Changelog for selinux-policy-minimum-20210419-6.1.noarch.rpm :

* Tue May 18 2021 Ludwig Nussel - allow systemd to watch /usr, /usr/lib, /etc, /etc/pki as we have path units that trigger on changes in those. Added fix_systemd_watch.patch- own /usr/share/selinux/packages/$SELINUXTYPE/ and /var/lib/selinux/$SELINUXTYPE/active/modules/
* to allow packages to install files there
* Wed Apr 28 2021 Ludwig Nussel - allow cockpit socket to bind nodes (fix_cockpit.patch)- use %autosetup to get rid of endless patch lines
* Tue Apr 27 2021 Johannes Segitz - Updated fix_networkmanager.patch to allow NetworkManager to watch its configuration directories- Added fix_dovecot.patch to fix dovecot authentication (bsc#1182207)
* Mon Apr 26 2021 Johannes Segitz - Added Recommends for selinux-autorelabel (bsc#1181837)- Prevent libreoffice fonts from changing types on every relabel (bsc#1185265). Added fix_libraries.patch
* Fri Apr 23 2021 Johannes Segitz - Transition unconfined users to ldconfig type (bsc#1183121). Extended fix_unconfineduser.patch
* Mon Apr 19 2021 Johannes Segitz - Update to version 20210419- Refreshed:
* fix_dbus.patch
* fix_hadoop.patch
* fix_init.patch
* fix_unprivuser.patch
* Fri Mar 12 2021 Ales Kedroutek - Adjust fix_init.patch to allow systemd to do sd-listen on tcp socket [bsc#1183177]
* Tue Mar 09 2021 Johannes Segitz - Update to version 20210309- Refreshed
* fix_systemd.patch
* fix_selinuxutil.patch
* fix_iptables.patch
* fix_init.patch
* fix_logging.patch
* fix_nscd.patch
* fix_hadoop.patch
* fix_unconfineduser.patch
* fix_chronyd.patch
* fix_networkmanager.patch
* fix_cron.patch
* fix_usermanage.patch
* fix_unprivuser.patch
* fix_rpm.patch- Ensure that /usr/etc is labeled according to /etc rules
* Tue Feb 23 2021 Thorsten Kukuk - Update to version 20210223- Change name of tar file to a more common schema to allow parallel installation of several source versions- Adjust fix_init.patch
* Mon Jan 11 2021 Thorsten Kukuk - Update to version 20210111 - Drop fix_policykit.patch (integrated upstream) - Adjust fix_iptables.patch - update container policy
* Tue Nov 10 2020 Johannes Segitz - Updated fix_corecommand.patch to set correct types for the OBS build tools
* Thu Oct 29 2020 Thorsten Kukuk - wicked.fc: add libexec directories- Update to version 20201029 - update container policy
* Fri Oct 16 2020 Thorsten Kukuk - Update to version 20201016- Use python3 to build (fc_sort.c was replaced by fc_sort.py which uses python3)- Drop SELINUX=disabled, \"selinux=0\" kernel commandline option has to be used instead. New default is \"permissive\" [bsc#1176923].
* Thu Sep 10 2020 Johannes Segitz - Update to version 20200910. Refreshed
* fix_authlogin.patch
* fix_nagios.patch
* fix_systemd.patch
* fix_usermanage.patch- Delete suse_specific.patch, moved content into fix_selinuxutil.patch- Cleanup of booleans-
* presets
* Enabled user_rw_noexattrfile unconfined_chrome_sandbox_transition unconfined_mozilla_plugin_transition for the minimal policy
* Disabled xserver_object_manager for the MLS policy
* Disabled openvpn_enable_homedirs privoxy_connect_any selinuxuser_direct_dri_enabled selinuxuser_ping (aka user_ping) squid_connect_any telepathy_tcp_connect_generic_network_ports for the targeted policy Change your local config if you need them- Build HTML version of manpages for the -devel package
* Thu Sep 03 2020 Johannes Segitz - Drop BuildRequires for python, python-xml. It\'s not needed anymore
* Tue Sep 01 2020 Johannes Segitz - Drop fix_dbus.patch_orig, was included by accident- Drop segenxml_interpreter.patch, not used anymore
* Tue Aug 11 2020 Thorsten Kukuk - macros.selinux-policy: move rpm-state directory to /run and make sure it exists
* Wed Aug 05 2020 Thorsten Kukuk - Cleanup spec file and follow more closely Fedora- Label /sys/kernel/uevent_helper with tmpfiles.d/selinux-policy.conf- Move config to /etc/selinux/config and create during %post install to be compatible with upstream and documentation.- Add RPM macros for SELinux (macros.selinux-policy)- Install booleans.subs_dist- Remove unused macros- Sync make/install macros with Fedora spec file- Introduce sandbox sub-package
* Wed Jul 29 2020 Thorsten Kukuk - Add policycoreutils-devel as BuildRequires
* Fri Jul 17 2020 Johannes Segitz - Update to version 20200717. Refreshed
* fix_fwupd.patch
* fix_hadoop.patch
* fix_init.patch
* fix_irqbalance.patch
* fix_logrotate.patch
* fix_nagios.patch
* fix_networkmanager.patch
* fix_postfix.patch
* fix_sysnetwork.patch
* fix_systemd.patch
* fix_thunderbird.patch
* fix_unconfined.patch
* fix_unprivuser.patch
* selinux-policy.spec- Added update.sh to make updating easier
* Tue Jul 14 2020 Johannes Segitz - Updated fix_unconfineduser.patch to allow unconfined_dbusd_t access to accountsd dbus- New patch:
* fix_nis.patch- Updated patches:
* fix_postfix.patch: Transition is done in distribution specific script
* Tue Jun 02 2020 Johannes Segitz - Added module for wicked- New patches:
* fix_authlogin.patch
* fix_screen.patch
* fix_unprivuser.patch
* fix_rpm.patch
* fix_apache.patch
* Thu Mar 26 2020 Johannes Segitz - Added module for rtorrent- Enable snapper module in minimum policy to reduce issues on BTRFS Updated fix_snapper.patch to prevent relabling of snapshot
* Mon Mar 09 2020 Johannes Segitz - New patches:
* fix_accountsd.patch
* fix_automount.patch
* fix_colord.patch
* fix_mcelog.patch
* fix_sslh.patch
* fix_nagios.patch
* fix_openvpn.patch
* fix_cron.patch
* fix_usermanage.patch
* fix_smartmon.patch
* fix_geoclue.patch
* suse_specific.patch Default systems should now work without selinuxuser_execmod- Removed xdm_entrypoint_pam.patch, necessary change is in fix_unconfineduser.patch- Enable SUSE specific settings again
* Wed Feb 19 2020 Johannes Segitz - Update to version 20200219 Refreshed fix_hadoop.patch Updated
* fix_dbus.patch
* fix_hadoop.patch
* fix_nscd.patch
* fix_xserver.patch Renamed postfix_paths.patch to fix_postfix.patch Added
* fix_init.patch
* fix_locallogin.patch
* fix_policykit.patch
* fix_iptables.patch
* fix_irqbalance.patch
* fix_ntp.patch
* fix_fwupd.patch
* fix_firewalld.patch
* fix_logrotate.patch
* fix_selinuxutil.patch
* fix_corecommand.patch
* fix_snapper.patch
* fix_systemd.patch
* fix_unconfined.patch
* fix_unconfineduser.patch
* fix_chronyd.patch
* fix_networkmanager.patch
* xdm_entrypoint_pam.patch- Removed modules minimum_temp_fixes and targeted_temp_fixes from the corresponding policies- Reduced default module list of minimum policy by removing apache inetd nis postfix mta modules- Adding/removing necessary pam config automatically- Minimum and targeted policy: Enable domain_can_mmap_files by default- Targeted policy: Disable selinuxuser_execmem, selinuxuser_execmod and selinuxuser_execstack to have safe defaults
* Fri Aug 09 2019 Johannes Segitz - Moved back to fedora policy (20190802)- Removed spec file conditionals for old SELinux userland- Removed config.tgz- Removed patches:
* label_sysconfig.selinux.patch
* label_var_run_rsyslog.patch
* suse_additions_obs.patch
* suse_additions_sslh.patch
* suse_modifications_apache.patch
* suse_modifications_cron.patch
* suse_modifications_getty.patch
* suse_modifications_logging.patch
* suse_modifications_ntp.patch
* suse_modifications_usermanage.patch
* suse_modifications_virt.patch
* suse_modifications_xserver.patch
* sysconfig_network_scripts.patch
* segenxml_interpreter.patch- Added patches:
* fix_djbdns.patch
* fix_dbus.patch
* fix_gift.patch
* fix_java.patch
* fix_hadoop.patch
* fix_thunderbird.patch
* postfix_paths.patch
* fix_nscd.patch
* fix_sysnetwork.patch
* fix_logging.patch
* fix_xserver.patch
* fix_miscfiles.patch to fix problems with the coresponding modules- Added sedoctool.patch to prevent build failures- This also adds three modules:
* packagekit.(te|if|fc) Basic (currently permissive) module for packagekit
* minimum_temp_fixes.(te|if|fc) and
* targeted_temp_fixes.(te|if|fc) both are currently necessary to get the systems to boot in enforcing mode. Most of them obviosly stem from mislabeled files, so this needs to be worked through and then removed eventually Also selinuxuser_execstack, selinuxuser_execmod and domain_can_mmap_files need to be enabled. Especially the first two are bad and should be removed ASAP
* Thu Jul 11 2019 - Update to refpolicy 20190609. New modules for stubby and several systemd updates, including initial support for systemd --user sessions. Refreshed
* label_var_run_rsyslog.patch
* suse_modifications_cron.patch
* suse_modifications_logging.patch
* suse_modifications_ntp.patch
* suse_modifications_usermanage.patch
* suse_modifications_xserver.patch
* sysconfig_network_scripts.patch
* Mon Feb 04 2019 jsegitzAATTsuse.com- Update to refpolicy 20190201. New modules for chromium, hostapd, and sigrok and minor fixes for existing modules. Refreshed suse_modifications_usermanage.patch
* Wed Nov 28 2018 jsegitzAATTsuse.com- Change default state to disabled and disable SELinux after uninstallation of policy to prevent unbootable system (bsc#1108949, bsc#1109590)
* Tue Nov 27 2018 jsegitzAATTsuse.com- Use refpolicy 20180701 as a base- Dropped patches
* allow-local_login_t-read-shadow.patch
* dont_use_xmllint_in_make_conf.patch
* label_sysconfig.selinux-policy.patch
* policy-rawhide-base.patch
* policy-rawhide-contrib.patch
* suse_modifications_authlogin.patch
* suse_modifications_dbus.patch
* suse_modifications_glusterfs.patch
* suse_modifications_ipsec.patch
* suse_modifications_passenger.patch
* suse_modifications_policykit.patch
* suse_modifications_postfix.patch
* suse_modifications_rtkit.patch
* suse_modifications_selinuxutil.patch
* suse_modifications_ssh.patch
* suse_modifications_staff.patch
* suse_modifications_stapserver.patch
* suse_modifications_systemd.patch
* suse_modifications_unconfined.patch
* suse_modifications_unconfineduser.patch
* suse_modifications_unprivuser.patch
* systemd-tmpfiles.patch
* type_transition_contrib.patch
* type_transition_file_class.patch
* useradd-netlink_selinux_socket.patch
* xconsole.patch Rebased the other patches to apply to refpolicy- Added segenxml_interpreter.patch to not use env in shebang- Added rpmlintrc to surpress duplicate file warnings
* Mon Mar 26 2018 rgoldwynAATTsuse.com- Add overlayfs as xattr capable (bsc#1073741)
* add-overlayfs-as-xattr-capable.patch
* Tue Dec 12 2017 jsegitzAATTsuse.com- Added
* suse_modifications_glusterfs.patch
* suse_modifications_passenger.patch
* suse_modifications_stapserver.patch to modify module name to make the current tools happy
* Wed Nov 29 2017 rbrownAATTsuse.com- Repair erroneous changes introduced with %_fillupdir macro
* Thu Nov 23 2017 rbrownAATTsuse.com- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)
* Wed Mar 15 2017 mwilckAATTsuse.com- POLCYVER depends both on the libsemanage/policycoreutils version and the kernel. The former is more important for us, kernel seems to have all necessary features in Leap 42.1 already.- Replaced = runtime dependencies on checkpolicy/policycoreutils with \"=\". 2.5 policy is not supposed to work with 2.3 tools, The runtime policy tools need to be same the policy was built with.
* Wed Mar 15 2017 mwilckAATTsuse.com- Changes required by policycoreutils update to 2.5
* lots of spec file content needs to be conditional on policycoreutils version.- Specific policycoreutils 2.5 related changes:
* modules moved from /etc/selinux to /var/lib/selinux (https://github.com/SELinuxProject/selinux/wiki/Policy-Store-Migration)
* module path now includes includes priority. Users override default policies by setting higher priority. Thus installed policy modules can be fully verified by RPM.
* Installed modules have a different format and path. Raw bzip2 doesn\'t suffice to create them any more, but we can process them all in a single semodule -i command.- Policy version depends on kernel / distro version
* do not touch policy., rather fail if it\'s not created- Enabled building mls policy for Leap (not for SLES)- Other
* Bug: \"sandbox.disabled\" should be \"sandbox.pp.disabled\" for old policycoreutils
* Bug: (minimum) additional modules that need to be activated: postfix (required by apache), plymouthd (required by getty)
* Cleanup: /etc -> %{sysconfdir} etc.
* Thu Aug 13 2015 jsegitzAATTnovell.com- fixed missing role assignment in cron_unconfined_role
* Tue Aug 11 2015 jsegitzAATTnovell.com- Updated suse_modifications_ipsec.patch, removed dontaudits for ipsec_mgmt_t and granted matching permissions
* Wed Aug 05 2015 jsegitzAATTnovell.com- Added suse_modifications_ipsec.patch to grant additional privileges to ipsec_mgmt_t
* Tue Jul 21 2015 jsegitzAATTnovell.com- Minor changes for CC evaluation. Allow reading of /dev/random and ipc_lock for dbus and dhcp
* Wed Jun 24 2015 jsegitzAATTnovell.com- Transition from unconfined user to cron admin type- Allow systemd_timedated_t to talk to unconfined dbus for minimal policy (bsc#932826)- Allow hostnamectl to set the hostname (bsc#933764)
* Wed May 20 2015 jsegitzAATTnovell.com- Removed ability of staff_t and user_t to use svirt. Will reenable this later on with a policy upgrade Added suse_modifications_staff.patch
* Wed Feb 25 2015 jsegitzAATTnovell.com- Added dont_use_xmllint_in_make_conf.patch to remove xmllint usage in make conf. This currently breaks manual builds.- Added BuildRequires for libxml2-tools to enable xmllint checks once the issue mentioned above is solved
* Thu Jan 29 2015 jsegitzAATTnovell.com- adjusted suse_modifications_ntp to match SUSE chroot paths
* Wed Jan 28 2015 jsegitzAATTnovell.com- Added
* suse_additions_obs.patch to allow local builds by OBS
* suse_additions_sslh.patch to confine sslh- Added suse_modifications_cron.patch to adjust crontabs contexts- Modified suse_modifications_postfix.patch to match SUSE paths- Modified suse_modifications_ssh.patch to bring boolean sshd_forward_ports back- Modified
* suse_modifications_dbus.patch
* suse_modifications_unprivuser.patch
* suse_modifications_xserver.patch to allow users to be confined- Added
* suse_modifications_apache.patch
* suse_modifications_ntp.patch and modified
* suse_modifications_xserver.patch to fix labels on startup scripts used by systemd- Removed unused and incorrect interface dev_create_all_dev_nodes from systemd-tmpfiles.patch- Removed BuildRequire for selinux-policy-devel
* Fri Jan 23 2015 jsegitzAATTnovell.com- Major cleanup of the spec file
* Fri Jan 23 2015 jsegitzAATTnovell.com- removed suse_minimal_cc.patch and splitted them into
* suse_modifications_dbus.patch
* suse_modifications_policykit.patch
* suse_modifications_postfix.patch
* suse_modifications_rtkit.patch
* suse_modifications_unconfined.patch
* suse_modifications_systemd.patch
* suse_modifications_unconfineduser.patch
* suse_modifications_selinuxutil.patch
* suse_modifications_logging.patch
* suse_modifications_getty.patch
* suse_modifications_authlogin.patch
* suse_modifications_xserver.patch
* suse_modifications_ssh.patch
* suse_modifications_usermanage.patch- Added suse_modifications_virt.patch to enable svirt on s390x
* Sat Nov 08 2014 Led - fix bashism in post script
* Thu Sep 18 2014 jsegitzAATTsuse.comRedid changes done by vcizekAATTsuse.com in SLE12 package- disable build of MLS policy- removed outdated description files
* Alan_Rouse-openSUSE_with_SELinux.txt
* Alan_Rouse-Policy_Development_Process.txt
* Mon Sep 08 2014 jsegitzAATTsuse.com- removed remove_duplicate_filetrans_pattern_rules.patch
* Fri Sep 05 2014 jsegitzAATTsuse.com- Updated policy to include everything up until 20140730 (refpolicy and fedora rawhide improvements). Rebased all patches that are still necessary- Removed permissivedomains.pp. Doesn\'t work with the new policy- modified spec file so that all modifications for distro=redhat and distro=suse will be used.- added selinux-policy-rpmlintrc to suppress some warnings that aren\'t valid for this package- added suse_minimal_cc.patch to create a suse specific module to prevent errors while using the minimum policy. Will rework them in the proper places once the minimum policy is reworked to really only confine a minimal set of domains.
* Tue Sep 02 2014 vcizekAATTsuse.com- removed source files which were not used
* modules-minimum.conf, modules-mls.conf, modules-targeted.conf, permissivedomains.fc, permissivedomains.if, permissivedomains.te, seusers, seusers-mls, seusers-targeted, users_extra-mls, users_extra-targeted
* Mon Jun 02 2014 vcizekAATTsuse.com- remove duplicate filetrans_pattern rules
* fixes build with libsepol-2.3
* added remove_duplicate_filetrans_pattern_rules.patch
* Mon Dec 09 2013 vcizekAATTsuse.com- enable build of mls and targeted policies- fixes to the minimum policy:- label /var/run/rsyslog correctly
* label_var_run_rsyslog.patch- allow systemd-tmpfiles to create devices
* systemd-tmpfiles.patch- add rules for sysconfig
* correctly label /dev/.sysconfig/network
* added sysconfig_network_scripts.patch- run restorecon and fixfiles only if if selinux is enabled- fix console login
* allow-local_login_t-read-shadow.patch- allow rsyslog to write to xconsole
* xconsole.patch- useradd needs to call selinux_check_access (via pam_rootok)
* useradd-netlink_selinux_socket.patch
* Mon Aug 12 2013 roAATTsuse.de- fix build on factory: newer rpm does not allow to mark non-directories as dir anymore (like symlinks in this case)
* Thu Jul 11 2013 cooloAATTsuse.com- install COPYING
* Fri Mar 22 2013 vcizekAATTsuse.com- switch to Fedora as upstream- added patches:
* policy-rawhide-base.patch
* policy-rawhide-contrib.patch
* type_transition_file_class.patch
* type_transition_contrib.patch
* label_sysconfig.selinux-policy.patch
* Tue Dec 11 2012 vcizekAATTsuse.com- bump up policy version to 27, due to recent libsepol update- dropped currently unused policy-rawhide.patch- fix installing of file_contexts (this enables restorecond to run properly)- Recommends: audit and setools
* Mon Dec 10 2012 meissnerAATTsuse.com- mark included files in source
* Mon Oct 22 2012 vcizekAATTsuse.com- update to 2.20120725- added selinux-policy-run_sepolgen_during_build.patch- renamed patch with SUSE-specific policy to selinux-policy-SUSE.patch- dropped policygentool and OLPC stuff
* Wed May 09 2012 cooloAATTsuse.com- patch license to be in spdx.org format
* Fri May 21 2010 prusnakAATTsuse.cz- use policy created by Alan Rouse
* Sun Apr 11 2010 justinmattockAATTgmail.com- Adjust selinux-policy.spec so that the policy source tree is put in /usr/share/doc/packages/selinux-
* so users can build the policy [bnc#582404]
* Wed Apr 07 2010 thomasAATTnovell.com- fixed fileperms of /etc/selinux/config to be 644 to allow libselinux to read from it (bnc#582399) this is also the default file mode in fedora 12
* Fri Jun 26 2009 thomasAATTnovell.com- added config file for /etc/selinux/
* Wed Jan 14 2009 prusnakAATTsuse.cz- updated to version 2008.12.10
* Fix consistency of audioentropy and iscsi module naming.
* Debian file context fix for xen from Russell Coker.
* Xserver MLS fix from Eamon Walsh.
* Add omapi port for dhcpcd.
* Deprecate per-role templates and rolemap support.
* Implement user-based access control for use as role separations.
* Move shared library calls from individual modules to the domain module.
* Enable open permission checks policy capability.
* Remove hierarchy from portage module as it is not a good example of hieararchy.
* Remove enableaudit target from modular build as semodule -DB supplants it.
* Added modules: - milter (Paul Howarth)
* Thu Oct 16 2008 prusnakAATTsuse.cz- updated to version 2008.10.14
* Debian update for NetworkManager/wpa_supplicant from Martin Orr.
* Logrotate and Bind updates from Vaclav Ovsik.
* Init script file and domain support.
* Glibc 2.7 fix from Vaclav Ovsik.
* Samba/winbind update from Mike Edenfield.
* Policy size optimization with a non-security file attribute from James Carter.
* Database labeled networking update from KaiGai Kohei.
* Several misc changes from the Fedora policy, cherry picked by David Hardeman.
* Large whitespace fix from Dominick Grift.
* Pam_mount fix for local login from Stefan Schulze Frielinghaus.
* Issuing commands to upstart is over a datagram socket, not the initctl named pipe.
* Updated init_telinit() to match.
* Added modules: - cyphesis (Dan Walsh) - memcached (Dan Walsh) - oident (Dominick Grift) - w3c (Dan Walsh)
* Tue Jul 22 2008 prusnakAATTsuse.cz- initial version 2008.07.02 from tresys