|
|
 |
|
|
Changelog for selinux-policy-doc-3.13.1-23.el7.noarch.rpm :
* Fri Jan 30 2015 Miroslav Grepl 3.13.1-23- Update seutil_manage_config() interface.Resolves:#1185962- Allow pki-tomcat relabel pki_tomcat_etc_rw_t.- Turn on docker_transition_unconfined by default
* Wed Jan 28 2015 Miroslav Grepl 3.13.1-22- Allow virtd to list all mountpoints.Resolves:#1180713
* Wed Jan 28 2015 Miroslav Grepl 3.13.1-21- pkcsslotd_lock_t should be an alias for pkcs_slotd_lock_t.- Allow fowner capability for sssd because of selinux_child handling.- ALlow bind to read/write inherited ipsec pipes- Allow hypervkvp to read /dev/urandom and read addition states/config files.- Allow gluster rpm scripletto create glusterd socket with correct labeling. This is a workaround until we get fix in glusterd.- Add glusterd_filetrans_named_pid() interface- Allow radiusd to connect to radsec ports.- Allow setuid/setgid for selinux_child- Allow lsmd plugin to connect to tcp/5988 by default.- Allow lsmd plugin to connect to tcp/5989 by default.- Update ipsec_manage_pid() interface.Resolves:#1184978
* Fri Jan 23 2015 Miroslav Grepl 3.13.1-20- Update ipsec_manage_pid() interface.Resolves:#1184978
* Wed Jan 21 2015 Miroslav Grepl 3.13.1-19- Allow ntlm_auth running in winbind_helper_t to access /dev/urandom.
* Wed Jan 21 2015 Miroslav Grepl 3.13.1-18- Add auditing support for ipsec.Resolves:#1182524- Label /ostree/deploy/rhel-atomic-host/deploy directory as system_conf_t- Allow netutils chown capability to make tcpdump working with -w
* Tue Jan 20 2015 Miroslav Grepl 3.13.1-17- Allow ipsec to execute _updown.netkey script to run unbound-control.- Allow neutron to read rpm DB.- Add additional fixes for hyperkvp
* creates new ifcfg-{name} file
* Runs hv_set_ifconfig.sh, which does the following
* Copies ifcfg-{name} to /etc/sysconfig/network-scripts- Allow svirt to read symbolic links in /sys/fs/cgroups labeled as tmpfs_t- Add labeling for pacemaker.log.- Allow radius to connect/bind radsec ports.- Allow pm-suspend running as virt_qemu_ga to read /var/log/pm-suspend.log- Allow virt_qemu_ga to dbus chat with rpm.- Update virt_read_content() interface to allow read also char devices.- Allow glance-registry to connect to keystone port.Resolves:#1181818
* Mon Jan 12 2015 Miroslav Grepl 3.13.1-16- Allow sssd to send dbus all user domains.Resolves:#1172291- Allow lsm plugin to read certificates.- Fix labeling for keystone CGI scripts.- Make snapperd back as unconfined domain.
* Fri Jan 09 2015 Miroslav Grepl 3.13.1-15- Fix bugs in interfaces discovered by sepolicy.- Allow slapd to read /usr/share/cracklib/pw_dict.hwm.- Allow lsm plugins to connect to tcp/18700 by default.- Allow brltty mknod capability to allow create /var/run/brltty/vcsa.- Fix pcp_domain_template() interface.- Fix conman.te.- Allow mon_fsstatd to read /proc/sys/fs/binfmt_misc- Allow glance-scrubber to connect tcp/9191.- Add missing setuid capability for sblim-sfcbd.- Allow pegasus ioctl() on providers.- Add conman_can_network.- Allow chronyd to read chrony conf files located in /run/timemaster/.- Allow radius to bind on tcp/1813 port.- dontaudit block suspend access for openvpn_t - Allow conman to create files/dirs in /tmp.- Update xserver_rw_xdm_keys() interface to have \'setattr\'.Resolves:#1172291 - Allow sulogin to read /dev/urandom and /dev/random.- Update radius port definition to have also tcp/18121- Label prandom as random_device_t.- Allow charon to manage files in /etc/strongimcv labeled as ipsec_conf_t.
* Fri Dec 12 2014 Miroslav Grepl 3.13.1-14- Allow virt_qemu_ga_t to execute kmod.- Add missing files_dontaudit_list_security_dirs() for smbd_t in samba_export_all_ro boolean.- Add additionnal MLS attribute for oddjob_mkhomedir to create homedirs.Resolves:#1113725- Enable OpenStack cinder policy- Add support for /usr/share/vdsm/daemonAdapter- Add support for /var/run/gluster
* Tue Dec 02 2014 Miroslav Grepl 3.13.1-13- Remove old pkcsslotd.pp from minimum package- Allow rlogind to use also rlogin ports.- Add support for /usr/libexec/ntpdate-wrapper. Label it as ntpdate_exec_t.- Allow bacula to connect also to postgresql.- Label /usr/libexec/tomcat/server as tomcat_exec_t- Add support for /usr/sbin/ctdbd_wrapper- Add support for /usr/libexec/ppc64-diag/rtas_errd- Allow rpm_script_roles to access system_mail_t- Allow brltty to create /var/run/brltty- Allow lsmd plugin to access netlink_route_socket- Allow smbcontrol to read passwd- Add support for /usr/libexec/sssd/selinux_child and create sssd_selinux_manager_t domain for itResolves:#1140106- Allow osad to execute rhn_check- Allow load_policy to rw inherited sssd pipes because of selinux_child- Allow admin SELinux users mounting / as private within a new mount namespace as root in MLS- Add additional fixes for su_restricted_domain_template to make moving to sysadm_r and trying to su working correctly- Add additional booleans substitions
* Tue Nov 25 2014 Miroslav Grepl 3.13.1-12- Add seutil_dontaudit_access_check_semanage_module_store() interfaceResolves:#1140106- Update to have all _systemctl() interface also init_reload_services().- Dontaudit access check on SELinux module store for sssd.- Add labeling for /sbin/iw.- Allow named_filetrans_domain to create ibus directory with correct labeling.
* Mon Nov 24 2014 Miroslav Grepl 3.13.1-11- Allow radius to bind tcp/1812 radius port.- Dontaudit list user_tmp files for system_mail_t.- Label virt-who as virtd_exec_t.- Allow rhsmcertd to send a null signal to virt-who running as virtd_t.- Add missing alias for _content_rw_t.Resolves:#1089177- Allow spamd to access razor-agent.log.- Add fixes for sfcb from libvirt-cim TestOnly bug.- Allow NetworkManager stream connect on openvpn.- Make /usr/bin/vncserver running as unconfined_service_t.- getty_t should be ranged in MLS. Then also local_login_t runs as ranged domain.- Label /etc/docker/certs.d as cert_t.
* Tue Nov 18 2014 Miroslav Grepl 3.13.1-10- Label /etc/strongimcv as ipsec_conf_file_t.- Add support for /usr/bin/start-puppet-ca helper scriptResolves:#1160727- Allow rpm scripts to enable/disable transient systemd units.Resolves:#1154613 - Make kpropdas nsswitch domainResolves:#1153561- Make all glance domain as nsswitch domainsResolves:#1113281- Allow selinux_child running as sssd access check on /etc/selinux/targeted/modules/active- Allow access checks on setfiles/load_policy/semanage_lock for selinux_child running as sssd_tResolves:#1140106
* Mon Nov 10 2014 Miroslav Grepl 3.13.1-9- Dontaudit access check on setfiles/load_policy for sssd_t.Resolves:#1140106- Add kdump_rw_inherited_kdumpctl_tmp_pipes()Resolves:#1156442- Make linuxptp services as unconfined.- Added new policy linuxptp.Resolves:#1149693- Label keystone cgi files as keystone_cgi_script_exec_t.Resolves:#1138424- Make tuned as unconfined domain
* Thu Nov 06 2014 Miroslav Grepl 3.13.1-8- Allow guest to connect to libvirt using unix_stream_socket.- Allow all bus client domains to dbus chat with unconfined_service_t.- Allow inetd service without own policy to run in inetd_child_t which is unconfined domain.- Make opensm as nsswitch domain to make it working with sssd.- Allow brctl to read meminfo.- Allow winbind-helper to execute ntlm_auth in the caller domain.Resolves:#1160339- Make plymouthd as nsswitch domain to make it working with sssd.Resolves:#1160196- Make drbd as nsswitch domain to make it working with sssd.- Make conman as nsswitch domain to make ipmitool.exp runing as conman_t working.- Add support for /var/lib/sntp directory.- Add fixes to allow docker to create more content in tmpfs ,and donaudit reading /proc- Allow winbind to read usermodehelper- Allow telepathy domains to execute shells and bin_t- Allow gpgdomains to create netlink_kobject_uevent_sockets- Allow mongodb to bind to the mongo port and mongos to run as mongod_t- Allow abrt to read software raid state.- Allow nslcd to execute netstat.- Allow dovecot to create user\'s home directory when they log into IMAP.- Allow login domains to create kernel keyring with different level.
* Mon Nov 03 2014 Miroslav Grepl 3.13.1-7- Allow modemmanger to connectto itselfResolves:#1120152 - Allow pki_tomcat to create link files in /var/lib/pki-ca.Resolves:#1121744 - varnishd needs to have fsetid capabilityResolves:#1125165- Allow snapperd to dbus chat with system cron jobs.Resolves:#1152447- Allow dovecot to create user\'s home directory when they log into IMAP Resolves:#1152773 - Add labeling for /usr/sbin/haproxy-systemd-wrapper wrapper to make haproxy running haproxy_t.- ALlow listen and accept on tcp socket for init_t in MLS. Previously it was for xinetd_t. - Allow nslcd to execute netstat.- Add suppor for keepalived unconfined scripts and allow keepalived to read all domain state and kill capability.- Allow nslcd to read /dev/urandom.
* Thu Oct 16 2014 Miroslav Grepl 3.13.1-6- Add back kill permisiion for system classResolves:#1150011
* Wed Oct 15 2014 Miroslav Grepl 3.13.1-5- Add back kill permisiion for service classResolves:#1150011- Make rhsmcertd_t also as dbus domain.- Allow named to create DNS_25 with correct labeling.- Add cloudform_dontaudit_write_cloud_log()- Call auth_use_nsswitch to apache to read/write cloud-init keys.- Allow cloud-init to dbus chat with certmonger.- Fix path to mon_statd_initrc_t script.- Allow all RHCS services to read system state.- Allow dnssec_trigger_t to execute unbound-control in own domain.- kernel_read_system_state needs to be called with type. Moved it to antivirus.if.- Added policy for mon_statd and mon_procd services. BZ (1077821)- Allow opensm_t to read/write /dev/infiniband/umad1.- Allow mongodb to manage own log files.- Allow neutron connections to system dbus.- Add support for /var/lib/swiftdirectory.- Allow nova-scheduler to read certs.- Allow openvpn to access /sys/fs/cgroup dir.- Allow openvpn to execute systemd-passwd-agent in systemd_passwd_agent_t to make openvpn working with systemd.- Fix samba_export_all_ro/samba_export_all_rw booleans to dontaudit search/read security files.- Add auth_use_nsswitch for portreserve to make it working with sssd.- automount policy is non-base module so it needs to be called in optional block.- ALlow sensord to getattr on sysfs.- Label /usr/share/corosync/corosync as cluster_exec_t.- Allow lmsd_plugin to read passwd file. BZ(1093733)- Allow read antivirus domain all kernel sysctls.- Allow mandb to getattr on file systems- Allow nova-console to connect to mem_cache port.- Make sosreport as unconfined domain.- Allow mondogdb to \'accept\' accesses on the tcp_socket port.- ALlow sanlock to send a signal to virtd_t.
* Thu Oct 09 2014 Miroslav Grepl 3.13.1-4- Build also MLS policyResolves:#1138424
* Thu Oct 09 2014 Miroslav Grepl 3.13.1-3- Add back kill permisiion for system class- Allow iptables read fail2ban logs.- Fix radius labeled ports- Add userdom_manage_user_tmpfs_files interface- Allow libreswan to connect to VPN via NM-libreswan.- Label 4101 tcp port as brlp port- fix dev_getattr_generic_usb_dev interface- Allow all domains to read fonts- Make sure /run/systemd/generator and system is labeled correctly on creation.- Dontaudit aicuu to search home config dir. - Make keystone_cgi_script_t domain. Resolves:#1138424- Fix bug in drbd policy, - Added support for cpuplug. - ALlow sanlock_t to read sysfs_t.- Added sendmail_domtrans_unconfined interface- Fix broken interfaces- radiusd wants to write own log files.- Label /usr/libexec/rhsmd as rhsmcertd_exec_t- Allow rhsmcertd send signull to setroubleshoot. - Allow rhsmcertd manage rpm db. - Added policy for blrtty. - Fix keepalived policy- Allow rhev-agentd dbus chat with systemd-logind.- Allow keepalived manage snmp var lib sock files.- Add support for /var/lib/graphite-web- Allow NetworkManager to create Bluetooth SDP sockets- It\'s going to do the the discovery for DUN service for modems with Bluez 5.- Allow swift to connect to all ephemeral ports by default.- Allow sssd to read selinux config to add SELinux user mapping.- Allow lsmd to search own plguins.- Allow abrt to read /dev/memto generate an unique machine_id and uses sosuploader\'s algorithm based off dmidecode[1] fields.- ALlow zebra for user/group look-ups.- Allow nova domains to getattr on all filesystems.- Allow collectd sys_ptrace and dac_override caps because of reading of /proc/%i/io for several processes.- Allow pppd to connect to /run/sstpc/sstpc-nm-sstp-service-28025 over unix stream socket.- Allow rhnsd_t to manage also rhnsd config symlinks.- ALlow user mail domains to create dead.letter.- Allow rabbitmq_t read rabbitmq_var_lib_t lnk files. - Allow pki-tomcat to change SELinux object identity.- Allow radious to connect to apache ports to do OCSP check- Allow git cgi scripts to create content in /tmp- Allow cockpit-session to do GSSAPI logins.- Allow sensord read in /proc - Additional access required by usbmuxd
* Thu Sep 18 2014 Miroslav Grepl 3.13.1-2- Allow locate to look at files/directories without labels, and chr_file and blk_file on non dev file systems- Label /usr/lib/erlang/erts.
*/bin files as bin_t- Add files_dontaudit_access_check_home_dir() inteface.- Allow udev_t mounton udev_var_run_t dirs #(1128618)- Add systemd_networkd_var_run_t labeling for /var/run/systemd/netif and allow systemd-networkd to manage it.- Add init_dontaudit_read_state() interface.- Add label for ~/.local/share/fonts- Allow unconfined_r to access unconfined_service_t.- Allow init to read all config files- Add new interface to allow creation of file with lib_t type- Assign rabbitmq port.- Allow unconfined_service_t to dbus chat with all dbus domains- Add new interfaces to access users keys.- Allow domains to are allowed to mounton proc to mount on files as well as dirs- Fix labeling for HOME_DIR/tmp and HOME_DIR/.tmp directories.- Add a port definition for shellinaboxd- Label ~/tmp and ~/.tmp directories in user tmp dirs as user_tmp_t- Allow userdomains to stream connect to pcscd for smart cards- Allow programs to use pam to search through user_tmp_t dires (/tmp/.X11-unix)- Update to rawhide-contrib changesResolves:#1123844
* Thu Aug 21 2014 Miroslav Grepl 3.13.1-1- Rebase to 3.13.1 which we have in Fedora21Resolves:#1128284
* Fri Jun 13 2014 Miroslav Grepl 3.12.1-156- Back port fixes from Fedora. Mainly OpenStack and Docker fixes
* Wed Jun 11 2014 Miroslav Grepl 3.12.1-155- Add policy-rhel-7.1-{base,contrib} patches
* Mon May 05 2014 Miroslav Grepl 3.12.1-154- Add support for us_cli ports- Fix labeling for /var/run/user//gvfs- add support for tcp/9697- Additional rules required by openstack, needs backport to F20 and RHEL7- Additional access required by docker- ALlow motion to use tcp/8082 port- Allow init_t to setattr/relabelfrom dhcp state files- Dontaudit antivirus domains read access on all security files by default- Add missing alias for old amavis_etc_t type- Allow block_suspend cap for haproxy- Additional fixes for instack overcloud- Allow OpenStack to read mysqld_db links and connect to MySQL- Remove dup filename rules in gnome.te- Allow sys_chroot cap for httpd_t and setattr on httpd_log_t- Allow iscsid to handle own unit files- Add iscsi_systemctl()- Allow mongod to create also sock_files in /run with correct labeling- Allow httpd to send signull to apache script domains and don\'t audit leaks- Allow rabbitmq_beam to connect to httpd port- Allow aiccu stream connect to pcscd- Allow dmesg to read hwdata and memory dev- Allow all freeipmi domains to read/write ipmi devices- Allow sblim_sfcbd to use also pegasus-https port- Allow rabbitmq_epmd to manage rabbit_var_log_t files- Allow chronyd to read /sys/class/hwmon/hwmon1/device/temp2_input- Allow docker to status any unit file and allow it to start generic unit files
* Mon Apr 07 2014 Miroslav Grepl 3.12.1-153- Change hsperfdata_root to have as user_tmp_tResolves:#1076523
* Fri Apr 04 2014 Miroslav Grepl 3.12.1-152- Fix Multiple same specifications for /var/named/chroot/dev/zero- Add labels for /var/named/chroot_sdb/dev devices- Add support for strongimcv- Use kerberos_keytab_domains in auth_use_nsswitch- Update auth_use_nsswitch to make all these types as kerberos_keytab_domain to- Allow net_raw cap for neutron_t and send sigkill to dnsmasq- Fix ntp_filetrans_named_content for sntp-kod file- Add httpd_dbus_sssd boolean- Dontaudit exec insmod in boinc policy- Rename kerberos_keytab_domain to kerberos_keytab_domains- Add kerberos_keytab_domain()- Fix kerberos_keytab_template()- Make all domains which use kerberos as kerberos_keytab_domainResolves:#1083670- Allow kill capability to winbind_t
* Wed Apr 02 2014 Miroslav Grepl 3.12.1-151- varnishd wants chown capability- update ntp_filetrans_named_content() interface- Add additional fixes for neutron_t. #1083335- Dontaudit getattr on proc_kcore_t- Allow pki_tomcat_t to read ipa lib files- Allow named_filetrans_domain to create /var/cache/ibus with correct labelign- Allow init_t run /sbin/augenrules- Add dev_unmount_sysfs_fs and sysnet_manage_ifconfig_run interfaces- Allow unpriv SELinux user to use sandbox- Add default label for /tmp/hsperfdata_root
* Tue Apr 01 2014 Miroslav Grepl 3.12.1-149- Add file subs also for /var/home
* Mon Mar 31 2014 Miroslav Grepl 3.12.1-149- Allow xauth_t to read user_home_dir_t lnk_file- Add labeling for lightdm-data- Allow certmonger to manage ipa lib files- Add support for /var/lib/ipa- Allow pegasus to getattr virt_content- Added some new rules to pcp policy- Allow chrome_sandbox to execute config_home_t- Add support for ABRT FAF
* Fri Mar 28 2014 Miroslav Grepl 3.12.1-148- Allow kdm to send signull to remote_login_t process- Add gear policy- Turn on gear_port_t- Allow cgit to read gitosis lib files by default- Allow vdagent to read xdm state- Allow NM and fcoeadm to talk together over unix_dgram_socket
* Thu Mar 27 2014 Miroslav Grepl 3.12.1-147- Back port fixes for pegasus_openlmi_admin_t from rawhideResolves:#1080973- Add labels for ostree- Add SELinux awareness for NM- Label /usr/sbin/pwhistory_helper as updpwd_exec_t
* Wed Mar 26 2014 Miroslav Grepl 3.12.1-146- add gnome_append_home_config()- Allow thumb to append GNOME config home files- Allow rasdaemon to rw /dev/cpu//msr- fix /var/log/pki file spec- make bacula_t as auth_nsswitch domain- Identify pki_tomcat_cert_t as a cert_type- Define speech-dispater_exec_t as an application executable- Add a new file context for /var/named/chroot/run directory- update storage_filetrans_all_named_dev for sg
* devices- Allow auditctl_t to getattr on all removeable devices- Allow nsswitch_domains to stream connect to nmbd- Allow unprivusers to connect to memcached- label /var/lib/dirsrv/scripts-INSTANCE as bin_t
* Mon Mar 24 2014 Miroslav Grepl 3.12.1-145- Allow also unpriv user to run vmtools- Allow secadm to read /dev/urandom and meminfoResolves:#1079250- Add booleans to allow docker processes to use nfs and samba- Add mdadm_tmpfs support- Dontaudit net_amdin for /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.51-2.4.5.1.el7.x86_64/jre-abrt/bin/java running as pki_tomcat_t- Allow vmware-user-sui to use user ttys- Allow talk 2 users logged via console too- Allow ftp services to manage xferlog_t- Make all pcp domanis as unconfined for RHEL7.0 beucause of new policies- allow anaconda to dbus chat with systemd-localed
* Fri Mar 21 2014 Miroslav Grepl 3.12.1-144- allow anaconda to dbus chat with systemd-localed- Add fixes for haproxy based on bperkinsAATTredhat.com- Allow cmirrord to make dmsetup working- Allow NM to execute arping- Allow users to send messages through talk- Add userdom_tmp_role for secadm_t
* Thu Mar 20 2014 Lukas Vrabec 3.12.1-143- Add additional fixes for rtas_errd- Fix transitions for tmp/tmpfs in rtas.te- Allow rtas_errd to readl all sysctls
* Wed Mar 19 2014 Miroslav Grepl 3.12.1-142- Add support for /var/spool/rhsm/debug- Make virt_sandbox_use_audit as True by default- Allow svirt_sandbox_domains to ptrace themselves
* Wed Mar 19 2014 Miroslav Grepl 3.12.1-141- Allow docker containers to manage /var/lib/docker content
* Mon Mar 17 2014 Miroslav Grepl 3.12.1-140- Allow docker to read tmpfs_t symlinks- Allow sandbox svirt_lxc_net_t to talk to syslog and to sssd over stream sockets
* Mon Mar 17 2014 Miroslav Grepl 3.12.1-139- Allow collectd to talk to libvirt- Allow chrome_sandbox to use leaked unix_stream_sockets- Dontaudit leaks of sockets into chrome_sandbox_t- If you create a cups directory in /var/cache then it should be labeled cups_rw_etc_t- Run vmtools as unconfined domains- Allow snort to manage its log files- Allow systemd_cronjob_t to be entered via bin_t- Allow procman to list doveconf_etc_t- allow keyring daemon to create content in tmpfs directories- Add proper labelling for icedtea-web- vpnc is creating content in networkmanager var run directory- Label sddm as xdm_exec_t to make KDE working again- Allow postgresql to read network state- Allow java running as pki_tomcat to read network sysctls- Fix cgroup.te to allow cgred to read cgconfig_etc_t- Allow beam.smp to use ephemeral ports- Allow winbind to use the nis to authenticate passwords
* Fri Mar 14 2014 Lukas Vrabec 3.12.1-138- Make rtas_errd_t as unconfined domain for F20.It needs additional fixes. It runs rpm at least.- Allow net_admin cap for fence_virtd running as fenced_t- Make abrt-java-connector working- Make cimtest script 03_defineVS.py of ComputerSystem group working- Fix git_system_enable_homedirs boolean- Allow munin mail plugins to read network systcl
* Thu Mar 13 2014 Miroslav Grepl 3.12.1-137- Allow vmtools_helper_t to execute bin_t- Add support for /usr/share/joomla- /var/lib/containers should be labeled as openshift content for now- Allow docker domains to talk to the login programs, to allow a process to login into the container- Allow install_t do dbus chat with NM- Fix interface names in anaconda.if- Add install_t for anaconda. A new type is a part of anaconda policy- sshd to read network sysctls
* Wed Mar 12 2014 Miroslav Grepl 3.12.1-136- Allow zabbix to send system log msgs- Allow init_t to stream connect to ipsecResolves:#1060775
* Tue Mar 11 2014 Miroslav Grepl 3.12.1-135- Add docker_connect_any boolean
* Tue Mar 11 2014 Miroslav Grepl 3.12.1-134- Allow unpriv SELinux users to dbus chat with firewalld- Add lvm_write_metadata()- Label /etc/yum.reposd dir as system_conf_t. Should be safe because system_conf_t is base_ro_file_type- Allow pegasus_openlmi_storage_t to write lvm metadata- Add hide_broken_symptoms for kdumpgui because of systemd bug- Make kdumpgui_t as unconfined domainResolves:#1044299- Allow docker to connect to tcp/5000
* Mon Mar 10 2014 Miroslav Grepl 3.12.1-133- Allow numad to write scan_sleep_millisecs- Turn on entropyd_use_audio boolean by default- Allow cgred to read /etc/cgconfig.conf because it contains templates used together with rules from /etc/cgrules.conf.- Allow lscpu running as rhsmcertd_t to read /proc/sysinfo- Fix label on irclogs in the homedir- Allow kerberos_keytab_domain domains to manage keys until we get sssd fix- Allow postgresql to use ldap- Add missing syslog-conn port- Add support for /dev/vmcp and /dev/sclpResolves:#1069310
* Fri Mar 07 2014 Miroslav Grepl 3.12.1-132- Modify xdm_write_home to allow create files/links in /root with xdm_home_- Allow virt domains to read network stateResolves:#1072019
* Thu Mar 06 2014 Miroslav Grepl 3.12.1-131- Added pcp rules- dontaudit openshift_cron_t searching random directories, should be back ported to RHEL6- clean up ctdb.te- Allow ctdbd to connect own ports- Fix samba_export_all_rw booleanto cover also non security dirs- Allow swift to exec rpm in swift_t and allow to create tmp files/dirs- Allow neutron to create /run/netns with correct labeling- Allow certmonger to list home dirs
* Wed Mar 05 2014 Miroslav Grepl 3.12.1-130- Change userdom_use_user_inherited_ttys to userdom_use_user_ttys for systemd-tty-ask- Add sysnet_filetrans_named_content_ifconfig() interface- Allow ctdbd to connect own ports- Fix samba_export_all_rw booleanto cover also non security dirs- Allow swift to exec rpm in swift_t and allow to create tmp files/dirs- Allow neutron to create /run/netns with correct labeling- Allow kerberos keytab domains to manage sssd/userdomain keys\"- Allow to run ip cmd in neutron_t domain
* Mon Mar 03 2014 Miroslav Grepl 3.12.1-129- Allow block_suspend cap2 for systemd-logind and rw dri device- Add labeling for /usr/libexec/nm-libreswan-service- Allow locallogin to rw xdm key to make Virtual Terminal login providing smartcard pin working- Add xserver_rw_xdm_keys()- Allow rpm_script_t to dbus chat also with systemd-located- Fix ipa_stream_connect_otpd()- update lpd_manage_spool() interface- Allow krb5kdc to stream connect to ipa-otpd- Add ipa_stream_connect_otpd() interface- Allow vpnc to unlink NM pids- Add networkmanager_delete_pid_files()- Allow munin plugins to access unconfined plugins- update abrt_filetrans_named_content to cover /var/spool/debug- Label /var/spool/debug as abrt_var_cache_t- Allow rhsmcertd to connect to squid port- Make docker_transition_unconfined as optional boolean- Allow certmonger to list home dirs
* Wed Feb 26 2014 Miroslav Grepl 3.12.1-128- Make snapperd as unconfined domain and add additional fixes for it- Remove nsplugin.pp module on upgrade
* Tue Feb 25 2014 Miroslav Grepl 3.12.1-127- Add snapperd_home_t for HOME_DIR/.snapshots directory- Make sosreport as unconfined domain- Allow sosreport to execute grub2-probe- Allow NM to manage hostname config file- Allow systemd_timedated_t to dbus chat with rpm_script_t- Allow lsmd plugins to connect to http/ssh/http_cache ports by default- Add lsmd_plugin_connect_any boolean- Allow mozilla_plugin to attempt to set capabilities- Allow lsdm_plugins to use tcp_socket- Dontaudit mozilla plugin from getattr on /proc or /sys- Dontaudit use of the keyring by the services in a sandbox- Dontaudit attempts to sys_ptrace caused by running ps for mysqld_safe_t- Allow rabbitmq_beam to connect to jabber_interserver_port- Allow logwatch_mail_t to transition to qmail_inject and queueu- Added new rules to pcp policy- Allow vmtools_helper_t to change role to system_r- Allow NM to dbus chat with vmtools- Fix couchdb_manage_files() to allow manage couchdb conf files- Add support for /var/run/redis.sock- dontaudit gpg trying to use audit- Allow consolekit to create log directories and files- Fix vmtools policy to allow user roles to access vmtools_helper_t- Allow block_suspend cap2 for ipa-otpd- Allow pkcsslotd to read users state- Add ioctl to init_dontaudit_rw_stream_socket- Add systemd_hostnamed_manage_config() interface- Remove transition for temp dirs created by init_t- gdm-simple-slave uses use setsockopt- sddm-greater is a xdm type program
* Tue Feb 18 2014 Miroslav Grepl 3.12.1-126- Add lvm_read_metadata()- Allow auditadm to search /var/log/audit dir- Add lvm_read_metadata() interface- Allow confined users to run vmtools helpers- Fix userdom_common_user_template()- Generic systemd unit scripts do write check on /- Allow init_t to create init_tmp_t in /tmp.This is for temporary content created by generic unit files- Add additional fixes needed for init_t and setup script running in generic unit files- Allow general users to create packet_sockets- added connlcli port- Add init_manage_transient_unit() interface- Allow init_t (generic unit files) to manage rpc state date as we had it for initrc_t- Fix userdomain.te to require passwd class- devicekit_power sends out a signal to all processes on the message bus when power is going down- Dontaudit rendom domains listing /proc and hittping system_map_t- Dontauit leaks of var_t into ifconfig_t- Allow domains that transition to ssh_t to manipulate its keyring- Define oracleasm_t as a device node- Change to handle /root as a symbolic link for os-tree- Allow sysadm_t to create packet_socket, also move some rules to attributes- Add label for openvswitch port- Remove general transition for files/dirs created in /etc/mail which got etc_aliases_t label.- Allow postfix_local to read .forward in pcp lib files- Allow pegasus_openlmi_storage_t to read lvm metadata- Add additional fixes for pegasus_openlmi_storage_t- Allow bumblebee to manage debugfs- Make bumblebee as unconfined domain- Allow snmp to read etc_aliases_t- Allow lscpu running in pegasus_openlmi_storage_t to read /dev/mem- Allow pegasus_openlmi_storage_t to read /proc/1/environ- Dontaudit read gconf files for cupsd_config_t- make vmtools as unconfined domain- Add vmtools_helper_t for helper scripts. Allow vmtools shutdonw a host and run ifconfig.- Allow collectd_t to use a mysql database- Allow ipa-otpd to perform DNS name resolution- Added new policy for keepalived- Allow openlmi-service provider to manage transitient units and allow stream connect to sssd- Add additional fixes new pscs-lite+polkit support- Add labeling for /run/krb5kdc- Change w3c_validator_tmp_t to httpd_w3c_validator_tmp_t in F20- Allow pcscd to read users proc info- Dontaudit smbd_t sending out random signuls- Add boolean to allow openshift domains to use nfs- Allow w3c_validator to create content in /tmp- zabbix_agent uses nsswitch- Allow procmail and dovecot to work together to deliver mail- Allow spamd to execute files in homedir if boolean turned on- Allow openvswitch to listen on port 6634- Add net_admin capability in collectd policy- Fixed snapperd policy- Fixed bugsfor pcp policy- Allow dbus_system_domains to be started by init- Fixed some interfaces- Add kerberos_keytab_domain attribute- Fix snapperd_conf_t def
* Tue Feb 11 2014 Miroslav Grepl 3.12.1-125- Addopt corenet rules for unbound-anchor to rpm_script_t- Allow runuser to send send audit messages.- Allow postfix-local to search .forward in munin lib dirs- Allow udisks to connect to D-Bus- Allow spamd to connect to spamd port- Fix syntax error in snapper.te- Dontaudit osad to search gconf home files- Allow rhsmcertd to manage /etc/sysconf/rhn director- Fix pcp labeling to accept /usr/bin for all daemon binaries- Fix mcelog_read_log() interface- Allow iscsid to manage iscsi lib files- Allow snapper domtrans to lvm_t. Add support for /etc/snapper and allow snapperd to manage it.- Make tuned_t as unconfined domain for RHEL7.0- Allow ABRT to read puppet certs- Add sys_time capability for virt-ga- Allow gemu-ga to domtrans to hwclock_t- Allow additional access for virt_qemu_ga_t processes to read system clock and send audit messages- Fix some AVCs in pcp policy- Add to bacula capability setgid and setuid and allow to bind to bacula ports- Changed label from rhnsd_rw_conf_t to rhnsd_conf_t- Add access rhnsd and osad to /etc/sysconfig/rhn- drbdadm executes drbdmeta- Fixes needed for docker- Allow epmd to manage /var/log/rabbitmq/startup_err file- Allow beam.smp connect to amqp port- Modify xdm_write_home to allow create also links as xdm_home_t if the boolean is on true- Allow init_t to manage pluto.ctl because of init_t instead of initrc_t- Allow systemd_tmpfiles_t to manage all non security files on the system- Added labels for bacula ports- Fix label on /dev/vfio/vfio- Add kernel_mounton_messages() interface- init wants to manage lock files for iscsi
* Mon Feb 03 2014 Miroslav Grepl 3.12.1-124- Added osad policy- Allow postfix to deliver to procmail- Allow bumblebee to seng kill signal to xserver- Allow vmtools to execute /usr/bin/lsb_release- Allow docker to write system net ctrls- Add support for rhnsd unit file- Add dbus_chat_session_bus() interface- Add dbus_stream_connect_session_bus() interface- Fix pcp.te- Fix logrotate_use_nfs boolean- Add lot of pcp fixes found in RHEL7- fix labeling for pmie for pcp pkg- Change thumb_t to be allowed to chat/connect with session bus type- Allow call renice in mlocate- Add logrotate_use_nfs boolean- Allow setroubleshootd to read rpc sysctl
* Fri Jan 31 2014 Miroslav Grepl 3.12.1-123- Turn on bacula, rhnsd policy- Add support for rhnsd unit file- Add dbus_chat_session_bus() interface- Add dbus_stream_connect_session_bus() interface- Fix logrotate_use_nfs boolean- Add lot of pcp fixes found in RHEL7- fix labeling for pmie for pcp pkg- Change thumb_t to be allowed to chat/connect with session bus type- Allow call renice in mlocate- Add logrotate_use_nfs boolean- Allow setroubleshootd to read rpc sysctl- Fixes for
*_admin interfaces- Add pegasus_openlmi_storage_var_run_t type def- Add support for /var/run/openlmi-storage- Allow tuned to create syslog.conf with correct labeling- Add httpd_dontaudit_search_dirs boolean- Add support for winbind.service- ALlow also fail2ban-client to read apache logs- Allow vmtools to getattr on all fs- Add support for dey_sapi port- Add logging_filetrans_named_conf()- Allow passwd_t to use ipc_lock, so that it can change the password in gnome-keyring
* Tue Jan 28 2014 Miroslav Grepl 3.12.1-122- Update snapper policy- Allow domains to append rkhunter lib files- Allow snapperd to getattr on all fs- Allow xdm to create /var/gdm with correct labeling- Add label for snapper.log- Allow fail2ban-client to read apache log files- Allow thumb_t to execute dbus-daemon in thumb_t
* Mon Jan 27 2014 Miroslav Grepl 3.12.1-121- Allow gdm to create /var/gdm with correct labeling- Allow domains to append rkhunterl lib files. #1057982- Allow systemd_tmpfiles_t net_admin to communicate with journald- Add interface to getattr on an isid_type for any type of file- Update libs_filetrans_named_content() to have support for /usr/lib/debug directory- Allow initrc_t domtrans to authconfig if unconfined is enabled- Allow docker and mount on devpts chr_file- Allow docker to transition to unconfined_t if boolean set- init calling needs to be optional in domain.te- Allow uncofined domain types to handle transient unit files- Fix labeling for vfio devices- Allow net_admin capability and send system log msgs- Allow lldpad send dgram to NM- Add networkmanager_dgram_send()- rkhunter_var_lib_t is correct type- Back port pcp policy from rawhide- Allow openlmi-storage to read removable devices- Allow system cron jobs to manage rkhunter lib files- Add rkhunter_manage_lib_files()- Fix ftpd_use_fusefs boolean to allow manage also symlinks- Allow smbcontrob block_suspend cap2- Allow slpd to read network and system state info- Allow NM domtrans to iscsid_t if iscsiadm is executed- Allow slapd to send a signal itself- Allow sslget running as pki_ra_t to contact port 8443, the secure port of the CA.- Fix plymouthd_create_log() interface- Add rkhunter policy with files type definition for /var/lib/rkhunter until it is fixed in rkhunter package- Add mozilla_plugin_exec_t for /usr/lib/firefox/plugin-container- Allow postfix and cyrus-imapd to work out of box- Allow fcoemon to talk with unpriv user domain using unix_stream_socket- Dontaudit domains that are calling into journald to net_admin- Add rules to allow vmtools to do what it does- snapperd is D-Bus service- Allow OpenLMI PowerManagement to call \'systemctl --force reboot\'- Add haproxy_connect_any boolean- Allow haproxy also to use http cache port by defaultResolves:#1058248
* Tue Jan 21 2014 Miroslav Grepl 3.12.1-120- Allow apache to write to the owncloud data directory in /var/www/html...- Allow consolekit to create log dir- Add support for icinga CGI scripts- Add support for icinga- Allow kdumpctl_t to create kdump lock fileResolves:#1055634- Allow kdump to create lnk lock file- Allow nscd_t block_suspen capability- Allow unconfined domain types to manage own transient unit file- Allow systemd domains to handle transient init unit files- Add interfaces to handle transient
* Mon Jan 20 2014 Miroslav Grepl 3.12.1-119- Add cron unconfined role support for uncofined SELinux user- Call corenet_udp_bind_all_ports() in milter.te- Allow fence_virtd to connect to zented port- Fix header for mirrormanager_admin()- Allow dkim-milter to bind udp ports- Allow milter domains to send signull itself- Allow block_suspend for yum running as mock_t- Allow beam.smp to manage couchdb files- Add couchdb_manage_files()- Add labeling for /var/log/php_errors.log- Allow bumblebee to stream connect to xserver- Allow bumblebee to send a signal to xserver- gnome-thumbnail to stream connect to bumblebee- Allow xkbcomp running as bumblebee_t to execute bin_t- Allow logrotate to read squid.conf- Additional rules to get docker and lxc to play well with SELinux- Allow bumbleed to connect to xserver port- Allow pegasus_openlmi_storage_t to read hwdata
* Thu Jan 16 2014 Miroslav Grepl 3.12.1-118- Allow init_t to work on transitient and snapshot unit files- Add logging_manage_syslog_config()- Update sysnet_dns_name_resolve() to allow connect to dnssec por- Allow pegasus_openlmi_storage_t to read hwdataResolves:#1031721- Fix rhcs_rw_cluster_tmpfs()- Allow fenced_t to bind on zented udp port- Added policy for vmtools- Fix mirrormanager_read_lib_files()- Allow mirromanager scripts running as httpd_t to manage mirrormanager pid files- Allow ctdb to create sock files in /var/run/ctdb- Add sblim_filetrans_named_content() interface- Allow rpm scritplets to create /run/gather with correct labeling- Allow gnome keyring domains to create gnome config dirs- Dontaudit read/write to init stream socket for lsmd_plugin_t- Allow automount to read nfs link files- Allow lsm plugins to read/write lsmd stream socket- Allow certmonger to connect ldap port to make IPA CA certificate renewal working.- Add also labeling for /var/run/ctdb- Add missing labeling for /var/lib/ctdb- ALlow tuned to manage syslog.conf. Should be fixed in tuned. #1030446- Dontaudit hypervkvp to search homedirs- Dontaudit hypervkvp to search admin homedirs- Allow hypervkvp to execute bin_t and ifconfig in the caller domain- Dontaudit xguest_t to read ABRT conf files- Add abrt_dontaudit_read_config()- Allow namespace-init to getattr on fs- Add thumb_role() also for xguest- Add filename transitions to create .spamassassin with correct labeling- Allow apache domain to read mirrormanager pid files- Allow domains to read/write shm and sem owned by mozilla_plugin_t- Allow alsactl to send a generic signal to kernel_t
* Tue Jan 14 2014 Miroslav Grepl 3.12.1-117- Add back rpm_run() for unconfined user
* Tue Jan 14 2014 Miroslav Grepl 3.12.1-116- Add missing files_create_var_lib_dirs()- Fix typo in ipsec.te- Allow passwd to create directory in /var/lib- Add filename trans also for event21- Allow iptables command to read /dev/rand- Add sigkill capabilityfor ipsec_t- Add filename transitions for bcache devices- Add additional rules to create /var/log/cron by syslogd_t with correct labeling- Add give everyone full access to all key rings- Add default lvm_var_run_t label for /var/run/multipathd- Fix log labeling to have correct default label for them after logrotate- Labeled ~/.nv/GLCache as being gstreamer output- Allow nagios_system_plugin to read mrtg lib files- Add mrtg_read_lib_files()- Call rhcs_rw_cluster_tmpfs for dlm_controld- Make authconfing as named_filetrans domain- Allow virsh to connect to user process using stream socket- Allow rtas_errd to read rand/urand devices and add chown capability- Fix labeling from /var/run/net-snmpd to correct /var/run/net-snmpResolves:#1051497- Add also chown cap for abrt_upload_watch_t. It already has dac_override- Allow sosreport to manage rhsmcertd pid files- Add rhsmcertd_manage_pid_files()- Allow also setgid cap for rpc.gssd- Dontaudit access check for abrt on cert_t- Allow pegasus_openlmi_system providers to dbus chat with systemd-logind
* Fri Jan 10 2014 Miroslav Grepl 3.12.1-115- Fix semanage import handling in spec file
* Fri Jan 10 2014 Miroslav Grepl 3.12.1-114- Add default lvm_var_run_t label for /var/run/multipathdResolves:#1051430- Fix log labeling to have correct default label for them after logrotate- Add files_write_root_dirs- Add new openflow port label for 6653/tcp and 6633/tcp- Add xserver_manage_xkb_libs()- Label tcp/8891 as milter por- Allow gnome_manage_generic_cache_files also create cache_home_t files- Fix aide.log labeling- Fix log labeling to have correct default label for them after logrotate- Allow mysqld-safe write access on /root to make mysqld working- Allow sosreport domtrans to prelikn- Allow OpenvSwitch to connec to openflow ports- Allow NM send dgram to lldpad- Allow hyperv domains to execute shell- Allow lsmd plugins stream connect to lsmd/init- Allow sblim domains to create /run/gather with correct labeling- Allow httpd to read ldap certs- Allow cupsd to send dbus msgs to process with different MLS level- Allow bumblebee to stream connect to apmd- Allow bumblebee to run xkbcomp- Additional allow rules to get libvirt-lxc containers working with docker- Additional allow rules to get libvirt-lxc containers working with docker- Allow docker to getattr on itself- Additional rules needed for sandbox apps- Allow mozilla_plugin to set attributes on usb device if use_spice boolean enabled- httpd should be able to send signal/signull to httpd_suexec_t- Add more fixes for neturon. Domtrans to dnsmasq, iptables. Make neutron as filenamtrans domain.
* Wed Jan 08 2014 Miroslav Grepl 3.12.1-113- Add neutron fixes
* Mon Jan 06 2014 Miroslav Grepl 3.12.1-112- Allow sshd to write to all process levels in order to change passwd when running at a level- Allow updpwd_t to downgrade /etc/passwd file to s0, if it is not running with this range- Allow apcuspd_t to status and start the power unit file- Allow udev to manage kdump unit file- Added new interface modutils_dontaudit_exec_insmod- Allow cobbler to search dhcp_etc_t directory- systemd_systemctl needs sys_admin capability- Allow sytemd_tmpfiles_t to delete all directories- passwd to create gnome-keyring passwd socket- Add missing zabbix_var_lib_t type- Fix filename trans for zabbixsrv in zabbix.te- Allow fprintd_t to send syslog messages- Add zabbix_var_lib_t for /var/lib/zabbixsrv, also allow zabix to connect to smtp port- Allow mozilla plugin to chat with policykit, needed for spice- Allow gssprozy to change user and gid, as well as read user keyrings- Label upgrades directory under /var/www as httpd_sys_rw_content_t, add other filetrans rules to label content correctly- Allow polipo to connect to http_cache_ports- Allow cron jobs to manage apache var lib content- Allow yppassword to manage the passwd_file_t- Allow showall_t to send itself signals- Allow cobbler to restart dhcpc, dnsmasq and bind services- Allow certmonger to manage home cert files- Add userdom filename trans for user mail domains- Allow apcuspd_t to status and start the power unit file- Allow cgroupdrulesengd to create content in cgoups directories- Allow smbd_t to signull cluster- Allow gluster daemon to create fifo files in glusterd_brick_t and sock_file in glusterd_var_lib_t- Add label for /var/spool/cron.aquota.user- Allow sandbox_x domains to use work with the mozilla plugin semaphore- Added new policy for speech-dispatcher- Added dontaudit rule for insmod_exec_t in rasdaemon policy- Updated rasdaemon policy- Allow system_mail_t to transition to postfix_postdrop_t- Clean up mirrormanager policy- Allow virt_domains to read cert files, needs backport to RHEL7- Allow sssd to read systemd_login_var_run_t- Allow irc_t to execute shell and bin-t files:- Add new access for mythtv- Allow rsync_t to manage all non auth files- allow modemmanger to read /dev/urand- Allow sandbox apps to attempt to set and get capabilties
* Thu Dec 19 2013 Miroslav Grepl 3.12.1-111- Add labeling for /var/lib/servicelog/servicelog.db-journal- Add support for freeipmi port- Add sysadm_u_default_contexts- Make new type to texlive files in homedir- Allow subscription-manager running as sosreport_t to manage rhsmcertd- Additional fixes for docker.te- Remove ability to do mount/sys_admin by default in virt_sandbox domains- New rules required to run docker images within libivrt- Add label for ~/.cvsignore- Change mirrormanager to be run by cron- Add mirrormanager policy- Fixed bumblebee_admin() and mip6d_admin()- Add log support for sensord- Fix typo in docker.te- Allow amanda to do backups over UDP- Allow bumblebee to read /etc/group and clean up bumblebee.te- type transitions with a filename not allowed inside conditionals- Don\'t allow virt-sandbox tools to use netlink out of the box, needs back port to RHEL7- Make new type to texlive files in homedir
* Thu Dec 12 2013 Miroslav Grepl 3.12.1-110- Allow freeipmi_ipmidetectd_t to use freeipmi port- Update freeipmi_domain_template()- Allow journalctl running as ABRT to read /run/log/journal- Allow NM to read dispatcher.d directory- Update freeipmi policy- Type transitions with a filename not allowed inside conditionals- Allow tor to bind to hplip port- Make new type to texlive files in homedir- Allow zabbix_agent to transition to dmidecode- Add rules for docker- Allow sosreport to send signull to unconfined_t- Add virt_noatsecure and virt_rlimitinh interfaces- Fix labeling in thumb.fc to add support for /usr/lib64/tumbler-1/tumblerddd support for freeipmi port- Add sysadm_u_default_contexts- Add logging_read_syslog_pid()- Fix userdom_manage_home_texlive() interface- Make new type to texlive files in homedir- Add filename transitions for /run and /lock links- Allow virtd to inherit rlimit informationResolves:#975358
* Tue Dec 10 2013 Miroslav Grepl 3.12.1-109- Change labeling for /usr/libexec/nm-dispatcher.action to NetworkManager_exec_tResolves:#1039879- Add labeling for /usr/lib/systemd/system/mariadb.service- Allow hyperv_domain to read sysfs- Fix ldap_read_certs() interface to allow acess also link files- Add support for /usr/libexec/pegasus/cmpiLMI_Journald-cimprovagt- Allow tuned to run modprobe- Allow portreserve to search /var/lib/sss dir- Add SELinux support for the teamd package contains team network device control daemon.- Dontaudit access check on /proc for bumblebee- Bumblebee wants to load nvidia modules- Fix rpm_named_filetrans_log_files and wine.te- Add conman policy for rawhide- DRM master and input event devices are used by the TakeDevice API- Clean up bumblebee policy- Update pegasus_openlmi_storage_t policy- Add freeipmi_stream_connect() interface- Allow logwatch read madm.conf to support RAID setup- Add raid_read_conf_files() interface- Allow up2date running as rpm_t create up2date log file with rpm_log_t labeling- add rpm_named_filetrans_log_files() interface- Allow dkim-milter to create files/dirs in /tmp- update freeipmi policy- Add policy for freeipmi services- Added rdisc_admin and rdisc_systemctl interfaces- opensm policy clean up- openwsman policy clean up- ninfod policy clean up- Added new policy for ninfod- Added new policy for openwsman- Added rdisc_admin and rdisc_systemctl interfaces- Fix kernel_dontaudit_access_check_proc()- Add support for /dev/uhid- Allow sulogin to get the attributes of initctl and sys_admin cap- Add kernel_dontaudit_access_check_proc()- Fix dev_rw_ipmi_dev()- Fix new interface in devices.if- DRM master and input event devices are used by the TakeDevice API- add dev_rw_inherited_dri() and dev_rw_inherited_input_dev()- Added support for default conman port- Add interfaces for ipmi devices
* Wed Dec 04 2013 Miroslav Grepl 3.12.1-108- Allow sosreport to send a signal to ABRT- Add proper aliases for pegasus_openlmi_service_exec_t and pegasus_openlmi_service_t- Label /usr/sbin/htcacheclean as httpd_exec_tResolves:#1037529- Added support for rdisc unit file- Add antivirus_db_t labeling for /var/lib/clamav-unofficial-sigs- Allow runuser running as logrotate connections to system DBUS- Label bcache devices as fixed_disk_device_t- Allow systemctl running in ipsec_mgmt_t to access /usr/lib/systemd/system/ipsec.service- Label /usr/lib/systemd/system/ipsec.service as ipsec_mgmt_unit_file_t
* Mon Dec 02 2013 Miroslav Grepl 3.12.1-107- Add back setpgid/setsched for sosreport_t
* Mon Dec 02 2013 Dan Walsh 3.12.1-106- Added fix for clout_init to transition to rpm_script_t (dwalshAATTredhat.com)
* Tue Nov 26 2013 Miroslav Grepl 3.12.1-105- Dontaudit openshift domains trying to use rawip_sockets, this is caused by a bad check in the kernel.- Allow git_system_t to read git_user_content if the git_system_enable_homedirs boolean is turned on- Add lsmd_plugin_t for lsm plugins- Allow dovecot-deliver to search mountpoints- Add labeling for /etc/mdadm.conf- Allow opelmi admin providers to dbus chat with init_t- Allow sblim domain to read /dev/urandom and /dev/random- Allow apmd to request the kernel load modules- Add glusterd_brick_t type- label mate-keyring-daemon with gkeyringd_exec_t- Add plymouthd_create_log()- Dontaudit leaks from openshift domains into mail domains, needs back port to RHEL6- Allow sssd to request the kernel loads modules- Allow gpg_agent to use ssh-add- Allow gpg_agent to use ssh-add- Dontaudit access check on /root for myslqd_safe_t- Allow ctdb to getattr on al filesystems- Allow abrt to stream connect to syslog- Allow dnsmasq to list dnsmasq.d directory- Watchdog opens the raw socket- Allow watchdog to read network state info- Dontaudit access check on lvm lock dir- Allow sosreport to send signull to setroubleshootd- Add setroubleshoot_signull() interface- Fix ldap_read_certs() interface- Allow sosreport all signal perms- Allow sosreport to run systemctl- Allow sosreport to dbus chat with rpm- Add glusterd_brick_t files type- Allow zabbix_agentd to read all domain state- Clean up rtas.if- Allow smoltclient to execute ldconfig- Allow sosreport to request the kernel to load a module- Fix userdom_confined_admin_template()- Add back exec_content boolean for secadm, logadm, auditadm- Fix files_filetrans_system_db_named_files() interface- Allow sulogin to getattr on /proc/kcore- Add filename transition also for servicelog.db-journal- Add files_dontaudit_access_check_root()- Add lvm_dontaudit_access_check_lock() interface
* Thu Nov 21 2013 Miroslav Grepl 3.12.1-104- Allow watchdog to read /etc/passwd- Allow browser plugins to connect to bumblebee- New policy for bumblebee and freqset- Add new policy for mip6d daemon- Add new policy for opensm daemon- Allow condor domains to read/write condor_master udp_socket- Allow openshift_cron_t to append to openshift log files, label /var/log/openshift- Add back file_pid_filetrans for /var/run/dlm_controld- Allow smbd_t to use inherited tmpfs content- Allow mcelog to use the /dev/cpu device- sosreport runs rpcinfo- sosreport runs subscription-manager- Allow staff_t to run frequency command- Allow systemd_tmpfiles to relabel log directories- Allow staff_t to read xserver_log file- Label hsperfdata_root as tmp_t
* Wed Nov 20 2013 Miroslav Grepl 3.12.1-103- More sosreport fixes to make ABRT working
* Fri Nov 15 2013 Miroslav Grepl 3.12.1-102- Fix files_dontaudit_unmount_all_mountpoints()- Add support for 2608-2609 tcp/udp ports- Should allow domains to lock the terminal device- More fixes for user config files to make crond_t running in userdomain- Add back disable/reload/enable permissions for system class- Fix manage_service_perms macro- We need to require passwd rootok- Fix zebra.fc- Fix dnsmasq_filetrans_named_content() interface- Allow all sandbox domains create content in svirt_home_t- Allow zebra domains also create zebra_tmp_t files in /tmp- Add support for new zebra services:isisd,babeld. Add systemd support for zebra services.- Fix labeling on neutron and remove transition to iconfig_t- abrt needs to read mcelog log file- Fix labeling on dnsmasq content- Fix labeling on /etc/dnsmasq.d- Allow glusterd to relabel own lib files- Allow sandbox domains to use pam_rootok, and dontaudit attempts to unmount file systems, this is caused by a bug in systemd- Allow ipc_lock for abrt to run journalctl
* Thu Nov 14 2013 Miroslav Grepl 3.12.1-101- Fix config.tgz
* Tue Nov 12 2013 Miroslav Grepl 3.12.1-100- Fix passenger_stream_connect interface- setroubleshoot_fixit wants to read network state- Allow procmail_t to connect to dovecot stream sockets- Allow cimprovagt service providers to read network states- Add labeling for /var/run/mariadb- pwauth uses lastlog() to update system\'s lastlog- Allow account provider to read login records- Add support for texlive2013- More fixes for user config files to make crond_t running in userdomain- Add back disable/reload/enable permissions for system class- Fix manage_service_perms macro- Allow passwd_t to connect to gnome keyring to change password- Update mls config files to have cronjobs in the user domains- Remove access checks that systemd does not actually do
* Fri Nov 08 2013 Miroslav Grepl 3.12.1-99- Add support for yubikey in homedir- Add support for upd/3052 port- Allow apcupsd to use PowerChute Network Shutdown- Allow lsmd to execute various lsmplugins- Add labeling also for /etc/watchdog\\.d where are watchdog scripts located too- Update gluster_export_all_rw boolean to allow relabel all base file types- Allow x86_energy_perf tool to modify the MSR- Fix /var/lib/dspam/data labeling
* Wed Nov 06 2013 Miroslav Grepl 3.12.1-98- Add files_relabel_base_file_types() interface- Allow netlabel-config to read passwd- update gluster_export_all_rw boolean to allow relabel all base file types caused by lsetxattr()- Allow x86_energy_perf tool to modify the MSR- Fix /var/lib/dspam/data labeling- Allow pegasus to domtrans to mount_t- Add labeling for unconfined scripts in /usr/libexec/watchdog/scripts- Add support for unconfined watchdog scripts- Allow watchdog to manage own log files
* Wed Nov 06 2013 Miroslav Grepl 3.12.1-97- Add label only for redhat.repo instead of /etc/yum.repos.d. But probably we will need to switch for the directory.- Label /etc/yum.repos.d as system_conf_t- Use sysnet_filetrans_named_content in udev.te instead of generic transition for net_conf_t- Allow dac_override for sysadm_screen_t- Allow init_t to read ipsec_conf_t as we had it for initrc_t. Needed by ipsec unit file.- Allow netlabel-config to read meminfo- Add interface to allow docker to mounton file_t- Add new interface to exec unlabeled files- Allow lvm to use docker semaphores- Setup transitons for .xsessions-errors.old- Change labels of files in /var/lib/
*/.ssh to transition properly- Allow staff_t and user_t to look at logs using journalctl- pluto wants to manage own log file- Allow pluto running as ipsec_t to create pluto.log- Fix alias decl in corenetwork.te.in- Add support for fuse.glusterfs- Allow dmidecode to read/write /run/lock/subsys/rhsmcertd- Allow rhsmcertd to manage redhat.repo which is now labeled as system.conf. Allow rhsmcertd to manage all log files.- Additional access for docker- Added more rules to sblim policy- Fix kdumpgui_run_bootloader boolean- Allow dspam to connect to lmtp port- Included sfcbd service into sblim policy- rhsmcertd wants to manaage /etc/pki/consumer dir- Add kdumpgui_run_bootloader boolean- Add support for /var/cache/watchdog- Remove virt_domain attribute for virt_qemu_ga_unconfined_t- Fixes for handling libvirt containes- Dontaudit attempts by mysql_safe to write content into /- Dontaudit attempts by system_mail to modify network config- Allow dspam to bind to lmtp ports- Add new policy to allow staff_t and user_t to look at logs using journalctl- Allow apache cgi scripts to list sysfs- Dontaudit attempts to write/delete user_tmp_t files- Allow all antivirus domains to manage also own log dirs- Allow pegasus_openlmi_services_t to stream connect to sssd_t
* Fri Nov 01 2013 Miroslav Grepl 3.12.1-96- Add missing permission checks for nscd
* Wed Oct 30 2013 Miroslav Grepl 3.12.1-95- Fix alias decl in corenetwork.te.in- Add support for fuse.glusterfs- Add file transition rules for content created by f5link- Rename quantum_port information to neutron- Allow all antivirus domains to manage also own log dirs- Rename quantum_port information to neutron- Allow pegasus_openlmi_services_t to stream connect to sssd_t
* Mon Oct 28 2013 Miroslav Grepl 3.12.1-94- Allow sysadm_t to read login information- Allow systemd_tmpfiles to setattr on var_log_t directories- Udpdate Makefile to include systemd_contexts- Add systemd_contexts- Add fs_exec_hugetlbfs_files() interface- Add daemons_enable_cluster_mode boolean- Fix rsync_filetrans_named_content()- Add rhcs_read_cluster_pid_files() interface- Update rhcs.if with additional interfaces from RHEL6- Fix rhcs_domain_template() to not create run dirs with cluster_var_run_t- Allow glusterd_t to mounton glusterd_tmp_t- Allow glusterd to unmout al filesystems- Allow xenstored to read virt config- Add label for swift_server.lock and make add filetrans_named_content to make sure content gets created with the correct label- Allow mozilla_plugin_t to mmap hugepages as an executable
* Thu Oct 24 2013 Miroslav Grepl 3.12.1-94- Add back userdom_security_admin_template() interface and use it for sysadm_t if sysadm_secadm.pp
* Tue Oct 22 2013 Miroslav Grepl 3.12.1-93- Allow sshd_t to read openshift content, needs backport to RHEL6.5- Label /usr/lib64/sasl2/libsasldb.so.3.0.0 as textrel_shlib_t- Make sur kdump lock is created with correct label if kdumpctl is executed- gnome interface calls should always be made within an optional_block- Allow syslogd_t to connect to the syslog_tls port- Add labeling for /var/run/charon.ctl socket- Add kdump_filetrans_named_content()- Allo setpgid for fenced_t- Allow setpgid and r/w cluster tmpfs for fenced_t- gnome calls should always be within optional blocks- wicd.pid should be labeled as networkmanager_var_run_t- Allow sys_resource for lldpad
* Thu Oct 17 2013 Miroslav Grepl 3.12.1-92- Add rtas policy
* Thu Oct 17 2013 Miroslav Grepl 3.12.1-91- Allow mailserver_domains to manage and transition to mailman data- Dontaudit attempts by mozilla plugin to relabel content, caused by using mv and cp commands- Allow mailserver_domains to manage and transition to mailman data- Allow svirt_domains to read sysctl_net_t- Allow thumb_t to use tmpfs inherited from the user- Allow mozilla_plugin to bind to the vnc port if running with spice- Add new attribute to discover confined_admins and assign confined admin to it- Fix zabbix to handle attributes in interfaces- Fix zabbix to read system states for all zabbix domains- Fix piranha_domain_template()- Allow ctdbd to create udp_socket. Allow ndmbd to access ctdbd var files.- Allow lldpad sys_rouserce cap due to #986870- Allow dovecot-auth to read nologin- Allow openlmi-networking to read /proc/net/dev- Allow smsd_t to execute scripts created on the fly labeled as smsd_spool_t- Add zabbix_domain attribute for zabbix domains to treat them together- Add labels for zabbix-poxy-
* (#1018221)- Update openlmi-storage policy to reflect #1015067- Back port piranha tmpfs fixes from RHEL6- Update httpd_can_sendmail boolean to allow read/write postfix spool maildrop- Add postfix_rw_spool_maildrop_files interface- Call new userdom_admin_user_templat() also for sysadm_secadm.pp- Fix typo in userdom_admin_user_template()- Allow SELinux users to create coolkeypk11sE-Gate in /var/cache/coolkey- Add new attribute to discover confined_admins- Fix labeling for /etc/strongswan/ipsec.d- systemd_logind seems to pass fd to anyone who dbus communicates with it- Dontaudit leaked write descriptor to dmesg
* Mon Oct 14 2013 Miroslav Grepl 3.12.1-90- Activate motion policy
* Mon Oct 14 2013 Miroslav Grepl 3.12.1-89- Fix gnome_read_generic_data_home_files()- allow openshift_cgroup_t to read/write inherited openshift file types- Remove httpd_cobbler_content
* from cobbler_admin interface- Allow svirt sandbox domains to setattr on chr_file and blk_file svirt_sandbox_file_t, so sshd will work within a container- Allow httpd_t to read also git sys content symlinks- Allow init_t to read gnome home data- Dontaudit setroubleshoot_fixit_t execmem, since it does not seem to really need it.- Allow virsh to execute systemctl- Fix for nagios_services plugins- add type defintion for ctdbd_var_t- Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file- Allow net_admin/netlink_socket all hyperv_domain domains- Add labeling for zarafa-search.log and zarafa-search.pid- Fix hypervkvp.te- Fix nscd_shm_use()- Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services.- Add hypervkvp_unit_file_t type- Fix logging policy- Allow syslog to bind to tls ports- Update labeling for /dev/cdc-wdm- Allow to su_domain to read init states- Allow init_t to read gnome home data- Make sure if systemd_logind creates nologin file with the correct label- Clean up ipsec.te
* Tue Oct 08 2013 Miroslav Grepl 3.12.1-88- Add auth_exec_chkpwd interface- Fix port definition for ctdb ports- Allow systemd domains to read /dev/urand- Dontaudit attempts for mozilla_plugin to append to /dev/random- Add label for /var/run/charon.
*- Add labeling for /usr/lib/systemd/system/lvm2.
*dd policy for motion service- Fix for nagios_services plugins- Fix some bugs in zoneminder policy- add type defintion for ctdbd_var_t- Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file- Allow net_admin/netlink_socket all hyperv_domain domains- Add labeling for zarafa-search.log and zarafa-search.pid- glusterd binds to random unreserved ports- Additional allow rules found by testing glusterfs- apcupsd needs to send a message to all users on the system so needs to look them up- Fix the label on ~/.juniper_networks- Dontaudit attempts for mozilla_plugin to append to /dev/random- Allow polipo_daemon to connect to flash ports- Allow gssproxy_t to create replay caches- Fix nscd_shm_use()- Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services.- Add hypervkvp_unit_file_t type
* Fri Oct 04 2013 Miroslav Grepl 3.12.1-87- init reload from systemd_localed_t- Allow domains that communicate with systemd_logind_sessions to use systemd_logind_t fd- Allow systemd_localed_t to ask systemd to reload the locale.- Add systemd_runtime_unit_file_t type for unit files that systemd creates in memory- Allow readahead to read /dev/urand- Fix lots of avcs about tuned- Any file names xenstored in /var/log should be treated as xenstored_var_log_t- Allow tuned to inderact with hugepages- Allow condor domains to list etc rw dirs
* Fri Oct 04 2013 Miroslav Grepl 3.12.1-86- Fix nscd_shm_use()- Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services.- Add hypervkvp_unit_file_t type- Add additional fixes forpegasus_openlmi_account_t- Allow mdadm to read /dev/urand- Allow pegasus_openlmi_storage_t to create mdadm.conf and write it- Add label/rules for /etc/mdadm.conf- Allow pegasus_openlmi_storage_t to transition to fsadm_t- Fixes for interface definition problems- Dontaudit dovecot-deliver to gettatr on all fs dirs- Allow domains to search data_home_t directories- Allow cobblerd to connect to mysql- Allow mdadm to r/w kdump lock files- Add support for kdump lock files- Label zarafa-search as zarafa-indexer- Openshift cgroup wants to read /etc/passwd- Add new sandbox domains for kvm- Allow mpd to interact with pulseaudio if mpd_enable_homedirs is turned on- Fix labeling for /usr/lib/systemd/system/lvm2.
*- Add labeling for /usr/lib/systemd/system/lvm2.
*- Fix typos to get a new build. We should not cover filename trans rules to prevent duplicate rules- Add sshd_keygen_t policy for sshd-keygen- Fix alsa_home_filetrans interface name and definition- Allow chown for ssh_keygen_t- Add fs_dontaudit_getattr_all_dirs()- Allow init_t to manage etc_aliases_t and read xserver_var_lib_t and chrony keys- Fix up patch to allow systemd to manage home content- Allow domains to send/recv unlabeled traffic if unlabelednet.pp is enabled- Allow getty to exec hostname to get info- Add systemd_home_t for ~/.local/share/systemd directory
* Wed Oct 02 2013 Miroslav Grepl 3.12.1-85- Fix lxc labels in config.tgz
* Mon Sep 30 2013 Miroslav Grepl 3.12.1-84- Fix labeling for /usr/libexec/kde4/kcmdatetimehelper- Allow tuned to search all file system directories- Allow alsa_t to sys_nice, to get top performance for sound management- Add support for MySQL/PostgreSQL for amavis- Allow openvpn_t to manage openvpn_var_log_t files.- Allow dirsrv_t to create tmpfs_t directories- Allow dirsrv to create dirs in /dev/shm with dirsrv_tmpfs label- Dontaudit leaked unix_stream_sockets into gnome keyring- Allow telepathy domains to inhibit pipes on telepathy domains- Allow cloud-init to domtrans to rpm- Allow abrt daemon to manage abrt-watch tmp files- Allow abrt-upload-watcher to search /var/spool directory- Allow nsswitch domains to manage own process key- Fix labeling for mgetty.
* logs- Allow systemd to dbus chat with upower- Allow ipsec to send signull to itself- Allow setgid cap for ipsec_t- Match upstream labeling
* Wed Sep 25 2013 Miroslav Grepl 3.12.1-83- Do not build sanbox pkg on MLS
* Wed Sep 25 2013 Miroslav Grepl 3.12.1-82- wine_tmp is no longer needed- Allow setroubleshoot to look at /proc- Allow telepathy domains to dbus with systemd logind- Fix handling of fifo files of rpm- Allow mozilla_plugin to transition to itself- Allow certwatch to write to cert_t directories- New abrt application- Allow NetworkManager to set the kernel scheduler- Make wine_domain shared by all wine domains- Allow mdadm_t to read images labeled svirt_image_t- Allow amanda to read /dev/urand- ALlow my_print_default to read /dev/urand- Allow mdadm to write to kdumpctl fifo files- Allow nslcd to send signull to itself- Allow yppasswd to read /dev/urandom- Fix zarafa_setrlimit- Add support for /var/lib/php/wsdlcache- Add zarafa_setrlimit boolean- Allow fetchmail to send mails- Add additional alias for user_tmp_t because wine_tmp_t is no longer used- More handling of ther kernel keyring required by kerberos- New privs needed for init_t when running without transition to initrc_t over bin_t, and without unconfined domain installed
* Thu Sep 19 2013 Miroslav Grepl 3.12.1-81- Dontaudit attempts by sosreport to read shadow_t- Allow browser sandbox plugins to connect to cups to print- Add new label mpd_home_t- Label /srv/www/logs as httpd_log_t- Add support for /var/lib/php/wsdlcache- Add zarafa_setrlimit boolean- Allow fetchmail to send mails- Add labels for apache logs under miq package- Allow irc_t to use tcp sockets- fix labels in puppet.if- Allow tcsd to read utmp file- Allow openshift_cron_t to run ssh-keygen in ssh_keygen_t to access host keys- Define svirt_socket_t as a domain_type- Take away transition from init_t to initrc_t when executing bin_t, allow init_t to run chk_passwd_t- Fix label on pam_krb5 helper apps
* Thu Sep 12 2013 Miroslav Grepl 3.12.1-80- Allow ldconfig to write to kdumpctl fifo files- allow neutron to connect to amqp ports- Allow kdump_manage_crash to list the kdump_crash_t directory- Allow glance-api to connect to amqp port- Allow virt_qemu_ga_t to read meminfo- Add antivirus_home_t type for antivirus date in HOMEDIRS- Allow mpd setcap which is needed by pulseaudio- Allow smbcontrol to create content in /var/lib/samba- Allow mozilla_exec_t to be used as a entrypoint to mozilla_domtrans_spec- Add additional labeling for qemu-ga/fsfreeze-hook.d scripts- amanda_exec_t needs to be executable file- Allow block_suspend cap for samba-net- Allow apps that read ipsec_mgmt_var_run_t to search ipsec_var_run_t- Allow init_t to run crash utility- Treat usr_t just like bin_t for transitions and executions- Add port definition of pka_ca to port 829 for openshift- Allow selinux_store to use symlinks
* Mon Sep 09 2013 Miroslav Grepl 3.12.1-79- Allow block_suspend cap for samba-net- Allow t-mission-control to manage gabble cache files- Allow nslcd to read /sys/devices/system/cpu- Allow selinux_store to use symlinks
* Mon Sep 09 2013 Miroslav Grepl 3.12.1-78- Allow xdm_t to transition to itself- Call neutron interfaces instead of quantum- Allow init to change targed role to make uncofined services (xrdp which now has own systemd unit file) working. We want them to have in unconfined_t- Make sure directories in /run get created with the correct label- Make sure /root/.pki gets created with the right label- try to remove labeling for motion from zoneminder_exec_t to bin_t- Allow inetd_t to execute shell scripts- Allow cloud-init to read all domainstate- Fix to use quantum port- Add interface netowrkmanager_initrc_domtrans- Fix boinc_execmem- Allow t-mission-control to read gabble cache home- Add labeling for ~/.cache/telepathy/avatars/gabble- Allow memcache to read sysfs data- Cleanup antivirus policy and add additional fixes- Add boolean boinc_enable_execstack- Add support for couchdb in rabbitmq policy- Add interface couchdb_search_pid_dirs- Allow firewalld to read NM state- Allow systemd running as git_systemd to bind git port- Fix mozilla_plugin_rw_tmpfs_files()
* Thu Sep 05 2013 Miroslav Grepl 3.12.1-77- Split out rlogin ports from inetd- Treat files labeld as usr_t like bin_t when it comes to transitions- Allow staff_t to read login config- Allow ipsec_t to read .google authenticator data- Allow systemd running as git_systemd to bind git port- Fix mozilla_plugin_rw_tmpfs_files()- Call the correct interface - corenet_udp_bind_ktalkd_port()- Allow all domains that can read gnome_config to read kde config- Allow sandbox domain to read/write mozilla_plugin_tmpfs_t so pulseaudio will work- Allow mdadm to getattr any file system- Allow a confined domain to executes mozilla_exec_t via dbus- Allow cupsd_lpd_t to bind to the printer port- Dontaudit attempts to bind to ports < 1024 when nis is turned on- Allow apache domain to connect to gssproxy socket- Allow rlogind to bind to the rlogin_port- Allow telnetd to bind to the telnetd_port- Allow ktalkd to bind to the ktalkd_port- Allow cvs to bind to the cvs_port
* Wed Sep 04 2013 Miroslav Grepl 3.12.1-76- Cleanup related to init_domain()+inetd_domain fixes- Use just init_domain instead of init_daemon_domain in inetd_core_service_domain- svirt domains neeed to create kobject_uevint_sockets- Lots of new access required for sosreport- Allow tgtd_t to connect to isns ports- Allow init_t to transition to all inetd domains:- openct needs to be able to create netlink_object_uevent_sockets- Dontaudit leaks into ldconfig_t- Dontaudit su domains getattr on /dev devices, move su domains to attribute based calls- Move kernel_stream_connect into all Xwindow using users- Dontaudit inherited lock files in ifconfig o dhcpc_t
* Tue Sep 03 2013 Miroslav Grepl 3.12.1-75- Also sock_file trans rule is needed in lsm- Fix labeling for fetchmail pid files/dirs- Add additional fixes for abrt-upload-watch- Fix polipo.te- Fix transition rules in asterisk policy- Add fowner capability to networkmanager policy- Allow polipo to connect to tor ports- Cleanup lsmd.if- Cleanup openhpid policy- Fix kdump_read_crash() interface- Make more domains as init domain- Fix cupsd.te- Fix requires in rpm_rw_script_inherited_pipes- Fix interfaces in lsm.if- Allow munin service plugins to manage own tmpfs files/dirs- Allow virtd_t also relabel unix stream sockets for virt_image_type- Make ktalk as init domain- Fix to define ktalkd_unit_file_t correctly- Fix ktalk.fc- Add systemd support for talk-server- Allow glusterd to create sock_file in /run- Allow xdm_t to delete gkeyringd_tmp_t files on logout- Add fixes for hypervkvp policy- Add logwatch_can_sendmail boolean- Allow mysqld_safe_t to handle also symlinks in /var/log/mariadb- Allow xdm_t to delete gkeyringd_tmp_t files on logout
* Thu Aug 29 2013 Miroslav Grepl 3.12.1-74- Add selinux-policy-sandbox pkg
* Tue Aug 27 2013 Miroslav Grepl 3.12.1-730 - Allow rhsmcertd to read init state- Allow fsetid for pkcsslotd- Fix labeling for /usr/lib/systemd/system/pkcsslotd.service- Allow fetchmail to create own pid with correct labeling- Fix rhcs_domain_template()- Allow roles which can run mock to read mock lib files to view results- Allow rpcbind to use nsswitch- Fix lsm.if summary- Fix collectd_t can read /etc/passwd file- Label systemd unit files under dracut correctly- Add support for pam_mount to mount user\'s encrypted home When a user logs in and logs out using ssh- Add support for .Xauthority-n- Label umount.crypt as lvm_exec_t- Allow syslogd to search psad lib files- Allow ssh_t to use /dev/ptmx- Make sure /run/pluto dir is created with correct labeling- Allow syslog to run shell and bin_t commands- Allow ip to relabel tun_sockets- Allow mount to create directories in files under /run- Allow processes to use inherited fifo files
* Fri Aug 23 2013 Miroslav Grepl 3.12.1-72- Add policy for lsmd- Add support for /var/log/mariadb dir and allow mysqld_safe to list this directory- Update condor_master rules to allow read system state info and allow logging- Add labeling for /etc/condor and allow condor domain to write it (bug)- Allow condor domains to manage own logs- Allow glusterd to read domains state- Fix initial hypervkvp policy- Add policy for hypervkvpd- Fix redis.if summary
* Wed Aug 21 2013 Miroslav Grepl 3.12.1-71- Allow boinc to connect to AATT/tmp/.X11-unix/X0- Allow beam.smp to connect to tcp/5984- Allow named to manage own log files- Add label for /usr/libexec/dcc/start-dccifd and domtrans to dccifd_t- Add virt_transition_userdomain boolean decl- Allow httpd_t to sendto unix_dgram sockets on its children- Allow nova domains to execute ifconfig- bluetooth wants to create fifo_files in /tmp- exim needs to be able to manage mailman data- Allow sysstat to getattr on all file systems- Looks like bluetoothd has moved- Allow collectd to send ping packets- Allow svirt_lxc domains to getpgid- Remove virt-sandbox-service labeling as virsh_exec_t, since it no longer does virsh_t stuff- Allow frpintd_t to read /dev/urandom- Allow asterisk_t to create sock_file in /var/run- Allow usbmuxd to use netlink_kobject- sosreport needs to getattr on lots of devices, and needs access to netlink_kobject_uevent_socket- More cleanup of svirt_lxc policy- virtd_lxc_t now talks to dbus- Dontaudit leaked ptmx_t- Allow processes to use inherited fifo files- Allow openvpn_t to connect to squid ports- Allow prelink_cron_system_t to ask systemd to reloaddd miscfiles_dontaudit_access_check_cert()- Allow ssh_t to use /dev/ptmx- Make sure /run/pluto dir is created with correct labeling- Allow syslog to run shell and bin_t commands- Allow ip to relabel tun_sockets- Allow mount to create directories in files under /run- Allow processes to use inherited fifo files- Allow user roles to connect to the journal socket
* Thu Aug 08 2013 Miroslav Grepl 3.12.1-70- selinux_set_enforce_mode needs to be used with type- Add append to the dontaudit for unix_stream_socket of xdm_t leak- Allow xdm_t to create symlinks in log direcotries- Allow login programs to read afs config- Label 10933 as a pop port, for dovecot- New policy to allow selinux_server.py to run as semanage_t as a dbus service- Add fixes to make netlabelctl working on MLS- AVCs required for running sepolicy gui as staff_t- Dontaudit attempts to read symlinks, sepolicy gui is likely to cause this type of AVC- New dbus server to be used with new gui- After modifying some files in /etc/mail, I saw this needed on the next boot- Loading a vm from /usr/tmp with virt-manager- Clean up oracleasm policy for Fedora- Add oracleasm policy written by rlopezAATTredhat.com- Make postfix_postdrop_t as mta_agent to allow domtrans to system mail if it is executed by apache- Add label for /var/crash- Allow fenced to domtrans to sanclok_t- Allow nagios to manage nagios spool files- Make tfptd as home_manager- Allow kdump to read kcore on MLS system- Allow mysqld-safe sys_nice/sys_resource caps- Allow apache to search automount tmp dirs if http_use_nfs is enabled- Allow crond to transition to named_t, for use with unbound- Allow crond to look at named_conf_t, for unbound- Allow mozilla_plugin_t to transition its home content- Allow dovecot_domain to read all system and network state- Allow httpd_user_script_t to call getpw- Allow semanage to read pid files- Dontaudit leaked file descriptors from user domain into thumb- Make PAM authentication working if it is enabled in ejabberd- Add fixes for rabbit to fix ##992920,#992931- Allow glusterd to mount filesystems- Loading a vm from /usr/tmp with virt-manager- Trying to load a VM I got an AVC from devicekit_disk for loopcontrol device- Add fix for pand service- shorewall touches own log- Allow nrpe to list /var- Mozilla_plugin_roles can not be passed into lpd_run_lpr- Allow afs domains to read afs_config files- Allow login programs to read afs config- Allow virt_domain to read virt_var_run_t symlinks- Allow smokeping to send its process signals- Allow fetchmail to setuid- Add kdump_manage_crash() interface- Allow abrt domain to write abrt.socket
* Wed Jul 31 2013 Miroslav Grepl 3.12.1-69- Add more aliases in pegasus.te- Add more fixes for
*_admin interfaces- Add interface fixes- Allow nscd to stream connect to nmbd- Allow gnupg apps to write to pcscd socket- Add more fixes for openlmi provides. Fix naming and support for additionals- Allow fetchmail to resolve host names- Allow firewalld to interact also with lnk files labeled as firewalld_etc_rw_t- Add labeling for cmpiLMI_Fan-cimprovagt- Allow net_admin for glusterd- Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/- Add pegasus_openlmi_system_t- Fix puppet_domtrans_master() to make all puppet calling working in passenger.te- Fix corecmd_exec_chroot()- Fix logging_relabel_syslog_pid_socket interface- Fix typo in unconfineduser.te- Allow system_r to access unconfined_dbusd_t to run hp_chec
* Tue Jul 30 2013 Miroslav Grepl 3.12.1-68- Allow xdm_t to act as a dbus client to itsel- Allow fetchmail to resolve host names- Allow gnupg apps to write to pcscd socket- Add labeling for cmpiLMI_Fan-cimprovagt- Allow net_admin for glusterd- Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/- Add pegasus_openlmi_system_t- Fix puppet_domtrans_master() to make all puppet calling working in passenger.te-httpd_t does access_check on certs
* Fri Jul 26 2013 Miroslav Grepl 3.12.1-67- Add support for cmpiLMI_Service-cimprovagt- Allow pegasus domtrans to rpm_t to make pycmpiLMI_Software-cimprovagt running as rpm_t- Label pycmpiLMI_Software-cimprovagt as rpm_exec_t- Add support for pycmpiLMI_Storage-cimprovagt- Add support for cmpiLMI_Networking-cimprovagt- Allow system_cronjob_t to create user_tmpfs_t to make pulseaudio working- Allow virtual machines and containers to run as user doains, needed for virt-sandbox- Allow buglist.cgi to read cpu info
* Mon Jul 22 2013 Miroslav Grepl 3.12.1-66- Allow systemd-tmpfile to handle tmp content in print spool dir- Allow systemd-sysctl to send system log messages- Add support for RTP media ports and fmpro-internal- Make auditd working if audit is configured to perform SINGLE action on disk error- Add interfaces to handle systemd units- Make systemd-notify working if pcsd is used- Add support for netlabel and label /usr/sbin/netlabelctl as iptables_exec_t- Instead of having all unconfined domains get all of the named transition rules,- Only allow unconfined_t, init_t, initrc_t and rpm_script_t by default.- Add definition for the salt ports- Allow xdm_t to create link files in xdm_var_run_t- Dontaudit reads of blk files or chr files leaked into ldconfig_t- Allow sys_chroot for useradd_t- Allow net_raw cap for ipsec_t- Allow sysadm_t to reload services- Add additional fixes to make strongswan working with a simple conf- Allow sysadm_t to enable/disable init_t services- Add additional glusterd perms- Allow apache to read lnk files in the /mnt directory- Allow glusterd to ask the kernel to load a module- Fix description of ftpd_use_fusefs boolean- Allow svirt_lxc_net_t to sys_chroot, modify policy to tighten up svirt_lxc_domain capabilties and process controls, but add them to svirt_lxc_net_t- Allow glusterds to request load a kernel module- Allow boinc to stream connect to xserver_t- Allow sblim domains to read /etc/passwd- Allow mdadm to read usb devices- Allow collectd to use ping plugin- Make foghorn working with SNMP- Allow sssd to read ldap certs- Allow haproxy to connect to RTP media ports- Add additional trans rules for aide_db- Add labeling for /usr/lib/pcsd/pcsd- Add labeling for /var/log/pcsd- Add support for pcs which is a corosync and pacemaker configuration tool
* Wed Jul 17 2013 Miroslav Grepl 3.12.1-65- Label /var/lib/ipa/pki-ca/publish as pki_tomcat_cert_t- Add labeling for /usr/libexec/kde4/polkit-kde-authentication-agent-1- Allow all domains that can domtrans to shutdown, to start the power services script to shutdown- consolekit needs to be able to shut down system- Move around interfaces- Remove nfsd_rw_t and nfsd_ro_t, they don\'t do anything- Add additional fixes for rabbitmq_beam to allow getattr on mountpoints- Allow gconf-defaults-m to read /etc/passwd- Fix pki_rw_tomcat_cert() interface to support lnk_files
* Fri Jul 12 2013 Miroslav Grepl 3.12.1-64- Add support for gluster ports- Make sure that all keys located in /etc/ssh/ are labeled correctly- Make sure apcuspd lock files get created with the correct label- Use getcap in gluster.te- Fix gluster policy- add additional fixes to allow beam.smp to interact with couchdb files- Additional fix for #974149- Allow gluster to user gluster ports- Allow glusterd to transition to rpcd_t and add additional fixes for #980683- Allow tgtd working when accessing to the passthrough device- Fix labeling for mdadm unit files
* Thu Jul 11 2013 Miroslav Grepl 3.12.1-63- Add mdadm fixes
* Tue Jul 09 2013 Miroslav Grepl 3.12.1-62- Fix definition of sandbox.disabled to sandbox.pp.disabled
* Mon Jul 08 2013 Miroslav Grepl 3.12.1-61- Allow mdamd to execute systemctl- Allow mdadm to read /dev/kvm- Allow ipsec_mgmt_t to read l2tpd pid content
* Mon Jul 08 2013 Miroslav Grepl 3.12.1-60- Allow nsd_t to read /dev/urand- Allow mdadm_t to read framebuffer- Allow rabbitmq_beam_t to read process info on rabbitmq_epmd_t- Allow mozilla_plugin_config_t to create tmp files- Cleanup openvswitch policy- Allow mozilla plugin to getattr on all executables- Allow l2tpd_t to create fifo_files in /var/run- Allow samba to touch/manage fifo_files or sock_files in a samba_share_t directory- Allow mdadm to connecto its own unix_stream_socket- FIXME: nagios changed locations to /log/nagios which is wrong. But we need to have this workaround for now.- Allow apache to access smokeping pid files- Allow rabbitmq_beam_t to getattr on all filesystems- Add systemd support for iodined- Allow nup_upsdrvctl_t to execute its entrypoint- Allow fail2ban_client to write to fail2ban_var_run_t, Also allow it to use nsswitch- add labeling for ~/.cache/libvirt-sandbox- Add interface to allow domains transitioned to by confined users to send sigchld to screen program- Allow sysadm_t to check the system status of files labeled etc_t, /etc/fstab- Allow systemd_localed to start /usr/lib/systemd/system/systemd-vconsole-setup.service- Allow an domain that has an entrypoint from a type to be allowed to execute the entrypoint without a transition, I can see no case where this is a bad thing, and elminiates a whole class of AVCs.- Allow staff to getsched all domains, required to run htop- Add port definition for redis port- fix selinuxuser_use_ssh_chroot boolean
* Wed Jul 03 2013 Miroslav Grepl 3.12.1-59- Add prosody policy written by Michael Scherer- Allow nagios plugins to read /sys info- ntpd needs to manage own log files- Add support for HOME_DIR/.IBMERS- Allow iptables commands to read firewalld config- Allow consolekit_t to read utmp- Fix filename transitions on .razor directory- Add additional fixes to make DSPAM with LDA working- Allow snort to read /etc/passwd- Allow fail2ban to communicate with firewalld over dbus- Dontaudit openshift_cgreoup_file_t read/write leaked dev- Allow nfsd to use mountd port- Call th proper interface- Allow openvswitch to read sys and execute plymouth- Allow tmpwatch to read /var/spool/cups/tmp- Add support for /usr/libexec/telepathy-rakia- Add systemd support for zoneminder- Allow mysql to create files/directories under /var/log/mysql- Allow zoneminder apache scripts to rw zoneminder tmpfs- Allow httpd to manage zoneminder lib files- Add zoneminder_run_sudo boolean to allow to start zoneminder- Allow zoneminder to send mails- gssproxy_t sock_file can be under /var/lib- Allow web domains to connect to whois port.- Allow sandbox_web_type to connect to the same ports as mozilla_plugin_t.- We really need to add an interface to corenet to define what a web_client_domain is and- then define chrome_sandbox_t, mozilla_plugin_t and sandbox_web_type to that domain.- Add labeling for cmpiLMI_LogicalFile-cimprovagt- Also make pegasus_openlmi_logicalfile_t as unconfined to have unconfined_domain attribute for filename trans rules- Update policy rules for pegasus_openlmi_logicalfile_t- Add initial types for logicalfile/unconfined OpenLMI providers- mailmanctl needs to read own log- Allow logwatch manage own lock files- Allow nrpe to read meminfo- Allow httpd to read certs located in pki-ca- Add pki_read_tomcat_cert() interface- Add support for nagios openshift plugins- Add port definition for redis port- fix selinuxuser_use_ssh_chroot boolean
* Fri Jun 28 2013 Miroslav Grepl 3.12.1-58- Shrink the size of policy by moving to attributes, also add dridomain so that mozilla_plugin can follow selinuxuse_dri boolean. - Allow bootloader to manage generic log files - Allow ftp to bind to port 989 - Fix label of new gear directory - Add support for new directory /var/lib/openshift/gears/ - Add openshift_manage_lib_dirs() - allow virtd domains to manage setrans_var_run_t - Allow useradd to manage all openshift content - Add support so that mozilla_plugin_t can use dri devices - Allow chronyd to change the scheduler - Allow apmd to shut downthe system - Devicekit_disk_t needs to manage /etc/fstab
* Wed Jun 26 2013 Miroslav Grepl 3.12.1-57- Make DSPAM to act as a LDA working- Allow ntop to create netlink socket- Allow policykit to send a signal to policykit-auth- Allow stapserver to dbus chat with avahi/systemd-logind- Fix labeling on haproxy unit file- Clean up haproxy policy- A new policy for haproxy and placed it to rhcs.te- Add support for ldirectord and treat it with cluster_t- Make sure anaconda log dir is created with var_log_t
* Mon Jun 24 2013 Miroslav Grepl 3.12.1-56- Allow lvm_t to create default targets for filesystem handling- Fix labeling for razor-lightdm binaries- Allow insmod_t to read any file labeled var_lib_t- Add policy for pesign- Activate policy for cmpiLMI_Account-cimprovagt- Allow isnsd syscall=listen- /usr/libexec/pegasus/cimprovagt needs setsched caused by sched_setscheduler- Allow ctdbd to use udp/4379- gatherd wants sys_nice and setsched- Add support for texlive2012- Allow NM to read file_t (usb stick with no labels used to transfer keys for example)- Allow cobbler to execute apache with domain transition
* Fri Jun 21 2013 Miroslav Grepl 3.12.1-55- condor_collector uses tcp/9000- Label /usr/sbin/virtlockd as virtd_exec_t for now- Allow cobbler to execute ldconfig- Allow NM to execute ssh- Allow mdadm to read /dev/crash- Allow antivirus domains to connect to snmp port- Make amavisd-snmp working correctly- Allow nfsd_t to mounton nfsd_fs_t- Add initial snapper policy- We still need to have consolekit policy- Dontaudit firefox attempting to connect to the xserver_port_t if run within sandbox_web_t- Dontaudit sandbox apps attempting to open user_devpts_t- Allow dirsrv to read network state- Fix pki_read_tomcat_lib_files- Add labeling for /usr/libexec/nm-ssh-service- Add label cert_t for /var/lib/ipa/pki-ca/publish- Lets label /sys/fs/cgroup as cgroup_t for now, to keep labels consistant- Allow nfsd_t to mounton nfsd_fs_t- Dontaudit sandbox apps attempting to open user_devpts_t- Allow passwd_t to change role to system_r from unconfined_r
* Wed Jun 19 2013 Miroslav Grepl 3.12.1-54- Don\'t audit access checks by sandbox xserver on xdb var_lib- Allow ntop to read usbmon devices- Add labeling for new polcykit authorizor- Dontaudit access checks from fail2ban_client- Don\'t audit access checks by sandbox xserver on xdb var_lib- Allow apps that connect to xdm stream to conenct to xdm_dbusd_t stream- Fix labeling for all /usr/bim/razor-lightdm-
* binaries- Add filename trans for /dev/md126p1
* Tue Jun 18 2013 Miroslav Grepl 3.12.1-53- Make vdagent able to request loading kernel module- Add support for cloud-init make it as unconfined domain- Allow snmpd to run smartctl in fsadm_t domain- remove duplicate openshift_search_lib() interface- Allow mysqld to search openshift lib files- Allow openshift cgroup to interact with passedin file descriptors- Allow colord to list directories inthe users homedir- aide executes prelink to check files- Make sure cupsd_t creates content in /etc/cups with the correct label- Lest dontaudit apache read all domains, so passenger will not cause this avc- Allow gssd to connect to gssproxy- systemd-tmpfiles needs to be able to raise the level to fix labeling on /run/setrans in MLS- Allow systemd-tmpfiles to relabel also lock files- Allow useradd to add homdir in /var/lib/openshift- Allow setfiles and semanage to write output to /run/files
* Fri Jun 14 2013 Miroslav Grepl 3.12.1-52- Add labeling for /dev/tgt- Dontaudit leak fd from firewalld for modprobe- Allow runuser running as rpm_script_t to create netlink_audit socket- Allow mdadm to read BIOS non-volatile RAM
* Thu Jun 13 2013 Miroslav Grepl 3.12.1-51- accountservice watches when accounts come and go in wtmp- /usr/java/jre1.7.0_21/bin/java needs to create netlink socket- Add httpd_use_sasl boolean- Allow net_admin for tuned_t- iscsid needs sys_module to auto-load kernel modules- Allow blueman to read bluetooth conf- Add nova_manage_lib_files() interface- Fix mplayer_filetrans_home_content()- Add mplayer_filetrans_home_content()- mozilla_plugin_config_roles need to be able to access mozilla_plugin_config_t- Revert \"Allow thumb_t to append inherited xdm stream socket\"- Add iscsi_filetrans_named_content() interface- Allow to create .mplayer with the correct labeling for unconfined- Allow iscsiadmin to create lock file with the correct labeling
* Tue Jun 11 2013 Miroslav Grepl 3.12.1-50- Allow wine to manage wine home content- Make amanda working with socket actiovation- Add labeling for /usr/sbin/iscsiadm- Add support for /var/run/gssproxy.sock- dnsmasq_t needs to read sysctl_net_t
* Fri Jun 07 2013 Miroslav Grepl 3.12.1-49- Fix courier_domain_template() interface- Allow blueman to write ip_forward- Allow mongodb to connect to mongodb port- Allow mongodb to connect to mongodb port- Allow java to bind jobss_debug port- Fixes for
*_admin interfaces- Allow iscsid auto-load kernel modules needed for proper iSCSI functionality- Need to assign attribute for courier_domain to all courier_domains- Fail2ban reads /etc/passwd- postfix_virtual will create new files in postfix_spool_t- abrt triggers sys_ptrace by running pidof- Label ~/abc as mozilla_home_t, since java apps as plugin want to create it- Add passenger fixes needed by foreman- Remove dup interfaces- Add additional interfaces for quantum- Add new interfaces for dnsmasq- Allow passenger to read localization and send signull to itself- Allow dnsmasq to stream connect to quantum- Add quantum_stream_connect()- Make sure that mcollective starts the service with the correct labeling- Add labels for ~/.manpath- Dontaudit attempts by svirt_t to getpw
* calls- sandbox domains are trying to look at parent process data- Allow courior auth to create its pid file in /var/spool/courier subdir- Add fixes for beam to have it working with couchdb- Add labeling for /run/nm-xl2tpd.con- Allow apache to stream connect to thin- Add systemd support for amand- Make public types usable for fs mount points- Call correct mandb interface in domain.te- Allow iptables to r/w quantum inherited pipes and send sigchld- Allow ifconfig domtrans to iptables and execute ldconfig- Add labels for ~/.manpath- Allow systemd to read iscsi lib files- seunshare is trying to look at parent process data
* Mon Jun 03 2013 Miroslav Grepl 3.12.1-48- Fix openshift_search_lib- Add support for abrt-uefioops-oops- Allow colord to getattr any file system- Allow chrome processes to look at each other- Allow sys_ptrace for abrt_t- Add new policy for gssproxy- Dontaudit leaked file descriptor writes from firewalld- openshift_net_type is interface not template- Dontaudit pppd to search gnome config- Update openshift_search_lib() interface- Add fs_list_pstorefs()- Fix label on libbcm_host.so since it is built incorrectly on raspberry pi, needs back port to F18- Better labels for raspberry pi devices- Allow init to create devpts_t directory- Temporarily label rasbery pi devices as memory_device_t, needs back port to f18- Allow sysadm_t to build kernels- Make sure mount creates /var/run/blkid with the correct label, needs back port to F18- Allow userdomains to stream connect to gssproxy- Dontaudit leaked file descriptor writes from firewalld- Allow xserver to read /dev/urandom- Add additional fixes for ipsec-mgmt- Make SSHing into an Openshift Enterprise Node working
* Wed May 29 2013 Miroslav Grepl 3.12.1-47- Add transition rules to unconfined domains and to sysadm_t to create /etc/adjtime- with the proper label.- Update files_filetrans_named_content() interface to get right labeling for pam.d conf files- Allow systemd-timedated to create adjtime- Add clock_create_adjtime()- Additional fix ifconfing for #966106- Allow kernel_t to create boot.log with correct labeling- Remove unconfined_mplayer for which we don\'t have rules- Rename interfaces- Add userdom_manage_user_home_files/dirs interfaces- Fix files_dontaudit_read_all_non_security_files- Fix ipsec_manage_key_file()- Fix ipsec_filetrans_key_file()- Label /usr/bin/razor-lightdm-greeter as xdm_exec_t instead of spamc_exec_t- Fix labeling for ipse.secrets- Add interfaces for ipsec and labeling for ipsec.info and ipsec_setup.pid- Add files_dontaudit_read_all_non_security_files() interface- /var/log/syslog-ng should be labeled var_log_t- Make ifconfig_var_run_t a mountpoint- Add transition from ifconfig to dnsmasq- Allow ifconfig to execute bin_t/shell_exec_t- We want to have hwdb.bin labeled as etc_t- update logging_filetrans_named_content() interface- Allow systemd_timedate_t to manage /etc/adjtime- Allow NM to send signals to l2tpd- Update antivirus_can_scan_system boolean- Allow devicekit_disk_t to sys_config_tty- Run abrt-harvest programs as abrt_t, and allow abrt_t to list all filesystem directories- Make printing from vmware working- Allow php-cgi from php54 collection to access /var/lib/net-snmp/mib_indexes- Add virt_qemu_ga_data_t for qemu-ga- Make chrome and mozilla able to connect to same ports, add jboss_management_port_t to both- Fix typo in virt.te- Add virt_qemu_ga_unconfined_t for hook scripts- Make sure NetworkManager files get created with the correct label- Add mozilla_plugin_use_gps boolean- Fix cyrus to have support for net-snmp- Additional fixes for dnsmasq and quantum for #966106- Add plymouthd_create_log()- remove httpd_use_oddjob for which we don\'t have rules- Add missing rules for httpd_can_network_connect_cobbler- Add missing cluster_use_execmem boolean- Call userdom_manage_all_user_home_type_files/dirs- Additional fix for ftp_home_dir- Fix ftp_home_dir boolean- Allow squit to recv/send client squid packet- Fix nut.te to have nut_domain attribute- Add support for ejabberd; TODO: revisit jabberd and rabbit policy- Fix amanda policy- Add more fixes for domains which use libusb- Make domains which use libusb working correctly- Allow l2tpd to create ipsec key files with correct labeling and manage them- Fix cobbler_manage_lib_files/cobbler_read_lib_files to cover also lnk files- Allow rabbitmq-beam to bind generic node- Allow l2tpd to read ipse-mgmt pid files- more fixes for l2tpd, NM and pppd from #967072
* Wed May 22 2013 Miroslav Grepl 3.12.1-46- Dontaudit to getattr on dirs for dovecot-deliver- Allow raiudusd server connect to postgresql socket- Add kerberos support for radiusd- Allow saslauthd to connect to ldap port- Allow postfix to manage postfix_private_t files- Add chronyd support for #965457- Fix labeling for HOME_DIR/\\.icedtea- CHange squid and snmpd to be allowed also write own logs- Fix labeling for /usr/libexec/qemu-ga- Allow virtd_t to use virt_lock_t- Allow also sealert to read the policy from the kernel- qemu-ga needs to execute scripts in /usr/libexec/qemu-ga and to use /tmp content- Dontaudit listing of users homedir by sendmail Seems like a leak- Allow passenger to transition to puppet master- Allow apache to connect to mythtv- Add definition for mythtv ports
* Fri May 17 2013 Miroslav Grepl 3.12.1-45- Add additional fixes for #948073 bug- Allow sge_execd_t to also connect to sge ports- Allow openshift_cron_t to manage openshift_var_lib_t sym links- Allow openshift_cron_t to manage openshift_var_lib_t sym links- Allow sge_execd to bind sge ports. Allow kill capability and reads cgroup files- Remove pulseaudio filetrans pulseaudio_manage_home_dirs which is a part of pulseaudio_manage_home_files- Add networkmanager_stream_connect()- Make gnome-abrt wokring with staff_t- Fix openshift_manage_lib_files() interface- mdadm runs ps command which seems to getattr on random log files- Allow mozilla_plugin_t to create pulseaudit_home_t directories- Allow qemu-ga to shutdown virtual hosts- Add labelling for cupsd-browsed- Add web browser plugins to connect to aol ports- Allow nm-dhcp-helper to stream connect to NM- Add port definition for sge ports
* Mon May 13 2013 Miroslav Grepl 3.12.1-44- Make sure users and unconfined domains create .hushlogin with the correct label- Allow pegaus to chat with realmd over DBus- Allow cobblerd to read network state- Allow boicn-client to stat on /dev/input/mice- Allow certwatch to read net_config_t when it executes apache- Allow readahead to create /run/systemd and then create its own directory with the correct label
* Mon May 13 2013 Miroslav Grepl 3.12.1-43- Transition directories and files when in a user_tmp_t directory- Change certwatch to domtrans to apache instead of just execute- Allow virsh_t to read xen lib files- update policy rules for pegasus_openlmi_account_t- Add support for svnserve_tmp_t- Activate account openlmi policy- pegasus_openlmi_domain_template needs also require pegasus_t- One more fix for policykit.te- Call fs_list_cgroups_dirs() in policykit.te- Allow nagios service plugin to read mysql config files- Add labeling for /var/svn- Fix chrome.te- Fix pegasus_openlmi_domain_template() interfaces- Fix dev_rw_vfio_dev definiton, allow virtd_t to read tmpfs_t symlinks- Fix location of google-chrome data- Add support for chome_sandbox to store content in the homedir- Allow policykit to watch for changes in cgroups file system- Add boolean to allow mozilla_plugin_t to use spice- Allow collectd to bind to udp port- Allow collected_t to read all of /proc- Should use netlink socket_perms- Should use netlink socket_perms- Allow glance domains to connect to apache ports- Allow apcupsd_t to manage its log files- Allow chrome objects to rw_inherited unix_stream_socket from callers- Allow staff_t to execute virtd_exec_t for running vms- nfsd_t needs to bind mountd port to make nfs-mountd.service working- Allow unbound net_admin capability because of setsockopt syscall- Fix fs_list_cgroup_dirs()- Label /usr/lib/nagios/plugins/utils.pm as bin_t- Remove uplicate definition of fs_read_cgroup_files()- Remove duplicate definition of fs_read_cgroup_files()- Add files_mountpoint_filetrans interface to be used by quotadb_t and snapperd- Additional interfaces needed to list and read cgroups config- Add port definition for collectd port- Add labels for /dev/ptp
*- Allow staff_t to execute virtd_exec_t for running vms
* Mon May 06 2013 Miroslav Grepl 3.12.1-42- Allow samba-net to also read realmd tmp files- Allow NUT to use serial ports- realmd can be started by systemctl now
* Mon May 06 2013 Miroslav Grepl 3.12.1-41- Remove userdom_home_manager for xdm_t and move all rules to xserver.te directly- Add new xdm_write_home boolean to allow xdm_t to create files in HOME dirs with xdm_home_t- Allow postfix-showq to read/write unix.showq in /var/spool/postfix/pid- Allow virsh to read xen lock file- Allow qemu-ga to create files in /run with proper labeling- Allow glusterd to connect to own socket in /tmp- Allow glance-api to connect to http port to make glance image-create working- Allow keystonte_t to execute rpm
* Fri May 03 2013 Miroslav Grepl 3.12.1-40- Fix realmd cache interfaces
* Fri May 03 2013 Miroslav Grepl 3.12.1-39- Allow tcpd to execute leafnode- Allow samba-net to read realmd cache files- Dontaudit sys_tty_config for alsactl- Fix allow rules for postfix_var_run- Allow cobblerd to read /etc/passwd- Allow pegasus to read exports- Allow systemd-timedate to read xdm state- Allow mout to stream connect to rpcbind- Add labeling just for /usr/share/pki/ca-trust-source instead of /usr/share/pki
* Tue Apr 30 2013 Miroslav Grepl 3.12.1-38- Allow thumbnails to share memory with apps which run thumbnails- Allow postfix-postqueue block_suspend- Add lib interfaces for smsd- Add support for nginx- Allow s2s running as jabberd_t to connect to jabber_interserver_port_t- Allow pki apache domain to create own tmp files and execute httpd_suexec- Allow procmail to manger user tmp files/dirs/lnk_files- Add virt_stream_connect_svirt() interface- Allow dovecot-auth to execute bin_t- Allow iscsid to request that kernel load a kernel module- Add labeling support for /var/lib/mod_security- Allow iw running as tuned_t to create netlink socket- Dontaudit sys_tty_config for thumb_t- Add labeling for nm-l2tp-service- Allow httpd running as certwatch_t to open tcp socket- Allow useradd to manager smsd lib files- Allow useradd_t to add homedirs in /var/lib- Fix typo in userdomain.te- Cleanup userdom_read_home_certs- Implement userdom_home_reader_certs_type to allow read certs also on encrypt /home with ecryptfs_t- Allow staff to stream connect to svirt_t to make gnome-boxes working
* Fri Apr 26 2013 Miroslav Grepl 3.12.1-37- Allow lvm to create its own unit files- Label /var/lib/sepolgen as selinux_config_t- Add filetrans rules for tw devices- Add transition from cupsd_config_t to cupsd_t
* Wed Apr 24 2013 Miroslav Grepl 3.12.1-36- Add filetrans rules for tw devices- Cleanup bad transition lines
* Tue Apr 23 2013 Miroslav Grepl 3.12.1-35- Fix lockdev_manage_files()- Allow setroubleshootd to read var_lib_t to make email_alert working- Add lockdev_manage_files()- Call proper interface in virt.te- Allow gkeyring_domain to create /var/run/UID/config/dbus file- system dbus seems to be blocking suspend- Dontaudit attemps to sys_ptrace, which I believe gpsd does not need- When you enter a container from root, you generate avcs with a leaked file descriptor- Allow mpd getattr on file system directories- Make sure realmd creates content with the correct label- Allow systemd-tty-ask to write kmsg- Allow mgetty to use lockdev library for device locking- Fix selinuxuser_user_share_music boolean name to selinuxuser_share_music- When you enter a container from root, you generate avcs with a leaked file descriptor- Make sure init.fc files are labeled correctly at creation- File name trans vconsole.conf- Fix labeling for nagios plugins- label shared libraries in /opt/google/chrome as testrel_shlib_t
* Thu Apr 18 2013 Miroslav Grepl 3.12.1-34- Allow certmonger to dbus communicate with realmd - Make realmd working
* Thu Apr 18 2013 Miroslav Grepl 3.12.1-33- Fix mozilla specification of homedir content- Allow certmonger to read network state- Allow tmpwatch to read tmp in /var/spool/{cups,lpd}- Label all nagios plugin as unconfined by default- Add httpd_serve_cobbler_files()- Allow mdadm to read /dev/sr0 and create tmp files- Allow certwatch to send mails- Fix labeling for nagios plugins- label shared libraries in /opt/google/chrome as testrel_shlib_t
* Wed Apr 17 2013 Miroslav Grepl 3.12.1-32- Allow realmd to run ipa, really needs to be an unconfined_domain- Allow sandbox domains to use inherted terminals- Allow pscd to use devices labeled svirt_image_t in order to use cat cards.- Add label for new alsa pid- Alsa now uses a pid file and needs to setsched - Fix oracleasmfs_t definition- Add support for sshd_unit_file_t- Add oracleasmfs_t- Allow unlabeled_t files to be stored on unlabeled_t filesystems
* Tue Apr 16 2013 Miroslav Grepl 3.12.1-31- Fix description of deny_ptrace boolean- Remove allow for execmod lib_t for now- Allow quantum to connect to keystone port- Allow nova-console to talk with mysql over unix stream socket- Allow dirsrv to stream connect to uuidd- thumb_t needs to be able to create ~/.cache if it does not exist- virtd needs to be able to sys_ptrace when starting and stoping containers
* Mon Apr 15 2013 Miroslav Grepl 3.12.1-30- Allow alsa_t signal_perms, we probaly should search for any app that can execute something without transition and give it signal_perms...- Add dontaudit for mozilla_plugin_t looking at the xdm_t sockets- Fix deny_ptrace boolean, certain ptrace leaked into the system- Allow winbind to manage kerberos_rcache_host- Allow spamd to create spamd_var_lib_t directories- Remove transition to mozilla_tmp_t by mozilla_t, to allow it to manage the users tmp dirs- Add mising nslcd_dontaudit_write_sock_file() interface- one more fix- Fix pki_read_tomcat_lib_files() interface- Allow certmonger to read pki-tomcat lib files- Allow certwatch to execute bin_t- Allow snmp to manage /var/lib/net-snmp files- Call snmp_manage_var_lib_files(fogorn_t) instead of snmp_manage_var_dirs- Fix vmware_role() interface- Fix cobbler_manage_lib_files() interface- Allow nagios check disk plugins to execute bin_t- Allow quantum to transition to openvswitch_t- Allow postdrop to stream connect to postfix-master- Allow quantum to stream connect to openvswitch- Add xserver_dontaudit_xdm_rw_stream_sockets() interface- Allow daemon to send dgrams to initrc_t- Allow kdm to start the power service to initiate a reboot or poweroff
* Thu Apr 11 2013 Miroslav Grepl 3.12.1-29- Add mising nslcd_dontaudit_write_sock_file() interface- one more fix- Fix pki_read_tomcat_lib_files() interface- Allow certmonger to read pki-tomcat lib files- Allow certwatch to execute bin_t- Allow snmp to manage /var/lib/net-snmp files- Don\'t audit attempts to write to stream socket of nscld by thumbnailers- Allow git_system_t to read network state- Allow pegasas to execute mount command- Fix desc for drdb_admin- Fix condor_amin()- Interface fixes for uptime, vdagent, vnstatd- Fix labeling for moodle in /var/www/moodle/data- Add interface fixes- Allow bugzilla to read certs- /var/www/moodle needs to be writable by apache- Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest- Fix namespace_init_t to create content with proper labels, and allow it to manage all user content- Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean- Fixes for dlm_controld- Fix apache_read_sys_content_rw_dirs() interface- Allow logrotate to read /var/log/z-push dir- Fix sys_nice for cups_domain- Allow postfix_postdrop to acces postfix_public socket- Allow sched_setscheduler for cupsd_t- Add missing context for /usr/sbin/snmpd- Kernel_t needs mac_admin in order to support labeled NFS- Fix systemd_dontaudit_dbus_chat() interface- Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest- Allow consolehelper domain to write Xauth files in /root- Add port definition for osapi_compute port- Allow unconfined to create /etc/hostname with correct labeling- Add systemd_filetrans_named_hostname() interface
* Mon Apr 08 2013 Dan Walsh 3.12.1-28- Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean- Fixes for dlm_controld- Fix apache_read_sys_content_rw_dirs() interface- Allow logrotate to read /var/log/z-push dir- Allow postfix_postdrop to acces postfix_public socket- Allow sched_setscheduler for cupsd_t- Add missing context for /usr/sbin/snmpd- Allow consolehelper more access discovered by Tom London- Allow fsdaemon to send signull to all domain- Add port definition for osapi_compute port- Allow unconfined to create /etc/hostname with correct labeling- Add systemd_filetrans_named_hostname() interface
* Sat Apr 06 2013 Dan Walsh 3.12.1-27- Fix file_contexts.subs to label /run/lock correctly
* Fri Apr 05 2013 Miroslav Grepl 3.12.1-26- Try to label on controlC devices up to 30 correctly- Add mount_rw_pid_files() interface- Add additional mount/umount interfaces needed by mock- fsadm_t sends audit messages in reads kernel_ipc_info when doing livecd-iso-to-disk- Fix tabs- Allow initrc_domain to search rgmanager lib files- Add more fixes which make mock working together with confined users
* Allow mock_t to manage rpm files
* Allow mock_t to read rpm log files
* Allow mock to setattr on tmpfs, devpts
* Allow mount/umount filesystems- Add rpm_read_log() interface- yum-cron runs rpm from within it.- Allow tuned to transition to dmidecode- Allow firewalld to do net_admin- Allow mock to unmont tmpfs_t- Fix virt_sigkill() interface- Add additional fixes for mock. Mainly caused by mount running in mock_t- Allow mock to write sysfs_t and mount pid files- Add mailman_domain to mailman_template()- Allow openvswitch to execute shell- Allow qpidd to use kerberos- Allow mailman to use fusefs, needs back port to RHEL6- Allow apache and its scripts to use anon_inodefs- Add alias for git_user_content_t and git_sys_content_t so that RHEL6 will update to RHEL7- Realmd needs to connect to samba ports, needs back port to F18 also- Allow colord to read /run/initial-setup-- Allow sanlock-helper to send sigkill to virtd which is registred to sanlock- Add virt_kill() interface- Add rgmanager_search_lib() interface- Allow wdmd to getattr on all filesystems. Back ported from RHEL6
* Tue Apr 02 2013 Miroslav Grepl 3.12.1-25- Allow realmd to create tmp files- FIx ircssi_home_t type to irssi_home_t- Allow adcli running as realmd_t to connect to ldap port- Allow NetworkManager to transition to ipsec_t, for running strongswan- Make openshift_initrc_t an lxc_domain- Allow gssd to manage user_tmp_t files- Fix handling of irclogs in users homedir- Fix labeling for drupal an wp-content in subdirs of /var/www/html- Allow abrt to read utmp_t file- Fix openshift policy to transition lnk_file, sock-file an fifo_file when created in a tmpfs_t, needs back port to RHEL6- fix labeling for (oo|rhc)-restorer-wrapper.sh- firewalld needs to be able to write to network sysctls- Fix mozilla_plugin_dontaudit_rw_sem() interface- Dontaudit generic ipc read/write to a mozilla_plugin for sandbox_x domains- Add mozilla_plugin_dontaudit_rw_sem() interface- Allow svirt_lxc_t to transition to openshift domains- Allow condor domains block_suspend and dac_override caps- Allow condor_master to read passd- Allow condor_master to read system state- Allow NetworkManager to transition to ipsec_t, for running strongswan- Lots of access required by lvm_t to created encrypted usb device- Allow xdm_t to dbus communicate with systemd_localed_t- Label strongswan content as ipsec_exec_mgmt_t for now- Allow users to dbus chat with systemd_localed- Fix handling of .xsession-errors in xserver.if, so kde will work- Might be a bug but we are seeing avc\'s about people status on init_t:service- Make sure we label content under /var/run/lock as <>- Allow daemon and systemprocesses to search init_var_run_t directory- Add boolean to allow xdm to write xauth data to the home directory- Allow mount to write keys for the unconfined domain- Add unconfined_write_keys() interface
* Tue Mar 26 2013 Miroslav Grepl 3.12.1-24- Add labeling for /usr/share/pki- Allow programs that read var_run_t symlinks also read var_t symlinks- Add additional ports as mongod_port_t for 27018, 27019, 28017, 28018 and 28019 ports- Fix labeling for /etc/dhcp directory- add missing systemd_stub_unit_file() interface- Add files_stub_var() interface- Add lables for cert_t directories- Make localectl set-x11-keymap working at all- Allow abrt to manage mock build environments to catch build problems.- Allow virt_domains to setsched for running gdb on itself- Allow thumb_t to execute user home content- Allow pulseaudio running as mozilla_plugin_t to read /run/systemd/users/1000- Allow certwatch to execut /usr/bin/httpd- Allow cgred to send signal perms to itself, needs back port to RHEL6- Allow openshift_cron_t to look at quota- Allow cups_t to read inhered tmpfs_t from the kernel- Allow yppasswdd to use NIS- Tuned wants sys_rawio capability- Add ftpd_use_fusefs boolean- Allow dirsrvadmin_t to signal itself
* Wed Mar 20 2013 Miroslav Grepl 3.12.1-23- Allow localectl to read /etc/X11/xorg.conf.d directory- Revert \"Revert \"Fix filetrans rules for kdm creates .xsession-errors\"\"- Allow mount to transition to systemd_passwd_agent- Make sure abrt directories are labeled correctly- Allow commands that are going to read mount pid files to search mount_var_run_t- label /usr/bin/repoquery as rpm_exec_t- Allow automount to block suspend- Add abrt_filetrans_named_content so that abrt directories get labeled correctly- Allow virt domains to setrlimit and read file_context
* Mon Mar 18 2013 Miroslav Grepl 3.12.1-22- Allow nagios to manage nagios spool files- /var/spool/snmptt is a directory which snmdp needs to write to, needs back port to RHEL6- Add swift_alias.
* policy files which contain typealiases for swift types- Add support for /run/lock/opencryptoki- Allow pkcsslotd chown capability- Allow pkcsslotd to read passwd- Add rsync_stub() interface- Allow systemd_timedate also manage gnome config homedirs- Label /usr/lib64/security/pam_krb5/pam_krb5_cchelper as bin_t- Fix filetrans rules for kdm creates .xsession-errors- Allow sytemd_tmpfiles to create wtmp file- Really should not label content under /var/lock, since it could have labels on it different from var_lock_t- Allow systemd to list all file system directories- Add some basic stub interfaces which will be used in PRODUCT policies
* Wed Mar 13 2013 Miroslav Grepl 3.12.1-21- Fix log transition rule for cluster domains- Start to group all cluster log together- Dont use filename transition for POkemon Advanced Adventure until a new checkpolicy update- cups uses usbtty_device_t devices- These fixes were all required to build a MLS virtual Machine with single level desktops- Allow domains to transiton using httpd_exec_t- Allow svirt domains to manage kernel key rings- Allow setroubleshoot to execute ldconfig- Allow firewalld to read generate gnome data- Allow bluetooth to read machine-info- Allow boinc domain to send signal to itself- Fix gnome_filetrans_home_content() interface- Allow mozilla_plugins to list apache modules, for use with gxine- Fix labels for POkemon in the users homedir- Allow xguest to read mdstat- Dontaudit virt_domains getattr on /dev/
*- These fixes were all required to build a MLS virtual Machine with single level desktops- Need to back port this to RHEL6 for openshift- Add tcp/8891 as milter port- Allow nsswitch domains to read sssd_var_lib_t files- Allow ping to read network state.- Fix typo- Add labels to /etc/X11/xorg.d and allow systemd-timestampd_t to manage them
* Fri Mar 08 2013 Miroslav Grepl 3.12.1-20- Adopt swift changes from lhhAATTredhat.com- Add rhcs_manage_cluster_pid_files() interface- Allow screen domains to configure tty and setup sock_file in ~/.screen directory- ALlow setroubleshoot to read default_context_t, needed to backport to F18- Label /etc/owncloud as being an apache writable directory- Allow sshd to stream connect to an lxc domain
* Thu Mar 07 2013 Miroslav Grepl 3.12.1-19- Allow postgresql to manage rgmanager pid files- Allow postgresql to read ccs data- Allow systemd_domain to send dbus messages to policykit- Add labels for /etc/hostname and /etc/machine-info and allow systemd-hostnamed to create them- All systemd domains that create content are reading the file_context file and setfscreate- Systemd domains need to search through init_var_run_t- Allow sshd to communicate with libvirt to set containers labels- Add interface to manage pid files- Allow NetworkManger_t to read /etc/hostname- Dontaudit leaked locked files into openshift_domains- Add fixes for oo-cgroup-read - it nows creates tmp files- Allow gluster to manage all directories as well as files- Dontaudit chrome_sandbox_nacl_t using user terminals- Allow sysstat to manage its own log files- Allow virtual machines to setrlimit and send itself signals.- Add labeling for /var/run/hplip
* Mon Mar 04 2013 Miroslav Grepl 3.12.1-18- Fix POSTIN scriptlet
* Fri Mar 01 2013 Miroslav Grepl 3.12.1-17- Merge rgmanger, corosync,pacemaker,aisexec policies to cluster_t in rhcs.pp
* Wed Feb 27 2013 Miroslav Grepl 3.12.1-16- Fix authconfig.py labeling- Make any domains that write homedir content do it correctly- Allow glusterd to read/write anyhwere on the file system by default- Be a little more liberal with the rsync log files- Fix iscsi_admin interface- Allow iscsid_t to read /dev/urand- Fix up iscsi domain for use with unit files- Add filename transition support for spamassassin policy- Allow web plugins to use badly formated libraries- Allow nmbd_t to create samba_var_t directories- Add filename transition support for spamassassin policy- Add filename transition support for tvtime- Fix alsa_home_filetrans_alsa_home() interface- Move all userdom_filetrans_home_content() calling out of booleans- Allow logrotote to getattr on all file sytems- Remove duplicate userdom_filetrans_home_content() calling- Allow kadmind to read /etc/passwd- Dontaudit append .xsession-errors file on ecryptfs for policykit-auth- Allow antivirus domain to manage antivirus db links- Allow logrotate to read /sys- Allow mandb to setattr on man dirs- Remove mozilla_plugin_enable_homedirs boolean- Fix ftp_home_dir boolean- homedir mozilla filetrans has been moved to userdom_home_manager- homedir telepathy filetrans has been moved to userdom_home_manager- Remove gnome_home_dir_filetrans() from gnome_role_gkeyringd()- Might want to eventually write a daemon on fusefsd.- Add policy fixes for sshd [net] child from plautrbaAATTredhat.com- Tor uses a new port- Remove bin_t for authconfig.py- Fix so only one call to userdom_home_file_trans- Allow home_manager_types to create content with the correctl label- Fix all domains that write data into the homedir to do it with the correct label- Change the postgresql to use proper boolean names, which is causing httpd_t to- not get access to postgresql_var_run_t- Hostname needs to send syslog messages- Localectl needs to be able to send dbus signals to users- Make sure userdom_filetrans_type will create files/dirs with user_home_t labeling by default- Allow user_home_manger domains to create spam
* homedir content with correct labeling- Allow user_home_manger domains to create HOMEDIR/.tvtime with correct labeling- Add missing miscfiles_setattr_man_pages() interface and for now comment some rules for userdom_filetrans_type to make build process working- Declare userdom_filetrans_type attribute- userdom_manage_home_role() needs to be called withoout usertype attribute because of userdom_filetrans_type attribute- fusefsd is mounding a fuse file system on /run/user/UID/gvfs
* Thu Feb 21 2013 Miroslav Grepl 3.12.1-15- Man pages are now generated in the build process- Allow cgred to list inotifyfs filesystem
* Wed Feb 20 2013 Miroslav Grepl 3.12.1-14- Allow gluster to get attrs on all fs- New access required for virt-sandbox- Allow dnsmasq to execute bin_t- Allow dnsmasq to create content in /var/run/NetworkManager- Fix openshift_initrc_signal() interface- Dontaudit openshift domains doing getattr on other domains- Allow consolehelper domain to communicate with session bus- Mock should not be transitioning to any other domains, we should keep mock_t as mock_t- Update virt_qemu_ga_t policy- Allow authconfig running from realmd to restart oddjob service- Add systemd support for oddjob- Add initial policy for realmd_consolehelper_t which if for authconfig executed by realmd- Add labeling for gnashpluginrc- Allow chrome_nacl to execute /dev/zero- Allow condor domains to read /proc- mozilla_plugin_t will getattr on /core if firefox crashes- Allow condor domains to read /etc/passwd- Allow dnsmasq to execute shell scripts, openstack requires this access- Fix glusterd labeling- Allow virtd_t to interact with the socket type- Allow nmbd_t to override dac if you turned on sharing all files- Allow tuned to created kobject_uevent socket- Allow guest user to run fusermount- Allow openshift to read /proc and locale- Allow realmd to dbus chat with rpm- Add new interface for virt- Remove depracated interfaces- Allow systemd_domains read access on etc, etc_runtime and usr files, also allow them to connect stream to syslog socket- /usr/share/munin/plugins/plugin.sh should be labeled as bin_t- Remove some more unconfined_t process transitions, that I don\'t believe are necessary- Stop transitioning uncofnined_t to checkpc- dmraid creates /var/lock/dmraid- Allow systemd_localed to creatre unix_dgram_sockets- Allow systemd_localed to write kernel messages.- Also cleanup systemd definition a little.- Fix userdom_restricted_xwindows_user_template() interface- Label any block devices or char devices under /dev/infiniband as fixed_disk_device_t- User accounts need to dbus chat with accountsd daemon- Gnome requires all users to be able to read /proc/1/
* Thu Feb 14 2013 Miroslav Grepl 3.12.1-13- virsh now does a setexeccon call- Additional rules required by openshift domains- Allow svirt_lxc_domains to use inherited terminals, needed to make virt-sandbox-service execute work- Allow spamd_update_t to search spamc_home_t- Avcs discovered by mounting an isci device under /mnt- Allow lspci running as logrotate to read pci.ids- Additional fix for networkmanager_read_pid_files()- Fix networkmanager_read_pid_files() interface- Allow all svirt domains to connect to svirt_socket_t- Allow virsh to set SELinux context for a process.- Allow tuned to create netlink_kobject_uevent_socket- Allow systemd-timestamp to set SELinux context- Add support for /var/lib/systemd/linger- Fix ssh_sysadm_login to be working on MLS as expected
* Mon Feb 11 2013 Miroslav Grepl 3.12.1-12- Rename files_rw_inherited_tmp_files to files_rw_inherited_tmp_file- Add missing files_rw_inherited_tmp_files interface- Add additional interface for ecryptfs- ALlow nova-cert to connect to postgresql- Allow keystone to connect to postgresql- Allow all cups domains to getattr on filesystems- Allow pppd to send signull- Allow tuned to execute ldconfig- Allow gpg to read fips_enabled- Add additional fixes for ecryptfs- Allow httpd to work with posgresql- Allow keystone getsched and setsched
* Fri Feb 08 2013 Miroslav Grepl 3.12.1-11- Allow gpg to read fips_enabled- Add support for /var/cache/realmd- Add support for /usr/sbin/blazer_usb and systemd support for nut- Add labeling for fenced_sanlock and allow sanclok transition to fenced_t- bitlbee wants to read own log file- Allow glance domain to send a signal itself- Allow xend_t to request that the kernel load a kernel module- Allow pacemaker to execute heartbeat lib files- cleanup new swift policy
* Tue Feb 05 2013 Miroslav Grepl 3.12.1-10- Fix smartmontools- Fix userdom_restricted_xwindows_user_template() interface- Add xserver_xdm_ioctl_log() interface- Allow Xusers to ioctl lxdm.log to make lxdm working- Add MLS fixes to make MLS boot/log-in working- Add mls_socket_write_all_levels() also for syslogd- fsck.xfs needs to read passwd- Fix ntp_filetrans_named_content calling in init.te- Allow postgresql to create pg_log dir- Allow sshd to read rsync_data_t to make rsync working- Change ntp.conf to be labeled net_conf_t- Allow useradd to create homedirs in /run. ircd-ratbox does this and we should just allow it- Allow xdm_t to execute gstreamer home content- Allod initrc_t and unconfined domains, and sysadm_t to manage ntp- New policy for openstack swift domains- More access required for openshift_cron_t- Use cupsd_log_t instead of cupsd_var_log_t- rpm_script_roles should be used in rpm_run- Fix rpm_run() interface- Fix openshift_initrc_run()- Fix sssd_dontaudit_stream_connect() interface- Fix sssd_dontaudit_stream_connect() interface- Allow LDA\'s job to deliver mail to the mailbox- dontaudit block_suspend for mozilla_plugin_t- Allow l2tpd_t to all signal perms- Allow uuidgen to read /dev/random- Allow mozilla-plugin-config to read power_supply info- Implement cups_domain attribute for cups domains- We now need access to user terminals since we start by executing a command outside the tty- We now need access to user terminals since we start by executing a command outside the tty- svirt lxc containers want to execute userhelper apps, need these changes to allow this to happen- Add containment of openshift cron jobs- Allow system cron jobs to create tmp directories- Make userhelp_conf_t a config file- Change rpm to use rpm_script_roles- More fixes for rsync to make rsync wokring- Allow logwatch to domtrans to mdadm- Allow pacemaker to domtrans to ifconfig- Allow pacemaker to setattr on corosync.log- Add pacemaker_use_execmem for memcheck-amd64 command- Allow block_suspend capability- Allow create fifo_file in /tmp with pacemaker_tmp_t- Allow systat to getattr on fixed disk- Relabel /etc/ntp.conf to be net_conf_t- ntp_admin should create files in /etc with the correct label- Add interface to create ntp_conf_t files in /etc- Add additional labeling for quantum- Allow quantum to execute dnsmasq with transition
* Wed Jan 30 2013 Miroslav Grepl 3.12.1-9- boinc_cliean wants also execmem as boinc projecs have- Allow sa-update to search admin home for /root/.spamassassin- Allow sa-update to search admin home for /root/.spamassassin- Allow antivirus domain to read net sysctl- Dontaudit attempts from thumb_t to connect to ssd- Dontaudit attempts by readahead to read sock_files- Dontaudit attempts by readahead to read sock_files- Create tmpfs file while running as wine as user_tmpfs_t- Dontaudit attempts by readahead to read sock_files- libmpg ships badly created librarie
* Mon Jan 28 2013 Miroslav Grepl 3.12.1-8- Change ssh_use_pts to use macro and only inherited sshd_devpts_t- Allow confined users to read systemd_logind seat information- libmpg ships badly created libraries- Add support for strongswan.service- Add labeling for strongswan- Allow l2tpd_t to read network manager content in /run directory- Allow rsync to getattr any file in rsync_data_t- Add labeling and filename transition for .grl-podcasts
* Fri Jan 25 2013 Miroslav Grepl 3.12.1-7- mount.glusterfs executes glusterfsd binary- Allow systemd_hostnamed_t to stream connect to systemd- Dontaudit any user doing a access check- Allow obex-data-server to request the kernel to load a module- Allow gpg-agent to manage gnome content (~/.cache/gpg-agent-info)- Allow gpg-agent to read /proc/sys/crypto/fips_enabled- Add new types for antivirus.pp policy module- Allow gnomesystemmm_t caps because of ioprio_set- Make sure if mozilla_plugin creates files while in permissive mode, they get created with the correct label, user_home_t- Allow gnomesystemmm_t caps because of ioprio_set- Allow NM rawip socket- files_relabel_non_security_files can not be used with boolean- Add interface to thumb_t dbus_chat to allow it to read remote process state- ALlow logrotate to domtrans to mdadm_t- kde gnomeclock wants to write content to /tmp
* Wed Jan 23 2013 Miroslav Grepl 3.12.1-6- kde gnomeclock wants to write content to /tmp- /usr/libexec/kde4/kcmdatetimehelper attempts to create /root/.kde- Allow blueman_t to rwx zero_device_t, for some kind of jre- Allow mozilla_plugin_t to rwx zero_device_t, for some kind of jre- Ftp full access should be allowed to create directories as well as files- Add boolean to allow rsync_full_acces, so that an rsync server can write all- over the local machine- logrotate needs to rotate logs in openshift directories, needs back port to RHEL6- Add missing vpnc_roles type line- Allow stapserver to write content in /tmp- Allow gnome keyring to create keyrings dir in ~/.local/share- Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on- Add interface to colord_t dbus_chat to allow it to read remote process state- Allow colord_t to read cupsd_t state- Add mate-thumbnail-font as thumnailer- Allow sectoolm to sys_ptrace since it is looking at other proceses /proc data.- Allow qpidd to list /tmp. Needed by ssl- Only allow init_t to transition to rsync_t domain, not initrc_t. This should be back ported to F17, F18- - Added systemd support for ksmtuned- Added booleans ksmtuned_use_nfs ksmtuned_use_cifs- firewalld seems to be creating mmap files which it needs to execute in /run /tmp and /dev/shm. Would like to clean this up but for now we will allow- Looks like qpidd_t needs to read /dev/random- Lots of probing avc\'s caused by execugting gpg from staff_t- Dontaudit senmail triggering a net_admin avc- Change thumb_role to use thumb_run, not sure why we have a thumb_role, needs back port- Logwatch does access check on mdadm binary- Add raid_access_check_mdadm() iterface
* Wed Jan 16 2013 Miroslav Grepl 3.12.1-5- Fix systemd_manage_unit_symlinks() interface- Call systemd_manage_unit_symlinks(() which is correct interface- Add filename transition for opasswd- Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock- Allow sytstemd-timedated to get status of init_t- Add new systemd policies for hostnamed and rename gnomeclock_t to systemd_timedate_t- colord needs to communicate with systemd and systemd_logind, also remove duplicate rules- Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock- Allow gpg_t to manage all gnome files- Stop using pcscd_read_pub_files- New rules for xguest, dontaudit attempts to dbus chat- Allow firewalld to create its mmap files in tmpfs and tmp directories- Allow firewalld to create its mmap files in tmpfs and tmp directories- run unbound-chkconf as named_t, so it can read dnssec- Colord is reading xdm process state, probably reads state of any apps that sends dbus message- Allow mdadm_t to change the kernel scheduler- mythtv policy- Update mandb_admin() interface- Allow dsspam to listen on own tpc_socket- seutil_filetrans_named_content needs to be optional- Allow sysadm_t to execute content in his homedir- Add attach_queue to tun_socket, new patch from Paul Moore- Change most of selinux configuration types to security_file_type.- Add filename transition rules for selinux configuration- ssh into a box with -X -Y requires ssh_use_ptys- Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on- Allow all unpriv userdomains to send dbus messages to hostnamed and timedated- New allow rules found by Tom London for systemd_hostnamed
* Mon Jan 14 2013 Miroslav Grepl 3.12.1-4- Allow systemd-tmpfiles to relabel lpd spool files- Ad labeling for texlive bash scripts- Add xserver_filetrans_fonts_cache_home_content() interface- Remove duplicate rules from
*.te- Add support for /var/lock/man-db.lock- Add support for /var/tmp/abrt(/.
*)?- Add additional labeling for munin cgi scripts- Allow httpd_t to read munin conf files- Allow certwatch to read meminfo- Fix nscd_dontaudit_write_sock_file() interfac- Fix gnome_filetrans_home_content() to include also \"fontconfig\" dir as cache_home_t- llow mozilla_plugin_t to create HOMEDIR/.fontconfig with the proper labeling
* Fri Jan 11 2013 Miroslav Grepl 3.12.1-3- Allow gnomeclock to talk to puppet over dbus- Allow numad access discovered by Dominic- Add support for HOME_DIR/.maildir- Fix attribute_role for mozilla_plugin_t domain to allow staff_r to access this domain- Allow udev to relabel udev_var_run_t lnk_files- New bin_t file in mcelog
* Thu Jan 10 2013 Miroslav Grepl 3.12.1-2- Remove all mcs overrides and replace with t1 != mcs_constrained_types- Add attribute_role for iptables- mcs_process_set_categories needs to be called for type- Implement additional role_attribute statements- Sodo domain is attempting to get the additributes of proc_kcore_t- Unbound uses port 8953- Allow svirt_t images to compromise_kernel when using pci-passthrough- Add label for dns lib files- Bluetooth aquires a dbus name- Remove redundant files_read_usr_file calling- Remove redundant files_read_etc_file calling- Fix mozilla_run_plugin()- Add role_attribute support for more domains
* Wed Jan 09 2013 Miroslav Grepl 3.12.1-1- Mass merge with upstream
* Sat Jan 05 2013 Dan Walsh 3.11.1-69.1- Bump the policy version to 28 to match selinux userspace- Rebuild versus latest libsepol
* Wed Jan 02 2013 Miroslav Grepl 3.11.1-69- Add systemd_status_all_unit_files() interface- Add support for nshadow- Allow sysadm_t to administrate the postfix domains- Add interface to setattr on isid directories for use by tmpreaper- Allow sshd_t sys_admin for use with afs logins- Allow systemd to read/write all sysctls- Allow sshd_t sys_admin for use with afs logins- Allow systemd to read/write all sysctls- Add systemd_status_all_unit_files() interface- Add support for nshadow- Allow sysadm_t to administrate the postfix domains- Add interface to setattr on isid directories for use by tmpreaper- Allow sshd_t sys_admin for use with afs logins- Allow systemd to read/write all sysctls- Allow sshd_t sys_admin for use with afs logins- Add labeling for /var/named/chroot/etc/localtim
* Thu Dec 27 2012 Miroslav Grepl 3.11.1-68- Allow setroubleshoot_fixit to execute rpm- zoneminder needs to connect to httpd ports where remote cameras are listening- Allow firewalld to execute content created in /run directory- Allow svirt_t to read generic certs- Dontaudit leaked ps content to mozilla plugin- Allow sshd_t sys_admin for use with afs logins- Allow systemd to read/write all sysctls- init scripts are creating systemd_unit_file_t directories
* Fri Dec 21 2012 Miroslav Grepl 3.11.1-67- systemd_logind_t is looking at all files under /run/user/apache- Allow systemd to manage all user tmp files- Add labeling for /var/named/chroot/etc/localtime- Allow netlabel_peer_t type to flow over netif_t and node_t, and only be hindered by MLS, need back port to RHEL6- Keystone is now using a differnt port- Allow xdm_t to use usbmuxd daemon to control sound- Allow passwd daemon to execute gnome_exec_keyringd- Fix chrome_sandbox policy- Add labeling for /var/run/checkquorum-timer- More fixes for the dspam domain, needs back port to RHEL6- More fixes for the dspam domain, needs back port to RHEL6- sssd needs to connect to kerberos password port if a user changes his password- Lots of fixes from RHEL testing of dspam web- Allow chrome and mozilla_plugin to create msgq and semaphores- Fixes for dspam cgi scripts- Fixes for dspam cgi scripts- Allow confine users to ptrace screen- Backport virt_qemu_ga_t changes from RHEL- Fix labeling for dspam.cgi needed for RHEL6- We need to back port this policy to RHEL6, for lxc domains- Dontaudit attempts to set sys_resource of logrotate- Allow corosync to read/write wdmd\'s tmpfs files- I see a ptrace of mozilla_plugin_t by staff_t, will allow without deny_ptrace being set- Allow cron jobs to read bind config for unbound- libvirt needs to inhibit systemd- kdumpctl needs to delete boot_t files- Fix duplicate gnome_config_filetrans- virtd_lxc_t is using /dev/fuse- Passenger needs to create a directory in /var/log, needs a backport to RHEL6 for openshift- apcupsd can be setup to listen to snmp trafic- Allow transition from kdumpgui to kdumpctl- Add fixes for munin CGI scripts- Allow deltacloud to connect to openstack at the keystone port- Allow domains that transition to svirt domains to be able to signal them- Fix file context of gstreamer in .cache directory- libvirt is communicating with logind- NetworkManager writes to the systemd inhibit pipe
* Mon Dec 17 2012 Miroslav Grepl 3.11.1-66- Allow munin disk plugins to get attributes of all directories- Allow munin disk plugins to get attributes of all directorie- Allow logwatch to get attributes of all directories- Fix networkmanager_manage_lib() interface- Fix gnome_manage_config() to allow to manage sock_file- Fix virtual_domain_context- Add support for dynamic DNS for DHCPv6
* Sat Dec 15 2012 Miroslav Grepl 3.11.1-65- Allow svirt to use netlink_route_socket which was a part of auth_use_nsswitch- Add additional labeling for /var/www/openshift/broker- Fix rhev policy- Allow openshift_initrc domain to dbus chat with systemd_logind- Allow httpd to getattr passenger log file if run_stickshift- Allow consolehelper-gtk to connect to xserver- Add labeling for the tmp-inst directory defined in pam_namespace.conf- Add lvm_metadata_t labeling for /etc/multipath
* Fri Dec 14 2012 Miroslav Grepl 3.11.1-64- consoletype is no longer used
* Wed Dec 12 2012 Miroslav Grepl 3.11.1-63- Add label for efivarfs- Allow certmonger to send signal to itself- Allow plugin-config to read own process status- Add more fixes for pacemaker- apache/drupal can run clamscan on uploaded content- Allow chrome_sandbox_nacl_t to read pid 1 content
* Tue Dec 11 2012 Miroslav Grepl 3.11.1-62- Fix MCS Constraints to control ingres and egres controls on the network.- Change name of svirt_nokvm_t to svirt_tcg_t- Allow tuned to request the kernel to load kernel modules
* Mon Dec 10 2012 Miroslav Grepl 3.11.1-61- Label /var/lib/pgsql/.ssh as ssh_home_t- Add labeling for /usr/bin/pg_ctl- Allow systemd-logind to manage keyring user tmp dirs- Add support for 7389/tcp port- gems seems to be placed in lots of places- Since xdm is running a full session, it seems to be trying to execute lots of executables via dbus- Add back tcp/8123 port as http_cache port- Add ovirt-guest-agent\\.pid labeling- Allow xend to run scsi_id- Allow rhsmcertd-worker to read \"physical_package_id\"- Allow pki_tomcat to connect to ldap port- Allow lpr to read /usr/share/fonts- Allow open file from CD/DVD drive on domU- Allow munin services plugins to talk to SSSD- Allow all samba domains to create samba directory in var_t directories- Take away svirt_t ability to use nsswitch- Dontaudit attempts by openshift to read apache logs- Allow apache to create as well as append _ra_content_t- Dontaudit sendmail_t reading a leaked file descriptor- Add interface to have admin transition /etc/prelink.cache to the proper label- Add sntp support to ntp policy- Allow firewalld to dbus chat with devicekit_power- Allow tuned to call lsblk- Allow tor to read /proc/sys/kernel/random/uuid- Add tor_can_network_relay boolean
* Wed Dec 05 2012 Miroslav Grepl 3.11.1-60- Add openshift_initrc_signal() interface- Fix typos- dspam port is treat as spamd_port_t- Allow setroubleshoot to getattr on all executables- Allow tuned to execute profiles scripts in /etc/tuned- Allow apache to create directories to store its log files- Allow all directories/files in /var/log starting with passenger to be labeled passenger_log_t- Looks like apache is sending sinal to openshift_initrc_t now,needs back port to RHEL6- Allow Postfix to be configured to listen on TCP port 10026 for email from DSPAM- Add filename transition for /etc/tuned/active_profile- Allow condor_master to send mails- Allow condor_master to read submit.cf- Allow condor_master to create /tmp files/dirs- Allow condor_mater to send sigkill to other condor domains- Allow condor_procd sigkill capability- tuned-adm wants to talk with tuned daemon- Allow kadmind and krb5kdc to also list sssd_public_t- Allow accountsd to dbus chat with init- Fix git_read_generic_system_content_files() interface- pppd wants sys_nice by nmcli because of \"syscall=sched_setscheduler\"- Fix mozilla_plugin_can_network_connect to allow to connect to all ports- Label all munin plugins which are not covered by munin plugins policy as unconfined_munin_plugin_exec_t- dspam wants to search /var/spool for opendkim data- Revert \"Add support for tcp/10026 port as dspam_port_t\"- Turning on labeled networking requires additional access for netlabel_peer_t; these allow rules need to be back ported to RHEL6- Allow all application domains to use fifo_files passed in from userdomains, also allow them to write to tmp_files inherited from userdomain- Allow systemd_tmpfiles_t to setattr on mandb_cache_t
* Sat Dec 01 2012 Miroslav Grepl 3.11.1-59- consolekit.pp was not removed from the postinstall script
* Fri Nov 30 2012 Miroslav Grepl 3.11.1-58- Add back consolekit policy- Silence bootloader trying to use inherited tty- Silence xdm_dbusd_t trying to execute telepathy apps- Fix shutdown avcs when machine has unconfined.pp disabled- The host and a virtual machine can share the same printer on a usb device- Change oddjob to transition to a ranged openshift_initr_exec_t when run from oddjob- Allow abrt_watch_log_t to execute bin_t- Allow chrome sandbox to write content in ~/.config/chromium- Dontaudit setattr on fontconfig dir for thumb_t- Allow lircd to request the kernel to load module- Make rsync as userdom_home_manager- Allow rsync to search automount filesystem- Add fixes for pacemaker
* Wed Nov 28 2012 Miroslav Grepl 3.11.1-57- Add support for 4567/tcp port- Random fixes from Tuomo Soini- xdm wants to get init status- Allow programs to run in fips_mode- Add interface to allow the reading of all blk device nodes- Allow init to relabel rpcbind sock_file- Fix labeling for lastlog and faillog related to logrotate- ALlow aeolus_configserver to use TRAM port- Add fixes for aeolus_configserver- Allow snmpd to connect to snmp port- Allow spamd_update to create spamd_var_lib_t directories- Allow domains that can read sssd_public_t files to also list the directory- Remove miscfiles_read_localization, this is defined for all domains
* Mon Nov 26 2012 Miroslav Grepl 3.11.1-56- Allow syslogd to request the kernel to load a module- Allow syslogd_t to read the network state information- Allow xdm_dbusd_t connect to the system DBUS- Add support for 7389/tcp port- Allow domains to read/write all inherited sockets- Allow staff_t to read kmsg- Add awstats_purge_apache_log boolean- Allow ksysguardproces to read /.config/Trolltech.conf- Allow passenger to create and append puppet log files- Add puppet_append_log and puppet_create_log interfaces- Add puppet_manage_log() interface- Allow tomcat domain to search tomcat_var_lib_t- Allow pki_tomcat_t to connect to pki_ca ports- Allow pegasus_t to have net_admin capability- Allow pegasus_t to write /sys/class/net//flags- Allow mailserver_delivery to manage mail_home_rw_t lnk_files- Allow fetchmail to create log files- Allow gnomeclock to manage home config in .kde- Allow bittlebee to read kernel sysctls- Allow logrotate to list /root
* Mon Nov 19 2012 Miroslav Grepl 3.11.1-55- Fix userhelper_console_role_template()- Allow enabling Network Access Point service using blueman- Make vmware_host_t as unconfined domain- Allow authenticate users in webaccess via squid, using mysql as backend- Allow gathers to get various metrics on mounted file systems- Allow firewalld to read /etc/hosts- Fix cron_admin_role() to make sysadm cronjobs running in the sysadm_t instead of cronjob_t- Allow kdumpgui to read/write to zipl.conf- Commands needed to get mock to build from staff_t in enforcing mode- Allow mdadm_t to manage cgroup files- Allow all daemons and systemprocesses to use inherited initrc_tmp_t files- dontaudit ifconfig_t looking at fifo_files that are leaked to it- Add lableing for Quest Authentication System
* Thu Nov 15 2012 Miroslav Grepl 3.11.1-54- Fix filetrans interface definitions- Dontaudit xdm_t to getattr on BOINC lib files- Add systemd_reload_all_services() interface- Dontaudit write access on /var/lib/net-snmp/mib_indexes - Only stop mcsuntrustedproc from relableing files- Allow accountsd to dbus chat with gdm- Allow realmd to getattr on all fs- Allow logrotate to reload all services- Add systemd unit file for radiusd- Allow winbind to create samba pid dir- Add labeling for /var/nmbd/unexpected- Allow chrome and mozilla plugin to connect to msnp ports
* Mon Nov 12 2012 Miroslav Grepl 3.11.1-53- Fix storage_rw_inherited_fixed_disk_dev() to cover also blk_file- Dontaudit setfiles reading /dev/random- On initial boot gnomeclock is going to need to be set buy gdm- Fix tftp_read_content() interface- Random apps looking at kernel file systems- Testing virt with lxc requiers additional access for virsh_t- New allow rules requied for latest libvirt, libvirt talks directly to journald,lxc setup tool needs compromize_kernel,and we need ipc_lock in the container- Allow MPD to read /dev/radnom- Allow sandbox_web_type to read logind files which needs to read pulseaudio- Allow mozilla plugins to read /dev/hpet- Add labeling for /var/lib/zarafa-webap- Allow BOINC client to use an HTTP proxy for all connections- Allow rhsmertd to domain transition to dmidecod- Allow setroubleshootd to send D-Bus msg to ABRT
* Thu Nov 08 2012 Miroslav Grepl 3.11.1-52- Define usbtty_device_t as a term_tty- Allow svnserve to accept a connection- Allow xend manage default virt_image_t type- Allow prelink_cron_system_t to overide user componant when executing cp- Add labeling for z-push- Gnomeclock sets the realtime clock- Openshift seems to be storing apache logs in /var/lib/openshift/.log/httpd- Allow lxc domains to use /dev/random and /dev/urandom
* Wed Nov 07 2012 Miroslav Grepl 3.11.1-51- Add port defintion for tcp/9000- Fix labeling for /usr/share/cluster/checkquorum to label also checkquorum.wdmd- Add rules and labeling for $HOME/cache/\\.gstreamer-.
* directory- Add support for CIM provider openlmi-networking which uses NetworkManager dbus API- Allow shorewall_t to create netlink_socket- Allow krb5admind to block suspend- Fix labels on /var/run/dlm_controld /var/log/dlm_controld- Allow krb5kdc to block suspend- gnomessytemmm_t needs to read /etc/passwd- Allow cgred to read all sysctls
* Tue Nov 06 2012 Miroslav Grepl 3.11.1-50- Allow all domains to read /proc/sys/vm/overcommit_memory- Make proc_numa_t an MLS Trusted Object- Add /proc/numactl support for confined users- Allow ssh_t to connect to any port > 1023- Add openvswitch domain- Pulseaudio tries to create directories in gnome_home_t directories- New ypbind pkg wants to search /var/run which is caused by sd_notify- Allow NM to read certs on NFS/CIFS using use_nfs_
*, use_samba_
* booleans- Allow sanlock to read /dev/random- Treat php-fpm with httpd_t- Allow domains that can read named_conf_t to be able to list the directories- Allow winbind to create sock files in /var/run/samba
* Thu Nov 01 2012 Miroslav Grepl 3.11.1-49- Add smsd policy- Add support for OpenShift sbin labelin- Add boolean to allow virt to use rawip- Allow mozilla_plugin to read all file systems with noxattrs support- Allow kerberos to write on anon_inodefs fs- Additional access required by fenced- Add filename transitions for passwd.lock/group.lock- UPdate man pages- Create coolkey directory in /var/cache with the correct label
* Tue Oct 30 2012 Miroslav Grepl 3.11.1-48- Fix label on /etc/group.lock- Allow gnomeclock to create lnk_file in /etc- label /root/.pki as a home_cert_t- Add interface to make sure rpcbind.sock is created with the correct label- Add definition for new directory /var/lib/os-probe and bootloader wants to read udev rules- opendkim should be a part of milter- Allow libvirt to set the kernel sched algorythm- Allow mongod to read sysfs_t- Add authconfig policy- Remove calls to miscfiles_read_localization all domains get this- Allow virsh_t to read /root/.pki/ content- Add label for log directory under /var/www/stickshift
* Mon Oct 29 2012 Miroslav Grepl 3.11.1-47- Allow getty to setattr on usb ttys- Allow sshd to search all directories for sshd_home_t content- Allow staff domains to send dbus messages to kdumpgui- Fix labels on /etc/.pwd.lock and friends to be passwd_file_t- Dontaudit setfiles reading urand- Add files_dontaudit_list_tmp() for domains to which we added sys_nice/setsched- Allow staff_gkeyringd_t to read /home/$USER/.local/share/keyrings dir- Allow systemd-timedated to read /dev/urandom- Allow entropyd_t to read proc_t (meminfo)- Add unconfined munin plugin- Fix networkmanager_read_conf() interface- Allow blueman to list /tmp which is needed by sys_nic/setsched- Fix label of /etc/mail/aliasesdb-stamp- numad is searching cgroups- realmd is communicating with networkmanager using dbus- Lots of fixes to try to get kdump to work
* Fri Oct 26 2012 Miroslav Grepl 3.11.1-46- Allow loging programs to dbus chat with realmd- Make apache_content_template calling as optional- realmd is using policy kit
* Fri Oct 26 2012 Miroslav Grepl 3.11.1-45- Add new selinuxuser_use_ssh_chroot boolean- dbus needs to be able to read/write inherited fixed disk device_t passed through it- Cleanup netutils process allow rule- Dontaudit leaked fifo files from openshift to ping- sanlock needs to read mnt_t lnk files- Fail2ban needs to setsched and sys_nice
* Wed Oct 24 2012 Miroslav Grepl 3.11.1-44- Change default label of all files in /var/run/rpcbind- Allow sandbox domains (java) to read hugetlbfs_t- Allow awstats cgi content to create tmp files and read apache log files- Allow setuid/setgid for cupsd-config- Allow setsched/sys_nice pro cupsd-config- Fix /etc/localtime sym link to be labeled locale_t- Allow sshd to search postgresql db t since this is a homedir- Allow xwindows users to chat with realmd- Allow unconfined domains to configure all files and null_device_t service
* Tue Oct 23 2012 Miroslav Grepl 3.11.1-43- Adopt pki-selinux policy
* Mon Oct 22 2012 Miroslav Grepl 3.11.1-42- pki is leaking which we dontaudit until a pki code fix- Allow setcap for arping- Update man pages- Add labeling for /usr/sbin/mcollectived- pki fixes- Allow smokeping to execute fping in the netutils_t domain
* Fri Oct 19 2012 Miroslav Grepl 3.11.1-41- Allow mount to relabelfrom unlabeled file systems- systemd_logind wants to send and receive messages from devicekit disk over dbus to make connected mouse working- Add label to get bin files under libreoffice labeled correctly- Fix interface to allow executing of base_ro_file_type- Add fixes for realmd- Update pki policy- Add tftp_homedir boolean- Allow blueman sched_setscheduler- openshift user domains wants to r/w ssh tcp sockets
* Wed Oct 17 2012 Miroslav Grepl 3.11.1-40- Additional requirements for disable unconfined module when booting- Fix label of systemd script files- semanage can use -F /dev/stdin to get input- syslog now uses kerberos keytabs- Allow xserver to compromise_kernel access- Allow nfsd to write to mount_var_run_t when running the mount command- Add filename transition rule for bin_t directories- Allow files to read usr_t lnk_files- dhcpc wants chown- Add support for new openshift labeling- Clean up for tunable+optional statements- Add labeling for /usr/sbin/mkhomedir_helper- Allow antivirus domain to managa amavis spool files- Allow rpcbind_t to read passwd - Allow pyzor running as spamc to manage amavis spool
* Tue Oct 16 2012 Miroslav Grepl 3.11.1-39- Add interfaces to read kernel_t proc info- Missed this version of exec_all- Allow anyone who can load a kernel module to compromise kernel- Add oddjob_dbus_chat to openshift apache policy- Allow chrome_sandbox_nacl_t to send signals to itself- Add unit file support to usbmuxd_t- Allow all openshift domains to read sysfs info- Allow openshift domains to getattr on all domains
* Fri Oct 12 2012 Miroslav Grepl 3.11.1-38- MLS fixes from Dan- Fix name of capability2 secure_firmware->compromise_kerne
* Thu Oct 11 2012 Miroslav Grepl 3.11.1-37- Allow xdm to search all file systems- Add interface to allow the config of all files- Add rngd policy- Remove kgpg as a gpg_exec_t type- Allow plymouthd to block suspend- Allow systemd_dbus to config any file- Allow system_dbus_t to configure all services- Allow freshclam_t to read usr_files- varnishd requires execmem to load modules
* Thu Oct 11 2012 Miroslav Grepl 3.11.1-36- Allow semanage to verify types- Allow sudo domain to execute user home files- Allow session_bus_type to transition to user_tmpfs_t- Add dontaudit caused by yum updates- Implement pki policy but not activated
* Wed Oct 10 2012 Miroslav Grepl 3.11.1-35- tuned wants to getattr on all filesystems- tuned needs also setsched. The build is needed for test day
* Wed Oct 10 2012 Miroslav Grepl 3.11.1-34- Add policy for qemu-qa- Allow razor to write own config files- Add an initial antivirus policy to collect all antivirus program- Allow qdisk to read usr_t- Add additional caps for vmware_host- Allow tmpfiles_t to setattr on mandb_cache_t- Dontaudit leaked files into mozilla_plugin_config_t- Allow wdmd to getattr on tmpfs- Allow realmd to use /dev/random- allow containers to send audit messages- Allow root mount any file via loop device with enforcing mls policy- Allow tmpfiles_t to setattr on mandb_cache_t- Allow tmpfiles_t to setattr on mandb_cache_t- Make userdom_dontaudit_write_all_ not allow open- Allow init scripts to read all unit files- Add support for saphostctrl ports
* Mon Oct 08 2012 Miroslav Grepl 3.11.1-33- Add kernel_read_system_state to sandbox_client_t- Add some of the missing access to kdumpgui- Allow systemd_dbusd_t to status the init system- Allow vmnet-natd to request the kernel to load a module- Allow gsf-office-thum to append .cache/gdm/session.log- realmd wants to read .config/dconf/user- Firewalld wants sys_nice/setsched- Allow tmpreaper to delete mandb cache files- Firewalld wants sys_nice/setsched- Allow firewalld to perform a DNS name resolution- Allown winbind to read /usr/share/samba/codepages/lowcase.dat- Add support for HTTPProxy
* in /etc/freshclam.conf- Fix authlogin_yubike boolean- Extend smbd_selinux man page to include samba booleans- Allow dhcpc to execute consoletype- Allow ping to use inherited tmp files created in init scripts- On full relabel with unconfined domain disabled, initrc was running some chcon\'s- Allow people who delete man pages to delete mandb cache files
* Thu Oct 04 2012 Miroslav Grepl 3.11.1-32- Add missing permissive domains
* Thu Oct 04 2012 Miroslav Grepl 3.11.1-31- Add new mandb policy- ALlow systemd-tmpfiles_t to relabel mandb_cache_t- Allow logrotate to start all unit files
* Thu Oct 04 2012 Miroslav Grepl 3.11.1-30- Add fixes for ctbd- Allow nmbd to stream connect to ctbd- Make cglear_t as nsswitch_domain- Fix bogus in interfaces- Allow openshift to read/write postfix public pipe- Add postfix_manage_spool_maildrop_files() interface- stickshift paths have been renamed to openshift- gnome-settings-daemon wants to write to /run/systemd/inhibit/ pipes- Update man pages, adding ENTRYPOINTS
* Tue Oct 02 2012 Miroslav Grepl 3.11.1-29- Add mei_device_t- Make sure gpg content in homedir created with correct label- Allow dmesg to write to abrt cache files- automount wants to search virtual memory sysctls- Add support for hplip logs stored in /var/log/hp/tmp- Add labeling for /etc/owncloud/config.php- Allow setroubleshoot to send analysys to syslogd-journal- Allow virsh_t to interact with new fenced daemon- Allow gpg to write to /etc/mail/spamassassiin directories- Make dovecot_deliver_t a mail server delivery type- Add label for /var/tmp/DNS25
* Thu Sep 27 2012 Miroslav Grepl 3.11.1-28- Fixes for tomcat_domain template interface
* Thu Sep 27 2012 Miroslav Grepl 3.11.1-27- Remove init_systemd and init_upstart boolean, Move init_daemon_domain and init_system_domain to use attributes- Add attribute to all base os types. Allow all domains to read all ro base OS types
* Wed Sep 26 2012 Miroslav Grepl 3.11.1-26- Additional unit files to be defined as power unit files- Fix more boolean names
* Tue Sep 25 2012 Miroslav Grepl 3.11.1-25- Fix boolean name so subs will continue to work
* Tue Sep 25 2012 Miroslav Grepl 3.11.1-24- dbus needs to start getty unit files- Add interface to allow system_dbusd_t to start the poweroff service- xdm wants to exec telepathy apps- Allow users to send messages to systemdlogind- Additional rules needed for systemd and other boot apps- systemd wants to list /home and /boot- Allow gkeyringd to write dbus/conf file- realmd needs to read /dev/urand- Allow readahead to delete /.readahead if labeled root_t, might get created before policy is loaded
* Thu Sep 20 2012 Miroslav Grepl 3.11.1-23- Fixes to safe more rules- Re-write tomcat_domain_template()- Fix passenger labeling- Allow all domains to read man pages- Add ephemeral_port_t to the \'generic\' port interfaces- Fix the names of postgresql booleans
* Tue Sep 18 2012 Miroslav Grepl 3.11.1-22- Stop using attributes form netlabel_peer and syslog, auth_use_nsswitch setsup netlabel_peer- Move netlable_peer check out of booleans- Remove call to recvfrom_netlabel for kerberos call- Remove use of attributes when calling syslog call - Move -miscfiles_read_localization to domain.te to save hundreds of allow rules- Allow all domains to read locale files. This eliminates around 1500 allow rules- Cleanup nis_use_ypbind_uncond interface- Allow rndc to block suspend- tuned needs to modify the schedule of the kernel- Allow svirt_t domains to read alsa configuration files- ighten security on irc domains and make sure they label content in homedir correctly- Add filetrans_home_content for irc files- Dontaudit all getattr access for devices and filesystems for sandbox domains- Allow stapserver to search cgroups directories- Allow all postfix domains to talk to spamd
* Mon Sep 17 2012 Miroslav Grepl 3.11.1-21- Add interfaces to ignore setattr until kernel fixes this to be checked after the DAC check- Change pam_t to pam_timestamp_t- Add dovecot_domain attribute and allow this attribute block_suspend capability2- Add sanlock_use_fusefs boolean- numad wants send/recieve msg- Allow rhnsd to send syslog msgs- Make piranha-pulse as initrc domain- Update openshift instances to dontaudit setattr until the kernel is fixed.
* Fri Sep 14 2012 Miroslav Grepl 3.11.1-20- Fix auth_login_pgm_domain() interface to allow domains also managed user tmp dirs because of #856880 related to pam_systemd- Remove pam_selinux.8 which conflicts with man page owned by the pam package- Allow glance-api to talk to mysql- ABRT wants to read Xorg.0.log if if it detects problem with Xorg- Fix gstreamer filename trans. interface
* Thu Sep 13 2012 Miroslav Grepl 3.11.1-19- Man page fixes by Dan Walsh
* Tue Sep 11 2012 Miroslav Grepl 3.11.1-18- Allow postalias to read postfix config files- Allow man2html to read man pages- Allow rhev-agentd to search all mountpoints- Allow rhsmcertd to read /dev/random- Add tgtd_stream_connect() interface- Add cyrus_write_data() interface- Dontaudit attempts by sandboxX clients connectiing to the xserver_port_t- Add port definition for tcp/81 as http_port_t- Fix /dev/twa labeling- Allow systemd to read modules config
* Mon Sep 10 2012 Miroslav Grepl 3.11.1-17- Merge openshift policy- Allow xauth to read /dev/urandom- systemd needs to relabel content in /run/systemd directories- Files unconfined should be able to perform all services on all files- Puppet tmp file can be leaked to all domains- Dontaudit rhsmcertd-worker to search /root/.local- Allow chown capability for zarafa domains- Allow system cronjobs to runcon into openshift domains- Allow virt_bridgehelper_t to manage content in the svirt_home_t labeled directories
* Fri Sep 07 2012 Miroslav Grepl 3.11.1-16- nmbd wants to create /var/nmbd- Stop transitioning out of anaconda and firstboot, just causes AVC messages- Allow clamscan to read /etc files- Allow bcfg2 to bind cyphesis port- heartbeat should be run as rgmanager_t instead of corosync_t- Add labeling for /etc/openldap/certs- Add labeling for /opt/sartest directory- Make crontab_t as userdom home reader- Allow tmpreaper to list admin_home dir- Add defition for imap_0 replay cache file- Add support for gitolite3- Allow virsh_t to send syslog messages- allow domains that can read samba content to be able to list the directories also- Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd- Separate out sandbox from sandboxX policy so we can disable it by default- Run dmeventd as lvm_t- Mounting on any directory requires setattr and write permissions- Fix use_nfs_home_dirs() boolean- New labels for pam_krb5- Allow init and initrc domains to sys_ptrace since this is needed to look at processes not owned by uid 0- Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd
* Fri Aug 31 2012 Dan Walsh 3.11.1-15- Separate sandbox policy into sandbox and sandboxX, and disable sandbox by default on fresh installs- Allow domains that can read etc_t to read etc_runtime_t - Allow all domains to use inherited tmpfiles
* Wed Aug 29 2012 Miroslav Grepl 3.11.1-14- Allow realmd to read resolv.conf- Add pegasus_cache_t type- Label /usr/sbin/fence_virtd as virsh_exec_t- Add policy for pkcsslotd- Add support for cpglockd- Allow polkit-agent-helper to read system-auth-ac- telepathy-idle wants to read gschemas.compiled- Allow plymouthd to getattr on fs_t- Add slpd policy- Allow ksysguardproces to read/write config_usr_t
* Sat Aug 25 2012 Dan Walsh 3.11.1-13- Fix labeling substitution so rpm will label /lib/systemd content correctly
* Fri Aug 24 2012 Miroslav Grepl 3.11.1-12- Add file name transitions for ttyACM0- spice-vdagent(d)\'s are going to log over to syslog- Add sensord policy- Add more fixes for passenger policy related to puppet- Allow wdmd to create wdmd_tmpfs_t- Fix labeling for /var/run/cachefilesd\\.pid- Add thumb_tmpfs_t files type | |
