de6774
%define distro redhat
771686
%define polyinstatiate n
1580c8
%define monolithic n
bd3f0e
%if %{?BUILD_TARGETED:0}%{!?BUILD_TARGETED:1}
bd3f0e
%define BUILD_TARGETED 1
bd3f0e
%endif
675bba
%if %{?BUILD_MINIMUM:0}%{!?BUILD_MINIMUM:1}
675bba
%define BUILD_MINIMUM 1
675bba
%endif
a4ec9b
%if %{?BUILD_OLPC:0}%{!?BUILD_OLPC:1}
a4ec9b
%define BUILD_OLPC 0
a4ec9b
%endif
bd3f0e
%if %{?BUILD_MLS:0}%{!?BUILD_MLS:1}
3debd0
%define BUILD_MLS 1
bd3f0e
%endif
998737
%define POLICYVER 23
57ac1c
%define libsepolver 2.0.20-1
b2c5e7
%define POLICYCOREUTILSVER 2.0.71-2
812930
%define CHECKPOLICYVER 2.0.16-3
1580c8
Summary: SELinux policy configuration
1580c8
Name: selinux-policy
69290f
Version: 3.6.32
d9d64e
Release: 16%{?dist}
d83af2
License: GPLv2+
1580c8
Group: System Environment/Base
1580c8
Source: serefpolicy-%{version}.tgz
ef7416
patch: policy-F12.patch
504da9
Source1: modules-targeted.conf
504da9
Source2: booleans-targeted.conf
585f82
Source3: Makefile.devel
504da9
Source4: setrans-targeted.conf
504da9
Source5: modules-mls.conf
6e9bcb
Source6: booleans-mls.conf	
504da9
Source8: setrans-mls.conf
a4ec9b
Source9: modules-olpc.conf
a4ec9b
Source10: booleans-olpc.conf	
a4ec9b
Source11: setrans-olpc.conf
a4ec9b
Source12: securetty_types-olpc
de82d8
Source13: policygentool
ee095f
Source14: securetty_types-targeted
ee095f
Source15: securetty_types-mls
675bba
Source16: modules-minimum.conf
675bba
Source17: booleans-minimum.conf
675bba
Source18: setrans-minimum.conf
675bba
Source19: securetty_types-minimum
80beee
Source20: customizable_types
faf9cb
Source21: config.tgz
3e930b
0c34c6
Url: http://oss.tresys.com/repos/refpolicy/
ca8bc2
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
1580c8
BuildArch: noarch
7b146d
BuildRequires: python gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-python >= %{POLICYCOREUTILSVER} bzip2 
23e708
Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER} libsemanage >= 2.0.14-3
dc00fc
Requires(post): /usr/bin/bunzip2 /bin/mktemp /bin/awk
081b6a
Requires: checkpolicy >= %{CHECKPOLICYVER} m4 
081b6a
Obsoletes: selinux-policy-devel
081b6a
Provides: selinux-policy-devel
1580c8
1335ee
%description 
1335ee
SELinux Base package
1335ee
1335ee
%files 
a85aef
%{_mandir}/man*/*
a85aef
# policycoreutils owns these manpage directories, we only own the files within them
a85aef
%{_mandir}/ru/*/*
585f82
%dir %{_usr}/share/selinux
081b6a
%dir %{_usr}/share/selinux/devel
081b6a
%dir %{_usr}/share/selinux/devel/include
62cfaf
%dir %{_usr}/share/selinux/packages
585f82
%dir %{_sysconfdir}/selinux
585f82
%ghost %config(noreplace) %{_sysconfdir}/selinux/config
585f82
%ghost %{_sysconfdir}/sysconfig/selinux
d19b68
%{_usr}/share/selinux/devel/include/*
d19b68
%{_usr}/share/selinux/devel/Makefile
d19b68
%{_usr}/share/selinux/devel/policygentool
d19b68
%{_usr}/share/selinux/devel/example.*
364044
%{_usr}/share/selinux/devel/policy.*
412570
412570
%package doc
412570
Summary: SELinux policy documentation
412570
Group: System Environment/Base
412570
Requires(pre): selinux-policy = %{version}-%{release}
f5a104
Requires: /usr/bin/xdg-open
412570
412570
%description doc
412570
SELinux policy documentation package
412570
412570
%files doc
412570
%doc %{_usr}/share/doc/%{name}-%{version}
d2c260
%attr(755,root,root) %{_usr}/share/selinux/devel/policyhelp
1335ee
081b6a
%check
673eaa
/usr/bin/sepolgen-ifgen -i %{buildroot}%{_usr}/share/selinux/devel/include -o /dev/null
673eaa
de82d8
%define setupCmds() \
01ce3d
make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 bare \
01ce3d
make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024  conf \
53f819
cp -f $RPM_SOURCE_DIR/modules-%1.conf  ./policy/modules.conf \
53f819
cp -f $RPM_SOURCE_DIR/booleans-%1.conf ./policy/booleans.conf \
de82d8
e8b599
%define moduleList() %([ -f %{_sourcedir}/modules-%{1}.conf ] && \
07c04f
awk '$1 !~ "/^#/" && $2 == "=" && $3 == "module" { printf "%%s.pp.bz2 ", $1 }' %{_sourcedir}/modules-%{1}.conf )
998737
de82d8
%define installCmds() \
01ce3d
make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 base.pp \
01ce3d
make validate UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 modules \
01ce3d
make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 install \
01ce3d
make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 install-appconfig \
ca8bc2
#%{__cp} *.pp %{buildroot}/%{_usr}/share/selinux/%1/ \
ca8bc2
%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/policy \
ca8bc2
%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/modules/active \
ca8bc2
%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/contexts/files \
ca8bc2
touch %{buildroot}/%{_sysconfdir}/selinux/%1/modules/semanage.read.LOCK \
ca8bc2
touch %{buildroot}/%{_sysconfdir}/selinux/%1/modules/semanage.trans.LOCK \
ca8bc2
rm -rf %{buildroot}%{_sysconfdir}/selinux/%1/booleans \
ca8bc2
touch %{buildroot}%{_sysconfdir}/selinux/%1/seusers \
ca8bc2
touch %{buildroot}%{_sysconfdir}/selinux/%1/policy/policy.%{POLICYVER} \
ca8bc2
touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts \
ca8bc2
touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \
53f819
install -m0644 $RPM_SOURCE_DIR/securetty_types-%1 %{buildroot}%{_sysconfdir}/selinux/%1/contexts/securetty_types \
53f819
install -m0644 $RPM_SOURCE_DIR/setrans-%1.conf %{buildroot}%{_sysconfdir}/selinux/%1/setrans.conf \
80beee
install -m0644 $RPM_SOURCE_DIR/customizable_types %{buildroot}%{_sysconfdir}/selinux/%1/contexts/customizable_types \
998737
bzip2 %{buildroot}/%{_usr}/share/selinux/%1/*.pp
3e930b
%nil
1580c8
1580c8
%define fileList() \
1580c8
%defattr(-,root,root) \
d7e0f9
%dir %{_usr}/share/selinux/%1 \
998737
%{_usr}/share/selinux/%1/*.pp.bz2 \
1580c8
%dir %{_sysconfdir}/selinux/%1 \
1580c8
%config(noreplace) %{_sysconfdir}/selinux/%1/setrans.conf \
1580c8
%ghost %{_sysconfdir}/selinux/%1/seusers \
1580c8
%dir %{_sysconfdir}/selinux/%1/modules \
8bee3a
%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/semanage.read.LOCK \
8bee3a
%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/semanage.trans.LOCK \
21dea1
%attr(700,root,root) %dir %{_sysconfdir}/selinux/%1/modules/active \
97081d
#%verify(not md5 size mtime) %attr(600,root,root) %config(noreplace) %{_sysconfdir}/selinux/%1/modules/active/seusers \
1580c8
%dir %{_sysconfdir}/selinux/%1/policy/ \
7c94e8
%ghost %{_sysconfdir}/selinux/%1/policy/policy.* \
1580c8
%dir %{_sysconfdir}/selinux/%1/contexts \
d2c260
%config %{_sysconfdir}/selinux/%1/contexts/customizable_types \
ee095f
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/securetty_types \
1580c8
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/dbus_contexts \
5ca2ff
%config %{_sysconfdir}/selinux/%1/contexts/x_contexts \
7c94e8
%config %{_sysconfdir}/selinux/%1/contexts/default_contexts \
de6774
%config	%{_sysconfdir}/selinux/%1/contexts/virtual_domain_context \
de6774
%config	%{_sysconfdir}/selinux/%1/contexts/virtual_image_context \
1580c8
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/default_type \
1580c8
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/failsafe_context \
1580c8
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/initrc_context \
1580c8
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/removable_context \
1580c8
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/userhelper_context \
1580c8
%dir %{_sysconfdir}/selinux/%1/contexts/files \
a08ba8
%ghost %{_sysconfdir}/selinux/%1/contexts/files/file_contexts \
a08ba8
%ghost %{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \
d19b68
%config %{_sysconfdir}/selinux/%1/contexts/files/media \
da0829
%dir %{_sysconfdir}/selinux/%1/contexts/users \
a4ec9b
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/root \
a4ec9b
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/guest_u \
a80e7a
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/xguest_u \
a4ec9b
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/user_u \
4d59c2
%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/staff_u 
1580c8
1580c8
%define saveFileContext() \
bd7e86
if [ -s /etc/selinux/config ]; then \
bd7e86
	. %{_sysconfdir}/selinux/config; \
bd7e86
	FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \
e080bb
	if [ "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT} ]; then \
72bc25
	   [ -f ${FILE_CONTEXT}.pre ] || cp -f ${FILE_CONTEXT} ${FILE_CONTEXT}.pre; \
bd7e86
	fi \
bd7e86
fi
1580c8
a4ec9b
%define loadpolicy() \
02d888
( cd /usr/share/selinux/%1; \
0e31a0
semodule -b base.pp.bz2 -i %2 -s %1; \
bb36d7
); \
1580c8
1580c8
%define relabel() \
1580c8
. %{_sysconfdir}/selinux/config; \
1580c8
FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \
2528fa
selinuxenabled; \
e080bb
if [ $? = 0  -a "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT}.pre ]; then \
ad73e8
	fixfiles -C ${FILE_CONTEXT}.pre restore; \
bea548
	restorecon -R /var/log /var/run 2> /dev/null; \
1580c8
	rm -f ${FILE_CONTEXT}.pre; \
1580c8
fi; 
1580c8
1580c8
%description
1580c8
SELinux Reference Policy - modular.
abd153
Based off of reference policy: Checked out revision  2.20090730
1580c8
d83af2
%build
d83af2
3e930b
%prep 
d83af2
%setup -n serefpolicy-%{version} -q
3c584c
%patch -p1
bd3f0e
1580c8
%install
faf9cb
tar zxvf $RPM_SOURCE_DIR/config.tgz
e56873
# Build targeted policy
ca8bc2
%{__rm} -fR %{buildroot}
28021c
mkdir -p %{buildroot}%{_mandir}
7330e8
cp -R  man/* %{buildroot}%{_mandir}
ca8bc2
mkdir -p %{buildroot}%{_sysconfdir}/selinux
ca8bc2
mkdir -p %{buildroot}%{_sysconfdir}/sysconfig
ca8bc2
touch %{buildroot}%{_sysconfdir}/selinux/config
ca8bc2
touch %{buildroot}%{_sysconfdir}/sysconfig/selinux
1335ee
b4cab5
# Always create policy module package directories
2fbeb7
mkdir -p %{buildroot}%{_usr}/share/selinux/{targeted,mls,minimum,modules}/
b4cab5
d19b68
# Install devel
d19b68
make clean
bd3f0e
%if %{BUILD_TARGETED}
129ba1
# Build targeted policy
129ba1
# Commented out because only targeted ref policy currently builds
db0daf
%setupCmds targeted mcs n y allow
db0daf
%installCmds targeted mcs n y allow
bd3f0e
%endif
3e930b
675bba
%if %{BUILD_MINIMUM}
675bba
# Build minimum policy
675bba
# Commented out because only minimum ref policy currently builds
675bba
%setupCmds minimum mcs n y allow
675bba
%installCmds minimum mcs n y allow
675bba
%endif
675bba
bd3f0e
%if %{BUILD_MLS}
129ba1
# Build mls policy
9185bf
%setupCmds mls mls n y deny
9185bf
%installCmds mls mls n y deny
a4ec9b
%endif
a4ec9b
a4ec9b
%if %{BUILD_OLPC}
675bba
# Build olpc policy
675bba
# Commented out because only olpc ref policy currently builds
9185bf
%setupCmds olpc mcs n y allow
9185bf
%installCmds olpc mcs n y allow
bd3f0e
%endif
129ba1
db0daf
make UNK_PERMS=allow NAME=targeted TYPE=mcs DISTRO=%{distro} UBAC=n DIRECT_INITRC=n MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} PKGNAME=%{name}-%{version} POLY=y MLS_CATS=1024 MCS_CATS=1024 install-headers install-docs
ce7f30
mkdir %{buildroot}%{_usr}/share/selinux/devel/
62cfaf
mkdir %{buildroot}%{_usr}/share/selinux/packages/
ce7f30
mv %{buildroot}%{_usr}/share/selinux/targeted/include %{buildroot}%{_usr}/share/selinux/devel/include
7f9951
install -m 755 $RPM_SOURCE_DIR/policygentool %{buildroot}%{_usr}/share/selinux/devel/
7f9951
install -m 644 $RPM_SOURCE_DIR/Makefile.devel %{buildroot}%{_usr}/share/selinux/devel/Makefile
ce7f30
install -m 644 doc/example.* %{buildroot}%{_usr}/share/selinux/devel/
364044
install -m 644 doc/policy.* %{buildroot}%{_usr}/share/selinux/devel/
f1a827
echo  "xdg-open file:///usr/share/doc/selinux-policy-%{version}/html/index.html"> %{buildroot}%{_usr}/share/selinux/devel/policyhelp
ce7f30
chmod +x %{buildroot}%{_usr}/share/selinux/devel/policyhelp
ce7f30
1580c8
%clean
ca8bc2
%{__rm} -fR %{buildroot}
1580c8
9c64bb
%post
af6090
if [ ! -s /etc/selinux/config ]; then
af6090
	#
af6090
	#	New install so we will default to targeted policy
af6090
	#
af6090
	echo "
af6090
# This file controls the state of SELinux on the system.
af6090
# SELINUX= can take one of these three values:
af6090
#	enforcing - SELinux security policy is enforced.
af6090
#	permissive - SELinux prints warnings instead of enforcing.
af6090
#	disabled - No SELinux policy is loaded.
af6090
SELINUX=enforcing
af6090
# SELINUXTYPE= can take one of these two values:
56187c
#	targeted - Targeted processes are protected,
af6090
#	mls - Multi Level Security protection.
af6090
SELINUXTYPE=targeted 
af6090
af6090
" > /etc/selinux/config
af6090
6e9bcb
	ln -sf ../selinux/config /etc/sysconfig/selinux 
d44a39
	restorecon /etc/selinux/config 2> /dev/null || :
af6090
else
97081d
	. /etc/selinux/config
af6090
	# if first time update booleans.local needs to be copied to sandbox
9c64bb
	[ -f /etc/selinux/${SELINUXTYPE}/booleans.local ] && mv /etc/selinux/${SELINUXTYPE}/booleans.local /etc/selinux/targeted/modules/active/
9c64bb
	[ -f /etc/selinux/${SELINUXTYPE}/seusers ] && cp -f /etc/selinux/${SELINUXTYPE}/seusers /etc/selinux/${SELINUXTYPE}/modules/active/seusers
af6090
	grep -q "^SETLOCALDEFS" /etc/selinux/config || echo -n "
af6090
">> /etc/selinux/config
af6090
fi
081b6a
exit 0
9c64bb
5ff36d
%postun
bbaa1f
if [ $1 = 0 ]; then
bbaa1f
	setenforce 0 2> /dev/null
bbaa1f
	if [ ! -s /etc/selinux/config ]; then
bbaa1f
		echo "SELINUX=disabled" > /etc/selinux/config
bbaa1f
	else
bbaa1f
		sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config
bbaa1f
	fi
5ff36d
fi
a4ec9b
exit 0
5ff36d
bd3f0e
%if %{BUILD_TARGETED}
bd3f0e
%package targeted
bd3f0e
Summary: SELinux targeted base policy
fb11ad
Provides: selinux-policy-base
bd3f0e
Group: System Environment/Base
d83af2
Obsoletes: selinux-policy-targeted-sources < 2
23e708
Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}
d83af2
Requires(pre): coreutils
d83af2
Requires(pre): selinux-policy = %{version}-%{release}
b4cab5
Conflicts:  audispd-plugins <= 1.7.7-1
236d3c
Obsoletes: mod_fcgid-selinux
6b7b0c
Conflicts:  seedit
bd3f0e
bd3f0e
%description targeted
bd3f0e
SELinux Reference policy targeted base module.
bd3f0e
bd3f0e
%pre targeted
bd3f0e
%saveFileContext targeted
bd3f0e
9c64bb
%post targeted
e080bb
if [ $1 -eq 1 ]; then
07c04f
   packages="%{expand:%%moduleList targeted}"
e080bb
   %loadpolicy targeted $packages
e080bb
   restorecon -R /root /var/log /var/run 2> /dev/null
e080bb
else
9de703
   semodule -n -s targeted -r moilscanner -r mailscanner -r gamin -r audio_entropy -r iscsid -r polkit_auth -r polkit -r rtkit_daemon -r ModemManager 2>/dev/null
07c04f
   packages="%{expand:%%moduleList targeted}"
e080bb
   %loadpolicy targeted $packages
e080bb
   %relabel targeted
e080bb
fi
e080bb
exit 0
d83af2
5baf53
%triggerpostun targeted -- selinux-policy-targeted < 3.2.5-9.fc9
4b1d56
. /etc/selinux/config
4b1d56
[ "${SELINUXTYPE}" != "targeted" ] && exit 0
af6777
setsebool -P use_nfs_home_dirs=1
df6220
semanage user -l | grep -s unconfined_u > /dev/null
a6e128
if [ $? -eq 0 ]; then
df6220
   semanage user -m -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u
99d367
else
df6220
   semanage user -a -P user -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u
99d367
fi
99d367
seuser=`semanage login -l | grep __default__ | awk '{ print $2 }'`
4b1d56
[ "$seuser" != "unconfined_u" ]  && semanage login -m -s "unconfined_u"  -r s0-s0:c0.c1023 __default__
99d367
seuser=`semanage login -l | grep root | awk '{ print $2 }'`
e080bb
[ "$seuser" = "system_u" ] && semanage login -m -s "unconfined_u"  -r s0-s0:c0.c1023 root
1ffa68
restorecon -R /root /etc/selinux/targeted 2> /dev/null
5baf53
semodule -r qmail 2> /dev/null
a4ec9b
exit 0
af6090
bd3f0e
%files targeted
4d59c2
%config(noreplace) %{_sysconfdir}/selinux/targeted/contexts/users/unconfined_u
4d59c2
%fileList targeted
a4ec9b
%endif
a4ec9b
675bba
%if %{BUILD_MINIMUM}
675bba
%package minimum
675bba
Summary: SELinux minimum base policy
675bba
Provides: selinux-policy-base
675bba
Group: System Environment/Base
23e708
Requires(post): policycoreutils-python >= %{POLICYCOREUTILSVER}
675bba
Requires(pre): coreutils
675bba
Requires(pre): selinux-policy = %{version}-%{release}
6b7b0c
Conflicts:  seedit
675bba
675bba
%description minimum
675bba
SELinux Reference policy minimum base module.
675bba
675bba
%pre minimum
675bba
%saveFileContext minimum
675bba
675bba
%post minimum
07c04f
%loadpolicy minimum
0e31a0
if [ $1 -eq 1 ]; then
675bba
semanage -S minimum -i - << __eof
675bba
login -m  -s unconfined_u -r s0-s0:c0.c1023 __default__
675bba
login -m  -s unconfined_u -r s0-s0:c0.c1023 root
675bba
__eof
675bba
restorecon -R /root /var/log /var/run 2> /dev/null
675bba
else
675bba
%relabel minimum
675bba
fi
675bba
exit 0
675bba
675bba
%files minimum
675bba
%config(noreplace) %{_sysconfdir}/selinux/minimum/contexts/users/unconfined_u
675bba
%fileList minimum
675bba
%endif
675bba
a4ec9b
%if %{BUILD_OLPC}
a4ec9b
%package olpc 
a4ec9b
Summary: SELinux olpc base policy
a4ec9b
Group: System Environment/Base
fb11ad
Provides: selinux-policy-base
23e708
Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}
d83af2
Requires(pre): coreutils
d83af2
Requires(pre): selinux-policy = %{version}-%{release}
6b7b0c
Conflicts:  seedit
a4ec9b
a4ec9b
%description olpc 
a4ec9b
SELinux Reference policy olpc base module.
a4ec9b
a4ec9b
%pre olpc 
a4ec9b
%saveFileContext olpc
a4ec9b
a4ec9b
%post olpc 
07c04f
packages="%{expand:%%moduleList olpc}"
c32d79
%loadpolicy olpc $packages
8fd9df
a6e128
if [ $1 -ne 1 ]; then
a4ec9b
%relabel olpc
24ccb8
fi
a4ec9b
exit 0
a4ec9b
a4ec9b
%files olpc
a4ec9b
%fileList olpc
bd3f0e
bd3f0e
%endif
bd3f0e
bd3f0e
%if %{BUILD_MLS}
504da9
%package mls 
504da9
Summary: SELinux mls base policy
1580c8
Group: System Environment/Base
fb11ad
Provides: selinux-policy-base
d83af2
Obsoletes: selinux-policy-mls-sources < 2
c77aca
Requires: policycoreutils-newrole >= %{POLICYCOREUTILSVER} setransd
23e708
Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}
d83af2
Requires(pre): coreutils
d83af2
Requires(pre): selinux-policy = %{version}-%{release}
6b7b0c
Conflicts:  seedit
1580c8
504da9
%description mls 
504da9
SELinux Reference policy mls base module.
1580c8
504da9
%pre mls 
504da9
%saveFileContext mls
1580c8
504da9
%post mls 
e9eca4
semodule -n -s mls -r mailscanner -r polkit -r ModemManager 2>/dev/null
c32d79
packages="%{expand:%%moduleList mls}"
c32d79
%loadpolicy mls $packages
8fd9df
24ccb8
if [ $1 != 1 ]; then
504da9
%relabel mls
24ccb8
fi
a4ec9b
exit 0
1580c8
504da9
%files mls
57ae10
%config(noreplace) %{_sysconfdir}/selinux/mls/contexts/users/unconfined_u
504da9
%fileList mls
3e930b
bd3f0e
%endif
bd3f0e
56187c
%changelog
d9d64e
* Wed Sep 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-16
d9d64e
- Fix minimum policy installs
d9d64e
- Allow udev and rpcbind to request the kernel to load modules
d9d64e
6769b1
* Wed Sep 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-15
e9eca4
- Add plymouth policy
6769b1
- Allow local_login to sys_admin
e9eca4
e9eca4
* Tue Sep 29 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-13
e9eca4
- Allow cupsd_config to read user tmp
e9eca4
- Allow snmpd_t to signal itself
e9eca4
- Allow sysstat_t to makedir in sysstat_log_t
e9eca4
e9eca4
* Fri Sep 25 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-12
e9eca4
- Update rhcs policy
e9eca4
85582d
* Thu Sep 24 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-11
85582d
- Allow users to exec restorecond
85582d
f5a104
* Tue Sep 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-10
f5a104
- Allow sendmail to request kernel modules load
f5a104
4c2f29
* Mon Sep 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-9
405a74
- Fix all kernel_request_load_module domains
405a74
4c2f29
* Mon Sep 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-8
4c2f29
- Fix all kernel_request_load_module domains
405a74
41f8e3
* Sun Sep 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-7
41f8e3
- Remove allow_exec* booleans for confined users.  Only available for unconfined_t
41f8e3
8323d5
* Fri Sep 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-6
8323d5
- More fixes for sandbox_web_t
8323d5
ab4629
* Fri Sep 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-5
ab4629
- Allow sshd to create .ssh directory and content
ab4629
d53d15
* Fri Sep 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-4
d53d15
- Fix request_module line to module_request
d53d15
1fb0a9
* Fri Sep 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-3
1fb0a9
- Fix sandbox policy to allow it to run under firefox.  
1fb0a9
- Dont audit leaks.
1fb0a9
1fb0a9
* Thu Sep 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-2
9de703
- Fixes for sandbox
9de703
69290f
* Wed Sep 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-1
69290f
- Update to upstream
69290f
- Dontaudit nsplugin search /root
69290f
- Dontaudit nsplugin sys_nice
69290f
23e708
* Mon Sep 15 2009 Dan Walsh <dwalsh@redhat.com> 3.6.31-5
23e708
- Fix label on /usr/bin/notepad, /usr/sbin/vboxadd-service
23e708
- Remove policycoreutils-python requirement except for minimum
23e708
6b7b0c
* Mon Sep 14 2009 Dan Walsh <dwalsh@redhat.com> 3.6.31-4
6b7b0c
- Fix devicekit_disk_t to getattr on all domains sockets and fifo_files
6b7b0c
- Conflicts seedit (You can not use selinux-policy-targeted and seedit at the same time.)
6b7b0c
6b7b0c
e20e35
* Thu Sep 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.31-3
e20e35
- Add wordpress/wp-content/uploads label
e20e35
- Fixes for sandbox when run from staff_t
e20e35
ddc858
* Thu Sep 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.31-2
ddc858
- Update to upstream
ddc858
- Fixes for devicekit_disk
ddc858
b8498d
* Tue Sep 8 2009 Dan Walsh <dwalsh@redhat.com> 3.6.30-6
b8498d
- More fixes
b8498d
123ae9
* Tue Sep 8 2009 Dan Walsh <dwalsh@redhat.com> 3.6.30-5
123ae9
- Lots of fixes for initrc and other unconfined domains
123ae9
72bc25
* Fri Sep 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.30-4
72bc25
- Allow xserver to use  netlink_kobject_uevent_socket
72bc25
72bc25
* Thu Sep 3 2009 Dan Walsh <dwalsh@redhat.com> 3.6.30-3
72bc25
- Fixes for sandbox 
72bc25
1a2981
* Mon Aug 31 2009 Dan Walsh <dwalsh@redhat.com> 3.6.30-2
1a2981
- Dontaudit setroubleshootfix looking at /root directory
1a2981
65c3f9
* Mon Aug 31 2009 Dan Walsh <dwalsh@redhat.com> 3.6.30-1
65c3f9
- Update to upsteam
65c3f9
cb5670
* Mon Aug 31 2009 Dan Walsh <dwalsh@redhat.com> 3.6.29-2
cb5670
- Allow gssd to send signals to users
cb5670
- Fix duplicate label for apache content
cb5670
faf9cb
* Fri Aug 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.29-1
faf9cb
- Update to upstream
faf9cb
38d427
* Fri Aug 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-9
38d427
- Remove polkit_auth on upgrades
38d427
07c04f
* Wed Aug 26 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-8
07c04f
- Add back in unconfined.pp and unconfineduser.pp
42f9ef
- Add Sandbox unshare
07c04f
89e354
* Tue Aug 25 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-7
89e354
- Fixes for cdrecord, mdadm, and others
89e354
080ce6
* Sat Aug 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-6
080ce6
- Add capability setting to dhcpc and gpm
080ce6
8e64d7
* Sat Aug 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-5
8e64d7
- Allow cronjobs to read exim_spool_t
8e64d7
c5f5b5
* Fri Aug 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-4
c5f5b5
- Add ABRT policy
c5f5b5
e3dd49
* Thu Aug 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-3
e3dd49
- Fix system-config-services policy
e3dd49
fc8ff2
* Wed Aug 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-2
fc8ff2
- Allow libvirt to change user componant of virt_domain
fc8ff2
40243d
* Tue Aug 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-1
40243d
- Allow cupsd_config_t to be started by dbus
40243d
- Add smoltclient policy
40243d
9c2702
* Fri Aug 14 2009 Dan Walsh <dwalsh@redhat.com> 3.6.27-1
9c2702
- Add policycoreutils-python to pre install
9c2702
b2c5e7
* Thu Aug 13 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-11
b2c5e7
- Make all unconfined_domains permissive so we can see what AVC's happen 
b2c5e7
7fe210
* Mon Aug 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-10
7fe210
- Add pt_chown policy
7fe210
867473
* Mon Aug 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-9
867473
- Add kdump policy for Miroslav Grepl
867473
- Turn off execstack boolean
867473
ac7bbf
* Fri Aug 7 2009 Bill Nottingham <notting@redhat.com> 3.6.26-8
ac7bbf
- Turn on execstack on a temporary basis (#512845)
ac7bbf
4de382
* Thu Aug 6 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-7
4de382
- Allow nsplugin to connecto the session bus
4de382
- Allow samba_net to write to coolkey data
4de382
e21330
* Wed Aug 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-6
e21330
- Allow devicekit_disk to list inotify
e21330
4816e9
* Wed Aug 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-5
4816e9
- Allow svirt images to create sock_file in svirt_var_run_t
4816e9
467326
* Tue Aug 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-4
467326
- Allow exim to getattr on mountpoints
467326
- Fixes for pulseaudio
467326
947b43
* Fri Jul 31 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-3
947b43
- Allow svirt_t to stream_connect to virtd_t
947b43
af4fa8
* Fri Jul 31 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-2
af4fa8
- Allod hald_dccm_t to create sock_files in /tmp
af4fa8
af4fa8
* Thu Jul 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.26-1
abd153
- More fixes from upstream
abd153
c6e222
* Tue Jul 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.25-1
c6e222
- Fix polkit label
c6e222
- Remove hidebrokensymptoms for nss_ldap fix
c6e222
- Add modemmanager policy
c6e222
- Lots of merges from upstream
c6e222
- Begin removing textrel_shlib_t labels, from fixed libraries
c6e222
375056
* Tue Jul 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.24-1
375056
- Update to upstream
375056
916052
* Mon Jul 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.23-2
916052
- Allow certmaster to override dac permissions
916052
df7055
* Thu Jul 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.23-1
df7055
- Update to upstream
df7055
df7055
* Tue Jul 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.22-3
8da024
- Fix context for VirtualBox
8da024
2360ff
* Tue Jul 14 2009 Dan Walsh <dwalsh@redhat.com> 3.6.22-1
2360ff
- Update to upstream
2360ff
2360ff
* Fri Jul 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.21-4
2360ff
- Allow clamscan read amavis spool files
2360ff
a88b48
* Wed Jul 8 2009 Dan Walsh <dwalsh@redhat.com> 3.6.21-3
a88b48
- Fixes for xguest
a88b48
a85aef
* Tue Jul  7 2009 Tom "spot" Callaway <tcallawa@redhat.com> 3.6.21-2
a85aef
- fix multiple directory ownership of mandirs
a85aef
d9676a
* Wed Jul 1 2009 Dan Walsh <dwalsh@redhat.com> 3.6.21-1
d9676a
- Update to upstream
d9676a
bcc53d
* Tue Jun 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.20-2
bcc53d
- Add rules for rtkit-daemon
bcc53d
7b16d5
* Thu Jun 25 2009 Dan Walsh <dwalsh@redhat.com> 3.6.20-1
7b16d5
- Update to upstream
7b16d5
- Fix nlscd_stream_connect
7b16d5
221642
* Thu Jun 25 2009 Dan Walsh <dwalsh@redhat.com> 3.6.19-5
221642
- Add rtkit policy
221642
d399fb
* Wed Jun 24 2009 Dan Walsh <dwalsh@redhat.com> 3.6.19-4
d399fb
- Allow rpcd_t to stream connect to rpcbind
d399fb
9850f4
* Tue Jun 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.19-3
9850f4
- Allow kpropd to create tmp files
9850f4
93dc66
* Tue Jun 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.19-2
93dc66
- Fix last duplicate /var/log/rpmpkgs
93dc66
93dc66
* Mon Jun 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.19-1
a9f095
- Update to upstream
a9f095
  * add sssd
a9f095
886631
* Sat Jun 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.18-1
886631
- Update to upstream
886631
  * cleanup
607109
* Fri Jun 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.17-1
607109
- Update to upstream
607109
- Additional mail ports
607109
- Add virt_use_usb boolean for svirt
607109
9386d6
* Thu Jun 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.16-4
9386d6
- Fix mcs rules to include chr_file and blk_file
9386d6
e3bf67
* Tue Jun 16 2009 Dan Walsh <dwalsh@redhat.com> 3.6.16-3
e3bf67
- Add label for udev-acl
e3bf67
f8df9e
* Mon Jun 15 2009 Dan Walsh <dwalsh@redhat.com> 3.6.16-2
f8df9e
- Additional rules for consolekit/udev, privoxy and various other fixes
f8df9e
49883e
* Fri Jun 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.16-1
d3ae97
- New version for upstream
d3ae97
6b8380
* Thu Jun 11 2009 Dan Walsh <dwalsh@redhat.com> 3.6.14-3
6b8380
- Allow NetworkManager to read inotifyfs
6b8380
aa7b9c
* Wed Jun 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.14-2
aa7b9c
- Allow setroubleshoot to run mlocate
aa7b9c
819771
* Mon Jun 8 2009 Dan Walsh <dwalsh@redhat.com> 3.6.14-1
819771
- Update to upstream 
819771
819771
* Tue Jun 2 2009 Dan Walsh <dwalsh@redhat.com> 3.6.13-3
819771
- Add fish as a shell
819771
- Allow fprintd to list usbfs_t
819771
- Allow consolekit to search mountpoints
819771
- Add proper labeling for shorewall
819771
9ee63d
* Tue May 26 2009 Dan Walsh <dwalsh@redhat.com> 3.6.13-2
9ee63d
- New log file for vmware
9ee63d
- Allow xdm to setattr on user_tmp_t
9ee63d
ef7416
* Thu May 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.13-1
ef7416
- Upgrade to upstream
ef7416
eead2a
* Wed May 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-39
eead2a
- Allow fprintd to access sys_ptrace
eead2a
- Add sandbox policy
eead2a
7b6c10
* Mon May 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-38
7b6c10
- Add varnishd policy
7b6c10
f72bd4
* Thu May 14 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-37
f72bd4
- Fixes for kpropd
f72bd4
fcb441
* Tue May 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-36
fcb441
- Allow brctl to r/w tun_tap_device_t
fcb441
62cfaf
* Mon May 11 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-35
62cfaf
- Add /usr/share/selinux/packages
62cfaf
0f6b92
* Mon May 11 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-34
0f6b92
- Allow rpcd_t to send signals to kernel threads
0f6b92
992419
* Fri May 7 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-33
992419
- Fix upgrade for F10 to F11
992419
a2098a
* Thu May 7 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-31
a2098a
- Add policy for /var/lib/fprint
a2098a
8a0604
* Tue May 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-30
8a0604
-Remove duplicate line
8a0604
959ab9
* Tue May 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-29
959ab9
- Allow svirt to manage pci and other sysfs device data
959ab9
0e31a0
* Mon May 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-28
0e31a0
- Fix package selection handling
0e31a0
5dd89f
* Fri May 1 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-27
5dd89f
- Fix /sbin/ip6tables-save context
c32d79
- Allod udev to transition to mount
c32d79
- Fix loading of mls policy file
5dd89f
37ebfc
* Thu Apr 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-26
37ebfc
- Add shorewall policy
37ebfc
37ebfc
* Wed Apr 29 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-25
21b13f
- Additional rules for fprintd and sssd
21b13f
40d8f6
* Tue Apr 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-24
40d8f6
- Allow nsplugin to unix_read unix_write sem for unconfined_java
40d8f6
b3ac4a
* Tue Apr 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-23
b3ac4a
- Fix uml files to be owned by users
b3ac4a
e080bb
* Tue Apr 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-22
e080bb
- Fix Upgrade path to install unconfineduser.pp when unocnfined package is 3.0.0 or less
e080bb
b11dbb
* Mon Apr 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-21
e080bb
- Allow confined users to manage virt_content_t, since this is home dir content
b11dbb
- Allow all domains to read rpm_script_tmp_t which is what shell creates on redirection
b11dbb
b0991a
* Mon Apr 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-20
b0991a
- Fix labeling on /var/lib/misc/prelink*
b0991a
- Allow xserver to rw_shm_perms with all x_clients
b0991a
- Allow prelink to execute files in the users home directory
b0991a
89c9c9
* Fri Apr 24 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-19
dac838
- Allow initrc_t to delete dev_null
dac838
- Allow readahead to configure auditing
eaaf2a
- Fix milter policy
eaaf2a
- Add /var/lib/readahead
dac838
cd0a39
* Fri Apr 24 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-16
cd0a39
- Update to latest milter code from Paul Howarth
cd0a39
5ce1c4
* Thu Apr 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-15
5ce1c4
- Additional perms for readahead
5ce1c4
4d5adb
* Thu Apr 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-14
4d5adb
- Allow pulseaudio to acquire_svc on session bus
4d5adb
- Fix readahead labeling
4d5adb
4d5adb
* Thu Apr 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-13
4d5adb
- Allow sysadm_t to run rpm directly
4d5adb
- libvirt needs fowner
4d5adb
3c498a
* Wed Apr 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-12
3c498a
- Allow sshd to read var_lib symlinks for freenx
3c498a
a32a15
* Tue Apr 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-11
a32a15
- Allow nsplugin unix_read and write on users shm and sem
a32a15
- Allow sysadm_t to execute su
a32a15
a32a15
* Tue Apr 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-10
a32a15
- Dontaudit attempts to getattr user_tmpfs_t by lvm
a32a15
- Allow nfs to share removable media
a32a15
a32a15
* Mon Apr 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-9
a32a15
- Add ability to run postdrop from confined users
a32a15
d982e7
* Sat Apr 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-8
d982e7
- Fixes for podsleuth
d982e7
d982e7
* Fri Apr 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-7
d982e7
- Turn off nsplugin transition
d982e7
- Remove Konsole leaked file descriptors for release
dc00fc
dc00fc
* Fri Apr 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-6
6203f4
- Allow cupsd_t to create link files in print_spool_t
dc00fc
- Fix iscsi_stream_connect typo
dc00fc
- Fix labeling on /etc/acpi/actions
dc00fc
- Don't reinstall unconfine and unconfineuser on upgrade if they are not installed
6203f4
4a0aac
* Tue Apr 14 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-5
4a0aac
- Allow audioentroy to read etc files
4a0aac
685032
* Mon Apr 13 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-4
685032
- Add fail2ban_var_lib_t
685032
- Fixes for devicekit_power_t
685032
d4af17
* Thu Apr 9 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-3
d4af17
- Separate out the ucnonfined user from the unconfined.pp package
d4af17
90e419
* Wed Apr 7 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-2
90e419
- Make sure unconfined_java_t and unconfined_mono_t create user_tmpfs_t.
90e419
25a476
* Tue Apr 7 2009 Dan Walsh <dwalsh@redhat.com> 3.6.12-1
25a476
- Upgrade to latest upstream
25a476
- Allow devicekit_disk sys_rawio
25a476
510c2a
* Mon Apr 6 2009 Dan Walsh <dwalsh@redhat.com> 3.6.11-1
510c2a
- Dontaudit binds to ports < 1024 for named
510c2a
- Upgrade to latest upstream
510c2a
04b682
* Fri Apr 3 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-9
04b682
- Allow podsleuth to use tmpfs files
04b682
80beee
* Fri Apr 3 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-8
80beee
- Add customizable_types for svirt
80beee
f49c57
* Fri Apr 3 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-7
f49c57
- Allow setroubelshoot exec* privs to prevent crash from bad libraries
f49c57
- add cpufreqselector
f49c57
90ea5b
* Thu Apr 2 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-6
90ea5b
- Dontaudit listing of /root directory for cron system jobs
90ea5b
3434a9
* Mon Mar 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-5
3434a9
- Fix missing ld.so.cache label
3434a9
c0158a
* Fri Mar 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-4
c0158a
- Add label for ~/.forward and /root/.forward
c0158a
6130d5
* Thu Mar 26 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-3
6130d5
- Fixes for svirt
6130d5
9ca87f
* Thu Mar 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-2
9ca87f
- Fixes to allow svirt read iso files in homedir
9ca87f
5dce3c
* Thu Mar 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-1
5dce3c
- Add xenner and wine fixes from mgrepl
5dce3c
bfc78b
* Wed Mar 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.9-4
bfc78b
- Allow mdadm to read/write mls override
bfc78b
095146
* Tue Mar 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.9-3
095146
- Change to svirt to only access svirt_image_t
095146
d4b8dc
* Thu Mar 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.9-2
d4b8dc
- Fix libvirt policy
d4b8dc
b12011
* Thu Mar 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.9-1
b12011
- Upgrade to latest upstream
b12011
c240b6
* Tue Mar 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.8-4
c240b6
- Fixes for iscsid and sssd
c240b6
- More cleanups for upgrade from F10 to Rawhide.
c240b6
e72f55
* Mon Mar 9 2009 Dan Walsh <dwalsh@redhat.com> 3.6.8-3
e72f55
- Add pulseaudio, sssd policy
e72f55
- Allow networkmanager to exec udevadm
e72f55
0c34c6
* Sat Mar 7 2009 Dan Walsh <dwalsh@redhat.com> 3.6.8-2
0c34c6
- Add pulseaudio context
0c34c6
a67a1c
* Thu Mar 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.8-1
a67a1c
- Upgrade to latest patches
a67a1c
0a03cc
* Wed Mar 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.7-2
0a03cc
- Fixes for libvirt
0a03cc
8c3a31
* Mon Mar 2 2009 Dan Walsh <dwalsh@redhat.com> 3.6.7-1
8c3a31
- Update to Latest upstream
8c3a31
8c3a31
* Sat Feb 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-9
8c3a31
- Fix setrans.conf to show SystemLow for s0
8c3a31
496752
* Fri Feb 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-8
496752
- Further confinement of qemu images via svirt
496752
150ff5
* Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.6.6-7
150ff5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
150ff5
52cbcb
* Thu Feb 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-6
52cbcb
- Allow NetworkManager to manage /etc/NetworkManager/system-connections
52cbcb
de6774
* Wed Feb 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-5
de6774
- add virtual_image_context and virtual_domain_context files
de6774
8f6e43
* Tue Feb 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-4
8f6e43
- Allow rpcd_t to send signal to mount_t
8f6e43
- Allow libvirtd to run ranged
8f6e43
8c2b68
* Tue Feb 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-3
8c2b68
- Fix sysnet/net_conf_t
8c2b68
817947
* Tue Feb 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-2
817947
- Fix squidGuard labeling
817947
2eec43
* Wed Feb 11 2009 Dan Walsh <dwalsh@redhat.com> 3.6.6-1
2eec43
- Re-add corenet_in_generic_if(unlabeled_t)
2eec43
e46e00
* Wed Feb 11 2009 Dan Walsh <dwalsh@redhat.com> 3.6.5-3
e46e00
1d1c05
* Tue Feb 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.5-2
1d1c05
- Add git web policy
1d1c05
bd0db4
* Mon Feb 9 2009 Dan Walsh <dwalsh@redhat.com> 3.6.5-1
bd0db4
- Add setrans contains from upstream 
bd0db4
bd0db4
* Mon Feb 9 2009 Dan Walsh <dwalsh@redhat.com> 3.6.4-6
bd0db4
- Do transitions outside of the booleans
bd0db4
4ed140
* Sun Feb 8 2009 Dan Walsh <dwalsh@redhat.com> 3.6.4-5
4ed140
- Allow xdm to create user_tmp_t sockets for switch user to work
4ed140
bc861e
* Thu Feb 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.4-4
bc861e
- Fix staff_t domain
bc861e
73fe81
* Thu Feb 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.4-3
73fe81
- Grab remainder of network_peer_controls patch
73fe81
659e96
* Wed Feb 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.4-2
659e96
- More fixes for devicekit
659e96
c957c3
* Tue Feb 3 2009 Dan Walsh <dwalsh@redhat.com> 3.6.4-1
c957c3
- Upgrade to latest upstream 
c957c3
574cab
* Mon Feb 2 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-13
574cab
- Add boolean to disallow unconfined_t login
574cab
0554a1
* Fri Jan 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-12
0554a1
- Add back transition from xguest to mozilla
0554a1
ab3e55
* Fri Jan 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-11
ab3e55
- Add virt_content_ro_t and labeling for isos directory
ab3e55
f89910
* Tue Jan 27 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-10
f89910
- Fixes for wicd daemon
f89910
48adbe
* Mon Jan 26 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-9
48adbe
- More mls/rpm fixes 
48adbe
14c9b9
* Fri Jan 23 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-8
14c9b9
- Add policy to make dbus/nm-applet work
14c9b9
40dd24
* Thu Jan 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-7
40dd24
- Remove polgen-ifgen from post and add trigger to policycoreutils-python
40dd24
6f8856
* Wed Jan 21 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-6
1b94a1
- Add wm policy
6cf32a
- Make mls work in graphics mode
1b94a1
2a4bda
* Tue Jan 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-3
2a4bda
- Fixed for DeviceKit
2a4bda
acc137
* Mon Jan 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-2
acc137
- Add devicekit policy
acc137
1d72fb
* Mon Jan 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.3-1
1d72fb
- Update to upstream
1d72fb
eacea1
* Thu Jan 15 2009 Dan Walsh <dwalsh@redhat.com> 3.6.2-5
eacea1
- Define openoffice as an x_domain
eacea1
339bf3
* Mon Jan 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.2-4
339bf3
- Fixes for reading xserver_tmp_t
339bf3
87fb15
* Thu Jan 8 2009 Dan Walsh <dwalsh@redhat.com> 3.6.2-3
87fb15
- Allow cups_pdf_t write to nfs_t
87fb15
2ed2ff
* Tue Jan 6 2009 Dan Walsh <dwalsh@redhat.com> 3.6.2-2
2ed2ff
- Remove audio_entropy policy
2ed2ff
292c49
* Mon Jan 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.2-1
292c49
- Update to upstream
292c49
5df262
* Sun Jan 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.1-15
5df262
- Allow hal_acl_t to getattr/setattr fixed_disk
5df262
323639
* Sat Dec 27 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-14
323639
- Change userdom_read_all_users_state to include reading symbolic links in /proc
323639
cf8fd9
* Mon Dec 22 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-13
cf8fd9
- Fix dbus reading /proc information
cf8fd9
bae2e9
* Thu Dec 18 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-12
bae2e9
- Add missing alias for home directory content
bae2e9
33c7ea
* Wed Dec 17 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-11
33c7ea
- Fixes for IBM java location
33c7ea
dcd0c9
* Thu Dec 11 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-10
dcd0c9
- Allow unconfined_r unconfined_java_t
dcd0c9
fd2b62
* Tue Dec 9 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-9
fd2b62
- Add cron_role back to user domains
fd2b62
9a43d2
* Mon Dec 8 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-8
9a43d2
- Fix sudo setting of user keys
9a43d2
2ae161
* Thu Dec 4 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-7
01ce3d
- Allow iptables to talk to terminals
2ae161
- Fixes for policy kit
2ae161
- lots of fixes for booting. 
01ce3d
bcb192
* Wed Dec 3 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-4
739db2
- Cleanup policy
739db2
23d684
* Mon Dec 01 2008 Ignacio Vazquez-Abrams <ivazqueznet+rpm@gmail.com> - 3.6.1-2
23d684
- Rebuild for Python 2.6
23d684
02d888
* Fri Nov 5 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-19
02d888
- Fix labeling on /var/spool/rsyslog
02d888
0d6e62
* Thu Nov 5 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-18
0d6e62
- Allow postgresl to bind to udp nodes
0d6e62
2a650e
* Wed Nov 5 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-17
2a650e
- Allow lvm to dbus chat with hal
2a650e
- Allow rlogind to read nfs_t 
2a650e
074b12
* Wed Nov 5 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-16
074b12
- Fix cyphesis file context
074b12
6a09cf
* Tue Nov 3 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-15
6a09cf
- Allow hal/pm-utils to look at /var/run/video.rom
6a09cf
- Add ulogd policy
6a09cf
411a42
* Tue Nov 3 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-14
411a42
- Additional fixes for cyphesis
411a42
- Fix certmaster file context
411a42
- Add policy for system-config-samba
6a09cf
- Allow hal to read /var/run/video.rom
411a42
333ebd
* Mon Nov 3 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-13
333ebd
- Allow dhcpc to restart ypbind
333ebd
- Fixup labeling in /var/run
333ebd
333ebd
* Thu Oct 30 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-12
333ebd
- Add certmaster policy
333ebd
1bc89b
* Wed Oct 29 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-11
236205
- Fix confined users 
236205
- Allow xguest to read/write xguest_dbusd_t
236205
a3e038
* Mon Oct 27 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-9
a3e038
- Allow openoffice execstack/execmem privs
a3e038
4fa9db
* Fri Oct 24 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-8
4fa9db
- Allow mozilla to run with unconfined_execmem_t
4fa9db
798a73
* Thu Oct 23 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-7
798a73
- Dontaudit domains trying to write to .xsession-errors
798a73
328123
* Thu Oct 23 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-6
328123
- Allow nsplugin to look at autofs_t directory
328123
de61cc
* Wed Oct 22 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-5
de61cc
- Allow kerneloops to create tmp files
de61cc
ae68d9
* Wed Oct 22 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-4
ae68d9
- More alias for fastcgi
ae68d9
236d3c
* Tue Oct 21 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-3
236d3c
- Remove mod_fcgid-selinux package
236d3c
b9e15d
* Mon Oct 20 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-2
b9e15d
- Fix dovecot access
b9e15d
49f48f
* Fri Oct 17 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-1
49f48f
- Policy cleanup 
49f48f
611568
* Thu Oct 16 2008 Dan Walsh <dwalsh@redhat.com> 3.5.12-3
611568
- Remove Multiple spec
611568
- Add include
611568
- Fix makefile to not call per_role_expansion
611568
4b4392
* Wed Oct 15 2008 Dan Walsh <dwalsh@redhat.com> 3.5.12-2
4b4392
- Fix labeling of libGL
4b4392
b6cc6a
* Fri Oct 10 2008 Dan Walsh <dwalsh@redhat.com> 3.5.12-1
b6cc6a
- Update to upstream
b6cc6a
675bba
* Wed Oct 8 2008 Dan Walsh <dwalsh@redhat.com> 3.5.11-1
675bba
- Update to upstream policy
675bba
1062bd
* Mon Oct 6 2008 Dan Walsh <dwalsh@redhat.com> 3.5.10-3
1062bd
- Fixes for confined xwindows and xdm_t 
1062bd
86369e
* Fri Oct 3 2008 Dan Walsh <dwalsh@redhat.com> 3.5.10-2
86369e
- Allow confined users and xdm to exec wm
86369e
- Allow nsplugin to talk to fifo files on nfs
86369e
f1a827
* Fri Oct 3 2008 Dan Walsh <dwalsh@redhat.com> 3.5.10-1
f1a827
- Allow NetworkManager to transition to avahi and iptables
b42a1e
- Allow domains to search other domains keys, coverup kernel bug
b42a1e
094ef3
* Wed Oct 1 2008 Dan Walsh <dwalsh@redhat.com> 3.5.9-4
094ef3
- Fix labeling for oracle 
094ef3
2ede4e
* Wed Oct 1 2008 Dan Walsh <dwalsh@redhat.com> 3.5.9-3
2ede4e
- Allow nsplugin to comminicate with xdm_tmp_t sock_file
2ede4e
998737
* Mon Sep 29 2008 Dan Walsh <dwalsh@redhat.com> 3.5.9-2
998737
- Change all user tmpfs_t files to be labeled user_tmpfs_t
998737
- Allow radiusd to create sock_files
998737
b709ff
* Wed Sep 24 2008 Dan Walsh <dwalsh@redhat.com> 3.5.9-1
b709ff
- Upgrade to upstream
b709ff
ed32c6
* Tue Sep 23 2008 Dan Walsh <dwalsh@redhat.com> 3.5.8-7
ed32c6
- Allow confined users to login with dbus
ed32c6
d86efe
* Mon Sep 22 2008 Dan Walsh <dwalsh@redhat.com> 3.5.8-6
d86efe
- Fix transition to nsplugin
d86efe
f0375d
* Mon Sep 22 2008 Dan Walsh <dwalsh@redhat.com> 3.5.8-5
f0375d
- Add file context for /dev/mspblk.*
f0375d
f77dd2
* Sun Sep 21 2008 Dan Walsh <dwalsh@redhat.com> 3.5.8-4
f77dd2
- Fix transition to nsplugin
f77dd2
'
11ef24
* Thu Sep 18 2008 Dan Walsh <dwalsh@redhat.com> 3.5.8-3
530772
- Fix labeling on new pm*log
530772
- Allow ssh to bind to all nodes
530772
16c3ff
* Thu Sep 11 2008 Dan Walsh <dwalsh@redhat.com> 3.5.8-1
16c3ff
- Merge upstream changes
16c3ff
- Add Xavier Toth patches
16c3ff
16c3ff
* Wed Sep 10 2008 Dan Walsh <dwalsh@redhat.com> 3.5.7-2
16c3ff
- Add qemu_cache_t for /var/cache/libvirt
16c3ff
aca77a
* Fri Sep 5 2008 Dan Walsh <dwalsh@redhat.com> 3.5.7-1
aca77a
- Remove gamin policy
aca77a
d0d307
* Thu Sep 4 2008 Dan Walsh <dwalsh@redhat.com> 3.5.6-2
d0d307
- Add tinyxs-max file system support
d0d307
0a219f
* Wed Sep 3 2008 Dan Walsh <dwalsh@redhat.com> 3.5.6-1
0a219f
- Update to upstream
0a219f
- 	 New handling of init scripts
0a219f
0a219f
* Fri Aug 29 2008 Dan Walsh <dwalsh@redhat.com> 3.5.5-4
0a219f
- Allow pcsd to dbus
0a219f
- Add memcache policy
0a219f
3ad355
* Fri Aug 29 2008 Dan Walsh <dwalsh@redhat.com> 3.5.5-3
3ad355
- Allow audit dispatcher to kill his children
3ad355
cd8bee
* Tue Aug 26 2008 Dan Walsh <dwalsh@redhat.com> 3.5.5-2
cd8bee
- Update to upstream
cd8bee
- Fix crontab use by unconfined user
cd8bee
eb7e6d
* Tue Aug 12 2008 Dan Walsh <dwalsh@redhat.com> 3.5.4-2
eb7e6d
- Allow ifconfig_t to read dhcpc_state_t
eb7e6d
1a0f64
* Mon Aug 11 2008 Dan Walsh <dwalsh@redhat.com> 3.5.4-1
1a0f64
- Update to upstream
1a0f64
b5d09d
* Thu Aug 7 2008 Dan Walsh <dwalsh@redhat.com> 3.5.3-1
b5d09d
- Update to upstream 
b5d09d
0f1bd6
* Wed Aug 2 2008 Dan Walsh <dwalsh@redhat.com> 3.5.2-2
0f1bd6
- Allow system-config-selinux to work with policykit
0f1bd6
170fa2
* Fri Jul 25 2008 Dan Walsh <dwalsh@redhat.com> 3.5.1-5
170fa2
- Fix novel labeling
170fa2
07bd5c
* Fri Jul 25 2008 Dan Walsh <dwalsh@redhat.com> 3.5.1-4
07bd5c
- Consolodate pyzor,spamassassin, razor into one security domain
07bd5c
- Fix xdm requiring additional perms.
07bd5c
8f2532
* Fri Jul 25 2008 Dan Walsh <dwalsh@redhat.com> 3.5.1-3
8f2532
- Fixes for logrotate, alsa
8f2532
f12d5b
* Thu Jul 25 2008 Dan Walsh <dwalsh@redhat.com> 3.5.1-2
f12d5b
- Eliminate vbetool duplicate entry
f12d5b
feefee
* Wed Jul 16 2008 Dan Walsh <dwalsh@redhat.com> 3.5.1-1
feefee
- Fix xguest -> xguest_mozilla_t -> xguest_openiffice_t
0b0533
- Change dhclient to be able to red networkmanager_var_run
feefee
078ad0
* Tue Jul 15 2008 Dan Walsh <dwalsh@redhat.com> 3.5.0-1
6ed853
- Update to latest refpolicy
078ad0
- Fix libsemanage initial install bug
6ed853
6db69f
* Wed Jul 9 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-14
6db69f
- Add inotify support to nscd
6db69f
43f9fc
* Tue Jul 8 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-13
43f9fc
- Allow unconfined_t to setfcap
43f9fc
273a44
* Mon Jul 7 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-12
273a44
- Allow amanda to read tape
273a44
- Allow prewikka cgi to use syslog, allow audisp_t to signal cgi
273a44
- Add support for netware file systems
273a44
258b00
* Thu Jul 3 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-11
258b00
- Allow ypbind apps to net_bind_service
258b00
75edec
* Wed Jul 2 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-10
75edec
- Allow all system domains and application domains to append to any log file
75edec
cd60b6
* Sun Jun 29 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-9
cd60b6
- Allow gdm to read rpm database
cd60b6
- Allow nsplugin to read mplayer config files
cd60b6
c18681
* Thu Jun 26 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-8
c18681
- Allow vpnc to run ifconfig
c18681
f86ed5
* Tue Jun 24 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-7
f86ed5
- Allow confined users to use postgres
f86ed5
- Allow system_mail_t to exec other mail clients
f86ed5
- Label mogrel_rails as an apache server
f86ed5
547aa2
* Mon Jun 23 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-6
547aa2
- Apply unconfined_execmem_exec_t to haskell programs
547aa2
6959e0
* Sun Jun 22 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-5
6959e0
- Fix prelude file context
6959e0
fe0d46
* Fri Jun 12 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-4
fe0d46
- allow hplip to talk dbus
fe0d46
- Fix context on ~/.local dir
fe0d46
f4ff8b
* Thu Jun 12 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-3
f4ff8b
- Prevent applications from reading x_device
f4ff8b
5608a9
* Thu Jun 12 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-2
5608a9
- Add /var/lib/selinux context
5608a9
c5c253
* Wed Jun 11 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-1
c5c253
- Update to upstream 
c5c253
f513c7
* Wed Jun 4 2008 Dan Walsh <dwalsh@redhat.com> 3.4.1-5
15f71c
- Add livecd policy
15f71c
15f71c
* Wed Jun 4 2008 Dan Walsh <dwalsh@redhat.com> 3.4.1-3
91ec07
- Dontaudit search of admin_home for init_system_domain
91ec07
- Rewrite of xace interfaces
91ec07
- Lots of new fs_list_inotify
91ec07
- Allow livecd to transition to setfiles_mac
91ec07
80e0b8
* Fri May 9 2008 Dan Walsh <dwalsh@redhat.com> 3.4.1-2
80e0b8
- Begin XAce integration
80e0b8
4b7f03
* Fri May 9 2008 Dan Walsh <dwalsh@redhat.com> 3.4.1-1
4b7f03
- Merge Upstream
4b7f03
993c27
* Wed May 7 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-48
993c27
- Allow amanada to create data files
993c27
993c27
* Wed May 7 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-47
993c27
- Fix initial install, semanage setup
993c27
993c27
* Tue May 6 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-46
993c27
- Allow system_r for httpd_unconfined_script_t
993c27
6c25b4
* Wed Apr 30 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-45
6c25b4
- Remove dmesg boolean
6c25b4
- Allow user domains to read/write game data
6c25b4
86881d
* Mon Apr 28 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-44
86881d
- Change unconfined_t to transition to unconfined_mono_t when running mono
86881d
- Change XXX_mono_t to transition to XXX_t when executing bin_t files, so gnome-do will work
86881d
2d8ff5
* Mon Apr 28 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-43
2d8ff5
- Remove old booleans from targeted-booleans.conf file
2d8ff5
2d8ff5
* Fri Apr 25 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-42
2d8ff5
- Add boolean to mmap_zero
2d8ff5
- allow tor setgid
2d8ff5
- Allow gnomeclock to set clock
2d8ff5
b4e933
* Thu Apr 24 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-41
ef5e60
- Don't run crontab from unconfined_t
ef5e60
4b1d56
* Wed Apr 23 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-39
4b1d56
- Change etc files to config files to allow users to read them
4b1d56
4b1d56
* Fri Apr 14 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-37
4b1d56
- Lots of fixes for confined domains on NFS_t homedir
4b1d56
a6a82a
* Mon Apr 14 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-36
a6a82a
- dontaudit mrtg reading /proc
a6a82a
- Allow iscsi to signal itself
a6a82a
- Allow gnomeclock sys_ptrace
bb36d7
06686c
* Thu Apr 10 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-33
06686c
- Allow dhcpd to read kernel network state
06686c
41625a
* Thu Apr 10 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-32
41625a
- Label /var/run/gdm correctly
41625a
- Fix unconfined_u user creation
41625a
254e3c
* Tue Apr 8 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-31
254e3c
- Allow transition from initrc_t to getty_t
254e3c
5a576e
* Tue Apr 8 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-30
5a576e
- Allow passwd to communicate with user sockets to change gnome-keyring
5a576e
c3c4a5
* Sat Apr 5 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-29
7f851a
- Fix initial install
c3c4a5
27943d
* Fri Apr 4 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-28
27943d
- Allow radvd to use fifo_file
27943d
- dontaudit setfiles reading links
27943d
- allow semanage sys_resource
27943d
- add allow_httpd_mod_auth_ntlm_winbind boolean
27943d
- Allow privhome apps including dovecot read on nfs and cifs home 
27943d
dirs if the boolean is set
27943d
27943d
c66f2b
* Tue Apr 1 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-27
c66f2b
- Allow nsplugin to read /etc/mozpluggerrc, user_fonts
c66f2b
- Allow syslog to manage innd logs.
c66f2b
- Allow procmail to ioctl spamd_exec_t
c66f2b
294ea7
* Sat Mar 28 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-26
294ea7
- Allow initrc_t to dbus chat with consolekit.
294ea7
e54cb2
* Thu Mar 27 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-25
e54cb2
- Additional access for nsplugin
e54cb2
- Allow xdm setcap/getcap until pulseaudio is fixed
e54cb2
f70afc
* Tue Mar 25 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-24
f70afc
- Allow mount to mkdir on tmpfs
f70afc
- Allow ifconfig to search debugfs
f70afc
bf3d39
* Fri Mar 18 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-23
bf3d39
- Fix file context for MATLAB
bf3d39
- Fixes for xace
bf3d39
94b7be
* Tue Mar 18 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-22
5ea3f1
- Allow stunnel to transition to inetd children domains
5ea3f1
- Make unconfined_dbusd_t an unconfined domain 
94b7be
ba9e5e
* Mon Mar 17 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-21
ba9e5e
- Fixes for qemu/virtd
ba9e5e
a6e128
* Fri Mar 14 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-20
a6e128
- Fix bug in mozilla policy to allow xguest transition
a6e128
- This will fix the 
a6e128
a6e128
libsemanage.dbase_llist_query: could not find record value
a6e128
libsemanage.dbase_llist_query: could not query record value (No such file or
a6e128
directory)
a6e128
 bug in xguest
a6e128
d593d2
* Fri Mar 14 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-19
d593d2
- Allow nsplugin to run acroread
d593d2
987b10
* Thu Mar 13 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-18
987b10
- Add cups_pdf policy
987b10
- Add openoffice policy to run in xguest
987b10
7f811b
* Thu Mar 13 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-17
7f811b
- prewika needs to contact mysql
7f811b
- Allow syslog to read system_map files
7f811b
ceda8f
* Wed Mar 12 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-16
ceda8f
- Change init_t to an unconfined_domain
ceda8f
0879f4
* Tue Mar 11 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-15
0879f4
- Allow init to transition to initrc_t on shell exec.
0879f4
- Fix init to be able to sendto init_t.
0879f4
- Allow syslog to connect to mysql
0879f4
- Allow lvm to manage its own fifo_files
0879f4
- Allow bugzilla to use ldap
0879f4
- More mls fixes 
0879f4
110bce
* Tue Mar 11 2008 Bill Nottingham <notting@redhat.com> 3.3.1-14
110bce
- fixes for init policy (#436988)
110bce
- fix build
110bce
2041ac
* Mon Mar 10 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-13
2041ac
- Additional changes for MLS policy
2041ac
1bf67d
* Thu Mar 6 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-12
1bf67d
- Fix initrc_context generation for MLS
1bf67d
dc57e6
* Mon Mar 3 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-11
dc57e6
- Fixes for libvirt
dc57e6
594790
* Mon Mar 3 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-10
594790
- Allow bitlebee to read locale_t
594790
d8c160
* Fri Feb 29 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-9
d8c160
- More xselinux rules
d8c160
9a0f35
* Thu Feb 28 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-8
9a0f35
- Change httpd_$1_script_r*_t to httpd_$1_content_r*_t
338714
40ce26
* Wed Feb 27 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-6
40ce26
- Prepare policy for beta release
40ce26
- Change some of the system domains back to unconfined
40ce26
- Turn on some of the booleans
40ce26
533c75
* Tue Feb 26 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-5
533c75
- Allow nsplugin_config execstack/execmem
533c75
- Allow nsplugin_t to read alsa config
533c75
- Change apache to use user content 
533c75
c092cc
* Tue Feb 26 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-4
c092cc
- Add cyphesis policy
c092cc
27b2b0
* Tue Feb 26 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-2
063999
- Fix Makefile.devel to build mls modules
063999
- Fix qemu to be more specific on labeling
063999
f75033
* Tue Feb 26 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-1
f75033
- Update to upstream fixes
f75033
f75033
* Fri Feb 22 2008 Dan Walsh <dwalsh@redhat.com> 3.3.0-2
f75033
- Allow staff to mounton user_home_t
f75033
5ca2ff
* Fri Feb 22 2008 Dan Walsh <dwalsh@redhat.com> 3.3.0-1
5ca2ff
- Add xace support
5ca2ff
8bd036
* Thu Feb 21 2008 Dan Walsh <dwalsh@redhat.com> 3.2.9-2
8bd036
- Add fusectl file system
8bd036
e5aceb
* Wed Feb 20 2008 Dan Walsh <dwalsh@redhat.com> 3.2.9-1
541ba8
- Fixes from yum-cron
541ba8
- Update to latest upstream
541ba8
e5aceb
306393
* Tue Feb 19 2008 Dan Walsh <dwalsh@redhat.com> 3.2.8-2
306393
- Fix userdom_list_user_files
306393
306393
eb3e9f
* Fri Feb 15 2008 Dan Walsh <dwalsh@redhat.com> 3.2.8-1
eb3e9f
- Merge with upstream
eb3e9f
7e1e7b
* Thu Feb 5 2008 Dan Walsh <dwalsh@redhat.com> 3.2.7-6
7e1e7b
- Allow udev to send audit messages
7e1e7b
9870c6
* Thu Feb 5 2008 Dan Walsh <dwalsh@redhat.com> 3.2.7-5
9870c6
- Add additional login users interfaces
9870c6
  -     userdom_admin_login_user_template(staff)
9870c6
ebe074
* Thu Feb 5 2008 Dan Walsh <dwalsh@redhat.com> 3.2.7-3
ebe074
- More fixes for polkit
ebe074
ebe074
* Thu Feb 5 2008 Dan Walsh <dwalsh@redhat.com> 3.2.7-2
ebe074
- Eliminate transition from unconfined_t to qemu by default
ebe074
- Fixes for gpg
ebe074
57ac1c
* Tue Feb 5 2008 Dan Walsh <dwalsh@redhat.com> 3.2.7-1
57ac1c
- Update to upstream
57ac1c
4637b6
* Tue Feb 5 2008 Dan Walsh <dwalsh@redhat.com> 3.2.6-7
4637b6
- Fixes for staff_t
4637b6
b53db5
* Tue Feb 5 2008 Dan Walsh <dwalsh@redhat.com> 3.2.6-6
b53db5
- Add policy for kerneloops
b53db5
- Add policy for gnomeclock
b53db5
881d64
* Mon Feb 4 2008 Dan Walsh <dwalsh@redhat.com> 3.2.6-5
881d64
- Fixes for libvirt
881d64
60c693
* Sun Feb 3 2008 Dan Walsh <dwalsh@redhat.com> 3.2.6-4
60c693
- Fixes for nsplugin
60c693
60c693
* Sat Feb 2 2008 Dan Walsh <dwalsh@redhat.com> 3.2.6-3
60c693
- More fixes for qemu
60c693
11ac4b
* Sat Feb 2 2008 Dan Walsh <dwalsh@redhat.com> 3.2.6-2
11ac4b
- Additional ports for vnc and allow qemu and libvirt to search all directories
11ac4b
b19d47
* Fri Feb 1 2008 Dan Walsh <dwalsh@redhat.com> 3.2.6-1
b19d47
- Update to upstream
b19d47
- Add libvirt policy
b19d47
- add qemu policy
b19d47
e1060e
* Fri Feb 1 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-25
e1060e
- Allow fail2ban to create a socket in /var/run
e1060e
59d6fb
* Wed Jan 30 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-24
7c124f
- Allow allow_httpd_mod_auth_pam to work
7c124f
f18a88
* Wed Jan 30 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-22
f18a88
- Add audisp policy and prelude
f18a88
0f7011
* Mon Jan 28 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-21
0f7011
- Allow all user roles to executae samba net command
0f7011
7c2be3
* Fri Jan 25 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-20
7c2be3
- Allow usertypes to read/write noxattr file systems
7c2be3
7c7d59
* Thu Jan 24 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-19
7c7d59
- Fix nsplugin to allow flashplugin to work in enforcing mode
7c7d59
093987
* Wed Jan 23 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-18
093987
- Allow pam_selinux_permit to kill all processes
093987
cc5bb8
* Mon Jan 21 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-17
cc5bb8
- Allow ptrace or user processes by users of same type
cc5bb8
- Add boolean for transition to nsplugin
cc5bb8
ef19b7
* Mon Jan 21 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-16
ef19b7
- Allow nsplugin sys_nice, getsched, setsched
ef19b7
b3c8a0
* Mon Jan 21 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-15
b3c8a0
- Allow login programs to talk dbus to oddjob
b3c8a0
98f84c
* Thu Jan 17 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-14
98f84c
- Add procmail_log support
98f84c
- Lots of fixes for munin
98f84c
e26fef
* Tue Jan 15 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-13
e26fef
- Allow setroubleshoot to read policy config and send audit messages
e26fef
8a40d6
* Mon Jan 14 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-12
8a40d6
- Allow users to execute all files in homedir, if boolean set
8a40d6
- Allow mount to read samba config
8a40d6
27c7d8
* Sun Jan 13 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-11
27c7d8
- Fixes for xguest to run java plugin
27c7d8
4be3ba
* Mon Jan 7 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-10
4be3ba
- dontaudit pam_t and dbusd writing to user_home_t
4be3ba
5baf53
* Mon Jan 7 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-9
5baf53
- Update gpg to allow reading of inotify
5baf53
a502c5
* Wed Jan 2 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-8
a502c5
- Change user and staff roles to work correctly with varied perms
a502c5
c64ec2
* Mon Dec 31 2007 Dan Walsh <dwalsh@redhat.com> 3.2.5-7
c64ec2
- Fix munin log,
c64ec2
- Eliminate duplicate mozilla file context
c64ec2
- fix wpa_supplicant spec
c64ec2
5d1334
* Mon Dec 24 2007 Dan Walsh <dwalsh@redhat.com> 3.2.5-6
88ae3f
- Fix role transition from unconfined_r to system_r when running rpm
88ae3f
- Allow unconfined_domains to communicate with user dbus instances
5d1334
5d1334
* Sat Dec 21 2007 Dan Walsh <dwalsh@redhat.com> 3.2.5-5
5d1334
- Fixes for xguest
5d1334
0ec33d
* Thu Dec 20 2007 Dan Walsh <dwalsh@redhat.com> 3.2.5-4
0ec33d
- Let all uncofined domains communicate with dbus unconfined
0ec33d
673eaa
* Thu Dec 20 2007 Dan Walsh <dwalsh@redhat.com> 3.2.5-3
673eaa
- Run rpm in system_r
673eaa
5615fe
* Wed Dec 19 2007 Dan Walsh <dwalsh@redhat.com> 3.2.5-2
5615fe
- Zero out customizable types
5615fe
9a2cf8
* Wed Dec 19 2007 Dan Walsh <dwalsh@redhat.com> 3.2.5-1
9a2cf8
- Fix definiton of admin_home_t
9a2cf8
2f257c
* Wed Dec 19 2007 Dan Walsh <dwalsh@redhat.com> 3.2.4-5
2f257c
- Fix munin file context
2f257c
91c2fa
* Tue Dec 18 2007 Dan Walsh <dwalsh@redhat.com> 3.2.4-4
91c2fa
- Allow cron to run unconfined apps
91c2fa
99d367
* Mon Dec 17 2007 Dan Walsh <dwalsh@redhat.com> 3.2.4-3
99d367
- Modify default login to unconfined_u
99d367
592868
* Thu Dec 13 2007 Dan Walsh <dwalsh@redhat.com> 3.2.4-1
592868
- Dontaudit dbus user client search of /root
592868
76e340
* Wed Dec 12 2007 Dan Walsh <dwalsh@redhat.com> 3.2.4-1
76e340
- Update to upstream
76e340
4c6f2d
* Tue Dec 11 2007 Dan Walsh <dwalsh@redhat.com> 3.2.3-2
4c6f2d
- Fixes for polkit
4c6f2d
- Allow xserver to ptrace
4c6f2d
7dfe3e
* Tue Dec 11 2007 Dan Walsh <dwalsh@redhat.com> 3.2.3-1
7dfe3e
- Add polkit policy
7dfe3e
- Symplify userdom context, remove automatic per_role changes
7dfe3e
d195fc
* Tue Dec 4 2007 Dan Walsh <dwalsh@redhat.com> 3.2.2-1
02654b
- Update to upstream
d195fc
- Allow httpd_sys_script_t to search users homedirs
d195fc
320f3e
* Mon Dec 3 2007 Dan Walsh <dwalsh@redhat.com> 3.2.1-3
320f3e
- Allow rpm_script to transition to unconfined_execmem_t
320f3e
9186dc
* Fri Nov 30 2007 Dan Walsh <dwalsh@redhat.com> 3.2.1-1
9186dc
- Remove user based home directory separation
9186dc
3a54e4
* Wed Nov 28 2007 Dan Walsh <dwalsh@redhat.com> 3.1.2-2
3a54e4
- Remove user specific crond_t
3a54e4
a1341a
* Mon Nov 19 2007 Dan Walsh <dwalhh@redhat.com> 3.1.2-1
0fffba
- Merge with upstream
0fffba
- Allow xsever to read hwdata_t
0fffba
- Allow login programs to setkeycreate
0fffba
7330e8
* Sat Nov 10 2007 Dan Walsh <dwalsh@redhat.com> 3.1.1-1
7330e8
- Update to upstream
7330e8
fa0d1c
* Mon Oct 22 2007 Dan Walsh <dwalsh@redhat.com> 3.1.0-1
fa0d1c
- Update to upstream
fa0d1c
fa0d1c
* Mon Oct 22 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-30
d0649e
- Allow XServer to read /proc/self/cmdline
fa0d1c
- Fix unconfined cron jobs
fa0d1c
- Allow fetchmail to transition to procmail
fa0d1c
- Fixes for hald_mac
fa0d1c
- Allow system_mail to transition to exim
fa0d1c
- Allow tftpd to upload files
fa0d1c
- Allow xdm to manage unconfined_tmp
fa0d1c
- Allow udef to read alsa config
fa0d1c
- Fix xguest to be able to connect to sound port
d0649e
30dfdc
* Fri Oct 17 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-28
30dfdc
- Fixes for hald_mac 
30dfdc
- Treat unconfined_home_dir_t as a home dir
30dfdc
- dontaudit rhgb writes to fonts and root
30dfdc
3375c3
* Fri Oct 17 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-27
3375c3
- Fix dnsmasq
3375c3
- Allow rshd full login privs
3375c3
6455c9
* Thu Oct 16 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-26
6455c9
- Allow rshd to connect to ports > 1023
6455c9
ccf8a7
* Thu Oct 16 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-25
ccf8a7
- Fix vpn to bind to port 4500
ccf8a7
- Allow ssh to create shm
953fd1
- Add Kismet policy
ccf8a7
b4ed6d
* Tue Oct 16 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-24
b4ed6d
- Allow rpm to chat with networkmanager
b4ed6d
b4ed6d
* Mon Oct 15 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-23
b4ed6d
- Fixes for ipsec and exim mail
b4ed6d
- Change default to unconfined user
b4ed6d
9185bf
* Fri Oct 12 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-22
9185bf
- Pass the UNK_PERMS param to makefile
9185bf
- Fix gdm location
9185bf
c27b2b
* Wed Oct 10 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-21
c27b2b
- Make alsa work
c27b2b
28021c
* Tue Oct 9 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-20
28021c
- Fixes for consolekit and startx sessions
28021c
7a91e8
* Mon Oct 8 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-19
7a91e8
- Dontaudit consoletype talking to unconfined_t
7a91e8
922f64
* Thu Oct 4 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-18
922f64
- Remove homedir_template
922f64
24ccb8
* Tue Oct 2 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-17
24ccb8
- Check asound.state
24ccb8
492612
* Mon Oct 1 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-16
492612
- Fix exim policy
492612
1ffa68
* Thu Sep 24 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-15
1ffa68
- Allow tmpreadper to read man_t
1ffa68
- Allow racoon to bind to all nodes
1ffa68
- Fixes for finger print reader
1ffa68
7c1c17
* Tue Sep 24 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-14
7c1c17
- Allow xdm to talk to input device (fingerprint reader)
7c1c17
- Allow octave to run as java
7c1c17
d770c5
* Tue Sep 24 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-13
d770c5
- Allow login programs to set ioctl on /proc
d770c5
fb11ad
* Mon Sep 24 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-12
fb11ad
- Allow nsswitch apps to read samba_var_t
fb11ad
f5018f
* Mon Sep 24 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-11
f5018f
- Fix maxima
f5018f
d83ea8
* Mon Sep 24 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-10
d83ea8
- Eliminate rpm_t:fifo_file avcs
d83ea8
- Fix dbus path for helper app
d83ea8
6c319e
* Sat Sep 22 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-9
6c319e
- Fix service start stop terminal avc's
6c319e
ec4fb1
* Fri Sep 21 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-8
ec4fb1
- Allow also to search var_lib
ec4fb1
- New context for dbus launcher 
ec4fb1
347ff1
* Fri Sep 21 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-7
347ff1
- Allow cupsd_config_t to read/write usb_device_t
347ff1
- Support for finger print reader,
347ff1
- Many fixes for clvmd
347ff1
- dbus starting networkmanager
347ff1
07e28d
* Thu Sep 20 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-5
07e28d
- Fix java and mono to run in xguest account
07e28d
c67a12
* Wed Sep 19 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-4
c67a12
- Fix to add xguest account when inititial install
a9d4b8
- Allow mono, java, wine to run in userdomains
c67a12
21c534
* Wed Sep 19 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-3
21c534
- Allow xserver to search devpts_t
21c534
- Dontaudit ldconfig output to homedir
21c534
7ff410
* Tue Sep 18 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-2
7ff410
- Remove hplip_etc_t change back to etc_t.
7ff410
7ff410
1a3fe3
* Mon Sep 17 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-1
1a3fe3
- Allow cron to search nfs and samba homedirs
1a3fe3
babb36
* Tue Sep 11 2007 Dan Walsh <dwalsh@redhat.com> 3.0.7-10
babb36
- Allow NetworkManager to dbus chat with yum-updated
babb36
bf7f97
* Tue Sep 11 2007 Dan Walsh <dwalsh@redhat.com> 3.0.7-9
bf7f97
- Allow xfs to bind to port 7100
bf7f97
25d586
* Mon Sep 10 2007 Dan Walsh <dwalsh@redhat.com> 3.0.7-8
25d586
- Allow newalias/sendmail dac_override
25d586
- Allow bind to bind to all udp ports
25d586
4eaf5c
* Fri Sep 7 2007 Dan Walsh <dwalsh@redhat.com> 3.0.7-7
4eaf5c
- Turn off direct transition
4eaf5c
c7e443
* Fri Sep 7 2007 Dan Walsh <dwalsh@redhat.com> 3.0.7-6
c7e443
- Allow wine to run in system role
c7e443
37d6a1
* Thu Sep 6 2007 Dan Walsh <dwalsh@redhat.com> 3.0.7-5
37d6a1
- Fix java labeling 
37d6a1
07b868
* Thu Sep 6 2007 Dan Walsh <dwalsh@redhat.com> 3.0.7-4
07b868
- Define user_home_type as home_type
07b868
bea548
* Tue Aug 28 2007 Dan Walsh <dwalsh@redhat.com> 3.0.7-3
bea548
- Allow sendmail to create etc_aliases_t
bea548
bc85a6
* Tue Aug 28 2007 Dan Walsh <dwalsh@redhat.com> 3.0.7-2
bc85a6
- Allow login programs to read symlinks on homedirs
bc85a6
e8b599
* Mon Aug 27 2007 Dan Walsh <dwalsh@redhat.com> 3.0.7-1
e8b599
- Update an readd modules
e8b599
d83af2
* Fri Aug 24 2007 Dan Walsh <dwalsh@redhat.com> 3.0.6-3
d83af2
- Cleanup  spec file
d83af2
3b13a8
* Fri Aug 24 2007 Dan Walsh <dwalsh@redhat.com> 3.0.6-2
3b13a8
- Allow xserver to be started by unconfined process and talk to tty
3b13a8
95bbe5
* Wed Aug 22 2007 Dan Walsh <dwalsh@redhat.com> 3.0.6-1
95bbe5
- Upgrade to upstream to grab postgressql changes
95bbe5
c77aca
* Tue Aug 21 2007 Dan Walsh <dwalsh@redhat.com> 3.0.5-11
c77aca
- Add setransd for mls policy
c77aca
4f23c4
* Mon Aug 20 2007 Dan Walsh <dwalsh@redhat.com> 3.0.5-10
4f23c4
- Add ldconfig_cache_t
4f23c4
b4ae7d
* Sat Aug 18 2007 Dan Walsh <dwalsh@redhat.com> 3.0.5-9
b4ae7d
- Allow sshd to write to proc_t for afs login
b4ae7d
f01207
* Sat Aug 18 2007 Dan Walsh <dwalsh@redhat.com> 3.0.5-8
f01207
- Allow xserver access to urand
f01207
7f6883
* Tue Aug 14 2007 Dan Walsh <dwalsh@redhat.com> 3.0.5-7
7f6883
- allow dovecot to search mountpoints
7f6883
0354c2
* Sat Aug 11 2007 Dan Walsh <dwalsh@redhat.com> 3.0.5-6
0354c2
- Fix Makefile for building policy modules
0354c2
60a9ef
* Fri Aug 10 2007 Dan Walsh <dwalsh@redhat.com> 3.0.5-5
60a9ef
- Fix dhcpc startup of service 
60a9ef
bf3320
* Fri Aug 10 2007 Dan Walsh <dwalsh@redhat.com> 3.0.5-4
bf3320
- Fix dbus chat to not happen for xguest and guest users
bf3320
d44a39
* Mon Aug 6 2007 Dan Walsh <dwalsh@redhat.com> 3.0.5-3
d44a39
- Fix nagios cgi
d44a39
- allow squid to communicate with winbind
d44a39
1a12c2
* Mon Aug 6 2007 Dan Walsh <dwalsh@redhat.com> 3.0.5-2
1a12c2
- Fixes for ldconfig
1a12c2
25a754
* Thu Aug 2 2007 Dan Walsh <dwalsh@redhat.com> 3.0.5-1
25a754
- Update from upstream
25a754
25a754
* Wed Aug 1 2007 Dan Walsh <dwalsh@redhat.com> 3.0.4-6
25a754
- Add nasd support
25a754
8239a9
* Wed Aug 1 2007 Dan Walsh <dwalsh@redhat.com> 3.0.4-5
8239a9
- Fix new usb devices and dmfm
8239a9
47a35f
* Mon Jul 30 2007 Dan Walsh <dwalsh@redhat.com> 3.0.4-4
47a35f
- Eliminate mount_ntfs_t policy, merge into mount_t
47a35f
07351e
* Mon Jul 30 2007 Dan Walsh <dwalsh@redhat.com> 3.0.4-3
07351e
- Allow xserver to write to ramfs mounted by rhgb
07351e
9c0386
* Tue Jul 23 2007 Dan Walsh <dwalsh@redhat.com> 3.0.4-2
9c0386
- Add context for dbus machine id
9c0386
2fac1d
* Tue Jul 23 2007 Dan Walsh <dwalsh@redhat.com> 3.0.4-1
2fac1d
- Update with latest changes from upstream
2fac1d
0f8f54
* Tue Jul 23 2007 Dan Walsh <dwalsh@redhat.com> 3.0.3-6
0f8f54
- Fix prelink to handle execmod
0f8f54
e0ae20
* Mon Jul 23 2007 Dan Walsh <dwalsh@redhat.com> 3.0.3-5
e0ae20
- Add ntpd_key_t to handle secret data
e0ae20
2ced40
* Fri Jul 20 2007 Dan Walsh <dwalsh@redhat.com> 3.0.3-4
2ced40
- Add anon_inodefs
2ced40
- Allow unpriv user exec pam_exec_t
2ced40
- Fix trigger
2ced40
779d23
* Fri Jul 20 2007 Dan Walsh <dwalsh@redhat.com> 3.0.3-3
779d23
- Allow cups to use generic usb
779d23
- fix inetd to be able to run random apps (git)
779d23
908512
* Thu Jul 19 2007 Dan Walsh <dwalsh@redhat.com> 3.0.3-2
908512
- Add proper contexts for rsyslogd
908512
908512
* Thu Jul 19 2007 Dan Walsh <dwalsh@redhat.com> 3.0.3-1
908512
- Fixes for xguest policy
908512
297dd1
* Tue Jul 17 2007 Dan Walsh <dwalsh@redhat.com> 3.0.2-9
297dd1
- Allow execution of gconf
297dd1
1d0319
* Sat Jul 14 2007 Dan Walsh <dwalsh@redhat.com> 3.0.2-8
1d0319
- Fix moilscanner update problem
1d0319
7e3506
* Thu Jul 12 2007 Dan Walsh <dwalsh@redhat.com> 3.0.2-7
7e3506
- Begin adding policy to separate setsebool from semanage
16d953
- Fix xserver.if definition to not break sepolgen.if
16d953
2796de
* Wed Jul 11 2007 Dan Walsh <dwalsh@redhat.com> 3.0.2-5
2796de
- Add new devices
2796de
154d82
* Tue Jul 10 2007 Dan Walsh <dwalsh@redhat.com> 3.0.2-4
154d82
- Add brctl policy
154d82
501a17
* Fri Jul 6 2007 Dan Walsh <dwalsh@redhat.com> 3.0.2-3
501a17
- Fix root login to include system_r
501a17
35e7f7
* Fri Jul 6 2007 Dan Walsh <dwalsh@redhat.com> 3.0.2-2
35e7f7
- Allow prelink to read kernel sysctls
35e7f7
b529ed
* Mon Jul 2 2007 Dan Walsh <dwalsh@redhat.com> 3.0.1-5
b529ed
- Default to user_u:system_r:unconfined_t 
b529ed
2fdb5f
* Sun Jul 1 2007 Dan Walsh <dwalsh@redhat.com> 3.0.1-4
2fdb5f
- fix squid
2fdb5f
- Fix rpm running as uid
2fdb5f
b786a2
* Wed Jun 26 2007 Dan Walsh <dwalsh@redhat.com> 3.0.1-3
b786a2
- Fix syslog declaration
b786a2
7f4421
* Wed Jun 26 2007 Dan Walsh <dwalsh@redhat.com> 3.0.1-2
7f4421
- Allow avahi to access inotify
7f4421
- Remove a lot of bogus security_t:filesystem avcs
7f4421
56187c
* Fri May 25 2007 Dan Walsh <dwalsh@redhat.com> 3.0.1-1
56187c
- Remove ifdef strict policy from upstream
3e930b
56187c
* Fri May 18 2007 Dan Walsh <dwalsh@redhat.com> 2.6.5-3
56187c
- Remove ifdef strict to allow user_u to login 
d4da53
bdb830
* Fri May 18 2007 Dan Walsh <dwalsh@redhat.com> 2.6.5-2
bdb830
- Fix for amands
bdb830
- Allow semanage to read pp files
bdb830
- Allow rhgb to read xdm_xserver_tmp
346d2d
346d2d
* Fri May 18 2007 Dan Walsh <dwalsh@redhat.com> 2.6.4-7
346d2d
- Allow kerberos servers to use ldap for backing store
346d2d
9ffb88
* Thu May 17 2007 Dan Walsh <dwalsh@redhat.com> 2.6.4-6
9ffb88
- allow alsactl to read kernel state
9ffb88
fc3577
* Wed May 16 2007 Dan Walsh <dwalsh@redhat.com> 2.6.4-5
88c846
- More fixes for alsactl
fc3577
- Transition from hal and modutils
cf806e
- Fixes for suspend resume.  
cf806e
	- insmod domtrans to alsactl
cf806e
	- insmod writes to hal log
cf806e
7c3dcb
* Wed May 16 2007 Dan Walsh <dwalsh@redhat.com> 2.6.4-2
7c3dcb
- Allow unconfined_t to transition to NetworkManager_t
7c3dcb
- Fix netlabel policy
7c3dcb
810e69
* Mon May 14 2007 Dan Walsh <dwalsh@redhat.com> 2.6.4-1
810e69
- Update to latest from upstream
810e69
daa6ab
* Fri May 4 2007 Dan Walsh <dwalsh@redhat.com> 2.6.3-1
daa6ab
- Update to latest from upstream
daa6ab
8fea83
* Mon Apr 30 2007 Dan Walsh <dwalsh@redhat.com> 2.6.2-1
8fea83
- Update to latest from upstream
8fea83
8fea83
* Fri Apr 27 2007 Dan Walsh <dwalsh@redhat.com> 2.6.1-4
8fea83
- Allow pcscd_t to send itself signals
8fea83
6821c3
* Fri Apr 27 2007 Dan Walsh <dwalsh@redhat.com> 2.6.1-3
6821c3
- 
6821c3
77d25e
* Wed Apr 25 2007 Dan Walsh <dwalsh@redhat.com> 2.6.1-2
77d25e
- Fixes for unix_update
77d25e
- Fix logwatch to be able to search all dirs
77d25e
8396b2
* Mon Apr 23 2007 Dan Walsh <dwalsh@redhat.com> 2.6.1-1
8396b2
- Upstream bumped the version
8396b2
61947f
* Thu Apr 19 2007 Dan Walsh <dwalsh@redhat.com> 2.5.12-12
61947f
- Allow consolekit to syslog
61947f
- Allow ntfs to work with hal
61947f
2db3c1
* Thu Apr 19 2007 Dan Walsh <dwalsh@redhat.com> 2.5.12-11
61947f
- Allow iptables to read etc_runtime_t
2db3c1
466176
* Thu Apr 19 2007 Dan Walsh <dwalsh@redhat.com> 2.5.12-10
53b222
- MLS Fixes
53b222
883a02
* Wed Apr 18 2007 Dan Walsh <dwalsh@redhat.com> 2.5.12-8
883a02
- Fix path of /etc/lvm/cache directory
ab59be
- Fixes for alsactl and pppd_t
32b18f
- Fixes for consolekit
32b18f
7671ce
* Tue Apr 17 2007 Dan Walsh <dwalsh@redhat.com> 2.5.12-5
7671ce
- Allow insmod_t to mount kvmfs_t filesystems
7671ce
9fc00b
* Tue Apr 17 2007 Dan Walsh <dwalsh@redhat.com> 2.5.12-4
9fc00b
- Rwho policy
9fc00b
- Fixes for consolekit
9fc00b
e6f3cf
* Fri Apr 12 2007 Dan Walsh <dwalsh@redhat.com> 2.5.12-3
e6f3cf
- fixes for fusefs
e6f3cf
8c912a
* Thu Apr 12 2007 Dan Walsh <dwalsh@redhat.com> 2.5.12-2
8c912a
- Fix samba_net to allow it to view samba_var_t
8c912a
a3b1a2
* Tue Apr 10 2007 Dan Walsh <dwalsh@redhat.com> 2.5.12-1
a3b1a2
- Update to upstream
a3b1a2
5d5cae
* Tue Apr 10 2007 Dan Walsh <dwalsh@redhat.com> 2.5.11-8
5d5cae
- Fix Sonypic backlight
5d5cae
- Allow snmp to look at squid_conf_t
5d5cae
7f1bd8
* Mon Apr 9 2007 Dan Walsh <dwalsh@redhat.com> 2.5.11-7
7f1bd8
- Fixes for pyzor, cyrus, consoletype on everything installs
7f1bd8
0b3279
* Mon Apr 9 2007 Dan Walsh <dwalsh@redhat.com> 2.5.11-6
0b3279
- Fix hald_acl_t to be able to getattr/setattr on usb devices
0b3279
- Dontaudit write to unconfined_pipes for load_policy
0b3279
21029b
* Thu Apr 5 2007 Dan Walsh <dwalsh@redhat.com> 2.5.11-5
21029b
- Allow bluetooth to read inotifyfs
21029b
e6b9e2
* Wed Apr 4 2007 Dan Walsh <dwalsh@redhat.com> 2.5.11-4
e6b9e2
- Fixes for samba domain controller.
e6b9e2
- Allow ConsoleKit to look at ttys
e6b9e2
f9f9dd
* Tue Apr 3 2007 Dan Walsh <dwalsh@redhat.com> 2.5.11-3
f9f9dd
- Fix interface call
f9f9dd
89d3de
* Tue Apr 3 2007 Dan Walsh <dwalsh@redhat.com> 2.5.11-2
89d3de
- Allow syslog-ng to read /var
89d3de
- Allow locate to getattr on all filesystems
89d3de
- nscd needs setcap
89d3de
ce7f30
* Mon Mar 26 2007 Dan Walsh <dwalsh@redhat.com> 2.5.11-1
ce7f30
- Update to upstream
ce7f30
f040ac
* Fri Mar 23 2007 Dan Walsh <dwalsh@redhat.com> 2.5.10-2
f040ac
- Allow samba to run groupadd
f040ac
f63473
* Thu Mar 22 2007 Dan Walsh <dwalsh@redhat.com> 2.5.10-1
f63473
- Update to upstream
f63473
f63473
* Thu Mar 22 2007 Dan Walsh <dwalsh@redhat.com> 2.5.9-6
f63473
- Allow mdadm to access generic scsi devices
f63473
281f5f
* Wed Mar 21 2007 Dan Walsh <dwalsh@redhat.com> 2.5.9-5
281f5f
- Fix labeling on udev.tbl dirs
281f5f
552645
* Tue Mar 20 2007 Dan Walsh <dwalsh@redhat.com> 2.5.9-4
552645
- Fixes for logwatch
552645
593fb1
* Tue Mar 20 2007 Dan Walsh <dwalsh@redhat.com> 2.5.9-3
593fb1
- Add fusermount and mount_ntfs policy
593fb1
9d59ec
* Tue Mar 20 2007 Dan Walsh <dwalsh@redhat.com> 2.5.9-2
9d59ec
- Update to upstream
9d59ec
- Allow saslauthd to use kerberos keytabs
d3aaba
741e81
* Mon Mar 19 2007 Dan Walsh <dwalsh@redhat.com> 2.5.8-8
741e81
- Fixes for samba_var_t
741e81
741e81
* Mon Mar 19 2007 Dan Walsh <dwalsh@redhat.com> 2.5.8-7
741e81
- Allow networkmanager to setpgid
741e81
- Fixes for hal_acl_t
741e81
2823e2
* Mon Mar 19 2007 Dan Walsh <dwalsh@redhat.com> 2.5.8-6
db4f0e
- Remove disable_trans booleans
2823e2
- hald_acl_t needs to talk to nscd
2823e2
2f82ee
* Thu Mar 15 2007 Dan Walsh <dwalsh@redhat.com> 2.5.8-5
2f82ee
- Fix prelink to be able to manage usr dirs.