|
|
 |
|
|
Changelog for selinux-policy-targeted-3.13.1-192.el7_5.4.noarch.rpm :
Thu Jun 7 14:00:00 2018 Lukas Vrabec - 3.13.1-192.4
- Allow certmonger to sends emails
Resolves: rhbz#1588363
Wed Mar 28 14:00:00 2018 Lukas Vrabec - 3.13.1-192.3
- Allow snapperd_t domain to unmount fs_t filesystems
Resolves: rhbz#1561424
Mon Mar 26 14:00:00 2018 Lukas Vrabec - 3.13.1-192.2
- Allow snapperd_t to set priority for kernel processes
Resolves: rhbz#1558656
Wed Mar 21 13:00:00 2018 Lukas Vrabec - 3.13.1-192.1
- Backport several changes for snapperdfrom Fedora Rawhide
Resolves: rhbz#1558656
Tue Feb 27 13:00:00 2018 Lukas Vrabec - 3.13.1-192
- Label /usr/libexec/dbus-1/dbus-daemon-launch-helper as dbusd_exec_t to have systemd dbus services running in the correct domain instead of unconfined_service_t if unconfined.pp module is enabled.
Resolves: rhbz#1546721
Mon Feb 19 13:00:00 2018 Lukas Vrabec - 3.13.1-191
- Allow openvswitch_t stream connect svirt_t
Resolves: rhbz#1540702
Fri Feb 16 13:00:00 2018 Lukas Vrabec - 3.13.1-190
- Allow openvswitch domain to manage svirt_tmp_t sock files
Resolves: rhbz#1540702
- Fix broken systemd_tmpfiles_run() interface
Wed Feb 7 13:00:00 2018 Lukas Vrabec - 3.13.1-189
- Allow dirsrv_t domain to create tmp link files
Resolves: rhbz#1536011
- Label /usr/sbin/ldap-agent as dirsrv_snmp_exec_t
Resolves: rhbz#1428568
- Allow ipsec_mgmt_t execute ifconfig_exec_t binaries
- Allow ipsec_mgmt_t nnp domain transition to ifconfig_t
Resolves: rhbz#1539416
Wed Feb 7 13:00:00 2018 Lukas Vrabec - 3.13.1-188
- Allow svirt_domain to create socket files in /tmp with label svirt_tmp_t
Resolves: rhbz#1540702
- Allow keepalived_t domain getattr proc filesystem
Resolves: rhbz#1477542
- Rename svirt_sandbox_file_t to container_file_t and svirt_lxc_net_t to container_t
Resolves: rhbz#1538544
- Allow ipsec_t nnp transistions to domains ipsec_mgmt_t and ifconfig_t
Resolves: rhbz:#1539416
- Allow systemd_logind_t domain to bind on dhcpd_port_t,pki_ca_port_t,flash_port_t
Resolves: rhbz#1479350
Tue Feb 6 13:00:00 2018 Lukas Vrabec - 3.13.1-187
- Allow openvswitch_t domain to read cpuid, write to sysfs files and creating openvswitch_tmp_t sockets
Resolves: rhbz#1535196
- Add new interface ppp_filetrans_named_content()
Resolves: rhbz#1530601
- Allow keepalived_t read sysctl_net_t files
Resolves: rhbz#1477542
- Allow puppetmaster_t domtran to puppetagent_t
Resolves: rhbz#1376893
- Allow kdump_t domain to read kernel ring buffer
Resolves: rhbz#1540004
- Allow ipsec_t domain to exec ifconfig_exec_t binaries.
Resolves: rhbz#1539416
- Allow unconfined_domain_typ to create pppd_lock_t directory in /var/lock
Resolves: rhbz#1530601
- Allow updpwd_t domain to create files in /etc with shadow_t label
Resolves: rhbz#1412838
- Allow iptables sysctl load list support with SELinux enforced
Resolves: rhbz#1535572
Wed Jan 17 13:00:00 2018 Lukas Vrabec - 3.13.1-186
- Allow virt_domains to acces infiniband pkeys.
Resolves: rhbz#1533183
- Label /usr/libexec/ipsec/addconn as ipsec_exec_t to run this script as ipsec_t instead of init_t
Resolves: rhbz#1535133
- Allow audisp_remote_t domain write to files on all levels
Resolves: rhbz#1534924
Thu Jan 11 13:00:00 2018 Lukas Vrabec - 3.13.1-185
- Allow vmtools_t domain creating vmware_log_t files
Resolves: rhbz#1507048
- Allow openvswitch_t domain to acces infiniband devices
Resolves: rhbz#1532705
Wed Jan 10 13:00:00 2018 Lukas Vrabec - 3.13.1-184
- Allow chronyc_t domain to manage chronyd_keys_t files.
Resolves: rhbz#1530525
- Make virtlog_t domain system dbus client
Resolves: rhbz#1481109
- Update openvswitch SELinux module
Resolves: rhbz#1482682
- Allow virtd_t to create also sock_files with label virt_var_run_t
Resolves: rhbz#1484075
Mon Dec 11 13:00:00 2017 Lukas Vrabec - 3.13.1-183
- Allow domains that manage logfiles to man logdirs
Resolves: rhbz#1523811
Thu Dec 7 13:00:00 2017 Lukas Vrabec - 3.13.1-182
- Label /dev/drm_dp_aux
* as xserver_misc_device_t
Resolves: rhbz#1520897
- Allow sysadm_t to run puppet_exec_t binaries as puppet_t
Resolves: rhbz#1255745
Mon Dec 4 13:00:00 2017 Lukas Vrabec - 3.13.1-181
- Allow tomcat_t to manage pki_tomcat pid files
Resolves: rhbz#1478371
- networkmanager: allow talking to openvswitch
Resolves: rhbz#1517247
- Allow networkmanager_t and opensm_t to manage subned endports for IPoIB VLANs
Resolves: rhbz#1517895
- Allow domains networkmanager_t and opensm_t to control IPoIB VLANs
Resolves: rhbz#1517744
- Fix typo in guest interface file
Resolves: rhbz#1468254
- Allow isnsd_t domain to accept tcp connections.
Resolves: rhbz#1390208
Mon Nov 20 13:00:00 2017 Lukas Vrabec - 3.13.1-180
- Allow getty to use usbttys
Resolves: rhbz#1514235
Mon Nov 13 13:00:00 2017 Lukas Vrabec - 3.13.1-179
- Allow ldap_t domain to manage also slapd_tmp_t lnk files
Resolves: rhbz#1510883
- Allow cluster_t domain creating bundles directory with label var_log_t instead of cluster_var_log_t
Resolves: rhbz:#1508360
- Add dac_read_search and dac_override capabilities to ganesha
Resolves: rhbz#1483451
Wed Nov 8 13:00:00 2017 Lukas Vrabec - 3.13.1-178
- Add dependency for policycoreutils-2.5.18 becuase of new cgroup_seclabel policy capability
Resolves: rhbz#1510145
Mon Nov 6 13:00:00 2017 Lukas Vrabec - 3.13.1-177
- Allow jabber domains to connect to postgresql ports
Resolves: rhbz#1438489
- Dontaudit accountsd domain creating dirs in /root
Resolves: rhbz#1456760
- Dontaudit slapd_t to block suspend system
Resolves: rhbz: #1479759
- Allow spamc_t to stream connect to cyrus.
Resolves: rhbz#1382955
- allow imapd to read /proc/net/unix file
Resolves: rhbz#1393030
- Allow passenger to connect to mysqld_port_t
Resolves: rhbz#1433464
Mon Nov 6 13:00:00 2017 Lukas Vrabec - 3.13.1-176
- Allow chronyc_t domain to use user_ptys
Resolves: rhbz#1470150
- allow ptp4l to read /proc/net/unix file
- Allow conmand to use usb ttys.
Resolves: rhbz#1505121
- Label all files /var/log/opensm.
* as opensm_log_t because opensm creating new log files with name opensm-subnet.lst
Resolves: rhbz#1505845
- Allow chronyd daemon to execute chronyc.
Resolves: rhbz#1508486
- Allow firewalld exec ldconfig.
Resolves: rhbz#1375576
- Allow mozilla_plugin_t domain to dbus chat with devicekit
Resolves: rhbz#1460477
- Dontaudit leaked logwatch pipes
Resolves: rhbz#1450119
- Label /usr/bin/VGAuthService as vmtools_exec_t to confine this daemon.
Resolves: rhbz#1507048
- Allow httpd_t domain to execute hugetlbfs_t files
Resolves: rhbz#1507682
- Allow nfsd_t domain to read configfs_t files/dirs
Resolves: rhbz#1439442
- Hide all allow rules with ptrace inside deny_ptrace boolean
Resolves: rhbz#1421075
- Allow tgtd_t domain to read generic certs
Resolves: rhbz#1438532
- Allow ptp4l to send msgs via dgram socket to unprivileged user domains
Resolves: rhbz#1429853
- Allow dirsrv_snmp_t to use inherited user ptys and read system state
Resolves: rhbz#1428568
- Allow glusterd_t domain to create own tmpfs dirs/files
Resolves: rhbz#1411310
- Allow keepalived stream connect to snmp
Resolves: rhbz#1401556
- After fix in kernel where LSM hooks for dac_override and dac_search_read capability was swaped we need to fix it also in policy
Resolves: rhbz#1507089
Fri Oct 27 14:00:00 2017 Lukas Vrabec - 3.13.1-175
- Allow pegasus_openlmi_services_t to read generic certs
Resolves: rhbz#1462292
- Allow ganesha_t domain to read random device
Resolves: rhbz#1494382
- Allow zabbix_t domain to change its resource limits
Resolves: rhbz:#1504074
- Add new boolean nagios_use_nfs
Resolves: rhbz#1504826
- Allow system_mail_t to search network sysctls
Resolves: rhbz#1505779
- Add samba_manage_var_dirs() interface
- Fix typo bug in virt filecontext file
- Allow nagios_script_t to read nagios_spool_t files
Resolves: rhbz#1426824
- Allow samba to manage var dirs/files
Resolves: rhbz#1415088
- Allow sbd_t to create own sbd_tmpfs_t dirs/files
Resolves: rhbz#1380795
- Allow firewalld and networkmanager to chat with hypervkvp via dbus
Resolves: rhbz#1377276
- Allow dmidecode to read rhsmcert_log_t files
Resolves: rhbz#1300799
- Allow mail system to connect mariadb sockets.
Resolves: rhbz#1368642
- Allow logrotate_t to change passwd and reloead services
Resolves: rhbz#1450789
- Allow mail system to connect mariadb sockets.
Resolves: rhbz#1368642
- Allow logrotate_t to change passwd and reloead services
Resolves: rhbz#1450789
- Allow pegasus_openlmi_services_t to read generic certs
Resolves: rhbz#1462292
- Allow ganesha_t domain to read random device
Resolves: rhbz#1494382
- Allow zabbix_t domain to change its resource limits
Resolves: rhbz:#1504074
- Add new boolean nagios_use_nfs
Resolves: rhbz#1504826
- Allow system_mail_t to search network sysctls
Resolves: rhbz#1505779
- Add samba_manage_var_dirs() interface
- Fix typo bug in virt filecontext file
- Allow nagios_script_t to read nagios_spool_t files
Resolves: rhbz#1426824
- Allow samba to manage var dirs/files
Resolves: rhbz#1415088
- Allow sbd_t to create own sbd_tmpfs_t dirs/files
Resolves: rhbz#1380795
- Allow firewalld and networkmanager to chat with hypervkvp via dbus
Resolves: rhbz#1377276
- Allow dmidecode to read rhsmcert_log_t files
Resolves: rhbz#1300799
- Allow mail system to connect mariadb sockets.
Resolves: rhbz#1368642
- Allow logrotate_t to change passwd and reloead services
Resolves: rhbz#1450789
- Allow chronyd_t do request kernel module and block_suspend capability
Resolves: rhbz#1350765
- Allow system_cronjob_t to create /var/lib/letsencrypt dir with right label
Resolves: rhbz#1447278
- Allow httpd_t also read httpd_user_content_type dirs when httpd_enable_homedirs is enables
Resolves: rhbz#1491994
- Allow svnserve to use kerberos
Resolves: rhbz#1475271
- Allow conman to use ptmx. Add conman_use_nfs boolean
Resolves: rhbz#1377915
- Add nnp transition for services using: NoNewPrivileges systemd security feature
Resolves: rhbz#1311430
- Add SELinux support for chronyc
Resolves: rhbz#1470150
- Add dac_read_search capability to openvswitch_t domain
Resolves: rhbz#1501336
- Allow svnserve to manage own svnserve_log_t files/dirs
Resolves: rhbz#1480741
- Allow keepalived_t to search network sysctls
Resolves: rhbz#1477542
- Allow puppetagent_t domain dbus chat with rhsmcertd_t domain
Resolves: rhbz#1446777
- Add dccp_socket into socker_class_set subset
Resolves: rhbz#1459941
- Allow iptables_t to run setfiles to restore context on system
Resolves: rhbz#1489118
- Label 20514 tcp/udp ports as syslogd_port_t Label 10514 tcp/udp portas as syslog_tls_port_t
Resolves: rhbz:#1411400
- Make nnp transition Active
Resolves: rhbz#1480518
- Label tcp 51954 as isns_port_t
Resolves: rhbz#1390208
- Add dac_read_search capability chkpwd_t
Resolves: rhbz#1376991
- Add support for running certbot(letsencrypt) in crontab
Resolves: rhbz#1447278
- Add init_nnp_daemon_domain interface
- Allow xdm_t to gettattr /dev/loop-control device
Resolves: rhbz#1462925
- Allow nnp trasintion for unconfined_service_t
Resolves: rhbz#1311430
- Allow unpriv user domains and unconfined_service_t to use chronyc
Resolves: rhbz#1470150
- Allow iptables to exec plymouth.
Resolves: rhbz#1480374
- Fix typo in fs_unmount_tracefs interface.
Resolves: rhbz#1371057
- Label postgresql-check-db-dir as postgresql_exec_t
Resolves: rhbz#1490956
Tue Sep 26 14:00:00 2017 Lukas Vrabec - 3.13.1-174
- We should not ship selinux-policy with permissivedomains enabled.
Resolves: rhbz#1494172
- Fix order of installing selinux-policy-sandbox, because of depedencied in sandbox module, selinux-policy-targeted needs to be installed before selinux-policy-sandbox
Resolves: rhbz#1492606
Tue Sep 19 14:00:00 2017 Lukas Vrabec - 3.13.1-173
- Allow tomcat to setsched
Resolves: rhbz#1492730
- Fix rules blocking ipa-server upgrade process
Resolves: rhbz#1478371
- Add new boolean tomcat_read_rpm_db()
Resolves: rhbz#1477887
- Allow tomcat to connect on mysqld tcp ports
- Add ctdbd_t domain sys_source capability and allow setrlimit
Resolves: rhbz#1491235
- Fix keepalived SELinux module
- Allow automount domain to manage mount pid files
Resolves: rhbz#1482381
- Allow stunnel_t domain setsched
Resolves: rhbz#1479383
- Add keepalived domain setpgid capability
Resolves: rhbz#1486638
- Allow tomcat domain to connect to mssql port
Resolves: rhbz#1484572
- Remove snapperd_t from unconfined domaines
Resolves: rhbz#1365555
- Fix typo bug in apache module
Resolves: rhbz#1397311
- Dontaudit that system_mail_t is trying to read /root/ files
Resolves: rhbz#1147945
- Make working webadm_t userdomain
Resolves: rhbz#1323792
- Allow redis domain to execute shell scripts.
Resolves: rhbz#1421326
- Allow system_cronjob_t to create redhat-access-insights.log with var_log_t
Resolves: rhbz#1473303
- Add couple capabilities to keepalived domain and allow get attributes of all domains
Resolves: rhbz#1429327
- Allow dmidecode read rhsmcertd lock files
Resolves: rhbz#1300799
- Add new interface rhsmcertd_rw_lock_files()
Resolves: rhbz#1300799
- Label all plymouthd archives as plymouthd_var_log_t
Resolves: rhbz#1478323
- Allow cloud_init_t to dbus chat with systemd_timedated_t
Resolves: rhbz#1440730
- Allow logrotate_t to write to kmsg
Resolves: rhbz#1397744
- Add capability kill to rhsmcertd_t
Resolves: rhbz#1398338
- Disable mysqld_safe_t secure mode environment cleansing.
Resolves: rhbz#1464063
- Allow winbind to manage smbd_tmp_t files
Resolves: rhbz#1475566
- Dontaudit that system_mail_t is trying to read /root/ files
Resolves: rhbz#1147945
- Make working webadm_t userdomain
Resolves: rhbz#1323792
- Allow redis domain to execute shell scripts.
Resolves: rhbz#1421326
- Allow system_cronjob_t to create redhat-access-insights.log with var_log_t
Resolves: rhbz#1473303
- Add couple capabilities to keepalived domain and allow get attributes of all domains
Resolves: rhbz#1429327
- Allow dmidecode read rhsmcertd lock files
Resolves: rhbz#1300799
- Add new interface rhsmcertd_rw_lock_files()
Resolves: rhbz#1300799
- Label all plymouthd archives as plymouthd_var_log_t
Resolves: rhbz#1478323
- Allow cloud_init_t to dbus chat with systemd_timedated_t
Resolves: rhbz#1440730
- Allow logrotate_t to write to kmsg
Resolves: rhbz#1397744
- Add capability kill to rhsmcertd_t
Resolves: rhbz#1398338
- Disable mysqld_safe_t secure mode environment cleansing.
Resolves: rhbz#1464063
- Allow winbind to manage smbd_tmp_t files
Resolves: rhbz#1475566
- Add interface systemd_tmpfiles_run
- End of file cannot be in comment
- Allow systemd-logind to use ypbind
Resolves: rhbz#1479350
- Add creating opasswd file with shadow_t SELinux label in auth_manage_shadow() interface
Resolves: rhbz#1412838
- Allow sysctl_irq_t assciate with proc_t
Resolves: rhbz#1485909
- Enable cgourp sec labeling
Resolves: rhbz#1485947
- Add cgroup_seclabel policycap.
Resolves: rhbz#1485947
- Allow sshd_t domain to send signull to xdm_t processes
Resolves: rhbz#1448959
- Allow updpwd_t domain auth file name trans
Resolves: rhbz#1412838
- Allow sysadm user to run systemd-tmpfiles
Resolves: rbhz#1325364
- Add support labeling for vmci and vsock device
Resolves: rhbz#1451358
- Add userdom_dontaudit_manage_admin_files() interface
Resolves: rhbz#1323792
- Allow iptables_t domain to read files with modules_conf_t label
Resolves: rhbz#1373220
- init: Add NoNewPerms support for systemd.
Resolves: rhbz#1480518
- Add nnp_nosuid_transition policycap and related class/perm definitions.
Resolves: rhbz#1480518
- refpolicy: Infiniband pkeys and endports
Resolves: rhbz#1464484
Tue Aug 29 14:00:00 2017 Lukas Vrabec - 3.13.1-172
- Allow certmonger using systemctl on pki_tomcat unit files
Resolves: rhbz#1481388
Tue Aug 29 14:00:00 2017 Lukas Vrabec - 3.13.1-171
- Allow targetd_t to create own tmp files.
- Dontaudit targetd_t to exec rpm binary file.
Resolves: rhbz#1373860
Resolves: rhbz#1424621
Thu Aug 24 14:00:00 2017 Lukas Vrabec - 3.13.1-170
- Add few rules to make working targetd daemon with SELinux
Resolves: rhbz#1373860
- Allow ipmievd_t domain to load kernel modules
Resolves: rhbz#1441081
- Allow logrotate to reload transient systemd unit
Resolves: rhbz#1440515
- Add certwatch_t domain dac_override and dac_read_search capabilities
Resolves: rhbz#1422000
- Allow postgrey to execute bin_t files and add postgrey into nsswitch_domain
Resolves: rhbz#1412072
- Allow nscd_t domain to search network sysctls
Resolves: rhbz#1432361
- Allow iscsid_t domain to read mount pid files
Resolves: rhbz#1482097
- Allow ksmtuned_t domain manage sysfs_t files/dirs
Resolves: rhbz#1413865
- Allow keepalived_t domain domtrans into iptables_t
Resolves: rhbz#1477719
- Allow rshd_t domain reads net sysctls
Resolves: rhbz#1477908
- Add interface seutil_dontaudit_read_module_store()
- Update interface lvm_rw_pipes() by adding also open permission
- Label /dev/clp device as vfio_device_t
Resolves: rhbz#1477624
- Allow ifconfig_t domain unmount fs_t
Resolves: rhbz#1477445
- Label /dev/gpiochip
* devices as gpio_device_t
Resolves: rhbz#1477618
- Add interface dev_manage_sysfs()
Resolves: rhbz#1474989
Mon Aug 14 14:00:00 2017 Lukas Vrabec - 3.13.1-169
- Label /usr/libexec/sudo/sesh as shell_exec_t
Resolves: rhbz#1480791
Fri Aug 11 14:00:00 2017 Lukas Vrabec - 3.13.1-168
- Allow tomcat_t domain couple capabilities to make working tomcat-jsvc
Resolves: rhbz#1470735
Wed Aug 9 14:00:00 2017 Lukas Vrabec - 3.13.1-167
- Allow llpdad send dgram to libvirt
Resolves: rhbz#1472722
Mon Jul 10 14:00:00 2017 Lukas Vrabec - 3.13.1-166
- Add new boolean gluster_use_execmem
Resolves: rhbz#1469027
- Allow cluster_t and glusterd_t domains to dbus chat with ganesha service
Resolves: rhbz#1468581
Mon Jun 26 14:00:00 2017 Lukas Vrabec - 3.13.1-165
- Dontaudit staff_t user read admin_home_t files.
Resolves: rhbz#1290633
Wed Jun 21 14:00:00 2017 Lukas Vrabec - 3.13.1-164
- Allow couple rules needed to start targetd daemon with SELinux in enforcing mode
Resolves: rhbz#1424621
- Add interface lvm_manage_metadata
Resolves: rhbz#1424621
Tue Jun 20 14:00:00 2017 Lukas Vrabec - 3.13.1-163
- Allow sssd_t to read realmd lib files.
Resolves: rhbz#1436689
- Add permission open to files_read_inherited_tmp_files() interface
Resolves: rhbz#1290633
Resolves: rhbz#1457106
Thu Jun 15 14:00:00 2017 Lukas Vrabec - 3.13.1-162
- Allow unconfined_t user all user namespace capabilties.
Resolves: rhbz#1461488
Thu Jun 8 14:00:00 2017 Lukas Vrabec - 3.13.1-161
- Allow httpd_t to read realmd_var_lib_t files Resolves: rhbz#1436689
Tue Jun 6 14:00:00 2017 Lukas Vrabec - 3.13.1-160
- Allow named_t to bind on udp 4321 port
Resolves: rhbz#1312972
- Allow systemd-sysctl cap. sys_ptrace
Resolves: rhbz#1458999
Mon Jun 5 14:00:00 2017 Lukas Vrabec - 3.13.1-159
- Allow pki_tomcat_t execute ldconfig.
Resolves: rhbz#1436689
Fri Jun 2 14:00:00 2017 Lukas Vrabec - 3.13.1-158
- Allow iscsi domain load kernel module.
Resolves: rhbz#1457874
- Allow keepalived domain connect to squid tcp port
Resolves: rhbz#1457455
- Allow krb5kdc_t domain read realmd lib files.
Resolves: rhbz#1436689
- xdm_t should view kernel keys
Resolves: rhbz#1432645
Thu Jun 1 14:00:00 2017 Lukas Vrabec - 3.13.1-157
- Allow tomcat to connect on all unreserved ports
- Allow ganesha to connect to all rpc ports
Resolves: rhbz#1448090
- Update ganesha with another fixes.
Resolves: rhbz#1448090
- Update rpc_read_nfs_state_data() interface to allow read also lnk_files.
Resolves: rhbz#1448090
- virt_use_glusterd boolean should be in optional block Update ganesha module to allow create tmp files
Resolves: rhbz#1448090
- Hide broken symptoms when machine is configured with network bounding.
Wed May 31 14:00:00 2017 Lukas Vrabec - 3.13.1-156
- Add new boolean virt_use_glusterd
Resolves: rhbz#1455994
- Add capability sys_boot for sbd_t domain
- Allow sbd_t domain to create rpc sysctls.
Resolves: rhbz#1455631
- Allow ganesha_t domain to manage glusterd_var_run_t pid files.
Resolves: rhbz#1448090
Tue May 30 14:00:00 2017 Lukas Vrabec - 3.13.1-155
- Create new interface: glusterd_read_lib_files()
- Allow ganesha read glusterd lib files.
- Allow ganesha read network sysctls
Resolves: rhbz#1448090
Mon May 29 14:00:00 2017 Lukas Vrabec - 3.13.1-154
- Add few allow rules to ganesha module
Resolves: rhbz#1448090
- Allow condor_master_t to read sysctls.
Resolves: rhbz#1277506
- Add dac_override cap to ctdbd_t domain
Resolves: rhbz#1435708
- Label 8750 tcp/udp port as dey_keyneg_port_t
Resolves: rhbz#1448090
Mon May 29 14:00:00 2017 Lukas Vrabec - 3.13.1-153
- Add ganesha_use_fusefs boolean.
Resolves: rhbz#1448090
Wed May 24 14:00:00 2017 Lukas Vrabec - 3.13.1-152
- Allow httpd_t reading kerberos kdc config files
Resolves: rhbz#1452215
- Allow tomcat_t domain connect to ibm_dt_2 tcp port.
Resolves: rhbz#1447436
- Allow stream connect to initrc_t domains
Resolves: rhbz#1447436
- Allow dnsmasq_t domain to read systemd-resolved pid files.
Resolves: rhbz#1453114
- Allow tomcat domain name_bind on tcp bctp_port_t
Resolves: rhbz#1451757
- Allow smbd_t domain generate debugging files under /var/run/gluster. These files are created through the libgfapi.so library that provides integration of a GlusterFS client in the Samba (vfs_glusterfs) process.
Resolves: rhbz#1447669
- Allow condor_master_t write to sysctl_net_t
Resolves: rhbz#1277506
- Allow nagios check disk plugin read /sys/kernel/config/
Resolves: rhbz#1277718
- Allow pcp_pmie_t domain execute systemctl binary
Resolves: rhbz#1271998
- Allow nagios to connect to stream sockets. Allow nagios start httpd via systemctl
Resolves: rhbz#1247635
- Label tcp/udp port 1792 as ibm_dt_2_port_t
Resolves: rhbz#1447436
- Add interface fs_read_configfs_dirs()
- Add interface fs_read_configfs_files()
- Fix systemd_resolved_read_pid interface
- Add interface systemd_resolved_read_pid()
Resolves: rhbz#1453114
- Allow sshd_net_t domain read/write into crypto devices
Resolves: rhbz#1452759
- Label 8999 tcp/udp as bctp_port_t
Resolves: rhbz#1451757
Thu May 18 14:00:00 2017 Lukas Vrabec - 3.13.1-151
- nmbd_t needs net_admin capability like smbd
Resolves: rhbz#1431859
- Dontaudit net_admin capability for domains postfix_master_t and postfix_qmgr_t
Resolves: rhbz#1431859
- Allow rngd domain read sysfs_t
Resolves: rhbz#1451735
- Add interface pki_manage_common_files()
Resolves: rhbz#1447436
- Allow tomcat_t domain to manage pki_common_t files and dirs
Resolves: rhbz#1447436
- Use stricter fc rules for sssd sockets in /var/run
Resolves: rhbz#1448060
- Allow certmonger reads httpd_config_t files
Resolves: rhbz#1436689
- Allow keepalived_t domain creating netlink_netfilter_socket.
Resolves: rhbz#1451684
- Allow tomcat domain read rpm_var_lib_t files Allow tomcat domain exec rpm_exec_t files Allow tomcat domain name connect on oracle_port_t Allow tomcat domain read cobbler_var_lib_t files.
Resolves: rhbz#1451318
- Make able deply overcloud via neutron_t to label nsfs as fs_t
Resolves: rhbz#1373321
Tue May 16 14:00:00 2017 Lukas Vrabec - 3.13.1-150
- Allow tomcat domain read rpm_var_lib_t files Allow tomcat domain exec rpm_exec_t files Allow tomcat domain name connect on oracle_port_t Allow tomcat domain read cobbler_var_lib_t files.
Resolves: rhbz#1451318
- Allow sssd_t domain creating sock files labeled as sssd_var_run_t in /var/run/
Resolves: rhbz#1448056 Resolves: rhbz#1448060
- Allow tomcat_domain connect to
* postgresql_port_t
* amqp_port_t Allow tomcat_domain read network sysctls
Resolves: rhbz#1450819
- Make able deply overcloud via neutron_t to label nsfs as fs_t
Resolves: rhbz#1373321
- Allow netutils setpcap capability
Resolves:1444438
Mon May 15 14:00:00 2017 Lukas Vrabec - 3.13.1-149
- Update targetd policy to accommodate changes in the service
Resolves: rhbz#1424621
- Allow tomcat_domain connect to
* postgresql_port_t
* amqp_port_t Allow tomcat_domain read network sysctls
Resolves: rhbz#1450819
- Update virt_rw_stream_sockets_svirt() interface to allow confined users set socket options.
Resolves: rhbz#1415841
- Allow radius domain stream connec to postgresql
Resolves: rhbz#1446145
- Allow virt_domain to read raw fixed_disk_device_t to make working blockcommit
Resolves: rhbz#1449977
- Allow glusterd_t domain start ganesha service
Resolves: rhbz#1448090
- Made few cosmetic changes in sssd SELinux module
Resolves: rhbz#1448060
- sssd-kcm should not run as unconfined_service_t BZ(1447411)
Resolves: rhbz#1448060
- Add sssd_secrets labeling Also add named_filetrans interface to make sure all labels are correct
Resolves: rhbz#1448056
- Allow keepalived_t domain read usermodehelper_t
Resolves: rhbz#1449769
- Allow tomcat_t domain read pki_common_t files
Resolves: rhbz#1447436
- Add interface pki_read_common_files()
Resolves: rhbz#1447436
Tue May 9 14:00:00 2017 Lukas Vrabec - 3.13.1-148
- Allow hypervkvp_t domain execute hostname
Resolves: rhbz#1449064
- Dontaudit sssd_selinux_manager_t use of net_admin capability
Resolves: rhbz#1444955
- Allow tomcat_t stream connect to pki_common_t
Resolves: rhbz#1447436
- Dontaudit xguest_t\'s attempts to listen to its tcp_socket
- Allow sssd_selinux_manager_t to ioctl init_t sockets
Resolves: rhbz#1436689
- Allow _su_t to create netlink_selinux_socket
Resolves rhbz#1146987
- Allow unconfined_t to module_load any file
Resolves rhbz#1442994
Sat Apr 29 14:00:00 2017 Lukas Vrabec - 3.13.1-147
- Improve ipa_cert_filetrans_named_content() interface to also allow caller domain manage ipa_cert_t type.
Resolves: rhbz#1436689
Fri Apr 28 14:00:00 2017 Lukas Vrabec - 3.13.1-146
- Allow pki_tomcat_t domain read /etc/passwd.
Resolves: rhbz#1436689
- Allow tomcat_t domain read ipa_tmp_t files
Resolves: rhbz#1436689
- Label new path for ipa-otpd
Resolves: rhbz#1446353
- Allow radiusd_t domain stream connect to postgresql_t
Resolves: rhbz#1446145
- Allow rhsmcertd_t to execute hostname_exec_t binaries.
Resolves: rhbz#1445494
- Allow virtlogd to append nfs_t files when virt_use_nfs=1
Resolves: rhbz#1402561
Wed Apr 26 14:00:00 2017 Lukas Vrabec - 3.13.1-145
- Update tomcat policy to adjust for removing unconfined_domain attr.
Resolves: rhbz#1432083
- Allow httpd_t domain read also httpd_user_content_type lnk_files.
Resolves: rhbz#1383621
- Allow httpd_t domain create /etc/httpd/alias/ipaseesion.key with label ipa_cert_t
Resolves: rhbz#1436689
- Dontaudit _gkeyringd_t stream connect to system_dbusd_t
Resolves: rhbz#1052880
- Label /var/www/html/nextcloud/data as httpd_sys_rw_content_t
Resolves: rhbz#1425530
- Add interface ipa_filetrans_named_content()
Resolves: rhbz#1432115
- Allow tomcat use nsswitch
Resolves: rhbz#1436689
- Allow certmonger_t start/status generic services
Resolves: rhbz#1436689
- Allow dirsrv read cgroup files.
Resolves: rhbz#1436689
- Allow ganesha_t domain read/write infiniband devices.
Resolves: rhbz#1383784
- Allow sendmail_t domain sysctl_net_t files
Resolves: rhbz#1369376
- Allow targetd_t domain read network state and getattr on loop_control_device_t
Resolves: rhbz#1373860
- Allow condor_schedd_t domain send mails.
Resolves: rhbz#1277506
- Alow certmonger to create own systemd unit files.
Resolves: rhbz#1436689
- Allow staff to systemctl virt server when staff_use_svirt=1
Resolves: rhbz#1415841
- Allow unconfined_t create /tmp/ca.p12 file with ipa_tmp_t context
Resolves: rhbz#1432115
- Label /sysroot/ostree/deploy/rhel-atomic-host/
* as root_t
Resolves: rhbz#1428112
Wed Apr 19 14:00:00 2017 Lukas Vrabec - 3.13.1-144
- Alow certmonger to create own systemd unit files.
Resolves: rhbz#1436689
Tue Apr 18 14:00:00 2017 Lukas Vrabec - 3.13.1-143
- Hide broken symptoms when using kernel 3.10.0-514+ with network bonding. Postfix_picup_t domain requires NET_ADMIN capability which is not really needed.
Resolves: rhbz#1431859
- Fix policy to reflect all changes in new IPA release
Resolves: rhbz#1432115
Resolves: rhbz#1436689
Wed Apr 12 14:00:00 2017 Lukas Vrabec - 3.13.1-142
- Allow sbd_t to read/write fixed disk devices
Resolves: rhbz#1440165
- Add sys_ptrace capability to radiusd_t domain
Resolves: rhbz#1426641
- Allow cockpit_session_t domain connects to ssh tcp ports.
Resolves: rhbz#1413509
Fri Apr 7 14:00:00 2017 Lukas Vrabec - 3.13.1-141
- Update tomcat policy to make working ipa install process
Resolves: rhbz#1436689
Wed Apr 5 14:00:00 2017 Lukas Vrabec - 3.13.1-140
- Allow pcp_pmcd_t net_admin capability.
- Allow pcp_pmcd_t read net sysctls
- Allow system_cronjob_t create /var/run/pcp with pcp_var_run_t
Resolves: rhbz#1336211
Wed Apr 5 14:00:00 2017 Lukas Vrabec - 3.13.1-139
- Fix all AVC denials during pkispawn of CA
Resolves: rhbz#1436383
- Update pki interfaces and tomcat module
Resolves: rhbz#1436689
Tue Apr 4 14:00:00 2017 Lukas Vrabec - 3.13.1-138
- Update pki interfaces and tomcat module
Resolves: rhbz#1436689
Tue Apr 4 14:00:00 2017 Lukas Vrabec - 3.13.1-137
- Dontaudit firewalld wants write to /root
Resolves: rhbz#1438708
- Dontaudit firewalld to create dirs in /root/
Resolves: rhbz#1438708
- Allow sendmail to search network sysctls
Resolves: rhbz#1369376
- Add interface gssd_noatsecure()
Resolves: rhbz#1438036
- Add interface gssproxy_noatsecure()
Resolves: rhbz#1438036
- Dontaudit pcp_pmlogger_t search for xserver logs. Allow pcp_pmlogger_t to send signals to unconfined doamins Allow pcp_pmlogger_t to send logs to journals
Resolves: rhbz#1379371
- Allow chronyd_t net_admin capability to allow support HW timestamping.
Resolves: rhbz#1416015
- Update tomcat policy
Resolves: rhbz#1436689
Resolves: rhbz#1436383
- Allow certmonger to start haproxy service
Resolves: rhbz#1349394
- Allow init noatsecure for gssd and gssproxy
Resolves: rhbz#1438036
Thu Mar 30 14:00:00 2017 Lukas Vrabec - 3.13.1-136
- geoclue wants to dbus chat with avahi
Resolves: rhbz#1434286
- Allow iptables get list of kernel modules
Resolves: rhbz#1367520
- Allow unconfined_domain_type to enable/disable transient unit
Resolves: rhbz#1337041
- Add interfaces init_enable_transient_unit() and init_disable_transient_unit
- Revert \"Allow sshd setcap capability. This is needed due to latest changes in sshd\"
Resolves: rhbz#1435264
- Label sysroot dir under ostree as root_t
Resolves: rhbz#1428112
Wed Mar 29 14:00:00 2017 Lukas Vrabec - 3.13.1-135
- Remove ganesha_t domain from permissive domains.
Resolves: rhbz#1436988
Tue Mar 28 14:00:00 2017 Lukas Vrabec - 3.13.1-134
- Allow named_t domain bind on several udp ports
Resolves: rhbz#1312972
- Update nscd_use() interface
Resolves: rhbz#1281716
- Allow radius_t domain ptrace
Resolves: rhbz#1426641
- Update nagios to allos exec systemctl
Resolves: rhbz#1247635
- Update pcp SELinux module to reflect all pcp changes
Resolves: rhbz#1271998
- Label /var/lib/ssl_db as squid_cache_t Label /etc/squid/ssl_db as squid_cache_t
Resolves: rhbz#1325527
- Allow pcp_pmcd_t domain search for network sysctl Allow pcp_pmcd_t domain sys_ptrace capability Resolves: rhbz#1336211
Mon Mar 27 14:00:00 2017 Lukas Vrabec - 3.13.1-133
- Allow drbd load modules
Resolves: rhbz#1134883
- Revert \"Add sys_module capability for drbd
Resolves: rhbz#1134883\"
- Allow stapserver list kernel modules
Resolves: rhbz#1325976
- Update targetd policy
Resolves: rhbz#1373860
- Add sys_admin capability to amanda
Resolves: rhbz#1371561
- Allow hypervvssd_t to read all dirs.
Resolves: rhbz#1331309
- Label /run/haproxy.sock socket as haproxy_var_run_t
Resolves: rhbz#1386233
- Allow oddjob_mkhomedir_t to mamange autofs_t dirs.
Resolves: rhbz#1408819
- Allow tomcat to connect on http_cache_port_t
Resolves: rhbz#1432083
- Allow geoclue to send msgs to syslog.
Resolves: rhbz#1434286
- Allow condor_master_t domain capability chown.
Resolves: rhbz#1277506
- Update mta_filetrans_named_content() interface to allow calling domain create files labeled as etc_aliases_t in dir labeled as etc_mail_t.
Resolves: rhbz#1167468
- Allow nova domain search for httpd configuration.
Resolves: rhbz#1190761
- Add sys_module capability for drbd
Resolves: rhbz#1134883
- Allow user_u users stream connect to dirsrv, Allow sysadm_u and staff_u users to manage dirsrv files
Resolves: rhbz#1286474
- Allow systemd_networkd_t communicate with systemd_networkd_t via dbus
Resolves: rhbz#1278010
Wed Mar 22 13:00:00 2017 Lukas Vrabec - 3.13.1-132
- Add haproxy_t domain fowner capability
Resolves: rhbz#1386233
- Allow domain transition from ntpd_t to hwclock_t domains
Resolves: rhbz#1375624
- Allow cockpit_session_t setrlimit and sys_resource
Resolves: rhbz#1402316
- Dontaudit svirt_t read state of libvirtd domain
Resolves: rhbz#1426106
- Update httpd and gssproxy modules to reflects latest changes in freeipa
Resolves: rhbz#1432115
- Allow iptables read modules_conf_t
Resolves: rhbz#1367520
Wed Mar 22 13:00:00 2017 Lukas Vrabec - 3.13.1-131
- Remove tomcat_t domain from unconfined domains
Resolves: rhbz#1432083
- Create new boolean: sanlock_enable_home_dirs()
Resolves: rhbz#1432783
- Allow mdadm_t domain to read/write nvme_device_t
Resolves: rhbz#1431617
- Remove httpd_user_
*_content_t domains from user_home_type attribute. This tighten httpd policy and acces to user data will be more strinct, and also fix mutual influente between httpd_enable_homedirs and httpd_read_user_content
Resolves: rhbz#1383621
- Dontaudit domain to create any file in /proc. This is kernel bug.
Resolves: rhbz#1412679
- Add interface dev_rw_nvme
Resolves: rhbz#1431617
Thu Mar 16 13:00:00 2017 Lukas Vrabec - 3.13.1-130
- Allow gssproxy to get attributes on all filesystem object types.
Resolves: rhbz#1430295
- Allow ganesha to chat with unconfined domains via dbus
Resolves: rhbz#1426554
- add the policy required for nextcloud
Resolves: rhbz#1425530
- Add nmbd_t capability2 block_suspend
Resolves: rhbz#1425357
- Label /var/run/chrony as chronyd_var_run_t
Resolves: rhbz#1416015
- Add domain transition from sosreport_t to iptables_t
Resolves: rhbz#1359789
- Fix path to /usr/lib64/erlang/erts-5.10.4/bin/epmd
Resolves: rhbz:#1332803
Tue Mar 14 13:00:00 2017 Lukas Vrabec - 3.13.1-129
- Update rpm macros
Resolves: rhbz#1380854
Mon Mar 13 13:00:00 2017 Lukas Vrabec - 3.13.1-128
- Add handling booleans via selinux-policy macros in custom policy spec files.
Resolves: rhbz#1380854
Thu Mar 9 13:00:00 2017 Lukas Vrabec - 3.13.1-127
- Allow openvswitch to load kernel modules
Resolves: rhbz#1405479
Thu Mar 9 13:00:00 2017 Lukas Vrabec - 3.13.1-126
- Allow openvswitch read script state.
Resolves: rhbz#1405479
Tue Mar 7 13:00:00 2017 Lukas Vrabec - 3.13.1-125
- Update ganesha policy
Resolves: rhbz#1426554
Resolves: rhbz#1383784
- Allow chronyd to read adjtime
Resolves: rhbz#1416015
- Fixes for chrony version 2.2
Resolves: rhbz#1416015
- Add interface virt_rw_stream_sockets_svirt()
Resolves: rhbz#1415841
- Label /dev/ss0 as gpfs_device_t
Resolves: rhbz#1383784
- Allow staff to rw svirt unix stream sockets.
Resolves: rhbz#1415841
- Label /rhev/data-center/mnt as mnt_t
Resolves: rhbz#1408275
- Associate sysctl_rpc_t with proc filesystems
Resolves: rhbz#1350927
- Add new boolean: domain_can_write_kmsg
Resolves: rhbz#1415715
Thu Mar 2 13:00:00 2017 Lukas Vrabec - 3.13.1-124
- Allow rhsmcertd_t dbus chat with system_cronjob_t
Resolves: rhbz#1405341
- Allow openvswitch exec hostname and readinitrc_t files
Resolves: rhbz#1405479
- Improve SELinux context for mysql_db_t objects.
Resolves: rhbz#1391521
- Allow postfix_postdrop to communicate with postfix_master via pipe.
Resolves: rhbz#1379736
- Add radius_use_jit boolean
Resolves: rhbz#1426205
- Label /var/lock/subsys/iptables as iptables_lock_t
Resolves: rhbz#1405441
- Label /usr/lib64/erlang/erts-5.10.4/bin/epmd as lib_t
Resolves: rhbz#1332803
- Allow can_load_kernmodule to load kernel modules.
Resolves: rhbz#1423427
Resolves: rhbz#1424621
Thu Feb 23 13:00:00 2017 Lukas Vrabec - 3.13.1-123
- Allow nfsd_t domain to create sysctls_rpc_t files
Resolves: rhbz#1405304
- Allow openvswitch to create netlink generic sockets.
Resolves: rhbz#1397974
- Create kernel_create_rpc_sysctls() interface
Resolves: rhbz#1405304
Fri Feb 17 13:00:00 2017 Lukas Vrabec - 3.13.1-122
- Allow nfsd_t domain rw sysctl_rpc_t dirs
Resolves: rhbz#1405304
- Allow cgdcbxd_t to manage cgroup files.
Resolves: rhbz#1358493
- Allow cmirrord_t domain to create netlink_connector sockets
Resolves: rhbz#1412670
- Allow fcoemon to create netlink scsitransport sockets
Resolves: rhbz#1362496
- Allow quota_nld_t create netlink_generic sockets
Resolves: rhbz#1358679
- Allow cgred_t create netlink_connector sockets
Resolves: rhbz#1376357
- Add dhcpd_t domain fowner capability
Resolves: rhbz#1358485
- Allow acpid to attempt to connect to the Linux kernel via generic netlink socket.
Resolves: rhbz#1358478
- Rename docker module to container module
Resolves: rhbz#1386916
- Allow setflies to mount tracefs
Resolves: rhbz#1376357
- Allow iptables to read nsfs files.
Resolves: rhbz#1411316
- Allow systemd_bootchart_t domain create dgram sockets.
Resolves: rhbz#1365953
- Rename docker interfaces to container
Resolves: rhbz#1386916
Wed Feb 15 13:00:00 2017 Lukas Vrabec - 3.13.1-120
- Allow initrc_t domain to run rhel-autorelabel script properly during boot process
Resolves: rhbz#1379722
- Allow systemd_initctl_t to create and connect unix_dgram sockets
Resolves: rhbz#1365947
- Allow ifconfig_t to mount/unmount nsfs_t filesystem
Resolves: rhbz#1349814
- Add interfaces allowing mount/unmount nsfs_t filesystem
Resolves: rhbz#1349814
Mon Feb 13 13:00:00 2017 Lukas Vrabec - 3.13.1-119
- Add interface init_stream_connectto()
Resolves:rhbz#1365947
- Allow rhsmcertd domain signull kernel.
Resolves: rhbz#1379781
- Allow kdumpgui domain to read nvme device
- Allow insmod_t to load kernel modules
Resolves: rhbz#1421598
- Add interface files_load_kernel_modules()
Resolves: rhbz#1421598
- Add SELinux support for systemd-initctl daemon
Resolves:rhbz#1365947
- Add SELinux support for systemd-bootchart
Resolves: rhbz#1365953
Tue Feb 7 13:00:00 2017 Lukas Vrabec - 3.13.1-118
- Allow firewalld to getattr open search read modules_object_t:dir
Resolves: rhbz#1418391
- Fix label for nagios plugins in nagios file conxtext file
Resolves: rhbz#1277718
- Add sys_ptrace capability to pegasus domain
Resolves: rhbz#1381238
- Allow sssd_t domain setpgid
Resolves:rhbz#1416780
- After the latest changes in nfsd. We should allow nfsd_t to read raw fixed disk.
Resolves: rhbz#1350927
- Allow kdumpgui domain to read nvme device
Resolves: rhbz#1415084
- su using libselinux and creating netlink_selinux socket is needed to allow libselinux initialization.
Resolves: rhbz#1146987
- Add user namespace capability object classes.
Resolves: rhbz#1368057
- Add module_load permission to class system
Resolves:rhbz#1368057
- Add the validate_trans access vector to the security class
Resolves: rhbz#1368057
- Add \"binder\" security class and access vectors
Resolves: rhbz#1368057
- Allow ifconfig_t domain read nsfs_t
Resolves: rhbz#1349814
- Allow ping_t domain to load kernel modules.
Resolves: rhbz#1388363
Mon Jan 9 13:00:00 2017 Lukas Vrabec - 3.13.1-117
- Allow systemd container to read/write usermodehelperstate
Resolves: rhbz#1403254
- Label udp ports in range 24007-24027 as gluster_port_t
Resolves: rhbz#1404152
Tue Dec 20 13:00:00 2016 Lukas Vrabec - 3.13.1-116
- Allow glusterd_t to bind on glusterd_port_t udp ports.
Resolves: rhbz#1404152
- Revert: Allow glusterd_t to bind on med_tlp port.
Mon Dec 19 13:00:00 2016 Lukas Vrabec - 3.13.1-115
- Allow glusterd_t to bind on med_tlp port.
Resolves: rhbz#1404152
- Update ctdbd_t policy to reflect all changes.
Resolves: rhbz#1402451
- Label tcp port 24009 as med_tlp_port_t
Resolves: rhbz#1404152
- Issue appears during update directly from RHEL-7.0 to RHEL-7.3 or above. Modules pkcsslotd and vbetools missing in selinux-policy package for RHEL-7.3 which causing warnings during SELinux policy store migration process. Following patch fixes issue by skipping pkcsslotd and vbetools modules migration.
Thu Dec 15 13:00:00 2016 Lukas Vrabec - 3.13.1-114
- Allow ctdbd_t domain transition to rpcd_t
Resolves:rhbz#1402451
Thu Dec 15 13:00:00 2016 Lukas Vrabec - 3.13.1-113
- Fixes for containers Allow containers to attempt to write to unix_sysctls. Allow cotainers to use the FD\'s leaked to them from parent processes.
Resolves: rhbz#1403254
Tue Dec 13 13:00:00 2016 Lukas Vrabec - 3.13.1-112
- Allow glusterd_t send signals to userdomain. Label new glusterd binaries as glusterd_exec_t
Resolves: rhbz#1404152
- Allow systemd to stop glusterd_t domains.
Resolves: rhbz#1400493
Fri Dec 9 13:00:00 2016 Lukas Vrabec - 3.13.1-111
- Make working CTDB:NFS: CTDB failover from selinux-policy POV
Resolves: rhbz#1402451
Fri Dec 2 13:00:00 2016 Lukas Vrabec - 3.13.1-110
- Add kdump_t domain sys_admin capability
Resolves: rhbz#1375963
Thu Dec 1 13:00:00 2016 Lukas Vrabec - 3.13.1-109
- Allow puppetagent_t to access timedated dbus. Use the systemd_dbus_chat_timedated interface to allow puppetagent_t the access.
Resolves: rhbz#1399250
Mon Nov 14 13:00:00 2016 Lukas Vrabec - 3.13.1-108
- Update systemd on RHEL-7.2 box to version from RHEL-7.3 and then as a separate yum command update the selinux policy systemd will start generating USER_AVC denials and will start returning \"Access Denied\" errors to DBus clients
Resolves: rhbz#1393505
Wed Nov 9 13:00:00 2016 Lukas Vrabec - 3.13.1-107
- Allow cluster_t communicate to fprintd_t via dbus
Resolves: rhbz#1349798
Tue Nov 8 13:00:00 2016 Lukas Vrabec - 3.13.1-106
- Fix error message during update from RHEL-7.2 to RHEL-7.3, when /usr/sbin/semanage command is not installed and selinux-policy-migrate-local-changes.sh script is executed in %post install phase of selinux-policy package
Resolves: rhbz#1392010
Tue Oct 18 14:00:00 2016 Miroslav Grepl - 3.13.1-105
- Allow GlusterFS with RDMA transport to be started correctly. It requires ipc_lock capability together with rw permission on rdma_cm device.
Resolves: rhbz#1384488
- Allow glusterd to get attributes on /sys/kernel/config directory.
Resolves: rhbz#1384483
Mon Oct 10 14:00:00 2016 Lukas Vrabec - 3.13.1-104
- Use selinux-policy-migrate-local-changes.sh instead of migrateStore
* macros
- Add selinux-policy-migrate-local-changes service
Resolves: rhbz#1381588
Fri Sep 30 14:00:00 2016 Lukas Vrabec - 3.13.1-103
- Allow sssd_selinux_manager_t to manage also dir class.
Resolves: rhbz#1368097
- Add interface seutil_manage_default_contexts_dirs()
Resolves: rhbz#1368097
Tue Sep 27 14:00:00 2016 Dan Walsh - 3.13.1-102
- Add virt_sandbox_use_nfs -> virt_use_nfs boolean substitution.
Resolves: rhbz#1355783
Tue Sep 27 14:00:00 2016 Lukas Vrabec - 3.13.1-101
- Allow pcp_pmcd_t domain transition to lvm_t Add capability kill and sys_ptrace to pcp_pmlogger_t
Resolves: rhbz#1309883
Wed Sep 21 14:00:00 2016 Lukas Vrabec - 3.13.1-100
- Allow ftp daemon to manage apache_user_content
Resolves: rhbz#1097775
- Label /etc/sysconfig/oracleasm as oracleasm_conf_t
Resolves: rhbz#1331383
- Allow oracleasm to rw inherited fixed disk device
Resolves: rhbz#1331383
- Allow collectd to connect on unix_stream_socket
Resolves: rhbz#1377259
Wed Sep 14 14:00:00 2016 Lukas Vrabec - 3.13.1-99
- Allow iscsid create netlink iscsid sockets.
Resolves: rhbz#1358266
- Improve regexp for power_unit_file_t files. To catch just systemd power unit files.
Resolves: rhbz#1375462
Tue Sep 13 14:00:00 2016 Lukas Vrabec - 3.13.1-98
- Update oracleasm SELinux module that can manage oracleasmfs_t blk files. Add dac_override cap to oracleasm_t domain.
Resolves: rhbz#1331383
- Add few rules to pcp SELinux module to make ti able to start pcp_pmlogger service
Resolves: rhbz#1206525
Tue Sep 6 14:00:00 2016 Lukas Vrabec - 3.13.1-97
- Add oracleasm_conf_t type and allow oracleasm_t to create /dev/oracleasm
Resolves: rhbz#1331383
- Label /usr/share/pcp/lib/pmie as pmie_exec_t and /usr/share/pcp/lib/pmlogger as pmlogger_exec_t
Resolves: rhbz#1206525
- Allow mdadm_t to getattr all device nodes
Resolves: rhbz#1365171
- Add interface dbus_dontaudit_stream_connect_system_dbusd()
Resolves:rhbz#1052880
- Add virt_stub_
* interfaces for docker policy which is no longer a part of our base policy.
Resolves: rhbz#1372705
- Allow guest-set-user-passwd to set users password.
Resolves: rhbz#1369693
- Allow samdbox domains to use msg class
Resolves: rhbz#1372677
- Allow domains using kerberos to read also kerberos config dirs
Resolves: rhbz#1368492
- Allow svirt_sandbox_domains to r/w onload sockets
Resolves: rhbz#1342930
- Add interface fs_manage_oracleasm()
Resolves: rhbz#1331383
- Label /dev/kfd as hsa_device_t
Resolves: rhbz#1373488
- Update seutil_manage_file_contexts() interface that caller domain can also manage file_context_t dirs
Resolves: rhbz#1368097
- Add interface to write to nsfs inodes
Resolves: rhbz#1372705
- Allow systemd services to use PrivateNetwork feature
Resolves: rhbz#1372705
- Add a type and genfscon for nsfs.
Resolves: rhbz#1372705
- Allow run sulogin_t in range mls_systemlow-mls_systemhigh.
Resolves: rhbz#1290400
Wed Aug 31 14:00:00 2016 Lukas Vrabec - 3.13.1-96
- Allow arpwatch to create netlink netfilter sockets. Resolves: rhbz#1358261
- Fix file context for /etc/pki/pki-tomcat/ca/
- new interface oddjob_mkhomedir_entrypoint()
- Move label for /var/lib/docker/vfs/ to proper SELinux module
- Allow mdadm to get attributes from all devices.
- Label /etc/puppetlabs as puppet_etc_t.
- Allow systemd-machined to communicate to lxc container using dbus
- Allow systemd_resolved to send dbus msgs to userdomains Resolves: rhbz#1236579
- Allow systemd-resolved to read network sysctls Resolves: rhbz#1236579
- Allow systemd_resolved to connect on system bus. Resolves: rhbz#1236579
- Make entrypoint oddjob_mkhomedir_exec_t for unconfined_t
- Label all files in /dev/oracleasmfs/ as oracleasmfs_t Resolves: rhbz#1331383
Tue Aug 23 14:00:00 2016 Lukas Vrabec - 3.13.1-95
- Label /etc/pki/pki-tomcat/ca/ as pki_tomcat_cert_t
Resolves:rhbz#1366915
- Allow certmonger to manage all systemd unit files
Resolves:rhbz#1366915
- Grant certmonger \"chown\" capability
Resolves:rhbz#1366915
- Allow ipa_helper_t stream connect to dirsrv_t domain
Resolves: rhbz#1368418
- Update oracleasm SELinux module
Resolves: rhbz#1331383
- label /var/lib/kubelet as svirt_sandbox_file_t
Resolves: rhbz#1369159
- Add few interfaces to cloudform.if file
Resolves: rhbz#1367834
- Label /var/run/corosync-qnetd and /var/run/corosync-qdevice as cluster_var_run_t. Note: corosync policy is now par of rhcs module
Resolves: rhbz#1347514
- Allow krb5kdc_t to read krb4kdc_conf_t dirs.
Resolves: rhbz#1368492
- Update networkmanager_filetrans_named_content() interface to allow source domain to create also temad dir in /var/run.
Resolves: rhbz#1365653
- Allow teamd running as NetworkManager_t to access netlink_generic_socket to allow multiple network interfaces to be teamed together.
Resolves: rhbz#1365653
- Label /dev/oracleasmfs as oracleasmfs_t. Add few interfaces related to oracleasmfs_t type
Resolves: rhbz#1331383
- A new version of cloud-init that supports the effort to provision RHEL Atomic on Microsoft Azure requires some a new rules that allows dhclient/dhclient hooks to call cloud-init.
Resolves: rhbz#1367834
- Allow iptables to creating netlink generic sockets.
Resolves: rhbz#1364359
Wed Aug 17 14:00:00 2016 Lukas Vrabec - 3.13.1-94
- Allow ipmievd domain to create lock files in /var/lock/subsys/
Resolves:rhbz#1349058
- Update policy for ipmievd daemon.
Resolves:rhbz#1349058
- Dontaudit hyperkvp to getattr on non security files.
Resolves: rhbz#1349356
- Label /run/corosync-qdevice and /run/corosync-qnetd as corosync_var_run_t
Resolves: rhbz#1347514
- Fixed lsm SELinux module
- Add sys_admin capability to sbd domain
Resolves: rhbz#1322725
- Allow vdagent to comunnicate with systemd-logind via dbus
Resolves: rhbz#1366731
- Allow lsmd_plugin_t domain to create fixed_disk device.
Resolves: rhbz#1238066
- Allow opendnssec domain to create and manage own tmp dirs/files
Resolves: rhbz#1366649
- Allow opendnssec domain to read system state
Resolves: rhbz#1366649
- Update opendnssec_manage_config() interface to allow caller domain also manage opendnssec_conf_t dirs
Resolves: rhbz#1366649
- Allow rasdaemon to mount/unmount tracefs filesystem.
Resolves: rhbz#1364380
- Label /usr/libexec/iptables/iptables.init as iptables_exec_t Allow iptables creating lock file in /var/lock/subsys/
Resolves: rhbz#1367520
- Modify interface den_read_nvme() to allow also read nvme_device_t block files.
Resolves: rhbz#1362564
- Label /var/run/storaged as lvm_var_run_t.
Resolves: rhbz#1264390
- Allow unconfineduser to run ipa_helper_t.
Resolves: rhbz#1361636
Wed Aug 10 14:00:00 2016 Lukas Vrabec - 3.13.1-93
- Dontaudit mock to write to generic certs.
Resolves: rhbz#1271209
- Add labeling for corosync-qdevice and corosync-qnetd daemons, to run as cluster_t
Resolves: rhbz#1347514
- Revert \"Label corosync-qnetd and corosync-qdevice as corosync_t domain\"
- Allow modemmanager to write to systemd inhibit pipes
Resolves: rhbz#1365214
- Label corosync-qnetd and corosync-qdevice as corosync_t domain
Resolves: rhbz#1347514
- Allow ipa_helper to read network state
Resolves: rhbz#1361636
- Label oddjob_reqiest as oddjob_exec_t
Resolves: rhbz#1361636
- Add interface oddjob_run()
Resolves: rhbz#1361636
- Allow modemmanager chat with systemd_logind via dbus
Resolves: rhbz#1362273
- Allow NetworkManager chat with puppetagent via dbus
Resolves: rhbz#1363989
- Allow NetworkManager chat with kdumpctl via dbus
Resolves: rhbz#1363977
- Allow sbd send msgs to syslog Allow sbd create dgram sockets. Allow sbd to communicate with kernel via dgram socket Allow sbd r/w kernel sysctls.
Resolves: rhbz#1322725
- Allow ipmievd_t domain to re-create ipmi devices Label /usr/libexec/openipmi-helper as ipmievd_exec_t
Resolves: rhbz#1349058
- Allow rasdaemon to use tracefs filesystem.
Resolves: rhbz#1364380
- Fix typo bug in dirsrv policy
- Some logrotate scripts run su and then su runs unix_chkpwd. Allow logrotate_t domain to check passwd.
Resolves: rhbz#1283134
- Add ipc_lock capability to sssd domain. Allow sssd connect to http_cache_t
Resolves: rhbz#1362688
- Allow dirsrv to read dirsrv_share_t content
Resolves: rhbz#1363662
- Allow virtlogd_t to append svirt_image_t files.
Resolves: rhbz#1358140
- Allow hypervkvp domain to read hugetlbfs dir/files.
Resolves: rhbz#1349356
- Allow mdadm daemon to read nvme_device_t blk files
Resolves: rhbz#1362564
- Allow selinuxusers and unconfineduser to run oddjob_request
Resolves: rhbz#1361636
- Allow sshd server to acces to Crypto Express 4 (CEX4) devices.
Resolves: rhbz#1362539
- Fix labeling issue in init.fc file. Path /usr/lib/systemd/fedora-
* changed to /usr/lib/systemd/rhel-
*.
Resolves: rhbz#1363769
- Fix typo in device interfaces
Resolves: rhbz#1349058
- Add interfaces for managing ipmi devices
Resolves: rhbz#1349058
- Add interfaces to allow mounting/umounting tracefs filesystem
Resolves: rhbz#1364380
- Add interfaces to allow rw tracefs filesystem
Resolves: rhbz#1364380
- Add interface dev_read_nvme() to allow reading Non-Volatile Memory Host Controller devices.
Resolves: rhbz#1362564
- Label /sys/kernel/debug/tracing filesystem
Resolves: rhbz#1364380
- Allow sshd setcap capability. This is needed due to latest changes in sshd
Resolves: rhbz#1357857
Thu Jul 28 14:00:00 2016 Lukas Vrabec - 3.13.1-92
- Dontaudit mock_build_t can list all ptys.
Resolves: rhbz#1271209
- Allow ftpd_t to mamange userhome data without any boolean.
Resolves: rhbz#1097775
- Add logrotate permissions for creating netlink selinux sockets.
Resolves: rhbz#1283134
- Allow lsmd_plugin_t to exec ldconfig.
Resolves: rhbz#1238066
- Allow vnstatd domain to read /sys/class/net/ files
Resolves: rhbz#1358243
- Remove duplicate allow rules in spamassassin SELinux module
Resolves:rhbz#1358175
- Allow spamc_t and spamd_t domains create .spamassassin file in user homedirs
Resolves:rhbz#1358175
- Allow sshd setcap capability. This is needed due to latest changes in sshd
Resolves: rhbz#1357857
- Add new MLS attribute to allow relabeling objects higher than system low. This exception is needed for package managers when processing sensitive data.
Resolves: rhbz#1330464
- Allow gnome-keyring also manage user_tmp_t sockets.
Resolves: rhbz#1257057
- corecmd: Remove fcontext for /etc/sysconfig/libvirtd
Resolves:rhbz#1351382
Tue Jul 19 14:00:00 2016 Lukas Vrabec - 3.13.1-91
- Allow ipa_dnskey domain to search cache dirs
Resolves: rhbz#1350957
Tue Jul 19 14:00:00 2016 Lukas Vrabec - 3.13.1-90
- Allow ipa-dnskey read system state.
Reasolves: rhbz#1350957
- Allow dogtag-ipa-ca-renew-agent-submit labeled as certmonger_t to create /var/log/ipa/renew.log file
Resolves: rhbz#1350957
Mon Jul 18 14:00:00 2016 Lukas Vrabec - 3.13.1-89
- Allow firewalld to manage net_conf_t files.
Resolves:rhbz#1304723
- Allow logrotate read logs inside containers.
Resolves: rhbz#1303514
- Allow sssd to getattr on fs_t
Resolves: rhbz#1356082
- Allow opendnssec domain to manage bind chace files
Resolves: rhbz#1350957
- Fix typo in rhsmcertd policy module
Resolves: rhbz#1329475
- Allow systemd to get status of systemd-logind daemon
Resolves: rhbz#1356141
- Label more ndctl devices not just ndctl0
Resolves: rhbz#1355809
Thu Jul 14 14:00:00 2016 Lukas Vrabec - 3.13.1-88
- Allow rhsmcertd to copy certs into /etc/docker/cert.d
- Add interface docker_rw_config()
Resolves: rhbz#1344500
- Fix logrotate fc file to label also /var/lib/logrotate/ dir as logrotate_var_lib_t
Resolves: rhbz#1355632
- Allow rhsmcertd to read network sysctls
Resolves: rhbz#1329475
- Label /var/log/graphite-web dir as httpd_log_t
Resolves: rhbz#1310898
- Allow mock to use generic ptys
Resolves: rhbz#1271209
- Allow adcli running as sssd_t to write krb5.keytab file.
Resolves: rhbz#1356082
- Allow openvswitch connect to openvswitch_port_t type.
Resolves: rhbz#1335024
- Add SELinux policy for opendnssec service.
Resolves: rhbz#1350957
- Create new SELinux type for /usr/libexec/ipa/ipa-dnskeysyncd
Resolves: rhbz#1350957
- label /dev/ndctl0 device as nvram_device_t
Resolves: rhbz#1355809
Mon Jul 11 14:00:00 2016 Lukas Vrabec - 3.13.1-87
- Allow lttng tools to block suspending
Resolves: rhbz#1256374
- Allow creation of vpnaas in openstack
Resolves: rhbz#1352710
- virt: add strict policy for virtlogd daemon
Resolves:rhbz#1311606
- Update makefile to support snapperd_contexts file
Resolves: rhbz#1352681
Fri Jul 8 14:00:00 2016 Lukas Vrabec - 3.13.1-86
- Allow udev to manage systemd-hwdb files
- Add interface systemd_hwdb_manage_config()
Resolves: rhbz#1350756
- Fix paths to infiniband devices. This allows use more then two infiniband interfaces.
Resolves: rhbz#1210263
Thu Jul 7 14:00:00 2016 Lukas Vrabec - 3.13.1-85
- Allow virtual machines to rw infiniband devices.
Resolves: rhbz#1210263
- Allow opensm daemon to rw infiniband_mgmt_device_t
Resolves: rhbz#1210263
- Allow systemd_hwdb_t to relabel /etc/udev/hwdb.bin file.
Resolves: rhbz#1350756
- Make label for new infiniband_mgmt deivices
Resolves: rhbz#1210263
Tue Jul 5 14:00:00 2016 Lukas Vrabec - 3.13.1-84
- Fix typo in brltty SELinux module
- Add new SELinux module sbd
Resolves: rhbz#1322725
- Allow pcp dmcache metrics collection
Resolves: rhbz#1309883
- Allow pkcs_slotd_t to create dir in /var/lock Add label pkcs_slotd_log_t
Resolves: rhbz#1350782
- Allow openvpn to create sock files labeled as openvpn_var_run_t
Resolves: rhbz#1328246
- Allow hypervkvp daemon to getattr on all filesystem types.
Resolves: rhbz#1349356
- Allow firewalld to create net_conf_t files
Resolves: rhbz#1304723
- Allow mock to use lvm
Resolves: rhbz#1271209
- Allow keepalived to create netlink generic sockets.
Resolves: rhbz#1349809
- Allow mirromanager creating log files in /tmp
Resolves:rhbz#1328818
- Rename few modules to make it consistent with source files
Resolves: rhbz#1351445
- Allow vmtools_t to transition to rpm_script domain
Resolves: rhbz#1342119
- Allow nsd daemon to manage nsd_conf_t dirs and files
Resolves: rhbz#1349791
- Allow cluster to create dirs in /var/run labeled as cluster_var_run_t
Resolves: rhbz#1346900
- Allow sssd read also sssd_conf_t dirs
Resolves: rhbz#1350535
- Dontaudit su_role_template interface to getattr /proc/kcore Dontaudit su_role_template interface to getattr /dev/initctl
Resolves: rhbz#1086240
- Add interface lvm_getattr_exec_files()
Resolves: rhbz#1271209
- Fix typo Compliling vs. Compiling
Resolves: rhbz#1351445
Wed Jun 29 14:00:00 2016 Lukas Vrabec - 3.13.1-83
- Allow krb5kdc_t to communicate with sssd
Resolves: rhbz#1319933
- Allow prosody to bind on prosody ports
Resolves: rhbz#1304664
- Add dac_override caps for fail2ban-client
Resolves: rhbz#1316678
- dontaudit read access for svirt_t on the file /var/db/nscd/group
Resolves: rhbz#1301637
- Allow inetd child process to communicate via dbus with systemd-logind
Resolves: rhbz#1333726
- Add label for brltty log file
Resolves: rhbz#1328818
- Allow dspam to read the passwd file
Resolves: rhbz#1286020
- Allow snort_t to communicate with sssd
Resolves: rhbz#1284908
- svirt_sandbox_domains need to be able to execmod for badly built libraries.
Resolves: rhbz#1206339
- Add policy for lttng-tools package.
Resolves: rhbz#1256374
- Make mirrormanager as application domain.
Resolves: rhbz#1328234
- Add support for the default lttng-sessiond port - tcp/5345. This port is used by LTTng 2.x central tracing registry session daemon.
- Add prosody ports
Resolves: rhbz#1304664
- Allow sssd read also sssd_conf_t dirs
Resolves: rhbz#1350535
Tue Jun 28 14:00:00 2016 Lukas Vrabec - 3.13.1-82
- Label /var/lib/softhsm as named_cache_t. Allow named_t to manage named_cache_t dirs.
Resolves:rhbz#1331315
- Label named-pkcs11 binary as named_exec_t.
Resolves: rhbz#1331315
- Allow glusterd daemon to get systemd status
Resolves: rhbz#1321785
- Allow logrotate dbus-chat with system_logind daemon
Resolves: rhbz#1283134
- Allow pcp_pmlogger to read kernel network state Allow pcp_pmcd to read cron pid files
Resolves: rhbz#1336211
- Add interface cron_read_pid_files()
Resolves: rhbz#1336211
- Allow pcp_pmlogger to create unix dgram sockets
Resolves: rhbz#1336211
- Add hwloc-dump-hwdata SELinux policy
Resolves: rhbz#1344054
- Remove non-existing jabberd_spool_t() interface and add new jabbertd_var_spool_t.
Resolves: rhbz#1121171
- Remove non-existing interface salk_resetd_systemctl() and replace it with sanlock_systemctl_sanlk_resetd()
Resolves: rhbz#1259764
- Create label for openhpid log files.
esolves: rhbz#1259764
- Label /var/lib/ganglia as httpd_var_lib_t
Resolves: rhbz#1260536
- Allow firewalld_t to create entries in net_conf_t dirs.
Resolves: rhbz#1304723
- Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals
Resolves: rhbz#1288255
- Include patch from distgit repo: policy-RHEL-7.1-flask.patch.
Resolves: rhbz#1329560
- Update refpolicy to handle hwloc
Resolves: rhbz#1344054
- Label /etc/dhcp/scripts dir as bin_t
- Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals.
Resolves: rhbz#1288255
Wed Jun 22 14:00:00 2016 Lukas Vrabec - 3.13.1-81
- Allow firewalld_t to create entries in net_conf_t dirs.
Resolves: rhbz#1304723
- Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals
Resolves: rhbz#1288255
- Allow mongod log to syslog.
Resolves: rhbz#1306995
- Allow rhsmcertd connect to port tcp 9090
Resolves: rhbz#1337319
- Label for /bin/mail(x) was removed but /usr/bin/mail(x) not. This path is also needed to remove.
Resolves: rhbz#1262483
Resolves: rhbz#1277506
- Label /usr/libexec/mimedefang-wrapper as spamd_exec_t.
Resolves: rhbz#1301516
- Add new boolean spamd_update_can_network.
Resolves: rhbz#1305469
- Allow rhsmcertd connect to tcp netport_port_t
Resolves: rhbz#1329475
- Fix SELinux context for /usr/share/mirrormanager/server/mirrormanager to Label all binaries under dir as mirrormanager_exec_t.
Resolves: rhbz#1328234
- Allow prosody to bind to fac_restore tcp port.
Resolves: rhbz#1321787
- Allow ninfod to read raw packets
Resolves: rhbz#1317964
- Allow pegasus get attributes from qemu binary files.
Resolves: rhbz#1260835
- Allow pegasus get attributes from qemu binary files.
Resolves: rhbz#1271159
- Allow tuned to use policykit. This change is required by cockpit.
Resolves: rhbz#1346464
- Allow conman_t to read dir with conman_unconfined_script_t binary files.
Resolves: rhbz#1297323
- Allow pegasus to read /proc/sysinfo.
Resolves: rhbz#1265883
- Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals.
Resolves: rhbz#1288255
- Label tcp ports:16379, 26379 as redis_port_t
Resolves: rhbz#1348471
- Allow systemd to relabel /var and /var/lib directories during boot.
- Add files_relabel_var_dirs() and files_relabel_var_dirs() interfaces.
- Add files_relabelto_var_lib_dirs() interface.
- Label tcp port 2004 as mailbox_port_t.
Resolves: rhbz#1332843
- Label tcp and udp port 5582 as fac_restore_port_t
Resolves: rhbz#1321787
- Allow sysadm_t user to run postgresql-setup.
Resolves: rhbz#1282543
- Allow sysadm_t user to dbus chat with oddjob_t. This allows confined admin run oddjob mkhomedirfor script.
Resolves: rhbz#1297480
- Update netlink socket classes.
Thu Jun 16 14:00:00 2016 Lukas Vrabec - 3.13.1-80
- Allow conman to kill conman_unconfined_script.
Resolves: rhbz#1297323
- Make conman_unconfined_script_t as init_system_domain.
Resolves:rhbz#1297323
- Allow init dbus chat with apmd.
Resolves:rhbz#995898
- Patch /var/lib/rpm is symlink to /usr/share/rpm on Atomic, due to this change we need to label also /usr/share/rpm as rpm_var_lib_t.
Resolves: rhbz#1233252
- Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_t
Resolves: rhbz#1052880
- Add mediawiki rules to proper scope
Resolves: rhbz#1301186
- Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_t
Resolves: rhbz#1052880
- Allow mysqld_safe to inherit rlimit information from mysqld
Resolves: rhbz#1323673
- Allow collectd_t to stream connect to postgresql.
Resolves: rhbz#1344056
- Allow mediawiki-script to read /etc/passwd file.
Resolves: rhbz#1301186
- Add filetrans rule that NetworkManager_t can create net_conf_t files in /etc.
Resolves: rhbz#1344505
- Add labels for mediawiki123
Resolves: rhbz#1293872
- Fix label for all fence_scsi_check scripts
- Allow ip netns to mounton root fs and unmount proc_t fs.
Resolves: rhbz#1343776
Resolves: rhbz#1286851
- Allow sysadm_t to run newaliases command.
Resolves: rhbz#1344828
- Add interface sysnet_filetrans_named_net_conf()
Resolves: rhbz#1344505
Mon Jun 13 14:00:00 2016 Petr Lautrbach - 3.13.1-79
- Fix several issues related to the SELinux Userspace changes
Thu Jun 9 14:00:00 2016 Lukas Vrabec - 3.13.1-78
- Allow glusterd domain read krb5_keytab_t files.
Resolves: rhbz#1343929
- Fix typo in files_setattr_non_security_dirs.
Resolves: rhbz#1115987
Thu Jun 9 14:00:00 2016 Lukas Vrabec - 3.13.1-77
- Allow tmpreaper_t to read/setattr all non_security_file_type dirs
Resolves: rhbz#1115987
- Allow firewalld to create firewalld_var_run_t directory.
Resolves: rhbz#1304723
- Add interface firewalld_read_pid_files()
Resolves: rhbz#1304723
- Label /usr/libexec/rpm-ostreed as rpm_exec_t.
Resolves: rhbz#1340542
- Allow sanlock service to read/write cephfs_t files.
Resolves: rhbz#1315332
- Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
- Added missing docker interfaces: - docker_typebounds - docker_entrypoint
Resolves: rhbz#1236580
- Add interface files_setattr_non_security_dirs()
Resolves: rhbz#1115987
- Add support for onloadfs
- Allow iptables to read firewalld pid files.
Resolves: rhbz#1304723
- Add SELinux support for ceph filesystem.
Resolves: rhbz#1315332
- Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
Resolves: rhbz#1236580
Mon Jun 6 14:00:00 2016 Lukas Vrabec - 3.13.1-76
- Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
- Added missing docker interfaces: - docker_typebounds - docker_entrypoint
Resolves: rhbz#1236580
- New interfaces needed for systemd-machinectl
Resolves: rhbz#1236580
- New interfaces needed by systemd-machine
Resolves: rhbz#1236580
- Add interface allowing sending and receiving messages from virt over dbus.
Resolves: rhbz#1236580
- Backport docker policy from Fedora.
Related: #1303123
Resolves: #1341257
- Allow NetworkManager_t and policykit_t read access to systemd-machined pid files.
Resolves: rhbz#1236580
- Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
- Added interfaces needed by new docker policy.
Related: rhbz#1303123
- Add support for systemd-machined daemon
Resolves: rhbz#1236580
- Allow rpm-ostree domain transition to install_t domain from init_t.
Resolves: rhbz#1340542
Tue May 31 14:00:00 2016 Lukas Vrabec - 3.13.1-75
- dnsmasq: allow NetworkManager to control dnsmasq via D-Bus
Resolves: rhbz#1336722
- Directory Server (389-ds-base) has been updated to use systemd-ask-password. In order to function correctly we need the following added to dirsrv.te
Resolves: rhbz#1333198
- sftpd_
* booleans are functionless these days.
Resolves: rhbz#1335656
- Label /var/log/ganesha.log as gluster_log_t Allow glusterd_t domain to create glusterd_log_t files. Label /var/run/ganesha.pid as gluster_var_run_t.
Resolves: rhbz#1335828
- Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus.
Resolves: rhbz#1336760
- Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t.
Resolves: rhbz#1336737
- Label /usr/libexec/storaged/storaged as lvm_exec_t to run storaged daemon in lvm_t SELinux domain.
Resolves: rhbz#1264390
- Allow systemd_hostanmed_t to read /proc/sysinfo labeled as sysctl_t.
Resolves: rhbz#1337061
- Revert \"Allow all domains some process flags.\"
Resolves: rhbz#1303644
- Revert \"Remove setrlimit to all domains.\"
Resolves: rhbz#1303644
- Label /usr/sbin/xrdp
* files as bin_t
Resolves: rhbz#1276777
- Add mls support for some db classes
Resolves: rhbz#1303651
- Allow systemd_resolved_t to check if ipv6 is disabled.
Resolves: rhbz#1236579
- Allow systemd_resolved to read systemd_networkd run files.
Resolves: rhbz#1236579
Mon May 23 14:00:00 2016 Lukas Vrabec - 3.13.1-74
- Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus.
Resolves: rhbz#1336760
- Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t.
Resolves: rhbz#1336737
Mon May 16 14:00:00 2016 Lukas Vrabec - 3.13.1-73
- Allow logwatch to domtrans to postqueue
Resolves: rhbz#1331542
- Label /var/log/ganesha.log as gluster_log_t
- Allow glusterd_t domain to create glusterd_log_t files.
- Label /var/run/ganesha.pid as gluster_var_run_t.
Resolves: rhbz#1335828
- Allow zabbix to connect to postgresql port
Resolves: rhbz#1330479
- Add userdom_destroy_unpriv_user_shared_mem() interface.
Related: rhbz#1306403
- systemd-logind remove all IPC objects owned by a user on a logout. This covers also SysV memory. This change allows to destroy unpriviledged user SysV shared memory segments.
Resolves: rhbz#1306403
Mon May 16 14:00:00 2016 Lukas Vrabec - 3.13.1-72
- We need to restore contexts on /etc/passwd
*,/etc/group
*,/etc/
*shadow
* during install phase to get proper labeling for these files until selinux-policy pkgs are installed.
Resolves: rhbz#1333952
Tue May 10 14:00:00 2016 Lukas Vrabec - 3.13.1-71
- Add interface glusterd_dontaudit_read_lib_dirs()
Resolves: rhbz#1295680
- Dontaudit Occasionally observing AVC\'s while running geo-rep automation
Resolves: rhbz#1295680
- Allow glusterd to manage socket files labeled as glusterd_brick_t.
Resolves: rhbz#1331561
- Create new apache content template for files stored in user homedir. This change is needed to make working booleans: - httpd_enable_homedirs - httpd_read_user_content
Resolves: rhbz#1246522
- Allow stunnel create log files.
Resolves: rhbz#1296851
- Label tcp port 8181 as intermapper_port_t.
Resolves: rhbz#1334783
- Label tcp/udp port 2024 as xinuexpansion4_port_t
Resolves: rhbz#1334783
- Label tcp port 7002 as afs_pt_port_t Label tcp/udp port 2023 as xinuexpansion3_port_t
Resolves: rhbz#1334783
- Dontaudit ldconfig read gluster lib files.
Resolves: rhbz#1295680
- Add interface auth_use_nsswitch() to systemd_domain_template.
Resolves: rhbz#1236579
Tue May 3 14:00:00 2016 Lukas Vrabec - 3.13.1-70
- Label /usr/bin/ganesha.nfsd as glusterd_exec_t to run ganesha as glusterd_t. Allow glusterd_t stream connect to rpbind_t. Allow cluster_t to create symlink /var/lib/nfs labeled as var_lib_nfs_t. Add interface rpc_filetrans_var_lib_nfs_content() Add new boolean: rpcd_use_fusefs to allow rpcd daemon use fusefs.
Resolves: rhbz#1312809
Resolves: rhbz#1323947
- Allow dbus chat between httpd_t and oddjob_t. Resolves: rhbz#1324144
- Label /usr/libexec/ipa/oddjob/org.freeipa.server.conncheck as ipa_helper_exec_t.
Resolves: rhbz#1324144
- Label /var/log/ipareplica-conncheck.log file as ipa_log_t Allow ipa_helper_t domain to manage logs labeledas ipa_log_t Allow ipa_helper_t to connect on http and kerberos_passwd ports.
Resolves: rhbz#1324144
- Allow prosody to listen on port 5000 for mod_proxy65.
Resolves: rhbz#1316918
- Allow pcp_pmcd_t domain to manage docker lib files. This rule is needed to allow pcp to collect container information when SELinux is enabled.
Resolves: rhbz#1309454
Wed Apr 27 14:00:00 2016 Lukas Vrabec - 3.13.1-69
- Allow runnig php7 in fpm mode. From selinux-policy side, we need to allow httpd to read/write hugetlbfs.
Resolves: rhbz#1319442
- Allow openvswitch daemons to run under openvswitch Linux user instead of root. This change needs allow set capabilities: chwon, setgid, setuid, setpcap.
Resolves: rhbz#1296640
- Remove ftpd_home_dir() boolean from distro policy. Reason is that we cannot make this working due to m4 macro language limits.
Resolves: rhbz#1097775
- /bin/mailx is labeled sendmail_exec_t, and enters the sendmail_t domain on execution. If /usr/sbin/sendmail does not have its own domain to transition to, and is not one of several products whose behavior is allowed by the sendmail_t policy, execution will fail. In this case we need to label /bin/mailx as bin_t.
Resolves: rhbz#1262483
- Allow nsd daemon to create log file in /var/log as nsd_log_t
Resolves: rhbz#1293140
- Sanlock policy update. - New sub-domain for sanlk-reset daemon
Resolves: rhbz#1212324
- Label all run tgtd files, not just socket files
Resolves: rhbz#1280280
- Label all run tgtd files, not just socket files.
Resolves: rhbz#1280280
- Allow prosody to stream connect to sasl. This will allow using cyrus authentication in prosody.
Resolves: rhbz#1321049
- unbound wants to use ephemeral ports as a default configuration. Allow to use also udp sockets.
Resolves: rhbz#1318224
- Allow prosody to listen on port 5000 for mod_proxy65.
Resolves: rhbz#1316918
- Allow targetd to read/write to /dev/mapper/control device.
Resolves: rhbz#1063714
- Allow KDM to get status about power services. This change allow kdm to be able do shutdown.
Resolves: rhbz#1316724
- Allow systemd-resolved daemon creating netlink_route sockets.
Resolves:rhbz#1236579
- Allow systemd_resolved_t to read /etc/passwd file. Allow systemd_resolved_t to write to kmsg_device_t when \'systemd.log_target=kmsg\' option is used
Resolves: rhbz#1065362
- Label /etc/selinux/(minimum|mls|targeted)/active/ as semanage_store_t
Resolves: rhbz#1321943
- Label all nvidia binaries as xserver_exec_t
Resolves: rhbz#1322283
Wed Mar 23 13:00:00 2016 Lukas Vrabec - 3.13.1-68
- Create new permissivedomains CIL module and make it active.
Resolves: rhbz#1320451
- Add support for new mock location - /usr/libexec/mock/mock.
Resolves: rhbz#1271209
- Allow bitlee to create bitlee_var_t dirs.
Resolves: rhbz#1268651
- Allow CIM provider to read sssd public files.
Resolves: rhbz#1263339
- Fix some broken interfaces in distro policy.
Resolves: rhbz#1121171
- Allow power button to shutdown the laptop.
Resolves: rhbz#995898
- Allow lsm plugins to create named fixed disks.
Resolves: rhbz#1238066
- Add default labeling for /etc/Pegasus/cimserver_current.conf. It is a correct patch instead of the current /etc/Pegasus/pegasus_current.confResolves: rhbz#1278777
- Allow hyperv domains to rw hyperv devices.
Resolves: rhbz#1309361
- Label /var/www/html(/.
*)?/wp_backups(/.
*)? as httpd_sys_rw_content_t.Resolves: rhbz#1246780
- Create conman_unconfined_script_t type for conman script stored in /use/share/conman/exec/
Resolves: rhbz#1297323
- Fix rule definitions for httpd_can_sendmail boolean. We need to distinguish between base and contrib.
- Add support for /dev/mptctl device used to check RAID status.
Resolves: rhbz#1258029
- Create hyperv
* devices and create rw interfaces for this devices.
Resolves: rhbz#1309361
- Add fixes for selinux userspace moving the policy store to /var/lib/selinux.
- Remove optional else block for dhcp ping
Thu Mar 17 13:00:00 2016 Lukas Vrabec - 3.13.1-67
- Allow rsync_export_all_ro boolean to read also non_auth_dirs/files/symlinks.
Resolves: rhbz#1263770
- Fix context of \"/usr/share/nginx/html\".
Resolves: rhbz#1261857
- Allow pmdaapache labeled as pcp_pmcd_t access to port 80 for apache diagnostics
Resolves: rhbz#1270344
- Allow pmlogger to create pmlogger.primary.socket link file.
Resolves: rhbz#1270344
- Label nagios scripts as httpd_sys_script_exec_t.
Resolves: rhbz#1260306
- Add dontaudit interface for kdumpctl_tmp_t
Resolves: rhbz#1156442
- Allow mdadm read files in EFI partition.
Resolves: rhbz#1291801
- Allow nsd_t to bind on nsf_control tcp port. Allow nsd_crond_t to read nsd pid.
Resolves: rhbz#1293140
- Label some new nsd binaries as nsd_exec_t Allow nsd domain net_admin cap. Create label nsd_tmp_t for nsd tmp files/dirs
Resolves: rhbz#1293140
- Add filename transition that /etc/princap will be created with cupsd_rw_etc_t label in cups_filetrans_named_content() interface.
Resolves: rhbz#1265102
- Add missing labeling for /usr/libexec/abrt-hook-ccpp.
Resolves: rhbz#1213409
- Allow pcp_pmie and pcp_pmlogger to read all domains state.
Resolves: rhbz#1206525
- Label /etc/redis-sentinel.conf as redis_conf_t. Allow redis_t write to redis_conf_t. Allow redis_t to connect on redis tcp port.
Resolves: rhbz#1275246
- cockpit has grown content in /var/run directory
Resolves: rhbz#1279429
- Allow collectd setgid capability
Resolves:#1310898
- Remove declaration of empty booleans in virt policy.
Resolves: rhbz#1103153
- Fix typo in drbd policy
- Add new drbd file type: drbd_var_run_t. Allow drbd_t to manage drbd_var_run_t files/dirs. Allow drbd_t create drbd_tmp_t files in /tmp.
Resolves: rhbz#1134883
- Label /etc/ctdb/events.d/
* as ctdb_exec_t. Allow ctdbd_t to setattr on ctdbd_exec_t files.
Resolves: rhbz#1293788
- Allow abrt-hook-ccpp to get attributes of all processes because of core_pattern.
Resolves: rhbz#1254188
- Allow abrt_t to read sysctl_net_t files.
Resolves: rhbz#1254188
- The ABRT coredump handler has code to emulate default core file creation The handler runs in a separate process with abrt_dump_oops_t SELinux process type. abrt-hook-ccpp also saves the core dump file in the very same way as kernel does and a user can specify CWD location for a coredump. abrt-hook-ccpp has been made as a SELinux aware apps to create this coredumps with correct labeling and with this commit the policy rules have been updated to allow access all non security files on a system.
- Allow abrt-hook-ccpp to getattr on all executables.
- Allow setuid/setgid capabilities for abrt-hook-ccpp.
Resolves: rhbz#1254188
- abrt-hook-ccpp needs to have setfscreate access because it is SELinux aware and compute a target labeling.
Resolves: rhbz#1254188
- Allow abrt-hook-ccpp to change SELinux user identity for created objects.
Resolves: rhbz#1254188
- Dontaudit write access to inherited kdumpctl tmp files.
Resolves: rbhz#1156442
- Add interface to allow reading files in efivarfs - contains Linux Kernel configuration options for UEFI systems (UEFI Runtime Variables)
Resolves: rhbz#1291801
- Label 8952 tcp port as nsd_control.
Resolves: rhbz#1293140
- Allow ipsec to use pam.
Resolves: rhbz#1315700
- Allow to log out to gdm after screen was resized in session via vdagent.
Resolves: rhbz#1249020
- Allow setrans daemon to read /proc/meminfo.
Resolves: rhbz#1316804
- Allow systemd_networkd_t to write kmsg, when kernel was started with following params: systemd.debug systemd.log_level=debug systemd.log_target=kmsg
Resolves: rhbz#1298151
- Label tcp port 5355 as llmnr-> Link-Local Multicast Name Resolution
Resolves: rhbz#1236579
- Add new selinux policy for systemd-resolved dawmon.
Resolves: rhbz#1236579
- Add interface ssh_getattr_server_keys() interface.
Resolves: rhbz#1306197
- Allow run sshd-keygen on second boot if first boot fails after some reason and content is not syncedon the disk. These changes are reflecting this commit in sshd. http://pkgs.fedoraproject.org/cgit/rpms/openssh.git/commit/?id=af94f46861844cbd6ba4162115039bebcc8f78ba rhbz#1299106
Resolves: rhbz#1306197
- Allow systemd_notify_t to write to kmsg_device_t when \'systemd.log_target=kmsg\' option is used.
Resolves: rhbz#1309417
- Remove bin_t label for /etc/ctdb/events.d/. We need to label this scripts as ctdb_exec_t.
Resolves: rhbz#1293788
Thu Mar 17 13:00:00 2016 Petr Lautrbach - 3.13.1-66
- Prepare selinux-policy package for userspace release 2016-02-23. Resolves: rhbz#1305982
Tue Mar 8 13:00:00 2016 Lukas Vrabec 3.13.1-65
- Allow sending dbus msgs between firewalld and system_cronjob domains. Resolves: rhbz#1284902
- Allow zabbix-agentd to connect to following tcp sockets. One of zabbix-agentd functions is get service status of ftp,http,innd,pop,smtp protocols.
Resolves: rhbz#1242506
- Add new boolean tmpreaper_use_cifs() to allow tmpreaper to run on local directories being shared with Samba.
Resolves: rhbz#1284972
- Add support for systemd-hwdb daemon.
Resolves: rhbz#1257940
- Add interface fs_setattr_cifs_dirs().
Resolves: rhbz#1284972
Mon Feb 29 13:00:00 2016 Lukas Vrabec 3.13.1-64
- Add new SELinux policy fo targetd daemon.
Resolves: rhbz#1063714
- Add new SELinux policy fo ipmievd daemon.
Resolves: rhbz#1083031
- Add new SELinux policy fo hsqldb daemon.
Resolves: rhbz#1083171
- Add new SELinux policy for blkmapd daemon.
Resolves: rhbz#1072997
- Allow p11-child to connect to apache ports.
- Label /usr/sbin/lvmlockd binary file as lvm_exec_t.
Resolves: rhbz#1278028
- Add interface \"lvm_manage_lock\" to lvm policy.
Resolves: rhbz#1063714
Wed Jan 27 13:00:00 2016 Lukas Vrabec 3.13.1-63
- Allow openvswitch domain capability sys_rawio.
Resolves: rhbz#1278495
Tue Jan 26 13:00:00 2016 Lukas Vrabec 3.13.1-62
- Allow openvswitch to manage hugetlfs files and dirs.
Resolves: rhbz#1278495
- Add fs_manage_hugetlbfs_files() interface.
Resolves: rhbz#1278495
Tue Jan 12 13:00:00 2016 Lukas Vrabec 3.13.1-61
- Allow smbcontrol domain to send sigchld to ctdbd domain.
Resolves: #1293784
- Allow openvswitch read/write hugetlb filesystem.
Resolves: #1278495
Wed Oct 14 14:00:00 2015 Miroslav Grepl 3.13.1-60
Allow hypervvssd to list all mountpoints to have VSS live backup working correctly.
Resolves:#1247880
Tue Oct 13 14:00:00 2015 Miroslav Grepl 3.13.1-59
- Revert Add missing labeling for /usr/libexec/abrt-hook-ccpp patch
Resolves: #1254188
Thu Oct 8 14:00:00 2015 Lukas Vrabec 3.13.1-58
- Allow search dirs in sysfs types in kernel_read_security_state.
Resolves: #1254188
- Fix kernel_read_security_state interface that source domain of this interface can search sysctl_fs_t dirs.
Resolves: #1254188
Wed Oct 7 14:00:00 2015 Lukas Vrabec 3.13.1-57
- Add missing labeling for /usr/libexec/abrt-hook-ccpp as a part of #1245477 and #1242467 bugs
Resolves: #1254188
- We need allow connect to xserver for all sandbox_x domain because we have one type for all sandbox processes.
Resolves:#1261938
Fri Oct 2 14:00:00 2015 Miroslav Grepl 3.13.1-56
- Remove labeling for modules_dep_t file contexts to have labeled them as modules_object_t.
- Update files_read_kernel_modules() to contain modutils_read_module_deps_files() calling because module deps labeling could remain and it allows to avoid regressions.
Resolves:#1266928
Tue Sep 29 14:00:00 2015 Lukas Vrabec 3.13.1-55
- We need to require sandbox_web_type attribute in sandbox_x_domain_template().
Resolves: #1261938
- ipsec: The NM helper needs to read the SAs
Resolves: #1259786
- ipsec: Allow ipsec management to create ptys
Resolves: #1259786
Tue Sep 29 14:00:00 2015 Lukas Vrabec 3.13.1-54
- Add temporary fixes for sandbox related to #1103622. It allows to run everything under one sandbox type.
Resolves:#1261938
- Allow abrt_t domain to write to kernel msg device.
Resolves: #1257828
- Allow rpcbind_t domain to change file owner and group
Resolves: #1265266
Tue Sep 22 14:00:00 2015 Lukas Vrabec 3.13.1-53
- Allow smbcontrol to create a socket in /var/samba which uses for a communication with smbd, nmbd and winbind.
Resolves: #1256459
Fri Sep 18 14:00:00 2015 Lukas Vrabec 3.13.1-52
- Allow dirsrv-admin script to read passwd file. Allow dirsrv-admin script to read httpd pid files. Label dirsrv-admin unit file and allow dirsrv-admin domains to use it.
Resolves: #1230300
- Allow qpid daemon to connect on amqp tcp port.
Resolves: #1261805
Fri Sep 18 14:00:00 2015 Miroslav Grepl 3.13.1-51
- Label /etc/ipa/nssdb dir as cert_t
Resolves:#1262718
- Do not provide docker policy files which is shipped by docker-selinux.rpm
Resolves:#1262812
Thu Sep 17 14:00:00 2015 Lukas Vrabec 3.13.1-50
- Add labels for afs binaries: dafileserver, davolserver, salvageserver, dasalvager
Resolves: #1192338
- Add lsmd_plugin_t sys_admin capability, Allow lsmd_plugin_t getattr from sysfs filesystem.
Resolves: #1238079
- Allow rhsmcertd_t send signull to unconfined_service_t domains.
Resolves: #1176078
- Remove file transition from snmp_manage_var_lib_dirs() interface which created snmp_var_lib_t dirs in var_lib_t.
- Allow openhpid_t daemon to manage snmp files and dirs.
Resolves: #1243902
- Allow mdadm_t domain read/write to general ptys and unallocated ttys.
Resolves: #1073314
- Add interface unconfined_server_signull() to allow domains send signull to unconfined_service_t
Resolves: #1176078
Fri Sep 11 14:00:00 2015 Lukas Vrabec 3.13.1-49
- Allow systemd-udevd to access netlink_route_socket to change names for network interfaces without unconfined.pp module. It affects also MLS.
Resolves:#1250456
Thu Sep 10 14:00:00 2015 Lukas Vrabec 3.13.1-48
- Fix labeling for fence_scsi_check script
Resolves: #1255020
- Allow openhpid to read system state Allow openhpid to connect to tcp http port.
Resolves: #1244248
- Allow openhpid to read snmp var lib files.
Resolves: #1243902
- Allow openvswitch_t domains read kernel dependencies due to openvswitch run modprobe
- Allow unconfined_t domains to create /var/run/xtables.lock with iptables_var_run_t
Resolves: #1243403
- Remove bin_t label for /usr/share/cluster/fence_scsi_check\\.pl
Resolves: #1255020
Wed Sep 2 14:00:00 2015 Lukas Vrabec 3.13.1-47
- Fix regexp in chronyd.fc file
Resolves: #1243764
- Allow passenger to getattr filesystem xattr
Resolves: #1196555
- Label mdadm.conf.anackbak as mdadm_conf_t file.
Resolves: #1088904
- Revert \"Allow pegasus_openlmi_storage_t create mdadm.conf.anacbak file in /etc.\"
- Allow watchdog execute fenced python script.
Resolves: #1255020
- Added inferface watchdog_unconfined_exec_read_lnk_files()
- Remove labeling for /var/db/.
*\\.db as etc_t to label db files as system_db_t.
Resolves: #1230877
Thu Aug 27 14:00:00 2015 Lukas Vrabec 3.13.1-46
- Allow watchdog execute fenced python script. Resolves: #1255020
- Added inferface watchdog_unconfined_exec_read_lnk_files()
- Label /var/run/chrony-helper dir as chronyd_var_run_t. Resolves: #1243764
- Allow dhcpc_t domain transition to chronyd_t Resolves: #1243764
Fri Aug 21 14:00:00 2015 Lukas Vrabec 3.13.1-45
- Fix postfix_spool_maildrop_t,postfix_spool_flush_t contexts in postfix.fc file.
Resolves: #1252442
Wed Aug 19 14:00:00 2015 Lukas Vrabec 3.13.1-44
- Allow exec pidof under hypervkvp domain.
Resolves: #1254870
- Allow hypervkvp daemon create connection to the system DBUS
Resolves: #1254870
Wed Aug 19 14:00:00 2015 Lukas Vrabec 3.13.1-43
- Allow openhpid_t to read system state.
Resolves: #1244248
- Added labels for files provided by rh-nginx18 collection
Resolves: #1249945
- Dontaudit block_suspend capability for ipa_helper_t, this is kernel bug. Allow ipa_helper_t capability net_admin. Allow ipa_helper_t to list /tmp. Allow ipa_helper_t to read rpm db.
Resolves: #1252968
- Allow rhsmcertd exec rhsmcertd_var_run_t files and rhsmcerd_tmp_t files. This rules are in hide_broken_sympthons until we find better solution.
Resolves: #1243431
- Allow abrt_dump_oops_t to read proc_security_t files.
- Allow abrt_dump_oops to signull all domains Allow abrt_dump_oops to read all domains state Allow abrt_dump_oops to ptrace all domains
- Add interface abrt_dump_oops_domtrans()
- Add mountpoint dontaudit access check in rhsmcertd policy.
Resolves: #1243431
- Allow samba_net_t to manage samba_var_t sock files.
Resolves: #1252937
- Allow chrome setcap to itself.
Resolves: #1251996
- Allow httpd daemon to manage httpd_var_lib_t lnk_files.
Resolves: #1253706
- Allow chronyd exec systemctl
Resolves: #1243764
- Add inteface chronyd_signal Allow timemaster_t send generic signals to chronyd_t.
Resolves: #1243764
- Added interface fs_dontaudit_write_configfs_dirs
- Add label for kernel module dep files in /usr/lib/modules
Resolves:#916635
- Allow kernel_t domtrans to abrt_dump_oops_t
- Added to files_dontaudit_write_all_mountpoints intefface new dontaudit rule, that domain included this interface dontaudit capability dac_override.
- Allow systemd-networkd to send logs to systemd-journald.
Resolves: #1236616
Wed Aug 12 14:00:00 2015 Lukas Vrabec 3.13.1-42
- Fix label on /var/tmp/kiprop_0
Resolves:#1220763
- Allow lldpad_t to getattr tmpfs_t.
Resolves: #1246220
- Label /dev/shm/lldpad.
* as lldapd_tmpfs_t
Resolves: #1246220
- Allow audisp client to read system state.
Tue Aug 11 14:00:00 2015 Lukas Vrabec 3.13.1-41
- Allow pcp_domain to manage pcp_var_lib_t lnk_files.
Resolves: #1252341
- Label /var/run/xtables.
* as iptables_var_run_t
Resolves: #1243403
Mon Aug 10 14:00:00 2015 Lukas Vrabec 3.13.1-40
- Add interface to read/write watchdog device
- Add labels for /dev/memory_bandwith and /dev/vhci. Thanks ssekidde
Resolves:#1210237
- Allow apcupsd_t to read /sys/devices
Resolves:#1189185
- Allow logrotate to reload services.
Resolves: #1242453
- Allow openhpid use libwatchdog plugin. (Allow openhpid_t rw watchdog device)
Resolves: #1244260
- Allow openhpid liboa_soap plugin to read generic certs.
Resolves: #1244248
- Allow openhpid liboa_soap plugin to read resolv.conf file.
Resolves: #1244248
- Label /usr/libexec/chrony-helper as chronyd_exec_t
- Allow chronyd_t to read dhcpc state.
- Allow chronyd to execute mkdir command.
Fri Aug 7 14:00:00 2015 Miroslav Grepl 3.13.1-39
- Allow mdadm to access /dev/random and add support to create own files/dirs as mdadm_tmpfs_t.
Resolves:#1073314
- Allow udev, lvm and fsadm to access systemd-cat in /var/tmp/dracut if \'dracut -fv\' is executed in MLS.
- Allow admin SELinu users to communicate with kernel_t. It is needed to access /run/systemd/journal/stdout if \'dracut -vf\' is executed. We allow it for other SELinux users.
- Allow sysadm to execute systemd-sysctl in the sysadm_t domain. It is needed for ifup command in MLS mode.
- Add fstools_filetrans_named_content_fsadm() and call it for named_filetrans_domain domains. We need to be sure that /run/blkid is created with correct labeling.
Resolves:#1183503
- Add support for /etc/sanlock which is writable by sanlock daemon.
Resolves:#1231377
- Allow useradd add homedir located in /var/lib/kdcproxy in ipa-server RPM scriplet.
Resolves:#1243775
- Allow snapperd to pass data (one way only) via pipe negotiated over dbus
Resolves:#1250550
- Allow lsmd also setuid capability. Some commands need to executed under root privs. Other commands are executed under unprivileged user.
Wed Aug 5 14:00:00 2015 Lukas Vrabec 3.13.1-38
- Allow openhpid to use libsnmp_bc plugin (allow read snmp lib files).
Resolves: #1243902
- Allow lsm_plugin_t to read sysfs, read hwdata, rw to scsi_generic_device
Resolves: #1238079
- Allow lsm_plugin_t to rw raw_fixed_disk.
Resolves:#1238079
- Allow rhsmcertd to send signull to unconfined_service.
Mon Aug 3 14:00:00 2015 Lukas Vrabec 3.13.1-37
- Allow httpd_suexec_t to read and write Apache stream sockets
Resolves: #1243569
- Allow qpid to create lnk_files in qpid_var_lib_t
Resolves: #1247279
Thu Jul 30 14:00:00 2015 Lukas Vrabec 3.13.1-36
- Allow drbd to get attributes from filesystems.
- Allow redis to read kernel parameters.
Resolves: #1209518
- Allow virt_qemu_ga_t domtrans to passwd_t
- Allow audisp_remote_t to start power unit files domain to allow halt system.
Resolves: #1186780
- Allow audisp_remote_t to read/write user domain pty.
Resolves: #1186780
- Label /usr/sbin/chpasswd as passwd_exec_t.
- Allow sysadm to administrate ldap environment and allow to bind ldap port to allow to setup an LDAP server (389ds).
Resolves:#1221121
Mon Jul 27 14:00:00 2015 Lukas Vrabec 3.13.1-35
- gnome_dontaudit_search_config() needs to be a part of optinal_policy in pegasus.te
- Allow pcp_pmcd daemon to read postfix config files.
- Allow pcp_pmcd daemon to search postfix spool dirs.
Resolves: #1213740
- Added Booleans: pcp_read_generic_logs.
Resolves: #1213740
- Allow drbd to read configuration options used when loading modules.
Resolves: #1134883
- Allow glusterd to manage nfsd and rpcd services.
- Allow glusterd to communicate with cluster domains over stream socket.
- glusterd call pcs utility which calls find for cib.
* files and runs pstree under glusterd. Dontaudit access to security files and update gluster boolean to reflect these changes.
Mon Jul 20 14:00:00 2015 Lukas Vrabec 3.13.1-34
- Allow glusterd to manage nfsd and rpcd services.
- Allow networkmanager to communicate via dbus with systemd_hostanmed.
Resolves: #1234954
- Allow stream connect logrotate to prosody.
- Add prosody_stream_connect() interface.
- httpd should be able to send signal/signull to httpd_suexec_t, instead of httpd_suexec_exec_t.
- Allow prosody to create own tmp files/dirs.
Resolves:#1212498
Wed Jul 15 14:00:00 2015 Lukas Vrabec 3.13.1-33
- Allow networkmanager read rfcomm port.
Resolves:#1212498
- Remove non exists label.
- Fix
*_admin intefaces where body is not consistent with header.
- Label /usr/afs/ as afs_files_t, Allow afs_bosserver_t create afs_config_t and afs_dbdir_t dirs under afs_files_t, Allow afs_bosserver_t read kerberos config
- Remove non exits nfsd_ro_t label.
- Make all interfaces related to openshift_cache_t as deprecated.
- Add rpm_var_run_t label to rpm_admin header
- Add jabberd_lock_t label to jabberd_admin header.
- Add samba_unconfined_script_exec_t to samba_admin header.
- inn daemon should create innd_log_t objects in var_log_t instead of innd_var_run_t
- Fix ctdb policy
- Add samba_signull_winbind()
- Add samba_signull_unconfined_net()
- Allow ctdbd_t send signull to samba_unconfined_net_t.
- Allow openshift_initrc_t to communicate with firewalld over dbus
Resolves:#1221326
Tue Jul 14 14:00:00 2015 Lukas Vrabec 3.13.1-32
- Allow gluster to connect to all ports. It is required by random services executed by gluster.
- Add interfaces winbind_signull(), samba_unconfined_net_signull().
- Dontaudit smbd_t block_suspend capability. This is kernel bug.
- Allow ctdbd sending signull to process winbind, samba_unconfined_net, to
checking if processes exists.
- Add tmpreaper booleans to use nfs_t and samba_share_t.
- Fix path from /usr/sbin/redis-server to /usr/bin/redis-server
- Allow connect ypserv to portmap_port_t
- Fix paths in inn policy, Allow innd read innd_log_t dirs, Allow innd execute innd_etc_t files
- Add support for openstack-nova-
* packages
- Allow NetworkManager_t send signull to dnssec_trigger_t.
- Allow glusterd to execute showmount in the showmount domain.
- Label swift-container-reconciler binary as swift_t.
- Allow dnssec_trigger_t relabelfrom dnssec_trigger_var_run_t files.
- Add cobbler_var_lib_t to \"/var/lib/tftpboot/boot(/.
*)?\"
Resolves:#1213540
- Merge all nova_
* labels under one nova_t.
Wed Jul 8 14:00:00 2015 Miroslav Grepl 3.13.1-31
- Add logging_syslogd_run_nagios_plugins boolean for rsyslog to allow transition to nagios unconfined plugins
Resolves:#1233550
- Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/
- Add support for oddjob based helper in FreeIPA.
- Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob.
- Add nagios_domtrans_unconfined_plugins() interface.
- Update mta_filetrans_named_content() interface to cover more db files.
Resolves:#1167468
- Add back ftpd_use_passive_mode boolean with fixed description.
- Allow pmcd daemon stream connect to mysqld.
- Allow pcp domains to connect to own process using unix_stream_socket.
Resolves:#1213709
- Allow abrt-upload-watch service to dbus chat with ABRT daemon and fsetid capability to allow run reporter-upload correctly.
- Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob.
- Add support for oddjob based helper in FreeIPA.
- Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/
Thu Jul 2 14:00:00 2015 Miroslav Grepl 3.13.1-30
- Allow iptables to read ctdbd lib files.
Resolves:#1224879
- Add systemd_networkd_t to nsswitch domains.
- Allow drbd_t write to fixed_disk_device. Reason: drbdmeta needs write to fixed_disk_device during initialization.
Resolves:#1130675
- Allow NetworkManager write to sysfs.
- Fix cron_system_cronjob_use_shares boolean to call fs interfaces which contain only entrypoint permission.
- Add cron_system_cronjob_use_shares boolean to allow system cronjob to be executed from shares - NFS, CIFS, FUSE. It requires \"entrypoint\" permissios on nfs_t, cifs_t and fusefs_t SELinux types.
- Allow NetworkManager write to sysfs.
- Allow ctdb_t sending signull to smbd_t, for checking if smbd process exists.
- Dontaudit apache to manage snmpd_var_lib_t files/dirs.
- Add interface snmp_dontaudit_manage_snmp_var_lib_files().
- Dontaudit mozilla_plugin_t cap. sys_ptrace.
- Rename xodbc-connect port to xodbc_connect
- Allow ovsdb-server to connect on xodbc-connect and ovsdb tcp ports.
- Allow iscsid write to fifo file kdumpctl_tmp_t. Appears when kdump generates the initramfs during the kernel boot.
- Dontaudit chrome to read passwd file.
- nrpe needs kill capability to make gluster moniterd nodes working.
Resolves:#1235587
Wed Jun 17 14:00:00 2015 Miroslav Grepl 3.13.1-29
- We allow can_exec() on ssh_keygen on gluster. But there is a transition defined by init_initrc_domain() because we need to allow execute unconfined services by glusterd. So ssh-keygen ends up with ssh_keygen_t and we need to allow to manage /var/lib/glusterd/geo-replication/secret.pem.
- Allow sshd to execute gnome-keyring if there is configured pam_gnome_keyring.so.
- Allow gnome-keyring executed by passwd to access /run/user/UID/keyring to change a password.
- Label gluster python hooks also as bin_t.
- Allow glusterd to interact with gluster tools running in a user domain
- Add glusterd_manage_lib_files() interface.
- ntop reads /var/lib/ntop/macPrefix.db and it needs dac_override. It has setuid/setgid.
- Allow samba_t net_admin capability to make CIFS mount working.
- S30samba-start gluster hooks wants to search audit logs. Dontaudit it.
Resolves:#1224879
Mon Jun 15 14:00:00 2015 Miroslav Grepl 3.13.1-28
- Allow glusterd to send generic signals to systemd_passwd_agent processes.
- Allow glusterd to access init scripts/units without defined policy
- Allow glusterd to run init scripts.
- Allow glusterd to execute /usr/sbin/xfs_dbin glusterd_t domain.
Resolves:#1224879
Fri Jun 12 14:00:00 2015 Miroslav Grepl 3.13.1-27
- Calling cron_system_entry() in pcp_domain_template needs to be a part of optional_policy block.
- Allow samba-net to access /var/lib/ctdbd dirs/files.
- Allow glusterd to send a signal to smbd.
- Make ctdbd as home manager to access also FUSE.
- Allow glusterd to use geo-replication gluster tool.
- Allow glusterd to execute ssh-keygen.
- Allow glusterd to interact with cluster services.
- Allow glusterd to connect to the system DBUS for service (acquire_svc).
- Label /dev/log correctly.
Resolves:#1230932
Tue Jun 9 14:00:00 2015 Miroslav Grepl 3.13.1-26
- Back port the latest F22 changes to RHEL7. It should fix most of RHEL7.2 bugs
- Add cgdcbxd policy
Resolves:#1072493
- Fix ftp_homedir boolean
Resolve:#1097775
- Dontaudit ifconfig writing inhertited /var/log/pluto.log.
- Allow cluster domain to dbus chat with systemd-logind.
Resolves:#1145215
- Dontaudit write access to inherited kdumpctl tmp files
Resolves:#1156442
- Allow isnsd_t to communicate with sssd
Resolves:#1167702
- Allow rwho_t to communicate with sssd
Resolves:#1167718
- Allow sblim_gatherd_t to communicate with sssd
Resolves:#1167732
- Allow pkcs_slotd_t to communicate with sssd
Resolves:#1167737
- Allow openvswitch_t to communicate with sssd
Resolves:#1167816
- Allow mysqld_safe_t to communicate with sssd
Resolves:#1167832
- Allow sshd_keygen_t to communicate with sssd
Resolves:#1167840
- Add support for iprdbg logging files in /var/log.
Resolves:#1174363
- Allow tmpreaper_t to manage ntp log content
Resolves:#1176965
- Allow gssd_t to manage ssh keyring
Resolves:#1184791
- Allow httpd_sys_script_t to send system log messages
Resolves:#1185231
- Allow apcupsd_t to read /sys/devices
Resolves:#1189185
- Allow dovecot_t sys_resource capability
Resolves:#1191143
- Add support for mongod/mongos systemd unit files.
Resolves:#1197038
- Add bacula fixes
- Added label mysqld_etc_t for /etc/my.cnf.d/ dir.
Resolves:#1203991
Thu May 14 14:00:00 2015 Miroslav Grepl 3.13.1-25
- Label /usr/libexec/postgresql-ctl as postgresql_exec_t.
- Add more restriction on entrypoint for unconfined domains.
- Only allow semanage_t to be able to setenforce 0, no all domains that use selinux_semanage interface
- Allow all domains to read /dev/urandom. It is needed by all apps/services linked to libgcrypt. There is no harm to allow it by default.
- Update policy/mls for sockets related to access perm. Rules were contradictory.
- Add nagios_run_pnp4nagios and nagios_run_sudo booleans to allow r
un sudo from NRPE utils scripts and allow run nagios in conjunction w
ith PNP4Nagios.
Resolves:#1201054
- Don\'t use deprecated userdom_manage_tmpfs_role() interface calliing and use userdom_manage_tmp_role() instead.
- Update virt_read_pid_files() interface to allow read also symlinks with virt_var_run_t type
- Label /var/lib/tftpboot/aarch64(/.
*)? and /var/lib/tftpboot/images2(/.
*)?
- Add support for iprdbg logging files in /var/log.
- Add fixes to rhsmcertd_t
- Allow puppetagent_t to transfer firewalld messages over dbus
- Add support for /usr/libexec/mongodb-scl-helper RHSCL helper script.
- Added label mysqld_etc_t for /etc/my.cnf.d/ dir.
- Add support for mongod/mongos systemd unit files.
- cloudinit and rhsmcertd need to communicate with dbus
- Allow dovecot_t sys_resource capability
Tue Mar 31 14:00:00 2015 Miroslav Grepl 3.13.1-24
- ALlow mongod execmem by default.
- Update policy/mls for sockets. Rules were contradictory.
Resolves:#1207133
- Allow a user to login with different security level via ssh.
Fri Jan 30 13:00:00 2015 Miroslav Grepl 3.13.1-23
- Update seutil_manage_config() interface.
Resolves:#1185962
- Allow pki-tomcat relabel pki_tomcat_etc_rw_t.
- Turn on docker_transition_unconfined by default
Wed Jan 28 13:00:00 2015 Miroslav Grepl 3.13.1-22
- Allow virtd to list all mountpoints.
Resolves:#1180713
Wed Jan 28 13:00:00 2015 Miroslav Grepl 3.13.1-21
- pkcsslotd_lock_t should be an alias for pkcs_slotd_lock_t.
- Allow fowner capability for sssd because of selinux_child handling.
- ALlow bind to read/write inherited ipsec pipes
- Allow hypervkvp to read /dev/urandom and read addition states/config files.
- Allow gluster rpm scripletto create glusterd socket with correct labeling. This is a workaround until we get fix in glusterd.
- Add glusterd_filetrans_named_pid() interface
- Allow radiusd to connect to radsec ports.
- Allow setuid/setgid for selinux_child
- Allow lsmd plugin to connect to tcp/5988 by default.
- Allow lsmd plugin to connect to tcp/5989 by default.
- Update ipsec_manage_pid() interface.
Resolves:#1184978
Fri Jan 23 13:00:00 2015 Miroslav Grepl 3.13.1-20
- Update ipsec_manage_pid() interface.
Resolves:#1184978
Wed Jan 21 13:00:00 2015 Miroslav Grepl 3.13.1-19
- Allow ntlm_auth running in winbind_helper_t to access /dev/urandom.
Wed Jan 21 13:00:00 2015 Miroslav Grepl 3.13.1-18
- Add auditing support for ipsec.
Resolves:#1182524
- Label /ostree/deploy/rhel-atomic-host/deploy directory as system_conf_t
- Allow netutils chown capability to make tcpdump working with -w
Tue Jan 20 13:00:00 2015 Miroslav Grepl 3.13.1-17
- Allow ipsec to execute _updown.netkey script to run unbound-control.
- Allow neutron to read rpm DB.
- Add additional fixes for hyperkvp
* creates new ifcfg-{name} file
* Runs hv_set_ifconfig.sh, which does the following
* Copies ifcfg-{name} to /etc/sysconfig/network-scripts
- Allow svirt to read symbolic links in /sys/fs/cgroups labeled as tmpfs_t
- Add labeling for pacemaker.log.
- Allow radius to connect/bind radsec ports.
- Allow pm-suspend running as virt_qemu_ga to read /var/log/pm-suspend.log
- Allow virt_qemu_ga to dbus chat with rpm.
- Update virt_read_content() interface to allow read also char devices.
- Allow glance-registry to connect to keystone port.
Resolves:#1181818
Mon Jan 12 13:00:00 2015 Miroslav Grepl 3.13.1-16
- Allow sssd to send dbus all user domains.
Resolves:#1172291
- Allow lsm plugin to read certificates.
- Fix labeling for keystone CGI scripts.
- Make snapperd back as unconfined domain.
Fri Jan 9 13:00:00 2015 Miroslav Grepl 3.13.1-15
- Fix bugs in interfaces discovered by sepolicy.
- Allow slapd to read /usr/share/cracklib/pw_dict.hwm.
- Allow lsm plugins to connect to tcp/18700 by default.
- Allow brltty mknod capability to allow create /var/run/brltty/vcsa.
- Fix pcp_domain_template() interface.
- Fix conman.te.
- Allow mon_fsstatd to read /proc/sys/fs/binfmt_misc
- Allow glance-scrubber to connect tcp/9191.
- Add missing setuid capability for sblim-sfcbd.
- Allow pegasus ioctl() on providers.
- Add conman_can_network.
- Allow chronyd to read chrony conf files located in /run/timemaster/.
- Allow radius to bind on tcp/1813 port.
- dontaudit block suspend access for openvpn_t
- Allow conman to create files/dirs in /tmp.
- Update xserver_rw_xdm_keys() interface to have \'setattr\'.
Resolves:#1172291
- Allow sulogin to read /dev/urandom and /dev/random.
- Update radius port definition to have also tcp/18121
- Label prandom as random_device_t.
- Allow charon to manage files in /etc/strongimcv labeled as ipsec_conf_t.
Fri Dec 12 13:00:00 2014 Miroslav Grepl 3.13.1-14
- Allow virt_qemu_ga_t to execute kmod.
- Add missing files_dontaudit_list_security_dirs() for smbd_t in samba_export_all_ro boolean.
- Add additionnal MLS attribute for oddjob_mkhomedir to create homedirs.
Resolves:#1113725
- Enable OpenStack cinder policy
- Add support for /usr/share/vdsm/daemonAdapter
- Add support for /var/run/gluster
Tue Dec 2 13:00:00 2014 Miroslav Grepl 3.13.1-13
- Remove old pkcsslotd.pp from minimum package
- Allow rlogind to use also rlogin ports.
- Add support for /usr/libexec/ntpdate-wrapper. Label it as ntpdate_exec_t.
- Allow bacula to connect also to postgresql.
- Label /usr/libexec/tomcat/server as tomcat_exec_t
- Add support for /usr/sbin/ctdbd_wrapper
- Add support for /usr/libexec/ppc64-diag/rtas_errd
- Allow rpm_script_roles to access system_mail_t
- Allow brltty to create /var/run/brltty
- Allow lsmd plugin to access netlink_route_socket
- Allow smbcontrol to read passwd
- Add support for /usr/libexec/sssd/selinux_child and create sssd_selinux_manager_t domain for it
Resolves:#1140106
- Allow osad to execute rhn_check
- Allow load_policy to rw inherited sssd pipes because of selinux_child
- Allow admin SELinux users mounting / as private within a new mount namespace as root in MLS
- Add additional fixes for su_restricted_domain_template to make moving to sysadm_r and trying to su working correctly
- Add additional booleans substitions
Tue Nov 25 13:00:00 2014 Miroslav Grepl 3.13.1-12
- Add seutil_dontaudit_access_check_semanage_module_store() interface
Resolves:#1140106
- Update to have all _systemctl() interface also init_reload_services().
- Dontaudit access check on SELinux module store for sssd.
- Add labeling for /sbin/iw.
- Allow named_filetrans_domain to create ibus directory with correct labeling.
Mon Nov 24 13:00:00 2014 Miroslav Grepl 3.13.1-11
- Allow radius to bind tcp/1812 radius port.
- Dontaudit list user_tmp files for system_mail_t.
- Label virt-who as virtd_exec_t.
- Allow rhsmcertd to send a null signal to virt-who running as virtd_t.
- Add missing alias for _content_rw_t.
Resolves:#1089177
- Allow spamd to access razor-agent.log.
- Add fixes for sfcb from libvirt-cim TestOnly bug.
- Allow NetworkManager stream connect on openvpn.
- Make /usr/bin/vncserver running as unconfined_service_t.
- getty_t should be ranged in MLS. Then also local_login_t runs as ranged domain.
- Label /etc/docker/certs.d as cert_t.
Tue Nov 18 13:00:00 2014 Miroslav Grepl 3.13.1-10
- Label /etc/strongimcv as ipsec_conf_file_t.
- Add support for /usr/bin/start-puppet-ca helper script
Resolves:#1160727
- Allow rpm scripts to enable/disable transient systemd units.
Resolves:#1154613
- Make kpropdas nsswitch domain
Resolves:#1153561
- Make all glance domain as nsswitch domains
Resolves:#1113281
- Allow selinux_child running as sssd access check on /etc/selinux/targeted/modules/active
- Allow access checks on setfiles/load_policy/semanage_lock for selinux_child running as sssd_t
Resolves:#1140106
Mon Nov 10 13:00:00 2014 Miroslav Grepl 3.13.1-9
- Dontaudit access check on setfiles/load_policy for sssd_t.
Resolves:#1140106
- Add kdump_rw_inherited_kdumpctl_tmp_pipes()
Resolves:#1156442
- Make linuxptp services as unconfined.
- Added new policy linuxptp.
Resolves:#1149693
- Label keystone cgi files as keystone_cgi_script_exec_t.
Resolves:#1138424
- Make tuned as unconfined domain
Thu Nov 6 13:00:00 2014 Miroslav Grepl 3.13.1-8
- Allow guest to connect to libvirt using unix_stream_socket.
- Allow all bus client domains to dbus chat with unconfined_service_t.
- Allow inetd service without own policy to run in inetd_child_t which is unconfined domain.
- Make opensm as nsswitch domain to make it working with sssd.
- Allow brctl to read meminfo.
- Allow winbind-helper to execute ntlm_auth in the caller domain.
Resolves:#1160339
- Make plymouthd as nsswitch domain to make it working with sssd.
Resolves:#1160196
- Make drbd as nsswitch domain to make it working with sssd.
- Make conman as nsswitch domain to make ipmitool.exp runing as conman_t working.
- Add support for /var/lib/sntp directory.
- Add fixes to allow docker to create more content in tmpfs ,and donaudit reading /proc
- Allow winbind to read usermodehelper
- Allow telepathy domains to execute shells and bin_t
- Allow gpgdomains to create netlink_kobject_uevent_sockets
- Allow mongodb to bind to the mongo port and mongos to run as mongod_t
- Allow abrt to read software raid state.
- Allow nslcd to execute netstat.
- Allow dovecot to create user\'s home directory when they log into IMAP.
- Allow login domains to create kernel keyring with different level.
Mon Nov 3 13:00:00 2014 Miroslav Grepl 3.13.1-7
- Allow modemmanger to connectto itself
Resolves:#1120152
- Allow pki_tomcat to create link files in /var/lib/pki-ca.
Resolves:#1121744
- varnishd needs to have fsetid capability
Resolves:#1125165
- Allow snapperd to dbus chat with system cron jobs.
Resolves:#1152447
- Allow dovecot to create user\'s home directory when they log into IMAP
Resolves:#1152773
- Add labeling for /usr/sbin/haproxy-systemd-wrapper wrapper to make haproxy running haproxy_t.
- ALlow listen and accept on tcp socket for init_t in MLS. Previously it was for xinetd_t.
- Allow nslcd to execute netstat.
- Add suppor for keepalived unconfined scripts and allow keepalived to read all domain state and kill capability.
- Allow nslcd to read /dev/urandom.
Thu Oct 16 14:00:00 2014 Miroslav Grepl 3.13.1-6
- Add back kill permisiion for system class
Resolves:#1150011
Wed Oct 15 14:00:00 2014 Miroslav Grepl 3.13.1-5
- Add back kill permisiion for service class
Resolves:#1150011
- Make rhsmcertd_t also as dbus domain.
- Allow named to create DNS_25 with correct labeling.
- Add cloudform_dontaudit_write_cloud_log()
- Call auth_use_nsswitch to apache to read/write cloud-init keys.
- Allow cloud-init to dbus chat with certmonger.
- Fix path to mon_statd_initrc_t script.
- Allow all RHCS services to read system state.
- Allow dnssec_trigger_t to execute unbound-control in own domain.
- kernel_read_system_state needs to be called with type. Moved it to antivirus.if.
- Added policy for mon_statd and mon_procd services. BZ (1077821)
- Allow opensm_t to read/write /dev/infiniband/umad1.
- Allow mongodb to manage own log files.
- Allow neutron connections to system dbus.
- Add support for /var/lib/swiftdirectory.
- Allow nova-scheduler to read certs.
- Allow openvpn to access /sys/fs/cgroup dir.
- Allow openvpn to execute systemd-passwd-agent in systemd_passwd_agent_t to make openvpn working with systemd.
- Fix samba_export_all_ro/samba_export_all_rw booleans to dontaudit search/read security files.
- Add auth_use_nsswitch for portreserve to make it working with sssd.
- automount policy is non-base module so it needs to be called in optional block.
- ALlow sensord to getattr on sysfs.
- Label /usr/share/corosync/corosync as cluster_exec_t.
- Allow lmsd_plugin to read passwd file. BZ(1093733)
- Allow read antivirus domain all kernel sysctls.
- Allow mandb to getattr on file systems
- Allow nova-console to connect to mem_cache port.
- Make sosreport as unconfined domain.
- Allow mondogdb to \'accept\' accesses on the tcp_socket port.
- ALlow sanlock to send a signal to virtd_t.
Thu Oct 9 14:00:00 2014 Miroslav Grepl 3.13.1-4
- Build also MLS policy
Resolves:#1138424
Thu Oct 9 14:00:00 2014 Miroslav Grepl 3.13.1-3
- Add back kill permisiion for system class
- Allow iptables read fail2ban logs.
- Fix radius labeled ports
- Add userdom_manage_user_tmpfs_files interface
- Allow libreswan to connect to VPN via NM-libreswan.
- Label 4101 tcp port as brlp port
- fix dev_getattr_generic_usb_dev interface
- Allow all domains to read fonts
- Make sure /run/systemd/generator and system is labeled correctly on creation.
- Dontaudit aicuu to search home config dir.
- Make keystone_cgi_script_t domain.
Resolves:#1138424
- Fix bug in drbd policy,
- Added support for cpuplug.
- ALlow sanlock_t to read sysfs_t.
- Added sendmail_domtrans_unconfined interface
- Fix broken interfaces
- radiusd wants to write own log files.
- Label /usr/libexec/rhsmd as rhsmcertd_exec_t
- Allow rhsmcertd send signull to setroubleshoot.
- Allow rhsmcertd manage rpm db.
- Added policy for blrtty.
- Fix keepalived policy
- Allow rhev-agentd dbus chat with systemd-logind.
- Allow keepalived manage snmp var lib sock files.
- Add support for /var/lib/graphite-web
- Allow NetworkManager to create Bluetooth SDP sockets
- It\'s going to do the the discovery for DUN service for modems with Bluez 5.
- Allow swift to connect to all ephemeral ports by default.
- Allow sssd to read selinux config to add SELinux user mapping.
- Allow lsmd to search own plguins.
- Allow abrt to read /dev/memto generate an unique machine_id and uses sosuploader\'s algorithm based off dmidecode[1] fields.
- ALlow zebra for user/group look-ups.
- Allow nova domains to getattr on all filesystems.
- Allow collectd sys_ptrace and dac_override caps because of reading of /proc/%i/io for several processes.
- Allow pppd to connect to /run/sstpc/sstpc-nm-sstp-service-28025 over unix stream socket.
- Allow rhnsd_t to manage also rhnsd config symlinks.
- ALlow user mail domains to create dead.letter.
- Allow rabbitmq_t read rabbitmq_var_lib_t lnk files.
- Allow pki-tomcat to change SELinux object identity.
- Allow radious to connect to apache ports to do OCSP check
- Allow git cgi scripts to create content in /tmp
- Allow cockpit-session to do GSSAPI logins.
- Allow sensord read in /proc
- Additional access required by usbmuxd
Thu Sep 18 14:00:00 2014 Miroslav Grepl 3.13.1-2
- Allow locate to look at files/directories without labels, and chr_file and blk_file on non dev file systems
- Label /usr/lib/erlang/erts.
*/bin files as bin_t
- Add files_dontaudit_access_check_home_dir() inteface.
- Allow udev_t mounton udev_var_run_t dirs #(1128618)
- Add systemd_networkd_var_run_t labeling for /var/run/systemd/netif and allow systemd-networkd to manage it.
- Add init_dontaudit_read_state() interface.
- Add label for ~/.local/share/fonts
- Allow unconfined_r to access unconfined_service_t.
- Allow init to read all config files
- Add new interface to allow creation of file with lib_t type
- Assign rabbitmq port.
- Allow unconfined_service_t to dbus chat with all dbus domains
- Add new interfaces to access users keys.
- Allow domains to are allowed to mounton proc to mount on files as well as dirs
- Fix labeling for HOME_DIR/tmp and HOME_DIR/.tmp directories.
- Add a port definition for shellinaboxd
- Label ~/tmp and ~/.tmp directories in user tmp dirs as user_tmp_t
- Allow userdomains to stream connect to pcscd for smart cards
- Allow programs to use pam to search through user_tmp_t dires (/tmp/.X11-unix)
- Update to rawhide-contrib changes
Resolves:#1123844
Thu Aug 21 14:00:00 2014 Miroslav Grepl 3.13.1-1
- Rebase to 3.13.1 which we have in Fedora21
Resolves:#1128284
Fri Jun 13 14:00:00 2014 Miroslav Grepl 3.12.1-156
- Back port fixes from Fedora. Mainly OpenStack and Docker fixes
Wed Jun 11 14:00:00 2014 Miroslav Grepl 3.12.1-155
- Add policy-rhel-7.1-{base,contrib} patches
Mon May 5 14:00:00 2014 Miroslav Grepl 3.12.1-154
- Add support for us_cli ports
- Fix labeling for /var/run/user//gvfs
- add support for tcp/9697
- Additional rules required by openstack, needs backport to F20 and RHEL7
- Additional access required by docker
- ALlow motion to use tcp/8082 port
- Allow init_t to setattr/relabelfrom dhcp state files
- Dontaudit antivirus domains read access on all security files by default
- Add missing alias for old amavis_etc_t type
- Allow block_suspend cap for haproxy
- Additional fixes for instack overcloud
- Allow OpenStack to read mysqld_db links and connect to MySQL
- Remove dup filename rules in gnome.te
- Allow sys_chroot cap for httpd_t and setattr on httpd_log_t
- Allow iscsid to handle own unit files
- Add iscsi_systemctl()
- Allow mongod to create also sock_files in /run with correct labeling
- Allow httpd to send signull to apache script domains and don\'t audit leaks
- Allow rabbitmq_beam to connect to httpd port
- Allow aiccu stream connect to pcscd
- Allow dmesg to read hwdata and memory dev
- Allow all freeipmi domains to read/write ipmi devices
- Allow sblim_sfcbd to use also pegasus-https port
- Allow rabbitmq_epmd to manage rabbit_var_log_t files
- Allow chronyd to read /sys/class/hwmon/hwmon1/device/temp2_input
- Allow docker to status any unit file and allow it to start generic unit files
Mon Apr 7 14:00:00 2014 Miroslav Grepl 3.12.1-153
- Change hsperfdata_root to have as user_tmp_t
Resolves:#1076523
Fri Apr 4 14:00:00 2014 Miroslav Grepl 3.12.1-152
- Fix Multiple same specifications for /var/named/chroot/dev/zero
- Add labels for /var/named/chroot_sdb/dev devices
- Add support for strongimcv
- Use kerberos_keytab_domains in auth_use_nsswitch
- Update auth_use_nsswitch to make all these types as kerberos_keytab_domain to
- Allow net_raw cap for neutron_t and send sigkill to dnsmasq
- Fix ntp_filetrans_named_content for sntp-kod file
- Add httpd_dbus_sssd boolean
- Dontaudit exec insmod in boinc policy
- Rename kerberos_keytab_domain to kerberos_keytab_domains
- Add kerberos_keytab_domain()
- Fix kerberos_keytab_template()
- Make all domains which use kerberos as kerberos_keytab_domain
Resolves:#1083670
- Allow kill capability to winbind_t
Wed Apr 2 14:00:00 2014 Miroslav Grepl 3.12.1-151
- varnishd wants chown capability
- update ntp_filetrans_named_content() interface
- Add additional fixes for neutron_t. #1083335
- Dontaudit getattr on proc_kcore_t
- Allow pki_tomcat_t to read ipa lib files
- Allow named_filetrans_domain to create /var/cache/ibus with correct labelign
- Allow init_t run /sbin/augenrules
- Add dev_unmount_sysfs_fs and sysnet_manage_ifconfig_run interfaces
- Allow unpriv SELinux user to use sandbox
- Add default label for /tmp/hsperfdata_root
Tue Apr 1 14:00:00 2014 Miroslav Grepl 3.12.1-149
- Add file subs also for /var/home
Mon Mar 31 14:00:00 2014 Miroslav Grepl 3.12.1-149
- Allow xauth_t to read user_home_dir_t lnk_file
- Add labeling for lightdm-data
- Allow certmonger to manage ipa lib files
- Add support for /var/lib/ipa
- Allow pegasus to getattr virt_content
- Added some new rules to pcp policy
- Allow chrome_sandbox to execute config_home_t
- Add support for ABRT FAF
Fri Mar 28 13:00:00 2014 Miroslav Grepl 3.12.1-148
- Allow kdm to send signull to remote_login_t process
- Add gear policy
- Turn on gear_port_t
- Allow cgit to read gitosis lib files by default
- Allow vdagent to read xdm state
- Allow NM and fcoeadm to talk together over unix_dgram_socket
Thu Mar 27 13:00:00 2014 Miroslav Grepl 3.12.1-147
- Back port fixes for pegasus_openlmi_admin_t from rawhide
Resolves:#1080973
- Add labels for ostree
- Add SELinux awareness for NM
- Label /usr/sbin/pwhistory_helper as updpwd_exec_t
Wed Mar 26 13:00:00 2014 Miroslav Grepl 3.12.1-146
- add gnome_append_home_config()
- Allow thumb to append GNOME config home files
- Allow rasdaemon to rw /dev/cpu//msr
- fix /var/log/pki file spec
- make bacula_t as auth_nsswitch domain
- Identify pki_tomcat_cert_t as a cert_type
- Define speech-dispater_exec_t as an application executable
- Add a new file context for /var/named/chroot/run directory
- update storage_filetrans_all_named_dev for sg
* devices
- Allow auditctl_t to getattr on all removeable devices
- Allow nsswitch_domains to stream connect to nmbd
- Allow unprivusers to connect to memcached
- label /var/lib/dirsrv/scripts-INSTANCE as bin_t
Mon Mar 24 13:00:00 2014 Miroslav Grepl 3.12.1-145
- Allow also unpriv user to run vmtools
- Allow secadm to read /dev/urandom and meminfo
Resolves:#1079250
- Add booleans to allow docker processes to use nfs and samba
- Add mdadm_tmpfs support
- Dontaudit net_amdin for /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.51-2.4.5.1.el7.x86_64/jre-abrt/bin/java running as pki_tomcat_t
- Allow vmware-user-sui to use user ttys
- Allow talk 2 users logged via console too
- Allow ftp services to manage xferlog_t
- Make all pcp domanis as unconfined for RHEL7.0 beucause of new policies
- allow anaconda to dbus chat with systemd-localed
Fri Mar 21 13:00:00 2014 Miroslav Grepl 3.12.1-144
- allow anaconda to dbus chat with systemd-localed
- Add fixes for haproxy based on bperkinsAATTredhat.com
- Allow cmirrord to make dmsetup working
- Allow NM to execute arping
- Allow users to send messages through talk
- Add userdom_tmp_role for secadm_t
Thu Mar 20 13:00:00 2014 Lukas Vrabec 3.12.1-143
- Add additional fixes for rtas_errd
- Fix transitions for tmp/tmpfs in rtas.te
- Allow rtas_errd to readl all sysctls
Wed Mar 19 13:00:00 2014 Miroslav Grepl 3.12.1-142
- Add support for /var/spool/rhsm/debug
- Make virt_sandbox_use_audit as True by default
- Allow svirt_sandbox_domains to ptrace themselves
Wed Mar 19 13:00:00 2014 Miroslav Grepl 3.12.1-141
- Allow docker containers to manage /var/lib/docker content
Mon Mar 17 13:00:00 2014 Miroslav Grepl 3.12.1-140
- Allow docker to read tmpfs_t symlinks
- Allow sandbox svirt_lxc_net_t to talk to syslog and to sssd over stream sockets
Mon Mar 17 13:00:00 2014 Miroslav Grepl 3.12.1-139
- Allow collectd to talk to libvirt
- Allow chrome_sandbox to use leaked unix_stream_sockets
- Dontaudit leaks of sockets into chrome_sandbox_t
- If you create a cups directory in /var/cache then it should be labeled cups_rw_etc_t
- Run vmtools as unconfined domains
- Allow snort to manage its log files
- Allow systemd_cronjob_t to be entered via bin_t
- Allow procman to list doveconf_etc_t
- allow keyring daemon to create content in tmpfs directories
- Add proper labelling for icedtea-web
- vpnc is creating content in networkmanager var run directory
- Label sddm as xdm_exec_t to make KDE working again
- Allow postgresql to read network state
- Allow java running as pki_tomcat to read network sysctls
- Fix cgroup.te to allow cgred to read cgconfig_etc_t
- Allow beam.smp to use ephemeral ports
- Allow winbind to use the nis to authenticate passwords
Fri Mar 14 13:00:00 2014 Lukas Vrabec 3.12.1-138
- Make rtas_errd_t as unconfined domain for F20.It needs additional fixes. It runs rpm at least.
- Allow net_admin cap for fence_virtd running as fenced_t
- Make abrt-java-connector working
- Make cimtest script 03_defineVS.py of ComputerSystem group working
- Fix git_system_enable_homedirs boolean
- Allow munin mail plugins to read network systcl
Thu Mar 13 13:00:00 2014 Miroslav Grepl 3.12.1-137
- Allow vmtools_helper_t to execute bin_t
- Add support for /usr/share/joomla
- /var/lib/containers should be labeled as openshift content for now
- Allow docker domains to talk to the login programs, to allow a process to login into the container
- Allow install_t do dbus chat with NM
- Fix interface names in anaconda.if
- Add install_t for anaconda. A new type is a part of anaconda policy
- sshd to read network sysctls
Wed Mar 12 13:00:00 2014 Miroslav Grepl 3.12.1-136
- Allow zabbix to send system log msgs
- Allow init_t to stream connect to ipsec
Resolves:#1060775
Tue Mar 11 13:00:00 2014 Miroslav Grepl 3.12.1-135
- Add docker_connect_any boolean
Tue Mar 11 13:00:00 2014 Miroslav Grepl 3.12.1-134
- Allow unpriv SELinux users to dbus chat with firewalld
- Add lvm_write_metadata()
- Label /etc/yum.reposd dir as system_conf_t. Should be safe because system_conf_t is base_ro_file_type
- Allow pegasus_openlmi_storage_t to write lvm metadata
- Add hide_broken_symptoms for kdumpgui because of systemd bug
- Make kdumpgui_t as unconfined domain
Resolves:#1044299
- Allow docker to connect to tcp/5000
Mon Mar 10 13:00:00 2014 Miroslav Grepl 3.12.1-133
- Allow numad to write scan_sleep_millisecs
- Turn on entropyd_use_audio boolean by default
- Allow cgred to read /etc/cgconfig.conf because it contains templates used together with rules from /etc/cgrules.conf.
- Allow lscpu running as rhsmcertd_t to read /proc/sysinfo
- Fix label on irclogs in the homedir
- Allow kerberos_keytab_domain domains to manage keys until we get sssd fix
- Allow postgresql to use ldap
- Add missing syslog-conn port
- Add support for /dev/vmcp and /dev/sclp
Resolves:#1069310
Fri Mar 7 13:00:00 2014 Miroslav Grepl 3.12.1-132
- Modify xdm_write_home to allow create files/links in /root with xdm_home_
- Allow virt domains to read network state
Resolves:#1072019
Thu Mar 6 13:00:00 2014 Miroslav Grepl 3.12.1-131
- Added pcp rules
- dontaudit openshift_cron_t searching random directories, should be back ported to RHEL6
- clean up ctdb.te
- Allow ctdbd to connect own ports
- Fix samba_export_all_rw booleanto cover also non security dirs
- Allow swift to exec rpm in swift_t and allow to create tmp files/dirs
- Allow neutron to create /run/netns with correct labeling
- Allow certmonger to list home dirs
Wed Mar 5 13:00:00 2014 Miroslav Grepl 3.12.1-130
- Change userdom_use_user_inherited_ttys to userdom_use_user_ttys for systemd-tty-ask
- Add sysnet_filetrans_named_content_ifconfig() interface
- Allow ctdbd to connect own ports
- Fix samba_export_all_rw booleanto cover also non security dirs
- Allow swift to exec rpm in swift_t and allow to create tmp files/dirs
- Allow neutron to create /run/netns with correct labeling
- Allow kerberos keytab domains to manage sssd/userdomain keys\"
- Allow to run ip cmd in neutron_t domain
Mon Mar 3 13:00:00 2014 Miroslav Grepl 3.12.1-129
- Allow block_suspend cap2 for systemd-logind and rw dri device
- Add labeling for /usr/libexec/nm-libreswan-service
- Allow locallogin to rw xdm key to make Virtual Terminal login providing smartcard pin working
- Add xserver_rw_xdm_keys()
- Allow rpm_script_t to dbus chat also with systemd-located
- Fix ipa_stream_connect_otpd()
- update lpd_manage_spool() interface
- Allow krb5kdc to stream connect to ipa-otpd
- Add ipa_stream_connect_otpd() interface
- Allow vpnc to unlink NM pids
- Add networkmanager_delete_pid_files()
- Allow munin plugins to access unconfined plugins
- update abrt_filetrans_named_content to cover /var/spool/debug
- Label /var/spool/debug as abrt_var_cache_t
- Allow rhsmcertd to connect to squid port
- Make docker_transition_unconfined as optional boolean
- Allow certmonger to list home dirs
Wed Feb 26 13:00:00 2014 Miroslav Grepl 3.12.1-128
- Make snapperd as unconfined domain and add additional fixes for it
- Remove nsplugin.pp module on upgrade
Tue Feb 25 13:00:00 2014 Miroslav Grepl 3.12.1-127
- Add snapperd_home_t for HOME_DIR/.snapshots directory
- Make sosreport as unconfined domain
- Allow sosreport to execute grub2-probe
- Allow NM to manage hostname config file
- Allow systemd_timedated_t to dbus chat with rpm_script_t
- Allow lsmd plugins to connect to http/ssh/http_cache ports by default
- Add lsmd_plugin_connect_any boolean
- Allow mozilla_plugin to attempt to set capabilities
- Allow lsdm_plugins to use tcp_socket
- Dontaudit mozilla plugin from getattr on /proc or /sys
- Dontaudit use of the keyring by the services in a sandbox
- Dontaudit attempts to sys_ptrace caused by running ps for mysqld_safe_t
- Allow rabbitmq_beam to connect to jabber_interserver_port
- Allow logwatch_mail_t to transition to qmail_inject and queueu
- Added new rules to pcp policy
- Allow vmtools_helper_t to change role to system_r
- Allow NM to dbus chat with vmtools
- Fix couchdb_manage_files() to allow manage couchdb conf files
- Add support for /var/run/redis.sock
- dontaudit gpg trying to use audit
- Allow consolekit to create log directories and files
- Fix vmtools policy to allow user roles to access vmtools_helper_t
- Allow block_suspend cap2 for ipa-otpd
- Allow pkcsslotd to read users state
- Add ioctl to init_dontaudit_rw_stream_socket
- Add systemd_hostnamed_manage_config() interface
- Remove transition for temp dirs created by init_t
- gdm-simple-slave uses use setsockopt
- sddm-greater is a xdm type program
Tue Feb 18 13:00:00 2014 Miroslav Grepl 3.12.1-126
- Add lvm_read_metadata()
- Allow auditadm to search /var/log/audit dir
- Add lvm_read_metadata() interface
- Allow confined users to run vmtools helpers
- Fix userdom_common_user_template()
- Generic systemd unit scripts do write check on /
- Allow init_t to create init_tmp_t in /tmp.This is for temporary content created by generic unit files
- Add additional fixes needed for init_t and setup script running in generic unit files
- Allow general users to create packet_sockets
- added connlcli port
- Add init_manage_transient_unit() interface
- Allow init_t (generic unit files) to manage rpc state date as we had it for initrc_t
- Fix userdomain.te to require passwd class
- devicekit_power sends out a signal to all processes on the message bus when power is going down
- Dontaudit rendom domains listing /proc and hittping system_map_t
- Dontauit leaks of var_t into ifconfig_t
- Allow domains that transition to ssh_t to manipulate its keyring
- Define oracleasm_t as a device node
- Change to handle /root as a symbolic link for os-tree
- Allow sysadm_t to create packet_socket, also move some rules to attributes
- Add label for openvswitch port
- Remove general transition for files/dirs created in /etc/mail which got etc_aliases_t label.
- Allow postfix_local to read .forward in pcp lib files
- Allow pegasus_openlmi_storage_t to read lvm metadata
- Add additional fixes for pegasus_openlmi_storage_t
- Allow bumblebee to manage debugfs
- Make bumblebee as unconfined domain
- Allow snmp to read etc_aliases_t
- Allow lscpu running in pegasus_openlmi_storage_t to read /dev/mem
- Allow pegasus_openlmi_storage_t to read /proc/1/environ
- Dontaudit read gconf files for cupsd_config_t
- make vmtools as unconfined domain
- Add vmtools_helper_t for helper scripts. Allow vmtools shutdonw a host and run ifconfig.
- Allow collectd_t to use a mysql database
- Allow ipa-otpd to perform DNS name resolution
- Added new policy for keepalived
- Allow openlmi-service provider to manage transitient units and allow stream connect to sssd
- Add additional fixes new pscs-lite+polkit support
- Add labeling for /run/krb5kdc
- Change w3c_validator_tmp_t to httpd_w3c_validator_tmp_t in F20
- Allow pcscd to read users proc info
- Dontaudit smbd_t sending out random signuls
- Add boolean to allow openshift domains to use nfs
- Allow w3c_validator to create content in /tmp
- zabbix_agent uses nsswitch
- Allow procmail and dovecot to work together to deliver mail
- Allow spamd to execute files in homedir if boolean turned on
- Allow openvswitch to listen on port 6634
- Add net_admin capability in collectd policy
- Fixed snapperd policy
- Fixed bugsfor pcp policy
- Allow dbus_system_domains to be started by init
- Fixed some interfaces
- Add kerberos_keytab_domain attribute
- Fix snapperd_conf_t def
Tue Feb 11 13:00:00 2014 Miroslav Grepl 3.12.1-125
- Addopt corenet rules for unbound-anchor to rpm_script_t
- Allow runuser to send send audit messages.
- Allow postfix-local to search .forward in munin lib dirs
- Allow udisks to connect to D-Bus
- Allow spamd to connect to spamd port
- Fix syntax error in snapper.te
- Dontaudit osad to search gconf home files
- Allow rhsmcertd to manage /etc/sysconf/rhn director
- Fix pcp labeling to accept /usr/bin for all daemon binaries
- Fix mcelog_read_log() interface
- Allow iscsid to manage iscsi lib files
- Allow snapper domtrans to lvm_t. Add support for /etc/snapper and allow snapperd to manage it.
- Make tuned_t as unconfined domain for RHEL7.0
- Allow ABRT to read puppet certs
- Add sys_time capability for virt-ga
- Allow gemu-ga to domtrans to hwclock_t
- Allow additional access for virt_qemu_ga_t processes to read system clock and send audit messages
- Fix some AVCs in pcp policy
- Add to bacula capability setgid and setuid and allow to bind to bacula ports
- Changed label from rhnsd_rw_conf_t to rhnsd_conf_t
- Add access rhnsd and osad to /etc/sysconfig/rhn
- drbdadm executes drbdmeta
- Fixes needed for docker
- Allow epmd to manage /var/log/rabbitmq/startup_err file
- Allow beam.smp connect to amqp port
- Modify xdm_write_home to allow create also links as xdm_home_t if the boolean is on true
- Allow init_t to manage pluto.ctl because of init_t instead of initrc_t
- Allow systemd_tmpfiles_t to manage all non security files on the system
- Added labels for bacula ports
- Fix label on /dev/vfio/vfio
- Add kernel_mounton_messages() interface
- init wants to manage lock files for iscsi
Mon Feb 3 13:00:00 2014 Miroslav Grepl 3.12.1-124
- Added osad policy
- Allow postfix to deliver to procmail
- Allow bumblebee to seng kill signal to xserver
- Allow vmtools to execute /usr/bin/lsb_release
- Allow docker to write system net ctrls
- Add support for rhnsd unit file
- Add dbus_chat_session_bus() interface
- Add dbus_stream_connect_session_bus() interface
- Fix pcp.te
- Fix logrotate_use_nfs boolean
- Add lot of pcp fixes found in RHEL7
- fix labeling for pmie for pcp pkg
- Change thumb_t to be allowed to chat/connect with session bus type
- Allow call renice in mlocate
- Add logrotate_use_nfs boolean
- Allow setroubleshootd to read rpc sysctl
Fri Jan 31 13:00:00 2014 Miroslav Grepl 3.12.1-123
- Turn on bacula, rhnsd policy
- Add support for rhnsd unit file
- Add dbus_chat_session_bus() interface
- Add dbus_stream_connect_session_bus() interface
- Fix logrotate_use_nfs boolean
- Add lot of pcp fixes found in RHEL7
- fix labeling for pmie for pcp pkg
- Change thumb_t to be allowed to chat/connect with session bus type
- Allow call renice in mlocate
- Add logrotate_use_nfs boolean
- Allow setroubleshootd to read rpc sysctl
- Fixes for
*_admin interfaces
- Add pegasus_openlmi_storage_var_run_t type def
- Add support for /var/run/openlmi-storage
- Allow tuned to create syslog.conf with correct labeling
- Add httpd_dontaudit_search_dirs boolean
- Add support for winbind.service
- ALlow also fail2ban-client to read apache logs
- Allow vmtools to getattr on all fs
- Add support for dey_sapi port
- Add logging_filetrans_named_conf()
- Allow passwd_t to use ipc_lock, so that it can change the password in gnome-keyring
Tue Jan 28 13:00:00 2014 Miroslav Grepl 3.12.1-122
- Update snapper policy
- Allow domains to append rkhunter lib files
- Allow snapperd to getattr on all fs
- Allow xdm to create /var/gdm with correct labeling
- Add label for snapper.log
- Allow fail2ban-client to read apache log files
- Allow thumb_t to execute dbus-daemon in thumb_t
Mon Jan 27 13:00:00 2014 Miroslav Grepl 3.12.1-121
- Allow gdm to create /var/gdm with correct labeling
- Allow domains to append rkhunterl lib files. #1057982
- Allow systemd_tmpfiles_t net_admin to communicate with journald
- Add interface to getattr on an isid_type for any type of file
- Update libs_filetrans_named_content() to have support for /usr/lib/debug directory
- Allow initrc_t domtrans to authconfig if unconfined is enabled
- Allow docker and mount on devpts chr_file
- Allow docker to transition to unconfined_t if boolean set
- init calling needs to be optional in domain.te
- Allow uncofined domain types to handle transient unit files
- Fix labeling for vfio devices
- Allow net_admin capability and send system log msgs
- Allow lldpad send dgram to NM
- Add networkmanager_dgram_send()
- rkhunter_var_lib_t is correct type
- Back port pcp policy from rawhide
- Allow openlmi-storage to read removable devices
- Allow system cron jobs to manage rkhunter lib files
- Add rkhunter_manage_lib_files()
- Fix ftpd_use_fusefs boolean to allow manage also symlinks
- Allow smbcontrob block_suspend cap2
- Allow slpd to read network and system state info
- Allow NM domtrans to iscsid_t if iscsiadm is executed
- Allow slapd to send a signal itself
- Allow sslget running as pki_ra_t to contact port 8443, the secure port of the CA.
- Fix plymouthd_create_log() interface
- Add rkhunter policy with files type definition for /var/lib/rkhunter until it is fixed in rkhunter package
- Add mozilla_plugin_exec_t for /usr/lib/firefox/plugin-container
- Allow postfix and cyrus-imapd to work out of box
- Allow fcoemon to talk with unpriv user domain using unix_stream_socket
- Dontaudit domains that are calling into journald to net_admin
- Add rules to allow vmtools to do what it does
- snapperd is D-Bus service
- Allow OpenLMI PowerManagement to call \'systemctl --force reboot\'
- Add haproxy_connect_any boolean
- Allow haproxy also to use http cache port by default
Resolves:#1058248
Tue Jan 21 13:00:00 2014 Miroslav Grepl 3.12.1-120
- Allow apache to write to the owncloud data directory in /var/www/html...
- Allow consolekit to create log dir
- Add support for icinga CGI scripts
- Add support for icinga
- Allow kdumpctl_t to create kdump lock file
Resolves:#1055634
- Allow kdump to create lnk lock file
- Allow nscd_t block_suspen capability
- Allow unconfined domain types to manage own transient unit file
- Allow systemd domains to handle transient init unit files
- Add interfaces to handle transient
Mon Jan 20 13:00:00 2014 Miroslav Grepl 3.12.1-119
- Add cron unconfined role support for uncofined SELinux user
- Call corenet_udp_bind_all_ports() in milter.te
- Allow fence_virtd to connect to zented port
- Fix header for mirrormanager_admin()
- Allow dkim-milter to bind udp ports
- Allow milter domains to send signull itself
- Allow block_suspend for yum running as mock_t
- Allow beam.smp to manage couchdb files
- Add couchdb_manage_files()
- Add labeling for /var/log/php_errors.log
- Allow bumblebee to stream connect to xserver
- Allow bumblebee to send a signal to xserver
- gnome-thumbnail to stream connect to bumblebee
- Allow xkbcomp running as bumblebee_t to execute bin_t
- Allow logrotate to read squid.conf
- Additional rules to get docker and lxc to play well with SELinux
- Allow bumbleed to connect to xserver port
- Allow pegasus_openlmi_storage_t to read hwdata
Thu Jan 16 13:00:00 2014 Miroslav Grepl 3.12.1-118
- Allow init_t to work on transitient and snapshot unit files
- Add logging_manage_syslog_config()
- Update sysnet_dns_name_resolve() to allow connect to dnssec por
- Allow pegasus_openlmi_storage_t to read hwdata
Resolves:#1031721
- Fix rhcs_rw_cluster_tmpfs()
- Allow fenced_t to bind on zented udp port
- Added policy for vmtools
- Fix mirrormanager_read_lib_files()
- Allow mirromanager scripts running as httpd_t to manage mirrormanager pid files
- Allow ctdb to create sock files in /var/run/ctdb
- Add sblim_filetrans_named_content() interface
- Allow rpm scritplets to create /run/gather with correct labeling
- Allow gnome keyring domains to create gnome config dirs
- Dontaudit read/write to init stream socket for lsmd_plugin_t
- Allow automount to read nfs link files
- Allow lsm plugins to read/write lsmd stream socket
- Allow certmonger to connect ldap port to make IPA CA certificate renewal working.
- Add also labeling for /var/run/ctdb
- Add missing labeling for /var/lib/ctdb
- ALlow tuned to manage syslog.conf. Should be fixed in tuned. #1030446
- Dontaudit hypervkvp to search homedirs
- Dontaudit hypervkvp to search admin homedirs
- Allow hypervkvp to execute bin_t and ifconfig in the caller domain
- Dontaudit xguest_t to read ABRT conf files
- Add abrt_dontaudit_read_config()
- Allow namespace-init to getattr on fs
- Add thumb_role() also for xguest
- Add filename transitions to create .spamassassin with correct labeling
- Allow apache domain to read mirrormanager pid files
- Allow domains to read/write shm and sem owned by mozilla_plugin_t
- Allow alsactl to send a generic signal to kernel_t
Tue Jan 14 13:00:00 2014 Miroslav Grepl 3.12.1-117
- Add back rpm_run() for unconfined user
Tue Jan 14 13:00:00 2014 Miroslav Grepl 3.12.1-116
- Add missing files_create_var_lib_dirs()
- Fix typo in ipsec.te
- Allow passwd to create directory in /var/lib
- Add filename trans also for event21
- Allow iptables command to read /dev/rand
- Add sigkill capabilityfor ipsec_t
- Add filename transitions for bcache devices
- Add additional rules to create /var/log/cron by syslogd_t with correct labeling
- Add give everyone full access to all key rings
- Add default lvm_var_run_t label for /var/run/multipathd
- Fix log labeling to have correct default label for them after logrotate
- Labeled ~/.nv/GLCache as being gstreamer output
- Allow nagios_system_plugin to read mrtg lib files
- Add mrtg_read_lib_files()
- Call rhcs_rw_cluster_tmpfs for dlm_controld
- Make authconfing as named_filetrans domain
- Allow virsh to connect to user process using stream socket
- Allow rtas_errd to read rand/urand devices and add chown capability
- Fix labeling from /var/run/net-snmpd to correct /var/run/net-snmp
Resolves:#1051497
- Add also chown cap for abrt_upload_watch_t. It already has dac_override
- Allow sosreport to manage rhsmcertd pid files
- Add rhsmcertd_manage_pid_files()
- Allow also setgid cap for rpc.gssd
- Dontaudit access check for abrt on cert_t
- Allow pegasus_openlmi_system providers to dbus chat with systemd-logind
Fri Jan 10 13:00:00 2014 Miroslav Grepl 3.12.1-115
- Fix semanage import handling in spec file
Fri Jan 10 13:00:00 2014 Miroslav Grepl 3.12.1-114
- Add default lvm_var_run_t label for /var/run/multipathd
Resolves:#1051430
- Fix log labeling to have correct default label for them after logrotate
- Add files_write_root_dirs
- Add new openflow port label for 6653/tcp and 6633/tcp
- Add xserver_manage_xkb_libs()
- Label tcp/8891 as milter por
- Allow gnome_manage_generic_cache_files also create cache_home_t files
- Fix aide.log labeling
- Fix log labeling to have correct default label for them after logrotate
- Allow mysqld-safe write access on /root to make mysqld working
- Allow sosreport domtrans to prelikn
- Allow OpenvSwitch to connec to openflow ports
- Allow NM send dgram to lldpad
- Allow hyperv domains to execute shell
- Allow lsmd plugins stream connect to lsmd/init
- Allow sblim domains to create /run/gather with correct labeling
- Allow httpd to read ldap certs
- Allow cupsd to send dbus msgs to process with different MLS level
- Allow bumblebee to stream connect to apmd
- Allow bumblebee to run xkbcomp
- Additional allow rules to get libvirt-lxc containers working with docker
- Additional allow rules to get libvirt-lxc containers working with docker
- Allow docker to getattr on itself
- Additional rules needed for sandbox apps
- Allow mozilla_plugin to set attributes on usb device if use_spice boolean enabled
- httpd should be able to send signal/signull to httpd_suexec_t
- Add more fixes for neturon. Domtrans to dnsmasq, iptables. Make neutron as filenamtrans domain.
Wed Jan 8 13:00:00 2014 Miroslav Grepl 3.12.1-113
- Add neutron fixes
Mon Jan 6 13:00:00 2014 Miroslav Grepl 3.12.1-112
- Allow sshd to write to all process levels in order to change passwd when running at a level
- Allow updpwd_t to downgrade /etc/passwd file to s0, if it is not running with this range
- Allow apcuspd_t to status and start the power unit file
- Allow udev to manage kdump unit file
- Added new interface modutils_dontaudit_exec_insmod
- Allow cobbler to search dhcp_etc_t directory
- systemd_systemctl needs sys_admin capability
- Allow sytemd_tmpfiles_t to delete all directories
- passwd to create gnome-keyring passwd socket
- Add missing zabbix_var_lib_t type
- Fix filename trans for zabbixsrv in zabbix.te
- Allow fprintd_t to send syslog messages
- Add zabbix_var_lib_t for /var/lib/zabbixsrv, also allow zabix to connect to smtp port
- Allow mozilla plugin to chat with policykit, needed for spice
- Allow gssprozy to change user and gid, as well as read user keyrings
- Label upgrades directory under /var/www as httpd_sys_rw_content_t, add other filetrans rules to label content correctly
- Allow polipo to connect to http_cache_ports
- Allow cron jobs to manage apache var lib content
- Allow yppassword to manage the passwd_file_t
- Allow showall_t to send itself signals
- Allow cobbler to restart dhcpc, dnsmasq and bind services
- Allow certmonger to manage home cert files
- Add userdom filename trans for user mail domains
- Allow apcuspd_t to status and start the power unit file
- Allow cgroupdrulesengd to create content in cgoups directories
- Allow smbd_t to signull cluster
- Allow gluster daemon to create fifo files in glusterd_brick_t and sock_file in glusterd_var_lib_t
- Add label for /var/spool/cron.aquota.user
- Allow sandbox_x domains to use work with the mozilla plugin semaphore
- Added new policy for speech-dispatcher
- Added dontaudit rule for insmod_exec_t in rasdaemon policy
- Updated rasdaemon policy
- Allow system_mail_t to transition to postfix_postdrop_t
- Clean up mirrormanager policy
- Allow virt_domains to read cert files, needs backport to RHEL7
- Allow sssd to read systemd_login_var_run_t
- Allow irc_t to execute shell and bin-t files:
- Add new access for mythtv
- Allow rsync_t to manage all non auth files
- allow modemmanger to read /dev/urand
- Allow sandbox apps to attempt to set and get capabilties
Thu Dec 19 13:00:00 2013 Miroslav Grepl 3.12.1-111 | |
