5ae8fb6
08b8904
%define distro redhat
7716868
%define polyinstatiate n
1580c87
%define monolithic n
bd3f0ea
%if %{?BUILD_TARGETED:0}%{!?BUILD_TARGETED:1}
bd3f0ea
%define BUILD_TARGETED 1
bd3f0ea
%endif
675bbab
%if %{?BUILD_MINIMUM:0}%{!?BUILD_MINIMUM:1}
675bbab
%define BUILD_MINIMUM 1
675bbab
%endif
a4ec9b7
%if %{?BUILD_OLPC:0}%{!?BUILD_OLPC:1}
a4ec9b7
%define BUILD_OLPC 0
a4ec9b7
%endif
bd3f0ea
%if %{?BUILD_MLS:0}%{!?BUILD_MLS:1}
3debd0a
%define BUILD_MLS 1
bd3f0ea
%endif
755e2d6
%define POLICYVER 24
755e2d6
%define libsepolver 2.0.41-1
9c90ba7
%define POLICYCOREUTILSVER 2.0.78-1
755e2d6
%define CHECKPOLICYVER 2.0.21-1
1580c87
Summary: SELinux policy configuration
1580c87
Name: selinux-policy
05f913e
Version: 3.9.10
1adb28c
Release: 13%{?dist}
d83af23
License: GPLv2+
1580c87
Group: System Environment/Base
1580c87
Source: serefpolicy-%{version}.tgz
6e50b74
patch: policy-F15.patch
504da9f
Source1: modules-targeted.conf
504da9f
Source2: booleans-targeted.conf
585f827
Source3: Makefile.devel
504da9f
Source4: setrans-targeted.conf
504da9f
Source5: modules-mls.conf
487de6f
Source6: booleans-mls.conf
504da9f
Source8: setrans-mls.conf
a4ec9b7
Source9: modules-olpc.conf
487de6f
Source10: booleans-olpc.conf
a4ec9b7
Source11: setrans-olpc.conf
a4ec9b7
Source12: securetty_types-olpc
de82d85
Source13: policygentool
ee095f5
Source14: securetty_types-targeted
ee095f5
Source15: securetty_types-mls
675bbab
Source16: modules-minimum.conf
675bbab
Source17: booleans-minimum.conf
675bbab
Source18: setrans-minimum.conf
675bbab
Source19: securetty_types-minimum
80beeee
Source20: customizable_types
faf9cbb
Source21: config.tgz
fc05ac0
Source22: users-mls
fc05ac0
Source23: users-targeted
fc05ac0
Source24: users-olpc
fc05ac0
Source25: users-minimum
3e930b8
0c34c69
Url: http://oss.tresys.com/repos/refpolicy/
ca8bc2d
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
1580c87
BuildArch: noarch
7b146db
BuildRequires: python gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-python >= %{POLICYCOREUTILSVER} bzip2 
23e7082
Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER} libsemanage >= 2.0.14-3
dc00fc3
Requires(post): /usr/bin/bunzip2 /bin/mktemp /bin/awk
081b6ac
Requires: checkpolicy >= %{CHECKPOLICYVER} m4 
487de6f
Obsoletes: selinux-policy-devel <= %{version}-%{release}
487de6f
Provides: selinux-policy-devel = %{version}-%{release}
1580c87
1335ee8
%description 
1335ee8
SELinux Base package
1335ee8
1335ee8
%files 
487de6f
%defattr(-,root,root,-)
a85aeff
%{_mandir}/man*/*
a85aeff
# policycoreutils owns these manpage directories, we only own the files within them
a85aeff
%{_mandir}/ru/*/*
585f827
%dir %{_usr}/share/selinux
081b6ac
%dir %{_usr}/share/selinux/devel
081b6ac
%dir %{_usr}/share/selinux/devel/include
62cfafd
%dir %{_usr}/share/selinux/packages
585f827
%dir %{_sysconfdir}/selinux
585f827
%ghost %config(noreplace) %{_sysconfdir}/selinux/config
585f827
%ghost %{_sysconfdir}/sysconfig/selinux
d19b685
%{_usr}/share/selinux/devel/include/*
d19b685
%{_usr}/share/selinux/devel/Makefile
d19b685
%{_usr}/share/selinux/devel/policygentool
d19b685
%{_usr}/share/selinux/devel/example.*
3640444
%{_usr}/share/selinux/devel/policy.*
4125702
4125702
%package doc
4125702
Summary: SELinux policy documentation
4125702
Group: System Environment/Base
4125702
Requires(pre): selinux-policy = %{version}-%{release}
f5a104d
Requires: /usr/bin/xdg-open
4125702
4125702
%description doc
4125702
SELinux policy documentation package
4125702
4125702
%files doc
352dafd
%defattr(-,root,root,-)
4125702
%doc %{_usr}/share/doc/%{name}-%{version}
d2c2609
%attr(755,root,root) %{_usr}/share/selinux/devel/policyhelp
1335ee8
081b6ac
%check
bc4089c
if /usr/sbin/selinuxenabled; then
bc4089c
/usr/bin/sepolgen-ifgen -i %{buildroot}%{_usr}/share/selinux/devel/include -o /dev/null 
bc4089c
fi
673eaae
487de6f
%define makeCmds() \
01ce3df
make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 bare \
01ce3df
make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024  conf \
487de6f
cp -f selinux_config/modules-%1.conf  ./policy/modules.conf \
487de6f
cp -f selinux_config/booleans-%1.conf ./policy/booleans.conf \
487de6f
cp -f selinux_config/users-%1 ./policy/users \
9987374
de82d85
%define installCmds() \
01ce3df
make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 base.pp \
01ce3df
make validate UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 modules \
01ce3df
make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 install \
01ce3df
make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 install-appconfig \
ca8bc2d
#%{__cp} *.pp %{buildroot}/%{_usr}/share/selinux/%1/ \
ca8bc2d
%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/policy \
ca8bc2d
%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/modules/active \
ca8bc2d
%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/contexts/files \
ca8bc2d
touch %{buildroot}/%{_sysconfdir}/selinux/%1/modules/semanage.read.LOCK \
ca8bc2d
touch %{buildroot}/%{_sysconfdir}/selinux/%1/modules/semanage.trans.LOCK \
ca8bc2d
rm -rf %{buildroot}%{_sysconfdir}/selinux/%1/booleans \
ca8bc2d
touch %{buildroot}%{_sysconfdir}/selinux/%1/seusers \
ca8bc2d
touch %{buildroot}%{_sysconfdir}/selinux/%1/policy/policy.%{POLICYVER} \
ca8bc2d
touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts \
ca8bc2d
touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \
487de6f
install -m0644 selinux_config/securetty_types-%1 %{buildroot}%{_sysconfdir}/selinux/%1/contexts/securetty_types \
487de6f
install -m0644 selinux_config/setrans-%1.conf %{buildroot}%{_sysconfdir}/selinux/%1/setrans.conf \
487de6f
install -m0644 selinux_config/customizable_types %{buildroot}%{_sysconfdir}/selinux/%1/contexts/customizable_types \
487de6f
bzip2 %{buildroot}/%{_usr}/share/selinux/%1/*.pp \
487de6f
awk '$1 !~ "/^#/" && $2 == "=" && $3 == "module" { printf "%%s.pp.bz2 ", $1 }' ./policy/modules.conf > %{buildroot}/%{_usr}/share/selinux/%1/modules.lst
3e930b8
%nil
1580c87
1580c87
%define fileList() \
1580c87
%defattr(-,root,root) \
d7e0f9f
%dir %{_usr}/share/selinux/%1 \
9987374
%{_usr}/share/selinux/%1/*.pp.bz2 \
487de6f
%{_usr}/share/selinux/%1/modules.lst \
1580c87
%dir %{_sysconfdir}/selinux/%1 \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/setrans.conf \
1580c87
%ghost %{_sysconfdir}/selinux/%1/seusers \
1580c87
%dir %{_sysconfdir}/selinux/%1/modules \
8bee3a4
%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/semanage.read.LOCK \
8bee3a4
%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/semanage.trans.LOCK \
21dea1c
%attr(700,root,root) %dir %{_sysconfdir}/selinux/%1/modules/active \
97081dc
#%verify(not md5 size mtime) %attr(600,root,root) %config(noreplace) %{_sysconfdir}/selinux/%1/modules/active/seusers \
1580c87
%dir %{_sysconfdir}/selinux/%1/policy/ \
7c94e8e
%ghost %{_sysconfdir}/selinux/%1/policy/policy.* \
1580c87
%dir %{_sysconfdir}/selinux/%1/contexts \
d2c2609
%config %{_sysconfdir}/selinux/%1/contexts/customizable_types \
ee095f5
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/securetty_types \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/dbus_contexts \
5ca2ff9
%config %{_sysconfdir}/selinux/%1/contexts/x_contexts \
7c94e8e
%config %{_sysconfdir}/selinux/%1/contexts/default_contexts \
487de6f
%config %{_sysconfdir}/selinux/%1/contexts/virtual_domain_context \
487de6f
%config %{_sysconfdir}/selinux/%1/contexts/virtual_image_context \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/default_type \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/failsafe_context \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/initrc_context \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/removable_context \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/userhelper_context \
1580c87
%dir %{_sysconfdir}/selinux/%1/contexts/files \
a08ba87
%ghost %{_sysconfdir}/selinux/%1/contexts/files/file_contexts \
a08ba87
%ghost %{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \
d19b685
%config %{_sysconfdir}/selinux/%1/contexts/files/media \
da08298
%dir %{_sysconfdir}/selinux/%1/contexts/users \
a4ec9b7
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/root \
a4ec9b7
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/guest_u \
a80e7ac
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/xguest_u \
a4ec9b7
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/user_u \
4d59c29
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/staff_u 
1580c87
1580c87
%define saveFileContext() \
bd7e86c
if [ -s /etc/selinux/config ]; then \
487de6f
     . %{_sysconfdir}/selinux/config; \
487de6f
     FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \
487de6f
     if [ "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT} ]; then \
487de6f
        [ -f ${FILE_CONTEXT}.pre ] || cp -f ${FILE_CONTEXT} ${FILE_CONTEXT}.pre; \
487de6f
     fi \
bd7e86c
fi
1580c87
a4ec9b7
%define loadpolicy() \
02d888c
( cd /usr/share/selinux/%1; \
0e31a0e
semodule -b base.pp.bz2 -i %2 -s %1; \
bb36d75
); \
1580c87
1580c87
%define relabel() \
1580c87
. %{_sysconfdir}/selinux/config; \
1580c87
FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \
2528fa0
selinuxenabled; \
e080bbd
if [ $? = 0  -a "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT}.pre ]; then \
487de6f
     fixfiles -C ${FILE_CONTEXT}.pre restore; \
487de6f
     restorecon -R /root /var/log /var/run /var/lib 2> /dev/null; \
487de6f
     rm -f ${FILE_CONTEXT}.pre; \
1580c87
fi; 
1580c87
1580c87
%description
1580c87
SELinux Reference Policy - modular.
55acbfd
Based off of reference policy: Checked out revision  2.20091117
1580c87
d83af23
%build
d83af23
3e930b8
%prep 
d83af23
%setup -n serefpolicy-%{version} -q
3c584c7
%patch -p1
add9573
add9573
%install
487de6f
mkdir selinux_config
487de6f
for i in %{SOURCE1} %{SOURCE2} %{SOURCE3} %{SOURCE4} %{SOURCE5} %{SOURCE6} %{SOURCE8} %{SOURCE9} %{SOURCE10} %{SOURCE11} %{SOURCE12} %{SOURCE13} %{SOURCE14} %{SOURCE15} %{SOURCE16} %{SOURCE17} %{SOURCE18} %{SOURCE19} %{SOURCE20} %{SOURCE21} %{SOURCE22} %{SOURCE23} %{SOURCE24} %{SOURCE25};do
487de6f
 cp $i selinux_config
487de6f
done
487de6f
tar zxvf selinux_config/config.tgz
e568731
# Build targeted policy
ca8bc2d
%{__rm} -fR %{buildroot}
28021c8
mkdir -p %{buildroot}%{_mandir}
7330e86
cp -R  man/* %{buildroot}%{_mandir}
ca8bc2d
mkdir -p %{buildroot}%{_sysconfdir}/selinux
ca8bc2d
mkdir -p %{buildroot}%{_sysconfdir}/sysconfig
ca8bc2d
touch %{buildroot}%{_sysconfdir}/selinux/config
ca8bc2d
touch %{buildroot}%{_sysconfdir}/sysconfig/selinux
1335ee8
b4cab5a
# Always create policy module package directories
2fbeb78
mkdir -p %{buildroot}%{_usr}/share/selinux/{targeted,mls,minimum,modules}/
b4cab5a
d19b685
# Install devel
d19b685
make clean
bd3f0ea
%if %{BUILD_TARGETED}
129ba16
# Build targeted policy
129ba16
# Commented out because only targeted ref policy currently builds
487de6f
%makeCmds targeted mcs n y allow
db0dafa
%installCmds targeted mcs n y allow
bd3f0ea
%endif
3e930b8
675bbab
%if %{BUILD_MINIMUM}
675bbab
# Build minimum policy
675bbab
# Commented out because only minimum ref policy currently builds
487de6f
%makeCmds minimum mcs n y allow
675bbab
%installCmds minimum mcs n y allow
675bbab
%endif
675bbab
bd3f0ea
%if %{BUILD_MLS}
129ba16
# Build mls policy
487de6f
%makeCmds mls mls n y deny
9185bf2
%installCmds mls mls n y deny
a4ec9b7
%endif
a4ec9b7
a4ec9b7
%if %{BUILD_OLPC}
675bbab
# Build olpc policy
675bbab
# Commented out because only olpc ref policy currently builds
487de6f
%makeCmds olpc mcs n y allow
9185bf2
%installCmds olpc mcs n y allow
bd3f0ea
%endif
129ba16
db0dafa
make UNK_PERMS=allow NAME=targeted TYPE=mcs DISTRO=%{distro} UBAC=n DIRECT_INITRC=n MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} PKGNAME=%{name}-%{version} POLY=y MLS_CATS=1024 MCS_CATS=1024 install-headers install-docs
ce7f30a
mkdir %{buildroot}%{_usr}/share/selinux/devel/
62cfafd
mkdir %{buildroot}%{_usr}/share/selinux/packages/
ce7f30a
mv %{buildroot}%{_usr}/share/selinux/targeted/include %{buildroot}%{_usr}/share/selinux/devel/include
487de6f
install -m 755 selinux_config/policygentool %{buildroot}%{_usr}/share/selinux/devel/
487de6f
install -m 644 selinux_config/Makefile.devel %{buildroot}%{_usr}/share/selinux/devel/Makefile
ce7f30a
install -m 644 doc/example.* %{buildroot}%{_usr}/share/selinux/devel/
3640444
install -m 644 doc/policy.* %{buildroot}%{_usr}/share/selinux/devel/
f1a8278
echo  "xdg-open file:///usr/share/doc/selinux-policy-%{version}/html/index.html"> %{buildroot}%{_usr}/share/selinux/devel/policyhelp
ce7f30a
chmod +x %{buildroot}%{_usr}/share/selinux/devel/policyhelp
487de6f
rm -rf selinux_config
1580c87
%clean
ca8bc2d
%{__rm} -fR %{buildroot}
1580c87
9c64bb6
%post
af60908
if [ ! -s /etc/selinux/config ]; then
487de6f
#
487de6f
#     New install so we will default to targeted policy
487de6f
#
487de6f
echo "
af60908
# This file controls the state of SELinux on the system.
af60908
# SELINUX= can take one of these three values:
487de6f
#     enforcing - SELinux security policy is enforced.
487de6f
#     permissive - SELinux prints warnings instead of enforcing.
487de6f
#     disabled - No SELinux policy is loaded.
af60908
SELINUX=enforcing
af60908
# SELINUXTYPE= can take one of these two values:
487de6f
#     targeted - Targeted processes are protected,
487de6f
#     mls - Multi Level Security protection.
af60908
SELINUXTYPE=targeted 
af60908
af60908
" > /etc/selinux/config
af60908
487de6f
     ln -sf ../selinux/config /etc/sysconfig/selinux 
487de6f
     restorecon /etc/selinux/config 2> /dev/null || :
af60908
else
487de6f
     . /etc/selinux/config
487de6f
     # if first time update booleans.local needs to be copied to sandbox
487de6f
     [ -f /etc/selinux/${SELINUXTYPE}/booleans.local ] && mv /etc/selinux/${SELINUXTYPE}/booleans.local /etc/selinux/targeted/modules/active/
487de6f
     [ -f /etc/selinux/${SELINUXTYPE}/seusers ] && cp -f /etc/selinux/${SELINUXTYPE}/seusers /etc/selinux/${SELINUXTYPE}/modules/active/seusers
af60908
fi
081b6ac
exit 0
9c64bb6
5ff36d6
%postun
bbaa1f2
if [ $1 = 0 ]; then
487de6f
     setenforce 0 2> /dev/null
487de6f
     if [ ! -s /etc/selinux/config ]; then
487de6f
          echo "SELINUX=disabled" > /etc/selinux/config
487de6f
     else
487de6f
          sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config
487de6f
     fi
5ff36d6
fi
a4ec9b7
exit 0
5ff36d6
bd3f0ea
%if %{BUILD_TARGETED}
bd3f0ea
%package targeted
bd3f0ea
Summary: SELinux targeted base policy
487de6f
Provides: selinux-policy-base = %{version}-%{release}
bd3f0ea
Group: System Environment/Base
d83af23
Obsoletes: selinux-policy-targeted-sources < 2
23e7082
Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}
d83af23
Requires(pre): coreutils
d83af23
Requires(pre): selinux-policy = %{version}-%{release}
3b54668
Requires: selinux-policy = %{version}-%{release}
b4cab5a
Conflicts:  audispd-plugins <= 1.7.7-1
487de6f
Obsoletes: mod_fcgid-selinux <= %{version}-%{release}
bc4089c
Obsoletes: cachefilesd-selinux <= 0.10-1
6b7b0c1
Conflicts:  seedit
fc9bf2f
Conflicts:  389-ds-base < 1.2.7, 389-admin < 1.1.12
bd3f0ea
bd3f0ea
%description targeted
bd3f0ea
SELinux Reference policy targeted base module.
bd3f0ea
bd3f0ea
%pre targeted
bd3f0ea
%saveFileContext targeted
bd3f0ea
9c64bb6
%post targeted
487de6f
packages=`cat /usr/share/selinux/targeted/modules.lst`
e080bbd
if [ $1 -eq 1 ]; then
e080bbd
   %loadpolicy targeted $packages
755e2d6
   restorecon -R /root /var/log /var/run /var/lib 2> /dev/null
e080bbd
else
922cd61
   semodule -n -s targeted -r pyzor -r razor -r moilscanner mailscanner gamin audio_entropy iscsid polkit_auth polkit rtkit_daemon ModemManager telepathysofiasip ethereal 2>/dev/null
e080bbd
   %loadpolicy targeted $packages
e080bbd
   %relabel targeted
e080bbd
fi
e080bbd
exit 0
d83af23
5baf53a
%triggerpostun targeted -- selinux-policy-targeted < 3.2.5-9.fc9
4b1d56d
. /etc/selinux/config
4b1d56d
[ "${SELINUXTYPE}" != "targeted" ] && exit 0
af67779
setsebool -P use_nfs_home_dirs=1
df62201
semanage user -l | grep -s unconfined_u > /dev/null
a6e1280
if [ $? -eq 0 ]; then
df62201
   semanage user -m -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u
99d3676
else
df62201
   semanage user -a -P user -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u
99d3676
fi
99d3676
seuser=`semanage login -l | grep __default__ | awk '{ print $2 }'`
4b1d56d
[ "$seuser" != "unconfined_u" ]  && semanage login -m -s "unconfined_u"  -r s0-s0:c0.c1023 __default__
99d3676
seuser=`semanage login -l | grep root | awk '{ print $2 }'`
e080bbd
[ "$seuser" = "system_u" ] && semanage login -m -s "unconfined_u"  -r s0-s0:c0.c1023 root
1ffa684
restorecon -R /root /etc/selinux/targeted 2> /dev/null
5baf53a
semodule -r qmail 2> /dev/null
a4ec9b7
exit 0
af60908
bd3f0ea
%files targeted
487de6f
%defattr(-,root,root,-)
4d59c29
%config(noreplace) %{_sysconfdir}/selinux/targeted/contexts/users/unconfined_u
4d59c29
%fileList targeted
a4ec9b7
%endif
a4ec9b7
675bbab
%if %{BUILD_MINIMUM}
675bbab
%package minimum
675bbab
Summary: SELinux minimum base policy
487de6f
Provides: selinux-policy-base = %{version}-%{release}
675bbab
Group: System Environment/Base
23e7082
Requires(post): policycoreutils-python >= %{POLICYCOREUTILSVER}
675bbab
Requires(pre): coreutils
675bbab
Requires(pre): selinux-policy = %{version}-%{release}
3b54668
Requires: selinux-policy = %{version}-%{release}
6b7b0c1
Conflicts:  seedit
675bbab
675bbab
%description minimum
675bbab
SELinux Reference policy minimum base module.
675bbab
675bbab
%pre minimum
675bbab
%saveFileContext minimum
675bbab
675bbab
%post minimum
487de6f
packages="execmem.pp.bz2 unconfined.pp.bz2 unconfineduser.pp.bz2"
32594a1
%loadpolicy minimum $packages
0e31a0e
if [ $1 -eq 1 ]; then
675bbab
semanage -S minimum -i - << __eof
675bbab
login -m  -s unconfined_u -r s0-s0:c0.c1023 __default__
675bbab
login -m  -s unconfined_u -r s0-s0:c0.c1023 root
675bbab
__eof
755e2d6
restorecon -R /root /var/log /var/run /var/lib 2> /dev/null
675bbab
else
675bbab
%relabel minimum
675bbab
fi
675bbab
exit 0
675bbab
675bbab
%files minimum
487de6f
%defattr(-,root,root,-)
675bbab
%config(noreplace) %{_sysconfdir}/selinux/minimum/contexts/users/unconfined_u
675bbab
%fileList minimum
675bbab
%endif
675bbab
a4ec9b7
%if %{BUILD_OLPC}
a4ec9b7
%package olpc 
a4ec9b7
Summary: SELinux olpc base policy
a4ec9b7
Group: System Environment/Base
487de6f
Provides: selinux-policy-base = %{version}-%{release}
23e7082
Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}
d83af23
Requires(pre): coreutils
d83af23
Requires(pre): selinux-policy = %{version}-%{release}
3b54668
Requires: selinux-policy = %{version}-%{release}
6b7b0c1
Conflicts:  seedit
a4ec9b7
a4ec9b7
%description olpc 
a4ec9b7
SELinux Reference policy olpc base module.
a4ec9b7
a4ec9b7
%pre olpc 
a4ec9b7
%saveFileContext olpc
a4ec9b7
a4ec9b7
%post olpc 
487de6f
packages=`cat /usr/share/selinux/olpc/modules.lst`
c32d79e
%loadpolicy olpc $packages
8fd9df6
a6e1280
if [ $1 -ne 1 ]; then
a4ec9b7
%relabel olpc
24ccb8b
fi
a4ec9b7
exit 0
a4ec9b7
a4ec9b7
%files olpc
487de6f
%defattr(-,root,root,-)
a4ec9b7
%fileList olpc
bd3f0ea
bd3f0ea
%endif
bd3f0ea
bd3f0ea
%if %{BUILD_MLS}
504da9f
%package mls 
504da9f
Summary: SELinux mls base policy
1580c87
Group: System Environment/Base
487de6f
Provides: selinux-policy-base = %{version}-%{release}
d83af23
Obsoletes: selinux-policy-mls-sources < 2
c77aca5
Requires: policycoreutils-newrole >= %{POLICYCOREUTILSVER} setransd
23e7082
Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}
d83af23
Requires(pre): coreutils
d83af23
Requires(pre): selinux-policy = %{version}-%{release}
3b54668
Requires: selinux-policy = %{version}-%{release}
6b7b0c1
Conflicts:  seedit
1580c87
504da9f
%description mls 
504da9f
SELinux Reference policy mls base module.
1580c87
504da9f
%pre mls 
504da9f
%saveFileContext mls
1580c87
504da9f
%post mls 
922cd61
semodule -n -s mls -r pyzor -r razor -r mailscanner polkit ModemManager telepathysofiasip ethereal 2>/dev/null
487de6f
packages=`cat /usr/share/selinux/mls/modules.lst`
c32d79e
%loadpolicy mls $packages
8fd9df6
487de6f
if [ $1 -eq 1 ]; then
487de6f
   restorecon -R /root /var/log /var/run /var/lib 2> /dev/null
487de6f
else
504da9f
%relabel mls
24ccb8b
fi
a4ec9b7
exit 0
1580c87
504da9f
%files mls
487de6f
%defattr(-,root,root,-)
57ae10c
%config(noreplace) %{_sysconfdir}/selinux/mls/contexts/users/unconfined_u
504da9f
%fileList mls
3e930b8
bd3f0ea
%endif
bd3f0ea
56187c2
%changelog
1adb28c
* Tue Dec 14 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.9-13
1adb28c
- Allow sandbox to run on nfs partitions, fixes for systemd_tmpfs
1adb28c
- remove per sandbox domains devpts types
1adb28c
- Allow dkim-milter sending signal to itself
1adb28c
25660bf
* Mon Dec 13 2010 Dan Walsh <dwalsh@redhat.com> 3.9.9-12
25660bf
- Allow domains that transition to ping or traceroute, kill them
25660bf
- Allow user_t to conditionally transition to ping_t and traceroute_t
25660bf
- Add fixes to systemd- tools, including new labeling for systemd-fsck, systemd-cryptsetup
25660bf
3c0b9ea
* Mon Dec 13 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.9-11
3c0b9ea
- Turn on systemd policy
3c0b9ea
- mozilla_plugin needs to read certs in the homedir.
3c0b9ea
- Dontaudit leaked file descriptors from devicekit
3c0b9ea
- Fix ircssi to use auth_use_nsswitch
3c0b9ea
- Change to use interface without param in corenet to disable unlabelednet packets
3c0b9ea
- Allow init to relabel sockets and fifo files in /dev
3c0b9ea
- certmonger needs dac* capabilities to manage cert files not owned by root
3c0b9ea
- dovecot needs fsetid to change group membership on mail
3c0b9ea
- plymouthd removes /var/log/boot.log
3c0b9ea
- systemd is creating symlinks in /dev
3c0b9ea
- Change label on /etc/httpd/alias to be all cert_t
3c0b9ea
b04a855
* Fri Dec 10 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.9-10
b04a855
- Fixes for clamscan and boinc policy
b04a855
- Add boinc_project_t setpgid
b04a855
- Allow alsa to create tmp files in /tmp
b04a855
c2ad368
* Tue Dec 7 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.9-9
c2ad368
- Push fixes to allow disabling of unlabeled_t packet access
c2ad368
- Enable unlabelednet policy
c2ad368
7b62a83
* Tue Dec 7 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.9-8
7b62a83
- Fixes for lvm to work with systemd
7b62a83
1511604
* Mon Dec 6 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.9-7
1511604
- Fix the label for wicd log
1511604
- plymouthd creates force-display-on-active-vt file
1511604
- Allow avahi to request the kernel to load a module
1511604
- Dontaudit hal leaks
1511604
- Fix gnome_manage_data interface
1511604
- Add new interface corenet_packet to define a type as being an packet_type.
1511604
- Removed general access to packet_type from icecast and squid.
1511604
- Allow mpd to read alsa config
1511604
- Fix the label for wicd log
1511604
- Add systemd policy
1511604
a4f1f54
* Fri Dec 3 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.9-6
a4f1f54
- Fix gnome_manage_data interface
a4f1f54
- Dontaudit sys_ptrace capability for iscsid
a4f1f54
- Fixes for nagios plugin policy
a4f1f54
0946045
* Thu Dec 1 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.9-5
0946045
- Fix cron to run ranged when started by init
0946045
- Fix devicekit to use log files
0946045
- Dontaudit use of devicekit_var_run_t for fstools
0946045
- Allow init to setattr on logfile directories
0946045
- Allow hald to manage files in /var/run/pm-utils/ dir which is now labeled as devicekit_var_run_t
0946045
5bcd7aa
* Tue Nov 30 2010 Dan Walsh <dwalsh@redhat.com> 3.9.9-4
5bcd7aa
- Fix up handling of dnsmasq_t creating /var/run/libvirt/network
5bcd7aa
- Turn on sshd_forward_ports boolean by default
5bcd7aa
- Allow sysadmin to dbus chat with rpm
5bcd7aa
- Add interface for rw_tpm_dev
5bcd7aa
- Allow cron to execute bin
5bcd7aa
- fsadm needs to write sysfs
5bcd7aa
- Dontaudit consoletype reading /var/run/pm-utils
5bcd7aa
- Lots of new privs fro mozilla_plugin_t running java app, make mozilla_plugin
5bcd7aa
- certmonger needs to manage dirsrv data
5bcd7aa
- /var/run/pm-utils should be labeled as devicekit_var_run_t
5bcd7aa
954ef8a
* Tue Nov 30 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.10-3
954ef8a
- fixes to allow /var/run and /var/lock as tmpfs
954ef8a
- Allow chrome sandbox to connect to web ports
954ef8a
- Allow dovecot to listem on lmtp and sieve ports
954ef8a
- Allov ddclient to search sysctl_net_t
954ef8a
- Transition back to original domain if you execute the shell
954ef8a
b63541e
* Thu Nov 25 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.10-2
b63541e
- Remove duplicate declaration
b63541e
05f913e
* Thu Nov 25 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.10-1
05f913e
- Update to upstream
05f913e
- Cleanup for sandbox
05f913e
- Add attribute to be able to select sandbox types
05f913e
3daa6c7
* Mon Nov 22 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.9-4
3daa6c7
- Allow ddclient to fix file mode bits of ddclient conf file
3daa6c7
- init leaks file descriptors to daemons
3daa6c7
- Add labels for /etc/lirc/ and
3daa6c7
- Allow amavis_t to exec shell
3daa6c7
- Add label for gssd_tmp_t for /var/tmp/nfs_0
3daa6c7
d6719f6
* Thu Nov 18 2010 Dan Walsh <dwalsh@redhat.com> 3.9.9-3
d6719f6
- Put back in lircd_etc_t so policy will install
d6719f6
4eb45eb
* Thu Nov 18 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.9-2
4eb45eb
- Turn on allow_postfix_local_write_mail_spool
4eb45eb
- Allow initrc_t to transition to shutdown_t
4eb45eb
- Allow logwatch and cron to mls_read_to_clearance for MLS boxes
4eb45eb
- Allow wm to send signull to all applications and receive them from users
4eb45eb
- lircd patch from field
4eb45eb
- Login programs have to read /etc/samba
4eb45eb
- New programs under /lib/systemd
4eb45eb
- Abrt needs to read config files
4eb45eb
582d2c5
* Tue Nov 16 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.9-1
582d2c5
- Update to upstream
582d2c5
- Dontaudit leaked sockets from userdomains to user domains
582d2c5
- Fixes for mcelog to handle scripts
582d2c5
- Apply patch from Ruben Kerkhof
582d2c5
- Allow syslog to search spool dirs
582d2c5
cbb8d59
* Mon Nov 15 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.8-7
cbb8d59
- Allow nagios plugins to read usr files
cbb8d59
- Allow mysqld-safe to send system log messages
cbb8d59
- Fixes fpr ddclient policy
cbb8d59
- Fix sasl_admin interface
cbb8d59
- Allow apache to search zarafa config
cbb8d59
- Allow munin plugins to search /var/lib directory
cbb8d59
- Allow gpsd to read sysfs_t
cbb8d59
- Fix labels on /etc/mcelog/triggers to bin_t
cbb8d59
519b05a
* Fri Nov 12 2010 Dan Walsh <dwalsh@redhat.com> 3.9.8-6
519b05a
- Remove saslauthd_tmp_t and transition tmp files to krb5_host_rcache_t
763342a
- Allow saslauthd_t to create krb5_host_rcache_t files in /tmp
763342a
- Fix xserver interface
763342a
- Fix definition of /var/run/lxdm
519b05a
9238df0
* Fri Nov 12 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.8-5
9238df0
- Turn on mediawiki policy
50dacac
- kdump leaks kdump_etc_t to ifconfig, add dontaudit
50dacac
- uux needs to transition to uucpd_t
50dacac
- More init fixes relabels man,faillog
50dacac
- Remove maxima defs in libraries.fc
50dacac
- insmod needs to be able to create tmpfs_t files
50dacac
- ping needs setcap
50dacac
5d168a3
* Wed Nov 10 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.8-4
5d168a3
- Allow groupd transition to fenced domain when executes fence_node
5d168a3
- Fixes for rchs policy
5d168a3
- Allow mpd to be able to read samba/nfs files
7297a33
ded1efb
* Tue Nov 9 2010 Dan Walsh <dwalsh@redhat.com> 3.9.8-3
ded1efb
- Fix up corecommands.fc to match upstream
ded1efb
- Make sure /lib/systemd/* is labeled init_exec_t
ded1efb
- mount wants to setattr on all mountpoints
ded1efb
- dovecot auth wants to read dovecot etc files
ded1efb
- nscd daemon looks at the exe file of the comunicating daemon
ded1efb
- openvpn wants to read utmp file
ded1efb
- postfix apps now set sys_nice and lower limits
ded1efb
- remote_login (telnetd/login) wants to use telnetd_devpts_t and user_devpts_t to work correctly
ded1efb
- Also resolves nsswitch
ded1efb
- Fix labels on /etc/hosts.*
ded1efb
- Cleanup to make upsteam patch work
ded1efb
- allow abrt to read etc_runtime_t
ded1efb
fc9bf2f
* Fri Nov 5 2010 Dan Walsh <dwalsh@redhat.com> 3.9.8-2
fc9bf2f
- Add conflicts for dirsrv package
fc9bf2f
06262c1
* Fri Nov 5 2010 Dan Walsh <dwalsh@redhat.com> 3.9.8-1
06262c1
- Update to upstream
06262c1
- Add vlock policy
06262c1
c52856e
* Wed Nov 3 2010 Dan Walsh <dwalsh@redhat.com> 3.9.7-10
c52856e
- Fix sandbox to work on nfs homedirs
c52856e
- Allow cdrecord to setrlimit
c52856e
- Allow mozilla_plugin to read xauth
c52856e
- Change label on systemd-logger to syslogd_exec_t
c52856e
- Install dirsrv policy from dirsrv package
c52856e
9896599
* Tue Nov 2 2010 Dan Walsh <dwalsh@redhat.com> 3.9.7-9
c52856e
- Add virt_home_t, allow init to setattr on xserver_tmp_t and relabel it
c52856e
- Udev needs to stream connect to init and kernel
c52856e
- Add xdm_exec_bootloader boolean, which allows xdm to execute /sbin/grub and read files in /boot directory
9896599
9754f47
* Mon Nov 1 2010 Dan Walsh <dwalsh@redhat.com> 3.9.7-8
9754f47
- Allow NetworkManager to read openvpn_etc_t
9754f47
- Dontaudit hplip to write of /usr dirs
9754f47
- Allow system_mail_t to create /root/dead.letter as mail_home_t
9754f47
- Add vdagent policy for spice agent daemon
9754f47
7a20869
* Thu Oct 28 2010 Dan Walsh <dwalsh@redhat.com> 3.9.7-7
7a20869
- Dontaudit sandbox sending sigkill to all user domains
7a20869
- Add policy for rssh_chroot_helper
7a20869
- Add missing flask definitions
7a20869
- Allow udev to relabelto removable_t
7a20869
- Fix label on /var/log/wicd.log
7a20869
- Transition to initrc_t from init when executing bin_t
7a20869
- Add audit_access permissions to file
7a20869
- Make removable_t a device_node 
7a20869
- Fix label on /lib/systemd/*
7a20869
2bb6181
* Fri Oct 22 2010 Dan Walsh <dwalsh@redhat.com> 3.9.7-6
2bb6181
- Fixes for systemd to manage /var/run
2bb6181
- Dontaudit leaks by firstboot
2bb6181
bac2708
* Tue Oct 19 2010 Dan Walsh <dwalsh@redhat.com> 3.9.7-5
bac2708
- Allow chome to create netlink_route_socket
bac2708
- Add additional MATHLAB file context
bac2708
- Define nsplugin as an application_domain
bac2708
- Dontaudit sending signals from sandboxed domains to other domains
bac2708
- systemd requires init to build /tmp /var/auth and /var/lock dirs
bac2708
- mount wants to read devicekit_power /proc/ entries
bac2708
- mpd wants to connect to soundd port
bac2708
- Openoffice causes a setattr on a lib_t file for normal users, add dontaudit
bac2708
- Treat lib_t and textrel_shlib_t directories the same
bac2708
- Allow mount read access on virtual images
bac2708
4da7659
* Fri Oct 15 2010 Dan Walsh <dwalsh@redhat.com> 3.9.7-4
4da7659
- Allow sandbox_x_domains to work with nfs/cifs/fusefs home dirs.
bac2708
- Allow devicekit_power to domtrans to mount
bac2708
- Allow dhcp to bind to udp ports > 1024 to do named stuff
bac2708
- Allow ssh_t to exec ssh_exec_t
bac2708
- Remove telepathy_butterfly_rw_tmp_files(), dev_read_printk() interfaces which are nolonger used
bac2708
- Fix clamav_append_log() intefaces
bac2708
- Fix 'psad_rw_fifo_file' interface
4da7659
c849c84
* Fri Oct 15 2010 Dan Walsh <dwalsh@redhat.com> 3.9.7-3
c849c84
- Allow cobblerd to list cobler appache content
c849c84
d33e644
* Fri Oct 15 2010 Dan Walsh <dwalsh@redhat.com> 3.9.7-2
d33e644
- Fixup for the latest version of upowed
d33e644
- Dontaudit sandbox sending SIGNULL to desktop apps
d33e644
618ed7a
* Wed Oct 13 2010 Dan Walsh <dwalsh@redhat.com> 3.9.7-1
5a152bc
- Update to upstream
5a152bc
f0a56ee
* Tue Oct 12 2010 Dan Walsh <dwalsh@redhat.com> 3.9.6-3
f0a56ee
-Mount command from a confined user generates setattr on /etc/mtab file, need to dontaudit this access
f0a56ee
- dovecot-auth_t needs ipc_lock
f0a56ee
- gpm needs to use the user terminal
f0a56ee
- Allow system_mail_t to append ~/dead.letter
f0a56ee
- Allow NetworkManager to edit /etc/NetworkManager/NetworkManager.conf
f0a56ee
- Add pid file to vnstatd
f0a56ee
- Allow mount to communicate with gfs_controld
f0a56ee
- Dontaudit hal leaks in setfiles
dd20c25
dd20c25
* Fri Oct 8 2010 Dan Walsh <dwalsh@redhat.com> 3.9.6-2
dd20c25
- Lots of fixes for systemd
dd20c25
- systemd now executes readahead and tmpwatch type scripts
dd20c25
- Needs to manage random seed
dd20c25
6f93468
* Thu Oct 7 2010 Dan Walsh <dwalsh@redhat.com> 3.9.6-1
6f256d2
- Allow smbd to use sys_admin
6f256d2
- Remove duplicate file context for tcfmgr
6f93468
- Update to upstream
6f256d2
0daa8b7
* Wed Oct 6 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-11
0daa8b7
- Fix fusefs handling
0daa8b7
- Do not allow sandbox to manage nsplugin_rw_t
0daa8b7
- Allow mozilla_plugin_t to connecto its parent
0daa8b7
- Allow init_t to connect to plymouthd running as kernel_t
0daa8b7
- Add mediawiki policy
0daa8b7
- dontaudit sandbox sending signals to itself.  This can happen when they are running at different mcs.
0daa8b7
- Disable transition from dbus_session_domain to telepathy for F14
0daa8b7
- Allow boinc_project to use shm
0daa8b7
- Allow certmonger to search through directories that contain certs
0daa8b7
- Allow fail2ban the DAC Override so it can read log files owned by non root users
0daa8b7
b1cbbd0
* Mon Oct 4 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-10
b1cbbd0
- Start adding support for use_fusefs_home_dirs
b1cbbd0
- Add /var/lib/syslog directory file context
b1cbbd0
- Add /etc/localtime as locale file context
b1cbbd0
fbd9ca0
* Thu Sep 30 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-9
fbd9ca0
- Turn off default transition to mozilla_plugin and telepathy domains from unconfined user 
fbd9ca0
- Turn off iptables from unconfined user 
fbd9ca0
- Allow sudo to send signals to any domains the user could have transitioned to.
fbd9ca0
- Passwd in single user mode needs to talk to console_device_t
fbd9ca0
- Mozilla_plugin_t needs to connect to web ports, needs to write to video device, and read alsa_home_t alsa setsup pulseaudio
fbd9ca0
- locate tried to read a symbolic link, will dontaudit
fbd9ca0
- New labels for telepathy-sunshine content in homedir
fbd9ca0
- Google is storing other binaries under /opt/google/talkplugin
fbd9ca0
- bluetooth/kernel is creating unlabeled_t socket that I will allow it to use until kernel fixes bug
fbd9ca0
- Add boolean for unconfined_t transition to mozilla_plugin_t and telepathy domains, turned off in F14 on in F15
fbd9ca0
- modemmanger and bluetooth send dbus messages to devicekit_power
fbd9ca0
- Samba needs to getquota on filesystems labeld samba_share_t
fbd9ca0
5ae8fb6
* Wed Sep 29 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-8
5ae8fb6
- Dontaudit attempts by xdm_t to write to bin_t for kdm
5ae8fb6
- Allow initrc_t to manage system_conf_t
5ae8fb6
5ae8fb6
* Mon Sep 27 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-7
7c487e9
- Fixes to allow mozilla_plugin_t to create nsplugin_home_t directory.
7c487e9
- Allow mozilla_plugin_t to create tcp/udp/netlink_route sockets
7c487e9
- Allow confined users to read xdm_etc_t files
7c487e9
- Allow xdm_t to transition to xauth_t for lxdm program
7c487e9
7c487e9
* Sun Sep 26 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-6
7c487e9
- Rearrange firewallgui policy to be more easily updated to upstream, dontaudit search of /home
7c487e9
- Allow clamd to send signals to itself
7c487e9
- Allow mozilla_plugin_t to read user home content.  And unlink pulseaudio shm.
7c487e9
- Allow haze to connect to yahoo chat and messenger port tcp:5050.
7c487e9
Bz #637339
7c487e9
- Allow guest to run ps command on its processes by allowing it to read /proc
7c487e9
- Allow firewallgui to sys_rawio which seems to be required to setup masqerading
7c487e9
- Allow all domains to search through default_t directories, in order to find differnet labels.  For example people serring up /foo/bar to be share via samba.
7c487e9
- Add label for /var/log/slim.log
7c487e9
e257991
* Fri Sep 24 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-5
e257991
- Pull in cleanups from dgrift
e257991
- Allow mozilla_plugin_t to execute mozilla_home_t
e257991
- Allow rpc.quota to do quotamod
e257991
42c814d
* Thu Sep 23 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-4
42c814d
- Cleanup policy via dgrift
42c814d
- Allow dovecot_deliver to append to inherited log files
42c814d
- Lots of fixes for consolehelper
42c814d
1d153ea
* Wed Sep 21 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-3
1d153ea
- Fix up Xguest policy
1d153ea
ea3b7b5
* Thu Sep 16 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-2
ea3b7b5
- Add vnstat policy
ea3b7b5
- allow libvirt to send audit messages
ea3b7b5
- Allow chrome-sandbox to search nfs_t
ea3b7b5
a24e6a6
* Thu Sep 16 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-1
a24e6a6
- Update to upstream
a24e6a6
a24e6a6
* Wed Sep 15 2010 Dan Walsh <dwalsh@redhat.com> 3.9.4-3
a24e6a6
- Add the ability to send audit messages to confined admin policies
a24e6a6
- Remove permissive domain from cmirrord and dontaudit sys_tty_config
a24e6a6
- Split out unconfined_domain() calls from other unconfined_ calls so we can d
a24e6a6
- virt needs to be able to read processes to clearance for MLS
a24e6a6
ba8c31f
* Tue Sep 14 2010 Dan Walsh <dwalsh@redhat.com> 3.9.4-2
ba8c31f
- Allow all domains that can use cgroups to search tmpfs_t directory
ba8c31f
- Allow init to send audit messages
ba8c31f
a0e8efd
* Thu Sep 8 2010 Dan Walsh <dwalsh@redhat.com> 3.9.4-1
a0e8efd
- Update to upstream
a0e8efd
a0e8efd
* Thu Sep 8 2010 Dan Walsh <dwalsh@redhat.com> 3.9.3-4
a0e8efd
- Allow mdadm_t to create files and sock files in /dev/md/
a0e8efd
30a7d17
* Thu Sep 8 2010 Dan Walsh <dwalsh@redhat.com> 3.9.3-3
30a7d17
- Add policy for ajaxterm
30a7d17
6e2d7f3
* Wed Sep 8 2010 Dan Walsh <dwalsh@redhat.com> 3.9.3-2
6e2d7f3
- Handle /var/db/sudo
6e2d7f3
- Allow pulseaudio to read alsa config
6e2d7f3
- Allow init to send initrc_t dbus messages
6e2d7f3
6e2d7f3
* Tue Sep 7 2010 Dan Walsh <dwalsh@redhat.com> 3.9.3-1
64d84cf
Allow iptables to read shorewall tmp files
64d84cf
Change chfn and passwd to use auth_use_pam so they can send dbus messages to fpr
64d84cf
intd
64d84cf
label vlc as an execmem_exec_t 
64d84cf
Lots of fixes for mozilla_plugin to run google vidio chat
64d84cf
Allow telepath_msn to execute ldconfig and its own tmp files
64d84cf
Fix labels on hugepages
64d84cf
Allow mdadm to read files on /dev
64d84cf
Remove permissive domains and change back to unconfined
64d84cf
Allow freshclam to execute shell and bin_t
64d84cf
Allow devicekit_power to transition to dhcpc
64d84cf
Add boolean to allow icecast to connect to any port
64d84cf
482c9f3
* Thu Aug 31 2010 Dan Walsh <dwalsh@redhat.com> 3.9.2-1
482c9f3
- Merge upstream fix of mmap_zero
482c9f3
- Allow mount to write files in debugfs_t
482c9f3
- Allow corosync to communicate with clvmd via tmpfs
482c9f3
- Allow certmaster to read usr_t files
482c9f3
- Allow dbus system services to search cgroup_t
482c9f3
- Define rlogind_t as a login pgm
482c9f3
482c9f3
482c9f3
* Wed Aug 31 2010 Dan Walsh <dwalsh@redhat.com> 3.9.1-3
482c9f3
- Allow mdadm_t to read/write hugetlbfs
482c9f3
482c9f3
* Tue Aug 30 2010 Dan Walsh <dwalsh@redhat.com> 3.9.1-2
482c9f3
- Dominic Grift Cleanup
482c9f3
- Miroslav Grepl policy for jabberd
482c9f3
- Various fixes for mount/livecd and prelink
482c9f3
a7a2367
* Mon Aug 30 2010 Dan Walsh <dwalsh@redhat.com> 3.9.1-1
a7a2367
- Merge with upstream
a7a2367
6578cf7
* Thu Aug 26 2010 Dan Walsh <dwalsh@redhat.com> 3.9.0-2
6578cf7
- More access needed for devicekit
6578cf7
- Add dbadm policy
6578cf7
ba77266
* Thu Aug 26 2010 Dan Walsh <dwalsh@redhat.com> 3.9.0-1
ba77266
- Merge with upstream
ba77266
370d04e
* Tue Aug 24 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-21
370d04e
- Allow seunshare to fowner
370d04e
cc138e8
* Tue Aug 24 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-20
cc138e8
- Allow cron to look at user_cron_spool links
cc138e8
- Lots of fixes for mozilla_plugin_t
cc138e8
- Add sysv file system
cc138e8
- Turn unconfined domains to permissive to find additional avcs
cc138e8
6326566
* Mon Aug 23 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-19
6326566
- Update policy for mozilla_plugin_t
6326566
eee39f9
* Mon Aug 23 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-18
eee39f9
- Allow clamscan to read proc_t
eee39f9
- Allow mount_t to write to debufs_t dir
eee39f9
- Dontaudit mount_t trying to write to security_t dir
eee39f9
19988ca
* Thu Aug 18 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-17
19988ca
- Allow clamscan_t execmem if clamd_use_jit set
19988ca
- Add policy for firefox plugin-container
19988ca
19988ca
* Wed Aug 17 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-16
19988ca
- Fix /root/.forward definition
19988ca
3798ee9
* Tue Aug 17 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-15
3798ee9
- label dead.letter as mail_home_t
3798ee9
3798ee9
* Fri Aug 13 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-14
3798ee9
- Allow login programs to search /cgroups
3798ee9
3798ee9
* Thu Aug 12 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-13
3798ee9
- Fix cert handling
3798ee9
922cd61
* Tue Aug 10 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-12
922cd61
- Fix devicekit_power bug
922cd61
- Allow policykit_auth_t more access.
922cd61
922cd61
* Thu Aug 5 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-11
922cd61
- Fix nis calls to allow bind to ports 512-1024
922cd61
- Fix smartmon
922cd61
922cd61
* Wed Aug 4 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-10
922cd61
- Allow pcscd to read sysfs
922cd61
- systemd fixes 
922cd61
- Fix wine_mmap_zero_ignore boolean
922cd61
922cd61
* Tue Aug 3 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-9
922cd61
- Apply Miroslav munin patch
922cd61
- Turn back on allow_execmem and allow_execmod booleans
922cd61
d4bb132
* Tue Jul 27 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-8
d4bb132
- Merge in fixes from dgrift repository
d4bb132
7f5d8f3
* Tue Jul 27 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-7
7f5d8f3
- Update boinc policy
7f5d8f3
- Fix sysstat policy to allow sys_admin
7f5d8f3
- Change failsafe_context to unconfined_r:unconfined_t:s0
7f5d8f3
a1ef703
* Mon Jul 26 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-6
a1ef703
- New paths for upstart
a1ef703
8d55a41
* Mon Jul 26 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-5
8d55a41
- New permissions for syslog
8d55a41
- New labels for /lib/upstart
8d55a41
8d55a41
* Fri Jul 23 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-4
8d55a41
- Add mojomojo policy
8d55a41
f3fc105
* Thu Jul 22 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-3
f3fc105
- Allow systemd to setsockcon on sockets to immitate other services
f3fc105
9f811ef
* Wed Jul 21 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-2
9f811ef
- Remove debugfs label
9f811ef
d66bec6
* Tue Jul 20 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-1
d66bec6
- Update to latest policy
d66bec6
1df2fc2
* Mon Jul 14 2010 Dan Walsh <dwalsh@redhat.com> 3.8.7-3
1df2fc2
- Fix eclipse labeling from IBMSupportAssasstant packageing
1df2fc2
3f1005a
* Mon Jul 14 2010 Dan Walsh <dwalsh@redhat.com> 3.8.7-2
3f1005a
- Make boot with systemd in enforcing mode
3f1005a
0f2ae00
* Mon Jul 14 2010 Dan Walsh <dwalsh@redhat.com> 3.8.7-1
0f2ae00
- Update to upstream
0f2ae00
9c1bcc2
* Mon Jul 12 2010 Dan Walsh <dwalsh@redhat.com> 3.8.6-3
9c1bcc2
- Add boolean to turn off port forwarding in sshd.
9c1bcc2
be922a1
* Fri Jul 9 2010 Miroslav Grepl <mgrepl@redhat.com> 3.8.6-2
be922a1
- Add support for ebtables
be922a1
- Fixes for rhcs and corosync policy
be922a1
6c42218
* Tue Jun 22 2010 Dan Walsh <dwalsh@redhat.com> 3.8.6-1
6c42218
-Update to upstream
6c42218
fa98e0e
* Mon Jun 21 2010 Dan Walsh <dwalsh@redhat.com> 3.8.5-1
fa98e0e
-Update to upstream
fa98e0e
5f371ac
* Thu Jun 17 2010 Dan Walsh <dwalsh@redhat.com> 3.8.4-1
5f371ac
-Update to upstream
5f371ac
5f371ac
* Wed Jun 16 2010 Dan Walsh <dwalsh@redhat.com> 3.8.3-4
7c727a8
- Add Zarafa policy
7c727a8
f2403c5
* Wed Jun 9 2010 Dan Walsh <dwalsh@redhat.com> 3.8.3-3
f2403c5
- Cleanup of aiccu policy
f2403c5
- initial mock policy
f2403c5
f651bb6
* Wed Jun 9 2010 Dan Walsh <dwalsh@redhat.com> 3.8.3-2
f651bb6
- Lots of random fixes
f651bb6
b39ccca
* Tue Jun 8 2010 Dan Walsh <dwalsh@redhat.com> 3.8.3-1
b39ccca
- Update to upstream
b39ccca
632048c
* Fri Jun 4 2010 Dan Walsh <dwalsh@redhat.com> 3.8.2-1
632048c
- Update to upstream
632048c
- Allow prelink script to signal itself
632048c
- Cobbler fixes
632048c
bca242c
* Wed Jun 2 2010 Dan Walsh <dwalsh@redhat.com> 3.8.1-5
bca242c
- Add xdm_var_run_t to xserver_stream_connect_xdm
bca242c
- Add cmorrord and mpd policy from Miroslav Grepl
bca242c
bca242c
* Tue Jun 1 2010 Dan Walsh <dwalsh@redhat.com> 3.8.1-4
e512844
- Fix sshd creation of krb cc files for users to be user_tmp_t
e512844
4abfc01
* Thu May 27 2010 Dan Walsh <dwalsh@redhat.com> 3.8.1-3
4abfc01
- Fixes for accountsdialog
4abfc01
- Fixes for boinc
4abfc01
65c6e4c
* Thu May 27 2010 Dan Walsh <dwalsh@redhat.com> 3.8.1-2
65c6e4c
- Fix label on /var/lib/dokwiki
65c6e4c
- Change permissive domains to enforcing
65c6e4c
- Fix libvirt policy to allow it to run on mls
65c6e4c
bc4089c
* Tue May 25 2010 Dan Walsh <dwalsh@redhat.com> 3.8.1-1
bc4089c
- Update to upstream
bc4089c
bc4089c
* Tue May 25 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-22
bc4089c
- Allow procmail to execute scripts in the users home dir that are labeled home_bin_t
bc4089c
- Fix /var/run/abrtd.lock label
bc4089c
bc4089c
* Mon May 24 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-21
bc4089c
- Allow login programs to read krb5_home_t
bc4089c
Resolves: 594833
bc4089c
- Add obsoletes for cachefilesfd-selinux package
bc4089c
Resolves: #575084
bc4089c
bc4089c
* Thu May 20 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-20
bc4089c
- Allow mount to r/w abrt fifo file
bc4089c
- Allow svirt_t to getattr on hugetlbfs
bc4089c
- Allow abrt to create a directory under /var/spool
bc4089c
bc4089c
* Wed May 19 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-19
bc4089c
- Add labels for /sys
bc4089c
- Allow sshd to getattr on shutdown
bc4089c
- Fixes for munin
bc4089c
- Allow sssd to use the kernel key ring
bc4089c
- Allow tor to send syslog messages
bc4089c
- Allow iptabels to read usr files
bc4089c
- allow policykit to read all domains state
bc4089c
bc4089c
* Thu May 13 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-17
bc4089c
- Fix path for /var/spool/abrt
bc4089c
- Allow nfs_t as an entrypoint for http_sys_script_t
bc4089c
- Add policy for piranha
bc4089c
- Lots of fixes for sosreport
bc4089c
bc4089c
* Wed May 12 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-16
bc4089c
- Allow xm_t to read network state and get and set capabilities
bc4089c
- Allow policykit to getattr all processes
bc4089c
- Allow denyhosts to connect to tcp port 9911
bc4089c
- Allow pyranha to use raw ip sockets and ptrace itself
bc4089c
- Allow unconfined_execmem_t and gconfsd mechanism to dbus
bc4089c
- Allow staff to kill ping process
bc4089c
- Add additional MLS rules
bc4089c
bc4089c
* Mon May 10 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-15
bc4089c
- Allow gdm to edit ~/.gconf dir
bc4089c
Resolves: #590677
bc4089c
- Allow dovecot to create directories in /var/lib/dovecot
bc4089c
Partially resolves 590224
bc4089c
- Allow avahi to dbus chat with NetworkManager
bc4089c
- Fix cobbler labels
bc4089c
- Dontaudit iceauth_t leaks
bc4089c
- fix /var/lib/lxdm file context
bc4089c
- Allow aiccu to use tun tap devices
bc4089c
- Dontaudit shutdown using xserver.log
bc4089c
bc4089c
* Fri May 6 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-14
bc4089c
- Fixes for sandbox_x_net_t  to match access for sandbox_web_t ++
bc4089c
- Add xdm_etc_t for /etc/gdm directory, allow accountsd to manage this directory
bc4089c
- Add dontaudit interface for bluetooth dbus
bc4089c
- Add chronyd_read_keys, append_keys for initrc_t
bc4089c
- Add log support for ksmtuned
bc4089c
Resolves: #586663
bc4089c
bc4089c
* Thu May 6 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-13
bc4089c
- Allow boinc to send mail
bc4089c
bc4089c
* Wed May 5 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-12
bc4089c
- Allow initrc_t to remove dhcpc_state_t
bc4089c
- Fix label on sa-update.cron
bc4089c
- Allow dhcpc to restart chrony initrc
bc4089c
- Don't allow sandbox to send signals to its parent processes
bc4089c
- Fix transition from unconfined_t -> unconfined_mount_t -> rpcd_t
bc4089c
Resolves: #589136
bc4089c
bc4089c
* Mon May 3 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-11
bc4089c
- Fix location of oddjob_mkhomedir
bc4089c
Resolves: #587385
bc4089c
- fix labeling on /root/.shosts and ~/.shosts
bc4089c
- Allow ipsec_mgmt_t to manage net_conf_t
bc4089c
Resolves: #586760
bc4089c
bc4089c
* Fri Apr 30 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-10
bc4089c
- Dontaudit sandbox trying to connect to netlink sockets
bc4089c
Resolves: #587609
bc4089c
- Add policy for piranha
bc4089c
bc4089c
* Thu Apr 29 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-9
bc4089c
- Fixups for xguest policy
bc4089c
- Fixes for running sandbox firefox
bc4089c
bc4089c
* Wed Apr 28 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-8
bc4089c
- Allow ksmtuned to use terminals
bc4089c
Resolves: #586663
bc4089c
- Allow lircd to write to generic usb devices
bc4089c
bc4089c
* Tue Apr 27 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-7
bc4089c
- Allow sandbox_xserver to connectto unconfined stream
bc4089c
Resolves: #585171
bc4089c
bc4089c
* Mon Apr 26 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-6
bc4089c
- Allow initrc_t to read slapd_db_t
bc4089c
Resolves: #585476
bc4089c
- Allow ipsec_mgmt to use unallocated devpts and to create /etc/resolv.conf
bc4089c
Resolves: #585963
bc4089c
bc4089c
* Thu Apr 22 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-5
bc4089c
- Allow rlogind_t to search /root for .rhosts
bc4089c
Resolves: #582760
bc4089c
- Fix path for cached_var_t
bc4089c
- Fix prelink paths /var/lib/prelink	
bc4089c
- Allow confined users to direct_dri
bc4089c
- Allow mls lvm/cryptosetup to work
bc4089c
bc4089c
* Wed Apr 21 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-4
bc4089c
- Allow virtd_t to manage firewall/iptables config
bc4089c
Resolves: #573585
bc4089c
bc4089c
* Tue Apr 20 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-3
bc4089c
- Fix label on /root/.rhosts
bc4089c
Resolves: #582760
bc4089c
- Add labels for Picasa
bc4089c
- Allow openvpn to read home certs
bc4089c
- Allow plymouthd_t to use tty_device_t
bc4089c
- Run ncftool as iptables_t
bc4089c
- Allow mount to unmount unlabeled_t
bc4089c
- Dontaudit hal leaks
bc4089c
bc4089c
* Wed Apr 14 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-2
bc4089c
- Allow livecd to transition to mount
bc4089c
bc4089c
* Tue Apr 13 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-1
bc4089c
- Update to upstream
bc4089c
- Allow abrt to delete sosreport
bc4089c
Resolves: #579998
bc4089c
- Allow snmp to setuid and gid
bc4089c
Resolves: #582155
bc4089c
- Allow smartd to use generic scsi devices
bc4089c
Resolves: #582145
bc4089c
bc4089c
* Tue Apr 13 2010 Dan Walsh <dwalsh@redhat.com> 3.7.18-3
bc4089c
- Allow ipsec_t to create /etc/resolv.conf with the correct label
bc4089c
- Fix reserved port destination
bc4089c
- Allow autofs to transition to showmount
bc4089c
- Stop crashing tuned
bc4089c
bc4089c
* Mon Apr 12 2010 Dan Walsh <dwalsh@redhat.com> 3.7.18-2
bc4089c
- Add telepathysofiasip policy
bc4089c
bc4089c
* Mon Apr 5 2010 Dan Walsh <dwalsh@redhat.com> 3.7.18-1
bc4089c
- Update to upstream
bc4089c
- Fix label for  /opt/google/chrome/chrome-sandbox
bc4089c
- Allow modemmanager to dbus with policykit
bc4089c
bc4089c
* Mon Apr 5 2010 Dan Walsh <dwalsh@redhat.com> 3.7.17-6
bc4089c
- Fix allow_httpd_mod_auth_pam to use 	auth_use_pam(httpd_t)
bc4089c
- Allow accountsd to read shadow file
bc4089c
- Allow apache to send audit messages when using pam
bc4089c
- Allow asterisk to bind and connect to sip tcp ports
bc4089c
- Fixes for dovecot 2.0
bc4089c
- Allow initrc_t to setattr on milter directories
bc4089c
- Add procmail_home_t for .procmailrc file
bc4089c
bc4089c
bc4089c
* Thu Apr 1 2010 Dan Walsh <dwalsh@redhat.com> 3.7.17-5
bc4089c
- Fixes for labels during install from livecd
bc4089c
bc4089c
* Thu Apr 1 2010 Dan Walsh <dwalsh@redhat.com> 3.7.17-4
bc4089c
- Fix /cgroup file context 
bc4089c
- Fix broken afs use of unlabled_t
bc4089c
- Allow getty to use the console for s390
bc4089c
bc4089c
* Wed Mar 31 2010 Dan Walsh <dwalsh@redhat.com> 3.7.17-3
bc4089c
- Fix cgroup handling adding policy for /cgroup
bc4089c
- Allow confined users to write to generic usb devices, if user_rw_noexattrfile boolean set
bc4089c
bc4089c
* Tue Mar 30 2010 Dan Walsh <dwalsh@redhat.com> 3.7.17-2
bc4089c
- Merge patches from dgrift
bc4089c
bc4089c
* Mon Mar 29 2010 Dan Walsh <dwalsh@redhat.com> 3.7.17-1
bc4089c
- Update upstream
bc4089c
- Allow abrt to write to the /proc under any process
bc4089c
bc4089c
* Fri Mar 26 2010 Dan Walsh <dwalsh@redhat.com> 3.7.16-2
bc4089c
  - Fix ~/.fontconfig label
bc4089c
- Add /root/.cert label
bc4089c
- Allow reading of the fixed_file_disk_t:lnk_file if you can read file
bc4089c
- Allow qemu_exec_t as an entrypoint to svirt_t
bc4089c
bc4089c
* Tue Mar 23 2010 Dan Walsh <dwalsh@redhat.com> 3.7.16-1
bc4089c
- Update to upstream
bc4089c
- Allow tmpreaper to delete sandbox sock files
bc4089c
- Allow chrome-sandbox_t to use /dev/zero, and dontaudit getattr file systems
bc4089c
- Fixes for gitosis
bc4089c
- No transition on livecd to passwd or chfn
bc4089c
- Fixes for denyhosts
bc4089c
bc4089c
* Tue Mar 23 2010 Dan Walsh <dwalsh@redhat.com> 3.7.15-4
bc4089c
- Add label for /var/lib/upower
bc4089c
- Allow logrotate to run sssd
bc4089c
- dontaudit readahead on tmpfs blk files
bc4089c
- Allow tmpreaper to setattr on sandbox files
bc4089c
- Allow confined users to execute dos files
bc4089c
- Allow sysadm_t to kill processes running within its clearance
bc4089c
- Add accountsd policy
bc4089c
- Fixes for corosync policy
bc4089c
- Fixes from crontab policy
bc4089c
- Allow svirt to manage svirt_image_t chr files
bc4089c
- Fixes for qdisk policy
bc4089c
- Fixes for sssd policy
bc4089c
- Fixes for newrole policy
bc4089c
bc4089c
* Thu Mar 18 2010 Dan Walsh <dwalsh@redhat.com> 3.7.15-3
bc4089c
- make libvirt work on an MLS platform
bc4089c
bc4089c
* Thu Mar 18 2010 Dan Walsh <dwalsh@redhat.com> 3.7.15-2
bc4089c
- Add qpidd policy
bc4089c
a72c31d
* Thu Mar 18 2010 Dan Walsh <dwalsh@redhat.com> 3.7.15-1
a72c31d
- Update to upstream
a72c31d
a72c31d
* Tue Mar 16 2010 Dan Walsh <dwalsh@redhat.com> 3.7.14-5
a72c31d
- Allow boinc to read kernel sysctl
a72c31d
- Fix snmp port definitions
a72c31d
- Allow apache to read anon_inodefs
a72c31d
a72c31d
* Sun Mar 14 2010 Dan Walsh <dwalsh@redhat.com> 3.7.14-4
a72c31d
- Allow shutdown dac_override
a72c31d
a72c31d
* Sat Mar 13 2010 Dan Walsh <dwalsh@redhat.com> 3.7.14-3
a72c31d
- Add device_t as a file system
a72c31d
- Fix sysfs association
a72c31d
a72c31d
* Fri Mar 12 2010 Dan Walsh <dwalsh@redhat.com> 3.7.14-2
a72c31d
- Dontaudit ipsec_mgmt sys_ptrace
a72c31d
- Allow at to mail its spool files
a72c31d
- Allow nsplugin to search in .pulse directory
a72c31d
a72c31d
* Fri Mar 12 2010 Dan Walsh <dwalsh@redhat.com> 3.7.14-1
a72c31d
- Update to upstream
a72c31d
a72c31d
* Fri Mar 12 2010 Dan Walsh <dwalsh@redhat.com> 3.7.13-4
a72c31d
- Allow users to dbus chat with xdm
a72c31d
- Allow users to r/w wireless_device_t
a72c31d
- Dontaudit reading of process states by ipsec_mgmt
a72c31d
a72c31d
* Thu Mar 11 2010 Dan Walsh <dwalsh@redhat.com> 3.7.13-3
a72c31d
- Fix openoffice from unconfined_t
a72c31d
a72c31d
* Wed Mar 10 2010 Dan Walsh <dwalsh@redhat.com> 3.7.13-2
a72c31d
- Add shutdown policy so consolekit can shutdown system
a72c31d
a72c31d
* Tue Mar 9 2010 Dan Walsh <dwalsh@redhat.com> 3.7.13-1
a72c31d
- Update to upstream
a72c31d
a72c31d
* Thu Mar 4 2010 Dan Walsh <dwalsh@redhat.com> 3.7.12-1
a72c31d
- Update to upstream
a72c31d
a72c31d
* Thu Mar 4 2010 Dan Walsh <dwalsh@redhat.com> 3.7.11-1
a72c31d
- Update to upstream - These are merges of my patches
a72c31d
- Remove 389 labeling conflicts
a72c31d
- Add MLS fixes found in RHEL6 testing
a72c31d
- Allow pulseaudio to run as a service
a72c31d
- Add label for mssql and allow apache to connect to this database port if boolean set
a72c31d
- Dontaudit searches of debugfs mount point
a72c31d
- Allow policykit_auth to send signals to itself
a72c31d
- Allow modcluster to call getpwnam
a72c31d
- Allow swat to signal winbind
a72c31d
- Allow usbmux to run as a system role
a72c31d
- Allow svirt to create and use devpts
a72c31d
a72c31d
* Mon Mar 1 2010 Dan Walsh <dwalsh@redhat.com> 3.7.10-5
a72c31d
- Add MLS fixes found in RHEL6 testing
a72c31d
- Allow domains to append to rpm_tmp_t
a72c31d
- Add cachefilesfd policy
a72c31d
- Dontaudit leaks when transitioning
a72c31d
a72c31d
* Wed Feb 23 2010 Dan Walsh <dwalsh@redhat.com> 3.7.10-4
a72c31d
- Change allow_execstack and allow_execmem booleans to on
a72c31d
- dontaudit acct using console
a72c31d
- Add label for fping
a72c31d
- Allow tmpreaper to delete sandbox_file_t
a72c31d
- Fix wine dontaudit mmap_zero
a72c31d
- Allow abrt to read var_t symlinks
a72c31d
a72c31d
* Tue Feb 22 2010 Dan Walsh <dwalsh@redhat.com> 3.7.10-3
a72c31d
- Additional policy for rgmanager
a72c31d
a72c31d
* Mon Feb 22 2010 Dan Walsh <dwalsh@redhat.com> 3.7.10-2
a72c31d
- Allow sshd to setattr on pseudo terms
a72c31d
a72c31d
* Mon Feb 22 2010 Dan Walsh <dwalsh@redhat.com> 3.7.10-1
a72c31d
- Update to upstream
a72c31d
a72c31d
* Thu Feb 18 2010 Dan Walsh <dwalsh@redhat.com> 3.7.9-4
a72c31d
- Allow policykit to send itself signals
a72c31d
a72c31d
* Wed Feb 17 2010 Dan Walsh <dwalsh@redhat.com> 3.7.9-3
a72c31d
- Fix duplicate cobbler definition
a72c31d
a72c31d
* Wed Feb 17 2010 Dan Walsh <dwalsh@redhat.com> 3.7.9-2
a72c31d
- Fix file context of /var/lib/avahi-autoipd
a72c31d
add9573
* Fri Feb 12 2010 Dan Walsh <dwalsh@redhat.com> 3.7.9-1
add9573
- Merge with upstream
add9573
3c551b8
* Thu Feb 11 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-11
3c551b8
- Allow sandbox to work with MLS 
3c551b8
43c7f5f
* Tue Feb 9 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-9
43c7f5f
- Make Chrome work with staff user
43c7f5f
487de6f
* Thu Feb 4 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-8
487de6f
- Add icecast policy
487de6f
- Cleanup  spec file
487de6f
30c2199
* Wed Feb 3 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-7
30c2199
- Add mcelog policy
30c2199
a62c640
* Mon Feb 1 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-6
a62c640
- Lots of fixes found in F12
a62c640
b2f6b06
* Thu Jan 27 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-5
b2f6b06
- Fix rpm_dontaudit_leaks
b2f6b06
4d67b40
* Wed Jan 27 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-4
4d67b40
- Add getsched to hald_t
4d67b40
- Add file context for Fedora/Redhat Directory Server
4d67b40
b0f3656
* Mon Jan 25 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-3
b0f3656
- Allow abrt_helper to getattr on all filesystems
487de6f
- Add label for /opt/real/RealPlayer/plugins/oggfformat\.so     
b0f3656
b65afa2
* Thu Jan 21 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-2
b65afa2
- Add gstreamer_home_t for ~/.gstreamer
b65afa2
faec5c2
* Mon Jan 18 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-1
faec5c2
- Update to upstream
faec5c2
3b54668
* Fri Jan 15 2010 Dan Walsh <dwalsh@redhat.com> 3.7.7-3
3b54668
- Fix git
3b54668
89ad5ea
* Thu Jan 7 2010 Dan Walsh <dwalsh@redhat.com> 3.7.7-2
89ad5ea
- Turn on puppet policy
89ad5ea
- Update to dgrift git policy
89ad5ea
fc05ac0
* Mon Jan 7 2010 Dan Walsh <dwalsh@redhat.com> 3.7.7-1
fc05ac0
- Move users file to selection by spec file.
fc05ac0
- Allow vncserver to run as unconfined_u:unconfined_r:unconfined_t
fc05ac0
352dafd
* Thu Jan 7 2010 Dan Walsh <dwalsh@redhat.com> 3.7.6-1
352dafd
- Update to upstream
352dafd
6049e24
* Wed Jan 6 2010 Dan Walsh <dwalsh@redhat.com> 3.7.5-8
6049e24
- Remove most of the permissive domains from F12.
6049e24
485ded5
* Tue Jan 5 2010 Dan Walsh <dwalsh@redhat.com> 3.7.5-7
485ded5
- Add cobbler policy from dgrift
485ded5
1e86f3f
* Mon Jan 4 2010 Dan Walsh <dwalsh@redhat.com> 3.7.5-6
1e86f3f
- add usbmon device
1e86f3f
- Add allow rulse for devicekit_disk
1e86f3f
4478a9a
* Wed Dec 30 2009 Dan Walsh <dwalsh@redhat.com> 3.7.5-5
4478a9a
- Lots of fixes found in F12, fixes from Tom London
4478a9a
e2f53df
* Wed Dec 23 2009 Dan Walsh <dwalsh@redhat.com> 3.7.5-4
e2f53df
- Cleanups from dgrift
e2f53df
550cc5f
* Tue Dec 22 2009 Dan Walsh <dwalsh@redhat.com> 3.7.5-3
550cc5f
- Add back xserver_manage_home_fonts
550cc5f
7d40583
* Mon Dec 21 2009 Dan Walsh <dwalsh@redhat.com> 3.7.5-2
7d40583
- Dontaudit sandbox trying to read nscd and sssd
7d40583
b467541
* Fri Dec 18 2009 Dan Walsh <dwalsh@redhat.com> 3.7.5-1
b467541
- Update to upstream
b467541
b467541
* Thu Dec 17 2009 Dan Walsh <dwalsh@redhat.com> 3.7.4-4
6ca563e
- Rename udisks-daemon back to devicekit_disk_t policy
6ca563e
e54cc7c
* Wed Dec 16 2009 Dan Walsh <dwalsh@redhat.com> 3.7.4-3
e54cc7c
- Fixes for abrt calls
e54cc7c
755e2d6
* Fri Dec 11 2009 Dan Walsh <dwalsh@redhat.com> 3.7.4-2
755e2d6
- Add tgtd policy
755e2d6
9eef358
* Fri Dec 4 2009 Dan Walsh <dwalsh@redhat.com> 3.7.4-1
9eef358
- Update to upstream release
9eef358
f2a1dcd
* Mon Nov 16 2009 Dan Walsh <dwalsh@redhat.com> 3.7.3-1
ce8c76d
- Add asterisk policy back in
f2a1dcd
- Update to upstream release 2.20091117
ce8c76d
55acbfd
* Mon Nov 16 2009 Dan Walsh <dwalsh@redhat.com> 3.7.1-1
55acbfd
- Update to upstream release 2.20091117
55acbfd
55acbfd
* Mon Nov 16 2009 Dan Walsh <dwalsh@redhat.com> 3.6.33-2
55acbfd
- Fixup nut policy
55acbfd
5e44eb8
* Thu Nov 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.33-1
5e44eb8
- Update to upstream
5e44eb8
32594a1
* Thu Oct 1 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-17
32594a1
- Allow vpnc request the kernel to load modules
32594a1
32594a1
* Wed Sep 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-16
32594a1
- Fix minimum policy installs
32594a1
- Allow udev and rpcbind to request the kernel to load modules
32594a1
32594a1
* Wed Sep 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-15
aaf52ff
- Add plymouth policy
32594a1
- Allow local_login to sys_admin
aaf52ff
aaf52ff
* Tue Sep 29 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-13
d976a83
- Allow cupsd_config to read user tmp
d976a83
- Allow snmpd_t to signal itself
d976a83
- Allow sysstat_t to makedir in sysstat_log_t
d976a83
8b10e3a
* Fri Sep 25 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-12
8b10e3a
- Update rhcs policy
8b10e3a
85582d6
* Thu Sep 24 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-11
85582d6
- Allow users to exec restorecond
85582d6
f5a104d
* Tue Sep 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-10
f5a104d
- Allow sendmail to request kernel modules load
f5a104d
4c2f298
* Mon Sep 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-9
405a74c
- Fix all kernel_request_load_module domains
405a74c
4c2f298
* Mon Sep 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-8
4c2f298
- Fix all kernel_request_load_module domains
405a74c
41f8e38
* Sun Sep 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-7
41f8e38
- Remove allow_exec* booleans for confined users.  Only available for unconfined_t
41f8e38
8323d54
* Fri Sep 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-6
8323d54
- More fixes for sandbox_web_t
8323d54
ab46291
* Fri Sep 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-5
ab46291
- Allow sshd to create .ssh directory and content
ab46291
d53d158
* Fri Sep 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-4
d53d158
- Fix request_module line to module_request
d53d158
1fb0a98
* Fri Sep 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-3
1fb0a98
- Fix sandbox policy to allow it to run under firefox.  
1fb0a98
- Dont audit leaks.
1fb0a98
1fb0a98
* Thu Sep 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-2
9de7033
- Fixes for sandbox
9de7033
69290fd
* Wed Sep 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-1
69290fd
- Update to upstream
69290fd
- Dontaudit nsplugin search /root
69290fd
- Dontaudit nsplugin sys_nice
69290fd
23e7082
* Mon Sep 15 2009 Dan Walsh <dwalsh@redhat.com> 3.6.31-5
23e7082
- Fix label on /usr/bin/notepad, /usr/sbin/vboxadd-service
23e7082
- Remove policycoreutils-python requirement except for minimum
23e7082
6b7b0c1
* Mon Sep 14 2009 Dan Walsh <dwalsh@redhat.com> 3.6.31-4
6b7b0c1
- Fix devicekit_disk_t to getattr on all domains sockets and fifo_files
6b7b0c1
- Conflicts seedit (You can not use selinux-policy-targeted and seedit at the same time.)
6b7b0c1
6b7b0c1
e20e351
* Thu Sep 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.31-3
e20e351
- Add wordpress/wp-content/uploads label
e20e351
- Fixes for sandbox when run from staff_t
e20e351
ddc8588
* Thu Sep 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.31-2
ddc8588
- Update to upstream
ddc8588
- Fixes for devicekit_disk
ddc8588
b8498d1
* Tue Sep 8 2009 Dan Walsh <dwalsh@redhat.com> 3.6.30-6
b8498d1
- More fixes
b8498d1
123ae99
* Tue Sep 8 2009 Dan Walsh <dwalsh@redhat.com> 3.6.30-5
123ae99
- Lots of fixes for initrc and other unconfined domains
123ae99
72bc25d
* Fri Sep 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.30-4
72bc25d
- Allow xserver to use  netlink_kobject_uevent_socket
72bc25d
72bc25d
* Thu Sep 3 2009 Dan Walsh <dwalsh@redhat.com> 3.6.30-3
72bc25d
- Fixes for sandbox 
72bc25d
1a2981b
* Mon Aug 31 2009 Dan Walsh <dwalsh@redhat.com> 3.6.30-2
1a2981b
- Dontaudit setroubleshootfix looking at /root directory
1a2981b
65c3f9a
* Mon Aug 31 2009 Dan Walsh <dwalsh@redhat.com> 3.6.30-1
65c3f9a
- Update to upsteam
65c3f9a
cb5670c
* Mon Aug 31 2009 Dan Walsh <dwalsh@redhat.com> 3.6.29-2
cb5670c
- Allow gssd to send signals to users
cb5670c
- Fix duplicate label for apache content
cb5670c
faf9cbb
* Fri Aug 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.29-1
faf9cbb
- Update to upstream
faf9cbb
38d427a
* Fri Aug 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-9
38d427a
- Remove polkit_auth on upgrades
38d427a
07c04f8
* Wed Aug 26 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-8
07c04f8
- Add back in unconfined.pp and unconfineduser.pp
42f9eff
- Add Sandbox unshare
07c04f8
89e3546
* Tue Aug 25 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-7
89e3546
- Fixes for cdrecord, mdadm, and others
89e3546
080ce6f
* Sat Aug 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-6
080ce6f
- Add capability setting to dhcpc and gpm
080ce6f
8e64d7d
* Sat Aug 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-5
8e64d7d
- Allow cronjobs to read exim_spool_t
8e64d7d
c5f5b5d
* Fri Aug 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-4
c5f5b5d
- Add ABRT policy
c5f5b5d
e3dd491
* Thu Aug 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-3
e3dd491
- Fix system-config-services policy
e3dd491
fc8ff2f
* Wed Aug 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-2
fc8ff2f
- Allow libvirt to change user componant of virt_domain
fc8ff2f
40243d9
* Tue Aug 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-1
40243d9
- Allow cupsd_config_t to be started by dbus
40243d9
- Add smoltclient policy
40243d9
9c27022
* Fri Aug 14 2009 Dan Walsh <dwalsh@redhat.com> 3.6.27-1
9c27022
- Add policycoreutils-python to pre install
9c27022
b2c5e72
* Thu Aug 13 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-11
b2c5e72
- Make all unconfined_domains permissive so we can see what AVC's happen 
b2c5e72
7fe210d
* Mon Aug 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-10
7fe210d
- Add pt_chown policy
7fe210d
867473a
* Mon Aug 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-9
867473a
- Add kdump policy for Miroslav Grepl
867473a
- Turn off execstack boolean
867473a
ac7bbfa
* Fri Aug 7 2009 Bill Nottingham <notting@redhat.com> 3.6.26-8
ac7bbfa
- Turn on execstack on a temporary basis (#512845)
ac7bbfa
4de3826
* Thu Aug 6 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-7
4de3826
- Allow nsplugin to connecto the session bus
4de3826
- Allow samba_net to write to coolkey data
4de3826
e213303
* Wed Aug 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-6
e213303
- Allow devicekit_disk to list inotify
e213303
4816e90
* Wed Aug 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-5
4816e90
- Allow svirt images to create sock_file in svirt_var_run_t
4816e90
4673269
* Tue Aug 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-4
4673269
- Allow exim to getattr on mountpoints
4673269
- Fixes for pulseaudio
4673269
947b439
* Fri Jul 31 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-3
947b439
- Allow svirt_t to stream_connect to virtd_t
947b439
af4fa82
* Fri Jul 31 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-2
af4fa82
- Allod hald_dccm_t to create sock_files in /tmp
af4fa82
af4fa82
* Thu Jul 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-1
abd1536
- More fixes from upstream
abd1536
c6e2224
* Tue Jul 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.25-1
c6e2224
- Fix polkit label
c6e2224
- Remove hidebrokensymptoms for nss_ldap fix
c6e2224
- Add modemmanager policy
c6e2224
- Lots of merges from upstream
c6e2224
- Begin removing textrel_shlib_t labels, from fixed libraries
c6e2224
3750561
* Tue Jul 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.24-1
3750561
- Update to upstream
3750561
9160520
* Mon Jul 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.23-2
9160520
- Allow certmaster to override dac permissions
9160520
df7055d
* Thu Jul 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.23-1
df7055d
- Update to upstream
df7055d
df7055d
* Tue Jul 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.22-3
8da0248
- Fix context for VirtualBox
8da0248
2360ff9
* Tue Jul 14 2009 Dan Walsh <dwalsh@redhat.com> 3.6.22-1
2360ff9
- Update to upstream
2360ff9
2360ff9
* Fri Jul 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.21-4
2360ff9
- Allow clamscan read amavis spool files
2360ff9
a88b486
* Wed Jul 8 2009 Dan Walsh <dwalsh@redhat.com> 3.6.21-3
a88b486
- Fixes for xguest
a88b486
a85aeff
* Tue Jul  7 2009 Tom "spot" Callaway <tcallawa@redhat.com> 3.6.21-2
a85aeff
- fix multiple directory ownership of mandirs
a85aeff
d9676a6
* Wed Jul 1 2009 Dan Walsh <dwalsh@redhat.com> 3.6.21-1
d9676a6
- Update to upstream
d9676a6
bcc53da
* Tue Jun 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.20-2
bcc53da
- Add rules for rtkit-daemon
bcc53da
7b16d56
* Thu Jun 25 2009 Dan Walsh <dwalsh@redhat.com> 3.6.20-1
7b16d56
- Update to upstream
7b16d56
- Fix nlscd_stream_connect
7b16d56
221642f
* Thu Jun 25 2009 Dan Walsh <dwalsh@redhat.com> 3.6.19-5
221642f
- Add rtkit policy
221642f
d399fb4
* Wed Jun 24 2009 Dan Walsh <dwalsh@redhat.com> 3.6.19-4
d399fb4
- Allow rpcd_t to stream connect to rpcbind
d399fb4
9850f4d
* Tue Jun 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.19-3
9850f4d
- Allow kpropd to create tmp files
9850f4d
93dc66e
* Tue Jun 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.19-2
93dc66e
- Fix last duplicate /var/log/rpmpkgs
93dc66e
93dc66e
* Mon Jun 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.19-1
a9f0953
- Update to upstream
a9f0953
  * add sssd
a9f0953
8866315
* Sat Jun 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.18-1
8866315
- Update to upstream
8866315
  * cleanup
6071093
* Fri Jun 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.17-1
6071093
- Update to upstream
6071093
- Additional mail ports
6071093
- Add virt_use_usb boolean for svirt
6071093
9386d6f
* Thu Jun 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.16-4
9386d6f
- Fix mcs rules to include chr_file and blk_file
9386d6f
e3bf679
* Tue Jun 16 2009 Dan Walsh <dwalsh@redhat.com> 3.6.16-3
e3bf679
- Add label for udev-acl
e3bf679
f8df9e5
* Mon Jun 15 2009 Dan Walsh <dwalsh@redhat.com> 3.6.16-2
f8df9e5
- Additional rules for consolekit/udev, privoxy and various other fixes
f8df9e5
49883e8
* Fri Jun 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.16-1
d3ae977
- New version for upstream
d3ae977
6b83805
* Thu Jun 11 2009 Dan Walsh <dwalsh@redhat.com> 3.6.14-3
6b83805
- Allow NetworkManager to read inotifyfs
6b83805
aa7b9cb
* Wed Jun 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.14-2
aa7b9cb
- Allow setroubleshoot to run mlocate
aa7b9cb
8197718
* Mon Jun 8 2009 Dan Walsh <dwalsh@redhat.com> 3.6.14-1
8197718
- Update to upstream 
8197718
8197718
* Tue Jun 2 2009 Dan Walsh <dwalsh@redhat.com> 3.6.13-3
8197718
- Add fish as a shell
8197718
- Allow fprintd to list usbfs_t
8197718
- Allow consolekit to search mountpoints
8197718
- Add proper labeling for shorewall
8197718
9ee63df
* Tue May 26 2009 Dan Walsh <dwalsh@redhat.com> 3.6.13-2
9ee63df
- New log file for vmware
9ee63df
- Allow xdm to setattr on user_tmp_t
9ee63df
ef7416c
* Thu May 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.13-1
ef7416c
- Upgrade to upstream
ef7416c
eead2a6
* Wed May 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-39
eead2a6
- Allow fprintd to access sys_ptrace
eead2a6
- Add sandbox policy
eead2a6
7b6c105
* Mon May 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-38
7b6c105
- Add varnishd policy
7b6c105
f72bd44
* Thu May 14 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-37
f72bd44
- Fixes for kpropd
f72bd44
fcb4418
* Tue May 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-36
fcb4418
- Allow brctl to r/w tun_tap_device_t
fcb4418
62cfafd
* Mon May 11 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-35
62cfafd
- Add /usr/share/selinux/packages
62cfafd
0f6b92d
* Mon May 11 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-34
0f6b92d
- Allow rpcd_t to send signals to kernel threads
0f6b92d
9924194
* Fri May 7 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-33
9924194
- Fix upgrade for F10 to F11
9924194
a2098a5
* Thu May 7 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-31
a2098a5
- Add policy for /var/lib/fprint
a2098a5
8a0604e
* Tue May 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-30
8a0604e
-Remove duplicate line
8a0604e
959ab94
* Tue May 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-29
959ab94
- Allow svirt to manage pci and other sysfs device data
959ab94
0e31a0e
* Mon May 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-28
0e31a0e
- Fix package selection handling
0e31a0e
5dd89f3
* Fri May 1 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-27
5dd89f3
- Fix /sbin/ip6tables-save context
c32d79e
- Allod udev to transition to mount
c32d79e
- Fix loading of mls policy file
5dd89f3
37ebfc9
* Thu Apr 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-26
37ebfc9
- Add shorewall policy
37ebfc9
37ebfc9
* Wed Apr 29 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-25
21b13fc
- Additional rules for fprintd and sssd
21b13fc
40d8f60
* Tue Apr 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-24
40d8f60
- Allow nsplugin to unix_read unix_write sem for unconfined_java
40d8f60
b3ac4a0
* Tue Apr 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-23
b3ac4a0
- Fix uml files to be owned by users
b3ac4a0
e080bbd
* Tue Apr 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-22
e080bbd
- Fix Upgrade path to install unconfineduser.pp when unocnfined package is 3.0.0 or less
e080bbd
b11dbbb
* Mon Apr 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-21
e080bbd
- Allow confined users to manage virt_content_t, since this is home dir content
b11dbbb
- Allow all domains to read rpm_script_tmp_t which is what shell creates on redirection
b11dbbb
b0991a2
* Mon Apr 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-20
b0991a2
- Fix labeling on /var/lib/misc/prelink*
b0991a2
- Allow xserver to rw_shm_perms with all x_clients
b0991a2
- Allow prelink to execute files in the users home directory
b0991a2
89c9c9a
* Fri Apr 24 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-19
dac8380
- Allow initrc_t to delete dev_null
dac8380
- Allow readahead to configure auditing
eaaf2ab
- Fix milter policy
eaaf2ab
- Add /var/lib/readahead
dac8380
cd0a396
* Fri Apr 24 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-16
cd0a396
- Update to latest milter code from Paul Howarth
cd0a396
5ce1c49
* Thu Apr 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-15
5ce1c49
- Additional perms for readahead
5ce1c49
4d5adb7
* Thu Apr 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-14
4d5adb7
- Allow pulseaudio to acquire_svc on session bus
4d5adb7
- Fix readahead labeling
4d5adb7
4d5adb7
* Thu Apr 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-13
4d5adb7
- Allow sysadm_t to run rpm directly
4d5adb7
- libvirt needs fowner
4d5adb7
3c498a7
* Wed Apr 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-12
3c498a7
- Allow sshd to read var_lib symlinks for freenx
3c498a7
a32a159
* Tue Apr 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-11
a32a159
- Allow nsplugin unix_read and write on users shm and sem
a32a159
- Allow sysadm_t to execute su
a32a159
a32a159
* Tue Apr 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-10
a32a159
- Dontaudit attempts to getattr user_tmpfs_t by lvm
a32a159
- Allow nfs to share removable media
a32a159
a32a159
* Mon Apr 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-9
a32a159
- Add ability to run postdrop from confined users
a32a159
d982e7e
* Sat Apr 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-8
d982e7e
- Fixes for podsleuth
d982e7e
d982e7e
* Fri Apr 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-7
d982e7e
- Turn off nsplugin transition
d982e7e
- Remove Konsole leaked file descriptors for release
dc00fc3
dc00fc3
* Fri Apr 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-6
6203f42
- Allow cupsd_t to create link files in print_spool_t
dc00fc3
- Fix iscsi_stream_connect typo
dc00fc3
- Fix labeling on /etc/acpi/actions
dc00fc3
- Don't reinstall unconfine and unconfineuser on upgrade if they are not installed
6203f42
4a0aac1
* Tue Apr 14 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-5
4a0aac1
- Allow audioentroy to read etc files
4a0aac1
685032c
* Mon Apr 13 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-4
685032c
- Add fail2ban_var_lib_t
685032c
- Fixes for devicekit_power_t
685032c
d4af172
* Thu Apr 9 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-3
d4af172
- Separate out the ucnonfined user from the unconfined.pp package
d4af172
90e4193
* Wed Apr 7 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-2
90e4193
- Make sure unconfined_java_t and unconfined_mono_t create user_tmpfs_t.
90e4193
25a4763
* Tue Apr 7 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-1
25a4763
- Upgrade to latest upstream
25a4763
- Allow devicekit_disk sys_rawio
25a4763
510c2a3
* Mon Apr 6 2009 Dan Walsh <dwalsh@redhat.com> 3.6.11-1
510c2a3
- Dontaudit binds to ports < 1024 for named
510c2a3
- Upgrade to latest upstream
510c2a3
04b6828
* Fri Apr 3 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-9
04b6828
- Allow podsleuth to use tmpfs files
04b6828
80beeee
* Fri Apr 3 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-8
80beeee
- Add customizable_types for svirt
80beeee
f49c57d
* Fri Apr 3 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-7
f49c57d
- Allow setroubelshoot exec* privs to prevent crash from bad libraries
f49c57d
- add cpufreqselector
f49c57d
90ea5b3
* Thu Apr 2 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-6
90ea5b3
- Dontaudit listing of /root directory for cron system jobs
90ea5b3
3434a9b
* Mon Mar 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-5
3434a9b
- Fix missing ld.so.cache label
3434a9b
c0158a8
* Fri Mar 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-4
c0158a8
- Add label for ~/.forward and /root/.forward
c0158a8
6130d52
* Thu Mar 26 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-3
6130d52
- Fixes for svirt
6130d52
9ca87fc
* Thu Mar 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-2
9ca87fc
- Fixes to allow svirt read iso files in homedir
9ca87fc
5dce3c1
* Thu Mar 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-1
5dce3c1
- Add xenner and wine fixes from mgrepl
5dce3c1
bfc78b6
* Wed Mar 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.9-4
bfc78b6
- Allow mdadm to read/write mls override
bfc78b6
095146a
* Tue Mar 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.9-3
095146a
- Change to svirt to only access svirt_image_t
095146a
d4b8dcf
* Thu Mar 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.9-2
d4b8dcf
- Fix libvirt policy
d4b8dcf
b12011f
* Thu Mar 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.9-1
b12011f
- Upgrade to latest upstream
b12011f
c240b60
* Tue Mar 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.8-4
c240b60
- Fixes for iscsid and sssd
c240b60
- More cleanups for upgrade from F10 to Rawhide.
c240b60
e72f55a
* Mon Mar 9 2009 Dan Walsh <dwalsh@redhat.com> 3.6.8-3
e72f55a
- Add pulseaudio, sssd policy
e72f55a
- Allow networkmanager to exec udevadm
e72f55a
0c34c69
* Sat Mar 7 2009 Dan Walsh <dwalsh@redhat.com> 3.6.8-2
0c34c69
- Add pulseaudio context
0c34c69
a67a1c1
* Thu Mar 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.8-1
a67a1c1
- Upgrade to latest patches
a67a1c1
0a03cce
* Wed Mar 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.7-2
0a03cce
- Fixes for libvirt
0a03cce
8c3a31a
* Mon Mar 2 2009 Dan Walsh <dwalsh@redhat.com> 3.6.7-1
8c3a31a
- Update to Latest upstream
8c3a31a
8c3a31a
* Sat Feb 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-9
8c3a31a
- Fix setrans.conf to show SystemLow for s0
8c3a31a
4967525
* Fri Feb 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-8
4967525
- Further confinement of qemu images via svirt
4967525
150ff59
* Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.6.6-7
150ff59
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
150ff59
52cbcb4
* Thu Feb 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-6
52cbcb4
- Allow NetworkManager to manage /etc/NetworkManager/system-connections
52cbcb4
de67749
* Wed Feb 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-5
de67749
- add virtual_image_context and virtual_domain_context files
de67749
8f6e436
* Tue Feb 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-4
8f6e436
- Allow rpcd_t to send signal to mount_t
8f6e436
- Allow libvirtd to run ranged
8f6e436
8c2b68a
* Tue Feb 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-3
8c2b68a
- Fix sysnet/net_conf_t
8c2b68a
8179476
* Tue Feb 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-2
8179476
- Fix squidGuard labeling
8179476
2eec438
* Wed Feb 11 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-1
2eec438
- Re-add corenet_in_generic_if(unlabeled_t)
2eec438
e46e005
* Wed Feb 11 2009 Dan Walsh <dwalsh@redhat.com> 3.6.5-3
e46e005
1d1c058
* Tue Feb 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.5-2
1d1c058
- Add git web policy
1d1c058
bd0db4f
* Mon Feb 9 2009 Dan Walsh <dwalsh@redhat.com> 3.6.5-1
bd0db4f
- Add setrans contains from upstream 
bd0db4f
bd0db4f
* Mon Feb 9 2009 Dan Walsh <dwalsh@redhat.com> 3.6.4-6
bd0db4f
- Do transitions outside of the booleans
bd0db4f
4ed140a
* Sun Feb 8 2009 Dan Walsh <dwalsh@redhat.com> 3.6.4-5
4ed140a
- Allow xdm to create user_tmp_t sockets for switch user to work
4ed140a
bc861e6
* Thu Feb 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.4-4
bc861e6
- Fix staff_t domain
bc861e6
73fe81b
* Thu Feb 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.4-3
73fe81b
- Grab remainder of network_peer_controls patch
73fe81b
659e96f
* Wed Feb 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.4-2
659e96f
- More fixes for devicekit
659e96f
c957c38
* Tue Feb 3 2009 Dan Walsh <dwalsh@redhat.com> 3.6.4-1
c957c38
- Upgrade to latest upstream 
c957c38
574cab4
* Mon Feb 2 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-13
574cab4
- Add boolean to disallow unconfined_t login
574cab4
0554a10
* Fri Jan 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-12
0554a10
- Add back transition from xguest to mozilla
0554a10
ab3e55d
* Fri Jan 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-11
ab3e55d
- Add virt_content_ro_t and labeling for isos directory
ab3e55d
f899107
* Tue Jan 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-10
f899107
- Fixes for wicd daemon
f899107
48adbea
* Mon Jan 26 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-9
48adbea
- More mls/rpm fixes 
48adbea
14c9b9c
* Fri Jan 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-8
14c9b9c
- Add policy to make dbus/nm-applet work
14c9b9c
40dd24d
* Thu Jan 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-7
40dd24d
- Remove polgen-ifgen from post and add trigger to policycoreutils-python
40dd24d
6f8856e
* Wed Jan 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-6
1b94a13
- Add wm policy
6cf32a1
- Make mls work in graphics mode
1b94a13
2a4bdae
* Tue Jan 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-3
2a4bdae
- Fixed for DeviceKit
2a4bdae
acc1376
* Mon Jan 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-2
acc1376
- Add devicekit policy
acc1376
1d72fb0
* Mon Jan 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-1
1d72fb0
- Update to upstream
1d72fb0
eacea1d
* Thu Jan 15 2009 Dan Walsh <dwalsh@redhat.com> 3.6.2-5
eacea1d
- Define openoffice as an x_domain
eacea1d
339bf3b
* Mon Jan 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.2-4
339bf3b
- Fixes for reading xserver_tmp_t
339bf3b
87fb153
* Thu Jan 8 2009 Dan Walsh <dwalsh@redhat.com> 3.6.2-3
87fb153
- Allow cups_pdf_t write to nfs_t
87fb153
2ed2ff4
* Tue Jan 6 2009 Dan Walsh <dwalsh@redhat.com> 3.6.2-2
2ed2ff4
- Remove audio_entropy policy
2ed2ff4
292c49c
* Mon Jan 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.2-1
292c49c
- Update to upstream
292c49c
5df2628
* Sun Jan 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.1-15
5df2628
- Allow hal_acl_t to getattr/setattr fixed_disk
5df2628
3236390
* Sat Dec 27 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-14
3236390
- Change userdom_read_all_users_state to include reading symbolic links in /proc
3236390
cf8fd9f
* Mon Dec 22 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-13
cf8fd9f
- Fix dbus reading /proc information
cf8fd9f
bae2e98
* Thu Dec 18 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-12
bae2e98
- Add missing alias for home directory content
bae2e98
33c7eab
* Wed Dec 17 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-11
33c7eab
- Fixes for IBM java location
33c7eab
dcd0c96
* Thu Dec 11 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-10
dcd0c96
- Allow unconfined_r unconfined_java_t
dcd0c96
fd2b62e
* Tue Dec 9 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-9
fd2b62e
- Add cron_role back to user domains
fd2b62e
9a43d2b
* Mon Dec 8 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-8
9a43d2b
- Fix sudo setting of user keys
9a43d2b
2ae1615
* Thu Dec 4 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-7
01ce3df
- Allow iptables to talk to terminals
2ae1615
- Fixes for policy kit
2ae1615
- lots of fixes for booting. 
01ce3df
bcb1922
* Wed Dec 3 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-4
739db21
- Cleanup policy
739db21
23d6844
* Mon Dec 01 2008 Ignacio Vazquez-Abrams <ivazqueznet+rpm@gmail.com> - 3.6.1-2
23d6844
- Rebuild for Python 2.6
23d6844