2216 lines
101 KiB
Plaintext
2216 lines
101 KiB
Plaintext
This is the Changelog for the old refpolicy-contrib submodule. This
|
|
submodule was removed and its contents moved back to the main Reference
|
|
Policy repository on 2018-23-06.
|
|
|
|
|
|
* Sun Jan 14 2018 Chris PeBenito <pebenito@ieee.org> - 2.20180114
|
|
Chad Hanson (1):
|
|
Allow rpm to relabel files at all levels
|
|
|
|
Chris PeBenito (46):
|
|
Remove deprecated interfaces more than one year old.
|
|
Remove complement and wildcard in allow rules.
|
|
Merge branch 'master' of git://github.com/teg/refpolicy-contrib
|
|
dbus: Module version bump for dbus-broker patch from Tom Gundersen.
|
|
Module version bump for patches from Guido Trentalancia.
|
|
Module version bumps for patches from David Sugar.
|
|
dhcp, logrotate: Module version bump.
|
|
Module version bumps for chkrootkit, dkim, dmidecode, portage, and
|
|
rkhunter.
|
|
Module version bumps.
|
|
spamassassin: Move lines.
|
|
mandb, spamassassin: Module version bumps.
|
|
spamassassin: Fix build error.
|
|
spamassassin: Add missing requirement in spamassassin_admin().
|
|
dphysswapfile: Module version bump.
|
|
gpg, pulseaudio, rpc: Module version bump.
|
|
dnsmasq, gnome, mon, mta, openoffice, pulseaudio, wm: Version bumps.
|
|
Revert "postfix: Some table drivers (notably cdb) need to mmap() their
|
|
databases"
|
|
java, mozilla, mta, postfix: Module version bump.
|
|
portage: Fix usr_t map interface usage.
|
|
apache, portage: Module version bump.
|
|
dbus, policykit, wm: Module version bump.
|
|
dbus: Add comment.
|
|
Merge branch 'nm_audit' of git://github.com/bigon/refpolicy-contrib
|
|
networkmanager: Module version bump.
|
|
virt: Move a line.
|
|
alsa, mon, virt: Module version bump.
|
|
gpg, mozilla, rpc: Module version bump.
|
|
Several module version bumps.
|
|
blueman, evolution, gpg, mozilla, openoffice, thunderbird, wireshark, wm:
|
|
Module version bump.
|
|
wm: Module version bump.
|
|
networkmanager: Move line.
|
|
networkmanager: Module version bump.
|
|
Merge branch 'pkcs' of https://github.com/dodys/refpolicy-contrib
|
|
pkcs: Rename pkcs_slotd_unit_file_t.
|
|
pkcs: Module version bump.
|
|
accountsd, policykit: Module version bump.
|
|
dbus, devicekit, modemmanager, networkmanager, virt: Module version bump.
|
|
modemmanager: Move lines.
|
|
rpm: Module version bump.
|
|
cachefilesd, dbus, dirmngr, gnome, gpg, pulseaudio: Module version bump.
|
|
Replace deprecated mmap perm sets and pattern usage.
|
|
gssproxy: Module version bump.
|
|
monit: Module version bump.
|
|
apache, dkim, monit: Module version bump.
|
|
spamassassin: Module version bump.
|
|
Bump module versions for release.
|
|
|
|
Christian Göttsche (20):
|
|
dkim: align filecontexts
|
|
dkim: update
|
|
milter: align filecontexts
|
|
apache: align filecontexts
|
|
dmidecode: use userdom_use_inherited_user_terminals
|
|
spamassassin: align filecontexts
|
|
chkrootkit: update
|
|
rkhunter: add several missing permission
|
|
fakehwclock: update
|
|
milter: update
|
|
mandb: fixes for systemd timer and /usr/local/man label
|
|
spamassassin: update
|
|
dphysswapfile: fix swapfile creation
|
|
apache: update
|
|
monit: update
|
|
dkim: align file contexts
|
|
dkim: update
|
|
apache: update
|
|
monit: read /usr/share/ca-certificates for cert verification
|
|
spamassassin: fix missing perms
|
|
|
|
Daniel Jurgens (1):
|
|
networkmanager: Grant access to unlabeled PKeys
|
|
|
|
David Sugar (5):
|
|
mon: move rpc_* into optional
|
|
wm: consolidate networkmanger interface calls into single optional
|
|
cron: optional_policy for mta_* interfaces
|
|
Label /usr/bin/mutter
|
|
Allow to read /proc/sys/crypto/fips_enabled
|
|
|
|
Eduardo Barretto (2):
|
|
Update pkcs policy to include pkccsslotd.service
|
|
Update missing permissions for pkcs
|
|
|
|
Guido Trentalancia (13):
|
|
libmtp: read symlinks in user home directories
|
|
spamassassin: update rules for the Bayesian classifier trainer
|
|
wm: let gnome-shell start properly
|
|
gnome: keyring daemon dbus policy update
|
|
gnome: keyring daemon read SELinux config
|
|
openoffice: improve temporary directories' operations
|
|
pulseaudio: general update
|
|
wm: gnome-shell SELinux integration
|
|
mozilla: run Java Web Start applications
|
|
wm: run PolicyKit
|
|
dbus: read user home content files
|
|
mozilla: read generic SSL certificates
|
|
contrib: use the new SSL private keys type (was: "let the mozilla and
|
|
other domains read generic SSL certificates")
|
|
|
|
Jason Zaman (12):
|
|
cgmanager: Apply auth_use_nsswitch interface
|
|
alsa: needs to map its tmpfs files
|
|
virt: add policy for virtlogd
|
|
virt: updated perms for starting guests
|
|
gssproxy: add policy
|
|
rpc: Allow stream connect to gssproxy
|
|
gpg: search dir when connecting to agent socket
|
|
dirmngr: allow filetrans in gpg_runtime_t
|
|
gpg: Add gpg_agent_use_card boolean for OpenPGP cards
|
|
cachefilesd: make cachefilesd_cache_t a mountpoint
|
|
Set user_runtime_content_type for all remaining types in /run/user/%{UID}/
|
|
gssproxy: allow writing kerberos rcache
|
|
|
|
Jason Zaman via refpolicy (3):
|
|
pulseaudio: Add neccessary map permissions
|
|
gpg: add fcontexts for user runtime sockets
|
|
rpc: add sm-notify pid fcontext
|
|
|
|
Laurent Bigonville (2):
|
|
Allow NetworkManager to write to audit
|
|
Call systemd_write_inherited_logind_inhibit_pipes() where needed
|
|
|
|
Luis Ressel (12):
|
|
portage: Allow portage_t and portage_sandbox_t to access locale_t
|
|
postfix: Some table drivers (notably cdb) need to mmap() their databases
|
|
portage: Grant the map permissions neccessary for git and install
|
|
alsa: alsactl needs to map its configuration
|
|
mozilla: Add neccessary map permissions
|
|
mandb: man-db needs to map its 'index.db' cache
|
|
portage: Remove nonsensical dontaudit of an allowed permission
|
|
portage: Transition to ldconfig_t when calling ldconfig
|
|
postfix: Some table drivers (notably cdb) need to mmap() their databases
|
|
postfix: Silence cap_dac_read_search denials
|
|
portage: Grant portage the map permission on usr_t
|
|
Allow gtk apps to map usr_t files
|
|
|
|
Nicolas Iooss (2):
|
|
dbus: move comments out of the file context definitions
|
|
logrotate: allow systemd to start logrotate
|
|
|
|
Russell Coker (3):
|
|
udev and dhcpd
|
|
minor nspawn, dnsmasq, and mon patches
|
|
refpolicy and certs
|
|
|
|
Tom Gundersen (1):
|
|
dbus: add policy for dbus-broker
|
|
|
|
* Sat Aug 05 2017 Chris PeBenito <pebenito@ieee.org> - 2.20170805
|
|
Chris PeBenito (82):
|
|
Create / to /usr equivalence for bin, sbin, and lib, from Russell Coker.
|
|
Module version bump for usrmerge FC fixes from Jason Zaman.
|
|
mon policy from Russell Coker.
|
|
Module version bump for cups patches from Guido Trentalancia.
|
|
Module version bump for tbird and mozilla printing from Guido
|
|
Trentalancia.
|
|
Revert "cups/lpd: read permission for cupsd_var_run_t socket files"
|
|
Module version bump for cups revert.
|
|
Sort capabilities permissions from Russell Coker.
|
|
Little misc patch from Russell Coker.
|
|
mon: Fix deprecated interface usage.
|
|
dpkg: Updates from Russell Coker.
|
|
Monit policy from Russell Coker and cgzones.
|
|
monit: Fix build error.
|
|
fetchmail, mysql, tor: Misc fixes from Russell Coker.
|
|
Merge branch 'alsa_module' of git://github.com/cgzones/refpolicy-contrib
|
|
Merge branch 'vnstat_module' of git://github.com/cgzones/refpolicy-contrib
|
|
Module version bump for alsa and vnstatd fixes from cgzones.
|
|
Merge branch 'ntp_module' of git://github.com/cgzones/refpolicy-contrib
|
|
Module version bump for ntp fixes from cgzones.
|
|
samba: A few line moves.
|
|
Module version bump for samba patch from Russell Coker.
|
|
Systemd fixes from Russell Coker.
|
|
Xen fixes from Russell Coker.
|
|
mailman: Fixes from Russell Coker.
|
|
MTA fixes from Russell Coker.
|
|
Network daemon patches from Russell Coker.
|
|
apache: Fix CI error.
|
|
Merge branch 'modutils_adapt_interfaces' of
|
|
git://github.com/cgzones/refpolicy-contrib
|
|
Merge branch 'corecmd_read_bin_symlinks' of
|
|
git://github.com/cgzones/refpolicy-contrib
|
|
Module version bumps for fixes from cgzones.
|
|
Merge branch 'mandb' of git://github.com/cgzones/refpolicy-contrib
|
|
Merge branch 'dphysswapfile' of git://github.com/cgzones/refpolicy-contrib
|
|
Module version bump for dphysswapfile and mandb fixes from cgzones.
|
|
Merge branch 'var_run_filecontext' of
|
|
git://github.com/cgzones/refpolicy-contrib
|
|
Merge branch 'vnstatd' of git://github.com/cgzones/refpolicy-contrib
|
|
Module version bump for fixes from cgzones.
|
|
dontaudit net_admin for SO_SNDBUFFORCE
|
|
/var/run -> /run again
|
|
Merge branch 'monit' of git://github.com/cgzones/refpolicy-contrib
|
|
Module version bump for monit patch from cgzones.
|
|
systemd-resolvd, sessions, and tmpfiles take2
|
|
Misc fc changes from Russell Coker.
|
|
Systemd-related changes from Russell Coker.
|
|
networkmanager: adjust interface docs format.
|
|
wm: interface docs adjustment.
|
|
Module version bump for misc fixes from Guido Trentalancia.
|
|
systemd init from Russell Coker
|
|
misc daemons from Russell Coker.
|
|
logging patches from Russell Coker
|
|
kmod, lvm, brctl patches from Russell Coker
|
|
devicekit, mount, xserver, and selinuxutil from Russell Coker
|
|
some userdomain patches from Russell Coker
|
|
Module version bump for gnome fix from Guido Trentalancia.
|
|
apache: Move blocks. No rule changes.
|
|
Module version bump for changes from Sven Vermeulen and Guido
|
|
Trentalancia.
|
|
login take 4 from Russell Coker.
|
|
Rename apm to acpi from Russell Coker.
|
|
Module version bump for patches from Russell Coker.
|
|
some little misc things from Russell Coker.
|
|
apt/dpkg strict patches from Russell Coker.
|
|
Module version bump for minor fixes from Guido Trentalancia.
|
|
Merge branch 'usr_bin_fc' of
|
|
git://github.com/fishilico/selinux-refpolicy-contrib
|
|
Module version bump for /usr/bin fc fixes from Nicolas Iooss.
|
|
Module version bump for chronyd changes from Luis Ressel.
|
|
openoffice: Move ooffice_rw_tmp_files() implementation.
|
|
Module version bump for openoffice fix from Guido Trentalancia.
|
|
libmtp: move lines
|
|
Module version bump for fixes from Guido Trentalancia.
|
|
Module version bump for mmap fixes from Stephen Smalley.
|
|
Module version bump for misc patches from Guido Trentalancia.
|
|
gpg: Fix overspecified dependencies in gpg_agent_tmp_filetrans.
|
|
dirmngr: Whitespace fixes.
|
|
Module version bumps for patches from Jason Zaman.
|
|
cgmanager: Move lines
|
|
Module version bumps for patches from Jason Zaman.
|
|
gpg: Module version bump for patch from Guido Trentalancia.
|
|
mozilla: Module version bump for patch from Luis Ressel.
|
|
rkhunter: Fix module version and move lines.
|
|
Module version bump for patches from cgzones.
|
|
chkrootkit: Fix module version.
|
|
Module version bump for patches from cgzones.
|
|
Bump module versions for release.
|
|
|
|
Guido Trentalancia (28):
|
|
cups: read permission for cupsd_var_run_t socket files in
|
|
cups_stream_connect()
|
|
cups/lpd: read permission for cupsd_var_run_t socket files
|
|
thunderbird: allow stream connections to cups so that it can print
|
|
mozilla: allow stream connections to cups so that it can print
|
|
java: enable interactive use
|
|
evolution: add dbus acquire service permission
|
|
evolution: do not audit kernel read state
|
|
evolution: add some critical permissions
|
|
mozilla: read hardware state information
|
|
mozilla: add a permission
|
|
wm: load the NetworkManager applet
|
|
wm: interactive start
|
|
Gnome and Evolution dbus chat permissions
|
|
openoffice: support starting it from the window manager
|
|
evolution: minor fixes and updates
|
|
java: error messages terminal printout
|
|
loadkeys: use init fds (system bootup)
|
|
plymouth: pid interface usability
|
|
shutdown: send msg to syslog
|
|
openoffice: open files retrieved using mozilla
|
|
contrib: new libmtp module
|
|
openoffice: minor update
|
|
gnome: improved integration with openoffice
|
|
cups: let hplip read udev pid files
|
|
dbus: let session bus daemon manage user runtime dirs
|
|
zabbix: Grant zabbix_agent_t to call setrlimit on self
|
|
ntp: fix the drift file context and transition
|
|
gpg: manage user runtime socket files and directories
|
|
|
|
Jason Zaman (12):
|
|
usrmerge: Add missed /usr fcontexts
|
|
java: update fcontexts for new versions of icedtea
|
|
dirmngr: add to roles and allow gpg to domtrans
|
|
gpg dirmngr: create and connect to socket
|
|
dirmngr: fcontext for ~/.gnupg/crls.d/
|
|
dirmngr: Network rules to connect to keyserver
|
|
cgmanager: add policy from gentoo
|
|
consolekit: Add support for consolekit2
|
|
consolekit: allow purging tmp
|
|
consolekit: introduce consolekit_use_inhibit_lock interface
|
|
dbus: use consolekit inhibit locks
|
|
networkmanager: use consolekit inhibit locks
|
|
|
|
Luis Ressel (3):
|
|
chronyd: Re-align fc file
|
|
chronyd: Allow init scripts to create /run/chrony
|
|
mozilla: Add fc for the files used by the firefox addon "vimperator"
|
|
|
|
Nicolas Iooss (1):
|
|
Support systems with a single /usr/bin directory
|
|
|
|
Russell Coker (1):
|
|
patch for samba
|
|
|
|
Stephen Smalley (1):
|
|
contrib: allow map permission where needed
|
|
|
|
Sven Vermeulen (1):
|
|
rpc_* interfaces should be wrapped by optional_policy()
|
|
|
|
cgzones (16):
|
|
update ntp module
|
|
update alsa module
|
|
vnstatd: update module
|
|
corecmd_read_bin_symlinks(): remove deprecated and redundant calls
|
|
modutils: adopt calls to new interfaces
|
|
vnstatd: update
|
|
dphysswapfile: update
|
|
monit: update
|
|
mandb: update
|
|
logrotate: reload monit after log rotation
|
|
remove /var/run file context lefovers, add dbus exception
|
|
monit: add syslog access and support for monit systemd service
|
|
rkhunter: add policy module
|
|
arpwatch: align file contexts
|
|
chkrootkit: add policy module
|
|
arpwatch: update
|
|
|
|
* Sat Feb 04 2017 Chris PeBenito <pebenito@ieee.org> - 2.20170204
|
|
Chris PeBenito (41):
|
|
Module version bump for patches from Jason Zaman.
|
|
authbind: Remove dead policy.
|
|
Module version bump for cups patch from Guido Trentalancia.
|
|
Merge pull request #29 from cgzones/deprecated_macros
|
|
Module version bump for Debian fprintd fc entry from Laurent Bigonville.
|
|
Module version bumps for openoffice patches from Guido Trentalancia.
|
|
Module version bumps for patches from Guido Trentalancia.
|
|
Merge pull request #30 from cgzones/trailing_whitespaces
|
|
Module version bumps for mozilla and gpg patches from Luis Ressel.
|
|
Module version bump for patches from Guido Trentalancia.
|
|
Module version bump for patches from Guido Trentalancia.
|
|
rtkit, wm: Remove calls to nonexistant interfaces.
|
|
Module version bumps for patches from Guido Trentalancia.
|
|
rtkit: enable dbus chat with xdm
|
|
Module version bump for patches from Guido Trentalancia.
|
|
Module version bump for xscreensaver patch from Guido Trentalancia.
|
|
Merge branch 'run_transition' of
|
|
git://github.com/cgzones/refpolicy-contrib
|
|
Module version bumps for /run fc changes from cgzones.
|
|
Module version bump for openoffice and wm patches from Guido Trentalancia.
|
|
Module version bump for patches from Guido Trentalancia.
|
|
Module version bump for wm patch from Guido Trentalancia.
|
|
Merge branch 'usr-fc' of
|
|
git://github.com/fishilico/selinux-refpolicy-contrib
|
|
Module version bump for fc updates from Nicolas Iooss.
|
|
Module version bump for patches from Guido Trentalancia.
|
|
Module version bump for capability2 fixes from Guido Trentalancia.
|
|
Module version bump for plymouth fix from Guido Trentalancia.
|
|
boinc: Update from Russell Coker.
|
|
Module version bump for mozilla update from Guido Trentalancia.
|
|
Merge pull request #47 from cgzones/dphysswap_module
|
|
Merge pull request #40 from cgzones/fakehwclock_module
|
|
Merge branch 'gpg_module' of git://github.com/cgzones/refpolicy-contrib
|
|
Merge branch 'irqbalance_module' of
|
|
git://github.com/cgzones/refpolicy-contrib
|
|
Merge branch 'loadkeys_module' of
|
|
git://github.com/cgzones/refpolicy-contrib
|
|
Module version bumps for patches from cgzones.
|
|
Merge branch 'exim_module' of git://github.com/cgzones/refpolicy-contrib
|
|
Merge branch 'screen_module' of git://github.com/cgzones/refpolicy-contrib
|
|
Module version bump for screen and exim changes from cgzones.
|
|
screen: Revert broken interface call.
|
|
cups: Move hplip_domtrans interface.
|
|
Module version bump for cups patch from Guido Trentalancia.
|
|
Bump module versions for release.
|
|
|
|
Dominick Grift (1):
|
|
Re-add raid fc spec that must have been removed earlier by mistake
|
|
|
|
Guido Trentalancia (29):
|
|
cups: descend "rw" directories when reading configuration files
|
|
Apache OpenOffice module (contrib policy part)
|
|
openoffice: rename two interfaces in openoffice and evolution
|
|
mozilla: extend dbus connection permissions
|
|
openoffice: permission to read user temporary files
|
|
xguest: restrict ability to execute files on noxattr filesystems
|
|
pulseaudio: update server and client permissions
|
|
mozilla: remove redundant pulseaudio interface calls
|
|
networkmanager: read user certs not user content (was enable
|
|
userdom_read_user_certs() throughout the policy)
|
|
Make several calls to mta interfaces optional
|
|
wm: update the window manager (wm) module and enable its role template
|
|
(v7)
|
|
rtkit: enable dbus chat with xdm
|
|
networkmanager: enable dbus chat with xdm
|
|
policykit: enable dbus chat with xdm
|
|
games: general update and improved pulseaudio integration
|
|
wm: improved integration with games
|
|
xscreensaver: update the module so that it can be effectively used
|
|
wm: properly set domain entrypoint in wm_application_domain()
|
|
openoffice: add writer support for sending email directly to multiple
|
|
recipients
|
|
contrib: use new genhomedircon template for username
|
|
contrib: extend wm ability to launch confined graphical applications
|
|
contrib: support the new interface to manage X session logs
|
|
networkmanager: dbus chat with cups
|
|
cups: add cups-browsed executable fc
|
|
devicekit: add new wake_alarm permission (capability2)
|
|
networkmanager: add new wake_alarm permission (capability2)
|
|
plymouth: use the correct running domain for the client
|
|
mozilla: execute evolution to send emails
|
|
cups: new interface to execute HPLIP applications in their own domain
|
|
|
|
Jason Zaman (4):
|
|
pcscd: dbus and domain lookup
|
|
devicekit: fcontext for udisks2
|
|
gnome: add gkeyring rules and fcontext
|
|
gpg: add new socket paths
|
|
|
|
Laurent Bigonville (1):
|
|
Add debian path for fprintd daemon
|
|
|
|
Luis Ressel (3):
|
|
gpg: Add filetrans for scdaemon socket and gpg-agent extra sockets
|
|
gpg.fc: Adjust whitespace
|
|
mozilla: Add miscfiles_dontaudit_setattr_fonts_cache_dirs()
|
|
|
|
Nicolas Iooss (1):
|
|
Add file contexts for files in /usr/{lib,sbin}
|
|
|
|
cgzones (10):
|
|
use domain_auto_transition_pattern instead of domain_auto_trans
|
|
remove trailing whitespaces
|
|
transition file contexts to /run
|
|
update loadkeys module
|
|
add fakehwclock module
|
|
add dphysswapfile module
|
|
update gpg module
|
|
update screen module
|
|
update irqbalance module
|
|
update exim module
|
|
|
|
* Sun Oct 23 2016 Chris PeBenito <pebenito@ieee.org> - 2.20161023
|
|
Adam Tkac (2):
|
|
varnishncsa (varnishlog_t) reads localization files
|
|
Grant certmonger "chown" capability
|
|
|
|
Chris PeBenito (42):
|
|
Merge branch 'bigon-geoclue'
|
|
Add additional comments in geoclue.
|
|
Merge branch 'bigon-virt-1'
|
|
Merge branch 'nm-1' of git://github.com/bigon/refpolicy-contrib into
|
|
bigon-nm-1
|
|
Merge branch 'bigon-nm-1'
|
|
Module version bump for virt and networkmanager patches from Laurent
|
|
Bigonville.
|
|
Merge branch 'master' of git://github.com/bigon/refpolicy-contrib
|
|
Module version bump for firewalld updates from Laurent Bigonville.
|
|
Module version bump for collectd update from Jason Zaman.
|
|
Module version bumps for user runtime fixes from Jason Zaman.
|
|
Boinc updates from Russell Coker.
|
|
rpcbind: Read /sys/devices/system/cpu/online from Russell Coker.
|
|
watchdog: Move line.
|
|
Module version bump for watchdog pidfile option from Russell Coker.
|
|
Systemd units from Russell Coker.
|
|
Module version bump for pulseaudio fc fix from Jason Zaman.
|
|
cpucontrol: revise cpucontrol_conf_t labeling, from Guido Trentalancia.
|
|
Module version bumps for patches from Guido Trentalancia.
|
|
Update the telepathy module:
|
|
Update the alsa module so that the alsa_etc_t file context (previously
|
|
alsa_etc_rw_t) is widened to the whole alsa share directory, instead of
|
|
just a couple of files.
|
|
alsa: Add compatibility alias for alsa_etc_rw_t.
|
|
Update the sysnetwork module to add some permissions needed by the dhcp
|
|
client (another separate patch makes changes to the ifconfig part).
|
|
Module version bump for various patches from Guido Trentalancia.
|
|
pulseaudio: Fix compile errors.
|
|
Merge branch 'master' of
|
|
https://github.com/SeanPlacchetti/refpolicy-contrib
|
|
Module version bump for webalizer dead type removal from Sean Placchetti.
|
|
Module version bump for Evolution SSL fix from Guido Trentalancia.
|
|
evolution: Read user certs from Guido Trentalancia.
|
|
cups: Move can_exec() line.
|
|
cups: Module version bump for hplip patch from Guido Trentalancia
|
|
pulseaudio: Move interface definitions.
|
|
Module version bump for mozilla patch from Guido Trentalancia.
|
|
Module version bump for gnome patch from Guido Trentalancia.
|
|
Module version bump for evolution patch from Guido Trentalancia.
|
|
gpg: Whitespace fix.
|
|
Merge branch 'feature/fix-networkmanager-varrun-macro' of
|
|
https://github.com/rfkrocktk/refpolicy-contrib
|
|
Module version bump for networkmanager fix from Naftuli Tzvi Kay.
|
|
Merge branch 'rfkrocktk-feature/syncthing'
|
|
Rearrange lines in syncthing.
|
|
webalizer: Rearrange a couple lines.
|
|
Module version bump for webalizer patch from Russell Coker.
|
|
Bump module versions for release.
|
|
|
|
Dominick Grift (18):
|
|
Module version bump for changes to the geoclue module by Laurent
|
|
Bigonville.
|
|
Module version bump for changes to various modules from Laurent
|
|
Bigonville.
|
|
geoclue: move kernel interface call to the appropriate position
|
|
Actually associate mailmain_domain attribute with mailman domains
|
|
Module version bumps for changes to various modules by Nicolas Iooss
|
|
Module version bump for changes to the cron module by Jason Zaman
|
|
Module version bump for changes to the redis module by Grant Ridder
|
|
Module version bump for changes to the raid module by Laurent Bigonville
|
|
Module version bump for changes to the networkmanager module by Laurent
|
|
Bigonville.
|
|
Module version bump for changes to the redis module by Grant Ridder.
|
|
Module version bump for changes to the mozilla module by Laurent
|
|
Bigonville.
|
|
Module version bump for changes to the geoclue module by Nicolas Iooss.
|
|
Add hwloc-dump-hwdata SELinux policy
|
|
Module version bump for changes to the varnishd module by Robert Moucha
|
|
Module version bump for changes to the puppet module by Thomas Mueller
|
|
Module version bump for changes to the varnishd module by Adam Tkac
|
|
Module version bump for changes to the certmonger module by Adam Tkac
|
|
Revert "dbus: allow system, and session bus clients to answer to dbus
|
|
unconfined domains"
|
|
|
|
Grant Ridder (2):
|
|
Add read/write perms for redis-sentinel
|
|
Allow tcp_connect to redis_port_t for redis_t
|
|
|
|
Guido Trentalancia (7):
|
|
Policykit module: add fs_getattr_xattr_fs()
|
|
Update the policy for module apm
|
|
Let gpg disable core dumps
|
|
Update the rtkit module
|
|
Update the pulseaudio module for usability and ORC support
|
|
cups: update permissions for HP printers (load firmware)
|
|
gpg: public key signature verification in evolution
|
|
|
|
Guido Trentalancia via refpolicy (3):
|
|
evolution: read SSL certificates
|
|
mozilla: let mozilla play audio
|
|
gnome: add support for the OIL Runtime Compiler (ORC) optimized code
|
|
execution
|
|
|
|
Jason Zaman (10):
|
|
cron: Allow locks to be lnk_files
|
|
collectd: update policy for 5.5
|
|
consolekit: allow managing user runtime
|
|
pulseaudio: fcontext and filetrans for runtime
|
|
ftp: Add filetrans from user_runtime
|
|
gnome: Add filetrans from user_runtime
|
|
mplayer: Add filetrans from user_runtime
|
|
userhelper: Add filetrans from user_runtime
|
|
wm: Add filetrans from user_runtime
|
|
pulseaudio: fix user runtime fcontext
|
|
|
|
Laurent Bigonville (13):
|
|
Add initial geoclue 2 module
|
|
Properly escape dot in the path to the geoclue daemon
|
|
Use auth_use_nsswitch() as we need DNS resolving and access nsswitch.conf
|
|
virt.fc: Add some debian contexts
|
|
networkmanager.fc: nm-dispatcher.action has been renamed to nm-dispatcher
|
|
Allow some domain to read sysctl_vm_overcommit_t
|
|
Allow mdadm read efivarfs files
|
|
Allow /var/run/firewalld/ directory to transition to firewalld_var_run_t
|
|
Add an interface to allow a domain to read firewalld_var_run_t files
|
|
Allow firewalld to create firewalld_var_run_t directory.
|
|
dontaudit firewalld attempt to relabel its own config files
|
|
Allow NM to execute arping
|
|
Debian now ships firefox-esr, properly label the executable
|
|
|
|
Luis Ressel (1):
|
|
New policy for tboot utilities
|
|
|
|
Naftuli Tzvi Kay (2):
|
|
Fix NetworkManager Read Pid Files Macro
|
|
Syncthing Policy
|
|
|
|
Nicolas Iooss (3):
|
|
Describe _initrc_domtrans interfaces differently from the _domtrans ones
|
|
Fix typos in several interfaces
|
|
Add Arch Linux path for geoclue module
|
|
|
|
Robert Moucha (1):
|
|
Fix trivial typo in varnishncsa name
|
|
|
|
Russell Coker (2):
|
|
watchdog reads pid files
|
|
named reads vm sysctls
|
|
|
|
Russell Coker via refpolicy (1):
|
|
webalizer patch for inclusion
|
|
|
|
Sean Placchetti (1):
|
|
-Remove unused declarations from webalizer type enforcement file
|
|
|
|
Thomas Mueller (1):
|
|
Allow puppet_t transtition to shorewall_t
|
|
|
|
doverride (3):
|
|
Merge pull request #8 from bigon/geoclue
|
|
Merge pull request #11 from bigon/overcommit-1
|
|
Merge pull request #12 from fishilico/typos
|
|
|
|
* Tue Dec 08 2015 Chris PeBenito <selinux@tresys.com> - 2.20151208
|
|
Alexander Wetzel (1):
|
|
add vfio support for libvirt
|
|
|
|
Chas Williams - CONTRACTOR (1):
|
|
afs: update labels, file contexts and allow access to urandom
|
|
|
|
Chris PeBenito (14):
|
|
Module version bump for hadoop_admin() fix from Jazon Zaman.
|
|
Module version bump for fc typo in radius from Sven Vermeulen.
|
|
Module version bump for patches from Jason Zaman.
|
|
Module version bump for init_startstop_service from Jason Zaman.
|
|
Module version bump for cron_admin interface from Jason Zaman.
|
|
Comment/whitespace fix in virt.te.
|
|
Module version bump for vfio support for libvirt from Alexander Wetzel.
|
|
Add systemd unit types.
|
|
Add systemd socket activations.
|
|
Merge branch 'pebenito-master'
|
|
Module version bump for systemd additions.
|
|
Merge branch 'bigon-systemd'
|
|
Module version bump for dbus systemd patch from Laurent Bigonville.
|
|
Bump module versions for release.
|
|
|
|
Dominick Grift (16):
|
|
Module version bump for courier fixes from Sven Vermeulen.
|
|
Module version bump for afs fixes from Chas Williams.
|
|
Redundant rules and afs_files_t is not a filesystem type
|
|
Various samhain fixes
|
|
Cachefilesd module updates
|
|
Module version bump for changes to the dnsmasq policy module by Jason
|
|
Zaman
|
|
Module version bump for changes to the snmp policy module by Jason Zaman
|
|
Module version bump for changes to the pulseaudio policy module by Jason
|
|
Zaman
|
|
cachefiles: It is cachefilesd_cache_t
|
|
Module version bump for update to the networkmanager policy module by
|
|
Stephen Smalley.
|
|
Module version bumps for "Remove run interface calls from admin
|
|
interfaces" changes by Jason Zaman.
|
|
Module version bump for changes to the pulseaudio module by Niklas Haas.
|
|
Changes to the git, hadoop and rsync modules by Jason Zaman.
|
|
Module version bump for changes to the virt module by Jason Zaman
|
|
Module version bump for changes to the mozilla module from Laurent
|
|
Bigonville.
|
|
Module version bump for changes to the wine module by Nicolas Iooss
|
|
|
|
Jason Zaman (19):
|
|
hadoop: remove _role from _admin interface
|
|
rpcbind: typo fix
|
|
git: make inetd interface optional
|
|
rpc: introduce allow_gssd_write_tmp boolean
|
|
rpc: allow setgid capability
|
|
virt: add virt_tmpfs_t type and permissions
|
|
introduce virt_leaseshelper_t
|
|
dnsmasq: allow exec shell for scripts
|
|
snmp: missing fcontext for snmpd
|
|
pulseaudio: filetrans for autospawn.lock
|
|
Use init_startstop_service in admin interfaces A-M
|
|
Use init_startstop_service in admin interfaces N-Z
|
|
Remove _run() interfaces from _admin()
|
|
Introduce cron_admin interface
|
|
rsync: remove rsync_run from admin interface
|
|
git: allow git_system_t to listen on tcp_sockets
|
|
hadoop: init_startstop_service() can not take attributes
|
|
virt: Allow creating qemu guest agent socket
|
|
virt: Add policy for virtlockd the Virtual machine lock manager
|
|
|
|
Laurent Bigonville (2):
|
|
Transition D-Bus system service out of the init_t domain when PID1 is
|
|
systemd
|
|
Label iceweasel plugin-container executable as mozilla_plugin_exec_t
|
|
|
|
Nicolas Iooss (1):
|
|
wine: remove use of nonexisting interface
|
|
|
|
Niklas Haas (1):
|
|
pulse: don't give pulseaudio_client full access to user_home_t
|
|
|
|
Stephen Smalley (1):
|
|
contrib: networkmanager: allow netlink_generic_socket access
|
|
|
|
Sven Vermeulen (6):
|
|
Locate authdaemon socket and communicate with authdaemon
|
|
Allow authdaemon to access selinux fs to check SELinux state
|
|
Grant setuid/setgid to courier_pop_t
|
|
Execute courier helper script after authentication
|
|
Courier IMAP needs to manage the users' maildir
|
|
Fix typo for radiusd /var/lib location
|
|
|
|
doverride (2):
|
|
Merge pull request #3 from haasn/pulse-nohome
|
|
Merge pull request #6 from bigon/mozilla-1
|
|
|
|
* Wed Dec 03 2014 Chris PeBenito <selinux@tresys.com> - 2.20141203
|
|
Chris PeBenito (26):
|
|
Whitespace fix in ntp.fc.
|
|
Module version bump for ntp fc entries from Laurent Bigonville.
|
|
Whitespace fix in shibboleth.te.
|
|
Module version bump for new shibboleth module from Martin Lang.
|
|
Module version bump for apt fix from Nicolas Iooss.
|
|
Module version bump for dnsmasq MTU fix from Sven Vermeulen.
|
|
Module version bump for apache content interfaces from Sven Vermeulen.
|
|
Module version bump for gitweb fc entry on Debian and ArchLinux from
|
|
Nicolas Iooss.
|
|
Module version bump for fc regex fixes from Nicolas Iooss.
|
|
Module version bump for various fixes from Laurent Bigonville.
|
|
Module version bump for ModemManager fc entry from Laurent Bigonville.
|
|
Add missing cron_admin_role() dependency.
|
|
Move sock_file filetrans to fcron_crond conditional.
|
|
Module version bump for cron and snort updates from Sven Vermeulen.
|
|
Module version bump for java icedtea fc entries from Sven Vermeulen.
|
|
Module version bump for apache/mlogc patch from Elia Pinto.
|
|
Remove name from ntp-kod ntp_drift_t filetrans.
|
|
Module version bump for ntp-kod file support from Jason Zaman.
|
|
Module version bump for init_daemon_pid_file use from Sven Vermeulen.
|
|
Module version bump for alsa and hiawatha fixes from Sven Vermeulen.
|
|
Module version bump for ftp and tftp fixes from Nicolas Iooss.
|
|
Move irc exec lines.
|
|
Module version bump for irc re-exec itself patch from Luis Ressel.
|
|
Module version bump for NetworkManager fc fix for ArchLinux from Nicolas
|
|
Iooss.
|
|
Module version bump for _admin fixes from Jason Zaman.
|
|
Bump module versions for release.
|
|
|
|
Dominick Grift (3):
|
|
Module version bump for changes to the loadkeys module by Nicolas Iooss
|
|
cron: that boolean identifier does not exist also require it
|
|
Module version bump for changes to the networkmanager modules by Lubomir
|
|
Rintel
|
|
|
|
Elia Pinto (1):
|
|
apache.te: Add labelling support for /var/log/mlogc
|
|
|
|
Jason Zaman (20):
|
|
Add filetrans for ntp-kod file
|
|
ccs: syntax errors in ccs_admin interface
|
|
condor: syntax error in condor_admin
|
|
distcc: syntax error in distcc_admin
|
|
ftp: syntax error in ftp_admin
|
|
kerberos: syntax error in kerberos_admin
|
|
kismet: syntax error in kismet_admin
|
|
nut: syntax error in nut_admin
|
|
prelude: syntax error in prelude_admin
|
|
psad: syntax error in psad_admin
|
|
quota: syntax error in quota_admin
|
|
rpcbind: syntax error in rpcbind_admin
|
|
rpm: syntax error in rpm_admin
|
|
systemtap: syntax error in stapserver_admin
|
|
svnserve: syntax error in svnserve_admin
|
|
uptime: syntax error in uptime_admin
|
|
zabbix: syntax error in zabbix_admin
|
|
remove pyzor_role() from pyzor_admin()
|
|
remove spamassassin_role() from spamassassin_admin()
|
|
rsync: syntax error in rsync_admin
|
|
|
|
Laurent Bigonville (7):
|
|
Add several fcontext for debian specific paths for ntp
|
|
Fix dbus_all_session_domain(), session_bus_type is an attribute
|
|
Allow gconfd to be started by the session bus
|
|
Fix the usage of dbus_spec_session_domain() interface
|
|
Properly label exim4 initscript under Debian
|
|
Add new gnome_spec_domtrans_all_gkeyringd() interface
|
|
Label /usr/sbin/ModemManager as modemmanager_exec_t
|
|
|
|
Lubomir Rintel (1):
|
|
Allow NetworkManager to create Bluetooth SDP sockets
|
|
|
|
Luis Ressel (1):
|
|
irc.te: Allow irssi to re-execute itself
|
|
|
|
Martin Lang (1):
|
|
Add a policy module for shibboleth authentication
|
|
|
|
Nicolas Iooss (7):
|
|
apt: remove non-existing permission set write_dir_perms
|
|
Label /usr/share/gitweb/static as httpd_git_content_t
|
|
Fix strange file patterns
|
|
ftp: fix labels in /var/lock/subsys/
|
|
Label /usr/bin/tftpd as tftpd_exec_t
|
|
Label /usr/lib/networkmanager/ like /usr/lib/NetworkManager/
|
|
Allow loadkeys to read usr_t files
|
|
|
|
Sven Vermeulen (17):
|
|
dnsmasq reads MTU sysctl
|
|
Support read/append/manage functions for various httpd content
|
|
Snort policy updates
|
|
fcron socket support
|
|
Fix typo in dnsmasq.if
|
|
Mark icedtea binaries as java_exec_t
|
|
Use init_daemon_pid_file for contrib modules
|
|
Enable asound.state.lock support
|
|
Add support for Hiawatha web server
|
|
Use logging_search_logs, not logging_search_log
|
|
Use logging_search_logs, not logging_search_log
|
|
Use files_search_etc, not logging_search_etc
|
|
Use files_search_etc, not logging_search_etc
|
|
Use files_search_etc, not files_search_config
|
|
Use corecmd_search_bin, not corecmd_searh_bin
|
|
Use fs_search_tmpfs, not files_search_tmpfs
|
|
Use domain_auto_trans, not auto_trans
|
|
|
|
* Tue Mar 11 2014 Chris PeBenito <selinux@tresys.com> - 2.20140311
|
|
Chris PeBenito (17):
|
|
Minor rearrangement of minidlna lines.
|
|
Module version bump for openvpn tmp files from Sven Vermeulen.
|
|
Update modules for file_t merge into unlabeled_t.
|
|
Module version bump for postfix showq fc from Laurent Bigonville.
|
|
Rename gpg_agent_connect to gpg_stream_connect_agent.
|
|
Module version bump for gpg agent interface from Luis Ressel.
|
|
Whitespace fixes in git.fc.
|
|
Module version bump for debian git fc entries from Laurent Bigonville.
|
|
Move bin_t fc to corecommands.
|
|
Move exec/transition lines in couchdb.
|
|
Add comment about couchdb_js policy.
|
|
Module version bump for couchdb updates from Luis Ressel.
|
|
Module version bump for pcscd fix from Luis Ressel.
|
|
Move screen dontaudit rule.
|
|
Module version bump for screen fix from Luis Ressel.
|
|
Module version bump for git fc fix from Nicolas Iooss.
|
|
Bump module versions for release.
|
|
|
|
Dan Walsh (28):
|
|
Allow irc_t to use tcp sockets
|
|
Add labels for apache logs under miq package
|
|
Allow smbcontrol to create content in /var/lib/samba
|
|
Allow ktalkd to bind to the ktalkd_port
|
|
Allow memcache to read sysfs data
|
|
Allow mdadm to getattr any file system
|
|
Allow cupsd_lpd_t to bind to the printer port
|
|
Allow rlogind to bind to the rlogin_port
|
|
Allow cvs to bind to the cvs_port
|
|
svirt domains neeed to create kobject_uevint_sockets
|
|
Lots of new access required for sosreport
|
|
Allow tgtd_t to connect to isns ports
|
|
openct needs to be able to create netlink_object_uevent_sockets
|
|
Allow glusterd to create sock_file in /run
|
|
Add support for tmp directories to openvswitch
|
|
Allow virt_domain with USB devices to look at dos file systems
|
|
Additional access for MLS
|
|
Additional access for MLS window manager
|
|
Additional access for MLS window manager
|
|
Additional access for MLS window manager
|
|
Allow rpcbind to use nsswitch
|
|
Allow gpg_agent to use ssh-add
|
|
Add apache labeling for glpi
|
|
Allow pegasus to transition to dmidecode
|
|
Allow mcelog to use the /dev/cpu device
|
|
Allow apmd to request the kernel load modules
|
|
Allow postfix programs to getattr on all executables
|
|
label mate-keyring-daemon with gkeyringd_exec_t
|
|
|
|
Dominick Grift (126):
|
|
Typo fix in ksmtuned_admin() by Shintaro Fujiwara
|
|
Fix monolithic built
|
|
Change file context spec for aide log files to catch suffixes
|
|
Module version bumps for changes in various policy modules by Sven
|
|
Vermeulen
|
|
Squid: Use a single pattern for brevity
|
|
Irc was already allowed to create tcp sockets, it only needed an
|
|
additional accept, and listen to be able to act as a proxy
|
|
Its probably a better idea to use the httpd_sys_ra_content_t type sid
|
|
for logs in these locations
|
|
Module version bump for changes to the tcsd policy module by Lukas
|
|
Vrabec
|
|
Module version bump for changes to various policy modules by Miroslav
|
|
Grepl
|
|
Module version bump for changes to the samba policy module by Dan Walsh
|
|
Module version bump for changes to the telepathy policy module by
|
|
Miroslav Grepl
|
|
We do not have a boinc domain type attribute Change boolean
|
|
description a bit
|
|
Additional rabbitmq couchdb support
|
|
Module version bumps for changes to various policy modules by Miroslav
|
|
Grepl
|
|
Additional git tcp networking rules
|
|
Additional ktalkd udp networking rules
|
|
Module version bump for changes to various policy modules by Dan Walsh
|
|
Addtional cups ldp tcp networking rules
|
|
Should be server packets because it is binding, and not connecting
|
|
Clean up telnet, and rlogin networking rules
|
|
Additional cvs tcp networking rules
|
|
Module version bump for changes to various policy modules by Dan Walsh
|
|
Addtional tgtd tcp networking rules
|
|
Additional polipo tcp networking rules
|
|
Fix asterisk files_spool_filetrans()
|
|
Module version bump for changes to the networkmanager policy module by
|
|
Lukas Vrabec
|
|
Additional fs_tmpfs_filetrans() for munin service plugin content on
|
|
tmpfs
|
|
Module version bump for changes to various policy modules by Miroslav
|
|
Grepl
|
|
Support rlogind, and telnetd as init daemon domains ( i think fedora is
|
|
campaigning to get rid of (x)?inetd )
|
|
Support mariadb logging, file context specification for mariadb specific
|
|
config location
|
|
Change logwatch boolean identifier to something more self-documenting.
|
|
Additional tcp networking rules
|
|
Module version bump for changes to various policy modules by Miroslav
|
|
Grepl
|
|
Fix inconsistencies in the pkcs policy module
|
|
Fix fetchmail inconsistencies
|
|
Module version bump for changes in various policy modules by Dan Walsh
|
|
Support for window managers to stream socket connect to pulseaudio
|
|
Logwatch does not need to be able to bind tcp sockets to generic nodes
|
|
since its only connecting
|
|
Adds userhelper_exec_consolehelper for window managers
|
|
Remove duplicate rules due to addition of auth_use_nsswitch()
|
|
We dont use the arbt domain types template. Use a more uniform boolean
|
|
discription
|
|
Clean up libstoragemngmt policy module We do not yet support systemd
|
|
Change type from etc_rw to conf for readability admin access to
|
|
condor_conf_t
|
|
Hit by a nasty optional policy nesting issue
|
|
We will find another way to run pa as a system server
|
|
Module version bump for changes to various policy modules by Miroslav
|
|
Grepl
|
|
Clean up hypervkvp policy module (seems incomplete)
|
|
Clean up initial redis policy module
|
|
Additional openvpn tcp networking rules
|
|
redis: allow redis to bind tcp sockets to redis_port_t type ports
|
|
bluetooth: bluetooth_t acquires org.bluez service on dbus system bus
|
|
wm: associate wm_exec_t to core command executable files so that initrc_t
|
|
(/sbin/start-stop-daemon) can access it (metacity)
|
|
logrotate restarts syslogd via init script in Debian
|
|
This file is called just man-db in Debian.
|
|
exim: exim owns directory /var/lib/exim4
|
|
accountsd: accounts-daemon lists /var/log
|
|
alsa: alsactl listing /dev/shm alsa: alsactl reading /dev/urandom alsa:
|
|
alsactl getting attributes of devtmpfs / (/dev) alsa: alsactl maintains
|
|
a pulseaudio tmpfs file
|
|
Cron: /sbin/runlevel reads /run/utmp cron: anacron (system_cronjob_t)
|
|
reading, writing inherited random crond tmp files (/tmp/tmpfk1VT2O)
|
|
dbus: allow system, and session bus clients to answer to dbus unconfined
|
|
domains
|
|
apt: Run apt system cronjobs in the apt_t domain apt: apt system cronjob
|
|
creates dpkg.status.* files in /var/backup
|
|
devicekit: upowerd reads own unix stream socket devicekit:
|
|
devicekit_power_t (runlevel) read /run/utmp
|
|
mandb: Make the man-db cronjob work on Debian
|
|
rtkit: traverse /proc to get to process state files
|
|
networkmanager: NetworkManager reads /run/udev/data/n2 file
|
|
avahi: create a avahi_initrc_domtrans for udev_t: udev runs a avahi dns
|
|
check script which does, i guess, a dns check. If needed it starts, or
|
|
stops avahi via its init script. I also created a
|
|
avahi_manage_pid_files() for udev_t because the script manages a file
|
|
called "checked_nameservers.*" in /run/avahi-daemon
|
|
Cleanups of various modules with regard to regular expressions and white
|
|
space
|
|
apt: As it turns out the /var/backups directory is labeled in the backup
|
|
module (which i incidentally did not have installed earlier). Instead
|
|
of creating this file with a file type transition to
|
|
apt_var_cache_t, allow apt_t to manage backup_store files
|
|
mta: this needs to be verified again, it should just have been running
|
|
in exim_t. I might have taken this from old logs
|
|
mandb: /etc/cron.daily/man-db executes dpkg, reads dpkg db on Debian
|
|
slocate: catch /usr/bin/updatedb.mlocate, and /etc/cron.daily/mlocate on
|
|
Debian
|
|
dpkg: catch /etc/cron.daily/dpkg on Debian dpkg: allow
|
|
/etc/cron.daily/dpkg to manage backup store files on Debian
|
|
cron: consistent usage of regular expressions cron: prelink no longer
|
|
runs in the system cronjob domain
|
|
alsa: alsactl wants to associate pulse-shm-.* to device_t type
|
|
filesystems. This happens early on but i do not understand how that
|
|
(/dev) relates to /dev/shm in this regard
|
|
devicekit: reads udev pid files modemmanager: reads udev pid files
|
|
vdagent: spice-vdagentd uses /dev/vport1p1 virtio console
|
|
tmpreaper: mountall-bootcl in the tmpreaper_t domain reads, writes
|
|
/dev/pts/0 inherited from init script
|
|
revert regular expressions
|
|
wm: allow $1_wm_t to stream connect to $1_gkeyringd_t
|
|
mta: allow system_mail_t (user_mail_domains) to read kernel sysctls and
|
|
to read exim var lib files.
|
|
mta: These are duplicates because system_mail_t is a user_mail_domain,
|
|
as it is based off of the mta_base_mail_template() which assigns that
|
|
type attribute
|
|
locate: extra rules needed by debian /etc/cron.daily/locate script
|
|
backup: in Debian /etc/cron.daily/passwd backs-up shadow, passwd etc to
|
|
/var/backups
|
|
avahi: create interfaces that will allow calles to create avahi pid dirs
|
|
and create specifc avahi pid objects with a type transition (for
|
|
udev, which runs: /usr/lib/avahi/avahi-daemon-check-dns.sh in
|
|
Debian
|
|
Initial gdomap policy module
|
|
Initial minissdpd policy module
|
|
alsa: due to a bug in gnome 3.4, in debian, alsactl does all kinds of
|
|
weird things related to pulseaudio
|
|
various: revert regex fixes: fcsort does not want this now
|
|
gdomap: gdomap_port_t is now available, gdomap binds tcp, and udp socket
|
|
to it
|
|
alsa: make alsa_t and pulseaudio_client so that pulseaudio_client rules
|
|
apply to it. alsactl does not actually run pulseaudio it seems though.
|
|
pulseaudio: allow all pulseaudio_client to send null signals to
|
|
unconfined_t, since unconfined_t is not actually a pulseaudio_client (
|
|
unconfined_t runs pulseaudio without a domain transition)
|
|
avahi: create avahi_setattr_pid_dirs() for udev (avahi dns check script
|
|
run by udev in Debian)
|
|
These { read write } tty_device_t chr files on boot up in Debian
|
|
colord: colord executable file locations in Debian
|
|
colord: reads /proc/1, reads /run/udev files
|
|
vdagent: read/write mtrr file
|
|
mandb: dpkg running in the mandb_t domain in Debian (mandb cronjob)
|
|
traverses /root
|
|
exim: traverses sysfs, uses system cronjob file descriptors (/dev/null) in
|
|
Debian (/etc/cron.daily/exim)
|
|
minissdpd fixes
|
|
devicekit: disk reads /proc/sys/vm/overcommit_memory
|
|
devicekit: edit devicekit_append_inherited_log_files to include get
|
|
attribute permission so that it can be also used for fsadm
|
|
devicekit: 95hdparm-apm (devicekit_power_t) gets attributes of /dev/sda
|
|
(fixed_disk_device_t)
|
|
networkmanager: added interfaces that fedora calls for dhcpc. In Debian it
|
|
was confirmed that at least dhclient manages
|
|
/var/lib/NetworkManager/dhclient-eth0.conf
|
|
firewalld: various fixes that i borrowed from Fedora but that also apply
|
|
to Debian (confirmed)
|
|
firewalld: interfaces created for iptables
|
|
irqbalance: getsched from Debian
|
|
colord: colord reads /proc/3412/cmdline (cupsd state files)
|
|
virt: libvirtd reads /run/udev/data/+input:input3
|
|
firewalld: traverses / on sysfs
|
|
rngd: needs ipc_lock capability, maintains /run/rngd.pid
|
|
tmpreaper: mountall-bootcl executes /bin/plymouth on Debian
|
|
minissdpd: deal with assertion violation (sys_module)
|
|
gdomap: missing networking rules, it traverses /tmp for some reason
|
|
ntp: create ntp_read_drift_files() for dhclient
|
|
dpkg: allow dpkg, and dpkg script to domain transition to initrc_t on any
|
|
init script file type rather than only the generic initrc_exec_t init
|
|
script file type
|
|
exim: exim4 reads online
|
|
apt: apt runs /usr/bin/apt-get apt: on_ac_power (apt_t) lists
|
|
/sys/class/power_supply
|
|
exim: exim_manage_var_lib_files created for init: init script runs helper
|
|
apps that create/manage /var/lib/exim4/config.autogenerated.tmp
|
|
gdomap/minissdpd: create read_config interfaces for initrc_t
|
|
exim: make exim init script create /var/run/exim4 with a proper context
|
|
pulseaudio: pulsaudio_t needs to be able to read user_tmpfs_files
|
|
(/run/shm/pulse-shm-.*)
|
|
dnsmasq: add support for /etc/dnsmasq.d/
|
|
Module version bumps for various policy modules
|
|
Module version bump for changes to the logrotate module by Luis Ressel
|
|
Git: git daemons can list and read git personal repositories
|
|
Module version bumps for changes to various policy modules by Fedora
|
|
redis, lsm: typo fixes
|
|
userhelper: append newline
|
|
|
|
James Carter (8):
|
|
- Fixed typo in contrib/avahi.if
|
|
- Fixed typo in contrib/glusterfs.te
|
|
- Fixed typo in contrib/jabber.if
|
|
- Fixed typo in contrib/keystone.if
|
|
- Fixed typo in contrib/mailscanner.if
|
|
- Fixed typo in contrib/qpid.if
|
|
- Fixed typo in contrib/readahead.fc.
|
|
- Fixed typo in contrib/rpm.if.
|
|
|
|
Laurent Bigonville (2):
|
|
Label /usr/lib/postfix/showq as postfix_showq_exec_t
|
|
Properly label git-daemon and gitweb.cgi on Debian
|
|
|
|
Luis Ressel (10):
|
|
Allow initrc_t to create /var/run/opendkim
|
|
Label /etc/cron.daily/logrotate correctly.
|
|
gpg: Create gpg_agent_connect interface
|
|
Minor updates to couchdb policy
|
|
couchdb: Add separate domain for couchjs
|
|
couchdb: Dontaudit denials caused by Erlang's disksup
|
|
Reformat couchdb.fc
|
|
pcscd.if: Permit access to pid files inside /var/run/pcscd/.
|
|
Allow gpg-agent's scdaemon to connect to pcscd.
|
|
Dontaudit screen asking for the sys_tty_config capability
|
|
|
|
Lukas Vrabec (8):
|
|
Allow tcsd to read utmp file
|
|
fix boinc policy
|
|
Add support for couchdb in rabbitmq policy
|
|
Fix transition rules in asterisk policy
|
|
Add fowner capability to networkmanager policy
|
|
Add policy for lsmd
|
|
Add policy for hypervkvpd
|
|
Add policy for redis-server
|
|
|
|
Mika Pflüger (1):
|
|
Correct typo in passenger module name
|
|
|
|
Miroslav Grepl (40):
|
|
Allow passenger to execute ifconfig
|
|
Allow mpd setcap which is needed by pulseaudio
|
|
Allow block_suspend cap for samba-net
|
|
Allow t-mission-control to manage gabble cache files
|
|
Allow nslcd to read /sys/devices/system/cpu
|
|
Add labeling for ~/.cache/telepathy/avatars/gabble
|
|
Allow firewalld to read NM state
|
|
Allow systemd running as git_systemd to bind git port
|
|
Fix labeling for fetchmail pid files/dirs
|
|
Fix polipo.te
|
|
Fix cupsd.te
|
|
Allow munin service plugins to manage own tmpfs files/dirs
|
|
Make ktalk as init domain
|
|
Allow mysqld_safe_t to handle also symlinks in /var/log/mariadb
|
|
Add logwatch_can_sendmail boolean
|
|
Allow rhsmcertd to read init state
|
|
Allow fsetid for pkcsslotd
|
|
Allow fetchmail to create own pid with correct labeling
|
|
Fix rhcs_domain_template()
|
|
Add support for abrt-upload-watch
|
|
Allow virtd to relabel unix stream socket
|
|
Fix lsm.fc for pid files
|
|
Also sock_file trans rule is needed in lsm
|
|
Update condor_master rules to allow read system state info and allow
|
|
logging
|
|
Add labeling for /etc/condor and allow condor domain to write it (bug)
|
|
Allow condor domains to manage own logs
|
|
Allow glusterd to read domains state
|
|
Add openvpn_can_network_connect() boolean
|
|
Fix minissdpd_admin()
|
|
Allow ctdb to getattr on al filesystems
|
|
Watchdog opens the raw socket
|
|
Allow watchdog to read network state info
|
|
Add setroubleshoot_signull() interface
|
|
Allow sosreport to send signull to setroubleshootd
|
|
Allow sosreport all signal perms
|
|
Allow sosreport to dbus chat with rpm
|
|
Allow zabbix_agentd to read all domain state
|
|
Allow smoltclient to execute ldconfig
|
|
Allow sosreport to request the kernel to load a module
|
|
Allow setpgid for sosreport
|
|
|
|
Nicolas Iooss (1):
|
|
git: fix file pattern after whitespace fixes
|
|
|
|
Sven Vermeulen (6):
|
|
Add minidlna policy
|
|
Allow openvpn temporary files
|
|
Add aide bin /usr/bin and mark /var/lib/aide
|
|
Provide alsa_write_lib interface
|
|
Run dmidecode after newrole or on terminals
|
|
Grant write privileges to squid on its log files
|
|
|
|
* Wed Apr 24 2013 Chris PeBenito <selinux@tresys.com> - 2.20130424
|
|
Chris PeBenito (18):
|
|
Rewrite of mcelog module from Guido Trentalancia
|
|
Remove unnecessary lines in mcelog.te.
|
|
Slight rearrangement in mcelog.te.
|
|
Module version bump for mcelog update from Guido Trentalancia.
|
|
Module version bump for ntp module fixes from Dominick Grift.
|
|
Module version bump for fc substitutions optimizations from Sven
|
|
Vermeulen.
|
|
Module version bump for postfix/mta misc fixes from Sven Vermeulen.
|
|
Module version bump for init_daemon_run_dirs usage from Sven Vermeulen.
|
|
Turn off all tunables by default, from Guido Trentalancia.
|
|
Module version bump for tunable default change.
|
|
Module version bump for saslauthd tcp mysql connections from Mika Flueger.
|
|
Move kernel request line in quota.
|
|
Module version bump for quota kernel module request from Mika Pflueger.
|
|
Module version bump for djbdns ports fixes from Russell Coker.
|
|
Remove stray + in keystone.te.
|
|
Whitespace fixes in cron.fc.
|
|
Module version bump for pulseaudio type_transition conflict fix from Sven
|
|
Vermeulen.
|
|
Bump module versions for release.
|
|
|
|
Dominick Grift (889):
|
|
Initial BIRD Internet Routing Daemon policy
|
|
oident daemon fixes
|
|
Introduce ntp_conf_t
|
|
Allow ntp_admin() to manage ntp_drift_t content.
|
|
List etc_t directories
|
|
Use "Role allowed access." for consistency
|
|
Use permissions sets for compatibility.
|
|
Remove getattr permision from ntp_admin()
|
|
Initial Sensord policy module
|
|
Various block_suspend capability2 support from Fedora
|
|
Gitolite3 support from Fedora
|
|
/var/lib/sqlgrey is greylist milter data from Fedora
|
|
Terminal related fixes for plymouthd from Fedora Support block_suspend
|
|
capability2 for plymouth
|
|
Support minimal polkit in new location
|
|
Support ldap for user authentication from Fedora
|
|
Sanlock sends kill signals to non-root processes from Fedora Various
|
|
other capabilities for sanlock from Fedora
|
|
Initial support for sqlgrey from Fedora
|
|
Tor reads network sysctls from Fedora
|
|
GPG agent reads /dev/random from Fedora
|
|
Freshclam reads system and network state from Fedora
|
|
Execute wpa_cli in the NetworkManager_t domain for wicd from Fedora
|
|
lpstat.cups reads fips_enabled from Fedora
|
|
Initial system tap compile server policy module
|
|
Systemtap server admin manages stapserver_var_lib_t content
|
|
Telepathy Idle reads gschemas.compiled from Fedora
|
|
Initial slpd policy module
|
|
Initial lightsquid policy module
|
|
Initial wdmd policy module
|
|
Initial mailscanner policy module and some depencies.
|
|
Support slpd log rotation
|
|
Initial numad policy module
|
|
Open log files for append only
|
|
CGClear reads CGConfig files from Fedora Cosmetic changes to cgroup
|
|
policy module File contexts of cgroup app executables files in
|
|
/sbin also apply to /usr/sbin Make cgroup_admin() a bit more
|
|
compact
|
|
Initial svnserve policy module
|
|
Various small changes to ucspitcp
|
|
Initial fcoe policy module
|
|
Initial lldpad policy module
|
|
fcoemon sends to lldpad with a dgram socket
|
|
Initial quantum policy module
|
|
Initial dspam policy module
|
|
Module version bump for Telepathy file context spec fixes from Laurent
|
|
Bigonville.
|
|
Initial isns policy module
|
|
Various changes to tcs policy module
|
|
Initial ctdb policy module
|
|
Various changes to the sblim policy module and its dependencies
|
|
Initial polipo policy module
|
|
Module version bump for networkmanager fixes
|
|
Fixes to the polipo policy module
|
|
Module version bump for smartmon fixes from Laurent Bigonville.
|
|
Module version bump for accountsd file context spec fix from Laurent
|
|
Bigonville.
|
|
Various changes to the raid module
|
|
Module version bump for rtkit file context spec fix from Laurent
|
|
Bigonville
|
|
Initial couchdb policy module
|
|
Changes to the bind policy module
|
|
Initial dnssectrigger policy module
|
|
Initial man2html policy module
|
|
Initial openhpi policy module
|
|
Bind sends/receives http server instead of client packets conditionally
|
|
Two file context regular expression fixes by Eric Paris
|
|
Type mdadm_t is no longer a unconfined type
|
|
Initial pkcs policy module
|
|
Initial cfengine policy module
|
|
Initial keystone policy module
|
|
Initial l2tp policy module
|
|
Initial mongodb policy module
|
|
cfengine whitespace cleanup
|
|
Changes to the accountsservice policy module
|
|
Changes to the acct policy module
|
|
Changes to the ada policy module
|
|
changes to the afs policy module
|
|
Changes to the accountsservice policy module
|
|
Changes to the aiccu policy module
|
|
Changes to the aide policy module
|
|
Syntax error in afs_admin()
|
|
Changes to the aisexec policy module
|
|
Changes to the alsa policy module
|
|
Changes to the amanda policy module
|
|
Changes to the amavisd policy module and relevant dependencies
|
|
Changes to the amtu policy module
|
|
Changes to the anaconda policy module
|
|
Changes to the abrt policy module and relevant dependencies
|
|
numad sends/receives msgs from Fedora
|
|
Amtu executable file in installed in /usr/sbin in Fedora
|
|
The (usr/)? expression does not work consistently so better not use it
|
|
at all
|
|
Changes to the httpd policy module
|
|
Merge branch 'master' of
|
|
ssh://dgrift@oss.tresys.com/home/git/refpolicy-contrib
|
|
Fixes to the apache policy module and dependencies
|
|
Changes to the apcupsd policy module
|
|
Role attributes for lightsquid application domain
|
|
Changes to the mailscanner module
|
|
Changes to the svnserve policy module
|
|
Changes to the quantum policy module
|
|
Changes to the dspam module
|
|
Changes to the ctdb policy module
|
|
Changes to the couchdb policy module
|
|
Changes to the openhpid policy module
|
|
Changes to the keystone policy module
|
|
Changes to the l2tp policy module
|
|
Changes to the apm module and relevant dependencies
|
|
Changes to the arpwatch policy module
|
|
Changes to the apcupsd policy module
|
|
Changes to the abrt policy module
|
|
Changes to the apache policy module
|
|
Changes to the asterisk policy module and dependencies
|
|
Changes to the authbind policy module
|
|
Changes to the automount policy module
|
|
Change acpid lock file context spec
|
|
Changes to the avahi policy module and dependencies
|
|
Changes to the awstats policy module
|
|
Changes to the bacula policy module
|
|
Changes to the bcfg2 policy module
|
|
Changes to the apt policy module
|
|
Changes to the apache policy module
|
|
Changes to the backup module
|
|
Changes to the bind policy module
|
|
Bird module clean up
|
|
Fix arpwatch connected_stream_socket_perms
|
|
Changes to the bitlbee policy module
|
|
Changes to the blueman policy module
|
|
Changes to the bluetooth policy module
|
|
Changes to the brctl policy module
|
|
Changes to the apache policy module
|
|
Changes to the bugzilla policy module
|
|
Changes to the calamaris policy module
|
|
Implement lightsquid_admin()
|
|
Changes to the apache policy module and dependencies
|
|
Initial boinc policy module
|
|
Initial callweaver policy module
|
|
Changes to the canna policy module
|
|
Changes to the ccs policy module
|
|
Changes to the cdrecord policy module
|
|
Changes to the certmaster policy module and various role attribute fixes
|
|
cdrecord needs to read and write callers unix domain stream socket not
|
|
create it
|
|
Changes to the certmonger policy module and its dependencies
|
|
Initial cachefilesd policy module
|
|
Changes to the certwatch policy module
|
|
Changes to the chronyd policy module
|
|
Changes to the cipe policy module
|
|
Changes to the clamav policy module
|
|
Various network clean up
|
|
Add dev_rw_cachefiles() to cachefilesd policy module
|
|
Changes to the clockspeed policy module
|
|
Changes to the clogd policy module
|
|
Changes to the cmirrord policy module
|
|
Changes to the cobbler policy module
|
|
Changes to the colord policy module
|
|
Changes to the comsat policy module
|
|
Initial collectd policy module
|
|
Initial condor policy module and relevant dependencies
|
|
Changes to the consolekit policy module and relevant dependencies
|
|
Changes to the corosync policy module and relevant dependencies
|
|
Clean up couchdb network rules
|
|
Changes to the courier policy module
|
|
Changes to the cpucontrol policy module
|
|
Changes to the cpufreqselector policy module
|
|
Changes to the cron policy module and relevant dependencies
|
|
Changes to the cups policy module and relevant dependencies
|
|
Changes to the cvs policy module
|
|
Remove redundant connect avperms
|
|
Changes to the cyphesis policy module
|
|
Remove redundant rules from apache_admin()
|
|
Changes to the cyrus policy module
|
|
Changes to the daemontools policy module
|
|
Changes to the dante policy module
|
|
Modify dbadm boolean descriptions
|
|
Changes to the dbus policy module and its dependencies
|
|
Changes to the dcc policy module
|
|
Changes to the ddclient policy module
|
|
Changes to the ddcprobe policy module
|
|
Changes to the denyhosts policy module
|
|
Changes to the devicekit policy module and relevant dependencies
|
|
Changes to the dhcpd policy module
|
|
Changes tothe dictd policy module
|
|
Changes to the discc policy module
|
|
Changes to the djbdns policy module
|
|
Changes to the dkim policy module
|
|
Changes to the dmidecode policy module
|
|
Module bump for Laurent Bigonville trousers init script file context
|
|
specification fix
|
|
Module bump for Laurent Bigonville libvirt init script file context
|
|
specification fix
|
|
Changes to the dnsmasq policy module and relevant dependencies
|
|
Changes to the dovecot policy module
|
|
Changes to the dpkg policy module
|
|
Changes to the entropyd policy module
|
|
Changes to the evolution policy module
|
|
Changes to the exim policy module and relevant dependencies
|
|
Changes to the cron policy module
|
|
Changes to the fail2ban policy module
|
|
fcoemon XML clean up
|
|
Changes to the fetchmail policy module
|
|
Changes to the fingerd policy module
|
|
Initial firewalld policy module
|
|
Changes to the firstboot policy module
|
|
Changes to the fprint policy module and relevant dependencies
|
|
Changes to the ftp module
|
|
Changes to the games policy module
|
|
Clean up evolution and cdrecord XML
|
|
Changes to the gatekeeper policy module
|
|
Changes to the gift policy module
|
|
Changes to the git policy module
|
|
Changes to the gitosis policy module
|
|
Changes to the glance policy module
|
|
Initial glusterfs policy module
|
|
Add gatekeeper newline
|
|
Deprecate glusterd_admin() use glusterfs_admin() instead
|
|
Portage module version bump for autofs support by Matthew Thode and
|
|
clean up
|
|
cfengine: This location is now labeled with a cfengine private type
|
|
Changes to the slpd policy module
|
|
Changes to the gnomeclock policy module and relevant dependencies
|
|
Changes to the gpg policy module
|
|
Changes to the gpm policy module
|
|
Changes to the gpsd policy module and relevant dependencies
|
|
changes to the guest policy module
|
|
Changes to the gnomeclock policy module
|
|
Deprecate various DBUS interfaces and relevant dependencies
|
|
Changes to the cachefilesd policy module
|
|
Remove file context specification for kgpg which is a GUI frontend to
|
|
GPG. Domain transition to gpg_t will happen when kgpg runs gpg.
|
|
(rhbz#862229)
|
|
Initial mandb policy module
|
|
Changes to the hadoop policy module
|
|
Changes to the hald policy module
|
|
Changes to the hddtemp policy module
|
|
Changes to the howl policy module
|
|
changes to the mandb policy module
|
|
Changes to the dbus policy module
|
|
Changes to the rpm policy module
|
|
Changes to the i18n_input policy module
|
|
Changes to the icecast policy module
|
|
Changes to the ifplugd policy module
|
|
Changes to the imaze policy module
|
|
Changes to the inetd policy module and relevant dependencies
|
|
Changes to the innd policy module
|
|
Changes to the irc policy module
|
|
Changes to the ircd policy module
|
|
Changes to the irc policy module
|
|
Changes to the dbus policy module
|
|
Changes to the avahi policy module
|
|
Changes to the bluetooth policy module
|
|
Changes to the aiccu policy module
|
|
Changes to the bacula policy module
|
|
Changes to the boinc policy module
|
|
Changes to the bugzilla policy module
|
|
Changes to the ccs policy module
|
|
Changes to the clamav policy module
|
|
Changes to the cobbler policy module
|
|
Changes to the cyphesis policy module
|
|
Changes to the dante policy module
|
|
Changes to the dbskk policy module
|
|
Changes to the ddclient policy module
|
|
Changes to the denyhosts policy module
|
|
Changes to the dnssectrigger policy module
|
|
Changes to the dovecot policy module
|
|
Changes to the drbd policy module
|
|
Changes to the evolution policy module
|
|
Changes to the fail2ban policy module
|
|
Changes to the firewalld policy module
|
|
Changes to the firstboot policy module
|
|
Changes to the games policy module
|
|
Changes to the gift policy module
|
|
Changes to the glance policy module
|
|
Changes to the hald policy module
|
|
Changes to the dbus policy module
|
|
Changes to the git policy module
|
|
Changes to the polipo policy module
|
|
Changes to the firewalld policy module
|
|
Changes to the gpg policy module
|
|
Tab clean up in ircbalance file context file
|
|
Changes to the irqbalance policy module
|
|
Tab clean up in iscsi file context file
|
|
Changes to the iscsi policy module
|
|
Tab clean up in jabber file context file
|
|
Changes to the jabberd policy module
|
|
Changes to the pyicqt policy module
|
|
Tab clean up in java file context file
|
|
Changes to the java policy module
|
|
Changes to the dbus policy module
|
|
Changes to the gnome policy module
|
|
Changes to the apache policy module
|
|
Changes to the accountsd policy module
|
|
Changes to the alsa policy module
|
|
Changes to the evolution policy module
|
|
Changes to the bluetooth policy module
|
|
Changes to the games policy module
|
|
Changes to the gift policy module
|
|
Changes to the gpg policy module
|
|
Changes to the hadoop policy module
|
|
Tab clean up in kdump file context file
|
|
Changes to the kdump policy module
|
|
Changes to the gpg policy module
|
|
Changes to the dbus policy module
|
|
Changes to the evolution policy module
|
|
Changes to the gpm policy module
|
|
Version bump for evolution file context fixes by Laurent Bigonville
|
|
Version bump for nut file context fixes by Laurent Bigonville
|
|
Changes to the kdumpgui policy module
|
|
Tab clean up in kerberos file context file
|
|
Changes to the kerberos policy module and relevant dependencies
|
|
Changes to the kerneloops policy module
|
|
Tab clean up in kerberos file context file
|
|
Changes to the kismet policy module
|
|
Clean up amavis XML header
|
|
Initial keyboardd policy module
|
|
Tab clean up in ksmtuned file context file
|
|
Changes to the ksmtuned policy module
|
|
Tab clean up in ktalk file context file
|
|
Changes to the ktalk policy module
|
|
Changes to the kudzu policy module
|
|
Initial iodine policy module
|
|
Initial dirmngr policy module
|
|
Changes to the iodine policy module
|
|
Changes to the kerberos policy module
|
|
Changes to the kdumpgui policy module
|
|
Update deprecated interface calls ( gnome_read_config ->
|
|
gnome_read_generic_home_content )
|
|
Changes to the mozilla policy module
|
|
Changes to the thunderbird policy module
|
|
Changes to the l2tp policy module
|
|
Tab clean up in ldap file context file
|
|
Changes to the ldap policy module
|
|
Tab clean up in likewise file context file
|
|
Changes to the likewise policy module
|
|
Tab clean up in lircd file context file
|
|
Changes to the lircd policy module
|
|
Changes to the livecd policy module
|
|
Tab clean up in loadkeys file context file
|
|
Changes to the loadkeys policy module and relevant dependencies
|
|
Tab clean up in lockdev file context file
|
|
Changes to the lockdev policy module
|
|
Tab clean up in logrotate file context file
|
|
Changes to the logrotate policy module and relevant dependencies
|
|
Tab clean up in logwatch file context file
|
|
Changes to the logrotate policy module
|
|
Changes to the logwatch policy module
|
|
Tab clean up in lpd file context file
|
|
Changes to the lpd policy module
|
|
Tab clean up in cron policy module
|
|
Changes to the lpd policy module
|
|
Changes to the consolekit policy module
|
|
Tab fix in cron policy module
|
|
Tab clean up in mailman file context file
|
|
Changes to the mailman policy module and relevant dependencies
|
|
Tab clean up in mcelog file context file
|
|
Changes to the mcelog policy module
|
|
Tab clean up in mediawiki file context file
|
|
Mediawiki XML clean up
|
|
Tab clean up in memcached file context file
|
|
Changes to the memcached policy module
|
|
Changes to the apache policy module
|
|
Tab clean up in milter file context file
|
|
Changes to the milter policy module and relevant dependencies
|
|
Changes to the modemmanager policy module
|
|
Tab clean up in mojomojo file context file
|
|
Changes to the mojomojo policy module and relevant dependencies
|
|
Changes to the gpg policy module
|
|
Changes to the mongodb policy module
|
|
Changes to the mono policy module
|
|
Changes to the monop policy module
|
|
Tab clean up in mozilla file context file
|
|
Changes to the mozilla policy module and relevant dependencies
|
|
Changes to the mozilla policy module
|
|
Changes to the apache policy module
|
|
Tab clean up in mpd file context file
|
|
Changes to the mpd policy module
|
|
Tab clean up in mplayer file context file
|
|
Changes to the evolution policy module
|
|
Changes to the mplayer policy module
|
|
Changes to the irc policy module
|
|
Tab clean up in mrtg file context file
|
|
Changes to the mrtg policy module
|
|
Tab clean up in mta file context file
|
|
Changes to the mta policy module and relevant dependencies
|
|
Changes to the mta policy module and relevant dependencies
|
|
Get rid of mozilla_conf_t as it is unused
|
|
Changes to the logrotate policy module
|
|
Changes to the logwatch policy module
|
|
Changes to the java policy module
|
|
Changes to the apache module and relevant dependencies
|
|
Tab clean up in munin file context file
|
|
Changes to the munin policy module and relevant dependencies
|
|
Tab clean up in mysql file context file
|
|
Changes to mysqld policy module
|
|
Changes to various policy modules
|
|
Changes to the munin policy module
|
|
Changes to the dovecot policy module
|
|
Changes to various policy modules
|
|
Changes to the mta policy module
|
|
Changes to the certmonger policy module and relavant dependencies
|
|
Tab clean up in nagios file context file
|
|
Changes to the nagios policy module and relevant dependencies
|
|
Changes to the modutils policy module
|
|
Tab cleanup in the nessus file context file
|
|
Changes to the nessus policy module
|
|
Tab clean up in the network manager file context file
|
|
Changes to the networkmanager policy module and relevant dependencies
|
|
Changes to the mozilla policy module
|
|
Changes to the cobbler policy module
|
|
Initial rngd policy module
|
|
Tab clean up in the nis file context file
|
|
Changes to the nis policy module
|
|
Tab clean up in the nscd file context file
|
|
Changes to the nscd policy module
|
|
Tab clean up in the nsd file context file
|
|
Changes to the nsd policy module
|
|
Tab clean up in the nslcd file context file
|
|
Changes to the nslcd policy module
|
|
Tab clean up in the ntop file context file
|
|
Changes to the ntop policy module
|
|
Tab clean up in the ntp file context file
|
|
Changes to the ntp policy module
|
|
Changes to the numad policy module
|
|
Tab clean up in the nut file context file
|
|
Changes to the nut policy module
|
|
Tab clean up in the nx file context file
|
|
Changes to the nx policy module
|
|
Changes to the oav policy module
|
|
Initial obex policy module
|
|
Tab clean up in the oddjob file context file
|
|
Tab clean up in gpg policy module
|
|
Changes to the oddjob policy module
|
|
Changes to the mozilla policy module
|
|
Initial pacemaker policy module
|
|
Tab clean up in the oidentd file context file
|
|
Changes to the oident policy module
|
|
Tab clean up in the openca file context file
|
|
Changes to the openca policy module
|
|
Tab clean up in the openct file context file
|
|
Changes to the openct policy module
|
|
Tab clean up in the openvpn file context file
|
|
Changes to the openvpn policy module
|
|
Tab clean up in the pads file context file
|
|
Changes to the pads policy module
|
|
Tab clean up in the passenger file context file
|
|
Changes to the passenger policy module and relevant dependencies
|
|
Tab clean up in the pcmcia file context file
|
|
Changes to the pcmcia policy module
|
|
Tab clean up in the pcscd file context file
|
|
Changes to the pcscd policy module and relevant dependencies
|
|
Tab clean up in the pegasus file context file
|
|
Changes to the pegasus policy module
|
|
Tab clean up in the perdition file context file
|
|
Changes to the perdition policy module
|
|
Tab clean up in the pingd file context file
|
|
Changes to the pingd policy module
|
|
Changes to the plymouthd policy module
|
|
Changes to the mozilla policy module
|
|
Changes to the plymouth policy module
|
|
Tab clean up in the podsleuth file context file
|
|
Changes to the podsleuth policy module
|
|
Tab clean up in the policykit file context file
|
|
Changes to the policykit policy module and relevant dependencies
|
|
Tab clean up in the portage file context file
|
|
Changes to the portage policy module
|
|
Tab clean up in the portmap file context file
|
|
Changes to the portmap policy module
|
|
Tab clean up in the portreserve file context file
|
|
Changes to the portreserve policy module
|
|
Tab clean up in the portslave file context file
|
|
Changes to the portslave policy module and relevant dependencies
|
|
Tab clean up in the postfix file context file
|
|
Changes to the postfix policy module and relevant dependencies
|
|
Fixes to various policy modules
|
|
Tab clean up in the postfixpolicyd file context file
|
|
Changes to the postfixpolicyd policy module
|
|
Tab clean up in the postgrey file context file
|
|
Changes to the postgrey policy module
|
|
Tab clean up in the ppp file context file
|
|
Changes to the ppp policy module and relevant dependencies
|
|
Tab clean up in the prelink file context file
|
|
Changes to the prelink policy module and relevant dependencies
|
|
Tab clean up in the prelude file context file
|
|
Changes to the prelude policy module
|
|
Tab clean up in the privoxy file context file
|
|
Changes to the privoxy policy module
|
|
Tab clean up in the procmail file context file
|
|
Changes to the procmail policy module
|
|
Tab clean up in the psad file context file
|
|
Changes to the psad policy module
|
|
Changes to the ptchown policy module
|
|
Tab clean up in the publicfile file context file
|
|
Changes to the publicfile policy module
|
|
Fix a fatal syntax error in mozilla_plugin_role()
|
|
Changes to the plymouth policy module
|
|
Changes to the policykit policy module
|
|
Module version bump for fixes in shorewall, fail2ban and portage policy
|
|
modules by Sven Vermeulen
|
|
Tab clean up in the puppet file context file
|
|
Changes to ther puppet policy module and relevant dependencies
|
|
Initial pwauth policy module
|
|
Tab clean up in the pxe file context file
|
|
Changes to the pxe policy module
|
|
Tab clean up in the pyzor file context file
|
|
Changes to the pyzor policy module
|
|
Tab clean up in the qemu file context file
|
|
Changes to the qemu policy module
|
|
Tab clean up in the virt file context file
|
|
Changes to the virt policy module and relevant depedencies
|
|
Changes to the virt policy module
|
|
Changes to the cron policy module
|
|
Changes to the qemu policy module
|
|
Changes to the virt policy module
|
|
Epylog wants sys_nice and setsched
|
|
Tab clean up in the qmail file context file
|
|
Changes to the qmail policy module
|
|
Tab clean up in the qpid file context file
|
|
Changes to the qpid policy module
|
|
Tab clean up in the quota file context file
|
|
Changes to the quota policy module and relevant dependencies
|
|
Initial rabbitmq policy module
|
|
Tab clean up in the radius file context file
|
|
Changes to the radius policy module
|
|
Tab clean up in the radvd file context file
|
|
Changes to the radvd policy module
|
|
Changes to the raid policy module
|
|
Tab clean up in the razor file context file
|
|
Changes to the razor policy module and relevant dependencies
|
|
Smokeping cgi needs to run ping with a domain transition Remove
|
|
redundant socket create already provided by
|
|
sysnet_dns_name_resolve()
|
|
Changes to the virt policy module
|
|
Changes to the apache policy module
|
|
Changes to the gnome policy module
|
|
Changes to the rdisc policy mpdule
|
|
Changes to the readahead policy module
|
|
Changes to the remotelogin policy module
|
|
Tab clean up in the resmgr file context file
|
|
Changes to the resmgr policy module
|
|
Tab clean up in the rgmanager file context file
|
|
Changes to the rgmanager policy module
|
|
Initial Realmd policy module and relevant dependencies
|
|
Fix resmgrd init script file context specification
|
|
Changes to the cups policy module
|
|
automount reads overcommit_memory
|
|
Changes to the networkmanager policy module
|
|
Freshclam manages amavis spool content
|
|
Changes to the tftp policy module
|
|
Changes to the cobbler policy module
|
|
Tab clean up in the rhcs file context file
|
|
Changes to the rhcs policy module and relevant dependencies
|
|
Tab clean up in the rhgb file context file
|
|
Changes to the rhgb policy module
|
|
Tab clean up in the rhsmcertd file context file
|
|
Changes to the rhsmcertd policy module
|
|
Tab clean up in the ricci file context file
|
|
Changes to the ricci policy module
|
|
Tab clean up in the rlogin file context file
|
|
Changes to the rlogin policy module
|
|
Tab clean up in the roundup file context file
|
|
Changes to the roundup policy module
|
|
Changes to the remotelogin policy module
|
|
Changes to the apache policy module
|
|
Changes to the awstats policy module
|
|
fix puppet_admin() need to require types that it uses
|
|
Replace wrong type in puppet_admin()
|
|
Fix a syntax error in ricci_domtrans()
|
|
Catch all rpcbind content in /var/run
|
|
Changes to the cups policy module
|
|
Tab clean up in the rpc file context file
|
|
Changes to the rpc policy module
|
|
Tab clean up in the rpcbind file context file
|
|
Changes to the rpcbind policy module
|
|
Tab clean up in the rpm file context file
|
|
Changes to the rpm policy module and depedencies
|
|
Changes to the rshd policy module
|
|
Changes to the virt policy module
|
|
Changes to the rssh policy module
|
|
Tab clean up in the rsync file context file
|
|
Fix a typo in apache XML
|
|
Changes to the rsync policy module
|
|
Changes to the rtkit policy module
|
|
Tab clean up in the rwho file context file
|
|
Changes to the rwho policy module
|
|
Reads /proc/sys/kernel/random/poolsize
|
|
Tab clean up in the samba file context file
|
|
Changes to the samba policy module and relevant dependencies
|
|
Tab clean up in the sambagui file context file
|
|
Changes to the sambagui policy module
|
|
Initial firewallgui policy module
|
|
Tab clean up in the samhain file context file
|
|
Changes to the samhain policy module
|
|
Tab clean up in the sanlock file context file
|
|
Changes to the sanlock policy module and relevant dependencies
|
|
Tab clean up in the sasl file context file
|
|
Changes to the sasl policy module
|
|
Chnages to the sblim policy module
|
|
Tab clean up in the screen file context file
|
|
Changes to the screen policy module
|
|
Tab clean up in the sectoolm file context file
|
|
Changes to firewallgui policy module
|
|
Changes to the sectoolm policy module
|
|
Tab clean up in the sendmail file context file
|
|
Changes to the sendmail policy module and relevant dependencies
|
|
Tab clean up in the setroubleshoot file context file
|
|
Changes to the setroubleshoot policy module
|
|
Tab clean up in the shorewall file context file
|
|
Changes to the shorewall policy module
|
|
Tab clean up in the shutdown file context file
|
|
Changes to the shutdown policy module and relevant dependencies
|
|
Tab clean up in the slocate file context file
|
|
Changes to the slocate policy module and relevant dependencies
|
|
These domains transition to shutdown domain now so they no longer need
|
|
direct access
|
|
Re-add missing network rule in screen policy module
|
|
fail2ban server sets scheduler
|
|
shutdown XML clean up
|
|
libvirtd sets kernel scheduler
|
|
mongod reads cpuinfo_max_freq
|
|
Changes to the slrnpull policy module
|
|
Tab clean up in the smartmon file context file
|
|
Changes to the smartmon policy module
|
|
Tab clean up in the smokeping file context file
|
|
Changes to the smokeping policy module
|
|
Tab clean up in the smoltclient file context file
|
|
Changes to the smoltclient policy module
|
|
Tab clean up in the snmp file context file
|
|
Changes to the snmp policy module
|
|
Tab clean up in the snort file context file
|
|
Changes to the snort policy module
|
|
Changes to the sosreport policy module and relevant dependencies
|
|
Tab clean up in the soundserver file context file
|
|
Changes to the soundserver policy module
|
|
Tab clean up in the spamassassin file context file
|
|
Changes to the spamassassin policy module and relevant dependendies
|
|
spamassassin_role callers create ~/.spamd with the spamd_home_t user
|
|
home type instead
|
|
Re-add sys_admin capability that was lost with porting from Fedora
|
|
Move mailscanner content to mailscanner module
|
|
Changes to the speedtouch policy module
|
|
Tab clean up in the squid file context file
|
|
Changes to the squid policy module
|
|
Changes to the sssd policy module
|
|
Tab clean up in the stunnel file context file
|
|
Changes to the stunnel policy module
|
|
Tab clean up in the sxid file context file
|
|
Changes to the sxid policy module
|
|
Tab clean up in the sysstat file context file
|
|
Changes to the sysstat policy module
|
|
Tab clean up in the tcpd file context file
|
|
Changes to the tcpd policy module
|
|
Changes to the tcsd policy module
|
|
Tab clean up in the telepathy file context file
|
|
Changes to the telepathy policy module
|
|
Tab clean up in the telnet file context file
|
|
Changes to the telnet policy module
|
|
Tab clean up in the tftp file context file
|
|
Changes to the tftp policy module
|
|
Tab clean up in the tgtd file context file
|
|
Changes to the tgtd policy module
|
|
Tab clean up in the thunderbird file context file
|
|
Changes to the thunderbird policy module
|
|
Catch /var/log/cron directory as well
|
|
Dovecot module version bump for fixes by Sven Vermeulen
|
|
Portage module version bump for fixes by Sven Vermeulen
|
|
Cron module version bump for fixes by Sven Vermeulen
|
|
Changes to the exim policy module
|
|
Entropyd reads /proc/meminfo
|
|
Blueman reads tmp_t directories
|
|
Do not audit attempts by cups config to read tmp_t directories
|
|
Do not audit attempts by fail2ban to read tmp_t directories
|
|
Do not audit attempts by firewalld to read tmp_t directories
|
|
Gnomeclock reads urandom and realtime clock
|
|
Kdumpctl needs sys_chroot capability
|
|
Various kdumpgui fixes from Fedora
|
|
Do not audit attempts by logwatch to read tmp_t directories
|
|
Catch all alias files
|
|
Refine aliases file transition with names
|
|
Realmd dbus chat policykit and networkmanager from Fedora
|
|
Do not audit attempts by tuned to read tmp_t directories
|
|
Changes to the timidity policy module
|
|
Tab clean up in the tmpreaper file context file
|
|
Changes to the tmpreaper policy module and relevant dependencies
|
|
Tab clean up in the tor file context file
|
|
Changes to the tor policy module
|
|
Changes to the transproxy policy module
|
|
Tab clean up in the tripwire file context file
|
|
Changes to the tripwire policy module
|
|
Tab clean up in the tuned file context file
|
|
Changes to the tuned policy module
|
|
Tab clean up in the tvtime file context file
|
|
Changes to the tvtime policy module
|
|
Changes to the tzdata policy module
|
|
Changes to the ucspitcp policy module
|
|
Tab clean up in the ulogd file context file
|
|
Changes to the ulogd policy module
|
|
Tab clean up in the uml file context file
|
|
Changes to the uml policy module
|
|
Make it so that irc clients can also get attributes of cifs, nfs, fuse
|
|
and other file systems
|
|
Changes to the updfstab policy module
|
|
Changes to the uptime policy module
|
|
Tab clean up in the usbmodules file context file
|
|
Changes to the usbmodule policy module
|
|
Changes to the usbmuxd policy module
|
|
Tab clean up in the userhelper file context file
|
|
Screen sends child terminated signals to all interactive fd domains
|
|
Changes to the userhelper policy module and relevant dependencies
|
|
Changes to the virt policy module
|
|
Module version bump for fail2ban changes by Sven Vermeulen
|
|
Changes to the rpm policy module
|
|
fix smartmon init script file context specification
|
|
Changes to the usernetctl policy module
|
|
Tab clean up in the uucp file context file
|
|
Changes to the uucp policy module
|
|
Changes to the virt policy module
|
|
Tab clean up in the uuid file context file
|
|
Changes to the uuidd policy module
|
|
Tab clean up in the uwimap file context file
|
|
Changes to the uwimap policy module
|
|
Tab clean up in the varnishd file context file
|
|
Changes to the varnishd policy module
|
|
Changes to the vbetool policy module
|
|
Tab clean up in the vdagent file context file
|
|
Changes to the vdagent policy module
|
|
Tab clean up in the vhostmd file context file
|
|
Changes to the vhostmd policy module
|
|
Changes to the vlock policy module
|
|
Tab clean up in the vmware file context file
|
|
Changes to the vmware policy module
|
|
Tab clean up in the vnstatd file context file
|
|
Changes to the vnstatd policy module
|
|
Tab clean up in the vpn file context file
|
|
Changes to the vpnc policy module
|
|
Tab clean up in the w3c file context file
|
|
Changes to the w3c policy module
|
|
Tab clean up in the watchdog file context file
|
|
Changes to the watchdog policy module
|
|
Changes to the wdmd policy module
|
|
Changes to the webadm policy modules
|
|
Changes to the webalizer policy module
|
|
White space fix in apache policy module
|
|
Changes to the wine policy module
|
|
Tab clean up in the wireshark file context file
|
|
Changes to the wireshark policy module
|
|
Tab clean up in the wm file context file
|
|
Changes to the wm policy module
|
|
Changes to the inn policy module
|
|
Move man cache file type to miscfiles
|
|
Changes to the inn policy module
|
|
More accurate dbadm boolean descriptions
|
|
mysql_admin() has access to ~/.my.cnf files
|
|
Tab clean up in the xen file context file
|
|
Changes to the xen policy module and relevant dependencies
|
|
Tab clean up in the xfs file context file
|
|
Changes to the xfs policy module
|
|
Changes to the xguest policy module and relevant dependencies
|
|
Changes to the xprint policy module
|
|
Changes to the xscreensaver policy module
|
|
Tab clean up in the yam file context file
|
|
Changes to the yam policy module
|
|
Tab clean up in the zabbix file context file
|
|
Changes to the zabbix policy module
|
|
Tab clean up in the zarafa file context file
|
|
Changes to the zarafa policy module
|
|
Tab clean up in the zebra file context file
|
|
Changes to the zebra policy module
|
|
Changes to the zosremote policy module
|
|
Changes to the mysql policy module
|
|
Tab clean up in the pulseaudio file context file
|
|
Changes to the pulseaudio policy module and relevant dependencies
|
|
Changes to the pulseaudio policy module
|
|
One chown too many
|
|
Changes to the mplayer policy module
|
|
The prelink cron script now runs in its own domain
|
|
Initial smstools policy module
|
|
Initial openvswitch policy module and relevant dependencies
|
|
Reads pcsd pid files
|
|
Reads random device
|
|
winbind manages smbd pid sock files from Fedora
|
|
Changes to the bind policy module
|
|
CG rules daemon reads all sysctls
|
|
Runs consoletype and searches nfs state data from Fedora
|
|
Support munin unbound plugin from Fedora
|
|
Zabbix sends signals from Fedora
|
|
Blueman sets scheduler and sends signals from Fedora
|
|
pcscd_read_pub_files is deprecated, use pcscd_read_pid_files instead
|
|
Module version bumps for fixes in portage and virt modules by Sven
|
|
Vermeulen
|
|
Policy module version bumps for various changes by Sven Vermeulen
|
|
Changes to the openvpn policy module
|
|
Module version bumps for various fixes by Sven Vermeulen
|
|
Changes to the mandb policy module
|
|
Changes to the tmpreaper policy module
|
|
Changes to the munin policy module
|
|
Changes to the rngd policy module
|
|
Changes to the awstats policy module and relevant dependencies
|
|
Changes to the apache policy module
|
|
Changes to various policy modules
|
|
Changes to the abrt policy module
|
|
Changes to the passenger policy module and relevant depedencies
|
|
Changes to the pegagus policy module
|
|
Changes to the mta policy module
|
|
Changes to the fetchmail policy module
|
|
Changes to the bitlbee policy module
|
|
Changes to the blueman policy module and relevant dependencies
|
|
Changes to the amavis policy module
|
|
Changes to the userhelper policy module
|
|
Changes to the blueman policy module
|
|
Changes to the squid policy module
|
|
Changes to the sblim policy module
|
|
Changes to the kdumpgui policy module
|
|
Changes to the mailman policy module
|
|
Changes to the realmd policy module
|
|
Changes to the raid policy module
|
|
Changes to the samba policy module
|
|
Changes to the various policy modules
|
|
Changes to the snmp policy module
|
|
Changes to the spamassassin policy module
|
|
Changes to the sssd policy module
|
|
Changes to the l2tpd policy module
|
|
Changes to the shorewall policy module
|
|
Changes to the xen policy module
|
|
Changes to the tftp policy modules
|
|
Changes to the accountsd policy module
|
|
Changes to the tgtd policy module
|
|
Changes to the corosync policy module
|
|
Changes to the kdump policy module
|
|
Changes to the openvswitch policy module
|
|
Changes to the mpd policy module
|
|
Changes to the mozilla policy module
|
|
Changes to the zarafa policy module
|
|
Changes to the boinc policy module
|
|
Changes to the setroubleshoot policy module
|
|
Changes to the dspam policy module
|
|
Changes to the rgrmanager policy module and relevant dependencies
|
|
Changes to the svnserve policy module
|
|
Changes to the virt policy module
|
|
Changes to the prelink policy module
|
|
Changes to the apache policy module
|
|
Changes to the gnomeclock policy module
|
|
Changes to various policy modules
|
|
Changes to the pegagus policy module
|
|
Changes to the shorewall policy module
|
|
Changes to the kerberos policy module
|
|
Changes to the rhcs policy module
|
|
Changes to the irc policy module
|
|
Changes to the clamav policy module
|
|
Changes to the mrtg policy module
|
|
Changes to the munin policy module
|
|
Changes to the amavis policy module
|
|
Changes to the ppp policy module
|
|
Initial jockey policy module
|
|
Module version bumps for "several named transition for directories
|
|
created in /var/run by initscripts" in various modules by Laurent
|
|
Bigonville
|
|
Module version bumps for fixes in various modules by Laurent Bigonville
|
|
Module version bump for changes to the consolekit policy module by
|
|
Laurent Bigonville
|
|
Changes to the stunnel policy module
|
|
Module version bumps for fixes in various modules by Sven Vermeulen
|
|
Changes to the virt policy module
|
|
Changes to the apache policy module
|
|
Changes to the wm policy module
|
|
Changes to the samba policy module
|
|
Changes to the certmonger policy module
|
|
Changes to the mozilla policy module
|
|
Changes to the corosync policy module
|
|
Changes to the pacemaker policy module
|
|
Changes to the tuned policy module
|
|
Changes to the cups module and relevant dependencies
|
|
Changes to the rhsmcertd policy module
|
|
Changes to the lpd policy module
|
|
Changes to the munin policy module
|
|
Changes to the ntp policy module
|
|
Changes to the tor policy module
|
|
Changes to the firewalld policy module
|
|
Changes to the dspam policy module
|
|
Changes to the setroubleshoot policy module
|
|
Changes to the condor policy module
|
|
Changes to the kerberos policy module
|
|
Changes to the passenger policy module
|
|
Changes to the ppp policy module
|
|
Changes to the the dkim policy module
|
|
Changes to the abrt policy module
|
|
Changes to the lircd policy module
|
|
Changes to the dkim policy module
|
|
Changes to the virt policy module
|
|
Changes to the munin policy module
|
|
Changes to the dovecot policy module
|
|
Changes to the cobbler policy module
|
|
Changes to the userhelper policy module
|
|
Changes to the logwatch policy module
|
|
Changes to the wdmd policy module and relevant dependencies
|
|
Changes to the nscd policy module and relevant dependencies
|
|
Changes to the dbus policy module
|
|
Module version bumps for fixes in various policy modules by Laurent
|
|
Bigonville
|
|
Changes to the cups policy module
|
|
Changes to the dbus policy module
|
|
Changes to the apcupsd policy module
|
|
Remove redundant net_bind_service capabilities in various modules
|
|
Changes to the virt policy module
|
|
Changes to the puppet policy module
|
|
Module version bumps for fixes in various policy module by Sven
|
|
Vermeulen
|
|
Module version bumps for file context fixes in various policy modules by
|
|
Laurent Bigonville
|
|
Make httpd_manage_all_user_content() do what it advertises
|
|
Add more networking rules to mplayer policy module for compatibility
|
|
Fix fcronsighup file context. Should be crontab_exec_t as per previous
|
|
spec
|
|
Module version bumps for changes in various modules by Sven Vermeulen
|
|
Move asterisk_exec() and modify XML header
|
|
Consolekit creates /var/run/console directories with a type transition
|
|
unconditionally
|
|
Module version bump in consolekit policy module for changes by Sven
|
|
Vermeulen
|
|
The imaplogin executable file should be courier_pop_exec_t according to
|
|
existing file context specification
|
|
Module version bump for changes to the fail2ban policy module by Sven
|
|
Vermeulen
|
|
Modules version bumps for changes in various policy modules by Sven
|
|
Vermeulen
|
|
|
|
Laurent Bigonville (28):
|
|
Add Debian locations for Telepathy connection managers
|
|
Label telepathy-rakia as telepathy-sofiasip
|
|
Allow smartd daemon to write in /var/lib/smartmontools directory
|
|
Add Debian location for smartd daemon initscript
|
|
Add Debian location for accounts-daemon daemon
|
|
Add Debian location for rtkit-daemon daemon
|
|
Add Debian location for tcsd init script
|
|
Add Debian location for libvirtd init script
|
|
Add Debian location for evolution executables
|
|
Add Debian locationis for nut executables and configuration files
|
|
Add several named transition for directories created in /var/run by
|
|
initscripts
|
|
Run packagekit under apt_t context on Debian distribution
|
|
Add proper label for colord daemon in debian
|
|
Allow the system dbus to search cgroup directories
|
|
Allow virtd_t context to read sysctl_crypto_t
|
|
Allow colord_t context to read sysctl_crypto_t
|
|
Add proper label for gconfd-2 daemon in Debian
|
|
Ensure that consolekit can create /var/run/console directory on Debian
|
|
Properly label nm-dispatcher.action on Debian
|
|
policykit.fc: Properly label polkit-agent-helper-1 on Debian
|
|
cups.fc: Properly label cups-pk-helper-mechanism on Debian
|
|
Allow pcscd the fsetid capability
|
|
Allow networkmanager_t to read crypto_sysctl_t
|
|
Allow virsh_t context to read sysctl_crypto_t
|
|
Allow cupsd_t to read cupsd_log_t
|
|
gnomeclock.fc: Properly label gsd-datetime-mechanism in Debian
|
|
ptchown.fc: Properly label pt_chown executable in Debian
|
|
Label /usr/bin/kvm as qemu_exec_t
|
|
|
|
Matthew Thode (2):
|
|
added autofs support and nsswitch support
|
|
removing refrences to named_var_lib_t as it doesn't exist anymore for
|
|
bind.if
|
|
|
|
Mika Pflüger (3):
|
|
Allow saslauthd_t to talk to mysqld via TCP
|
|
Quota policy adjustments: * Allow quota_t to load kernel modules
|
|
Debian locations for dovecot deliver and dovecot auth.
|
|
|
|
Russell Coker (1):
|
|
Fix djbdns ports
|
|
|
|
Sven Vermeulen (75):
|
|
Update with new substitutions
|
|
Mark the pid directory as a pid directory
|
|
Add in transitions for queue types when the queues are created
|
|
Fix typo in interface postfix_exec_postqueue
|
|
Allow maildelivery to use dotlock files in the mail spool
|
|
Allow postfix local to change ownership of mailfiles
|
|
Use libexec location for postfix binaries
|
|
Allow initrc_t to create run dirs for contrib modules
|
|
Update logwatch location in file context
|
|
Sandbox is an inherent part of the portage inner workings
|
|
Fix startup issue with fail2ban-client
|
|
Be able to get output from fail2ban-client
|
|
Ignore searches when ran from the user home directory
|
|
Shorewall admins execute shorewall too
|
|
Shorewall needs sys_admin capability for manipulating network stack
|
|
Be able to display dovecot errors
|
|
Remove transition to ldconfig
|
|
Adding interfaces for handling cron log files
|
|
Fail2ban client checks state of log files before telling the server
|
|
Support mysql init script
|
|
Support initial creation of mysql database files
|
|
Portage fetch domain needs to access certificates
|
|
Make samba domtrans optional in virt
|
|
Fix typo in tunable declaration for fcron_crond
|
|
Introducing cron_manage_log_files interface
|
|
Introduce dontaudit interfaces for leaked fd and unix stream sockets
|
|
Dontaudit attempts by system_mail_t to use leaked fd or stream sockets
|
|
Support at service
|
|
Additional postfix admin requirements
|
|
Reintroduce postfix_var_run_t for pid directory and fowner capability
|
|
Postfix deferred queue should not mark mails as postfix_spool_maildrop_t
|
|
Running qemu with SDL support requires more xserver-related privileges
|
|
Fix typo in clockspeed comment
|
|
Support openvpn status file
|
|
Asterisk voicemail messages are generated from tmp
|
|
Make rtkit calls optional
|
|
Gentoo installs dovecot certs in /etc/ssl/dovecot
|
|
Moving sandbox code to sandbox section (v2)
|
|
Allow sandbox to log violations
|
|
Use rw_fifo_file_perms
|
|
Apache should not depend on gpg
|
|
Named init script creates rundir
|
|
Add ~/.maildir as a valid maildir destination
|
|
Support stunnel_read_config for startup
|
|
Updates on stunnel policy
|
|
More .maildir fixes
|
|
Mark make.profile entry as portage_conf_t (v2)
|
|
Move mta call (coding style)
|
|
Changes to puppet domain
|
|
Allow rpc admin to run exportfs
|
|
Grant sys_admin capability to puppet
|
|
Puppet module helper scripts are puppet_var_lib_t
|
|
Support netlink_route_socket creation for puppet
|
|
Puppet initscript creates /run/puppet
|
|
Puppet runs statfs against selinuxfs
|
|
mplayer streams HTTP resources
|
|
fcron and fcronsighup binaries are moved
|
|
Asterisk needs to search through logs
|
|
Denial in mail log on node bind
|
|
Fix typo in mcelog_admin (missing bracket)
|
|
Add in contexts for fcron rm.systab and systab.tmp
|
|
Remove pulseaudio filename_trans conflict
|
|
Allow asterisk admins to execute asterisk binary directly
|
|
Support tagfiles for consolekit
|
|
ConsoleKit needs to read the dbus machine-id
|
|
File context updates for courier-imap
|
|
Update on file contexts for OpenLDAP
|
|
Update on file contexts for wpa_supplicant
|
|
Allow IRC clients to read certificates
|
|
Allow reading /proc/self for fail2ban due to FAM support
|
|
Update file contexts for puppet
|
|
Support ~/.tmux.conf as tmux configuration file
|
|
Add setuid/setgid capability to ulogd_t
|
|
Support tmux control socket
|
|
Postfix creates defer(red) queue locations
|
|
|