
Dominick Grift (2):
domain: unconfined access to bpf
Remove shell automatic domain transitions to unconfined_t from various pam
login programs
Guido Trentalancia (4):
Update the pulseaudio application module with a few user domain file read
and management permissions.
Allow userdomain to read and write the wireless devices (for example for
querying their state, enabling and/or disabling them using userspace
tools such as "rfkill" from util-linux).
Add an interface to allow watch permission on generic device directories.
Allow pulseaudio to watch generic device directories.
Jason Zaman (16):
udev: Allow udevadm access to udev_tbl_t
xserver: ICEauthority can be in /run/user
devicekit: udisks needs access to /run/mount/utab.lock
dirmngr: accept unix stream socket
chromium: allow dbus chat to inhibit power
virt: Add unix socket for virtlogd/virtlockd
virt: allow lvm_control access
fstools: add zfs-auto-snapshot
udev: Add watch perms
accountsd: Add watch perms
cron: watch cron spool
colord: add watch perms
policykit devicekit: Add watch perms
dbus: add watch perms
chromium: watch etc dirs
gpg: add watch perms for agent
Laurent Bigonville (9):
Makefile: Avoid regenerating the iftemplates at everyrun
Allow systemd_modules_load_t to module_request and map modules_object_t
files
Allow udevadm to read files in /run/udev/data
Allow udevadm_t to use dac_read_search capability
Allow the systemd dbus-daemon to talk to systemd
Allow geoclue to log in syslog
Allow realmd_t to read localization files
Allow alsa_t to create alsa_runtime_t file as well
Allow alsa_t to set scheduling priority and send signal to itself
Luca Boccassi (2):
journald: allow to remove /run/log/journal
logging: add interface to start/stop syslog units
Nicolas Iooss (75):
ulogd: add Debian's log directory
ulogd: allow creating a netlink-netfilter socket
ulogd: allow starting on a Debian system
entropyd: label the unit file of haveged
entropyd: allow haveged to create a Unix socket to received commands
ulogd: fix pattern for /run/ulog directory
monit: use s0 instead of s9
java: reduce the scope of the pattern in for java entry points
libraries: match a digit in Adobe Reader directories
drbd: fix pattern for /usr/lib/ocf/resource.d/linbit/drbd
rpcbind: remove redundant file context for /run/rpc.statd.pid
files: reduce the scope of the pattern matching /usr/include
Remove unescaped single dot from the policy
Fix use of buggy pattern (.*)?
libraries: drop a pattern specific to Python 2.4
systemd: introduce an interface for services using PrivateDevices=yes
Vagrantfile: upgrade VM to Fedora 30
Allow Debian to generate a dynamic motd when users log in
entropyd: haveged service uses PrivateDevices=yes
Check the .fc files for common typos
corecommands: no longer use \d
libraries: fix some misspellings in patterns
java: remove unnecessary parentheses in pattern
cups: add a slash to match /opt/brother/Printers/
Vagrantfile: build and install refpolicy on Fedora VM
Vagrantfile: add a Debian virtual machine
ntp: allow systemd-timesyncd to read network status
cups: use ([^/]+/)? to match a subdirectory of CUPS configuration
portage: really make consoletype module optional
Label programs in /usr/bin like /usr/sbin
apt: allow transition from apt_t to dpkg_t with NNP
apt: allow preventing shutdown by calling a systemd-logind D-Bus method
authlogin: label utempter correctly on Debian
irc: add WeeChat policy
systemd: allow systemd --user to receive messages from
netlink_kobject_uevent_socket
Add a policy module for WireGuard VPN
modutils: allow depmod to read /boot/System.map
modutils: allow depmod and modprobe to use the I/O provided by apt
systemd: allow systemd-modules-load.service to read sysfs
sudo: allow using use_pty flag
Allow using /([^/]+/)? and (/[^/]+)?/ in patterns
ulogd: adjust policy for Debian
bitlbee: allow using GetDynamicUser on Debian
chromium: remove distro-specific ifdef
systemd-networkd: allow creating a generic netlink socket
systemd-networkd: allow communicating with hostnamed
sudo: allow transmitting SIGWINCH to its child
sudo: allow using CAP_KILL for SIGWINCH
systemd: allow detecting Windows Subsystem for Linux
systemd: allow more accesses to systemd --user
systemd: remove unnecessary init_write_runtime_socket()
.travis.yml: update distro to Ubuntu 18.04 LTS (Bionic Beaver)
filesystem: allow following symlinks with fs_rw_cgroup_files()
systemd: allow user environment helpers to communicate with systemd --user
.travis.yml: check the .fc files in CI
systemd: make the kernel spawn systemd-coredump with a context transition
gpg: allow gpg-agent to read crypto.fips_enabled sysctl
testing/check_fc_files: allow @ character in file context patterns
mount: allow callers of mount to search /usr/bin
sysadm: allow using hostnamectl
init: allow systemd to mount over /dev/kmsg and /proc/kmsg
Add policy for CryFS, encfs and gocryptfs
Vagrantfile: fix configuration
Vagrantfile: remove sudo
Vagrantfile: add a specific SELinux policy module
systemd: allow reading options from EFI variable SystemdOptions
virt: allow more accesses to libvirt_leaseshelper
systemd-logind: allow using BootLoaderEntries DBUS property
storage: introduce storage_raw_read_fixed_disk_cond
Vagrantfile: allow unconfined and sysadm SSH login
Vagrant: allow VirtualBox provisionning to use dhclient and ip
Associate role unconfined_r to wine_t
systemd: add an interface to use nss-systemd
usermanage: allow groupadd to lookup dynamic users from systemd
mount: label fusermount3 like fusermount
Peter Morrow (1):
systemd_tmpfiles_t: Allow systemd_tempfiles_t to change permissions in
sysfs
Petr Lautrbach (1):
newrole: allow newrole to use setcap to drop capabilities
Stephen Smalley (4):
access_vectors: Remove unused permissions
access_vectors: Remove entrypoint and execute_no_trans from chr_file
access_vectors: remove flow_in and flow_out permissions from packet class
Rename obsolete netlink_firewall_socket and netlink_ip6fw_socket classes
Sugar, David (13):
grant rpm permission to map rpm_var_lib_t
grant permission for rpm to write to audit log
grant rpm permissions to map locale_t
Allow rpm to map file contexts
Allow rpm scripts to alter systemd services
grant rpm_t permission to map security_t
Module for tpm2
Add missing gen_require for init_t in init_script_domain
resolve syslog imuxsock denial
Add interface to read efivarfs_t directory
Fix indent to match the rest of the file (space -> tab)
Allow systemd to getattr all files
audit daemon can halt system, allow this to happen.
Topi Miettinen (2):
Consider jitterentropy to belong to entropyd family
Consider iwd equivalent to NetworkManager etc.
Vilgot Fredenberg (1):
Remove obsolete gentoo specific rule
bauen1 (16):
fix: sudo can't determine default type for sysadm_r
fix ifupdown2 executable mislabeled as lib_t
added bpf_t filesystem label
netutils: allow mtr to communicate with mtr-packet
kernel/corecommands: fix the label of xfce4 helpers (on debian)
systemd: remove whitespace
init: add interfaces for managing /run/systemd
systemd: add policy for systemd-fstab-generator
udev: remove console-setup
consolesetup: add policy for console-setup
udev: run consolesetup
loadkeys: remove redundant ifdef
init: split init_create_pid_files interface
ntp: watch systemd networkd runtime dirs This is required for correct
function after linux 5.4
systemd-user-runtime-dir: add policy
sysadm: add sysadm_allow_rw_inherited_fifo tunable to allow writing to
fifo_files inherited from domains allowed to change role to sysadm_r.
* Sun Jun 09 2019 Chris PeBenito <[email protected]> - 2.20190609
Chris PeBenito (70):
systemd: Module version bump.
Merge branch 'sysadm-dynamic-users' of
git:https://github.com/fishilico/selinux-refpolicy
sysadm: Module version bump.
Merge branch 'stubby-daemon' of
git:https://github.com/fishilico/selinux-refpolicy
corenetwork: Module version bump.
systemd: Remove unnecessary brackets.
init, systemd, cdrecord: Module version bump.
logging, miscfiles, authlogin: Module version bump.
Merge branch 'systemd-journald-signull' of
git:https://github.com/fishilico/selinux-refpolicy
Merge branch 'restorecond-no-read-all' of
git:https://github.com/fishilico/selinux-refpolicy
logging, selinuxutil: Module version bump.
Merge branch 'systemd-update-done' of
git:https://github.com/fishilico/selinux-refpolicy
systemd: Module version bump.
aide, clamav: Module version bump.
filesystem, cron, authlogin: Module version bump.
Remove incorrect comment about capability2:mac_admin.
usermanage: Move kernel_dgram_send(passwd_t) to systemd block.
systemd, udev, usermanage: Module version bump.
genhomedircon.py: Fix top-level exception handling.
udev: Whitespace fix.
udev: Move one line and remove a redundant line.
sysadm, udev: Module version bump.
Merge pull request #35 from pebenito/master
systemd: Drop unconfined kernel access for systemd_nspawn.
udev: Drop write by udev to its executable.
init: Remove duplicate setenforce rule for init scripts.
authlogin, dbus, ntp: Module version bump.
ntp, init, lvm: Module version bump.
Merge pull request #37 from pebenito/master
kernel, init, systemd, udev: Module version bump.
init: Revise conditions in init_startstop_service().
Merge pull request #39 from pebenito/revise-init-stopstart
init: Module version bump.
kernel: Module version bump.
Merge pull request #40 from gtrentalancia/master
xserver: Module version bump.
various: Module version bump
apache: Make MTA optional.
systemd: Remove unnecessary names in systemd-update-done filetrans.
Merge pull request #42 from dsugar100/master
kernel, devices, plymouthd, xserver: Module version bump.
storage: Label /dev/mmcblk* character nodes.
devices: Label /dev/tpmrm[0-9].
devices: Add type for GPIO chips, /dev/gpiochip[0-9]
devices: Change netcontrol devices to pmqos.
systemd: Add initial policy for systemd --user.
Merge pull request #43 from pebenito/various-device-labels
Merge pull request #44 from pebenito/http-mta-optional
Merge pull request #45 from pebenito/systemd-update-done-tweak
Merge pull request #46 from pebenito/systemd-user
various: Module version bump.
Merge pull request #47 from dsugar100/master
Merge pull request #48 from bigon/dovecot_lmtp
Merge pull request #49 from bigon/fail2ban_logrotate
dovecot, logrotate: Module version bump.
logrotate: Make MTA optional.
Merge pull request #51 from pebenito/logrotate-optional-mta
Merge pull request #53 from WOnder93/makefile-fix
logrotate: Module version bump.
init: Add systemd block to init_script_domain().
systemd: modules-load updates.
apache: Web content rules simplification.
storage: Add fc entry for /dev/pmem*
devices: Add type for /dev/daxX.Y.
Merge pull request #54 from pebenito/init-script-systemd
Merge pull request #55 from pebenito/modules-load
Merge pull request #56 from pebenito/apache-simplify
Merge pull request #57 from pebenito/pmem-dax
various: Module version bump.
Bump module versions for release.
Dave Sugar (3):
Allow xdm (lightdm) start plymouth
Changes to support plymouth working in enforcing
create interfaces for NetworkManager units
Guido Trentalancia (1):
The Qt library version 5 requires to write xserver_tmp_t files upon
starting up applications (tested on version 5.12.1).
Laurent Bigonville (2):
Add dovecot to listen to LMTP port
Allow logrotate to execute fail2ban-client
Lukas Vrabec (1):
Label /sys/kernel/ns_last_pid as sysctl_kernel_ns_last_pid_t
Nicolas Iooss (6):
sysadm: allow resolving dynamic users
Add policy for stubby DNS resolver
Allow systemd-journald to use kill(pid, 0) on its clients
Allow restorecond to read customizable_types
Remove a broad read-files rule for restorecond
Update systemd-update-done policy
Ondrej Mosnacek (1):
Fix find commands in Makefiles
Sugar, David (26):
Allow systemd-networkd to get IP address from dhcp server
Separate domain for systemd-modules-load
Allow init_t to read net_conf_t
Allow systemd-hostnamed to set the hostname
Add interface to run cdrecord in caller domain
Add interface to get status of rsyslog service
New interface to dontaudit access to cert_t
Fix incorrect type in clamav_enableddisable_clamd interface
Allow freshclam to read sysctl_crypto_t
Add interfaces to run freshclam
Allow AIDE to sendto kernel datagram socket
Allow AIDE to read kernel sysctl_crypto_t
Allow AIDE to mmap files
Add interface to allow relabeling of iso 9660 filesystems.
Update cron use to pam interface
Allow additional map permission when reading hwdb
Resolve denial while changing password
Separate out udevadm into a new domain
Add interface ntp_dbus_chat
Allow ntpd to update chronyd service
Allow ntpd to update timezone symlink
Resolve denial about logging to journal from chkpwd
Resolve denial about logging to journal from dbus
Allow ntpd to read unit files
Denial of cryptsetup reading cracklib database
Add kernel_dgram_send() into logging_send_syslog_msg()
* Fri Feb 01 2019 Chris PeBenito <[email protected]> - 2.20190201
Alexander Miroshnichenko (16):
Add signal_perms setpgid setsched permissions to syncthing_t.
Add corecmd_exec_bin permissions to syncthing_t.
Allow syncthing_t to read network state.
Allow syncthing_t to execute ifconfig/iproute2.
Add required permissions for nsd_t to be able running.
Add nsd_admin interface to sysadm.te.
Add map permission to lvm_t on lvm_metadata_t.
Add comment for map on lvm_metadata_t.
Remove syncthing tunable_policy.
Remove unneeded braces from nsd.te.
Add new interface fs_rmw_hugetlbfs_files.
Add map permission for postgresql_t to postgresql_tmp_t files.
Add dovecot_can_connect_db boolean.
fs_mmap_rw_hugetlbfs_files is a more appropriate name for the interface
Add hostapd service module
minor updates redis module to be able to start the app
Chris PeBenito (85):
mozilla, devices, selinux, xserver, init, iptables: Module version bump.
devices: Module version bump.
misc_patterns.spt: Remove unnecessary brackets.
ipsec: Module version bump.
fstools: Module version bump.
corecommands: Module version bump.
xserver: Module version bump.
Merge pull request #1 from bigon/fix-sepolgen-ifgen
Remove unused translate permission in context userspace class.
logrotate: Module version bump.
miscfiles: Module version bump.
Merge pull request #3 from bigon/xdp-socket
obj_perm_sets.spt: Add xdp_socket to socket_class_set.
clamav, ssh, init: Module version bump.
amavis, apache, clamav, exim, mta, udev: Module version bump.
dnsmasq: Whitespace fix in file contexts.
dnsmasq: Reorder lines in file contexts.
Merge branch 'master' of https://github.com/bigon/refpolicy
Merge branch 'resolved' of https://github.com/bigon/refpolicy
Merge branch 'iscsi' of https://github.com/bigon/refpolicy
Various modules: Version bump.
dnsmasq: Module version bump.
Merge branch 'minissdpd' of https://github.com/bigon/refpolicy
cron, minissdpd, ntp, systemd: Module version bump.
dbus, xserver, init, logging, modutils: Module version bump.
Merge branch 'syncthing' of https://github.com/alexminder/refpolicy
syncthing: Whitespace change
Merge branch 'lvm' of https://github.com/alexminder/refpolicy
lvm, syncthing: Module version bump.
sigrok: Remove extra comments.
networkmanager: Add ICMPv6 comment
sysnetwork: Move optional block in sysnet_dns_name_resolve().
sysnetwork: Move lines.
dpkg: Rename dpkg_read_script_tmp_links().
apt, rpm: Remove and move lines to fix fc conflicts.
sudo: Whitespace fix.
many: Module version bumps for changes from Russell Coker.
systemd: Rename systemd_list_netif() to systemd_list_networkd_runtime().
init: Remove inadvertent merge.
Merge branch 'nsd' of https://github.com/alexminder/refpolicy
nsd: Merge two rules into one.
Merge branch 'ssh_dac_read_search' of
git:https://github.com/fishilico/selinux-refpolicy
Merge branch 'restorecond_getattr_cgroupfs' of
git:https://github.com/fishilico/selinux-refpolicy
Merge branch 'systemd-logind-getutxent' of
git:https://github.com/fishilico/selinux-refpolicy
various: Module version bump.
iptables: Module version bump.
Add CONTRIBUTING file.
kernel, systemd: Move lines.
kernel, jabber, ntp, init, logging, systemd: Module version bump.
Merge branch 'systemd-journald_units_symlinks' of
git:https://github.com/fishilico/selinux-refpolicy
init, logging: Module version bump.
Merge branch 'services_single_usr_bin' of
git:https://github.com/fishilico/selinux-refpolicy
Merge branch 'init_rename_pid_interfaces' of
git:https://github.com/fishilico/selinux-refpolicy
various: Module name bump.
Merge branch 'systemd-rfkill' of
git:https://github.com/fishilico/selinux-refpolicy
systemd: Whitespace change
systemd: Module version bump.
Merge branch 'restorecond-symlinks' of
git:https://github.com/fishilico/selinux-refpolicy
Merge branch 'add_comment' of git:https://github.com/DefenSec/refpolicy
usermanage, cron, selinuxutil: Module version bump.
logging, sysnetwork, systemd: Module version bump.
Merge branch 'restorecond-dontaudit-symlinks' of
git:https://github.com/fishilico/selinux-refpolicy
selinuxutil: Module version bump.
Merge branch 'dbus-dynamic-uid' of
git:https://github.com/fishilico/selinux-refpolicy
xserver: Move line
systemd: Move interface implementation.
various: Module version bump.
dpkg: Rename dpkg_nnp_transition() to dpkg_nnp_domtrans().
dpkg: Move interface implementations.
init: Rename init_read_generic_units_links() to
init_read_generic_units_symlinks().
init: Drop unnecessary userspace class dependence in
init_read_generic_units_symlinks().
chromium: Whitespace fixes.
chromium: Move line.
Merge branch 'dovecot' of git:https://github.com/alexminder/refpolicy
dovecot: Move lines.
various: Module version bump.
Merge branch 'postgres' of git:https://github.com/alexminder/refpolicy
filesystem, postgresql: Module version bump.
hostapd: Whitespace change.
hostapd: Move line.
various: Module version bump.
redis: Move line.
redis: Module version bump.
corecommands, staff, unprivuser, ssh, locallogin, systemd: Module version
bump.
Bump module versions for release.
David Sugar (15):
Interface to allow reading of virus signature files.
Update CUSTOM_BUILDOPT
Add interface udev_run_domain
Allow clamd_t to read /proc/sys/crypt/fips_enabled
Interface to add domain allowed to be read by ClamAV for scanning.
Add interfaces to control clamav_unit_t systemd services
Allow clamd to use sent file descriptor
Add interfaces to control ntpd_unit_t systemd services
interface to enable/disable systemd_networkd service
Interface to read cron_system_spool_t
Allow X (xserver_t) to read /proc/sys/crypto/fips_enabled
Allow kmod to read /proc/sys/crypto/fips_enabled
Allow dbus to access /proc/sys/crypto/fips_enabled
Add missing require for 'daemon' attribute.
Allow auditctl_t to read bin_t symlinks.
Dominick Grift (1):
unconfined: add a note about DBUS
Guido Trentalancia (1):
Add sigrok contrib module
Jagannathan Raman (1):
vhost: Add /dev/vhost-scsi device of type vhost_device_t.
Jason Zaman (10):
selinux: compute_access_vector requires creating netlink_selinux_sockets
mozilla: xdg updates
xserver: label .cache/fontconfig as user_fonts_cache_t
Allow map xserver_misc_device_t for nvidia driver
iptables: fcontexts for 1.8.0
devices: introduce dev_dontaudit_read_sysfs
files: introduce files_dontaudit_read_etc_files
kernel: introduce kernel_dontaudit_read_kernel_sysctl
userdomain: introduce userdom_user_home_dir_filetrans_user_cert
Add chromium policy upstreamed from Gentoo
Laurent Bigonville (10):
policy/support/obj_perm_sets.spt: modify indentation of mmap_file_perms to
make sepolgen-ifgen happy
Add xdp_socket security class and access vectors
irqbalance now creates an abstract socket
Allow semanage_t to connect to system D-Bus bus
Allow ntpd_t to read init state
Add systemd_dbus_chat_resolved() interface
Allow sysnet_dns_name_resolve() to use resolved to resolve DNS names
Allow systemd_resolved_t to bind to port 53 and use net_raw
Allow iscsid_t to create a netlink_iscsi_socket
Allow minissdpd_t to create a unix_stream_socket
Luis Ressel (7):
corecommands: Fix /usr/share/apr* fc
xserver: Allow user fonts (and caches) to be mmap()ed.
Add fc for /var/lib/misc/logrotate.status
Realign logrotate.fc, remove an obvious comment
miscfiles: Label /usr/share/texmf*/fonts/ as fonts_t
services/ssh: Don't audit accesses from ssh_t to /dev/random
system/init: Give init_spec_daemon_domain()s the "daemon" attribute
Lukas Vrabec (1):
Improve domain_transition_pattern to allow mmap entrypoint bin file.
Nicolas Iooss (11):
fstools: label e2mmpstatus as fsadm_exec_t
ssh: use dac_read_search instead of dac_override
selinuxutil: allow restorecond to try counting the number of files in
cgroup fs
systemd: allow systemd-logind to use getutxent()
Allow systemd-journald to read systemd unit symlinks
Label service binaries in /usr/bin like /usr/sbin
init: rename *_pid_* interfaces to use "runtime"
systemd: add policy for systemd-rfkill
selinuxutil: allow restorecond to read symlinks
selinuxutil: restorecond is buggy when it dereferencies symlinks
dbus: allow using dynamic UID
Petr Vorel (1):
dnsmasq: Require log files to have .log suffix
Russell Coker (19):
misc services patches
misc interfaces
last misc stuff
systemd related interfaces
systemd misc
missing from previous
cron trivial
mls stuff
logging
some little stuff
trivial system cronjob
another trivial
more tiny stuff
map systemd private dirs
tiny stuff for today
yet more tiny stuff
yet another little patch
chromium
more misc stuff
Sugar, David (9):
Allow greeter to start dbus
pam_faillock creates files in /run/faillock
Add interface to get status of iptables service
Add interface to start/stop iptables service
label journald configuraiton files syslog_conf_t
Interface with systemd_hostnamed over dbus to set hostname
Modify type for /etc/hostname
Add interface clamav_run
Add interface to read journal files
Yuli Khodorkovskiy (1):
ipsec: add missing permissions for pluto
* Sun Jul 01 2018 Chris PeBenito <[email protected]> - 2.20180701
Chris PeBenito (28):
Enable cgroup_seclabel and nnp_nosuid_transition.
Misc dbus fixes from Russell Coker.
Simple map patch from Russell Coker.
another trivial dbus patch from Russell Coker.
Merge branch 'xtable-proc' of https://github.com/bigon/refpolicy
iptables: Module version bump.
Update contrib.
.travis.yml: Change to master branch for sctp support.
corenetwork, init: Module version bump.
Module version bumps for patches from James Carter.
Update contrib.
init, logging, sysnetwork, systemd, udev: Module version bump.
sysnetwork: Move lines in sysnet_read_config().
sysnetwork: Module version bump.
init: Module version bump.
Remove deprecated flask.py script.
Switch all remaining Python references to the Python 3 interpreter.
systemd: Move lines.
corecommands: Module version bump.
Makefile: Tweak cli output.
XDG: Module version bump.
Remove refpolicy-contrib submodule.
Re-add policy modules from old refpolicy-contrib submodule.
Move all files out of the old contrib directory.
Changelog.contrib: Add note about refpolicy-contrib removal.
sysnetwork: Module version bump.
xdg, xserver, mplayer, games: Module version bump.
Bump module versions for release.
Christian Göttsche (1):
add definition of bpf class and systemd perms
Dave Sugar (8):
Fix problems booting with fips=1
Interface to read /run/systemd/resolve/resolv.conf
Allow systemd-resolved to read sysctl
Allow systemd_resolved to read systemd_networkd runtime files
Allow systemd-resolved to connect to system dbusd
systemd-resolved uses notify to indicate status
policy for systemd-update-done
policy for systemd-hwdb
James Carter (8):
Removed unnecessary semicolons
Mark unused parameters as unused
Move the use of var_log_t from authlogin.fc to logging.fc
Move the use of initrc_var_run_t from files.fc to init.fc
Move use of systemd_unit_t from systemd.fc to init.fc
Move use of user_devpts_t from terminal.fc to userdomain.fc
Remove undeclared identifiers from interfaces
Remove undeclared identifiers from xserver interface
Jason Zaman (9):
sysnetwork: put systemd_read_resolved_runtime in an ifdef
init: Add filetrans for /run/initctl
corecommands: adjust gcc fcontext to also work on musl
userdom: remove filetrans from userdom_user_content_access_template
xdg: Add map perms, also make lnk_file, dirs consistent
xdg: filetrans should not add filetrans from user_home_dir
xdg: Introduce xdg_search_cache_dirs
xserver: Add mesa_shader_cache for GLSL in ~/.cache/mesa_shader_cache/
apps: rw mesa_shader_cache
Laurent Bigonville (1):
Label /etc/hosts.allow as net_conf_t
Miroslav Grepl (1):
xtables-multi wants to getattr of the proc fs
Richard Haines (1):
refpolicy: Update for kernel sctp support
Sven Vermeulen (7):
Add gentemplates.sh to extract template content
Update segenxml to include support for templated booleans and tunables
Generate template code and update genxml call for documentation generation
freedesktop location support
Allow X server users to manage all xdg resources
helper interfaces to read/manage all user content
tunable-managed user content access template
* Sun Jan 14 2018 Chris PeBenito <[email protected]> - 2.20180114
Adam Duskett (1):
fix regex escape sequence error.
Anthony PERARD (1):
Update for Xen 4.7
Chad Hanson (1):
Fix implementation of MLS file relabel attributes
Chris PeBenito (74):
Module version bump for patches from Guido Trentalancia and Anthony
PERARD.
Rules.modular: Fix file context verification.
Remove deprecated interfaces older than one year old.
.travis.yml: Use git tag instead of release tarball for selinux userspace.
kernel: Module version bump for patch from Nicolas Iooss.
Remove complement and wildcard in allow rules.
logging: Move line.
Module version bump for patches from Nicolas Iooss.
Module version bump for fixes from Nicolas Iooss.
Update contrib.
dbus: move comments out of the file context definitions
Update contrib.
systemd, udev: Module version bump.
systemd: Whitespace fix.
Module version bump for patches from Nicolas Iooss.
init: Move fc lines.
init: Module version bump for patch from Dave Sugar.
files: Move files_check_write_pid_dirs interface.
terminal: Rename term_create_devpts.
Several module version bumps.
init: Move init_spec_daemon_domain implementation.
Module version bumps.
init: Rename init_rlimit_inherit to init_inherit_rlimit.
init: Whitespace fix.
Module version bumps.
spamassassin: Fix build error.
init: Fix XML error.
spamassassin: Add missing requirement in spamassassin_admin().
sysadm,fstools: Module version bump.
authlogin, logging, udev: Module version bump.
init: Remove sm-notify.pid fc entry which collides with the rpc module.
corecommands, xserver, systemd, userdomain: Version bumps.
Update contrib.
Update contrib.
corecommands: Module version bump.
init: Module version bump.
Merge pull request #125 from lalozano/master
devices: Module version bump.
Module version bumps.
Merge branch 'master' of git:https://github.com/davidgraz/refpolicy
ipsec: Module version bump.
Merge branch 'master' of git:https://github.com/aduskett/refpolicy
init: Clean up line placement in init_systemd blocks.
files: Whitespace fix.
Merge branch 'systemd-networkd'
files, init, sysnetwork, systemd: Module version bumps.
Merge pull request #128 from williamcroberts/fc-sort-fixups
Update contrib.
files, netutils: Module version bump.
miscfiles: Module version bump.
Update contrib.
files, userdomain: Module version bump.
kernel, mls, sysadm, ssh, xserver, authlogin, locallogin, userdomain:
Module version bumps.
Several module version bumps.
Module version bumps.
dmesg, locallogin, modutils: Module version bump.
loadable_module.spt: Add debugging comments for tunable_policy blocks.
networkmanager: Grant access to unlabeled PKeys
filesystem: Rename fs_relabel_cgroup_lnk_files.
corcmd, fs, xserver, init, systemd, userdomain: Module version bump.
xserver, sysnetwork, systemd: Module version bump.
xserver: Module version bump.
init: Module version bump.
Update contrib.
mls, xserver, systemd, userdomain: Module version bump.
storage, userdomain: Module version bump.
Add new mmap permission set and pattern support macros.
Add missing mmap_*_files_pattern macros.
Revise mmap_file_perms deprecation warning message.
Update contrib.
hostname: Module version bump.
Update contrib.
init: Module version bump.
Bump module versions for release.
Christian Göttsche (6):
update travis
rkhunter: add interfaces for var_run and lock dir access check
dphysswapfile: add interfaces and sysadm access
hostname: cmdline usage + signal perms sort
filesystem: add fs_rw_inherited_hugetlbfs_files for apache module
init: add init_rw_inherited_stream_socket
David Graziano (1):
system/ipsec: Add signull access for strongSwan
David Sugar (20):
Strip spaces from NAME
Separate read and write interface for tun_tap_device_t
Label RHEL specific systemd binaries
Label /etc/rsyslog.d as syslog_conf_t
Add init_spec_daemon_domain interface
Add status into init_startstop_service interface
Add int_rlimit_inherit interface
remove interface init_inherit_rlimit
Fix problem labeling /run/log/journal/*
Denial relabeling /run/systemd/private
policy for systemd-networkd
Label /var/lib/lightdm-data
Change label for ~/.xsession-errors
Work around systemd-logind patch not in RHEL 7.x yet
RHEL 7.4 has moved the location of /usr/libexec/sesh to
/usr/libexec/sudo/sesh
Create interfaces to write to inherited xserver log files.
label systemd-shutdown so shutdown works
Make an attribute for objects in /run/user/%{USERID}/*
Make xdm directories created in /run/user/%{USERID}/ xdm_runtime_t
(user_runtime_content_type)
Allow systemd_logind to delete user_runtime_content_type files
David Sugar via refpolicy (2):
label /etc/mcelog/mcelog.setup correctly (for RHEL)
Allow xdm_t to read /proc/sys/crypto/fips_enabled
Guido Trentalancia (4):
userdomain: allow netlink_kobject_uvent_socket creation
xserver: do not audit ioctl operations on log files
fc_sort: memory leakages
base: create a type for SSL private keys
Jason Zaman (8):
Allow sysadm to map all non auth files
userdomain: allow admin to rw tape storage
files: fcontext for /etc/zfs/zpool.cache
mls mcs: Add constraints for key class
Add key interfaces and perms
gssproxy: Allow others to stream connect
userdomain: Allow public content access
storage: Add fcontexts for NVMe disks
Jason Zaman via refpolicy (3):
udev: map module objects to load kernel modules
syslog: allow map persist file
sudo: add fcontext for /run/sudo/ts/USERNAME
Konrad Rzeszutek Wilk (2):
kernel/xen: Update for Xen 4.6
kernel/xen: Add map permission to the dev_rw_xen
Krzysztof Nowicki (2):
Add policy for systemd GPT generator
Allow systemd to relabel cgroupfs legacy symlinks
Laurent Bigonville (2):
Allow domains using sysnet_dns_name_resolve() interface to access NSS
mymachines files
Add private type for systemd logind inhibit files and pipes
Luis A. Lozano (1):
Avoid memory leak warning.
Luis Ressel (15):
modutils: libkmod mmap()s modules.dep and *.ko's
libraries: ldconfig maps its "aux-cache" during cache updates
userdomain: Add various interfaces granting the map permission
files: Create files_map_usr_files interface
selinuxutil: Add map permissions neccessary for semanage
kernel: Add map permission to the dev_{read, write}_sound* interfaces
miscfiles: Allow libfontconfig consumers to map the fonts cache
userdomain: man-db needs to map its 'index.db' cache
logging: Various audit tools (auditctl, ausearch, etc) map their config
and logs
Grant all permissions neccessary for Xorg and basic X clients
libraries: Add fc entry for musl's ld.so config
xserver: Allow xdm_t to map usr_t files
locallogin: Grant local_login_t the dac_read_search capability
dmesg: Grant read access to /usr/share/terminfo
modutils: Dontaudit CAP_SYS_ADMIN checks for modprobe
Luis Ressel via refpolicy (2):
kernel/files.if: files_list_kernel_modules should grant read perms for
symlinks
netutils: Grant netutils_t map perms for the packet_socket class
Nicolas Iooss (9):
Add module_load permission to self when loading modules is allowed
audit: allow reading /etc/localtime
corecommands: label dhcpcd hook scripts bin_t
Add "/usr/(.*/)?bin(/.*)?" pattern back
Allow dhcpcd to use generic netlink and raw IP sockets
corecommands: label Arch Linux pacman's scripts as bin_t
init: allow systemd to create /dev/pts as devpts_t
init: allow systemd to relabel /dev and /run
corecommands: label systemd script directories bin_t
Nicolas Iooss via refpolicy (1):
terminal: /dev/pts exists in /dev filesystem
Russell Coker (4):
systemd nspawn and backlight
udev and dhcpd
minor nspawn, dnsmasq, and mon patches
refpolicy and certs
William Roberts (1):
fc_sort: use calloc instead of malloc
* Sat Aug 05 2017 Chris PeBenito <[email protected]> - 2.20170805
Chris PeBenito (134):
Create / to /usr equivalence for bin, sbin, and lib, from Russell Coker.
usrmerge FC fixes from Russell Coker.
Systemd tmpfiles fix for kmod.conf from Russell Coker.
Update contrib.
mon policy from Russell Coker.
Fix contrib commit.
Revert "bootloader: stricter permissions and more tailored file contexts"
Module version bump for bootloader patch revert. Plus compat alias.
Update contrib.
Sort capabilities permissions from Russell Coker.
Update contrib.
Little misc patches from Russell Coker.
Implement WERROR build option to treat warnings as errors.
Fix Travis-CI WERROR support.
Travis-CI: Terminate build immediately on error.
mon: Fix deprecated interface usage.
Merge branch 'setfiles_getattr' of git:https://github.com/cgzones/refpolicy
Merge branch 'sysadm_fixes' of git:https://github.com/cgzones/refpolicy
Merge branch 'corecmd_module' of git:https://github.com/cgzones/refpolicy
Merge branch 'var_and_run' of git:https://github.com/cgzones/refpolicy
Module version bump for changes from cgzones.
Merge pull request #98 from cgzones/admin_process_pattern
Merge branch 'hostname_module' of git:https://github.com/cgzones/refpolicy
Module version bump for hostname fix from cgzones.
Only display the WERROR notice if there actually are errors.
Merge branch 'master' of github.com:TresysTechnology/refpolicy
dpkg: Updates from Russell Coker.
Monit policy from Russell Coker and cgzones.
monit: Fix build error.
fetchmail, mysql, tor: Misc fixes from Russell Coker.
Merge branch 'systemd_transient' of git:https://github.com/cgzones/refpolicy
Merge branch 'selinuxutil_module' of git:https://github.com/cgzones/refpolicy
Module version bump for selinuxutil and systmd changes from cgzones.
Merge branch 'cgroups_fix' of git:https://github.com/cgzones/refpolicy
Module version bump for cgroups systemd fix from cgzones.
alsa, vnstat: Updates from cgzones.
Merge branch 'init_ntp_interface' of git:https://github.com/cgzones/refpolicy
Module version bump for ntp fixes from cgzones.
Systemd fixes from Russell Coker.
Fix CI errors.
Module version bump for CI fixes.
Xen fixes from Russell Coker.
mailman: Fixes from Russell Coker.
init: Rename init_search_pid_dirs() to init_search_pids().
init: Move interface and whitespace change.
systemd: Further revisions from Russell Coker.
Fix typo in README.
Network daemon patches from Russell Coker.
apache: Fix CI error.
devices: Fix docs for dev_write_generic_sock_files().
Merge branch 'su_module' of git:https://github.com/cgzones/refpolicy
Merge branch 'newrole_fixes' of git:https://github.com/cgzones/refpolicy
auth: Move optional out of auth_use_pam_systemd() to callers.
Merge branch 'locallogin_module' of git:https://github.com/cgzones/refpolicy
Module version bump for patches from cgzones.
Merge branch 'userdom_terminals_permit_open' of
git:https://github.com/cgzones/refpolicy
Module version bump for user terminal improvments from cgzones.
Merge branch 'monit_depend' of git:https://github.com/cgzones/refpolicy
Module version bump for misc fixes from cgzones.
Merge pull request #103 from fishilico/validate_modular_fc
Merge branch 'getty_module' of git:https://github.com/cgzones/refpolicy
Module version bump for getty patch from cgzones.
Merge branch 'modutils_module' of git:https://github.com/cgzones/refpolicy
Merge branch 'fix_usr_bin_merge' of git:https://github.com/cgzones/refpolicy
Module version bumps for fixes from cgzones.
Merge branch 'lvm' of git:https://github.com/cgzones/refpolicy
Merge branch 'macros' of git:https://github.com/cgzones/refpolicy
Module version bump for fixes from cgzones.
Module version bump for fixes from cgzones.
dontaudit net_admin for SO_SNDBUFFORCE
/var/run -> /run again
Merge branch 'var_run' of git:https://github.com/cgzones/refpolicy
Module version bump from /var/run fixes from cgzones.
Merge branch 'monit' of git:https://github.com/cgzones/refpolicy
Module version bump for monit patch from cgzones
another version of systemd cgroups hostnamed and logind
Merge pull request #109 from cgzones/python3
systemd-resolvd, sessions, and tmpfiles take2
systemd-nspawn again
Merge pull request #112 from cgzones/remove_support/pyplate
Misc fc changes from Russell Coker.
Systemd-related changes from Russell Coker.
Merge pull request #115 from fishilico/python_raw_strings
Module version bump for misc fixes from Guido Trentalancia.
systemd init from Russell Coker
more systemd stuff from Russell Coker
misc daemons from Russell Coker.
bootloader from Russell Coker.
kmod, lvm, brctl patches from Russell Coker
devicekit, mount, xserver, and selinuxutil from Russell Coker
another bootloader patch from Russell Coker
some userdomain patches from Russell Coker
corecommands: Add fc escaping for previous patch.
Module version bump for patch from Guido Trentalancia
Module version bump from fixes from Guido Trentalancia.
xdm sigchld interface from Russell Coker.
Further strict systemd fixes from Russell Coker.
Update contrib.
locallogin: Move two sulogin lines.
Login take 4 from Russell Coker.
Rename apm to acpi from Russell Coker.
Module version bump for patches from Russell Coker and Guido Trentalancia.