|
|
 |
|
|
Changelog for selinux-policy-targeted-3.13.1-268.el7.noarch.rpm :
* Tue May 12 2020 Zdenek Pytela - 3.13.1-268- Allow rhsmd read process state of all domains and kernel threadsResolves: rhbz#1837461- Allow ipa-adtrust-install restart sssd and dirsrv servicesResolves: rhbz#1820298- Allow nagios_plugin_domain execute programs in bin directoriesResolves: rhbz#1824625- selinux policy: add the right context for org.freeipa.server.trust-enable-agentRelated: rhbz#1820298
* Mon Mar 23 2020 Zdenek Pytela - 3.13.1-267- Allow chronyd_t domain to exec shellResolves: rhbz#1775573- Allow pmie daemon to send signal pcmd daemonResolves: rhbz#1770123- Allow auditd poweroff or switch to single modeResolves: rhbz#1780332
* Wed Nov 06 2019 Lukas Vrabec - 3.13.1-266- Dontaudit tmpreaper_t getting attributes from sysctl_type filesResolves: rhbz#1765063
* Thu Oct 31 2019 Lukas Vrabec - 3.13.1-265- Allow tmpreaper_t domain to getattr files labeled as mtrr_device_tResolves: rhbz#1765063
* Wed Oct 30 2019 Lukas Vrabec - 3.13.1-264- Allow tmpwatch process labeled as tmpreaper_t domain to execute fuser commandResolves: rhbz#1765063
* Wed Oct 30 2019 Lukas Vrabec - 3.13.1-263- Update tmpreaper_t policy due to fuser commandResolves: rhbz#1765063
* Fri Oct 25 2019 Lukas Vrabec - 3.13.1-262- Allow tmpreaper_t domain to read all domains stateResolves: rhbz#1765063
* Mon Oct 14 2019 Lukas Vrabec - 3.13.1-261- Update sudo_role_template() to allow caller domain to read syslog pid filesResolves: rhbz#1651253
* Fri Oct 11 2019 Lukas Vrabec - 3.13.1-260- Allow sbd_t domain to check presence of processes labeled as cluster_tResolves: rhbz#1753623
* Wed Sep 25 2019 Lukas Vrabec - 3.13.1-259- Allow ganesha_t domain to read system network state and connect to cyphesis_port_tResolves: rhbz#1653857- Label /var/log/collectd.log as collectd_log_t- Update gnome_role_template() interface to make working sysadm_u SELinux able to login to X sessionsResolves: rhbz#1688729- Update collectd policy to allow daemon create /var/log/collectd with collectd_log_t labelResolves: rhbz#1658319- Update sbd policy to allow manage cgroupsResolves: rhbz#1715136- Allow sudo userdomain to run rpm related commands- Update rpm_run() interface to avoid duplicate role transition in sudo_role_templateResolves: rhbz#1651253
* Fri Aug 16 2019 Lukas Vrabec - 3.13.1-258- Update gnome_role_template() interface to make working sysadm_u SELinux able to login to X sessionsResolves: rhbz#1688729- Update collectd policy to allow daemon create /var/log/collectd with collectd_log_t labelResolves: rhbz#1658319
* Wed Aug 14 2019 Lukas Vrabec - 3.13.1-257- Update sbd policy to allow manage cgroupsResolves: rhbz#1715136
* Tue Aug 13 2019 Lukas Vrabec - 3.13.1-256- Allow cupsd_t domain to manage cupsd_tmp_t temp link filesResolves: rhbz#1719754- Allow svnserve_t domain to read /dev/randomResolves: rhbz#1727458- Update sudodomains to make working confined users run sudo/suResolves: rhbz#1699391
* Tue Aug 06 2019 Lukas Vrabec - 3.13.1-255- Allow virtlockd process read virtlockd.conf fileResolves: rhbz#1714896
* Fri Jul 26 2019 Lukas Vrabec - 3.13.1-254- Rebuild selinux-policy build because of broken RHEL-7.8 buildroodduring build of selinux-policy-3.13.1-253Resolves: rhbz#1727341
* Mon Jul 22 2019 Lukas Vrabec - 3.13.1-253- Label user cron spool file with user_cron_spool_tResolves: rhbz#1727341- Allow svnserve_t domain to read system stateResolves: rhbz#1727458- Update svnserve_t policy to make working svnserve hooksResolves: rhbz#1727458- Update gnome_role_template() template to allow sysadm_t confined user to login to xsessionResolves: rhbz#1727379- Update gnome_role_template() to allow _gkeyringd_t domains to chat with systemd_logind over dbusResolves: rhbz#1727379- Allow userdomain gkeyringd domain to create stream socket with userdomainResolves: rhbz#1727379- Allow cupsd_t to create lnk_files in /tmp. BZ(1401634)Resolves: rhbz#1719754- Allow mysqld_t domain to manage cluster pid filesResolves: rhbz#1715805- Relabel /usr/sbin/virtlockd from virt_exec_t to virtlogd_exec_t.Resolves: rhbz#1714896- Allow systemd_hostnamed_t domain to dbus chat with sosreport_t domainResolves: rhbz#1705599- Allow rhsmcertd_t domain to send signull to all domainsResolves: rhbz#1701338- Allow cloud_init_t domain to ccreate iptables files with correct SELinux labelResolves: rhbz#1699249- Allow dnsmasq_t domain to manage NetworkManager_var_lib_t files- Allow certmonger to geattr of filesystems BZ(1578755)- Update tomcat_can_network_connect_db boolean to allow tomcat domains also connect to redis ports Resolves: rhbz#1687497- Allow lograte_t domain to manage collect_rw_content files and dirsResolves: rhbz#1658319- Add interface collectd_manage_rw_content()- Allow glusterd_t domain to setpgidResolves: rhbz#1653857- Allow sysadm_sudo_t to use SELinux tooling.Resolves: rhbz#1727341- Allow sysadm_t domain to create netlink selinux socketsResolves: rhbz#1727379- Allow systemd_resolved_t to dbusd chat with NetworkManager_tResolves: rhbz#1723877- Allow crack_t domain read /et/passwd filesResolves: rhbz#1721093- Allow sysadm_t domain to dbus chat with rtkit daemonResolves: rhbz#1720546- Allow x_userdomains to nnp domain transition to thumb_t domainResolves: rhbz#1712603- Dontaudit writing to user home dirs by gnome-keyring-daemonResolves: rhbz#1703959- Update logging_send_audit_msgs(sudodomain() to control TTY auditing for netlink socket for audit serviceResolves: rhbz#1699391- Allow systemd_tmpfiles_t domain to relabel from usermodehelper_t filesResolves: rhbz#1699063- Add interface kernel_relabelfrom_usermodehelper()
* Wed Jul 10 2019 Lukas Vrabec - 3.13.1-252.1- Allow sbd_t domain to use nsswitchResolves: rhbz#1728593
* Thu Jun 27 2019 Lukas Vrabec - 3.13.1-252- Allow ganesha_t domain to connect to tcp portmap_port_tResolves: rhbz#1715088
* Mon Jun 10 2019 Lukas Vrabec - 3.13.1-251- Allow redis to creating tmp files with own labelResolves: rhbz#1646765
* Wed Jun 05 2019 Lukas Vrabec - 3.13.1-250- Allow ctdb_t domain to manage samba_var_t files/links/sockets and dirsResolves: rhbz#1716400
* Wed May 22 2019 Lukas Vrabec - 3.13.1-249- Allow nrpe_t domain to read process state of systemd_logind_t- Add interface systemd_logind_read_state()Resolves: rhbz#1653309
* Tue May 21 2019 Lukas Vrabec - 3.13.1-248- Label /etc/rhsm as rhsmcertd_config_tResolves: rhbz#1703573
* Fri May 17 2019 Lukas Vrabec - 3.13.1-247- Fix typo in gpg SELinux module- Update gpg policy to make ti working with confined usersResolves: rhbz#1535109- Alow nrpe_t to send signull to sssd domain when nagios_run_sudo boolean is turned onResolves: rhbz#1653309- Allow nrpe_t domain to be dbus clienntResolves: rhbz#1653309- Add interface sssd_signull()Resolves: rhbz#1653309- Update userdomains to allow confined users to create gpg keysResolves: rhbz#1535109
* Thu May 02 2019 Lukas Vrabec - 3.13.1-246- Allow ngaios to use chown capabilityResolves: rhbz#1653309- Dontaudit gpg_domain to create netlink_audit socketsResolves: rhbz#1535109- Update fs_rw_cephfs_files() interface to allow also caller domain to read/write cephpfs_t lnk filesResolves: rhbz#1558836- Update domain_can_mmap_files() boolean to allow also mmap lnk files
* Thu Apr 25 2019 Lukas Vrabec - 3.13.1-245- Allow rhsmcertd_t domain to read yum.log file labeled as rpm_log_tResolves: rhbz#1695342
* Tue Apr 23 2019 Lukas Vrabec - 3.13.1-244- Update Nagios policy when sudo is usedResolves: rhbz#1653309
* Mon Apr 08 2019 Lukas Vrabec - 3.13.1-243- Allow modemmanager_t domain to write to raw_ip file labeled as sysfs_tResolves: rhbz#1676810
* Tue Mar 26 2019 Lukas Vrabec - 3.13.1-242- Make shell_exec_t type as entrypoint for vmtools_unconfined_t.Resolves: rhbz#1656814
* Wed Mar 13 2019 Lukas Vrabec - 3.13.1-241- Update vmtools policy Resolves: rhbz#1656814 Allow domain transition from vmtools_t to vmtools_unconfined_t when shell_exec_t is entrypoint.- Allow virt_qemu_ga_t domain to read udev_var_run_t filesResolves: rhbz#1663092- Update nagios_run_sudo boolean with few allow rules related to accessing sssdResolves: rhbz#1653309- Allow nfsd_t to read nvme block devices BZ(1562554)Resolves: rhbz#1655493- Allow tangd_t domain to bind on tcp ports labeled as tangd_port_tResolves: rhbz#1650909- Allow all domains to send dbus msgs to vmtools_unconfined_t processesResolves: rhbz#1656814- Label /dev/pkey as crypt_device_tResolves: rhbz#1623068- Allow sudodomains to write to systemd_logind_sessions_t pipes.Resolves: rhbz#1687452- Allow all user domains to read realmd_var_lib_t files and dirs to check if IPA is configured on the systemResolves: rhbz#1667962- Fixes: xenconsole does not startResolves: rhbz#1601525- Label /usr/lib64/libcuda.so.XX.XX library as textrel_shlib_t.Resolves: rhbz#1636197- Create tangd_port_t with default label tcp/7406Resolves: rhbz#1650909
* Tue Mar 05 2019 Lukas Vrabec - 3.13.1-240- named wants to access /proc/sys/net/ipv4/ip_local_port_range to get ehphemeral range.Resolves: rhbz#1683754- Allow sbd_t domain to bypass permission checks for sending signalsResolves: rhbz#1671132- Allow sbd_t domain read/write all sysctlsResolves: rhbz#1671132- Allow kpatch_t domain to communicate with policykit_t domsin over dbusResolves: rhbz#1602435- Allow boltd_t to stream connect to sytem dbusResolves: rhbz#1589086- Update userdom_admin_user_template() and init_prog_run_bpf() interfaces to make working bpftool for confined adminResolves: rhbz#1626115- Update unconfined_dbus_send() interface to allow both direction communication over dbus with unconfined process.Resolves: rhbz#1589086
* Fri Mar 01 2019 Lukas Vrabec - 3.13.1-239- Allow sbd_t domain read/write all sysctlsResolves: rhbz#1671132- Allow kpatch_t domain to communicate with policykit_t domsin over dbusResolves: rhbz#1602435- Allow boltd_t to stream connect to sytem dbusResolves: rhbz#1589086- Update unconfined_dbus_send() interface to allow both direction communication over dbus with unconfined process.Resolves: rhbz#1589086
* Mon Feb 25 2019 Lukas Vrabec - 3.13.1-238- Update redis_enable_notify() boolean to fix sending e-mail by redis when this boolean is turned onResolves: rhbz#1646765
* Tue Feb 19 2019 Lukas Vrabec - 3.13.1-237- Allow virtd_lxc_t domains use BPFResolves: rhbz#1626115- F29 NetworkManager implements a new code for IPv4 address conflict detection (RFC 5227) based on n-acd [1], which uses eBPF to process ARP packets from the network.Resolves: rhbz#1626115- Allow unconfined user all perms under bpf class BZ(1565738Resolves: rhbz#1626115- Allow unconfined and sysadm users to use bpftool BZ(1591440)Resolves: rhbz#1626115- Allow systemd to manage bpf dirs/filesResolves: rhbz#1626115- Create new type bpf_t and label /sys/fs/bpf with this typeResolves:rhbz#1626115- Add new interface init_prog_run_bpf()Resolves:rhbz#1626115- add definition of bpf class and systemd permsResolves: rhbz#1626115
* Sun Feb 03 2019 Lukas Vrabec - 3.13.1-236- Update policy with multiple allow rules to make working installing VM in MLS policyResolves: rhbz#1558121- Allow virt domain to use interited virtlogd domains fifo_fileResolves: rhbz#1558121- Allow chonyc_t domain to rw userdomain pipesResolves: rhbz#1618757- Add file contexts in ganesha.fc file to label logging ganesha files properly.Resolves: rhbz#1628247
* Thu Jan 31 2019 Lukas Vrabec - 3.13.1-235- Allow sandbox_xserver_t domain write to user_tmp_t filesResolves: rhbz#1646521- Allow virt_qemu_ga_t domain to read network stateResolves: rhbz#1630347- Bolt added d-bus API for force-powering the thunderbolt controller, so system-dbusd needs acces to boltd pipesResolves: rhbz#1589086- Add boltd policyResolves: rhbz#1589086- Allow virt domains to read/write cephfs filesystemsResolves: rhbz#1558836- Allow gpg_t to create own tmpfs dirs and socketsResolves: rhbz#1535109- Allow gpg_agent_t to send msgs to syslog/journalResolves: rhbz#1535109- Allow virtual machine to write to fixed_disk_device_tResolves: rhbz#1499208- Update kdump_manage_crash() interface to allow also manage dirs by caller domainResolves: rhbz#1491585- Add kpatch policyResolves: rhbz#1602435- Label /usr/bin/mysqld_safe_helper as mysqld_exec_t instead of bin_tResolves: rhbz#1623942- Allow svnserve_t domain to create in /tmp svn_0 file labeled as krb5_host_rcache_tResolves: rhbz#1475271- Allow systemd to mount boltd_var_run_t dirsResolves: rhbz#1589086- Allow systemd to mounont boltd lib dirsResolves: rhbz#1589086- Allow sysadm_t,staff_t and unconfined_t domain to execute kpatch as kpatch_t domainResolves: rhbz#1602435- Allow passwd_t domain chroot- Add miscfiles_filetrans_named_content_letsencrypt() to optional_block- Allow unconfined domains to create letsencrypt directory in /var/lib labeled as cert_tResolves: rhbz#1447278- Allow staff_t user to systemctl iptables units.Resolves: rhbz#1360470
* Thu Jan 31 2019 Lukas Vrabec - 3.13.1-234- Label /usr/bin/mysqld_safe_helper as mysqld_exec_t instead of bin_tResolves: rhbz#1623942- Allow svnserve_t domain to create in /tmp svn_0 file labeled as krb5_host_rcache_tResolves: rhbz#1475271- Allow passwd_t domain chroot- Add miscfiles_filetrans_named_content_letsencrypt() to optional_block- Allow unconfined domains to create letsencrypt directory in /var/lib labeled as cert_tResolves: rhbz#1447278- Allow staff_t user to systemctl iptables units.Resolves: rhbz#1360470
* Thu Jan 17 2019 Lukas Vrabec - 3.13.1-233- Allow gssd_t domain to manage kernel keyrings of every domain.Resolves: rhbz#1487350- Add new interface domain_manage_all_domains_keyrings()Resolves: rhbz#1487350
* Sun Jan 13 2019 Lukas Vrabec - 3.13.1-232- Allow gssd_t domain to read/write kernel keyrings of every domain.Resolves: rhbz#1487350- Add interface domain_rw_all_domains_keyrings()Resolves: rhbz#1487350
* Wed Dec 19 2018 Lukas Vrabec - 3.13.1-231- Update snapperd policy to allow snapperd manage all non security dirs.Resolves: rhbz#1619306
* Fri Nov 09 2018 Lukas Vrabec - 3.13.1-230-Allow nova_t domain to use pamResolves: rhbz:#1640528- sysstat: grant sysstat_t the search_dir_perms setResolves: rhbz#1637416- Allow cinder_volume_t domain to dbus chat with systemd_logind_t domainResolves: rhbz#1630318- Allow staff_t userdomain and confined_admindomain attribute to allow use generic ptys because of new sudo feature \'io logging\'Resolves: rhbz#1564470- Make ganesha policy active againResolves: rhbz#1511489
* Fri Oct 12 2018 Lukas Vrabec - 3.13.1-229.5- Remove disabling ganesha module in pre install phase of installation new selinux-policy package where ganesha is again standalone moduleResolves: rhbz#1638257
* Thu Oct 11 2018 Lukas Vrabec - 3.13.1-229.4- Allow staff_t userdomain and confined_admindomain attribute to allow use generic ptys because of new sudo feature \'io logging\'Resolves: rhbz#1638427
* Thu Oct 11 2018 Lukas Vrabec - 3.13.1-229.3- Run ganesha as ganesha_t domain again, revert changes where ganesha is running as nfsd_tResolves: rhbz#1638257
* Wed Oct 10 2018 Lukas Vrabec - 3.13.1-229.2- Fix missing patch in spec fileResolves: rhbz#1635704
* Fri Oct 05 2018 Lukas Vrabec - 3.13.1-229.1- Allow cinder_volume_t domain to dbus chat with systemd_logind_t domainResolves: rhbz#1635704
* Wed Sep 26 2018 Lukas Vrabec - 3.13.1-229- Allow neutron domain to read/write /var/run/utmpResolves: rhbz#1630318
* Tue Sep 25 2018 Lukas Vrabec - 3.13.1-228- Allow tomcat_domain to read /dev/randomResolves: rhbz#1631666- Allow neutron_t domain to use pamResolves: rhbz#1630318
* Mon Sep 17 2018 Lukas Vrabec - 3.13.1-227- Add interface apache_read_tmp_dirs()- Allow dirsrvadmin_script_t domain to list httpd_tmp_t dirsResolves: rhbz#1622602
* Sat Sep 15 2018 Lukas Vrabec - 3.13.1-226- Allow tomcat servers to manage usr_t filesResolves: rhbz#1625678- Dontaudit tomcat serves to append to /dev/random deviceResolves: rhbz#1625678- Allow sys_nice capability to mysqld_t domain- Allow dirsrvadmin_script_t domain to read httpd tmp filesResolves: rhbz#1622602- Allow syslogd_t domain to manage cert_t filesResolves: rhbz#1615995
* Wed Sep 12 2018 Lukas Vrabec - 3.13.1-225- Allow sbd_t domain to getattr of all char files in /dev and read sysfs_t files and dirsResolves: rhbz#1627114- Expand virt_read_lib_files() interface to allow list dirs with label virt_var_lib_tResolves: rhbz#1567753
* Fri Sep 07 2018 Lukas Vrabec - 3.13.1-224- Allow tomcat Tomcat to delete a temporary file used when compiling class files for JSPs.Resolves: rhbz#1625678- Allow chronyd_t domain to read virt_var_lib_t files- Allow virtual machines to use dri devices. This allows use openCL GPU calculations. BZ(1337333)Resolves: rhbz#1625613- Allow tomcat services create link file in /tmpResolves: rhbz#1624289- Add boolean: domain_can_mmap_files.Resolves: rhbz#1460322
* Sun Sep 02 2018 Lukas Vrabec - 3.13.1-223- Make working SELinux sandbox with Wayland.Resolves: rhbz#1624308- Allow svirt_t domain to mmap svirt_image_t block filesResolves: rhbz#1624224- Add caps dac_read_search and dav_override to pesign_t domain- Allow iscsid_t domain to mmap userio chr filesResolves: rhbz#1623589- Add boolean: domain_can_mmap_files.Resolves: rhbz#1460322- Add execute_no_trans permission to mmap_exec_file_perms pattern- Allow sudodomain to search caller domain proc info- Allow xdm_t domain to mmap and read cert_t files- Replace optional policy blocks to make dbus interfaces effectiveResolves: rhbz#1624414- Add interface dev_map_userio_dev()
* Wed Aug 29 2018 Lukas Vrabec - 3.13.1-222- Allow readhead_t domain to mmap own pid filesResolves: rhbz#1614169
* Tue Aug 28 2018 Lukas Vrabec - 3.13.1-221- Allow ovs-vswitchd labeled as openvswitch_t domain communicate with qemu-kvm via UNIX stream socket- Allow httpd_t domain to mmap tmp filesResolves: rhbz#1608355- Update dirsrv_read_share() interface to allow caller domain to mmap dirsrv_share_t files- Update dirsrvadmin_script_t policy to allow read httpd_tmp_t symlinks- Label /dev/tpmrm[0-9]
* as tpm_device_t- Allow semanage_t domain mmap usr_t filesResolves: rhbz#1622607- Update dev_filetrans_all_named_dev() to allow create event22-30 character files with label event_device_t
* Fri Aug 24 2018 Lukas Vrabec - 3.13.1-220- Allow nagios_script_t domain to mmap nagios_log_t filesResolves: rhbz#1620013- Allow nagios_script_t domain to mmap nagios_spool_t filesResolves: rhbz#1620013- Update userdom_security_admin() and userdom_security_admin_template() to allow use auditctlResolves: rhbz#1622197- Update selinux_validate_context() interface to allow caller domain to mmap security_t filesResolves: rhbz#1622061
* Wed Aug 22 2018 Lukas Vrabec - 3.13.1-219- Allow virtd_t domain to create netlink_socket- Allow rpm_t domain to write to audit- Allow rpm domain to mmap rpm_var_lib_t filesResolves: rhbz#1619785- Allow nagios_script_t domain to mmap nagios_etc_t filesResolves: rhbz#1620013- Update nscd_socket_use() to allow caller domain to stream connect to nscd_tResolves: rhbz#1460715- Allow secadm_t domain to mmap audit config and log files- Allow insmod_t domain to read iptables pid files- Allow systemd to mounton /etcResolves: rhbz#1619785
* Tue Aug 21 2018 Lukas Vrabec - 3.13.1-218- Allow kdumpctl_t domain to getattr fixed disk device in mlsResolves: rhbz#1615342- Allow initrc_domain to mmap all binaries labeled as systemprocess_entryResolves: rhbz#1615342
* Tue Aug 21 2018 Lukas Vrabec - 3.13.1-217- Allow virtlogd to execute itselfResolves: rhbz#1598392
* Mon Aug 20 2018 Lukas Vrabec - 3.13.1-216- Allow kdumpctl_t domain to manage kdumpctl_tmp_t fifo filesResolves: rhbz#1615342- Allow kdumpctl to write to files on all levelsResolves: rhbz#1615342- Fix typo in radius policyResolves: rhbz#1619197- Allow httpd_t domain to mmap httpd_config_t filesResolves: rhbz#1615894- Add interface dbus_acquire_svc_system_dbusd()- Allow sanlock_t domain to connectto to unix_stream_socketResolves: rhbz#1614965- Update nfsd_t policy because of ganesha featuresResolves: rhbz#1511489- Allow conman to getattr devpts_tResolves: rhbz#1377915- Allow tomcat_domain to connect to smtp portsResolves: rhbz#1253502- Allow tomcat_t domain to mmap tomcat_var_lib_t filesResolves: rhbz#1618519- Allow slapd_t domain to mmap slapd_var_run_t filesResolves: rhbz#1615319- Allow nagios_t domain to mmap nagios_log_t filesResolves: rhbz#1618675- Allow nagios to exec itself and mmap nagios spool files BZ(1559683)- Allow nagios to mmap nagios config files BZ(1559683)- Allow kpropd_t domain to mmap krb5kdc_principal_t filesResolves: rhbz#1619252- Update syslogd policy to make working elasticsearch- Label tcp and udp ports 9200 as wap_wsp_port- Allow few domains to rw inherited kdumpctl tmp pipesResolves: rhbz#1615342
* Fri Aug 10 2018 Lukas Vrabec - 3.13.1-215- Allow systemd_dbusd_t domain read/write to nvme devicesResolves: rhbz#1614236- Allow mysqld_safe_t do execute itself- Allow smbd_t domain to chat via dbus with avahi daemonResolves: rhbz#1600157- cupsd_t domain will create /etc/cupsd/ppd as cupsd_etc_rw_tResolves: rhbz#1452595- Allow amanda_t domain to getattr on tmpfs filesystem BZ(1527645)Resolves: rhbz#1452444- Update screen_role_template to allow caller domain to have screen_exec_t as entrypoint do new domainResolves: rhbz#1384769- Add alias httpd__script_t to _script_t to make sepolicy generate workingResolves: rhbz#1271324- Allow kprop_t domain to read network stateResolves: rhbz#1600705- Allow sysadm_t domain to accept socketResolves: rhbz#1557299- Allow sshd_t domain to mmap user_tmp_t filesResolves: rhbz#1613437
* Tue Aug 07 2018 Lukas Vrabec - 3.13.1-214- Allow sshd_t domain to mmap user_tmp_t filesResolves: rhbz#1613437
* Tue Aug 07 2018 Lukas Vrabec - 3.13.1-213- Allow kprop_t domain to read network stateResolves: rhbz#1600705
* Tue Aug 07 2018 Lukas Vrabec - 3.13.1-212- Allow kpropd domain to exec itselfResolves: rhbz#1600705- Allow ipmievd_t to mmap kernel modules BZ(1552535)- Allow hsqldb_t domain to mmap own temp filesResolves: rhbz#1612143- Allow hsqldb_t domain to read cgroup filesResolves: rhbz#1612143- Allow rngd_t domain to read generic certsResolves: rhbz#1612456- Allow innd_t domain to mmap own var_lib_t filesResolves: rhbz#1600591- Update screen_role_temaplate interfaceResolves: rhbz#1384769- Allow cupsd_t to create cupsd_etc_t dirsResolves: rhbz#1452595- Allow chronyd_t domain to mmap own tmpfs filesResolves: rhbz#1596563- Allow cyrus domain to mmap own var_lib_t and var_run filesResolves: rhbz#1610374- Allow sysadm_t domain to create rawip socketsResolves: rhbz#1571591- Allow sysadm_t domain to listen on socketResolves: rhbz#1557299- Update sudo_role_template() to allow caller domain also setattr generic ptysResolves: rhbz#1564470- Allow netutils_t domain to create bluetooth socketsResolves: rhbz#1600586
* Fri Aug 03 2018 Lukas Vrabec - 3.13.1-211- Allow innd_t domain to mmap own var_lib_t filesResolves: rhbz#1600591- Update screen_role_temaplate interfaceResolves: rhbz#1384769- Allow cupsd_t to create cupsd_etc_t dirsResolves: rhbz#1452595- Allow chronyd_t domain to mmap own tmpfs filesResolves: rhbz#1596563- Allow cyrus domain to mmap own var_lib_t and var_run filesResolves: rhbz#1610374- Allow sysadm_t domain to create rawip socketsResolves: rhbz#1571591- Allow sysadm_t domain to listen on socketResolves: rhbz#1557299- Update sudo_role_template() to allow caller domain also setattr generic ptysResolves: rhbz#1564470- Allow netutils_t domain to create bluetooth socketsResolves: rhbz#1600586
* Tue Jul 31 2018 Lukas Vrabec - 3.13.1-210- Allow virtlogd_t domain to chat via dbus with systemd_logindResolves: rhbz#1593740
* Sun Jul 29 2018 Lukas Vrabec - 3.13.1-209- Allow sblim_sfcbd_t domain to mmap own tmpfs filesResolves: rhbz#1609384- Update logging_manage_all_logs() interface to allow caller domain map all logfilesResolves: rhbz#1592028
* Thu Jul 26 2018 Lukas Vrabec - 3.13.1-208- Dontaudit oracleasm_t domain to request sys_admin capability- Allow iscsid_t domain to load kernel moduleResolves: rhbz#1589295- Update rhcs contexts to reflects the latest fenced changes- Allow httpd_t domain to rw user_tmp_t filesResolves: rhbz#1608355- /usr/libexec/udisks2/udisksd should be labeled as devicekit_disk_exec_tResolves: rhbz#1521063- Allow tangd_t dac_read_searchResolves: rhbz#1607810- Allow glusterd_t domain to mmap user_tmp_t files- Allow mongodb_t domain to mmap own var_lib_t filesResolves: rhbz#1607729- Allow iscsid_t domain to mmap sysfs_t filesResolves: rhbz#1602508- Allow tomcat_domain to search cgroup dirsResolves: rhbz#1600188- Allow httpd_t domain to mmap own cache filesResolves: rhbz#1603505- Allow cupsd_t domain to mmap cupsd_etc_t filesResolves: rhbz#1599694- Allow kadmind_t domain to mmap krb5kdc_principal_tResolves: rhbz#1601004- Allow virtlogd_t domain to read virt_etc_t link filesResolves: rhbz#1598593- Allow dirsrv_t domain to read crack dbResolves: rhbz#1599726- Dontaudit pegasus_t to require sys_admin capabilityResolves: rhbz#1374570- Allow mysqld_t domain to exec mysqld_exec_t binary files- Allow abrt_t odmain to read rhsmcertd lib filesResolves: rhbz#1601389- Allow winbind_t domain to request kernel module loadsResolves: rhbz#1599236- Allow gpsd_t domain to getsession and mmap own tmpfs filesResolves: rhbz#1598388- Allow smbd_t send to nmbd_t via dgram sockets BZ(1563791)Resolves: rhbz#1600157- Allow tomcat_domain to read cgroup_t filesResolves: rhbz#1601151- Allow varnishlog_t domain to mmap varnishd_var_lib_t filesResolves: rhbz#1600704- Allow dovecot_auth_t domain to manage also dovecot_var_run_t fifo files. BZ(1320415)Resolves: rhbz#1600692- Fix ntp SELinux module- Allow innd_t domain to mmap news_spool_t filesResolves: rhbz#1600591- Allow haproxy daemon to reexec itself. BZ(1447800)Resolves: rhbz#1600578- Label HOME_DIR/mozilla.pdf file as mozilla_home_t instead of user_home_tResolves: rhbz#1559859- Allow pkcs_slotd_t domain to mmap own tmpfs filesResolves: rhbz#1600434- Allow fenced_t domain to rebootResolves: rhbz#1293384- Allow bluetooth_t domain listen on bluetooth sockets BZ(1549247)Resolves: rhbz#1557299- Allow lircd to use nsswitch. BZ(1401375)- Allow targetd_t domain mmap lvm config filesResolves: rhbz#1546671- Allow amanda_t domain to read network system stateResolves: rhbz#1452444- Allow abrt_t domain to read rhsmcertd logsResolves: rhbz#1492059- Allow application_domain_type also mmap inherited user temp files BZ(1552765)Resolves: rhbz#1608421- Allow ipsec_t domain to read l2tpd pid filesResolves: rhbz#1607994- Allow systemd_tmpfiles_t do mmap system db files- Improve domain_transition_pattern to allow mmap entrypoint bin file.Resolves: rhbz#1460322- Allow nsswitch_domain to mmap passwd_file_t files BZ(1518655)Resolves: rhbz#1600528- Dontaudit syslogd to watching top llevel dirs when imfile module is enabledResolves: rhbz#1601928- Allow ipsec_t can exec ipsec_exec_tResolves: rhbz#1600684- Allow netutils_t domain to mmap usmmon deviceResolves: rhbz#1600586- Allow netlabel_mgmt_t domain to read sssd public files, stream connect to sssd_t BZ(1483655)- Allow userdomain sudo domains to use generic ptysResolves: rhbz#1564470- Allow traceroute to create icmp packetsResolves: rhbz#1548350- Allow systemd domain to mmap lvm config files BZ(1594584)- Add new interface lvm_map_config- refpolicy: Update for kernel sctp support Resolves: rhbz#1597111 Add additional entries to support the kernel SCTP implementation introduced in kernel 4.16
* Fri Jun 29 2018 Lukas Vrabec - 3.13.1-207- Update oddjob_domtrans_mkhomedir() interface to allow caller domain also mmap oddjob_mkhomedir_exec_t filesResolves: rhbz#1596306- Update rhcs_rw_cluster_tmpfs() interface to allow caller domain to mmap cluster_tmpfs_t filesResolves: rhbz#1589257- Allow radiusd_t domain to read network sysctlsResolves: rhbz#1516233- Allow chronyc_t domain to use nscd shmResolves: rhbz#1596563- Label /var/lib/tomcats dir as tomcat_var_lib_tResolves: rhbz#1596367- Allow lsmd_t domain to mmap lsmd_plugin_exec_t filesResolves: rhbz#bea0c8174- Label /usr/sbin/rhn_check-[0-9]+.[0-9]+ as rpm_exec_tResolves: rhbz#1596509- Update seutil_exec_loadpolicy() interface to allow caller domain to mmap load_policy_exec_t filesResolves: rhbz#1596072- Allow xdm_t to read systemd hwdbResolves: rhbz#1596720- Allow dhcpc_t domain to mmap files labeled as ping_exec_tResolves: rhbz#1596065
* Wed Jun 27 2018 Lukas Vrabec - 3.13.1-206- Allow tangd_t domain to create tcp socketsResolves: rhbz#1595775- Update postfix policy to allow postfix_master_t domain to mmap all postfix
* binariesResolves: rhbz#1595328- Allow amanda_t domain to have setgid capabilityResolves: rhbz#1452444- Update usermanage_domtrans_useradd() to allow caller domain to mmap useradd_exec_t filesResolves: rhbz#1595667
* Tue Jun 26 2018 Lukas Vrabec - 3.13.1-205- Allow abrt_watch_log_t domain to mmap binaries with label abrt_dump_oops_exec_t Resolves: rhbz#1591191- Update cups_filetrans_named_content() to allow caller domain create ppd directory with cupsd_etc_rw_t labelResolves: rhbz#1452595- Allow abrt_t domain to write to rhsmcertd pid filesResolves: rhbz#1492059- Allow pegasus_t domain to eexec lvm binaries and allow read/write access to lvm controlResolves: rhbz#1463470- Add vhostmd_t domain to read/write to svirt imagesResolves: rhbz#1465276- Dontaudit action when abrt-hook-ccpp is writing to nscd socketsResolves: rhbz#1460715- Update openvswitch policyResolves: rhbz#1594729- Update kdump_manage_kdumpctl_tmp_files() interface to allow caller domain also mmap kdumpctl_tmp_t filesResolves: rhbz#1583084- Allow sssd_t and slpad_t domains to mmap generic certsResolves: rhbz#1592016Resolves: rhbz#1592019- Allow oddjob_t domain to mmap binary files as oddjob_mkhomedir_exec_t filesResolves: rhbz#1592022- Update dbus_system_domain() interface to allow system_dbusd_t domain to mmap binary file from second parameterResolves: rhbz#1583080- Allow chronyc_t domain use inherited user ttysResolves: rhbz#1593267- Allow stapserver_t domain to mmap own tmp filesResolves: rhbz#1593122- Allow sssd_t domain to mmap files labeled as sssd_selinux_manager_exec_tResolves: rhbz#1592026- Update policy for ypserv_t domainResolves: rhbz#1592032- Allow abrt_dump_oops_t domain to mmap all non security filesResolves: rhbz#1593728- Allow svirt_t domain mmap svirt_image_t filesResolves: rhbz#1592688- Allow virtlogd_t domain to write inhibit systemd pipes.Resolves: rhbz#1593740- Allow sysadm_t and staff_t domains to use sudo io loggingResolves: rhbz#1564470- Allow sysadm_t domain create sctp socketsResolves: rhbz#1571591- Update mount_domtrans() interface to allow caller domain mmap mount_exec_tResolves: rhbz#1592025- Allow dhcpc_t to mmap all binaries with label hostname_exec_t, ifconfig_exec_t and netutils_exec_tResolves: rhbz#1594661
* Thu Jun 14 2018 Lukas Vrabec - 3.13.1-204- Fix typo in logwatch interface file- Allow spamd_t to manage logwatch_cache_t files/dirs- Allow dnsmasw_t domain to create own tmp files and manage mnt files- Allow fail2ban_client_t to inherit rlimit information from parent processResolves: rhbz#1513100- Allow nscd_t to read kernel sysctlsResolves: rhbz#1512852- Label /var/log/conman.d as conman_log_tResolves: rhbz#1538363- Add dac_override capability to tor_t domainResolves: rhbz#1540711- Allow certmonger_t to readwrite to user_tmp_t dirsResolves: rhbz#1543382- Allow abrt_upload_watch_t domain to read general certsResolves: rhbz#1545098- Update postfix_domtrans_master() interface to allow caller domain also mmap postfix_master_exec_t binaryResolves: rhbz#1583087- Allow postfix_domain to mmap postfix_qmgr_exec_t binariesResolves: rhbz#1583088- Allow postfix_domain to mmap postfix_pickup_exec_t binariesResolves: rhbz#1583091- Allow chornyd_t read phc2sys_t shared memoryResolves: rhbz#1578883- Allow virt_qemu_ga_t read utmpResolves: rhbz#1571202- Add several allow rules for pesign policy: Resolves: rhbz#1468744 - Allow pesign domain to read /dev/random - Allow pesign domain to create netlink_kobject_uevent_t sockets - Allow pesign domain create own tmp files- Add setgid and setuid capabilities to mysqlfd_safe_t domainResolves: rhbz#1474440- Add tomcat_can_network_connect_db booleanResolves: rhbz#1477948- Update virt_use_sanlock() boolean to read sanlock stateResolves: rhbz#1448799- Add sanlock_read_state() interface- Allow postfix_cleanup_t domain to stream connect to all milter sockets BZ(1436026)Resolves: rhbz#1563423- Update abrt_domtrans and abrt_exec() interfaces to allow caller domain to mmap binary fileResolves:rhbz#1583080- Update nscd_domtrans and nscd_exec interfaces to allow caller domain also mmap nscd binariesResolves: rhbz#1583086- Update snapperd_domtrans() interface to allow caller domain to mmap snapperd_exec_t fileResolves: rhbz#1583802- Allow zoneminder_t to getattr of fs_tResolves: rhbz#1585328- Fix denials during ipa-server-install process on F27+Resolves: rhbz#1586029- Allow ipa_dnskey_t to exec ipa_dnskey_exec_t filesResolves: rhbz#1586033- Allow rhsmcertd_t domain to send signull to postgresql_t domainResolves: rhbz#1588119- Allow policykit_t domain to dbus chat with dhcpc_tResolves: rhbz#1364513- Adding new boolean keepalived_connect_any()Resolves: rhbz#1443473- Allow amanda to create own amanda_tmpfs_t filesResolves: rhbz#1452444- Add amanda_tmpfs_t label. BZ(1243752)- Allow gdomap_t domain to connect to qdomap_port_tResolves: rhbz#1551944- Fix typos in sge- Fix typo in openvswitch policy- /usr/libexec/bluetooth/obexd should have only obexd_exec_t instead of bluetoothd_exec_t type- Allow sshd_keygen_t to execute plymouthdResolves: rhbz#1583531- Update seutil_domtrans_setfiles() interface to allow caller domain to do mmap on setfiles_exec_t binaryResolves: rhbz#1583090- Allow systemd_networkd_t create and relabel tun socketsResolves: rhbz#1583830- Allow map audisp_exec_t files fordomains executing this binaryResolves: rhbz#1586042- Add new interface postgresql_signull()- Add fs_read_xenfs_files() interface.
* Mon Jun 11 2018 Lukas Vrabec - 3.13.1-203- /usr/libexec/bluetooth/obexd should have only obexd_exec_t instead of bluetoothd_exec_t type- Allow dac override capability to mandb_t domain BZ(1529399)Resolves: rhbz#1423361- Allow inetd_child process to chat via dbus with abrtResolves: rhbz#1428805- Allow zabbix_agent_t domain to connect to redis_port_tResolves: rhbz#1418860- Allow rhsmcertd_t domain to read xenfs_t filesResolves: rhbz#1405870- Allow zabbix_agent_t to run zabbix scriptsResolves: rhbz#1380697- Allow rabbitmq_t domain to create own tmp files/dirsResolves: rhbz#1546897- Allow policykit_t mmap policykit_auth_exec_t filesResolves: rhbz#1583082- Allow ipmievd_t domain to read general certsResolves: rhbz#1514591- Add sys_ptrace capability to pcp_pmie_t domain- Allow squid domain to exec ldconfigResolves: rhbz#1532017- Make working gpg agent in gpg_agent_t domainResolves: rhbz#1535109- Update gpg SELinux policy module- Allow kexec to read kernel module files in /usr/lib/modules.Resolves: rhbz#1536690- Allow mailman_domain to read system network stateResolves: rhbz#1413510- Allow mailman_mail_t domain to search for apache configsResolves: rhbz#1413510- Allow openvswitch_t domain to read neutron state and read/write fixed disk devicesResolves: rhbz#1499208- Allow antivirus_domain to read all domain system stateResolves: rhbz#1560986- Allow targetd_t domain to red gconf_home_t files/dirsResolves: rhbz#1546671- Allow freeipmi domain to map sysfs_t filesResolves: rhbz#1575918- Label /usr/libexec/bluetooth/obexd as obexd_exec_tResolves: rhbz#1351750- Update rhcs SELinux moduleResolves: rhbz#1589257- Allow iscsid_t domain mmap kernel modulesResolves: rhbz#1589295- Allow iscsid_t domain mmap own tmp filesResolves: rhbz#1589295- Update iscsid_domtrans() interface to allow mmap iscsid_exec_t binaryResolves: rhbz#1589295- Update nscd_socket_use interface to allow caller domain also mmap nscd_var_run_t files.Resolves: rhbz#1589271- Allow nscd_t domain to mmap system_db_t filesResolves: rhbz#1589271- Add interface nagios_unconfined_signull()- Allow lircd_t domain read sssd public files Add setgid capability to lircd_t domainResolves: rhbz#1550700- Add missing requires- Allow tomcat domain sends emailResolves: rhbz#1585184- Allow memcached_t domain nnp_transition becuase of systemd security features BZ(1514867)Resolves: rhbz#1585714- Allow kdump_t domain to map /boot filesResolves: rhbz#1588884- Fix typo in netutils policy- Allow confined users get AFS tokensResolves: rhbz#1417671- Allow sysadm_t domain to chat via dbusResolves: rhbz#1582146- Associate sysctl_kernel_t type with filesystem attribute- Allow confined users to use new socket classes for bluetooth, alg and tcpdiag socketsResolves: rhbz#1557299- Allow user_t and staff_t domains create netlink tcpdiag socketsResolves: rhbz#1557281- Add interface dev_map_sysfs- Allow xdm_t domain to execute xdm_var_lib_t filesResolves: rhbz#1589139- Allow syslogd_t domain to send signull to nagios_unconfined_plugin_tResolves: rhbz#1569344- Label /dev/vhost-vsock char device as vhost_device_t- Add files_map_boot_files() interfaceResolves: rhbz#1588884- Update traceroute_t domain to allow create dccp socketsResolves: rhbz#1548350
* Wed Jun 06 2018 Lukas Vrabec - 3.13.1-202- Update ctdb domain to support gNFS setup Resolves: rhbz#1576818- Allow authconfig_t dbus chat with policykitResolves: rhbz#1551241- Allow lircd_t domain to read passwd_file_tResolves: rhbz:#1550700- Allow lircd_t domain to read system stateResolves: rhbz#1550700- Allow smbcontrol_t to mmap samba_var_t files and allow winbind create sockets BZ(1559795)Resolves: rhbz#1574521- Allow tangd_t domain read certsResolves: rhbz#1509055- Allow httpd_sys_script_t to connect to mongodb_port_t if boolean httpd_can_network_connect_db is turned onResolves: rhbz:#1579219- Allow chronyc_t to redirect ourput to /var/lib /var/log and /tmpResolves: rhbz#1574418- Allow ctdb_t domain modify ctdb_exec_t filesResolves: rhbz#1572584- Allow chrome_sandbox_t to mmap tmp filesResolves: rhbz#1574392- Allow ulogd_t to create netlink_netfilter sockets.Resolves: rhbz#1575924- Update ulogd SELinux security policy- Allow rhsmcertd_t domain send signull to apache processesResolves: rhbz#1576555- Allow freeipmi domain to read sysfs_t filesResolves: rhbz#1575918- Allow smbcontrol_t to create dirs with samba_var_t labelResolves: rhbz#1574521- Allow swnserve_t domain to stream connect to sasl domainResolves: rhbz#1574537- Allow SELinux users (except guest and xguest) to using bluetooth socketsResolves: rhbz#1557299- Allow confined users to use new socket classes for bluetooth, alg and tcpdiag socketsResolves: rhbz#1557299- Fix broken sysadm SELinux moduleResolves: rhbz#1557311- Allow user_t and staff_t domains create netlink tcpdiag socketsResolves: rhbz#1557281- Update ssh_domtrans_keygen interface to allow mmap ssh_keygen_exec_t binary fileResolves: rhbz#1583089- Allow systemd_networkd_t to read/write tun tap devicesResolves: rhbz#1583830- Add bridge_socket, dccp_socket, ib_socket and mpls_socket to socket_class_setResolves: rhbz#1583771- Allow audisp_t domain to mmap audisp_exec_t binaryResolves: rhbz#1583551- Fix duplicates in sysadm.te fileResolves: rhbz#1307183- Allow sysadm_u use xdmResolves: rhbz#1307183- Fix typo in sysnetwork.if fileResolves: rhbz#1581551
* Sun May 27 2018 Lukas Vrabec - 3.13.1-201- Fix duplicates in sysadm.te fileResolves: rhbz#1307183
* Sat May 26 2018 Lukas Vrabec - 3.13.1-200- Allow sysadm_u use xdmResolves: rhbz#1307183
* Fri May 25 2018 Lukas Vrabec - 3.13.1-199- Allow httpd_sys_script_t to connect to mongodb_port_t if boolean httpd_can_network_connect_db is turned onResolves: rhbz:#1579219- Allow chronyc_t to redirect ourput to /var/lib /var/log and /tmpResolves: rhbz#1574418- Allow chrome_sandbox_t to mmap tmp filesResolves: rhbz#1574392- Allow ulogd_t to create netlink_netfilter sockets.Resolves: rhbz#1575924- Update ulogd SELinux security policy- Allow rhsmcertd_t domain send signull to apache processesResolves: rhbz#1576555- Allow freeipmi domain to read sysfs_t filesResolves: rhbz#1575918- Allow smbcontrol_t to create dirs with samba_var_t labelResolves: rhbz#1574521- Allow swnserve_t domain to stream connect to sasl domainResolves: rhbz#1574537- Fix typo in sysnetwork.if fileResolves: rhbz#1581551
* Fri May 25 2018 Lukas Vrabec - 3.13.1-198- Fix typo in sysnetwork.if fileResolves: rhbz#1581551
* Thu May 24 2018 Lukas Vrabec - 3.13.1-197- Improve procmail_domtrans() to allow mmaping procmail_exec_t- Allow hypervvssd_t domain to read fixed disk devicesResolves: rhbz#1581225- Improve modutils_domtrans_insmod() interface to mmap insmod_exec_t binariesResolves: rhbz#1581551- Improve iptables_domtrans() interface to allow mmaping iptables_exec_t binaryResolves: rhbz#1581551- Improve auth_domtrans_login_programinterface to allow also mmap login_exec_t binariesResolves: rhbz#1581551- Improve auth_domtrans_chk_passwd() interface to allow also mmaping chkpwd_exec_t binaries.Resolves: rhbz#1581551- Allow mmap dhcpc_exec_t binaries in sysnet_domtrans_dhcpc interface
* Mon May 21 2018 Lukas Vrabec - 3.13.1-196- Add dbus_stream_connect_system_dbusd() interface.- Allow pegasus_t domain to mount tracefs_t filesystemResolves:rhbz#1374570- Allow psad_t domain to read all domains stateResolves: rhbz#1558439- Add net_raw capability to named_t domain BZ(1545586)- Allow tomcat_t domain to connect to mongod_t tcp portResolves:rhbz#1539748- Allow dovecot and postfix to connect to systemd stream socketsResolves: rhbz#1368642- Label /usr/libexec/bluetooth/obexd as bluetoothd_exec_t to run process as bluetooth_tResolves:rhbz#1351750- Rename tang policy to tangd- Add interface systemd_rfkill_domtrans()- Allow users staff and sysadm to run wireshark on own domainResolves:rhbz#1546362- Allow systemd-bootchart to create own tmpfs filesResolves:rhbz#1510412
* Wed Apr 25 2018 Lukas Vrabec - 3.13.1-195- Rename tang policy to tangd- Allow virtd_t domain to relabel virt_var_lib_t files Resolves: rhbz#1558121- Allow logrotate_t domain to stop services via systemdResolves: rhbz#1527522- Add tang policyResolves: rhbz#1509055- Allow mozilla_plugin_t to create mozilla.pdf file in user homedir with label mozilla_home_tResolves: rhbz#1559859- Improve snapperd SELinux policyResolves: rhbz#1365555- Allow snapperd_t daemon to create unlabeled dirs.Resolves: rhbz#1365555- We have inconsistency in cgi templates with upstream, we use _content_t, but refpolicy use httpd__content_t. Created aliasses to make it consistenceResolves: rhbz#1271324- Allow Openvswitch adding netdev bridge ovs 2.7.2.10 FDPResolves: rhbz#1503835- Add new Boolean tomcat_use_execmemResolves: rhbz#1565226- Allow domain transition from logrotate_t to chronyc_tResolves: rhbz#1568281- Allow nfsd_t domain to read/write sysctl fs filesResolves: rhbz#1516593- Allow conman to read system stateResolves: rhbz#1377915- Allow lircd_t to exec shell and add capabilities dac_read_search and dac_overrideResolves: rhbz#1550700- Allow usbmuxd to access /run/udev/data/+usb:
*.Resolves: rhbz#1521054- Allow abrt_t domain to manage kdump crash files Resolves: rhbz#1491585- Allow systemd to use virtio consoleResolves: rhbz#1558121- Allow transition from sysadm role into mdadm_t domain.Resolves: rhbz#1551568- Label /dev/op_panel and /dev/opal-prd as opal_device_tResolves: rhbz#1537618- Label /run/ebtables.lock as iptables_var_run_tResolves: rhbz#1511437- Allow udev_t domain to manage udev_rules_t char files.Resolves: rhbz#1545094- Allow nsswitch_domain to read virt_var_lib_t files, because of libvirt NSS plugin.Resolves: rhbz#1567753- Fix filesystem inteface file, we don\'t have nsfs_fs_t type, just nsfs_tResolves: rhbz#1547700- Allow iptables_t domain to create dirs in etc_t with system_conf_t labels
* Sat Apr 07 2018 Lukas Vrabec - 3.13.1-194- Add new boolean redis_enable_notify()Resolves: rhbz#1421326- Label /var/log/shibboleth-www(/.
*) as httpd_sys_rw_content_tResolves: rhbz#1549514- Add new label for vmtools scripts and label it as vmtools_unconfined_t stored in /etc/vmware-tools/Resolves: rbhz#1463593- Remove labeling for /etc/vmware-tools to bin_t it should be vmtools_unconfined_exec_tResolves: rbhz#1463593
* Thu Apr 05 2018 Lukas Vrabec - 3.13.1-193- Backport several changes for snapperdfrom Fedora RawhideResolves: rhbz#1556798- Allow snapperd_t to set priority for kernel processesResolves: rhbz#1556798- Make ganesha nfs server.Resolves: rhbz#1511489- Allow vxfs filesystem to use SELinux labelsResolves: rhbz#1482880- Add map permission to selinux-policyResolves: rhbz#1460322
* Tue Feb 27 2018 Lukas Vrabec - 3.13.1-192- Label /usr/libexec/dbus-1/dbus-daemon-launch-helper as dbusd_exec_t to have systemd dbus services running in the correct domain instead of unconfined_service_t if unconfined.pp module is enabled.Resolves: rhbz#1546721
* Mon Feb 19 2018 Lukas Vrabec - 3.13.1-191- Allow openvswitch_t stream connect svirt_tResolves: rhbz#1540702
* Fri Feb 16 2018 Lukas Vrabec - 3.13.1-190- Allow openvswitch domain to manage svirt_tmp_t sock filesResolves: rhbz#1540702- Fix broken systemd_tmpfiles_run() interface
* Wed Feb 07 2018 Lukas Vrabec - 3.13.1-189- Allow dirsrv_t domain to create tmp link filesResolves: rhbz#1536011- Label /usr/sbin/ldap-agent as dirsrv_snmp_exec_tResolves: rhbz#1428568- Allow ipsec_mgmt_t execute ifconfig_exec_t binaries- Allow ipsec_mgmt_t nnp domain transition to ifconfig_tResolves: rhbz#1539416
* Wed Feb 07 2018 Lukas Vrabec - 3.13.1-188- Allow svirt_domain to create socket files in /tmp with label svirt_tmp_tResolves: rhbz#1540702- Allow keepalived_t domain getattr proc filesystemResolves: rhbz#1477542- Rename svirt_sandbox_file_t to container_file_t and svirt_lxc_net_t to container_tResolves: rhbz#1538544- Allow ipsec_t nnp transistions to domains ipsec_mgmt_t and ifconfig_tResolves: rhbz:#1539416- Allow systemd_logind_t domain to bind on dhcpd_port_t,pki_ca_port_t,flash_port_tResolves: rhbz#1479350
* Tue Feb 06 2018 Lukas Vrabec - 3.13.1-187- Allow openvswitch_t domain to read cpuid, write to sysfs files and creating openvswitch_tmp_t socketsResolves: rhbz#1535196- Add new interface ppp_filetrans_named_content()Resolves: rhbz#1530601- Allow keepalived_t read sysctl_net_t filesResolves: rhbz#1477542- Allow puppetmaster_t domtran to puppetagent_tResolves: rhbz#1376893- Allow kdump_t domain to read kernel ring bufferResolves: rhbz#1540004- Allow ipsec_t domain to exec ifconfig_exec_t binaries.Resolves: rhbz#1539416- Allow unconfined_domain_typ to create pppd_lock_t directory in /var/lockResolves: rhbz#1530601- Allow updpwd_t domain to create files in /etc with shadow_t labelResolves: rhbz#1412838- Allow iptables sysctl load list support with SELinux enforcedResolves: rhbz#1535572
* Wed Jan 17 2018 Lukas Vrabec - 3.13.1-186- Allow virt_domains to acces infiniband pkeys.Resolves: rhbz#1533183- Label /usr/libexec/ipsec/addconn as ipsec_exec_t to run this script as ipsec_t instead of init_tResolves: rhbz#1535133- Allow audisp_remote_t domain write to files on all levelsResolves: rhbz#1534924
* Thu Jan 11 2018 Lukas Vrabec - 3.13.1-185- Allow vmtools_t domain creating vmware_log_t filesResolves: rhbz#1507048- Allow openvswitch_t domain to acces infiniband devicesResolves: rhbz#1532705
* Wed Jan 10 2018 Lukas Vrabec - 3.13.1-184- Allow chronyc_t domain to manage chronyd_keys_t files.Resolves: rhbz#1530525- Make virtlog_t domain system dbus clientResolves: rhbz#1481109- Update openvswitch SELinux moduleResolves: rhbz#1482682- Allow virtd_t to create also sock_files with label virt_var_run_tResolves: rhbz#1484075
* Mon Dec 11 2017 Lukas Vrabec - 3.13.1-183- Allow domains that manage logfiles to man logdirsResolves: rhbz#1523811
* Thu Dec 07 2017 Lukas Vrabec - 3.13.1-182- Label /dev/drm_dp_aux
* as xserver_misc_device_tResolves: rhbz#1520897- Allow sysadm_t to run puppet_exec_t binaries as puppet_tResolves: rhbz#1255745
* Mon Dec 04 2017 Lukas Vrabec - 3.13.1-181- Allow tomcat_t to manage pki_tomcat pid filesResolves: rhbz#1478371- networkmanager: allow talking to openvswitchResolves: rhbz#1517247- Allow networkmanager_t and opensm_t to manage subned endports for IPoIB VLANsResolves: rhbz#1517895- Allow domains networkmanager_t and opensm_t to control IPoIB VLANsResolves: rhbz#1517744- Fix typo in guest interface fileResolves: rhbz#1468254- Allow isnsd_t domain to accept tcp connections.Resolves: rhbz#1390208
* Mon Nov 20 2017 Lukas Vrabec - 3.13.1-180- Allow getty to use usbttysResolves: rhbz#1514235
* Mon Nov 13 2017 Lukas Vrabec - 3.13.1-179- Allow ldap_t domain to manage also slapd_tmp_t lnk filesResolves: rhbz#1510883- Allow cluster_t domain creating bundles directory with label var_log_t instead of cluster_var_log_tResolves: rhbz:#1508360- Add dac_read_search and dac_override capabilities to ganeshaResolves: rhbz#1483451
* Wed Nov 08 2017 Lukas Vrabec - 3.13.1-178- Add dependency for policycoreutils-2.5.18 becuase of new cgroup_seclabel policy capabilityResolves: rhbz#1510145
* Mon Nov 06 2017 Lukas Vrabec - 3.13.1-177- Allow jabber domains to connect to postgresql portsResolves: rhbz#1438489- Dontaudit accountsd domain creating dirs in /rootResolves: rhbz#1456760 - Dontaudit slapd_t to block suspend systemResolves: rhbz: #1479759 - Allow spamc_t to stream connect to cyrus.Resolves: rhbz#1382955 - allow imapd to read /proc/net/unix fileResolves: rhbz#1393030 - Allow passenger to connect to mysqld_port_tResolves: rhbz#1433464
* Mon Nov 06 2017 Lukas Vrabec - 3.13.1-176- Allow chronyc_t domain to use user_ptysResolves: rhbz#1470150- allow ptp4l to read /proc/net/unix file- Allow conmand to use usb ttys.Resolves: rhbz#1505121- Label all files /var/log/opensm.
* as opensm_log_t because opensm creating new log files with name opensm-subnet.lstResolves: rhbz#1505845- Allow chronyd daemon to execute chronyc.Resolves: rhbz#1508486- Allow firewalld exec ldconfig.Resolves: rhbz#1375576- Allow mozilla_plugin_t domain to dbus chat with devicekitResolves: rhbz#1460477- Dontaudit leaked logwatch pipesResolves: rhbz#1450119- Label /usr/bin/VGAuthService as vmtools_exec_t to confine this daemon.Resolves: rhbz#1507048- Allow httpd_t domain to execute hugetlbfs_t filesResolves: rhbz#1507682- Allow nfsd_t domain to read configfs_t files/dirsResolves: rhbz#1439442- Hide all allow rules with ptrace inside deny_ptrace booleanResolves: rhbz#1421075- Allow tgtd_t domain to read generic certsResolves: rhbz#1438532- Allow ptp4l to send msgs via dgram socket to unprivileged user domainsResolves: rhbz#1429853- Allow dirsrv_snmp_t to use inherited user ptys and read system stateResolves: rhbz#1428568- Allow glusterd_t domain to create own tmpfs dirs/filesResolves: rhbz#1411310- Allow keepalived stream connect to snmpResolves: rhbz#1401556- After fix in kernel where LSM hooks for dac_override and dac_search_read capability was swaped we need to fix it also in policyResolves: rhbz#1507089
* Fri Oct 27 2017 Lukas Vrabec - 3.13.1-175- Allow pegasus_openlmi_services_t to read generic certsResolves: rhbz#1462292- Allow ganesha_t domain to read random deviceResolves: rhbz#1494382- Allow zabbix_t domain to change its resource limitsResolves: rhbz:#1504074- Add new boolean nagios_use_nfsResolves: rhbz#1504826- Allow system_mail_t to search network sysctlsResolves: rhbz#1505779- Add samba_manage_var_dirs() interface- Fix typo bug in virt filecontext file- Allow nagios_script_t to read nagios_spool_t filesResolves: rhbz#1426824- Allow samba to manage var dirs/filesResolves: rhbz#1415088- Allow sbd_t to create own sbd_tmpfs_t dirs/filesResolves: rhbz#1380795- Allow firewalld and networkmanager to chat with hypervkvp via dbusResolves: rhbz#1377276- Allow dmidecode to read rhsmcert_log_t filesResolves: rhbz#1300799- Allow mail system to connect mariadb sockets.Resolves: rhbz#1368642- Allow logrotate_t to change passwd and reloead servicesResolves: rhbz#1450789- Allow mail system to connect mariadb sockets.Resolves: rhbz#1368642- Allow logrotate_t to change passwd and reloead servicesResolves: rhbz#1450789- Allow pegasus_openlmi_services_t to read generic certsResolves: rhbz#1462292- Allow ganesha_t domain to read random deviceResolves: rhbz#1494382- Allow zabbix_t domain to change its resource limitsResolves: rhbz:#1504074- Add new boolean nagios_use_nfsResolves: rhbz#1504826- Allow system_mail_t to search network sysctlsResolves: rhbz#1505779- Add samba_manage_var_dirs() interface- Fix typo bug in virt filecontext file- Allow nagios_script_t to read nagios_spool_t filesResolves: rhbz#1426824- Allow samba to manage var dirs/filesResolves: rhbz#1415088- Allow sbd_t to create own sbd_tmpfs_t dirs/filesResolves: rhbz#1380795- Allow firewalld and networkmanager to chat with hypervkvp via dbusResolves: rhbz#1377276- Allow dmidecode to read rhsmcert_log_t filesResolves: rhbz#1300799- Allow mail system to connect mariadb sockets.Resolves: rhbz#1368642- Allow logrotate_t to change passwd and reloead servicesResolves: rhbz#1450789- Allow chronyd_t do request kernel module and block_suspend capabilityResolves: rhbz#1350765- Allow system_cronjob_t to create /var/lib/letsencrypt dir with right labelResolves: rhbz#1447278- Allow httpd_t also read httpd_user_content_type dirs when httpd_enable_homedirs is enablesResolves: rhbz#1491994- Allow svnserve to use kerberosResolves: rhbz#1475271- Allow conman to use ptmx. Add conman_use_nfs booleanResolves: rhbz#1377915- Add nnp transition for services using: NoNewPrivileges systemd security featureResolves: rhbz#1311430- Add SELinux support for chronycResolves: rhbz#1470150- Add dac_read_search capability to openvswitch_t domainResolves: rhbz#1501336- Allow svnserve to manage own svnserve_log_t files/dirsResolves: rhbz#1480741- Allow keepalived_t to search network sysctlsResolves: rhbz#1477542- Allow puppetagent_t domain dbus chat with rhsmcertd_t domainResolves: rhbz#1446777- Add dccp_socket into socker_class_set subsetResolves: rhbz#1459941- Allow iptables_t to run setfiles to restore context on systemResolves: rhbz#1489118- Label 20514 tcp/udp ports as syslogd_port_t Label 10514 tcp/udp portas as syslog_tls_port_tResolves: rhbz:#1411400- Make nnp transition ActiveResolves: rhbz#1480518- Label tcp 51954 as isns_port_tResolves: rhbz#1390208- Add dac_read_search capability chkpwd_tResolves: rhbz#1376991- Add support for running certbot(letsencrypt) in crontabResolves: rhbz#1447278- Add init_nnp_daemon_domain interface- Allow xdm_t to gettattr /dev/loop-control deviceResolves: rhbz#1462925- Allow nnp trasintion for unconfined_service_tResolves: rhbz#1311430- Allow unpriv user domains and unconfined_service_t to use chronycResolves: rhbz#1470150- Allow iptables to exec plymouth.Resolves: rhbz#1480374- Fix typo in fs_unmount_tracefs interface.Resolves: rhbz#1371057- Label postgresql-check-db-dir as postgresql_exec_tResolves: rhbz#1490956
* Tue Sep 26 2017 Lukas Vrabec - 3.13.1-174- We should not ship selinux-policy with permissivedomains enabled.Resolves: rhbz#1494172- Fix order of installing selinux-policy-sandbox, because of depedencied in sandbox module, selinux-policy-targeted needs to be installed before selinux-policy-sandboxResolves: rhbz#1492606
* Tue Sep 19 2017 Lukas Vrabec - 3.13.1-173- Allow tomcat to setsched Resolves: rhbz#1492730- Fix rules blocking ipa-server upgrade processResolves: rhbz#1478371- Add new boolean tomcat_read_rpm_db()Resolves: rhbz#1477887- Allow tomcat to connect on mysqld tcp ports- Add ctdbd_t domain sys_source capability and allow setrlimitResolves: rhbz#1491235- Fix keepalived SELinux module- Allow automount domain to manage mount pid filesResolves: rhbz#1482381- Allow stunnel_t domain setschedResolves: rhbz#1479383- Add keepalived domain setpgid capabilityResolves: rhbz#1486638- Allow tomcat domain to connect to mssql portResolves: rhbz#1484572- Remove snapperd_t from unconfined domainesResolves: rhbz#1365555- Fix typo bug in apache moduleResolves: rhbz#1397311- Dontaudit that system_mail_t is trying to read /root/ filesResolves: rhbz#1147945- Make working webadm_t userdomainResolves: rhbz#1323792- Allow redis domain to execute shell scripts.Resolves: rhbz#1421326- Allow system_cronjob_t to create redhat-access-insights.log with var_log_tResolves: rhbz#1473303- Add couple capabilities to keepalived domain and allow get attributes of all domainsResolves: rhbz#1429327- Allow dmidecode read rhsmcertd lock filesResolves: rhbz#1300799- Add new interface rhsmcertd_rw_lock_files()Resolves: rhbz#1300799- Label all plymouthd archives as plymouthd_var_log_tResolves: rhbz#1478323- Allow cloud_init_t to dbus chat with systemd_timedated_tResolves: rhbz#1440730- Allow logrotate_t to write to kmsgResolves: rhbz#1397744- Add capability kill to rhsmcertd_tResolves: rhbz#1398338- Disable mysqld_safe_t secure mode environment cleansing.Resolves: rhbz#1464063- Allow winbind to manage smbd_tmp_t filesResolves: rhbz#1475566- Dontaudit that system_mail_t is trying to read /root/ filesResolves: rhbz#1147945- Make working webadm_t userdomainResolves: rhbz#1323792- Allow redis domain to execute shell scripts.Resolves: rhbz#1421326- Allow system_cronjob_t to create redhat-access-insights.log with var_log_tResolves: rhbz#1473303- Add couple capabilities to keepalived domain and allow get attributes of all domainsResolves: rhbz#1429327- Allow dmidecode read rhsmcertd lock filesResolves: rhbz#1300799- Add new interface rhsmcertd_rw_lock_files()Resolves: rhbz#1300799- Label all plymouthd archives as plymouthd_var_log_tResolves: rhbz#1478323 - Allow cloud_init_t to dbus chat with systemd_timedated_tResolves: rhbz#1440730- Allow logrotate_t to write to kmsgResolves: rhbz#1397744- Add capability kill to rhsmcertd_tResolves: rhbz#1398338- Disable mysqld_safe_t secure mode environment cleansing.Resolves: rhbz#1464063- Allow winbind to manage smbd_tmp_t filesResolves: rhbz#1475566- Add interface systemd_tmpfiles_run- End of file cannot be in comment- Allow systemd-logind to use ypbindResolves: rhbz#1479350- Add creating opasswd file with shadow_t SELinux label in auth_manage_shadow() interfaceResolves: rhbz#1412838- Allow sysctl_irq_t assciate with proc_tResolves: rhbz#1485909- Enable cgourp sec labelingResolves: rhbz#1485947- Add cgroup_seclabel policycap.Resolves: rhbz#1485947- Allow sshd_t domain to send signull to xdm_t processesResolves: rhbz#1448959- Allow updpwd_t domain auth file name transResolves: rhbz#1412838- Allow sysadm user to run systemd-tmpfilesResolves: rbhz#1325364- Add support labeling for vmci and vsock deviceResolves: rhbz#1451358- Add userdom_dontaudit_manage_admin_files() interfaceResolves: rhbz#1323792- Allow iptables_t domain to read files with modules_conf_t labelResolves: rhbz#1373220- init: Add NoNewPerms support for systemd.Resolves: rhbz#1480518- Add nnp_nosuid_transition policycap and related class/perm definitions.Resolves: rhbz#1480518- refpolicy: Infiniband pkeys and endportsResolves: rhbz#1464484
* Tue Aug 29 2017 Lukas Vrabec - 3.13.1-172- Allow certmonger using systemctl on pki_tomcat unit filesResolves: rhbz#1481388
* Tue Aug 29 2017 Lukas Vrabec - 3.13.1-171- Allow targetd_t to create own tmp files.- Dontaudit targetd_t to exec rpm binary file.Resolves: rhbz#1373860Resolves: rhbz#1424621
* Thu Aug 24 2017 Lukas Vrabec - 3.13.1-170- Add few rules to make working targetd daemon with SELinuxResolves: rhbz#1373860- Allow ipmievd_t domain to load kernel modulesResolves: rhbz#1441081- Allow logrotate to reload transient systemd unitResolves: rhbz#1440515- Add certwatch_t domain dac_override and dac_read_search capabilitiesResolves: rhbz#1422000- Allow postgrey to execute bin_t files and add postgrey into nsswitch_domainResolves: rhbz#1412072- Allow nscd_t domain to search network sysctlsResolves: rhbz#1432361- Allow iscsid_t domain to read mount pid filesResolves: rhbz#1482097- Allow ksmtuned_t domain manage sysfs_t files/dirsResolves: rhbz#1413865- Allow keepalived_t domain domtrans into iptables_tResolves: rhbz#1477719- Allow rshd_t domain reads net sysctlsResolves: rhbz#1477908- Add interface seutil_dontaudit_read_module_store()- Update interface lvm_rw_pipes() by adding also open permission- Label /dev/clp device as vfio_device_tResolves: rhbz#1477624- Allow ifconfig_t domain unmount fs_tResolves: rhbz#1477445- Label /dev/gpiochip
* devices as gpio_device_tResolves: rhbz#1477618- Add interface dev_manage_sysfs()Resolves: rhbz#1474989
* Mon Aug 14 2017 Lukas Vrabec - 3.13.1-169- Label /usr/libexec/sudo/sesh as shell_exec_tResolves: rhbz#1480791
* Fri Aug 11 2017 Lukas Vrabec - 3.13.1-168- Allow tomcat_t domain couple capabilities to make working tomcat-jsvcResolves: rhbz#1470735
* Wed Aug 09 2017 Lukas Vrabec - 3.13.1-167- Allow llpdad send dgram to libvirtResolves: rhbz#1472722
* Mon Jul 10 2017 Lukas Vrabec - 3.13.1-166- Add new boolean gluster_use_execmemResolves: rhbz#1469027- Allow cluster_t and glusterd_t domains to dbus chat with ganesha serviceResolves: rhbz#1468581
* Mon Jun 26 2017 Lukas Vrabec - 3.13.1-165- Dontaudit staff_t user read admin_home_t files.Resolves: rhbz#1290633
* Wed Jun 21 2017 Lukas Vrabec - 3.13.1-164- Allow couple rules needed to start targetd daemon with SELinux in enforcing modeResolves: rhbz#1424621- Add interface lvm_manage_metadataResolves: rhbz#1424621
* Tue Jun 20 2017 Lukas Vrabec - 3.13.1-163- Allow sssd_t to read realmd lib files.Resolves: rhbz#1436689- Add permission open to files_read_inherited_tmp_files() interfaceResolves: rhbz#1290633Resolves: rhbz#1457106
* Thu Jun 15 2017 Lukas Vrabec - 3.13.1-162- Allow unconfined_t user all user namespace capabilties.Resolves: rhbz#1461488
* Thu Jun 08 2017 Lukas Vrabec - 3.13.1-161- Allow httpd_t to read realmd_var_lib_t files Resolves: rhbz#1436689
* Tue Jun 06 2017 Lukas Vrabec - 3.13.1-160- Allow named_t to bind on udp 4321 portResolves: rhbz#1312972- Allow systemd-sysctl cap. sys_ptraceResolves: rhbz#1458999
* Mon Jun 05 2017 Lukas Vrabec - 3.13.1-159- Allow pki_tomcat_t execute ldconfig.Resolves: rhbz#1436689
* Fri Jun 02 2017 Lukas Vrabec - 3.13.1-158- Allow iscsi domain load kernel module.Resolves: rhbz#1457874- Allow keepalived domain connect to squid tcp portResolves: rhbz#1457455- Allow krb5kdc_t domain read realmd lib files.Resolves: rhbz#1436689- xdm_t should view kernel keysResolves: rhbz#1432645
* Thu Jun 01 2017 Lukas Vrabec - 3.13.1-157- Allow tomcat to connect on all unreserved ports- Allow ganesha to connect to all rpc portsResolves: rhbz#1448090- Update ganesha with another fixes.Resolves: rhbz#1448090- Update rpc_read_nfs_state_data() interface to allow read also lnk_files.Resolves: rhbz#1448090- virt_use_glusterd boolean should be in optional block Update ganesha module to allow create tmp filesResolves: rhbz#1448090- Hide broken symptoms when machine is configured with network bounding.
* Wed May 31 2017 Lukas Vrabec - 3.13.1-156- Add new boolean virt_use_glusterdResolves: rhbz#1455994- Add capability sys_boot for sbd_t domain- Allow sbd_t domain to create rpc sysctls.Resolves: rhbz#1455631- Allow ganesha_t domain to manage glusterd_var_run_t pid files.Resolves: rhbz#1448090
* Tue May 30 2017 Lukas Vrabec - 3.13.1-155- Create new interface: glusterd_read_lib_files()- Allow ganesha read glusterd lib files.- Allow ganesha read network sysctlsResolves: rhbz#1448090
* Mon May 29 2017 Lukas Vrabec - 3.13.1-154- Add few allow rules to ganesha moduleResolves: rhbz#1448090- Allow condor_master_t to read sysctls.Resolves: rhbz#1277506- Add dac_override cap to ctdbd_t domainResolves: rhbz#1435708- Label 8750 tcp/udp port as dey_keyneg_port_tResolves: rhbz#1448090
* Mon May 29 2017 Lukas Vrabec - 3.13.1-153- Add ganesha_use_fusefs boolean.Resolves: rhbz#1448090
* Wed May 24 2017 Lukas Vrabec - 3.13.1-152- Allow httpd_t reading kerberos kdc config filesResolves: rhbz#1452215- Allow tomcat_t domain connect to ibm_dt_2 tcp port.Resolves: rhbz#1447436- Allow stream connect to initrc_t domainsResolves: rhbz#1447436- Allow dnsmasq_t domain to read systemd-resolved pid files.Resolves: rhbz#1453114- Allow tomcat domain name_bind on tcp bctp_port_tResolves: rhbz#1451757- Allow smbd_t domain generate debugging files under /var/run/gluster. These files are created through the libgfapi.so library that provides integration of a GlusterFS client in the Samba (vfs_glusterfs) process.Resolves: rhbz#1447669- Allow condor_master_t write to sysctl_net_tResolves: rhbz#1277506- Allow nagios check disk plugin read /sys/kernel/config/Resolves: rhbz#1277718- Allow pcp_pmie_t domain execute systemctl binaryResolves: rhbz#1271998- Allow nagios to connect to stream sockets. Allow nagios start httpd via systemctlResolves: rhbz#1247635- Label tcp/udp port 1792 as ibm_dt_2_port_tResolves: rhbz#1447436- Add interface fs_read_configfs_dirs()- Add interface fs_read_configfs_files()- Fix systemd_resolved_read_pid interface- Add interface systemd_resolved_read_pid()Resolves: rhbz#1453114- Allow sshd_net_t domain read/write into crypto devicesResolves: rhbz#1452759- Label 8999 tcp/udp as bctp_port_tResolves: rhbz#1451757
* Thu May 18 2017 Lukas Vrabec - 3.13.1-151- nmbd_t needs net_admin capability like smbdResolves: rhbz#1431859- Dontaudit net_admin capability for domains postfix_master_t and postfix_qmgr_tResolves: rhbz#1431859- Allow rngd domain read sysfs_tResolves: rhbz#1451735- Add interface pki_manage_common_files()Resolves: rhbz#1447436- Allow tomcat_t domain to manage pki_common_t files and dirsResolves: rhbz#1447436- Use stricter fc rules for sssd sockets in /var/runResolves: rhbz#1448060- Allow certmonger reads httpd_config_t filesResolves: rhbz#1436689- Allow keepalived_t domain creating netlink_netfilter_socket.Resolves: rhbz#1451684- Allow tomcat domain read rpm_var_lib_t files Allow tomcat domain exec rpm_exec_t files Allow tomcat domain name connect on oracle_port_t Allow tomcat domain read cobbler_var_lib_t files.Resolves: rhbz#1451318- Make able deply overcloud via neutron_t to label nsfs as fs_tResolves: rhbz#1373321
* Tue May 16 2017 Lukas Vrabec - 3.13.1-150- Allow tomcat domain read rpm_var_lib_t files Allow tomcat domain exec rpm_exec_t files Allow tomcat domain name connect on oracle_port_t Allow tomcat domain read cobbler_var_lib_t files.Resolves: rhbz#1451318- Allow sssd_t domain creating sock files labeled as sssd_var_run_t in /var/run/Resolves: rhbz#1448056 Resolves: rhbz#1448060- Allow tomcat_domain connect to
* postgresql_port_t
* amqp_port_t Allow tomcat_domain read network sysctlsResolves: rhbz#1450819- Make able deply overcloud via neutron_t to label nsfs as fs_tResolves: rhbz#1373321- Allow netutils setpcap capabilityResolves:1444438
* Mon May 15 2017 Lukas Vrabec - 3.13.1-149- Update targetd policy to accommodate changes in the serviceResolves: rhbz#1424621- Allow tomcat_domain connect to
* postgresql_port_t
* amqp_port_t Allow tomcat_domain read network sysctlsResolves: rhbz#1450819- Update virt_rw_stream_sockets_svirt() interface to allow confined users set socket options.Resolves: rhbz#1415841- Allow radius domain stream connec to postgresqlResolves: rhbz#1446145- Allow virt_domain to read raw fixed_disk_device_t to make working blockcommitResolves: rhbz#1449977- Allow glusterd_t domain start ganesha serviceResolves: rhbz#1448090- Made few cosmetic changes in sssd SELinux moduleResolves: rhbz#1448060- sssd-kcm should not run as unconfined_service_t BZ(1447411)Resolves: rhbz#1448060- Add sssd_secrets labeling Also add named_filetrans interface to make sure all labels are correctResolves: rhbz#1448056- Allow keepalived_t domain read usermodehelper_tResolves: rhbz#1449769- Allow tomcat_t domain read pki_common_t filesResolves: rhbz#1447436- Add interface pki_read_common_files()Resolves: rhbz#1447436
* Tue May 09 2017 Lukas Vrabec - 3.13.1-148- Allow hypervkvp_t domain execute hostnameResolves: rhbz#1449064- Dontaudit sssd_selinux_manager_t use of net_admin capabilityResolves: rhbz#1444955- Allow tomcat_t stream connect to pki_common_tResolves: rhbz#1447436- Dontaudit xguest_t\'s attempts to listen to its tcp_socket- Allow sssd_selinux_manager_t to ioctl init_t socketsResolves: rhbz#1436689- Allow _su_t to create netlink_selinux_socketResolves rhbz#1146987- Allow unconfined_t to module_load any fileResolves rhbz#1442994
* Sat Apr 29 2017 Lukas Vrabec - 3.13.1-147- Improve ipa_cert_filetrans_named_content() interface to also allow caller domain manage ipa_cert_t type.Resolves: rhbz#1436689
* Fri Apr 28 2017 Lukas Vrabec - 3.13.1-146- Allow pki_tomcat_t domain read /etc/passwd.Resolves: rhbz#1436689- Allow tomcat_t domain read ipa_tmp_t filesResolves: rhbz#1436689- Label new path for ipa-otpdResolves: rhbz#1446353- Allow radiusd_t domain stream connect to postgresql_tResolves: rhbz#1446145- Allow rhsmcertd_t to execute hostname_exec_t binaries.Resolves: rhbz#1445494- Allow virtlogd to append nfs_t files when virt_use_nfs=1Resolves: rhbz#1402561
* Wed Apr 26 2017 Lukas Vrabec - 3.13.1-145- Update tomcat policy to adjust for removing unconfined_domain attr.Resolves: rhbz#1432083- Allow httpd_t domain read also httpd_user_content_type lnk_files.Resolves: rhbz#1383621- Allow httpd_t domain create /etc/httpd/alias/ipaseesion.key with label ipa_cert_tResolves: rhbz#1436689- Dontaudit _gkeyringd_t stream connect to system_dbusd_tResolves: rhbz#1052880- Label /var/www/html/nextcloud/data as httpd_sys_rw_content_tResolves: rhbz#1425530- Add interface ipa_filetrans_named_content()Resolves: rhbz#1432115- Allow tomcat use nsswitchResolves: rhbz#1436689- Allow certmonger_t start/status generic servicesResolves: rhbz#1436689- Allow dirsrv read cgroup files.Resolves: rhbz#1436689- Allow ganesha_t domain read/write infiniband devices.Resolves: rhbz#1383784- Allow sendmail_t domain sysctl_net_t filesResolves: rhbz#1369376- Allow targetd_t domain read network state and getattr on loop_control_device_tResolves: rhbz#1373860- Allow condor_schedd_t domain send mails.Resolves: rhbz#1277506- Alow certmonger to create own systemd unit files.Resolves: rhbz#1436689- Allow staff to systemctl virt server when staff_use_svirt=1Resolves: rhbz#1415841- Allow unconfined_t create /tmp/ca.p12 file with ipa_tmp_t contextResolves: rhbz#1432115- Label /sysroot/ostree/deploy/rhel-atomic-host/
* as root_tResolves: rhbz#1428112
* Wed Apr 19 2017 Lukas Vrabec - 3.13.1-144- Alow certmonger to create own systemd unit files.Resolves: rhbz#1436689
* Tue Apr 18 2017 Lukas Vrabec - 3.13.1-143- Hide broken symptoms when using kernel 3.10.0-514+ with network bonding. Postfix_picup_t domain requires NET_ADMIN capability which is not really needed.Resolves: rhbz#1431859- Fix policy to reflect all changes in new IPA releaseResolves: rhbz#1432115Resolves: rhbz#1436689
* Wed Apr 12 2017 Lukas Vrabec - 3.13.1-142- Allow sbd_t to read/write fixed disk devicesResolves: rhbz#1440165- Add sys_ptrace capability to radiusd_t domainResolves: rhbz#1426641- Allow cockpit_session_t domain connects to ssh tcp ports.Resolves: rhbz#1413509
* Fri Apr 07 2017 Lukas Vrabec - 3.13.1-141- Update tomcat policy to make working ipa install processResolves: rhbz#1436689
* Wed Apr 05 2017 Lukas Vrabec - 3.13.1-140- Allow pcp_pmcd_t net_admin capability.- Allow pcp_pmcd_t read net sysctls- Allow system_cronjob_t create /var/run/pcp with pcp_var_run_tResolves: rhbz#1336211
* Wed Apr 05 2017 Lukas Vrabec - 3.13.1-139- Fix all AVC denials during pkispawn of CAResolves: rhbz#1436383- Update pki interfaces and tomcat moduleResolves: rhbz#1436689
* Tue Apr 04 2017 Lukas Vrabec - 3.13.1-138- Update pki interfaces and tomcat moduleResolves: rhbz#1436689
* Tue Apr 04 2017 Lukas Vrabec - 3.13.1-137- Dontaudit firewalld wants write to /rootResolves: rhbz#1438708- Dontaudit firewalld to create dirs in /root/Resolves: rhbz#1438708- Allow sendmail to search network sysctlsResolves: rhbz#1369376- Add interface gssd_noatsecure()Resolves: rhbz#1438036- Add interface gssproxy_noatsecure()Resolves: rhbz#1438036- Dontaudit pcp_pmlogger_t search for xserver logs. Allow pcp_pmlogger_t to send signals to unconfined doamins Allow pcp_pmlogger_t to send logs to journalsResolves: rhbz#1379371- Allow chronyd_t net_admin capability to allow support HW timestamping.Resolves: rhbz#1416015- Update tomcat policyResolves: rhbz#1436689Resolves: rhbz#1436383- Allow certmonger to start haproxy serviceResolves: rhbz#1349394- Allow init noatsecure for gssd and gssproxyResolves: rhbz#1438036
* Thu Mar 30 2017 Lukas Vrabec - 3.13.1-136- geoclue wants to dbus chat with avahiResolves: rhbz#1434286- Allow iptables get list of kernel modulesResolves: rhbz#1367520- Allow unconfined_domain_type to enable/disable transient unitResolves: rhbz#1337041- Add interfaces init_enable_transient_unit() and init_disable_transient_unit- Revert \"Allow sshd setcap capability. This is needed due to latest changes in sshd\"Resolves: rhbz#1435264- Label sysroot dir under ostree as root_tResolves: rhbz#1428112
* Wed Mar 29 2017 Lukas Vrabec - 3.13.1-135- Remove ganesha_t domain from permissive domains.Resolves: rhbz#1436988
* Tue Mar 28 2017 Lukas Vrabec - 3.13.1-134- Allow named_t domain bind on several udp portsResolves: rhbz#1312972- Update nscd_use() interfaceResolves: rhbz#1281716- Allow radius_t domain ptraceResolves: rhbz#1426641- Update nagios to allos exec systemctlResolves: rhbz#1247635- Update pcp SELinux module to reflect all pcp changesResolves: rhbz#1271998- Label /var/lib/ssl_db as squid_cache_t Label /etc/squid/ssl_db as squid_cache_tResolves: rhbz#1325527- Allow pcp_pmcd_t domain search for network sysctl Allow pcp_pmcd_t domain sys_ptrace capability Resolves: rhbz#1336211
* Mon Mar 27 2017 Lukas Vrabec - 3.13.1-133- Allow drbd load modulesResolves: rhbz#1134883- Revert \"Add sys_module capability for drbdResolves: rhbz#1134883\"- Allow stapserver list kernel modulesResolves: rhbz#1325976- Update targetd policyResolves: rhbz#1373860- Add sys_admin capability to amandaResolves: rhbz#1371561- Allow hypervvssd_t to read all dirs.Resolves: rhbz#1331309- Label /run/haproxy.sock socket as haproxy_var_run_tResolves: rhbz#1386233- Allow oddjob_mkhomedir_t to mamange autofs_t dirs.Resolves: rhbz#1408819- Allow tomcat to connect on http_cache_port_tResolves: rhbz#1432083- Allow geoclue to send msgs to syslog.Resolves: rhbz#1434286- Allow condor_master_t domain capability chown.Resolves: rhbz#1277506- Update mta_filetrans_named_content() interface to allow calling domain create files labeled as etc_aliases_t in dir labeled as etc_mail_t.Resolves: rhbz#1167468- Allow nova domain search for httpd configuration.Resolves: rhbz#1190761- Add sys_module capability for drbdResolves: rhbz#1134883- Allow user_u users stream connect to dirsrv, Allow sysadm_u and staff_u users to manage dirsrv filesResolves: rhbz#1286474- Allow systemd_networkd_t communicate with systemd_networkd_t via dbusResolves: rhbz#1278010
* Wed Mar 22 2017 Lukas Vrabec - 3.13.1-132- Add haproxy_t domain fowner capabilityResolves: rhbz#1386233- Allow domain transition from ntpd_t to hwclock_t domainsResolves: rhbz#1375624- Allow cockpit_session_t setrlimit and sys_resourceResolves: rhbz#1402316- Dontaudit svirt_t read state of libvirtd domainResolves: rhbz#1426106- Update httpd and gssproxy modules to reflects latest changes in freeipaResolves: rhbz#1432115- Allow iptables read modules_conf_tResolves: rhbz#1367520
* Wed Mar 22 2017 Lukas Vrabec - 3.13.1-131- Remove tomcat_t domain from unconfined domainsResolves: rhbz#1432083- Create new boolean: sanlock_enable_home_dirs()Resolves: rhbz#1432783- Allow mdadm_t domain to read/write nvme_device_tResolves: rhbz#1431617- Remove httpd_user_
*_content_t domains from user_home_type attribute. This tighten httpd policy and acces to user data will be more strinct, and also fix mutual influente between httpd_enable_homedirs and httpd_read_user_contentResolves: rhbz#1383621- Dontaudit domain to create any file in /proc. This is kernel bug.Resolves: rhbz#1412679- Add interface dev_rw_nvmeResolves: rhbz#1431617
* Thu Mar 16 2017 Lukas Vrabec - 3.13.1-130- Allow gssproxy to get attributes on all filesystem object types.Resolves: rhbz#1430295- Allow ganesha to chat with unconfined domains via dbusResolves: rhbz#1426554- add the policy required for nextcloudResolves: rhbz#1425530- Add nmbd_t capability2 block_suspendResolves: rhbz#1425357- Label /var/run/chrony as chronyd_var_run_tResolves: rhbz#1416015- Add domain transition from sosreport_t to iptables_tResolves: rhbz#1359789- Fix path to /usr/lib64/erlang/erts-5.10.4/bin/epmdResolves: rhbz:#1332803
* Tue Mar 14 2017 Lukas Vrabec - 3.13.1-129- Update rpm macrosResolves: rhbz#1380854
* Mon Mar 13 2017 Lukas Vrabec - 3.13.1-128- Add handling booleans via selinux-policy macros in custom policy spec files.Resolves: rhbz#1380854
* Thu Mar 09 2017 Lukas Vrabec - 3.13.1-127- Allow openvswitch to load kernel modulesResolves: rhbz#1405479
* Thu Mar 09 2017 Lukas Vrabec - 3.13.1-126- Allow openvswitch read script state.Resolves: rhbz#1405479
* Tue Mar 07 2017 Lukas Vrabec - 3.13.1-125- Update ganesha policyResolves: rhbz#1426554Resolves: rhbz#1383784- Allow chronyd to read adjtimeResolves: rhbz#1416015- Fixes for chrony version 2.2Resolves: rhbz#1416015- Add interface virt_rw_stream_sockets_svirt()Resolves: rhbz#1415841- Label /dev/ss0 as gpfs_device_tResolves: rhbz#1383784- Allow staff to rw svirt unix stream sockets.Resolves: rhbz#1415841- Label /rhev/data-center/mnt as mnt_tResolves: rhbz#1408275- Associate sysctl_rpc_t with proc filesystemsResolves: rhbz#1350927- Add new boolean: domain_can_write_kmsgResolves: rhbz#1415715
* Thu Mar 02 2017 Lukas Vrabec - 3.13.1-124- Allow rhsmcertd_t dbus chat with system_cronjob_tResolves: rhbz#1405341- Allow openvswitch exec hostname and readinitrc_t filesResolves: rhbz#1405479- Improve SELinux context for mysql_db_t objects.Resolves: rhbz#1391521- Allow postfix_postdrop to communicate with postfix_master via pipe.Resolves: rhbz#1379736- Add radius_use_jit booleanResolves: rhbz#1426205- Label /var/lock/subsys/iptables as iptables_lock_tResolves: rhbz#1405441- Label /usr/lib64/erlang/erts-5.10.4/bin/epmd as lib_tResolves: rhbz#1332803- Allow can_load_kernmodule to load kernel modules.Resolves: rhbz#1423427Resolves: rhbz#1424621
* Thu Feb 23 2017 Lukas Vrabec - 3.13.1-123- Allow nfsd_t domain to create sysctls_rpc_t filesResolves: rhbz#1405304- Allow openvswitch to create netlink generic sockets.Resolves: rhbz#1397974- Create kernel_create_rpc_sysctls() interfaceResolves: rhbz#1405304
* Fri Feb 17 2017 Lukas Vrabec - 3.13.1-122- Allow nfsd_t domain rw sysctl_rpc_t dirsResolves: rhbz#1405304- Allow cgdcbxd_t to manage cgroup files.Resolves: rhbz#1358493- Allow cmirrord_t domain to create netlink_connector socketsResolves: rhbz#1412670- Allow fcoemon to create netlink scsitransport socketsResolves: rhbz#1362496- Allow quota_nld_t create netlink_generic socketsResolves: rhbz#1358679- Allow cgred_t create netlink_connector socketsResolves: rhbz#1376357- Add dhcpd_t domain fowner capabilityResolves: rhbz#1358485- Allow acpid to attempt to connect to the Linux kernel via generic netlink socket.Resolves: rhbz#1358478- Rename docker module to container moduleResolves: rhbz#1386916- Allow setflies to mount tracefsResolves: rhbz#1376357- Allow iptables to read nsfs files.Resolves: rhbz#1411316- Allow systemd_bootchart_t domain create dgram sockets.Resolves: rhbz#1365953- Rename docker interfaces to containerResolves: rhbz#1386916
* Wed Feb 15 2017 Lukas Vrabec - 3.13.1-120- Allow initrc_t domain to run rhel-autorelabel script properly during boot processResolves: rhbz#1379722- Allow systemd_initctl_t to create and connect unix_dgram socketsResolves: rhbz#1365947- Allow ifconfig_t to mount/unmount nsfs_t filesystemResolves: rhbz#1349814- Add interfaces allowing mount/unmount nsfs_t filesystemResolves: rhbz#1349814
* Mon Feb 13 2017 Lukas Vrabec - 3.13.1-119- Add interface init_stream_connectto()Resolves:rhbz#1365947- Allow rhsmcertd domain signull kernel.Resolves: rhbz#1379781- Allow kdumpgui domain to read nvme device- Allow insmod_t to load kernel modulesResolves: rhbz#1421598- Add interface files_load_kernel_modules()Resolves: rhbz#1421598- Add SELinux support for systemd-initctl daemonResolves:rhbz#1365947- Add SELinux support for systemd-bootchartResolves: rhbz#1365953
* Tue Feb 07 2017 Lukas Vrabec - 3.13.1-118- Allow firewalld to getattr open search read modules_object_t:dirResolves: rhbz#1418391- Fix label for nagios plugins in nagios file conxtext fileResolves: rhbz#1277718- Add sys_ptrace capability to pegasus domainResolves: rhbz#1381238- Allow sssd_t domain setpgidResolves:rhbz#1416780- After the latest changes in nfsd. We should allow nfsd_t to read raw fixed disk.Resolves: rhbz#1350927- Allow kdumpgui domain to read nvme deviceResolves: rhbz#1415084- su using libselinux and creating netlink_selinux socket is needed to allow libselinux initialization.Resolves: rhbz#1146987- Add user namespace capability object classes.Resolves: rhbz#1368057- Add module_load permission to class systemResolves:rhbz#1368057- Add the validate_trans access vector to the security class Resolves: rhbz#1368057- Add \"binder\" security class and access vectorsResolves: rhbz#1368057- Allow ifconfig_t domain read nsfs_tResolves: rhbz#1349814- Allow ping_t domain to load kernel modules.Resolves: rhbz#1388363
* Mon Jan 09 2017 Lukas Vrabec - 3.13.1-117- Allow systemd container to read/write usermodehelperstateResolves: rhbz#1403254- Label udp ports in range 24007-24027 as gluster_port_tResolves: rhbz#1404152
* Tue Dec 20 2016 Lukas Vrabec - 3.13.1-116- Allow glusterd_t to bind on glusterd_port_t udp ports.Resolves: rhbz#1404152- Revert: Allow glusterd_t to bind on med_tlp port.
* Mon Dec 19 2016 Lukas Vrabec - 3.13.1-115- Allow glusterd_t to bind on med_tlp port.Resolves: rhbz#1404152- Update ctdbd_t policy to reflect all changes.Resolves: rhbz#1402451- Label tcp port 24009 as med_tlp_port_tResolves: rhbz#1404152- Issue appears during update directly from RHEL-7.0 to RHEL-7.3 or above. Modules pkcsslotd and vbetools missing in selinux-policy package for RHEL-7.3 which causing warnings during SELinux policy store migration process. Following patch fixes issue by skipping pkcsslotd and vbetools modules migration.
* Thu Dec 15 2016 Lukas Vrabec - 3.13.1-114- Allow ctdbd_t domain transition to rpcd_tResolves:rhbz#1402451
* Thu Dec 15 2016 Lukas Vrabec - 3.13.1-113- Fixes for containers Allow containers to attempt to write to unix_sysctls. Allow cotainers to use the FD\'s leaked to them from parent processes.Resolves: rhbz#1403254
* Tue Dec 13 2016 Lukas Vrabec - 3.13.1-112- Allow glusterd_t send signals to userdomain. Label new glusterd binaries as glusterd_exec_tResolves: rhbz#1404152- Allow systemd to stop glusterd_t domains.Resolves: rhbz#1400493
* Fri Dec 09 2016 Lukas Vrabec - 3.13.1-111- Make working CTDB:NFS: CTDB failover from selinux-policy POVResolves: rhbz#1402451
* Fri Dec 02 2016 Lukas Vrabec - 3.13.1-110- Add kdump_t domain sys_admin capabilityResolves: rhbz#1375963
* Thu Dec 01 2016 Lukas Vrabec - 3.13.1-109- Allow puppetagent_t to access timedated dbus. Use the systemd_dbus_chat_timedated interface to allow puppetagent_t the access.Resolves: rhbz#1399250
* Mon Nov 14 2016 Lukas Vrabec - 3.13.1-108- Update systemd on RHEL-7.2 box to version from RHEL-7.3 and then as a separate yum command update the selinux policy systemd will start generating USER_AVC denials and will start returning \"Access Denied\" errors to DBus clientsResolves: rhbz#1393505
* Wed Nov 09 2016 Lukas Vrabec - 3.13.1-107- Allow cluster_t communicate to fprintd_t via dbusResolves: rhbz#1349798
* Tue Nov 08 2016 Lukas Vrabec - 3.13.1-106- Fix error message during update from RHEL-7.2 to RHEL-7.3, when /usr/sbin/semanage command is not installed and selinux-policy-migrate-local-changes.sh script is executed in %post install phase of selinux-policy packageResolves: rhbz#1392010
* Tue Oct 18 2016 Miroslav Grepl - 3.13.1-105- Allow GlusterFS with RDMA transport to be started correctly. It requires ipc_lock capability together with rw permission on rdma_cm device.Resolves: rhbz#1384488- Allow glusterd to get attributes on /sys/kernel/config directory.Resolves: rhbz#1384483
* Mon Oct 10 2016 Lukas Vrabec - 3.13.1-104- Use selinux-policy-migrate-local-changes.sh instead of migrateStore
* macros- Add selinux-policy-migrate-local-changes serviceResolves: rhbz#1381588
* Fri Sep 30 2016 Lukas Vrabec - 3.13.1-103- Allow sssd_selinux_manager_t to manage also dir class.Resolves: rhbz#1368097- Add interface seutil_manage_default_contexts_dirs()Resolves: rhbz#1368097
* Tue Sep 27 2016 Dan Walsh - 3.13.1-102- Add virt_sandbox_use_nfs -> virt_use_nfs boolean substitution.Resolves: rhbz#1355783
* Tue Sep 27 2016 Lukas Vrabec - 3.13.1-101- Allow pcp_pmcd_t domain transition to lvm_t Add capability kill and sys_ptrace to pcp_pmlogger_tResolves: rhbz#1309883
* Wed Sep 21 2016 Lukas Vrabec - 3.13.1-100- Allow ftp daemon to manage apache_user_contentResolves: rhbz#1097775- Label /etc/sysconfig/oracleasm as oracleasm_conf_tResolves: rhbz#1331383- Allow oracleasm to rw inherited fixed disk deviceResolves: rhbz#1331383- Allow collectd to connect on unix_stream_socketResolves: rhbz#1377259
* Wed Sep 14 2016 Lukas Vrabec - 3.13.1-99- Allow iscsid create netlink iscsid sockets.Resolves: rhbz#1358266- Improve regexp for power_unit_file_t files. To catch just systemd power unit files.Resolves: rhbz#1375462
* Tue Sep 13 2016 Lukas Vrabec - 3.13.1-98- Update oracleasm SELinux module that can manage oracleasmfs_t blk files. Add dac_override cap to oracleasm_t domain.Resolves: rhbz#1331383- Add few rules to pcp SELinux module to make ti able to start pcp_pmlogger serviceResolves: rhbz#1206525
* Tue Sep 06 2016 Lukas Vrabec - 3.13.1-97- Add oracleasm_conf_t type and allow oracleasm_t to create /dev/oracleasmResolves: rhbz#1331383- Label /usr/share/pcp/lib/pmie as pmie_exec_t and /usr/share/pcp/lib/pmlogger as pmlogger_exec_tResolves: rhbz#1206525- Allow mdadm_t to getattr all device nodesResolves: rhbz#1365171- Add interface dbus_dontaudit_stream_connect_system_dbusd()Resolves:rhbz#1052880- Add virt_stub_
* interfaces for docker policy which is no longer a part of our base policy.Resolves: rhbz#1372705- Allow guest-set-user-passwd to set users password.Resolves: rhbz#1369693- Allow samdbox domains to use msg classResolves: rhbz#1372677- Allow domains using kerberos to read also kerberos config dirsResolves: rhbz#1368492- Allow svirt_sandbox_domains to r/w onload socketsResolves: rhbz#1342930- Add interface fs_manage_oracleasm()Resolves: rhbz#1331383- Label /dev/kfd as hsa_device_tResolves: rhbz#1373488- Update seutil_manage_file_contexts() interface that caller domain can also manage file_context_t dirsResolves: rhbz#1368097- Add interface to write to nsfs inodesResolves: rhbz#1372705- Allow systemd services to use PrivateNetwork featureResolves: rhbz#1372705- Add a type and genfscon for nsfs.Resolves: rhbz#1372705- Allow run sulogin_t in range mls_systemlow-mls_systemhigh.Resolves: rhbz#1290400
* Wed Aug 31 2016 Lukas Vrabec - 3.13.1-96- Allow arpwatch to create netlink netfilter sockets. Resolves: rhbz#1358261- Fix file context for /etc/pki/pki-tomcat/ca/- new interface oddjob_mkhomedir_entrypoint()- Move label for /var/lib/docker/vfs/ to proper SELinux module- Allow mdadm to get attributes from all devices.- Label /etc/puppetlabs as puppet_etc_t.- Allow systemd-machined to communicate to lxc container using dbus- Allow systemd_resolved to send dbus msgs to userdomains Resolves: rhbz#1236579- Allow systemd-resolved to read network sysctls Resolves: rhbz#1236579- Allow systemd_resolved to connect on system bus. Resolves: rhbz#1236579- Make entrypoint oddjob_mkhomedir_exec_t for unconfined_t- Label all files in /dev/oracleasmfs/ as oracleasmfs_t Resolves: rhbz#1331383
* Tue Aug 23 2016 Lukas Vrabec - 3.13.1-95- Label /etc/pki/pki-tomcat/ca/ as pki_tomcat_cert_tResolves:rhbz#1366915- Allow certmonger to manage all systemd unit filesResolves:rhbz#1366915- Grant certmonger \"chown\" capabilityResolves:rhbz#1366915- Allow ipa_helper_t stream connect to dirsrv_t domainResolves: rhbz#1368418- Update oracleasm SELinux moduleResolves: rhbz#1331383- label /var/lib/kubelet as svirt_sandbox_file_tResolves: rhbz#1369159- Add few interfaces to cloudform.if fileResolves: rhbz#1367834- Label /var/run/corosync-qnetd and /var/run/corosync-qdevice as cluster_var_run_t. Note: corosync policy is now par of rhcs moduleResolves: rhbz#1347514- Allow krb5kdc_t to read krb4kdc_conf_t dirs.Resolves: rhbz#1368492- Update networkmanager_filetrans_named_content() interface to allow source domain to create also temad dir in /var/run.Resolves: rhbz#1365653- Allow teamd running as NetworkManager_t to access netlink_generic_socket to allow multiple network interfaces to be teamed together.Resolves: rhbz#1365653- Label /dev/oracleasmfs as oracleasmfs_t. Add few interfaces related to oracleasmfs_t typeResolves: rhbz#1331383- A new version of cloud-init that supports the effort to provision RHEL Atomic on Microsoft Azure requires some a new rules that allows dhclient/dhclient hooks to call cloud-init.Resolves: rhbz#1367834- Allow iptables to creating netlink generic sockets.Resolves: rhbz#1364359
* Wed Aug 17 2016 Lukas Vrabec - 3.13.1-94- Allow ipmievd domain to create lock files in /var/lock/subsys/Resolves:rhbz#1349058- Update policy for ipmievd daemon.Resolves:rhbz#1349058- Dontaudit hyperkvp to getattr on non security files.Resolves: rhbz#1349356- Label /run/corosync-qdevice and /run/corosync-qnetd as corosync_var_run_tResolves: rhbz#1347514- Fixed lsm SELinux module- Add sys_admin capability to sbd domainResolves: rhbz#1322725- Allow vdagent to comunnicate with systemd-logind via dbusResolves: rhbz#1366731- Allow lsmd_plugin_t domain to create fixed_disk device.Resolves: rhbz#1238066- Allow opendnssec domain to create and manage own tmp dirs/filesResolves: rhbz#1366649- Allow opendnssec domain to read system stateResolves: rhbz#1366649- Update opendnssec_manage_config() interface to allow caller domain also manage opendnssec_conf_t dirsResolves: rhbz#1366649- Allow rasdaemon to mount/unmount tracefs filesystem.Resolves: rhbz#1364380- Label /usr/libexec/iptables/iptables.init as iptables_exec_t Allow iptables creating lock file in /var/lock/subsys/Resolves: rhbz#1367520- Modify interface den_read_nvme() to allow also read nvme_device_t block files.Resolves: rhbz#1362564- Label /var/run/storaged as lvm_var_run_t.Resolves: rhbz#1264390- Allow unconfineduser to run ipa_helper_t.Resolves: rhbz#1361636
* Wed Aug 10 2016 Lukas Vrabec - 3.13.1-93- Dontaudit mock to write to generic certs.Resolves: rhbz#1271209- Add labeling for corosync-qdevice and corosync-qnetd daemons, to run as cluster_tResolves: rhbz#1347514- Revert \"Label corosync-qnetd and corosync-qdevice as corosync_t domain\"- Allow modemmanager to write to systemd inhibit pipesResolves: rhbz#1365214- Label corosync-qnetd and corosync-qdevice as corosync_t domainResolves: rhbz#1347514- Allow ipa_helper to read network stateResolves: rhbz#1361636- Label oddjob_reqiest as oddjob_exec_tResolves: rhbz#1361636- Add interface oddjob_run()Resolves: rhbz#1361636- Allow modemmanager chat with systemd_logind via dbusResolves: rhbz#1362273- Allow NetworkManager chat with puppetagent via dbusResolves: rhbz#1363989- Allow NetworkManager chat with kdumpctl via dbusResolves: rhbz#1363977- Allow sbd send msgs to syslog Allow sbd create dgram sockets. Allow sbd to communicate with kernel via dgram socket Allow sbd r/w kernel sysctls.Resolves: rhbz#1322725- Allow ipmievd_t domain to re-create ipmi devices Label /usr/libexec/openipmi-helper as ipmievd_exec_tResolves: rhbz#1349058- Allow rasdaemon to use tracefs filesystem.Resolves: rhbz#1364380- Fix typo bug in dirsrv policy- Some logrotate scripts run su and then su runs unix_chkpwd. Allow logrotate_t domain to check passwd.Resolves: rhbz#1283134- Add ipc_lock capability to sssd domain. Allow sssd connect to http_cache_tResolves: rhbz#1362688- Allow dirsrv to read dirsrv_share_t contentResolves: rhbz#1363662- Allow virtlogd_t to append svirt_image_t files.Resolves: rhbz#1358140- Allow hypervkvp domain to read hugetlbfs dir/files.Resolves: rhbz#1349356- Allow mdadm daemon to read nvme_device_t blk filesResolves: rhbz#1362564- Allow selinuxusers and unconfineduser to run oddjob_requestResolves: rhbz#1361636- Allow sshd server to acces to Crypto Express 4 (CEX4) devices.Resolves: rhbz#1362539- Fix labeling issue in init.fc file. Path /usr/lib/systemd/fedora-
* changed to /usr/lib/systemd/rhel-
*.Resolves: rhbz#1363769- Fix typo in device interfacesResolves: rhbz#1349058- Add interfaces for managing ipmi devicesResolves: rhbz#1349058- Add interfaces to allow mounting/umounting tracefs filesystemResolves: rhbz#1364380- Add interfaces to allow rw tracefs filesystemResolves: rhbz#1364380- Add interface dev_read_nvme() to allow reading Non-Volatile Memory Host Controller devices.Resolves: rhbz#1362564- Label /sys/kernel/debug/tracing filesystemResolves: rhbz#1364380- Allow sshd setcap capability. This is needed due to latest changes in sshdResolves: rhbz#1357857
* Thu Jul 28 2016 Lukas Vrabec - 3.13.1-92- Dontaudit mock_build_t can list all ptys.Resolves: rhbz#1271209- Allow ftpd_t to mamange userhome data without any boolean.Resolves: rhbz#1097775- Add logrotate permissions for creating netlink selinux sockets.Resolves: rhbz#1283134- Allow lsmd_plugin_t to exec ldconfig.Resolves: rhbz#1238066- Allow vnstatd domain to read /sys/class/net/ filesResolves: rhbz#1358243- Remove duplicate allow rules in spamassassin SELinux moduleResolves:rhbz#1358175- Allow spamc_t and spamd_t domains create .spamassassin file in user homedirsResolves:rhbz#1358175- Allow sshd setcap capability. This is needed due to latest changes in sshdResolves: rhbz#1357857- Add new MLS attribute to allow relabeling objects higher than system low. This exception is needed for package managers when processing sensitive data.Resolves: rhbz#1330464- Allow gnome-keyring also manage user_tmp_t sockets.Resolves: rhbz#1257057- corecmd: Remove fcontext for /etc/sysconfig/libvirtdResolves:rhbz#1351382
* Tue Jul 19 2016 Lukas Vrabec - 3.13.1-91- Allow ipa_dnskey domain to search cache dirsResolves: rhbz#1350957
* Tue Jul 19 2016 Lukas Vrabec - 3.13.1-90- Allow ipa-dnskey read system state.Reasolves: rhbz#1350957- Allow dogtag-ipa-ca-renew-agent-submit labeled as certmonger_t to create /var/log/ipa/renew.log fileResolves: rhbz#1350957
* Mon Jul 18 2016 Lukas Vrabec - 3.13.1-89- Allow firewalld to manage net_conf_t files.Resolves:rhbz#1304723- Allow logrotate read logs inside containers.Resolves: rhbz#1303514- Allow sssd to getattr on fs_tResolves: rhbz#1356082- Allow opendnssec domain to manage bind chace filesResolves: rhbz#1350957- Fix typo in rhsmcertd policy moduleResolves: rhbz#1329475- Allow systemd to get status of systemd-logind daemonResolves: rhbz#1356141- Label more ndctl devices not just ndctl0Resolves: rhbz#1355809
* Thu Jul 14 2016 Lukas Vrabec - 3.13.1-88- Allow rhsmcertd to copy certs into /etc/docker/cert.d- Add interface docker_rw_config()Resolves: rhbz#1344500- Fix logrotate fc file to label also /var/lib/logrotate/ dir as logrotate_var_lib_tResolves: rhbz#1355632- Allow rhsmcertd to read network sysctlsResolves: rhbz#1329475- Label /var/log/graphite-web dir as httpd_log_tResolves: rhbz#1310898- Allow mock to use generic ptysResolves: rhbz#1271209- Allow adcli running as sssd_t to write krb5.keytab file.Resolves: rhbz#1356082- Allow openvswitch connect to openvswitch_port_t type.Resolves: rhbz#1335024- Add SELinux policy for opendnssec service.Resolves: rhbz#1350957- Create new SELinux type for /usr/libexec/ipa/ipa-dnskeysyncdResolves: rhbz#1350957- label /dev/ndctl0 device as nvram_device_tResolves: rhbz#1355809
* Mon Jul 11 2016 Lukas Vrabec - 3.13.1-87- Allow lttng tools to block suspendingResolves: rhbz#1256374- Allow creation of vpnaas in openstackResolves: rhbz#1352710- virt: add strict policy for virtlogd daemonResolves:rhbz#1311606- Update makefile to support snapperd_contexts fileResolves: rhbz#1352681
* Fri Jul 08 2016 Lukas Vrabec - 3.13.1-86- Allow udev to manage systemd-hwdb files- Add interface systemd_hwdb_manage_config()Resolves: rhbz#1350756- Fix paths to infiniband devices. This allows use more then two infiniband interfaces.Resolves: rhbz#1210263
* Thu Jul 07 2016 Lukas Vrabec - 3.13.1-85- Allow virtual machines to rw infiniband devices.Resolves: rhbz#1210263- Allow opensm daemon to rw infiniband_mgmt_device_tResolves: rhbz#1210263- Allow systemd_hwdb_t to relabel /etc/udev/hwdb.bin file.Resolves: rhbz#1350756- Make label for new infiniband_mgmt deivicesResolves: rhbz#1210263
* Tue Jul 05 2016 Lukas Vrabec - 3.13.1-84- Fix typo in brltty SELinux module- Add new SELinux module sbdResolves: rhbz#1322725- Allow pcp dmcache metrics collectionResolves: rhbz#1309883- Allow pkcs_slotd_t to create dir in /var/lock Add label pkcs_slotd_log_tResolves: rhbz#1350782- Allow openvpn to create sock files labeled as openvpn_var_run_tResolves: rhbz#1328246- Allow hypervkvp daemon to getattr on all filesystem types.Resolves: rhbz#1349356- Allow firewalld to create net_conf_t filesResolves: rhbz#1304723- Allow mock to use lvmResolves: rhbz#1271209- Allow keepalived to create netlink generic sockets.Resolves: rhbz#1349809- Allow mirromanager creating log files in /tmpResolves:rhbz#1328818- Rename few modules to make it consistent with source filesResolves: rhbz#1351445- Allow vmtools_t to transition to rpm_script domainResolves: rhbz#1342119- Allow nsd daemon to manage nsd_conf_t dirs and filesResolves: rhbz#1349791- Allow cluster to create dirs in /var/run labeled as cluster_var_run_tResolves: rhbz#1346900- Allow sssd read also sssd_conf_t dirsResolves: rhbz#1350535- Dontaudit su_role_template interface to getattr /proc/kcore Dontaudit su_role_template interface to getattr /dev/initctlResolves: rhbz#1086240- Add interface lvm_getattr_exec_files()Resolves: rhbz#1271209- Fix typo Compliling vs. CompilingResolves: rhbz#1351445
* Wed Jun 29 2016 Lukas Vrabec - 3.13.1-83- Allow krb5kdc_t to communicate with sssdResolves: rhbz#1319933- Allow prosody to bind on prosody portsResolves: rhbz#1304664- Add dac_override caps for fail2ban-clientResolves: rhbz#1316678- dontaudit read access for svirt_t on the file /var/db/nscd/groupResolves: rhbz#1301637- Allow inetd child process to communicate via dbus with systemd-logindResolves: rhbz#1333726- Add label for brltty log fileResolves: rhbz#1328818- Allow dspam to read the passwd fileResolves: rhbz#1286020- Allow snort_t to communicate with sssdResolves: rhbz#1284908- svirt_sandbox_domains need to be able to execmod for badly built libraries.Resolves: rhbz#1206339- Add policy for lttng-tools package.Resolves: rhbz#1256374- Make mirrormanager as application domain.Resolves: rhbz#1328234- Add support for the default lttng-sessiond port - tcp/5345. This port is used by LTTng 2.x central tracing registry session daemon.- Add prosody portsResolves: rhbz#1304664- Allow sssd read also sssd_conf_t dirsResolves: rhbz#1350535
* Tue Jun 28 2016 Lukas Vrabec - 3.13.1-82- Label /var/lib/softhsm as named_cache_t. Allow named_t to manage named_cache_t dirs.Resolves:rhbz#1331315- Label named-pkcs11 binary as named_exec_t.Resolves: rhbz#1331315- Allow glusterd daemon to get systemd statusResolves: rhbz#1321785- Allow logrotate dbus-chat with system_logind daemonResolves: rhbz#1283134- Allow pcp_pmlogger to read kernel network state Allow pcp_pmcd to read cron pid filesResolves: rhbz#1336211- Add interface cron_read_pid_files()Resolves: rhbz#1336211- Allow pcp_pmlogger to create unix dgram socketsResolves: rhbz#1336211- Add hwloc-dump-hwdata SELinux policyResolves: rhbz#1344054- Remove non-existing jabberd_spool_t() interface and add new jabbertd_var_spool_t.Resolves: rhbz#1121171- Remove non-existing interface salk_resetd_systemctl() and replace it with sanlock_systemctl_sanlk_resetd()Resolves: rhbz#1259764- Create label for openhpid log files. esolves: rhbz#1259764- Label /var/lib/ganglia as httpd_var_lib_tResolves: rhbz#1260536- Allow firewalld_t to create entries in net_conf_t dirs.Resolves: rhbz#1304723- Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journalsResolves: rhbz#1288255- Include patch from distgit repo: policy-RHEL-7.1-flask.patch.Resolves: rhbz#1329560- Update refpolicy to handle hwlocResolves: rhbz#1344054- Label /etc/dhcp/scripts dir as bin_t- Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals.Resolves: rhbz#1288255
* Wed Jun 22 2016 Lukas Vrabec - 3.13.1-81- Allow firewalld_t to create entries in net_conf_t dirs.Resolves: rhbz#1304723- Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journalsResolves: rhbz#1288255- Allow mongod log to syslog.Resolves: rhbz#1306995- Allow rhsmcertd connect to port tcp 9090Resolves: rhbz#1337319- Label for /bin/mail(x) was removed but /usr/bin/mail(x) not. This path is also needed to remove. Resolves: rhbz#1262483Resolves: rhbz#1277506- Label /usr/libexec/mimedefang-wrapper as spamd_exec_t.Resolves: rhbz#1301516- Add new boolean spamd_update_can_network.Resolves: rhbz#1305469- Allow rhsmcertd connect to tcp netport_port_tResolves: rhbz#1329475- Fix SELinux context for /usr/share/mirrormanager/server/mirrormanager to Label all binaries under dir as mirrormanager_exec_t.Resolves: rhbz#1328234- Allow prosody to bind to fac_restore tcp port.Resolves: rhbz#1321787- Allow ninfod to read raw packetsResolves: rhbz#1317964- Allow pegasus get attributes from qemu binary files.Resolves: rhbz#1260835- Allow pegasus get attributes from qemu binary files.Resolves: rhbz#1271159- Allow tuned to use policykit. This change is required by cockpit.Resolves: rhbz#1346464- Allow conman_t to read dir with conman_unconfined_script_t binary files.Resolves: rhbz#1297323- Allow pegasus to read /proc/sysinfo.Resolves: rhbz#1265883- Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals.Resolves: rhbz#1288255- Label tcp ports:16379, 26379 as redis_port_tResolves: rhbz#1348471- Allow systemd to relabel /var and /var/lib directories during boot.- Add files_relabel_var_dirs() and files_relabel_var_dirs() interfaces.- Add files_relabelto_var_lib_dirs() interface.- Label tcp port 2004 as mailbox_port_t.Resolves: rhbz#1332843- Label tcp and udp port 5582 as fac_restore_port_tResolves: rhbz#1321787- Allow sysadm_t user to run postgresql-setup.Resolves: rhbz#1282543- Allow sysadm_t user to dbus chat with oddjob_t. This allows confined admin run oddjob mkhomedirfor script.Resolves: rhbz#1297480- Update netlink socket classes.
* Thu Jun 16 2016 Lukas Vrabec - 3.13.1-80- Allow conman to kill conman_unconfined_script.Resolves: rhbz#1297323- Make conman_unconfined_script_t as init_system_domain.Resolves:rhbz#1297323- Allow init dbus chat with apmd.Resolves:rhbz#995898- Patch /var/lib/rpm is symlink to /usr/share/rpm on Atomic, due to this change we need to label also /usr/share/rpm as rpm_var_lib_t.Resolves: rhbz#1233252- Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_tResolves: rhbz#1052880- Add mediawiki rules to proper scopeResolves: rhbz#1301186- Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_tResolves: rhbz#1052880- Allow mysqld_safe to inherit rlimit information from mysqldResolves: rhbz#1323673- Allow collectd_t to stream connect to postgresql.Resolves: rhbz#1344056- Allow mediawiki-script to read /etc/passwd file.Resolves: rhbz#1301186- Add filetrans rule that NetworkManager_t can create net_conf_t files in /etc.Resolves: rhbz#1344505- Add labels for mediawiki123Resolves: rhbz#1293872- Fix label for all fence_scsi_check scripts- Allow ip netns to mounton root fs and unmount proc_t fs.Resolves: rhbz#1343776Resolves: rhbz#1286851- Allow sysadm_t to run newaliases command.Resolves: rhbz#1344828- Add interface sysnet_filetrans_named_net_conf()Resolves: rhbz#1344505
* Mon Jun 13 2016 Petr Lautrbach - 3.13.1-79- Fix several issues related to the SELinux Userspace changes
* Thu Jun 09 2016 Lukas Vrabec - 3.13.1-78- Allow glusterd domain read krb5_keytab_t files.Resolves: rhbz#1343929- Fix typo in files_setattr_non_security_dirs.Resolves: rhbz#1115987
* Thu Jun 09 2016 Lukas Vrabec - 3.13.1-77- Allow tmpreaper_t to read/setattr all non_security_file_type dirsResolves: rhbz#1115987- Allow firewalld to create firewalld_var_run_t directory.Resolves: rhbz#1304723- Add interface firewalld_read_pid_files()Resolves: rhbz#1304723- Label /usr/libexec/rpm-ostreed as rpm_exec_t.Resolves: rhbz#1340542- Allow sanlock service to read/write cephfs_t files.Resolves: rhbz#1315332- Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)- Added missing docker interfaces: - docker_typebounds - docker_entrypointResolves: rhbz#1236580- Add interface files_setattr_non_security_dirs()Resolves: rhbz#1115987- Add support for onloadfs- Allow iptables to read firewalld pid files.Resolves: rhbz#1304723- Add SELinux support for ceph filesystem.Resolves: rhbz#1315332- Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)Resolves: rhbz#1236580
* Mon Jun 06 2016 Lukas Vrabec - 3.13.1-76- Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)- Added missing docker interfaces: - docker_typebounds - docker_entrypointResolves: rhbz#1236580- New interfaces needed for systemd-machinectlResolves: rhbz#1236580- New interfaces needed by systemd-machineResolves: rhbz#1236580- Add interface allowing sending and receiving messages from virt over dbus.Resolves: rhbz#1236580- Backport docker policy from Fedora.Related: #1303123Resolves: #1341257- Allow NetworkManager_t and policykit_t read access to systemd-machined pid files.Resolves: rhbz#1236580- Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)- Added interfaces needed by new docker policy.Related: rhbz#1303123- Add support for systemd-machined daemonResolves: rhbz#1236580- Allow rpm-ostree domain transition to install_t domain from init_t.Resolves: rhbz#1340542
* Tue May 31 2016 Lukas Vrabec - 3.13.1-75- dnsmasq: allow NetworkManager to control dnsmasq via D-BusResolves: rhbz#1336722- Directory Server (389-ds-base) has been updated to use systemd-ask-password. In order to function correctly we need the following added to dirsrv.teResolves: rhbz#1333198- sftpd_
* booleans are functionless these days.Resolves: rhbz#1335656- Label /var/log/ganesha.log as gluster_log_t Allow glusterd_t domain to create glusterd_log_t files. Label /var/run/ganesha.pid as gluster_var_run_t.Resolves: rhbz#1335828- Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus.Resolves: rhbz#1336760- Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t.Resolves: rhbz#1336737- Label /usr/libexec/storaged/storaged as lvm_exec_t to run storaged daemon in lvm_t SELinux domain.Resolves: rhbz#1264390- Allow systemd_hostanmed_t to read /proc/sysinfo labeled as sysctl_t.Resolves: rhbz#1337061- Revert \"Allow all domains some process flags.\"Resolves: rhbz#1303644- Revert \"Remove setrlimit to all domains.\"Resolves: rhbz#1303644- Label /usr/sbin/xrdp
* files as bin_tResolves: rhbz#1276777- Add mls support for some db classesResolves: rhbz#1303651- Allow systemd_resolved_t to check if ipv6 is disabled.Resolves: rhbz#1236579- Allow systemd_resolved to read systemd_networkd run files.Resolves: rhbz#1236579
* Mon May 23 2016 Lukas Vrabec - 3.13.1-74- Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus.Resolves: rhbz#1336760- Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t.Resolves: rhbz#1336737
* Mon May 16 2016 Lukas Vrabec - 3.13.1-73- Allow logwatch to domtrans to postqueueResolves: rhbz#1331542- Label /var/log/ganesha.log as gluster_log_t- Allow glusterd_t domain to create glusterd_log_t files.- Label /var/run/ganesha.pid as gluster_var_run_t.Resolves: rhbz#1335828- Allow zabbix to connect to postgresql portResolves: rhbz#1330479- Add userdom_destroy_unpriv_user_shared_mem() interface.Related: rhbz#1306403- systemd-logind remove all IPC objects owned by a user on a logout. This covers also SysV memory. This change allows to destroy unpriviledged user SysV shared memory segments.Resolves: rhbz#1306403
* Mon May 16 2016 Lukas Vrabec - 3.13.1-72- We need to restore contexts on /etc/passwd
*,/etc/group
*,/etc/
*shadow
* during install phase to get proper labeling for these files until selinux-policy pkgs are installed.Resolves: rhbz#1333952
* Tue May 10 2016 Lukas Vrabec - 3.13.1-71- Add interface glusterd_dontaudit_read_lib_dirs()Resolves: rhbz#1295680- Dontaudit Occasionally observing AVC\'s while running geo-rep automationResolves: rhbz#1295680- Allow glusterd to manage socket files labeled as glusterd_brick_t.Resolves: rhbz#1331561- Create new apache content template for files stored in user homedir. This change is needed to make working booleans: - httpd_enable_homedirs - httpd_read_user_content Resolves: rhbz#1246522- Allow stunnel create log files. Resolves: rhbz#1296851- Label tcp port 8181 as intermapper_port_t.Resolves: rhbz#1334783- Label tcp/udp port 2024 as xinuexpansion4_port_tResolves: rhbz#1334783- Label tcp port 7002 as afs_pt_port_t Label tcp/udp port 2023 as xinuexpansion3_port_tResolves: rhbz#1334783- Dontaudit ldconfig read gluster lib files.Resolves: rhbz#1295680- Add interface auth_use_nsswitch() to systemd_domain_template.Resolves: rhbz#1236579
* Tue May 03 2016 Lukas Vrabec - 3.13.1-70- Label /usr/bin/ganesha.nfsd as glusterd_exec_t to run ganesha as glusterd_t. Allow glusterd_t stream connect to rpbind_t. Allow cluster_t to create symlink /var/lib/nfs labeled as var_lib_nfs_t. Add interface rpc_filetrans_var_lib_nfs_content() Add new boolean: rpcd_use_fusefs to allow rpcd daemon use fusefs. Resolves: rhbz#1312809 Resolves: rhbz#1323947- Allow dbus chat between httpd_t and oddjob_t. Resolves: rhbz#1324144- Label /usr/libexec/ipa/oddjob/org.freeipa.server.conncheck as ipa_helper_exec_t.Resolves: rhbz#1324144- Label /var/log/ipareplica-conncheck.log file as ipa_log_t Allow ipa_helper_t domain to manage logs labeledas ipa_log_t Allow ipa_helper_t to connect on http and kerberos_passwd ports.Resolves: rhbz#1324144- Allow prosody to listen on port 5000 for mod_proxy65.Resolves: rhbz#1316918- Allow pcp_pmcd_t domain to manage docker lib files. This rule is needed to allow pcp to collect container information when SELinux is enabled.Resolves: rhbz#1309454
* Wed Apr 27 2016 Lukas Vrabec - 3.13.1-69- Allow runnig php7 in fpm mode. From selinux-policy side, we need to allow httpd to read/write hugetlbfs.Resolves: rhbz#1319442- Allow openvswitch daemons to run under openvswitch Linux user instead of root. This change needs allow set capabilities: chwon, setgid, setuid, setpcap.Resolves: rhbz#1296640- Remove ftpd_home_dir() boolean from distro policy. Reason is that we cannot make this working due to m4 macro language limits.Resolves: rhbz#1097775- /bin/mailx is labeled sendmail_exec_t, and enters the sendmail_t domain on execution. If /usr/sbin/sendmail does not have its own domain to transition to, and is not one of several products whose behavior is allowed by the sendmail_t policy, execution will fail. In this case we need to label /bin/mailx as bin_t.Resolves: rhbz#1262483- Allow nsd daemon to create log file in /var/log as nsd_log_tResolves: rhbz#1293140- Sanlock policy update. - New sub-domain for sanlk-reset daemonResolves: rhbz#1212324- Label all run tgtd files, not just socket filesResolves: rhbz#1280280- Label all run tgtd files, not just socket files.Resolves: rhbz#1280280- Allow prosody to stream connect to sasl. This will allow using cyrus authentication in prosody.Resolves: rhbz#1321049- unbound wants to use ephemeral ports as a default configuration. Allow to use also udp sockets.Resolves: rhbz#1318224- Allow prosody to listen on port 5000 for mod_proxy65.Resolves: rhbz#1316918- Allow targetd to read/write to /dev/mapper/control device.Resolves: rhbz#1063714- Allow KDM to get status about power services. This change allow kdm to be able do shutdown.Resolves: rhbz#1316724- Allow systemd-resolved daemon creating netlink_route sockets.Resolves:rhbz#1236579- Allow systemd_resolved_t to read /etc/passwd file. Allow systemd_resolved_t to write to kmsg_device_t when \'systemd.log_target=kmsg\' option is usedResolves: rhbz#1065362- Label /etc/selinux/(minimum|mls|targeted)/active/ as semanage_store_tResolves: rhbz#1321943- Label all nvidia binaries as xserver_exec_tResolves: rhbz#1322283
* Wed Mar 23 2016 Lukas Vrabec - 3.13.1-68- Create new permissivedomains CIL module and make it active.Resolves: rhbz#1320451- Add support for new mock location - /usr/libexec/mock/mock.Resolves: rhbz#1271209- Allow bitlee to create bitlee_var_t dirs.Resolves: rhbz#1268651- Allow CIM provider to read sssd public files.Resolves: rhbz#1263339- Fix some broken interfaces in distro policy.Resolves: rhbz#1121171- Allow power button to shutdown the laptop.Resolves: rhbz#995898- Allow lsm plugins to create named fixed disks.Resolves: rhbz#1238066- Add default labeling for /etc/Pegasus/cimserver_current.conf. It is a correct patch instead of the current /etc/Pegasus/pegasus_current.confResolves: rhbz#1278777- Allow hyperv domains to rw hyperv devices.Resolves: rhbz#1309361- Label /var/www/html(/.
*)?/wp_backups(/.
*)? as httpd_sys_rw_content_t.Resolves: rhbz#1246780- Create conman_unconfined_script_t type for conman script stored in /use/share/conman/exec/Resolves: rhbz#1297323- Fix rule definitions for httpd_can_sendmail boolean. We need to distinguish between base and contrib.- Add support for /dev/mptctl device used to check RAID status. Resolves: rhbz#1258029- Create hyperv
* devices and create rw interfaces for this devices.Resolves: rhbz#1309361- Add fixes for selinux userspace moving the policy store to /var/lib/selinux.- Remove optional else block for dhcp ping
* Thu Mar 17 2016 Lukas Vrabec - 3.13.1-67- Allow rsync_export_all_ro boolean to read also non_auth_dirs/files/symlinks.Resolves: rhbz#1263770- Fix context of \"/usr/share/nginx/html\".Resolves: rhbz#1261857- Allow pmdaapache labeled as pcp_pmcd_t access to port 80 for apache diagnosticsResolves: rhbz#1270344- Allow pmlogger to create pmlogger.primary.socket link file. Resolves: rhbz#1270344- Label nagios scripts as httpd_sys_script_exec_t.Resolves: rhbz#1260306- Add dontaudit interface for kdumpctl_tmp_tResolves: rhbz#1156442- Allow mdadm read files in EFI partition.Resolves: rhbz#1291801- Allow nsd_t to bind on nsf_control tcp port. Allow nsd_crond_t to read nsd pid.Resolves: rhbz#1293140- Label some new nsd binaries as nsd_exec_t Allow nsd domain net_admin cap. Create label nsd_tmp_t for nsd tmp files/dirsResolves: rhbz#1293140- Add filename transition that /etc/princap will be created with cupsd_rw_etc_t label in cups_filetrans_named_content() interface.Resolves: rhbz#1265102- Add missing labeling for /usr/libexec/abrt-hook-ccpp.Resolves: rhbz#1213409- Allow pcp_pmie and pcp_pmlogger to read all domains state.Resolves: rhbz#1206525- Label /etc/redis-sentinel.conf as redis_conf_t. Allow redis_t write to redis_conf_t. Allow redis_t to connect on redis tcp port.Resolves: rhbz#1275246- cockpit has grown content in /var/run directoryResolves: rhbz#1279429- Allow collectd setgid capabilityResolves:#1310898- Remove declaration of empty booleans in virt policy.Resolves: rhbz#1103153- Fix typo in drbd policy- Add new drbd file type: drbd_var_run_t. Allow drbd_t to manage drbd_var_run_t files/dirs. Allow drbd_t create drbd_tmp_t files in /tmp.Resolves: rhbz#1134883- Label /etc/ctdb/events.d/
* as ctdb_exec_t. Allow ctdbd_t to setattr on ctdbd_exec_t files.Resolves: rhbz#1293788- Allow abrt-hook-ccpp to get attributes of all processes because of core_pattern.Resolves: rhbz#1254188- Allow abrt_t to read sysctl_net_t files.Resolves: rhbz#1254188- The ABRT coredump handler has code to emulate default core file creation The handler runs in a separate process with abrt_dump_oops_t SELinux process type. abrt-hook-ccpp also saves the core dump file in the very same way as kernel does and a user can specify CWD location for a coredump. abrt-hook-ccpp has been made as a SELinux aware apps to create this coredumps with correct labeling and with this commit the policy rules have been updated to allow access all non security files on a system.- Allow abrt-hook-ccpp to getattr on all executables.- Allow setuid/setgid capabilities for abrt-hook-ccpp. Resolves: rhbz#1254188- abrt-hook-ccpp needs to have setfscreate access because it is SELinux aware and compute a target labeling. Resolves: rhbz#1254188- Allow abrt-hook-ccpp to change SELinux user identity for created objects. Resolves: rhbz#1254188- Dontaudit write access to inherited kdumpctl tmp files. Resolves: rbhz#1156442- Add interface to allow reading files in efivarfs - contains Linux Kernel configuration options for UEFI systems (UEFI Runtime Variables) Resolves: rhbz#1291801- Label 8952 tcp port as nsd_control. Resolves: rhbz#1293140- Allow ipsec to use pam. Resolves: rhbz#1315700- Allow to log out to gdm after screen was resized in session via vdagent.Resolves: rhbz#1249020- Allow setrans daemon to read /proc/meminfo. Resolves: rhbz#1316804- Allow systemd_networkd_t to write kmsg, when kernel was started with following params: systemd.debug systemd.log_level=debug systemd.log_target=kmsgResolves: rhbz#1298151- Label tcp port 5355 as llmnr-> Link-Local Multicast Name ResolutionResolves: rhbz#1236579- Add new selinux policy for systemd-resolved dawmon.Resolves: rhbz#1236579- Add interface ssh_getattr_server_keys() interface.Resolves: rhbz#1306197- Allow run sshd-keygen on second boot if first boot fails after some reason and content is not syncedon the disk. These changes are reflecting this commit in sshd. http://pkgs.fedoraproject.org/cgit/rpms/openssh.git/commit/?id=af94f46861844cbd6ba4162115039bebcc8f78ba rhbz#1299106Resolves: rhbz#1306197- Allow systemd_notify_t to write to kmsg_device_t when \'systemd.log_target=kmsg\' option is used.Resolves: rhbz#1309417- Remove bin_t label for /etc/ctdb/events.d/. We need to label this scripts as ctdb_exec_t.Resolves: rhbz#1293788
* Thu Mar 17 2016 Petr Lautrbach - 3.13.1-66- Prepare selinux-policy package for userspace release 2016-02-23. Resolves: rhbz#1305982
* Tue Mar 08 2016 Lukas Vrabec 3.13.1-65- Allow sending dbus msgs between firewalld and system_cronjob domains. Resolves: rhbz#1284902- Allow zabbix-agentd to connect to following tcp sockets. One of zabbix-agentd functions is get service status of ftp,http,innd,pop,smtp protocols.Resolves: rhbz#1242506- Add new boolean tmpreaper_use_cifs() to allow tmpreaper to run on local directories being shared with Samba.Resolves: rhbz#1284972- Add support for systemd-hwdb daemon. Resolves: rhbz#1257940- Add interface fs_setattr_cifs_dirs(). Resolves: rhbz#1284972
* Mon Feb 29 2016 Lukas Vrabec 3.13.1-64- Add new SELinux policy fo targetd daemon.Resolves: rhbz#1063714- Add new SELinux policy fo ipmievd daemon.Resolves: rhbz#1083031- Add new SELinux policy fo hsqldb daemon.Resolves: rhbz#1083171- Add new SELinux policy for blkmapd daemon.Resolves: rhbz#1072997- Allow p11-child to connect to apache ports.- Label /usr/sbin/lvmlockd binary file as lvm_exec_t.Resolves: rhbz#1278028- Add interface \"lvm_manage_lock\" to lvm policy.Resolves: rhbz#1063714
* Wed Jan 27 2016 Lukas Vrabec 3.13.1-63- Allow openvswitch domain capability sys_rawio.Resolves: rhbz#1278495
* Tue Jan 26 2016 Lukas Vrabec 3.13.1-62- Allow openvswitch to manage hugetlfs files and dirs.Resolves: rhbz#1278495- Add fs_manage_hugetlbfs_files() interface.Resolves: rhbz#1278495
* Tue Jan 12 2016 Lukas Vrabec 3.13.1-61- Allow smbcontrol domain to send sigchld to ctdbd domain.Resolves: #1293784- Allow openvswitch read/write hugetlb filesystem.Resolves: #1278495
* Wed Oct 14 2015 Miroslav Grepl 3.13.1-60Allow hypervvssd to list all mountpoints to have VSS live backup working correctly.Resolves:#1247880
* Tue Oct 13 2015 Miroslav Grepl 3.13.1-59- Revert Add missing labeling for /usr/libexec/abrt-hook-ccpp patchResolves: #1254188
* Thu Oct 08 2015 Lukas Vrabec 3.13.1-58- Allow search dirs in sysfs types in kernel_read_security_state.Resolves: #1254188- Fix kernel_read_security_state interface that source domain of this interface can search sysctl_fs_t dirs.Resolves: #1254188
* Wed Oct 07 2015 Lukas Vrabec 3.13.1-57- Add missing labeling for /usr/libexec/abrt-hook-ccpp as a part of #1245477 and #1242467 bugsResolves: #1254188- We need allow connect to xserver for all sandbox_x domain because we have one type for all sandbox processes.Resolves:#1261938
* Fri Oct 02 2015 Miroslav Grepl 3.13.1-56- Remove labeling for modules_dep_t file contexts to have labeled them as modules_object_t.- Update files_read_kernel_modules() to contain modutils_read_module_deps_files() calling because module deps labeling could remain and it allows to avoid regressions.Resolves:#1266928
* Tue Sep 29 2015 Lukas Vrabec 3.13.1-55- We need to require sandbox_web_type attribute in sandbox_x_domain_template(). Resolves: #1261938- ipsec: The NM helper needs to read the SAsResolves: #1259786- ipsec: Allow ipsec management to create ptysResolves: #1259786
* Tue Sep 29 2015 Lukas Vrabec 3.13.1-54- Add temporary fixes for sandbox related to #1103622. It allows to run everything under one sandbox type.Resolves:#1261938- Allow abrt_t domain to write to kernel msg device.Resolves: #1257828- Allow rpcbind_t domain to change file owner and groupResolves: #1265266
* Tue Sep 22 2015 Lukas Vrabec 3.13.1-53- Allow smbcontrol to create a socket in /var/samba which uses for a communication with smbd, nmbd and winbind. Resolves: #1256459
* Fri Sep 18 2015 Lukas Vrabec 3.13.1-52- Allow dirsrv-admin script to read passwd file. Allow dirsrv-admin script to read httpd pid files. Label dirsrv-admin unit file and allow dirsrv-admin domains to use it.Resolves: #1230300- Allow qpid daemon to connect on amqp tcp port.Resolves: #1261805
* Fri Sep 18 2015 Miroslav Grepl 3.13.1-51- Label /etc/ipa/nssdb dir as cert_tResolves:#1262718- Do not provide docker policy files which is shipped by docker-selinux.rpmResolves:#1262812
* Thu Sep 17 2015 Lukas Vrabec 3.13.1-50- Add labels for afs binaries: dafileserver, davolserver, salvageserver, dasalvager Resolves: #1192338- Add lsmd_plugin_t sys_admin capability, Allow lsmd_plugin_t getattr from sysfs filesystem. Resolves: #1238079- Allow rhsmcertd_t send signull to unconfined_service_t domains. Resolves: #1176078- Remove file transition from snmp_manage_var_lib_dirs() interface which created snmp_var_lib_t dirs in var_lib_t.- Allow openhpid_t daemon to manage snmp files and dirs. Resolves: #1243902- Allow mdadm_t domain read/write to general ptys and unallocated ttys. Resolves: #1073314- Add interface unconfined_server_signull() to allow domains send signull to unconfined_service_t Resolves: #1176078
* Fri Sep 11 2015 Lukas Vrabec 3.13.1-49- Allow systemd-udevd to access netlink_route_socket to change names for network interfaces without unconfined.pp module. It affects also MLS. Resolves:#1250456
* Thu Sep 10 2015 Lukas Vrabec 3.13.1-48- Fix labeling for fence_scsi_check scriptResolves: #1255020- Allow openhpid to read system state Allow openhpid to connect to tcp http port. Resolves: #1244248- Allow openhpid to read snmp var lib files. Resolves: #1243902- Allow openvswitch_t domains read kernel dependencies due to openvswitch run modprobe- Allow unconfined_t domains to create /var/run/xtables.lock with iptables_var_run_tResolves: #1243403- Remove bin_t label for /usr/share/cluster/fence_scsi_check\\.pl Resolves: #1255020
* Wed Sep 02 2015 Lukas Vrabec 3.13.1-47- Fix regexp in chronyd.fc fileResolves: #1243764- Allow passenger to getattr filesystem xattrResolves: #1196555- Label mdadm.conf.anackbak as mdadm_conf_t file.Resolves: #1088904- Revert \"Allow pegasus_openlmi_storage_t create mdadm.conf.anacbak file in /etc.\"- Allow watchdog execute fenced python script.Resolves: #1255020- Added inferface watchdog_unconfined_exec_read_lnk_files()- Remove labeling for /var/db/.
*\\.db as etc_t to label db files as system_db_t.Resolves: #1230877
* Thu Aug 27 2015 Lukas Vrabec 3.13.1-46- Allow watchdog execute fenced python script. Resolves: #1255020- Added inferface watchdog_unconfined_exec_read_lnk_files()- Label /var/run/chrony-helper dir as chronyd_var_run_t. Resolves: #1243764- Allow dhcpc_t domain transition to chronyd_t Resolves: #1243764
* Fri Aug 21 2015 Lukas Vrabec 3.13.1-45- Fix postfix_spool_maildrop_t,postfix_spool_flush_t contexts in postfix.fc file.Resolves: #1252442
* Wed Aug 19 2015 Lukas Vrabec 3.13.1-44- Allow exec pidof under hypervkvp domain.Resolves: #1254870- Allow hypervkvp daemon create connection to the system DBUSResolves: #1254870
* Wed Aug 19 2015 Lukas Vrabec 3.13.1-43- Allow openhpid_t to read system state.Resolves: #1244248- Added labels for files provided by rh-nginx18 collectionResolves: #1249945- Dontaudit block_suspend capability for ipa_helper_t, this is kernel bug. Allow ipa_helper_t capability net_admin. Allow ipa_helper_t to list /tmp. Allow ipa_helper_t to read rpm db.Resolves: #1252968- Allow rhsmcertd exec rhsmcertd_var_run_t files and rhsmcerd_tmp_t files. This rules are in hide_broken_sympthons until we find better solution.Resolves: #1243431- Allow abrt_dump_oops_t to read proc_security_t files.- Allow abrt_dump_oops to signull all domains Allow abrt_dump_oops to read all domains state Allow abrt_dump_oops to ptrace all domains- Add interface abrt_dump_oops_domtrans()- Add mountpoint dontaudit access check in rhsmcertd policy.Resolves: #1243431- Allow samba_net_t to manage samba_var_t sock files.Resolves: #1252937- Allow chrome setcap to itself.Resolves: #1251996- Allow httpd daemon to manage httpd_var_lib_t lnk_files.Resolves: #1253706- Allow chronyd exec systemctlResolves: #1243764- Add inteface chronyd_signal Allow timemaster_t send generic signals to chronyd_t.Resolves: #1243764- Added interface fs_dontaudit_write_configfs_dirs- Add label for kernel module dep files in /usr/lib/modulesResolves:#916635- Allow kernel_t domtrans to abrt_dump_oops_t- Added to files_dontaudit_write_all_mountpoints intefface new dontaudit rule, that domain included this interface dontaudit capability dac_override.- Allow systemd-networkd to send logs to systemd-journald.Resolves: #1236616
* Wed Aug 12 2015 Lukas Vrabec 3.13.1-42- Fix label on /var/tmp/kiprop_0Resolves:#1220763- Allow lldpad_t to getattr tmpfs_t.Resolves: #1246220- Label /dev/shm/lldpad.
* as lldapd_tmpfs_tResolves: #1246220- Allow audisp client to read system state.
* Tue Aug 11 2015 Lukas Vrabec 3.13.1-41- Allow pcp_domain to manage pcp_var_lib_t lnk_files.Resolves: #1252341- Label /var/run/xtables.
* as iptables_var_run_tResolves: #1243403
* Mon Aug 10 2015 Lukas Vrabec 3.13.1-40- Add interface to read/write watchdog device- Add labels for /dev/memory_bandwith and /dev/vhci. Thanks ssekiddeResolves:#1210237- Allow apcupsd_t to read /sys/devices Resolves:#1189185- Allow logrotate to reload services.Resolves: #1242453- Allow openhpid use libwatchdog plugin. (Allow openhpid_t rw watchdog device)Resolves: #1244260- Allow openhpid liboa_soap plugin to read generic certs.Resolves: #1244248- Allow openhpid liboa_soap plugin to read resolv.conf file.Resolves: #1244248- Label /usr/libexec/chrony-helper as chronyd_exec_t- Allow chronyd_t to read dhcpc state.- Allow chronyd to execute mkdir command.
* Fri Aug 07 2015 Miroslav Grepl 3.13.1-39- Allow mdadm to access /dev/random and add support to create own files/dirs as mdadm_tmpfs_t.Resolves:#1073314- Allow udev, lvm and fsadm to access systemd-cat in /var/tmp/dracut if \'dracut -fv\' is executed in MLS.- Allow admin SELinu users to communicate with kernel_t. It is needed to access /run/systemd/journal/stdout if \'dracut -vf\' is executed. We allow it for other SELinux users.- Allow sysadm to execute systemd-sysctl in the sysadm_t domain. It is needed for ifup command in MLS mode.- Add fstools_filetrans_named_content_fsadm() and call it for named_filetrans_domain domains. We need to be sure that /run/blkid is created with correct labeling.Resolves:#1183503- Add support for /etc/sanlock which is writable by sanlock daemon.Resolves:#1231377- Allow useradd add homedir located in /var/lib/kdcproxy in ipa-server RPM scriplet.Resolves:#1243775 - Allow snapperd to pass data (one way only) via pipe negotiated over dbusResolves:#1250550- Allow lsmd also setuid capability. Some commands need to executed under root privs. Other commands are executed under unprivileged user.
* Wed Aug 05 2015 Lukas Vrabec 3.13.1-38- Allow openhpid to use libsnmp_bc plugin (allow read snmp lib files). Resolves: #1243902- Allow lsm_plugin_t to read sysfs, read hwdata, rw to scsi_generic_device Resolves: #1238079- Allow lsm_plugin_t to rw raw_fixed_disk. Resolves:#1238079- Allow rhsmcertd to send signull to unconfined_service.
* Mon Aug 03 2015 Lukas Vrabec 3.13.1-37- Allow httpd_suexec_t to read and write Apache stream sockets Resolves: #1243569- Allow qpid to create lnk_files in qpid_var_lib_tResolves: #1247279
* Thu Jul 30 2015 Lukas Vrabec 3.13.1-36- Allow drbd to get attributes from filesystems.- Allow redis to read kernel parameters.Resolves: #1209518- Allow virt_qemu_ga_t domtrans to passwd_t- Allow audisp_remote_t to start power unit files domain to allow halt system.Resolves: #1186780- Allow audisp_remote_t to read/write user domain pty.Resolves: #1186780- Label /usr/sbin/chpasswd as passwd_exec_t.- Allow sysadm to administrate ldap environment and allow to bind ldap port to allow to setup an LDAP server (389ds).Resolves:#1221121
* Mon Jul 27 2015 Lukas Vrabec 3.13.1-35- gnome_dontaudit_search_config() needs to be a part of optinal_policy in pegasus.te- Allow pcp_pmcd daemon to read postfix config files.- Allow pcp_pmcd daemon to search postfix spool dirs.Resolves: #1213740- Added Booleans: pcp_read_generic_logs.Resolves: #1213740- Allow drbd to read configuration options used when loading modules.Resolves: #1134883- Allow glusterd to manage nfsd and rpcd services.- Allow glusterd to communicate with cluster domains over stream socket.- glusterd call pcs utility which calls find for cib.
* files and runs pstree under glusterd. Dontaudit access to security files and update gluster boolean to reflect these changes.
* Mon Jul 20 2015 Lukas Vrabec 3.13.1-34- Allow glusterd to manage nfsd and rpcd services.- Allow networkmanager to communicate via dbus with systemd_hostanmed. Resolves: #1234954- Allow stream connect logrotate to prosody.- Add prosody_stream_connect() interface.- httpd should be able to send signal/signull to httpd_suexec_t, instead of httpd_suexec_exec_t.- Allow prosody to create own tmp files/dirs.Resolves:#1212498
* Wed Jul 15 2015 Lukas Vrabec 3.13.1-33- Allow networkmanager read rfcomm port.Resolves:#1212498- Remove non exists label.- Fix
*_admin intefaces where body is not consistent with header.- Label /usr/afs/ as afs_files_t, Allow afs_bosserver_t create afs_config_t and afs_dbdir_t dirs under afs_files_t, Allow afs_bosserver_t read kerberos config- Remove non exits nfsd_ro_t label.- Make all interfaces related to openshift_cache_t as deprecated.- Add rpm_var_run_t label to rpm_admin header- Add jabberd_lock_t label to jabberd_admin header.- Add samba_unconfined_script_exec_t to samba_admin header.- inn daemon should create innd_log_t objects in var_log_t instead of innd_var_run_t- Fix ctdb policy- Add samba_signull_winbind()- Add samba_signull_unconfined_net()- Allow ctdbd_t send signull to samba_unconfined_net_t.- Allow openshift_initrc_t to communicate with firewalld over dbus Resolves:#1221326
* Tue Jul 14 2015 Lukas Vrabec 3.13.1-32- Allow gluster to connect to all ports. It is required by random services executed by gluster.- Add interfaces winbind_signull(), samba_unconfined_net_signull().- Dontaudit smbd_t block_suspend capability. This is kernel bug.- Allow ctdbd sending signull to process winbind, samba_unconfined_net, to checking if processes exists.- Add tmpreaper booleans to use nfs_t and samba_share_t.- Fix path from /usr/sbin/redis-server to /usr/bin/redis-server- Allow connect ypserv to portmap_port_t- Fix paths in inn policy, Allow innd read innd_log_t dirs, Allow innd execute innd_etc_t files- Add support for openstack-nova- | |
