25d796ed37
Unconditional staff and user oidentd home config access from Dominick Grift.
2010-09-15 08:20:16 -04:00
785ee7988c
Module version bump and changelog entry for conditional mmap_zero patch.
2010-09-01 10:08:09 -04:00
76a9fe96e4
Module version bumps and changelog for devtmpfs patchset.
2010-08-25 11:19:27 -04:00
c62f1bef77
Dbadm updates from KaiGai Kohei.
2010-08-19 08:41:39 -04:00
a9539a063b
Additional kdumpgui cleanup.
2010-08-10 09:21:01 -04:00
5d6bf457b9
Changelog entry for sambagui.
2010-08-09 09:51:35 -04:00
12ab39533b
Changelog entry for accountsd.
2010-08-03 09:51:01 -04:00
9d4395a736
MojoMojo from Lain Arnell.
2010-08-02 09:28:06 -04:00
27eeb649cc
Virtio disk file context update from Mika Pfluger.
2010-08-02 08:33:41 -04:00
21fdee9dd5
Increase bindreservport range to 512-1024 in corenetwork, from Dan Walsh.
...
We went back and reread the bindreservport code in glibc.
Turns out the range or ports that this will reserve are 512-1024 rather
then 600-1024.
The code actually first tries to reserve a port from 600-1024 and if
they are ALL reserved will try 512-599.
So we need to change corenetwork to reflect this.
2010-07-19 14:22:44 -04:00
29f3bfa464
Fix JIT usage for freshclam.
...
http://marc.info/?l=selinux&m=127893898208934&w=2
2010-07-13 08:39:54 -04:00
7e265a8abb
Add shutdown from Dan Walsh.
2010-07-07 11:10:56 -04:00
b841dffda1
Add livecd from Dan Walsh.
2010-07-07 10:28:25 -04:00
08690c84ad
Remove ethereal module since the application was renamed to wireshark due to trademark issues.
2010-07-07 09:31:57 -04:00
bca0cdb86e
Remove duplicate/redundant rules, from Russell Coker.
2010-07-07 08:41:20 -04:00
0001e26f4f
Increased default number of categories to 1024, from Russell Coker.
2010-06-28 09:04:24 -04:00
98652c65a3
Add missing changelog entry for cgroup.
2010-06-08 13:08:36 -04:00
5c2b95e1b9
Add missing cluster suite modules that were missing from the Changelog.
2010-05-26 11:53:21 -04:00
03e653bd28
Changelog and version update for release.
2010-05-25 16:01:49 -04:00
f9bdd1e389
Add missing changelog entries.
2010-05-24 15:24:40 -04:00
e9e43f04b3
Plymouthd policy from Dan Walsh.
2010-05-18 09:54:18 -04:00
e07fbc004d
Add DenyHosts from Dan Walsh.
2010-04-26 12:59:02 -04:00
85e71c86da
Fix network_port() in corenetwork to correctly handle port ranges.
2010-04-13 11:06:02 -04:00
ec8d32c8e9
[BUGFIX] lack of type transition on dbadm domain (Re: dbadm.pp is not available in selinux-policy package)
...
I found out a bug when we initialize the database with dbadm_r:dbadm_t
which belongs to sepgsql_admin_type attribute.
In the case when sepgsql_admin_type create a new database objects,
it does not have valid type_transition rules. So, it was failed.
Sorry, I didn't find out it for a long time.
And db_procedure:{execute} on the sepgsql_proc_exec_t might be necessary
for the administrative domain independently from sepgsql_unconfined_dbadm,
because we need to execute some of system defined procedures to look up
system tables.
2010-04-12 10:37:21 -04:00
ee2d2dda24
Add usbmuxd from Dan Walsh.
2010-03-29 13:29:18 -04:00
6d4dbd20ae
Vhostmd from Dan Walsh.
2010-03-29 11:25:06 -04:00
827060cb04
Style fixes and module version bumps for 38fc1bd.
2010-03-17 09:28:18 -04:00
29b580ce8f
Add sectoolm by Miroslav Grepl.
2010-02-19 09:39:06 -05:00
a513794b4c
Chronyd from Miroslav Grepl.
2010-02-16 14:53:59 -05:00
12dc618bff
Add changelog entry for 1031ee6.
2010-02-08 14:52:02 -05:00
e526fca176
Add nut from Stefan Schulze Frielinghaus and Miroslav Grepl.
2010-02-08 11:29:12 -05:00
4ebfec7303
Add pyicqt from Stefan Schulze Frielinghaus.
2010-02-08 10:58:16 -05:00
22a2874dbf
Add dbadm, from KaiGai Kohei.
2010-02-08 10:34:08 -05:00
7fc72a02d9
Changelog and version bump for X object manager changes.
2009-12-03 10:40:42 -05:00
a404bc39a7
update VERSION and Changelog for release.
2009-11-17 10:17:43 -05:00
e6d8fd1e50
additional cleanup for e877913.
2009-11-11 11:28:50 -05:00
222d5b5987
clean up 0bca409 and add changelog entry.
2009-11-03 09:25:37 -05:00
b04669aaea
add tuned from miroslav grepl.
2009-10-26 09:42:11 -04:00
c5967300e2
add changelog entry for e4928c5f79
2009-10-22 09:22:14 -04:00
4be8dd10b9
add seunshare from dan.
2009-09-28 15:40:06 -04:00
5a6b1fe2b4
add dkim from stefan schulze frielinghaus.
2009-09-17 09:12:33 -04:00
21b1d1096f
add gnomeclock from dan.
2009-09-16 08:38:58 -04:00
ed70158a39
add rtkit from dan.
2009-09-15 09:53:24 -04:00
1d3b9e384c
clean up xscreensaver.
2009-09-15 09:41:42 -04:00
c141d835f1
add modemmanager from dan.
2009-09-14 09:48:13 -04:00
e3a90e358a
add abrt from dan.
2009-09-14 09:22:24 -04:00
81bca10b28
nslcd policy from dan.
2009-09-08 10:31:19 -04:00
dbed95369c
add gitosis from miroslav grepl.
2009-09-03 09:52:08 -04:00
625be1b4e6
add shorewall from dan.
2009-09-02 08:58:52 -04:00
71965a1fc5
add kdump from dan.
2009-09-02 08:33:25 -04:00
aa83007d5a
add hddtemp from dan.
2009-09-01 08:34:04 -04:00
93c49bdb04
deprecate userdom_xwindows_client_template
...
The X policy for users is currently split between
userdom_xwindows_client_template() and xserver_role(). Deprecate
the former and put the rules into the latter.
For preserving restricted X roles (xguest), divide the rules
into xserver_restricted_role() and xserver_role().
2009-08-28 13:29:36 -04:00
62c80e2546
module version bumps and changelog update for the previous 3 commits.
2009-08-18 13:20:01 -04:00
909922027b
Debian policykit fixes from Martin Orr.
...
The policykit binaries on Debian live in /usr/lib/policykit so add file
contexts for that. Also a couple of policykit rules.
2009-08-18 09:49:31 -04:00
b2648249d9
Fix unconfined_r use of unconfined_java_t.
...
The unconfined role is running java in the unconfined_java_t. The current
policy only has a domtrans interface, so the unconfined_java_t domain is not
added to unconfined_r. Add a run interface and change the unconfined module
to use this new interface.
2009-08-17 13:19:26 -04:00
4254cec711
Add missing x_device rules for XI2 functions, from Eamon Walsh.
...
> Whats the difference between add/remove and create/destroy?
>
> The devices are in a kind of hierarchy. You can now create one or more
> "master devices" (mouse cursor and keyboard focus). The physical input
> devices are "slave devices" that attach to master devices.
>
> Add/remove controls the ability to add/remove slave devices from a
> master device. Create/destroy controls the ability to create new master
> devices.
2009-08-14 13:18:16 -04:00
2a77737d4e
Add missing rules to make unconfined_cronjob_t a valid cron job domain.
...
Unconfined_cronjob_t is not a valid cron job domain because the cron
module is lacking a transition from the crond to the unconfined_cronjob_t
domain. This adds the transition and also a constraints exemption since
part of the transition is also a seuser and role change typically.
2009-08-12 14:15:39 -04:00
0f5e26b620
Add btrfs and ext4 to labeling targets.
2009-08-11 09:01:58 -04:00
90286f4292
Fix infrastructure to expand macros in initrc_context when installing.
...
The initrc_context file uses the mls_systemhigh macro and needs to be properly
expanded based on the build.conf settings. Add makefile support to do this.
2009-08-10 14:00:34 -04:00
02e594d5dc
Handle unix_chkpwd usage by useradd and groupadd; fixes ticket #49 .
2009-08-05 14:19:54 -04:00
e335910197
Add missing compatibility aliases for xdm_xserver*_t types.
...
When collapsing all of the xdm_xserver*_t types into xserver*_t, aliases for
compatibility were mistakenly not added to the policy.
2009-08-05 11:17:53 -04:00
915dfa68b6
release 2.20090730
2009-07-30 14:35:47 -04:00
64c7061e1a
changelog entry for the previous gentoo fixes
2009-07-30 10:41:17 -04:00
20c3ccee1a
add fprintd module from dan.
2009-07-29 10:28:31 -04:00
677c4c2fea
add devicekit module from dan.
2009-07-29 10:02:06 -04:00
c7ae9ae1c8
Merge branch 'master' of ssh://oss.tresys.com/home/git/refpolicy
2009-07-28 08:00:03 -04:00
5f6c30f8bd
wm policy from dan
2009-07-27 15:11:22 -04:00
f4962ab15b
add cpufreqselector from dan
2009-07-27 09:09:00 -04:00
09516cb4be
remove read_default_t tunable
2009-07-23 08:58:35 -04:00
9b1907b217
add pulseaudio from dan.
2009-07-21 10:05:38 -04:00
dc0ab0f0c3
changelog for previous commit
2009-07-20 11:16:22 -04:00
50824a99ca
trunk: pads from dan.
2009-06-30 15:03:20 +00:00
267d9c60c5
trunk: varnishd from dan.
2009-06-30 13:49:53 +00:00
c017ee17ab
trunk: add sssd from dan.
2009-06-22 15:33:21 +00:00
c9c0d846de
trunk: Greylist milter from Paul Howarth.
2009-06-18 14:36:35 +00:00
c7dc1c7222
trunk: Allow unix_update to change the security attributes associate with files so
...
that it can properly create the shadow file. Also allow it to read from
urandom so that it can add salt to the password hash.
2009-06-18 13:57:26 +00:00
df28a0c444
trunk: Misc fixes for unix_update from Brandon Whalen.
2009-06-18 13:36:40 +00:00
95ea7d6986
trunk: Add x_device permissions for XI2 functions, from Eamon Walsh.
2009-06-18 13:07:23 +00:00
16fd1fd814
trunk: MLS constraints for the x_selection class, from Eamon Walsh.
2009-06-05 13:36:19 +00:00
cca4a215fe
trunk: add gpsd from miroslav grepl
2009-06-02 14:28:40 +00:00
350ed89156
se-postgresql update from kaigai
...
- rework: Add a comment of "deprecated" for deprecated permissions.
- bugfix: MCS policy did not constrain the following permissions.
db_database:{getattr}
db_table:{getattr lock}
db_column:{getattr}
db_procedure:{drop getattr setattr}
db_blob:{getattr import export}
- rework: db_table:{lock} is moved to reader side, because it makes
impossible to refer read-only table with foreign-key constraint.
(FK checks internally acquire explicit locks.)
- bugfix: some of permissions in db_procedure class are allowed
on sepgsql_trusted_proc_t, but it is a domain, not a procedure.
It should allow them on sepgsql_trusted_proc_exec_t.
I also aliased sepgsql_proc_t as sepgsql_proc_exec_t to avoid
such kind of confusion, as Chris suggested before.
- rework: we should not allow db_procedure:{install} on the
sepgsql_trusted_proc_exec_t, because of a risk to invoke trusted
procedure implicitly.
- bugfix: MLS policy dealt db_blob:{export} as writer-side permission,
but it is required whrn the largeobject is refered.
- bugfix: MLS policy didn't constrain the db_procedure class.
2009-05-07 12:35:32 +00:00
da3ed0667f
trunk: lircd from miroslav grepl
2009-05-06 15:09:46 +00:00
3392356f36
trunk: 5 patches from dan.
2009-05-06 14:26:20 +00:00
0cf1d56018
trunk: Milter state directory patch from Paul Howarth.
2009-04-21 20:40:45 +00:00
a5ef553c2d
trunk: 5 modules from dan.
2009-04-20 19:03:15 +00:00
153fe24bdc
trunk: 5 patches from dan.
2009-04-07 14:09:43 +00:00
42d567c3f4
trunk: 6 patches from dan.
2009-03-31 13:40:59 +00:00
3c9b2e9bc6
trunk: 6 patches from dan.
2009-03-19 17:56:10 +00:00
e1a70f1dde
trunk: add MLS constrains for ingress/egress permissions from Paul Moore.
...
Add MLS constraints for several network related access controls including
the new ingress/egress controls and the older Secmark controls. Based on
the following post to the SELinux Reference Policy mailing list:
* http://oss.tresys.com/pipermail/refpolicy/2009-February/000579.html
2009-03-02 15:16:49 +00:00
156204a385
trunk: Drop write permission from fs_read_rpc_sockets().
2009-02-24 20:00:15 +00:00
81fa19ed73
trunk: remove unused udev_runtime_t type.
2009-02-24 19:31:08 +00:00
f3fcadfe04
trunk: Patch for RadSec port from Glen Turner.
2009-02-23 13:41:28 +00:00
7722c29e88
trunk: Enable network_peer_controls policy capability from Paul Moore.
2009-02-03 15:45:30 +00:00
805f34ed09
trunk: btrfs from Paul Moore.
2009-01-30 13:44:14 +00:00
466e22a8ba
trunk: Add db_procedure install permission from KaiGai Kohei.
2009-01-23 19:49:36 +00:00
019dfaf9dc
trunk: Add support for network interfaces with access controlled by a Boolean from the CLIP project.
2009-01-15 20:31:06 +00:00
9e7a338509
trunk: su fixes from clip.
2009-01-13 19:44:23 +00:00
f0435b1ac4
trunk: add support for labeled booleans.
2009-01-13 13:01:48 +00:00
c1262146e0
trunk: Remove node definitions and change node usage to generic nodes.
2009-01-09 19:48:02 +00:00
347a701119
trunk: Add kernel_service access vectors, from Stephen Smalley.
2009-01-05 21:44:33 +00:00
e66a0cad18
trunk: check in version and changelog for release.
2008-12-10 19:49:42 +00:00
3196971ae8
trunk: Fix consistency of audioentropy and iscsi module naming.
2008-12-09 16:47:33 +00:00
b3eb124654
trunk: Debian file context fix for xen from Russell Coker.
2008-11-24 15:34:54 +00:00
b9e5238a24
trunk: add milter module from Paul Howarth.
2008-11-24 15:06:58 +00:00
7f49194215
trunk: Xserver MLS fix from Eamon Walsh.
2008-11-17 13:49:19 +00:00
99282e6be0
trunk: add omapi port for dhcpcd.
2008-11-12 13:11:00 +00:00
296273a719
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
6e68e6bb5e
trunk: Move shared library calls from individual modules to the domain module.
2008-10-17 17:36:56 +00:00
0b36a2146e
trunk: Enable open permission checks policy capability.
2008-10-16 16:09:20 +00:00
aea3f28e40
trunk: Remove hierarchy from portage module as it is not a good example of hieararchy.
2008-10-15 19:56:33 +00:00
b19f862271
trunk: Remove enableaudit target from modular build as semodule -DB supplants it.
2008-10-15 14:30:14 +00:00
40db860272
trunk: version bits for the release.
2008-10-14 17:38:03 +00:00
967fd1ba3f
trunk: 8 patches from dan.
2008-10-08 20:03:24 +00:00
73edbc9101
trunk: add oident from dominick grift.
2008-10-06 14:01:59 +00:00
52ceaaac6e
trunk: Debian update for NetworkManager/wpa_supplicant from Martin Orr.
2008-09-11 14:02:53 +00:00
a71e136cc3
trunk: add cyphesis from dan.
2008-09-03 14:46:10 +00:00
e40fa634b2
trunk: Logrotate and Bind updates from Vaclav Ovsik.
2008-09-03 14:12:56 +00:00
6cc3f35635
trunk: first part of init script labeling support.
2008-08-29 19:00:02 +00:00
32f8ff393b
trunk: add w3c from dan.
2008-08-21 13:52:52 +00:00
9c4500b2f4
trunk: Glibc 2.7 fix from Vaclav Ovsik.
2008-08-12 19:33:18 +00:00
8a948caf2b
trunk: 11 more cherry picks from fedora policy, by david hardeman.
2008-08-07 14:17:50 +00:00
b81bfc2651
trunk: Samba/winbind update from Mike Edenfield.
2008-08-05 12:54:11 +00:00
3338f231d5
trunk: Policy size optimization with a non-security file attribute from James Carter.
2008-07-31 14:05:46 +00:00
dc1920b218
trunk: Database labeled networking update from KaiGai Kohei.
2008-07-25 04:07:09 +00:00
6224fc1485
trunk: 7 patches from Fedora policy, cherry picked by david hrdeman.
2008-07-24 23:56:03 +00:00
0bfccda4e8
trunk: massive whitespace cleanup from dominick grift.
2008-07-23 21:38:39 +00:00
2b592aa495
trunk: pam_mount fix for local login from Stefan Schulze Frielinghaus
2008-07-18 13:25:31 +00:00
4459a7c086
trunk: update init_telinit() for upstart's datagram socket usage instead of pipe useage.
2008-07-15 15:33:51 +00:00
e64c38c7a4
trunk: VERSION and Changelog update for release.
2008-07-02 15:39:31 +00:00
e311e23a44
trunk: Fix httpd_enable_homedirs to actually provide the access it is supposed to provide.
2008-07-01 13:57:53 +00:00
c5cfd2d405
trunk: Add unused interface/template parameter metadata in XML.
2008-06-24 14:23:40 +00:00
8c6292b7a4
trunk: Patch to handle postfix data_directory from Vaclav Ovsik.
2008-06-24 13:21:35 +00:00
131634a581
trunk: podsleuth and hal updates from dan.
2008-06-17 14:07:44 +00:00
eb4216397c
trunk: add qemu and virt from dan.
2008-06-16 18:59:07 +00:00
e8cb08aefa
trunk: add sepostgresql policy from kaigai kohei.
2008-06-10 15:33:18 +00:00
ef55a11980
trunk: Patch for X.org dbus support from Martin Orr.
2008-06-07 13:31:48 +00:00
cdbd09f65e
trunk: add prelude from dan.
2008-06-06 03:13:42 +00:00
308baad28c
trunk: Patch for labeled networking controls in 2.6.25 from Paul Moore.
2008-05-26 18:38:06 +00:00
782c10e949
trunk: add kerneloops from dan.
2008-05-26 17:47:49 +00:00
ff79b83c51
trunk: add kismet from dan.
2008-05-26 15:35:25 +00:00
4416c416fa
trunk: Module loading now requires setsched on kernel threads.
2008-05-22 18:39:03 +00:00
a42ce93a4d
trunk: Patch to allow gpg agent --write-env-file option from Vaclav Ovsik.
2008-05-12 20:05:32 +00:00
d923d54c08
trunk: X application data class from Eamon Walsh and Ted Toth.
2008-05-06 14:37:05 +00:00
e9c6cda7da
trunk: Move user roles into individual modules.
2008-04-29 13:58:34 +00:00
7e11b74087
trunk: make hald_log_t a log file.
2008-04-18 16:04:15 +00:00
2083db2e40
trunk: Cryptsetup runs shell scripts. Patch from Martin Orr.
2008-04-18 15:32:03 +00:00
c07f9ccd18
trunk: Add file for enabling policy capabilities.
2008-04-18 14:21:01 +00:00
75da4b8ad3
trunk: Patch to fix leaky interface/template call depth calculator from Vaclav Ovsik.
2008-04-18 12:57:01 +00:00
c565b44f9c
trunk: release
2008-04-02 18:44:07 +00:00
2c12b471ad
trunk: add core xselinux support.
2008-04-01 20:23:23 +00:00
Chris PeBenito
KaiGai Kohei
Chris PeBenito