%define distro redhat

%define polyinstatiate n

%define monolithic n

%if %{?BUILD_TARGETED:0}%{!?BUILD_TARGETED:1}

%define BUILD_TARGETED 1

%endif

%if %{?BUILD_MINIMUM:0}%{!?BUILD_MINIMUM:1}

%define BUILD_MINIMUM 1

%endif

%if %{?BUILD_OLPC:0}%{!?BUILD_OLPC:1}

%define BUILD_OLPC 0

%endif

%if %{?BUILD_MLS:0}%{!?BUILD_MLS:1}

%define BUILD_MLS 1

%endif

%define POLICYVER 23

%define libsepolver 2.0.20-1

%define POLICYCOREUTILSVER 2.0.60-7

%define CHECKPOLICYVER 2.0.16-3

Summary: SELinux policy configuration

Name: selinux-policy

Version: 3.6.2

Release: 4%{?dist}

License: GPLv2+

Group: System Environment/Base

Source: serefpolicy-%{version}.tgz

patch: policy-20090105.patch

Source1: modules-targeted.conf

Source2: booleans-targeted.conf

Source3: Makefile.devel

Source4: setrans-targeted.conf

Source5: modules-mls.conf

Source6: booleans-mls.conf	

Source8: setrans-mls.conf

Source9: modules-olpc.conf

Source10: booleans-olpc.conf	

Source11: setrans-olpc.conf

Source12: securetty_types-olpc

Source13: policygentool

Source14: securetty_types-targeted

Source15: securetty_types-mls

Source16: modules-minimum.conf

Source17: booleans-minimum.conf

Source18: setrans-minimum.conf

Source19: securetty_types-minimum

Url: http://serefpolicy.sourceforge.net

BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)

BuildArch: noarch

BuildRequires: python gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils >= %{POLICYCOREUTILSVER} bzip2

Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER} libsemanage >= 2.0.14-3

Requires(post): /usr/bin/bunzip2 /bin/mktemp

Requires: checkpolicy >= %{CHECKPOLICYVER} m4 

Obsoletes: selinux-policy-devel

Provides: selinux-policy-devel

%description 

SELinux Base package

%files 

%{_mandir}/*

%dir %{_usr}/share/selinux

%dir %{_usr}/share/selinux/devel

%dir %{_usr}/share/selinux/devel/include

%dir %{_sysconfdir}/selinux

%ghost %config(noreplace) %{_sysconfdir}/selinux/config

%ghost %{_sysconfdir}/sysconfig/selinux

%{_usr}/share/selinux/devel/include/*

%{_usr}/share/selinux/devel/Makefile

%{_usr}/share/selinux/devel/policygentool

%{_usr}/share/selinux/devel/example.*

%{_usr}/share/selinux/devel/policy.*

%package doc

Summary: SELinux policy documentation

Group: System Environment/Base

Requires(pre): selinux-policy = %{version}-%{release}

%description doc

SELinux policy documentation package

%files doc

%doc %{_usr}/share/doc/%{name}-%{version}

%attr(755,root,root) %{_usr}/share/selinux/devel/policyhelp

%check

/usr/bin/sepolgen-ifgen -i %{buildroot}%{_usr}/share/selinux/devel/include -o /dev/null

%define setupCmds() \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 bare \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024  conf \

cp -f $RPM_SOURCE_DIR/modules-%1.conf  ./policy/modules.conf \

cp -f $RPM_SOURCE_DIR/booleans-%1.conf ./policy/booleans.conf \

%define moduleList() %([ -f %{_sourcedir}/modules-%{1}.conf ] && \

awk '$1 !~ "/^#/" && $2 == "=" && $3 == "module" { printf "%%s.pp.bz2 ", $1 }' %{_sourcedir}/modules-%{1}.conf )

%define installCmds() \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 base.pp \

make validate UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 modules \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 install \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 install-appconfig \

#%{__cp} *.pp %{buildroot}/%{_usr}/share/selinux/%1/ \

%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/policy \

%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/modules/active \

%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/contexts/files \

touch %{buildroot}/%{_sysconfdir}/selinux/%1/modules/semanage.read.LOCK \

touch %{buildroot}/%{_sysconfdir}/selinux/%1/modules/semanage.trans.LOCK \

rm -rf %{buildroot}%{_sysconfdir}/selinux/%1/booleans \

touch %{buildroot}%{_sysconfdir}/selinux/%1/seusers \

touch %{buildroot}%{_sysconfdir}/selinux/%1/policy/policy.%{POLICYVER} \

touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts \

touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \

install -m0644 $RPM_SOURCE_DIR/securetty_types-%1 %{buildroot}%{_sysconfdir}/selinux/%1/contexts/securetty_types \

install -m0644 $RPM_SOURCE_DIR/setrans-%1.conf %{buildroot}%{_sysconfdir}/selinux/%1/setrans.conf \

echo -n > %{buildroot}%{_sysconfdir}/selinux/%1/contexts/customizable_types \

bzip2 %{buildroot}/%{_usr}/share/selinux/%1/*.pp

%nil

%define fileList() \

%defattr(-,root,root) \

%dir %{_usr}/share/selinux/%1 \

%{_usr}/share/selinux/%1/*.pp.bz2 \

%dir %{_sysconfdir}/selinux/%1 \

%config(noreplace) %{_sysconfdir}/selinux/%1/setrans.conf \

%ghost %{_sysconfdir}/selinux/%1/seusers \

%dir %{_sysconfdir}/selinux/%1/modules \

%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/semanage.read.LOCK \

%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/semanage.trans.LOCK \

%attr(700,root,root) %dir %{_sysconfdir}/selinux/%1/modules/active \

#%verify(not md5 size mtime) %attr(600,root,root) %config(noreplace) %{_sysconfdir}/selinux/%1/modules/active/seusers \

%dir %{_sysconfdir}/selinux/%1/policy/ \

%ghost %{_sysconfdir}/selinux/%1/policy/policy.* \

%dir %{_sysconfdir}/selinux/%1/contexts \

%config %{_sysconfdir}/selinux/%1/contexts/customizable_types \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/securetty_types \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/dbus_contexts \

%config %{_sysconfdir}/selinux/%1/contexts/x_contexts \

%config %{_sysconfdir}/selinux/%1/contexts/default_contexts \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/default_type \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/failsafe_context \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/initrc_context \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/removable_context \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/userhelper_context \

%dir %{_sysconfdir}/selinux/%1/contexts/files \

%ghost %{_sysconfdir}/selinux/%1/contexts/files/file_contexts \

%ghost %{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \

%config %{_sysconfdir}/selinux/%1/contexts/files/media \

%dir %{_sysconfdir}/selinux/%1/contexts/users \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/root \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/guest_u \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/xguest_u \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/user_u \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/staff_u 

%define saveFileContext() \

if [ -s /etc/selinux/config ]; then \

	. %{_sysconfdir}/selinux/config; \

	FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \

	if [ "${SELINUXTYPE}" == %1 -a -f ${FILE_CONTEXT} ]; then \

		cp -f ${FILE_CONTEXT} ${FILE_CONTEXT}.pre; \

	fi \

fi

%define loadminpolicy() \

( cd /usr/share/selinux/%1; \

semodule -b base.pp.bz2 -i unconfined.pp.bz2 -s %1; \

); \

%define loadpolicy() \

( cd /usr/share/selinux/%1; \

semodule -b base.pp.bz2 -i %{expand:%%moduleList %1} -s %1; \

); \

%define relabel() \

. %{_sysconfdir}/selinux/config; \

FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \

selinuxenabled; \

if [ $? == 0  -a "${SELINUXTYPE}" == %1 -a -f ${FILE_CONTEXT}.pre ]; then \

	fixfiles -C ${FILE_CONTEXT}.pre restore; \

	restorecon -R /var/log /var/run 2> /dev/null; \

	rm -f ${FILE_CONTEXT}.pre; \

fi; 

%description

SELinux Reference Policy - modular.

Based off of reference policy: Checked out revision  2882.

%build

%prep 

%setup -n serefpolicy-%{version} -q

%patch -p1

%install

# Build targeted policy

%{__rm} -fR %{buildroot}

mkdir -p %{buildroot}%{_mandir}

cp -R  man/* %{buildroot}%{_mandir}

mkdir -p %{buildroot}%{_sysconfdir}/selinux

mkdir -p %{buildroot}%{_sysconfdir}/sysconfig

touch %{buildroot}%{_sysconfdir}/selinux/config

touch %{buildroot}%{_sysconfdir}/sysconfig/selinux

# Always create policy module package directories

mkdir -p %{buildroot}%{_usr}/share/selinux/{targeted,mls}/

# Install devel

make clean

%if %{BUILD_TARGETED}

# Build targeted policy

# Commented out because only targeted ref policy currently builds

%setupCmds targeted mcs n y allow

%installCmds targeted mcs n y allow

%endif

%if %{BUILD_MINIMUM}

# Build minimum policy

# Commented out because only minimum ref policy currently builds

%setupCmds minimum mcs n y allow

%installCmds minimum mcs n y allow

%endif

%if %{BUILD_MLS}

# Build mls policy

%setupCmds mls mls n y deny

%installCmds mls mls n y deny

%endif

%if %{BUILD_OLPC}

# Build olpc policy

# Commented out because only olpc ref policy currently builds

%setupCmds olpc mcs n y allow

%installCmds olpc mcs n y allow

%endif

make UNK_PERMS=allow NAME=targeted TYPE=targeted-mcs DISTRO=%{distro} UBAC=n DIRECT_INITRC=n MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} PKGNAME=%{name}-%{version} POLY=y MLS_CATS=1024 MCS_CATS=1024 install-headers install-docs

mkdir %{buildroot}%{_usr}/share/selinux/devel/

mv %{buildroot}%{_usr}/share/selinux/targeted/include %{buildroot}%{_usr}/share/selinux/devel/include

install -m 755 $RPM_SOURCE_DIR/policygentool %{buildroot}%{_usr}/share/selinux/devel/

install -m 644 $RPM_SOURCE_DIR/Makefile.devel %{buildroot}%{_usr}/share/selinux/devel/Makefile

install -m 644 doc/example.* %{buildroot}%{_usr}/share/selinux/devel/

install -m 644 doc/policy.* %{buildroot}%{_usr}/share/selinux/devel/

echo  "xdg-open file:///usr/share/doc/selinux-policy-%{version}/html/index.html"> %{buildroot}%{_usr}/share/selinux/devel/policyhelp

chmod +x %{buildroot}%{_usr}/share/selinux/devel/policyhelp

%clean

%{__rm} -fR %{buildroot}

%post

if [ ! -s /etc/selinux/config ]; then

	#

	#	New install so we will default to targeted policy

	#

	echo "

# This file controls the state of SELinux on the system.

# SELINUX= can take one of these three values:

#	enforcing - SELinux security policy is enforced.

#	permissive - SELinux prints warnings instead of enforcing.

#	disabled - No SELinux policy is loaded.

SELINUX=enforcing

# SELINUXTYPE= can take one of these two values:

#	targeted - Targeted processes are protected,

#	mls - Multi Level Security protection.

SELINUXTYPE=targeted 

" > /etc/selinux/config

	ln -sf ../selinux/config /etc/sysconfig/selinux 

	restorecon /etc/selinux/config 2> /dev/null || :

else

	. /etc/selinux/config

	# if first time update booleans.local needs to be copied to sandbox

	[ -f /etc/selinux/${SELINUXTYPE}/booleans.local ] && mv /etc/selinux/${SELINUXTYPE}/booleans.local /etc/selinux/targeted/modules/active/

	[ -f /etc/selinux/${SELINUXTYPE}/seusers ] && cp -f /etc/selinux/${SELINUXTYPE}/seusers /etc/selinux/${SELINUXTYPE}/modules/active/seusers

	grep -q "^SETLOCALDEFS" /etc/selinux/config || echo -n "

">> /etc/selinux/config

fi

[ -x /usr/bin/sepolgen-ifgen ] && /usr/bin/sepolgen-ifgen 

exit 0

%postun

if [ $1 = 0 ]; then

	setenforce 0 2> /dev/null

	if [ ! -s /etc/selinux/config ]; then

		echo "SELINUX=disabled" > /etc/selinux/config

	else

		sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config

	fi

fi

exit 0

%if %{BUILD_TARGETED}

%package targeted

Summary: SELinux targeted base policy

Provides: selinux-policy-base

Group: System Environment/Base

Obsoletes: selinux-policy-targeted-sources < 2

Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}

Requires(pre): coreutils

Requires(pre): selinux-policy = %{version}-%{release}

Conflicts:  audispd-plugins <= 1.7.7-1

Obsoletes: mod_fcgid-selinux

%description targeted

SELinux Reference policy targeted base module.

%pre targeted

%saveFileContext targeted

%post targeted

if [ $1 -eq 1 ]; then

%loadpolicy targeted

#semanage -S targeted -i - << __eof

#login -m  -s unconfined_u -r s0-s0:c0.c1023 __default__

#login -m  -s unconfined_u -r s0-s0:c0.c1023 root

#__eof

restorecon -R /root /var/log /var/run 2> /dev/null

else

semodule -n -s targeted -r moilscanner  -r gamin -r audio_entropy -r iscsid 2>/dev/null

%loadpolicy targeted

%relabel targeted

fi

exit 0

%triggerpostun targeted -- selinux-policy-targeted < 3.2.5-9.fc9

. /etc/selinux/config

[ "${SELINUXTYPE}" != "targeted" ] && exit 0

setsebool -P use_nfs_home_dirs=1

semanage user -l | grep -s unconfined_u > /dev/null

if [ $? -eq 0 ]; then

   semanage user -m -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u

else

   semanage user -a -P user -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u

fi

seuser=`semanage login -l | grep __default__ | awk '{ print $2 }'`

[ "$seuser" != "unconfined_u" ]  && semanage login -m -s "unconfined_u"  -r s0-s0:c0.c1023 __default__

seuser=`semanage login -l | grep root | awk '{ print $2 }'`

[ "$seuser" == "system_u" ] && semanage login -m -s "unconfined_u"  -r s0-s0:c0.c1023 root

restorecon -R /root /etc/selinux/targeted 2> /dev/null

semodule -r qmail 2> /dev/null

exit 0

%files targeted

%config(noreplace) %{_sysconfdir}/selinux/targeted/contexts/users/unconfined_u

%fileList targeted

%endif

%if %{BUILD_MINIMUM}

%package minimum

Summary: SELinux minimum base policy

Provides: selinux-policy-base

Group: System Environment/Base

Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}

Requires(pre): coreutils

Requires(pre): selinux-policy = %{version}-%{release}

%description minimum

SELinux Reference policy minimum base module.

%pre minimum

%saveFileContext minimum

%post minimum

if [ $1 -eq 1 ]; then

%loadminpolicy minimum

semanage -S minimum -i - << __eof

user -a -P user -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u 

__eof

semanage -S minimum -i - << __eof

login -m  -s unconfined_u -r s0-s0:c0.c1023 __default__

login -m  -s unconfined_u -r s0-s0:c0.c1023 root

__eof

restorecon -R /root /var/log /var/run 2> /dev/null

else

%loadminpolicy minimum

%relabel minimum

fi

exit 0

%files minimum

%config(noreplace) %{_sysconfdir}/selinux/minimum/contexts/users/unconfined_u

%fileList minimum

%endif

%if %{BUILD_OLPC}

%package olpc 

Summary: SELinux olpc base policy

Group: System Environment/Base

Provides: selinux-policy-base

Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}

Requires(pre): coreutils

Requires(pre): selinux-policy = %{version}-%{release}

%description olpc 

SELinux Reference policy olpc base module.

%pre olpc 

%saveFileContext olpc

%post olpc 

%loadpolicy olpc

if [ $1 -ne 1 ]; then

%relabel olpc

fi

exit 0

%files olpc

%fileList olpc

%endif

%if %{BUILD_MLS}

%package mls 

Summary: SELinux mls base policy

Group: System Environment/Base

Provides: selinux-policy-base

Obsoletes: selinux-policy-mls-sources < 2

Requires: policycoreutils-newrole >= %{POLICYCOREUTILSVER} setransd

Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}

Requires(pre): coreutils

Requires(pre): selinux-policy = %{version}-%{release}

%description mls 

SELinux Reference policy mls base module.

%pre mls 

%saveFileContext mls

%post mls 

%loadpolicy mls

if [ $1 != 1 ]; then

%relabel mls

fi

exit 0

%files mls

%config(noreplace) %{_sysconfdir}/selinux/mls/contexts/users/unconfined_u

%fileList mls

%endif

%changelog

* Mon Jan 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.2-4

- Fixes for reading xserver_tmp_t

* Thu Jan 8 2009 Dan Walsh <dwalsh@redhat.com> 3.6.2-3

- Allow cups_pdf_t write to nfs_t

* Tue Jan 6 2009 Dan Walsh <dwalsh@redhat.com> 3.6.2-2

- Remove audio_entropy policy

* Mon Jan 5 2009 Dan Walsh <dwalsh@redhat.com> 3.6.2-1

- Update to upstream

* Sun Jan 4 2009 Dan Walsh <dwalsh@redhat.com> 3.6.1-15

- Allow hal_acl_t to getattr/setattr fixed_disk

* Sat Dec 27 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-14

- Change userdom_read_all_users_state to include reading symbolic links in /proc

* Mon Dec 22 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-13

- Fix dbus reading /proc information

* Thu Dec 18 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-12

- Add missing alias for home directory content

* Wed Dec 17 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-11

- Fixes for IBM java location

* Thu Dec 11 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-10

- Allow unconfined_r unconfined_java_t

* Tue Dec 9 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-9

- Add cron_role back to user domains

* Mon Dec 8 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-8

- Fix sudo setting of user keys

* Thu Dec 4 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-7

- Allow iptables to talk to terminals

- Fixes for policy kit

- lots of fixes for booting. 

* Wed Dec 3 2008 Dan Walsh <dwalsh@redhat.com> 3.6.1-4

- Cleanup policy

* Mon Dec 01 2008 Ignacio Vazquez-Abrams <ivazqueznet+rpm@gmail.com> - 3.6.1-2

- Rebuild for Python 2.6

* Fri Nov 5 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-19

- Fix labeling on /var/spool/rsyslog

* Thu Nov 5 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-18

- Allow postgresl to bind to udp nodes

* Wed Nov 5 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-17

- Allow lvm to dbus chat with hal

- Allow rlogind to read nfs_t 

* Wed Nov 5 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-16

- Fix cyphesis file context

* Tue Nov 3 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-15

- Allow hal/pm-utils to look at /var/run/video.rom

- Add ulogd policy

* Tue Nov 3 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-14

- Additional fixes for cyphesis

- Fix certmaster file context

- Add policy for system-config-samba

- Allow hal to read /var/run/video.rom

* Mon Nov 3 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-13

- Allow dhcpc to restart ypbind

- Fixup labeling in /var/run

* Thu Oct 30 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-12

- Add certmaster policy

* Wed Oct 29 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-11

- Fix confined users 

- Allow xguest to read/write xguest_dbusd_t

* Mon Oct 27 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-9

- Allow openoffice execstack/execmem privs

* Fri Oct 24 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-8

- Allow mozilla to run with unconfined_execmem_t

* Thu Oct 23 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-7

- Dontaudit domains trying to write to .xsession-errors

* Thu Oct 23 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-6

- Allow nsplugin to look at autofs_t directory

* Wed Oct 22 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-5

- Allow kerneloops to create tmp files

* Wed Oct 22 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-4

- More alias for fastcgi

* Tue Oct 21 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-3

- Remove mod_fcgid-selinux package

* Mon Oct 20 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-2

- Fix dovecot access

* Fri Oct 17 2008 Dan Walsh <dwalsh@redhat.com> 3.5.13-1

- Policy cleanup 

* Thu Oct 16 2008 Dan Walsh <dwalsh@redhat.com> 3.5.12-3

- Remove Multiple spec

- Add include

- Fix makefile to not call per_role_expansion

* Wed Oct 15 2008 Dan Walsh <dwalsh@redhat.com> 3.5.12-2

- Fix labeling of libGL

* Fri Oct 10 2008 Dan Walsh <dwalsh@redhat.com> 3.5.12-1

- Update to upstream

* Wed Oct 8 2008 Dan Walsh <dwalsh@redhat.com> 3.5.11-1

- Update to upstream policy

* Mon Oct 6 2008 Dan Walsh <dwalsh@redhat.com> 3.5.10-3

- Fixes for confined xwindows and xdm_t 

* Fri Oct 3 2008 Dan Walsh <dwalsh@redhat.com> 3.5.10-2

- Allow confined users and xdm to exec wm

- Allow nsplugin to talk to fifo files on nfs

* Fri Oct 3 2008 Dan Walsh <dwalsh@redhat.com> 3.5.10-1

- Allow NetworkManager to transition to avahi and iptables

- Allow domains to search other domains keys, coverup kernel bug

* Wed Oct 1 2008 Dan Walsh <dwalsh@redhat.com> 3.5.9-4

- Fix labeling for oracle 

* Wed Oct 1 2008 Dan Walsh <dwalsh@redhat.com> 3.5.9-3

- Allow nsplugin to comminicate with xdm_tmp_t sock_file

* Mon Sep 29 2008 Dan Walsh <dwalsh@redhat.com> 3.5.9-2

- Change all user tmpfs_t files to be labeled user_tmpfs_t

- Allow radiusd to create sock_files

* Wed Sep 24 2008 Dan Walsh <dwalsh@redhat.com> 3.5.9-1

- Upgrade to upstream

* Tue Sep 23 2008 Dan Walsh <dwalsh@redhat.com> 3.5.8-7

- Allow confined users to login with dbus

* Mon Sep 22 2008 Dan Walsh <dwalsh@redhat.com> 3.5.8-6

- Fix transition to nsplugin

* Mon Sep 22 2008 Dan Walsh <dwalsh@redhat.com> 3.5.8-5

- Add file context for /dev/mspblk.*

* Sun Sep 21 2008 Dan Walsh <dwalsh@redhat.com> 3.5.8-4

- Fix transition to nsplugin

'

* Thu Sep 18 2008 Dan Walsh <dwalsh@redhat.com> 3.5.8-3

- Fix labeling on new pm*log

- Allow ssh to bind to all nodes

* Thu Sep 11 2008 Dan Walsh <dwalsh@redhat.com> 3.5.8-1

- Merge upstream changes

- Add Xavier Toth patches

* Wed Sep 10 2008 Dan Walsh <dwalsh@redhat.com> 3.5.7-2

- Add qemu_cache_t for /var/cache/libvirt

* Fri Sep 5 2008 Dan Walsh <dwalsh@redhat.com> 3.5.7-1

- Remove gamin policy

* Thu Sep 4 2008 Dan Walsh <dwalsh@redhat.com> 3.5.6-2

- Add tinyxs-max file system support

* Wed Sep 3 2008 Dan Walsh <dwalsh@redhat.com> 3.5.6-1

- Update to upstream

- 	 New handling of init scripts

* Fri Aug 29 2008 Dan Walsh <dwalsh@redhat.com> 3.5.5-4

- Allow pcsd to dbus

- Add memcache policy

* Fri Aug 29 2008 Dan Walsh <dwalsh@redhat.com> 3.5.5-3

- Allow audit dispatcher to kill his children

* Tue Aug 26 2008 Dan Walsh <dwalsh@redhat.com> 3.5.5-2

- Update to upstream

- Fix crontab use by unconfined user

* Tue Aug 12 2008 Dan Walsh <dwalsh@redhat.com> 3.5.4-2

- Allow ifconfig_t to read dhcpc_state_t

* Mon Aug 11 2008 Dan Walsh <dwalsh@redhat.com> 3.5.4-1

- Update to upstream

* Thu Aug 7 2008 Dan Walsh <dwalsh@redhat.com> 3.5.3-1

- Update to upstream 

* Wed Aug 2 2008 Dan Walsh <dwalsh@redhat.com> 3.5.2-2

- Allow system-config-selinux to work with policykit

* Fri Jul 25 2008 Dan Walsh <dwalsh@redhat.com> 3.5.1-5

- Fix novel labeling

* Fri Jul 25 2008 Dan Walsh <dwalsh@redhat.com> 3.5.1-4

- Consolodate pyzor,spamassassin, razor into one security domain

- Fix xdm requiring additional perms.

* Fri Jul 25 2008 Dan Walsh <dwalsh@redhat.com> 3.5.1-3

- Fixes for logrotate, alsa

* Thu Jul 25 2008 Dan Walsh <dwalsh@redhat.com> 3.5.1-2

- Eliminate vbetool duplicate entry

* Wed Jul 16 2008 Dan Walsh <dwalsh@redhat.com> 3.5.1-1

- Fix xguest -> xguest_mozilla_t -> xguest_openiffice_t

- Change dhclient to be able to red networkmanager_var_run

* Tue Jul 15 2008 Dan Walsh <dwalsh@redhat.com> 3.5.0-1

- Update to latest refpolicy

- Fix libsemanage initial install bug

* Wed Jul 9 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-14

- Add inotify support to nscd

* Tue Jul 8 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-13

- Allow unconfined_t to setfcap

* Mon Jul 7 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-12

- Allow amanda to read tape

- Allow prewikka cgi to use syslog, allow audisp_t to signal cgi

- Add support for netware file systems

* Thu Jul 3 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-11

- Allow ypbind apps to net_bind_service

* Wed Jul 2 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-10

- Allow all system domains and application domains to append to any log file

* Sun Jun 29 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-9

- Allow gdm to read rpm database

- Allow nsplugin to read mplayer config files

* Thu Jun 26 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-8

- Allow vpnc to run ifconfig

* Tue Jun 24 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-7

- Allow confined users to use postgres

- Allow system_mail_t to exec other mail clients

- Label mogrel_rails as an apache server

* Mon Jun 23 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-6

- Apply unconfined_execmem_exec_t to haskell programs

* Sun Jun 22 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-5

- Fix prelude file context

* Fri Jun 12 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-4

- allow hplip to talk dbus

- Fix context on ~/.local dir

* Thu Jun 12 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-3

- Prevent applications from reading x_device

* Thu Jun 12 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-2

- Add /var/lib/selinux context

* Wed Jun 11 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-1

- Update to upstream 

* Wed Jun 4 2008 Dan Walsh <dwalsh@redhat.com> 3.4.1-5

- Add livecd policy

* Wed Jun 4 2008 Dan Walsh <dwalsh@redhat.com> 3.4.1-3

- Dontaudit search of admin_home for init_system_domain

- Rewrite of xace interfaces

- Lots of new fs_list_inotify

- Allow livecd to transition to setfiles_mac

* Fri May 9 2008 Dan Walsh <dwalsh@redhat.com> 3.4.1-2

- Begin XAce integration

* Fri May 9 2008 Dan Walsh <dwalsh@redhat.com> 3.4.1-1

- Merge Upstream

* Wed May 7 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-48

- Allow amanada to create data files

* Wed May 7 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-47

- Fix initial install, semanage setup

* Tue May 6 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-46

- Allow system_r for httpd_unconfined_script_t

* Wed Apr 30 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-45

- Remove dmesg boolean

- Allow user domains to read/write game data

* Mon Apr 28 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-44

- Change unconfined_t to transition to unconfined_mono_t when running mono

- Change XXX_mono_t to transition to XXX_t when executing bin_t files, so gnome-do will work

* Mon Apr 28 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-43

- Remove old booleans from targeted-booleans.conf file

* Fri Apr 25 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-42

- Add boolean to mmap_zero

- allow tor setgid

- Allow gnomeclock to set clock

* Thu Apr 24 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-41

- Don't run crontab from unconfined_t

* Wed Apr 23 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-39

- Change etc files to config files to allow users to read them

* Fri Apr 14 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-37

- Lots of fixes for confined domains on NFS_t homedir

* Mon Apr 14 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-36

- dontaudit mrtg reading /proc

- Allow iscsi to signal itself

- Allow gnomeclock sys_ptrace

* Thu Apr 10 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-33

- Allow dhcpd to read kernel network state

* Thu Apr 10 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-32

- Label /var/run/gdm correctly

- Fix unconfined_u user creation

* Tue Apr 8 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-31

- Allow transition from initrc_t to getty_t

* Tue Apr 8 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-30

- Allow passwd to communicate with user sockets to change gnome-keyring

* Sat Apr 5 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-29

- Fix initial install

* Fri Apr 4 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-28

- Allow radvd to use fifo_file

- dontaudit setfiles reading links

- allow semanage sys_resource

- add allow_httpd_mod_auth_ntlm_winbind boolean

- Allow privhome apps including dovecot read on nfs and cifs home 

dirs if the boolean is set

* Tue Apr 1 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-27

- Allow nsplugin to read /etc/mozpluggerrc, user_fonts

- Allow syslog to manage innd logs.

- Allow procmail to ioctl spamd_exec_t

* Sat Mar 28 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-26

- Allow initrc_t to dbus chat with consolekit.

* Thu Mar 27 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-25

- Additional access for nsplugin

- Allow xdm setcap/getcap until pulseaudio is fixed

* Tue Mar 25 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-24

- Allow mount to mkdir on tmpfs

- Allow ifconfig to search debugfs

* Fri Mar 18 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-23

- Fix file context for MATLAB

- Fixes for xace

* Tue Mar 18 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-22

- Allow stunnel to transition to inetd children domains

- Make unconfined_dbusd_t an unconfined domain 

* Mon Mar 17 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-21

- Fixes for qemu/virtd

* Fri Mar 14 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-20

- Fix bug in mozilla policy to allow xguest transition

- This will fix the 

libsemanage.dbase_llist_query: could not find record value

libsemanage.dbase_llist_query: could not query record value (No such file or

directory)

 bug in xguest

* Fri Mar 14 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-19

- Allow nsplugin to run acroread

* Thu Mar 13 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-18

- Add cups_pdf policy

- Add openoffice policy to run in xguest

* Thu Mar 13 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-17

- prewika needs to contact mysql

- Allow syslog to read system_map files

* Wed Mar 12 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-16

- Change init_t to an unconfined_domain

* Tue Mar 11 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-15

- Allow init to transition to initrc_t on shell exec.

- Fix init to be able to sendto init_t.

- Allow syslog to connect to mysql

- Allow lvm to manage its own fifo_files

- Allow bugzilla to use ldap

- More mls fixes 

* Tue Mar 11 2008 Bill Nottingham <notting@redhat.com> 3.3.1-14

- fixes for init policy (#436988)

- fix build

* Mon Mar 10 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-13

- Additional changes for MLS policy

* Thu Mar 6 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-12

- Fix initrc_context generation for MLS

* Mon Mar 3 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-11

- Fixes for libvirt

* Mon Mar 3 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-10

- Allow bitlebee to read locale_t

* Fri Feb 29 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-9

- More xselinux rules

* Thu Feb 28 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-8

- Change httpd_$1_script_r*_t to httpd_$1_content_r*_t

* Wed Feb 27 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-6

- Prepare policy for beta release