RPM Search

Changelog for selinux-policy-3.13.1-63.atomic.el7.7.noarch.rpm :

* Wed Jun 22 2016 Colin Walters - 3.13.1-63.atomic.7- Backport patches for to ensure rpm-ostreed has the install_exec_t labelResolves: rhbz#1340542
* Fri Jun 10 2016 Lukas Vrabec 3.13.1-60.7- Allow glusterd domain read krb5_keytab_t files.Resolves: rhbz#1344630
* Fri May 27 2016 Miroslav Grepl 3.13.1-60.6- Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus.Resolves:#1340365
* Mon May 16 2016 Lukas Vrabec 3.13.1-60.5- Label /var/log/ganesha.log as gluster_log_t- Allow glusterd_t domain to create glusterd_log_t files.- Label /var/run/ganesha.pid as gluster_var_run_t.Resolves: rhbz#1333903
* Mon May 09 2016 Lukas Vrabec 3.13.1-60.4- Label /usr/bin/ganesha.nfsd as glusterd_exec_t to run ganesha as glusterd_t.- Allow glusterd_t stream connect to rpbind_t.- Allow cluster_t to create symlink /var/lib/nfs labeled as var_lib_nfs_t.- Add interface rpc_filetrans_var_lib_nfs_content()- Add new boolean: rpcd_use_fusefs to allow rpcd daemon use fusefs.Resolves: rhbz#1333875Resolves: rhbz#1333903
* Wed Jan 27 2016 Lukas Vrabec 3.13.1-60.3- Allow openvswitch domain capability sys_rawioResolves: rhbz#1299405
* Tue Jan 26 2016 Lukas Vrabec 3.13.1-60.2- Add fs_manage_hugetlbfs_files() interface.Resolves: rhbz#1299405- Allow openvswitch to manage hugetlfs files and dirsResolves: rhbz#1299405
* Mon Jan 25 2016 Lukas Vrabec 3.13.1-60.1- Allow openvswitch read/write hugetlb filesystem.Resolves: rhbz#1299405- Allow smbcontrol domain to send sigchld to ctdbd domain.Resolves: rhbz#1301522
* Wed Oct 14 2015 Miroslav Grepl 3.13.1-60Allow hypervvssd to list all mountpoints to have VSS live backup working correctly.Resolves:#1247880
* Tue Oct 13 2015 Miroslav Grepl 3.13.1-59- Revert Add missing labeling for /usr/libexec/abrt-hook-ccpp patchResolves: #1254188
* Thu Oct 08 2015 Lukas Vrabec 3.13.1-58- Allow search dirs in sysfs types in kernel_read_security_state.Resolves: #1254188- Fix kernel_read_security_state interface that source domain of this interface can search sysctl_fs_t dirs.Resolves: #1254188
* Wed Oct 07 2015 Lukas Vrabec 3.13.1-57- Add missing labeling for /usr/libexec/abrt-hook-ccpp as a part of #1245477 and #1242467 bugsResolves: #1254188- We need allow connect to xserver for all sandbox_x domain because we have one type for all sandbox processes.Resolves:#1261938
* Fri Oct 02 2015 Miroslav Grepl 3.13.1-56- Remove labeling for modules_dep_t file contexts to have labeled them as modules_object_t.- Update files_read_kernel_modules() to contain modutils_read_module_deps_files() calling because module deps labeling could remain and it allows to avoid regressions.Resolves:#1266928
* Tue Sep 29 2015 Lukas Vrabec 3.13.1-55- We need to require sandbox_web_type attribute in sandbox_x_domain_template(). Resolves: #1261938- ipsec: The NM helper needs to read the SAsResolves: #1259786- ipsec: Allow ipsec management to create ptysResolves: #1259786
* Tue Sep 29 2015 Lukas Vrabec 3.13.1-54- Add temporary fixes for sandbox related to #1103622. It allows to run everything under one sandbox type.Resolves:#1261938- Allow abrt_t domain to write to kernel msg device.Resolves: #1257828- Allow rpcbind_t domain to change file owner and groupResolves: #1265266
* Tue Sep 22 2015 Lukas Vrabec 3.13.1-53- Allow smbcontrol to create a socket in /var/samba which uses for a communication with smbd, nmbd and winbind. Resolves: #1256459
* Fri Sep 18 2015 Lukas Vrabec 3.13.1-52- Allow dirsrv-admin script to read passwd file. Allow dirsrv-admin script to read httpd pid files. Label dirsrv-admin unit file and allow dirsrv-admin domains to use it.Resolves: #1230300- Allow qpid daemon to connect on amqp tcp port.Resolves: #1261805
* Fri Sep 18 2015 Miroslav Grepl 3.13.1-51- Label /etc/ipa/nssdb dir as cert_tResolves:#1262718- Do not provide docker policy files which is shipped by docker-selinux.rpmResolves:#1262812
* Thu Sep 17 2015 Lukas Vrabec 3.13.1-50- Add labels for afs binaries: dafileserver, davolserver, salvageserver, dasalvager Resolves: #1192338- Add lsmd_plugin_t sys_admin capability, Allow lsmd_plugin_t getattr from sysfs filesystem. Resolves: #1238079- Allow rhsmcertd_t send signull to unconfined_service_t domains. Resolves: #1176078- Remove file transition from snmp_manage_var_lib_dirs() interface which created snmp_var_lib_t dirs in var_lib_t.- Allow openhpid_t daemon to manage snmp files and dirs. Resolves: #1243902- Allow mdadm_t domain read/write to general ptys and unallocated ttys. Resolves: #1073314- Add interface unconfined_server_signull() to allow domains send signull to unconfined_service_t Resolves: #1176078
* Fri Sep 11 2015 Lukas Vrabec 3.13.1-49- Allow systemd-udevd to access netlink_route_socket to change names for network interfaces without unconfined.pp module. It affects also MLS. Resolves:#1250456
* Thu Sep 10 2015 Lukas Vrabec 3.13.1-48- Fix labeling for fence_scsi_check scriptResolves: #1255020- Allow openhpid to read system state Allow openhpid to connect to tcp http port. Resolves: #1244248- Allow openhpid to read snmp var lib files. Resolves: #1243902- Allow openvswitch_t domains read kernel dependencies due to openvswitch run modprobe- Allow unconfined_t domains to create /var/run/xtables.lock with iptables_var_run_tResolves: #1243403- Remove bin_t label for /usr/share/cluster/fence_scsi_check\\.pl Resolves: #1255020
* Wed Sep 02 2015 Lukas Vrabec 3.13.1-47- Fix regexp in chronyd.fc fileResolves: #1243764- Allow passenger to getattr filesystem xattrResolves: #1196555- Label mdadm.conf.anackbak as mdadm_conf_t file.Resolves: #1088904- Revert \"Allow pegasus_openlmi_storage_t create mdadm.conf.anacbak file in /etc.\"- Allow watchdog execute fenced python script.Resolves: #1255020- Added inferface watchdog_unconfined_exec_read_lnk_files()- Remove labeling for /var/db/.
*\\.db as etc_t to label db files as system_db_t.Resolves: #1230877
* Thu Aug 27 2015 Lukas Vrabec 3.13.1-46- Allow watchdog execute fenced python script. Resolves: #1255020- Added inferface watchdog_unconfined_exec_read_lnk_files()- Label /var/run/chrony-helper dir as chronyd_var_run_t. Resolves: #1243764- Allow dhcpc_t domain transition to chronyd_t Resolves: #1243764
* Fri Aug 21 2015 Lukas Vrabec 3.13.1-45- Fix postfix_spool_maildrop_t,postfix_spool_flush_t contexts in postfix.fc file.Resolves: #1252442
* Wed Aug 19 2015 Lukas Vrabec 3.13.1-44- Allow exec pidof under hypervkvp domain.Resolves: #1254870- Allow hypervkvp daemon create connection to the system DBUSResolves: #1254870
* Wed Aug 19 2015 Lukas Vrabec 3.13.1-43- Allow openhpid_t to read system state.Resolves: #1244248- Added labels for files provided by rh-nginx18 collectionResolves: #1249945- Dontaudit block_suspend capability for ipa_helper_t, this is kernel bug. Allow ipa_helper_t capability net_admin. Allow ipa_helper_t to list /tmp. Allow ipa_helper_t to read rpm db.Resolves: #1252968- Allow rhsmcertd exec rhsmcertd_var_run_t files and rhsmcerd_tmp_t files. This rules are in hide_broken_sympthons until we find better solution.Resolves: #1243431- Allow abrt_dump_oops_t to read proc_security_t files.- Allow abrt_dump_oops to signull all domains Allow abrt_dump_oops to read all domains state Allow abrt_dump_oops to ptrace all domains- Add interface abrt_dump_oops_domtrans()- Add mountpoint dontaudit access check in rhsmcertd policy.Resolves: #1243431- Allow samba_net_t to manage samba_var_t sock files.Resolves: #1252937- Allow chrome setcap to itself.Resolves: #1251996- Allow httpd daemon to manage httpd_var_lib_t lnk_files.Resolves: #1253706- Allow chronyd exec systemctlResolves: #1243764- Add inteface chronyd_signal Allow timemaster_t send generic signals to chronyd_t.Resolves: #1243764- Added interface fs_dontaudit_write_configfs_dirs- Add label for kernel module dep files in /usr/lib/modulesResolves:#916635- Allow kernel_t domtrans to abrt_dump_oops_t- Added to files_dontaudit_write_all_mountpoints intefface new dontaudit rule, that domain included this interface dontaudit capability dac_override.- Allow systemd-networkd to send logs to systemd-journald.Resolves: #1236616
* Wed Aug 12 2015 Lukas Vrabec 3.13.1-42- Fix label on /var/tmp/kiprop_0Resolves:#1220763- Allow lldpad_t to getattr tmpfs_t.Resolves: #1246220- Label /dev/shm/lldpad.
* as lldapd_tmpfs_tResolves: #1246220- Allow audisp client to read system state.
* Tue Aug 11 2015 Lukas Vrabec 3.13.1-41- Allow pcp_domain to manage pcp_var_lib_t lnk_files.Resolves: #1252341- Label /var/run/xtables.
* as iptables_var_run_tResolves: #1243403
* Mon Aug 10 2015 Lukas Vrabec 3.13.1-40- Add interface to read/write watchdog device- Add labels for /dev/memory_bandwith and /dev/vhci. Thanks ssekiddeResolves:#1210237- Allow apcupsd_t to read /sys/devices Resolves:#1189185- Allow logrotate to reload services.Resolves: #1242453- Allow openhpid use libwatchdog plugin. (Allow openhpid_t rw watchdog device)Resolves: #1244260- Allow openhpid liboa_soap plugin to read generic certs.Resolves: #1244248- Allow openhpid liboa_soap plugin to read resolv.conf file.Resolves: #1244248- Label /usr/libexec/chrony-helper as chronyd_exec_t- Allow chronyd_t to read dhcpc state.- Allow chronyd to execute mkdir command.
* Fri Aug 07 2015 Miroslav Grepl 3.13.1-39- Allow mdadm to access /dev/random and add support to create own files/dirs as mdadm_tmpfs_t.Resolves:#1073314- Allow udev, lvm and fsadm to access systemd-cat in /var/tmp/dracut if \'dracut -fv\' is executed in MLS.- Allow admin SELinu users to communicate with kernel_t. It is needed to access /run/systemd/journal/stdout if \'dracut -vf\' is executed. We allow it for other SELinux users.- Allow sysadm to execute systemd-sysctl in the sysadm_t domain. It is needed for ifup command in MLS mode.- Add fstools_filetrans_named_content_fsadm() and call it for named_filetrans_domain domains. We need to be sure that /run/blkid is created with correct labeling.Resolves:#1183503- Add support for /etc/sanlock which is writable by sanlock daemon.Resolves:#1231377- Allow useradd add homedir located in /var/lib/kdcproxy in ipa-server RPM scriplet.Resolves:#1243775 - Allow snapperd to pass data (one way only) via pipe negotiated over dbusResolves:#1250550- Allow lsmd also setuid capability. Some commands need to executed under root privs. Other commands are executed under unprivileged user.
* Wed Aug 05 2015 Lukas Vrabec 3.13.1-38- Allow openhpid to use libsnmp_bc plugin (allow read snmp lib files). Resolves: #1243902- Allow lsm_plugin_t to read sysfs, read hwdata, rw to scsi_generic_device Resolves: #1238079- Allow lsm_plugin_t to rw raw_fixed_disk. Resolves:#1238079- Allow rhsmcertd to send signull to unconfined_service.
* Mon Aug 03 2015 Lukas Vrabec 3.13.1-37- Allow httpd_suexec_t to read and write Apache stream sockets Resolves: #1243569- Allow qpid to create lnk_files in qpid_var_lib_tResolves: #1247279
* Thu Jul 30 2015 Lukas Vrabec 3.13.1-36- Allow drbd to get attributes from filesystems.- Allow redis to read kernel parameters.Resolves: #1209518- Allow virt_qemu_ga_t domtrans to passwd_t- Allow audisp_remote_t to start power unit files domain to allow halt system.Resolves: #1186780- Allow audisp_remote_t to read/write user domain pty.Resolves: #1186780- Label /usr/sbin/chpasswd as passwd_exec_t.- Allow sysadm to administrate ldap environment and allow to bind ldap port to allow to setup an LDAP server (389ds).Resolves:#1221121
* Mon Jul 27 2015 Lukas Vrabec 3.13.1-35- gnome_dontaudit_search_config() needs to be a part of optinal_policy in pegasus.te- Allow pcp_pmcd daemon to read postfix config files.- Allow pcp_pmcd daemon to search postfix spool dirs.Resolves: #1213740- Added Booleans: pcp_read_generic_logs.Resolves: #1213740- Allow drbd to read configuration options used when loading modules.Resolves: #1134883- Allow glusterd to manage nfsd and rpcd services.- Allow glusterd to communicate with cluster domains over stream socket.- glusterd call pcs utility which calls find for cib.
* files and runs pstree under glusterd. Dontaudit access to security files and update gluster boolean to reflect these changes.
* Mon Jul 20 2015 Lukas Vrabec 3.13.1-34- Allow glusterd to manage nfsd and rpcd services.- Allow networkmanager to communicate via dbus with systemd_hostanmed. Resolves: #1234954- Allow stream connect logrotate to prosody.- Add prosody_stream_connect() interface.- httpd should be able to send signal/signull to httpd_suexec_t, instead of httpd_suexec_exec_t.- Allow prosody to create own tmp files/dirs.Resolves:#1212498
* Wed Jul 15 2015 Lukas Vrabec 3.13.1-33- Allow networkmanager read rfcomm port.Resolves:#1212498- Remove non exists label.- Fix
*_admin intefaces where body is not consistent with header.- Label /usr/afs/ as afs_files_t, Allow afs_bosserver_t create afs_config_t and afs_dbdir_t dirs under afs_files_t, Allow afs_bosserver_t read kerberos config- Remove non exits nfsd_ro_t label.- Make all interfaces related to openshift_cache_t as deprecated.- Add rpm_var_run_t label to rpm_admin header- Add jabberd_lock_t label to jabberd_admin header.- Add samba_unconfined_script_exec_t to samba_admin header.- inn daemon should create innd_log_t objects in var_log_t instead of innd_var_run_t- Fix ctdb policy- Add samba_signull_winbind()- Add samba_signull_unconfined_net()- Allow ctdbd_t send signull to samba_unconfined_net_t.- Allow openshift_initrc_t to communicate with firewalld over dbus Resolves:#1221326
* Tue Jul 14 2015 Lukas Vrabec 3.13.1-32- Allow gluster to connect to all ports. It is required by random services executed by gluster.- Add interfaces winbind_signull(), samba_unconfined_net_signull().- Dontaudit smbd_t block_suspend capability. This is kernel bug.- Allow ctdbd sending signull to process winbind, samba_unconfined_net, to checking if processes exists.- Add tmpreaper booleans to use nfs_t and samba_share_t.- Fix path from /usr/sbin/redis-server to /usr/bin/redis-server- Allow connect ypserv to portmap_port_t- Fix paths in inn policy, Allow innd read innd_log_t dirs, Allow innd execute innd_etc_t files- Add support for openstack-nova-
* packages- Allow NetworkManager_t send signull to dnssec_trigger_t.- Allow glusterd to execute showmount in the showmount domain.- Label swift-container-reconciler binary as swift_t.- Allow dnssec_trigger_t relabelfrom dnssec_trigger_var_run_t files.- Add cobbler_var_lib_t to \"/var/lib/tftpboot/boot(/.
*)?\"Resolves:#1213540- Merge all nova_
* labels under one nova_t.
* Wed Jul 08 2015 Miroslav Grepl 3.13.1-31- Add logging_syslogd_run_nagios_plugins boolean for rsyslog to allow transition to nagios unconfined pluginsResolves:#1233550- Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/- Add support for oddjob based helper in FreeIPA.- Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob.- Add nagios_domtrans_unconfined_plugins() interface.- Update mta_filetrans_named_content() interface to cover more db files. Resolves:#1167468- Add back ftpd_use_passive_mode boolean with fixed description.- Allow pmcd daemon stream connect to mysqld.- Allow pcp domains to connect to own process using unix_stream_socket. Resolves:#1213709- Allow abrt-upload-watch service to dbus chat with ABRT daemon and fsetid capability to allow run reporter-upload correctly.- Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob.- Add support for oddjob based helper in FreeIPA.- Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/
* Thu Jul 02 2015 Miroslav Grepl 3.13.1-30- Allow iptables to read ctdbd lib files.Resolves:#1224879- Add systemd_networkd_t to nsswitch domains.- Allow drbd_t write to fixed_disk_device. Reason: drbdmeta needs write to fixed_disk_device during initialization. Resolves:#1130675- Allow NetworkManager write to sysfs. - Fix cron_system_cronjob_use_shares boolean to call fs interfaces which contain only entrypoint permission.- Add cron_system_cronjob_use_shares boolean to allow system cronjob to be executed from shares - NFS, CIFS, FUSE. It requires \"entrypoint\" permissios on nfs_t, cifs_t and fusefs_t SELinux types.- Allow NetworkManager write to sysfs. - Allow ctdb_t sending signull to smbd_t, for checking if smbd process exists. - Dontaudit apache to manage snmpd_var_lib_t files/dirs. - Add interface snmp_dontaudit_manage_snmp_var_lib_files().- Dontaudit mozilla_plugin_t cap. sys_ptrace. - Rename xodbc-connect port to xodbc_connect- Allow ovsdb-server to connect on xodbc-connect and ovsdb tcp ports. - Allow iscsid write to fifo file kdumpctl_tmp_t. Appears when kdump generates the initramfs during the kernel boot. - Dontaudit chrome to read passwd file. - nrpe needs kill capability to make gluster moniterd nodes working. Resolves:#1235587
* Wed Jun 17 2015 Miroslav Grepl 3.13.1-29- We allow can_exec() on ssh_keygen on gluster. But there is a transition defined by init_initrc_domain() because we need to allow execute unconfined services by glusterd. So ssh-keygen ends up with ssh_keygen_t and we need to allow to manage /var/lib/glusterd/geo-replication/secret.pem.- Allow sshd to execute gnome-keyring if there is configured pam_gnome_keyring.so.- Allow gnome-keyring executed by passwd to access /run/user/UID/keyring to change a password. - Label gluster python hooks also as bin_t.- Allow glusterd to interact with gluster tools running in a user domain- Add glusterd_manage_lib_files() interface.- ntop reads /var/lib/ntop/macPrefix.db and it needs dac_override. It has setuid/setgid. - Allow samba_t net_admin capability to make CIFS mount working.- S30samba-start gluster hooks wants to search audit logs. Dontaudit it.Resolves:#1224879
* Mon Jun 15 2015 Miroslav Grepl 3.13.1-28- Allow glusterd to send generic signals to systemd_passwd_agent processes.- Allow glusterd to access init scripts/units without defined policy- Allow glusterd to run init scripts.- Allow glusterd to execute /usr/sbin/xfs_dbin glusterd_t domain.Resolves:#1224879
* Fri Jun 12 2015 Miroslav Grepl 3.13.1-27- Calling cron_system_entry() in pcp_domain_template needs to be a part of optional_policy block.- Allow samba-net to access /var/lib/ctdbd dirs/files.- Allow glusterd to send a signal to smbd.- Make ctdbd as home manager to access also FUSE.- Allow glusterd to use geo-replication gluster tool.- Allow glusterd to execute ssh-keygen.- Allow glusterd to interact with cluster services.- Allow glusterd to connect to the system DBUS for service (acquire_svc).- Label /dev/log correctly.Resolves:#1230932
* Tue Jun 09 2015 Miroslav Grepl 3.13.1-26- Back port the latest F22 changes to RHEL7. It should fix most of RHEL7.2 bugs- Add cgdcbxd policy Resolves:#1072493- Fix ftp_homedir booleanResolve:#1097775- Dontaudit ifconfig writing inhertited /var/log/pluto.log.- Allow cluster domain to dbus chat with systemd-logind.Resolves:#1145215- Dontaudit write access to inherited kdumpctl tmp filesResolves:#1156442- Allow isnsd_t to communicate with sssdResolves:#1167702- Allow rwho_t to communicate with sssdResolves:#1167718- Allow sblim_gatherd_t to communicate with sssdResolves:#1167732- Allow pkcs_slotd_t to communicate with sssdResolves:#1167737- Allow openvswitch_t to communicate with sssdResolves:#1167816- Allow mysqld_safe_t to communicate with sssdResolves:#1167832- Allow sshd_keygen_t to communicate with sssdResolves:#1167840- Add support for iprdbg logging files in /var/log.Resolves:#1174363- Allow tmpreaper_t to manage ntp log contentResolves:#1176965- Allow gssd_t to manage ssh keyringResolves:#1184791- Allow httpd_sys_script_t to send system log messagesResolves:#1185231- Allow apcupsd_t to read /sys/devicesResolves:#1189185- Allow dovecot_t sys_resource capabilityResolves:#1191143- Add support for mongod/mongos systemd unit files.Resolves:#1197038- Add bacula fixes- Added label mysqld_etc_t for /etc/my.cnf.d/ dir.Resolves:#1203991
* Thu May 14 2015 Miroslav Grepl 3.13.1-25- Label /usr/libexec/postgresql-ctl as postgresql_exec_t. - Add more restriction on entrypoint for unconfined domains.- Only allow semanage_t to be able to setenforce 0, no all domains that use selinux_semanage interface- Allow all domains to read /dev/urandom. It is needed by all apps/services linked to libgcrypt. There is no harm to allow it by default.- Update policy/mls for sockets related to access perm. Rules were contradictory.- Add nagios_run_pnp4nagios and nagios_run_sudo booleans to allow run sudo from NRPE utils scripts and allow run nagios in conjunction with PNP4Nagios.Resolves:#1201054- Don\'t use deprecated userdom_manage_tmpfs_role() interface calliing and use userdom_manage_tmp_role() instead.- Update virt_read_pid_files() interface to allow read also symlinks with virt_var_run_t type- Label /var/lib/tftpboot/aarch64(/.
*)? and /var/lib/tftpboot/images2(/.
*)?- Add support for iprdbg logging files in /var/log.- Add fixes to rhsmcertd_t- Allow puppetagent_t to transfer firewalld messages over dbus- Add support for /usr/libexec/mongodb-scl-helper RHSCL helper script.- Added label mysqld_etc_t for /etc/my.cnf.d/ dir.- Add support for mongod/mongos systemd unit files.- cloudinit and rhsmcertd need to communicate with dbus- Allow dovecot_t sys_resource capability
* Tue Mar 31 2015 Miroslav Grepl 3.13.1-24- ALlow mongod execmem by default.- Update policy/mls for sockets. Rules were contradictory.Resolves:#1207133- Allow a user to login with different security level via ssh.
* Fri Jan 30 2015 Miroslav Grepl 3.13.1-23- Update seutil_manage_config() interface.Resolves:#1185962- Allow pki-tomcat relabel pki_tomcat_etc_rw_t.- Turn on docker_transition_unconfined by default
* Wed Jan 28 2015 Miroslav Grepl 3.13.1-22- Allow virtd to list all mountpoints.Resolves:#1180713
* Wed Jan 28 2015 Miroslav Grepl 3.13.1-21- pkcsslotd_lock_t should be an alias for pkcs_slotd_lock_t.- Allow fowner capability for sssd because of selinux_child handling.- ALlow bind to read/write inherited ipsec pipes- Allow hypervkvp to read /dev/urandom and read addition states/config files.- Allow gluster rpm scripletto create glusterd socket with correct labeling. This is a workaround until we get fix in glusterd.- Add glusterd_filetrans_named_pid() interface- Allow radiusd to connect to radsec ports.- Allow setuid/setgid for selinux_child- Allow lsmd plugin to connect to tcp/5988 by default.- Allow lsmd plugin to connect to tcp/5989 by default.- Update ipsec_manage_pid() interface.Resolves:#1184978
* Fri Jan 23 2015 Miroslav Grepl 3.13.1-20- Update ipsec_manage_pid() interface.Resolves:#1184978
* Wed Jan 21 2015 Miroslav Grepl 3.13.1-19- Allow ntlm_auth running in winbind_helper_t to access /dev/urandom.
* Wed Jan 21 2015 Miroslav Grepl 3.13.1-18- Add auditing support for ipsec.Resolves:#1182524- Label /ostree/deploy/rhel-atomic-host/deploy directory as system_conf_t- Allow netutils chown capability to make tcpdump working with -w
* Tue Jan 20 2015 Miroslav Grepl 3.13.1-17- Allow ipsec to execute _updown.netkey script to run unbound-control.- Allow neutron to read rpm DB.- Add additional fixes for hyperkvp
* creates new ifcfg-{name} file
* Runs hv_set_ifconfig.sh, which does the following
* Copies ifcfg-{name} to /etc/sysconfig/network-scripts- Allow svirt to read symbolic links in /sys/fs/cgroups labeled as tmpfs_t- Add labeling for pacemaker.log.- Allow radius to connect/bind radsec ports.- Allow pm-suspend running as virt_qemu_ga to read /var/log/pm-suspend.log- Allow virt_qemu_ga to dbus chat with rpm.- Update virt_read_content() interface to allow read also char devices.- Allow glance-registry to connect to keystone port.Resolves:#1181818
* Mon Jan 12 2015 Miroslav Grepl 3.13.1-16- Allow sssd to send dbus all user domains.Resolves:#1172291- Allow lsm plugin to read certificates.- Fix labeling for keystone CGI scripts.- Make snapperd back as unconfined domain.
* Fri Jan 09 2015 Miroslav Grepl 3.13.1-15- Fix bugs in interfaces discovered by sepolicy.- Allow slapd to read /usr/share/cracklib/pw_dict.hwm.- Allow lsm plugins to connect to tcp/18700 by default.- Allow brltty mknod capability to allow create /var/run/brltty/vcsa.- Fix pcp_domain_template() interface.- Fix conman.te.- Allow mon_fsstatd to read /proc/sys/fs/binfmt_misc- Allow glance-scrubber to connect tcp/9191.- Add missing setuid capability for sblim-sfcbd.- Allow pegasus ioctl() on providers.- Add conman_can_network.- Allow chronyd to read chrony conf files located in /run/timemaster/.- Allow radius to bind on tcp/1813 port.- dontaudit block suspend access for openvpn_t - Allow conman to create files/dirs in /tmp.- Update xserver_rw_xdm_keys() interface to have \'setattr\'.Resolves:#1172291 - Allow sulogin to read /dev/urandom and /dev/random.- Update radius port definition to have also tcp/18121- Label prandom as random_device_t.- Allow charon to manage files in /etc/strongimcv labeled as ipsec_conf_t.
* Fri Dec 12 2014 Miroslav Grepl 3.13.1-14- Allow virt_qemu_ga_t to execute kmod.- Add missing files_dontaudit_list_security_dirs() for smbd_t in samba_export_all_ro boolean.- Add additionnal MLS attribute for oddjob_mkhomedir to create homedirs.Resolves:#1113725- Enable OpenStack cinder policy- Add support for /usr/share/vdsm/daemonAdapter- Add support for /var/run/gluster
* Tue Dec 02 2014 Miroslav Grepl 3.13.1-13- Remove old pkcsslotd.pp from minimum package- Allow rlogind to use also rlogin ports.- Add support for /usr/libexec/ntpdate-wrapper. Label it as ntpdate_exec_t.- Allow bacula to connect also to postgresql.- Label /usr/libexec/tomcat/server as tomcat_exec_t- Add support for /usr/sbin/ctdbd_wrapper- Add support for /usr/libexec/ppc64-diag/rtas_errd- Allow rpm_script_roles to access system_mail_t- Allow brltty to create /var/run/brltty- Allow lsmd plugin to access netlink_route_socket- Allow smbcontrol to read passwd- Add support for /usr/libexec/sssd/selinux_child and create sssd_selinux_manager_t domain for itResolves:#1140106- Allow osad to execute rhn_check- Allow load_policy to rw inherited sssd pipes because of selinux_child- Allow admin SELinux users mounting / as private within a new mount namespace as root in MLS- Add additional fixes for su_restricted_domain_template to make moving to sysadm_r and trying to su working correctly- Add additional booleans substitions
* Tue Nov 25 2014 Miroslav Grepl 3.13.1-12- Add seutil_dontaudit_access_check_semanage_module_store() interfaceResolves:#1140106- Update to have all _systemctl() interface also init_reload_services().- Dontaudit access check on SELinux module store for sssd.- Add labeling for /sbin/iw.- Allow named_filetrans_domain to create ibus directory with correct labeling.
* Mon Nov 24 2014 Miroslav Grepl 3.13.1-11- Allow radius to bind tcp/1812 radius port.- Dontaudit list user_tmp files for system_mail_t.- Label virt-who as virtd_exec_t.- Allow rhsmcertd to send a null signal to virt-who running as virtd_t.- Add missing alias for _content_rw_t.Resolves:#1089177- Allow spamd to access razor-agent.log.- Add fixes for sfcb from libvirt-cim TestOnly bug.- Allow NetworkManager stream connect on openvpn.- Make /usr/bin/vncserver running as unconfined_service_t.- getty_t should be ranged in MLS. Then also local_login_t runs as ranged domain.- Label /etc/docker/certs.d as cert_t.
* Tue Nov 18 2014 Miroslav Grepl 3.13.1-10- Label /etc/strongimcv as ipsec_conf_file_t.- Add support for /usr/bin/start-puppet-ca helper scriptResolves:#1160727- Allow rpm scripts to enable/disable transient systemd units.Resolves:#1154613 - Make kpropdas nsswitch domainResolves:#1153561- Make all glance domain as nsswitch domainsResolves:#1113281- Allow selinux_child running as sssd access check on /etc/selinux/targeted/modules/active- Allow access checks on setfiles/load_policy/semanage_lock for selinux_child running as sssd_tResolves:#1140106
* Mon Nov 10 2014 Miroslav Grepl 3.13.1-9- Dontaudit access check on setfiles/load_policy for sssd_t.Resolves:#1140106- Add kdump_rw_inherited_kdumpctl_tmp_pipes()Resolves:#1156442- Make linuxptp services as unconfined.- Added new policy linuxptp.Resolves:#1149693- Label keystone cgi files as keystone_cgi_script_exec_t.Resolves:#1138424- Make tuned as unconfined domain
* Thu Nov 06 2014 Miroslav Grepl 3.13.1-8- Allow guest to connect to libvirt using unix_stream_socket.- Allow all bus client domains to dbus chat with unconfined_service_t.- Allow inetd service without own policy to run in inetd_child_t which is unconfined domain.- Make opensm as nsswitch domain to make it working with sssd.- Allow brctl to read meminfo.- Allow winbind-helper to execute ntlm_auth in the caller domain.Resolves:#1160339- Make plymouthd as nsswitch domain to make it working with sssd.Resolves:#1160196- Make drbd as nsswitch domain to make it working with sssd.- Make conman as nsswitch domain to make ipmitool.exp runing as conman_t working.- Add support for /var/lib/sntp directory.- Add fixes to allow docker to create more content in tmpfs ,and donaudit reading /proc- Allow winbind to read usermodehelper- Allow telepathy domains to execute shells and bin_t- Allow gpgdomains to create netlink_kobject_uevent_sockets- Allow mongodb to bind to the mongo port and mongos to run as mongod_t- Allow abrt to read software raid state.- Allow nslcd to execute netstat.- Allow dovecot to create user\'s home directory when they log into IMAP.- Allow login domains to create kernel keyring with different level.
* Mon Nov 03 2014 Miroslav Grepl 3.13.1-7- Allow modemmanger to connectto itselfResolves:#1120152 - Allow pki_tomcat to create link files in /var/lib/pki-ca.Resolves:#1121744 - varnishd needs to have fsetid capabilityResolves:#1125165- Allow snapperd to dbus chat with system cron jobs.Resolves:#1152447- Allow dovecot to create user\'s home directory when they log into IMAP Resolves:#1152773 - Add labeling for /usr/sbin/haproxy-systemd-wrapper wrapper to make haproxy running haproxy_t.- ALlow listen and accept on tcp socket for init_t in MLS. Previously it was for xinetd_t. - Allow nslcd to execute netstat.- Add suppor for keepalived unconfined scripts and allow keepalived to read all domain state and kill capability.- Allow nslcd to read /dev/urandom.
* Thu Oct 16 2014 Miroslav Grepl 3.13.1-6- Add back kill permisiion for system classResolves:#1150011
* Wed Oct 15 2014 Miroslav Grepl 3.13.1-5- Add back kill permisiion for service classResolves:#1150011- Make rhsmcertd_t also as dbus domain.- Allow named to create DNS_25 with correct labeling.- Add cloudform_dontaudit_write_cloud_log()- Call auth_use_nsswitch to apache to read/write cloud-init keys.- Allow cloud-init to dbus chat with certmonger.- Fix path to mon_statd_initrc_t script.- Allow all RHCS services to read system state.- Allow dnssec_trigger_t to execute unbound-control in own domain.- kernel_read_system_state needs to be called with type. Moved it to antivirus.if.- Added policy for mon_statd and mon_procd services. BZ (1077821)- Allow opensm_t to read/write /dev/infiniband/umad1.- Allow mongodb to manage own log files.- Allow neutron connections to system dbus.- Add support for /var/lib/swiftdirectory.- Allow nova-scheduler to read certs.- Allow openvpn to access /sys/fs/cgroup dir.- Allow openvpn to execute systemd-passwd-agent in systemd_passwd_agent_t to make openvpn working with systemd.- Fix samba_export_all_ro/samba_export_all_rw booleans to dontaudit search/read security files.- Add auth_use_nsswitch for portreserve to make it working with sssd.- automount policy is non-base module so it needs to be called in optional block.- ALlow sensord to getattr on sysfs.- Label /usr/share/corosync/corosync as cluster_exec_t.- Allow lmsd_plugin to read passwd file. BZ(1093733)- Allow read antivirus domain all kernel sysctls.- Allow mandb to getattr on file systems- Allow nova-console to connect to mem_cache port.- Make sosreport as unconfined domain.- Allow mondogdb to \'accept\' accesses on the tcp_socket port.- ALlow sanlock to send a signal to virtd_t.
* Thu Oct 09 2014 Miroslav Grepl 3.13.1-4- Build also MLS policyResolves:#1138424
* Thu Oct 09 2014 Miroslav Grepl 3.13.1-3- Add back kill permisiion for system class- Allow iptables read fail2ban logs.- Fix radius labeled ports- Add userdom_manage_user_tmpfs_files interface- Allow libreswan to connect to VPN via NM-libreswan.- Label 4101 tcp port as brlp port- fix dev_getattr_generic_usb_dev interface- Allow all domains to read fonts- Make sure /run/systemd/generator and system is labeled correctly on creation.- Dontaudit aicuu to search home config dir. - Make keystone_cgi_script_t domain. Resolves:#1138424- Fix bug in drbd policy, - Added support for cpuplug. - ALlow sanlock_t to read sysfs_t.- Added sendmail_domtrans_unconfined interface- Fix broken interfaces- radiusd wants to write own log files.- Label /usr/libexec/rhsmd as rhsmcertd_exec_t- Allow rhsmcertd send signull to setroubleshoot. - Allow rhsmcertd manage rpm db. - Added policy for blrtty. - Fix keepalived policy- Allow rhev-agentd dbus chat with systemd-logind.- Allow keepalived manage snmp var lib sock files.- Add support for /var/lib/graphite-web- Allow NetworkManager to create Bluetooth SDP sockets- It\'s going to do the the discovery for DUN service for modems with Bluez 5.- Allow swift to connect to all ephemeral ports by default.- Allow sssd to read selinux config to add SELinux user mapping.- Allow lsmd to search own plguins.- Allow abrt to read /dev/memto generate an unique machine_id and uses sosuploader\'s algorithm based off dmidecode[1] fields.- ALlow zebra for user/group look-ups.- Allow nova domains to getattr on all filesystems.- Allow collectd sys_ptrace and dac_override caps because of reading of /proc/%i/io for several processes.- Allow pppd to connect to /run/sstpc/sstpc-nm-sstp-service-28025 over unix stream socket.- Allow rhnsd_t to manage also rhnsd config symlinks.- ALlow user mail domains to create dead.letter.- Allow rabbitmq_t read rabbitmq_var_lib_t lnk files. - Allow pki-tomcat to change SELinux object identity.- Allow radious to connect to apache ports to do OCSP check- Allow git cgi scripts to create content in /tmp- Allow cockpit-session to do GSSAPI logins.- Allow sensord read in /proc - Additional access required by usbmuxd
* Thu Sep 18 2014 Miroslav Grepl 3.13.1-2- Allow locate to look at files/directories without labels, and chr_file and blk_file on non dev file systems- Label /usr/lib/erlang/erts.
*/bin files as bin_t- Add files_dontaudit_access_check_home_dir() inteface.- Allow udev_t mounton udev_var_run_t dirs #(1128618)- Add systemd_networkd_var_run_t labeling for /var/run/systemd/netif and allow systemd-networkd to manage it.- Add init_dontaudit_read_state() interface.- Add label for ~/.local/share/fonts- Allow unconfined_r to access unconfined_service_t.- Allow init to read all config files- Add new interface to allow creation of file with lib_t type- Assign rabbitmq port.- Allow unconfined_service_t to dbus chat with all dbus domains- Add new interfaces to access users keys.- Allow domains to are allowed to mounton proc to mount on files as well as dirs- Fix labeling for HOME_DIR/tmp and HOME_DIR/.tmp directories.- Add a port definition for shellinaboxd- Label ~/tmp and ~/.tmp directories in user tmp dirs as user_tmp_t- Allow userdomains to stream connect to pcscd for smart cards- Allow programs to use pam to search through user_tmp_t dires (/tmp/.X11-unix)- Update to rawhide-contrib changesResolves:#1123844
* Thu Aug 21 2014 Miroslav Grepl 3.13.1-1- Rebase to 3.13.1 which we have in Fedora21Resolves:#1128284
* Fri Jun 13 2014 Miroslav Grepl 3.12.1-156- Back port fixes from Fedora. Mainly OpenStack and Docker fixes
* Wed Jun 11 2014 Miroslav Grepl 3.12.1-155- Add policy-rhel-7.1-{base,contrib} patches
* Mon May 05 2014 Miroslav Grepl 3.12.1-154- Add support for us_cli ports- Fix labeling for /var/run/user//gvfs- add support for tcp/9697- Additional rules required by openstack, needs backport to F20 and RHEL7- Additional access required by docker- ALlow motion to use tcp/8082 port- Allow init_t to setattr/relabelfrom dhcp state files- Dontaudit antivirus domains read access on all security files by default- Add missing alias for old amavis_etc_t type- Allow block_suspend cap for haproxy- Additional fixes for instack overcloud- Allow OpenStack to read mysqld_db links and connect to MySQL- Remove dup filename rules in gnome.te- Allow sys_chroot cap for httpd_t and setattr on httpd_log_t- Allow iscsid to handle own unit files- Add iscsi_systemctl()- Allow mongod to create also sock_files in /run with correct labeling- Allow httpd to send signull to apache script domains and don\'t audit leaks- Allow rabbitmq_beam to connect to httpd port- Allow aiccu stream connect to pcscd- Allow dmesg to read hwdata and memory dev- Allow all freeipmi domains to read/write ipmi devices- Allow sblim_sfcbd to use also pegasus-https port- Allow rabbitmq_epmd to manage rabbit_var_log_t files- Allow chronyd to read /sys/class/hwmon/hwmon1/device/temp2_input- Allow docker to status any unit file and allow it to start generic unit files
* Mon Apr 07 2014 Miroslav Grepl 3.12.1-153- Change hsperfdata_root to have as user_tmp_tResolves:#1076523
* Fri Apr 04 2014 Miroslav Grepl 3.12.1-152- Fix Multiple same specifications for /var/named/chroot/dev/zero- Add labels for /var/named/chroot_sdb/dev devices- Add support for strongimcv- Use kerberos_keytab_domains in auth_use_nsswitch- Update auth_use_nsswitch to make all these types as kerberos_keytab_domain to- Allow net_raw cap for neutron_t and send sigkill to dnsmasq- Fix ntp_filetrans_named_content for sntp-kod file- Add httpd_dbus_sssd boolean- Dontaudit exec insmod in boinc policy- Rename kerberos_keytab_domain to kerberos_keytab_domains- Add kerberos_keytab_domain()- Fix kerberos_keytab_template()- Make all domains which use kerberos as kerberos_keytab_domainResolves:#1083670- Allow kill capability to winbind_t
* Wed Apr 02 2014 Miroslav Grepl 3.12.1-151- varnishd wants chown capability- update ntp_filetrans_named_content() interface- Add additional fixes for neutron_t. #1083335- Dontaudit getattr on proc_kcore_t- Allow pki_tomcat_t to read ipa lib files- Allow named_filetrans_domain to create /var/cache/ibus with correct labelign- Allow init_t run /sbin/augenrules- Add dev_unmount_sysfs_fs and sysnet_manage_ifconfig_run interfaces- Allow unpriv SELinux user to use sandbox- Add default label for /tmp/hsperfdata_root
* Tue Apr 01 2014 Miroslav Grepl 3.12.1-149- Add file subs also for /var/home
* Mon Mar 31 2014 Miroslav Grepl 3.12.1-149- Allow xauth_t to read user_home_dir_t lnk_file- Add labeling for lightdm-data- Allow certmonger to manage ipa lib files- Add support for /var/lib/ipa- Allow pegasus to getattr virt_content- Added some new rules to pcp policy- Allow chrome_sandbox to execute config_home_t- Add support for ABRT FAF
* Fri Mar 28 2014 Miroslav Grepl 3.12.1-148- Allow kdm to send signull to remote_login_t process- Add gear policy- Turn on gear_port_t- Allow cgit to read gitosis lib files by default- Allow vdagent to read xdm state- Allow NM and fcoeadm to talk together over unix_dgram_socket
* Thu Mar 27 2014 Miroslav Grepl 3.12.1-147- Back port fixes for pegasus_openlmi_admin_t from rawhideResolves:#1080973- Add labels for ostree- Add SELinux awareness for NM- Label /usr/sbin/pwhistory_helper as updpwd_exec_t
* Wed Mar 26 2014 Miroslav Grepl 3.12.1-146- add gnome_append_home_config()- Allow thumb to append GNOME config home files- Allow rasdaemon to rw /dev/cpu//msr- fix /var/log/pki file spec- make bacula_t as auth_nsswitch domain- Identify pki_tomcat_cert_t as a cert_type- Define speech-dispater_exec_t as an application executable- Add a new file context for /var/named/chroot/run directory- update storage_filetrans_all_named_dev for sg
* devices- Allow auditctl_t to getattr on all removeable devices- Allow nsswitch_domains to stream connect to nmbd- Allow unprivusers to connect to memcached- label /var/lib/dirsrv/scripts-INSTANCE as bin_t
* Mon Mar 24 2014 Miroslav Grepl 3.12.1-145- Allow also unpriv user to run vmtools- Allow secadm to read /dev/urandom and meminfoResolves:#1079250- Add booleans to allow docker processes to use nfs and samba- Add mdadm_tmpfs support- Dontaudit net_amdin for /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.51-2.4.5.1.el7.x86_64/jre-abrt/bin/java running as pki_tomcat_t- Allow vmware-user-sui to use user ttys- Allow talk 2 users logged via console too- Allow ftp services to manage xferlog_t- Make all pcp domanis as unconfined for RHEL7.0 beucause of new policies- allow anaconda to dbus chat with systemd-localed
* Fri Mar 21 2014 Miroslav Grepl 3.12.1-144- allow anaconda to dbus chat with systemd-localed- Add fixes for haproxy based on bperkinsAATTredhat.com- Allow cmirrord to make dmsetup working- Allow NM to execute arping- Allow users to send messages through talk- Add userdom_tmp_role for secadm_t
* Thu Mar 20 2014 Lukas Vrabec 3.12.1-143- Add additional fixes for rtas_errd- Fix transitions for tmp/tmpfs in rtas.te- Allow rtas_errd to readl all sysctls
* Wed Mar 19 2014 Miroslav Grepl 3.12.1-142- Add support for /var/spool/rhsm/debug- Make virt_sandbox_use_audit as True by default- Allow svirt_sandbox_domains to ptrace themselves
* Wed Mar 19 2014 Miroslav Grepl 3.12.1-141- Allow docker containers to manage /var/lib/docker content
* Mon Mar 17 2014 Miroslav Grepl 3.12.1-140- Allow docker to read tmpfs_t symlinks- Allow sandbox svirt_lxc_net_t to talk to syslog and to sssd over stream sockets
* Mon Mar 17 2014 Miroslav Grepl 3.12.1-139- Allow collectd to talk to libvirt- Allow chrome_sandbox to use leaked unix_stream_sockets- Dontaudit leaks of sockets into chrome_sandbox_t- If you create a cups directory in /var/cache then it should be labeled cups_rw_etc_t- Run vmtools as unconfined domains- Allow snort to manage its log files- Allow systemd_cronjob_t to be entered via bin_t- Allow procman to list doveconf_etc_t- allow keyring daemon to create content in tmpfs directories- Add proper labelling for icedtea-web- vpnc is creating content in networkmanager var run directory- Label sddm as xdm_exec_t to make KDE working again- Allow postgresql to read network state- Allow java running as pki_tomcat to read network sysctls- Fix cgroup.te to allow cgred to read cgconfig_etc_t- Allow beam.smp to use ephemeral ports- Allow winbind to use the nis to authenticate passwords
* Fri Mar 14 2014 Lukas Vrabec 3.12.1-138- Make rtas_errd_t as unconfined domain for F20.It needs additional fixes. It runs rpm at least.- Allow net_admin cap for fence_virtd running as fenced_t- Make abrt-java-connector working- Make cimtest script 03_defineVS.py of ComputerSystem group working- Fix git_system_enable_homedirs boolean- Allow munin mail plugins to read network systcl
* Thu Mar 13 2014 Miroslav Grepl 3.12.1-137- Allow vmtools_helper_t to execute bin_t- Add support for /usr/share/joomla- /var/lib/containers should be labeled as openshift content for now- Allow docker domains to talk to the login programs, to allow a process to login into the container- Allow install_t do dbus chat with NM- Fix interface names in anaconda.if- Add install_t for anaconda. A new type is a part of anaconda policy- sshd to read network sysctls
* Wed Mar 12 2014 Miroslav Grepl 3.12.1-136- Allow zabbix to send system log msgs- Allow init_t to stream connect to ipsecResolves:#1060775
* Tue Mar 11 2014 Miroslav Grepl 3.12.1-135- Add docker_connect_any boolean
* Tue Mar 11 2014 Miroslav Grepl 3.12.1-134- Allow unpriv SELinux users to dbus chat with firewalld- Add lvm_write_metadata()- Label /etc/yum.reposd dir as system_conf_t. Should be safe because system_conf_t is base_ro_file_type- Allow pegasus_openlmi_storage_t to write lvm metadata- Add hide_broken_symptoms for kdumpgui because of systemd bug- Make kdumpgui_t as unconfined domainResolves:#1044299- Allow docker to connect to tcp/5000
* Mon Mar 10 2014 Miroslav Grepl 3.12.1-133- Allow numad to write scan_sleep_millisecs- Turn on entropyd_use_audio boolean by default- Allow cgred to read /etc/cgconfig.conf because it contains templates used together with rules from /etc/cgrules.conf.- Allow lscpu running as rhsmcertd_t to read /proc/sysinfo- Fix label on irclogs in the homedir- Allow kerberos_keytab_domain domains to manage keys until we get sssd fix- Allow postgresql to use ldap- Add missing syslog-conn port- Add support for /dev/vmcp and /dev/sclpResolves:#1069310
* Fri Mar 07 2014 Miroslav Grepl 3.12.1-132- Modify xdm_write_home to allow create files/links in /root with xdm_home_- Allow virt domains to read network stateResolves:#1072019
* Thu Mar 06 2014 Miroslav Grepl 3.12.1-131- Added pcp rules- dontaudit openshift_cron_t searching random directories, should be back ported to RHEL6- clean up ctdb.te- Allow ctdbd to connect own ports- Fix samba_export_all_rw booleanto cover also non security dirs- Allow swift to exec rpm in swift_t and allow to create tmp files/dirs- Allow neutron to create /run/netns with correct labeling- Allow certmonger to list home dirs
* Wed Mar 05 2014 Miroslav Grepl 3.12.1-130- Change userdom_use_user_inherited_ttys to userdom_use_user_ttys for systemd-tty-ask- Add sysnet_filetrans_named_content_ifconfig() interface- Allow ctdbd to connect own ports- Fix samba_export_all_rw booleanto cover also non security dirs- Allow swift to exec rpm in swift_t and allow to create tmp files/dirs- Allow neutron to create /run/netns with correct labeling- Allow kerberos keytab domains to manage sssd/userdomain keys\"- Allow to run ip cmd in neutron_t domain
* Mon Mar 03 2014 Miroslav Grepl 3.12.1-129- Allow block_suspend cap2 for systemd-logind and rw dri device- Add labeling for /usr/libexec/nm-libreswan-service- Allow locallogin to rw xdm key to make Virtual Terminal login providing smartcard pin working- Add xserver_rw_xdm_keys()- Allow rpm_script_t to dbus chat also with systemd-located- Fix ipa_stream_connect_otpd()- update lpd_manage_spool() interface- Allow krb5kdc to stream connect to ipa-otpd- Add ipa_stream_connect_otpd() interface- Allow vpnc to unlink NM pids- Add networkmanager_delete_pid_files()- Allow munin plugins to access unconfined plugins- update abrt_filetrans_named_content to cover /var/spool/debug- Label /var/spool/debug as abrt_var_cache_t- Allow rhsmcertd to connect to squid port- Make docker_transition_unconfined as optional boolean- Allow certmonger to list home dirs
* Wed Feb 26 2014 Miroslav Grepl 3.12.1-128- Make snapperd as unconfined domain and add additional fixes for it- Remove nsplugin.pp module on upgrade
* Tue Feb 25 2014 Miroslav Grepl 3.12.1-127- Add snapperd_home_t for HOME_DIR/.snapshots directory- Make sosreport as unconfined domain- Allow sosreport to execute grub2-probe- Allow NM to manage hostname config file- Allow systemd_timedated_t to dbus chat with rpm_script_t- Allow lsmd plugins to connect to http/ssh/http_cache ports by default- Add lsmd_plugin_connect_any boolean- Allow mozilla_plugin to attempt to set capabilities- Allow lsdm_plugins to use tcp_socket- Dontaudit mozilla plugin from getattr on /proc or /sys- Dontaudit use of the keyring by the services in a sandbox- Dontaudit attempts to sys_ptrace caused by running ps for mysqld_safe_t- Allow rabbitmq_beam to connect to jabber_interserver_port- Allow logwatch_mail_t to transition to qmail_inject and queueu- Added new rules to pcp policy- Allow vmtools_helper_t to change role to system_r- Allow NM to dbus chat with vmtools- Fix couchdb_manage_files() to allow manage couchdb conf files- Add support for /var/run/redis.sock- dontaudit gpg trying to use audit- Allow consolekit to create log directories and files- Fix vmtools policy to allow user roles to access vmtools_helper_t- Allow block_suspend cap2 for ipa-otpd- Allow pkcsslotd to read users state- Add ioctl to init_dontaudit_rw_stream_socket- Add systemd_hostnamed_manage_config() interface- Remove transition for temp dirs created by init_t- gdm-simple-slave uses use setsockopt- sddm-greater is a xdm type program
* Tue Feb 18 2014 Miroslav Grepl 3.12.1-126- Add lvm_read_metadata()- Allow auditadm to search /var/log/audit dir- Add lvm_read_metadata() interface- Allow confined users to run vmtools helpers- Fix userdom_common_user_template()- Generic systemd unit scripts do write check on /- Allow init_t to create init_tmp_t in /tmp.This is for temporary content created by generic unit files- Add additional fixes needed for init_t and setup script running in generic unit files- Allow general users to create packet_sockets- added connlcli port- Add init_manage_transient_unit() interface- Allow init_t (generic unit files) to manage rpc state date as we had it for initrc_t- Fix userdomain.te to require passwd class- devicekit_power sends out a signal to all processes on the message bus when power is going down- Dontaudit rendom domains listing /proc and hittping system_map_t- Dontauit leaks of var_t into ifconfig_t- Allow domains that transition to ssh_t to manipulate its keyring- Define oracleasm_t as a device node- Change to handle /root as a symbolic link for os-tree- Allow sysadm_t to create packet_socket, also move some rules to attributes- Add label for openvswitch port- Remove general transition for files/dirs created in /etc/mail which got etc_aliases_t label.- Allow postfix_local to read .forward in pcp lib files- Allow pegasus_openlmi_storage_t to read lvm metadata- Add additional fixes for pegasus_openlmi_storage_t- Allow bumblebee to manage debugfs- Make bumblebee as unconfined domain- Allow snmp to read etc_aliases_t- Allow lscpu running in pegasus_openlmi_storage_t to read /dev/mem- Allow pegasus_openlmi_storage_t to read /proc/1/environ- Dontaudit read gconf files for cupsd_config_t- make vmtools as unconfined domain- Add vmtools_helper_t for helper scripts. Allow vmtools shutdonw a host and run ifconfig.- Allow collectd_t to use a mysql database- Allow ipa-otpd to perform DNS name resolution- Added new policy for keepalived- Allow openlmi-service provider to manage transitient units and allow stream connect to sssd- Add additional fixes new pscs-lite+polkit support- Add labeling for /run/krb5kdc- Change w3c_validator_tmp_t to httpd_w3c_validator_tmp_t in F20- Allow pcscd to read users proc info- Dontaudit smbd_t sending out random signuls- Add boolean to allow openshift domains to use nfs- Allow w3c_validator to create content in /tmp- zabbix_agent uses nsswitch- Allow procmail and dovecot to work together to deliver mail- Allow spamd to execute files in homedir if boolean turned on- Allow openvswitch to listen on port 6634- Add net_admin capability in collectd policy- Fixed snapperd policy- Fixed bugsfor pcp policy- Allow dbus_system_domains to be started by init- Fixed some interfaces- Add kerberos_keytab_domain attribute- Fix snapperd_conf_t def
* Tue Feb 11 2014 Miroslav Grepl 3.12.1-125- Addopt corenet rules for unbound-anchor to rpm_script_t- Allow runuser to send send audit messages.- Allow postfix-local to search .forward in munin lib dirs- Allow udisks to connect to D-Bus- Allow spamd to connect to spamd port- Fix syntax error in snapper.te- Dontaudit osad to search gconf home files- Allow rhsmcertd to manage /etc/sysconf/rhn director- Fix pcp labeling to accept /usr/bin for all daemon binaries- Fix mcelog_read_log() interface- Allow iscsid to manage iscsi lib files- Allow snapper domtrans to lvm_t. Add support for /etc/snapper and allow snapperd to manage it.- Make tuned_t as unconfined domain for RHEL7.0- Allow ABRT to read puppet certs- Add sys_time capability for virt-ga- Allow gemu-ga to domtrans to hwclock_t- Allow additional access for virt_qemu_ga_t processes to read system clock and send audit messages- Fix some AVCs in pcp policy- Add to bacula capability setgid and setuid and allow to bind to bacula ports- Changed label from rhnsd_rw_conf_t to rhnsd_conf_t- Add access rhnsd and osad to /etc/sysconfig/rhn- drbdadm executes drbdmeta- Fixes needed for docker- Allow epmd to manage /var/log/rabbitmq/startup_err file- Allow beam.smp connect to amqp port- Modify xdm_write_home to allow create also links as xdm_home_t if the boolean is on true- Allow init_t to manage pluto.ctl because of init_t instead of initrc_t- Allow systemd_tmpfiles_t to manage all non security files on the system- Added labels for bacula ports- Fix label on /dev/vfio/vfio- Add kernel_mounton_messages() interface- init wants to manage lock files for iscsi
* Mon Feb 03 2014 Miroslav Grepl 3.12.1-124- Added osad policy- Allow postfix to deliver to procmail- Allow bumblebee to seng kill signal to xserver- Allow vmtools to execute /usr/bin/lsb_release- Allow docker to write system net ctrls- Add support for rhnsd unit file- Add dbus_chat_session_bus() interface- Add dbus_stream_connect_session_bus() interface- Fix pcp.te- Fix logrotate_use_nfs boolean- Add lot of pcp fixes found in RHEL7- fix labeling for pmie for pcp pkg- Change thumb_t to be allowed to chat/connect with session bus type- Allow call renice in mlocate- Add logrotate_use_nfs boolean- Allow setroubleshootd to read rpc sysctl
* Fri Jan 31 2014 Miroslav Grepl 3.12.1-123- Turn on bacula, rhnsd policy- Add support for rhnsd unit file- Add dbus_chat_session_bus() interface- Add dbus_stream_connect_session_bus() interface- Fix logrotate_use_nfs boolean- Add lot of pcp fixes found in RHEL7- fix labeling for pmie for pcp pkg- Change thumb_t to be allowed to chat/connect with session bus type- Allow call renice in mlocate- Add logrotate_use_nfs boolean- Allow setroubleshootd to read rpc sysctl- Fixes for
*_admin interfaces- Add pegasus_openlmi_storage_var_run_t type def- Add support for /var/run/openlmi-storage- Allow tuned to create syslog.conf with correct labeling- Add httpd_dontaudit_search_dirs boolean- Add support for winbind.service- ALlow also fail2ban-client to read apache logs- Allow vmtools to getattr on all fs- Add support for dey_sapi port- Add logging_filetrans_named_conf()- Allow passwd_t to use ipc_lock, so that it can change the password in gnome-keyring
* Tue Jan 28 2014 Miroslav Grepl 3.12.1-122- Update snapper policy- Allow domains to append rkhunter lib files- Allow snapperd to getattr on all fs- Allow xdm to create /var/gdm with correct labeling- Add label for snapper.log- Allow fail2ban-client to read apache log files- Allow thumb_t to execute dbus-daemon in thumb_t
* Mon Jan 27 2014 Miroslav Grepl 3.12.1-121- Allow gdm to create /var/gdm with correct labeling- Allow domains to append rkhunterl lib files. #1057982- Allow systemd_tmpfiles_t net_admin to communicate with journald- Add interface to getattr on an isid_type for any type of file- Update libs_filetrans_named_content() to have support for /usr/lib/debug directory- Allow initrc_t domtrans to authconfig if unconfined is enabled- Allow docker and mount on devpts chr_file- Allow docker to transition to unconfined_t if boolean set- init calling needs to be optional in domain.te- Allow uncofined domain types to handle transient unit files- Fix labeling for vfio devices- Allow net_admin capability and send system log msgs- Allow lldpad send dgram to NM- Add networkmanager_dgram_send()- rkhunter_var_lib_t is correct type- Back port pcp policy from rawhide- Allow openlmi-storage to read removable devices- Allow system cron jobs to manage rkhunter lib files- Add rkhunter_manage_lib_files()- Fix ftpd_use_fusefs boolean to allow manage also symlinks- Allow smbcontrob block_suspend cap2- Allow slpd to read network and system state info- Allow NM domtrans to iscsid_t if iscsiadm is executed- Allow slapd to send a signal itself- Allow sslget running as pki_ra_t to contact port 8443, the secure port of the CA.- Fix plymouthd_create_log() interface- Add rkhunter policy with files type definition for /var/lib/rkhunter until it is fixed in rkhunter package- Add mozilla_plugin_exec_t for /usr/lib/firefox/plugin-container- Allow postfix and cyrus-imapd to work out of box- Allow fcoemon to talk with unpriv user domain using unix_stream_socket- Dontaudit domains that are calling into journald to net_admin- Add rules to allow vmtools to do what it does- snapperd is D-Bus service- Allow OpenLMI PowerManagement to call \'systemctl --force reboot\'- Add haproxy_connect_any boolean- Allow haproxy also to use http cache port by defaultResolves:#1058248
* Tue Jan 21 2014 Miroslav Grepl 3.12.1-120- Allow apache to write to the owncloud data directory in /var/www/html...- Allow consolekit to create log dir- Add support for icinga CGI scripts- Add support for icinga- Allow kdumpctl_t to create kdump lock fileResolves:#1055634- Allow kdump to create lnk lock file- Allow nscd_t block_suspen capability- Allow unconfined domain types to manage own transient unit file- Allow systemd domains to handle transient init unit files- Add interfaces to handle transient
* Mon Jan 20 2014 Miroslav Grepl 3.12.1-119- Add cron unconfined role support for uncofined SELinux user- Call corenet_udp_bind_all_ports() in milter.te- Allow fence_virtd to connect to zented port- Fix header for mirrormanager_admin()- Allow dkim-milter to bind udp ports- Allow milter domains to send signull itself- Allow block_suspend for yum running as mock_t- Allow beam.smp to manage couchdb files- Add couchdb_manage_files()- Add labeling for /var/log/php_errors.log- Allow bumblebee to stream connect to xserver- Allow bumblebee to send a signal to xserver- gnome-thumbnail to stream connect to bumblebee- Allow xkbcomp running as bumblebee_t to execute bin_t- Allow logrotate to read squid.conf- Additional rules to get docker and lxc to play well with SELinux- Allow bumbleed to connect to xserver port- Allow pegasus_openlmi_storage_t to read hwdata
* Thu Jan 16 2014 Miroslav Grepl 3.12.1-118- Allow init_t to work on transitient and snapshot unit files- Add logging_manage_syslog_config()- Update sysnet_dns_name_resolve() to allow connect to dnssec por- Allow pegasus_openlmi_storage_t to read hwdataResolves:#1031721- Fix rhcs_rw_cluster_tmpfs()- Allow fenced_t to bind on zented udp port- Added policy for vmtools- Fix mirrormanager_read_lib_files()- Allow mirromanager scripts running as httpd_t to manage mirrormanager pid files- Allow ctdb to create sock files in /var/run/ctdb- Add sblim_filetrans_named_content() interface- Allow rpm scritplets to create /run/gather with correct labeling- Allow gnome keyring domains to create gnome config dirs- Dontaudit read/write to init stream socket for lsmd_plugin_t- Allow automount to read nfs link files- Allow lsm plugins to read/write lsmd stream socket- Allow certmonger to connect ldap port to make IPA CA certificate renewal working.- Add also labeling for /var/run/ctdb- Add missing labeling for /var/lib/ctdb- ALlow tuned to manage syslog.conf. Should be fixed in tuned. #1030446- Dontaudit hypervkvp to search homedirs- Dontaudit hypervkvp to search admin homedirs- Allow hypervkvp to execute bin_t and ifconfig in the caller domain- Dontaudit xguest_t to read ABRT conf files- Add abrt_dontaudit_read_config()- Allow namespace-init to getattr on fs- Add thumb_role() also for xguest- Add filename transitions to create .spamassassin with correct labeling- Allow apache domain to read mirrormanager pid files- Allow domains to read/write shm and sem owned by mozilla_plugin_t- Allow alsactl to send a generic signal to kernel_t
* Tue Jan 14 2014 Miroslav Grepl 3.12.1-117- Add back rpm_run() for unconfined user
* Tue Jan 14 2014 Miroslav Grepl 3.12.1-116- Add missing files_create_var_lib_dirs()- Fix typo in ipsec.te- Allow passwd to create directory in /var/lib- Add filename trans also for event21- Allow iptables command to read /dev/rand- Add sigkill capabilityfor ipsec_t- Add filename transitions for bcache devices- Add additional rules to create /var/log/cron by syslogd_t with correct labeling- Add give everyone full access to all key rings- Add default lvm_var_run_t label for /var/run/multipathd- Fix log labeling to have correct default label for them after logrotate- Labeled ~/.nv/GLCache as being gstreamer output- Allow nagios_system_plugin to read mrtg lib files- Add mrtg_read_lib_files()- Call rhcs_rw_cluster_tmpfs for dlm_controld- Make authconfing as named_filetrans domain- Allow virsh to connect to user process using stream socket- Allow rtas_errd to read rand/urand devices and add chown capability- Fix labeling from /var/run/net-snmpd to correct /var/run/net-snmpResolves:#1051497- Add also chown cap for abrt_upload_watch_t. It already has dac_override- Allow sosreport to manage rhsmcertd pid files- Add rhsmcertd_manage_pid_files()- Allow also setgid cap for rpc.gssd- Dontaudit access check for abrt on cert_t- Allow pegasus_openlmi_system providers to dbus chat with systemd-logind
* Fri Jan 10 2014 Miroslav Grepl 3.12.1-115- Fix semanage import handling in spec file
* Fri Jan 10 2014 Miroslav Grepl 3.12.1-114- Add default lvm_var_run_t label for /var/run/multipathdResolves:#1051430- Fix log labeling to have correct default label for them after logrotate- Add files_write_root_dirs- Add new openflow port label for 6653/tcp and 6633/tcp- Add xserver_manage_xkb_libs()- Label tcp/8891 as milter por- Allow gnome_manage_generic_cache_files also create cache_home_t files- Fix aide.log labeling- Fix log labeling to have correct default label for them after logrotate- Allow mysqld-safe write access on /root to make mysqld working- Allow sosreport domtrans to prelikn- Allow OpenvSwitch to connec to openflow ports- Allow NM send dgram to lldpad- Allow hyperv domains to execute shell- Allow lsmd plugins stream connect to lsmd/init- Allow sblim domains to create /run/gather with correct labeling- Allow httpd to read ldap certs- Allow cupsd to send dbus msgs to process with different MLS level- Allow bumblebee to stream connect to apmd- Allow bumblebee to run xkbcomp- Additional allow rules to get libvirt-lxc containers working with docker- Additional allow rules to get libvirt-lxc containers working with docker- Allow docker to getattr on itself- Additional rules needed for sandbox apps- Allow mozilla_plugin to set attributes on usb device if use_spice boolean enabled- httpd should be able to send signal/signull to httpd_suexec_t- Add more fixes for neturon. Domtrans to dnsmasq, iptables. Make neutron as filenamtrans domain.
* Wed Jan 08 2014 Miroslav Grepl 3.12.1-113- Add neutron fixes
* Mon Jan 06 2014 Miroslav Grepl 3.12.1-112- Allow sshd to write to all process levels in order to change passwd when running at a level- Allow updpwd_t to downgrade /etc/passwd file to s0, if it is not running with this range- Allow apcuspd_t to status and start the power unit file- Allow udev to manage kdump unit file- Added new interface modutils_dontaudit_exec_insmod- Allow cobbler to search dhcp_etc_t directory- systemd_systemctl needs sys_admin capability- Allow sytemd_tmpfiles_t to delete all directories- passwd to create gnome-keyring passwd socket- Add missing zabbix_var_lib_t type- Fix filename trans for zabbixsrv in zabbix.te- Allow fprintd_t to send syslog messages- Add zabbix_var_lib_t for /var/lib/zabbixsrv, also allow zabix to connect to smtp port- Allow mozilla plugin to chat with policykit, needed for spice- Allow gssprozy to change user and gid, as well as read user keyrings- Label upgrades directory under /var/www as httpd_sys_rw_content_t, add other filetrans rules to label content correctly- Allow polipo to connect to http_cache_ports- Allow cron jobs to manage apache var lib content- Allow yppassword to manage the passwd_file_t- Allow showall_t to send itself signals- Allow cobbler to restart dhcpc, dnsmasq and bind services- Allow certmonger to manage home cert files- Add userdom filename trans for user mail domains- Allow apcuspd_t to status and start the power unit file- Allow cgroupdrulesengd to create content in cgoups directories- Allow smbd_t to signull cluster- Allow gluster daemon to create fifo files in glusterd_brick_t and sock_file in glusterd_var_lib_t- Add label for /var/spool/cron.aquota.user- Allow sandbox_x domains to use work with the mozilla plugin semaphore- Added new policy for speech-dispatcher- Added dontaudit rule for insmod_exec_t in rasdaemon policy- Updated rasdaemon policy- Allow system_mail_t to transition to postfix_postdrop_t- Clean up mirrormanager policy- Allow virt_domains to read cert files, needs backport to RHEL7- Allow sssd to read systemd_login_var_run_t- Allow irc_t to execute shell and bin-t files:- Add new access for mythtv- Allow rsync_t to manage all non auth files- allow modemmanger to read /dev/urand- Allow sandbox apps to attempt to set and get capabilties
* Thu Dec 19 2013 Miroslav Grepl 3.12.1-111- Add labeling for /var/lib/servicelog/servicelog.db-journal- Add support for freeipmi port- Add sysadm_u_default_contexts- Make new type to texlive files in homedir- Allow subscription-manager running as sosreport_t to manage rhsmcertd- Additional fixes for docker.te- Remove ability to do mount/sys_admin by default in virt_sandbox domains- New rules required to run docker images within libivrt- Add label for ~/.cvsignore- Change mirrormanager to be run by cron- Add mirrormanager policy- Fixed bumblebee_admin() and mip6d_admin()- Add log support for sensord- Fix typo in docker.te- Allow amanda to do backups over UDP- Allow bumblebee to read /etc/group and clean up bumblebee.te- type transitions with a filename not allowed inside conditionals- Don\'t allow virt-sandbox tools to use netlink out of the box, needs back port to RHEL7- Make new type to texlive files in homedir
* Thu Dec 12 2013 Miroslav Grepl 3.12.1-110- Allow freeipmi_ipmidetectd_t to use freeipmi port- Update freeipmi_domain_template()- Allow journalctl running as ABRT to read /run/log/journal- Allow NM to read dispatcher.d directory- Update freeipmi policy- Type transitions with a filename not allowed inside conditionals- Allow tor to bind to hplip port- Make new type to texlive files in homedir- Allow zabbix_agent to transition to dmidecode- Add rules for docker- Allow sosreport to send signull to unconfined_t- Add virt_noatsecure and virt_rlimitinh interfaces- Fix labeling in thumb.fc to add support for /usr/lib64/tumbler-1/tumblerddd support for freeipmi port- Add sysadm_u_default_contexts- Add logging_read_syslog_pid()- Fix userdom_manage_home_texlive() interface- Make new type to texlive files in homedir- Add filename transitions for /run and /lock links- Allow virtd to inherit rlimit informationResolves:#975358
* Tue Dec 10 2013 Miroslav Grepl 3.12.1-109- Change labeling for /usr/libexec/nm-dispatcher.action to NetworkManager_exec_tResolves:#1039879- Add labeling for /usr/lib/systemd/system/mariadb.service- Allow hyperv_domain to read sysfs- Fix ldap_read_certs() interface to allow acess also link files- Add support for /usr/libexec/pegasus/cmpiLMI_Journald-cimprovagt- Allow tuned to run modprobe- Allow portreserve to search /var/lib/sss dir- Add SELinux support for the teamd package contains team network device control daemon.- Dontaudit access check on /proc for bumblebee- Bumblebee wants to load nvidia modules- Fix rpm_named_filetrans_log_files and wine.te- Add conman policy for rawhide- DRM master and input event devices are used by the TakeDevice API- Clean up bumblebee policy- Update pegasus_openlmi_storage_t policy- Add freeipmi_stream_connect() interface- Allow logwatch read madm.conf to support RAID setup- Add raid_read_conf_files() interface- Allow up2date running as rpm_t create up2date log file with rpm_log_t labeling- add rpm_named_filetrans_log_files() interface- Allow dkim-milter to create files/dirs in /tmp- update freeipmi policy- Add policy for freeipmi services- Added rdisc_admin and rdisc_systemctl interfaces- opensm policy clean up- openwsman policy clean up- ninfod policy clean up- Added new policy for ninfod- Added new policy for openwsman- Added rdisc_admin and rdisc_systemctl interfaces- Fix kernel_dontaudit_access_check_proc()- Add support for /dev/uhid- Allow sulogin to get the attributes of initctl and sys_admin cap- Add kernel_dontaudit_access_check_proc()- Fix dev_rw_ipmi_dev()- Fix new interface in devices.if- DRM master and input event devices are used by the TakeDevice API- add dev_rw_inherited_dri() and dev_rw_inherited_input_dev()- Added support for default conman port- Add interfaces for ipmi devices
* Wed Dec 04 2013 Miroslav Grepl 3.12.1-108- Allow sosreport to send a signal to ABRT- Add proper aliases for pegasus_openlmi_service_exec_t and pegasus_openlmi_service_t- Label /usr/sbin/htcacheclean as httpd_exec_tResolves:#1037529- Added support for rdisc unit file- Add antivirus_db_t labeling for /var/lib/clamav-unofficial-sigs- Allow runuser running as logrotate connections to system DBUS- Label bcache devices as fixed_disk_device_t- Allow systemctl running in ipsec_mgmt_t to access /usr/lib/systemd/system/ipsec.service- Label /usr/lib/systemd/system/ipsec.service as ipsec_mgmt_unit_file_t
* Mon Dec 02 2013 Miroslav Grepl 3.12.1-107- Add back setpgid/setsched for sosreport_t
* Mon Dec 02 2013 Dan Walsh 3.12.1-106- Added fix for clout_init to transition to rpm_script_t (dwalshAATTredhat.com)
* Tue Nov 26 2013 Miroslav Grepl 3.12.1-105- Dontaudit openshift domains trying to use rawip_sockets, this is caused by a bad check in the kernel.- Allow git_system_t to read git_user_content if the git_system_enable_homedirs boolean is turned on- Add lsmd_plugin_t for lsm plugins- Allow dovecot-deliver to search mountpoints- Add labeling for /etc/mdadm.conf- Allow opelmi admin providers to dbus chat with init_t- Allow sblim domain to read /dev/urandom and /dev/random- Allow apmd to request the kernel load modules- Add glusterd_brick_t type- label mate-keyring-daemon with gkeyringd_exec_t- Add plymouthd_create_log()- Dontaudit leaks from openshift domains into mail domains, needs back port to RHEL6- Allow sssd to request the kernel loads modules- Allow gpg_agent to use ssh-add- Allow gpg_agent to use ssh-add- Dontaudit access check on /root for myslqd_safe_t- Allow ctdb to getattr on al filesystems- Allow abrt to stream connect to syslog- Allow dnsmasq to list dnsmasq.d directory- Watchdog opens the raw socket- Allow watchdog to read network state info- Dontaudit access check on lvm lock dir- Allow sosreport to send signull to setroubleshootd- Add setroubleshoot_signull() interface- Fix ldap_read_certs() interface- Allow sosreport all signal perms- Allow sosreport to run systemctl- Allow sosreport to dbus chat with rpm- Add glusterd_brick_t files type- Allow zabbix_agentd to read all domain state- Clean up rtas.if- Allow smoltclient to execute ldconfig- Allow sosreport to request the kernel to load a module- Fix userdom_confined_admin_template()- Add back exec_content boolean for secadm, logadm, auditadm- Fix files_filetrans_system_db_named_files() interface- Allow sulogin to getattr on /proc/kcore- Add filename transition also for servicelog.db-journal- Add files_dontaudit_access_check_root()- Add lvm_dontaudit_access_check_lock() interface
* Thu Nov 21 2013 Miroslav Grepl 3.12.1-104- Allow watchdog to read /etc/passwd- Allow browser plugins to connect to bumblebee- New policy for bumblebee and freqset- Add new policy for mip6d daemon- Add new policy for opensm daemon- Allow condor domains to read/write condor_master udp_socket- Allow openshift_cron_t to append to openshift log files, label /var/log/openshift- Add back file_pid_filetrans for /var/run/dlm_controld- Allow smbd_t to use inherited tmpfs content- Allow mcelog to use the /dev/cpu device- sosreport runs rpcinfo- sosreport runs subscription-manager- Allow staff_t to run frequency command- Allow systemd_tmpfiles to relabel log directories- Allow staff_t to read xserver_log file- Label hsperfdata_root as tmp_t
* Wed Nov 20 2013 Miroslav Grepl 3.12.1-103- More sosreport fixes to make ABRT working
* Fri Nov 15 2013 Miroslav Grepl 3.12.1-102- Fix files_dontaudit_unmount_all_mountpoints()- Add support for 2608-2609 tcp/udp ports- Should allow domains to lock the terminal device- More fixes for user config files to make crond_t running in userdomain- Add back disable/reload/enable permissions for system class- Fix manage_service_perms macro- We need to require passwd rootok- Fix zebra.fc- Fix dnsmasq_filetrans_named_content() interface- Allow all sandbox domains create content in svirt_home_t- Allow zebra domains also create zebra_tmp_t files in /tmp- Add support for new zebra services:isisd,babeld. Add systemd support for zebra services.- Fix labeling on neutron and remove transition to iconfig_t- abrt needs to read mcelog log file- Fix labeling on dnsmasq content- Fix labeling on /etc/dnsmasq.d- Allow glusterd to relabel own lib files- Allow sandbox domains to use pam_rootok, and dontaudit attempts to unmount file systems, this is caused by a bug in systemd- Allow ipc_lock for abrt to run journalctl
* Thu Nov 14 2013 Miroslav Grepl 3.12.1-101- Fix config.tgz
* Tue Nov 12 2013 Miroslav Grepl 3.12.1-100- Fix passenger_stream_connect interface- setroubleshoot_fixit wants to read network state- Allow procmail_t to connect to dovecot stream sockets- Allow cimprovagt service providers to read network states- Add labeling for /var/run/mariadb- pwauth uses lastlog() to update system\'s lastlog- Allow account provider to read login records- Add support for texlive2013- More fixes for user config files to make crond_t running in userdomain- Add back disable/reload/enable permissions for system class- Fix manage_service_perms macro- Allow passwd_t to connect to gnome keyring to change password- Update mls config files to have cronjobs in the user domains- Remove access checks that systemd does not actually do
* Fri Nov 08 2013 Miroslav Grepl 3.12.1-99- Add support for yubikey in homedir- Add support for upd/3052 port- Allow apcupsd to use PowerChute Network Shutdown- Allow lsmd to execute various lsmplugins- Add labeling also for /etc/watchdog\\.d where are watchdog scripts located too- Update gluster_export_all_rw boolean to allow relabel all base file types- Allow x86_energy_perf tool to modify the MSR- Fix /var/lib/dspam/data labeling
* Wed Nov 06 2013 Miroslav Grepl 3.12.1-98- Add files_relabel_base_file_types() interface- Allow netlabel-config to read passwd- update gluster_export_all_rw boolean to allow relabel all base file types caused by lsetxattr()- Allow x86_energy_perf tool to modify the MSR- Fix /var/lib/dspam/data labeling- Allow pegasus to domtrans to mount_t- Add labeling for unconfined scripts in /usr/libexec/watchdog/scripts- Add support for unconfined watchdog scripts- Allow watchdog to manage own log files
* Wed Nov 06 2013 Miroslav Grepl 3.12.1-97- Add label only for redhat.repo instead of /etc/yum.repos.d. But probably we will need to switch for the directory.- Label /etc/yum.repos.d as system_conf_t- Use sysnet_filetrans_named_content in udev.te instead of generic transition for net_conf_t- Allow dac_override for sysadm_screen_t- Allow init_t to read ipsec_conf_t as we had it for initrc_t. Needed by ipsec unit file.- Allow netlabel-config to read meminfo- Add interface to allow docker to mounton file_t- Add new interface to exec unlabeled files- Allow lvm to use docker semaphores- Setup transitons for .xsessions-errors.old- Change labels of files in /var/lib/
*/.ssh to transition properly- Allow staff_t and user_t to look at logs using journalctl- pluto wants to manage own log file- Allow pluto running as ipsec_t to create pluto.log- Fix alias decl in corenetwork.te.in- Add support for fuse.glusterfs- Allow dmidecode to read/write /run/lock/subsys/rhsmcertd- Allow rhsmcertd to manage redhat.repo which is now labeled as system.conf. Allow rhsmcertd to manage all log files.- Additional access for docker- Added more rules to sblim policy- Fix kdumpgui_run_bootloader boolean- Allow dspam to connect to lmtp port- Included sfcbd service into sblim policy- rhsmcertd wants to manaage /etc/pki/consumer dir- Add kdumpgui_run_bootloader boolean- Add support for /var/cache/watchdog- Remove virt_domain attribute for virt_qemu_ga_unconfined_t- Fixes for handling libvirt containes- Dontaudit attempts by mysql_safe to write content into /- Dontaudit attempts by system_mail to modify network config- Allow dspam to bind to lmtp ports- Add new policy to allow staff_t and user_t to look at logs using journalctl- Allow apache cgi scripts to list sysfs- Dontaudit attempts to write/delete user_tmp_t files- Allow all antivirus domains to manage also own log dirs- Allow pegasus_openlmi_services_t to stream connect to sssd_t
* Fri Nov 01 2013 Miroslav Grepl 3.12.1-96- Add missing permission checks for nscd
* Wed Oct 30 2013 Miroslav Grepl 3.12.1-95- Fix alias decl in corenetwork.te.in- Add support for fuse.glusterfs- Add file transition rules for content created by f5link- Rename quantum_port information to neutron- Allow all antivirus domains to manage also own log dirs- Rename quantum_port information to neutron- Allow pegasus_openlmi_services_t to stream connect to sssd_t
* Mon Oct 28 2013 Miroslav Grepl 3.12.1-94- Allow sysadm_t to read login information- Allow systemd_tmpfiles to setattr on var_log_t directories- Udpdate Makefile to include systemd_contexts- Add systemd_contexts- Add fs_exec_hugetlbfs_files() interface- Add daemons_enable_cluster_mode boolean- Fix rsync_filetrans_named_content()- Add rhcs_read_cluster_pid_files() interface- Update rhcs.if with additional interfaces from RHEL6- Fix rhcs_domain_template() to not create run dirs with cluster_var_run_t- Allow glusterd_t to mounton glusterd_tmp_t- Allow glusterd to unmout al filesystems- Allow xenstored to read virt config- Add label for swift_server.lock and make add filetrans_named_content to make sure content gets created with the correct label- Allow mozilla_plugin_t to mmap hugepages as an executable
* Thu Oct 24 2013 Miroslav Grepl 3.12.1-94- Add back userdom_security_admin_template() interface and use it for sysadm_t if sysadm_secadm.pp
* Tue Oct 22 2013 Miroslav Grepl 3.12.1-93- Allow sshd_t to read openshift content, needs backport to RHEL6.5- Label /usr/lib64/sasl2/libsasldb.so.3.0.0 as textrel_shlib_t- Make sur kdump lock is created with correct label if kdumpctl is executed- gnome interface calls should always be made within an optional_block- Allow syslogd_t to connect to the syslog_tls port- Add labeling for /var/run/charon.ctl socket- Add kdump_filetrans_named_content()- Allo setpgid for fenced_t- Allow setpgid and r/w cluster tmpfs for fenced_t- gnome calls should always be within optional blocks- wicd.pid should be labeled as networkmanager_var_run_t- Allow sys_resource for lldpad
* Thu Oct 17 2013 Miroslav Grepl 3.12.1-92- Add rtas policy
* Thu Oct 17 2013 Miroslav Grepl 3.12.1-91- Allow mailserver_domains to manage and transition to mailman data- Dontaudit attempts by mozilla plugin to relabel content, caused by using mv and cp commands- Allow mailserver_domains to manage and transition to mailman data- Allow svirt_domains to read sysctl_net_t- Allow thumb_t to use tmpfs inherited from the user- Allow mozilla_plugin to bind to the vnc port if running with spice- Add new attribute to discover confined_admins and assign confined admin to it- Fix zabbix to handle attributes in interfaces- Fix zabbix to read system states for all zabbix domains- Fix piranha_domain_template()- Allow ctdbd to create udp_socket. Allow ndmbd to access ctdbd var files.- Allow lldpad sys_rouserce cap due to #986870- Allow dovecot-auth to read nologin- Allow openlmi-networking to read /proc/net/dev- Allow smsd_t to execute scripts created on the fly labeled as smsd_spool_t- Add zabbix_domain attribute for zabbix domains to treat them together- Add labels for zabbix-poxy-
* (#1018221)- Update openlmi-storage policy to reflect #1015067- Back port piranha tmpfs fixes from RHEL6- Update httpd_can_sendmail boolean to allow read/write postfix spool maildrop- Add postfix_rw_spool_maildrop_files interface- Call new userdom_admin_user_templat() also for sysadm_secadm.pp- Fix typo in userdom_admin_user_template()- Allow SELinux users to create coolkeypk11sE-Gate in /var/cache/coolkey- Add new attribute to discover confined_admins- Fix labeling for /etc/strongswan/ipsec.d- systemd_logind seems to pass fd to anyone who dbus communicates with it- Dontaudit leaked write descriptor to dmesg
* Mon Oct 14 2013 Miroslav Grepl 3.12.1-90- Activate motion policy
* Mon Oct 14 2013 Miroslav Grepl 3.12.1-89- Fix gnome_read_generic_data_home_files()- allow openshift_cgroup_t to read/write inherited openshift file types- Remove httpd_cobbler_content
* from cobbler_admin interface- Allow svirt sandbox domains to setattr on chr_file and blk_file svirt_sandbox_file_t, so sshd will work within a container- Allow httpd_t to read also git sys content symlinks- Allow init_t to read gnome home data- Dontaudit setroubleshoot_fixit_t execmem, since it does not seem to really need it.- Allow virsh to execute systemctl- Fix for nagios_services plugins- add type defintion for ctdbd_var_t- Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file- Allow net_admin/netlink_socket all hyperv_domain domains- Add labeling for zarafa-search.log and zarafa-search.pid- Fix hypervkvp.te- Fix nscd_shm_use()- Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services.- Add hypervkvp_unit_file_t type- Fix logging policy- Allow syslog to bind to tls ports- Update labeling for /dev/cdc-wdm- Allow to su_domain to read init states- Allow init_t to read gnome home data- Make sure if systemd_logind creates nologin file with the correct label- Clean up ipsec.te
* Tue Oct 08 2013 Miroslav Grepl 3.12.1-88- Add auth_exec_chkpwd interface- Fix port definition for ctdb ports- Allow systemd domains to read /dev/urand- Dontaudit attempts for mozilla_plugin to append to /dev/random- Add label for /var/run/charon.
*- Add labeling for /usr/lib/systemd/system/lvm2.
*dd policy for motion service- Fix for nagios_services plugins- Fix some bugs in zoneminder policy- add type defintion for ctdbd_var_t- Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file- Allow net_admin/netlink_socket all hyperv_domain domains- Add labeling for zarafa-search.log and zarafa-search.pid- glusterd binds to random unreserved ports- Additional allow rules found by testing glusterfs- apcupsd needs to send a message to all users on the system so needs to look them up- Fix the label on ~/.juniper_networks- Dontaudit attempts for mozilla_plugin to append to /dev/random- Allow polipo_daemon to connect to flash ports- Allow gssproxy_t to create replay caches- Fix nscd_shm_use()- Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services.- Add hypervkvp_unit_file_t type
* Fri Oct 04 2013 Miroslav Grepl 3.12.1-87- init reload from systemd_localed_t- Allow domains that communicate with systemd_logind_sessions to use systemd_logind_t fd- Allow systemd_localed_t to ask systemd to reload the locale.- Add systemd_runtime_unit_file_t type for unit files that systemd creates in memory- Allow readahead to read /dev/urand- Fix lots of avcs about tuned- Any file names xenstored in /var/log should be treated as xenstored_var_log_t- Allow tuned to inderact with hugepages- Allow condor domains to list etc rw dirs
* Fri Oct 04 2013 Miroslav Grepl 3.12.1-86- Fix nscd_shm_use()- Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services.- Add hypervkvp_unit_file_t type- Add additional fixes forpegasus_openlmi_account_t- Allow mdadm to read /dev/urand- Allow pegasus_openlmi_storage_t to create mdadm.conf and write it- Add label/rules for /etc/mdadm.conf- Allow pegasus_openlmi_storage_t to transition to fsadm_t- Fixes for interface definition problems- Dontaudit dovecot-deliver to gettatr on all fs dirs- Allow domains to search data_home_t directories- Allow cobblerd to connect to mysql- Allow mdadm to r/w kdump lock files- Add support for kdump lock files- Label zarafa-search as zarafa-indexer- Openshift cgroup wants to read /etc/passwd- Add new sandbox domains for kvm- Allow mpd to interact with pulseaudio if mpd_enable_homedirs is turned on- Fix labeling for /usr/lib/systemd/system/lvm2.
*- Add labeling for /usr/lib/systemd/system/lvm2.
*- Fix typos to get a new build. We should not cover filename trans rules to prevent duplicate rules- Add sshd_keygen_t policy for sshd-keygen- Fix alsa_home_filetrans interface name and definition- Allow chown for ssh_keygen_t- Add fs_dontaudit_getattr_all_dirs()- Allow init_t to manage etc_aliases_t and read xserver_var_lib_t and chrony keys- Fix up patch to allow systemd to manage home content- Allow domains to send/recv unlabeled traffic if unlabelednet.pp is enabled- Allow getty to exec hostname to get info- Add systemd_home_t for ~/.local/share/systemd directory
* Wed Oct 02 2013 Miroslav Grepl 3.12.1-85- Fix lxc labels in config.tgz
* Mon Sep 30 2013 Miroslav Grepl 3.12.1-84- Fix labeling for /usr/libexec/kde4/kcmdatetimehelper- Allow tuned to search all file system directories- Allow alsa_t to sys_nice, to get top performance for sound management- Add support for MySQL/PostgreSQL for amavis- Allow openvpn_t to manage openvpn_var_log_t files.- Allow dirsrv_t to create tmpfs_t directories- Allow dirsrv to create dirs in /dev/shm with dirsrv_tmpfs label- Dontaudit leaked unix_stream_sockets into gnome keyring- Allow telepathy domains to inhibit pipes on telepathy domains- Allow cloud-init to domtrans to rpm- Allow abrt daemon to manage abrt-watch tmp files- Allow abrt-upload-watcher to search /var/spool directory- Allow nsswitch domains to manage own process key- Fix labeling for mgetty.
* logs- Allow systemd to dbus chat with upower- Allow ipsec to send signull to itself- Allow setgid cap for ipsec_t- Match upstream labeling
* Wed Sep 25 2013 Miroslav Grepl 3.12.1-83- Do not build sanbox pkg on MLS
* Wed Sep 25 2013 Miroslav Grepl 3.12.1-82- wine_tmp is no longer needed- Allow setroubleshoot to look at /proc- Allow telepathy domains to dbus with systemd logind- Fix handling of fifo files of rpm- Allow mozilla_plugin to transition to itself- Allow certwatch to write to cert_t directories- New abrt application- Allow NetworkManager to set the kernel scheduler- Make wine_domain shared by all wine domains- Allow mdadm_t to read images labeled svirt_image_t- Allow amanda to read /dev/urand- ALlow my_print_default to read /dev/urand- Allow mdadm to write to kdumpctl fifo files- Allow nslcd to send signull to itself- Allow yppasswd to read /dev/urandom- Fix zarafa_setrlimit- Add support for /var/lib/php/wsdlcache- Add zarafa_setrlimit boolean- Allow fetchmail to send mails- Add additional alias for user_tmp_t because wine_tmp_t is no longer used- More handling of ther kernel keyring required by kerberos- New privs needed for init_t when running without transition to initrc_t over bin_t, and without unconfined domain installed
* Thu Sep 19 2013 Miroslav Grepl 3.12.1-81- Dontaudit attempts by sosreport to read shadow_t- Allow browser sandbox plugins to connect to cups to print- Add new label mpd_home_t- Label /srv/www/logs as httpd_log_t- Add support for /var/lib/php/wsdlcache- Add zarafa_setrlimit boolean- Allow fetchmail to send mails- Add labels for apache logs under miq package- Allow irc_t to use tcp sockets- fix labels in puppet.if- Allow tcsd to read utmp file- Allow openshift_cron_t to run ssh-keygen in ssh_keygen_t to access host keys- Define svirt_socket_t as a domain_type- Take away transition from init_t to initrc_t when executing bin_t, allow init_t to run chk_passwd_t- Fix label on pam_krb5 helper apps
* Thu Sep 12 2013 Miroslav Grepl 3.12.1-80- Allow ldconfig to write to kdumpctl fifo files- allow neutron to connect to amqp ports- Allow kdump_manage_crash to list the kdump_crash_t directory- Allow glance-api to connect to amqp port- Allow virt_qemu_ga_t to read meminfo- Add antivirus_home_t type for antivirus date in HOMEDIRS- Allow mpd setcap which is needed by pulseaudio- Allow smbcontrol to create content in /var/lib/samba- Allow mozilla_exec_t to be used as a entrypoint to mozilla_domtrans_spec- Add additional labeling for qemu-ga/fsfreeze-hook.d scripts- amanda_exec_t needs to be executable file- Allow block_suspend cap for samba-net- Allow apps that read ipsec_mgmt_var_run_t to search ipsec_var_run_t- Allow init_t to run crash utility- Treat usr_t just like bin_t for transitions and executions- Add port definition of pka_ca to port 829 for openshift- Allow selinux_store to use symlinks
* Mon Sep 09 2013 Miroslav Grepl 3.12.1-79- Allow block_suspend cap for samba-net- Allow t-mission-control to manage gabble cache files- Allow nslcd to read /sys/devices/system/cpu- Allow selinux_store to use symlinks
* Mon Sep 09 2013 Miroslav Grepl 3.12.1-78- Allow xdm_t to transition to itself- Call neutron interfaces instead of quantum- Allow init to change targed role to make uncofined services (xrdp which now has own systemd unit file) working. We want them to have in unconfined_t- Make sure directories in /run get created with the correct label- Make sure /root/.pki gets created with the right label- try to remove labeling for motion from zoneminder_exec_t to bin_t- Allow inetd_t to execute shell scripts- Allow cloud-init to read all domainstate- Fix to use quantum port- Add interface netowrkmanager_initrc_domtrans- Fix boinc_execmem- Allow t-mission-control to read gabble cache home- Add labeling for ~/.cache/telepathy/avatars/gabble- Allow memcache to read sysfs data- Cleanup antivirus policy and add additional fixes- Add boolean boinc_enable_execstack- Add support for couchdb in rabbitmq policy- Add interface couchdb_search_pid_dirs- Allow firewalld to read NM state- Allow systemd running as git_systemd to bind git port- Fix mozilla_plugin_rw_tmpfs_files()
* Thu Sep 05 2013 Miroslav Grepl 3.12.1-77- Split out rlogin ports from inetd- Treat files labeld as usr_t like bin_t when it comes to transitions- Allow staff_t to read login config- Allow ipsec_t to read .google authenticator data- Allow systemd running as git_systemd to bind git port- Fix mozilla_plugin_rw_tmpfs_files()- Call the correct interface - corenet_udp_bind_ktalkd_port()- Allow all domains that can read gnome_config to read kde config- Allow sandbox domain to read/write mozilla_plugin_tmpfs_t so pulseaudio will work- Allow mdadm to getattr any file system- Allow a confined domain to executes mozilla_exec_t via dbus- Allow cupsd_lpd_t to bind to the printer port- Dontaudit attempts to bind to ports < 1024 when nis is turned on- Allow apache domain to connect to gssproxy socket- Allow rlogind to bind to the rlogin_port- Allow telnetd to bind to the telnetd_port- Allow ktalkd to bind to the ktalkd_port- Allow cvs to bind to the cvs_port
* Wed Sep 04 2013 Miroslav Grepl 3.12.1-76- Cleanup related to init_domain()+inetd_domain fixes- Use just init_domain instead of init_daemon_domain in inetd_core_service_domain- svirt domains neeed to create kobject_uevint_sockets- Lots of new access required for sosreport- Allow tgtd_t to connect to isns ports- Allow init_t to transition to all inetd domains:- openct needs to be able to create netlink_object_uevent_sockets- Dontaudit leaks into ldconfig_t- Dontaudit su domains getattr on /dev devices, move su domains to attribute based calls- Move kernel_stream_connect into all Xwindow using users- Dontaudit inherited lock files in ifconfig o dhcpc_t
* Tue Sep 03 2013 Miroslav Grepl 3.12.1-75- Also sock_file trans rule is needed in lsm- Fix labeling for fetchmail pid files/dirs- Add additional fixes for abrt-upload-watch- Fix polipo.te- Fix transition rules in asterisk policy- Add fowner capability to networkmanager policy- Allow polipo to connect to tor ports- Cleanup lsmd.if- Cleanup openhpid policy- Fix kdump_read_crash() interface- Make more domains as init domain- Fix cupsd.te- Fix requires in rpm_rw_script_inherited_pipes- Fix interfaces in lsm.if- Allow munin service plugins to manage own tmpfs files/dirs- Allow virtd_t also relabel unix stream sockets for virt_image_type- Make ktalk as init domain- Fix to define ktalkd_unit_file_t correctly- Fix ktalk.fc- Add systemd support for talk-server- Allow glusterd to create sock_file in /run- Allow xdm_t to delete gkeyringd_tmp_t files on logout- Add fixes for hypervkvp policy- Add logwatch_can_sendmail boolean- Allow mysqld_safe_t to handle also symlinks in /var/log/mariadb- Allow xdm_t to delete gkeyringd_tmp_t files on logout
* Thu Aug 29 2013 Miroslav Grepl 3.12.1-74- Add selinux-policy-sandbox pkg
* Tue Aug 27 2013 Miroslav Grepl 3.12.1-730 - Allow rhsmcertd to read init state- Allow fsetid for pkcsslotd- Fix labeling for /usr/lib/systemd/system/pkcsslotd.service- Allow fetchmail to create own pid with correct labeling- Fix rhcs_domain_template()- Allow roles which can run mock to read mock lib files to view results- Allow rpcbind to use nsswitch- Fix lsm.if summary- Fix collectd_t can read /etc/passwd file- Label systemd unit files under dracut correctly- Add support for pam_mount to mount user\'s encrypted home When a user logs in and logs out using ssh- Add support for .Xauthority-n- Label umount.crypt as lvm_exec_t- Allow syslogd to search psad lib files- Allow ssh_t to use /dev/ptmx- Make sure /run/pluto dir is created with correct labeling- Allow syslog to run shell and bin_t commands- Allow ip to relabel tun_sockets- Allow mount to create directories in files under /run- Allow processes to use inherited fifo files
* Fri Aug 23 2013 Miroslav Grepl 3.12.1-72- Add policy for lsmd- Add support for /var/log/mariadb dir and allow mysqld_safe to list this directory- Update condor_master rules to allow read system state info and allow logging- Add labeling for /etc/condor and allow condor domain to write it (bug)- Allow condor domains to manage own logs- Allow glusterd to read domains state- Fix initial hypervkvp policy- Add policy for hypervkvpd- Fix redis.if summary
* Wed Aug 21 2013 Miroslav Grepl 3.12.1-71- Allow boinc to connect to AATT/tmp/.X11-unix/X0- Allow beam.smp to connect to tcp/5984- Allow named to manage own log files- Add label for /usr/libexec/dcc/start-dccifd and domtrans to dccifd_t- Add virt_transition_userdomain boolean decl- Allow httpd_t to sendto unix_dgram sockets on its children- Allow nova domains to execute ifconfig- bluetooth wants to create fifo_files in /tmp- exim needs to be able to manage mailman data- Allow sysstat to getattr on all file systems- Looks like bluetoothd has moved- Allow collectd to send ping packets- Allow svirt_lxc domains to getpgid- Remove virt-sandbox-service labeling as virsh_exec_t, since it no longer does virsh_t stuff- Allow frpintd_t to read /dev/urandom- Allow asterisk_t to create sock_file in /var/run- Allow usbmuxd to use netlink_kobject- sosreport needs to getattr on lots of devices, and needs access to netlink_kobject_uevent_socket- More cleanup of svirt_lxc policy- virtd_lxc_t now talks to dbus- Dontaudit leaked ptmx_t- Allow processes to use inherited fifo files- Allow openvpn_t to connect to squid ports- Allow prelink_cron_system_t to ask systemd to reloaddd miscfiles_dontaudit_access_check_cert()- Allow ssh_t to use /dev/ptmx- Make sure /run/pluto dir is created with correct labeling- Allow syslog to run shell and bin_t commands- Allow ip to relabel tun_sockets- Allow mount to create directories in files under /run- Allow processes to use inherited fifo files- Allow user roles to connect to the journal socket
* Thu Aug 08 2013 Miroslav Grepl 3.12.1-70- selinux_set_enforce_mode needs to be used with type- Add append to the dontaudit for unix_stream_socket of xdm_t leak- Allow xdm_t to create symlinks in log direcotries- Allow login programs to read afs config- Label 10933 as a pop port, for dovecot- New policy to allow selinux_server.py to run as semanage_t as a dbus service- Add fixes to make netlabelctl working on MLS- AVCs required for running sepolicy gui as staff_t- Dontaudit attempts to read symlinks, sepolicy gui is likely to cause this type of AVC- New dbus server to be used with new gui- After modifying some files in /etc/mail, I saw this needed on the next boot- Loading a vm from /usr/tmp with virt-manager- Clean up oracleasm policy for Fedora- Add oracleasm policy written by rlopezAATTredhat.com- Make postfix_postdrop_t as mta_agent to allow domtrans to system mail if it is executed by apache- Add label for /var/crash- Allow fenced to domtrans to sanclok_t- Allow nagios to manage nagios spool files- Make tfptd as home_manager- Allow kdump to read kcore on MLS system- Allow mysqld-safe sys_nice/sys_resource caps- Allow apache to search automount tmp dirs if http_use_nfs is enabled- Allow crond to transition to named_t, for use with unbound- Allow crond to look at named_conf_t, for unbound- Allow mozilla_plugin_t to transition its home content- Allow dovecot_domain to read all system and network state- Allow httpd_user_script_t to call getpw- Allow semanage to read pid files- Dontaudit leaked file descriptors from user domain into thumb- Make PAM authentication working if it is enabled in ejabberd- Add fixes for rabbit to fix ##992920,#992931- Allow glusterd to mount filesystems- Loading a vm from /usr/tmp with virt-manager- Trying to load a VM I got an AVC from devicekit_disk for loopcontrol device- Add fix for pand service- shorewall touches own log- Allow nrpe to list /var- Mozilla_plugin_roles can not be passed into lpd_run_lpr- Allow afs domains to read afs_config files- Allow login programs to read afs config- Allow virt_domain to read virt_var_run_t symlinks- Allow smokeping to send its process signals- Allow fetchmail to setuid- Add kdump_manage_crash() interface- Allow abrt domain to write abrt.socket
* Wed Jul 31 2013 Miroslav Grepl 3.12.1-69- Add more aliases in pegasus.te- Add more fixes for
*_admin interfaces- Add interface fixes- Allow nscd to stream connect to nmbd- Allow gnupg apps to write to pcscd socket- Add more fixes for openlmi provides. Fix naming and support for additionals- Allow fetchmail to resolve host names- Allow firewalld to interact also with lnk files labeled as firewalld_etc_rw_t- Add labeling for cmpiLMI_Fan-cimprovagt- Allow net_admin for glusterd- Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/- Add pegasus_openlmi_system_t- Fix puppet_domtrans_master() to make all puppet calling working in passenger.te- Fix corecmd_exec_chroot()- Fix logging_relabel_syslog_pid_socket interface- Fix typo in unconfineduser.te- Allow system_r to access unconfined_dbusd_t to run hp_chec
* Tue Jul 30 2013 Miroslav Grepl 3.12.1-68- Allow xdm_t to act as a dbus client to itsel- Allow fetchmail to resolve host names- Allow gnupg apps to write to pcscd socket- Add labeling for cmpiLMI_Fan-cimprovagt- Allow net_admin for glusterd- Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/- Add pegasus_openlmi_system_t- Fix puppet_domtrans_master() to make all puppet calling working in passenger.te-httpd_t does access_check on certs
* Fri Jul 26 2013 Miroslav Grepl 3.12.1-67- Add support for cmpiLMI_Service-cimprovagt- Allow pegasus domtrans to rpm_t to make pycmpiLMI_Software-cimprovagt running as rpm_t- Label pycmpiLMI_Software-cimprovagt as rpm_exec_t- Add support for pycmpiLMI_Storage-cimprovagt- Add support for cmpiLMI_Networking-cimprovagt- Allow system_cronjob_t to create user_tmpfs_t to make pulseaudio working- Allow virtual machines and containers to run as user doains, needed for virt-sandbox- Allow buglist.cgi to read cpu info
* Mon Jul 22 2013 Miroslav Grepl 3.12.1-66- Allow systemd-tmpfile to handle tmp content in print spool dir- Allow systemd-sysctl to send system log messages- Add support for RTP media ports and fmpro-internal- Make auditd working if audit is configured to perform SINGLE action on disk error- Add interfaces to handle systemd units- Make systemd-notify working if pcsd is used- Add support for netlabel and label /usr/sbin/netlabelctl as iptables_exec_t- Instead of having all unconfined domains get all of the named transition rules,- Only allow unconfined_t, init_t, initrc_t and rpm_script_t by default.- Add definition for the salt ports- Allow xdm_t to create link files in xdm_var_run_t- Dontaudit reads of blk files or chr files leaked into ldconfig_t- Allow sys_chroot for useradd_t- Allow net_raw cap for ipsec_t- Allow sysadm_t to reload services- Add additional fixes to make strongswan working with a simple conf- Allow sysadm_t to enable/disable init_t services- Add additional glusterd perms- Allow apache to read lnk files in the /mnt directory- Allow glusterd to ask the kernel to load a module- Fix description of ftpd_use_fusefs boolean- Allow svirt_lxc_net_t to sys_chroot, modify policy to tighten up svirt_lxc_domain capabilties and process controls, but add them to svirt_lxc_net_t- Allow glusterds to request load a kernel module- Allow boinc to stream connect to xserver_t- Allow sblim domains to read /etc/passwd- Allow mdadm to read usb devices- Allow collectd to use ping plugin- Make foghorn working with SNMP- Allow sssd to read ldap certs- Allow haproxy to connect to RTP media ports- Add additional trans rules for aide_db- Add labeling for /usr/lib/pcsd/pcsd- Add labeling for /var/log/pcsd- Add support for pcs which is a corosync and pacemaker configuration tool
* Wed Jul 17 2013 Miroslav Grepl 3.12.1-65- Label /var/lib/ipa/pki-ca/publish as pki_tomcat_cert_t- Add labeling for /usr/libexec/kde4/polkit-kde-authentication-agent-1- Allow all domains that can domtrans to shutdown, to start the power services script to shutdown- consolekit needs to be able to shut down system- Move around interfaces- Remove nfsd_rw_t and nfsd_ro_t, they don\'t do anything- Add additional fixes for rabbitmq_beam to allow getattr on mountpoints- Allow gconf-defaults-m to read /etc/passwd- Fix pki_rw_tomcat_cert() interface to support lnk_files
* Fri Jul 12 2013 Miroslav Grepl 3.12.1-64- Add support for gluster ports- Make sure that all keys located in /etc/ssh/ are labeled correctly- Make sure apcuspd lock files get created with the correct label- Use getcap in gluster.te- Fix gluster policy- add additional fixes to allow beam.smp to interact with couchdb files- Additional fix for #974149- Allow gluster to user gluster ports- Allow glusterd to transition to rpcd_t and add additional fixes for #980683- Allow tgtd working when accessing to the passthrough device- Fix labeling for mdadm unit files
* Thu Jul 11 2013 Miroslav Grepl 3.12.1-63- Add mdadm fixes
* Tue Jul 09 2013 Miroslav Grepl 3.12.1-62- Fix definition of sandbox.disabled to sandbox.pp.disabled
* Mon Jul 08 2013 Miroslav Grepl 3.12.1-61- Allow mdamd to execute systemctl- Allow mdadm to read /dev/kvm- Allow ipsec_mgmt_t to read l2tpd pid content
* Mon Jul 08 2013 Miroslav Grepl 3.12.1-60- Allow nsd_t to read /dev/urand- Allow mdadm_t to read framebuffer- Allow rabbitmq_beam_t to read process info on rabbitmq_epmd_t- Allow mozilla_plugin_config_t to create tmp files- Cleanup openvswitch policy- Allow mozilla plugin to getattr on all executables- Allow l2tpd_t to create fifo_files in /var/run- Allow samba to touch/manage fifo_files or sock_files in a samba_share_t directory- Allow mdadm to connecto its own unix_stream_socket- FIXME: nagios changed locations to /log/nagios which is wrong. But we need to have this workaround for now.- Allow apache to access smokeping pid files- Allow rabbitmq_beam_t to getattr on all filesystems- Add systemd support for iodined- Allow nup_upsdrvctl_t to execute its entrypoint- Allow fail2ban_client to write to fail2ban_var_run_t, Also allow it to use nsswitch- add labeling for ~/.cache/libvirt-sandbox- Add interface to allow domains transitioned to by confined users to send sigchld to screen program- Allow sysadm_t to check the system status of files labeled etc_t, /etc/fstab- Allow systemd_localed to start /usr/lib/systemd/system/systemd-vconsole-setup.service- Allow an domain that has an entrypoint from a type to be allowed to execute the entrypoint without a transition, I can see no case where this is a bad thing, and elminiates a whole class of AVCs.- Allow staff to getsched all domains, required to run htop- Add port definition for redis port- fix selinuxuser_use_ssh_chroot boolean
* Wed Jul 03 2013 Miroslav Grepl 3.12.1-59- Add prosody policy written by Michael Scherer- Allow nagios plugins to read /sys info- ntpd needs to manage own log files- Add support for HOME_DIR/.IBMERS- Allow iptables commands to read firewalld config- Allow consolekit_t to read utmp- Fix filename transitions on .razor directory- Add additional fixes to make DSPAM with LDA working- Allow snort to read /etc/passwd- Allow fail2ban to communicate with firewalld over dbus- Dontaudit openshift_cgreoup_file_t read/write leaked dev- Allow nfsd to use mountd port- Call th proper interface- Allow openvswitch to read sys and execute plymouth- Allow tmpwatch to read /var/spool/cups/tmp- Add support for /usr/libexec/telepathy-rakia- Add systemd support for zoneminder- Allow mysql to create files/directories under /var/log/mysql- Allow zoneminder apache scripts to rw zoneminder tmpfs- Allow httpd to manage zoneminder lib files- Add zoneminder_run_sudo boolean to allow to start zoneminder- Allow zoneminder to send mails- gssproxy_t sock_file can be under /var/lib- Allow web domains to connect to whois port.- Allow sandbox_web_type to connect to the same ports as mozilla_plugin_t.- We really need to add an interface to corenet to define what a web_client_domain is and- then define chrome_sandbox_t, mozilla_plugin_t and sandbox_web_type to that domain.- Add labeling for cmpiLMI_LogicalFile-cimprovagt- Also make pegasus_openlmi_logicalfile_t as unconfined to have unconfined_domain attribute for filename trans rules- Update policy rules for pegasus_openlmi_logicalfile_t- Add initial types for logicalfile/unconfined OpenLMI providers- mailmanctl needs to read own log- Allow logwatch manage own lock files- Allow nrpe to read meminfo- Allow httpd to read certs located in pki-ca- Add pki_read_tomcat_cert() interface- Add support for nagios openshift plugins- Add port definition for redis port- fix selinuxuser_use_ssh_chroot boolean
* Fri Jun 28 2013 Miroslav Grepl 3.12.1-58- Shrink the size of policy by moving to attributes, also add dridomain so that mozilla_plugin can follow selinuxuse_dri boolean. - Allow bootloader to manage generic log files - Allow ftp to bind to port 989 - Fix label of new gear directory - Add support for new directory /var/lib/openshift/gears/ - Add openshift_manage_lib_dirs() - allow virtd domains to manage setrans_var_run_t - Allow useradd to manage all openshift content - Add support so that mozilla_plugin_t can use dri devices - Allow chronyd to change the scheduler - Allow apmd to shut downthe system - Devicekit_disk_t needs to manage /etc/fstab
* Wed Jun 26 2013 Miroslav Grepl 3.12.1-57- Make DSPAM to act as a LDA working- Allow ntop to create netlink socket- Allow policykit to send a signal to policykit-auth- Allow stapserver to dbus chat with avahi/systemd-logind- Fix labeling on haproxy unit file- Clean up haproxy policy- A new policy for haproxy and placed it to rhcs.te- Add support for ldirectord and treat it with cluster_t- Make sure anaconda log dir is created with var_log_t
* Mon Jun 24 2013 Miroslav Grepl 3.12.1-56- Allow lvm_t to create default targets for filesystem handling- Fix labeling for razor-lightdm binaries- Allow insmod_t to read any file labeled var_lib_t- Add policy for pesign- Activate policy for cmpiLMI_Account-cimprovagt- Allow isnsd syscall=listen- /usr/libexec/pegasus/cimprovagt needs setsched caused by sched_setscheduler- Allow ctdbd to use udp/4379- gatherd wants sys_nice and setsched- Add support for texlive2012- Allow NM to read file_t (usb stick with no labels used to transfer keys for example)- Allow cobbler to execute apache with domain transition
* Fri Jun 21 2013 Miroslav Grepl 3.12.1-55- condor_collector uses tcp/9000- Label /usr/sbin/virtlockd as virtd_exec_t for now- Allow cobbler to execute ldconfig- Allow NM to execute ssh- Allow mdadm to read /dev/crash- Allow antivirus domains to connect to snmp port- Make amavisd-snmp working correctly- Allow nfsd_t to mounton nfsd_fs_t- Add initial snapper policy- We still need to have consolekit policy- Dontaudit firefox attempting to connect to the xserver_port_t if run within sandbox_web_t- Dontaudit sandbox apps attempting to open user_devpts_t- Allow dirsrv to read network state- Fix pki_read_tomcat_lib_files- Add labeling for /usr/libexec/nm-ssh-service- Add label cert_t for /var/lib/ipa/pki-ca/publish- Lets label /sys/fs/cgroup as cgroup_t for now, to keep labels consistant- Allow nfsd_t to mounton nfsd_fs_t- Dontaudit sandbox apps attempting to open user_devpts_t- Allow passwd_t to change role to system_r from unconfined_r
* Wed Jun 19 2013 Miroslav Grepl 3.12.1-54- Don\'t audit access checks by sandbox xserver on xdb var_lib- Allow ntop to read usbmon devices- Add labeling for new polcykit authorizor- Dontaudit access checks from fail2ban_client- Don\'t audit access checks by sandbox xserver on xdb var_lib- Allow apps that connect to xdm stream to conenct to xdm_dbusd_t stream- Fix labeling for all /usr/bim/razor-lightdm-
* binaries- Add filename trans for /dev/md126p1
* Tue Jun 18 2013 Miroslav Grepl 3.12.1-53- Make vdagent able to request loading kernel module- Add support for cloud-init make it as unconfined domain- Allow snmpd to run smartctl in fsadm_t domain- remove duplicate openshift_search_lib() interface- Allow mysqld to search openshift lib files- Allow openshift cgroup to interact with passedin file descriptors- Allow colord to list directories inthe users homedir- aide executes prelink to check files- Make sure cupsd_t creates content in /etc/cups with the correct label- Lest dontaudit apache read all domains, so passenger will not cause this avc- Allow gssd to connect to gssproxy- systemd-tmpfiles needs to be able to raise the level to fix labeling on /run/setrans in MLS- Allow systemd-tmpfiles to relabel also lock files- Allow useradd to add homdir in /var/lib/openshift- Allow setfiles and semanage to write output to /run/files
* Fri Jun 14 2013 Miroslav Grepl 3.12.1-52- Add labeling for /dev/tgt- Dontaudit leak fd from firewalld for modprobe- Allow runuser running as rpm_script_t to create netlink_audit socket- Allow mdadm to read BIOS non-volatile RAM
* Thu Jun 13 2013 Miroslav Grepl 3.12.1-51- accountservice watches when accounts come and go in wtmp- /usr/java/jre1.7.0_21/bin/java needs to create netlink socket- Add httpd_use_sasl boolean- Allow net_admin for tuned_t- iscsid needs sys_module to auto-load kernel modules- Allow blueman to read bluetooth conf- Add nova_manage_lib_files() interface- Fix mplayer_filetrans_home_content()- Add mplayer_filetrans_home_content()- mozilla_plugin_config_roles need to be able to access mozilla_plugin_config_t- Revert \"Allow thumb_t to append inherited xdm stream socket\"- Add iscsi_filetrans_named_content() interface- Allow to create .mplayer with the correct labeling for unconfined- Allow iscsiadmin to create lock file with the correct labeling
* Tue Jun 11 2013 Miroslav Grepl 3.12.1-50- Allow wine to manage wine home content- Make amanda working with socket actiovation- Add labeling for /usr/sbin/iscsiadm- Add support for /var/run/gssproxy.sock- dnsmasq_t needs to read sysctl_net_t
* Fri Jun 07 2013 Miroslav Grepl 3.12.1-49- Fix courier_domain_template() interface- Allow blueman to write ip_forward- Allow mongodb to connect to mongodb port- Allow mongodb to connect to mongodb port- Allow java to bind jobss_debug port- Fixes for
*_admin interfaces- Allow iscsid auto-load kernel modules needed for proper iSCSI functionality- Need to assign attribute for courier_domain to all courier_domains- Fail2ban reads /etc/passwd- postfix_virtual will create new files in postfix_spool_t- abrt triggers sys_ptrace by running pidof- Label ~/abc as mozilla_home_t, since java apps as plugin want to create it- Add passenger fixes needed by foreman- Remove dup interfaces- Add additional interfaces for quantum- Add new interfaces for dnsmasq- Allow passenger to read localization and send signull to itself- Allow dnsmasq to stream connect to quantum- Add quantum_stream_connect()- Make sure that mcollective starts the service with the correct labeling- Add labels for ~/.manpath- Dontaudit attempts by svirt_t to getpw
* calls- sandbox domains are trying to look at parent process data- Allow courior auth to create its pid file in /var/spool/courier subdir- Add fixes for beam to have it working with couchdb- Add labeling for /run/nm-xl2tpd.con- Allow apache to stream connect to thin- Add systemd support for amand- Make public types usable for fs mount points- Call correct mandb interface in domain.te- Allow iptables to r/w quantum inherited pipes and send sigchld- Allow ifconfig domtrans to iptables and execute ldconfig- Add labels for ~/.manpath- Allow systemd to read iscsi lib files- seunshare is trying to look at parent process data
* Mon Jun 03 2013 Miroslav Grepl 3.12.1-48- Fix openshift_search_lib- Add support for abrt-uefioops-oops- Allow colord to getattr any file system- Allow chrome processes to look at each other- Allow sys_ptrace for abrt_t- Add new policy for gssproxy- Dontaudit leaked file descriptor writes from firewalld- openshift_net_type is interface not template- Dontaudit pppd to search gnome config- Update openshift_search_lib() interface- Add fs_list_pstorefs()- Fix label on libbcm_host.so since it is built incorrectly on raspberry pi, needs back port to F18- Better labels for raspberry pi devices- Allow init to create devpts_t directory- Temporarily label rasbery pi devices as memory_device_t, needs back port to f18- Allow sysadm_t to build kernels- Make sure mount creates /var/run/blkid with the correct label, needs back port to F18- Allow userdomains to stream connect to gssproxy- Dontaudit leaked file descriptor writes from firewalld- Allow xserver to read /dev/urandom- Add additional fixes for ipsec-mgmt- Make SSHing into an Openshift Enterprise Node working
* Wed May 29 2013 Miroslav Grepl 3.12.1-47- Add transition rules to unconfined domains and to sysadm_t to create /etc/adjtime- with the proper label.- Update files_filetrans_named_content() interface to get right labeling for pam.d conf files- Allow systemd-timedated to create adjtime- Add clock_create_adjtime()- Additional fix ifconfing for #966106- Allow kernel_t to create boot.log with correct labeling- Remove unconfined_mplayer for which we don\'t have rules- Rename interfaces- Add userdom_manage_user_home_files/dirs interfaces- Fix files_dontaudit_read_all_non_security_files- Fix ipsec_manage_key_file()- Fix ipsec_filetrans_key_file()- Label /usr/bin/razor-lightdm-greeter as xdm_exec_t instead of spamc_exec_t- Fix labeling for ipse.secrets- Add interfaces for ipsec and labeling for ipsec.info and ipsec_setup.pid- Add files_dontaudit_read_all_non_security_files() interface- /var/log/syslog-ng should be labeled var_log_t- Make ifconfig_var_run_t a mountpoint- Add transition from ifconfig to dnsmasq- Allow ifconfig to execute bin_t/shell_exec_t- We want to have hwdb.bin labeled as etc_t- update logging_filetrans_named_content() interface- Allow systemd_timedate_t to manage /etc/adjtime- Allow NM to send signals to l2tpd- Update antivirus_can_scan_system boolean- Allow devicekit_disk_t to sys_config_tty- Run abrt-harvest programs as abrt_t, and allow abrt_t to list all filesystem directories- Make printing from vmware working- Allow php-cgi from php54 collection to access /var/lib/net-snmp/mib_indexes- Add virt_qemu_ga_data_t for qemu-ga- Make chrome and mozilla able to connect to same ports, add jboss_management_port_t to both- Fix typo in virt.te- Add virt_qemu_ga_unconfined_t for hook scripts- Make sure NetworkManager files get created with the correct label- Add mozilla_plugin_use_gps boolean- Fix cyrus to have support for net-snmp- Additional fixes for dnsmasq and quantum for #966106- Add plymouthd_create_log()- remove httpd_use_oddjob for which we don\'t have rules- Add missing rules for httpd_can_network_connect_cobbler- Add missing cluster_use_execmem boolean- Call userdom_manage_all_user_home_type_files/dirs- Additional fix for ftp_home_dir- Fix ftp_home_dir boolean- Allow squit to recv/send client squid packet- Fix nut.te to have nut_domain attribute- Add support for ejabberd; TODO: revisit jabberd and rabbit policy- Fix amanda policy- Add more fixes for domains which use libusb- Make domains which use libusb working correctly- Allow l2tpd to create ipsec key files with correct labeling and manage them- Fix cobbler_manage_lib_files/cobbler_read_lib_files to cover also lnk files- Allow rabbitmq-beam to bind generic node- Allow l2tpd to read ipse-mgmt pid files- more fixes for l2tpd, NM and pppd from #967072
* Wed May 22 2013 Miroslav Grepl 3.12.1-46- Dontaudit to getattr on dirs for dovecot-deliver- Allow raiudusd server connect to postgresql socket- Add kerberos support for radiusd- Allow saslauthd to connect to ldap port- Allow postfix to manage postfix_private_t files- Add chronyd support for #965457- Fix labeling for HOME_DIR/\\.icedtea- CHange squid and snmpd to be allowed also write own logs- Fix labeling for /usr/libexec/qemu-ga- Allow virtd_t to use virt_lock_t- Allow also sealert to read the policy from the kernel- qemu-ga needs to execute scripts in /usr/libexec/qemu-ga and to use /tmp content- Dontaudit listing of users homedir by sendmail Seems like a leak- Allow passenger to transition to puppet master- Allow apache to connect to mythtv- Add definition for mythtv ports
* Fri May 17 2013 Miroslav Grepl 3.12.1-45- Add additional fixes for #948073 bug- Allow sge_execd_t to also connect to sge ports- Allow openshift_cron_t to manage openshift_var_lib_t sym links- Allow openshift_cron_t to manage openshift_var_lib_t sym links- Allow sge_execd to bind sge ports. Allow kill capability and reads cgroup files- Remove pulseaudio filetrans pulseaudio_manage_home_dirs which is a part of pulseaudio_manage_home_files- Add networkmanager_stream_connect()- Make gnome-abrt wokring with staff_t- Fix openshift_manage_lib_files() interface- mdadm runs ps command which seems to getattr on random log files- Allow mozilla_plugin_t to create pulseaudit_home_t directories- Allow qemu-ga to shutdown virtual hosts- Add labelling for cupsd-browsed- Add web browser plugins to connect to aol ports- Allow nm-dhcp-helper to stream connect to NM- Add port definition for sge ports
* Mon May 13 2013 Miroslav Grepl 3.12.1-44- Make sure users and unconfined domains create .hushlogin with the correct label- Allow pegaus to chat with realmd over DBus- Allow cobblerd to read network state- Allow boicn-client to stat on /dev/input/mice- Allow certwatch to read net_config_t when it executes apache- Allow readahead to create /run/systemd and then create its own directory with the correct label
* Mon May 13 2013 Miroslav Grepl 3.12.1-43- Transition directories and files when in a user_tmp_t directory- Change certwatch to domtrans to apache instead of just execute- Allow virsh_t to read xen lib files- update policy rules for pegasus_openlmi_account_t- Add support for svnserve_tmp_t- Activate account openlmi policy- pegasus_openlmi_domain_template needs also require pegasus_t- One more fix for policykit.te- Call fs_list_cgroups_dirs() in policykit.te- Allow nagios service plugin to read mysql config files- Add labeling for /var/svn- Fix chrome.te- Fix pegasus_openlmi_domain_template() interfaces- Fix dev_rw_vfio_dev definiton, allow virtd_t to read tmpfs_t symlinks- Fix location of google-chrome data- Add support for chome_sandbox to store content in the homedir- Allow policykit to watch for changes in cgroups file system- Add boolean to allow mozilla_plugin_t to use spice- Allow collectd to bind to udp port- Allow collected_t to read all of /proc- Should use netlink socket_perms- Should use netlink socket_perms- Allow glance domains to connect to apache ports- Allow apcupsd_t to manage its log files- Allow chrome objects to rw_inherited unix_stream_socket from callers- Allow staff_t to execute virtd_exec_t for running vms- nfsd_t needs to bind mountd port to make nfs-mountd.service working- Allow unbound net_admin capability because of setsockopt syscall- Fix fs_list_cgroup_dirs()- Label /usr/lib/nagios/plugins/utils.pm as bin_t- Remove uplicate definition of fs_read_cgroup_files()- Remove duplicate definition of fs_read_cgroup_files()- Add files_mountpoint_filetrans interface to be used by quotadb_t and snapperd- Additional interfaces needed to list and read cgroups config- Add port definition for collectd port- Add labels for /dev/ptp
*- Allow staff_t to execute virtd_exec_t for running vms
* Mon May 06 2013 Miroslav Grepl 3.12.1-42- Allow samba-net to also read realmd tmp files- Allow NUT to use serial ports- realmd can be started by systemctl now
* Mon May 06 2013 Miroslav Grepl 3.12.1-41- Remove userdom_home_manager for xdm_t and move all rules to xserver.te directly- Add new xdm_write_home boolean to allow xdm_t to create files in HOME dirs with xdm_home_t- Allow postfix-showq to read/write unix.showq in /var/spool/postfix/pid- Allow virsh to read xen lock file- Allow qemu-ga to create files in /run with proper labeling- Allow glusterd to connect to own socket in /tmp- Allow glance-api to connect to http port to make glance image-create working- Allow keystonte_t to execute rpm
* Fri May 03 2013 Miroslav Grepl 3.12.1-40- Fix realmd cache interfaces
* Fri May 03 2013 Miroslav Grepl 3.12.1-39- Allow tcpd to execute leafnode- Allow samba-net to read realmd cache files- Dontaudit sys_tty_config for alsactl- Fix allow rules for postfix_var_run- Allow cobblerd to read /etc/passwd- Allow pegasus to read exports- Allow systemd-timedate to read xdm state- Allow mout to stream connect to rpcbind- Add labeling just for /usr/share/pki/ca-trust-source instead of /usr/share/pki
* Tue Apr 30 2013 Miroslav Grepl 3.12.1-38- Allow thumbnails to share memory with apps which run thumbnails- Allow postfix-postqueue block_suspend- Add lib interfaces for smsd- Add support for nginx- Allow s2s running as jabberd_t to connect to jabber_interserver_port_t- Allow pki apache domain to create own tmp files and execute httpd_suexec- Allow procmail to manger user tmp files/dirs/lnk_files- Add virt_stream_connect_svirt() interface- Allow dovecot-auth to execute bin_t- Allow iscsid to request that kernel load a kernel module- Add labeling support for /var/lib/mod_security- Allow iw running as tuned_t to create netlink socket- Dontaudit sys_tty_config for thumb_t- Add labeling for nm-l2tp-service- Allow httpd running as certwatch_t to open tcp socket- Allow useradd to manager smsd lib files- Allow useradd_t to add homedirs in /var/lib- Fix typo in userdomain.te- Cleanup userdom_read_home_certs- Implement userdom_home_reader_certs_type to allow read certs also on encrypt /home with ecryptfs_t- Allow staff to stream connect to svirt_t to make gnome-boxes working
* Fri Apr 26 2013 Miroslav Grepl 3.12.1-37- Allow lvm to create its own unit files- Label /var/lib/sepolgen as selinux_config_t- Add filetrans rules for tw devices- Add transition from cupsd_config_t to cupsd_t
* Wed Apr 24 2013 Miroslav Grepl 3.12.1-36- Add filetrans rules for tw devices- Cleanup bad transition lines
* Tue Apr 23 2013 Miroslav Grepl 3.12.1-35- Fix lockdev_manage_files()- Allow setroubleshootd to read var_lib_t to make email_alert working- Add lockdev_manage_files()- Call proper interface in virt.te- Allow gkeyring_domain to create /var/run/UID/config/dbus file- system dbus seems to be blocking suspend- Dontaudit attemps to sys_ptrace, which I believe gpsd does not need- When you enter a container from root, you generate avcs with a leaked file descriptor- Allow mpd getattr on file system directories- Make sure realmd creates content with the correct label- Allow systemd-tty-ask to write kmsg- Allow mgetty to use lockdev library for device locking- Fix selinuxuser_user_share_music boolean name to selinuxuser_share_music- When you enter a container from root, you generate avcs with a leaked file descriptor- Make sure init.fc files are labeled correctly at creation- File name trans vconsole.conf- Fix labeling for nagios plugins- label shared libraries in /opt/google/chrome as testrel_shlib_t
* Thu Apr 18 2013 Miroslav Grepl 3.12.1-34- Allow certmonger to dbus communicate with realmd - Make realmd working
* Thu Apr 18 2013 Miroslav Grepl 3.12.1-33- Fix mozilla specification of homedir content- Allow certmonger to read network state- Allow tmpwatch to read tmp in /var/spool/{cups,lpd}- Label all nagios plugin as unconfined by default- Add httpd_serve_cobbler_files()- Allow mdadm to read /dev/sr0 and create tmp files- Allow certwatch to send mails- Fix labeling for nagios plugins- label shared libraries in /opt/google/chrome as testrel_shlib_t
* Wed Apr 17 2013 Miroslav Grepl 3.12.1-32- Allow realmd to run ipa, really needs to be an unconfined_domain- Allow sandbox domains to use inherted terminals- Allow pscd to use devices labeled svirt_image_t in order to use cat cards.- Add label for new alsa pid- Alsa now uses a pid file and needs to setsched - Fix oracleasmfs_t definition- Add support for sshd_unit_file_t- Add oracleasmfs_t- Allow unlabeled_t files to be stored on unlabeled_t filesystems
* Tue Apr 16 2013 Miroslav Grepl 3.12.1-31- Fix description of deny_ptrace boolean- Remove allow for execmod lib_t for now- Allow quantum to connect to keystone port- Allow nova-console to talk with mysql over unix stream socket- Allow dirsrv to stream connect to uuidd- thumb_t needs to be able to create ~/.cache if it does not exist- virtd needs to be able to sys_ptrace when starting and stoping containers
* Mon Apr 15 2013 Miroslav Grepl 3.12.1-30- Allow alsa_t signal_perms, we probaly should search for any app that can execute something without transition and give it signal_perms...- Add dontaudit for mozilla_plugin_t looking at the xdm_t sockets- Fix deny_ptrace boolean, certain ptrace leaked into the system- Allow winbind to manage kerberos_rcache_host- Allow spamd to create spamd_var_lib_t directories- Remove transition to mozilla_tmp_t by mozilla_t, to allow it to manage the users tmp dirs- Add mising nslcd_dontaudit_write_sock_file() interface- one more fix- Fix pki_read_tomcat_lib_files() interface- Allow certmonger to read pki-tomcat lib files- Allow certwatch to execute bin_t- Allow snmp to manage /var/lib/net-snmp files- Call snmp_manage_var_lib_files(fogorn_t) instead of snmp_manage_var_dirs- Fix vmware_role() interface- Fix cobbler_manage_lib_files() interface- Allow nagios check disk plugins to execute bin_t- Allow quantum to transition to openvswitch_t- Allow postdrop to stream connect to postfix-master- Allow quantum to stream connect to openvswitch- Add xserver_dontaudit_xdm_rw_stream_sockets() interface- Allow daemon to send dgrams to initrc_t- Allow kdm to start the power service to initiate a reboot or poweroff
* Thu Apr 11 2013 Miroslav Grepl 3.12.1-29- Add mising nslcd_dontaudit_write_sock_file() interface- one more fix- Fix pki_read_tomcat_lib_files() interface- Allow certmonger to read pki-tomcat lib files- Allow certwatch to execute bin_t- Allow snmp to manage /var/lib/net-snmp files- Don\'t audit attempts to write to stream socket of nscld by thumbnailers- Allow git_system_t to read network state- Allow pegasas to execute mount command- Fix desc for drdb_admin- Fix condor_amin()- Interface fixes for uptime, vdagent, vnstatd- Fix labeling for moodle in /var/www/moodle/data- Add interface fixes- Allow bugzilla to read certs- /var/www/moodle needs to be writable by apache- Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest- Fix namespace_init_t to create content with proper labels, and allow it to manage all user content- Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean- Fixes for dlm_controld- Fix apache_read_sys_content_rw_dirs() interface- Allow logrotate to read /var/log/z-push dir- Fix sys_nice for cups_domain- Allow postfix_postdrop to acces postfix_public socket- Allow sched_setscheduler for cupsd_t- Add missing context for /usr/sbin/snmpd- Kernel_t needs mac_admin in order to support labeled NFS- Fix systemd_dontaudit_dbus_chat() interface- Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest- Allow consolehelper domain to write Xauth files in /root- Add port definition for osapi_compute port- Allow unconfined to create /etc/hostname with correct labeling- Add systemd_filetrans_named_hostname() interface
* Mon Apr 08 2013 Dan Walsh 3.12.1-28- Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean- Fixes for dlm_controld- Fix apache_read_sys_content_rw_dirs() interface- Allow logrotate to read /var/log/z-push dir- Allow postfix_postdrop to acces postfix_public socket- Allow sched_setscheduler for cupsd_t- Add missing context for /usr/sbin/snmpd- Allow consolehelper more access discovered by Tom London- Allow fsdaemon to send signull to all domain- Add port definition for osapi_compute port- Allow unconfined to create /etc/hostname with correct labeling- Add systemd_filetrans_named_hostname() interface
* Sat Apr 06 2013 Dan Walsh 3.12.1-27- Fix file_contexts.subs to label /run/lock correctly
* Fri Apr 05 2013 Miroslav Grepl 3.12.1-26- Try to label on controlC devices up to 30 correctly- Add mount_rw_pid_files() interface- Add additional mount/umount interfaces needed by mock- fsadm_t sends audit messages in reads kernel_ipc_info when doing livecd-iso-to-disk- Fix tabs- Allow initrc_domain to search rgmanager lib files- Add more fixes which make mock working together with confined users
* Allow mock_t to manage rpm files
* Allow mock_t to read rpm log files
* Allow mock to setattr on tmpfs, devpts
* Allow mount/umount filesystems- Add rpm_read_log() interface- yum-cron runs rpm from within it.- Allow tuned to transition to dmidecode- Allow firewalld to do net_admin- Allow mock to unmont tmpfs_t- Fix virt_sigkill() interface- Add additional fixes for mock. Mainly caused by mount running in mock_t- Allow mock to write sysfs_t and mount pid files- Add mailman_domain to mailman_template()- Allow openvswitch to execute shell- Allow qpidd to use kerberos- Allow mailman to use fusefs, needs back port to RHEL6- Allow apache and its scripts to use anon_inodefs- Add alias for git_user_content_t and git_sys_content_t so that RHEL6 will update to RHEL7- Realmd needs to connect to samba ports, needs back port to F18 also- Allow colord to read /run/initial-setup-- Allow sanlock-helper to send sigkill to virtd which is registred to sanlock- Add virt_kill() interface- Add rgmanager_search_lib() interface- Allow wdmd to getattr on all filesystems. Back ported from RHEL6
* Tue Apr 02 2013 Miroslav Grepl 3.12.1-25- Allow realmd to create tmp files- FIx ircssi_home_t type to irssi_home_t- Allow adcli running as realmd_t to connect to ldap port- Allow NetworkManager to transition to ipsec_t, for running strongswan- Make openshift_initrc_t an lxc_domain- Allow gssd to manage user_tmp_t files- Fix handling of irclogs in users homedir- Fix labeling for drupal an wp-content in subdirs of /var/www/html- Allow abrt to read utmp_t file- Fix openshift policy to transition lnk_file, sock-file an fifo_file when created in a tmpfs_t, needs back port to RHEL6- fix labeling for (oo|rhc)-restorer-wrapper.sh- firewalld needs to be able to write to network sysctls- Fix mozilla_plugin_dontaudit_rw_sem() interface- Dontaudit generic ipc read/write to a mozilla_plugin for sandbox_x domains- Add mozilla_plugin_dontaudit_rw_sem() interface- Allow svirt_lxc_t to transition to openshift domains- Allow condor domains block_suspend and dac_override caps- Allow condor_master to read passd- Allow condor_master to read system state- Allow NetworkManager to transition to ipsec_t, for running strongswan- Lots of access required by lvm_t to created encrypted usb device- Allow xdm_t to dbus communicate with systemd_localed_t- Label strongswan content as ipsec_exec_mgmt_t for now- Allow users to dbus chat with systemd_localed- Fix handling of .xsession-errors in xserver.if, so kde will work- Might be a bug but we are seeing avc\'s about people status on init_t:service- Make sure we label content under /var/run/lock as <>- Allow daemon and systemprocesses to search init_var_run_t directory- Add boolean to allow xdm to write xauth data to the home directory- Allow mount to write keys for the unconfined domain- Add unconfined_write_keys() interface
* Tue Mar 26 2013 Miroslav Grepl 3.12.1-24- Add labeling for /usr/share/pki- Allow programs that read var_run_t symlinks also read var_t symlinks- Add additional ports as mongod_port_t for 27018, 27019, 28017, 28018 and 28019 ports- Fix labeling for /etc/dhcp directory- add missing systemd_stub_unit_file() interface- Add files_stub_var() interface- Add lables for cert_t directories- Make localectl set-x11-keymap working at all- Allow abrt to manage mock build environments to catch build problems.- Allow virt_domains to setsched for running gdb on itself- Allow thumb_t to execute user home content- Allow pulseaudio running as mozilla_plugin_t to read /run/systemd/users/1000- Allow certwatch to execut /usr/bin/httpd- Allow cgred to send signal perms to itself, needs back port to RHEL6- Allow openshift_cron_t to look at quota- Allow cups_t to read inhered tmpfs_t from the kernel- Allow yppasswdd to use NIS- Tuned wants sys_rawio capability- Add ftpd_use_fusefs boolean- Allow dirsrvadmin_t to signal itself
* Wed Mar 20 2013 Miroslav Grepl 3.12.1-23- Allow localectl to read /etc/X11/xorg.conf.d directory- Revert \"Revert \"Fix filetrans rules for kdm creates .xsession-errors\"\"- Allow mount to transition to systemd_passwd_agent- Make sure abrt directories are labeled correctly- Allow commands that are going to read mount pid files to search mount_var_run_t- label /usr/bin/repoquery as rpm_exec_t- Allow automount to block suspend- Add abrt_filetrans_named_content so that abrt directories get labeled correctly- Allow virt domains to setrlimit and read file_context
* Mon Mar 18 2013 Miroslav Grepl 3.12.1-22- Allow nagios to manage nagios spool files- /var/spool/snmptt is a directory which snmdp needs to write to, needs back port to RHEL6- Add swift_alias.
* policy files which contain typealiases for swift types- Add support for /run/lock/opencryptoki- Allow pkcsslotd chown capability- Allow pkcsslotd to read passwd- Add rsync_stub() interface- Allow systemd_timedate also manage gnome config homedirs- Label /usr/lib64/security/pam_krb5/pam_krb5_cchelper as bin_t- Fix filetrans rules for kdm creates .xsession-errors- Allow sytemd_tmpfiles to create wtmp file- Really should not label content under /var/lock, since it could have labels on it different from var_lock_t- Allow systemd to list all file system directories- Add some basic stub interfaces which will be used in PRODUCT policies
* Wed Mar 13 2013 Miroslav Grepl 3.12.1-21- Fix log transition rule for cluster domains- Start to group all cluster log together- Dont use filename transition for POkemon Advanced Adventure until a new checkpolicy update- cups uses usbtty_device_t devices- These fixes were all required to build a MLS virtual Machine with single level desktops- Allow domains to transiton using httpd_exec_t- Allow svirt domains to manage kernel key rings- Allow setroubleshoot to execute ldconfig- Allow firewalld to read generate gnome data- Allow bluetooth to read machine-info- Allow boinc domain to send signal to itself- Fix gnome_filetrans_home_content() interface- Allow mozilla_plugins to list apache modules, for use with gxine- Fix labels for POkemon in the users homedir- Allow xguest to read mdstat- Dontaudit virt_domains getattr on /dev/
*- These fixes were all required to build a MLS virtual Machine with single level desktops- Need to back port this to RHEL6 for openshift- Add tcp/8891 as milter port- Allow nsswitch domains to read sssd_var_lib_t files- Allow ping to read network state.- Fix typo- Add labels to /etc/X11/xorg.d and allow systemd-timestampd_t to manage them
* Fri Mar 08 2013 Miroslav Grepl 3.12.1-20- Adopt swift changes from lhhAATTredhat.com- Add rhcs_manage_cluster_pid_files() interface- Allow screen domains to configure tty and setup sock_file in ~/.screen directory- ALlow setroubleshoot to read default_context_t, needed to backport to F18- Label /etc/owncloud as being an apache writable directory- Allow sshd to stream connect to an lxc domain
* Thu Mar 07 2013 Miroslav Grepl 3.12.1-19- Allow postgresql to manage rgmanager pid files- Allow postgresql to read ccs data- Allow systemd_domain to send dbus messages to policykit- Add labels for /etc/hostname and /etc/machine-info and allow systemd-hostnamed to create them- All systemd domains that create content are reading the file_context file and setfscreate- Systemd domains need to search through init_var_run_t- Allow sshd to communicate with libvirt to set containers labels- Add interface to manage pid files- Allow NetworkManger_t to read /etc/hostname- Dontaudit leaked locked files into openshift_domains- Add fixes for oo-cgroup-read - it nows creates tmp files- Allow gluster to manage all directories as well as files- Dontaudit chrome_sandbox_nacl_t using user terminals- Allow sysstat to manage its own log files- Allow virtual machines to setrlimit and send itself signals.- Add labeling for /var/run/hplip
* Mon Mar 04 2013 Miroslav Grepl 3.12.1-18- Fix POSTIN scriptlet
* Fri Mar 01 2013 Miroslav Grepl 3.12.1-17- Merge rgmanger, corosync,pacemaker,aisexec policies to cluster_t in rhcs.pp
* Wed Feb 27 2013 Miroslav Grepl 3.12.1-16- Fix authconfig.py labeling- Make any domains that write homedir content do it correctly- Allow glusterd to read/write anyhwere on the file system by default- Be a little more liberal with the rsync log files- Fix iscsi_admin interface- Allow iscsid_t to read /dev/urand- Fix up iscsi domain for use with unit files- Add filename transition support for spamassassin policy- Allow web plugins to use badly formated libraries- Allow nmbd_t to create samba_var_t directories- Add filename transition support for spamassassin policy- Add filename transition support for tvtime- Fix alsa_home_filetrans_alsa_home() interface- Move all userdom_filetrans_home_content() calling out of booleans- Allow logrotote to getattr on all file sytems- Remove duplicate userdom_filetrans_home_content() calling- Allow kadmind to read /etc/passwd- Dontaudit append .xsession-errors file on ecryptfs for policykit-auth- Allow antivirus domain to manage antivirus db links- Allow logrotate to read /sys- Allow mandb to setattr on man dirs- Remove mozilla_plugin_enable_homedirs boolean- Fix ftp_home_dir boolean- homedir mozilla filetrans has been moved to userdom_home_manager- homedir telepathy filetrans has been moved to userdom_home_manager- Remove gnome_home_dir_filetrans() from gnome_role_gkeyringd()- Might want to eventually write a daemon on fusefsd.- Add policy fixes for sshd [net] child from plautrbaAATTredhat.com- Tor uses a new port- Remove bin_t for authconfig.py- Fix so only one call to userdom_home_file_trans- Allow home_manager_types to create content with the correctl label- Fix all domains that write data into the homedir to do it with the correct label- Change the postgresql to use proper boolean names, which is causing httpd_t to- not get access to postgresql_var_run_t- Hostname needs to send syslog messages- Localectl needs to be able to send dbus signals to users- Make sure userdom_filetrans_type will create files/dirs with user_home_t labeling by default- Allow user_home_manger domains to create spam
* homedir content with correct labeling- Allow user_home_manger domains to create HOMEDIR/.tvtime with correct labeling- Add missing miscfiles_setattr_man_pages() interface and for now comment some rules for userdom_filetrans_type to make build process working- Declare userdom_filetrans_type attribute- userdom_manage_home_role() needs to be called withoout usertype attribute because of userdom_filetrans_type attribute- fusefsd is mounding a fuse file system on /run/user/UID/gvfs
* Thu Feb 21 2013 Miroslav Grepl 3.12.1-15- Man pages are now generated in the build process- Allow cgred to list inotifyfs filesystem
* Wed Feb 20 2013 Miroslav Grepl 3.12.1-14- Allow gluster to get attrs on all fs- New access required for virt-sandbox- Allow dnsmasq to execute bin_t- Allow dnsmasq to create content in /var/run/NetworkManager- Fix openshift_initrc_signal() interface- Dontaudit openshift domains doing getattr on other domains- Allow consolehelper domain to communicate with session bus- Mock should not be transitioning to any other domains, we should keep mock_t as mock_t- Update virt_qemu_ga_t policy- Allow authconfig running from realmd to restart oddjob service- Add systemd support for oddjob- Add initial policy for realmd_consolehelper_t which if for authconfig executed by realmd- Add labeling for gnashpluginrc- Allow chrome_nacl to execute /dev/zero- Allow condor domains to read /proc- mozilla_plugin_t will getattr on /core if firefox crashes- Allow condor domains to read /etc/passwd- Allow dnsmasq to execute shell scripts, openstack requires this access- Fix glusterd labeling- Allow virtd_t to interact with the socket type- Allow nmbd_t to override dac if you turned on sharing all files- Allow tuned to created kobject_uevent socket- Allow guest user to run fusermount- Allow openshift to read /proc and locale- Allow realmd to dbus chat with rpm- Add new interface for virt- Remove depracated interfaces- Allow systemd_domains read access on etc, etc_runtime and usr files, also allow them to connect stream to syslog socket- /usr/share/munin/plugins/plugin.sh should be labeled as bin_t- Remove some more unconfined_t process transitions, that I don\'t believe are necessary- Stop transitioning uncofnined_t to checkpc- dmraid creates /var/lock/dmraid- Allow systemd_localed to creatre unix_dgram_sockets- Allow systemd_localed to write kernel messages.- Also cleanup systemd definition a little.- Fix userdom_restricted_xwindows_user_template() interface- Label any block devices or char devices under /dev/infiniband as fixed_disk_device_t- User accounts need to dbus chat with accountsd daemon- Gnome requires all users to be able to read /proc/1/
* Thu Feb 14 2013 Miroslav Grepl 3.12.1-13- virsh now does a setexeccon call- Additional rules required by openshift domains- Allow svirt_lxc_domains to use inherited terminals, needed to make virt-sandbox-service execute work- Allow spamd_update_t to search spamc_home_t- Avcs discovered by mounting an isci device under /mnt- Allow lspci running as logrotate to read pci.ids- Additional fix for networkmanager_read_pid_files()- Fix networkmanager_read_pid_files() interface- Allow all svirt domains to connect to svirt_socket_t- Allow virsh to set SELinux context for a process.- Allow tuned to create netlink_kobject_uevent_socket- Allow systemd-timestamp to set SELinux context- Add support for /var/lib/systemd/linger- Fix ssh_sysadm_login to be working on MLS as expected
* Mon Feb 11 2013 Miroslav Grepl 3.12.1-12- Rename files_rw_inherited_tmp_files to files_rw_inherited_tmp_file- Add missing files_rw_inherited_tmp_files interface- Add additional interface for ecryptfs- ALlow nova-cert to connect to postgresql- Allow keystone to connect to postgresql- Allow all cups domains to getattr on filesystems- Allow pppd to send signull- Allow tuned to execute ldconfig- Allow gpg to read fips_enabled- Add additional fixes for ecryptfs- Allow httpd to work with posgresql- Allow keystone getsched and setsched
* Fri Feb 08 2013 Miroslav Grepl 3.12.1-11- Allow gpg to read fips_enabled- Add support for /var/cache/realmd- Add support for /usr/sbin/blazer_usb and systemd support for nut- Add labeling for fenced_sanlock and allow sanclok transition to fenced_t- bitlbee wants to read own log file- Allow glance domain to send a signal itself- Allow xend_t to request that the kernel load a kernel module- Allow pacemaker to execute heartbeat lib files- cleanup new swift policy
* Tue Feb 05 2013 Miroslav Grepl 3.12.1-10- Fix smartmontools- Fix userdom_restricted_xwindows_user_template() interface- Add xserver_xdm_ioctl_log() interface- Allow Xusers to ioctl lxdm.log to make lxdm working- Add MLS fixes to make MLS boot/log-in working- Add mls_socket_write_all_levels() also for syslogd- fsck.xfs needs to read passwd- Fix ntp_filetrans_named_content calling in init.te- Allow postgresql to create pg_log dir- Allow sshd to read rsync_data_t to make rsync working- Change ntp.conf to be labeled net_conf_t- Allow useradd to create homedirs in /run. ircd-ratbox does this and we should just allow it- Allow xdm_t to execute gstreamer home content- Allod initrc_t and unconfined domains, and sysadm_t to manage ntp- New policy for openstack swift domains- More access required for openshift_cron_t- Use cupsd_log_t instead of cupsd_var_log_t- rpm_script_roles should be used in rpm_run- Fix rpm_run() interface- Fix openshift_initrc_run()- Fix sssd_dontaudit_stream_connect() interface- Fix sssd_dontaudit_stream_connect() interface- Allow LDA\'s job to deliver mail to the mailbox- dontaudit block_suspend for mozilla_plugin_t- Allow l2tpd_t to all signal perms- Allow uuidgen to read /dev/random- Allow mozilla-plugin-config to read power_supply info- Implement cups_domain attribute for cups domains- We now need access to user terminals since we start by executing a command outside the tty- We now need access to user terminals since we start by executing a command outside the tty- svirt lxc containers want to execute userhelper apps, need these changes to allow this to happen- Add containment of openshift cron jobs- Allow system cron jobs to create tmp directories- Make userhelp_conf_t a config file- Change rpm to use rpm_script_roles- More fixes for rsync to make rsync wokring- Allow logwatch to domtrans to mdadm- Allow pacemaker to domtrans to ifconfig- Allow pacemaker to setattr on corosync.log- Add pacemaker_use_execmem for memcheck-amd64 command- Allow block_suspend capability- Allow create fifo_file in /tmp with pacemaker_tmp_t- Allow systat to getattr on fixed disk- Relabel /etc/ntp.conf to be net_conf_t- ntp_admin should create files in /etc with the correct label- Add interface to create ntp_conf_t files in /etc- Add additional labeling for quantum- Allow quantum to execute dnsmasq with transition
* Wed Jan 30 2013 Miroslav Grepl 3.12.1-9- boinc_cliean wants also execmem as boinc projecs have- Allow sa-update to search admin home for /root/.spamassassin- Allow sa-update to search admin home for /root/.spamassassin- Allow antivirus domain to read net sysctl- Dontaudit attempts from thumb_t to connect to ssd- Dontaudit attempts by readahead to read sock_files- Dontaudit attempts by readahead to read sock_files- Create tmpfs file while running as wine as user_tmpfs_t- Dontaudit attempts by readahead to read sock_files- libmpg ships badly created librarie
* Mon Jan 28 2013 Miroslav Grepl 3.12.1-8- Change ssh_use_pts to use macro and only inherited sshd_devpts_t- Allow confined users to read systemd_logind seat information- libmpg ships badly created libraries- Add support for strongswan.service- Add labeling for strongswan- Allow l2tpd_t to read network manager content in /run directory- Allow rsync to getattr any file in rsync_data_t- Add labeling and filename transition for .grl-podcasts
* Fri Jan 25 2013 Miroslav Grepl 3.12.1-7- mount.glusterfs executes glusterfsd binary- Allow systemd_hostnamed_t to stream connect to systemd- Dontaudit any user doing a access check- Allow obex-data-server to request the kernel to load a module- Allow gpg-agent to manage gnome content (~/.cache/gpg-agent-info)- Allow gpg-agent to read /proc/sys/crypto/fips_enabled- Add new types for antivirus.pp policy module- Allow gnomesystemmm_t caps because of ioprio_set- Make sure if mozilla_plugin creates files while in permissive mode, they get created with the correct label, user_home_t- Allow gnomesystemmm_t caps because of ioprio_set- Allow NM rawip socket- files_relabel_non_security_files can not be used with boolean- Add interface to thumb_t dbus_chat to allow it to read remote process state- ALlow logrotate to domtrans to mdadm_t- kde gnomeclock wants to write content to /tmp
* Wed Jan 23 2013 Miroslav Grepl 3.12.1-6- kde gnomeclock wants to write content to /tmp- /usr/libexec/kde4/kcmdatetimehelper attempts to create /root/.kde- Allow blueman_t to rwx zero_device_t, for some kind of jre- Allow mozilla_plugin_t to rwx zero_device_t, for some kind of jre- Ftp full access should be allowed to create directories as well as files- Add boolean to allow rsync_full_acces, so that an rsync server can write all- over the local machine- logrotate needs to rotate logs in openshift directories, needs back port to RHEL6- Add missing vpnc_roles type line- Allow stapserver to write content in /tmp- Allow gnome keyring to create keyrings dir in ~/.local/share- Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on- Add interface to colord_t dbus_chat to allow it to read remote process state- Allow colord_t to read cupsd_t state- Add mate-thumbnail-font as thumnailer- Allow sectoolm to sys_ptrace since it is looking at other proceses /proc data.- Allow qpidd to list /tmp. Needed by ssl- Only allow init_t to transition to rsync_t domain, not initrc_t. This should be back ported to F17, F18- - Added systemd support for ksmtuned- Added booleans ksmtuned_use_nfs ksmtuned_use_cifs- firewalld seems to be creating mmap files which it needs to execute in /run /tmp and /dev/shm. Would like to clean this up but for now we will allow- Looks like qpidd_t needs to read /dev/random- Lots of probing avc\'s caused by execugting gpg from staff_t- Dontaudit senmail triggering a net_admin avc- Change thumb_role to use thumb_run, not sure why we have a thumb_role, needs back port- Logwatch does access check on mdadm binary- Add raid_access_check_mdadm() iterface
* Wed Jan 16 2013 Miroslav Grepl 3.12.1-5- Fix systemd_manage_unit_symlinks() interface- Call systemd_manage_unit_symlinks(() which is correct interface- Add filename transition for opasswd- Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock- Allow sytstemd-timedated to get status of init_t- Add new systemd policies for hostnamed and rename gnomeclock_t to systemd_timedate_t- colord needs to communicate with systemd and systemd_logind, also remove duplicate rules- Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock- Allow gpg_t to manage all gnome files- Stop using pcscd_read_pub_files- New rules for xguest, dontaudit attempts to dbus chat- Allow firewalld to create its mmap files in tmpfs and tmp directories- Allow firewalld to create its mmap files in tmpfs and tmp directories- run unbound-chkconf as named_t, so it can read dnssec- Colord is reading xdm process state, probably reads state of any apps that sends dbus message- Allow mdadm_t to change the kernel scheduler- mythtv policy- Update mandb_admin() interface- Allow dsspam to listen on own tpc_socket- seutil_filetrans_named_content needs to be optional- Allow sysadm_t to execute content in his homedir- Add attach_queue to tun_socket, new patch from Paul Moore- Change most of selinux configuration types to security_file_type.- Add filename transition rules for selinux configuration- ssh into a box with -X -Y requires ssh_use_ptys- Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on- Allow all unpriv userdomains to send dbus messages to hostnamed and timedated- New allow rules found by Tom London for systemd_hostnamed
* Mon Jan 14 2013 Miroslav Grepl 3.12.1-4- Allow systemd-tmpfiles to relabel lpd spool files- Ad labeling for texlive bash scripts- Add xserver_filetrans_fonts_cache_home_content() interface- Remove duplicate rules from
*.te- Add support for /var/lock/man-db.lock- Add support for /var/tmp/abrt(/.
*)?- Add additional labeling for munin cgi scripts- Allow httpd_t to read munin conf files- Allow certwatch to read meminfo- Fix nscd_dontaudit_write_sock_file() interfac- Fix gnome_filetrans_home_content() to include also \"fontconfig\" dir as cache_home_t- llow mozilla_plugin_t to create HOMEDIR/.fontconfig with the proper labeling
* Fri Jan 11 2013 Miroslav Grepl 3.12.1-3- Allow gnomeclock to talk to puppet over dbus- Allow numad access discovered by Dominic- Add support for HOME_DIR/.maildir- Fix attribute_role for mozilla_plugin_t domain to allow staff_r to access this domain- Allow udev to relabel udev_var_run_t lnk_files- New bin_t file in mcelog
* Thu Jan 10 2013 Miroslav Grepl 3.12.1-2- Remove all mcs overrides and replace with t1 != mcs_constrained_types- Add attribute_role for iptables- mcs_process_set_categories needs to be called for type- Implement additional role_attribute statements- Sodo domain is attempting to get the additributes of proc_kcore_t- Unbound uses port 8953- Allow svirt_t images to compromise_kernel when using pci-passthrough- Add label for dns lib files- Bluetooth aquires a dbus name- Remove redundant files_read_usr_file calling- Remove redundant files_read_etc_file calling- Fix mozilla_run_plugin()- Add role_attribute support for more domains
* Wed Jan 09 2013 Miroslav Grepl 3.12.1-1- Mass merge with upstream
* Sat Jan 05 2013 Dan Walsh 3.11.1-69.1- Bump the policy version to 28 to match selinux userspace- Rebuild versus latest libsepol
* Wed Jan 02 2013 Miroslav Grepl 3.11.1-69- Add systemd_status_all_unit_files() interface- Add support for nshadow- Allow sysadm_t to administrate the postfix domains- Add interface to setattr on isid directories for use by tmpreaper- Allow sshd_t sys_admin for use with afs logins- Allow systemd to read/write all sysctls- Allow sshd_t sys_admin for use with afs logins- Allow systemd to read/write all sysctls- Add systemd_status_all_unit_files() interface- Add support for nshadow- Allow sysadm_t to administrate the postfix domains- Add interface to setattr on isid directories for use by tmpreaper- Allow sshd_t sys_admin for use with afs logins- Allow systemd to read/write all sysctls- Allow sshd_t sys_admin for use with afs logins- Add labeling for /var/named/chroot/etc/localtim
* Thu Dec 27 2012 Miroslav Grepl 3.11.1-68- Allow setroubleshoot_fixit to execute rpm- zoneminder needs to connect to httpd ports where remote cameras are listening- Allow firewalld to execute content created in /run directory- Allow svirt_t to read generic certs- Dontaudit leaked ps content to mozilla plugin- Allow sshd_t sys_admin for use with afs logins- Allow systemd to read/write all sysctls- init scripts are creating systemd_unit_file_t directories
* Fri Dec 21 2012 Miroslav Grepl 3.11.1-67- systemd_logind_t is looking at all files under /run/user/apache- Allow systemd to manage all user tmp files- Add labeling for /var/named/chroot/etc/localtime- Allow netlabel_peer_t type to flow over netif_t and node_t, and only be hindered by MLS, need back port to RHEL6- Keystone is now using a differnt port- Allow xdm_t to use usbmuxd daemon to control sound- Allow passwd daemon to execute gnome_exec_keyringd- Fix chrome_sandbox policy- Add labeling for /var/run/checkquorum-timer- More fixes for the dspam domain, needs back port to RHEL6- More fixes for the dspam domain, needs back port to RHEL6- sssd needs to connect to kerberos password port if a user changes his password- Lots of fixes from RHEL testing of dspam web- Allow chrome and mozilla_plugin to create msgq and semaphores- Fixes for dspam cgi scripts- Fixes for dspam cgi scripts- Allow confine users to ptrace screen- Backport virt_qemu_ga_t changes from RHEL- Fix labeling for dspam.cgi needed for RHEL6- We need to back port this policy to RHEL6, for lxc domains- Dontaudit attempts to set sys_resource of logrotate- Allow corosync to read/write wdmd\'s tmpfs files- I see a ptrace of mozilla_plugin_t by staff_t, will allow without deny_ptrace being set- Allow cron jobs to read bind config for unbound- libvirt needs to inhibit systemd- kdumpctl needs to delete boot_t files- Fix duplicate gnome_config_filetrans- virtd_lxc_t is using /dev/fuse- Passenger needs to create a directory in /var/log, needs a backport to RHEL6 for openshift- apcupsd can be setup to listen to snmp trafic- Allow transition from kdumpgui to kdumpctl- Add fixes for munin CGI scripts- Allow deltacloud to connect to openstack at the keystone port- Allow domains that transition to svirt domains to be able to signal them- Fix file context of gstreamer in .cache directory- libvirt is communicating with logind- NetworkManager writes to the systemd inhibit pipe
* Mon Dec 17 2012 Miroslav Grepl 3.11.1-66- Allow munin disk plugins to get attributes of all directories- Allow munin disk plugins to get attributes of all directorie- Allow logwatch to get attributes of all directories- Fix networkmanager_manage_lib() interface- Fix gnome_manage_config() to allow to manage sock_file- Fix virtual_domain_context- Add support for dynamic DNS for DHCPv6
* Sat Dec 15 2012 Miroslav Grepl 3.11.1-65- Allow svirt to use netlink_route_socket which was a part of auth_use_nsswitch- Add additional labeling for /var/www/openshift/broker- Fix rhev policy- Allow openshift_initrc domain to dbus chat with systemd_logind- Allow httpd to getattr passenger log file if run_stickshift- Allow consolehelper-gtk to connect to xserver- Add labeling for the tmp-inst directory defined in pam_namespace.conf- Add lvm_metadata_t labeling for /etc/multipath
* Fri Dec 14 2012 Miroslav Grepl 3.11.1-64- consoletype is no longer used
* Wed Dec 12 2012 Miroslav Grepl 3.11.1-63- Add label for efivarfs- Allow certmonger to send signal to itself- Allow plugin-config to read own process status- Add more fixes for pacemaker- apache/drupal can run clamscan on uploaded content- Allow chrome_sandbox_nacl_t to read pid 1 content
* Tue Dec 11 2012 Miroslav Grepl 3.11.1-62- Fix MCS Constraints to control ingres and egres controls on the network.- Change name of svirt_nokvm_t to svirt_tcg_t- Allow tuned to request the kernel to load kernel modules
* Mon Dec 10 2012 Miroslav Grepl 3.11.1-61- Label /var/lib/pgsql/.ssh as ssh_home_t- Add labeling for /usr/bin/pg_ctl- Allow systemd-logind to manage keyring user tmp dirs- Add support for 7389/tcp port- gems seems to be placed in lots of places- Since xdm is running a full session, it seems to be trying to execute lots of executables via dbus- Add back tcp/8123 port as http_cache port- Add ovirt-guest-agent\\.pid labeling- Allow xend to run scsi_id- Allow rhsmcertd-worker to read \"physical_package_id\"- Allow pki_tomcat to connect to ldap port- Allow lpr to read /usr/share/fonts- Allow open file from CD/DVD drive on domU- Allow munin services plugins to talk to SSSD- Allow all samba domains to create samba directory in var_t directories- Take away svirt_t ability to use nsswitch- Dontaudit attempts by openshift to read apache logs- Allow apache to create as well as append _ra_content_t- Dontaudit sendmail_t reading a leaked file descriptor- Add interface to have admin transition /etc/prelink.cache to the proper label- Add sntp support to ntp policy- Allow firewalld to dbus chat with devicekit_power- Allow tuned to call lsblk- Allow tor to read /proc/sys/kernel/random/uuid- Add tor_can_network_relay boolean
* Wed Dec 05 2012 Miroslav Grepl 3.11.1-60- Add openshift_initrc_signal() interface- Fix typos- dspam port is treat as spamd_port_t- Allow setroubleshoot to getattr on all executables- Allow tuned to execute profiles scripts in /etc/tuned- Allow apache to create directories to store its log files- Allow all directories/files in /var/log starting with passenger to be labeled passenger_log_t- Looks like apache is sending sinal to openshift_initrc_t now,needs back port to RHEL6- Allow Postfix to be configured to listen on TCP port 10026 for email from DSPAM- Add filename transition for /etc/tuned/active_profile- Allow condor_master to send mails- Allow condor_master to read submit.cf- Allow condor_master to create /tmp files/dirs- Allow condor_mater to send sigkill to other condor domains- Allow condor_procd sigkill capability- tuned-adm wants to talk with tuned daemon- Allow kadmind and krb5kdc to also list sssd_public_t- Allow accountsd to dbus chat with init- Fix git_read_generic_system_content_files() interface- pppd wants sys_nice by nmcli because of \"syscall=sched_setscheduler\"- Fix mozilla_plugin_can_network_connect to allow to connect to all ports- Label all munin plugins which are not covered by munin plugins policy as unconfined_munin_plugin_exec_t- dspam wants to search /var/spool for opendkim data- Revert \"Add support for tcp/10026 port as dspam_port_t\"- Turning on labeled networking requires additional access for netlabel_peer_t; these allow rules need to be back ported to RHEL6- Allow all application domains to use fifo_files passed in from userdomains, also allow them to write to tmp_files inherited from userdomain- Allow systemd_tmpfiles_t to setattr on mandb_cache_t
* Sat Dec 01 2012 Miroslav Grepl 3.11.1-59- consolekit.pp was not removed from the postinstall script
* Fri Nov 30 2012 Miroslav Grepl 3.11.1-58- Add back consolekit policy- Silence bootloader trying to use inherited tty- Silence xdm_dbusd_t trying to execute telepathy apps- Fix shutdown avcs when machine has unconfined.pp disabled- The host and a virtual machine can share the same printer on a usb device- Change oddjob to transition to a ranged openshift_initr_exec_t when run from oddjob- Allow abrt_watch_log_t to execute bin_t- Allow chrome sandbox to write content in ~/.config/chromium- Dontaudit setattr on fontconfig dir for thumb_t- Allow lircd to request the kernel to load module- Make rsync as userdom_home_manager- Allow rsync to search automount filesystem- Add fixes for pacemaker
* Wed Nov 28 2012 Miroslav Grepl 3.11.1-57- Add support for 4567/tcp port- Random fixes from Tuomo Soini- xdm wants to get init status- Allow programs to run in fips_mode- Add interface to allow the reading of all blk device nodes- Allow init to relabel rpcbind sock_file- Fix labeling for lastlog and faillog related to logrotate- ALlow aeolus_configserver to use TRAM port- Add fixes for aeolus_configserver- Allow snmpd to connect to snmp port- Allow spamd_update to create spamd_var_lib_t directories- Allow domains that can read sssd_public_t files to also list the directory- Remove miscfiles_read_localization, this is defined for all domains
* Mon Nov 26 2012 Miroslav Grepl 3.11.1-56- Allow syslogd to request the kernel to load a module- Allow syslogd_t to read the network state information- Allow xdm_dbusd_t connect to the system DBUS- Add support for 7389/tcp port- Allow domains to read/write all inherited sockets- Allow staff_t to read kmsg- Add awstats_purge_apache_log boolean- Allow ksysguardproces to read /.config/Trolltech.conf- Allow passenger to create and append puppet log files- Add puppet_append_log and puppet_create_log interfaces- Add puppet_manage_log() interface- Allow tomcat domain to search tomcat_var_lib_t- Allow pki_tomcat_t to connect to pki_ca ports- Allow pegasus_t to have net_admin capability- Allow pegasus_t to write /sys/class/net//flags- Allow mailserver_delivery to manage mail_home_rw_t lnk_files- Allow fetchmail to create log files- Allow gnomeclock to manage home config in .kde- Allow bittlebee to read kernel sysctls- Allow logrotate to list /root
* Mon Nov 19 2012 Miroslav Grepl 3.11.1-55- Fix userhelper_console_role_template()- Allow enabling Network Access Point service using blueman- Make vmware_host_t as unconfined domain- Allow authenticate users in webaccess via squid, using mysql as backend- Allow gathers to get various metrics on mounted file systems- Allow firewalld to read /etc/hosts- Fix cron_admin_role() to make sysadm cronjobs running in the sysadm_t instead of cronjob_t- Allow kdumpgui to read/write to zipl.conf- Commands needed to get mock to build from staff_t in enforcing mode- Allow mdadm_t to manage cgroup files- Allow all daemons and systemprocesses to use inherited initrc_tmp_t files- dontaudit ifconfig_t looking at fifo_files that are leaked to it- Add lableing for Quest Authentication System
* Thu Nov 15 2012 Miroslav Grepl 3.11.1-54- Fix filetrans interface definitions- Dontaudit xdm_t to getattr on BOINC lib files- Add systemd_reload_all_services() interface- Dontaudit write access on /var/lib/net-snmp/mib_indexes - Only stop mcsuntrustedproc from relableing files- Allow accountsd to dbus chat with gdm- Allow realmd to getattr on all fs- Allow logrotate to reload all services- Add systemd unit file for radiusd- Allow winbind to create samba pid dir- Add labeling for /var/nmbd/unexpected- Allow chrome and mozilla plugin to connect to msnp ports
* Mon Nov 12 2012 Miroslav Grepl 3.11.1-53- Fix storage_rw_inherited_fixed_disk_dev() to cover also blk_file- Dontaudit setfiles reading /dev/random- On initial boot gnomeclock is going to need to be set buy gdm- Fix tftp_read_content() interface- Random apps looking at kernel file systems- Testing virt with lxc requiers additional access for virsh_t- New allow rules requied for latest libvirt, libvirt talks directly to journald,lxc setup tool needs compromize_kernel,and we need ipc_lock in the container- Allow MPD to read /dev/radnom- Allow sandbox_web_type to read logind files which needs to read pulseaudio- Allow mozilla plugins to read /dev/hpet- Add labeling for /var/lib/zarafa-webap- Allow BOINC client to use an HTTP proxy for all connections- Allow rhsmertd to domain transition to dmidecod- Allow setroubleshootd to send D-Bus msg to ABRT
* Thu Nov 08 2012 Miroslav Grepl 3.11.1-52- Define usbtty_device_t as a term_tty- Allow svnserve to accept a connection- Allow xend manage default virt_image_t type- Allow prelink_cron_system_t to overide user componant when executing cp- Add labeling for z-push- Gnomeclock sets the realtime clock- Openshift seems to be storing apache logs in /var/lib/openshift/.log/httpd- Allow lxc domains to use /dev/random and /dev/urandom
* Wed Nov 07 2012 Miroslav Grepl 3.11.1-51- Add port defintion for tcp/9000- Fix labeling for /usr/share/cluster/checkquorum to label also checkquorum.wdmd- Add rules and labeling for $HOME/cache/\\.gstreamer-.
* directory- Add support for CIM provider openlmi-networking which uses NetworkManager dbus API- Allow shorewall_t to create netlink_socket- Allow krb5admind to block suspend- Fix labels on /var/run/dlm_controld /var/log/dlm_controld- Allow krb5kdc to block suspend- gnomessytemmm_t needs to read /etc/passwd- Allow cgred to read all sysctls
* Tue Nov 06 2012 Miroslav Grepl 3.11.1-50- Allow all domains to read /proc/sys/vm/overcommit_memory- Make proc_numa_t an MLS Trusted Object- Add /proc/numactl support for confined users- Allow ssh_t to connect to any port > 1023- Add openvswitch domain- Pulseaudio tries to create directories in gnome_home_t directories- New ypbind pkg wants to search /var/run which is caused by sd_notify- Allow NM to read certs on NFS/CIFS using use_nfs_
*, use_samba_
* booleans- Allow sanlock to read /dev/random- Treat php-fpm with httpd_t- Allow domains that can read named_conf_t to be able to list the directories- Allow winbind to create sock files in /var/run/samba
* Thu Nov 01 2012 Miroslav Grepl 3.11.1-49- Add smsd policy- Add support for OpenShift sbin labelin- Add boolean to allow virt to use rawip- Allow mozilla_plugin to read all file systems with noxattrs support- Allow kerberos to write on anon_inodefs fs- Additional access required by fenced- Add filename transitions for passwd.lock/group.lock- UPdate man pages- Create coolkey directory in /var/cache with the correct label
* Tue Oct 30 2012 Miroslav Grepl 3.11.1-48- Fix label on /etc/group.lock- Allow gnomeclock to create lnk_file in /etc- label /root/.pki as a home_cert_t- Add interface to make sure rpcbind.sock is created with the correct label- Add definition for new directory /var/lib/os-probe and bootloader wants to read udev rules- opendkim should be a part of milter- Allow libvirt to set the kernel sched algorythm- Allow mongod to read sysfs_t- Add authconfig policy- Remove calls to miscfiles_read_localization all domains get this- Allow virsh_t to read /root/.pki/ content- Add label for log directory under /var/www/stickshift
* Mon Oct 29 2012 Miroslav Grepl 3.11.1-47- Allow getty to setattr on usb ttys- Allow sshd to search all directories for sshd_home_t content- Allow staff domains to send dbus messages to kdumpgui- Fix labels on /etc/.pwd.lock and friends to be passwd_file_t- Dontaudit setfiles reading urand- Add files_dontaudit_list_tmp() for domains to which we added sys_nice/setsched- Allow staff_gkeyringd_t to read /home/$USER/.local/share/keyrings dir- Allow systemd-timedated to read /dev/urandom- Allow entropyd_t to read proc_t (meminfo)- Add unconfined munin plugin- Fix networkmanager_read_conf() interface- Allow blueman to list /tmp which is needed by sys_nic/setsched- Fix label of /etc/mail/aliasesdb-stamp- numad is searching cgroups- realmd is communicating with networkmanager using dbus- Lots of fixes to try to get kdump to work
* Fri Oct 26 2012 Miroslav Grepl 3.11.1-46- Allow loging programs to dbus chat with realmd- Make apache_content_template calling as optional- realmd is using policy kit
* Fri Oct 26 2012 Miroslav Grepl 3.11.1-45- Add new selinuxuser_use_ssh_chroot boolean- dbus needs to be able to read/write inherited fixed disk device_t passed through it- Cleanup netutils process allow rule- Dontaudit leaked fifo files from openshift to ping- sanlock needs to read mnt_t lnk files- Fail2ban needs to setsched and sys_nice
* Wed Oct 24 2012 Miroslav Grepl 3.11.1-44- Change default label of all files in /var/run/rpcbind- Allow sandbox domains (java) to read hugetlbfs_t- Allow awstats cgi content to create tmp files and read apache log files- Allow setuid/setgid for cupsd-config- Allow setsched/sys_nice pro cupsd-config- Fix /etc/localtime sym link to be labeled locale_t- Allow sshd to search postgresql db t since this is a homedir- Allow xwindows users to chat with realmd- Allow unconfined domains to configure all files and null_device_t service
* Tue Oct 23 2012 Miroslav Grepl 3.11.1-43- Adopt pki-selinux policy
* Mon Oct 22 2012 Miroslav Grepl 3.11.1-42- pki is leaking which we dontaudit until a pki code fix- Allow setcap for arping- Update man pages- Add labeling for /usr/sbin/mcollectived- pki fixes- Allow smokeping to execute fping in the netutils_t domain
* Fri Oct 19 2012 Miroslav Grepl 3.11.1-41- Allow mount to relabelfrom unlabeled file systems- systemd_logind wants to send and receive messages from devicekit disk over dbus to make connected mouse working- Add label to get bin files under libreoffice labeled correctly- Fix interface to allow executing of base_ro_file_type- Add fixes for realmd- Update pki policy- Add tftp_homedir boolean- Allow blueman sched_setscheduler- openshift user domains wants to r/w ssh tcp sockets
* Wed Oct 17 2012 Miroslav Grepl 3.11.1-40- Additional requirements for disable unconfined module when booting- Fix label of systemd script files- semanage can use -F /dev/stdin to get input- syslog now uses kerberos keytabs- Allow xserver to compromise_kernel access- Allow nfsd to write to mount_var_run_t when running the mount command- Add filename transition rule for bin_t directories- Allow files to read usr_t lnk_files- dhcpc wants chown- Add support for new openshift labeling- Clean up for tunable+optional statements- Add labeling for /usr/sbin/mkhomedir_helper- Allow antivirus domain to managa amavis spool files- Allow rpcbind_t to read passwd - Allow pyzor running as spamc to manage amavis spool
* Tue Oct 16 2012 Miroslav Grepl 3.11.1-39- Add interfaces to read kernel_t proc info- Missed this version of exec_all- Allow anyone who can load a kernel module to compromise kernel- Add oddjob_dbus_chat to openshift apache policy- Allow chrome_sandbox_nacl_t to send signals to itself- Add unit file support to usbmuxd_t- Allow all openshift domains to read sysfs info- Allow openshift domains to getattr on all domains
* Fri Oct 12 2012 Miroslav Grepl 3.11.1-38- MLS fixes from Dan- Fix name of capability2 secure_firmware->compromise_kerne
* Thu Oct 11 2012 Miroslav Grepl 3.11.1-37- Allow xdm to search all file systems- Add interface to allow the config of all files- Add rngd policy- Remove kgpg as a gpg_exec_t type- Allow plymouthd to block suspend- Allow systemd_dbus to config any file- Allow system_dbus_t to configure all services- Allow freshclam_t to read usr_files- varnishd requires execmem to load modules
* Thu Oct 11 2012 Miroslav Grepl 3.11.1-36- Allow semanage to verify types- Allow sudo domain to execute user home files- Allow session_bus_type to transition to user_tmpfs_t- Add dontaudit caused by yum updates- Implement pki policy but not activated
* Wed Oct 10 2012 Miroslav Grepl 3.11.1-35- tuned wants to getattr on all filesystems- tuned needs also setsched. The build is needed for test day
* Wed Oct 10 2012 Miroslav Grepl 3.11.1-34- Add policy for qemu-qa- Allow razor to write own config files- Add an initial antivirus policy to collect all antivirus program- Allow qdisk to read usr_t- Add additional caps for vmware_host- Allow tmpfiles_t to setattr on mandb_cache_t- Dontaudit leaked files into mozilla_plugin_config_t- Allow wdmd to getattr on tmpfs- Allow realmd to use /dev/random- allow containers to send audit messages- Allow root mount any file via loop device with enforcing mls policy- Allow tmpfiles_t to setattr on mandb_cache_t- Allow tmpfiles_t to setattr on mandb_cache_t- Make userdom_dontaudit_write_all_ not allow open- Allow init scripts to read all unit files- Add support for saphostctrl ports
* Mon Oct 08 2012 Miroslav Grepl 3.11.1-33- Add kernel_read_system_state to sandbox_client_t- Add some of the missing access to kdumpgui- Allow systemd_dbusd_t to status the init system- Allow vmnet-natd to request the kernel to load a module- Allow gsf-office-thum to append .cache/gdm/session.log- realmd wants to read .config/dconf/user- Firewalld wants sys_nice/setsched- Allow tmpreaper to delete mandb cache files- Firewalld wants sys_nice/setsched- Allow firewalld to perform a DNS name resolution- Allown winbind to read /usr/share/samba/codepages/lowcase.dat- Add support for HTTPProxy
* in /etc/freshclam.conf- Fix authlogin_yubike boolean- Extend smbd_selinux man page to include samba booleans- Allow dhcpc to execute consoletype- Allow ping to use inherited tmp files created in init scripts- On full relabel with unconfined domain disabled, initrc was running some chcon\'s- Allow people who delete man pages to delete mandb cache files
* Thu Oct 04 2012 Miroslav Grepl 3.11.1-32- Add missing permissive domains
* Thu Oct 04 2012 Miroslav Grepl 3.11.1-31- Add new mandb policy- ALlow systemd-tmpfiles_t to relabel mandb_cache_t- Allow logrotate to start all unit files
* Thu Oct 04 2012 Miroslav Grepl 3.11.1-30- Add fixes for ctbd- Allow nmbd to stream connect to ctbd- Make cglear_t as nsswitch_domain- Fix bogus in interfaces- Allow openshift to read/write postfix public pipe- Add postfix_manage_spool_maildrop_files() interface- stickshift paths have been renamed to openshift- gnome-settings-daemon wants to write to /run/systemd/inhibit/ pipes- Update man pages, adding ENTRYPOINTS
* Tue Oct 02 2012 Miroslav Grepl 3.11.1-29- Add mei_device_t- Make sure gpg content in homedir created with correct label- Allow dmesg to write to abrt cache files- automount wants to search virtual memory sysctls- Add support for hplip logs stored in /var/log/hp/tmp- Add labeling for /etc/owncloud/config.php- Allow setroubleshoot to send analysys to syslogd-journal- Allow virsh_t to interact with new fenced daemon- Allow gpg to write to /etc/mail/spamassassiin directories- Make dovecot_deliver_t a mail server delivery type- Add label for /var/tmp/DNS25
* Thu Sep 27 2012 Miroslav Grepl 3.11.1-28- Fixes for tomcat_domain template interface
* Thu Sep 27 2012 Miroslav Grepl 3.11.1-27- Remove init_systemd and init_upstart boolean, Move init_daemon_domain and init_system_domain to use attributes- Add attribute to all base os types. Allow all domains to read all ro base OS types
* Wed Sep 26 2012 Miroslav Grepl 3.11.1-26- Additional unit files to be defined as power unit files- Fix more boolean names
* Tue Sep 25 2012 Miroslav Grepl 3.11.1-25- Fix boolean name so subs will continue to work
* Tue Sep 25 2012 Miroslav Grepl 3.11.1-24- dbus needs to start getty unit files- Add interface to allow system_dbusd_t to start the poweroff service- xdm wants to exec telepathy apps- Allow users to send messages to systemdlogind- Additional rules needed for systemd and other boot apps- systemd wants to list /home and /boot- Allow gkeyringd to write dbus/conf file- realmd needs to read /dev/urand- Allow readahead to delete /.readahead if labeled root_t, might get created before policy is loaded
* Thu Sep 20 2012 Miroslav Grepl 3.11.1-23- Fixes to safe more rules- Re-write tomcat_domain_template()- Fix passenger labeling- Allow all domains to read man pages- Add ephemeral_port_t to the \'generic\' port interfaces- Fix the names of postgresql booleans
* Tue Sep 18 2012 Miroslav Grepl 3.11.1-22- Stop using attributes form netlabel_peer and syslog, auth_use_nsswitch setsup netlabel_peer- Move netlable_peer check out of booleans- Remove call to recvfrom_netlabel for kerberos call- Remove use of attributes when calling syslog call - Move -miscfiles_read_localization to domain.te to save hundreds of allow rules- Allow all domains to read locale files. This eliminates around 1500 allow rules- Cleanup nis_use_ypbind_uncond interface- Allow rndc to block suspend- tuned needs to modify the schedule of the kernel- Allow svirt_t domains to read alsa configuration files- ighten security on irc domains and make sure they label content in homedir correctly- Add filetrans_home_content for irc files- Dontaudit all getattr access for devices and filesystems for sandbox domains- Allow stapserver to search cgroups directories- Allow all postfix domains to talk to spamd
* Mon Sep 17 2012 Miroslav Grepl 3.11.1-21- Add interfaces to ignore setattr until kernel fixes this to be checked after the DAC check- Change pam_t to pam_timestamp_t- Add dovecot_domain attribute and allow this attribute block_suspend capability2- Add sanlock_use_fusefs boolean- numad wants send/recieve msg- Allow rhnsd to send syslog msgs- Make piranha-pulse as initrc domain- Update openshift instances to dontaudit setattr until the kernel is fixed.
* Fri Sep 14 2012 Miroslav Grepl 3.11.1-20- Fix auth_login_pgm_domain() interface to allow domains also managed user tmp dirs because of #856880 related to pam_systemd- Remove pam_selinux.8 which conflicts with man page owned by the pam package- Allow glance-api to talk to mysql- ABRT wants to read Xorg.0.log if if it detects problem with Xorg- Fix gstreamer filename trans. interface
* Thu Sep 13 2012 Miroslav Grepl 3.11.1-19- Man page fixes by Dan Walsh
* Tue Sep 11 2012 Miroslav Grepl 3.11.1-18- Allow postalias to read postfix config files- Allow man2html to read man pages- Allow rhev-agentd to search all mountpoints- Allow rhsmcertd to read /dev/random- Add tgtd_stream_connect() interface- Add cyrus_write_data() interface- Dontaudit attempts by sandboxX clients connectiing to the xserver_port_t- Add port definition for tcp/81 as http_port_t- Fix /dev/twa labeling- Allow systemd to read modules config
* Mon Sep 10 2012 Miroslav Grepl 3.11.1-17- Merge openshift policy- Allow xauth to read /dev/urandom- systemd needs to relabel content in /run/systemd directories- Files unconfined should be able to perform all services on all files- Puppet tmp file can be leaked to all domains- Dontaudit rhsmcertd-worker to search /root/.local- Allow chown capability for zarafa domains- Allow system cronjobs to runcon into openshift domains- Allow virt_bridgehelper_t to manage content in the svirt_home_t labeled directories
* Fri Sep 07 2012 Miroslav Grepl 3.11.1-16- nmbd wants to create /var/nmbd- Stop transitioning out of anaconda and firstboot, just causes AVC messages- Allow clamscan to read /etc files- Allow bcfg2 to bind cyphesis port- heartbeat should be run as rgmanager_t instead of corosync_t- Add labeling for /etc/openldap/certs- Add labeling for /opt/sartest directory- Make crontab_t as userdom home reader- Allow tmpreaper to list admin_home dir- Add defition for imap_0 replay cache file- Add support for gitolite3- Allow virsh_t to send syslog messages- allow domains that can read samba content to be able to list the directories also- Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd- Separate out sandbox from sandboxX policy so we can disable it by default- Run dmeventd as lvm_t- Mounting on any directory requires setattr and write permissions- Fix use_nfs_home_dirs() boolean- New labels for pam_krb5- Allow init and initrc domains to sys_ptrace since this is needed to look at processes not owned by uid 0- Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd
* Fri Aug 31 2012 Dan Walsh 3.11.1-15- Separate sandbox policy into sandbox and sandboxX, and disable sandbox by default on fresh installs- Allow domains that can read etc_t to read etc_runtime_t - Allow all domains to use inherited tmpfiles
* Wed Aug 29 2012 Miroslav Grepl 3.11.1-14- Allow realmd to read resolv.conf- Add pegasus_cache_t type- Label /usr/sbin/fence_virtd as virsh_exec_t- Add policy for pkcsslotd- Add support for cpglockd- Allow polkit-agent-helper to read system-auth-ac- telepathy-idle wants to read gschemas.compiled- Allow plymouthd to getattr on fs_t- Add slpd policy- Allow ksysguardproces to read/write config_usr_t
* Sat Aug 25 2012 Dan Walsh 3.11.1-13- Fix labeling substitution so rpm will label /lib/systemd content correctly
* Fri Aug 24 2012 Miroslav Grepl 3.11.1-12- Add file name transitions for ttyACM0- spice-vdagent(d)\'s are going to log over to syslog- Add sensord policy- Add more fixes for passenger policy related to puppet- Allow wdmd to create wdmd_tmpfs_t- Fix labeling for /var/run/cachefilesd\\.pid- Add thumb_tmpfs_t files type
* Mon Aug 20 2012 Miroslav Grepl 3.11.1-11- Allow svirt domains to manage the network since this is containerized- Allow svirt_lxc_net_t to send audit messages
* Mon Aug 20 2012 Miroslav Grepl 3.11.1-10- Make \"snmpwalk -mREDHAT-CLUSTER-MIB ....\" working- Allow dlm_controld to execute dlm_stonith labeled as bin_t- Allow GFS2 working on F17- Abrt needs to execute dmesg- Allow jockey to list the contents of modeprobe.d- Add policy for lightsquid as squid_cron_t- Mailscanner is creating files and directories in /tmp- dmesg is now reading /dev/kmsg- Allow xserver to communicate with secure_firmware- Allow fsadm tools (fsck) to read /run/mount contnet- Allow sysadm types to read /dev/kmsg-
* Thu Aug 16 2012 Dan Walsh 3.11.1-9- Allow postfix, sssd, rpcd to block_suspend- udev seems to need secure_firmware capability- Allow virtd to send dbus messages to firewalld so it can configure the firewall
* Thu Aug 16 2012 Dan Walsh 3.11.1-8- Fix labeling of content in /run created by virsh_t- Allow condor domains to read kernel sysctls- Allow condor_master to connect to amqp- Allow thumb drives to create shared memory and semaphores- Allow abrt to read mozilla_plugin config files- Add labels for lightsquid- Default files in /opt and /usr that end in .cgi as httpd_sys_script_t, allow- dovecot_auth_t uses ldap for user auth- Allow domains that can read dhcp_etc_t to read lnk_files- Add more then one watchdog device- Allow useradd_t to manage etc_t files so it can rename it and edit them- Fix invalid class dir should be fifo_file- Move /run/blkid to fsadm and make sure labeling is correct
* Tue Aug 14 2012 Dan Walsh 3.11.1-7- Fix bogus regex found by eparis- Fix manage run interface since lvm needs more access- syslogd is searching cgroups directory- Fixes to allow virt-sandbox-service to manage lxc var run content
* Mon Aug 13 2012 Dan Walsh 3.11.1-6- Fix Boolean settings- Add new libjavascriptcoregtk as textrel_shlib_t- Allow xdm_t to create xdm_home_t directories- Additional access required for systemd- Dontaudit mozilla_plugin attempts to ipc_lock- Allow tmpreaper to delete unlabeled files- Eliminate screen_tmp_t and allow it to manage user_tmp_t- Dontaudit mozilla_plugin_config_t to append to leaked file descriptors- Allow web plugins to connect to the asterisk ports- Condor will recreate the lock directory if it does not exist- Oddjob mkhomedir needs to connectto user processes- Make oddjob_mkhomedir_t a userdom home manager
* Thu Aug 09 2012 Miroslav Grepl 3.11.1-5- Put placeholder back in place for proper numbering of capabilities- Systemd also configures init scripts
* Thu Aug 09 2012 Miroslav Grepl 3.11.1-4- Fix ecryptfs interfaces- Bootloader seems to be trolling around /dev/shm and /dev- init wants to create /etc/systemd/system-update.target.wants- Fix systemd_filetrans call to move it out of tunable- Fix up policy to work with systemd userspace manager- Add secure_firmware capability and remove bogus epolwakeup- Call seutil_
*_login_config interfaces where should be needed- Allow rhsmcertd to send signal to itself- Allow thin domains to send signal to itself- Allow Chrome_ChildIO to read dosfs_t
* Tue Aug 07 2012 Miroslav Grepl 3.11.1-3- Add role rules for realmd, sambagui
* Tue Aug 07 2012 Miroslav Grepl 3.11.1-2- Add new type selinux_login_config_t for /etc/selinux//logins/- Additional fixes for seutil_manage_module_store()- dbus_system_domain() should be used with optional_policy- Fix svirt to be allowed to use fusefs file system- Allow login programs to read /run/ data created by systemd_login- sssd wants to write /etc/selinux//logins/ for SELinux PAM module- Fix svirt to be allowed to use fusefs file system- Allow piranha domain to use nsswitch- Sanlock needs to send Kill Signals to non root processes- Pulseaudio wants to execute /run/user/PID/.orc
* Fri Aug 03 2012 Miroslav Grepl 3.11.1-1- Fix saslauthd when it tries to read /etc/shadow- Label gnome-boxes as a virt homedir- Need to allow svirt_t ability to getattr on nfs_t file systems- Update sanlock policy to solve all AVC\'s- Change confined users can optionally manage virt content- Handle new directories under ~/.cache- Add block suspend to appropriate domains- More rules required for containers- Allow login programs to read /run/ data created by systemd_logind- Allow staff users to run svirt_t processes
* Thu Aug 02 2012 Miroslav Grepl 3.11.1-0- Update to upstream
* Mon Jul 30 2012 Miroslav Grepl 3.11.0-15- More fixes for systemd to make rawhide booting from Dan Walsh
* Mon Jul 30 2012 Miroslav Grepl 3.11.0-14- Add systemd fixes to make rawhide booting
* Fri Jul 27 2012 Miroslav Grepl 3.11.0-13- Add systemd_logind_inhibit_var_run_t attribute- Remove corenet_all_recvfrom_unlabeled() for non-contrib policies because we moved it to domain.if for all domain_type- Add interface for mysqld to dontaudit signull to all processes- Label new /var/run/journal directory correctly- Allow users to inhibit suspend via systemd- Add new type for the /var/run/inhibit directory- Add interface to send signull to systemd_login so avahi can send them- Allow systemd_passwd to send syslog messages- Remove corenet_all_recvfrom_unlabeled() calling fro policy files- Allow editparams.cgi running as httpd_bugzilla_script_t to read /etc/group- Allow smbd to read cluster config- Add additional labeling for passenger- Allow dbus to inhibit suspend via systemd- Allow avahi to send signull to systemd_login
* Mon Jul 23 2012 Miroslav Grepl 3.11.0-12- Add interface to dontaudit getattr access on sysctls- Allow sshd to execute /bin/login- Looks like xdm is recreating the xdm directory in ~/.cache/ on login- Allow syslog to use the leaked kernel_t unix_dgram_socket from system-jounald- Fix semanage to work with unconfined domain disabled on F18- Dontaudit attempts by mozilla plugins to getattr on all kernel sysctls- Virt seems to be using lock files- Dovecot seems to be searching directories of every mountpoint- Allow jockey to read random/urandom, execute shell and install third-party drivers- Add aditional params to allow cachedfiles to manage its content- gpg agent needs to read /dev/random- The kernel hands an svirt domains /SYSxxxxx which is a tmpfs that httpd wants to read and write- Add a bunch of dontaudit rules to quiet svirt_lxc domains- Additional perms needed to run svirt_lxc domains- Allow cgclear to read cgconfig- Allow sys_ptrace capability for snmp- Allow freshclam to read /proc- Allow procmail to manage /home/user/Maildir content- Allow NM to execute wpa_cli- Allow amavis to read clamd system state- Regenerate man pages
* Sat Jul 21 2012 Fedora Release Engineering - 3.11.0-11- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
* Mon Jul 16 2012 Miroslav Grepl 3.11.0-10- Add realmd and stapserver policies- Allow useradd to manage stap-server lib files- Tighten up capabilities for confined users- Label /etc/security/opasswd as shadow_t- Add label for /dev/ecryptfs- Allow condor_startd_t to start sshd with the ranged- Allow lpstat.cups to read fips_enabled file- Allow pyzor running as spamc_t to create /root/.pyzor directory- Add labelinf for amavisd-snmp init script- Add support for amavisd-snmp- Allow fprintd sigkill self- Allow xend (w/o libvirt) to start virtual machines- Allow aiccu to read /etc/passwd- Allow condor_startd to Make specified domain MCS trusted for setting any category set for the processes it executes- Add condor_startd_ranged_domtrans_to() interface- Add ssd_conf_t for /etc/sssd- accountsd needs to fchown some files/directories- Add ICACLient and zibrauserdata as mozilla_filetrans_home_content- SELinux reports afs_t needs dac_override to read /etc/mtab, even though everything works, adding dontaudit- Allow xend_t to read the /etc/passwd file
* Wed Jul 11 2012 Miroslav Grepl 3.11.0-9- Until we figure out how to fix systemd issues, allow all apps that send syslog messages to send them to kernel_t- Add init_access_check() interface- Fix label on /usr/bin/pingus to not be labeled as ping_exec_t- Allow tcpdump to create a netlink_socket- Label newusers like useradd- Change xdm log files to be labeled xdm_log_t- Allow sshd_t with privsep to work in MLS- Allow freshclam to update databases thru HTTP proxy- Allow s-m-config to access check on systemd- Allow abrt to read public files by default- Fix amavis_create_pid_files() interface- Add labeling and filename transition for dbomatic.log- Allow system_dbusd_t to stream connect to bluetooth, and use its socket- Allow amavisd to execute fsav- Allow tuned to use sys_admin and sys_nice capabilities- Add php-fpm policy from Bryan- Add labeling for aeolus-configserver-thinwrapper- Allow thin domains to execute shell- Fix gnome_role_gkeyringd() interface description- Lot of interface fixes- Allow OpenMPI job running as condor_startd_ssh_t to manage condor lib files- Allow OpenMPI job to use kerberos- Make deltacloudd_t as nsswitch_domain- Allow xend_t to run lsscsi- Allow qemu-dm running as xend_t to create tun_socket- Add labeling for /opt/brother/Printers(.
*/)?inf- Allow jockey-backend to read pyconfig-64.h labeled as usr_t- Fix clamscan_can_scan_system boolean- Allow lpr to connectto to /run/user/$USER/keyring-22uREb/pkcs11
* Tue Jul 03 2012 Miroslav Grepl 3.11.0-8- initrc is calling exportfs which is not confined so it attempts to read nfsd_files- Fixes for passenger running within openshift.- Add labeling for all tomcat6 dirs- Add support for tomcat6- Allow cobblerd to read /etc/passwd- Allow jockey to read sysfs and and execute binaries with bin_t- Allow thum to use user terminals- Allow cgclear to read cgconfig config files- Fix bcf2g.fc- Remove sysnet_dns_name_resolve() from policies where auth_use_nsswitch() is used for other domains- Allow dbomatic to execute ruby- abrt_watch_log should be abrt_domain- Allow mozilla_plugin to connect to gatekeeper port
* Wed Jun 27 2012 Miroslav Grepl 3.11.0-7- add ptrace_child access to process- remove files_read_etc_files() calling from all policies which have auth_use_nsswith()- Allow boinc domains to manage boinc_lib_t lnk_files- Add support for boinc-client.service unit file- Add support for boinc.log- Allow mozilla_plugin execmod on mozilla home files if allow_ex- Allow dovecot_deliver_t to read dovecot_var_run_t- Allow ldconfig and insmod to manage kdumpctl tmp files- Move thin policy out from cloudform.pp and add a new thin poli- pacemaker needs to communicate with corosync streams- abrt is now started on demand by dbus- Allow certmonger to talk directly to Dogtag servers- Change labeling for /var/lib/cobbler/webui_sessions to httpd_c- Allow mozila_plugin to execute gstreamer home files- Allow useradd to delete all file types stored in the users hom- rhsmcertd reads the rpm database- Add support for lightdm
* Mon Jun 25 2012 Miroslav Grepl 3.11.0-6- Add tomcat policy- Remove pyzor/razor policy- rhsmcertd reads the rpm database- Dontaudit thumb to setattr on xdm_tmp dir- Allow wicd to execute ldconfig in the networkmanager_t domain- Add /var/run/cherokee\\.pid labeling- Allow mozilla_plugin to create mozilla_plugin_tmp_t lnk files too- Allow postfix-master to r/w pipes other postfix domains- Allow snort to create netlink_socket- Add kdumpctl policy- Allow firstboot to create tmp_t files/directories- /usr/bin/paster should not be labeled as piranha_exec_t- remove initrc_domain from tomcat- Allow ddclient to read /etc/passwd- Allow useradd to delete all file types stored in the users homedir- Allow ldconfig and insmod to manage kdumpctl tmp files- Firstboot should be just creating tmp_t dirs and xauth should be allowed to write to those- Transition xauth files within firstboot_tmp_t- Fix labeling of /run/media to match /media- Label all lxdm.log as xserver_log_t- Add port definition for mxi port- Allow local_login_t to execute tmux
* Tue Jun 19 2012 Miroslav Grepl 3.11.0-5- apcupsd needs to read /etc/passwd- Sanlock allso sends sigkill- Allow glance_registry to connect to the mysqld port- Dontaudit mozilla_plugin trying to getattr on /dev/gpmctl- Allow firefox plugins/flash to connect to port 1234- Allow mozilla plugins to delete user_tmp_t files- Add transition name rule for printers.conf.O- Allow virt_lxc_t to read urand- Allow systemd_loigind to list gstreamer_home_dirs- Fix labeling for /usr/bin- Fixes for cloudform services
* support FIPS- Allow polipo to work as web caching- Allow chfn to execute tmux
* Fri Jun 15 2012 Miroslav Grepl 3.11.0-4- Add support for ecryptfs
* ecryptfs does not support xattr
* we need labeling for HOMEDIR- Add policy for (u)mount.ecryptfs
*- Fix labeling of kerbero host cache files, allow rpc.svcgssd to manage host cache- Allow dovecot to manage Maildir content, fix transitions to Maildir- Allow postfix_local to transition to dovecot_deliver- Dontaudit attempts to setattr on xdm_tmp_t, looks like bogus code- Cleanup interface definitions- Allow apmd to change with the logind daemon- Changes required for sanlock in rhel6- Label /run/user/apache as httpd_tmp_t- Allow thumb to use lib_t as execmod if boolean turned on- Allow squid to create the squid directory in /var with the correct labe- Add a new policy for glusterd from Bryan Bickford (bbickforAATTredhat.com)- Allow virtd to exec xend_exec_t without transition- Allow virtd_lxc_t to unmount all file systems
* Tue Jun 12 2012 Miroslav Grepl 3.11.0-3- PolicyKit path has changed- Allow httpd connect to dirsrv socket- Allow tuned to write generic kernel sysctls- Dontaudit logwatch to gettr on /dev/dm-2- Allow policykit-auth to manage kerberos files- Make condor_startd and rgmanager as initrc domain- Allow virsh to read /etc/passwd- Allow mount to mount on user_tmp_t for /run/user/dwalsh/gvfs- xdm now needs to execute xsession_exec_t- Need labels for /var/lib/gdm- Fix files_filetrans_named_content() interface- Add new attribute - initrc_domain- Allow systemd_logind_t to signal, signull, sigkill all processes- Add filetrans rules for etc_runtime files
* Sat Jun 09 2012 Miroslav Grepl 3.11.0-2- Rename boolean names to remove allow_
* Thu Jun 07 2012 Miroslav Grepl 3.11.0-1- Mass merge with upstream
* new policy topology to include contrib policy modules
* we have now two base policy patches
* Wed May 30 2012 Miroslav Grepl 3.10.0-128- Fix description of authlogin_nsswitch_use_ldap- Fix transition rule for rhsmcertd_t needed for RHEL7- Allow useradd to list nfs state data- Allow openvpn to manage its log file and directory- We want vdsm to transition to mount_t when executing mount command to make sure /etc/mtab remains labeled correctly- Allow thumb to use nvidia devices- Allow local_login to create user_tmp_t files for kerberos- Pulseaudio needs to read systemd_login /var/run content- virt should only transition named system_conf_t config files- Allow munin to execute its plugins- Allow nagios system plugin to read /etc/passwd- Allow plugin to connect to soundd port- Fix httpd_passwd to be able to ask passwords- Radius servers can use ldap for backing store- Seems to need to mount on /var/lib for xguest polyinstatiation to work.- Allow systemd_logind to list the contents of gnome keyring- VirtualGL need xdm to be able to manage content in /etc/opt/VirtualGL- Add policy for isns-utils
* Mon May 28 2012 Miroslav Grepl 3.10.0-127- Add policy for subversion daemon- Allow boinc to read passwd- Allow pads to read kernel network state- Fix man2html interface for sepolgen-ifgen- Remove extra /usr/lib/systemd/system/smb- Remove all /lib/systemd and replace with /usr/lib/systemd- Add policy for man2html- Fix the label of kerberos_home_t to krb5_home_t- Allow mozilla plugins to use Citrix- Allow tuned to read /proc/sys/kernel/nmi_watchdog- Allow tune /sys options via systemd\'s tmpfiles.d \"w\" type
* Wed May 23 2012 Miroslav Grepl 3.10.0-126- Dontaudit lpr_t to read/write leaked mozilla tmp files- Add file name transition for .grl-podcasts directory- Allow corosync to read user tmp files- Allow fenced to create snmp lib dirs/files- More fixes for sge policy- Allow mozilla_plugin_t to execute any application- Allow dbus to read/write any open file descriptors to any non security file on the system that it inherits to that it can pass them to another domain- Allow mongod to read system state information- Fix wrong type, we should dontaudit sys_admin for xdm_t not xserver_t- Allow polipo to manage polipo_cache dirs- Add jabbar_client port to mozilla_plugin_t- Cleanup procmail policy- system bus will pass around open file descriptors on files that do not have labels on them- Allow l2tpd_t to read system state- Allow tuned to run ls /dev- Allow sudo domains to read usr_t files- Add label to machine-id - Fix corecmd_read_bin_symlinks cut and paste error
* Wed May 16 2012 Miroslav Grepl 3.10.0-125- Fix pulseaudio port definition- Add labeling for condor_starter- Allow chfn_t to creat user_tmp_files- Allow chfn_t to execute bin_t- Allow prelink_cron_system_t to getpw calls- Allow sudo domains to manage kerberos rcache files- Allow user_mail_domains to work with courie- Port definitions necessary for running jboss apps within openshift- Add support for openstack-nova-metadata-api- Add support for nova-console
*- Add support for openstack-nova-xvpvncproxy- Fixes to make privsep+SELinux working if we try to use chage to change passwd- Fix auth_role() interface- Allow numad to read sysfs- Allow matahari-rpcd to execute shell- Add label for ~/.spicec- xdm is executing lspci as root which is requesting a sys_admin priv but seems to succeed without it- Devicekit_disk wants to read the logind sessions file when writing a cd- Add fixes for condor to make condor jobs working correctly- Change label of /var/log/rpmpkgs to cron_log_t- Access requires to allow systemd-tmpfiles --create to work.- Fix obex to be a user application started by the session bus.- Add additional filename trans rules for kerberos- Fix /var/run/heartbeat labeling- Allow apps that are managing rcache to file trans correctly- Allow openvpn to authenticate against ldap server- Containers need to listen to network starting and stopping events
* Wed May 09 2012 Miroslav Grepl 3.10.0-124- Make systemd unit files less specific
* Tue May 08 2012 Miroslav Grepl 3.10.0-123- Fix zarafa labeling- Allow guest_t to fix labeling- corenet_tcp_bind_all_unreserved_ports(ssh_t) should be called with the user_tcp_server boolean- add lxc_contexts- Allow accountsd to read /proc- Allow restorecond to getattr on all file sytems- tmpwatch now calls getpw- Allow apache daemon to transition to pwauth domain- Label content under /var/run/user/NAME/keyring
* as gkeyringd_tmp_t- The obex socket seems to be a stream socket- dd label for /var/run/nologin
* Mon May 07 2012 Miroslav Grepl 3.10.0-122- Allow jetty running as httpd_t to read hugetlbfs files- Allow sys_nice and setsched for rhsmcertd- Dontaudit attempts by mozilla_plugin_t to bind to ssdp ports- Allow setfiles to append to xdm_tmp_t- Add labeling for /export as a usr_t directory- Add labels for .grl files created by gstreamer
* Fri May 04 2012 Miroslav Grepl 3.10.0-121- Add labeling for /usr/share/jetty/bin/jetty.sh- Add jetty policy which contains file type definitios- Allow jockey to use its own fifo_file and make this the default for all domains- Allow mozilla_plugins to use spice (vnc_port/couchdb)- asterisk wants to read the network state- Blueman now uses /var/lib/blueman- Add label for nodejs_debug- Allow mozilla_plugin_t to create ~/.pki directory and content
* Wed May 02 2012 Miroslav Grepl 3.10.0-120- Add clamscan_can_scan_system boolean- Allow mysqld to read kernel network state- Allow sshd to read/write condor lib files- Allow sshd to read/write condor-startd tcp socket- Fix description on httpd_graceful_shutdown- Allow glance_registry to communicate with mysql- dbus_system_domain is using systemd to lauch applications- add interfaces to allow domains to send kill signals to user mail agents- Remove unnessary access for svirt_lxc domains, add privs for virtd_lxc_t- Lots of new access required for secure containers- Corosync needs sys_admin capability- ALlow colord to create shm- .orc should be allowed to be created by any app that can create gstream home content, thumb_t to be specific- Add boolean to control whether or not mozilla plugins can create random content in the users homedir- Add new interface to allow domains to list msyql_db directories, needed for libra- shutdown has to be allowed to delete etc_runtime_t- Fail2ban needs to read /etc/passwd- Allow ldconfig to create /var/cache/ldconfig- Allow tgtd to read hardware state information- Allow collectd to create packet socket- Allow chronyd to send signal to itself- Allow collectd to read /dev/random- Allow collectd to send signal to itself- firewalld needs to execute restorecon- Allow restorecon and other login domains to execute restorecon
* Tue Apr 24 2012 Miroslav Grepl 3.10.0-119- Allow logrotate to getattr on systemd unit files- Add support for tor systemd unit file- Allow apmd to create /var/run/pm-utils with the correct label- Allow l2tpd to send sigkill to pppd- Allow pppd to stream connect to l2tpd- Add label for scripts in /etc/gdm/- Allow systemd_logind_t to ignore mcs constraints on sigkill- Fix files_filetrans_system_conf_named_files() interface- Add labels for /usr/share/wordpress/wp-includes/
*.php- Allow cobbler to get SELinux mode and booleans
* Mon Apr 23 2012 Miroslav Grepl 3.10.0-118- Add unconfined_execmem_exec_t as an alias to bin_t- Allow fenced to read snmp var lib files, also allow it to read usr_t- ontaudit access checks on all executables from mozilla_plugin- Allow all user domains to setexec, so that sshd will work properly if it call setexec(NULL) while running withing a user mode- Allow systemd_tmpfiles_t to getattr all pipes and sockets- Allow glance-registry to send system log messages- semanage needs to manage mock lib files/dirs
* Sun Apr 22 2012 Miroslav Grepl 3.10.0-117- Add policy for abrt-watch-log- Add definitions for jboss_messaging ports- Allow systemd_tmpfiles to manage printer devices- Allow oddjob to use nsswitch- Fix labeling of log files for postgresql- Allow mozilla_plugin_t to execmem and execstack by default- Allow firewalld to execute shell- Fix /etc/wicd content files to get created with the correct label- Allow mcelog to exec shell- Add ~/.orc as a gstreamer_home_t- /var/spool/postfix/lib64 should be labeled lib_t- mpreaper should be able to list all file system labeled directories- Add support for apache to use openstack- Add labeling for /etc/zipl.conf and zipl binary- Turn on allow_execstack and turn off telepathy transition for final release
* Mon Apr 16 2012 Miroslav Grepl 3.10.0-116- More access required for virt_qmf_t- Additional assess required for systemd-logind to support multi-seat- Allow mozilla_plugin to setrlimit- Revert changes to fuse file system to stop deadlock
* Mon Apr 16 2012 Miroslav Grepl 3.10.0-115- Allow condor domains to connect to ephemeral ports- More fixes for condor policy- Allow keystone to stream connect to mysqld- Allow mozilla_plugin_t to read generic USB device to support GPS devices- Allow thum to file name transition gstreamer home content- Allow thum to read all non security files- Allow glance_api_t to connect to ephemeral ports- Allow nagios plugins to read /dev/urandom- Allow syslogd to search postfix spool to support postfix chroot env- Fix labeling for /var/spool/postfix/dev- Allow wdmd chown- Label .esd_auth as pulseaudio_home_t- Have no idea why keyring tries to write to /run/user/dwalsh/dconf/user, but we can dontaudit for now
* Fri Apr 13 2012 Miroslav Grepl 3.10.0-114- Add support for clamd+systemd- Allow fresclam to execute systemctl to handle clamd- Change labeling for /usr/sbin/rpc.ypasswd.env - Allow yppaswd_t to execute yppaswd_exec_t - Allow yppaswd_t to read /etc/passwd- Gnomekeyring socket has been moved to /run/user/USER/- Allow samba-net to connect to ldap port- Allow signal for vhostmd- allow mozilla_plugin_t to read user_home_t socket- New access required for secure Linux Containers- zfs now supports xattrs- Allow quantum to execute sudo and list sysfs- Allow init to dbus chat with the firewalld- Allow zebra to read /etc/passwd
* Tue Apr 10 2012 Miroslav Grepl 3.10.0-113- Allow svirt_t to create content in the users homedir under ~/.libvirt- Fix label on /var/lib/heartbeat- Allow systemd_logind_t to send kill signals to all processes started by a user- Fuse now supports Xattr Support
* Tue Apr 10 2012 Miroslav Grepl 3.10.0-112- upowered needs to setsched on the kernel- Allow mpd_t to manage log files- Allow xdm_t to create /var/run/systemd/multi-session-x- Add rules for missedfont.log to be used by thumb.fc- Additional access required for virt_qmf_t- Allow dhclient to dbus chat with the firewalld- Add label for lvmetad- Allow systemd_logind_t to remove userdomain sock_files- Allow cups to execute usr_t files- Fix labeling on nvidia shared libraries- wdmd_t needs access to sssd and /etc/passwd- Add boolean to allow ftp servers to run in passive mode- Allow namepspace_init_t to relabelto/from a different user system_u from the user the namespace_init running with- Fix using httpd_use_fusefs- Allow chrome_sandbox_nacl to write inherited user tmp files as we allow it for chrome_sandbox
* Fri Apr 06 2012 Miroslav Grepl 3.10.0-111- Rename rdate port to time port, and allow gnomeclock to connect to it- We no longer need to transition to ldconfig from rpm, rpm_script, or anaconda- /etc/auto.
* should be labeled bin_t- Add httpd_use_fusefs boolean- Add fixes for heartbeat- Allow sshd_t to signal processes that it transitions to- Add condor policy- Allow svirt to create monitors in ~/.libvirt- Allow dovecot to domtrans sendmail to handle sieve scripts- Lot of fixes for cfengine
* Tue Apr 03 2012 Miroslav Grepl 3.10.0-110- /var/run/postmaster.
* labeling is no longer needed- Alllow drbdadmin to read /dev/urandom- l2tpd_t seems to use ptmx- group+ and passwd+ should be labeled as /etc/passwd- Zarafa-indexer is a socket
* Fri Mar 30 2012 Miroslav Grepl 3.10.0-109- Ensure lastlog is labeled correctly- Allow accountsd to read /proc data about gdm- Add fixes for tuned- Add bcfg2 fixes which were discovered during RHEL6 testing- More fixes for gnome-keyring socket being moved- Run semanage as a unconfined domain, and allow initrc_t to create tmpfs_t sym links on shutdown- Fix description for files_dontaudit_read_security_files() interface
* Wed Mar 28 2012 Miroslav Grepl 3.10.0-108- Add new policy and man page for bcfg2- cgconfig needs to use getpw calls- Allow domains that communicate with the keyring to use cache_home_t instead of gkeyringd_tmpt- gnome-keyring wants to create a directory in cache_home_t- sanlock calls getpw
* Wed Mar 28 2012 Miroslav Grepl 3.10.0-107- Add numad policy and numad man page- Add fixes for interface bugs discovered by SEWatch- Add /tmp support for squid- Add fix for #799102
* change default labeling for /var/run/slapd.
* sockets- Make thumb_t as userdom_home_reader- label /var/lib/sss/mc same as pubconf, so getpw domains can read it- Allow smbspool running as cups_t to stream connect to nmbd- accounts needs to be able to execute passwd on behalf of users- Allow systemd_tmpfiles_t to delete boot flags- Allow dnssec_trigger to connect to apache ports- Allow gnome keyring to create sock_files in ~/.cache- google_authenticator is using .google_authenticator- sandbox running from within firefox is exposing more leaks- Dontaudit thumb to read/write /dev/card0- Dontaudit getattr on init_exec_t for gnomeclock_t- Allow certmonger to do a transition to certmonger_unconfined_t- Allow dhcpc setsched which is caused by nmcli- Add rpm_exec_t for /usr/sbin/bcfg2- system cronjobs are sending dbus messages to systemd_logind- Thumnailers read /dev/urand
* Thu Mar 22 2012 Miroslav Grepl 3.10.0-106- Allow auditctl getcap- Allow vdagent to use libsystemd-login- Allow abrt-dump-oops to search /etc/abrt- Got these avc\'s while trying to print a boarding pass from firefox- Devicekit is now putting the media directory under /run/media- Allow thumbnailers to create content in ~/.thumbails directory- Add support for proL2TPd by Dominick Grift- Allow all domains to call getcap- wdmd seems to get a random chown capability check that it does not need- Allow vhostmd to read kernel sysctls
* Wed Mar 21 2012 Miroslav Grepl 3.10.0-105- Allow chronyd to read unix- Allow hpfax to read /etc/passwd- Add support matahari vios-proxy-
* apps and add virtd_exec_t label for them- Allow rpcd to read quota_db_t- Update to man pages to match latest policy- Fix bug in jockey interface for sepolgen-ifgen- Add initial svirt_prot_exec_t policy
* Mon Mar 19 2012 Miroslav Grepl 3.10.0-104- More fixes for systemd from Dan Walsh
* Mon Mar 19 2012 Miroslav Grepl 3.10.0-103- Add a new type for /etc/firewalld and allow firewalld to write to this directory- Add definition for ~/Maildir, and allow mail deliver domains to write there- Allow polipo to run from a cron job- Allow rtkit to schedule wine processes- Allow mozilla_plugin_t to acquire a bug, and allow it to transition gnome content in the home dir to the proper label- Allow users domains to send signals to consolehelper domains
* Fri Mar 16 2012 Miroslav Grepl 3.10.0-102- More fixes for boinc policy- Allow polipo domain to create its own cache dir and pid file- Add systemctl support to httpd domain- Add systemctl support to polipo, allow NetworkManager to manage the service- Add policy for jockey-backend- Add support for motion daemon which is now covered by zoneminder policy- Allow colord to read/write motion tmpfs- Allow vnstat to search through var_lib_t directories- Stop transitioning to quota_t, from init an sysadm_t
* Wed Mar 14 2012 Miroslav Grepl 3.10.0-101- Add svirt_lxc_file_t as a customizable type
* Wed Mar 14 2012 Miroslav Grepl 3.10.0-100- Add additional fixes for icmp nagios plugin- Allow cron jobs to open fifo_files from cron, since service script opens /dev/stdin- Add certmonger_unconfined_exec_t- Make sure tap22 device is created with the correct label- Allow staff users to read systemd unit files- Merge in previously built policy- Arpwatch needs to be able to start netlink sockets in order to start- Allow cgred_t to sys_ptrace to look at other DAC Processes
* Mon Mar 12 2012 Miroslav Grepl 3.10.0-99- Back port some of the access that was allowed in nsplugin_t- Add definitiona for couchdb ports- Allow nagios to use inherited users ttys- Add git support for mock- Allow inetd to use rdate port- Add own type for rdate port- Allow samba to act as a portmapper- Dontaudit chrome_sandbox attempts to getattr on chr_files in /dev- New fixes needed for samba4- Allow apps that use lib_t to read lib_t symlinks
* Fri Mar 09 2012 Miroslav Grepl 3.10.0-98- Add policy for nove-cert- Add labeling for nova-openstack systemd unit files- Add policy for keystoke
* Thu Mar 08 2012 Miroslav Grepl 3.10.0-97- Fix man pages fro domains- Add man pages for SELinux users and roles- Add storage_dev_filetrans_named_fixed_disk() and use it for smartmon- Add policy for matahari-rpcd- nfsd executes mount command on restart- Matahari domains execute renice and setsched- Dontaudit leaked tty in mozilla_plugin_config- mailman is changing to a per instance naming- Add 7600 and 4447 as jboss_management ports- Add fixes for nagios event handlers- Label httpd.event as httpd_exec_t, it is an apache daemon
* Mon Mar 05 2012 Miroslav Grepl 3.10.0-96- Add labeling for /var/spool/postfix/dev/log- NM reads sysctl.conf- Iscsi log file context specification fix- Allow mozilla plugins to send dbus messages to user domains that transition to it- Allow mysql to read the passwd file- Allow mozilla_plugin_t to create mozilla home dirs in user homedir- Allow deltacloud to read kernel sysctl- Allow postgresql_t to connectto itselfAllow postgresql_t to connectto itself- Allow postgresql_t to connectto itself- Add login_userdomain attribute for users which can log in using terminal
* Tue Feb 28 2012 Miroslav Grepl 3.10.0-95- Allow sysadm_u to reach system_r by default #784011- Allow nagios plugins to use inherited user terminals- Razor labeling is not used no longer- Add systemd support for matahari- Add port_types to man page, move booleans to the top, fix some english- Add support for matahari-sysconfig-console- Clean up matahari.fc- Fix matahari_admin() interfac- Add labels for/etc/ssh/ssh_host_
*.pub keys
* Mon Feb 27 2012 Miroslav Grepl 3.10.0-94- Allow ksysguardproces to send system log msgs- Allow boinc setpgid and signull- Allow xdm_t to sys_ptrace to run pidof command- Allow smtpd_t to manage spool files/directories and symbolic links- Add labeling for jetty- Needed changes to get unbound/dnssec to work with openswan
* Thu Feb 23 2012 Miroslav Grepl 3.10.0-93- Add user_fonts_t alias xfs_tmp_t- Since depmod now runs as insmod_t we need to write to kernel_object_t- Allow firewalld to dbus chat with networkmanager- Allow qpidd to connect to matahari ports- policykit needs to read /proc for uses not owned by it- Allow systemctl apps to connecto the init stream
* Wed Feb 22 2012 Miroslav Grepl 3.10.0-92- Turn on deny_ptrace boolean
* Tue Feb 21 2012 Miroslav Grepl 3.10.0-91- Remove pam_selinux.8 man page. There was a conflict.
* Tue Feb 21 2012 Miroslav Grepl 3.10.0-90- Add proxy class and read access for gssd_proxy- Separate out the sharing public content booleans- Allow certmonger to execute a script and send signals to apache and dirsrv to reload the certificate- Add label transition for gstream-0.10 and 12- Add booleans to allow rsync to share nfs and cifs file sytems- chrome_sandbox wants to read the /proc/PID/exe file of the program that executed it- Fix filename transitions for cups files- Allow denyhosts to read \"unix\"- Add file name transition for locale.conf.new- Allow boinc projects to gconf config files- sssd needs to be able to increase the socket limit under certain loads- sge_execd needs to read /etc/passwd- Allow denyhost to check network state- NetworkManager needs to read sessions data- Allow denyhost to check network state- Allow xen to search virt images directories- Add label for /dev/megaraid_sas_ioctl_node- Add autogenerated man pages
* Thu Feb 16 2012 Miroslav Grepl 3.10.0-89- Allow boinc project to getattr on fs- Allow init to execute initrc_state_t- rhev-agent package was rename to ovirt-guest-agent- If initrc_t creates /etc/local.conf then we need to make sure it is labeled correctly- sytemd writes content to /run/initramfs and executes it on shutdown- kdump_t needs to read /etc/mtab, should be back ported to F16- udev needs to load kernel modules in early system boot
* Tue Feb 14 2012 Miroslav Grepl 3.10.0-88- Need to add sys_ptrace back in since reading any content in /proc can cause these accesses- Add additional systemd interfaces which are needed fro
*_admin interfaces- Fix bind_admin() interface
* Mon Feb 13 2012 Miroslav Grepl 3.10.0-87- Allow firewalld to read urand- Alias java, execmem_mono to bin_t to allow third parties- Add label for kmod- /etc/redhat-lsb contains binaries- Add boolean to allow gitosis to send mail- Add filename transition also for \"event20\"- Allow systemd_tmpfiles_t to delete all file types- Allow collectd to ipc_lock
* Fri Feb 10 2012 Miroslav Grepl 3.10.0-86- make consoletype_exec optional, so we can remove consoletype policy- remove unconfined_permisive.patch- Allow openvpn_t to inherit user home content and tmp content- Fix dnssec-trigger labeling- Turn on obex policy for staff_t- Pem files should not be secret- Add lots of rules to fix AVC\'s when playing with containers- Fix policy for dnssec- Label ask-passwd directories correctly for systemd
* Thu Feb 09 2012 Miroslav Grepl 3.10.0-85- sshd fixes seem to be causing unconfined domains to dyntrans to themselves- fuse file system is now being mounted in /run/user- systemd_logind is sending signals to processes that are dbus messaging with it- Add support for winshadow port and allow iscsid to connect to this port- httpd should be allowed to bind to the http_port_t udp socket- zarafa_var_lib_t can be a lnk_file- A couple of new .xsession-errors files- Seems like user space and login programs need to read logind_sessions_files- Devicekit disk seems to be being launched by systemd- Cleanup handling of setfiles so most of rules in te file- Correct port number for dnssec- logcheck has the home dir set to its cache
* Tue Feb 07 2012 Miroslav Grepl 3.10.0-84- Add policy for grindengine MPI jobs
* Mon Feb 06 2012 Miroslav Grepl 3.10.0-83- Add new sysadm_secadm.pp module
* contains secadm definition for sysadm_t- Move user_mail_domain access out of the interface into the te file- Allow httpd_t to create httpd_var_lib_t directories as well as files- Allow snmpd to connect to the ricci_modcluster stream- Allow firewalld to read /etc/passwd- Add auth_use_nsswitch for colord- Allow smartd to read network state- smartdnotify needs to read /etc/group
* Fri Feb 03 2012 Miroslav Grepl 3.10.0-82- Allow gpg and gpg_agent to store sock_file in gpg_secret_t directory- lxdm startup scripts should be labeled bin_t, so confined users will work- mcstransd now creates a pid, needs back port to F16- qpidd should be allowed to connect to the amqp port- Label devices 010-029 as usb devices- ypserv packager says ypserv does not use tmp_t so removing selinux policy types- Remove all ptrace commands that I believe are caused by the kernel/ps avcs- Add initial Obex policy- Add logging_syslogd_use_tty boolean- Add polipo_connect_all_unreserved bolean- Allow zabbix to connect to ftp port- Allow systemd-logind to be able to switch VTs- Allow apache to communicate with memcached through a sock_file
* Tue Jan 31 2012 Dan Walsh 3.10.0-81.2- Fix file_context.subs_dist for now to work with pre usrmove
* Mon Jan 30 2012 Miroslav Grepl 3.10.0-81- More /usr move fixes
* Thu Jan 26 2012 Miroslav Grepl 3.10.0-80- Add zabbix_can_network boolean- Add httpd_can_connect_zabbix boolean- Prepare file context labeling for usrmove functions- Allow system cronjobs to read kernel network state- Add support for selinux_avcstat munin plugin- Treat hearbeat with corosync policy- Allow corosync to read and write to qpidd shared mem- mozilla_plugin is trying to run pulseaudio - Fixes for new sshd patch for running priv sep domains as the users context- Turn off dontaudit rules when turning on allow_ypbind- udev now reads /etc/modules.d directory
* Tue Jan 24 2012 Miroslav Grepl 3.10.0-79- Turn on deny_ptrace boolean for the Rawhide run, so we can test this out- Cups exchanges dbus messages with init- udisk2 needs to send syslog messages- certwatch needs to read /etc/passwd
* Mon Jan 23 2012 Miroslav Grepl 3.10.0-78- Add labeling for udisks2- Allow fsadmin to communicate with the systemd process
* Mon Jan 23 2012 Miroslav Grepl 3.10.0-77- Treat Bip with bitlbee policy
* Bip is an IRC proxy- Add port definition for interwise port- Add support for ipa_memcached socket- systemd_jounald needs to getattr on all processes- mdadmin fixes
* uses getpw- amavisd calls getpwnam()- denyhosts calls getpwall()
* Fri Jan 20 2012 Miroslav Grepl 3.10.0-76- Setup labeling of /var/rsa and /var/lib/rsa to allow login programs to write there- bluetooth says they do not use /tmp and want to remove the type- Allow init to transition to colord- Mongod needs to read /proc/sys/vm/zone_reclaim_mode- Allow postfix_smtpd_t to connect to spamd- Add boolean to allow ftp to connect to all ports > 1023- Allow sendmain to write to inherited dovecot tmp files- setroubleshoot needs to be able to execute rpm to see what version of packages
* Mon Jan 16 2012 Miroslav Grepl 3.10.0-75- Merge systemd patch- systemd-tmpfiles wants to relabel /sys/devices/system/cpu/online- Allow deltacloudd dac_override, setuid, setgid caps- Allow aisexec to execute shell- Add use_nfs_home_dirs boolean for ssh-keygen
* Fri Jan 13 2012 Dan Walsh 3.10.0-74.2- Fixes to make rawhide boot in enforcing mode with latest systemd changes
* Wed Jan 11 2012 Miroslav Grepl 3.10.0-74- Add labeling for /var/run/systemd/journal/syslog- libvirt sends signals to ifconfig- Allow domains that read logind session files to list them
* Wed Jan 11 2012 Miroslav Grepl 3.10.0-73- Fixed destined form libvirt-sandbox- Allow apps that list sysfs to also read sympolicy links in this filesystem- Add ubac_constrained rules for chrome_sandbox- Need interface to allow domains to use tmpfs_t files created by the kernel, used by libra- Allow postgresql to be executed by the caller- Standardize interfaces of daemons - Add new labeling for mm-handler- Allow all matahari domains to read network state and etc_runtime_t files
* Wed Jan 04 2012 Miroslav Grepl 3.10.0-72- New fix for seunshare, requires seunshare_domains to be able to mounton /- Allow systemctl running as logrotate_t to connect to private systemd socket- Allow tmpwatch to read meminfo- Allow rpc.svcgssd to read supported_krb5_enctype- Allow zarafa domains to read /dev/random and /dev/urandom- Allow snmpd to read dev_snmp6- Allow procmail to talk with cyrus- Add fixes for check_disk and check_nagios plugins
* Tue Dec 20 2011 Miroslav Grepl 3.10.0-71- default trans rules for Rawhide policy- Make sure sound_devices controlC
* are labeled correctly on creation- sssd now needs sys_admin- Allow snmp to read all proc_type- Allow to setup users homedir with quota.group
* Mon Dec 19 2011 Miroslav Grepl 3.10.0-70- Add httpd_can_connect_ldap() interface- apcupsd_t needs to use seriel ports connected to usb devices- Kde puts procmail mail directory under ~/.local/share- nfsd_t can trigger sys_rawio on tests that involve too many mountpoints, dontaudit for now- Add labeling for /sbin/iscsiuio
* Wed Dec 14 2011 Miroslav Grepl 3.10.0-69- Add label for /var/lib/iscan/interpreter- Dont audit writes to leaked file descriptors or redirected output for nacl- NetworkManager needs to write to /sys/class/net/ib
*/mode
* Tue Dec 13 2011 Miroslav Grepl 3.10.0-68- Allow abrt to request the kernel to load a module- Make sure mozilla content is labeled correctly- Allow tgtd to read system state- More fixes for boinc
* allow to resolve dns name
* re-write boinc policy to use boinc_domain attribute- Allow munin services plugins to use NSCD services
* Thu Dec 08 2011 Miroslav Grepl 3.10.0-67- Allow mozilla_plugin_t to manage mozilla_home_t- Allow ssh derived domain to execute ssh-keygen in the ssh_keygen_t domain- Add label for tumblerd
* Wed Dec 07 2011 Miroslav Grepl 3.10.0-66- Fixes for xguest package
* Tue Dec 06 2011 Miroslav Grepl 3.10.0-65- Fixes related to /bin, /sbin- Allow abrt to getattr on blk files- Add type for rhev-agent log file- Fix labeling for /dev/dmfm- Dontaudit wicd leaking- Allow systemd_logind_t to look at process info of apps that exchange dbus messages with it- Label /etc/locale.conf correctly- Allow user_mail_t to read /dev/random- Allow postfix-smtpd to read MIMEDefang- Add label for /var/log/suphp.log- Allow swat_t to connect and read/write nmbd_t sock_file- Allow systemd-tmpfiles to setattr for /run/user/gdm/dconf- Allow systemd-tmpfiles to change user identity in object contexts- More fixes for rhev_agentd_t consolehelper policy
* Thu Dec 01 2011 Miroslav Grepl 3.10.0-64- Use fs_use_xattr for squashf- Fix procs_type interface- Dovecot has a new fifo_file /var/run/dovecot/stats-mail- Dovecot has a new fifo_file /var/run/stats-mail- Colord does not need to connect to network- Allow system_cronjob to dbus chat with NetworkManager- Puppet manages content, want to make sure it labels everything correctly
* Tue Nov 29 2011 Miroslav Grepl 3.10.0-63- Change port 9050 to tor_socks_port_t and then allow openvpn to connect to it- Allow all postfix domains to use the fifo_file- Allow sshd_t to getattr on all file systems in order to generate avc on nfs_t- Allow apmd_t to read grub.cfg- Let firewallgui read the selinux config- Allow systemd-tmpfiles to delete content in /root that has been moved to /tmp- Fix devicekit_manage_pid_files() interface- Allow squid to check the network state- Dontaudit colord getattr on file systems- Allow ping domains to read zabbix_tmp_t files
* Wed Nov 23 2011 Miroslav Grepl 3.10.0-59- Allow mcelog_t to create dir and file in /var/run and label it correctly- Allow dbus to manage fusefs- Mount needs to read process state when mounting gluster file systems- Allow collectd-web to read collectd lib files- Allow daemons and system processes started by init to read/write the unix_stream_socket passed in from as stdin/stdout/stderr- Allow colord to get the attributes of tmpfs filesystem- Add sanlock_use_nfs and sanlock_use_samba booleans- Add bin_t label for /usr/lib/virtualbox/VBoxManage
* Wed Nov 16 2011 Miroslav Grepl 3.10.0-58- Add ssh_dontaudit_search_home_dir- Changes to allow namespace_init_t to work- Add interface to allow exec of mongod, add port definition for mongod port, 27017- Label .kde/share/apps/networkmanagement/certificates/ as home_cert_t- Allow spamd and clamd to steam connect to each other- Add policy label for passwd.OLD- More fixes for postfix and postfix maildro- Add ftp support for mozilla plugins- Useradd now needs to manage policy since it calls libsemanage- Fix devicekit_manage_log_files() interface- Allow colord to execute ifconfig- Allow accountsd to read /sys- Allow mysqld-safe to execute shell- Allow openct to stream connect to pcscd- Add label for /var/run/nm-dns-dnsmasq\\.conf- Allow networkmanager to chat with virtd_t
* Fri Nov 11 2011 Dan Walsh 3.10.0-57- Pulseaudio changes- Merge patches
* Thu Nov 10 2011 Dan Walsh 3.10.0-56- Merge patches back into git repository.
* Tue Nov 08 2011 Dan Walsh 3.10.0-55.2- Remove allow_execmem boolean and replace with deny_execmem boolean
* Tue Nov 08 2011 Dan Walsh 3.10.0-55.1- Turn back on allow_execmem boolean
* Mon Nov 07 2011 Miroslav Grepl 3.10.0-55- Add more MCS fixes to make sandbox working- Make faillog MLS trusted to make sudo_$1_t working- Allow sandbox_web_client_t to read passwd_file_t- Add .mailrc file context- Remove execheap from openoffice domain- Allow chrome_sandbox_nacl_t to read cpu_info- Allow virtd to relabel generic usb which is need if USB device- Fixes for virt.if interfaces to consider chr_file as image file type
* Fri Nov 04 2011 Dan Walsh 3.10.0-54.1- Remove Open Office policy- Remove execmem policy
* Fri Nov 04 2011 Miroslav Grepl 3.10.0-54- MCS fixes- quota fixes
* Thu Nov 03 2011 Dan Walsh 3.10.0-53.1- Remove transitions to consoletype
* Tue Nov 01 2011 Miroslav Grepl 3.10.0-53- Make nvidia
* to be labeled correctly- Fix abrt_manage_cache() interface- Make filetrans rules optional so base policy will build- Dontaudit chkpwd_t access to inherited TTYS- Make sure postfix content gets created with the correct label- Allow gnomeclock to read cgroup- Fixes for cloudform policy
* Thu Oct 27 2011 Miroslav Grepl 3.10.0-52- Check in fixed for Chrome nacl support
* Thu Oct 27 2011 Miroslav Grepl 3.10.0-51- Begin removing qemu_t domain, we really no longer need this domain. - systemd_passwd needs dac_overide to communicate with users TTY\'s- Allow svirt_lxc domains to send kill signals within their container
* Thu Oct 27 2011 Dan Walsh 3.10.0-50.2- Remove qemu.pp again without causing a crash
* Wed Oct 26 2011 Dan Walsh