Update Changelog and VERSION for release 2.20210203.
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
This commit is contained in:
Chris PeBenito
parent
ff983a6239
commit
11612378e7
193
Changelog
193
Changelog
@ -1,3 +1,196 @@
|
|||||||
|
* Wed Feb 03 2021 Chris PeBenito <pebenito@ieee.org> - 2.20210203
|
||||||
|
(GalaxyMaster) (1):
|
||||||
|
added policy for systemd-socket-proxyd
|
||||||
|
|
||||||
|
0xC0ncord (1):
|
||||||
|
userdomain, xserver: move xdg rules to userdom_xdg_user_template
|
||||||
|
|
||||||
|
Anthony PERARD (1):
|
||||||
|
xen: Allow xenstored to map /proc/xen/xsd_kva
|
||||||
|
|
||||||
|
Antoine Tenart (15):
|
||||||
|
udev: allow udevadm to retrieve xattrs
|
||||||
|
locallogin: allow login to get attributes of procfs
|
||||||
|
logging: allow systemd-journal to write messages to the audit socket
|
||||||
|
sysnetwork: allow to read network configuration files
|
||||||
|
dbus: add two interfaces to allow reading from directories and named
|
||||||
|
sockets
|
||||||
|
dbus: allow clients to list runtime dirs and named sockets
|
||||||
|
systemd: add extra systemd_generator_t rules
|
||||||
|
systemd: allow systemd-hwdb to search init runtime directories
|
||||||
|
systemd: allow systemd-network to get attributes of fs
|
||||||
|
systemd: allow systemd-resolve to read in tmpfs
|
||||||
|
corecommands: add entry for Busybox shell
|
||||||
|
systemd: allow systemd-getty-generator to read and write unallocated ttys
|
||||||
|
systemd: allow systemd-network to list the runtime directory
|
||||||
|
ntp: allow systemd-timesyn to watch dbus objects
|
||||||
|
ntp: allow systemd-timesyn to setfscreate
|
||||||
|
|
||||||
|
Chris PeBenito (117):
|
||||||
|
Merge branch 'acpid_shutdown' of https://github.com/jpds/refpolicy into
|
||||||
|
jpds-acpid_shutdown
|
||||||
|
.travis.yml: Point selint at only the policy dir.
|
||||||
|
corecommands, dbus, locallogin, logging, sysnetwork, systemd, udev: Module
|
||||||
|
version bump.
|
||||||
|
systemd: Move systemd-pstore block up in alphabetical order.
|
||||||
|
Switch to GitHub actions for CI actions.
|
||||||
|
systemd: Whitespace changes.
|
||||||
|
systemd: Rename systemd_connectto_socket_proxyd_unix_sockets() to
|
||||||
|
systemd_stream_connect_socket_proxyd().
|
||||||
|
Drop criteria on github actions.
|
||||||
|
userdomain: Fix error in calling userdom_xdg_user_template().
|
||||||
|
systemd: Add systemd-tty-ask watch for /run/systemd/ask-password.
|
||||||
|
Makefile: Add -E to setfiles labeling targets.
|
||||||
|
udev: Drop udev_tbl_t.
|
||||||
|
udev: Systemd 246 merged udev and udevadm executables.
|
||||||
|
devicekit: Udisks uses udevadm, it does not exec udev.
|
||||||
|
Remove modules for programs that are deprecated or no longer supported.
|
||||||
|
chromium: Whitespace changes.
|
||||||
|
chromium: Move naclhelper lines.
|
||||||
|
certbot: Whitespace changes.
|
||||||
|
certbot: Drop aliases since they have never had the old names in
|
||||||
|
refpolicy.
|
||||||
|
certbot: Reorder fc lines.
|
||||||
|
miscfiles: Rename miscfiles_manage_generic_tls_privkey_lnk_files.
|
||||||
|
userdomain: Move lines.
|
||||||
|
certbot: Fix lint issues.
|
||||||
|
memlockd: Move lines.
|
||||||
|
memlockd: Whitespace fixes.
|
||||||
|
memlockd: Fix lint issue.
|
||||||
|
file_patterns.spt: Add a mmap_manage_files_pattern().
|
||||||
|
apache, mysql, postgrey, samba, squid: Apply new
|
||||||
|
mmap_manage_files_pattern().
|
||||||
|
devicekit, jabber, samba: Move lines.
|
||||||
|
cron: Make backup call for system_cronjob_t optional.
|
||||||
|
samba: Fix samba_runtime_t alias use.
|
||||||
|
samba: Move service interface definitions.
|
||||||
|
sysnetwork: Merge dhcpc_manage_samba tunable block with existing samba
|
||||||
|
block.
|
||||||
|
samba: Add missing userspace class requirements in unit interfaces.
|
||||||
|
apache: Fix lint error.
|
||||||
|
apache: Really fix lint error.
|
||||||
|
aptcacher: Drop broken config interfaces.
|
||||||
|
samba: Fix lint error.
|
||||||
|
0xC0ncord/feature/sudodomain_http_connect_boolean
|
||||||
|
0xC0ncord/bugfix/systemd_system_custom_unit_fc
|
||||||
|
dpkg, aptcatcher, milter, mysql, systemd: Rename interfaces.
|
||||||
|
apt, bootloader: Move lines.
|
||||||
|
systemd: Move lines.
|
||||||
|
systemd: Fix lint errors.
|
||||||
|
systemd: Rename systemd_use_machined_devpts().
|
||||||
|
Bump module versions for release.
|
||||||
|
|
||||||
|
Christian Göttsche (16):
|
||||||
|
postfixpolicyd: split multi-class rule
|
||||||
|
init/systemd: allow systemd to map the SELinux status page
|
||||||
|
selinux: add selinux_use_status_page and deprecate
|
||||||
|
selinux_map_security_files
|
||||||
|
genhomedircon: drop backwards compatibility section
|
||||||
|
genhomedircon: require match for home directory name
|
||||||
|
genhomedircon: drop unused functions
|
||||||
|
genhomedircon: generate file contexts for %{USERNAME} and %{USERID}
|
||||||
|
genhomedircon: misc pylint cleanup
|
||||||
|
genhomedircon: improve error messages for min uid search
|
||||||
|
Rules.monolithic: ignore version mismatch
|
||||||
|
gitignore: ignore monolithic generated files
|
||||||
|
Preset OUTPUT_POLICY to 32
|
||||||
|
Rules.monolithic: do not suppress load_policy warning messages
|
||||||
|
Rules.monolithic: tweak checkpolicy arguments
|
||||||
|
Rules.monolithic: drop dead variable
|
||||||
|
Rules.monolithic: add missing phony declarations
|
||||||
|
|
||||||
|
Daniel Burgener (4):
|
||||||
|
Allow init to mount over the system bus
|
||||||
|
Allow systemd-ask-password to watch files
|
||||||
|
Use self keyword when an AV rule source type matches destination
|
||||||
|
Fix typo in comment
|
||||||
|
|
||||||
|
Dannick Pomerleau (1):
|
||||||
|
access_vectors: Add new capabilities to cap2
|
||||||
|
|
||||||
|
Dave Sugar (9):
|
||||||
|
Looks like this got dropped in pull request #294
|
||||||
|
Allow snmpd to read hwdata
|
||||||
|
Updates for corosync to work in enforcing
|
||||||
|
To get pacemaker working in enforcing
|
||||||
|
pacemaker systemd permissions
|
||||||
|
Allow pacemaker to map/read/write corosync shared memory files
|
||||||
|
Allow systemd-modules-load to search kernel keys
|
||||||
|
pcs_snmpd_agent_t fix denials to allow it to read needed queues
|
||||||
|
Work with xdg module disabled
|
||||||
|
|
||||||
|
David Schadlich (1):
|
||||||
|
add policy for pcs_snmp_agent
|
||||||
|
|
||||||
|
Deepak Rawat (1):
|
||||||
|
Add selinux-policy for systemd-pstore service
|
||||||
|
|
||||||
|
Dominick Grift (1):
|
||||||
|
bind: add a few fc specs for unbound
|
||||||
|
|
||||||
|
Guido Trentalancia (1):
|
||||||
|
Add LVM module permissions needed to open cryptsetup devices.
|
||||||
|
|
||||||
|
Jason Zaman (5):
|
||||||
|
userdomain: Add watch on home dirs
|
||||||
|
getty: allow watching file /run/agetty.reload
|
||||||
|
Add transition on gentoo init_t to openrc
|
||||||
|
init: upstream fcontexts from gentoo policy
|
||||||
|
systemd: make remaining dbus_* optional
|
||||||
|
|
||||||
|
Jonathan Davies (8):
|
||||||
|
acpi.te: Allow acpid_t to shutdown the system - this is required to handle
|
||||||
|
shutdown calls from libvirt. Fixes #298.
|
||||||
|
acpi.te: Removed unnecessary init_write_initctl().
|
||||||
|
userdomain.if: Marked usbguard user modify tunable as optional so usbguard
|
||||||
|
may be excluded.
|
||||||
|
portage: Added /var/cache/distfiles path.
|
||||||
|
init: Added fcontext for openrc-init.
|
||||||
|
init: Added fcontext for openrc-shutdown.
|
||||||
|
apps/screen.fc: Added fcontext for tmux xdg directory.
|
||||||
|
apps/screen.te: Allow screen to search xdg directories.
|
||||||
|
|
||||||
|
Kenton Groombridge (11):
|
||||||
|
devices: add interface for IOCTL on input devices
|
||||||
|
virt: add boolean to allow evdev passthrough
|
||||||
|
stunnel: add log type and rules
|
||||||
|
fail2ban: allow reading systemd journal
|
||||||
|
spamassassin: add rspamd support and tunable
|
||||||
|
apache: add interface for list dir perms on httpd content
|
||||||
|
sudo: add tunable for HTTP connections
|
||||||
|
init: label systemd units in /etc
|
||||||
|
certbot: add support for acme.sh
|
||||||
|
lvm: add lvm_tmpfs_t type and rules
|
||||||
|
Various fixes
|
||||||
|
|
||||||
|
Peter Morrow (1):
|
||||||
|
selinux: add selinux_get_all_booleans() interface
|
||||||
|
|
||||||
|
Richard Haines (1):
|
||||||
|
Ensure correct monolithic binary policy is loaded
|
||||||
|
|
||||||
|
Russell Coker (11):
|
||||||
|
base chrome/chromium patch fixed
|
||||||
|
latest iteration of certbot policy as patch
|
||||||
|
yet more strict patches fixed
|
||||||
|
remove deprecated from 20190201
|
||||||
|
more Chrome stuff
|
||||||
|
latest memlockd patch
|
||||||
|
misc services patches with changes Dominick and Chris wanted
|
||||||
|
misc network patches with Dominick's changes*2
|
||||||
|
new version of filetrans patch
|
||||||
|
misc apps and admin patches
|
||||||
|
machined
|
||||||
|
|
||||||
|
Yi Zhao (1):
|
||||||
|
sysnet: allow dhcpcd to create socket file
|
||||||
|
|
||||||
|
bauen1 (4):
|
||||||
|
systemd: private type for /run/systemd/userdb
|
||||||
|
authlogin: connect to userdb
|
||||||
|
systemd-logind: utilize nsswitch
|
||||||
|
selint: fix S-010
|
||||||
|
|
||||||
* Tue Aug 18 2020 Chris PeBenito <pebenito@ieee.org> - 2.20200818
|
* Tue Aug 18 2020 Chris PeBenito <pebenito@ieee.org> - 2.20200818
|
||||||
Alexander Miroshnichenko (2):
|
Alexander Miroshnichenko (2):
|
||||||
openvpn: more versatile file context regex for ipp.txt
|
openvpn: more versatile file context regex for ipp.txt
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user