%define distro redhat

%define polyinstatiate n

%define monolithic n

%if %{?BUILD_TARGETED:0}%{!?BUILD_TARGETED:1}

%define BUILD_TARGETED 1

%endif

%if %{?BUILD_MINIMUM:0}%{!?BUILD_MINIMUM:1}

%define BUILD_MINIMUM 1

%endif

%if %{?BUILD_OLPC:0}%{!?BUILD_OLPC:1}

%define BUILD_OLPC 0

%endif

%if %{?BUILD_MLS:0}%{!?BUILD_MLS:1}

%define BUILD_MLS 1

%endif

%define POLICYVER 23

%define libsepolver 2.0.20-1

%define POLICYCOREUTILSVER 2.0.62-10

%define CHECKPOLICYVER 2.0.16-3

Summary: SELinux policy configuration

Name: selinux-policy

Version: 3.6.12

Release: 90%{?dist}

License: GPLv2+

Group: System Environment/Base

Source: serefpolicy-%{version}.tgz

patch1: policy-F11.patch

patch2: policy-20090521.patch

Source1: modules-targeted.conf

Source2: booleans-targeted.conf

Source3: Makefile.devel

Source4: setrans-targeted.conf

Source5: modules-mls.conf

Source6: booleans-mls.conf	

Source8: setrans-mls.conf

Source9: modules-olpc.conf

Source10: booleans-olpc.conf	

Source11: setrans-olpc.conf

Source12: securetty_types-olpc

Source13: policygentool

Source14: securetty_types-targeted

Source15: securetty_types-mls

Source16: modules-minimum.conf

Source17: booleans-minimum.conf

Source18: setrans-minimum.conf

Source19: securetty_types-minimum

Source20: customizable_types

Url: http://oss.tresys.com/repos/refpolicy/

BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)

BuildArch: noarch

BuildRequires: python gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-python >= %{POLICYCOREUTILSVER} bzip2 

Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER} libsemanage >= 2.0.14-3

Requires(post): /usr/bin/bunzip2 /bin/mktemp /bin/awk

Requires: checkpolicy >= %{CHECKPOLICYVER} m4 

Obsoletes: selinux-policy-devel

Provides: selinux-policy-devel

%description 

SELinux Base package

%files 

%{_mandir}/*

%dir %{_usr}/share/selinux

%dir %{_usr}/share/selinux/devel

%dir %{_usr}/share/selinux/devel/include

%dir %{_usr}/share/selinux/packages

%dir %{_sysconfdir}/selinux

%ghost %config(noreplace) %{_sysconfdir}/selinux/config

%ghost %{_sysconfdir}/sysconfig/selinux

%{_usr}/share/selinux/devel/include/*

%{_usr}/share/selinux/devel/Makefile

%{_usr}/share/selinux/devel/policygentool

%{_usr}/share/selinux/devel/example.*

%{_usr}/share/selinux/devel/policy.*

%package doc

Summary: SELinux policy documentation

Group: System Environment/Base

Requires(pre): selinux-policy = %{version}-%{release}

%description doc

SELinux policy documentation package

%files doc

%doc %{_usr}/share/doc/%{name}-%{version}

%attr(755,root,root) %{_usr}/share/selinux/devel/policyhelp

%check

/usr/bin/sepolgen-ifgen -i %{buildroot}%{_usr}/share/selinux/devel/include -o /dev/null

%define setupCmds() \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 bare \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024  conf \

cp -f $RPM_SOURCE_DIR/modules-%1.conf  ./policy/modules.conf \

cp -f $RPM_SOURCE_DIR/booleans-%1.conf ./policy/booleans.conf \

%define moduleList() %([ -f %{_sourcedir}/modules-%{1}.conf ] && \

awk '$1 !~ "/^#/" && $2 == "=" && $3 == "module" { printf "%%s.pp.bz2 ", $1 }' %{_sourcedir}/modules-%{1}.conf )

%define installCmds() \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 base.pp \

make validate UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 modules \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 install \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 install-appconfig \

#%{__cp} *.pp %{buildroot}/%{_usr}/share/selinux/%1/ \

%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/policy \

%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/modules/active \

%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/contexts/files \

touch %{buildroot}/%{_sysconfdir}/selinux/%1/modules/semanage.read.LOCK \

touch %{buildroot}/%{_sysconfdir}/selinux/%1/modules/semanage.trans.LOCK \

rm -rf %{buildroot}%{_sysconfdir}/selinux/%1/booleans \

touch %{buildroot}%{_sysconfdir}/selinux/%1/seusers \

touch %{buildroot}%{_sysconfdir}/selinux/%1/policy/policy.%{POLICYVER} \

touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts \

touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \

install -m0644 $RPM_SOURCE_DIR/securetty_types-%1 %{buildroot}%{_sysconfdir}/selinux/%1/contexts/securetty_types \

install -m0644 $RPM_SOURCE_DIR/setrans-%1.conf %{buildroot}%{_sysconfdir}/selinux/%1/setrans.conf \

install -m0644 $RPM_SOURCE_DIR/customizable_types %{buildroot}%{_sysconfdir}/selinux/%1/contexts/customizable_types \

bzip2 %{buildroot}/%{_usr}/share/selinux/%1/*.pp

%nil

%define fileList() \

%defattr(-,root,root) \

%dir %{_usr}/share/selinux/%1 \

%{_usr}/share/selinux/%1/*.pp.bz2 \

%dir %{_sysconfdir}/selinux/%1 \

%config(noreplace) %{_sysconfdir}/selinux/%1/setrans.conf \

%ghost %{_sysconfdir}/selinux/%1/seusers \

%dir %{_sysconfdir}/selinux/%1/modules \

%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/semanage.read.LOCK \

%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/semanage.trans.LOCK \

%attr(700,root,root) %dir %{_sysconfdir}/selinux/%1/modules/active \

#%verify(not md5 size mtime) %attr(600,root,root) %config(noreplace) %{_sysconfdir}/selinux/%1/modules/active/seusers \

%dir %{_sysconfdir}/selinux/%1/policy/ \

%ghost %{_sysconfdir}/selinux/%1/policy/policy.* \

%dir %{_sysconfdir}/selinux/%1/contexts \

%config %{_sysconfdir}/selinux/%1/contexts/customizable_types \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/securetty_types \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/dbus_contexts \

%config %{_sysconfdir}/selinux/%1/contexts/x_contexts \

%config %{_sysconfdir}/selinux/%1/contexts/default_contexts \

%config	%{_sysconfdir}/selinux/%1/contexts/virtual_domain_context \

%config	%{_sysconfdir}/selinux/%1/contexts/virtual_image_context \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/default_type \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/failsafe_context \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/initrc_context \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/removable_context \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/userhelper_context \

%dir %{_sysconfdir}/selinux/%1/contexts/files \

%ghost %{_sysconfdir}/selinux/%1/contexts/files/file_contexts \

%ghost %{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \

%config %{_sysconfdir}/selinux/%1/contexts/files/media \

%dir %{_sysconfdir}/selinux/%1/contexts/users \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/root \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/guest_u \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/xguest_u \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/user_u \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/staff_u 

%define saveFileContext() \

if [ -s /etc/selinux/config ]; then \

	. %{_sysconfdir}/selinux/config; \

	FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \

	if [ "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT} ]; then \

		cp -f ${FILE_CONTEXT} ${FILE_CONTEXT}.pre; \

	fi \

fi

%define loadpolicy() \

( cd /usr/share/selinux/%1; \

semodule -b base.pp.bz2 -i %2 -s %1; \

); \

%define relabel() \

. %{_sysconfdir}/selinux/config; \

FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \

selinuxenabled; \

if [ $? = 0  -a "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT}.pre ]; then \

	fixfiles -C ${FILE_CONTEXT}.pre restore; \

	restorecon -R /var/log /var/run 2> /dev/null; \

	rm -f ${FILE_CONTEXT}.pre; \

fi; 

%description

SELinux Reference Policy - modular.

Based off of reference policy: Checked out revision  2945.

%build

%prep 

%setup -n serefpolicy-%{version} -q

%patch1 -p1

%patch2 -p1

%install

# Build targeted policy

%{__rm} -fR %{buildroot}

mkdir -p %{buildroot}%{_mandir}

cp -R  man/* %{buildroot}%{_mandir}

mkdir -p %{buildroot}%{_sysconfdir}/selinux

mkdir -p %{buildroot}%{_sysconfdir}/sysconfig

touch %{buildroot}%{_sysconfdir}/selinux/config

touch %{buildroot}%{_sysconfdir}/sysconfig/selinux

# Always create policy module package directories

mkdir -p %{buildroot}%{_usr}/share/selinux/{targeted,mls,minimum,modules}/

# Install devel

make clean

%if %{BUILD_TARGETED}

# Build targeted policy

# Commented out because only targeted ref policy currently builds

%setupCmds targeted mcs n y allow

%installCmds targeted mcs n y allow

%endif

%if %{BUILD_MINIMUM}

# Build minimum policy

# Commented out because only minimum ref policy currently builds

%setupCmds minimum mcs n y allow

%installCmds minimum mcs n y allow

%endif

%if %{BUILD_MLS}

# Build mls policy

%setupCmds mls mls n y deny

%installCmds mls mls n y deny

%endif

%if %{BUILD_OLPC}

# Build olpc policy

# Commented out because only olpc ref policy currently builds

%setupCmds olpc mcs n y allow

%installCmds olpc mcs n y allow

%endif

make UNK_PERMS=allow NAME=targeted TYPE=mcs DISTRO=%{distro} UBAC=n DIRECT_INITRC=n MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} PKGNAME=%{name}-%{version} POLY=y MLS_CATS=1024 MCS_CATS=1024 install-headers install-docs

mkdir %{buildroot}%{_usr}/share/selinux/devel/

mkdir %{buildroot}%{_usr}/share/selinux/packages/

mv %{buildroot}%{_usr}/share/selinux/targeted/include %{buildroot}%{_usr}/share/selinux/devel/include

install -m 755 $RPM_SOURCE_DIR/policygentool %{buildroot}%{_usr}/share/selinux/devel/

install -m 644 $RPM_SOURCE_DIR/Makefile.devel %{buildroot}%{_usr}/share/selinux/devel/Makefile

install -m 644 doc/example.* %{buildroot}%{_usr}/share/selinux/devel/

install -m 644 doc/policy.* %{buildroot}%{_usr}/share/selinux/devel/

echo  "xdg-open file:///usr/share/doc/selinux-policy-%{version}/html/index.html"> %{buildroot}%{_usr}/share/selinux/devel/policyhelp

chmod +x %{buildroot}%{_usr}/share/selinux/devel/policyhelp

%clean

%{__rm} -fR %{buildroot}

%post

if [ ! -s /etc/selinux/config ]; then

	#

	#	New install so we will default to targeted policy

	#

	echo "

# This file controls the state of SELinux on the system.

# SELINUX= can take one of these three values:

#	enforcing - SELinux security policy is enforced.

#	permissive - SELinux prints warnings instead of enforcing.

#	disabled - No SELinux policy is loaded.

SELINUX=enforcing

# SELINUXTYPE= can take one of these two values:

#	targeted - Targeted processes are protected,

#	mls - Multi Level Security protection.

SELINUXTYPE=targeted 

" > /etc/selinux/config

	ln -sf ../selinux/config /etc/sysconfig/selinux 

	restorecon /etc/selinux/config 2> /dev/null || :

else

	. /etc/selinux/config

	# if first time update booleans.local needs to be copied to sandbox

	[ -f /etc/selinux/${SELINUXTYPE}/booleans.local ] && mv /etc/selinux/${SELINUXTYPE}/booleans.local /etc/selinux/targeted/modules/active/

	[ -f /etc/selinux/${SELINUXTYPE}/seusers ] && cp -f /etc/selinux/${SELINUXTYPE}/seusers /etc/selinux/${SELINUXTYPE}/modules/active/seusers

	grep -q "^SETLOCALDEFS" /etc/selinux/config || echo -n "

">> /etc/selinux/config

fi

exit 0

%postun

if [ $1 = 0 ]; then

	setenforce 0 2> /dev/null

	if [ ! -s /etc/selinux/config ]; then

		echo "SELINUX=disabled" > /etc/selinux/config

	else

		sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config

	fi

fi

exit 0

%if %{BUILD_TARGETED}

%package targeted

Summary: SELinux targeted base policy

Provides: selinux-policy-base

Group: System Environment/Base

Obsoletes: selinux-policy-targeted-sources < 2

Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}

Requires(pre): coreutils

Requires(pre): selinux-policy = %{version}-%{release}

Conflicts:  audispd-plugins <= 1.7.7-1

Obsoletes: mod_fcgid-selinux

%description targeted

SELinux Reference policy targeted base module.

%pre targeted

%saveFileContext targeted

%post targeted

if [ $1 -eq 1 ]; then

   packages="%{expand:%%moduleList targeted}"

   %loadpolicy targeted $packages

   restorecon -R /root /var/log /var/run 2> /dev/null

else

   semodule -n -s targeted -r moilscanner -r mailscanner -r gamin -r audio_entropy -r iscsid 2>/dev/null

   packages="%{expand:%%moduleList targeted}"

   %loadpolicy targeted $packages

   %relabel targeted

fi

exit 0

%triggerpostun targeted -- selinux-policy-targeted < 3.2.5-9.fc9

. /etc/selinux/config

[ "${SELINUXTYPE}" != "targeted" ] && exit 0

setsebool -P use_nfs_home_dirs=1

semanage user -l | grep -s unconfined_u > /dev/null

if [ $? -eq 0 ]; then

   semanage user -m -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u

else

   semanage user -a -P user -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u

fi

seuser=`semanage login -l | grep __default__ | awk '{ print $2 }'`

[ "$seuser" != "unconfined_u" ]  && semanage login -m -s "unconfined_u"  -r s0-s0:c0.c1023 __default__

seuser=`semanage login -l | grep root | awk '{ print $2 }'`

[ "$seuser" = "system_u" ] && semanage login -m -s "unconfined_u"  -r s0-s0:c0.c1023 root

restorecon -R /root /etc/selinux/targeted 2> /dev/null

semodule -r qmail 2> /dev/null

exit 0

%files targeted

%config(noreplace) %{_sysconfdir}/selinux/targeted/contexts/users/unconfined_u

%fileList targeted

%endif

%if %{BUILD_MINIMUM}

%package minimum

Summary: SELinux minimum base policy

Provides: selinux-policy-base

Group: System Environment/Base

Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}

Requires(pre): coreutils

Requires(pre): selinux-policy = %{version}-%{release}

%description minimum

SELinux Reference policy minimum base module.

%pre minimum

%saveFileContext minimum

%post minimum

packages="unconfined.pp.bz2 unconfineduser.pp.bz2"

%loadpolicy minimum $packages

if [ $1 -eq 1 ]; then

semanage -S minimum -i - << __eof

login -m  -s unconfined_u -r s0-s0:c0.c1023 __default__

login -m  -s unconfined_u -r s0-s0:c0.c1023 root

__eof

restorecon -R /root /var/log /var/run 2> /dev/null

else

%relabel minimum

fi

exit 0

%files minimum

%config(noreplace) %{_sysconfdir}/selinux/minimum/contexts/users/unconfined_u

%fileList minimum

%endif

%if %{BUILD_OLPC}

%package olpc 

Summary: SELinux olpc base policy

Group: System Environment/Base

Provides: selinux-policy-base

Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}

Requires(pre): coreutils

Requires(pre): selinux-policy = %{version}-%{release}

%description olpc 

SELinux Reference policy olpc base module.

%pre olpc 

%saveFileContext olpc

%post olpc 

packages="%{expand:%%moduleList olpc}"

%loadpolicy olpc $packages

if [ $1 -ne 1 ]; then

%relabel olpc

fi

exit 0

%files olpc

%fileList olpc

%endif

%if %{BUILD_MLS}

%package mls 

Summary: SELinux mls base policy

Group: System Environment/Base

Provides: selinux-policy-base

Obsoletes: selinux-policy-mls-sources < 2

Requires: policycoreutils-newrole >= %{POLICYCOREUTILSVER} setransd

Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}

Requires(pre): coreutils

Requires(pre): selinux-policy = %{version}-%{release}

%description mls 

SELinux Reference policy mls base module.

%pre mls 

%saveFileContext mls

%post mls 

semodule -n -s mls -r mailscanner 2>/dev/null

packages="%{expand:%%moduleList mls}"

%loadpolicy mls $packages

if [ $1 != 1 ]; then

%relabel mls

fi

exit 0

%files mls

%config(noreplace) %{_sysconfdir}/selinux/mls/contexts/users/unconfined_u

%fileList mls

%endif

%changelog

* Thu Nov 19 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-90

- Allow mysqld_safe_t to read generic kernel sysctls

- Dontaudit netutils sys_module capability

- Fix nfs_selinux man page

* Mon Nov 16 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-89

- Fix libADM* libs labeling

- More textrel_shlib_t file path fixes

* Thu Nov 5 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-88

- Allow hplip to bind to howl_port_t

* Fri Oct 30 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-87

- Allow consolekit to manage /var/run/console directory

- Fixed sssd policy

- Allow iptables to work with shorewall

- Add libADM* libs to textrel_shlib_t

* Fri Oct 16 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-86

- Allow xdm to unlink xauth_home_t

* Wed Sep 30 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-85

- dovecot needs setcap/getcap

- Fix up sssd policy  

* Tue Sep 22 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-84

- Allow sshd to create .ssh directory and content

* Wed Sep 16 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-83

- Add wordpress/wp-content/uploads label

- Add /var/lib/libvirt/qemu label

- Allow tzdata to getattr of all persistent filesystems

* Wed Sep 2 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-82

- Allow gssd to send signals to users

- Allow fsdaemon_t setpcap capability

* Thu Aug 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-81

- Turn back on unconfineduser and unconfined domains

* Mon Aug 24 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-80

- Allow pptp dac_override capability

* Thu Aug 20 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-79

- Fixes for racoon 

- Fixes for ptchown

- Fixes for openvpn

* Fri Aug 14 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-78

- Add ptchown policy from Dan Walsh

* Thu Aug 13 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-77

- Allow fprintd_t to getattr of all persistent filesystems

* Thu Aug 13 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-76

- Allow hald_t to list net_conf_t directory

* Tue Aug 11 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-75

- Allow polkit_auth_t to getattr of all persistent filesystems

* Wed Aug 5 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-74

- Allow svirt images to create sock_file in svirt_var_run_t

* Tue Aug 4 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-73

- Allow svirt_t to stream_connect to virtd_t 

* Fri Jul 31 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-72

- Add postfix and dovecot fixes from dwalsh

* Fri Jul 31 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-71

- Allow lircd read/write input event devices 

* Tue Jul 28 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-70

- Dontaudit logrotate sys_ptrace capability

- Allow mrtg to transition to ping_t

* Mon Jul 20 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-69

- Allow sshd getsched capability

* Fri Jul 17 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-68

- Fixes for hald_dccm 

* Fri Jul 17 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-67

- Allow hal to dbus chat with polkit

* Wed Jul 15 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-66

- Allow dhcpc to read users files

* Wed Jul 8 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-65

- Fixes for xguest

* Tue Jul 7 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-64

- Fixes for kpropd

- Fix up kismet policy

* Fri Jul 3 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-63

- Allow ftpd to create shm

* Mon Jun 29 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-62

- Allow sshd to manage gitosis var/lib files

* Mon Jun 29 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-61

- Allow avahi net_admin capability

* Thu Jun 25 2009 Miroslav Grepl <mgrepl@redhat.com> 3.6.12-60

- Fix up gpsd policy

* Wed Jun 24 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-59

- Fix up xguest policy

* Tue Jun 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-58

- Allow kpropd to create tmp files

* Sat Jun 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-57

- Allow mysqld_safe to manage db files

- Allow udev_t to read/write anon_inodefs

* Sat Jun 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-56

- Add gitosis policy

* Fri Jun 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-55

- Add boolean to allow svirt to use usb devices

* Tue Jun 15 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-53

- Allow ftp to create xferlog_t files in an xferlog_t directory

- Fix svirt separation on chr_file, and blk_file

* Mon Jun 15 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-52

- Allow kpropd to create krb5_lock_t files in krb5_conf_t directory

* Fri Jun 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-51

- Remove some privs from svirt to tighten the policy

* Fri Jun 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-50

- Allow udev to transition to bluetooth

* Thu Jun 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-49

- Add labeling for midori shared libraries

* Thu Jun 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-48

- Allow setroubleshoot to run mlocate

* Thu Jun 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-47

- Allow fprintd to read /proc

* Tue Jun 2 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-46

- Allow domains to check if the /selinux is mounted and search the directory

- Dontaudit rules are blocking audit events

* Tue Jun 2 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-45

- Add proper labeling for shorewall

* Mon Jun 1 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-44

- Add fish as a shell_exec_t

- Allow consolekit to search mountpoints

- Allow xdm_t to delete user_home_t

* Wed May 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-43

- Allow fprintd to list usbfs_t

- Add listing of mailman_data_t

- Allow hald to manage fusefs_t directories

- Allow groupadd to read usr_t symlinks

* Tue May 26 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-42

- New log file for vmware

- Allow xdm to setattr on user_tmp_t

* Thu May 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-41

- Allow sysadm_t to connect to virt stream

* Thu May 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-40

- Add context for /root/.spamassassin

* Wed May 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-39

- Allow fprintd to access sys_ptrace

- Add sandbox policy

* Mon May 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-38

- Add varnishd policy

* Thu May 14 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-37

- Fixes for kpropd

* Tue May 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-36

- Allow brctl to r/w tun_tap_device_t

* Mon May 11 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-35

- Add /usr/share/selinux/packages

* Mon May 11 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-34

- Allow rpcd_t to send signals to kernel threads

* Fri May 7 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-33

- Fix upgrade for F10 to F11

* Thu May 7 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-31

- Add policy for /var/lib/fprint

* Tue May 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-30

-Remove duplicate line

* Tue May 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-29

- Allow svirt to manage pci and other sysfs device data

* Mon May 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-28

- Fix package selection handling

* Fri May 1 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-27

- Fix /sbin/ip6tables-save context

- Allod udev to transition to mount

- Fix loading of mls policy file

* Thu Apr 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-26

- Add shorewall policy

* Wed Apr 29 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-25

- Additional rules for fprintd and sssd

* Tue Apr 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-24

- Allow nsplugin to unix_read unix_write sem for unconfined_java

* Tue Apr 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-23

- Fix uml files to be owned by users

* Tue Apr 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-22

- Fix Upgrade path to install unconfineduser.pp when unocnfined package is 3.0.0 or less

* Mon Apr 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-21

- Allow confined users to manage virt_content_t, since this is home dir content

- Allow all domains to read rpm_script_tmp_t which is what shell creates on redirection

* Mon Apr 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-20

- Fix labeling on /var/lib/misc/prelink*

- Allow xserver to rw_shm_perms with all x_clients

- Allow prelink to execute files in the users home directory

* Fri Apr 24 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-19

- Allow initrc_t to delete dev_null

- Allow readahead to configure auditing

- Fix milter policy

- Add /var/lib/readahead

* Fri Apr 24 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-16

- Update to latest milter code from Paul Howarth

* Thu Apr 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-15

- Additional perms for readahead

* Thu Apr 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-14

- Allow pulseaudio to acquire_svc on session bus

- Fix readahead labeling

* Thu Apr 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-13

- Allow sysadm_t to run rpm directly

- libvirt needs fowner

* Wed Apr 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-12

- Allow sshd to read var_lib symlinks for freenx

* Tue Apr 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-11

- Allow nsplugin unix_read and write on users shm and sem

- Allow sysadm_t to execute su

* Tue Apr 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-10

- Dontaudit attempts to getattr user_tmpfs_t by lvm

- Allow nfs to share removable media

* Mon Apr 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-9

- Add ability to run postdrop from confined users

* Sat Apr 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-8

- Fixes for podsleuth