forked from OwlCyberDefense/refpolicy
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Changelog
1341 lines (1264 loc) · 61.8 KB
/
Changelog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
* Sat Aug 05 2017 Chris PeBenito <[email protected]> - 2.20170805
Chris PeBenito (134):
Create / to /usr equivalence for bin, sbin, and lib, from Russell Coker.
usrmerge FC fixes from Russell Coker.
Systemd tmpfiles fix for kmod.conf from Russell Coker.
Update contrib.
mon policy from Russell Coker.
Fix contrib commit.
Revert "bootloader: stricter permissions and more tailored file contexts"
Module version bump for bootloader patch revert. Plus compat alias.
Update contrib.
Sort capabilities permissions from Russell Coker.
Update contrib.
Little misc patches from Russell Coker.
Implement WERROR build option to treat warnings as errors.
Fix Travis-CI WERROR support.
Travis-CI: Terminate build immediately on error.
mon: Fix deprecated interface usage.
Merge branch 'setfiles_getattr' of git://github.com/cgzones/refpolicy
Merge branch 'sysadm_fixes' of git://github.com/cgzones/refpolicy
Merge branch 'corecmd_module' of git://github.com/cgzones/refpolicy
Merge branch 'var_and_run' of git://github.com/cgzones/refpolicy
Module version bump for changes from cgzones.
Merge pull request #98 from cgzones/admin_process_pattern
Merge branch 'hostname_module' of git://github.com/cgzones/refpolicy
Module version bump for hostname fix from cgzones.
Only display the WERROR notice if there actually are errors.
Merge branch 'master' of github.com:TresysTechnology/refpolicy
dpkg: Updates from Russell Coker.
Monit policy from Russell Coker and cgzones.
monit: Fix build error.
fetchmail, mysql, tor: Misc fixes from Russell Coker.
Merge branch 'systemd_transient' of git://github.com/cgzones/refpolicy
Merge branch 'selinuxutil_module' of git://github.com/cgzones/refpolicy
Module version bump for selinuxutil and systmd changes from cgzones.
Merge branch 'cgroups_fix' of git://github.com/cgzones/refpolicy
Module version bump for cgroups systemd fix from cgzones.
alsa, vnstat: Updates from cgzones.
Merge branch 'init_ntp_interface' of git://github.com/cgzones/refpolicy
Module version bump for ntp fixes from cgzones.
Systemd fixes from Russell Coker.
Fix CI errors.
Module version bump for CI fixes.
Xen fixes from Russell Coker.
mailman: Fixes from Russell Coker.
init: Rename init_search_pid_dirs() to init_search_pids().
init: Move interface and whitespace change.
systemd: Further revisions from Russell Coker.
Fix typo in README.
Network daemon patches from Russell Coker.
apache: Fix CI error.
devices: Fix docs for dev_write_generic_sock_files().
Merge branch 'su_module' of git://github.com/cgzones/refpolicy
Merge branch 'newrole_fixes' of git://github.com/cgzones/refpolicy
auth: Move optional out of auth_use_pam_systemd() to callers.
Merge branch 'locallogin_module' of git://github.com/cgzones/refpolicy
Module version bump for patches from cgzones.
Merge branch 'userdom_terminals_permit_open' of
git://github.com/cgzones/refpolicy
Module version bump for user terminal improvments from cgzones.
Merge branch 'monit_depend' of git://github.com/cgzones/refpolicy
Module version bump for misc fixes from cgzones.
Merge pull request #103 from fishilico/validate_modular_fc
Merge branch 'getty_module' of git://github.com/cgzones/refpolicy
Module version bump for getty patch from cgzones.
Merge branch 'modutils_module' of git://github.com/cgzones/refpolicy
Merge branch 'fix_usr_bin_merge' of git://github.com/cgzones/refpolicy
Module version bumps for fixes from cgzones.
Merge branch 'lvm' of git://github.com/cgzones/refpolicy
Merge branch 'macros' of git://github.com/cgzones/refpolicy
Module version bump for fixes from cgzones.
Module version bump for fixes from cgzones.
dontaudit net_admin for SO_SNDBUFFORCE
/var/run -> /run again
Merge branch 'var_run' of git://github.com/cgzones/refpolicy
Module version bump from /var/run fixes from cgzones.
Merge branch 'monit' of git://github.com/cgzones/refpolicy
Module version bump for monit patch from cgzones
another version of systemd cgroups hostnamed and logind
Merge pull request #109 from cgzones/python3
systemd-resolvd, sessions, and tmpfiles take2
systemd-nspawn again
Merge pull request #112 from cgzones/remove_support/pyplate
Misc fc changes from Russell Coker.
Systemd-related changes from Russell Coker.
Merge pull request #115 from fishilico/python_raw_strings
Module version bump for misc fixes from Guido Trentalancia.
systemd init from Russell Coker
more systemd stuff from Russell Coker
misc daemons from Russell Coker.
bootloader from Russell Coker.
kmod, lvm, brctl patches from Russell Coker
devicekit, mount, xserver, and selinuxutil from Russell Coker
another bootloader patch from Russell Coker
some userdomain patches from Russell Coker
corecommands: Add fc escaping for previous patch.
Module version bump for patch from Guido Trentalancia
Module version bump from fixes from Guido Trentalancia.
xdm sigchld interface from Russell Coker.
Further strict systemd fixes from Russell Coker.
Update contrib.
locallogin: Move two sulogin lines.
Login take 4 from Russell Coker.
Rename apm to acpi from Russell Coker.
Module version bump for patches from Russell Coker and Guido Trentalancia.
some little misc things from Russell Coker.
apt/dpkg strict patches from Russell Coker.
little misc strict from Russell Coker.
locallogin: Move one line.
Module version bump for locallogin patch from Guido Trentalancia.
Module version bump for minor fixes from Guido Trentalancia.
Merge branch 'usr_bin_fc' of
git://github.com/fishilico/selinux-refpolicy-patched
Module version bump for /usr/bin fc fixes from Nicolas Iooss.
Module version bump for changes from Jason Zaman and Luis Ressel.
init: add comment for ProtectSystem.
Module version bump for systemd fix from Krzysztof Nowicki.
Update contrib
Module version bump for libmtp from Guido Trentalancia.
corenet/sysadm: Move lines.
Module version bump for infiniband policy from Daniel Jurgens.
Module version bump for mmap fixes from Stephen Smalley.
Update contrib.
Module version bumps for patches from Jason Zaman.
filesystem: Fix error in fs_cgroup_filetrans().
Module version bumps for patches from Jason Zaman.
gpg: Module version bump for patch from Guido Trentalancia.
miscfiles: Module version bump for patch from Luis Ressel.
Module version bump for patches from cgzones.
Module version bump for patches from cgzones.
netutils: Module version bump for patch from Luis Ressel.
README: Update build requirements.
travis-ci: Update to 2.7 userspace release.
Enable extended_socket_class policy capability;
Add nnp_nosuid_transition policycap and related class/perm definitions.
Add cgroup_seclabel policycap.
init: Add NoNewPerms support for systemd.
Bump module versions for release.
Daniel Jurgens (1):
refpolicy: Infiniband pkeys and endports
Guido Trentalancia (8):
userdomain: do not audit netlink socket creation attempts
corecommands: new file contexts for Gnome applications
locallogin: fix the sulogin submodule (emergency shell!)
locallogin: fine tune DAC override permissions
kernel: low-priority update
init: smoother system boot
base: role changes for the new libmtp module
fc_sort: avoid compiler warning/error
Guido Trentalancia via refpolicy (1):
xserver: fix iceauth_home_t file context creation
Jason Zaman (6):
authlogin: put interface properly inside optional
libraries: update wildcard /usr/lib fcontext
appconfig: Add openrc_contexts file
corecommands: add consolekit fcontexts
dirmngr: add to roles
filesystem: introduce fs_cgroup_filetrans interface
Krzysztof Nowicki (1):
Enable /etc directory protection using ProtectSystem
Luis Ressel (5):
system/selinuxutil: Allow semanage to execute its tmp files
system/miscfiles: Generalize the man_t fc's
netutils: Mix nmap perms in with the other traceroute_t perms
netutils: Add some permissions required by nmap to traceroute_t
netutils: Allow tcpdump to reduce its capability bounding set
Nicolas Iooss (5):
Make "validate" target verify file contexts
devices: fix Debian file contexts
Use raw strings in regular expressions
Synchronize file patterns for /usr/bin/mount... and /usr/sbin/mount...
Support systems with a single /usr/bin directory
Russell Coker (4):
inherited file and fifo perms
tiny mon patch
rw_inherited_file_perms
new init interfaces for systemd
Stephen Smalley (3):
refpolicy: Define getrlimit permission for class process
refpolicy: Define smc_socket security class
refpolicy: Define and allow map permission
cgzones (40):
systemd: label /run/systemd/transient as systemd_unit_t
setfiles: allow getattr to kernel pseudo fs
sysadm: fix denials
hostname: small adjustments
selinuxutil: adjustments
corecommands: label some binaries as bin_t
files: no default types for /run and /var/lock
add admin_process_pattern macro
systemd_cgroups_t: fix denials
locallogin: adjustments
authlogin: introduce auth_use_pam_systemd
su: some adjustments
newrole: fix denials
add corecmd_check_exec_bin_files()
add fs_getattr_dos_dirs()
update init_ACTION_all_units
add init_daemon_lock_file()
improve documentation for user_user_(inherited_)?user_terminals
getty: overlook module
modutils: format filecontexts
modutils: adjust interfaces after recent binaries merge
systemd-tmpfiles: refactor runtime configs
corecommands: fix corecmd_*_bin() for usr merged systems
corecmd_read_bin_symlinks(): remove deprecated and redundant calls
modutils: adopt callers to new interfaces
m4 errprint: add __program__ info
domtrans_pattern: use inherited fifo perms
sysadm: add monit admin permissions
lvm: small adjustments
convert build scripts to python3
travis: run make xml, html and install(-.*)? targets
fix travis and genhomedircon
remove /var/run file context leftovers
travis: move after_success tests into script section
clean up python3 cache on make bare
rkhunter: add interfaces for rkhunter module and sysadm permit
iptables: align file contexts
chkrootkit: add interfaces and sysadm permit
netutils: update
iptables: update
* Sat Feb 04 2017 Chris PeBenito <[email protected]> - 2.20170204
Chris PeBenito (55):
Module version bumps for patches from Guido Trentalancia.
Update contrib.
Remove unneeded system_u seusers mapping.
Update contrib.
Merge pull request #45 from cgzones/travis2
Merge pull request #46 from cgzones/update_readme
Merge pull request #47 from cgzones/spelling
Module version bump for xserver patch from Guido Trentalancia
Update contrib.
Merge pull request #50 from cgzones/macros
Merge pull request #48 from cgzones/makefile
xserver: Rearrange lines
Module version bump for xserver changes from Guido Trentalancia.
Merge branch 'dhcp_avahi' of https://github.com/cgzones/refpolicy
Module version bumps for patches from cgzones.
Update contrib.
Merge branch 'syslogd' of git://github.com/cgzones/refpolicy
Module version bump for journald fixes from cgzones.
Merge pull request #57 from cgzones/trailing_whitespaces
modutils: Move lines.
Module version bumps for openoffice patches from Guido Trentalancia.
Module version bump for kernel sysctl patch from Luis Ressel
Update contrib.
Module version bump for netutils patch from Luis Ressel.
Module version bump for xserver patch from Guido Trentalancia.
Module version bumps for patches from Guido Trentalancia.
rtkit: enable dbus chat with xdm
xserver: Move interface definition.
Module version bump for patches from Guido Trentalancia.
Module version bump for xscreensaver patch from Guido Trentalancia.
Merge branch 'run_transition' of git://github.com/cgzones/refpolicy
Module version bumps for /run fc changes from cgzones.
Module version bump for patches from Guido Trentalancia.
Merge branch '2016-12-27_systemd' of
git://github.com/fishilico/selinux-refpolicy-patched
Module version bump for systemd patch from Nicolas Iooss.
Merge branch 'usr-fc' of
git://github.com/fishilico/selinux-refpolicy-patched
Module version bump for fc updates from Nicolas Iooss.
Module version bump for patches from Guido Trentalancia.
xserver: Update from Russell Coker for boinc.
Module version bump for patches from Guido Trentalancia.
Merge pull request #62 from cgzones/fix_permission_segenxml
Merge pull request #94 from cgzones/travis
Merge branch 'corenetork_module' of git://github.com/cgzones/refpolicy
Merge branch 'mount_module' of git://github.com/cgzones/refpolicy
Merge branch 'terminal_module' of git://github.com/cgzones/refpolicy
Merge branch 'files_search_src' of git://github.com/cgzones/refpolicy
Merge branch 'unconfined_module' of git://github.com/cgzones/refpolicy
Merge branch 'auditd_fixes' of git://github.com/cgzones/refpolicy
Module version bumps for patches from cgzones.
Module version bump for cpu_online genfscon from Laurent Bigonville.
Update contrib.
Fix contrib.
Module version bump for cups patch from Guido Trentalancia.
Module version bump for xkb fix from Jason Zaman.
Bump module versions for release.
Guido Trentalancia (19):
xserver: remove unneeded user content permissions
xserver: remove unneeded user content permissions
Apache OpenOffice module (base policy part)
xserver: enable dbus messaging with devicekit power
authlogin: indentation/whitespace fix
wm: update the window manager (wm) module and enable its role template
(v7)
userdomain: separate optional conditionals for gnome and wm role templates
udev: manage tmpfs files and directories
udev: always enable kernel module loading
base: enable the xscreensaver role
bootloader: stricter permissions and more tailored file contexts
modutils: update to run in confined mode
base: use new genhomedircon template for username
kernel: missing permissions for confined execution
xserver: introduce new fc and interface to manage X session logs
kernel: add missing plymouth interface
xserver: restrict executable memory permissions
init: support sysvinit
udev: execute HPLIP applications in their own domain
Guido Trentalancia via refpolicy (4):
Let users read/manage symlinks on fs that do not support xattr
Let unprivileged users list mounted filesystems
Let the user list noxattr fs directories
sysadm: add the shutdown role
Jason Zaman (1):
xserver: allow X roles to read xkb libs to set keymaps
Laurent Bigonville (1):
Use genfscon to label /sys/devices/system/cpu/online as cpu_online_t
Luis Ressel (3):
system/modutils: Add kernel_search_key(kmod_t)
kernel.if: Allow listing /proc/sys/net/unix
netutils: Label iptstate as netutils_t
Nicolas Iooss (4):
systemd: add systemd-backlight policy
systemd: add systemd-binfmt policy
Allow searching /proc/sys/fs when using /proc/sys/fs/binfmt_misc
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib
Russell Coker (1):
single binary modutils
Stephen Smalley (2):
refpolicy: Define extended_socket_class policy capability and socket
classes
refpolicy: drop unused socket security classes
cgzones (21):
update .travis.yml
update README
fix spelling
update Makefile
update policy/support macros
review
keep 2 empty lines in front of a new section
using intermediate target instead of splitting up conf files generation
define filecontext for /run/agetty.reload
allow dhcp_t to domtrans into avahi
fix syslogd audits
remove trailing whitespaces
transition file contexts to /run
fix permission of installed segenxml.py by install-headers
auditd / auditctl: fix audits
add files_search_src()
update unconfined module * grant capability2:wake_alarm * remove
deprecated interfaces
update terminal module
update corenetwork module
use travis cache
update mount module
* Sun Oct 23 2016 Chris PeBenito <[email protected]> - 2.20161023
Chris PeBenito (94):
Module version bump for systemd-user-sessions fc entry from Dominick Grift
Module version bumps for 2 patches from Dominick Grift.
Module version bump for vm overcommit sysctl interfaces from Laurent
Bigonville.
Update contrib.
Module version bump for Xorg and SSH patches from Nicolas Iooss.
Add neverallow for mac_override capability. It is not used by SELinux.
Merge branch 'overcommit-1' of git://github.com/bigon/refpolicy into
bigon-overcommit-1
Merge branch 'bigon-overcommit-1'
Merge branch 'systemd-1' of git://github.com/bigon/refpolicy into
bigon-systemd-1
Merge branch 'bigon-systemd-1'
Module version bump for syslog and systemd changes from Laurent Bigonville
Merge pull request #19 from shootingatshadow/fc_sort
Merge branch 'xorg-1' of git://github.com/bigon/refpolicy into
bigon-xorg-1
Merge branch 'bigon-xorg-1'
Module version bump for Debian Xorg fc fixes from Laurent Bigonville
Add a type and genfscon for nsfs.
Module version bump for systemd PrivateNetwork patch from Nicolas Iooss
Module version bump for systemd audit_read capability from Laurent
Bigonville
Merge pull request #21 from fishilico/typos
Module version bump for patches from Nicolas Iooss and Grant Ridder.
Update contrib.
Module version bump for efivarfs patches from Dan Walsh, Vit Mojzis, and
Laurent Bigonville
Module version bump for ipset fc entry from Laurent Bigonville.
Update contrib.
Whitespace fix in iptables.fc.
Module version bump for iptables fc entries from Laurent Bigonville and
Lukas Vrabec.
Update contrib.
Module version bump for iptables/firewalld patch from Laurent Bigonville.
Merge pull request #29 from bigon/appconfig-lxc
Module version bump for getty patch from Luis Ressel.
Module version bump for tboot utils from Luis Ressel and systemd fix from
Jason Zaman.
Merge branch 'corecommands-archlinux' of
https://github.com/fishilico/selinux-refpolicy-patched
Merge branch 'dev_setattr_dlm_control-typo' of
https://github.com/fishilico/selinux-refpolicy-patched
Merge branch 'kdevtmpfs-unlink' of
https://github.com/fishilico/selinux-refpolicy-patched
Module version bump for several Arch fixes from Nicolas Iooss.
Update contrib.
Reduce broad entrypoints for unconfined domains.
Update Travis-CI build to newest SELinux userspace release.
Update su for libselinux-2.5 changes.
Merge branch 'selinux-1' of https://github.com/bigon/refpolicy
Module version bump for Debian fc entries from Laurent Bigonville.
Module version bump for patches from Dominick Grift and Lukas Vrabec.
Add user namespace capability object classes.
Module version bump for hwloc-dump-hwdata from Dominick Grift and Grzegorz
Andrejczuk.
Module version bump for nftables fc entry from Jason Zaman.
Update contrib.
Module version bump for LMNR port from Laurent Bigonville.
Module version bump for systemd-resolved patch from Laurent BIgonville.
Merge branch 'master' of https://github.com/qqo/refpolicy into qqo-master
Merge branch 'qqo-master'
Module version bump for mlstrustedsocket from qqo.
Module version bumps + contrib update for user_runtime from Jason Zaman.
Update contrib.
Module version bump for corecommands update from Garrett Holmstrom.
Module version bump for MLS relabeling patch from Lukas Vrabec.
Get attributes of generic ptys, from Russell Coker.
Module version bump for user_udp_server tunable from Russell Coker.
libraries: Move libsystemd fc entry.
libraries: Module version bump for libsystemd fc entry from Lukas Vrabec.
Update contrib.
Systemd units from Russell Coker.
corenetwork: Add port labeling for Global Catalog over LDAPS.
corenetwork: Missed version bump for previous commit.
Update contrib.
Allow the system user domains to chat over dbus with a few other domains
(e.g. gnome session).
Update alsa module use from Guido Trentalancia.
Update the sysnetwork module to add some permissions needed by the dhcp
client (another separate patch makes changes to the ifconfig part).
Ifconfig should be able to read firmware files in /lib (i.e. some network
cards need to load their firmware) and it should not audit attempts to
load kernel modules directly.
Remove redundant libs_read_lib_files() for ifconfig_t.
Module version bump for various patches from Guido Trentalancia.
Update contrib.
Update for the xserver module:
userdomain: Fix compile errors.
Update contrib.
Merge pull request #38 from fishilico/travis-nosudo
Module version bump for module_load perm use from Guido Trentalancia.
Update contrib.
Merge pull request #39 from rfkrocktk/feature/vagrant
Merge pull request #40 from jer-gentoo/patch-1
userdomain: Move enable_mls block in userdom_common_user_template().
Module version bumps for LVM and useromain patches from Guido
Trentalancia.
Update contrib.
Additional change from Guido Trentalancia related to evolution.
Module version bump for selinuxutil fix from Jason Zaman.
Update contrib.
Update contrib.
Merge branch 'feature/syncthing' of https://github.com/rfkrocktk/refpolicy
into rfkrocktk-feature/syncthing
Merge branch 'rfkrocktk-feature/syncthing'
Module version bumps for syncthing from Naftuli Tzvi Kay.
Merge pull request #41 from SeanPlacchetti/patch-1
Merge pull request #42 from SeanPlacchetti/patch-1
Merge pull request #43 from williamcroberts/google-patch
Update contrib.
Bump module versions for release.
Dan Walsh (1):
Add label for efivarfs
Dominick Grift (5):
systemd: add missing file context spec for systemd-user-sessions
executable file
authlogin: remove duplicate files_list_var_lib(nsswitch_domain)
kernel: implement sysctl_vm_overcommit_t for
/proc/sys/vm/overcommit_memory
systemd: Add support for --log-target
Update refpolicy to handle hwloc
Garrett Holmstrom (1):
corecmd: Remove fcontext for /etc/sysconfig/libvirtd
Grant Ridder (1):
Add redis-sentinel port to redis network_port def
Guido Trentalancia (6):
Add module_load permission to class system
Add module_load permission to can_load_kernmodule
Remove deprecated semodule options from Makefile
Update the lvm module
Improve tunable support for rw operations on noxattr fs / removable media
userdomain: introduce the user certificate file context (was miscfiles:
introduce the user certificate file context)
Jason Zaman (6):
system/init: move systemd_ interfaces into optional_policy
iptables: add fcontext for nftables
authlogin: remove fcontext for /var/run/user
userdomain: Introduce types for /run/user
userdomain: user_tmp requires searching /run/user
userdomain: introduce interfaces for user runtime
Jason Zaman via refpolicy (1):
selinuxutil: allow setfiles to read semanage store
Jeroen Roovers (1):
Use $(AWK) not plain awk
Laurent Bigonville (15):
Add interfaces to read/write /proc/sys/vm/overcommit_memory
Give some systemd domain access to /proc/sys/kernel/random/boot_id
On Debian, systemd binaries are installed in / not /usr
Allow syslogd_t to read sysctl_vm_overcommit_t
Label Xorg server binary correctly on Debian
Allow systemd the audit_read capability
Allow logind to read efivarfs files
Add label for /sbin/ipset
Label /var/run/ebtables.lock as iptables_var_run_t.
Allow {eb,ip,ip6}tables-restore to read files in /run/firewalld
Add lxc_contexts config file
Add some labels for SELinux tools path in Debian
Add the validate_trans access vector to the security class
Add llmnr/5355 (Link-local Multicast Name Resolution)
Add policy for systemd-resolved
Luis Ressel (2):
Allow getty the sys_admin capability
Allow sysadm to run txt-stat.
Lukas Vrabec (4):
Label /var/run/xtables.lock as iptables_var_run_t.
SELinux support for cgroup2 filesystem.
Add new MLS attribute to allow relabeling objects higher than system low.
This exception is needed for package managers when processing sensitive
data.
Systemd by version 231 starts using shared library and systemd daemons
execute it. For this reason lib_t type is needed.
Mike Palmiotto (1):
Add mls support for some db classes
Naftuli Tzvi Kay (2):
Add Syncthing Support to Policy
Add Vagrant box for development.
Nicolas Iooss (18):
Label Xorg server binary correctly on Arch Linux
Label OpenSSH files correctly on Arch Linux
Label OpenSSH systemd unit files
Allow systemd services to use PrivateNetwork feature
Fix typo in init_dbus_chat requirements
Fix typos in comments from corenetwork module
man: Spelling fixes
Fix interface descriptions when duplicate ones are found
Label /sys/kernel/debug/tracing filesystem
Label TexLive scripts bin_t
Label system-config-printer applet properly on Arch Linux
Label gedit plugins properly on Arch Linux
Label some user session DBus services as bin_t
Do not label /usr/lib/gvfs/libgvfscommon.so as bin_t
Fix typo in dev_setattr_dlm_control interface requirements
Allow kdevtmpfs to unlink fixed disk devices
Fix typo in module compilation message
Make Travis-CI build without using sudo
Rahul Chaudhry (1):
fc_sort: cleanup warnings caught by clang tidy / static analyzer.
Russell Coker (2):
user_udp_server tunable
getattr on unlabeled blk devs
Sean Placchetti (2):
Update to refpolicy spec file
Update specfile
Vit Mojzis (1):
Add interface to allow reading files in efivarfs - contains Linux Kernel
configuration options for UEFI systems (UEFI Runtime Variables)
William Roberts (1):
fc_sort: strip whitespace errors
qqo (1):
Adds attribute mlstrustedsocket, along with the interface.
* Tue Dec 08 2015 Chris PeBenito <[email protected]> - 2.20151208
Alexander Wetzel (1):
adds vfio device support to base policy
Chris PeBenito (48):
Module version bump for optional else block removal from Steve Lawrence.
Add always_check_network policy capability.
Update contrib.
Fix domain_mmap_low() to be a proper tunable.
Add initial Travis CI configuration.
Travis CI already exports variables.
Add validate target for monolithic policy.
Update contrib.
Use matrix keyword to simplify travis-ci build definitions.
Undo last commit.
Simplify travis-ci build handling of SELinux toolchain.
Update contrib.
Module version bump for fstools blkid fix from Jason Zaman
Update contrib.
Module version bump for debufs mount point fc entry from Laurent
Bigonville.
Module version bump for updated netlink sockets from Stephen Smalley
Update contrib.
Module version bump for init_startstop_service from Jason Zaman.
Update contrib.
Change CI tests to drop DIRECT_INITRC.
Module version bumps for further init_startstop_service() changes from
Jason Zaman.
Module version bump for admin interface changes from Jason Zaman.
Update contrib.
Module version bumps for admin interfaces from Jason Zaman.
Module version bump for cron_admin for sysadm from Jason Zaman.
Module version bump for ssh-agent -k fix from Luis Ressel.
Module version bump for APR build script labeling from Luis Ressel.
Module version bump for vfio device from Alexander Wetzel.
Update contrib.
Rearrange lines in ipsec.te.
Module version bump for patches from Jason Zaman/Matthias Dahl.
Add systemd build option.
Add systemd access vectors.
Implement core systemd policy.
Add supporting rules for domains tightly-coupled with systemd.
Add rules for sysadm_r to manage the services.
Add systemd units for core refpolicy services.
Add sysfs_types attribute.
Add refpolicy core socket-activated services.
Change policy_config_t to a security file type.
Merge branch 'pebenito-master'
Module version bump for systemd additions.
Update contrib for dbus systemd fix.
Revise selinux module interfaces for perms protected by neverallows.
Remove bad interface in systemd.if.
Module version bump for utempter Debian helper from Laurent Bigonville.
Update contrib.
Bump module versions for release.
Jason Zaman (13):
fstools: add in filetrans for /run dir
Introduce init_startstop_service interface
logging: use init_startstop_service in _admin interface
postgresql: use init_startstop_service in _admin interface
Add openrc support to init_startstop_service
Introduce iptables_admin
Add all the missing _admin interfaces to sysadm
Introduce lvm_admin interface
Introduce ipsec_admin interface
Introduce setrans_admin interface
add new cron_admin interface to sysadm
Add overlayfs as an XATTR capable fs
system/ipsec: Add policy for StrongSwan
Laurent Bigonville (4):
Add fc for /sys/kernel/debug as debugfs_t
Add "binder" security class and access vectors
Properly label utempter helper on debian
Allow the user cronjobs to run in their userdomain
Luis Ressel (2):
Allow ssh-agent to send signals to itself
Mark APR build scripts as bin_t
Stephen Smalley (1):
Update netlink socket classes.
Steve Lawrence (1):
Remove optional else block for dhcp ping
* Wed Dec 03 2014 Chris PeBenito <[email protected]> - 2.20141203
Artyom Smirnov (3):
New database object classes
Fixes for db_domain and db_exception
Renamed db_type to db_datatype, to avoid confusion with SELinux "type"
Chris PeBenito (69):
Whitespace fix in postgresql.fc
Module version bump for postgresql fc entries from Luis Ressel.
Add symlink to contrib Changelog for easy reference.
Move lightdm line in xserver.fc.
Whitespace fix in xserver.fc.
Update contrib.
Module version bump for userdomain kernel symbol table fix from Nicolas
Iooss.
Module version bump for 2 Gentoo patches from Sven Vermeulen.
Update contrib.
Module version bump for 2 patch sets from Laurent Bigonville.
Update contrib.
Module version bump for gnome keyring fix from Laurent Bigonville.
Update contrib.
Module version bump for /sys/fs/selinux support from Sven Vermeulen.
Module version bump for fixes from Laurent Bigonville.
Update contrib.
Module version bumps for fc fixes from Nicolas Iooss.
Update contrib.
Add file for placing default_* statements.
Fix error in default_user example.
Module version bump for unconfined->lvm transition from Nicolas Iooss.
Need the __future__ import for python2 if using print().
Module version bump for ifconfig fc entry from Sven Vermeulen.
Module version bump for deprecated interface usage removal from Nicolas
Iooss.
Update contrib.
Module version bump for rcs2log and xserver updates from Sven Vermeulen.
Module version bump for shutdown transitions from Luis Ressel.
Remove firstboot_rw_t as FC5 has been gone for a long time.
Module version bump for firstboot_rw_t alias removal.
Module version bump for dropbox port from Sven Vermeulen.
Module version bump for unconfined syslog cap from Nicolas Iooss.
Always use the unknown permissions handling build option.
Merge pull request #1 from artyom-smirnov/master
Module version bump for zram fc entry from Jason Zaman.
Update contrib.
Module version bump for init_daemon_pid_file from Sven Vermeulen.
Move tumblerd fc entry
Module version bump for tumblerd fc entry from Jason Zaman.
Module version bump for libraries fc fix from Nicolas Iooss.
Update contrib.
Module version bump for fstools fc entries from Luis Ressel.
Module version bump for missing unlabeled interfaces from Sven Vermeulen.
Module version bump for ping rawip socket fix from Luis Ressel.
Module version bump for full IRC ports from Luis Ressel.
Move losetup addition in fstools.
Module version bump for losetup fixes from Luis Ressel.
Update contrib.
Module version bump for postgres fc revisions from Luis Ressel.
Module version bump for FUSE fix for mount from Luis Ressel.
Module version bump for misc fixes from Nicolas Iooss.
Move systemd fc entry.
Whitespace change in logging.fc.
Add comment for journald ring buffer reading.
Module version bumps for systemd/journald patches from Nicolas Iooss.
Update contrib.
/dev/log symlinks are not labeled devlog_t.
Module version bump for CIL fixes from Yuli Khodorkovskiy.
Drop RHEL4 and RHEL5 support.
Merge pull request #3 from bigon/arping
Merge pull request #4 from fishilico/minor-typo
Module version bump for Debian arping fc entries from Laurent Bigonville.
Add comment for iw generic netlink socket usage
Module version bump for /sbin/iw support from Nicolas Iooss.
Merge pull request #5 from bigon/audit_read
Update contrib.
Module version bump for misc fixes from Sven Vermeulen.
Update contrib.
Module version bump for module store move from Steve Lawrence.
Bump module versions for release.
Elia Pinto (1):
Fix misspelling
Jason Zaman (2):
File contexts for zram
File Context for tumbler
Laurent Bigonville (14):
Properly label git-shell and other git commands for Debian
Label /usr/sbin/lightdm as xdm_exec_t
Create new xattrfs attribute and fs_getattr_all_xattr_fs() interface
Associate the new xattrfs attribute to fs_t and some pseudo-fs
Use new fs_getattr_all_xattr_fs interface for setfiles_t and restorecond_t
Add telepathy role for user_r and staff_r
Properly label the manpages installed by postgresql
Label /usr/local/share/ca-certificates(/.*)? as cert_t
Allow the xdm_t domain to enter all the gkeyringd ones
Label /etc/locale.alias as locale_t on Debian
Allow hugetlbfs_t to be associated to /dev
On Debian iputils-arping is installed in /usr/bin/arping
Debian also ship a different arping implementation
Add new audit_read access vector in capability2 class
Luis Ressel (13):
Add two postgresql file contexts from gentoo policy
Allow init to execute shutdown
Allow xdm_t to transition to shutdown_t domain
Some of the fsadm tools can also be in /usr/sbin instead of /sbin
Label /usr/sbin/{add, del}part as fsadm_exec_t
Grant ping_t getattr on rawip_socket
kernel/corenetwork.te: Add all registered IRC ports
system/mount.if: Add mount_rw_loopback_files interface
system/fstools.if: Add fstools_use_fds interface
Add neccessary permissions for losetup
Only label administrative postgres commands as postgresql_exec_t
Also apply the new postgres labeling scheme on Debian
Grant mount permission to access /dev/fuse
Nicolas Iooss (31):
Fix parallel build of the policy
fc_sort: fix typos in comments
fc_sort: initialize allocated memory to fix execution on an empty file
fc_sort: make outfile argument optional
userdomain: no longer allow unprivileged users to read kernel symbols
Label syslog-ng.pid as syslogd_var_run_t
filesystem: label cgroup symlinks
Label /usr/lib/getconf as bin_t
Label /usr/share/virtualbox/VBoxCreateUSBNode.sh as udev_helper_exec_t
Make support/policyvers.py compatible with Python 3
Make unconfined user run lvm programs in confined domain
No longer use deprecated MLS interfaces
Allow unconfined domains to use syslog capability
Label /lib symlink as lib_t for every distro
Label /usr/lib/networkmanager/ like /usr/lib/NetworkManager/
Add ioctl and lock to manage_lnk_file_perms
Label (/var)?/tmp/systemd-private-.../tmp like /tmp
Fix typo in fs_getattr_all_fs description
Label systemd files in init module
Introduce init_search_run interface
Label systemd-journald files and directories
Support logging with /run/systemd/journal/dev-log
Allow journald to read the kernel ring buffer and to use /dev/kmsg
Allow journald to access to the state of all processes
Remove redundant Gentoo-specific term_append_unallocated_ttys(syslogd_t)
Fix minor typo in init.if
Label /sbin/iw as ifconfig_exec_t
Allow iw to create generic netlink sockets
Use create_netlink_socket_perms when allowing netlink socket creation
Update Python requirement in INSTALL
Create tmp directory when compiling a .mod.fc file in a modular way
Steve Lawrence (1):
Update policy for selinux userspace moving the policy store to
/var/lib/selinux
Sven Vermeulen (24):
Hide getattr denials upon sudo invocation
Support /sys/devices/system/cpu/online
The security_t file system can be at /sys/fs/selinux
Dontaudit access on security_t file system at /sys/fs/selinux
ifconfig can also be in /bin
xserver_t needs to ender dirs labeled xdm_var_run_t
Enable rcs2log location for all distributions
Add dropbox_port_t support
Support initrc_t generated pid files with file transition
Deprecate init_daemon_run_dir interface
Use init_daemon_pid_file instead of init_daemon_run_dir
Introduce kernel_delete_unlabeled_symlinks
Introduce kernel_delete_unlabeled_pipes
Introduce kernel_delete_unlabeled_sockets
Introduce kernel_delete_unlabeled_blk_files
Introduce kernel_delete_unlabeled_chr_files
Run grub(2)-mkconfig in bootloader domain
Add auth_pid_filetrans_pam_var_run
New sudo manages timestamp directory in /var/run/sudo
xfce4-notifyd is an executable
Mark f2fs as a SELinux capable file system
Add in LightDM contexts
Add gfisk and efibootmgr as fsadm_exec_t
Add /var/lib/racoon as runtime directory for ipsec
Yuli Khodorkovskiy (1):
Remove duplicate role declarations
cgarst (1):
Updating submodule URL to github
* Tue Mar 11 2014 Chris PeBenito <[email protected]> - 2.20140311
Chris PeBenito (96):
Update contrib to pull in minidlna.
Remove general unlabeled packet usage.
Update contrib.
Use python libselinux bindings to determine policy version.
Add MLS constraints for x_pointer and x_keyboard.
Add label for parted.
Fix support/policyvers.py not to error if building policy on a
SELinux-disabled system.
Module version bump for kerberos keytab changes for ssh from Dominick
Grift.
Module version bump for pstore filesystem support from Dominick Grift.
Module version bump for redis port from Dominick Grift.
Update contrib.
Add comment for setfiles using /dev/console when it needs to be relabeled.
Module version bump for xserver and selinuxutil updates from Dominick
Grift.
Module version bump for tmpfs associate to device_t from Dominick Grift.
Module version bump for syslog reading overcommit_memory from Dominick
Grift.
Module version bump for ethtool reading pm-powersave.lock from Dominick
Grift.
Module version bump for sysadm fix for git role usage from Dominick Grift.
Module version bump for lvm update from Dominick Grift.
Module version bump for fc fix in authlogin from Dominick Grift.
Module version bump for restricted x user template fix from Dominick
Grift.
Add comment for debian avahi-daemon-check-dns.sh usage by udev
Module version bump for udev Debian fixes from Dominick Grift.
Module version bump for selinuxfs location change from Dominick Grift.
Update contrib.
Module version bump for unconfined dbus fixes from Dominick Grift.
Whitespace fix in terminal.te.
Module version bump for virtio console from Dominick Grift.
Module version bump for init interface and corecommand fc from Dominick
Grift.
Module version bump for ping capabilities from Sven Vermeulen.
Module version bump for slim fc entries from Sven Vermeulen.
Module version bump for xdm dbus access from Dominick Grift.
Rearrange sysnet if blocks.
Module version bump for debian ifstate changes from Dominick Grift.
Module version bump for xserver console and fc fixes from Dominick Grift.
Module version bump for gdomap port from Dominick Grift.
Module version bumps for dhcpc leaked fds to hostname.
Module version bump for ssh server caps for Debian from Dominick Grift.
Move stray Debian rule in udev.
Update contrib
Module version bumps for Debian udev updates from Dominick Grift.
Module version bump for mount updates from Dominick Grift.
Silence symlink reading by setfiles since it doesn't follow symlinks
anyway.
Reorder dhcpc additions.
Module version bump for dhcpc fixes from Dominick Grift.
Add comments about new capabilities for syslogd_t.
Module version bumps for syslog-ng and semodule updates.
Update contrib.
Module version bump for first batch of patches from Dominick Grift.
Update contrib.
Rearrage userdom_delete_user_tmpfs_files() interface.
setrans: needs to be able to get attributes of selinuxfs, else fails to
start in Debian
Whitespace fix in fstools.
Add comment in policy for lvm sysfs write.
Module version bump for second lot of patches from Dominick Grift.
Whitespace fix in usermanage.
Whitespace fix in libraries.
Module version bump for patches from Dominick Grift.
Whitespace fix in init.te.
init: init_script_domain() allow system_r role the init script domain type
init: creates /run/utmp
Module version bump for 4 init patches from Dominick Grift.
Fix Debian compile issue.
Module version bump for 2 patches from Dominick Grift.
Module version bump for patch from Laurent Bigonville.
Update contrib.
Module version bump for patch from Laurent Bigonville.
Module version bump for xserver change from Dominick Grift.
Merge file_t into unlabeled_t, as they are security equivalent.
Update modules for file_t merge into unlabeled_t.
Make the QUIET build option apply to clean and bare targets.
Module version bump for direct initrc fixes from Dominick Grift.
Module version bump for module store labeling fixes from Laurent
Bigonville.
Remove ZFS symlink labeling.
Fix ZFS fc escaping in mount.
Rearrange ZFS fc entries.
Module version bump for ZFS tools fc entries from Matthew Thode.
Module version bump for unconfined transition to dpkg from Laurent
Bigonville.
Module version bump for logging fc patch from Laurent Bigonville.
Update contrib.
Module version bump for pid file directory from Russell Coker/Laurent
Bigonville.
Rename gpg_agent_connect to gpg_stream_connect_agent.
Rearrange gpg agent calls.
Module version bump for ssh use of gpg-agent from Luis Ressel.
Module version bump for files_dontaudit_list_var() interface from Luis
Ressel.
Move bin_t fc from couchdb to corecommands.
Update contrib.
Module version bump for sesh fc from Nicolas Iooss.
Move loop control interface definition.
Rename mount_read_mount_loopback() to mount_read_loopback_file().
Module version bump for loopback file mounting fixes from Luis Ressel.
Fix read loopback file interface.
Update contrib.
Module version bump for bootloader fc fixes from Luis Ressel.
Update contrib.
Update contrib.
Bump module versions for release.
Dominick Grift (58):
The kerberos_keytab_template() template is deprecated: Breaks monolithic
built (out-of-scope)
Initial pstore support
Support redis port tcp,6379
These regular expressions were not matched
Restorecon reads, and writes /dev/console before it is properly labeled
filesystem: associate tmpfs_t (shm) to device_t (devtmpfs) file systems
logging: syslog (rs:main Q:Reg) reading sysctl_vm files
(overcommit_memory) in Debian
sysnetwork: ethtool reads /run/pm-utils/locks/pm-powersave.lock