1580c87
%define distro redhat
7716868
%define polyinstatiate n
1580c87
%define monolithic n
bd3f0ea
%if %{?BUILD_STRICT:0}%{!?BUILD_STRICT:1}
bd3f0ea
%define BUILD_STRICT 1
bd3f0ea
%endif
bd3f0ea
%if %{?BUILD_TARGETED:0}%{!?BUILD_TARGETED:1}
bd3f0ea
%define BUILD_TARGETED 1
bd3f0ea
%endif
bd3f0ea
%if %{?BUILD_MLS:0}%{!?BUILD_MLS:1}
3debd0a
%define BUILD_MLS 1
bd3f0ea
%endif
7c94e8e
%define POLICYVER 20
727bb2e
%define POLICYCOREUTILSVER 1.30-1
bbe0ad9
%define CHECKPOLICYVER 1.30.1-2
1580c87
Summary: SELinux policy configuration
1580c87
Name: selinux-policy
c4826d0
Version: 2.2.31
c4826d0
Release: 1
1580c87
License: GPL
1580c87
Group: System Environment/Base
1580c87
Source: serefpolicy-%{version}.tgz
c4826d0
patch1: policy-20060411.patch
504da9f
Source1: modules-targeted.conf
504da9f
Source2: booleans-targeted.conf
585f827
Source3: Makefile.devel
504da9f
Source4: setrans-targeted.conf
504da9f
Source5: modules-mls.conf
6e9bcb4
Source6: booleans-mls.conf	
504da9f
Source8: setrans-mls.conf
129ba16
Source9: modules-strict.conf
129ba16
Source10: booleans-strict.conf
129ba16
Source12: setrans-strict.conf
de82d85
Source13: policygentool
3e930b8
1580c87
Url: http://serefpolicy.sourceforge.net
1580c87
BuildRoot: %{_tmppath}/serefpolicy-buildroot
1580c87
BuildArch: noarch
1580c87
BuildRequires: checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils >= %{POLICYCOREUTILSVER}
12e089c
PreReq: policycoreutils >= %{POLICYCOREUTILSVER}
1580c87
Obsoletes: policy 
d19b685
Obsoletes: selinux-policy-devel
1580c87
1335ee8
%description 
1335ee8
SELinux Base package
1335ee8
1335ee8
%files 
1335ee8
%{_mandir}/man8/*
585f827
%doc %{_usr}/share/doc/%{name}-%{version}
585f827
%dir %{_usr}/share/selinux
585f827
%dir %{_sysconfdir}/selinux
d19b685
%dir %{_usr}/share/selinux/devel
d19b685
%dir %{_usr}/share/selinux/devel/include
585f827
%ghost %config(noreplace) %{_sysconfdir}/selinux/config
585f827
%ghost %{_sysconfdir}/sysconfig/selinux
d19b685
%{_usr}/share/selinux/devel/include/*
d19b685
%{_usr}/share/selinux/devel/Makefile
d19b685
%{_usr}/share/selinux/devel/policygentool
d19b685
%{_usr}/share/selinux/devel/example.*
d2c2609
%attr(755,root,root) %{_usr}/share/selinux/devel/policyhelp
1335ee8
de82d85
%define setupCmds() \
d2c2609
make NAME=%1 TYPE=%2 DISTRO=%{distro} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%3 bare \
d2c2609
make NAME=%1 TYPE=%2 DISTRO=%{distro} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%3  conf \
3e930b8
cp -f ${RPM_SOURCE_DIR}/modules-%1.conf  ./policy/modules.conf \
3e930b8
cp -f ${RPM_SOURCE_DIR}/booleans-%1.conf ./policy/booleans.conf \
de82d85
de82d85
%define installCmds() \
d2c2609
make NAME=%1 TYPE=%2 DISTRO=%{distro} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%3 base.pp \
d2c2609
make NAME=%1 TYPE=%2 DISTRO=%{distro} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%3 modules \
d2c2609
make NAME=%1 TYPE=%2 DISTRO=%{distro} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=$RPM_BUILD_ROOT POLY=%3 install \
d2c2609
make NAME=%1 TYPE=%2 DISTRO=%{distro} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=$RPM_BUILD_ROOT POLY=%3 install-appconfig \
6e9bcb4
#%{__cp} *.pp $RPM_BUILD_ROOT/%{_usr}/share/selinux/%1/ \
1580c87
%{__mkdir} -p $RPM_BUILD_ROOT/%{_sysconfdir}/selinux/%1/policy \
1580c87
%{__mkdir} -p $RPM_BUILD_ROOT/%{_sysconfdir}/selinux/%1/modules/active \
1580c87
%{__mkdir} -p $RPM_BUILD_ROOT/%{_sysconfdir}/selinux/%1/contexts/files \
3debd0a
touch $RPM_BUILD_ROOT/%{_sysconfdir}/selinux/%1/modules/semanage.read.LOCK \
3debd0a
touch $RPM_BUILD_ROOT/%{_sysconfdir}/selinux/%1/modules/semanage.trans.LOCK \
d2c2609
make NAME=%1 TYPE=%2 DISTRO=%{distro} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%3  enableaudit \
54b0b58
make -W base.conf NAME=%1 TYPE=%2 DISTRO=%{distro} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%3 base.pp \
315b4a4
install -m0644 base.pp ${RPM_BUILD_ROOT}%{_usr}/share/selinux/%1/enableaudit.pp \
1580c87
rm -rf $RPM_BUILD_ROOT%{_sysconfdir}/selinux/%1/booleans \
1580c87
touch $RPM_BUILD_ROOT%{_sysconfdir}/selinux/%1/seusers \
7c94e8e
touch $RPM_BUILD_ROOT%{_sysconfdir}/selinux/%1/policy/policy.%{POLICYVER} \
1580c87
touch $RPM_BUILD_ROOT%{_sysconfdir}/selinux/%1/contexts/files/file_contexts \
1580c87
touch $RPM_BUILD_ROOT%{_sysconfdir}/selinux/%1/contexts/files/homedir_template \
3e930b8
touch $RPM_BUILD_ROOT%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \
3e930b8
install -m0644 ${RPM_SOURCE_DIR}/setrans-%1.conf ${RPM_BUILD_ROOT}%{_sysconfdir}/selinux/%1/setrans.conf \
d19b685
ln -sf ../devel/include ${RPM_BUILD_ROOT}%{_usr}/share/selinux/%1/include \
3e930b8
%nil
1580c87
1580c87
%define fileList() \
1580c87
%defattr(-,root,root) \
1580c87
%dir %{_usr}/share/selinux/%1 \
129ba16
%{_usr}/share/selinux/%1/*.pp \
1580c87
%dir %{_sysconfdir}/selinux/%1 \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/setrans.conf \
1580c87
%ghost %{_sysconfdir}/selinux/%1/seusers \
1580c87
%dir %{_sysconfdir}/selinux/%1/modules \
3debd0a
%{_sysconfdir}/selinux/%1/modules/semanage.read.LOCK \
3debd0a
%{_sysconfdir}/selinux/%1/modules/semanage.trans.LOCK \
21dea1c
%attr(700,root,root) %dir %{_sysconfdir}/selinux/%1/modules/active \
6e9bcb4
#%verify(not md5 size mtime) %attr(600,root,root) %config(noreplace) %{_sysconfdir}/selinux/%1/modules/active/seusers \
1580c87
%dir %{_sysconfdir}/selinux/%1/policy/ \
7c94e8e
%ghost %{_sysconfdir}/selinux/%1/policy/policy.* \
1580c87
%dir %{_sysconfdir}/selinux/%1/contexts \
d2c2609
%config %{_sysconfdir}/selinux/%1/contexts/customizable_types \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/dbus_contexts \
7c94e8e
%config %{_sysconfdir}/selinux/%1/contexts/default_contexts \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/default_type \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/failsafe_context \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/initrc_context \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/removable_context \
1580c87
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/userhelper_context \
1580c87
%dir %{_sysconfdir}/selinux/%1/contexts/files \
a08ba87
%ghost %{_sysconfdir}/selinux/%1/contexts/files/file_contexts \
a08ba87
%ghost %{_sysconfdir}/selinux/%1/contexts/files/homedir_template \
a08ba87
%ghost %{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \
d19b685
%config %{_sysconfdir}/selinux/%1/contexts/files/media \
d19b685
%{_usr}/share/selinux/%1/include
1580c87
1580c87
%define saveFileContext() \
bd7e86c
if [ -s /etc/selinux/config ]; then \
bd7e86c
	. %{_sysconfdir}/selinux/config; \
bd7e86c
	FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \
bd7e86c
	if [ "${SELINUXTYPE}" == %1 -a -f ${FILE_CONTEXT} ]; then \
bd7e86c
		cp -f ${FILE_CONTEXT} ${FILE_CONTEXT}.pre; \
bd7e86c
	fi \
bd7e86c
fi
1580c87
1580c87
%define rebuildpolicy() \
de82d85
( cd /usr/share/selinux/%1; \
d19b685
x=`ls *.pp | grep -v -e base.pp -e enableaudit.pp | awk '{ print "-i " $1 }'`; \
a3a62ab
semodule -b base.pp $x -s %1; \
de82d85
);\
598be15
rm -f %{_sysconfdir}/selinux/%1/policy/policy.*.rpmnew
1580c87
1580c87
%define relabel() \
1580c87
. %{_sysconfdir}/selinux/config; \
1580c87
FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \
1580c87
if [ "${SELINUXTYPE}" == %1 -a -f ${FILE_CONTEXT}.pre ]; then \
ad73e86
	fixfiles -C ${FILE_CONTEXT}.pre restore; \
1580c87
	rm -f ${FILE_CONTEXT}.pre; \
1580c87
fi; 
1580c87
1580c87
%description
1580c87
SELinux Reference Policy - modular.
1580c87
3e930b8
%prep 
1580c87
%setup -q -n serefpolicy-%{version}
5cbfde1
%patch1 -p1
bd3f0ea
1580c87
%install
e568731
# Build targeted policy
1580c87
%{__rm} -fR $RPM_BUILD_ROOT
1335ee8
mkdir -p ${RPM_BUILD_ROOT}%{_mandir}/man8/
1335ee8
install -m 644 man/man8/*.8 ${RPM_BUILD_ROOT}%{_mandir}/man8/
585f827
mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/selinux
585f827
mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig
585f827
touch $RPM_BUILD_ROOT%{_sysconfdir}/selinux/config
585f827
touch $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/selinux
1335ee8
d19b685
# Install devel
d19b685
make clean
d2c2609
make NAME=targeted TYPE=targeted-mcs DISTRO=%{distro} DIRECT_INITRC=y MONOLITHIC=%{monolithic} DESTDIR=$RPM_BUILD_ROOT PKGNAME=%{name}-%{version} POLY=%3 install-headers install-docs
d19b685
mkdir ${RPM_BUILD_ROOT}%{_usr}/share/selinux/devel/
d19b685
mv ${RPM_BUILD_ROOT}%{_usr}/share/selinux/targeted/include ${RPM_BUILD_ROOT}%{_usr}/share/selinux/devel/include
fbec4b5
rm -f ${RPM_BUILD_ROOT}%{_usr}/share/selinux/devel/include/include
d19b685
install -m 755 ${RPM_SOURCE_DIR}/policygentool ${RPM_BUILD_ROOT}%{_usr}/share/selinux/devel/
d19b685
install -m 644 ${RPM_SOURCE_DIR}/Makefile.devel ${RPM_BUILD_ROOT}%{_usr}/share/selinux/devel/Makefile
d19b685
install -m 644 doc/example.* ${RPM_BUILD_ROOT}%{_usr}/share/selinux/devel/
bd3f0ea
echo  "htmlview file:///usr/share/doc/selinux-policy-%{version}/html/index.html"> ${RPM_BUILD_ROOT}%{_usr}/share/selinux/devel/policyhelp
d2c2609
chmod +x ${RPM_BUILD_ROOT}%{_usr}/share/selinux/devel/policyhelp
d19b685
bd3f0ea
%if %{BUILD_TARGETED}
129ba16
# Build targeted policy
129ba16
# Commented out because only targeted ref policy currently builds
d2c2609
%setupCmds targeted targeted-mcs y n
d2c2609
%installCmds targeted targeted-mcs y  n
bd3f0ea
%endif
3e930b8
bd3f0ea
%if %{BUILD_STRICT}
d77f56b
# Build strict policy
d77f56b
# Commented out because only targeted ref policy currently builds
d2c2609
make NAME=strict TYPE=strict-mcs DISTRO=%{distro} DIRECT_INITRC=y MONOLITHIC=%{monolithic} POLY=n bare 
d2c2609
make NAME=strict TYPE=strict-mcs DISTRO=%{distro} DIRECT_INITRC=y MONOLITHIC=%{monolithic} POLY=n conf
5c1cd71
cp -f ${RPM_SOURCE_DIR}/modules-strict.conf  ./policy/modules.conf 
d2c2609
%installCmds strict strict-mcs y n
bd3f0ea
%endif
129ba16
bd3f0ea
%if %{BUILD_MLS}
129ba16
# Build mls policy
d2c2609
%setupCmds mls strict-mls n y
d2c2609
%installCmds mls strict-mls n y 
bd3f0ea
%endif
129ba16
1580c87
%clean
1580c87
%{__rm} -fR $RPM_BUILD_ROOT
1580c87
9c64bb6
%post
af60908
if [ ! -s /etc/selinux/config ]; then
af60908
	#
af60908
	#	New install so we will default to targeted policy
af60908
	#
af60908
	echo "
af60908
# This file controls the state of SELinux on the system.
af60908
# SELINUX= can take one of these three values:
af60908
#	enforcing - SELinux security policy is enforced.
af60908
#	permissive - SELinux prints warnings instead of enforcing.
af60908
#	disabled - No SELinux policy is loaded.
af60908
SELINUX=enforcing
af60908
# SELINUXTYPE= can take one of these two values:
af60908
#	targeted - Only targeted network daemons are protected.
af60908
#	strict - Full SELinux protection.
af60908
#	mls - Multi Level Security protection.
af60908
SELINUXTYPE=targeted 
af60908
# SETLOCALDEFS= Check local definition changes
af60908
SETLOCALDEFS=0 
af60908
af60908
" > /etc/selinux/config
af60908
6e9bcb4
	ln -sf ../selinux/config /etc/sysconfig/selinux 
af60908
	restorecon /etc/selinux/config 2> /dev/null
af60908
else
9c64bb6
	. /etc/selinux/config
af60908
	# if first time update booleans.local needs to be copied to sandbox
9c64bb6
	[ -f /etc/selinux/${SELINUXTYPE}/booleans.local ] && mv /etc/selinux/${SELINUXTYPE}/booleans.local /etc/selinux/targeted/modules/active/
9c64bb6
	[ -f /etc/selinux/${SELINUXTYPE}/seusers ] && cp -f /etc/selinux/${SELINUXTYPE}/seusers /etc/selinux/${SELINUXTYPE}/modules/active/seusers
af60908
	grep -q "^SETLOCALDEFS" /etc/selinux/config || echo -n "
af60908
# SETLOCALDEFS= Check local definition changes
af60908
SETLOCALDEFS=0 
af60908
">> /etc/selinux/config
af60908
fi
9c64bb6
bd3f0ea
%if %{BUILD_TARGETED}
bd3f0ea
%package targeted
bd3f0ea
Summary: SELinux targeted base policy
bd3f0ea
Group: System Environment/Base
bd3f0ea
Provides: selinux-policy-base
bd3f0ea
Obsoletes: selinux-policy-targeted-sources
bd3f0ea
Prereq: policycoreutils >= %{POLICYCOREUTILSVER}
bd3f0ea
Prereq: coreutils
bd3f0ea
Prereq: selinux-policy = %{version}-%{release}
bd3f0ea
bd3f0ea
%description targeted
bd3f0ea
SELinux Reference policy targeted base module.
bd3f0ea
bd3f0ea
%pre targeted
bd3f0ea
%saveFileContext targeted
bd3f0ea
9c64bb6
%post targeted
504da9f
%rebuildpolicy targeted
504da9f
%relabel targeted
af60908
504da9f
%triggerpostun targeted -- selinux-policy-targeted <= 2.0.7
504da9f
%rebuildpolicy targeted
af60908
bd3f0ea
%files targeted
bd3f0ea
%fileList targeted
bd3f0ea
bd3f0ea
%endif
bd3f0ea
bd3f0ea
%if %{BUILD_MLS}
504da9f
%package mls 
504da9f
Summary: SELinux mls base policy
1580c87
Group: System Environment/Base
1580c87
Provides: selinux-policy-base
504da9f
Obsoletes: selinux-policy-mls-sources
eb190f8
Prereq: policycoreutils >= %{POLICYCOREUTILSVER}
eb190f8
Prereq: coreutils
a736f97
Prereq: selinux-policy = %{version}-%{release}
1580c87
504da9f
%description mls 
504da9f
SELinux Reference policy mls base module.
1580c87
504da9f
%pre mls 
504da9f
%saveFileContext mls
1580c87
504da9f
%post mls 
d19b685
%rebuildpolicy mls
504da9f
%relabel mls
d19b685
ln -sf ../devel/include /usr/share/selinux/mls/include
1580c87
504da9f
%triggerpostun mls -- mls <= 2.0.7
504da9f
%{rebuildpolicy} mls 
1580c87
504da9f
%files mls
504da9f
%fileList mls
3e930b8
bd3f0ea
%endif
bd3f0ea
bd3f0ea
%if %{BUILD_STRICT}
bd3f0ea
504da9f
%package strict 
504da9f
Summary: SELinux strict base policy
3e930b8
Group: System Environment/Base
3e930b8
Provides: selinux-policy-base
504da9f
Obsoletes: selinux-policy-strict-sources
eb190f8
Prereq: policycoreutils >= %{POLICYCOREUTILSVER}
eb190f8
Prereq: coreutils
a736f97
Prereq: selinux-policy = %{version}-%{release}
3e930b8
504da9f
%description strict 
504da9f
SELinux Reference policy strict base module.
3e930b8
504da9f
%pre strict 
504da9f
%saveFileContext strict
3e930b8
504da9f
%post strict 
d19b685
%rebuildpolicy strict
504da9f
%relabel strict
d19b685
ln -sf ../devel/include /usr/share/selinux/strict/include
3e930b8
504da9f
%triggerpostun strict -- strict <= 2.0.7
504da9f
%{rebuildpolicy} strict 
3e930b8
504da9f
%files strict
504da9f
%fileList strict
d4da533
bd3f0ea
%endif
bd3f0ea
1580c87
%changelog
c4826d0
* Thu Apr 14 2006 Dan Walsh <dwalsh@redhat.com> 2.2.31-1
c4826d0
- Update to latest from upstream
c4826d0
- Allow mono and unconfined to talk to initrc_t dbus objects
c4826d0
c7b01ad
* Tue Apr 11 2006 Dan Walsh <dwalsh@redhat.com> 2.2.30-2
c7b01ad
- Change libraries.fc to stop shlib_t form overriding texrel_shlib_t
c7b01ad
c7b01ad
* Tue Apr 11 2006 Dan Walsh <dwalsh@redhat.com> 2.2.30-1
c7b01ad
- Fix samba creating dirs in homedir
c7b01ad
- Fix NFS so its booleans would work
c7b01ad
c53f3b8
* Mon Apr 10 2006 Dan Walsh <dwalsh@redhat.com> 2.2.29-6
c53f3b8
- Allow secadm_t ability to relabel all files
c53f3b8
- Allow ftp to search xferlog_t directories
c53f3b8
- Allow mysql to communicate with ldap
c53f3b8
- Allow rsync to bind to rsync_port_t
c53f3b8
rcoker a442ed4
* Mon Apr 10 2006 Russell Coker <rcoker@redhat.com> 2.2.29-5
rcoker a442ed4
- Fixed mailman with Postfix #183928
rcoker a442ed4
- Allowed semanage to create file_context files.
rcoker a442ed4
- Allowed amanda_t to access inetd_t TCP sockets and allowed amanda_recover_t
rcoker a442ed4
  to bind to reserved ports.  #149030
rcoker a442ed4
- Don't allow devpts_t to be associated with tmp_t.
rcoker a442ed4
- Allow hald_t to stat all mountpoints.
rcoker a442ed4
- Added boolean samba_share_nfs to allow smbd_t full access to NFS mounts.
rcoker a442ed4
  #169947
rcoker a442ed4
- Make mount run in mount_t domain from unconfined_t to prevent mislabeling of
rcoker a442ed4
  /etc/mtab.
rcoker a442ed4
- Changed the file_contexts to not have a regex before the first ^/[a-z]/
rcoker a442ed4
  whenever possible, makes restorecon slightly faster.
rcoker a442ed4
- Correct the label of /etc/named.caching-nameserver.conf
rcoker a442ed4
- Now label /usr/src/kernels/.+/lib(/.*)? as usr_t instead of
rcoker a442ed4
  /usr/src(/.*)?/lib(/.*)? - I don't think we need anything else under /usr/src
rcoker a442ed4
  hit by this.
rcoker a442ed4
- Granted xen access to /boot, allowed mounting on xend_var_lib_t, and allowed
rcoker a442ed4
  xenstored_t rw access to the xen device node.
rcoker a442ed4
67bc5eb
* Mon Mar 30 2006 Dan Walsh <dwalsh@redhat.com> 2.2.29-4
67bc5eb
- More textrel_shlib_t file path fixes
67bc5eb
- Add ada support
67bc5eb
4fd214b
* Mon Mar 30 2006 Dan Walsh <dwalsh@redhat.com> 2.2.29-3
4fd214b
- Get auditctl working in MLS policy
4fd214b
2ad4f12
* Mon Mar 30 2006 Dan Walsh <dwalsh@redhat.com> 2.2.29-2
2ad4f12
- Add mono dbus support
2ad4f12
- Lots of file_context fixes for textrel_shlib_t in FC5
2ad4f12
- Turn off execmem auditallow since they are filling log files
2ad4f12
da5d600
* Fri Mar 30 2006 Dan Walsh <dwalsh@redhat.com> 2.2.29-1
da5d600
- Update to upstream
da5d600
da5d600
* Thu Mar 30 2006 Dan Walsh <dwalsh@redhat.com> 2.2.28-3
d2bd4f4
- Allow automount and dbus to read cert files
d2bd4f4
da5d600
* Thu Mar 30 2006 Dan Walsh <dwalsh@redhat.com> 2.2.28-2
58ec7a5
- Fix ftp policy
58ec7a5
- Fix secadm running of auditctl
58ec7a5
5a01431
* Mon Mar 27 2006 Dan Walsh <dwalsh@redhat.com> 2.2.28-1
5a01431
- Update to upstream
5a01431
5a01431
* Wed Mar 22 2006 Dan Walsh <dwalsh@redhat.com> 2.2.27-1
5a01431
- Update to upstream
5a01431
bd3f0ea
* Wed Mar 22 2006 Dan Walsh <dwalsh@redhat.com> 2.2.25-3
bd3f0ea
- Fix policyhelp
bd3f0ea
faffd3a
* Wed Mar 22 2006 Dan Walsh <dwalsh@redhat.com> 2.2.25-2
faffd3a
- Fix pam_console handling of usb_device
faffd3a
- dontaudit logwatch reading /mnt dir
faffd3a
faffd3a
* Fri Mar 17 2006 Dan Walsh <dwalsh@redhat.com> 2.2.24-1
727bb2e
- Update to upstream
727bb2e
9f8b058
* Wed Mar 15 2006 Dan Walsh <dwalsh@redhat.com> 2.2.23-19
9f8b058
- Get transition rules to create policy.20 at SystemHigh
9f8b058
5b46764
* Tue Mar 14 2006 Dan Walsh <dwalsh@redhat.com> 2.2.23-18
5b46764
- Allow secadmin to shutdown system
5b46764
- Allow sendmail to exec newalias
5b46764
6d42754
* Tue Mar 14 2006 Dan Walsh <dwalsh@redhat.com> 2.2.23-17
0a74a26
- MLS Fixes
0a74a26
	dmidecode needs mls_file_read_up
0a74a26
- add ypxfr_t
0a74a26
- run init needs access to nscd
0a74a26
- udev needs setuid
0a74a26
- another xen log file
0a74a26
- Dontaudit mount getattr proc_kcore_t
0a74a26
4e431cf
* Tue Mar 14 2006 Karsten Hopp <karsten@redhat.de> 2.2.23-16
4e431cf
- fix buildroot usage (#185391)
4e431cf
4c9f08f
* Thu Mar 9 2006 Dan Walsh <dwalsh@redhat.com> 2.2.23-15
4c9f08f
- Get rid of mount/fsdisk scan of /dev messages
4c9f08f
- Additional fixes for suspend/resume
4c9f08f
54b0b58
* Thu Mar 9 2006 Dan Walsh <dwalsh@redhat.com> 2.2.23-14
54b0b58
- Fake make to rebuild enableaudit.pp
54b0b58
6d23889
* Thu Mar 9 2006 Dan Walsh <dwalsh@redhat.com> 2.2.23-13
6d23889
- Get xen networking running.
6d23889
23a177b
* Thu Mar 9 2006 Dan Walsh <dwalsh@redhat.com> 2.2.23-12
23a177b
- Fixes for Xen
23a177b
- enableaudit should not be the same as base.pp
23a177b
- Allow ps to work for all process
23a177b
b33ec3c
* Thu Mar  9 2006 Jeremy Katz <katzj@redhat.com> - 2.2.23-11
b33ec3c
- more xen policy fixups
b33ec3c
1b07552
* Wed Mar  8 2006 Jeremy Katz <katzj@redhat.com> - 2.2.23-10
1b07552
- more xen fixage (#184393)
1b07552
060041b
* Wed Mar 8 2006 Dan Walsh <dwalsh@redhat.com> 2.2.23-9
060041b
- Fix blkid specification
060041b
- Allow postfix to execute mailman_que
060041b
9c64bb6
* Wed Mar 8 2006 Dan Walsh <dwalsh@redhat.com> 2.2.23-8
9c64bb6
- Blkid changes
9c64bb6
- Allow udev access to usb_device_t
9c64bb6
- Fix post script to create targeted policy config file
9c64bb6
4c9f658
* Wed Mar 8 2006 Dan Walsh <dwalsh@redhat.com> 2.2.23-7
4c9f658
- Allow lvm tools to create drevice dir
4c9f658
0204772
* Tue Mar 7 2006 Dan Walsh <dwalsh@redhat.com> 2.2.23-5
0204772
- Add Xen support
0204772
0296aff
* Mon Mar 6 2006 Dan Walsh <dwalsh@redhat.com> 2.2.23-4
0296aff
- Fixes for cups
0296aff
- Make cryptosetup work with hal
0296aff
76d7c52
* Sun Mar 5 2006 Dan Walsh <dwalsh@redhat.com> 2.2.23-3
76d7c52
- Load Policy needs translock
76d7c52
ef0cb15
* Sat Mar 4 2006 Dan Walsh <dwalsh@redhat.com> 2.2.23-2
ef0cb15
- Fix cups html interface
ef0cb15
21277d9
* Sat Mar 4 2006 Dan Walsh <dwalsh@redhat.com> 2.2.23-1
21277d9
- Add hal changes suggested by Jeremy
d2c2609
- add policyhelp to point at policy html pages
d2c2609
8254bb0
* Mon Feb 27 2006 Dan Walsh <dwalsh@redhat.com> 2.2.22-2
8254bb0
- Additional fixes for nvidia and cups
8254bb0
575aa98
* Mon Feb 27 2006 Dan Walsh <dwalsh@redhat.com> 2.2.22-1
575aa98
- Update to upstream
575aa98
- Merged my latest fixes
575aa98
- Fix cups policy to handle unix domain sockets
38c8068
575aa98
* Sat Feb 25 2006 Dan Walsh <dwalsh@redhat.com> 2.2.21-9
fbec4b5
- NSCD socket is in nscd_var_run_t needs to be able to search dir
fbec4b5
575aa98
* Fri Feb 24 2006 Dan Walsh <dwalsh@redhat.com> 2.2.21-8
290aa68
- Fixes Apache interface file
290aa68
575aa98
* Fri Feb 24 2006 Dan Walsh <dwalsh@redhat.com> 2.2.21-7
dd2612b
- Fixes for new version of cups
dd2612b
575aa98
* Fri Feb 24 2006 Dan Walsh <dwalsh@redhat.com> 2.2.21-6
7716868
- Turn off polyinstatiate util after FC5
7716868
575aa98
* Fri Feb 24 2006 Dan Walsh <dwalsh@redhat.com> 2.2.21-5
c126996
- Fix problem with privoxy talking to Tor
c126996
7dca0e2
* Thu Feb 22 2006 Dan Walsh <dwalsh@redhat.com> 2.2.21-4
7dca0e2
- Turn on polyinstatiation
7dca0e2
5d5343f
* Thu Feb 22 2006 Dan Walsh <dwalsh@redhat.com> 2.2.21-3
7dca0e2
- Don't transition from unconfined_t to fsadm_t
5d5343f
d19b685
* Thu Feb 22 2006 Dan Walsh <dwalsh@redhat.com> 2.2.21-2
d19b685
- Fix policy update model.
d19b685
701455e
* Thu Feb 22 2006 Dan Walsh <dwalsh@redhat.com> 2.2.21-1
701455e
- Update to upstream
701455e
585f827
* Wed Feb 22 2006 Dan Walsh <dwalsh@redhat.com> 2.2.20-1
d4d1f2b
- Fix load_policy to work on MLS
d4d1f2b
- Fix cron_rw_system_pipes for postfix_postdrop_t
d4d1f2b
- Allow audotmount to run showmount
d4d1f2b
a57054e
* Tue Feb 21 2006 Dan Walsh <dwalsh@redhat.com> 2.2.19-2
a57054e
- Fix swapon
a57054e
- allow httpd_sys_script_t to be entered via a shell
a57054e
- Allow httpd_sys_script_t to read eventpolfs
a57054e
d5ae27d
* Tue Feb 21 2006 Dan Walsh <dwalsh@redhat.com> 2.2.19-1
d5ae27d
- Update from upstream
d5ae27d
46bd65b
* Tue Feb 21 2006 Dan Walsh <dwalsh@redhat.com> 2.2.18-2
46bd65b
- allow cron to read apache files
46bd65b
31d4d26
* Tue Feb 21 2006 Dan Walsh <dwalsh@redhat.com> 2.2.18-1
31d4d26
- Fix vpnc policy to work from NetworkManager
31d4d26
f0e87bc
* Mon Feb 20 2006 Dan Walsh <dwalsh@redhat.com> 2.2.17-2
f0e87bc
- Update to upstream
f0e87bc
- Fix semoudle polcy
f0e87bc
6e9bcb4
* Thu Feb 16 2006 Dan Walsh <dwalsh@redhat.com> 2.2.16-1
6e9bcb4
- Update to upstream 
6e9bcb4
- fix sysconfig/selinux link
6e9bcb4
f3a3900
* Wed Feb 15 2006 Dan Walsh <dwalsh@redhat.com> 2.2.15-4
f3a3900
- Add router port for zebra
f3a3900
- Add imaze port for spamd
f3a3900
- Fixes for amanda and java
f3a3900
025d1ec
* Tue Feb 14 2006 Dan Walsh <dwalsh@redhat.com> 2.2.15-3
025d1ec
- Fix bluetooth handling of usb devices
2f15a23
- Fix spamd reading of ~/
2f15a23
- fix nvidia spec
2f15a23
c417f6b
* Tue Feb 14 2006 Dan Walsh <dwalsh@redhat.com> 2.2.15-1
c417f6b
- Update to upsteam
c417f6b
847884d
* Mon Feb 13 2006 Dan Walsh <dwalsh@redhat.com> 2.2.14-2
847884d
- Add users_extra files
847884d
32b8716
* Fri Feb 10 2006 Dan Walsh <dwalsh@redhat.com> 2.2.14-1
32b8716
- Update to upstream
32b8716
faa80bb
* Fri Feb 10 2006 Dan Walsh <dwalsh@redhat.com> 2.2.13-1
faa80bb
- Add semodule policy
faa80bb
5a82999
* Tue Feb 7 2006 Dan Walsh <dwalsh@redhat.com> 2.2.12-1
5a82999
- Update from upstream
5a82999
5a82999
b28bebe
* Mon Feb 6 2006 Dan Walsh <dwalsh@redhat.com> 2.2.11-2
b28bebe
- Fix for spamd to use razor port
b28bebe
a3a62ab
* Fri Feb 3 2006 Dan Walsh <dwalsh@redhat.com> 2.2.11-1
a3a62ab
- Fixes for mcs
a3a62ab
- Turn on mount and fsadm for unconfined_t
a3a62ab
de82d85
* Wed Feb 1 2006 Dan Walsh <dwalsh@redhat.com> 2.2.10-1
de82d85
- Fixes for the -devel package
de82d85
38c8068
* Wed Feb 1 2006 Dan Walsh <dwalsh@redhat.com> 2.2.9-2
38c8068
- Fix for spamd to use ldap
38c8068
38c8068
* Fri Jan 27 2006 Dan Walsh <dwalsh@redhat.com> 2.2.9-1
38c8068
- Update to upstream
38c8068
7374323
* Fri Jan 27 2006 Dan Walsh <dwalsh@redhat.com> 2.2.8-2
3325377
- Update to upstream
7374323
- Fix rhgb, and other Xorg startups
3325377
78265f4
* Thu Jan 26 2006 Dan Walsh <dwalsh@redhat.com> 2.2.7-1
78265f4
- Update to upstream
78265f4
78265f4
* Thu Jan 26 2006 Dan Walsh <dwalsh@redhat.com> 2.2.6-3
78265f4
- Separate out role of secadm for mls
78265f4
b6e6b56
* Thu Jan 26 2006 Dan Walsh <dwalsh@redhat.com> 2.2.6-2
b6e6b56
- Add inotifyfs handling
b6e6b56
e76babe
* Thu Jan 26 2006 Dan Walsh <dwalsh@redhat.com> 2.2.6-1
e76babe
- Update to upstream
e76babe
- Put back in changes for pup/zen
e76babe
e76babe
* Tue Jan 24 2006 Dan Walsh <dwalsh@redhat.com> 2.2.5-1
a3b5c30
- Many changes for MLS 
a3b5c30
- Turn on strict policy
a3b5c30
129ba16
* Mon Jan 23 2006 Dan Walsh <dwalsh@redhat.com> 2.2.4-1
129ba16
- Update to upstream
129ba16
129ba16
* Wed Jan 18 2006 Dan Walsh <dwalsh@redhat.com> 2.2.3-1
129ba16
- Update to upstream
129ba16
- Fixes for booting and logging in on MLS machine
129ba16
30a020f
* Wed Jan 18 2006 Dan Walsh <dwalsh@redhat.com> 2.2.2-1
30a020f
- Update to upstream
30a020f
- Turn off execheap execstack for unconfined users
30a020f
- Add mono/wine policy to allow execheap and execstack for them
30a020f
- Add execheap for Xdm policy
30a020f
30a020f
* Wed Jan 18 2006 Dan Walsh <dwalsh@redhat.com> 2.2.1-1
30a020f
- Update to upstream
30a020f
- Fixes to fetchmail,
30a020f
05207b6
* Tue Jan 17 2006 Dan Walsh <dwalsh@redhat.com> 2.1.13-1
05207b6
- Update to upstream
05207b6
05207b6
* Tue Jan 17 2006 Dan Walsh <dwalsh@redhat.com> 2.1.12-3
05207b6
- Fix for procmail/spamassasin
2e71478
- Update to upstream
a1c584a
- Add rules to allow rpcd to work with unlabeled_networks.
2e71478
cdab5cb
* Sat Jan 14 2006 Dan Walsh <dwalsh@redhat.com> 2.1.11-1
cdab5cb
- Update to upstream
cdab5cb
- Fix ftp Man page
cdab5cb
7ba8b0d
* Fri Jan 13 2006 Dan Walsh <dwalsh@redhat.com> 2.1.10-1
7ba8b0d
- Update to upstream
7ba8b0d
b9b2d8a
* Wed Jan 11 2006 Jeremy Katz <katzj@redhat.com> - 2.1.9-2
b9b2d8a
- fix pup transitions (#177262)
b9b2d8a
- fix xen disks (#177599)
b9b2d8a
6401280
* Tue Jan 10 2006 Dan Walsh <dwalsh@redhat.com> 2.1.9-1
6401280
- Update to upstream
6401280
ef14779
* Tue Jan 10 2006 Dan Walsh <dwalsh@redhat.com> 2.1.8-3
ef14779
- More Fixes for hal and readahead
ef14779
e485f59
* Mon Jan 9 2006 Dan Walsh <dwalsh@redhat.com> 2.1.8-2
e485f59
- Fixes for hal and readahead
e485f59
26e33df
* Mon Jan 9 2006 Dan Walsh <dwalsh@redhat.com> 2.1.8-1
26e33df
- Update to upstream
e485f59
- Apply 
26e33df
* Fri Jan 7 2006 Dan Walsh <dwalsh@redhat.com> 2.1.7-4
26e33df
- Add wine and fix hal problems
26e33df
26e33df
* Thu Jan 6 2006 Dan Walsh <dwalsh@redhat.com> 2.1.7-3
451d9b4
- Handle new location of hal scripts
451d9b4
0088858
* Thu Jan 5 2006 Dan Walsh <dwalsh@redhat.com> 2.1.7-2
0088858
- Allow su to read /etc/mtab
0088858
a736f97
* Wed Jan 4 2006 Dan Walsh <dwalsh@redhat.com> 2.1.7-1
a736f97
- Update to upstream
a736f97
120d3b5
* Tue Jan 3 2006 Dan Walsh <dwalsh@redhat.com> 2.1.6-24
120d3b5
- Fix  "libsemanage.parse_module_headers: Data did not represent a module." problem
120d3b5
ce66f50
* Tue Jan 3 2006 Dan Walsh <dwalsh@redhat.com> 2.1.6-23
ce66f50
- Allow load_policy to read /etc/mtab
ce66f50
1f31224
* Mon Jan 2 2006 Dan Walsh <dwalsh@redhat.com> 2.1.6-22
1f31224
- Fix dovecot to allow dovecot_auth to look at /tmp
1f31224
d7b05bc
* Mon Jan 2 2006 Dan Walsh <dwalsh@redhat.com> 2.1.6-21
d7b05bc
- Allow restorecon to read unlabeled_t directories in order to fix labeling.
d7b05bc
3607aaf
* Fri Dec 30 2005 Dan Walsh <dwalsh@redhat.com> 2.1.6-20
a08ba87
- Add Logwatch policy
a08ba87
798572f
* Wed Dec 28 2005 Dan Walsh <dwalsh@redhat.com> 2.1.6-18
798572f
- Fix /dev/ub[a-z] file context
798572f
9f7b037
* Tue Dec 27 2005 Dan Walsh <dwalsh@redhat.com> 2.1.6-17
9f7b037
- Fix library specification
9f7b037
- Give kudzu execmem privs
9f7b037
596229f
* Thu Dec 22 2005 Dan Walsh <dwalsh@redhat.com> 2.1.6-16
596229f
- Fix hostname in targeted policy
596229f
5a47e64
* Wed Dec 21 2005 Dan Walsh <dwalsh@redhat.com> 2.1.6-15
5a47e64
- Fix passwd command on mls
5a47e64
71ee99d
* Wed Dec 21 2005 Dan Walsh <dwalsh@redhat.com> 2.1.6-14
71ee99d
- Lots of fixes to make mls policy work
71ee99d
6e9ee77
* Tue Dec 20 2005 Dan Walsh <dwalsh@redhat.com> 2.1.6-13
9d20b26
- Add dri libs to textrel_shlib_t
6e9ee77
- Add system_r role for java
6e9ee77
- Add unconfined_exec_t for vncserver
6e9ee77
- Allow slapd to use kerberos
9d20b26
1335ee8
* Mon Dec 19 2005 Dan Walsh <dwalsh@redhat.com> 2.1.6-11
1335ee8
- Add man pages
1335ee8
1335ee8
* Fri Dec 16 2005 Dan Walsh <dwalsh@redhat.com> 2.1.6-10
315b4a4
- Add enableaudit.pp
315b4a4
1335ee8
* Fri Dec 16 2005 Dan Walsh <dwalsh@redhat.com> 2.1.6-9
105bbf6
- Fix mls policy
105bbf6
1335ee8
* Fri Dec 16 2005 Dan Walsh <dwalsh@redhat.com> 2.1.6-8
0c9f87b
- Update mls file from old version
0c9f87b
1335ee8
* Thu Dec 15 2005 Dan Walsh <dwalsh@redhat.com> 2.1.6-5
dce316d
- Add sids back in
dce316d
- Rebuild with update checkpolicy
dce316d
1335ee8
* Thu Dec 15 2005 Dan Walsh <dwalsh@redhat.com> 2.1.6-4
9ce97af
- Fixes to allow automount to use portmap
9ce97af
- Fixes to start kernel in s0-s15:c0.c255
9ce97af
1335ee8
* Wed Dec 14 2005 Dan Walsh <dwalsh@redhat.com> 2.1.6-3
1c86025
- Add java unconfined/execmem policy 
1c86025
1335ee8
* Wed Dec 14 2005 Dan Walsh <dwalsh@redhat.com> 2.1.6-2
1f00750
- Add file context for /var/cvs
1f00750
- Dontaudit webalizer search of homedir
1f00750
1335ee8
* Tue Dec 13 2005 Dan Walsh <dwalsh@redhat.com> 2.1.6-1
504da9f
- Update from upstream
504da9f
504da9f
* Tue Dec 13 2005 Dan Walsh <dwalsh@redhat.com> 2.1.4-2
504da9f
- Clean up spec
504da9f
- range_transition crond to SystemHigh
504da9f
e24a8b1
* Mon Dec 12 2005 Dan Walsh <dwalsh@redhat.com> 2.1.4-1
1ff14ab
- Fixes for hal
e24a8b1
- Update to upstream
1ff14ab
afa8a21
* Mon Dec 12 2005 Dan Walsh <dwalsh@redhat.com> 2.1.3-1
d8566e6
- Turn back on execmem since we need it for java, firefox, ooffice
57c18fe
- Allow gpm to stream socket to itself
57c18fe
eb190f8
* Mon Dec 12 2005 Jeremy Katz <katzj@redhat.com> - 2.1.2-3
eb190f8
- fix requirements to be on the actual packages so that policy can get
eb190f8
  created properly at install time
eb190f8
9e85a85
* Sun Dec  10 2005 Dan Walsh <dwalsh@redhat.com> 2.1.2-2
9e85a85
- Allow unconfined_t to execmod texrel_shlib_t
9e85a85
d4da533
* Sat Dec  9 2005 Dan Walsh <dwalsh@redhat.com> 2.1.2-1
d4da533
- Update to upstream 
d4da533
- Turn off allow_execmem and allow_execmod booleans
d4da533
- Add tcpd and automount policies
d4da533
e1ccb6f
* Fri Dec  8 2005 Dan Walsh <dwalsh@redhat.com> 2.1.1-3
e1ccb6f
- Add two new httpd booleans, turned off by default
e1ccb6f
	* httpd_can_network_relay
e1ccb6f
	* httpd_can_network_connect_db
e1ccb6f
7c94e8e
* Fri Dec  8 2005 Dan Walsh <dwalsh@redhat.com> 2.1.1-2
7c94e8e
- Add ghost for policy.20
7c94e8e
6f5a3bc
* Thu Dec  8 2005 Dan Walsh <dwalsh@redhat.com> 2.1.1-1
6f5a3bc
- Update to upstream
6f5a3bc
- Turn off boolean allow_execstack
6f5a3bc
c6c4985
* Thu Dec  8 2005 Dan Walsh <dwalsh@redhat.com> 2.1.0-3
c6c4985
- Change setrans-mls to use new libsetrans
c6c4985
- Add default_context rule for xdm
c6c4985
12e089c
* Thu Dec  8 2005 Dan Walsh <dwalsh@redhat.com> 2.1.0-2.
12e089c
- Change Requires to PreReg for requiring of policycoreutils on install
12e089c
12e089c
* Wed Dec  7 2005 Dan Walsh <dwalsh@redhat.com> 2.1.0-1.
12e089c
- New upstream release
12e089c
97bd2aa
* Wed Dec  7 2005 Dan Walsh <dwalsh@redhat.com> 2.0.11-2.
97bd2aa
Add xdm policy
97bd2aa
46a9067
* Tue Dec  6 2005 Dan Walsh <dwalsh@redhat.com> 2.0.11-1.
46a9067
Update from upstream
46a9067
4751861
* Fri Dec  2 2005 Dan Walsh <dwalsh@redhat.com> 2.0.9-1.
4751861
Update from upstream
4751861
caeef12
* Fri Dec  2 2005 Dan Walsh <dwalsh@redhat.com> 2.0.8-1.
caeef12
Update from upstream
caeef12
2b2203d
* Fri Dec  2 2005 Dan Walsh <dwalsh@redhat.com> 2.0.7-3
2b2203d
- Also trigger to rebuild policy for versions up to 2.0.7.
2b2203d
2b2203d
* Tue Nov 29 2005 Dan Walsh <dwalsh@redhat.com> 2.0.7-2
28930b1
- No longer installing policy.20 file, anaconda handles the building of the app.
28930b1
2b2203d
* Tue Nov 29 2005 Dan Walsh <dwalsh@redhat.com> 2.0.6-2
4199dc8
- Fixes for dovecot and saslauthd
4199dc8
2b2203d
* Wed Nov 23 2005 Dan Walsh <dwalsh@redhat.com> 2.0.5-4
21dea1c
- Cleanup pegasus and named 
21dea1c
- Fix spec file
c1b0228
- Fix up passwd changing applications
21dea1c
2b2203d
* Tue Nov 21 2005 Dan Walsh <dwalsh@redhat.com> 2.0.5-1
e38dc41
-Update to latest from upstream
e38dc41
2b2203d
* Tue Nov 21 2005 Dan Walsh <dwalsh@redhat.com> 2.0.4-1
765f818
- Add rules for pegasus and avahi
765f818
2b2203d
* Mon Nov 21 2005 Dan Walsh <dwalsh@redhat.com> 2.0.2-2
a32f665
- Start building MLS Policy
a32f665
2b2203d
* Fri Nov 18 2005 Dan Walsh <dwalsh@redhat.com> 2.0.2-1
1a0a256
- Update to upstream
1a0a256
2b2203d
* Wed Nov 9 2005 Dan Walsh <dwalsh@redhat.com> 2.0.1-2
205d3ff
- Turn on bash
205d3ff
2b2203d
* Wed Nov 9 2005 Dan Walsh <dwalsh@redhat.com> 2.0.1-1
1580c87
- Initial version