34055cae87
Bump module versions for release.
2016-10-23 16:58:59 -04:00
2c465410d9
Add neverallow for mac_override capability. It is not used by SELinux.
2016-01-06 09:09:36 -05:00
c23353bcd8
Bump module versions for release.
2015-12-08 09:53:02 -05:00
17694adc7b
Module version bump for systemd additions.
2015-10-23 14:53:14 -04:00
3639880cf6
Implement core systemd policy.
...
Significant contributions from the Tresys CLIP team.
Other changes from Laurent Bigonville.
2015-10-23 10:16:59 -04:00
468185f5f7
Bump module versions for release.
2014-12-03 13:37:38 -05:00
2abfedde73
Module version bump for 2 Gentoo patches from Sven Vermeulen.
2014-04-04 16:09:30 -04:00
22ef609197
Support /sys/devices/system/cpu/online
...
In glibc, the get_nprocs method reads /sys/devices/system/cpu/online, so
we need to grant most domains read access to this file. As we don't want
them to have read access on sysfs_t by default, create a new type
(cpu_online_t) and assign it to the file, and grant domains read access
to the file.
This does require systems to relabel the file upon every boot, something
distributions do in their bootup scripts, as /sys devices don't keep
their context.
Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2014-04-04 16:07:43 -04:00
f65edd8280
Bump module versions for release.
2012-02-15 14:32:45 -05:00
f7a845fcca
Module version bump for udp_socket listen dontaudit for all domains.
2011-08-23 08:29:03 -04:00
ec280b3209
Silence spurious udp_socket listen denials.
2011-08-23 08:21:40 -04:00
aa4dad379b
Module version bump for release.
2011-07-26 08:11:01 -04:00
0de0ea5c9e
Start pulling in kernel layer pieces from Fedora.
2011-03-29 10:33:43 -04:00
826d014241
Bump module versions for release.
2010-12-13 09:12:22 -05:00
785ee7988c
Module version bump and changelog entry for conditional mmap_zero patch.
2010-09-01 10:08:09 -04:00
623e4f0885
1/1] Make the ability to mmap zero conditional where this is fapplicable.
...
Retry: forgot to include attribute mmap_low_domain_type attribute to domain_mmap_low() :
Inspired by similar implementation in Fedora.
Wine and vbetool do not always actually need the ability to mmap a low area of the address space.
In some cases this can be silently denied.
Therefore introduce an interface that facilitates "mmap low" conditionally, and the corresponding boolean.
Also implement booleans for wine and vbetool that enables the ability to not audit attempts by wine and vbetool to mmap a low area of the address space.
Rename domain_mmap_low interface to domain_mmap_low_uncond.
Change call to domain_mmap_low to domain_mmap_low_uncond for xserver_t. Also move this call to distro redhat ifndef block because Redhat does not need this ability.
Signed-off-by: Dominick Grift <domg472@gmail.com>
2010-09-01 09:41:56 -04:00
48f99a81c0
Whitespace change: drop unnecessary blank line at the start of .te files.
2010-06-10 08:16:35 -04:00
29af4c13e7
Bump module versions for release.
2010-05-24 15:32:01 -04:00
1f6d975502
Domain patch from Dan Walsh.
2010-03-17 10:02:07 -04:00
9570b28801
module version number bump for release 2.20090730 that was mistakenly omitted.
2009-08-05 10:59:21 -04:00
a65fd90a50
trunk: 6 patches from dan.
2009-06-11 15:00:48 +00:00
17ec8c1f84
trunk: bump module versions for release.
2008-12-10 19:38:10 +00:00
6e68e6bb5e
trunk: Move shared library calls from individual modules to the domain module.
2008-10-17 17:36:56 +00:00
0bfccda4e8
trunk: massive whitespace cleanup from dominick grift.
2008-07-23 21:38:39 +00:00
f7925f25f7
trunk: bump module versions for release.
2007-12-14 14:23:18 +00:00
0aa18d9fd5
trunk: version bumps for previous commit.
2007-11-26 16:46:38 +00:00
bdccbacdd6
trunk: add labeled networking support to unconfined.
2007-11-14 14:38:45 +00:00
a56055e362
trunk: rearrange the bottom of domain.if and fix domain_ipsec_labels().
2007-11-14 13:40:25 +00:00
495df41602
trunk: 11 patches from dan.
2007-10-29 18:35:32 +00:00
ef659a476e
Deprecate some old file and dir permission set macros in favor of the newer, more consistently-named macros.
2007-10-09 17:29:48 +00:00
12e9ea1ae3
trunk: module version bumps for previous commit.
2007-10-02 17:15:07 +00:00
350b6ab767
trunk: merge strict and targeted policies. merge shlib_t into lib_t.
2007-10-02 16:04:50 +00:00
116c1da330
trunk: update module version numbers for release.
2007-06-29 14:48:13 +00:00
41337aa8b9
Memprotect support patch from Stephen Smalley.
2007-06-19 13:02:26 +00:00
0251df3e39
bump module versions for release
2007-04-17 13:28:09 +00:00
6b19be3360
patch from dan, Thu, 2007-01-25 at 08:12 -0500
2007-02-16 23:01:42 +00:00
a52b4d4f23
bump versions to release numbers
2006-10-18 19:25:27 +00:00
d822675850
add access to keys for unconfined
2006-07-14 13:11:42 +00:00
17de1b790b
remove extra level of directory
2006-07-12 20:32:27 +00:00
Chris PeBenito
Chris PeBenito
Sven Vermeulen
Dominick Grift