de67749
%define distro redhat
7716868
%define polyinstatiate n
1580c87
%define monolithic n
bd3f0ea
%if %{?BUILD_TARGETED:0}%{!?BUILD_TARGETED:1}
bd3f0ea
%define BUILD_TARGETED 1
bd3f0ea
%endif
675bbab
%if %{?BUILD_MINIMUM:0}%{!?BUILD_MINIMUM:1}
675bbab
%define BUILD_MINIMUM 1
675bbab
%endif
a4ec9b7
%if %{?BUILD_OLPC:0}%{!?BUILD_OLPC:1}
a4ec9b7
%define BUILD_OLPC 0
a4ec9b7
%endif
bd3f0ea
%if %{?BUILD_MLS:0}%{!?BUILD_MLS:1}
3debd0a
%define BUILD_MLS 1
bd3f0ea
%endif
9987374
%define POLICYVER 23
57ac1ca
%define libsepolver 2.0.20-1
b2c5e72
%define POLICYCOREUTILSVER 2.0.71-2
812930a
%define CHECKPOLICYVER 2.0.16-3
1580c87
Summary: SELinux policy configuration
1580c87
Name: selinux-policy
9c27022
Version: 3.6.27
9c27022
Release: 1%{?dist}
d83af23
License: GPLv2+
1580c87
Group: System Environment/Base
1580c87
Source: serefpolicy-%{version}.tgz
ef7416c
patch: policy-F12.patch
504da9f
Source1: modules-targeted.conf
504da9f
Source2: booleans-targeted.conf
585f827
Source3: Makefile.devel
504da9f
Source4: setrans-targeted.conf
504da9f
Source5: modules-mls.conf
6e9bcb4
Source6: booleans-mls.conf	
504da9f
Source8: setrans-mls.conf
a4ec9b7
Source9: modules-olpc.conf
a4ec9b7
Source10: booleans-olpc.conf	
a4ec9b7
Source11: setrans-olpc.conf
a4ec9b7
Source12: securetty_types-olpc
de82d85
Source13: policygentool
ee095f5
Source14: securetty_types-targeted
ee095f5
Source15: securetty_types-mls
675bbab
Source16: modules-minimum.conf
675bbab
Source17: booleans-minimum.conf
675bbab
Source18: setrans-minimum.conf
675bbab
Source19: securetty_types-minimum
80beeee
Source20: customizable_types
3e930b8
0c34c69
Url: http://oss.tresys.com/repos/refpolicy/
ca8bc2d
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
1580c87
BuildArch: noarch
7b146db
BuildRequires: python gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-python >= %{POLICYCOREUTILSVER} bzip2 
9c27022
Requires(pre): policycoreutils-python >= %{POLICYCOREUTILSVER} libsemanage >= 2.0.14-3
dc00fc3
Requires(post): /usr/bin/bunzip2 /bin/mktemp /bin/awk
081b6ac
Requires: checkpolicy >= %{CHECKPOLICYVER} m4 
081b6ac
Obsoletes: selinux-policy-devel
081b6ac
Provides: selinux-policy-devel
1580c87
1335ee8
%description 
1335ee8
SELinux Base package
1335ee8
1335ee8
%files 
a85aeff
%{_mandir}/man*/*
a85aeff
# policycoreutils owns these manpage directories, we only own the files within them
a85aeff
%{_mandir}/ru/*/*
585f827
%dir %{_usr}/share/selinux
081b6ac
%dir %{_usr}/share/selinux/devel
081b6ac
%dir %{_usr}/share/selinux/devel/include
62cfafd
%dir %{_usr}/share/selinux/packages
585f827
%dir %{_sysconfdir}/selinux
585f827
%ghost %config(noreplace) %{_sysconfdir}/selinux/config
585f827
%ghost %{_sysconfdir}/sysconfig/selinux
d19b685
%{_usr}/share/selinux/devel/include/*
d19b685
%{_usr}/share/selinux/devel/Makefile
d19b685
%{_usr}/share/selinux/devel/policygentool
d19b685
%{_usr}/share/selinux/devel/example.*
3640444
%{_usr}/share/selinux/devel/policy.*
4125702
4125702
%package doc
4125702
Summary: SELinux policy documentation
4125702
Group: System Environment/Base
4125702
Requires(pre): selinux-policy = %{version}-%{release}
4125702
4125702
%description doc
4125702
SELinux policy documentation package
4125702
4125702
%files doc
4125702
%doc %{_usr}/share/doc/%{name}-%{version}
d2c2609
%attr(755,root,root) %{_usr}/share/selinux/devel/policyhelp
1335ee8
081b6ac
%check
673eaae
/usr/bin/sepolgen-ifgen -i %{buildroot}%{_usr}/share/selinux/devel/include -o /dev/null
673eaae
de82d85
%define setupCmds() \
01ce3df
make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 bare \
01ce3df
make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024  conf \
53f8191
cp -f $RPM_SOURCE_DIR/modules-%1.conf  ./policy/modules.conf \
53f8191
cp -f $RPM_SOURCE_DIR/booleans-%1.conf ./policy/booleans.conf \
de82d85
e8b5993
%define moduleList() %([ -f %{_sourcedir}/modules-%{1}.conf ] && \
dc00fc3
awk '$1 !~ "/^#/" && $1 != "unconfined" && $1 != "unconfineduser" && $2 == "=" && $3 == "module" { printf "%%s.pp.bz2 ", $1 }' %{_sourcedir}/modules-%{1}.conf )
9987374
de82d85
%define installCmds() \
01ce3df
make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 base.pp \
01ce3df
make validate UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 modules \
01ce3df
make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 install \
01ce3df
make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 install-appconfig \
ca8bc2d
#%{__cp} *.pp %{buildroot}/%{_usr}/share/selinux/%1/ \
ca8bc2d
%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/policy \
ca8bc2d
%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/modules/active \
ca8bc2d
%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/contexts/files \
ca8bc2d
touch %{buildroot}/%{_sysconfdir}/selinux/%1/modules/semanage.read.LOCK \
ca8bc2d
touch %{buildroot}/%{_sysconfdir}/selinux/%1/modules/semanage.trans.LOCK \
ca8bc2d
rm -rf %{buildroot}%{_sysconfdir}/selinux/%1/booleans \
ca8bc2d
touch %{buildroot}%{_sysconfdir}/selinux/%1/seusers \
ca8bc2d
touch %{buildroot}%{_sysconfdir}/selinux/%1/policy/policy.%{POLICYVER} \
ca8bc2d
touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts \
ca8bc2d
touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \
53f8191
install -m0644 $RPM_SOURCE_DIR/securetty_types-%1 %{buildroot}%{_sysconfdir}/selinux/%1/contexts/securetty_types \
53f8191
install -m0644 $RPM_SOURCE_DIR/setrans-%1.conf %{buildroot}%{_sysconfdir}/selinux/%1/setrans.conf \
80beeee
install -m0644 $RPM_SOURCE_DIR/customizable_types %{buildroot}%{_sysconfdir}/selinux/%1/contexts/customizable_types \
9987374
bzip2 %{buildroot}/%{_usr}/share/selinux/%1/*.pp
3e930b8
%nil
1580c87
1580c87
%define fileList() \
1580c87
%defattr(-,root,root) \
d7e0f9f
%dir %{_usr}/share/selinux/%1 \
9987374
%{_usr}/share/selinux/%1/*.pp.bz2 \
1580c87
%dir %{_sysconfdir}/selinux/%1 \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/setrans.conf \
1580c87
%ghost %{_sysconfdir}/selinux/%1/seusers \
1580c87
%dir %{_sysconfdir}/selinux/%1/modules \
8bee3a4
%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/semanage.read.LOCK \
8bee3a4
%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/semanage.trans.LOCK \
21dea1c
%attr(700,root,root) %dir %{_sysconfdir}/selinux/%1/modules/active \
97081dc
#%verify(not md5 size mtime) %attr(600,root,root) %config(noreplace) %{_sysconfdir}/selinux/%1/modules/active/seusers \
1580c87
%dir %{_sysconfdir}/selinux/%1/policy/ \
7c94e8e
%ghost %{_sysconfdir}/selinux/%1/policy/policy.* \
1580c87
%dir %{_sysconfdir}/selinux/%1/contexts \
d2c2609
%config %{_sysconfdir}/selinux/%1/contexts/customizable_types \
ee095f5
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/securetty_types \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/dbus_contexts \
5ca2ff9
%config %{_sysconfdir}/selinux/%1/contexts/x_contexts \
7c94e8e
%config %{_sysconfdir}/selinux/%1/contexts/default_contexts \
de67749
%config	%{_sysconfdir}/selinux/%1/contexts/virtual_domain_context \
de67749
%config	%{_sysconfdir}/selinux/%1/contexts/virtual_image_context \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/default_type \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/failsafe_context \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/initrc_context \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/removable_context \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/userhelper_context \
1580c87
%dir %{_sysconfdir}/selinux/%1/contexts/files \
a08ba87
%ghost %{_sysconfdir}/selinux/%1/contexts/files/file_contexts \
a08ba87
%ghost %{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \
d19b685
%config %{_sysconfdir}/selinux/%1/contexts/files/media \
da08298
%dir %{_sysconfdir}/selinux/%1/contexts/users \
a4ec9b7
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/root \
a4ec9b7
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/guest_u \
a80e7ac
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/xguest_u \
a4ec9b7
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/user_u \
4d59c29
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/staff_u 
1580c87
1580c87
%define saveFileContext() \
bd7e86c
if [ -s /etc/selinux/config ]; then \
bd7e86c
	. %{_sysconfdir}/selinux/config; \
bd7e86c
	FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \
e080bbd
	if [ "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT} ]; then \
bd7e86c
		cp -f ${FILE_CONTEXT} ${FILE_CONTEXT}.pre; \
bd7e86c
	fi \
bd7e86c
fi
1580c87
a4ec9b7
%define loadpolicy() \
02d888c
( cd /usr/share/selinux/%1; \
0e31a0e
semodule -b base.pp.bz2 -i %2 -s %1; \
bb36d75
); \
1580c87
1580c87
%define relabel() \
1580c87
. %{_sysconfdir}/selinux/config; \
1580c87
FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \
2528fa0
selinuxenabled; \
e080bbd
if [ $? = 0  -a "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT}.pre ]; then \
ad73e86
	fixfiles -C ${FILE_CONTEXT}.pre restore; \
bea5486
	restorecon -R /var/log /var/run 2> /dev/null; \
1580c87
	rm -f ${FILE_CONTEXT}.pre; \
1580c87
fi; 
1580c87
1580c87
%description
1580c87
SELinux Reference Policy - modular.
abd1536
Based off of reference policy: Checked out revision  2.20090730
1580c87
d83af23
%build
d83af23
3e930b8
%prep 
d83af23
%setup -n serefpolicy-%{version} -q
3c584c7
%patch -p1
bd3f0ea
1580c87
%install
e568731
# Build targeted policy
ca8bc2d
%{__rm} -fR %{buildroot}
28021c8
mkdir -p %{buildroot}%{_mandir}
7330e86
cp -R  man/* %{buildroot}%{_mandir}
ca8bc2d
mkdir -p %{buildroot}%{_sysconfdir}/selinux
ca8bc2d
mkdir -p %{buildroot}%{_sysconfdir}/sysconfig
ca8bc2d
touch %{buildroot}%{_sysconfdir}/selinux/config
ca8bc2d
touch %{buildroot}%{_sysconfdir}/sysconfig/selinux
1335ee8
b4cab5a
# Always create policy module package directories
2fbeb78
mkdir -p %{buildroot}%{_usr}/share/selinux/{targeted,mls,minimum,modules}/
b4cab5a
d19b685
# Install devel
d19b685
make clean
bd3f0ea
%if %{BUILD_TARGETED}
129ba16
# Build targeted policy
129ba16
# Commented out because only targeted ref policy currently builds
db0dafa
%setupCmds targeted mcs n y allow
db0dafa
%installCmds targeted mcs n y allow
bd3f0ea
%endif
3e930b8
675bbab
%if %{BUILD_MINIMUM}
675bbab
# Build minimum policy
675bbab
# Commented out because only minimum ref policy currently builds
675bbab
%setupCmds minimum mcs n y allow
675bbab
%installCmds minimum mcs n y allow
675bbab
%endif
675bbab
bd3f0ea
%if %{BUILD_MLS}
129ba16
# Build mls policy
9185bf2
%setupCmds mls mls n y deny
9185bf2
%installCmds mls mls n y deny
a4ec9b7
%endif
a4ec9b7
a4ec9b7
%if %{BUILD_OLPC}
675bbab
# Build olpc policy
675bbab
# Commented out because only olpc ref policy currently builds
9185bf2
%setupCmds olpc mcs n y allow
9185bf2
%installCmds olpc mcs n y allow
bd3f0ea
%endif
129ba16
db0dafa
make UNK_PERMS=allow NAME=targeted TYPE=mcs DISTRO=%{distro} UBAC=n DIRECT_INITRC=n MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} PKGNAME=%{name}-%{version} POLY=y MLS_CATS=1024 MCS_CATS=1024 install-headers install-docs
ce7f30a
mkdir %{buildroot}%{_usr}/share/selinux/devel/
62cfafd
mkdir %{buildroot}%{_usr}/share/selinux/packages/
ce7f30a
mv %{buildroot}%{_usr}/share/selinux/targeted/include %{buildroot}%{_usr}/share/selinux/devel/include
7f9951d
install -m 755 $RPM_SOURCE_DIR/policygentool %{buildroot}%{_usr}/share/selinux/devel/
7f9951d
install -m 644 $RPM_SOURCE_DIR/Makefile.devel %{buildroot}%{_usr}/share/selinux/devel/Makefile
ce7f30a
install -m 644 doc/example.* %{buildroot}%{_usr}/share/selinux/devel/
3640444
install -m 644 doc/policy.* %{buildroot}%{_usr}/share/selinux/devel/
f1a8278
echo  "xdg-open file:///usr/share/doc/selinux-policy-%{version}/html/index.html"> %{buildroot}%{_usr}/share/selinux/devel/policyhelp
ce7f30a
chmod +x %{buildroot}%{_usr}/share/selinux/devel/policyhelp
ce7f30a
1580c87
%clean
ca8bc2d
%{__rm} -fR %{buildroot}
1580c87
9c64bb6
%post
af60908
if [ ! -s /etc/selinux/config ]; then
af60908
	#
af60908
	#	New install so we will default to targeted policy
af60908
	#
af60908
	echo "
af60908
# This file controls the state of SELinux on the system.
af60908
# SELINUX= can take one of these three values:
af60908
#	enforcing - SELinux security policy is enforced.
af60908
#	permissive - SELinux prints warnings instead of enforcing.
af60908
#	disabled - No SELinux policy is loaded.
af60908
SELINUX=enforcing
af60908
# SELINUXTYPE= can take one of these two values:
56187c2
#	targeted - Targeted processes are protected,
af60908
#	mls - Multi Level Security protection.
af60908
SELINUXTYPE=targeted 
af60908
af60908
" > /etc/selinux/config
af60908
6e9bcb4
	ln -sf ../selinux/config /etc/sysconfig/selinux 
d44a393
	restorecon /etc/selinux/config 2> /dev/null || :
af60908
else
97081dc
	. /etc/selinux/config
af60908
	# if first time update booleans.local needs to be copied to sandbox
9c64bb6
	[ -f /etc/selinux/${SELINUXTYPE}/booleans.local ] && mv /etc/selinux/${SELINUXTYPE}/booleans.local /etc/selinux/targeted/modules/active/
9c64bb6
	[ -f /etc/selinux/${SELINUXTYPE}/seusers ] && cp -f /etc/selinux/${SELINUXTYPE}/seusers /etc/selinux/${SELINUXTYPE}/modules/active/seusers
af60908
	grep -q "^SETLOCALDEFS" /etc/selinux/config || echo -n "
af60908
">> /etc/selinux/config
af60908
fi
081b6ac
exit 0
9c64bb6
5ff36d6
%postun
bbaa1f2
if [ $1 = 0 ]; then
bbaa1f2
	setenforce 0 2> /dev/null
bbaa1f2
	if [ ! -s /etc/selinux/config ]; then
bbaa1f2
		echo "SELINUX=disabled" > /etc/selinux/config
bbaa1f2
	else
bbaa1f2
		sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config
bbaa1f2
	fi
5ff36d6
fi
a4ec9b7
exit 0
5ff36d6
bd3f0ea
%if %{BUILD_TARGETED}
bd3f0ea
%package targeted
bd3f0ea
Summary: SELinux targeted base policy
fb11ad6
Provides: selinux-policy-base
bd3f0ea
Group: System Environment/Base
d83af23
Obsoletes: selinux-policy-targeted-sources < 2
9850f4d
Requires(pre): policycoreutils-python >= %{POLICYCOREUTILSVER}
d83af23
Requires(pre): coreutils
d83af23
Requires(pre): selinux-policy = %{version}-%{release}
b4cab5a
Conflicts:  audispd-plugins <= 1.7.7-1
236d3cc
Obsoletes: mod_fcgid-selinux
bd3f0ea
bd3f0ea
%description targeted
bd3f0ea
SELinux Reference policy targeted base module.
bd3f0ea
bd3f0ea
%pre targeted
bd3f0ea
%saveFileContext targeted
bd3f0ea
9c64bb6
%post targeted
e080bbd
function get_unconfined() {
e080bbd
# We only want to upgrade unconfined.pp and unconfineduser if they are 
e080bbd
# currently installed.  If you have a version 3.0.0 or less of unconfined 
e080bbd
# installed, you will need to install both, since unconfineduser did not exist 
e080bbd
# prior to this.
9924194
eval `semodule -l | while read package version; do
9924194
	case $package in
9924194
	"unconfineduser")
9924194
	        echo "unconfineduser=$version"
9924194
		;;
9924194
	"unconfined")
9924194
	 	echo "unconfined=$version"
9924194
		;;
9924194
	esac
9924194
done`
9924194
9924194
if [ -z "$unconfineduser" -a -n "$unconfined" ]; then
9924194
    f1=`echo $unconfined | cut -d. -f 1`
e080bbd
    if [ $f1 -lt 3 ]; then
9924194
	unconfineduser="1"
e080bbd
    else
e080bbd
        if [ $f1 -eq  3 ]; then
9924194
	    f2=`echo $unconfined | cut -s -d. -f2`
9924194
	    f3=`echo $unconfined | cut -s -d. -f3`
e080bbd
	    if [ \( -z "$f2" \) -o \( \( "$f2" -eq 0 \)  -a \( -z "f3" -o "$f3" -eq 0 \) \) ]; then 
9924194
	        unconfineduser="1"
e080bbd
	    fi
e080bbd
	fi
e080bbd
    fi
d83af23
fi
9924194
echo ${unconfined:+unconfined.pp.bz2} ${unconfineduser:+unconfineduser.pp.bz2}
e080bbd
}
af60908
e080bbd
if [ $1 -eq 1 ]; then
c32d79e
   packages="%{expand:%%moduleList targeted} unconfined.pp.bz2 unconfineduser.pp.bz2"
e080bbd
   %loadpolicy targeted $packages
e080bbd
   restorecon -R /root /var/log /var/run 2> /dev/null
e080bbd
else
b2c5e72
   semodule -n -s targeted -r moilscanner -r mailscanner -r gamin -r audio_entropy -r iscsid -r polkit 2>/dev/null
9924194
   packages="%{expand:%%moduleList targeted} `get_unconfined`"
e080bbd
   %loadpolicy targeted $packages
e080bbd
   %relabel targeted
e080bbd
fi
e080bbd
exit 0
d83af23
5baf53a
%triggerpostun targeted -- selinux-policy-targeted < 3.2.5-9.fc9
4b1d56d
. /etc/selinux/config
4b1d56d
[ "${SELINUXTYPE}" != "targeted" ] && exit 0
af67779
setsebool -P use_nfs_home_dirs=1
df62201
semanage user -l | grep -s unconfined_u > /dev/null
a6e1280
if [ $? -eq 0 ]; then
df62201
   semanage user -m -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u
99d3676
else
df62201
   semanage user -a -P user -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u
99d3676
fi
99d3676
seuser=`semanage login -l | grep __default__ | awk '{ print $2 }'`
4b1d56d
[ "$seuser" != "unconfined_u" ]  && semanage login -m -s "unconfined_u"  -r s0-s0:c0.c1023 __default__
99d3676
seuser=`semanage login -l | grep root | awk '{ print $2 }'`
e080bbd
[ "$seuser" = "system_u" ] && semanage login -m -s "unconfined_u"  -r s0-s0:c0.c1023 root
1ffa684
restorecon -R /root /etc/selinux/targeted 2> /dev/null
5baf53a
semodule -r qmail 2> /dev/null
a4ec9b7
exit 0
af60908
bd3f0ea
%files targeted
4d59c29
%config(noreplace) %{_sysconfdir}/selinux/targeted/contexts/users/unconfined_u
4d59c29
%fileList targeted
a4ec9b7
%endif
a4ec9b7
675bbab
%if %{BUILD_MINIMUM}
675bbab
%package minimum
675bbab
Summary: SELinux minimum base policy
675bbab
Provides: selinux-policy-base
675bbab
Group: System Environment/Base
9850f4d
Requires(pre): policycoreutils-python >= %{POLICYCOREUTILSVER}
675bbab
Requires(pre): coreutils
675bbab
Requires(pre): selinux-policy = %{version}-%{release}
675bbab
675bbab
%description minimum
675bbab
SELinux Reference policy minimum base module.
675bbab
675bbab
%pre minimum
675bbab
%saveFileContext minimum
675bbab
675bbab
%post minimum
c32d79e
packages="unconfined.pp.bz2 unconfineduser.pp.bz2"
c32d79e
%loadpolicy minimum $packages
0e31a0e
if [ $1 -eq 1 ]; then
675bbab
semanage -S minimum -i - << __eof
675bbab
login -m  -s unconfined_u -r s0-s0:c0.c1023 __default__
675bbab
login -m  -s unconfined_u -r s0-s0:c0.c1023 root
675bbab
__eof
675bbab
restorecon -R /root /var/log /var/run 2> /dev/null
675bbab
else
675bbab
%relabel minimum
675bbab
fi
675bbab
exit 0
675bbab
675bbab
%files minimum
675bbab
%config(noreplace) %{_sysconfdir}/selinux/minimum/contexts/users/unconfined_u
675bbab
%fileList minimum
675bbab
%endif
675bbab
a4ec9b7
%if %{BUILD_OLPC}
a4ec9b7
%package olpc 
a4ec9b7
Summary: SELinux olpc base policy
a4ec9b7
Group: System Environment/Base
fb11ad6
Provides: selinux-policy-base
9850f4d
Requires(pre): policycoreutils-python >= %{POLICYCOREUTILSVER}
d83af23
Requires(pre): coreutils
d83af23
Requires(pre): selinux-policy = %{version}-%{release}
a4ec9b7
a4ec9b7
%description olpc 
a4ec9b7
SELinux Reference policy olpc base module.
a4ec9b7
a4ec9b7
%pre olpc 
a4ec9b7
%saveFileContext olpc
a4ec9b7
a4ec9b7
%post olpc 
c32d79e
packages="%{expand:%%moduleList olpc} unconfined.pp.bz2 unconfineduser.pp.bz2"
c32d79e
%loadpolicy olpc $packages
8fd9df6
a6e1280
if [ $1 -ne 1 ]; then
a4ec9b7
%relabel olpc
24ccb8b
fi
a4ec9b7
exit 0
a4ec9b7
a4ec9b7
%files olpc
a4ec9b7
%fileList olpc
bd3f0ea
bd3f0ea
%endif
bd3f0ea
bd3f0ea
%if %{BUILD_MLS}
504da9f
%package mls 
504da9f
Summary: SELinux mls base policy
1580c87
Group: System Environment/Base
fb11ad6
Provides: selinux-policy-base
d83af23
Obsoletes: selinux-policy-mls-sources < 2
c77aca5
Requires: policycoreutils-newrole >= %{POLICYCOREUTILSVER} setransd
9850f4d
Requires(pre): policycoreutils-python >= %{POLICYCOREUTILSVER}
d83af23
Requires(pre): coreutils
d83af23
Requires(pre): selinux-policy = %{version}-%{release}
1580c87
504da9f
%description mls 
504da9f
SELinux Reference policy mls base module.
1580c87
504da9f
%pre mls 
504da9f
%saveFileContext mls
1580c87
504da9f
%post mls 
b2c5e72
semodule -n -s mls -r mailscanner -r polkit 2>/dev/null
c32d79e
packages="%{expand:%%moduleList mls}"
c32d79e
%loadpolicy mls $packages
8fd9df6
24ccb8b
if [ $1 != 1 ]; then
504da9f
%relabel mls
24ccb8b
fi
a4ec9b7
exit 0
1580c87
504da9f
%files mls
57ae10c
%config(noreplace) %{_sysconfdir}/selinux/mls/contexts/users/unconfined_u
504da9f
%fileList mls
3e930b8
bd3f0ea
%endif
bd3f0ea
56187c2
%changelog
9c27022
* Fri Aug 14 2009 Dan Walsh <dwalsh@redhat.com> 3.6.27-1
9c27022
- Add policycoreutils-python to pre install
9c27022
b2c5e72
* Thu Aug 13 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-11
b2c5e72
- Make all unconfined_domains permissive so we can see what AVC's happen 
b2c5e72
7fe210d
* Mon Aug 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-10
7fe210d
- Add pt_chown policy
7fe210d
867473a
* Mon Aug 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-9
867473a
- Add kdump policy for Miroslav Grepl
867473a
- Turn off execstack boolean
867473a
ac7bbfa
* Fri Aug 7 2009 Bill Nottingham <notting@redhat.com> 3.6.26-8
ac7bbfa
- Turn on execstack on a temporary basis (#512845)
ac7bbfa
4de3826
* Thu Aug 6 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-7
4de3826
- Allow nsplugin to connecto the session bus
4de3826
- Allow samba_net to write to coolkey data
4de3826
e213303
* Wed Aug 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-6
e213303
- Allow devicekit_disk to list inotify
e213303
4816e90
* Wed Aug 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-5
4816e90
- Allow svirt images to create sock_file in svirt_var_run_t
4816e90
4673269
* Tue Aug 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-4
4673269
- Allow exim to getattr on mountpoints
4673269
- Fixes for pulseaudio
4673269
947b439
* Fri Jul 31 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-3
947b439
- Allow svirt_t to stream_connect to virtd_t
947b439
af4fa82
* Fri Jul 31 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-2
af4fa82
- Allod hald_dccm_t to create sock_files in /tmp
af4fa82
af4fa82
* Thu Jul 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-1
abd1536
- More fixes from upstream
abd1536
c6e2224
* Tue Jul 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.25-1
c6e2224
- Fix polkit label
c6e2224
- Remove hidebrokensymptoms for nss_ldap fix
c6e2224
- Add modemmanager policy
c6e2224
- Lots of merges from upstream
c6e2224
- Begin removing textrel_shlib_t labels, from fixed libraries
c6e2224
3750561
* Tue Jul 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.24-1
3750561
- Update to upstream
3750561
9160520
* Mon Jul 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.23-2
9160520
- Allow certmaster to override dac permissions
9160520
df7055d
* Thu Jul 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.23-1
df7055d
- Update to upstream
df7055d
df7055d
* Tue Jul 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.22-3
8da0248
- Fix context for VirtualBox
8da0248
2360ff9
* Tue Jul 14 2009 Dan Walsh <dwalsh@redhat.com> 3.6.22-1
2360ff9
- Update to upstream
2360ff9
2360ff9
* Fri Jul 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.21-4
2360ff9
- Allow clamscan read amavis spool files
2360ff9
a88b486
* Wed Jul 8 2009 Dan Walsh <dwalsh@redhat.com> 3.6.21-3
a88b486
- Fixes for xguest
a88b486
a85aeff
* Tue Jul  7 2009 Tom "spot" Callaway <tcallawa@redhat.com> 3.6.21-2
a85aeff
- fix multiple directory ownership of mandirs
a85aeff
d9676a6
* Wed Jul 1 2009 Dan Walsh <dwalsh@redhat.com> 3.6.21-1
d9676a6
- Update to upstream
d9676a6
bcc53da
* Tue Jun 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.20-2
bcc53da
- Add rules for rtkit-daemon
bcc53da
7b16d56
* Thu Jun 25 2009 Dan Walsh <dwalsh@redhat.com> 3.6.20-1
7b16d56
- Update to upstream
7b16d56
- Fix nlscd_stream_connect
7b16d56
221642f
* Thu Jun 25 2009 Dan Walsh <dwalsh@redhat.com> 3.6.19-5
221642f
- Add rtkit policy
221642f
d399fb4
* Wed Jun 24 2009 Dan Walsh <dwalsh@redhat.com> 3.6.19-4
d399fb4
- Allow rpcd_t to stream connect to rpcbind
d399fb4
9850f4d
* Tue Jun 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.19-3
9850f4d
- Allow kpropd to create tmp files
9850f4d
93dc66e
* Tue Jun 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.19-2
93dc66e
- Fix last duplicate /var/log/rpmpkgs
93dc66e
93dc66e
* Mon Jun 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.19-1
a9f0953
- Update to upstream
a9f0953
  * add sssd
a9f0953
8866315
* Sat Jun 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.18-1
8866315
- Update to upstream
8866315
  * cleanup
6071093
* Fri Jun 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.17-1
6071093
- Update to upstream
6071093
- Additional mail ports
6071093
- Add virt_use_usb boolean for svirt
6071093
9386d6f
* Thu Jun 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.16-4
9386d6f
- Fix mcs rules to include chr_file and blk_file
9386d6f
e3bf679
* Tue Jun 16 2009 Dan Walsh <dwalsh@redhat.com> 3.6.16-3
e3bf679
- Add label for udev-acl
e3bf679
f8df9e5
* Mon Jun 15 2009 Dan Walsh <dwalsh@redhat.com> 3.6.16-2
f8df9e5
- Additional rules for consolekit/udev, privoxy and various other fixes
f8df9e5
49883e8
* Fri Jun 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.16-1
d3ae977
- New version for upstream
d3ae977
6b83805
* Thu Jun 11 2009 Dan Walsh <dwalsh@redhat.com> 3.6.14-3
6b83805
- Allow NetworkManager to read inotifyfs
6b83805
aa7b9cb
* Wed Jun 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.14-2
aa7b9cb
- Allow setroubleshoot to run mlocate
aa7b9cb
8197718
* Mon Jun 8 2009 Dan Walsh <dwalsh@redhat.com> 3.6.14-1
8197718
- Update to upstream 
8197718
8197718
* Tue Jun 2 2009 Dan Walsh <dwalsh@redhat.com> 3.6.13-3
8197718
- Add fish as a shell
8197718
- Allow fprintd to list usbfs_t
8197718
- Allow consolekit to search mountpoints
8197718
- Add proper labeling for shorewall
8197718
9ee63df
* Tue May 26 2009 Dan Walsh <dwalsh@redhat.com> 3.6.13-2
9ee63df
- New log file for vmware
9ee63df
- Allow xdm to setattr on user_tmp_t
9ee63df
ef7416c
* Thu May 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.13-1
ef7416c
- Upgrade to upstream
ef7416c
eead2a6
* Wed May 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-39
eead2a6
- Allow fprintd to access sys_ptrace
eead2a6
- Add sandbox policy
eead2a6
7b6c105
* Mon May 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-38
7b6c105
- Add varnishd policy
7b6c105
f72bd44
* Thu May 14 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-37
f72bd44
- Fixes for kpropd
f72bd44
fcb4418
* Tue May 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-36
fcb4418
- Allow brctl to r/w tun_tap_device_t
fcb4418
62cfafd
* Mon May 11 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-35
62cfafd
- Add /usr/share/selinux/packages
62cfafd
0f6b92d
* Mon May 11 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-34
0f6b92d
- Allow rpcd_t to send signals to kernel threads
0f6b92d
9924194
* Fri May 7 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-33
9924194
- Fix upgrade for F10 to F11
9924194
a2098a5
* Thu May 7 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-31
a2098a5
- Add policy for /var/lib/fprint
a2098a5
8a0604e
* Tue May 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-30
8a0604e
-Remove duplicate line
8a0604e
959ab94
* Tue May 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-29
959ab94
- Allow svirt to manage pci and other sysfs device data
959ab94
0e31a0e
* Mon May 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-28
0e31a0e
- Fix package selection handling
0e31a0e
5dd89f3
* Fri May 1 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-27
5dd89f3
- Fix /sbin/ip6tables-save context
c32d79e
- Allod udev to transition to mount
c32d79e
- Fix loading of mls policy file
5dd89f3
37ebfc9
* Thu Apr 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-26
37ebfc9
- Add shorewall policy
37ebfc9
37ebfc9
* Wed Apr 29 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-25
21b13fc
- Additional rules for fprintd and sssd
21b13fc
40d8f60
* Tue Apr 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-24
40d8f60
- Allow nsplugin to unix_read unix_write sem for unconfined_java
40d8f60
b3ac4a0
* Tue Apr 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-23
b3ac4a0
- Fix uml files to be owned by users
b3ac4a0
e080bbd
* Tue Apr 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-22
e080bbd
- Fix Upgrade path to install unconfineduser.pp when unocnfined package is 3.0.0 or less
e080bbd
b11dbbb
* Mon Apr 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-21
e080bbd
- Allow confined users to manage virt_content_t, since this is home dir content
b11dbbb
- Allow all domains to read rpm_script_tmp_t which is what shell creates on redirection
b11dbbb
b0991a2
* Mon Apr 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-20
b0991a2
- Fix labeling on /var/lib/misc/prelink*
b0991a2
- Allow xserver to rw_shm_perms with all x_clients
b0991a2
- Allow prelink to execute files in the users home directory
b0991a2
89c9c9a
* Fri Apr 24 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-19
dac8380
- Allow initrc_t to delete dev_null
dac8380
- Allow readahead to configure auditing
eaaf2ab
- Fix milter policy
eaaf2ab
- Add /var/lib/readahead
dac8380
cd0a396
* Fri Apr 24 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-16
cd0a396
- Update to latest milter code from Paul Howarth
cd0a396
5ce1c49
* Thu Apr 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-15
5ce1c49
- Additional perms for readahead
5ce1c49
4d5adb7
* Thu Apr 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-14
4d5adb7
- Allow pulseaudio to acquire_svc on session bus
4d5adb7
- Fix readahead labeling
4d5adb7
4d5adb7
* Thu Apr 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-13
4d5adb7
- Allow sysadm_t to run rpm directly
4d5adb7
- libvirt needs fowner
4d5adb7
3c498a7
* Wed Apr 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-12
3c498a7
- Allow sshd to read var_lib symlinks for freenx
3c498a7
a32a159
* Tue Apr 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-11
a32a159
- Allow nsplugin unix_read and write on users shm and sem
a32a159
- Allow sysadm_t to execute su
a32a159
a32a159
* Tue Apr 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-10
a32a159
- Dontaudit attempts to getattr user_tmpfs_t by lvm
a32a159
- Allow nfs to share removable media
a32a159
a32a159
* Mon Apr 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-9
a32a159
- Add ability to run postdrop from confined users
a32a159
d982e7e
* Sat Apr 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-8
d982e7e
- Fixes for podsleuth
d982e7e
d982e7e
* Fri Apr 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-7
d982e7e
- Turn off nsplugin transition
d982e7e
- Remove Konsole leaked file descriptors for release
dc00fc3
dc00fc3
* Fri Apr 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-6
6203f42
- Allow cupsd_t to create link files in print_spool_t
dc00fc3
- Fix iscsi_stream_connect typo
dc00fc3
- Fix labeling on /etc/acpi/actions
dc00fc3
- Don't reinstall unconfine and unconfineuser on upgrade if they are not installed
6203f42
4a0aac1
* Tue Apr 14 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-5
4a0aac1
- Allow audioentroy to read etc files
4a0aac1
685032c
* Mon Apr 13 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-4
685032c
- Add fail2ban_var_lib_t
685032c
- Fixes for devicekit_power_t
685032c
d4af172
* Thu Apr 9 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-3
d4af172
- Separate out the ucnonfined user from the unconfined.pp package
d4af172
90e4193
* Wed Apr 7 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-2
90e4193
- Make sure unconfined_java_t and unconfined_mono_t create user_tmpfs_t.
90e4193
25a4763
* Tue Apr 7 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-1
25a4763
- Upgrade to latest upstream
25a4763
- Allow devicekit_disk sys_rawio
25a4763
510c2a3
* Mon Apr 6 2009 Dan Walsh <dwalsh@redhat.com> 3.6.11-1
510c2a3
- Dontaudit binds to ports < 1024 for named
510c2a3
- Upgrade to latest upstream
510c2a3
04b6828
* Fri Apr 3 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-9
04b6828
- Allow podsleuth to use tmpfs files
04b6828
80beeee
* Fri Apr 3 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-8
80beeee
- Add customizable_types for svirt
80beeee
f49c57d
* Fri Apr 3 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-7
f49c57d
- Allow setroubelshoot exec* privs to prevent crash from bad libraries
f49c57d
- add cpufreqselector
f49c57d
90ea5b3
* Thu Apr 2 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-6
90ea5b3
- Dontaudit listing of /root directory for cron system jobs
90ea5b3
3434a9b
* Mon Mar 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-5
3434a9b
- Fix missing ld.so.cache label
3434a9b
c0158a8
* Fri Mar 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-4
c0158a8
- Add label for ~/.forward and /root/.forward
c0158a8
6130d52
* Thu Mar 26 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-3
6130d52
- Fixes for svirt
6130d52
9ca87fc
* Thu Mar 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-2
9ca87fc
- Fixes to allow svirt read iso files in homedir
9ca87fc
5dce3c1
* Thu Mar 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-1
5dce3c1
- Add xenner and wine fixes from mgrepl
5dce3c1
bfc78b6
* Wed Mar 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.9-4
bfc78b6
- Allow mdadm to read/write mls override
bfc78b6
095146a
* Tue Mar 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.9-3
095146a
- Change to svirt to only access svirt_image_t
095146a
d4b8dcf
* Thu Mar 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.9-2
d4b8dcf
- Fix libvirt policy
d4b8dcf
b12011f
* Thu Mar 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.9-1
b12011f
- Upgrade to latest upstream
b12011f
c240b60
* Tue Mar 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.8-4
c240b60
- Fixes for iscsid and sssd
c240b60
- More cleanups for upgrade from F10 to Rawhide.
c240b60
e72f55a
* Mon Mar 9 2009 Dan Walsh <dwalsh@redhat.com> 3.6.8-3
e72f55a
- Add pulseaudio, sssd policy
e72f55a
- Allow networkmanager to exec udevadm
e72f55a
0c34c69
* Sat Mar 7 2009 Dan Walsh <dwalsh@redhat.com> 3.6.8-2
0c34c69
- Add pulseaudio context
0c34c69
a67a1c1
* Thu Mar 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.8-1
a67a1c1
- Upgrade to latest patches
a67a1c1
0a03cce
* Wed Mar 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.7-2
0a03cce
- Fixes for libvirt
0a03cce
8c3a31a
* Mon Mar 2 2009 Dan Walsh <dwalsh@redhat.com> 3.6.7-1
8c3a31a
- Update to Latest upstream
8c3a31a
8c3a31a
* Sat Feb 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-9
8c3a31a
- Fix setrans.conf to show SystemLow for s0
8c3a31a
4967525
* Fri Feb 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-8
4967525
- Further confinement of qemu images via svirt
4967525
150ff59
* Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.6.6-7
150ff59
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
150ff59
52cbcb4
* Thu Feb 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-6
52cbcb4
- Allow NetworkManager to manage /etc/NetworkManager/system-connections
52cbcb4
de67749
* Wed Feb 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-5
de67749
- add virtual_image_context and virtual_domain_context files
de67749
8f6e436
* Tue Feb 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-4
8f6e436
- Allow rpcd_t to send signal to mount_t
8f6e436
- Allow libvirtd to run ranged
8f6e436
8c2b68a
* Tue Feb 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-3
8c2b68a
- Fix sysnet/net_conf_t
8c2b68a
8179476
* Tue Feb 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-2
8179476
- Fix squidGuard labeling
8179476
2eec438
* Wed Feb 11 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-1
2eec438
- Re-add corenet_in_generic_if(unlabeled_t)
2eec438
e46e005
* Wed Feb 11 2009 Dan Walsh <dwalsh@redhat.com> 3.6.5-3
e46e005
1d1c058
* Tue Feb 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.5-2
1d1c058
- Add git web policy
1d1c058
bd0db4f
* Mon Feb 9 2009 Dan Walsh <dwalsh@redhat.com> 3.6.5-1
bd0db4f
- Add setrans contains from upstream 
bd0db4f
bd0db4f
* Mon Feb 9 2009 Dan Walsh <dwalsh@redhat.com> 3.6.4-6
bd0db4f
- Do transitions outside of the booleans
bd0db4f
4ed140a
* Sun Feb 8 2009 Dan Walsh <dwalsh@redhat.com> 3.6.4-5
4ed140a
- Allow xdm to create user_tmp_t sockets for switch user to work
4ed140a
bc861e6
* Thu Feb 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.4-4
bc861e6
- Fix staff_t domain
bc861e6
73fe81b
* Thu Feb 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.4-3
73fe81b
- Grab remainder of network_peer_controls patch
73fe81b
659e96f
* Wed Feb 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.4-2
659e96f
- More fixes for devicekit
659e96f
c957c38
* Tue Feb 3 2009 Dan Walsh <dwalsh@redhat.com> 3.6.4-1
c957c38
- Upgrade to latest upstream 
c957c38
574cab4
* Mon Feb 2 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-13
574cab4
- Add boolean to disallow unconfined_t login
574cab4
0554a10
* Fri Jan 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-12
0554a10
- Add back transition from xguest to mozilla
0554a10
ab3e55d
* Fri Jan 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-11
ab3e55d
- Add virt_content_ro_t and labeling for isos directory
ab3e55d
f899107
* Tue Jan 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-10
f899107
- Fixes for wicd daemon
f899107
48adbea
* Mon Jan 26 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-9
48adbea
- More mls/rpm fixes 
48adbea
14c9b9c
* Fri Jan 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-8
14c9b9c
- Add policy to make dbus/nm-applet work
14c9b9c
40dd24d
* Thu Jan 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-7
40dd24d
- Remove polgen-ifgen from post and add trigger to policycoreutils-python
40dd24d
6f8856e
* Wed Jan 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-6
1b94a13
- Add wm policy
6cf32a1
- Make mls work in graphics mode
1b94a13
2a4bdae
* Tue Jan 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-3
2a4bdae
- Fixed for DeviceKit
2a4bdae
acc1376
* Mon Jan 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-2
acc1376
- Add devicekit policy
acc1376
1d72fb0
* Mon Jan 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-1
1d72fb0
- Update to upstream
1d72fb0
eacea1d
* Thu Jan 15 2009 Dan Walsh <dwalsh@redhat.com> 3.6.2-5
eacea1d
- Define openoffice as an x_domain
eacea1d
339bf3b
* Mon Jan 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.2-4
339bf3b
- Fixes for reading xserver_tmp_t
339bf3b
87fb153
* Thu Jan 8 2009 Dan Walsh <dwalsh@redhat.com> 3.6.2-3
87fb153
- Allow cups_pdf_t write to nfs_t
87fb153
2ed2ff4
* Tue Jan 6 2009 Dan Walsh <dwalsh@redhat.com> 3.6.2-2
2ed2ff4
- Remove audio_entropy policy
2ed2ff4
292c49c
* Mon Jan 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.2-1
292c49c
- Update to upstream
292c49c
5df2628
* Sun Jan 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.1-15
5df2628
- Allow hal_acl_t to getattr/setattr fixed_disk
5df2628
3236390
* Sat Dec 27 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-14
3236390
- Change userdom_read_all_users_state to include reading symbolic links in /proc
3236390
cf8fd9f
* Mon Dec 22 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-13
cf8fd9f
- Fix dbus reading /proc information
cf8fd9f
bae2e98
* Thu Dec 18 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-12
bae2e98
- Add missing alias for home directory content
bae2e98
33c7eab
* Wed Dec 17 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-11
33c7eab
- Fixes for IBM java location
33c7eab
dcd0c96
* Thu Dec 11 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-10
dcd0c96
- Allow unconfined_r unconfined_java_t
dcd0c96
fd2b62e
* Tue Dec 9 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-9
fd2b62e
- Add cron_role back to user domains
fd2b62e
9a43d2b
* Mon Dec 8 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-8
9a43d2b
- Fix sudo setting of user keys
9a43d2b
2ae1615
* Thu Dec 4 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-7
01ce3df
- Allow iptables to talk to terminals
2ae1615
- Fixes for policy kit
2ae1615
- lots of fixes for booting. 
01ce3df
bcb1922
* Wed Dec 3 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-4
739db21
- Cleanup policy
739db21
23d6844
* Mon Dec 01 2008 Ignacio Vazquez-Abrams <ivazqueznet+rpm@gmail.com> - 3.6.1-2
23d6844
- Rebuild for Python 2.6
23d6844
02d888c
* Fri Nov 5 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-19
02d888c
- Fix labeling on /var/spool/rsyslog
02d888c
0d6e623
* Thu Nov 5 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-18
0d6e623
- Allow postgresl to bind to udp nodes
0d6e623
2a650ea
* Wed Nov 5 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-17
2a650ea
- Allow lvm to dbus chat with hal
2a650ea
- Allow rlogind to read nfs_t 
2a650ea
074b12f
* Wed Nov 5 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-16
074b12f
- Fix cyphesis file context
074b12f
6a09cfb
* Tue Nov 3 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-15
6a09cfb
- Allow hal/pm-utils to look at /var/run/video.rom
6a09cfb
- Add ulogd policy
6a09cfb
411a424
* Tue Nov 3 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-14
411a424
- Additional fixes for cyphesis
411a424
- Fix certmaster file context
411a424
- Add policy for system-config-samba
6a09cfb
- Allow hal to read /var/run/video.rom
411a424
333ebd6
* Mon Nov 3 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-13
333ebd6
- Allow dhcpc to restart ypbind
333ebd6
- Fixup labeling in /var/run
333ebd6
333ebd6
* Thu Oct 30 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-12
333ebd6
- Add certmaster policy
333ebd6
1bc89b8
* Wed Oct 29 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-11
2362056
- Fix confined users 
2362056
- Allow xguest to read/write xguest_dbusd_t
2362056
a3e038c
* Mon Oct 27 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-9
a3e038c
- Allow openoffice execstack/execmem privs
a3e038c
4fa9db7
* Fri Oct 24 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-8
4fa9db7
- Allow mozilla to run with unconfined_execmem_t
4fa9db7
798a73d
* Thu Oct 23 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-7
798a73d
- Dontaudit domains trying to write to .xsession-errors
798a73d
3281238
* Thu Oct 23 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-6
3281238
- Allow nsplugin to look at autofs_t directory
3281238
de61cc7
* Wed Oct 22 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-5
de61cc7
- Allow kerneloops to create tmp files
de61cc7
ae68d97
* Wed Oct 22 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-4
ae68d97
- More alias for fastcgi
ae68d97
236d3cc
* Tue Oct 21 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-3
236d3cc
- Remove mod_fcgid-selinux package
236d3cc
b9e15d9
* Mon Oct 20 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-2
b9e15d9
- Fix dovecot access
b9e15d9
49f48f4
* Fri Oct 17 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-1
49f48f4
- Policy cleanup 
49f48f4
6115689
* Thu Oct 16 2008 Dan Walsh <dwalsh@redhat.com> 3.5.12-3
6115689
- Remove Multiple spec
6115689
- Add include
6115689
- Fix makefile to not call per_role_expansion
6115689
4b4392d
* Wed Oct 15 2008 Dan Walsh <dwalsh@redhat.com> 3.5.12-2
4b4392d
- Fix labeling of libGL
4b4392d
b6cc6a8
* Fri Oct 10 2008 Dan Walsh <dwalsh@redhat.com> 3.5.12-1
b6cc6a8
- Update to upstream
b6cc6a8
675bbab
* Wed Oct 8 2008 Dan Walsh <dwalsh@redhat.com> 3.5.11-1
675bbab
- Update to upstream policy
675bbab
1062bd3
* Mon Oct 6 2008 Dan Walsh <dwalsh@redhat.com> 3.5.10-3
1062bd3
- Fixes for confined xwindows and xdm_t 
1062bd3
86369ef
* Fri Oct 3 2008 Dan Walsh <dwalsh@redhat.com> 3.5.10-2
86369ef
- Allow confined users and xdm to exec wm
86369ef
- Allow nsplugin to talk to fifo files on nfs
86369ef
f1a8278
* Fri Oct 3 2008 Dan Walsh <dwalsh@redhat.com> 3.5.10-1
f1a8278
- Allow NetworkManager to transition to avahi and iptables
b42a1ed
- Allow domains to search other domains keys, coverup kernel bug
b42a1ed
094ef3d
* Wed Oct 1 2008 Dan Walsh <dwalsh@redhat.com> 3.5.9-4
094ef3d
- Fix labeling for oracle 
094ef3d
2ede4ec
* Wed Oct 1 2008 Dan Walsh <dwalsh@redhat.com> 3.5.9-3
2ede4ec
- Allow nsplugin to comminicate with xdm_tmp_t sock_file
2ede4ec
9987374
* Mon Sep 29 2008 Dan Walsh <dwalsh@redhat.com> 3.5.9-2
9987374
- Change all user tmpfs_t files to be labeled user_tmpfs_t
9987374
- Allow radiusd to create sock_files
9987374
b709ffd
* Wed Sep 24 2008 Dan Walsh <dwalsh@redhat.com> 3.5.9-1
b709ffd
- Upgrade to upstream
b709ffd
ed32c64
* Tue Sep 23 2008 Dan Walsh <dwalsh@redhat.com> 3.5.8-7
ed32c64
- Allow confined users to login with dbus
ed32c64
d86efe5
* Mon Sep 22 2008 Dan Walsh <dwalsh@redhat.com> 3.5.8-6
d86efe5
- Fix transition to nsplugin
d86efe5
f0375d5
* Mon Sep 22 2008 Dan Walsh <dwalsh@redhat.com> 3.5.8-5
f0375d5
- Add file context for /dev/mspblk.*
f0375d5
f77dd2c
* Sun Sep 21 2008 Dan Walsh <dwalsh@redhat.com> 3.5.8-4
f77dd2c
- Fix transition to nsplugin
f77dd2c
'
11ef247
* Thu Sep 18 2008 Dan Walsh <dwalsh@redhat.com> 3.5.8-3
530772a
- Fix labeling on new pm*log
530772a
- Allow ssh to bind to all nodes
530772a
16c3ff1
* Thu Sep 11 2008 Dan Walsh <dwalsh@redhat.com> 3.5.8-1
16c3ff1
- Merge upstream changes
16c3ff1
- Add Xavier Toth patches
16c3ff1
16c3ff1
* Wed Sep 10 2008 Dan Walsh <dwalsh@redhat.com> 3.5.7-2
16c3ff1
- Add qemu_cache_t for /var/cache/libvirt
16c3ff1
aca77a6
* Fri Sep 5 2008 Dan Walsh <dwalsh@redhat.com> 3.5.7-1
aca77a6
- Remove gamin policy
aca77a6
d0d3073
* Thu Sep 4 2008 Dan Walsh <dwalsh@redhat.com> 3.5.6-2
d0d3073
- Add tinyxs-max file system support
d0d3073
0a219fe
* Wed Sep 3 2008 Dan Walsh <dwalsh@redhat.com> 3.5.6-1
0a219fe
- Update to upstream
0a219fe
- 	 New handling of init scripts
0a219fe
0a219fe
* Fri Aug 29 2008 Dan Walsh <dwalsh@redhat.com> 3.5.5-4
0a219fe
- Allow pcsd to dbus
0a219fe
- Add memcache policy
0a219fe
3ad3552
* Fri Aug 29 2008 Dan Walsh <dwalsh@redhat.com> 3.5.5-3
3ad3552
- Allow audit dispatcher to kill his children
3ad3552
cd8bee5
* Tue Aug 26 2008 Dan Walsh <dwalsh@redhat.com> 3.5.5-2
cd8bee5
- Update to upstream
cd8bee5
- Fix crontab use by unconfined user
cd8bee5
eb7e6dc
* Tue Aug 12 2008 Dan Walsh <dwalsh@redhat.com> 3.5.4-2
eb7e6dc
- Allow ifconfig_t to read dhcpc_state_t
eb7e6dc
1a0f642
* Mon Aug 11 2008 Dan Walsh <dwalsh@redhat.com> 3.5.4-1
1a0f642
- Update to upstream
1a0f642
b5d09d1
* Thu Aug 7 2008 Dan Walsh <dwalsh@redhat.com> 3.5.3-1
b5d09d1
- Update to upstream 
b5d09d1
0f1bd62
* Wed Aug 2 2008 Dan Walsh <dwalsh@redhat.com> 3.5.2-2
0f1bd62
- Allow system-config-selinux to work with policykit
0f1bd62
170fa29
* Fri Jul 25 2008 Dan Walsh <dwalsh@redhat.com> 3.5.1-5
170fa29
- Fix novel labeling
170fa29
07bd5c4
* Fri Jul 25 2008 Dan Walsh <dwalsh@redhat.com> 3.5.1-4
07bd5c4
- Consolodate pyzor,spamassassin, razor into one security domain
07bd5c4
- Fix xdm requiring additional perms.
07bd5c4
8f2532e
* Fri Jul 25 2008 Dan Walsh <dwalsh@redhat.com> 3.5.1-3
8f2532e
- Fixes for logrotate, alsa
8f2532e
f12d5b9
* Thu Jul 25 2008 Dan Walsh <dwalsh@redhat.com> 3.5.1-2
f12d5b9
- Eliminate vbetool duplicate entry
f12d5b9
feefeee
* Wed Jul 16 2008 Dan Walsh <dwalsh@redhat.com> 3.5.1-1
feefeee
- Fix xguest -> xguest_mozilla_t -> xguest_openiffice_t
0b05335
- Change dhclient to be able to red networkmanager_var_run
feefeee
078ad09
* Tue Jul 15 2008 Dan Walsh <dwalsh@redhat.com> 3.5.0-1
6ed8533
- Update to latest refpolicy
078ad09
- Fix libsemanage initial install bug
6ed8533
6db69f0
* Wed Jul 9 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-14
6db69f0
- Add inotify support to nscd
6db69f0
43f9fce
* Tue Jul 8 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-13
43f9fce
- Allow unconfined_t to setfcap
43f9fce
273a44c
* Mon Jul 7 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-12
273a44c
- Allow amanda to read tape
273a44c
- Allow prewikka cgi to use syslog, allow audisp_t to signal cgi
273a44c
- Add support for netware file systems
273a44c
258b00e
* Thu Jul 3 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-11
258b00e
- Allow ypbind apps to net_bind_service
258b00e
75edec4
* Wed Jul 2 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-10
75edec4
- Allow all system domains and application domains to append to any log file
75edec4
cd60b64
* Sun Jun 29 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-9
cd60b64
- Allow gdm to read rpm database
cd60b64
- Allow nsplugin to read mplayer config files
cd60b64
c186814
* Thu Jun 26 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-8
c186814
- Allow vpnc to run ifconfig
c186814
f86ed5a
* Tue Jun 24 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-7
f86ed5a
- Allow confined users to use postgres
f86ed5a
- Allow system_mail_t to exec other mail clients
f86ed5a
- Label mogrel_rails as an apache server
f86ed5a
547aa2a
* Mon Jun 23 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-6
547aa2a
- Apply unconfined_execmem_exec_t to haskell programs
547aa2a
6959e0b
* Sun Jun 22 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-5
6959e0b
- Fix prelude file context
6959e0b
fe0d467
* Fri Jun 12 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-4
fe0d467
- allow hplip to talk dbus
fe0d467
- Fix context on ~/.local dir
fe0d467
f4ff8bb
* Thu Jun 12 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-3
f4ff8bb
- Prevent applications from reading x_device
f4ff8bb
5608a9d
* Thu Jun 12 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-2
5608a9d
- Add /var/lib/selinux context
5608a9d
c5c253f
* Wed Jun 11 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-1
c5c253f
- Update to upstream 
c5c253f
f513c7b
* Wed Jun 4 2008 Dan Walsh <dwalsh@redhat.com> 3.4.1-5
15f71c5
- Add livecd policy
15f71c5
15f71c5
* Wed Jun 4 2008 Dan Walsh <dwalsh@redhat.com> 3.4.1-3
91ec07f
- Dontaudit search of admin_home for init_system_domain
91ec07f
- Rewrite of xace interfaces
91ec07f
- Lots of new fs_list_inotify
91ec07f
- Allow livecd to transition to setfiles_mac
91ec07f
80e0b80
* Fri May 9 2008 Dan Walsh <dwalsh@redhat.com> 3.4.1-2
80e0b80
- Begin XAce integration
80e0b80
4b7f030
* Fri May 9 2008 Dan Walsh <dwalsh@redhat.com> 3.4.1-1
4b7f030
- Merge Upstream
4b7f030
993c27d
* Wed May 7 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-48
993c27d
- Allow amanada to create data files
993c27d
993c27d
* Wed May 7 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-47
993c27d
- Fix initial install, semanage setup
993c27d
993c27d
* Tue May 6 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-46
993c27d
- Allow system_r for httpd_unconfined_script_t
993c27d
6c25b42
* Wed Apr 30 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-45
6c25b42
- Remove dmesg boolean
6c25b42
- Allow user domains to read/write game data
6c25b42
86881dd
* Mon Apr 28 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-44
86881dd
- Change unconfined_t to transition to unconfined_mono_t when running mono
86881dd
- Change XXX_mono_t to transition to XXX_t when executing bin_t files, so gnome-do will work
86881dd
2d8ff51
* Mon Apr 28 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-43
2d8ff51
- Remove old booleans from targeted-booleans.conf file
2d8ff51
2d8ff51
* Fri Apr 25 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-42
2d8ff51
- Add boolean to mmap_zero
2d8ff51
- allow tor setgid
2d8ff51
- Allow gnomeclock to set clock
2d8ff51
b4e9331
* Thu Apr 24 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-41
ef5e600
- Don't run crontab from unconfined_t
ef5e600
4b1d56d
* Wed Apr 23 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-39
4b1d56d
- Change etc files to config files to allow users to read them
4b1d56d
4b1d56d
* Fri Apr 14 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-37
4b1d56d
- Lots of fixes for confined domains on NFS_t homedir
4b1d56d
a6a82ae
* Mon Apr 14 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-36
a6a82ae
- dontaudit mrtg reading /proc
a6a82ae
- Allow iscsi to signal itself
a6a82ae
- Allow gnomeclock sys_ptrace
bb36d75
06686c2
* Thu Apr 10 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-33
06686c2
- Allow dhcpd to read kernel network state
06686c2
41625a2
* Thu Apr 10 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-32
41625a2
- Label /var/run/gdm correctly
41625a2
- Fix unconfined_u user creation
41625a2
254e3c7
* Tue Apr 8 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-31
254e3c7
- Allow transition from initrc_t to getty_t
254e3c7
5a576e0
* Tue Apr 8 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-30
5a576e0
- Allow passwd to communicate with user sockets to change gnome-keyring
5a576e0
c3c4a52
* Sat Apr 5 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-29
7f851af
- Fix initial install
c3c4a52
27943de
* Fri Apr 4 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-28
27943de
- Allow radvd to use fifo_file
27943de
- dontaudit setfiles reading links
27943de
- allow semanage sys_resource
27943de
- add allow_httpd_mod_auth_ntlm_winbind boolean
27943de
- Allow privhome apps including dovecot read on nfs and cifs home 
27943de
dirs if the boolean is set
27943de
27943de
c66f2bc
* Tue Apr 1 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-27
c66f2bc
- Allow nsplugin to read /etc/mozpluggerrc, user_fonts
c66f2bc
- Allow syslog to manage innd logs.
c66f2bc
- Allow procmail to ioctl spamd_exec_t
c66f2bc
294ea7a
* Sat Mar 28 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-26
294ea7a
- Allow initrc_t to dbus chat with consolekit.
294ea7a
e54cb21
* Thu Mar 27 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-25
e54cb21
- Additional access for nsplugin
e54cb21
- Allow xdm setcap/getcap until pulseaudio is fixed
e54cb21
f70afcd
* Tue Mar 25 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-24
f70afcd
- Allow mount to mkdir on tmpfs
f70afcd
- Allow ifconfig to search debugfs
f70afcd
bf3d39e
* Fri Mar 18 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-23
bf3d39e
- Fix file context for MATLAB
bf3d39e
- Fixes for xace
bf3d39e
94b7be9
* Tue Mar 18 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-22
5ea3f10
- Allow stunnel to transition to inetd children domains
5ea3f10
- Make unconfined_dbusd_t an unconfined domain 
94b7be9
ba9e5e8
* Mon Mar 17 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-21
ba9e5e8
- Fixes for qemu/virtd
ba9e5e8
a6e1280
* Fri Mar 14 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-20
a6e1280
- Fix bug in mozilla policy to allow xguest transition
a6e1280
- This will fix the 
a6e1280
a6e1280
libsemanage.dbase_llist_query: could not find record value
a6e1280
libsemanage.dbase_llist_query: could not query record value (No such file or
a6e1280
directory)
a6e1280
 bug in xguest
a6e1280
d593d26
* Fri Mar 14 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-19
d593d26
- Allow nsplugin to run acroread
d593d26
987b10f
* Thu Mar 13 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-18
987b10f
- Add cups_pdf policy
987b10f
- Add openoffice policy to run in xguest
987b10f
7f811bf
* Thu Mar 13 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-17
7f811bf
- prewika needs to contact mysql
7f811bf
- Allow syslog to read system_map files
7f811bf
ceda8fe
* Wed Mar 12 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-16
ceda8fe
- Change init_t to an unconfined_domain
ceda8fe
0879f48
* Tue Mar 11 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-15
0879f48
- Allow init to transition to initrc_t on shell exec.
0879f48
- Fix init to be able to sendto init_t.
0879f48
- Allow syslog to connect to mysql
0879f48
- Allow lvm to manage its own fifo_files
0879f48
- Allow bugzilla to use ldap
0879f48
- More mls fixes 
0879f48
110bce3
* Tue Mar 11 2008 Bill Nottingham <notting@redhat.com> 3.3.1-14
110bce3
- fixes for init policy (#436988)
110bce3
- fix build
110bce3
2041ac3
* Mon Mar 10 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-13
2041ac3
- Additional changes for MLS policy
2041ac3
1bf67d5
* Thu Mar 6 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-12
1bf67d5
- Fix initrc_context generation for MLS
1bf67d5
dc57e68
* Mon Mar 3 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-11
dc57e68
- Fixes for libvirt
dc57e68
5947905
* Mon Mar 3 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-10
5947905
- Allow bitlebee to read locale_t
5947905
d8c1602
* Fri Feb 29 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-9
d8c1602
- More xselinux rules
d8c1602
9a0f35b
* Thu Feb 28 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-8
9a0f35b
- Change httpd_$1_script_r*_t to httpd_$1_content_r*_t
338714f
40ce268
* Wed Feb 27 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-6
40ce268
- Prepare policy for beta release
40ce268
- Change some of the system domains back to unconfined
40ce268
- Turn on some of the booleans
40ce268
533c755
* Tue Feb 26 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-5
533c755
- Allow nsplugin_config execstack/execmem
533c755
- Allow nsplugin_t to read alsa config
533c755
- Change apache to use user content 
533c755
c092cc1
* Tue Feb 26 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-4
c092cc1
- Add cyphesis policy
c092cc1
27b2b09
* Tue Feb 26 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-2
063999d
- Fix Makefile.devel to build mls modules
063999d
- Fix qemu to be more specific on labeling
063999d
27b2b09
f75033d
* Tue Feb 26 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-1
f75033d
- Update to upstream fixes
f75033d
f75033d
* Fri Feb 22 2008 Dan Walsh <dwalsh@redhat.com> 3.3.0-2
f75033d
- Allow staff to mounton user_home_t
f75033d
5ca2ff9
* Fri Feb 22 2008 Dan Walsh <dwalsh@redhat.com> 3.3.0-1
5ca2ff9
- Add xace support
5ca2ff9
8bd036a
* Thu Feb 21 2008 Dan Walsh <dwalsh@redhat.com> 3.2.9-2
8bd036a
- Add fusectl file system
8bd036a
e5acebe
* Wed Feb 20 2008 Dan Walsh <dwalsh@redhat.com> 3.2.9-1
541ba8e
- Fixes from yum-cron
541ba8e
- Update to latest upstream
541ba8e
e5acebe
3063935
* Tue Feb 19 2008 Dan Walsh <dwalsh@redhat.com> 3.2.8-2
3063935
- Fix userdom_list_user_files
3063935
3063935
eb3e9fb
* Fri Feb 15 2008 Dan Walsh <dwalsh@redhat.com> 3.2.8-1
eb3e9fb
- Merge with upstream
eb3e9fb
7e1e7be
* Thu Feb 5 2008 Dan Walsh <dwalsh@redhat.com> 3.2.7-6
7e1e7be
- Allow udev to send audit messages
7e1e7be
9870c64
* Thu Feb 5 2008 Dan Walsh <dwalsh@redhat.com> 3.2.7-5
9870c64
- Add additional login users interfaces
9870c64
  -     userdom_admin_login_user_template(staff)
9870c64
ebe074b
* Thu Feb 5 2008 Dan Walsh <dwalsh@redhat.com> 3.2.7-3
ebe074b
- More fixes for polkit
ebe074b
ebe074b
* Thu Feb 5 2008 Dan Walsh <dwalsh@redhat.com> 3.2.7-2
ebe074b
- Eliminate transition from unconfined_t to qemu by default
ebe074b
- Fixes for gpg
ebe074b
57ac1ca
* Tue Feb 5 2008 Dan Walsh <dwalsh@redhat.com> 3.2.7-1
57ac1ca
- Update to upstream
57ac1ca
4637b67
* Tue Feb 5 2008 Dan Walsh <dwalsh@redhat.com> 3.2.6-7
4637b67
- Fixes for staff_t
4637b67
b53db53
* Tue Feb 5 2008 Dan Walsh <dwalsh@redhat.com> 3.2.6-6
b53db53
- Add policy for kerneloops
b53db53
- Add policy for gnomeclock
b53db53
881d64a
* Mon Feb 4 2008 Dan Walsh <dwalsh@redhat.com> 3.2.6-5
881d64a
- Fixes for libvirt
881d64a
60c693e
* Sun Feb 3 2008 Dan Walsh <dwalsh@redhat.com> 3.2.6-4
60c693e
- Fixes for nsplugin
60c693e
60c693e
* Sat Feb 2 2008 Dan Walsh <dwalsh@redhat.com> 3.2.6-3
60c693e
- More fixes for qemu
60c693e
11ac4bc
* Sat Feb 2 2008 Dan Walsh <dwalsh@redhat.com> 3.2.6-2
11ac4bc
- Additional ports for vnc and allow qemu and libvirt to search all directories
11ac4bc
b19d470
* Fri Feb 1 2008 Dan Walsh <dwalsh@redhat.com> 3.2.6-1
b19d470
- Update to upstream
b19d470
- Add libvirt policy
b19d470
- add qemu policy
b19d470
e1060e2
* Fri Feb 1 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-25
e1060e2
- Allow fail2ban to create a socket in /var/run
e1060e2
59d6fbb
* Wed Jan 30 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-24
7c124f5
- Allow allow_httpd_mod_auth_pam to work
7c124f5
f18a882
* Wed Jan 30 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-22
f18a882
- Add audisp policy and prelude
f18a882
0f70114
* Mon Jan 28 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-21
0f70114
- Allow all user roles to executae samba net command
0f70114
7c2be34
* Fri Jan 25 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-20
7c2be34
- Allow usertypes to read/write noxattr file systems
7c2be34
7c7d599
* Thu Jan 24 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-19
7c7d599
- Fix nsplugin to allow flashplugin to work in enforcing mode
7c7d599
0939872
* Wed Jan 23 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-18
0939872
- Allow pam_selinux_permit to kill all processes
0939872
cc5bb89
* Mon Jan 21 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-17
cc5bb89
- Allow ptrace or user processes by users of same type
cc5bb89
- Add boolean for transition to nsplugin
cc5bb89
ef19b75
* Mon Jan 21 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-16
ef19b75
- Allow nsplugin sys_nice, getsched, setsched
ef19b75
b3c8a04
* Mon Jan 21 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-15
b3c8a04
- Allow login programs to talk dbus to oddjob
b3c8a04
98f84cb
* Thu Jan 17 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-14
98f84cb
- Add procmail_log support
98f84cb
- Lots of fixes for munin
98f84cb
e26fef9
* Tue Jan 15 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-13
e26fef9
- Allow setroubleshoot to read policy config and send audit messages
e26fef9
8a40d69
* Mon Jan 14 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-12
8a40d69
- Allow users to execute all files in homedir, if boolean set
8a40d69
- Allow mount to read samba config
8a40d69
27c7d85
* Sun Jan 13 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-11
27c7d85
- Fixes for xguest to run java plugin
27c7d85
4be3ba5
* Mon Jan 7 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-10
4be3ba5
- dontaudit pam_t and dbusd writing to user_home_t
4be3ba5
5baf53a
* Mon Jan 7 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-9
5baf53a
- Update gpg to allow reading of inotify
5baf53a
a502c55
* Wed Jan 2 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-8
a502c55
- Change user and staff roles to work correctly with varied perms
a502c55
c64ec27
* Mon Dec 31 2007 Dan Walsh <dwalsh@redhat.com> 3.2.5-7
c64ec27
- Fix munin log,
c64ec27
- Eliminate duplicate mozilla file context
c64ec27
- fix wpa_supplicant spec
c64ec27
5d13344
* Mon Dec 24 2007 Dan Walsh <dwalsh@redhat.com> 3.2.5-6
88ae3f5
- Fix role transition from unconfined_r to system_r when running rpm
88ae3f5
- Allow unconfined_domains to communicate with user dbus instances
5d13344
5d13344
* Sat Dec 21 2007 Dan Walsh <dwalsh@redhat.com> 3.2.5-5
5d13344
- Fixes for xguest
5d13344
0ec33db
* Thu Dec 20 2007 Dan Walsh <dwalsh@redhat.com> 3.2.5-4
0ec33db
- Let all uncofined domains communicate with dbus unconfined
0ec33db
673eaae
* Thu Dec 20 2007 Dan Walsh <dwalsh@redhat.com> 3.2.5-3
673eaae
- Run rpm in system_r
673eaae
5615fe1
* Wed Dec 19 2007 Dan Walsh <dwalsh@redhat.com> 3.2.5-2
5615fe1
- Zero out customizable types
5615fe1
9a2cf87
* Wed Dec 19 2007 Dan Walsh <dwalsh@redhat.com> 3.2.5-1
9a2cf87
- Fix definiton of admin_home_t
9a2cf87
2f257cb
* Wed Dec 19 2007 Dan Walsh <dwalsh@redhat.com> 3.2.4-5
2f257cb
- Fix munin file context
2f257cb
91c2fa9
* Tue Dec 18 2007 Dan Walsh <dwalsh@redhat.com> 3.2.4-4
91c2fa9
- Allow cron to run unconfined apps
91c2fa9
99d3676
* Mon Dec 17 2007 Dan Walsh <dwalsh@redhat.com> 3.2.4-3
99d3676
- Modify default login to unconfined_u
99d3676
5928688
* Thu Dec 13 2007 Dan Walsh <dwalsh@redhat.com> 3.2.4-1
5928688
- Dontaudit dbus user client search of /root
5928688
76e3401
* Wed Dec 12 2007 Dan Walsh <dwalsh@redhat.com> 3.2.4-1
76e3401
- Update to upstream
76e3401
4c6f2dd
* Tue Dec 11 2007 Dan Walsh <dwalsh@redhat.com> 3.2.3-2
4c6f2dd
- Fixes for polkit
4c6f2dd
- Allow xserver to ptrace
4c6f2dd
7dfe3eb
* Tue Dec 11 2007 Dan Walsh <dwalsh@redhat.com> 3.2.3-1
7dfe3eb
- Add polkit policy
7dfe3eb
- Symplify userdom context, remove automatic per_role changes
7dfe3eb
d195fc7
* Tue Dec 4 2007 Dan Walsh <dwalsh@redhat.com> 3.2.2-1
02654b8
- Update to upstream
d195fc7
- Allow httpd_sys_script_t to search users homedirs
d195fc7
320f3e6
* Mon Dec 3 2007 Dan Walsh <dwalsh@redhat.com> 3.2.1-3
320f3e6
- Allow rpm_script to transition to unconfined_execmem_t
320f3e6
9186dc5
* Fri Nov 30 2007 Dan Walsh <dwalsh@redhat.com> 3.2.1-1
9186dc5
- Remove user based home directory separation
9186dc5
3a54e48
* Wed Nov 28 2007 Dan Walsh <dwalsh@redhat.com> 3.1.2-2
3a54e48
- Remove user specific crond_t
3a54e48
a1341a8
* Mon Nov 19 2007 Dan Walsh <dwalhh@redhat.com> 3.1.2-1
0fffbad
- Merge with upstream
0fffbad
- Allow xsever to read hwdata_t
0fffbad
- Allow login programs to setkeycreate
0fffbad
7330e86
* Sat Nov 10 2007 Dan Walsh <dwalsh@redhat.com> 3.1.1-1
7330e86
- Update to upstream
7330e86
fa0d1c8
* Mon Oct 22 2007 Dan Walsh <dwalsh@redhat.com> 3.1.0-1
fa0d1c8
- Update to upstream
fa0d1c8
fa0d1c8
* Mon Oct 22 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-30
d0649e9
- Allow XServer to read /proc/self/cmdline
fa0d1c8
- Fix unconfined cron jobs
fa0d1c8
- Allow fetchmail to transition to procmail
fa0d1c8
- Fixes for hald_mac
fa0d1c8
- Allow system_mail to transition to exim
fa0d1c8
- Allow tftpd to upload files
fa0d1c8
- Allow xdm to manage unconfined_tmp
fa0d1c8
- Allow udef to read alsa config
fa0d1c8
- Fix xguest to be able to connect to sound port
d0649e9
30dfdc7
* Fri Oct 17 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-28
30dfdc7
- Fixes for hald_mac 
30dfdc7
- Treat unconfined_home_dir_t as a home dir
30dfdc7
- dontaudit rhgb writes to fonts and root
30dfdc7
3375c34
* Fri Oct 17 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-27
3375c34
- Fix dnsmasq
3375c34
- Allow rshd full login privs
3375c34
6455c9d
* Thu Oct 16 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-26
6455c9d
- Allow rshd to connect to ports > 1023
6455c9d
ccf8a72
* Thu Oct 16 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-25
ccf8a72
- Fix vpn to bind to port 4500
ccf8a72
- Allow ssh to create shm
953fd14
- Add Kismet policy
ccf8a72
b4ed6db
* Tue Oct 16 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-24
b4ed6db
- Allow rpm to chat with networkmanager
b4ed6db
b4ed6db
* Mon Oct 15 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-23
b4ed6db
- Fixes for ipsec and exim mail
b4ed6db
- Change default to unconfined user
b4ed6db
9185bf2
* Fri Oct 12 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-22
9185bf2
- Pass the UNK_PERMS param to makefile
9185bf2
- Fix gdm location
9185bf2
c27b2bd
* Wed Oct 10 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-21
c27b2bd
- Make alsa work
c27b2bd
28021c8
* Tue Oct 9 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-20
28021c8
- Fixes for consolekit and startx sessions
28021c8
7a91e89
* Mon Oct 8 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-19
7a91e89
- Dontaudit consoletype talking to unconfined_t
7a91e89
922f646
* Thu Oct 4 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-18
922f646
- Remove homedir_template
922f646
24ccb8b
* Tue Oct 2 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-17
24ccb8b
- Check asound.state
24ccb8b
492612d
* Mon Oct 1 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-16
492612d
- Fix exim policy
492612d
1ffa684
* Thu Sep 24 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-15
1ffa684
- Allow tmpreadper to read man_t
1ffa684
- Allow racoon to bind to all nodes
1ffa684
- Fixes for finger print reader
1ffa684
7c1c172
* Tue Sep 24 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-14
7c1c172
- Allow xdm to talk to input device (fingerprint reader)
7c1c172
- Allow octave to run as java
7c1c172
d770c53
* Tue Sep 24 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-13
d770c53
- Allow login programs to set ioctl on /proc
d770c53
fb11ad6
* Mon Sep 24 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-12
fb11ad6
- Allow nsswitch apps to read samba_var_t
fb11ad6
f5018f1
* Mon Sep 24 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-11
f5018f1
- Fix maxima
f5018f1
d83ea80
* Mon Sep 24 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-10
d83ea80
- Eliminate rpm_t:fifo_file avcs
d83ea80
- Fix dbus path for helper app
d83ea80
6c319e4
* Sat Sep 22 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-9
6c319e4
- Fix service start stop terminal avc's
6c319e4
ec4fb1c
* Fri Sep 21 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-8
ec4fb1c
- Allow also to search var_lib
ec4fb1c
- New context for dbus launcher 
ec4fb1c
347ff1a
* Fri Sep 21 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-7
347ff1a
- Allow cupsd_config_t to read/write usb_device_t
347ff1a
- Support for finger print reader,
347ff1a
- Many fixes for clvmd
347ff1a
- dbus starting networkmanager
347ff1a
07e28d1
* Thu Sep 20 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-5
07e28d1
- Fix java and mono to run in xguest account
07e28d1
c67a121
* Wed Sep 19 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-4
c67a121
- Fix to add xguest account when inititial install
a9d4b80
- Allow mono, java, wine to run in userdomains
c67a121
21c534b
* Wed Sep 19 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-3
21c534b
- Allow xserver to search devpts_t
21c534b
- Dontaudit ldconfig output to homedir
21c534b
7ff410d
* Tue Sep 18 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-2
7ff410d
- Remove hplip_etc_t change back to etc_t.
7ff410d
7ff410d
1a3fe36
* Mon Sep 17 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-1
1a3fe36
- Allow cron to search nfs and samba homedirs
1a3fe36
babb364
* Tue Sep 11 2007 Dan Walsh <dwalsh@redhat.com> 3.0.7-10
babb364
- Allow NetworkManager to dbus chat with yum-updated
babb364
bf7f975
* Tue Sep 11 2007 Dan Walsh <dwalsh@redhat.com> 3.0.7-9
bf7f975
- Allow xfs to bind to port 7100
bf7f975
25d5868
* Mon Sep 10 2007 Dan Walsh <dwalsh@redhat.com> 3.0.7-8
25d5868
- Allow newalias/sendmail dac_override
25d5868
- Allow bind to bind to all udp ports
25d5868
4eaf5c6
* Fri Sep 7 2007 Dan Walsh <dwalsh@redhat.com> 3.0.7-7
4eaf5c6
- Turn off direct transition
4eaf5c6
c7e443c
* Fri Sep 7 2007 Dan Walsh <dwalsh@redhat.com> 3.0.7-6
c7e443c
- Allow wine to run in system role
c7e443c
37d6a1c
* Thu Sep 6 2007 Dan Walsh <dwalsh@redhat.com> 3.0.7-5
37d6a1c
- Fix java labeling 
37d6a1c
07b8680
* Thu Sep 6 2007 Dan Walsh <dwalsh@redhat.com> 3.0.7-4
07b8680
- Define user_home_type as home_type
07b8680
bea5486
* Tue Aug 28 2007 Dan Walsh <dwalsh@redhat.com> 3.0.7-3
bea5486
- Allow sendmail to create etc_aliases_t
bea5486
bc85a6b
* Tue Aug 28 2007 Dan Walsh <dwalsh@redhat.com> 3.0.7-2
bc85a6b
- Allow login programs to read symlinks on homedirs
bc85a6b
e8b5993
* Mon Aug 27 2007 Dan Walsh <dwalsh@redhat.com> 3.0.7-1
e8b5993
- Update an readd modules
e8b5993
d83af23
* Fri Aug 24 2007 Dan Walsh <dwalsh@redhat.com> 3.0.6-3
d83af23
- Cleanup  spec file
d83af23
3b13a83
* Fri Aug 24 2007 Dan Walsh <dwalsh@redhat.com> 3.0.6-2
3b13a83
- Allow xserver to be started by unconfined process and talk to tty
3b13a83
95bbe5c
* Wed Aug 22 2007 Dan Walsh <dwalsh@redhat.com> 3.0.6-1
95bbe5c
- Upgrade to upstream to grab postgressql changes
95bbe5c
c77aca5
* Tue Aug 21 2007 Dan Walsh <dwalsh@redhat.com> 3.0.5-11
c77aca5
- Add setransd for mls policy
c77aca5
4f23c46
* Mon Aug 20 2007 Dan Walsh <dwalsh@redhat.com> 3.0.5-10
4f23c46
- Add ldconfig_cache_t
4f23c46
b4ae7d8
* Sat Aug 18 2007 Dan Walsh <dwalsh@redhat.com> 3.0.5-9
b4ae7d8
- Allow sshd to write to proc_t for afs login
b4ae7d8
f012074
* Sat Aug 18 2007 Dan Walsh <dwalsh@redhat.com> 3.0.5-8
f012074
- Allow xserver access to urand
f012074
7f6883c
* Tue Aug 14 2007 Dan Walsh <dwalsh@redhat.com> 3.0.5-7
7f6883c
- allow dovecot to search mountpoints
7f6883c
0354c22
* Sat Aug 11 2007 Dan Walsh <dwalsh@redhat.com> 3.0.5-6
0354c22
- Fix Makefile for building policy modules
0354c22
60a9ef6
* Fri Aug 10 2007 Dan Walsh <dwalsh@redhat.com> 3.0.5-5
60a9ef6
- Fix dhcpc startup of service 
60a9ef6
bf33202
* Fri Aug 10 2007 Dan Walsh <dwalsh@redhat.com> 3.0.5-4
bf33202
- Fix dbus chat to not happen for xguest and guest users
bf33202
d44a393
* Mon Aug 6 2007 Dan Walsh <dwalsh@redhat.com> 3.0.5-3
d44a393
- Fix nagios cgi
d44a393
- allow squid to communicate with winbind
d44a393
1a12c25
* Mon Aug 6 2007 Dan Walsh <dwalsh@redhat.com> 3.0.5-2
1a12c25
- Fixes for ldconfig
1a12c25
25a7546
* Thu Aug 2 2007 Dan Walsh <dwalsh@redhat.com> 3.0.5-1
25a7546
- Update from upstream
25a7546
25a7546
* Wed Aug 1 2007 Dan Walsh <dwalsh@redhat.com> 3.0.4-6
25a7546
- Add nasd support
25a7546
8239a93
* Wed Aug 1 2007 Dan Walsh <dwalsh@redhat.com> 3.0.4-5
8239a93
- Fix new usb devices and dmfm
8239a93
47a35fa
* Mon Jul 30 2007 Dan Walsh <dwalsh@redhat.com> 3.0.4-4
47a35fa
- Eliminate mount_ntfs_t policy, merge into mount_t
47a35fa
07351eb
* Mon Jul 30 2007 Dan Walsh <dwalsh@redhat.com> 3.0.4-3
07351eb
- Allow xserver to write to ramfs mounted by rhgb
07351eb
9c03863
* Tue Jul 23 2007 Dan Walsh <dwalsh@redhat.com> 3.0.4-2
9c03863
- Add context for dbus machine id
9c03863
2fac1d6
* Tue Jul 23 2007 Dan Walsh <dwalsh@redhat.com> 3.0.4-1
2fac1d6
- Update with latest changes from upstream
2fac1d6
0f8f545
* Tue Jul 23 2007 Dan Walsh <dwalsh@redhat.com> 3.0.3-6
0f8f545
- Fix prelink to handle execmod
0f8f545
e0ae206
* Mon Jul 23 2007 Dan Walsh <dwalsh@redhat.com> 3.0.3-5
e0ae206
- Add ntpd_key_t to handle secret data
e0ae206
2ced404
* Fri Jul 20 2007 Dan Walsh <dwalsh@redhat.com> 3.0.3-4
2ced404
- Add anon_inodefs
2ced404
- Allow unpriv user exec pam_exec_t
2ced404
- Fix trigger
2ced404
779d23c
* Fri Jul 20 2007 Dan Walsh <dwalsh@redhat.com> 3.0.3-3
779d23c
- Allow cups to use generic usb
779d23c
- fix inetd to be able to run random apps (git)
779d23c
908512c
* Thu Jul 19 2007 Dan Walsh <dwalsh@redhat.com> 3.0.3-2
908512c
- Add proper contexts for rsyslogd
908512c
908512c
* Thu Jul 19 2007 Dan Walsh <dwalsh@redhat.com> 3.0.3-1
908512c
- Fixes for xguest policy
908512c
297dd1a
* Tue Jul 17 2007 Dan Walsh <dwalsh@redhat.com> 3.0.2-9
297dd1a
- Allow execution of gconf
297dd1a
1d03199
* Sat Jul 14 2007 Dan Walsh <dwalsh@redhat.com> 3.0.2-8
1d03199
- Fix moilscanner update problem
1d03199
7e35064
* Thu Jul 12 2007 Dan Walsh <dwalsh@redhat.com> 3.0.2-7
7e35064
- Begin adding policy to separate setsebool from semanage
16d9531
- Fix xserver.if definition to not break sepolgen.if
16d9531
2796de2
* Wed Jul 11 2007 Dan Walsh <dwalsh@redhat.com> 3.0.2-5
2796de2
- Add new devices
2796de2
154d823
* Tue Jul 10 2007 Dan Walsh <dwalsh@redhat.com> 3.0.2-4
154d823
- Add brctl policy
154d823
501a17b
* Fri Jul 6 2007 Dan Walsh <dwalsh@redhat.com> 3.0.2-3
501a17b
- Fix root login to include system_r
501a17b
35e7f77
* Fri Jul 6 2007 Dan Walsh <dwalsh@redhat.com> 3.0.2-2
35e7f77
- Allow prelink to read kernel sysctls
35e7f77
b529ed6
* Mon Jul 2 2007 Dan Walsh <dwalsh@redhat.com> 3.0.1-5
b529ed6
- Default to user_u:system_r:unconfined_t 
b529ed6
2fdb5fd
* Sun Jul 1 2007 Dan Walsh <dwalsh@redhat.com> 3.0.1-4
2fdb5fd
- fix squid
2fdb5fd
- Fix rpm running as uid
2fdb5fd
b786a2b
* Wed Jun 26 2007 Dan Walsh <dwalsh@redhat.com> 3.0.1-3
b786a2b
- Fix syslog declaration
b786a2b
7f44213
* Wed Jun 26 2007 Dan Walsh <dwalsh@redhat.com> 3.0.1-2
7f44213
- Allow avahi to access inotify
7f44213
- Remove a lot of bogus security_t:filesystem avcs
7f44213
56187c2
* Fri May 25 2007 Dan Walsh <dwalsh@redhat.com> 3.0.1-1
56187c2
- Remove ifdef strict policy from upstream
3e930b8
56187c2
* Fri May 18 2007 Dan Walsh <dwalsh@redhat.com> 2.6.5-3
56187c2
- Remove ifdef strict to allow user_u to login 
d4da533
bdb8302
* Fri May 18 2007 Dan Walsh <dwalsh@redhat.com> 2.6.5-2
bdb8302
- Fix for amands
bdb8302
- Allow semanage to read pp files
bdb8302
- Allow rhgb to read xdm_xserver_tmp
346d2dc
346d2dc
* Fri May 18 2007 Dan Walsh <dwalsh@redhat.com> 2.6.4-7
346d2dc
- Allow kerberos servers to use ldap for backing store
346d2dc
9ffb88e
* Thu May 17 2007 Dan Walsh <dwalsh@redhat.com> 2.6.4-6
9ffb88e
- allow alsactl to read kernel state
9ffb88e
fc35770
* Wed May 16 2007 Dan Walsh <dwalsh@redhat.com> 2.6.4-5
88c8465
- More fixes for alsactl
fc35770
- Transition from hal and modutils
cf806eb
- Fixes for suspend resume.  
cf806eb
	- insmod domtrans to alsactl
cf806eb
	- insmod writes to hal log
cf806eb
7c3dcb3
* Wed May 16 2007 Dan Walsh <dwalsh@redhat.com> 2.6.4-2
7c3dcb3
- Allow unconfined_t to transition to NetworkManager_t
7c3dcb3
- Fix netlabel policy
7c3dcb3
810e696
* Mon May 14 2007 Dan Walsh <dwalsh@redhat.com> 2.6.4-1
810e696
- Update to latest from upstream
810e696
daa6abe
* Fri May 4 2007 Dan Walsh <dwalsh@redhat.com> 2.6.3-1
daa6abe
- Update to latest from upstream
daa6abe
8fea836
* Mon Apr 30 2007 Dan Walsh <dwalsh@redhat.com> 2.6.2-1
8fea836
- Update to latest from upstream
8fea836
8fea836
* Fri Apr 27 2007 Dan Walsh <dwalsh@redhat.com> 2.6.1-4
8fea836
- Allow pcscd_t to send itself signals
8fea836
6821c3d
* Fri Apr 27 2007 Dan Walsh <dwalsh@redhat.com> 2.6.1-3
6821c3d
- 
6821c3d
77d25eb
* Wed Apr 25 2007 Dan Walsh <dwalsh@redhat.com> 2.6.1-2
77d25eb
- Fixes for unix_update
77d25eb
- Fix logwatch to be able to search all dirs
77d25eb
8396b2d
* Mon Apr 23 2007 Dan Walsh <dwalsh@redhat.com> 2.6.1-1
8396b2d
- Upstream bumped the version
8396b2d
61947fa
* Thu Apr 19 2007 Dan Walsh <dwalsh@redhat.com> 2.5.12-12
61947fa
- Allow consolekit to syslog
61947fa
- Allow ntfs to work with hal
61947fa
2db3c1e
* Thu Apr 19 2007 Dan Walsh <dwalsh@redhat.com> 2.5.12-11
61947fa
- Allow iptables to read etc_runtime_t
2db3c1e
4661767
* Thu Apr 19 2007 Dan Walsh <dwalsh@redhat.com> 2.5.12-10
53b2229
- MLS Fixes
53b2229
883a025
* Wed Apr 18 2007 Dan Walsh <dwalsh@redhat.com> 2.5.12-8
883a025
- Fix path of /etc/lvm/cache directory
ab59bec
- Fixes for alsactl and pppd_t
32b18f8
- Fixes for consolekit
32b18f8
7671cee
* Tue Apr 17 2007 Dan Walsh <dwalsh@redhat.com> 2.5.12-5
7671cee
- Allow insmod_t to mount kvmfs_t filesystems
7671cee
9fc00bc
* Tue Apr 17 2007 Dan Walsh <dwalsh@redhat.com> 2.5.12-4
9fc00bc
- Rwho policy
9fc00bc
- Fixes for consolekit
9fc00bc
e6f3cfb
* Fri Apr 12 2007 Dan Walsh <dwalsh@redhat.com> 2.5.12-3
e6f3cfb
- fixes for fusefs
e6f3cfb
8c912ab
* Thu Apr 12 2007 Dan Walsh <dwalsh@redhat.com> 2.5.12-2
8c912ab
- Fix samba_net to allow it to view samba_var_t
8c912ab
a3b1a2c
* Tue Apr 10 2007 Dan Walsh <dwalsh@redhat.com> 2.5.12-1
a3b1a2c
- Update to upstream
a3b1a2c
5d5caeb
* Tue Apr 10 2007 Dan Walsh <dwalsh@redhat.com> 2.5.11-8
5d5caeb
- Fix Sonypic backlight
5d5caeb
- Allow snmp to look at squid_conf_t
5d5caeb
7f1bd86
* Mon Apr 9 2007 Dan Walsh <dwalsh@redhat.com> 2.5.11-7
7f1bd86
- Fixes for pyzor, cyrus, consoletype on everything installs
7f1bd86
0b3279d
* Mon Apr 9 2007 Dan Walsh <dwalsh@redhat.com> 2.5.11-6
0b3279d
- Fix hald_acl_t to be able to getattr/setattr on usb devices
0b3279d
- Dontaudit write to unconfined_pipes for load_policy
0b3279d
21029bf
* Thu Apr 5 2007 Dan Walsh <dwalsh@redhat.com> 2.5.11-5
21029bf
- Allow bluetooth to read inotifyfs
21029bf
e6b9e29
* Wed Apr 4 2007 Dan Walsh <dwalsh@redhat.com> 2.5.11-4
e6b9e29
- Fixes for samba domain controller.
e6b9e29
- Allow ConsoleKit to look at ttys
e6b9e29
f9f9ddc
* Tue Apr 3 2007 Dan Walsh <dwalsh@redhat.com> 2.5.11-3
f9f9ddc
- Fix interface call
f9f9ddc
89d3de7
* Tue Apr 3 2007 Dan Walsh <dwalsh@redhat.com> 2.5.11-2
89d3de7
- Allow syslog-ng to read /var
89d3de7
- Allow locate to getattr on all filesystems
89d3de7
- nscd needs setcap
89d3de7
ce7f30a
* Mon Mar 26 2007 Dan Walsh <dwalsh@redhat.com> 2.5.11-1
ce7f30a
- Update to upstream
ce7f30a
f040ac5
* Fri Mar 23 2007 Dan Walsh <dwalsh@redhat.com> 2.5.10-2
f040ac5
- Allow samba to run groupadd
f040ac5
f634733
* Thu Mar 22 2007 Dan Walsh <dwalsh@redhat.com> 2.5.10-1
f634733
- Update to upstream
f634733
f634733
* Thu Mar 22 2007 Dan Walsh <dwalsh@redhat.com> 2.5.9-6
f634733
- Allow mdadm to access generic scsi devices
f634733
281f5f5
* Wed Mar 21 2007 Dan Walsh <dwalsh@redhat.com> 2.5.9-5
281f5f5
- Fix labeling on udev.tbl dirs
281f5f5
552645b
* Tue Mar 20 2007 Dan Walsh <dwalsh@redhat.com> 2.5.9-4
552645b
- Fixes for logwatch
552645b
593fb16
* Tue Mar 20 2007 Dan Walsh <dwalsh@redhat.com> 2.5.9-3
593fb16
- Add fusermount and mount_ntfs policy
593fb16
9d59ec4
* Tue Mar 20 2007 Dan Walsh <dwalsh@redhat.com> 2.5.9-2
9d59ec4
- Update to upstream
9d59ec4
- Allow saslauthd to use kerberos keytabs
d3aabae
741e816
* Mon Mar 19 2007 Dan Walsh <dwalsh@redhat.com> 2.5.8-8
741e816
- Fixes for samba_var_t
741e816
741e816
* Mon Mar 19 2007 Dan Walsh <dwalsh@redhat.com> 2.5.8-7
741e816
- Allow networkmanager to setpgid
741e816
- Fixes for hal_acl_t
741e816
2823e28
* Mon Mar 19 2007 Dan Walsh <dwalsh@redhat.com> 2.5.8-6
db4f0ec
- Remove disable_trans booleans
2823e28
- hald_acl_t needs to talk to nscd
2823e28
2f82eed
* Thu Mar 15 2007 Dan Walsh <dwalsh@redhat.com> 2.5.8-5
2f82eed
- Fix prelink to be able to manage usr dirs.
2f82eed
9468a64
* Tue Mar 13 2007 Dan Walsh <dwalsh@redhat.com> 2.5.8-4
9468a64
- Allow insmod to launch init scripts
9468a64
271752a
* Tue Mar 13 2007 Dan Walsh <dwalsh@redhat.com> 2.5.8-3
271752a
- Remove setsebool policy
271752a
bdb7f99
* Mon Mar 12 2007 Dan Walsh <dwalsh@redhat.com> 2.5.8-2
bdb7f99
- Fix handling of unlabled_t packets
bdb7f99
bdb7f99
* Thu Mar 8 2007 Dan Walsh <dwalsh@redhat.com> 2.5.8-1
2a9b648
- More of my patches from upstream
2a9b648
9a8202d
* Thu Mar 1 2007 Dan Walsh <dwalsh@redhat.com> 2.5.7-1
9a8202d
- Update to latest from upstream
9a8202d
- Add fail2ban policy
9a8202d
5ad70cf
* Wed Feb 28 2007 Dan Walsh <dwalsh@redhat.com> 2.5.6-1
5ad70cf
- Update to remove security_t:filesystem getattr problems
5ad70cf
13893ed
* Fri Feb 23 2007 Dan Walsh <dwalsh@redhat.com> 2.5.5-2
13893ed
- Policy for consolekit
13893ed
af8af9c
* Fri Feb 23 2007 Dan Walsh <dwalsh@redhat.com> 2.5.5-1
13893ed
- Update to latest from upstream
af8af9c
cc1be22
* Wed Feb 21 2007 Dan Walsh <dwalsh@redhat.com> 2.5.4-2
cc1be22
- Revert Nemiver change
cc1be22
- Set sudo as a corecmd so prelink will work,  remove sudoedit mapping, since this will not work, it does not transition.
cc1be22
- Allow samba to execute useradd
cc1be22
cc1be22
* Tue Feb 20 2007 Dan Walsh <dwalsh@redhat.com> 2.5.4-1
cc1be22
- Upgrade to the latest from upstream
cc1be22
2fa5bb0
* Thu Feb 15 2007 Dan Walsh <dwalsh@redhat.com> 2.5.3-3
e10e57a
- Add sepolgen support
e10e57a
- Add bugzilla policy
e10e57a
1a24735
* Wed Feb 14 2007 Dan Walsh <dwalsh@redhat.com> 2.5.3-2
1a24735
- Fix file context for nemiver
1a24735
1a24735
* Sun Feb 11 2007 Dan Walsh <dwalsh@redhat.com> 2.5.3-1
1a24735
- Remove include sym link
9aff35b
39b6cec
* Mon Feb 5 2007 Dan Walsh <dwalsh@redhat.com> 2.5.2-6
39b6cec
- Allow mozilla, evolution and thunderbird to read dev_random.
39b6cec
Resolves: #227002
39b6cec
- Allow spamd to connect to smtp port
39b6cec
Resolves: #227184
39b6cec
- Fixes to make ypxfr work
39b6cec
Resolves: #227237
39b6cec
33501ce
* Sun Feb 4 2007 Dan Walsh <dwalsh@redhat.com> 2.5.2-5
33501ce
- Fix ssh_agent to be marked as an executable
33501ce
- Allow Hal to rw sound device 
33501ce
<