|
|
 |
|
|
Changelog for selinux-policy-minimum-3.13.1-102.el7_3.15.noarch.rpm :
Tue Feb 7 13:00:00 2017 Lukas Vrabec - 3.13.1-102.15
- Allow sssd_t domain setpgid
Resolves:rhbz#1419836
Wed Jan 11 13:00:00 2017 Lukas Vrabec - 3.13.1-102.14
- Upgrade fails %post: Re-declaration of type pkcsslotd_t
Resolves: rhbz#1411660
Mon Jan 9 13:00:00 2017 Lukas Vrabec - 3.13.1-102.13
- Allow systemd container to read/write usermodehelperstate
Resolves: rhbz#1408126
- Allow glusterd_t to bind on glusterd_port_t udp ports.
Resolves: rhbz#1408128
Wed Jan 4 13:00:00 2017 Lukas Vrabec - 3.13.1-102.12
- Allow glusterd_t to bind on glusterd_port_t udp ports.
Resolves: rhbz#1408128
- Allow glusterd_t send signals to userdomain. Label new glusterd binaries as glusterd_exec_t
Resolves: rhbz#1408128
- Fixes for containers
- Allow containers to attempt to write to unix_sysctls.
- Allow cotainers to use the FD\'s leaked to them from parent processes.
Resolves: rhbz#1408126
- Allow systemd to stop glusterd_t domains.
Resolves: rhbz#1408125
Mon Dec 19 13:00:00 2016 Lukas Vrabec - 3.13.1-102.11
- Update ctdbd_t policy to reflect all changes.
Resolves: rhbz#1403266
Thu Dec 15 13:00:00 2016 Lukas Vrabec - 3.13.1-102.10
- Allow ctdbd_t domain transition to rpcd_t
Resolves:rhbz#1403266
Tue Dec 13 13:00:00 2016 Lukas Vrabec - 3.13.1-102.9
- Make working CTDB:NFS: CTDB failover from selinux-policy POV
Resolves: rhbz#1403266
Mon Dec 5 13:00:00 2016 Lukas Vrabec - 3.13.1-102.8
- Allow puppetagent_t to access timedated dbus. Use the systemd_dbus_chat_timedated interface to allow puppetagent_t the access.
Resolves: rhbz#1400505
Mon Nov 14 13:00:00 2016 Lukas Vrabec - 3.13.1-102.7
- Update systemd on RHEL-7.2 box to version from RHEL-7.3 and then as a separate yum command update the selinux policy systemd will start generating USER_AVC denials and will start returning \"Access Denied\" errors to DBus clients.
Resolves: rhbz#1394715
Wed Nov 9 13:00:00 2016 Lukas Vrabec - 3.13.1-102.6
- Allow cluster_t communicate to fprintd_t via dbus
Resolves: rhbz#1349798
Wed Nov 9 13:00:00 2016 Lukas Vrabec - 3.13.1-102.5
- Fix error message during update from RHEL-7.2 to RHEL-7.3, when /usr/sbin/semanage command is not installed and selinux-policy-migrate-local-changes.sh script is executed in %post install phase of selinux-policy package
Resolves: rhbz#1393045
Wed Oct 19 14:00:00 2016 Miroslav Grepl - 3.13.1-102.4
- Allow GlusterFS with RDMA transport to be started correctly. It requires ipc_lock capability together with rw permission on rdma_cm device.
Resolves:#1386620
- Allow glusterd to get attributes on /sys/kernel/config directory.
Resolves:#1386621
Wed Oct 12 14:00:00 2016 Petr Lautrbach - 3.13.1-102.3
- Use selinux-policy-migrate-local-changes.sh instead of migrateStore
* macros
Resolves: rhbz#1383450
- Add selinux-policy-migrate-local-changes service
Resolves: rhbz#1383450
Fri Sep 30 14:00:00 2016 Lukas Vrabec - 3.13.1-102.1
- Allow sssd_selinux_manager_t to manage also dir class.
Resolves: rhbz#1380687
- Add interface seutil_manage_default_contexts_dirs()
Resolves: rhbz#1380687
Tue Sep 27 14:00:00 2016 Dan Walsh - 3.13.1-102
- Add virt_sandbox_use_nfs -> virt_use_nfs boolean substitution.
Resolves: rhbz#1355783
Tue Sep 27 14:00:00 2016 Lukas Vrabec - 3.13.1-101
- Allow pcp_pmcd_t domain transition to lvm_t Add capability kill and sys_ptrace to pcp_pmlogger_t
Resolves: rhbz#1309883
Wed Sep 21 14:00:00 2016 Lukas Vrabec - 3.13.1-100
- Allow ftp daemon to manage apache_user_content
Resolves: rhbz#1097775
- Label /etc/sysconfig/oracleasm as oracleasm_conf_t
Resolves: rhbz#1331383
- Allow oracleasm to rw inherited fixed disk device
Resolves: rhbz#1331383
- Allow collectd to connect on unix_stream_socket
Resolves: rhbz#1377259
Wed Sep 14 14:00:00 2016 Lukas Vrabec - 3.13.1-99
- Allow iscsid create netlink iscsid sockets.
Resolves: rhbz#1358266
- Improve regexp for power_unit_file_t files. To catch just systemd power unit files.
Resolves: rhbz#1375462
Tue Sep 13 14:00:00 2016 Lukas Vrabec - 3.13.1-98
- Update oracleasm SELinux module that can manage oracleasmfs_t blk files. Add dac_override cap to oracleasm_t domain.
Resolves: rhbz#1331383
- Add few rules to pcp SELinux module to make ti able to start pcp_pmlogger service
Resolves: rhbz#1206525
Tue Sep 6 14:00:00 2016 Lukas Vrabec - 3.13.1-97
- Add oracleasm_conf_t type and allow oracleasm_t to create /dev/oracleasm
Resolves: rhbz#1331383
- Label /usr/share/pcp/lib/pmie as pmie_exec_t and /usr/share/pcp/lib/pmlogger as pmlogger_exec_t
Resolves: rhbz#1206525
- Allow mdadm_t to getattr all device nodes
Resolves: rhbz#1365171
- Add interface dbus_dontaudit_stream_connect_system_dbusd()
Resolves:rhbz#1052880
- Add virt_stub_
* interfaces for docker policy which is no longer a part of our base policy.
Resolves: rhbz#1372705
- Allow guest-set-user-passwd to set users password.
Resolves: rhbz#1369693
- Allow samdbox domains to use msg class
Resolves: rhbz#1372677
- Allow domains using kerberos to read also kerberos config dirs
Resolves: rhbz#1368492
- Allow svirt_sandbox_domains to r/w onload sockets
Resolves: rhbz#1342930
- Add interface fs_manage_oracleasm()
Resolves: rhbz#1331383
- Label /dev/kfd as hsa_device_t
Resolves: rhbz#1373488
- Update seutil_manage_file_contexts() interface that caller domain can also manage file_context_t dirs
Resolves: rhbz#1368097
- Add interface to write to nsfs inodes
Resolves: rhbz#1372705
- Allow systemd services to use PrivateNetwork feature
Resolves: rhbz#1372705
- Add a type and genfscon for nsfs.
Resolves: rhbz#1372705
- Allow run sulogin_t in range mls_systemlow-mls_systemhigh.
Resolves: rhbz#1290400
Wed Aug 31 14:00:00 2016 Lukas Vrabec - 3.13.1-96
- Allow arpwatch to create netlink netfilter sockets. Resolves: rhbz#1358261
- Fix file context for /etc/pki/pki-tomcat/ca/
- new interface oddjob_mkhomedir_entrypoint()
- Move label for /var/lib/docker/vfs/ to proper SELinux module
- Allow mdadm to get attributes from all devices.
- Label /etc/puppetlabs as puppet_etc_t.
- Allow systemd-machined to communicate to lxc container using dbus
- Allow systemd_resolved to send dbus msgs to userdomains Resolves: rhbz#1236579
- Allow systemd-resolved to read network sysctls Resolves: rhbz#1236579
- Allow systemd_resolved to connect on system bus. Resolves: rhbz#1236579
- Make entrypoint oddjob_mkhomedir_exec_t for unconfined_t
- Label all files in /dev/oracleasmfs/ as oracleasmfs_t Resolves: rhbz#1331383
Tue Aug 23 14:00:00 2016 Lukas Vrabec - 3.13.1-95
- Label /etc/pki/pki-tomcat/ca/ as pki_tomcat_cert_t
Resolves:rhbz#1366915
- Allow certmonger to manage all systemd unit files
Resolves:rhbz#1366915
- Grant certmonger \"chown\" capability
Resolves:rhbz#1366915
- Allow ipa_helper_t stream connect to dirsrv_t domain
Resolves: rhbz#1368418
- Update oracleasm SELinux module
Resolves: rhbz#1331383
- label /var/lib/kubelet as svirt_sandbox_file_t
Resolves: rhbz#1369159
- Add few interfaces to cloudform.if file
Resolves: rhbz#1367834
- Label /var/run/corosync-qnetd and /var/run/corosync-qdevice as cluster_var_run_t. Note: corosync policy is now par of rhcs module
Resolves: rhbz#1347514
- Allow krb5kdc_t to read krb4kdc_conf_t dirs.
Resolves: rhbz#1368492
- Update networkmanager_filetrans_named_content() interface to allow source domain to create also temad dir in /var/run.
Resolves: rhbz#1365653
- Allow teamd running as NetworkManager_t to access netlink_generic_socket to allow multiple network interfaces to be teamed together.
Resolves: rhbz#1365653
- Label /dev/oracleasmfs as oracleasmfs_t. Add few interfaces related to oracleasmfs_t type
Resolves: rhbz#1331383
- A new version of cloud-init that supports the effort to provision RHEL Atomic on Microsoft Azure requires some a new rules that allows dhclient/dhclient hooks to call cloud-init.
Resolves: rhbz#1367834
- Allow iptables to creating netlink generic sockets.
Resolves: rhbz#1364359
Wed Aug 17 14:00:00 2016 Lukas Vrabec - 3.13.1-94
- Allow ipmievd domain to create lock files in /var/lock/subsys/
Resolves:rhbz#1349058
- Update policy for ipmievd daemon.
Resolves:rhbz#1349058
- Dontaudit hyperkvp to getattr on non security files.
Resolves: rhbz#1349356
- Label /run/corosync-qdevice and /run/corosync-qnetd as corosync_var_run_t
Resolves: rhbz#1347514
- Fixed lsm SELinux module
- Add sys_admin capability to sbd domain
Resolves: rhbz#1322725
- Allow vdagent to comunnicate with systemd-logind via dbus
Resolves: rhbz#1366731
- Allow lsmd_plugin_t domain to create fixed_disk device.
Resolves: rhbz#1238066
- Allow opendnssec domain to create and manage own tmp dirs/files
Resolves: rhbz#1366649
- Allow opendnssec domain to read system state
Resolves: rhbz#1366649
- Update opendnssec_manage_config() interface to allow caller domain also manage opendnssec_conf_t dirs
Resolves: rhbz#1366649
- Allow rasdaemon to mount/unmount tracefs filesystem.
Resolves: rhbz#1364380
- Label /usr/libexec/iptables/iptables.init as iptables_exec_t Allow iptables creating lock file in /var/lock/subsys/
Resolves: rhbz#1367520
- Modify interface den_read_nvme() to allow also read nvme_device_t block files.
Resolves: rhbz#1362564
- Label /var/run/storaged as lvm_var_run_t.
Resolves: rhbz#1264390
- Allow unconfineduser to run ipa_helper_t.
Resolves: rhbz#1361636
Wed Aug 10 14:00:00 2016 Lukas Vrabec - 3.13.1-93
- Dontaudit mock to write to generic certs.
Resolves: rhbz#1271209
- Add labeling for corosync-qdevice and corosync-qnetd daemons, to run as cluster_t
Resolves: rhbz#1347514
- Revert \"Label corosync-qnetd and corosync-qdevice as corosync_t domain\"
- Allow modemmanager to write to systemd inhibit pipes
Resolves: rhbz#1365214
- Label corosync-qnetd and corosync-qdevice as corosync_t domain
Resolves: rhbz#1347514
- Allow ipa_helper to read network state
Resolves: rhbz#1361636
- Label oddjob_reqiest as oddjob_exec_t
Resolves: rhbz#1361636
- Add interface oddjob_run()
Resolves: rhbz#1361636
- Allow modemmanager chat with systemd_logind via dbus
Resolves: rhbz#1362273
- Allow NetworkManager chat with puppetagent via dbus
Resolves: rhbz#1363989
- Allow NetworkManager chat with kdumpctl via dbus
Resolves: rhbz#1363977
- Allow sbd send msgs to syslog Allow sbd create dgram sockets. Allow sbd to communicate with kernel via dgram socket Allow sbd r/w kernel sysctls.
Resolves: rhbz#1322725
- Allow ipmievd_t domain to re-create ipmi devices Label /usr/libexec/openipmi-helper as ipmievd_exec_t
Resolves: rhbz#1349058
- Allow rasdaemon to use tracefs filesystem.
Resolves: rhbz#1364380
- Fix typo bug in dirsrv policy
- Some logrotate scripts run su and then su runs unix_chkpwd. Allow logrotate_t domain to check passwd.
Resolves: rhbz#1283134
- Add ipc_lock capability to sssd domain. Allow sssd connect to http_cache_t
Resolves: rhbz#1362688
- Allow dirsrv to read dirsrv_share_t content
Resolves: rhbz#1363662
- Allow virtlogd_t to append svirt_image_t files.
Resolves: rhbz#1358140
- Allow hypervkvp domain to read hugetlbfs dir/files.
Resolves: rhbz#1349356
- Allow mdadm daemon to read nvme_device_t blk files
Resolves: rhbz#1362564
- Allow selinuxusers and unconfineduser to run oddjob_request
Resolves: rhbz#1361636
- Allow sshd server to acces to Crypto Express 4 (CEX4) devices.
Resolves: rhbz#1362539
- Fix labeling issue in init.fc file. Path /usr/lib/systemd/fedora-
* changed to /usr/lib/systemd/rhel-
*.
Resolves: rhbz#1363769
- Fix typo in device interfaces
Resolves: rhbz#1349058
- Add interfaces for managing ipmi devices
Resolves: rhbz#1349058
- Add interfaces to allow mounting/umounting tracefs filesystem
Resolves: rhbz#1364380
- Add interfaces to allow rw tracefs filesystem
Resolves: rhbz#1364380
- Add interface dev_read_nvme() to allow reading Non-Volatile Memory Host Controller devices.
Resolves: rhbz#1362564
- Label /sys/kernel/debug/tracing filesystem
Resolves: rhbz#1364380
- Allow sshd setcap capability. This is needed due to latest changes in sshd
Resolves: rhbz#1357857
Thu Jul 28 14:00:00 2016 Lukas Vrabec - 3.13.1-92
- Dontaudit mock_build_t can list all ptys.
Resolves: rhbz#1271209
- Allow ftpd_t to mamange userhome data without any boolean.
Resolves: rhbz#1097775
- Add logrotate permissions for creating netlink selinux sockets.
Resolves: rhbz#1283134
- Allow lsmd_plugin_t to exec ldconfig.
Resolves: rhbz#1238066
- Allow vnstatd domain to read /sys/class/net/ files
Resolves: rhbz#1358243
- Remove duplicate allow rules in spamassassin SELinux module
Resolves:rhbz#1358175
- Allow spamc_t and spamd_t domains create .spamassassin file in user homedirs
Resolves:rhbz#1358175
- Allow sshd setcap capability. This is needed due to latest changes in sshd
Resolves: rhbz#1357857
- Add new MLS attribute to allow relabeling objects higher than system low. This exception is needed for package managers when processing sensitive data.
Resolves: rhbz#1330464
- Allow gnome-keyring also manage user_tmp_t sockets.
Resolves: rhbz#1257057
- corecmd: Remove fcontext for /etc/sysconfig/libvirtd
Resolves:rhbz#1351382
Tue Jul 19 14:00:00 2016 Lukas Vrabec - 3.13.1-91
- Allow ipa_dnskey domain to search cache dirs
Resolves: rhbz#1350957
Tue Jul 19 14:00:00 2016 Lukas Vrabec - 3.13.1-90
- Allow ipa-dnskey read system state.
Reasolves: rhbz#1350957
- Allow dogtag-ipa-ca-renew-agent-submit labeled as certmonger_t to create /var/log/ipa/renew.log file
Resolves: rhbz#1350957
Mon Jul 18 14:00:00 2016 Lukas Vrabec - 3.13.1-89
- Allow firewalld to manage net_conf_t files.
Resolves:rhbz#1304723
- Allow logrotate read logs inside containers.
Resolves: rhbz#1303514
- Allow sssd to getattr on fs_t
Resolves: rhbz#1356082
- Allow opendnssec domain to manage bind chace files
Resolves: rhbz#1350957
- Fix typo in rhsmcertd policy module
Resolves: rhbz#1329475
- Allow systemd to get status of systemd-logind daemon
Resolves: rhbz#1356141
- Label more ndctl devices not just ndctl0
Resolves: rhbz#1355809
Thu Jul 14 14:00:00 2016 Lukas Vrabec - 3.13.1-88
- Allow rhsmcertd to copy certs into /etc/docker/cert.d
- Add interface docker_rw_config()
Resolves: rhbz#1344500
- Fix logrotate fc file to label also /var/lib/logrotate/ dir as logrotate_var_lib_t
Resolves: rhbz#1355632
- Allow rhsmcertd to read network sysctls
Resolves: rhbz#1329475
- Label /var/log/graphite-web dir as httpd_log_t
Resolves: rhbz#1310898
- Allow mock to use generic ptys
Resolves: rhbz#1271209
- Allow adcli running as sssd_t to write krb5.keytab file.
Resolves: rhbz#1356082
- Allow openvswitch connect to openvswitch_port_t type.
Resolves: rhbz#1335024
- Add SELinux policy for opendnssec service.
Resolves: rhbz#1350957
- Create new SELinux type for /usr/libexec/ipa/ipa-dnskeysyncd
Resolves: rhbz#1350957
- label /dev/ndctl0 device as nvram_device_t
Resolves: rhbz#1355809
Mon Jul 11 14:00:00 2016 Lukas Vrabec - 3.13.1-87
- Allow lttng tools to block suspending
Resolves: rhbz#1256374
- Allow creation of vpnaas in openstack
Resolves: rhbz#1352710
- virt: add strict policy for virtlogd daemon
Resolves:rhbz#1311606
- Update makefile to support snapperd_contexts file
Resolves: rhbz#1352681
Fri Jul 8 14:00:00 2016 Lukas Vrabec - 3.13.1-86
- Allow udev to manage systemd-hwdb files
- Add interface systemd_hwdb_manage_config()
Resolves: rhbz#1350756
- Fix paths to infiniband devices. This allows use more then two infiniband interfaces.
Resolves: rhbz#1210263
Thu Jul 7 14:00:00 2016 Lukas Vrabec - 3.13.1-85
- Allow virtual machines to rw infiniband devices.
Resolves: rhbz#1210263
- Allow opensm daemon to rw infiniband_mgmt_device_t
Resolves: rhbz#1210263
- Allow systemd_hwdb_t to relabel /etc/udev/hwdb.bin file.
Resolves: rhbz#1350756
- Make label for new infiniband_mgmt deivices
Resolves: rhbz#1210263
Tue Jul 5 14:00:00 2016 Lukas Vrabec - 3.13.1-84
- Fix typo in brltty SELinux module
- Add new SELinux module sbd
Resolves: rhbz#1322725
- Allow pcp dmcache metrics collection
Resolves: rhbz#1309883
- Allow pkcs_slotd_t to create dir in /var/lock Add label pkcs_slotd_log_t
Resolves: rhbz#1350782
- Allow openvpn to create sock files labeled as openvpn_var_run_t
Resolves: rhbz#1328246
- Allow hypervkvp daemon to getattr on all filesystem types.
Resolves: rhbz#1349356
- Allow firewalld to create net_conf_t files
Resolves: rhbz#1304723
- Allow mock to use lvm
Resolves: rhbz#1271209
- Allow keepalived to create netlink generic sockets.
Resolves: rhbz#1349809
- Allow mirromanager creating log files in /tmp
Resolves:rhbz#1328818
- Rename few modules to make it consistent with source files
Resolves: rhbz#1351445
- Allow vmtools_t to transition to rpm_script domain
Resolves: rhbz#1342119
- Allow nsd daemon to manage nsd_conf_t dirs and files
Resolves: rhbz#1349791
- Allow cluster to create dirs in /var/run labeled as cluster_var_run_t
Resolves: rhbz#1346900
- Allow sssd read also sssd_conf_t dirs
Resolves: rhbz#1350535
- Dontaudit su_role_template interface to getattr /proc/kcore Dontaudit su_role_template interface to getattr /dev/initctl
Resolves: rhbz#1086240
- Add interface lvm_getattr_exec_files()
Resolves: rhbz#1271209
- Fix typo Compliling vs. Compiling
Resolves: rhbz#1351445
Wed Jun 29 14:00:00 2016 Lukas Vrabec - 3.13.1-83
- Allow krb5kdc_t to communicate with sssd
Resolves: rhbz#1319933
- Allow prosody to bind on prosody ports
Resolves: rhbz#1304664
- Add dac_override caps for fail2ban-client
Resolves: rhbz#1316678
- dontaudit read access for svirt_t on the file /var/db/nscd/group
Resolves: rhbz#1301637
- Allow inetd child process to communicate via dbus with systemd-logind
Resolves: rhbz#1333726
- Add label for brltty log file
Resolves: rhbz#1328818
- Allow dspam to read the passwd file
Resolves: rhbz#1286020
- Allow snort_t to communicate with sssd
Resolves: rhbz#1284908
- svirt_sandbox_domains need to be able to execmod for badly built libraries.
Resolves: rhbz#1206339
- Add policy for lttng-tools package.
Resolves: rhbz#1256374
- Make mirrormanager as application domain.
Resolves: rhbz#1328234
- Add support for the default lttng-sessiond port - tcp/5345. This port is used by LTTng 2.x central tracing registry session daemon.
- Add prosody ports
Resolves: rhbz#1304664
- Allow sssd read also sssd_conf_t dirs
Resolves: rhbz#1350535
Tue Jun 28 14:00:00 2016 Lukas Vrabec - 3.13.1-82
- Label /var/lib/softhsm as named_cache_t. Allow named_t to manage named_cache_t dirs.
Resolves:rhbz#1331315
- Label named-pkcs11 binary as named_exec_t.
Resolves: rhbz#1331315
- Allow glusterd daemon to get systemd status
Resolves: rhbz#1321785
- Allow logrotate dbus-chat with system_logind daemon
Resolves: rhbz#1283134
- Allow pcp_pmlogger to read kernel network state Allow pcp_pmcd to read cron pid files
Resolves: rhbz#1336211
- Add interface cron_read_pid_files()
Resolves: rhbz#1336211
- Allow pcp_pmlogger to create unix dgram sockets
Resolves: rhbz#1336211
- Add hwloc-dump-hwdata SELinux policy
Resolves: rhbz#1344054
- Remove non-existing jabberd_spool_t() interface and add new jabbertd_var_spool_t.
Resolves: rhbz#1121171
- Remove non-existing interface salk_resetd_systemctl() and replace it with sanlock_systemctl_sanlk_resetd()
Resolves: rhbz#1259764
- Create label for openhpid log files.
esolves: rhbz#1259764
- Label /var/lib/ganglia as httpd_var_lib_t
Resolves: rhbz#1260536
- Allow firewalld_t to create entries in net_conf_t dirs.
Resolves: rhbz#1304723
- Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals
Resolves: rhbz#1288255
- Include patch from distgit repo: policy-RHEL-7.1-flask.patch.
Resolves: rhbz#1329560
- Update refpolicy to handle hwloc
Resolves: rhbz#1344054
- Label /etc/dhcp/scripts dir as bin_t
- Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals.
Resolves: rhbz#1288255
Wed Jun 22 14:00:00 2016 Lukas Vrabec - 3.13.1-81
- Allow firewalld_t to create entries in net_conf_t dirs.
Resolves: rhbz#1304723
- Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals
Resolves: rhbz#1288255
- Allow mongod log to syslog.
Resolves: rhbz#1306995
- Allow rhsmcertd connect to port tcp 9090
Resolves: rhbz#1337319
- Label for /bin/mail(x) was removed but /usr/bin/mail(x) not. This path is also needed to remove.
Resolves: rhbz#1262483
Resolves: rhbz#1277506
- Label /usr/libexec/mimedefang-wrapper as spamd_exec_t.
Resolves: rhbz#1301516
- Add new boolean spamd_update_can_network.
Resolves: rhbz#1305469
- Allow rhsmcertd connect to tcp netport_port_t
Resolves: rhbz#1329475
- Fix SELinux context for /usr/share/mirrormanager/server/mirrormanager to Label all binaries under dir as mirrormanager_exec_t.
Resolves: rhbz#1328234
- Allow prosody to bind to fac_restore tcp port.
Resolves: rhbz#1321787
- Allow ninfod to read raw packets
Resolves: rhbz#1317964
- Allow pegasus get attributes from qemu binary files.
Resolves: rhbz#1260835
- Allow pegasus get attributes from qemu binary files.
Resolves: rhbz#1271159
- Allow tuned to use policykit. This change is required by cockpit.
Resolves: rhbz#1346464
- Allow conman_t to read dir with conman_unconfined_script_t binary files.
Resolves: rhbz#1297323
- Allow pegasus to read /proc/sysinfo.
Resolves: rhbz#1265883
- Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals.
Resolves: rhbz#1288255
- Label tcp ports:16379, 26379 as redis_port_t
Resolves: rhbz#1348471
- Allow systemd to relabel /var and /var/lib directories during boot.
- Add files_relabel_var_dirs() and files_relabel_var_dirs() interfaces.
- Add files_relabelto_var_lib_dirs() interface.
- Label tcp port 2004 as mailbox_port_t.
Resolves: rhbz#1332843
- Label tcp and udp port 5582 as fac_restore_port_t
Resolves: rhbz#1321787
- Allow sysadm_t user to run postgresql-setup.
Resolves: rhbz#1282543
- Allow sysadm_t user to dbus chat with oddjob_t. This allows confined admin run oddjob mkhomedirfor script.
Resolves: rhbz#1297480
- Update netlink socket classes.
Thu Jun 16 14:00:00 2016 Lukas Vrabec - 3.13.1-80
- Allow conman to kill conman_unconfined_script.
Resolves: rhbz#1297323
- Make conman_unconfined_script_t as init_system_domain.
Resolves:rhbz#1297323
- Allow init dbus chat with apmd.
Resolves:rhbz#995898
- Patch /var/lib/rpm is symlink to /usr/share/rpm on Atomic, due to this change we need to label also /usr/share/rpm as rpm_var_lib_t.
Resolves: rhbz#1233252
- Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_t
Resolves: rhbz#1052880
- Add mediawiki rules to proper scope
Resolves: rhbz#1301186
- Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_t
Resolves: rhbz#1052880
- Allow mysqld_safe to inherit rlimit information from mysqld
Resolves: rhbz#1323673
- Allow collectd_t to stream connect to postgresql.
Resolves: rhbz#1344056
- Allow mediawiki-script to read /etc/passwd file.
Resolves: rhbz#1301186
- Add filetrans rule that NetworkManager_t can create net_conf_t files in /etc.
Resolves: rhbz#1344505
- Add labels for mediawiki123
Resolves: rhbz#1293872
- Fix label for all fence_scsi_check scripts
- Allow ip netns to mounton root fs and unmount proc_t fs.
Resolves: rhbz#1343776
Resolves: rhbz#1286851
- Allow sysadm_t to run newaliases command.
Resolves: rhbz#1344828
- Add interface sysnet_filetrans_named_net_conf()
Resolves: rhbz#1344505
Mon Jun 13 14:00:00 2016 Petr Lautrbach - 3.13.1-79
- Fix several issues related to the SELinux Userspace changes
Thu Jun 9 14:00:00 2016 Lukas Vrabec - 3.13.1-78
- Allow glusterd domain read krb5_keytab_t files.
Resolves: rhbz#1343929
- Fix typo in files_setattr_non_security_dirs.
Resolves: rhbz#1115987
Thu Jun 9 14:00:00 2016 Lukas Vrabec - 3.13.1-77
- Allow tmpreaper_t to read/setattr all non_security_file_type dirs
Resolves: rhbz#1115987
- Allow firewalld to create firewalld_var_run_t directory.
Resolves: rhbz#1304723
- Add interface firewalld_read_pid_files()
Resolves: rhbz#1304723
- Label /usr/libexec/rpm-ostreed as rpm_exec_t.
Resolves: rhbz#1340542
- Allow sanlock service to read/write cephfs_t files.
Resolves: rhbz#1315332
- Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
- Added missing docker interfaces: - docker_typebounds - docker_entrypoint
Resolves: rhbz#1236580
- Add interface files_setattr_non_security_dirs()
Resolves: rhbz#1115987
- Add support for onloadfs
- Allow iptables to read firewalld pid files.
Resolves: rhbz#1304723
- Add SELinux support for ceph filesystem.
Resolves: rhbz#1315332
- Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
Resolves: rhbz#1236580
Mon Jun 6 14:00:00 2016 Lukas Vrabec - 3.13.1-76
- Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
- Added missing docker interfaces: - docker_typebounds - docker_entrypoint
Resolves: rhbz#1236580
- New interfaces needed for systemd-machinectl
Resolves: rhbz#1236580
- New interfaces needed by systemd-machine
Resolves: rhbz#1236580
- Add interface allowing sending and receiving messages from virt over dbus.
Resolves: rhbz#1236580
- Backport docker policy from Fedora.
Related: #1303123
Resolves: #1341257
- Allow NetworkManager_t and policykit_t read access to systemd-machined pid files.
Resolves: rhbz#1236580
- Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
- Added interfaces needed by new docker policy.
Related: rhbz#1303123
- Add support for systemd-machined daemon
Resolves: rhbz#1236580
- Allow rpm-ostree domain transition to install_t domain from init_t.
Resolves: rhbz#1340542
Tue May 31 14:00:00 2016 Lukas Vrabec - 3.13.1-75
- dnsmasq: allow NetworkManager to control dnsmasq via D-Bus
Resolves: rhbz#1336722
- Directory Server (389-ds-base) has been updated to use systemd-ask-password. In order to function correctly we need the following added to dirsrv.te
Resolves: rhbz#1333198
- sftpd_
* booleans are functionless these days.
Resolves: rhbz#1335656
- Label /var/log/ganesha.log as gluster_log_t Allow glusterd_t domain to create glusterd_log_t files. Label /var/run/ganesha.pid as gluster_var_run_t.
Resolves: rhbz#1335828
- Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus.
Resolves: rhbz#1336760
- Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t.
Resolves: rhbz#1336737
- Label /usr/libexec/storaged/storaged as lvm_exec_t to run storaged daemon in lvm_t SELinux domain.
Resolves: rhbz#1264390
- Allow systemd_hostanmed_t to read /proc/sysinfo labeled as sysctl_t.
Resolves: rhbz#1337061
- Revert \"Allow all domains some process flags.\"
Resolves: rhbz#1303644
- Revert \"Remove setrlimit to all domains.\"
Resolves: rhbz#1303644
- Label /usr/sbin/xrdp
* files as bin_t
Resolves: rhbz#1276777
- Add mls support for some db classes
Resolves: rhbz#1303651
- Allow systemd_resolved_t to check if ipv6 is disabled.
Resolves: rhbz#1236579
- Allow systemd_resolved to read systemd_networkd run files.
Resolves: rhbz#1236579
Mon May 23 14:00:00 2016 Lukas Vrabec - 3.13.1-74
- Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus.
Resolves: rhbz#1336760
- Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t.
Resolves: rhbz#1336737
Mon May 16 14:00:00 2016 Lukas Vrabec - 3.13.1-73
- Allow logwatch to domtrans to postqueue
Resolves: rhbz#1331542
- Label /var/log/ganesha.log as gluster_log_t
- Allow glusterd_t domain to create glusterd_log_t files.
- Label /var/run/ganesha.pid as gluster_var_run_t.
Resolves: rhbz#1335828
- Allow zabbix to connect to postgresql port
Resolves: rhbz#1330479
- Add userdom_destroy_unpriv_user_shared_mem() interface.
Related: rhbz#1306403
- systemd-logind remove all IPC objects owned by a user on a logout. This covers also SysV memory. This change allows to destroy unpriviledged user SysV shared memory segments.
Resolves: rhbz#1306403
Mon May 16 14:00:00 2016 Lukas Vrabec - 3.13.1-72
- We need to restore contexts on /etc/passwd
*,/etc/group
*,/etc/
*shadow
* during install phase to get proper labeling for these files until selinux-policy pkgs are installed.
Resolves: rhbz#1333952
Tue May 10 14:00:00 2016 Lukas Vrabec - 3.13.1-71
- Add interface glusterd_dontaudit_read_lib_dirs()
Resolves: rhbz#1295680
- Dontaudit Occasionally observing AVC\'s while running geo-rep automation
Resolves: rhbz#1295680
- Allow glusterd to manage socket files labeled as glusterd_brick_t.
Resolves: rhbz#1331561
- Create new apache content template for files stored in user homedir. This change is needed to make working booleans: - httpd_enable_homedirs - httpd_read_user_content
Resolves: rhbz#1246522
- Allow stunnel create log files.
Resolves: rhbz#1296851
- Label tcp port 8181 as intermapper_port_t.
Resolves: rhbz#1334783
- Label tcp/udp port 2024 as xinuexpansion4_port_t
Resolves: rhbz#1334783
- Label tcp port 7002 as afs_pt_port_t Label tcp/udp port 2023 as xinuexpansion3_port_t
Resolves: rhbz#1334783
- Dontaudit ldconfig read gluster lib files.
Resolves: rhbz#1295680
- Add interface auth_use_nsswitch() to systemd_domain_template.
Resolves: rhbz#1236579
Tue May 3 14:00:00 2016 Lukas Vrabec - 3.13.1-70
- Label /usr/bin/ganesha.nfsd as glusterd_exec_t to run ganesha as glusterd_t. Allow glusterd_t stream connect to rpbind_t. Allow cluster_t to create symlink /var/lib/nfs labeled as var_lib_nfs_t. Add interface rpc_filetrans_var_lib_nfs_content() Add new boolean: rpcd_use_fusefs to allow rpcd daemon use fusefs.
Resolves: rhbz#1312809
Resolves: rhbz#1323947
- Allow dbus chat between httpd_t and oddjob_t. Resolves: rhbz#1324144
- Label /usr/libexec/ipa/oddjob/org.freeipa.server.conncheck as ipa_helper_exec_t.
Resolves: rhbz#1324144
- Label /var/log/ipareplica-conncheck.log file as ipa_log_t Allow ipa_helper_t domain to manage logs labeledas ipa_log_t Allow ipa_helper_t to connect on http and kerberos_passwd ports.
Resolves: rhbz#1324144
- Allow prosody to listen on port 5000 for mod_proxy65.
Resolves: rhbz#1316918
- Allow pcp_pmcd_t domain to manage docker lib files. This rule is needed to allow pcp to collect container information when SELinux is enabled.
Resolves: rhbz#1309454
Wed Apr 27 14:00:00 2016 Lukas Vrabec - 3.13.1-69
- Allow runnig php7 in fpm mode. From selinux-policy side, we need to allow httpd to read/write hugetlbfs.
Resolves: rhbz#1319442
- Allow openvswitch daemons to run under openvswitch Linux user instead of root. This change needs allow set capabilities: chwon, setgid, setuid, setpcap.
Resolves: rhbz#1296640
- Remove ftpd_home_dir() boolean from distro policy. Reason is that we cannot make this working due to m4 macro language limits.
Resolves: rhbz#1097775
- /bin/mailx is labeled sendmail_exec_t, and enters the sendmail_t domain on execution. If /usr/sbin/sendmail does not have its own domain to transition to, and is not one of several products whose behavior is allowed by the sendmail_t policy, execution will fail. In this case we need to label /bin/mailx as bin_t.
Resolves: rhbz#1262483
- Allow nsd daemon to create log file in /var/log as nsd_log_t
Resolves: rhbz#1293140
- Sanlock policy update. - New sub-domain for sanlk-reset daemon
Resolves: rhbz#1212324
- Label all run tgtd files, not just socket files
Resolves: rhbz#1280280
- Label all run tgtd files, not just socket files.
Resolves: rhbz#1280280
- Allow prosody to stream connect to sasl. This will allow using cyrus authentication in prosody.
Resolves: rhbz#1321049
- unbound wants to use ephemeral ports as a default configuration. Allow to use also udp sockets.
Resolves: rhbz#1318224
- Allow prosody to listen on port 5000 for mod_proxy65.
Resolves: rhbz#1316918
- Allow targetd to read/write to /dev/mapper/control device.
Resolves: rhbz#1063714
- Allow KDM to get status about power services. This change allow kdm to be able do shutdown.
Resolves: rhbz#1316724
- Allow systemd-resolved daemon creating netlink_route sockets.
Resolves:rhbz#1236579
- Allow systemd_resolved_t to read /etc/passwd file. Allow systemd_resolved_t to write to kmsg_device_t when \'systemd.log_target=kmsg\' option is used
Resolves: rhbz#1065362
- Label /etc/selinux/(minimum|mls|targeted)/active/ as semanage_store_t
Resolves: rhbz#1321943
- Label all nvidia binaries as xserver_exec_t
Resolves: rhbz#1322283
Wed Mar 23 13:00:00 2016 Lukas Vrabec - 3.13.1-68
- Create new permissivedomains CIL module and make it active.
Resolves: rhbz#1320451
- Add support for new mock location - /usr/libexec/mock/mock.
Resolves: rhbz#1271209
- Allow bitlee to create bitlee_var_t dirs.
Resolves: rhbz#1268651
- Allow CIM provider to read sssd public files.
Resolves: rhbz#1263339
- Fix some broken interfaces in distro policy.
Resolves: rhbz#1121171
- Allow power button to shutdown the laptop.
Resolves: rhbz#995898
- Allow lsm plugins to create named fixed disks.
Resolves: rhbz#1238066
- Add default labeling for /etc/Pegasus/cimserver_current.conf. It is a correct patch instead of the current /etc/Pegasus/pegasus_current.confResolves: rhbz#1278777
- Allow hyperv domains to rw hyperv devices.
Resolves: rhbz#1309361
- Label /var/www/html(/.
*)?/wp_backups(/.
*)? as httpd_sys_rw_content_t.Resolves: rhbz#1246780
- Create conman_unconfined_script_t type for conman script stored in /use/share/conman/exec/
Resolves: rhbz#1297323
- Fix rule definitions for httpd_can_sendmail boolean. We need to distinguish between base and contrib.
- Add support for /dev/mptctl device used to check RAID status.
Resolves: rhbz#1258029
- Create hyperv
* devices and create rw interfaces for this devices.
Resolves: rhbz#1309361
- Add fixes for selinux userspace moving the policy store to /var/lib/selinux.
- Remove optional else block for dhcp ping
Thu Mar 17 13:00:00 2016 Lukas Vrabec - 3.13.1-67
- Allow rsync_export_all_ro boolean to read also non_auth_dirs/files/symlinks.
Resolves: rhbz#1263770
- Fix context of \"/usr/share/nginx/html\".
Resolves: rhbz#1261857
- Allow pmdaapache labeled as pcp_pmcd_t access to port 80 for apache diagnostics
Resolves: rhbz#1270344
- Allow pmlogger to create pmlogger.primary.socket link file.
Resolves: rhbz#1270344
- Label nagios scripts as httpd_sys_script_exec_t.
Resolves: rhbz#1260306
- Add dontaudit interface for kdumpctl_tmp_t
Resolves: rhbz#1156442
- Allow mdadm read files in EFI partition.
Resolves: rhbz#1291801
- Allow nsd_t to bind on nsf_control tcp port. Allow nsd_crond_t to read nsd pid.
Resolves: rhbz#1293140
- Label some new nsd binaries as nsd_exec_t Allow nsd domain net_admin cap. Create label nsd_tmp_t for nsd tmp files/dirs
Resolves: rhbz#1293140
- Add filename transition that /etc/princap will be created with cupsd_rw_etc_t label in cups_filetrans_named_content() interface.
Resolves: rhbz#1265102
- Add missing labeling for /usr/libexec/abrt-hook-ccpp.
Resolves: rhbz#1213409
- Allow pcp_pmie and pcp_pmlogger to read all domains state.
Resolves: rhbz#1206525
- Label /etc/redis-sentinel.conf as redis_conf_t. Allow redis_t write to redis_conf_t. Allow redis_t to connect on redis tcp port.
Resolves: rhbz#1275246
- cockpit has grown content in /var/run directory
Resolves: rhbz#1279429
- Allow collectd setgid capability
Resolves:#1310898
- Remove declaration of empty booleans in virt policy.
Resolves: rhbz#1103153
- Fix typo in drbd policy
- Add new drbd file type: drbd_var_run_t. Allow drbd_t to manage drbd_var_run_t files/dirs. Allow drbd_t create drbd_tmp_t files in /tmp.
Resolves: rhbz#1134883
- Label /etc/ctdb/events.d/
* as ctdb_exec_t. Allow ctdbd_t to setattr on ctdbd_exec_t files.
Resolves: rhbz#1293788
- Allow abrt-hook-ccpp to get attributes of all processes because of core_pattern.
Resolves: rhbz#1254188
- Allow abrt_t to read sysctl_net_t files.
Resolves: rhbz#1254188
- The ABRT coredump handler has code to emulate default core file creation The handler runs in a separate process with abrt_dump_oops_t SELinux process type. abrt-hook-ccpp also saves the core dump file in the very same way as kernel does and a user can specify CWD location for a coredump. abrt-hook-ccpp has been made as a SELinux aware apps to create this coredumps with correct labeling and with this commit the policy rules have been updated to allow access all non security files on a system.
- Allow abrt-hook-ccpp to getattr on all executables.
- Allow setuid/setgid capabilities for abrt-hook-ccpp.
Resolves: rhbz#1254188
- abrt-hook-ccpp needs to have setfscreate access because it is SELinux aware and compute a target labeling.
Resolves: rhbz#1254188
- Allow abrt-hook-ccpp to change SELinux user identity for created objects.
Resolves: rhbz#1254188
- Dontaudit write access to inherited kdumpctl tmp files.
Resolves: rbhz#1156442
- Add interface to allow reading files in efivarfs - contains Linux Kernel configuration options for UEFI systems (UEFI Runtime Variables)
Resolves: rhbz#1291801
- Label 8952 tcp port as nsd_control.
Resolves: rhbz#1293140
- Allow ipsec to use pam.
Resolves: rhbz#1315700
- Allow to log out to gdm after screen was resized in session via vdagent.
Resolves: rhbz#1249020
- Allow setrans daemon to read /proc/meminfo.
Resolves: rhbz#1316804
- Allow systemd_networkd_t to write kmsg, when kernel was started with following params: systemd.debug systemd.log_level=debug systemd.log_target=kmsg
Resolves: rhbz#1298151
- Label tcp port 5355 as llmnr-> Link-Local Multicast Name Resolution
Resolves: rhbz#1236579
- Add new selinux policy for systemd-resolved dawmon.
Resolves: rhbz#1236579
- Add interface ssh_getattr_server_keys() interface.
Resolves: rhbz#1306197
- Allow run sshd-keygen on second boot if first boot fails after some reason and content is not syncedon the disk. These changes are reflecting this commit in sshd. http://pkgs.fedoraproject.org/cgit/rpms/openssh.git/commit/?id=af94f46861844cbd6ba4162115039bebcc8f78ba rhbz#1299106
Resolves: rhbz#1306197
- Allow systemd_notify_t to write to kmsg_device_t when \'systemd.log_target=kmsg\' option is used.
Resolves: rhbz#1309417
- Remove bin_t label for /etc/ctdb/events.d/. We need to label this scripts as ctdb_exec_t.
Resolves: rhbz#1293788
Thu Mar 17 13:00:00 2016 Petr Lautrbach - 3.13.1-66
- Prepare selinux-policy package for userspace release 2016-02-23. Resolves: rhbz#1305982
Tue Mar 8 13:00:00 2016 Lukas Vrabec 3.13.1-65
- Allow sending dbus msgs between firewalld and system_cronjob domains. Resolves: rhbz#1284902
- Allow zabbix-agentd to connect to following tcp sockets. One of zabbix-agentd functions is get service status of ftp,http,innd,pop,smtp protocols.
Resolves: rhbz#1242506
- Add new boolean tmpreaper_use_cifs() to allow tmpreaper to run on local directories being shared with Samba.
Resolves: rhbz#1284972
- Add support for systemd-hwdb daemon.
Resolves: rhbz#1257940
- Add interface fs_setattr_cifs_dirs().
Resolves: rhbz#1284972
Mon Feb 29 13:00:00 2016 Lukas Vrabec 3.13.1-64
- Add new SELinux policy fo targetd daemon.
Resolves: rhbz#1063714
- Add new SELinux policy fo ipmievd daemon.
Resolves: rhbz#1083031
- Add new SELinux policy fo hsqldb daemon.
Resolves: rhbz#1083171
- Add new SELinux policy for blkmapd daemon.
Resolves: rhbz#1072997
- Allow p11-child to connect to apache ports.
- Label /usr/sbin/lvmlockd binary file as lvm_exec_t.
Resolves: rhbz#1278028
- Add interface \"lvm_manage_lock\" to lvm policy.
Resolves: rhbz#1063714
Wed Jan 27 13:00:00 2016 Lukas Vrabec 3.13.1-63
- Allow openvswitch domain capability sys_rawio.
Resolves: rhbz#1278495
Tue Jan 26 13:00:00 2016 Lukas Vrabec 3.13.1-62
- Allow openvswitch to manage hugetlfs files and dirs.
Resolves: rhbz#1278495
- Add fs_manage_hugetlbfs_files() interface.
Resolves: rhbz#1278495
Tue Jan 12 13:00:00 2016 Lukas Vrabec 3.13.1-61
- Allow smbcontrol domain to send sigchld to ctdbd domain.
Resolves: #1293784
- Allow openvswitch read/write hugetlb filesystem.
Resolves: #1278495
Wed Oct 14 14:00:00 2015 Miroslav Grepl 3.13.1-60
Allow hypervvssd to list all mountpoints to have VSS live backup working correctly.
Resolves:#1247880
Tue Oct 13 14:00:00 2015 Miroslav Grepl 3.13.1-59
- Revert Add missing labeling for /usr/libexec/abrt-hook-ccpp patch
Resolves: #1254188
Thu Oct 8 14:00:00 2015 Lukas Vrabec 3.13.1-58
- Allow search dirs in sysfs types in kernel_read_security_state.
Resolves: #1254188
- Fix kernel_read_security_state interface that source domain of this interface can search sysctl_fs_t dirs.
Resolves: #1254188
Wed Oct 7 14:00:00 2015 Lukas Vrabec 3.13.1-57
- Add missing labeling for /usr/libexec/abrt-hook-ccpp as a part of #1245477 and #1242467 bugs
Resolves: #1254188
- We need allow connect to xserver for all sandbox_x domain because we have one type for all sandbox processes.
Resolves:#1261938
Fri Oct 2 14:00:00 2015 Miroslav Grepl 3.13.1-56
- Remove labeling for modules_dep_t file contexts to have labeled them as modules_object_t.
- Update files_read_kernel_modules() to contain modutils_read_module_deps_files() calling because module deps labeling could remain and it allows to avoid regressions.
Resolves:#1266928
Tue Sep 29 14:00:00 2015 Lukas Vrabec 3.13.1-55
- We need to require sandbox_web_type attribute in sandbox_x_domain_template().
Resolves: #1261938
- ipsec: The NM helper needs to read the SAs
Resolves: #1259786
- ipsec: Allow ipsec management to create ptys
Resolves: #1259786
Tue Sep 29 14:00:00 2015 Lukas Vrabec 3.13.1-54
- Add temporary fixes for sandbox related to #1103622. It allows to run everything under one sandbox type.
Resolves:#1261938
- Allow abrt_t domain to write to kernel msg device.
Resolves: #1257828
- Allow rpcbind_t domain to change file owner and group
Resolves: #1265266
Tue Sep 22 14:00:00 2015 Lukas Vrabec 3.13.1-53
- Allow smbcontrol to create a socket in /var/samba which uses for a communication with smbd, nmbd and winbind.
Resolves: #1256459
Fri Sep 18 14:00:00 2015 Lukas Vrabec 3.13.1-52
- Allow dirsrv-admin script to read passwd file. Allow dirsrv-admin script to read httpd pid files. Label dirsrv-admin unit file and allow dirsrv-admin domains to use it.
Resolves: #1230300
- Allow qpid daemon to connect on amqp tcp port.
Resolves: #1261805
Fri Sep 18 14:00:00 2015 Miroslav Grepl 3.13.1-51
- Label /etc/ipa/nssdb dir as cert_t
Resolves:#1262718
- Do not provide docker policy files which is shipped by docker-selinux.rpm
Resolves:#1262812
Thu Sep 17 14:00:00 2015 Lukas Vrabec 3.13.1-50
- Add labels for afs binaries: dafileserver, davolserver, salvageserver, dasalvager
Resolves: #1192338
- Add lsmd_plugin_t sys_admin capability, Allow lsmd_plugin_t getattr from sysfs filesystem.
Resolves: #1238079
- Allow rhsmcertd_t send signull to unconfined_service_t domains.
Resolves: #1176078
- Remove file transition from snmp_manage_var_lib_dirs() interface which created snmp_var_lib_t dirs in var_lib_t.
- Allow openhpid_t daemon to manage snmp files and dirs.
Resolves: #1243902
- Allow mdadm_t domain read/write to general ptys and unallocated ttys.
Resolves: #1073314
- Add interface unconfined_server_signull() to allow domains send signull to unconfined_service_t
Resolves: #1176078
Fri Sep 11 14:00:00 2015 Lukas Vrabec 3.13.1-49
- Allow systemd-udevd to access netlink_route_socket to change names for network interfaces without unconfined.pp module. It affects also MLS.
Resolves:#1250456
Thu Sep 10 14:00:00 2015 Lukas Vrabec 3.13.1-48
- Fix labeling for fence_scsi_check script
Resolves: #1255020
- Allow openhpid to read system state Allow openhpid to connect to tcp http port.
Resolves: #1244248
- Allow openhpid to read snmp var lib files.
Resolves: #1243902
- Allow openvswitch_t domains read kernel dependencies due to openvswitch run modprobe
- Allow unconfined_t domains to create /var/run/xtables.lock with iptables_var_run_t
Resolves: #1243403
- Remove bin_t label for /usr/share/cluster/fence_scsi_check\\.pl
Resolves: #1255020
Wed Sep 2 14:00:00 2015 Lukas Vrabec 3.13.1-47
- Fix regexp in chronyd.fc file
Resolves: #1243764
- Allow passenger to getattr filesystem xattr
Resolves: #1196555
- Label mdadm.conf.anackbak as mdadm_conf_t file.
Resolves: #1088904
- Revert \"Allow pegasus_openlmi_storage_t create mdadm.conf.anacbak file in /etc.\"
- Allow watchdog execute fenced python script.
Resolves: #1255020
- Added inferface watchdog_unconfined_exec_read_lnk_files()
- Remove labeling for /var/db/.
*\\.db as etc_t to label db files as system_db_t.
Resolves: #1230877
Thu Aug 27 14:00:00 2015 Lukas Vrabec 3.13.1-46
- Allow watchdog execute fenced python script. Resolves: #1255020
- Added inferface watchdog_unconfined_exec_read_lnk_files()
- Label /var/run/chrony-helper dir as chronyd_var_run_t. Resolves: #1243764
- Allow dhcpc_t domain transition to chronyd_t Resolves: #1243764
Fri Aug 21 14:00:00 2015 Lukas Vrabec 3.13.1-45
- Fix postfix_spool_maildrop_t,postfix_spool_flush_t contexts in postfix.fc file.
Resolves: #1252442
Wed Aug 19 14:00:00 2015 Lukas Vrabec 3.13.1-44
- Allow exec pidof under hypervkvp domain.
Resolves: #1254870
- Allow hypervkvp daemon create connection to the system DBUS
Resolves: #1254870
Wed Aug 19 14:00:00 2015 Lukas Vrabec 3.13.1-43
- Allow openhpid_t to read system state.
Resolves: #1244248
- Added labels for files provided by rh-nginx18 collection
Resolves: #1249945
- Dontaudit block_suspend capability for ipa_helper_t, this is kernel bug. Allow ipa_helper_t capability net_admin. Allow ipa_helper_t to list /tmp. Allow ipa_helper_t to read rpm db.
Resolves: #1252968
- Allow rhsmcertd exec rhsmcertd_var_run_t files and rhsmcerd_tmp_t files. This rules are in hide_broken_sympthons until we find better solution.
Resolves: #1243431
- Allow abrt_dump_oops_t to read proc_security_t files.
- Allow abrt_dump_oops to signull all domains Allow abrt_dump_oops to read all domains state Allow abrt_dump_oops to ptrace all domains
- Add interface abrt_dump_oops_domtrans()
- Add mountpoint dontaudit access check in rhsmcertd policy.
Resolves: #1243431
- Allow samba_net_t to manage samba_var_t sock files.
Resolves: #1252937
- Allow chrome setcap to itself.
Resolves: #1251996
- Allow httpd daemon to manage httpd_var_lib_t lnk_files.
Resolves: #1253706
- Allow chronyd exec systemctl
Resolves: #1243764
- Add inteface chronyd_signal Allow timemaster_t send generic signals to chronyd_t.
Resolves: #1243764
- Added interface fs_dontaudit_write_configfs_dirs
- Add label for kernel module dep files in /usr/lib/modules
Resolves:#916635
- Allow kernel_t domtrans to abrt_dump_oops_t
- Added to files_dontaudit_write_all_mountpoints intefface new dontaudit rule, that domain included this interface dontaudit capability dac_override.
- Allow systemd-networkd to send logs to systemd-journald.
Resolves: #1236616
Wed Aug 12 14:00:00 2015 Lukas Vrabec 3.13.1-42
- Fix label on /var/tmp/kiprop_0
Resolves:#1220763
- Allow lldpad_t to getattr tmpfs_t.
Resolves: #1246220
- Label /dev/shm/lldpad.
* as lldapd_tmpfs_t
Resolves: #1246220
- Allow audisp client to read system state.
Tue Aug 11 14:00:00 2015 Lukas Vrabec 3.13.1-41
- Allow pcp_domain to manage pcp_var_lib_t lnk_files.
Resolves: #1252341
- Label /var/run/xtables.
* as iptables_var_run_t
Resolves: #1243403
Mon Aug 10 14:00:00 2015 Lukas Vrabec 3.13.1-40
- Add interface to read/write watchdog device
- Add labels for /dev/memory_bandwith and /dev/vhci. Thanks ssekidde
Resolves:#1210237
- Allow apcupsd_t to read /sys/devices
Resolves:#1189185
- Allow logrotate to reload services.
Resolves: #1242453
- Allow openhpid use libwatchdog plugin. (Allow openhpid_t rw watchdog device)
Resolves: #1244260
- Allow openhpid liboa_soap plugin to read generic certs.
Resolves: #1244248
- Allow openhpid liboa_soap plugin to read resolv.conf file.
Resolves: #1244248
- Label /usr/libexec/chrony-helper as chronyd_exec_t
- Allow chronyd_t to read dhcpc state.
- Allow chronyd to execute mkdir command.
Fri Aug 7 14:00:00 2015 Miroslav Grepl 3.13.1-39
- Allow mdadm to access /dev/random and add support to create own files/dirs as mdadm_tmpfs_t.
Resolves:#1073314
- Allow udev, lvm and fsadm to access systemd-cat in /var/tmp/dracut if \'dracut -fv\' is executed in MLS.
- Allow admin SELinu users to communicate with kernel_t. It is needed to access /run/systemd/journal/stdout if \'dracut -vf\' is executed. We allow it for other SELinux users.
- Allow sysadm to execute systemd-sysctl in the sysadm_t domain. It is needed for ifup command in MLS mode.
- Add fstools_filetrans_named_content_fsadm() and call it for named_filetrans_domain domains. We need to be sure that /run/blkid is created with correct labeling.
Resolves:#1183503
- Add support for /etc/sanlock which is writable by sanlock daemon.
Resolves:#1231377
- Allow useradd add homedir located in /var/lib/kdcproxy in ipa-server RPM scriplet.
Resolves:#1243775
- Allow snapperd to pass data (one way only) via pipe negotiated over dbus
Resolves:#1250550
- Allow lsmd also setuid capability. Some commands need to executed under root privs. Other commands are executed under unprivileged user.
Wed Aug 5 14:00:00 2015 Lukas Vrabec 3.13.1-38
- Allow openhpid to use libsnmp_bc plugin (allow read snmp lib files).
Resolves: #1243902
- Allow lsm_plugin_t to read sysfs, read hwdata, rw to scsi_generic_device
Resolves: #1238079
- Allow lsm_plugin_t to rw raw_fixed_disk.
Resolves:#1238079
- Allow rhsmcertd to send signull to unconfined_service.
Mon Aug 3 14:00:00 2015 Lukas Vrabec 3.13.1-37
- Allow httpd_suexec_t to read and write Apache stream sockets
Resolves: #1243569
- Allow qpid to create lnk_files in qpid_var_lib_t
Resolves: #1247279
Thu Jul 30 14:00:00 2015 Lukas Vrabec 3.13.1-36
- Allow drbd to get attributes from filesystems.
- Allow redis to read kernel parameters.
Resolves: #1209518
- Allow virt_qemu_ga_t domtrans to passwd_t
- Allow audisp_remote_t to start power unit files domain to allow halt system.
Resolves: #1186780
- Allow audisp_remote_t to read/write user domain pty.
Resolves: #1186780
- Label /usr/sbin/chpasswd as passwd_exec_t.
- Allow sysadm to administrate ldap environment and allow to bind ldap port to allow to setup an LDAP server (389ds).
Resolves:#1221121
Mon Jul 27 14:00:00 2015 Lukas Vrabec 3.13.1-35
- gnome_dontaudit_search_config() needs to be a part of optinal_policy in pegasus.te
- Allow pcp_pmcd daemon to read postfix config files.
- Allow pcp_pmcd daemon to search postfix spool dirs.
Resolves: #1213740
- Added Booleans: pcp_read_generic_logs.
Resolves: #1213740
- Allow drbd to read configuration options used when loading modules.
Resolves: #1134883
- Allow glusterd to manage nfsd and rpcd services.
- Allow glusterd to communicate with cluster domains over stream socket.
- glusterd call pcs utility which calls find for cib.
* files and runs pstree under glusterd. Dontaudit access to security files and update gluster boolean to reflect these changes.
Mon Jul 20 14:00:00 2015 Lukas Vrabec 3.13.1-34
- Allow glusterd to manage nfsd and rpcd services.
- Allow networkmanager to communicate via dbus with systemd_hostanmed.
Resolves: #1234954
- Allow stream connect logrotate to prosody.
- Add prosody_stream_connect() interface.
- httpd should be able to send signal/signull to httpd_suexec_t, instead of httpd_suexec_exec_t.
- Allow prosody to create own tmp files/dirs.
Resolves:#1212498
Wed Jul 15 14:00:00 2015 Lukas Vrabec 3.13.1-33
- Allow networkmanager read rfcomm port.
Resolves:#1212498
- Remove non exists label.
- Fix
*_admin intefaces where body is not consistent with header.
- Label /usr/afs/ as afs_files_t, Allow afs_bosserver_t create afs_config_t and afs_dbdir_t dirs under afs_files_t, Allow afs_bosserver_t read kerberos config
- Remove non exits nfsd_ro_t label.
- Make all interfaces related to openshift_cache_t as deprecated.
- Add rpm_var_run_t label to rpm_admin header
- Add jabberd_lock_t label to jabberd_admin header.
- Add samba_unconfined_script_exec_t to samba_admin header.
- inn daemon should create innd_log_t objects in var_log_t instead of innd_var_run_t
- Fix ctdb policy
- Add samba_signull_winbind()
- Add samba_signull_unconfined_net()
- Allow ctdbd_t send signull to samba_unconfined_net_t.
- Allow openshift_initrc_t to communicate with firewalld over dbus
Resolves:#1221326
Tue Jul 14 14:00:00 2015 Lukas Vrabec 3.13.1-32
- Allow gluster to connect to all ports. It is required by random services executed by gluster.
- Add interfaces winbind_signull(), samba_unconfined_net_signull().
- Dontaudit smbd_t block_suspend capability. This is kernel bug.
- Allow ctdbd sending signull to process winbind, samba_unconfined_net, to
checking if processes exists.
- Add tmpreaper booleans to use nfs_t and samba_share_t.
- Fix path from /usr/sbin/redis-server to /usr/bin/redis-server
- Allow connect ypserv to portmap_port_t
- Fix paths in inn policy, Allow innd read innd_log_t dirs, Allow innd execute innd_etc_t files
- Add support for openstack-nova-
* packages
- Allow NetworkManager_t send signull to dnssec_trigger_t.
- Allow glusterd to execute showmount in the showmount domain.
- Label swift-container-reconciler binary as swift_t.
- Allow dnssec_trigger_t relabelfrom dnssec_trigger_var_run_t files.
- Add cobbler_var_lib_t to \"/var/lib/tftpboot/boot(/.
*)?\"
Resolves:#1213540
- Merge all nova_
* labels under one nova_t.
Wed Jul 8 14:00:00 2015 Miroslav Grepl 3.13.1-31
- Add logging_syslogd_run_nagios_plugins boolean for rsyslog to allow transition to nagios unconfined plugins
Resolves:#1233550
- Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/
- Add support for oddjob based helper in FreeIPA.
- Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob.
- Add nagios_domtrans_unconfined_plugins() interface.
- Update mta_filetrans_named_content() interface to cover more db files.
Resolves:#1167468
- Add back ftpd_use_passive_mode boolean with fixed description.
- Allow pmcd daemon stream connect to mysqld.
- Allow pcp domains to connect to own process using unix_stream_socket.
Resolves:#1213709
- Allow abrt-upload-watch service to dbus chat with ABRT daemon and fsetid capability to allow run reporter-upload correctly.
- Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob.
- Add support for oddjob based helper in FreeIPA.
- Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/
Thu Jul 2 14:00:00 2015 Miroslav Grepl 3.13.1-30
- Allow iptables to read ctdbd lib files.
Resolves:#1224879
- Add systemd_networkd_t to nsswitch domains.
- Allow drbd_t write to fixed_disk_device. Reason: drbdmeta needs write to fixed_disk_device during initialization.
Resolves:#1130675
- Allow NetworkManager write to sysfs.
- Fix cron_system_cronjob_use_shares boolean to call fs interfaces which contain only entrypoint permission.
- Add cron_system_cronjob_use_shares boolean to allow system cronjob to be executed from shares - NFS, CIFS, FUSE. It requires \"entrypoint\" permissios on nfs_t, cifs_t and fusefs_t SELinux types.
- Allow NetworkManager write to sysfs.
- Allow ctdb_t sending signull to smbd_t, for checking if smbd process exists.
- Dontaudit apache to manage snmpd_var_lib_t files/dirs.
- Add interface snmp_dontaudit_manage_snmp_var_lib_files().
- Dontaudit mozilla_plugin_t cap. sys_ptrace.
- Rename xodbc-connect port to xodbc_connect
- Allow ovsdb-server to connect on xodbc-connect and ovsdb tcp ports.
- Allow iscsid write to fifo file kdumpctl_tmp_t. Appears when kdump generates the initramfs during the kernel boot.
- Dontaudit chrome to read passwd file.
- nrpe needs kill capability to make gluster moniterd nodes working.
Resolves:#1235587
Wed Jun 17 14:00:00 2015 Miroslav Grepl 3.13.1-29
- We allow can_exec() on ssh_keygen on gluster. But there is a transition defined by init_initrc_domain() because we need to allow execute unconfined services by glusterd. So ssh-keygen ends up with ssh_keygen_t and we need to allow to manage /var/lib/glusterd/geo-replication/secret.pem.
- Allow sshd to execute gnome-keyring if there is configured pam_gnome_keyring.so.
- Allow gnome-keyring executed by passwd to access /run/user/UID/keyring to change a password.
- Label gluster python hooks also as bin_t.
- Allow glusterd to interact with gluster tools running in a user domain
- Add glusterd_manage_lib_files() interface.
- ntop reads /var/lib/ntop/macPrefix.db and it needs dac_override. It has setuid/setgid.
- Allow samba_t net_admin capability to make CIFS mount working.
- S30samba-start gluster hooks wants to search audit logs. Dontaudit it.
Resolves:#1224879
Mon Jun 15 14:00:00 2015 Miroslav Grepl 3.13.1-28
- Allow glusterd to send generic signals to systemd_passwd_agent processes.
- Allow glusterd to access init scripts/units without defined policy
- Allow glusterd to run init scripts.
- Allow glusterd to execute /usr/sbin/xfs_dbin glusterd_t domain.
Resolves:#1224879
Fri Jun 12 14:00:00 2015 Miroslav Grepl 3.13.1-27
- Calling cron_system_entry() in pcp_domain_template needs to be a part of optional_policy block.
- Allow samba-net to access /var/lib/ctdbd dirs/files.
- Allow glusterd to send a signal to smbd.
- Make ctdbd as home manager to access also FUSE.
- Allow glusterd to use geo-replication gluster tool.
- Allow glusterd to execute ssh-keygen.
- Allow glusterd to interact with cluster services.
- Allow glusterd to connect to the system DBUS for service (acquire_svc).
- Label /dev/log correctly.
Resolves:#1230932
Tue Jun 9 14:00:00 2015 Miroslav Grepl 3.13.1-26
- Back port the latest F22 changes to RHEL7. It should fix most of RHEL7.2 bugs
- Add cgdcbxd policy
Resolves:#1072493
- Fix ftp_homedir boolean
Resolve:#1097775
- Dontaudit ifconfig writing inhertited /var/log/pluto.log.
- Allow cluster domain to dbus chat with systemd-logind.
Resolves:#1145215
- Dontaudit write access to inherited kdumpctl tmp files
Resolves:#1156442
- Allow isnsd_t to communicate with sssd
Resolves:#1167702
- Allow rwho_t to communicate with sssd
Resolves:#1167718
- Allow sblim_gatherd_t to communicate with sssd
Resolves:#1167732
- Allow pkcs_slotd_t to communicate with sssd
Resolves:#1167737
- Allow openvswitch_t to communicate with sssd
Resolves:#1167816
- Allow mysqld_safe_t to communicate with sssd
Resolves:#1167832
- Allow sshd_keygen_t to communicate with sssd
Resolves:#1167840
- Add support for iprdbg logging files in /var/log.
Resolves:#1174363
- Allow tmpreaper_t to manage ntp log content
Resolves:#1176965
- Allow gssd_t to manage ssh keyring
Resolves:#1184791
- Allow httpd_sys_script_t to send system log messages
Resolves:#1185231
- Allow apcupsd_t to read /sys/devices
Resolves:#1189185
- Allow dovecot_t sys_resource capability
Resolves:#1191143
- Add support for mongod/mongos systemd unit files.
Resolves:#1197038
- Add bacula fixes
- Added label mysqld_etc_t for /etc/my.cnf.d/ dir.
Resolves:#1203991
Thu May 14 14:00:00 2015 Miroslav Grepl 3.13.1-25
- Label /usr/libexec/postgresql-ctl as postgresql_exec_t.
- Add more restriction on entrypoint for unconfined domains.
- Only allow semanage_t to be able to setenforce 0, no all domains that use selinux_semanage interface
- Allow all domains to read /dev/urandom. It is needed by all apps/services linked to libgcrypt. There is no harm to allow it by default.
- Update policy/mls for sockets related to access perm. Rules were contradictory.
- Add nagios_run_pnp4nagios and nagios_run_sudo booleans to allow r
un sudo from NRPE utils scripts and allow run nagios in conjunction w
ith PNP4Nagios.
Resolves:#1201054
- Don\'t use deprecated userdom_manage_tmpfs_role() interface calliing and use userdom_manage_tmp_role() instead.
- Update virt_read_pid_files() interface to allow read also symlinks with virt_var_run_t type
- Label /var/lib/tftpboot/aarch64(/.
*)? and /var/lib/tftpboot/images2(/.
*)?
- Add support for iprdbg logging files in /var/log.
- Add fixes to rhsmcertd_t
- Allow puppetagent_t to transfer firewalld messages over dbus
- Add support for /usr/libexec/mongodb-scl-helper RHSCL helper script.
- Added label mysqld_etc_t for /etc/my.cnf.d/ dir.
- Add support for mongod/mongos systemd unit files.
- cloudinit and rhsmcertd need to communicate with dbus
- Allow dovecot_t sys_resource capability
Tue Mar 31 14:00:00 2015 Miroslav Grepl 3.13.1-24
- ALlow mongod execmem by default.
- Update policy/mls for sockets. Rules were contradictory.
Resolves:#1207133
- Allow a user to login with different security level via ssh.
Fri Jan 30 13:00:00 2015 Miroslav Grepl 3.13.1-23
- Update seutil_manage_config() interface.
Resolves:#1185962
- Allow pki-tomcat relabel pki_tomcat_etc_rw_t.
- Turn on docker_transition_unconfined by default
Wed Jan 28 13:00:00 2015 Miroslav Grepl 3.13.1-22
- Allow virtd to list all mountpoints.
Resolves:#1180713
Wed Jan 28 13:00:00 2015 Miroslav Grepl 3.13.1-21
- pkcsslotd_lock_t should be an alias for pkcs_slotd_lock_t.
- Allow fowner capability for sssd because of selinux_child handling.
- ALlow bind to read/write inherited ipsec pipes
- Allow hypervkvp to read /dev/urandom and read addition states/config files.
- Allow gluster rpm scripletto create glusterd socket with correct labeling. This is a workaround until we get fix in glusterd.
- Add glusterd_filetrans_named_pid() interface
- Allow radiusd to connect to radsec ports.
- Allow setuid/setgid for selinux_child
- Allow lsmd plugin to connect to tcp/5988 by default.
- Allow lsmd plugin to connect to tcp/5989 by default.
- Update ipsec_manage_pid() interface.
Resolves:#1184978
Fri Jan 23 13:00:00 2015 Miroslav Grepl 3.13.1-20
- Update ipsec_manage_pid() interface.
Resolves:#1184978
Wed Jan 21 13:00:00 2015 Miroslav Grepl 3.13.1-19
- Allow ntlm_auth running in winbind_helper_t to access /dev/urandom.
Wed Jan 21 13:00:00 2015 Miroslav Grepl 3.13.1-18
- Add auditing support for ipsec.
Resolves:#1182524
- Label /ostree/deploy/rhel-atomic-host/deploy directory as system_conf_t
- Allow netutils chown capability to make tcpdump working with -w
Tue Jan 20 13:00:00 2015 Miroslav Grepl 3.13.1-17
- Allow ipsec to execute _updown.netkey script to run unbound-control.
- Allow neutron to read rpm DB.
- Add additional fixes for hyperkvp
* creates new ifcfg-{name} file
* Runs hv_set_ifconfig.sh, which does the following
* Copies ifcfg-{name} to /etc/sysconfig/network-scripts
- Allow svirt to read symbolic links in /sys/fs/cgroups labeled as tmpfs_t
- Add labeling for pacemaker.log.
- Allow radius to connect/bind radsec ports.
- Allow pm-suspend running as virt_qemu_ga to read /var/log/pm-suspend.log
- Allow virt_qemu_ga to dbus chat with rpm.
- Update virt_read_content() interface to allow read also char devices.
- Allow glance-registry to connect to keystone port.
Resolves:#1181818
Mon Jan 12 13:00:00 2015 Miroslav Grepl 3.13.1-16
- Allow sssd to send dbus all user domains.
Resolves:#1172291
- Allow lsm plugin to read certificates.
- Fix labeling for keystone CGI scripts.
- Make snapperd back as unconfined domain.
Fri Jan 9 13:00:00 2015 Miroslav Grepl 3.13.1-15
- Fix bugs in interfaces discovered by sepolicy.
- Allow slapd to read /usr/share/cracklib/pw_dict.hwm.
- Allow lsm plugins to connect to tcp/18700 by default.
- Allow brltty mknod capability to allow create /var/run/brltty/vcsa.
- Fix pcp_domain_template() interface.
- Fix conman.te.
- Allow mon_fsstatd to read /proc/sys/fs/binfmt_misc
- Allow glance-scrubber to connect tcp/9191.
- Add missing setuid capability for sblim-sfcbd.
- Allow pegasus ioctl() on providers.
- Add conman_can_network.
- Allow chronyd to read chrony conf files located in /run/timemaster/.
- Allow radius to bind on tcp/1813 port.
- dontaudit block suspend access for openvpn_t
- Allow conman to create files/dirs in /tmp.
- Update xserver_rw_xdm_keys() interface to have \'setattr\'.
Resolves:#1172291
- Allow sulogin to read /dev/urandom and /dev/random.
- Update radius port definition to have also tcp/18121
- Label prandom as random_device_t.
- Allow charon to manage files in /etc/strongimcv labeled as ipsec_conf_t.
Fri Dec 12 13:00:00 2014 Miroslav Grepl 3.13.1-14
- Allow virt_qemu_ga_t to execute kmod.
- Add missing files_dontaudit_list_security_dirs() for smbd_t in samba_export_all_ro boolean.
- Add additionnal MLS attribute for oddjob_mkhomedir to create homedirs.
Resolves:#1113725
- Enable OpenStack cinder policy
- Add support for /usr/share/vdsm/daemonAdapter
- Add support for /var/run/gluster
Tue Dec 2 13:00:00 2014 Miroslav Grepl 3.13.1-13
- Remove old pkcsslotd.pp from minimum package
- Allow rlogind to use also rlogin ports.
- Add support for /usr/libexec/ntpdate-wrapper. Label it as ntpdate_exec_t.
- Allow bacula to connect also to postgresql.
- Label /usr/libexec/tomcat/server as tomcat_exec_t
- Add support for /usr/sbin/ctdbd_wrapper
- Add support for /usr/libexec/ppc64-diag/rtas_errd
- Allow rpm_script_roles to access system_mail_t
- Allow brltty to create /var/run/brltty
- Allow lsmd plugin to access netlink_route_socket
- Allow smbcontrol to read passwd
- Add support for /usr/libexec/sssd/selinux_child and create sssd_selinux_manager_t domain for it
Resolves:#1140106
- Allow osad to execute rhn_check
- Allow load_policy to rw inherited sssd pipes because of selinux_child
- Allow admin SELinux users mounting / as private within a new mount namespace as root in MLS
- Add additional fixes for su_restricted_domain_template to make moving to sysadm_r and trying to su working correctly
- Add additional booleans substitions
Tue Nov 25 13:00:00 2014 Miroslav Grepl 3.13.1-12
- Add seutil_dontaudit_access_check_semanage_module_store() interface
Resolves:#1140106
- Update to have all _systemctl() interface also init_reload_services().
- Dontaudit access check on SELinux module store for sssd.
- Add labeling for /sbin/iw.
- Allow named_filetrans_domain to create ibus directory with correct labeling.
Mon Nov 24 13:00:00 2014 Miroslav Grepl 3.13.1-11
- Allow radius to bind tcp/1812 radius port.
- Dontaudit list user_tmp files for system_mail_t.
- Label virt-who as virtd_exec_t.
- Allow rhsmcertd to send a null signal to virt-who running as virtd_t.
- Add missing alias for _content_rw_t.
Resolves:#1089177
- Allow spamd to access razor-agent.log.
- Add fixes for sfcb from libvirt-cim TestOnly bug.
- Allow NetworkManager stream connect on openvpn.
- Make /usr/bin/vncserver running as unconfined_service_t.
- getty_t should be ranged in MLS. Then also local_login_t runs as ranged domain.
- Label /etc/docker/certs.d as cert_t.
Tue Nov 18 13:00:00 2014 Miroslav Grepl 3.13.1-10
- Label /etc/strongimcv as ipsec_conf_file_t.
- Add support for /usr/bin/start-puppet-ca helper script
Resolves:#1160727
- Allow rpm scripts to enable/disable transient systemd units.
Resolves:#1154613
- Make kpropdas nsswitch domain
Resolves:#1153561
- Make all glance domain as nsswitch domains
Resolves:#1113281
- Allow selinux_child running as sssd access check on /etc/selinux/targeted/modules/active
- Allow access checks on setfiles/load_policy/semanage_lock for selinux_child running as sssd_t
Resolves:#1140106
Mon Nov 10 13:00:00 2014 Miroslav Grepl 3.13.1-9
- Dontaudit access check on setfiles/load_policy for sssd_t.
Resolves:#1140106
- Add kdump_rw_inherited_kdumpctl_tmp_pipes()
Resolves:#1156442
- Make linuxptp services as unconfined.
- Added new policy linuxptp.
Resolves:#1149693
- Label keystone cgi files as keystone_cgi_script_exec_t.
Resolves:#1138424
- Make tuned as unconfined domain
Thu Nov 6 13:00:00 2014 Miroslav Grepl 3.13.1-8
- Allow guest to connect to libvirt using unix_stream_socket.
- Allow all bus client domains to dbus chat with unconfined_service_t.
- Allow inetd service without own policy to run in inetd_child_t which is unconfined domain.
- Make opensm as nsswitch domain to make it working with sssd.
- Allow brctl to read meminfo.
- Allow winbind-helper to execute ntlm_auth in the caller domain.
Resolves:#1160339
- Make plymouthd as nsswitch domain to make it working with sssd.
Resolves:#1160196
- Make drbd as nsswitch domain to make it working with sssd.
- Make conman as nsswitch domain to make ipmitool.exp runing as conman_t working.
- Add support for /var/lib/sntp directory.
- Add fixes to allow docker to create more content in tmpfs ,and donaudit reading /proc
- Allow winbind to read usermodehelper
- Allow telepathy domains to execute shells and bin_t
- Allow gpgdomains to create netlink_kobject_uevent_sockets
- Allow mongodb to bind to the mongo port and mongos to run as mongod_t
- Allow abrt to read software raid state.
- Allow nslcd to execute netstat.
- Allow dovecot to create user\'s home directory when they log into IMAP.
- Allow login domains to create kernel keyring with different level.
Mon Nov 3 13:00:00 2014 Miroslav Grepl 3.13.1-7
- Allow modemmanger to connectto itself
Resolves:#1120152
- Allow pki_tomcat to create link files in /var/lib/pki-ca.
Resolves:#1121744
- varnishd needs to have fsetid capability
Resolves:#1125165
- Allow snapperd to dbus chat with system cron jobs.
Resolves:#1152447
- Allow dovecot to create user\'s home directory when they log into IMAP
Resolves:#1152773
- Add labeling for /usr/sbin/haproxy-systemd-wrapper wrapper to make haproxy running haproxy_t.
- ALlow listen and accept on tcp socket for init_t in MLS. Previously it was for xinetd_t.
- Allow nslcd to execute netstat.
- Add suppor for keepalived unconfined scripts and allow keepalived to read all domain state and kill capability.
- Allow nslcd to read /dev/urandom.
Thu Oct 16 14:00:00 2014 Miroslav Grepl 3.13.1-6
- Add back kill permisiion for system class
Resolves:#1150011
Wed Oct 15 14:00:00 2014 Miroslav Grepl 3.13.1-5
- Add back kill permisiion for service class
Resolves:#1150011
- Make rhsmcertd_t also as dbus domain.
- Allow named to create DNS_25 with correct labeling.
- Add cloudform_dontaudit_write_cloud_log()
- Call auth_use_nsswitch to apache to read/write cloud-init keys.
- Allow cloud-init to dbus chat with certmonger.
- Fix path to mon_statd_initrc_t script.
- Allow all RHCS services to read system state.
- Allow dnssec_trigger_t to execute unbound-control in own domain.
- kernel_read_system_state needs to be called with type. Moved it to antivirus.if.
- Added policy for mon_statd and mon_procd services. BZ (1077821)
- Allow opensm_t to read/write /dev/infiniband/umad1.
- Allow mongodb to manage own log files.
- Allow neutron connections to system dbus.
- Add support for /var/lib/swiftdirectory.
- Allow nova-scheduler to read certs.
- Allow openvpn to access /sys/fs/cgroup dir.
- Allow openvpn to execute systemd-passwd-agent in systemd_passwd_agent_t to make openvpn working with systemd.
- Fix samba_export_all_ro/samba_export_all_rw booleans to dontaudit search/read security files.
- Add auth_use_nsswitch for portreserve to make it working with sssd.
- automount policy is non-base module so it needs to be called in optional block.
- ALlow sensord to getattr on sysfs.
- Label /usr/share/corosync/corosync as cluster_exec_t.
- Allow lmsd_plugin to read passwd file. BZ(1093733)
- Allow read antivirus domain all kernel sysctls.
- Allow mandb to getattr on file systems
- Allow nova-console to connect to mem_cache port.
- Make sosreport as unconfined domain.
- Allow mondogdb to \'accept\' accesses on the tcp_socket port.
- ALlow sanlock to send a signal to virtd_t.
Thu Oct 9 14:00:00 2014 Miroslav Grepl 3.13.1-4
- Build also MLS policy
Resolves:#1138424
Thu Oct 9 14:00:00 2014 Miroslav Grepl 3.13.1-3
- Add back kill permisiion for system class
- Allow iptables read fail2ban logs.
- Fix radius labeled ports
- Add userdom_manage_user_tmpfs_files interface
- Allow libreswan to connect to VPN via NM-libreswan.
- Label 4101 tcp port as brlp port
- fix dev_getattr_generic_usb_dev interface
- Allow all domains to read fonts
- Make sure /run/systemd/generator and system is labeled correctly on creation.
- Dontaudit aicuu to search home config dir.
- Make keystone_cgi_script_t domain.
Resolves:#1138424
- Fix bug in drbd policy,
- Added support for cpuplug.
- ALlow sanlock_t to read sysfs_t.
- Added sendmail_domtrans_unconfined interface
- Fix broken interfaces
- radiusd wants to write own log files.
- Label /usr/libexec/rhsmd as rhsmcertd_exec_t
- Allow rhsmcertd send signull to setroubleshoot.
- Allow rhsmcertd manage rpm db.
- Added policy for blrtty.
- Fix keepalived policy
- Allow rhev-agentd dbus chat with systemd-logind.
- Allow keepalived manage snmp var lib sock files.
- Add support for /var/lib/graphite-web
- Allow NetworkManager to create Bluetooth SDP sockets
- It\'s going to do the the discovery for DUN service for modems with Bluez 5.
- Allow swift to connect to all ephemeral ports by default.
- Allow sssd to read selinux config to add SELinux user mapping.
- Allow lsmd to search own plguins.
- Allow abrt to read /dev/memto generate an unique machine_id and uses sosuploader\'s algorithm based off dmidecode[1] fields.
- ALlow zebra for user/group look-ups.
- Allow nova domains to getattr on all filesystems.
- Allow collectd sys_ptrace and dac_override caps because of reading of /proc/%i/io for several processes.
- Allow pppd to connect to /run/sstpc/sstpc-nm-sstp-service-28025 over unix stream socket.
- Allow rhnsd_t to manage also rhnsd config symlinks.
- ALlow user mail domains to create dead.letter.
- Allow rabbitmq_t read rabbitmq_var_lib_t lnk files.
- Allow pki-tomcat to change SELinux object identity.
- Allow radious to connect to apache ports to do OCSP check
- Allow git cgi scripts to create content in /tmp
- Allow cockpit-session to do GSSAPI logins.
- Allow sensord read in /proc
- Additional access required by usbmuxd
Thu Sep 18 14:00:00 2014 Miroslav Grepl 3.13.1-2
- Allow locate to look at files/directories without labels, and chr_file and blk_file on non dev file systems
- Label /usr/lib/erlang/erts.
*/bin files as bin_t
- Add files_dontaudit_access_check_home_dir() inteface.
- Allow udev_t mounton udev_var_run_t dirs #(1128618)
- Add systemd_networkd_var_run_t labeling for /var/run/systemd/netif and allow systemd-networkd to manage it.
- Add init_dontaudit_read_state() interface.
- Add label for ~/.local/share/fonts
- Allow unconfined_r to access unconfined_service_t.
- Allow init to read all config files
- Add new interface to allow creation of file with lib_t type
- Assign rabbitmq port.
- Allow unconfined_service_t to dbus chat with all dbus domains
- Add new interfaces to access users keys.
- Allow domains to are allowed to mounton proc to mount on files as well as dirs
- Fix labeling for HOME_DIR/tmp and HOME_DIR/.tmp directories.
- Add a port definition for shellinaboxd
- Label ~/tmp and ~/.tmp directories in user tmp dirs as user_tmp_t
- Allow userdomains to stream connect to pcscd for smart cards
- Allow programs to use pam to search through user_tmp_t dires (/tmp/.X11-unix)
- Update to rawhide-contrib changes
Resolves:#1123844
Thu Aug 21 14:00:00 2014 Miroslav Grepl 3.13.1-1
- Rebase to 3.13.1 which we have in Fedora21
Resolves:#1128284
Fri Jun 13 14:00:00 2014 Miroslav Grepl 3.12.1-156
- Back port fixes from Fedora. Mainly OpenStack and Docker fixes
Wed Jun 11 14:00:00 2014 Miroslav Grepl 3.12.1-155
- Add policy-rhel-7.1-{base,contrib} patches
Mon May 5 14:00:00 2014 Miroslav Grepl 3.12.1-154
- Add support for us_cli ports
- Fix labeling for /var/run/user//gvfs
- add support for tcp/9697
- Additional rules required by openstack, needs backport to F20 and RHEL7
- Additional access required by docker
- ALlow motion to use tcp/8082 port
- Allow init_t to setattr/relabelfrom dhcp state files
- Dontaudit antivirus domains read access on all security files by default
- Add missing alias for old amavis_etc_t type
- Allow block_suspend cap for haproxy
- Additional fixes for instack overcloud
- Allow OpenStack to read mysqld_db links and connect to MySQL
- Remove dup filename rules in gnome.te
- Allow sys_chroot cap for httpd_t and setattr on httpd_log_t
- Allow iscsid to handle own unit files
- Add iscsi_systemctl()
- Allow mongod to create also sock_files in /run with correct labeling
- Allow httpd to send signull to apache script domains and don\'t audit leaks
- Allow rabbitmq_beam to connect to httpd port
- Allow aiccu stream connect to pcscd
- Allow dmesg to read hwdata and memory dev
- Allow all freeipmi domains to read/write ipmi devices
- Allow sblim_sfcbd to use also pegasus-https port
- Allow rabbitmq_epmd to manage rabbit_var_log_t files
- Allow chronyd to read /sys/class/hwmon/hwmon1/device/temp2_input
- Allow docker to status any unit file and allow it to start generic unit files
Mon Apr 7 14:00:00 2014 Miroslav Grepl 3.12.1-153
- Change hsperfdata_root to have as user_tmp_t
Resolves:#1076523
Fri Apr 4 14:00:00 2014 Miroslav Grepl 3.12.1-152
- Fix Multiple same specifications for /var/named/chroot/dev/zero
- Add labels for /var/named/chroot_sdb/dev devices
- Add support for strongimcv
- Use kerberos_keytab_domains in auth_use_nsswitch
- Update auth_use_nsswitch to make all these types as kerberos_keytab_domain to
- Allow net_raw cap for neutron_t and send sigkill to dnsmasq
- Fix ntp_filetrans_named_content for sntp-kod file
- Add httpd_dbus_sssd boolean
- Dontaudit exec insmod in boinc policy
- Rename kerberos_keytab_domain to kerberos_keytab_domains
- Add kerberos_keytab_domain()
- Fix kerberos_keytab_template()
- Make all domains which use kerberos as kerberos_keytab_domain
Resolves:#1083670
- Allow kill capability to winbind_t
Wed Apr 2 14:00:00 2014 Miroslav Grepl 3.12.1-151
- varnishd wants chown capability
- update ntp_filetrans_named_content() interface
- Add additional fixes for neutron_t. #1083335
- Dontaudit getattr on proc_kcore_t
- Allow pki_tomcat_t to read ipa lib files
- Allow named_filetrans_domain to create /var/cache/ibus with correct labelign
- Allow init_t run /sbin/augenrules
- Add dev_unmount_sysfs_fs and sysnet_manage_ifconfig_run interfaces
- Allow unpriv SELinux user to use sandbox
- Add default label for /tmp/hsperfdata_root
Tue Apr 1 14:00:00 2014 Miroslav Grepl 3.12.1-149
- Add file subs also for /var/home
Mon Mar 31 14:00:00 2014 Miroslav Grepl 3.12.1-149
- Allow xauth_t to read user_home_dir_t lnk_file
- Add labeling for lightdm-data
- Allow certmonger to manage ipa lib files
- Add support for /var/lib/ipa
- Allow pegasus to getattr virt_content
- Added some new rules to pcp policy
- Allow chrome_sandbox to execute config_home_t
- Add support for ABRT FAF
Fri Mar 28 13:00:00 2014 Miroslav Grepl 3.12.1-148
- Allow kdm to send signull to remote_login_t process
- Add gear policy
- Turn on gear_port_t
- Allow cgit to read gitosis lib files by default
- Allow vdagent to read xdm state
- Allow NM and fcoeadm to talk together over unix_dgram_socket
Thu Mar 27 13:00:00 2014 Miroslav Grepl 3.12.1-147
- Back port fixes for pegasus_openlmi_admin_t from rawhide
Resolves:#1080973
- Add labels for ostree
- Add SELinux awareness for NM
- Label /usr/sbin/pwhistory_helper as updpwd_exec_t
Wed Mar 26 13:00:00 2014 Miroslav Grepl 3.12.1-146
- add gnome_append_home_config()
- Allow thumb to append GNOME config home files
- Allow rasdaemon to rw /dev/cpu//msr
- fix /var/log/pki file spec
- make bacula_t as auth_nsswitch domain
- Identify pki_tomcat_cert_t as a cert_type
- Define speech-dispater_exec_t as an application executable
- Add a new file context for /var/named/chroot/run directory
- update storage_filetrans_all_named_dev for sg
* devices
- Allow auditctl_t to getattr on all removeable devices
- Allow nsswitch_domains to stream connect to nmbd
- Allow unprivusers to connect to memcached
- label /var/lib/dirsrv/scripts-INSTANCE as bin_t
Mon Mar 24 13:00:00 2014 Miroslav Grepl 3.12.1-145
- Allow also unpriv user to run vmtools
- Allow secadm to read /dev/urandom and meminfo
Resolves:#1079250
- Add booleans to allow docker processes to use nfs and samba
- Add mdadm_tmpfs support
- Dontaudit net_amdin for /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.51-2.4.5.1.el7.x86_64/jre-abrt/bin/java running as pki_tomcat_t
- Allow vmware-user-sui to use user ttys
- Allow talk 2 users logged via console too
- Allow ftp services to manage xferlog_t
- Make all pcp domanis as unconfined for RHEL7.0 beucause of new policies
- allow anaconda to dbus chat with systemd-localed
Fri Mar 21 13:00:00 2014 Miroslav Grepl 3.12.1-144
- allow anaconda to dbus chat with systemd-localed
- Add fixes for haproxy based on bperkinsAATTredhat.com
- Allow cmirrord to make dmsetup working
- Allow NM to execute arping
- Allow users to send messages through talk
- Add userdom_tmp_role for secadm_t
Thu Mar 20 13:00:00 2014 Lukas Vrabec 3.12.1-143
- Add additional fixes for rtas_errd
- Fix transitions for tmp/tmpfs in rtas.te
- Allow rtas_errd to readl all sysctls
Wed Mar 19 13:00:00 2014 Miroslav Grepl 3.12.1-142
- Add support for /var/spool/rhsm/debug
- Make virt_sandbox_use_audit as True by default
- Allow svirt_sandbox_domains to ptrace themselves
Wed Mar 19 13:00:00 2014 Miroslav Grepl 3.12.1-141
- Allow docker containers to manage /var/lib/docker content
Mon Mar 17 13:00:00 2014 Miroslav Grepl 3.12.1-140
- Allow docker to read tmpfs_t symlinks
- Allow sandbox svirt_lxc_net_t to talk to syslog and to sssd over stream sockets
Mon Mar 17 13:00:00 2014 Miroslav Grepl 3.12.1-139
- Allow collectd to talk to libvirt
- Allow chrome_sandbox to use leaked unix_stream_sockets
- Dontaudit leaks of sockets into chrome_sandbox_t
- If you create a cups directory in /var/cache then it should be labeled cups_rw_etc_t
- Run vmtools as unconfined domains
- Allow snort to manage its log files
- Allow systemd_cronjob_t to be entered via bin_t
- Allow procman to list doveconf_etc_t
- allow keyring daemon to create content in tmpfs directories
- Add proper labelling for icedtea-web
- vpnc is creating content in networkmanager var run directory
- Label sddm as xdm_exec_t to make KDE working again
- Allow postgresql to read network state
- Allow java running as pki_tomcat to read network sysctls
- Fix cgroup.te to allow cgred to read cgconfig_etc_t
- Allow beam.smp to use ephemeral ports
- Allow winbind to use the nis to authenticate passwords
Fri Mar 14 13:00:00 2014 Lukas Vrabec 3.12.1-138
- Make rtas_errd_t as unconfined domain for F20.It needs additional fixes. It runs rpm at least.
- Allow net_admin cap for fence_virtd running as fenced_t
- Make abrt-java-connector working
- Make cimtest script 03_defineVS.py of ComputerSystem group working
- Fix git_system_enable_homedirs boolean
- Allow munin mail plugins to read network systcl
Thu Mar 13 13:00:00 2014 Miroslav Grepl 3.12.1-137
- Allow vmtools_helper_t to execute bin_t
- Add support for /usr/share/joomla
- /var/lib/containers should be labeled as openshift content for now
- Allow docker domains to talk to the login programs, to allow a process to login into the container
- Allow install_t do dbus chat with NM
- Fix interface names in anaconda.if
- Add install_t for anaconda. A new type is a part of anaconda policy
- sshd to read network sysctls
Wed Mar 12 13:00:00 2014 Miroslav Grepl 3.12.1-136
- Allow zabbix to send system log msgs
- Allow init_t to stream connect to ipsec
Resolves:#1060775
Tue Mar 11 13:00:00 2014 Miroslav Grepl 3.12.1-135
- Add docker_connect_any boolean
Tue Mar 11 13:00:00 2014 Miroslav Grepl 3.12.1-134
- Allow unpriv SELinux users to dbus chat with firewalld
- Add lvm_write_metadata()
- Label /etc/yum.reposd dir as system_conf_t. Should be safe because system_conf_t is base_ro_file_type
- Allow pegasus_openlmi_storage_t to write lvm metadata
- Add hide_broken_symptoms for kdumpgui because of systemd bug
- Make kdumpgui_t as unconfined domain
Resolves:#1044299
- Allow docker to connect to tcp/5000
Mon Mar 10 13:00:00 2014 Miroslav Grepl 3.12.1-133
- Allow numad to write scan_sleep_millisecs
- Turn on entropyd_use_audio boolean by default
- Allow cgred to read /etc/cgconfig.conf because it contains templates used together with rules from /etc/cgrules.conf.
- Allow lscpu running as rhsmcertd_t to read /proc/sysinfo
- Fix label on irclogs in the homedir
- Allow kerberos_keytab_domain domains to manage keys until we get sssd fix
- Allow postgresql to use ldap
- Add missing syslog-conn port
- Add support for /dev/vmcp and /dev/sclp
Resolves:#1069310
Fri Mar 7 13:00:00 2014 Miroslav Grepl 3.12.1-132
- Modify xdm_write_home to allow create files/links in /root with xdm_home_
- Allow virt domains to read network state
Resolves:#1072019
Thu Mar 6 13:00:00 2014 Miroslav Grepl 3.12.1-131
- Added pcp rules
- dontaudit openshift_cron_t searching random directories, should be back ported to RHEL6
- clean up ctdb.te
- Allow ctdbd to connect own ports
- Fix samba_export_all_rw booleanto cover also non security dirs
- Allow swift to exec rpm in swift_t and allow to create tmp files/dirs
- Allow neutron to create /run/netns with correct labeling
- Allow certmonger to list home dirs
Wed Mar 5 13:00:00 2014 Miroslav Grepl 3.12.1-130
- Change userdom_use_user_inherited_ttys to userdom_use_user_ttys for systemd-tty-ask
- Add sysnet_filetrans_named_content_ifconfig() interface
- Allow ctdbd to connect own ports
- Fix samba_export_all_rw booleanto cover also non security dirs
- Allow swift to exec rpm in swift_t and allow to create tmp files/dirs
- Allow neutron to create /run/netns with correct labeling
- Allow kerberos keytab domains to manage sssd/userdomain keys\"
- Allow to run ip cmd in neutron_t domain
Mon Mar 3 13:00:00 2014 Miroslav Grepl 3.12.1-129
- Allow block_suspend cap2 for systemd-logind and rw dri device
- Add labeling for /usr/libexec/nm-libreswan-service
- Allow locallogin to rw xdm key to make Virtual Terminal login providing smartcard pin working
- Add xserver_rw_xdm_keys()
- Allow rpm_script_t to dbus chat also with systemd-located
- Fix ipa_stream_connect_otpd()
- update lpd_manage_spool() interface
- Allow krb5kdc to stream connect to ipa-otpd
- Add ipa_stream_connect_otpd() interface
- Allow vpnc to unlink NM pids
- Add networkmanager_delete_pid_files()
- Allow munin plugins to access unconfined plugins
- update abrt_filetrans_named_content to cover /var/spool/debug
- Label /var/spool/debug as abrt_var_cache_t
- Allow rhsmcertd to connect to squid port
- Make docker_transition_unconfined as optional boolean
- Allow certmonger to list home dirs
Wed Feb 26 13:00:00 2014 Miroslav Grepl 3.12.1-128
- Make snapperd as unconfined domain and add additional fixes for it
- Remove nsplugin.pp module on upgrade
Tue Feb 25 13:00:00 2014 Miroslav Grepl 3.12.1-127
- Add snapperd_home_t for HOME_DIR/.snapshots directory
- Make sosreport as unconfined domain
- Allow sosreport to execute grub2-probe
- Allow NM to manage hostname config file
- Allow systemd_timedated_t to dbus chat with rpm_script_t
- Allow lsmd plugins to connect to http/ssh/http_cache ports by default
- Add lsmd_plugin_connect_any boolean
- Allow mozilla_plugin to attempt to set capabilities
- Allow lsdm_plugins to use tcp_socket
- Dontaudit mozilla plugin from getattr on /proc or /sys
- Dontaudit use of the keyring by the services in a sandbox
- Dontaudit attempts to sys_ptrace caused by running ps for mysqld_safe_t
- Allow rabbitmq_beam to connect to jabber_interserver_port
- Allow logwatch_mail_t to transition to qmail_inject and queueu
- Added new rules to pcp policy
- Allow vmtools_helper_t to change role to system_r
- Allow NM to dbus chat with vmtools
- Fix couchdb_manage_files() to allow manage couchdb conf files
- Add support for /var/run/redis.sock
- dontaudit gpg trying to use audit
- Allow consolekit to create log directories and files
- Fix vmtools policy to allow user roles to access vmtools_helper_t
- Allow block_suspend cap2 for ipa-otpd
- Allow pkcsslotd to read users state
- Add ioctl to init_dontaudit_rw_stream_socket
- Add systemd_hostnamed_manage_config() interface
- Remove transition for temp dirs created by init_t
- gdm-simple-slave uses use setsockopt
- sddm-greater is a xdm type program
Tue Feb 18 13:00:00 2014 Miroslav Grepl 3.12.1-126
- Add lvm_read_metadata()
- Allow auditadm to search /var/log/audit dir
- Add lvm_read_metadata() interface
- Allow confined users to run vmtools helpers
- Fix userdom_common_user_template()
- Generic systemd unit scripts do write check on /
- Allow init_t to create init_tmp_t in /tmp.This is for temporary content created by generic unit files
- Add additional fixes needed for init_t and setup script running in generic unit files
- Allow general users to create packet_sockets
- added connlcli port
- Add init_manage_transient_unit() interface
- Allow init_t (generic unit files) to manage rpc state date as we had it for initrc_t
- Fix userdomain.te to require passwd class
- devicekit_power sends out a signal to all processes on the message bus when power is going down
- Dontaudit rendom domains listing /proc and hittping system_map_t
- Dontauit leaks of var_t into ifconfig_t
- Allow domains that transition to ssh_t to manipulate its keyring
- Define oracleasm_t as a device node
- Change to handle /root as a symbolic link for os-tree
- Allow sysadm_t to create packet_socket, also move some rules to attributes
- Add label for openvswitch port
- Remove general transition for files/dirs created in /etc/mail which got etc_aliases_t label.
- Allow postfix_local to read .forward in pcp lib files
- Allow pegasus_openlmi_storage_t to read lvm metadata
- Add additional fixes for pegasus_openlmi_storage_t
- Allow bumblebee to manage debugfs
- Make bumblebee as unconfined domain
- Allow snmp to read etc_aliases_t
- Allow lscpu running in pegasus_openlmi_storage_t to read /dev/mem
- Allow pegasus_openlmi_storage_t to read /proc/1/environ
- Dontaudit read gconf files for cupsd_config_t
- make vmtools as unconfined domain
- Add vmtools_helper_t for helper scripts. Allow vmtools shutdonw a host and run ifconfig.
- Allow collectd_t to use a mysql database
- Allow ipa-otpd to perform DNS name resolution
- Added new policy for keepalived
- Allow openlmi-service provider to manage transitient units and allow stream connect to sssd
- Add additional fixes new pscs-lite+polkit support
- Add labeling for /run/krb5kdc
- Change w3c_validator_tmp_t to httpd_w3c_validator_tmp_t in F20
- Allow pcscd to read users proc info
- Dontaudit smbd_t sending out random signuls
- Add boolean to allow openshift domains to use nfs
- Allow w3c_validator to create content in /tmp
- zabbix_agent uses nsswitch
- Allow procmail and dovecot to work together to deliver mail
- Allow spamd to execute files in homedir if boolean turned on
- Allow openvswitch to listen on port 6634
- Add net_admin capability in collectd policy
- Fixed snapperd policy
- Fixed bugsfor pcp policy
- Allow dbus_system_domains to be started by init
- Fixed some interfaces
- Add kerberos_keytab_domain attribute
- Fix snapperd_conf_t def
Tue Feb 11 13:00:00 2014 Miroslav Grepl 3.12.1-125
- Addopt corenet rules for unbound-anchor to rpm_script_t
- Allow runuser to send send audit messages.
- Allow postfix-local to search .forward in munin lib dirs
- Allow udisks to connect to D-Bus
- Allow spamd to connect to spamd port
- Fix syntax error in snapper.te
- Dontaudit osad to search gconf home files
- Allow rhsmcertd to manage /etc/sysconf/rhn director
- Fix pcp labeling to accept /usr/bin for all daemon binaries
- Fix mcelog_read_log() interface
- Allow iscsid to manage iscsi lib files
- Allow snapper domtrans to lvm_t. Add support for /etc/snapper and allow snapperd to manage it.
- Make tuned_t as unconfined domain for RHEL7.0
- Allow ABRT to read puppet certs
- Add sys_time capability for virt-ga
- Allow gemu-ga to domtrans to hwclock_t
- Allow additional access for virt_qemu_ga_t processes to read system clock and send audit messages
- Fix some AVCs in pcp policy
- Add to bacula capability setgid and setuid and allow to bind to bacula ports
- Changed label from rhnsd_rw_conf_t to rhnsd_conf_t
- Add access rhnsd and osad to /etc/sysconfig/rhn
- drbdadm executes drbdmeta
- Fixes needed for docker
- Allow epmd to manage /var/log/rabbitmq/startup_err file
- Allow beam.smp connect to amqp port
- Modify xdm_write_home to allow create also links as xdm_home_t if the boolean is on true
- Allow init_t to manage pluto.ctl because of init_t instead of initrc_t
- Allow systemd_tmpfiles_t to manage all non security files on the system
- Added labels for bacula ports
- Fix label on /dev/vfio/vfio
- Add kernel_mounton_messages() interface
- init wants to manage lock files for iscsi
Mon Feb 3 13:00:00 2014 Miroslav Grepl 3.12.1-124
- Added osad policy
- Allow postfix to deliver to procmail
- Allow bumblebee to seng kill signal to xserver
- Allow vmtools to execute /usr/bin/lsb_release
- Allow docker to write system net ctrls
- Add support for rhnsd unit file
- Add dbus_chat_session_bus() interface
- Add dbus_stream_connect_session_bus() interface
- Fix pcp.te
- Fix logrotate_use_nfs boolean
- Add lot of pcp fixes found in RHEL7
- fix labeling for pmie for pcp pkg
- Change thumb_t to be allowed to chat/connect with session bus type
- Allow call renice in mlocate
- Add logrotate_use_nfs boolean
- Allow setroubleshootd to read rpc sysctl
Fri Jan 31 13:00:00 2014 Miroslav Grepl 3.12.1-123
- Turn on bacula, rhnsd policy
- Add support for rhnsd unit file
- Add dbus_chat_session_bus() interface
- Add dbus_stream_connect_session_bus() interface
- Fix logrotate_use_nfs boolean
- Add lot of pcp fixes found in RHEL7
- fix labeling for pmie for pcp pkg
- Change thumb_t to be allowed to chat/connect with session bus type
- Allow call renice in mlocate
- Add logrotate_use_nfs boolean
- Allow setroubleshootd to read rpc sysctl
- Fixes for
*_admin interfaces
- Add pegasus_openlmi_storage_var_run_t type def
- Add support for /var/run/openlmi-storage
- Allow tuned to create syslog.conf with correct labeling
- Add httpd_dontaudit_search_dirs boolean
- Add support for winbind.service
- ALlow also fail2ban-client to read apache logs
- Allow vmtools to getattr on all fs
- Add support for dey_sapi port
- Add logging_filetrans_named_conf()
- Allow passwd_t to use ipc_lock, so that it can change the password in gnome-keyring
Tue Jan 28 13:00:00 2014 Miroslav Grepl 3.12.1-122
- Update snapper policy
- Allow domains to append rkhunter lib files
- Allow snapperd to getattr on all fs
- Allow xdm to create /var/gdm with correct labeling
- Add label for snapper.log
- Allow fail2ban-client to read apache log files
- Allow thumb_t to execute dbus-daemon in thumb_t
Mon Jan 27 13:00:00 2014 Miroslav Grepl 3.12.1-121
- Allow gdm to create /var/gdm with correct labeling
- Allow domains to append rkhunterl lib files. #1057982
- Allow systemd_tmpfiles_t net_admin to communicate with journald
- Add interface to getattr on an isid_type for any type of file
- Update libs_filetrans_named_content() to have support for /usr/lib/debug directory
- Allow initrc_t domtrans to authconfig if unconfined is enabled
- Allow docker and mount on devpts chr_file
- Allow docker to transition to unconfined_t if boolean set
- init calling needs to be optional in domain.te
- Allow uncofined domain types to handle transient unit files
- Fix labeling for vfio devices
- Allow net_admin capability and send system log msgs
- Allow lldpad send dgram to NM
- Add networkmanager_dgram_send()
- rkhunter_var_lib_t is correct type
- Back port pcp policy from rawhide
- Allow openlmi-storage to read removable devices
- Allow system cron jobs to manage rkhunter lib files
- Add rkhunter_manage_lib_files()
- Fix ftpd_use_fusefs boolean to allow manage also symlinks
- Allow smbcontrob block_suspend cap2
- Allow slpd to read network and system state info
- Allow NM domtrans to iscsid_t if iscsiadm is executed
- Allow slapd to send a signal itself
- Allow sslget running as pki_ra_t to contact port 8443, the secure port of the CA.
- Fix plymouthd_create_log() interface
- Add rkhunter policy with files type definition for /var/lib/rkhunter until it is fixed in rkhunter package
- Add mozilla_plugin_exec_t for /usr/lib/firefox/plugin-container
- Allow postfix and cyrus-imapd to work out of box
- Allow fcoemon to talk with unpriv user domain using unix_stream_socket
- Dontaudit domains that are calling into journald to net_admin
- Add rules to allow vmtools to do what it does
- snapperd is D-Bus service
- Allow OpenLMI PowerManagement to call \'systemctl --force reboot\'
- Add haproxy_connect_any boolean
- Allow haproxy also to use http cache port by default
Resolves:#1058248
Tue Jan 21 13:00:00 2014 Miroslav Grepl 3.12.1-120
- Allow apache to write to the owncloud data directory in /var/www/html...
- Allow consolekit to create log dir
- Add support for icinga CGI scripts
- Add support for icinga
- Allow kdumpctl_t to create kdump lock file
Resolves:#1055634
- Allow kdump to create lnk lock file
- Allow nscd_t block_suspen capability
- Allow unconfined domain types to manage own transient unit file
- Allow systemd domains to handle transient init unit files
- Add interfaces to handle transient
Mon Jan 20 13:00:00 2014 Miroslav Grepl 3.12.1-119
- Add cron unconfined role support for uncofined SELinux user
- Call corenet_udp_bind_all_ports() in milter.te
- Allow fence_virtd to connect to zented port
- Fix header for mirrormanager_admin()
- Allow dkim-milter to bind udp ports
- Allow milter domains to send signull itself
- Allow block_suspend for yum running as mock_t
- Allow beam.smp to manage couchdb files
- Add couchdb_manage_files()
- Add labeling for /var/log/php_errors.log
- Allow bumblebee to stream connect to xserver
- Allow bumblebee to send a signal to xserver
- gnome-thumbnail to stream connect to bumblebee
- Allow xkbcomp running as bumblebee_t to execute bin_t
- Allow logrotate to read squid.conf
- Additional rules to get docker and lxc to play well with SELinux
- Allow bumbleed to connect to xserver port
- Allow pegasus_openlmi_storage_t to read hwdata
Thu Jan 16 13:00:00 2014 Miroslav Grepl 3.12.1-118
- Allow init_t to work on transitient and snapshot unit files
- Add logging_manage_syslog_config()
- Update sysnet_dns_name_resolve() to allow connect to dnssec por
- Allow pegasus_openlmi_storage_t to read hwdata
Resolves:#1031721
- Fix rhcs_rw_cluster_tmpfs()
- Allow fenced_t to bind on zented udp port
- Added policy for vmtools
- Fix mirrormanager_read_lib_files()
- Allow mirromanager scripts running as httpd_t to manage mirrormanager pid files
- Allow ctdb to create sock files in /var/run/ctdb
- Add sblim_filetrans_named_content() interface
- Allow rpm scritplets to create /run/gather with correct labeling
- Allow gnome keyring domains to create gnome config dirs
- Dontaudit read/write to init stream socket for lsmd_plugin_t
- Allow automount to read nfs link files
- Allow lsm plugins to read/write lsmd stream socket
- Allow certmonger to connect ldap port to make IPA CA certificate renewal working.
- Add also labeling for /var/run/ctdb
- Add missing labeling for /var/lib/ctdb
- ALlow tuned to manage syslog.conf. Should be fixed in tuned. #1030446
- Dontaudit hypervkvp to search homedirs
- Dontaudit hypervkvp to search admin homedirs
- Allow hypervkvp to execute bin_t and ifconfig in the caller domain
- Dontaudit xguest_t to read ABRT conf files
- Add abrt_dontaudit_read_config()
- Allow namespace-init to getattr on fs
- Add thumb_role() also for xguest
- Add filename transitions to create .spamassassin with correct labeling
- Allow apache domain to read mirrormanager pid files
- Allow domains to read/write shm and sem owned by mozilla_plugin_t
- Allow alsactl to send a generic signal to kernel_t
Tue Jan 14 13:00:00 2014 Miroslav Grepl 3.12.1-117
- Add back rpm_run() for unconfined user
Tue Jan 14 13:00:00 2014 Miroslav Grepl 3.12.1-116
- Add missing files_create_var_lib_dirs()
- Fix typo in ipsec.te
- Allow passwd to create directory in /var/lib
- Add filename trans also for event21
- Allow iptables command to read /dev/rand
- Add sigkill capabilityfor ipsec_t
- Add filename transitions for bcache devices
- Add additional rules to create /var/log/cron by syslogd_t with correct labeling
- Add give everyone full access to all key rings
- Add default lvm_var_run_t label for /var/run/multipathd
- Fix log labeling to have correct default label for them after logrotate
- Labeled ~/.nv/GLCache as being gstreamer output
- Allow nagios_system_plugin to read mrtg lib files
- Add mrtg_read_lib_files()
- Call rhcs_rw_cluster_tmpfs for dlm_controld
- Make authconfing as named_filetrans domain
- Allow virsh to connect to user process using stream socket
- Allow rtas_errd to read rand/urand devices and add chown capability
- Fix labeling from /var/run/net-snmpd to correct /var/run/net-snmp
Resolves:#1051497
- Add also chown cap for abrt_upload_watch_t. It already has dac_override
- Allow sosreport to manage rhsmcertd pid files
- Add rhsmcertd_manage_pid_files()
- Allow also setgid cap for rpc.gssd
- Dontaudit access check for abrt on cert_t
- Allow pegasus_openlmi_system providers to dbus chat with systemd-logind
Fri Jan 10 13:00:00 2014 Miroslav Grepl 3.12.1-115
- Fix semanage import handling in spec file
Fri Jan 10 13:00:00 2014 Miroslav Grepl 3.12.1-114
- Add default lvm_var_run_t label for /var/run/multipathd
Resolves:#1051430
- Fix log labeling to have correct default label for them after logrotate
- Add files_write_root_dirs
- Add new openflow port label for 6653/tcp and 6633/tcp
- Add xserver_manage_xkb_libs()
- Label tcp/8891 as milter por
- Allow gnome_manage_generic_cache_files also create cache_home_t files
- Fix aide.log labeling
- Fix log labeling to have correct default label for them after logrotate
- Allow mysqld-safe write access on /root to make mysqld working
- Allow sosreport domtrans to prelikn
- Allow OpenvSwitch to connec to openflow ports
- Allow NM send dgram to lldpad
- Allow hyperv domains to execute shell
- Allow lsmd plugins stream connect to lsmd/init
- Allow sblim domains to create /run/gather with correct labeling
- Allow httpd to read ldap certs
- Allow cupsd to send dbus msgs to process with different MLS level
- Allow bumblebee to stream connect to apmd
- Allow bumblebee to run xkbcomp
- Additional allow rules to get libvirt-lxc containers working with docker
- Additional allow rules to get libvirt-lxc containers working with docker
- Allow docker to getattr on itself
- Additional rules needed for sandbox apps
- Allow mozilla_plugin to set attributes on usb device if use_spice boolean enabled
- httpd should be able to send signal/signull to httpd_suexec_t
- Add more fixes for neturon. Domtrans to dnsmasq, iptables. Make neutron as filenamtrans domain.
Wed Jan 8 13:00:00 2014 Miroslav Grepl 3.12.1-113
- Add neutron fixes
Mon Jan 6 13:00:00 2014 Miroslav Grepl 3.12.1-112
- Allow sshd to write to all process levels in order to change passwd when running at a level
- Allow updpwd_t to downgrade /etc/passwd file to s0, if it is not running with this range
- Allow apcuspd_t to status and start the power unit file
- Allow udev to manage kdump unit file
- Added new interface modutils_dontaudit_exec_insmod
- Allow cobbler to search dhcp_etc_t directory
- systemd_systemctl needs sys_admin capability
- Allow sytemd_tmpfiles_t to delete all directories
- passwd to create gnome-keyring passwd socket
- Add missing zabbix_var_lib_t type
- Fix filename trans for zabbixsrv in zabbix.te
- Allow fprintd_t to send syslog messages
- Add zabbix_var_lib_t for /var/lib/zabbixsrv, also allow zabix to connect to smtp port
- Allow mozilla plugin to chat with policykit, needed for spice
- Allow gssprozy to change user and gid, as well as read user keyrings
- Label upgrades directory under /var/www as httpd_sys_rw_content_t, add other filetrans rules to label content correctly
- Allow polipo to connect to http_cache_ports
- Allow cron jobs to manage apache var lib content
- Allow yppassword to manage the passwd_file_t
- Allow showall_t to send itself signals
- Allow cobbler to restart dhcpc, dnsmasq and bind services
- Allow certmonger to manage home cert files
- Add userdom filename trans for user mail domains
- Allow apcuspd_t to status and start the power unit file
- Allow cgroupdrulesengd to create content in cgoups directories
- Allow smbd_t to signull cluster
- Allow gluster daemon to create fifo files in glusterd_brick_t and sock_file in glusterd_var_lib_t
- Add label for /var/spool/cron.aquota.user
- Allow sandbox_x domains to use work with the mozilla plugin semaphore
- Added new policy for speech-dispatcher
- Added dontaudit rule for insmod_exec_t in rasdaemon policy
- Updated rasdaemon policy
- Allow system_mail_t to transition to postfix_postdrop_t
- Clean up mirrormanager policy
- Allow virt_domains to read cert files, needs backport to RHEL7
- Allow sssd to read systemd_login_var_run_t
- Allow irc_t to execute shell and bin-t files:
- Add new access for mythtv
- Allow rsync_t to manage all non auth files
- allow modemmanger to read /dev/urand
- Allow sandbox apps to attempt to set and get capabilties
Thu Dec 19 13:00:00 2013 Miroslav Grepl 3.12.1-111
- Add labeling for /var/lib/servicelog/servicelog.db-journal
- Add support for freeipmi port
- Add sysadm_u_default_contexts
- Make new type to texlive files in homedir
- Allow subscription-manager running as sosreport_t to manage rhsmcertd
- Additional fixes for docker.te
- Remove ability to do mount/sys_admin by default in virt_sandbox domains
- New rules required to run docker images within libivrt
- Add label for ~/.cvsignore
- Change mirrormanager to be run by cron
- Add mirrormanager policy
- Fixed bumblebee_admin() and mip6d_admin()
- Add log support for sensord
- Fix typo in docker.te
- Allow amanda to do backups over UDP
- Allow bumblebee to read /etc/group and clean up bumblebee.te
- type transitions with a filename not allowed inside conditionals
- Don\'t allow virt-sandbox tools to use netlink out of the box, needs back port to RHEL7
- Make new type to texlive files in homedir
Thu Dec 12 13:00:00 2013 Miroslav Grepl 3.12.1-110
- Allow freeipmi_ipmidetectd_t to use freeipmi port
- Update freeipmi_domain_template()
- Allow journalctl running as ABRT to read /run/log/journal
- Allow NM to read dispatcher.d directory
- Update freeipmi policy
- Type transitions with a filename not allowed inside conditionals
- Allow tor to bind to hplip port
- Make new type to texlive files in homedir
- Allow zabbix_agent to transition to dmidecode
- Add rules for docker
- Allow sosreport to send signull to unconfined_t
- Add virt_noatsecure and virt_rlimitinh interfaces
- Fix labeling in thumb.fc to add support for /usr/lib64/tumbler-1/tumblerddd support for freeipmi port
- Add sysadm_u_default_contexts
- Add logging_read_syslog_pid()
- Fix userdom_manage_home_texlive() interface
- Make new type to texlive files in homedir
- Add filename transitions for /run and /lock links
- Allow virtd to inherit rlimit information
Resolves:#975358
Tue Dec 10 13:00:00 2013 Miroslav Grepl 3.12.1-109
- Change labeling for /usr/libexec/nm-dispatcher.action to NetworkManager_exec_t
Resolves:#1039879
- Add labeling for /usr/lib/systemd/system/mariadb.service
- Allow hyperv_domain to read sysfs
- Fix ldap_read_certs() interface to allow acess also link files
- Add support for /usr/libexec/pegasus/cmpiLMI_Journald-cimprovagt
- Allow tuned to run modprobe
- Allow portreserve to search /var/lib/sss dir
- Add SELinux support for the teamd package contains team network device control daemon.
- Dontaudit access check on /proc for bumblebee
- Bumblebee wants to load nvidia modules
- Fix rpm_named_filetrans_log_files and wine.te
- Add conman policy for rawhide
- DRM master and input event devices are used by the TakeDevice API
- Clean up bumblebee policy
- Update pegasus_openlmi_storage_t policy
- Add freeipmi_stream_connect() interface
- Allow logwatch read madm.conf to support RAID setup
- Add raid_read_conf_files() interface
- Allow up2date running as rpm_t create up2date log file with rpm_log_t labeling
- add rpm_named_filetrans_log_files() interface
- Allow dkim-milter to create files/dirs in /tmp
- update freeipmi policy
- Add policy for freeipmi services
- Added rdisc_admin and rdisc_systemctl interfaces
- opensm policy clean up
- openwsman policy clean up
- ninfod policy clean up
- Added new policy for ninfod
- Added new policy for openwsman
- Added rdisc_admin and rdisc_systemctl interfaces
- Fix kernel_dontaudit_access_check_proc()
- Add support for /dev/uhid
- Allow sulogin to get the attributes of initctl and sys_admin cap
- Add kernel_dontaudit_access_check_proc()
- Fix dev_rw_ipmi_dev()
- Fix new interface in devices.if
- DRM master and input event devices are used by the TakeDevice API
- add dev_rw_inherited_dri() and dev_rw_inherited_input_dev()
- Added support for default conman port
- Add interfaces for ipmi devices
Wed Dec 4 13:00:00 2013 Miroslav Grepl 3.12.1-108
- Allow sosreport to send a signal to ABRT
- Add proper aliases for pegasus_openlmi_service_exec_t and pegasus_openlmi_service_t
- Label /usr/sbin/htcacheclean as httpd_exec_t
Resolves:#1037529
- Added support for rdisc unit file
- Add antivirus_db_t labeling for /var/lib/clamav-unofficial-sigs
- Allow runuser running as logrotate connections to system DBUS
- Label bcache devices as fixed_disk_device_t
- Allow systemctl running in ipsec_mgmt_t to access /usr/lib/systemd/system/ipsec.service
- Label /usr/lib/systemd/system/ipsec.service as ipsec_mgmt_unit_file_t
Mon Dec 2 13:00:00 2013 Miroslav Grepl 3.12.1-107
- Add back setpgid/setsched for sosreport_t
Mon Dec 2 13:00:00 2013 Dan Walsh 3.12.1-106
- Added fix for clout_init to transition to rpm_script_t (dwalshAATTredhat.com)
Tue Nov 26 13:00:00 2013 Miroslav Grepl 3.12.1-105
- Dontaudit openshift domains trying to use rawip_sockets, this is caused by a bad check in the kernel.
- Allow git_system_t to read git_user_content if the git_system_enable_homedirs boolean is turned on
- Add lsmd_plugin_t for lsm plugins
- Allow dovecot-deliver to search mountpoints
- Add labeling for /etc/mdadm.conf
- Allow opelmi admin providers to dbus chat with init_t
- Allow sblim domain to read /dev/urandom and /dev/random
- Allow apmd to request the kernel load modules
- Add glusterd_brick_t type
- label mate-keyring-daemon with gkeyringd_exec_t
- Add plymouthd_create_log()
- Dontaudit leaks from openshift domains into mail domains, needs back port to RHEL6
- Allow sssd to request the kernel loads modules
- Allow gpg_agent to use ssh-add
- Allow gpg_agent to use ssh-add
- Dontaudit access check on /root for myslqd_safe_t
- Allow ctdb to getattr on al filesystems
- Allow abrt to stream connect to syslog
- Allow dnsmasq to list dnsmasq.d directory
- Watchdog opens the raw socket
- Allow watchdog to read network state info
- Dontaudit access check on lvm lock dir
- Allow sosreport to send signull to setroubleshootd
- Add setroubleshoot_signull() interface
- Fix ldap_read_certs() interface
- Allow sosreport all signal perms
- Allow sosreport to run systemctl
- Allow sosreport to dbus chat with rpm
- Add glusterd_brick_t files type
- Allow zabbix_agentd to read all domain state
- Clean up rtas.if
- Allow smoltclient to execute ldconfig
- Allow sosreport to request the kernel to load a module
- Fix userdom_confined_admin_template()
- Add back exec_content boolean for secadm, logadm, auditadm
- Fix files_filetrans_system_db_named_files() interface
- Allow sulogin to getattr on /proc/kcore
- Add filename transition also for servicelog.db-journal
- Add files_dontaudit_access_check_root()
- Add lvm_dontaudit_access_check_lock() interface
Thu Nov 21 13:00:00 2013 Miroslav Grepl 3.12.1-104
- Allow watchdog to read /etc/passwd
- Allow browser plugins to connect to bumblebee
- New policy for bumblebee and freqset
- Add new policy for mip6d daemon
- Add new policy for opensm daemon
- Allow condor domains to read/write condor_master udp_socket
- Allow openshift_cron_t to append to openshift log files, label /var/log/openshift
- Add back file_pid_filetrans for /var/run/dlm_controld
- Allow smbd_t to use inherited tmpfs content
- Allow mcelog to use the /dev/cpu device
- sosreport runs rpcinfo
- sosreport runs subscription-manager
- Allow staff_t to run frequency command
- Allow systemd_tmpfiles to relabel log directories
- Allow staff_t to read xserver_log file
- Label hsperfdata_root as tmp_t
Wed Nov 20 13:00:00 2013 Miroslav Grepl 3.12.1-103
- More sosreport fixes to make ABRT working
Fri Nov 15 13:00:00 2013 Miroslav Grepl 3.12.1-102
- Fix files_dontaudit_unmount_all_mountpoints()
- Add support for 2608-2609 tcp/udp ports
- Should allow domains to lock the terminal device
- More fixes for user config files to make crond_t running in userdomain
- Add back disable/reload/enable permissions for system class
- Fix manage_service_perms macro
- We need to require passwd rootok
- Fix zebra.fc
- Fix dnsmasq_filetrans_named_content() interface
- Allow all sandbox domains create content in svirt_home_t
- Allow zebra domains also create zebra_tmp_t files in /tmp
- Add support for new zebra services:isisd,babeld. Add systemd support for zebra services.
- Fix labeling on neutron and remove transition to iconfig_t
- abrt needs to read mcelog log file
- Fix labeling on dnsmasq content
- Fix labeling on /etc/dnsmasq.d
- Allow glusterd to relabel own lib files
- Allow sandbox domains to use pam_rootok, and dontaudit attempts to unmount file systems, this is caused by a bug in systemd
- Allow ipc_lock for abrt to run journalctl
Thu Nov 14 13:00:00 2013 Miroslav Grepl 3.12.1-101
- Fix config.tgz
Tue Nov 12 13:00:00 2013 Miroslav Grepl 3.12.1-100
- Fix passenger_stream_connect interface
- setroubleshoot_fixit wants to read network state
- Allow procmail_t to connect to dovecot stream sockets
- Allow cimprovagt service providers to read network states
- Add labeling for /var/run/mariadb
- pwauth uses lastlog() to update system\'s lastlog
- Allow account provider to read login records
- Add support for texlive2013
- More fixes for user config files to make crond_t running in userdomain
- Add back disable/reload/enable permissions for system class
- Fix manage_service_perms macro
- Allow passwd_t to connect to gnome keyring to change password
- Update mls config files to have cronjobs in the user domains
- Remove access checks that systemd does not actually do
Fri Nov 8 13:00:00 2013 Miroslav Grepl 3.12.1-99
- Add support for yubikey in homedir
- Add support for upd/3052 port
- Allow apcupsd to use PowerChute Network Shutdown
- Allow lsmd to execute various lsmplugins
- Add labeling also for /etc/watchdog\\.d where are watchdog scripts located too
- Update gluster_export_all_rw boolean to allow relabel all base file types
- Allow x86_energy_perf tool to modify the MSR
- Fix /var/lib/dspam/data labeling
Wed Nov 6 13:00:00 2013 Miroslav Grepl 3.12.1-98
- Add files_relabel_base_file_types() interface
- Allow netlabel-config to read passwd
- update gluster_export_all_rw boolean to allow relabel all base file types caused by lsetxattr()
- Allow x86_energy_perf tool to modify the MSR
- Fix /var/lib/dspam/data labeling
- Allow pegasus to domtrans to mount_t
- Add labeling for unconfined scripts in /usr/libexec/watchdog/scripts
- Add support for unconfined watchdog scripts
- Allow watchdog to manage own log files
Wed Nov 6 13:00:00 2013 Miroslav Grepl 3.12.1-97
- Add label only for redhat.repo instead of /etc/yum.repos.d. But probably we will need to switch for the directory.
- Label /etc/yum.repos.d as system_conf_t
- Use sysnet_filetrans_named_content in udev.te instead of generic transition for net_conf_t
- Allow dac_override for sysadm_screen_t
- Allow init_t to read ipsec_conf_t as we had it for initrc_t. Needed by ipsec unit file.
- Allow netlabel-config to read meminfo
- Add interface to allow docker to mounton file_t
- Add new interface to exec unlabeled files
- Allow lvm to use docker semaphores
- Setup transitons for .xsessions-errors.old
- Change labels of files in /var/lib/
*/.ssh to transition properly
- Allow staff_t and user_t to look at logs using journalctl
- pluto wants to manage own log file
- Allow pluto running as ipsec_t to create pluto.log
- Fix alias decl in corenetwork.te.in
- Add support for fuse.glusterfs
- Allow dmidecode to read/write /run/lock/subsys/rhsmcertd
- Allow rhsmcertd to manage redhat.repo which is now labeled as system.conf. Allow rhsmcertd to manage all log files.
- Additional access for docker
- Added more rules to sblim policy
- Fix kdumpgui_run_bootloader boolean
- Allow dspam to connect to lmtp port
- Included sfcbd service into sblim policy
- rhsmcertd wants to manaage /etc/pki/consumer dir
- Add kdumpgui_run_bootloader boolean
- Add support for /var/cache/watchdog
- Remove virt_domain attribute for virt_qemu_ga_unconfined_t
- Fixes for handling libvirt containes
- Dontaudit attempts by mysql_safe to write content into /
- Dontaudit attempts by system_mail to modify network config
- Allow dspam to bind to lmtp ports
- Add new policy to allow staff_t and user_t to look at logs using journalctl
- Allow apache cgi scripts to list sysfs
- Dontaudit attempts to write/delete user_tmp_t files
- Allow all antivirus domains to manage also own log dirs
- Allow pegasus_openlmi_services_t to stream connect to sssd_t
Fri Nov 1 13:00:00 2013 Miroslav Grepl 3.12.1-96
- Add missing permission checks for nscd
Wed Oct 30 13:00:00 2013 Miroslav Grepl 3.12.1-95
- Fix alias decl in corenetwork.te.in
- Add support for fuse.glusterfs
- Add file transition rules for content created by f5link
- Rename quantum_port information to neutron
- Allow all antivirus domains to manage also own log dirs
- Rename quantum_port information to neutron
- Allow pegasus_openlmi_services_t to stream connect to sssd_t
Mon Oct 28 13:00:00 2013 Miroslav Grepl 3.12.1-94
- Allow sysadm_t to read login information
- Allow systemd_tmpfiles to setattr on var_log_t directories
- Udpdate Makefile to include systemd_contexts
- Add systemd_contexts
- Add fs_exec_hugetlbfs_files() interface
- Add daemons_enable_cluster_mode boolean
- Fix rsync_filetrans_named_content()
- Add rhcs_read_cluster_pid_files() interface
- Update rhcs.if with additional interfaces from RHEL6
- Fix rhcs_domain_template() to not create run dirs with cluster_var_run_t
- Allow glusterd_t to mounton glusterd_tmp_t
- Allow glusterd to unmout al filesystems
- Allow xenstored to read virt config
- Add label for swift_server.lock and make add filetrans_named_content to make sure content gets created with the correct label
- Allow mozilla_plugin_t to mmap hugepages as an executable
Thu Oct 24 14:00:00 2013 Miroslav Grepl 3.12.1-94
- Add back userdom_security_admin_template() interface and use it for sysadm_t if sysadm_secadm.pp
Tue Oct 22 14:00:00 2013 Miroslav Grepl 3.12.1-93
- Allow sshd_t to read openshift content, needs backport to RHEL6.5
- Label /usr/lib64/sasl2/libsasldb.so.3.0.0 as textrel_shlib_t
- Make sur kdump lock is created with correct label if kdumpctl is executed
- gnome interface calls should always be made within an optional_block
- Allow syslogd_t to connect to the syslog_tls port
- Add labeling for /var/run/charon.ctl socket
- Add kdump_filetrans_named_content()
- Allo setpgid for fenced_t
- Allow setpgid and r/w cluster tmpfs for fenced_t
- gnome calls should always be within optional blocks
- wicd.pid should be labeled as networkmanager_var_run_t
- Allow sys_resource for lldpad
Thu Oct 17 14:00:00 2013 Miroslav Grepl 3.12.1-92
- Add rtas policy
Thu Oct 17 14:00:00 2013 Miroslav Grepl 3.12.1-91
- Allow mailserver_domains to manage and transition to mailman data
- Dontaudit attempts by mozilla plugin to relabel content, caused by using mv and cp commands
- Allow mailserver_domains to manage and transition to mailman data
- Allow svirt_domains to read sysctl_net_t
- Allow thumb_t to use tmpfs inherited from the user
- Allow mozilla_plugin to bind to the vnc port if running with spice
- Add new attribute to discover confined_admins and assign confined admin to it
- Fix zabbix to handle attributes in interfaces
- Fix zabbix to read system states for all zabbix domains
- Fix piranha_domain_template()
- Allow ctdbd to create udp_socket. Allow ndmbd to access ctdbd var files.
- Allow lldpad sys_rouserce cap due to #986870
- Allow dovecot-auth to read nologin
- Allow openlmi-networking to read /proc/net/dev
- Allow smsd_t to execute scripts created on the fly labeled as smsd_spool_t
- Add zabbix_domain attribute for zabbix domains to treat them together
- Add labels for zabbix-poxy-
* (#1018221)
- Update openlmi-storage policy to reflect #1015067
- Back port piranha tmpfs fixes from RHEL6
- Update httpd_can_sendmail boolean to allow read/write postfix spool maildrop
- Add postfix_rw_spool_maildrop_files interface
- Call new userdom_admin_user_templat() also for sysadm_secadm.pp
- Fix typo in userdom_admin_user_template()
- Allow SELinux users to create coolkeypk11sE-Gate in /var/cache/coolkey
- Add new attribute to discover confined_admins
- Fix labeling for /etc/strongswan/ipsec.d
- systemd_logind seems to pass fd to anyone who dbus communicates with it
- Dontaudit leaked write descriptor to dmesg
Mon Oct 14 14:00:00 2013 Miroslav Grepl 3.12.1-90
- Activate motion policy
Mon Oct 14 14:00:00 2013 Miroslav Grepl 3.12.1-89
- Fix gnome_read_generic_data_home_files()
- allow openshift_cgroup_t to read/write inherited openshift file types
- Remove httpd_cobbler_content
* from cobbler_admin interface
- Allow svirt sandbox domains to setattr on chr_file and blk_file svirt_sandbox_file_t, so sshd will work within a container
- Allow httpd_t to read also git sys content symlinks
- Allow init_t to read gnome home data
- Dontaudit setroubleshoot_fixit_t execmem, since it does not seem to really need it.
- Allow virsh to execute systemctl
- Fix for nagios_services plugins
- add type defintion for ctdbd_var_t
- Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file
- Allow net_admin/netlink_socket all hyperv_domain domains
- Add labeling for zarafa-search.log and zarafa-search.pid
- Fix hypervkvp.te
- Fix nscd_shm_use()
- Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services.
- Add hypervkvp_unit_file_t type
- Fix logging policy
- Allow syslog to bind to tls ports
- Update labeling for /dev/cdc-wdm
- Allow to su_domain to read init states
- Allow init_t to read gnome home data
- Make sure if systemd_logind creates nologin file with the correct label
- Clean up ipsec.te
Tue Oct 8 14:00:00 2013 Miroslav Grepl 3.12.1-88
- Add auth_exec_chkpwd interface
- Fix port definition for ctdb ports
- Allow systemd domains to read /dev/urand
- Dontaudit attempts for mozilla_plugin to append to /dev/random
- Add label for /var/run/charon.
*
- Add labeling for /usr/lib/systemd/system/lvm2.
*dd policy for motion service
- Fix for nagios_services plugins
- Fix some bugs in zoneminder policy
- add type defintion for ctdbd_var_t
- Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file
- Allow net_admin/netlink_socket all hyperv_domain domains
- Add labeling for zarafa-search.log and zarafa-search.pid
- glusterd binds to random unreserved ports
- Additional allow rules found by testing glusterfs
- apcupsd needs to send a message to all users on the system so needs to look them up
- Fix the label on ~/.juniper_networks
- Dontaudit attempts for mozilla_plugin to append to /dev/random
- Allow polipo_daemon to connect to flash ports
- Allow gssproxy_t to create replay caches
- Fix nscd_shm_use()
- Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services.
- Add hypervkvp_unit_file_t type
Fri Oct 4 14:00:00 2013 Miroslav Grepl 3.12.1-87
- init reload from systemd_localed_t
- Allow domains that communicate with systemd_logind_sessions to use systemd_logind_t fd
- Allow systemd_localed_t to ask systemd to reload the locale.
- Add systemd_runtime_unit_file_t type for unit files that systemd creates in memory
- Allow readahead to read /dev/urand
- Fix lots of avcs about tuned
- Any file names xenstored in /var/log should be treated as xenstored_var_log_t
- Allow tuned to inderact with hugepages
- Allow condor domains to list etc rw dirs
Fri Oct 4 14:00:00 2013 Miroslav Grepl 3.12.1-86
- Fix nscd_shm_use()
- Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services.
- Add hypervkvp_unit_file_t type
- Add additional fixes forpegasus_openlmi_account_t
- Allow mdadm to read /dev/urand
- Allow pegasus_openlmi_storage_t to create mdadm.conf and write it
- Add label/rules for /etc/mdadm.conf
- Allow pegasus_openlmi_storage_t to transition to fsadm_t
- Fixes for interface definition problems
- Dontaudit dovecot-deliver to gettatr on all fs dirs
- Allow domains to search data_home_t directories
- Allow cobblerd to connect to mysql
- Allow mdadm to r/w kdump lock files
- Add support for kdump lock files
- Label zarafa-search as zarafa-indexer
- Openshift cgroup wants to read /etc/passwd
- Add new sandbox domains for kvm
- Allow mpd to interact with pulseaudio if mpd_enable_homedirs is turned on
- Fix labeling for /usr/lib/systemd/system/lvm2.
*
- Add labeling for /usr/lib/systemd/system/lvm2.
*
- Fix typos to get a new build. We should not cover filename trans rules to prevent duplicate rules
- Add sshd_keygen_t policy for sshd-keygen
- Fix alsa_home_filetrans interface name and definition
- Allow chown for ssh_keygen_t
- Add fs_dontaudit_getattr_all_dirs()
- Allow init_t to manage etc_aliases_t and read xserver_var_lib_t and chrony keys
- Fix up patch to allow systemd to manage home content
- Allow domains to send/recv unlabeled traffic if unlabelednet.pp is enabled
- Allow getty to exec hostname to get info
- Add systemd_home_t for ~/.local/share/systemd directory
Wed Oct 2 14:00:00 2013 Miroslav Grepl 3.12.1-85
- Fix lxc labels in config.tgz
Mon Sep 30 14:00:00 2013 Miroslav Grepl 3.12.1-84
- Fix labeling for /usr/libexec/kde4/kcmdatetimehelper
- Allow tuned to search all file system directories
- Allow alsa_t to sys_nice, to get top performance for sound management
- Add support for MySQL/PostgreSQL for amavis
- Allow openvpn_t to manage openvpn_var_log_t files.
- Allow dirsrv_t to create tmpfs_t directories
- Allow dirsrv to create dirs in /dev/shm with dirsrv_tmpfs label
- Dontaudit leaked unix_stream_sockets into gnome keyring
- Allow telepathy domains to inhibit pipes on telepathy domains
- Allow cloud-init to domtrans to rpm
- Allow abrt daemon to manage abrt-watch tmp files
- Allow abrt-upload-watcher to search /var/spool directory
- Allow nsswitch domains to manage own process key
- Fix labeling for mgetty.
* logs
- Allow systemd to dbus chat with upower
- Allow ipsec to send signull to itself
- Allow setgid cap for ipsec_t
- Match upstream labeling
Wed Sep 25 14:00:00 2013 Miroslav Grepl 3.12.1-83
- Do not build sanbox pkg on MLS
Wed Sep 25 14:00:00 2013 Miroslav Grepl 3.12.1-82
- wine_tmp is no longer needed
- Allow setroubleshoot to look at /proc
- Allow telepathy domains to dbus with systemd logind
- Fix handling of fifo files of rpm
- Allow mozilla_plugin to transition to itself
- Allow certwatch to write to cert_t directories
- New abrt application
- Allow NetworkManager to set the kernel scheduler
- Make wine_domain shared by all wine domains
- Allow mdadm_t to read images labeled svirt_image_t
- Allow amanda to read /dev/urand
- ALlow my_print_default to read /dev/urand
- Allow mdadm to write to kdumpctl fifo files
- Allow nslcd to send signull to itself
- Allow yppasswd to read /dev/urandom
- Fix zarafa_setrlimit
- Add support for /var/lib/php/wsdlcache
- Add zarafa_setrlimit boolean
- Allow fetchmail to send mails
- Add additional alias for user_tmp_t because wine_tmp_t is no longer used
- More handling of ther kernel keyring required by kerberos
- New privs needed for init_t when running without transition to initrc_t over bin_t, and without unconfined domain installed
Thu Sep 19 14:00:00 2013 Miroslav Grepl 3.12.1-81
- Dontaudit attempts by sosreport to read shadow_t
- Allow browser sandbox plugins to connect to cups to print
- Add new label mpd_home_t
- Label /srv/www/logs as httpd_log_t
- Add support for /var/lib/php/wsdlcache
- Add zarafa_setrlimit boolean
- Allow fetchmail to send mails
- Add labels for apache logs under miq package
- Allow irc_t to use tcp sockets
- fix labels in puppet.if
- Allow tcsd to read utmp file
- Allow openshift_cron_t to run ssh-keygen in ssh_keygen_t to access host keys
- Define svirt_socket_t as a domain_type
- Take away transition from init_t to initrc_t when executing bin_t, allow init_t to run chk_passwd_t
- Fix label on pam_krb5 helper apps
Thu Sep 12 14:00:00 2013 Miroslav Grepl 3.12.1-80
- Allow ldconfig to write to kdumpctl fifo files
- allow neutron to connect to amqp ports
- Allow kdump_manage_crash to list the kdump_crash_t directory
- Allow glance-api to connect to amqp port
- Allow virt_qemu_ga_t to read meminfo
- Add antivirus_home_t type for antivirus date in HOMEDIRS
- Allow mpd setcap which is needed by pulseaudio
- Allow smbcontrol to create content in /var/lib/samba
- Allow mozilla_exec_t to be used as a entrypoint to mozilla_domtrans_spec
- Add additional labeling for qemu-ga/fsfreeze-hook.d scripts
- amanda_exec_t needs to be executable file
- Allow block_suspend cap for samba-net
- Allow apps that read ipsec_mgmt_var_run_t to search ipsec_var_run_t
- Allow init_t to run crash utility
- Treat usr_t just like bin_t for transitions and executions
- Add port definition of pka_ca to port 829 for openshift
- Allow selinux_store to use symlinks
Mon Sep 9 14:00:00 2013 Miroslav Grepl 3.12.1-79
- Allow block_suspend cap for samba-net
- Allow t-mission-control to manage gabble cache files
- Allow nslcd to read /sys/devices/system/cpu
- Allow selinux_store to use symlinks
Mon Sep 9 14:00:00 2013 Miroslav Grepl 3.12.1-78
- Allow xdm_t to transition to itself
- Call neutron interfaces instead of quantum
- Allow init to change targed role to make uncofined services (xrdp which now has own systemd unit file) working. We want them to have in unconfined_t
- Make sure directories in /run get created with the correct label
- Make sure /root/.pki gets created with the right label
- try to remove labeling for motion from zoneminder_exec_t to bin_t
- Allow inetd_t to execute shell scripts
- Allow cloud-init to read all domainstate
- Fix to use quantum port
- Add interface netowrkmanager_initrc_domtrans
- Fix boinc_execmem
- Allow t-mission-control to read gabble cache home
- Add labeling for ~/.cache/telepathy/avatars/gabble
- Allow memcache to read sysfs data
- Cleanup antivirus policy and add additional fixes
- Add boolean boinc_enable_execstack
- Add support for couchdb in rabbitmq policy
- Add interface couchdb_search_pid_dirs
- Allow firewalld to read NM state
- Allow systemd running as git_systemd to bind git port
- Fix mozilla_plugin_rw_tmpfs_files()
Thu Sep 5 14:00:00 2013 Miroslav Grepl 3.12.1-77
- Split out rlogin ports from inetd
- Treat files labeld as usr_t like bin_t when it comes to transitions
- Allow staff_t to read login config
- Allow ipsec_t to read .google authenticator data
- Allow systemd running as git_systemd to bind git port
- Fix mozilla_plugin_rw_tmpfs_files()
- Call the correct interface - corenet_udp_bind_ktalkd_port()
- Allow all domains that can read gnome_config to read kde config
- Allow sandbox domain to read/write mozilla_plugin_tmpfs_t so pulseaudio will work
- Allow mdadm to getattr any file system
- Allow a confined domain to executes mozilla_exec_t via dbus
- Allow cupsd_lpd_t to bind to the printer port
- Dontaudit attempts to bind to ports < 1024 when nis is turned on
- Allow apache domain to connect to gssproxy socket
- Allow rlogind to bind to the rlogin_port
- Allow telnetd to bind to the telnetd_port
- Allow ktalkd to bind to the ktalkd_port
- Allow cvs to bind to the cvs_port
Wed Sep 4 14:00:00 2013 Miroslav Grepl 3.12.1-76
- Cleanup related to init_domain()+inetd_domain fixes
- Use just init_domain instead of init_daemon_domain in inetd_core_service_domain
- svirt domains neeed to create kobject_uevint_sockets
- Lots of new access required for sosreport
- Allow tgtd_t to connect to isns ports
- Allow init_t to transition to all inetd domains:
- openct needs to be able to create netlink_object_uevent_sockets
- Dontaudit leaks into ldconfig_t
- Dontaudit su domains getattr on /dev devices, move su domains to attribute based calls
- Move kernel_stream_connect into all Xwindow using users
- Dontaudit inherited lock files in ifconfig o dhcpc_t
Tue Sep 3 14:00:00 2013 Miroslav Grepl 3.12.1-75
- Also sock_file trans rule is needed in lsm
- Fix labeling for fetchmail pid files/dirs
- Add additional fixes for abrt-upload-watch
- Fix polipo.te
- Fix transition rules in asterisk policy
- Add fowner capability to networkmanager policy
- Allow polipo to connect to tor ports
- Cleanup lsmd.if
- Cleanup openhpid policy
- Fix kdump_read_crash() interface
- Make more domains as init domain
- Fix cupsd.te
- Fix requires in rpm_rw_script_inherited_pipes
- Fix interfaces in lsm.if
- Allow munin service plugins to manage own tmpfs files/dirs
- Allow virtd_t also relabel unix stream sockets for virt_image_type
- Make ktalk as init domain
- Fix to define ktalkd_unit_file_t correctly
- Fix ktalk.fc
- Add systemd support for talk-server
- Allow glusterd to create sock_file in /run
- Allow xdm_t to delete gkeyringd_tmp_t files on logout
- Add fixes for hypervkvp policy
- Add logwatch_can_sendmail boolean
- Allow mysqld_safe_t to handle also symlinks in /var/log/mariadb
- Allow xdm_t to delete gkeyringd_tmp_t files on logout
Thu Aug 29 14:00:00 2013 Miroslav Grepl 3.12.1-74
- Add selinux-policy-sandbox pkg
Tue Aug 27 14:00:00 2013 Miroslav Grepl 3.12.1-73
0
- Allow rhsmcertd to read init state
- Allow fsetid for pkcsslotd
- Fix labeling for /usr/lib/systemd/system/pkcsslotd.service
- Allow fetchmail to create own pid with correct labeling
- Fix rhcs_domain_template()
- Allow roles which can run mock to read mock lib files to view results
- Allow rpcbind to use nsswitch
- Fix lsm.if summary
- Fix collectd_t can read /etc/passwd file
- Label systemd unit files under dracut correctly
- Add support for pam_mount to mount user\'s encrypted home When a user logs in and logs out using ssh
- Add support for .Xauthority-n
- Label umount.crypt as lvm_exec_t
- Allow syslogd to search psad lib files
- Allow ssh_t to use /dev/ptmx
- Make sure /run/pluto dir is created with correct labeling
- Allow syslog to run shell and bin_t commands
- Allow ip to relabel tun_sockets
- Allow mount to create directories in files under /run
- Allow processes to use inherited fifo files
Fri Aug 23 14:00:00 2013 Miroslav Grepl 3.12.1-72
- Add policy for lsmd
- Add support for /var/log/mariadb dir and allow mysqld_safe to list this directory
- Update condor_master rules to allow read system state info and allow logging
- Add labeling for /etc/condor and allow condor domain to write it (bug)
- Allow condor domains to manage own logs
- Allow glusterd to read domains state
- Fix initial hypervkvp policy
- Add policy for hypervkvpd
- Fix redis.if summary
Wed Aug 21 14:00:00 2013 Miroslav Grepl 3.12.1-71
- Allow boinc to connect to AATT/tmp/.X11-unix/X0
- Allow beam.smp to connect to tcp/5984
- Allow named to manage own log files
- Add label for /usr/libexec/dcc/start-dccifd and domtrans to dccifd_t
- Add virt_transition_userdomain boolean decl
- Allow httpd_t to sendto unix_dgram sockets on its children
- Allow nova domains to execute ifconfig
- bluetooth wants to create fifo_files in /tmp
- exim needs to be able to manage mailman data
- Allow sysstat to getattr on all file systems
- Looks like bluetoothd has moved
- Allow collectd to send ping packets
- Allow svirt_lxc domains to getpgid
- Remove virt-sandbox-service labeling as virsh_exec_t, since it no longer does virsh_t stuff
- Allow frpintd_t to read /dev/urandom
- Allow asterisk_t to create sock_file in /var/run
- Allow usbmuxd to use netlink_kobject
- sosreport needs to getattr on lots of devices, and needs access to netlink_kobject_uevent_socket
- More cleanup of svirt_lxc policy
- virtd_lxc_t now talks to dbus
- Dontaudit leaked ptmx_t
- Allow processes to use inherited fifo files
- Allow openvpn_t to connect to squid ports
- Allow prelink_cron_system_t to ask systemd to reloaddd miscfiles_dontaudit_access_check_cert()
- Allow ssh_t to use /dev/ptmx
- Make sure /run/pluto dir is created with correct labeling
- Allow syslog to run shell and bin_t commands
- Allow ip to relabel tun_sockets
- Allow mount to create directories in files under /run
- Allow processes to use inherited fifo files
- Allow user roles to connect to the journal socket
Thu Aug 8 14:00:00 2013 Miroslav Grepl 3.12.1-70
- selinux_set_enforce_mode needs to be used with type
- Add append to the dontaudit for unix_stream_socket of xdm_t leak
- Allow xdm_t to create symlinks in log direcotries
- Allow login programs to read afs config
- Label 10933 as a pop port, for dovecot
- New policy to allow selinux_server.py to run as semanage_t as a dbus service
- Add fixes to make netlabelctl working on MLS
- AVCs required for running sepolicy gui as staff_t
- Dontaudit attempts to read symlinks, sepolicy gui is likely to cause this type of AVC
- New dbus server to be used with new gui
- After modifying some files in /etc/mail, I saw this needed on the next boot
- Loading a vm from /usr/tmp with virt-manager
- Clean up oracleasm policy for Fedora
- Add oracleasm policy written by rlopezAATTredhat.com
- Make postfix_postdrop_t as mta_agent to allow domtrans to system mail if it is executed by apache
- Add label for /var/crash
- Allow fenced to domtrans to sanclok_t
- Allow nagios to manage nagios spool files
- Make tfptd as home_manager
- Allow kdump to read kcore on MLS system
- Allow mysqld-safe sys_nice/sys_resource caps
- Allow apache to search automount tmp dirs if http_use_nfs is enabled
- Allow crond to transition to named_t, for use with unbound
- Allow crond to look at named_conf_t, for unbound
- Allow mozilla_plugin_t to transition its home content
- Allow dovecot_domain to read all system and network state
- Allow httpd_user_script_t to call getpw
- Allow semanage to read pid files
- Dontaudit leaked file descriptors from user domain into thumb
- Make PAM authentication working if it is enabled in ejabberd
- Add fixes for rabbit to fix ##992920,#992931
- Allow glusterd to mount filesystems
- Loading a vm from /usr/tmp with virt-manager
- Trying to load a VM I got an AVC from devicekit_disk for loopcontrol device
- Add fix for pand service
- shorewall touches own log
- Allow nrpe to list /var
- Mozilla_plugin_roles can not be passed into lpd_run_lpr
- Allow afs domains to read afs_config files
- Allow login programs to read afs config
- Allow virt_domain to read virt_var_run_t symlinks
- Allow smokeping to send its process signals
- Allow fetchmail to setuid
- Add kdump_manage_crash() interface
- Allow abrt domain to write abrt.socket
Wed Jul 31 14:00:00 2013 Miroslav Grepl 3.12.1-69
- Add more aliases in pegasus.te
- Add more fixes for
*_admin interfaces
- Add interface fixes
- Allow nscd to stream connect to nmbd
- Allow gnupg apps to write to pcscd socket
- Add more fixes for openlmi provides. Fix naming and support for additionals
- Allow fetchmail to resolve host names
- Allow firewalld to interact also with lnk files labeled as firewalld_etc_rw_t
- Add labeling for cmpiLMI_Fan-cimprovagt
- Allow net_admin for glusterd
- Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/
- Add pegasus_openlmi_system_t
- Fix puppet_domtrans_master() to make all puppet calling working in passenger.te
- Fix corecmd_exec_chroot()
- Fix logging_relabel_syslog_pid_socket interface
- Fix typo in unconfineduser.te
- Allow system_r to access unconfined_dbusd_t to run hp_chec
Tue Jul 30 14:00:00 2013 Miroslav Grepl 3.12.1-68
- Allow xdm_t to act as a dbus client to itsel
- Allow fetchmail to resolve host names
- Allow gnupg apps to write to pcscd socket
- Add labeling for cmpiLMI_Fan-cimprovagt
- Allow net_admin for glusterd
- Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/
- Add pegasus_openlmi_system_t
- Fix puppet_domtrans_master() to make all puppet calling working in passenger.te
-httpd_t does access_check on certs
Fri Jul 26 14:00:00 2013 Miroslav Grepl 3.12.1-67
- Add support for cmpiLMI_Service-cimprovagt
- Allow pegasus domtrans to rpm_t to make pycmpiLMI_Software-cimprovagt running as rpm_t
- Label pycmpiLMI_Software-cimprovagt as rpm_exec_t
- Add support for pycmpiLMI_Storage-cimprovagt
- Add support for cmpiLMI_Networking-cimprovagt
- Allow system_cronjob_t to create user_tmpfs_t to make pulseaudio working
- Allow virtual machines and containers to run as user doains, needed for virt-sandbox
- Allow buglist.cgi to read cpu info
Mon Jul 22 14:00:00 2013 Miroslav Grepl 3.12.1-66
- Allow systemd-tmpfile to handle tmp content in print spool dir
- Allow systemd-sysctl to send system log messages
- Add support for RTP media ports and fmpro-internal
- Make auditd working if audit is configured to perform SINGLE action on disk error
- Add interfaces to handle systemd units
- Make systemd-notify working if pcsd is used
- Add support for netlabel and label /usr/sbin/netlabelctl as iptables_exec_t
- Instead of having all unconfined domains get all of the named transition rules,
- Only allow unconfined_t, init_t, initrc_t and rpm_script_t by default.
- Add definition for the salt ports
- Allow xdm_t to create link files in xdm_var_run_t
- Dontaudit reads of blk files or chr files leaked into ldconfig_t
- Allow sys_chroot for useradd_t
- Allow net_raw cap for ipsec_t
- Allow sysadm_t to reload services
- Add additional fixes to make strongswan working with a simple conf
- Allow sysadm_t to enable/disable init_t services
- Add additional glusterd perms
- Allow apache to read lnk files in the /mnt directory
- Allow glusterd to ask the kernel to load a module
- Fix description of ftpd_use_fusefs boolean
- Allow svirt_lxc_net_t to sys_chroot, modify policy to tighten up svirt_lxc_domain capabilties and process controls, but add them to svirt_lxc_net_t
- Allow glusterds to request load a kernel module
- Allow boinc to stream connect to xserver_t
- Allow sblim domains to read /etc/passwd
- Allow mdadm to read usb devices
- Allow collectd to use ping plugin
- Make foghorn working with SNMP
- Allow sssd to read ldap certs
- Allow haproxy to connect to RTP media ports
- Add additional trans rules for aide_db
- Add labeling for /usr/lib/pcsd/pcsd
- Add labeling for /var/log/pcsd
- Add support for pcs which is a corosync and pacemaker configuration tool
Wed Jul 17 14:00:00 2013 Miroslav Grepl 3.12.1-65
- Label /var/lib/ipa/pki-ca/publish as pki_tomcat_cert_t
- Add labeling for /usr/libexec/kde4/polkit-kde-authentication-agent-1
- Allow all domains that can domtrans to shutdown, to start the power services script to shutdown
- consolekit needs to be able to shut down system
- Move around interfaces
- Remove nfsd_rw_t and nfsd_ro_t, they don\'t do anything
- Add additional fixes for rabbitmq_beam to allow getattr on mountpoints
- Allow gconf-defaults-m to read /etc/passwd
- Fix pki_rw_tomcat_cert() interface to support lnk_files
Fri Jul 12 14:00:00 2013 Miroslav Grepl 3.12.1-64
- Add support for gluster ports
- Make sure that all keys located in /etc/ssh/ are labeled correctly
- Make sure apcuspd lock files get created with the correct label
- Use getcap in gluster.te
- Fix gluster policy
- add additional fixes to allow beam.smp to interact with couchdb files
- Additional fix for #974149
- Allow gluster to user gluster ports
- Allow glusterd to transition to rpcd_t and add additional fixes for #980683
- Allow tgtd working when accessing to the passthrough device
- Fix labeling for mdadm unit files
Thu Jul 11 14:00:00 2013 Miroslav Grepl 3.12.1-63
- Add mdadm fixes
Tue Jul 9 14:00:00 2013 Miroslav Grepl 3.12.1-62
- Fix definition of sandbox.disabled to sandbox.pp.disabled
Mon Jul 8 14:00:00 2013 Miroslav Grepl 3.12.1-61
- Allow mdamd to execute systemctl
- Allow mdadm to read /dev/kvm
- Allow ipsec_mgmt_t to read l2tpd pid content
Mon Jul 8 14:00:00 2013 Miroslav Grepl 3.12.1-60
- Allow nsd_t to read /dev/urand
- Allow mdadm_t to read framebuffer
- Allow rabbitmq_beam_t to read process info on rabbitmq_epmd_t
- Allow mozilla_plugin_config_t to create tmp files
- Cleanup openvswitch policy
- Allow mozilla plugin to getattr on all executables
- Allow l2tpd_t to create fifo_files in /var/run
- Allow samba to touch/manage fifo_files or sock_files in a samba_share_t directory
- Allow mdadm to connecto its own unix_stream_socket
- FIXME: nagios changed locations to /log/nagios which is wrong. But we need to have this workaround for now.
- Allow apache to access smokeping pid files
- Allow rabbitmq_beam_t to getattr on all filesystems
- Add systemd support for iodined
- Allow nup_upsdrvctl_t to execute its entrypoint
- Allow fail2ban_client to write to fail2ban_var_run_t, Also allow it to use nsswitch
- add labeling for ~/.cache/libvirt-sandbox
- Add interface to allow domains transitioned to by confined users to send sigchld to screen program
- Allow sysadm_t to check the system status of files labeled etc_t, /etc/fstab
- Allow systemd_localed to start /usr/lib/systemd/system/systemd-vconsole-setup.service
- Allow an domain that has an entrypoint from a type to be allowed to execute the entrypoint without a transition, I can see no case where this is a bad thing, and elminiates a whole class of AVCs.
- Allow staff to getsched all domains, required to run htop
- Add port definition for redis port
- fix selinuxuser_use_ssh_chroot boolean
Wed Jul 3 14:00:00 2013 Miroslav Grepl 3.12.1-59
- Add prosody policy written by Michael Scherer
- Allow nagios plugins to read /sys info
- ntpd needs to manage own log files
- Add support for HOME_DIR/.IBMERS
- Allow iptables commands to read firewalld config
- Allow consolekit_t to read utmp
- Fix filename transitions on .razor directory
- Add additional fixes to make DSPAM with LDA working
- Allow snort to read /etc/passwd
- Allow fail2ban to communicate with firewalld over dbus
- Dontaudit openshift_cgreoup_file_t read/write leaked dev
- Allow nfsd to use mountd port
- Call th proper interface
- Allow openvswitch to read sys and execute plymouth
- Allow tmpwatch to read /var/spool/cups/tmp
- Add support for /usr/libexec/telepathy-rakia
- Add systemd support for zoneminder
- Allow mysql to create files/directories under /var/log/mysql
- Allow zoneminder apache scripts to rw zoneminder tmpfs
- Allow httpd to manage zoneminder lib files
- Add zoneminder_run_sudo boolean to allow to start zoneminder
- Allow zoneminder to send mails
- gssproxy_t sock_file can be under /var/lib
- Allow web domains to connect to whois port.
- Allow sandbox_web_type to connect to the same ports as mozilla_plugin_t.
- We really need to add an interface to corenet to define what a web_client_domain is and
- then define chrome_sandbox_t, mozilla_plugin_t and sandbox_web_type to that domain.
- Add labeling for cmpiLMI_LogicalFile-cimprovagt
- Also make pegasus_openlmi_logicalfile_t as unconfined to have unconfined_domain attribute for filename trans rules
- Update policy rules for pegasus_openlmi_logicalfile_t
- Add initial types for logicalfile/unconfined OpenLMI providers
- mailmanctl needs to read own log
- Allow logwatch manage own lock files
- Allow nrpe to read meminfo
- Allow httpd to read certs located in pki-ca
- Add pki_read_tomcat_cert() interface
- Add support for nagios openshift plugins
- Add port definition for redis port
- fix selinuxuser_use_ssh_chroot boolean
Fri Jun 28 14:00:00 2013 Miroslav Grepl 3.12.1-58
- Shrink the size of policy by moving to attributes, also add dridomain so that mozilla_plugin can follow selinuxuse_dri boolean.
- Allow bootloader to manage generic log files
- Allow ftp to bind to port 989
- Fix label of new gear directory
- Add support for new directory /var/lib/openshift/gears/
- Add openshift_manage_lib_dirs()
- allow virtd domains to manage setrans_var_run_t
- Allow useradd to manage all openshift content
- Add support so that mozilla_plugin_t can use dri devices
- Allow chronyd to change the scheduler
- Allow apmd to shut downthe system
- Devicekit_disk_t needs to manage /etc/fstab
Wed Jun 26 14:00:00 2013 Miroslav Grepl 3.12.1-57
- Make DSPAM to act as a LDA working
- Allow ntop to create netlink socket
- Allow policykit to send a signal to policykit-auth
- Allow stapserver to dbus chat with avahi/systemd-logind
- Fix labeling on haproxy unit file
- Clean up haproxy policy
- A new policy for haproxy and placed it to rhcs.te
- Add support for ldirectord and treat it with cluster_t
- Make sure anaconda log dir is created with var_log_t
Mon Jun 24 14:00:00 2013 Miroslav Grepl 3.12.1-56
- Allow lvm_t to create default targets for filesystem handling
- Fix labeling for razor-lightdm binaries
- Allow insmod_t to read any file labeled var_lib_t
- Add policy for pesign
- Activate policy for cmpiLMI_Account-cimprovagt
- Allow isnsd syscall=listen
- /usr/libexec/pegasus/cimprovagt needs setsched caused by sched_setscheduler
- Allow ctdbd to use udp/4379
- gatherd wants sys_nice and setsched
- Add support for texlive2012
- Allow NM to read file_t (usb stick with no labels used to transfer keys for example)
- Allow cobbler to execute apache with domain transition
Fri Jun 21 14:00:00 2013 Miroslav Grepl 3.12.1-55
- condor_collector uses tcp/9000
- Label /usr/sbin/virtlockd as virtd_exec_t for now
- Allow cobbler to execute ldconfig
- Allow NM to execute ssh
- Allow mdadm to read /dev/crash
- Allow antivirus domains to connect to snmp port
- Make amavisd-snmp working correctly
- Allow nfsd_t to mounton nfsd_fs_t
- Add initial snapper policy
- We still need to have consolekit policy
- Dontaudit firefox attempting to connect to the xserver_port_t if run within sandbox_web_t
- Dontaudit sandbox apps attempting to open user_devpts_t
- Allow dirsrv to read network state
- Fix pki_read_tomcat_lib_files
- Add labeling for /usr/libexec/nm-ssh-service
- Add label cert_t for /var/lib/ipa/pki-ca/publish
- Lets label /sys/fs/cgroup as cgroup_t for now, to keep labels consistant
- Allow nfsd_t to mounton nfsd_fs_t
- Dontaudit sandbox apps attempting to open user_devpts_t
- Allow passwd_t to change role to system_r from unconfined_r
Wed Jun 19 14:00:00 2013 Miroslav Grepl 3.12.1-54
- Don\'t audit access checks by sandbox xserver on xdb var_lib
- Allow ntop to read usbmon devices
- Add labeling for new polcykit authorizor
- Dontaudit access checks from fail2ban_client
- Don\'t audit access checks by sandbox xserver on xdb var_lib
- Allow apps that connect to xdm stream to conenct to xdm_dbusd_t stream
- Fix labeling for all /usr/bim/razor-lightdm-
* binaries
- Add filename trans for /dev/md126p1
Tue Jun 18 14:00:00 2013 Miroslav Grepl 3.12.1-53
- Make vdagent able to request loading kernel module
- Add support for cloud-init make it as unconfined domain
- Allow snmpd to run smartctl in fsadm_t domain
- remove duplicate openshift_search_lib() interface
- Allow mysqld to search openshift lib files
- Allow openshift cgroup to interact with passedin file descriptors
- Allow colord to list directories inthe users homedir
- aide executes prelink to check files
- Make sure cupsd_t creates content in /etc/cups with the correct label
- Lest dontaudit apache read all domains, so passenger will not cause this avc
- Allow gssd to connect to gssproxy
- systemd-tmpfiles needs to be able to raise the level to fix labeling on /run/setrans in MLS
- Allow systemd-tmpfiles to relabel also lock files
- Allow useradd to add homdir in /var/lib/openshift
- Allow setfiles and semanage to write output to /run/files
Fri Jun 14 14:00:00 2013 Miroslav Grepl 3.12.1-52
- Add labeling for /dev/tgt
- Dontaudit leak fd from firewalld for modprobe
- Allow runuser running as rpm_script_t to create netlink_audit socket
- Allow mdadm to read BIOS non-volatile RAM
Thu Jun 13 14:00:00 2013 Miroslav Grepl 3.12.1-51
- accountservice watches when accounts come and go in wtmp
- /usr/java/jre1.7.0_21/bin/java needs to create netlink socket
- Add httpd_use_sasl boolean
- Allow net_admin for tuned_t
- iscsid needs sys_module to auto-load kernel modules
- Allow blueman to read bluetooth conf
- Add nova_manage_lib_files() interface
- Fix mplayer_filetrans_home_content()
- Add mplayer_filetrans_home_content()
- mozilla_plugin_config_roles need to be able to access mozilla_plugin_config_t
- Revert \"Allow thumb_t to append inherited xdm stream socket\"
- Add iscsi_filetrans_named_content() interface
- Allow to create .mplayer with the correct labeling for unconfined
- Allow iscsiadmin to create lock file with the correct labeling
Tue Jun 11 14:00:00 2013 Miroslav Grepl 3.12.1-50
- Allow wine to manage wine home content
- Make amanda working with socket actiovation
- Add labeling for /usr/sbin/iscsiadm
- Add support for /var/run/gssproxy.sock
- dnsmasq_t needs to read sysctl_net_t
Fri Jun 7 14:00:00 2013 Miroslav Grepl 3.12.1-49
- Fix courier_domain_template() interface
- Allow blueman to write ip_forward
- Allow mongodb to connect to mongodb port
- Allow mongodb to connect to mongodb port
- Allow java to bind jobss_debug port
- Fixes for
*_admin interfaces
- Allow iscsid auto-load kernel modules needed for proper iSCSI functionality
- Need to assign attribute for courier_domain to all courier_domains
- Fail2ban reads /etc/passwd
- postfix_virtual will create new files in postfix_spool_t
- abrt triggers sys_ptrace by running pidof
- Label ~/abc as mozilla_home_t, since java apps as plugin want to create it
- Add passenger fixes needed by foreman
- Remove dup interfaces
- Add additional interfaces for quantum
- Add new interfaces for dnsmasq
- Allow passenger to read localization and send signull to itself
- Allow dnsmasq to stream connect to quantum
- Add quantum_stream_connect()
- Make sure that mcollective starts the service with the correct labeling
- Add labels for ~/.manpath
- Dontaudit attempts by svirt_t to getpw
* calls
- sandbox domains are trying to look at parent process data
- Allow courior auth to create its pid file in /var/spool/courier subdir
- Add fixes for beam to have it working with couchdb
- Add labeling for /run/nm-xl2tpd.con
- Allow apache to stream connect to thin
- Add systemd support for amand
- Make public types usable for fs mount points
- Call correct mandb interface in domain.te
- Allow iptables to r/w quantum inherited pipes and send sigchld
- Allow ifconfig domtrans to iptables and execute ldconfig
- Add labels for ~/.manpath
- Allow systemd to read iscsi lib files
- seunshare is trying to look at parent process data
Mon Jun 3 14:00:00 2013 Miroslav Grepl 3.12.1-48
- Fix openshift_search_lib
- Add support for abrt-uefioops-oops
- Allow colord to getattr any file system
- Allow chrome processes to look at each other
- Allow sys_ptrace for abrt_t
- Add new policy for gssproxy
- Dontaudit leaked file descriptor writes from firewalld
- openshift_net_type is interface not template
- Dontaudit pppd to search gnome config
- Update openshift_search_lib() interface
- Add fs_list_pstorefs()
- Fix label on libbcm_host.so since it is built incorrectly on raspberry pi, needs back port to F18
- Better labels for raspberry pi devices
- Allow init to create devpts_t directory
- Temporarily label rasbery pi devices as memory_device_t, needs back port to f18
- Allow sysadm_t to build kernels
- Make sure mount creates /var/run/blkid with the correct label, needs back port to F18
- Allow userdomains to stream connect to gssproxy
- Dontaudit leaked file descriptor writes from firewalld
- Allow xserver to read /dev/urandom
- Add additional fixes for ipsec-mgmt
- Make SSHing into an Openshift Enterprise Node working
Wed May 29 14:00:00 2013 Miroslav Grepl 3.12.1-47
- Add transition rules to unconfined domains and to sysadm_t to create /etc/adjtime
- with the proper label.
- Update files_filetrans_named_content() interface to get right labeling for pam.d conf files
- Allow systemd-timedated to create adjtime
- Add clock_create_adjtime()
- Additional fix ifconfing for #966106
- Allow kernel_t to create boot.log with correct labeling
- Remove unconfined_mplayer for which we don\'t have rules
- Rename interfaces
- Add userdom_manage_user_home_files/dirs interfaces
- Fix files_dontaudit_read_all_non_security_files
- Fix ipsec_manage_key_file()
- Fix ipsec_filetrans_key_file()
- Label /usr/bin/razor-lightdm-greeter as xdm_exec_t instead of spamc_exec_t
- Fix labeling for ipse.secrets
- Add interfaces for ipsec and labeling for ipsec.info and ipsec_setup.pid
- Add files_dontaudit_read_all_non_security_files() interface
- /var/log/syslog-ng should be labeled var_log_t
- Make ifconfig_var_run_t a mountpoint
- Add transition from ifconfig to dnsmasq
- Allow ifconfig to execute bin_t/shell_exec_t
- We want to have hwdb.bin labeled as etc_t
- update logging_filetrans_named_content() interface
- Allow systemd_timedate_t to manage /etc/adjtime
- Allow NM to send signals to l2tpd
- Update antivirus_can_scan_system boolean
- Allow devicekit_disk_t to sys_config_tty
- Run abrt-harvest programs as abrt_t, and allow abrt_t to list all filesystem directories
- Make printing from vmware working
- Allow php-cgi from php54 collection to access /var/lib/net-snmp/mib_indexes
- Add virt_qemu_ga_data_t for qemu-ga
- Make chrome and mozilla able to connect to same ports, add jboss_management_port_t to both
- Fix typo in virt.te
- Add virt_qemu_ga_unconfined_t for hook scripts
- Make sure NetworkManager files get created with the correct label
- Add mozilla_plugin_use_gps boolean
- Fix cyrus to have support for net-snmp
- Additional fixes for dnsmasq and quantum for #966106
- Add plymouthd_create_log()
- remove httpd_use_oddjob for which we don\'t have rules
- Add missing rules for httpd_can_network_connect_cobbler
- Add missing cluster_use_execmem boolean
- Call userdom_manage_all_user_home_type_files/dirs
- Additional fix for ftp_home_dir
- Fix ftp_home_dir boolean
- Allow squit to recv/send client squid packet
- Fix nut.te to have nut_domain attribute
- Add support for ejabberd; TODO: revisit jabberd and rabbit policy
- Fix amanda policy
- Add more fixes for domains which use libusb
- Make domains which use libusb working correctly
- Allow l2tpd to create ipsec key files with correct labeling and manage them
- Fix cobbler_manage_lib_files/cobbler_read_lib_files to cover also lnk files
- Allow rabbitmq-beam to bind generic node
- Allow l2tpd to read ipse-mgmt pid files
- more fixes for l2tpd, NM and pppd from #967072
Wed May 22 14:00:00 2013 Miroslav Grepl 3.12.1-46
- Dontaudit to getattr on dirs for dovecot-deliver
- Allow raiudusd server connect to postgresql socket
- Add kerberos support for radiusd
- Allow saslauthd to connect to ldap port
- Allow postfix to manage postfix_private_t files
- Add chronyd support for #965457
- Fix labeling for HOME_DIR/\\.icedtea
- CHange squid and snmpd to be allowed also write own logs
- Fix labeling for /usr/libexec/qemu-ga
- Allow virtd_t to use virt_lock_t
- Allow also sealert to read the policy from the kernel
- qemu-ga needs to execute scripts in /usr/libexec/qemu-ga and to use /tmp content
- Dontaudit listing of users homedir by sendmail Seems like a leak
- Allow passenger to transition to puppet master
- Allow apache to connect to mythtv
- Add definition for mythtv ports
Fri May 17 14:00:00 2013 Miroslav Grepl 3.12.1-45
- Add additional fixes for #948073 bug
- Allow sge_execd_t to also connect to sge ports
- Allow openshift_cron_t to manage openshift_var_lib_t sym links
- Allow openshift_cron_t to manage openshift_var_lib_t sym links
- Allow sge_execd to bind sge ports. Allow kill capability and reads cgroup files
- Remove pulseaudio filetrans pulseaudio_manage_home_dirs which is a part of pulseaudio_manage_home_files
- Add networkmanager_stream_connect()
- Make gnome-abrt wokring with staff_t
- Fix openshift_manage_lib_files() interface
- mdadm runs ps command which seems to getattr on random log files
- Allow mozilla_plugin_t to create pulseaudit_home_t directories
- Allow qemu-ga to shutdown virtual hosts
- Add labelling for cupsd-browsed
- Add web browser plugins to connect to aol ports
- Allow nm-dhcp-helper to stream connect to NM
- Add port definition for sge ports
Mon May 13 14:00:00 2013 Miroslav Grepl 3.12.1-44
- Make sure users and unconfined domains create .hushlogin with the correct label
- Allow pegaus to chat with realmd over DBus
- Allow cobblerd to read network state
- Allow boicn-client to stat on /dev/input/mice
- Allow certwatch to read net_config_t when it executes apache
- Allow readahead to create /run/systemd and then create its own directory with the correct label
Mon May 13 14:00:00 2013 Miroslav Grepl 3.12.1-43
- Transition directories and files when in a user_tmp_t directory
- Change certwatch to domtrans to apache instead of just execute
- Allow virsh_t to read xen lib files
- update policy rules for pegasus_openlmi_account_t
- Add support for svnserve_tmp_t
- Activate account openlmi policy
- pegasus_openlmi_domain_template needs also require pegasus_t
- One more fix for policykit.te
- Call fs_list_cgroups_dirs() in policykit.te
- Allow nagios service plugin to read mysql config files
- Add labeling for /var/svn
- Fix chrome.te
- Fix pegasus_openlmi_domain_template() interfaces
- Fix dev_rw_vfio_dev definiton, allow virtd_t to read tmpfs_t symlinks
- Fix location of google-chrome data
- Add support for chome_sandbox to store content in the homedir
- Allow policykit to watch for changes in cgroups file system
- Add boolean to allow mozilla_plugin_t to use spice
- Allow collectd to bind to udp port
- Allow collected_t to read all of /proc
- Should use netlink socket_perms
- Should use netlink socket_perms
- Allow glance domains to connect to apache ports
- Allow apcupsd_t to manage its log files
- Allow chrome objects to rw_inherited unix_stream_socket from callers
- Allow staff_t to execute virtd_exec_t for running vms
- nfsd_t needs to bind mountd port to make nfs-mountd.service working
- Allow unbound net_admin capability because of setsockopt syscall
- Fix fs_list_cgroup_dirs()
- Label /usr/lib/nagios/plugins/utils.pm as bin_t
- Remove uplicate definition of fs_read_cgroup_files()
- Remove duplicate definition of fs_read_cgroup_files()
- Add files_mountpoint_filetrans interface to be used by quotadb_t and snapperd
- Additional interfaces needed to list and read cgroups config
- Add port definition for collectd port
- Add labels for /dev/ptp
*
- Allow staff_t to execute virtd_exec_t for running vms
Mon May 6 14:00:00 2013 Miroslav Grepl 3.12.1-42
- Allow samba-net to also read realmd tmp files
- Allow NUT to use serial ports
- realmd can be started by systemctl now
Mon May 6 14:00:00 2013 Miroslav Grepl 3.12.1-41
- Remove userdom_home_manager for xdm_t and move all rules to xserver.te directly
- Add new xdm_write_home boolean to allow xdm_t to create files in HOME dirs with xdm_home_t
- Allow postfix-showq to read/write unix.showq in /var/spool/postfix/pid
- Allow virsh to read xen lock file
- Allow qemu-ga to create files in /run with proper labeling
- Allow glusterd to connect to own socket in /tmp
- Allow glance-api to connect to http port to make glance image-create working
- Allow keystonte_t to execute rpm
Fri May 3 14:00:00 2013 Miroslav Grepl 3.12.1-40
- Fix realmd cache interfaces
Fri May 3 14:00:00 2013 Miroslav Grepl 3.12.1-39
- Allow tcpd to execute leafnode
- Allow samba-net to read realmd cache files
- Dontaudit sys_tty_config for alsactl
- Fix allow rules for postfix_var_run
- Allow cobblerd to read /etc/passwd
- Allow pegasus to read exports
- Allow systemd-timedate to read xdm state
- Allow mout to stream connect to rpcbind
- Add labeling just for /usr/share/pki/ca-trust-source instead of /usr/share/pki
Tue Apr 30 14:00:00 2013 Miroslav Grepl 3.12.1-38
- Allow thumbnails to share memory with apps which run thumbnails
- Allow postfix-postqueue block_suspend
- Add lib interfaces for smsd
- Add support for nginx
- Allow s2s running as jabberd_t to connect to jabber_interserver_port_t
- Allow pki apache domain to create own tmp files and execute httpd_suexec
- Allow procmail to manger user tmp files/dirs/lnk_files
- Add virt_stream_connect_svirt() interface
- Allow dovecot-auth to execute bin_t
- Allow iscsid to request that kernel load a kernel module
- Add labeling support for /var/lib/mod_security
- Allow iw running as tuned_t to create netlink socket
- Dontaudit sys_tty_config for thumb_t
- Add labeling for nm-l2tp-service
- Allow httpd running as certwatch_t to open tcp socket
- Allow useradd to manager smsd lib files
- Allow useradd_t to add homedirs in /var/lib
- Fix typo in userdomain.te
- Cleanup userdom_read_home_certs
- Implement userdom_home_reader_certs_type to allow read certs also on encrypt /home with ecryptfs_t
- Allow staff to stream connect to svirt_t to make gnome-boxes working
Fri Apr 26 14:00:00 2013 Miroslav Grepl 3.12.1-37
- Allow lvm to create its own unit files
- Label /var/lib/sepolgen as selinux_config_t
- Add filetrans rules for tw devices
- Add transition from cupsd_config_t to cupsd_t
Wed Apr 24 14:00:00 2013 Miroslav Grepl 3.12.1-36
- Add filetrans rules for tw devices
- Cleanup bad transition lines
Tue Apr 23 14:00:00 2013 Miroslav Grepl 3.12.1-35
- Fix lockdev_manage_files()
- Allow setroubleshootd to read var_lib_t to make email_alert working
- Add lockdev_manage_files()
- Call proper interface in virt.te
- Allow gkeyring_domain to create /var/run/UID/config/dbus file
- system dbus seems to be blocking suspend
- Dontaudit attemps to sys_ptrace, which I believe gpsd does not need
- When you enter a container from root, you generate avcs with a leaked file descriptor
- Allow mpd getattr on file system directories
- Make sure realmd creates content with the correct label
- Allow systemd-tty-ask to write kmsg
- Allow mgetty to use lockdev library for device locking
- Fix selinuxuser_user_share_music boolean name to selinuxuser_share_music
- When you enter a container from root, you generate avcs with a leaked file descriptor
- Make sure init.fc files are labeled correctly at creation
- File name trans vconsole.conf
- Fix labeling for nagios plugins
- label shared libraries in /opt/google/chrome as testrel_shlib_t
Thu Apr 18 14:00:00 2013 Miroslav Grepl 3.12.1-34
- Allow certmonger to dbus communicate with realmd
- Make realmd working
Thu Apr 18 14:00:00 2013 Miroslav Grepl 3.12.1-33
- Fix mozilla specification of homedir content
- Allow certmonger to read network state
- Allow tmpwatch to read tmp in /var/spool/{cups,lpd}
- Label all nagios plugin as unconfined by default
- Add httpd_serve_cobbler_files()
- Allow mdadm to read /dev/sr0 and create tmp files
- Allow certwatch to send mails
- Fix labeling for nagios plugins
- label shared libraries in /opt/google/chrome as testrel_shlib_t
Wed Apr 17 14:00:00 2013 Miroslav Grepl 3.12.1-32
- Allow realmd to run ipa, really needs to be an unconfined_domain
- Allow sandbox domains to use inherted terminals
- Allow pscd to use devices labeled svirt_image_t in order to use cat cards.
- Add label for new alsa pid
- Alsa now uses a pid file and needs to setsched
- Fix oracleasmfs_t definition
- Add support for sshd_unit_file_t
- Add oracleasmfs_t
- Allow unlabeled_t files to be stored on unlabeled_t filesystems
Tue Apr 16 14:00:00 2013 Miroslav Grepl 3.12.1-31 | |
