Update Changelog and VERSION for release.
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
This commit is contained in:
Chris PeBenito
parent
b2f72e833b
commit
3039bde79c
235
Changelog
235
Changelog
|
|
@ -1,3 +1,238 @@
|
||||||
|
* Sat Feb 29 2020 Chris PeBenito <pebenito@ieee.org> - 2.20200229
|
||||||
|
Alexander Miroshnichenko (1):
|
||||||
|
Add knot module
|
||||||
|
|
||||||
|
Chris PeBenito (174):
|
||||||
|
knot: Whitespace changes.
|
||||||
|
knot: Move lines.
|
||||||
|
devices, storage: Add fc entries for mtd char devices and ndctl devices.
|
||||||
|
devices: Add types for trusted execution environment interfaces.
|
||||||
|
ulogd: Rename ulogd_var_run_t to ulogd_runtime_t.
|
||||||
|
INSTALL: Fix build requirements.
|
||||||
|
fishilico/systemd-read-netlink_kobject_uevent_socket
|
||||||
|
Rename *_var_run_t types to *_runtime_t.
|
||||||
|
Reorder declarations based on *_runtime_t renaming.
|
||||||
|
Remove old aliases.
|
||||||
|
fishilico/filesystem-fs_rw_cgroup_files-follow-symlink
|
||||||
|
fc_sort.py: Use "==" for comparing integers.
|
||||||
|
xserver: Remove duplicate colord rule.
|
||||||
|
xserver: Move XDM dbus chats under main dbus optional.
|
||||||
|
Move open, audit_access, and execmod to file common.
|
||||||
|
Add file and filesystem watch access vectors.
|
||||||
|
Fix file common ordering and kernel version from previous commit.
|
||||||
|
init: Whitespace change.
|
||||||
|
unconfined: Add namespaced capabilities.
|
||||||
|
unconfined: Fix systemd --user rule.
|
||||||
|
Remove incorrect usages of "is" operator from Python scripts.
|
||||||
|
logging: Reorder lines.
|
||||||
|
systemd: Logind removes /run/user/* user temp files.
|
||||||
|
unconfined: Add watch permission for files.
|
||||||
|
systemd: Add filesystem watches.
|
||||||
|
dbus: Add directory watches.
|
||||||
|
udev: Watch devices.
|
||||||
|
init: Revise systemd bind mounts.
|
||||||
|
Add perf_event access vectors.
|
||||||
|
systemd: Whitespace fix.
|
||||||
|
logging: Whitespace fix.
|
||||||
|
Bump module versions for release.
|
||||||
|
|
||||||
|
Christian Göttsche (6):
|
||||||
|
fix Makefile for policy-module directories with same ending
|
||||||
|
segenxml.py: fix format usage in warning message
|
||||||
|
travis: force the use of python3.5
|
||||||
|
travis: run check_fc_files linter with python 3.7
|
||||||
|
re-implement fc_sort in python
|
||||||
|
Add genfs_seclabel_symlinks policy capability
|
||||||
|
|
||||||
|
Daniel Burgener (4):
|
||||||
|
Add requires to interfaces that reference types or attributes without
|
||||||
|
requiring them
|
||||||
|
Remove uneeded types from interfaces where types were added
|
||||||
|
Fix situations where require blocks in interfaces listed types not
|
||||||
|
actually referenced by that interface
|
||||||
|
Remove unneeded semicolons after interface and macro calls
|
||||||
|
|
||||||
|
Dominick Grift (2):
|
||||||
|
domain: unconfined access to bpf
|
||||||
|
Remove shell automatic domain transitions to unconfined_t from various pam
|
||||||
|
login programs
|
||||||
|
|
||||||
|
Guido Trentalancia (4):
|
||||||
|
Update the pulseaudio application module with a few user domain file read
|
||||||
|
and management permissions.
|
||||||
|
Allow userdomain to read and write the wireless devices (for example for
|
||||||
|
querying their state, enabling and/or disabling them using userspace
|
||||||
|
tools such as "rfkill" from util-linux).
|
||||||
|
Add an interface to allow watch permission on generic device directories.
|
||||||
|
Allow pulseaudio to watch generic device directories.
|
||||||
|
|
||||||
|
Jason Zaman (16):
|
||||||
|
udev: Allow udevadm access to udev_tbl_t
|
||||||
|
xserver: ICEauthority can be in /run/user
|
||||||
|
devicekit: udisks needs access to /run/mount/utab.lock
|
||||||
|
dirmngr: accept unix stream socket
|
||||||
|
chromium: allow dbus chat to inhibit power
|
||||||
|
virt: Add unix socket for virtlogd/virtlockd
|
||||||
|
virt: allow lvm_control access
|
||||||
|
fstools: add zfs-auto-snapshot
|
||||||
|
udev: Add watch perms
|
||||||
|
accountsd: Add watch perms
|
||||||
|
cron: watch cron spool
|
||||||
|
colord: add watch perms
|
||||||
|
policykit devicekit: Add watch perms
|
||||||
|
dbus: add watch perms
|
||||||
|
chromium: watch etc dirs
|
||||||
|
gpg: add watch perms for agent
|
||||||
|
|
||||||
|
Laurent Bigonville (9):
|
||||||
|
Makefile: Avoid regenerating the iftemplates at everyrun
|
||||||
|
Allow systemd_modules_load_t to module_request and map modules_object_t
|
||||||
|
files
|
||||||
|
Allow udevadm to read files in /run/udev/data
|
||||||
|
Allow udevadm_t to use dac_read_search capability
|
||||||
|
Allow the systemd dbus-daemon to talk to systemd
|
||||||
|
Allow geoclue to log in syslog
|
||||||
|
Allow realmd_t to read localization files
|
||||||
|
Allow alsa_t to create alsa_runtime_t file as well
|
||||||
|
Allow alsa_t to set scheduling priority and send signal to itself
|
||||||
|
|
||||||
|
Luca Boccassi (2):
|
||||||
|
journald: allow to remove /run/log/journal
|
||||||
|
logging: add interface to start/stop syslog units
|
||||||
|
|
||||||
|
Nicolas Iooss (75):
|
||||||
|
ulogd: add Debian's log directory
|
||||||
|
ulogd: allow creating a netlink-netfilter socket
|
||||||
|
ulogd: allow starting on a Debian system
|
||||||
|
entropyd: label the unit file of haveged
|
||||||
|
entropyd: allow haveged to create a Unix socket to received commands
|
||||||
|
ulogd: fix pattern for /run/ulog directory
|
||||||
|
monit: use s0 instead of s9
|
||||||
|
java: reduce the scope of the pattern in for java entry points
|
||||||
|
libraries: match a digit in Adobe Reader directories
|
||||||
|
drbd: fix pattern for /usr/lib/ocf/resource.d/linbit/drbd
|
||||||
|
rpcbind: remove redundant file context for /run/rpc.statd.pid
|
||||||
|
files: reduce the scope of the pattern matching /usr/include
|
||||||
|
Remove unescaped single dot from the policy
|
||||||
|
Fix use of buggy pattern (.*)?
|
||||||
|
libraries: drop a pattern specific to Python 2.4
|
||||||
|
systemd: introduce an interface for services using PrivateDevices=yes
|
||||||
|
Vagrantfile: upgrade VM to Fedora 30
|
||||||
|
Allow Debian to generate a dynamic motd when users log in
|
||||||
|
entropyd: haveged service uses PrivateDevices=yes
|
||||||
|
Check the .fc files for common typos
|
||||||
|
corecommands: no longer use \d
|
||||||
|
libraries: fix some misspellings in patterns
|
||||||
|
java: remove unnecessary parentheses in pattern
|
||||||
|
cups: add a slash to match /opt/brother/Printers/
|
||||||
|
Vagrantfile: build and install refpolicy on Fedora VM
|
||||||
|
Vagrantfile: add a Debian virtual machine
|
||||||
|
ntp: allow systemd-timesyncd to read network status
|
||||||
|
cups: use ([^/]+/)? to match a subdirectory of CUPS configuration
|
||||||
|
portage: really make consoletype module optional
|
||||||
|
Label programs in /usr/bin like /usr/sbin
|
||||||
|
apt: allow transition from apt_t to dpkg_t with NNP
|
||||||
|
apt: allow preventing shutdown by calling a systemd-logind D-Bus method
|
||||||
|
authlogin: label utempter correctly on Debian
|
||||||
|
irc: add WeeChat policy
|
||||||
|
systemd: allow systemd --user to receive messages from
|
||||||
|
netlink_kobject_uevent_socket
|
||||||
|
Add a policy module for WireGuard VPN
|
||||||
|
modutils: allow depmod to read /boot/System.map
|
||||||
|
modutils: allow depmod and modprobe to use the I/O provided by apt
|
||||||
|
systemd: allow systemd-modules-load.service to read sysfs
|
||||||
|
sudo: allow using use_pty flag
|
||||||
|
Allow using /([^/]+/)? and (/[^/]+)?/ in patterns
|
||||||
|
ulogd: adjust policy for Debian
|
||||||
|
bitlbee: allow using GetDynamicUser on Debian
|
||||||
|
chromium: remove distro-specific ifdef
|
||||||
|
systemd-networkd: allow creating a generic netlink socket
|
||||||
|
systemd-networkd: allow communicating with hostnamed
|
||||||
|
sudo: allow transmitting SIGWINCH to its child
|
||||||
|
sudo: allow using CAP_KILL for SIGWINCH
|
||||||
|
systemd: allow detecting Windows Subsystem for Linux
|
||||||
|
systemd: allow more accesses to systemd --user
|
||||||
|
systemd: remove unnecessary init_write_runtime_socket()
|
||||||
|
.travis.yml: update distro to Ubuntu 18.04 LTS (Bionic Beaver)
|
||||||
|
filesystem: allow following symlinks with fs_rw_cgroup_files()
|
||||||
|
systemd: allow user environment helpers to communicate with systemd --user
|
||||||
|
.travis.yml: check the .fc files in CI
|
||||||
|
systemd: make the kernel spawn systemd-coredump with a context transition
|
||||||
|
gpg: allow gpg-agent to read crypto.fips_enabled sysctl
|
||||||
|
testing/check_fc_files: allow @ character in file context patterns
|
||||||
|
mount: allow callers of mount to search /usr/bin
|
||||||
|
sysadm: allow using hostnamectl
|
||||||
|
init: allow systemd to mount over /dev/kmsg and /proc/kmsg
|
||||||
|
Add policy for CryFS, encfs and gocryptfs
|
||||||
|
Vagrantfile: fix configuration
|
||||||
|
Vagrantfile: remove sudo
|
||||||
|
Vagrantfile: add a specific SELinux policy module
|
||||||
|
systemd: allow reading options from EFI variable SystemdOptions
|
||||||
|
virt: allow more accesses to libvirt_leaseshelper
|
||||||
|
systemd-logind: allow using BootLoaderEntries DBUS property
|
||||||
|
storage: introduce storage_raw_read_fixed_disk_cond
|
||||||
|
Vagrantfile: allow unconfined and sysadm SSH login
|
||||||
|
Vagrant: allow VirtualBox provisionning to use dhclient and ip
|
||||||
|
Associate role unconfined_r to wine_t
|
||||||
|
systemd: add an interface to use nss-systemd
|
||||||
|
usermanage: allow groupadd to lookup dynamic users from systemd
|
||||||
|
mount: label fusermount3 like fusermount
|
||||||
|
|
||||||
|
Peter Morrow (1):
|
||||||
|
systemd_tmpfiles_t: Allow systemd_tempfiles_t to change permissions in
|
||||||
|
sysfs
|
||||||
|
|
||||||
|
Petr Lautrbach (1):
|
||||||
|
newrole: allow newrole to use setcap to drop capabilities
|
||||||
|
|
||||||
|
Stephen Smalley (4):
|
||||||
|
access_vectors: Remove unused permissions
|
||||||
|
access_vectors: Remove entrypoint and execute_no_trans from chr_file
|
||||||
|
access_vectors: remove flow_in and flow_out permissions from packet class
|
||||||
|
Rename obsolete netlink_firewall_socket and netlink_ip6fw_socket classes
|
||||||
|
|
||||||
|
Sugar, David (13):
|
||||||
|
grant rpm permission to map rpm_var_lib_t
|
||||||
|
grant permission for rpm to write to audit log
|
||||||
|
grant rpm permissions to map locale_t
|
||||||
|
Allow rpm to map file contexts
|
||||||
|
Allow rpm scripts to alter systemd services
|
||||||
|
grant rpm_t permission to map security_t
|
||||||
|
Module for tpm2
|
||||||
|
Add missing gen_require for init_t in init_script_domain
|
||||||
|
resolve syslog imuxsock denial
|
||||||
|
Add interface to read efivarfs_t directory
|
||||||
|
Fix indent to match the rest of the file (space -> tab)
|
||||||
|
Allow systemd to getattr all files
|
||||||
|
audit daemon can halt system, allow this to happen.
|
||||||
|
|
||||||
|
Topi Miettinen (2):
|
||||||
|
Consider jitterentropy to belong to entropyd family
|
||||||
|
Consider iwd equivalent to NetworkManager etc.
|
||||||
|
|
||||||
|
Vilgot Fredenberg (1):
|
||||||
|
Remove obsolete gentoo specific rule
|
||||||
|
|
||||||
|
bauen1 (16):
|
||||||
|
fix: sudo can't determine default type for sysadm_r
|
||||||
|
fix ifupdown2 executable mislabeled as lib_t
|
||||||
|
added bpf_t filesystem label
|
||||||
|
netutils: allow mtr to communicate with mtr-packet
|
||||||
|
kernel/corecommands: fix the label of xfce4 helpers (on debian)
|
||||||
|
systemd: remove whitespace
|
||||||
|
init: add interfaces for managing /run/systemd
|
||||||
|
systemd: add policy for systemd-fstab-generator
|
||||||
|
udev: remove console-setup
|
||||||
|
consolesetup: add policy for console-setup
|
||||||
|
udev: run consolesetup
|
||||||
|
loadkeys: remove redundant ifdef
|
||||||
|
init: split init_create_pid_files interface
|
||||||
|
ntp: watch systemd networkd runtime dirs This is required for correct
|
||||||
|
function after linux 5.4
|
||||||
|
systemd-user-runtime-dir: add policy
|
||||||
|
sysadm: add sysadm_allow_rw_inherited_fifo tunable to allow writing to
|
||||||
|
fifo_files inherited from domains allowed to change role to sysadm_r.
|
||||||
|
|
||||||
* Sun Jun 09 2019 Chris PeBenito <pebenito@ieee.org> - 2.20190609
|
* Sun Jun 09 2019 Chris PeBenito <pebenito@ieee.org> - 2.20190609
|
||||||
Chris PeBenito (70):
|
Chris PeBenito (70):
|
||||||
systemd: Module version bump.
|
systemd: Module version bump.
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue