%define distro redhat

%define polyinstatiate n

%define monolithic n

%if %{?BUILD_TARGETED:0}%{!?BUILD_TARGETED:1}

%define BUILD_TARGETED 1

%endif

%if %{?BUILD_MINIMUM:0}%{!?BUILD_MINIMUM:1}

%define BUILD_MINIMUM 1

%endif

%if %{?BUILD_OLPC:0}%{!?BUILD_OLPC:1}

%define BUILD_OLPC 0

%endif

%if %{?BUILD_MLS:0}%{!?BUILD_MLS:1}

%define BUILD_MLS 1

%endif

%define POLICYVER 24

%define libsepolver 2.0.41-1

%define POLICYCOREUTILSVER 2.0.78-1

%define CHECKPOLICYVER 2.0.21-1

Summary: SELinux policy configuration

Name: selinux-policy

Version: 3.9.7

Release: 4%{?dist}

License: GPLv2+

Group: System Environment/Base

Source: serefpolicy-%{version}.tgz

patch: policy-F14.patch

Source1: modules-targeted.conf

Source2: booleans-targeted.conf

Source3: Makefile.devel

Source4: setrans-targeted.conf

Source5: modules-mls.conf

Source6: booleans-mls.conf

Source8: setrans-mls.conf

Source9: modules-olpc.conf

Source10: booleans-olpc.conf

Source11: setrans-olpc.conf

Source12: securetty_types-olpc

Source13: policygentool

Source14: securetty_types-targeted

Source15: securetty_types-mls

Source16: modules-minimum.conf

Source17: booleans-minimum.conf

Source18: setrans-minimum.conf

Source19: securetty_types-minimum

Source20: customizable_types

Source21: config.tgz

Source22: users-mls

Source23: users-targeted

Source24: users-olpc

Source25: users-minimum

Url: http://oss.tresys.com/repos/refpolicy/

BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)

BuildArch: noarch

BuildRequires: python gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-python >= %{POLICYCOREUTILSVER} bzip2 

Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER} libsemanage >= 2.0.14-3

Requires(post): /usr/bin/bunzip2 /bin/mktemp /bin/awk

Requires: checkpolicy >= %{CHECKPOLICYVER} m4 

Obsoletes: selinux-policy-devel <= %{version}-%{release}

Provides: selinux-policy-devel = %{version}-%{release}

%description 

SELinux Base package

%files 

%defattr(-,root,root,-)

%{_mandir}/man*/*

# policycoreutils owns these manpage directories, we only own the files within them

%{_mandir}/ru/*/*

%dir %{_usr}/share/selinux

%dir %{_usr}/share/selinux/devel

%dir %{_usr}/share/selinux/devel/include

%dir %{_usr}/share/selinux/packages

%dir %{_sysconfdir}/selinux

%ghost %config(noreplace) %{_sysconfdir}/selinux/config

%ghost %{_sysconfdir}/sysconfig/selinux

%{_usr}/share/selinux/devel/include/*

%{_usr}/share/selinux/devel/Makefile

%{_usr}/share/selinux/devel/policygentool

%{_usr}/share/selinux/devel/example.*

%{_usr}/share/selinux/devel/policy.*

%package doc

Summary: SELinux policy documentation

Group: System Environment/Base

Requires(pre): selinux-policy = %{version}-%{release}

Requires: /usr/bin/xdg-open

%description doc

SELinux policy documentation package

%files doc

%defattr(-,root,root,-)

%doc %{_usr}/share/doc/%{name}-%{version}

%attr(755,root,root) %{_usr}/share/selinux/devel/policyhelp

%check

if /usr/sbin/selinuxenabled; then

/usr/bin/sepolgen-ifgen -i %{buildroot}%{_usr}/share/selinux/devel/include -o /dev/null 

fi

%define makeCmds() \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 bare \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024  conf \

cp -f selinux_config/modules-%1.conf  ./policy/modules.conf \

cp -f selinux_config/booleans-%1.conf ./policy/booleans.conf \

cp -f selinux_config/users-%1 ./policy/users \

%define installCmds() \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 base.pp \

make validate UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 modules \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 install \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 install-appconfig \

#%{__cp} *.pp %{buildroot}/%{_usr}/share/selinux/%1/ \

%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/policy \

%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/modules/active \

%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/contexts/files \

touch %{buildroot}/%{_sysconfdir}/selinux/%1/modules/semanage.read.LOCK \

touch %{buildroot}/%{_sysconfdir}/selinux/%1/modules/semanage.trans.LOCK \

rm -rf %{buildroot}%{_sysconfdir}/selinux/%1/booleans \

touch %{buildroot}%{_sysconfdir}/selinux/%1/seusers \

touch %{buildroot}%{_sysconfdir}/selinux/%1/policy/policy.%{POLICYVER} \

touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts \

touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \

install -m0644 selinux_config/securetty_types-%1 %{buildroot}%{_sysconfdir}/selinux/%1/contexts/securetty_types \

install -m0644 selinux_config/setrans-%1.conf %{buildroot}%{_sysconfdir}/selinux/%1/setrans.conf \

install -m0644 selinux_config/customizable_types %{buildroot}%{_sysconfdir}/selinux/%1/contexts/customizable_types \

bzip2 %{buildroot}/%{_usr}/share/selinux/%1/*.pp \

awk '$1 !~ "/^#/" && $2 == "=" && $3 == "module" { printf "%%s.pp.bz2 ", $1 }' ./policy/modules.conf > %{buildroot}/%{_usr}/share/selinux/%1/modules.lst

%nil

%define fileList() \

%defattr(-,root,root) \

%dir %{_usr}/share/selinux/%1 \

%{_usr}/share/selinux/%1/*.pp.bz2 \

%{_usr}/share/selinux/%1/modules.lst \

%dir %{_sysconfdir}/selinux/%1 \

%config(noreplace) %{_sysconfdir}/selinux/%1/setrans.conf \

%ghost %{_sysconfdir}/selinux/%1/seusers \

%dir %{_sysconfdir}/selinux/%1/modules \

%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/semanage.read.LOCK \

%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/semanage.trans.LOCK \

%attr(700,root,root) %dir %{_sysconfdir}/selinux/%1/modules/active \

#%verify(not md5 size mtime) %attr(600,root,root) %config(noreplace) %{_sysconfdir}/selinux/%1/modules/active/seusers \

%dir %{_sysconfdir}/selinux/%1/policy/ \

%ghost %{_sysconfdir}/selinux/%1/policy/policy.* \

%dir %{_sysconfdir}/selinux/%1/contexts \

%config %{_sysconfdir}/selinux/%1/contexts/customizable_types \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/securetty_types \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/dbus_contexts \

%config %{_sysconfdir}/selinux/%1/contexts/x_contexts \

%config %{_sysconfdir}/selinux/%1/contexts/default_contexts \

%config %{_sysconfdir}/selinux/%1/contexts/virtual_domain_context \

%config %{_sysconfdir}/selinux/%1/contexts/virtual_image_context \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/default_type \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/failsafe_context \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/initrc_context \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/removable_context \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/userhelper_context \

%dir %{_sysconfdir}/selinux/%1/contexts/files \

%ghost %{_sysconfdir}/selinux/%1/contexts/files/file_contexts \

%ghost %{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \

%config %{_sysconfdir}/selinux/%1/contexts/files/media \

%dir %{_sysconfdir}/selinux/%1/contexts/users \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/root \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/guest_u \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/xguest_u \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/user_u \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/staff_u 

%define saveFileContext() \

if [ -s /etc/selinux/config ]; then \

     . %{_sysconfdir}/selinux/config; \

     FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \

     if [ "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT} ]; then \

        [ -f ${FILE_CONTEXT}.pre ] || cp -f ${FILE_CONTEXT} ${FILE_CONTEXT}.pre; \

     fi \

fi

%define loadpolicy() \

( cd /usr/share/selinux/%1; \

semodule -b base.pp.bz2 -i %2 -s %1; \

); \

%define relabel() \

. %{_sysconfdir}/selinux/config; \

FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \

selinuxenabled; \

if [ $? = 0  -a "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT}.pre ]; then \

     fixfiles -C ${FILE_CONTEXT}.pre restore; \

     restorecon -R /root /var/log /var/run /var/lib 2> /dev/null; \

     rm -f ${FILE_CONTEXT}.pre; \

fi; 

%description

SELinux Reference Policy - modular.

Based off of reference policy: Checked out revision  2.20091117

%build

%prep 

%setup -n serefpolicy-%{version} -q

%patch -p1

%install

mkdir selinux_config

for i in %{SOURCE1} %{SOURCE2} %{SOURCE3} %{SOURCE4} %{SOURCE5} %{SOURCE6} %{SOURCE8} %{SOURCE9} %{SOURCE10} %{SOURCE11} %{SOURCE12} %{SOURCE13} %{SOURCE14} %{SOURCE15} %{SOURCE16} %{SOURCE17} %{SOURCE18} %{SOURCE19} %{SOURCE20} %{SOURCE21} %{SOURCE22} %{SOURCE23} %{SOURCE24} %{SOURCE25};do

 cp $i selinux_config

done

tar zxvf selinux_config/config.tgz

# Build targeted policy

%{__rm} -fR %{buildroot}

mkdir -p %{buildroot}%{_mandir}

cp -R  man/* %{buildroot}%{_mandir}

mkdir -p %{buildroot}%{_sysconfdir}/selinux

mkdir -p %{buildroot}%{_sysconfdir}/sysconfig

touch %{buildroot}%{_sysconfdir}/selinux/config

touch %{buildroot}%{_sysconfdir}/sysconfig/selinux

# Always create policy module package directories

mkdir -p %{buildroot}%{_usr}/share/selinux/{targeted,mls,minimum,modules}/

# Install devel

make clean

%if %{BUILD_TARGETED}

# Build targeted policy

# Commented out because only targeted ref policy currently builds

%makeCmds targeted mcs n y allow

%installCmds targeted mcs n y allow

%endif

%if %{BUILD_MINIMUM}

# Build minimum policy

# Commented out because only minimum ref policy currently builds

%makeCmds minimum mcs n y allow

%installCmds minimum mcs n y allow

%endif

%if %{BUILD_MLS}

# Build mls policy

%makeCmds mls mls n y deny

%installCmds mls mls n y deny

%endif

%if %{BUILD_OLPC}

# Build olpc policy

# Commented out because only olpc ref policy currently builds

%makeCmds olpc mcs n y allow

%installCmds olpc mcs n y allow

%endif

make UNK_PERMS=allow NAME=targeted TYPE=mcs DISTRO=%{distro} UBAC=n DIRECT_INITRC=n MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} PKGNAME=%{name}-%{version} POLY=y MLS_CATS=1024 MCS_CATS=1024 install-headers install-docs

mkdir %{buildroot}%{_usr}/share/selinux/devel/

mkdir %{buildroot}%{_usr}/share/selinux/packages/

mv %{buildroot}%{_usr}/share/selinux/targeted/include %{buildroot}%{_usr}/share/selinux/devel/include

install -m 755 selinux_config/policygentool %{buildroot}%{_usr}/share/selinux/devel/

install -m 644 selinux_config/Makefile.devel %{buildroot}%{_usr}/share/selinux/devel/Makefile

install -m 644 doc/example.* %{buildroot}%{_usr}/share/selinux/devel/

install -m 644 doc/policy.* %{buildroot}%{_usr}/share/selinux/devel/

echo  "xdg-open file:///usr/share/doc/selinux-policy-%{version}/html/index.html"> %{buildroot}%{_usr}/share/selinux/devel/policyhelp

chmod +x %{buildroot}%{_usr}/share/selinux/devel/policyhelp

rm -rf selinux_config

%clean

%{__rm} -fR %{buildroot}

%post

if [ ! -s /etc/selinux/config ]; then

#

#     New install so we will default to targeted policy

#

echo "

# This file controls the state of SELinux on the system.

# SELINUX= can take one of these three values:

#     enforcing - SELinux security policy is enforced.

#     permissive - SELinux prints warnings instead of enforcing.

#     disabled - No SELinux policy is loaded.

SELINUX=enforcing

# SELINUXTYPE= can take one of these two values:

#     targeted - Targeted processes are protected,

#     mls - Multi Level Security protection.

SELINUXTYPE=targeted 

" > /etc/selinux/config

     ln -sf ../selinux/config /etc/sysconfig/selinux 

     restorecon /etc/selinux/config 2> /dev/null || :

else

     . /etc/selinux/config

     # if first time update booleans.local needs to be copied to sandbox

     [ -f /etc/selinux/${SELINUXTYPE}/booleans.local ] && mv /etc/selinux/${SELINUXTYPE}/booleans.local /etc/selinux/targeted/modules/active/

     [ -f /etc/selinux/${SELINUXTYPE}/seusers ] && cp -f /etc/selinux/${SELINUXTYPE}/seusers /etc/selinux/${SELINUXTYPE}/modules/active/seusers

fi

exit 0

%postun

if [ $1 = 0 ]; then

     setenforce 0 2> /dev/null

     if [ ! -s /etc/selinux/config ]; then

          echo "SELINUX=disabled" > /etc/selinux/config

     else

          sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config

     fi

fi

exit 0

%if %{BUILD_TARGETED}

%package targeted

Summary: SELinux targeted base policy

Provides: selinux-policy-base = %{version}-%{release}

Group: System Environment/Base

Obsoletes: selinux-policy-targeted-sources < 2

Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}

Requires(pre): coreutils

Requires(pre): selinux-policy = %{version}-%{release}

Requires: selinux-policy = %{version}-%{release}

Conflicts:  audispd-plugins <= 1.7.7-1

Obsoletes: mod_fcgid-selinux <= %{version}-%{release}

Obsoletes: cachefilesd-selinux <= 0.10-1

Conflicts:  seedit

%description targeted

SELinux Reference policy targeted base module.

%pre targeted

%saveFileContext targeted

%post targeted

packages=`cat /usr/share/selinux/targeted/modules.lst`

if [ $1 -eq 1 ]; then

   %loadpolicy targeted $packages

   restorecon -R /root /var/log /var/run /var/lib 2> /dev/null

else

   semodule -n -s targeted -r pyzor -r razor -r moilscanner mailscanner gamin audio_entropy iscsid polkit_auth polkit rtkit_daemon ModemManager telepathysofiasip ethereal 2>/dev/null

   %loadpolicy targeted $packages

   %relabel targeted

fi

exit 0

%triggerpostun targeted -- selinux-policy-targeted < 3.2.5-9.fc9

. /etc/selinux/config

[ "${SELINUXTYPE}" != "targeted" ] && exit 0

setsebool -P use_nfs_home_dirs=1

semanage user -l | grep -s unconfined_u > /dev/null

if [ $? -eq 0 ]; then

   semanage user -m -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u

else

   semanage user -a -P user -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u

fi

seuser=`semanage login -l | grep __default__ | awk '{ print $2 }'`

[ "$seuser" != "unconfined_u" ]  && semanage login -m -s "unconfined_u"  -r s0-s0:c0.c1023 __default__

seuser=`semanage login -l | grep root | awk '{ print $2 }'`

[ "$seuser" = "system_u" ] && semanage login -m -s "unconfined_u"  -r s0-s0:c0.c1023 root

restorecon -R /root /etc/selinux/targeted 2> /dev/null

semodule -r qmail 2> /dev/null

exit 0

%files targeted

%defattr(-,root,root,-)

%config(noreplace) %{_sysconfdir}/selinux/targeted/contexts/users/unconfined_u

%fileList targeted

%endif

%if %{BUILD_MINIMUM}

%package minimum

Summary: SELinux minimum base policy

Provides: selinux-policy-base = %{version}-%{release}

Group: System Environment/Base

Requires(post): policycoreutils-python >= %{POLICYCOREUTILSVER}

Requires(pre): coreutils

Requires(pre): selinux-policy = %{version}-%{release}

Requires: selinux-policy = %{version}-%{release}

Conflicts:  seedit

%description minimum

SELinux Reference policy minimum base module.

%pre minimum

%saveFileContext minimum

%post minimum

packages="execmem.pp.bz2 unconfined.pp.bz2 unconfineduser.pp.bz2"

%loadpolicy minimum $packages

if [ $1 -eq 1 ]; then

semanage -S minimum -i - << __eof

login -m  -s unconfined_u -r s0-s0:c0.c1023 __default__

login -m  -s unconfined_u -r s0-s0:c0.c1023 root

__eof

restorecon -R /root /var/log /var/run /var/lib 2> /dev/null

else

%relabel minimum

fi

exit 0

%files minimum

%defattr(-,root,root,-)

%config(noreplace) %{_sysconfdir}/selinux/minimum/contexts/users/unconfined_u

%fileList minimum

%endif

%if %{BUILD_OLPC}

%package olpc 

Summary: SELinux olpc base policy

Group: System Environment/Base

Provides: selinux-policy-base = %{version}-%{release}

Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}

Requires(pre): coreutils

Requires(pre): selinux-policy = %{version}-%{release}

Requires: selinux-policy = %{version}-%{release}

Conflicts:  seedit

%description olpc 

SELinux Reference policy olpc base module.

%pre olpc 

%saveFileContext olpc

%post olpc 

packages=`cat /usr/share/selinux/olpc/modules.lst`

%loadpolicy olpc $packages

if [ $1 -ne 1 ]; then

%relabel olpc

fi

exit 0

%files olpc

%defattr(-,root,root,-)

%fileList olpc

%endif

%if %{BUILD_MLS}

%package mls 

Summary: SELinux mls base policy

Group: System Environment/Base

Provides: selinux-policy-base = %{version}-%{release}

Obsoletes: selinux-policy-mls-sources < 2

Requires: policycoreutils-newrole >= %{POLICYCOREUTILSVER} setransd

Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}

Requires(pre): coreutils

Requires(pre): selinux-policy = %{version}-%{release}

Requires: selinux-policy = %{version}-%{release}

Conflicts:  seedit

%description mls 

SELinux Reference policy mls base module.

%pre mls 

%saveFileContext mls

%post mls 

semodule -n -s mls -r pyzor -r razor -r mailscanner polkit ModemManager telepathysofiasip ethereal 2>/dev/null

packages=`cat /usr/share/selinux/mls/modules.lst`

%loadpolicy mls $packages

if [ $1 -eq 1 ]; then

   restorecon -R /root /var/log /var/run /var/lib 2> /dev/null

else

%relabel mls

fi

exit 0

%files mls

%defattr(-,root,root,-)

%config(noreplace) %{_sysconfdir}/selinux/mls/contexts/users/unconfined_u

%fileList mls

%endif

%changelog

* Fri Oct 15 2010 Dan Walsh <dwalsh@redhat.com> 3.9.7-4

- Allow sandbox_x_domains to work with nfs/cifs/fusefs home dirs.

* Fri Oct 15 2010 Dan Walsh <dwalsh@redhat.com> 3.9.7-3

- Allow cobblerd to list cobler appache content

* Fri Oct 15 2010 Dan Walsh <dwalsh@redhat.com> 3.9.7-2

- Fixup for the latest version of upowed

- Dontaudit sandbox sending SIGNULL to desktop apps

* Wed Oct 13 2010 Dan Walsh <dwalsh@redhat.com> 3.9.7-1

- Update to upstream

* Tue Oct 12 2010 Dan Walsh <dwalsh@redhat.com> 3.9.6-3

-Mount command from a confined user generates setattr on /etc/mtab file, need to dontaudit this access

- dovecot-auth_t needs ipc_lock

- gpm needs to use the user terminal

- Allow system_mail_t to append ~/dead.letter

- Allow NetworkManager to edit /etc/NetworkManager/NetworkManager.conf

- Add pid file to vnstatd

- Allow mount to communicate with gfs_controld

- Dontaudit hal leaks in setfiles

* Fri Oct 8 2010 Dan Walsh <dwalsh@redhat.com> 3.9.6-2

- Lots of fixes for systemd

- systemd now executes readahead and tmpwatch type scripts

- Needs to manage random seed

* Thu Oct 7 2010 Dan Walsh <dwalsh@redhat.com> 3.9.6-1

- Allow smbd to use sys_admin

- Remove duplicate file context for tcfmgr

- Update to upstream

* Wed Oct 6 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-11

- Fix fusefs handling

- Do not allow sandbox to manage nsplugin_rw_t

- Allow mozilla_plugin_t to connecto its parent

- Allow init_t to connect to plymouthd running as kernel_t

- Add mediawiki policy

- dontaudit sandbox sending signals to itself.  This can happen when they are running at different mcs.

- Disable transition from dbus_session_domain to telepathy for F14

- Allow boinc_project to use shm

- Allow certmonger to search through directories that contain certs

- Allow fail2ban the DAC Override so it can read log files owned by non root users

* Mon Oct 4 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-10

- Start adding support for use_fusefs_home_dirs

- Add /var/lib/syslog directory file context

- Add /etc/localtime as locale file context

* Thu Sep 30 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-9

- Turn off default transition to mozilla_plugin and telepathy domains from unconfined user 

- Turn off iptables from unconfined user 

- Allow sudo to send signals to any domains the user could have transitioned to.

- Passwd in single user mode needs to talk to console_device_t

- Mozilla_plugin_t needs to connect to web ports, needs to write to video device, and read alsa_home_t alsa setsup pulseaudio

- locate tried to read a symbolic link, will dontaudit

- New labels for telepathy-sunshine content in homedir

- Google is storing other binaries under /opt/google/talkplugin

- bluetooth/kernel is creating unlabeled_t socket that I will allow it to use until kernel fixes bug

- Add boolean for unconfined_t transition to mozilla_plugin_t and telepathy domains, turned off in F14 on in F15

- modemmanger and bluetooth send dbus messages to devicekit_power

- Samba needs to getquota on filesystems labeld samba_share_t

* Wed Sep 29 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-8

- Dontaudit attempts by xdm_t to write to bin_t for kdm

- Allow initrc_t to manage system_conf_t

* Mon Sep 27 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-7

- Fixes to allow mozilla_plugin_t to create nsplugin_home_t directory.

- Allow mozilla_plugin_t to create tcp/udp/netlink_route sockets

- Allow confined users to read xdm_etc_t files

- Allow xdm_t to transition to xauth_t for lxdm program

* Sun Sep 26 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-6

- Rearrange firewallgui policy to be more easily updated to upstream, dontaudit search of /home

- Allow clamd to send signals to itself

- Allow mozilla_plugin_t to read user home content.  And unlink pulseaudio shm.

- Allow haze to connect to yahoo chat and messenger port tcp:5050.

Bz #637339

- Allow guest to run ps command on its processes by allowing it to read /proc

- Allow firewallgui to sys_rawio which seems to be required to setup masqerading

- Allow all domains to search through default_t directories, in order to find differnet labels.  For example people serring up /foo/bar to be share via samba.

- Add label for /var/log/slim.log

* Fri Sep 24 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-5

- Pull in cleanups from dgrift

- Allow mozilla_plugin_t to execute mozilla_home_t

- Allow rpc.quota to do quotamod

* Thu Sep 23 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-4

- Cleanup policy via dgrift

- Allow dovecot_deliver to append to inherited log files

- Lots of fixes for consolehelper

* Wed Sep 21 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-3

- Fix up Xguest policy

* Thu Sep 16 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-2

- Add vnstat policy

- allow libvirt to send audit messages

- Allow chrome-sandbox to search nfs_t

* Thu Sep 16 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-1

- Update to upstream

* Wed Sep 15 2010 Dan Walsh <dwalsh@redhat.com> 3.9.4-3

- Add the ability to send audit messages to confined admin policies

- Remove permissive domain from cmirrord and dontaudit sys_tty_config

- Split out unconfined_domain() calls from other unconfined_ calls so we can d

- virt needs to be able to read processes to clearance for MLS

* Tue Sep 14 2010 Dan Walsh <dwalsh@redhat.com> 3.9.4-2

- Allow all domains that can use cgroups to search tmpfs_t directory

- Allow init to send audit messages

* Thu Sep 8 2010 Dan Walsh <dwalsh@redhat.com> 3.9.4-1

- Update to upstream

* Thu Sep 8 2010 Dan Walsh <dwalsh@redhat.com> 3.9.3-4

- Allow mdadm_t to create files and sock files in /dev/md/

* Thu Sep 8 2010 Dan Walsh <dwalsh@redhat.com> 3.9.3-3

- Add policy for ajaxterm

* Wed Sep 8 2010 Dan Walsh <dwalsh@redhat.com> 3.9.3-2

- Handle /var/db/sudo

- Allow pulseaudio to read alsa config

- Allow init to send initrc_t dbus messages

* Tue Sep 7 2010 Dan Walsh <dwalsh@redhat.com> 3.9.3-1

Allow iptables to read shorewall tmp files

Change chfn and passwd to use auth_use_pam so they can send dbus messages to fpr

intd

label vlc as an execmem_exec_t 

Lots of fixes for mozilla_plugin to run google vidio chat

Allow telepath_msn to execute ldconfig and its own tmp files

Fix labels on hugepages

Allow mdadm to read files on /dev

Remove permissive domains and change back to unconfined

Allow freshclam to execute shell and bin_t

Allow devicekit_power to transition to dhcpc

Add boolean to allow icecast to connect to any port

* Thu Aug 31 2010 Dan Walsh <dwalsh@redhat.com> 3.9.2-1

- Merge upstream fix of mmap_zero

- Allow mount to write files in debugfs_t

- Allow corosync to communicate with clvmd via tmpfs

- Allow certmaster to read usr_t files

- Allow dbus system services to search cgroup_t

- Define rlogind_t as a login pgm

* Wed Aug 31 2010 Dan Walsh <dwalsh@redhat.com> 3.9.1-3

- Allow mdadm_t to read/write hugetlbfs

* Tue Aug 30 2010 Dan Walsh <dwalsh@redhat.com> 3.9.1-2

- Dominic Grift Cleanup

- Miroslav Grepl policy for jabberd

- Various fixes for mount/livecd and prelink

* Mon Aug 30 2010 Dan Walsh <dwalsh@redhat.com> 3.9.1-1

- Merge with upstream

* Thu Aug 26 2010 Dan Walsh <dwalsh@redhat.com> 3.9.0-2

- More access needed for devicekit

- Add dbadm policy

* Thu Aug 26 2010 Dan Walsh <dwalsh@redhat.com> 3.9.0-1

- Merge with upstream

* Tue Aug 24 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-21

- Allow seunshare to fowner

* Tue Aug 24 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-20

- Allow cron to look at user_cron_spool links

- Lots of fixes for mozilla_plugin_t

- Add sysv file system

- Turn unconfined domains to permissive to find additional avcs

* Mon Aug 23 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-19

- Update policy for mozilla_plugin_t

* Mon Aug 23 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-18

- Allow clamscan to read proc_t

- Allow mount_t to write to debufs_t dir

- Dontaudit mount_t trying to write to security_t dir

* Thu Aug 18 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-17

- Allow clamscan_t execmem if clamd_use_jit set

- Add policy for firefox plugin-container

* Wed Aug 17 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-16

- Fix /root/.forward definition

* Tue Aug 17 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-15

- label dead.letter as mail_home_t

* Fri Aug 13 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-14

- Allow login programs to search /cgroups

* Thu Aug 12 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-13

- Fix cert handling

* Tue Aug 10 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-12

- Fix devicekit_power bug

- Allow policykit_auth_t more access.

* Thu Aug 5 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-11

- Fix nis calls to allow bind to ports 512-1024

- Fix smartmon

* Wed Aug 4 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-10

- Allow pcscd to read sysfs

- systemd fixes 

- Fix wine_mmap_zero_ignore boolean

* Tue Aug 3 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-9

- Apply Miroslav munin patch

- Turn back on allow_execmem and allow_execmod booleans

* Tue Jul 27 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-8

- Merge in fixes from dgrift repository

* Tue Jul 27 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-7

- Update boinc policy

- Fix sysstat policy to allow sys_admin

- Change failsafe_context to unconfined_r:unconfined_t:s0

* Mon Jul 26 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-6

- New paths for upstart

* Mon Jul 26 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-5

- New permissions for syslog

- New labels for /lib/upstart

* Fri Jul 23 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-4

- Add mojomojo policy

* Thu Jul 22 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-3

- Allow systemd to setsockcon on sockets to immitate other services

* Wed Jul 21 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-2

- Remove debugfs label

* Tue Jul 20 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-1

- Update to latest policy

* Mon Jul 14 2010 Dan Walsh <dwalsh@redhat.com> 3.8.7-3

- Fix eclipse labeling from IBMSupportAssasstant packageing

* Mon Jul 14 2010 Dan Walsh <dwalsh@redhat.com> 3.8.7-2

- Make boot with systemd in enforcing mode

* Mon Jul 14 2010 Dan Walsh <dwalsh@redhat.com> 3.8.7-1

- Update to upstream

* Mon Jul 12 2010 Dan Walsh <dwalsh@redhat.com> 3.8.6-3

- Add boolean to turn off port forwarding in sshd.

* Fri Jul 9 2010 Miroslav Grepl <mgrepl@redhat.com> 3.8.6-2

- Add support for ebtables

- Fixes for rhcs and corosync policy

* Tue Jun 22 2010 Dan Walsh <dwalsh@redhat.com> 3.8.6-1

-Update to upstream

* Mon Jun 21 2010 Dan Walsh <dwalsh@redhat.com> 3.8.5-1

-Update to upstream

* Thu Jun 17 2010 Dan Walsh <dwalsh@redhat.com> 3.8.4-1

-Update to upstream

* Wed Jun 16 2010 Dan Walsh <dwalsh@redhat.com> 3.8.3-4

- Add Zarafa policy

* Wed Jun 9 2010 Dan Walsh <dwalsh@redhat.com> 3.8.3-3

- Cleanup of aiccu policy

- initial mock policy

* Wed Jun 9 2010 Dan Walsh <dwalsh@redhat.com> 3.8.3-2

- Lots of random fixes

* Tue Jun 8 2010 Dan Walsh <dwalsh@redhat.com> 3.8.3-1

- Update to upstream

* Fri Jun 4 2010 Dan Walsh <dwalsh@redhat.com> 3.8.2-1

- Update to upstream

- Allow prelink script to signal itself

- Cobbler fixes

* Wed Jun 2 2010 Dan Walsh <dwalsh@redhat.com> 3.8.1-5

- Add xdm_var_run_t to xserver_stream_connect_xdm

- Add cmorrord and mpd policy from Miroslav Grepl

* Tue Jun 1 2010 Dan Walsh <dwalsh@redhat.com> 3.8.1-4

- Fix sshd creation of krb cc files for users to be user_tmp_t

* Thu May 27 2010 Dan Walsh <dwalsh@redhat.com> 3.8.1-3

- Fixes for accountsdialog

- Fixes for boinc

* Thu May 27 2010 Dan Walsh <dwalsh@redhat.com> 3.8.1-2

- Fix label on /var/lib/dokwiki

- Change permissive domains to enforcing

- Fix libvirt policy to allow it to run on mls

* Tue May 25 2010 Dan Walsh <dwalsh@redhat.com> 3.8.1-1

- Update to upstream

* Tue May 25 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-22

- Allow procmail to execute scripts in the users home dir that are labeled home_bin_t

- Fix /var/run/abrtd.lock label

* Mon May 24 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-21

- Allow login programs to read krb5_home_t

Resolves: 594833

- Add obsoletes for cachefilesfd-selinux package

Resolves: #575084

* Thu May 20 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-20

- Allow mount to r/w abrt fifo file

- Allow svirt_t to getattr on hugetlbfs

- Allow abrt to create a directory under /var/spool

* Wed May 19 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-19

- Add labels for /sys

- Allow sshd to getattr on shutdown

- Fixes for munin

- Allow sssd to use the kernel key ring

- Allow tor to send syslog messages

- Allow iptabels to read usr files

- allow policykit to read all domains state

* Thu May 13 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-17

- Fix path for /var/spool/abrt

- Allow nfs_t as an entrypoint for http_sys_script_t

- Add policy for piranha

- Lots of fixes for sosreport

* Wed May 12 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-16

- Allow xm_t to read network state and get and set capabilities

- Allow policykit to getattr all processes

- Allow denyhosts to connect to tcp port 9911

- Allow pyranha to use raw ip sockets and ptrace itself

- Allow unconfined_execmem_t and gconfsd mechanism to dbus

- Allow staff to kill ping process

- Add additional MLS rules

* Mon May 10 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-15

- Allow gdm to edit ~/.gconf dir

Resolves: #590677

- Allow dovecot to create directories in /var/lib/dovecot

Partially resolves 590224

- Allow avahi to dbus chat with NetworkManager

- Fix cobbler labels

- Dontaudit iceauth_t leaks

- fix /var/lib/lxdm file context

- Allow aiccu to use tun tap devices

- Dontaudit shutdown using xserver.log

* Fri May 6 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-14

- Fixes for sandbox_x_net_t  to match access for sandbox_web_t ++

- Add xdm_etc_t for /etc/gdm directory, allow accountsd to manage this directory

- Add dontaudit interface for bluetooth dbus

- Add chronyd_read_keys, append_keys for initrc_t

- Add log support for ksmtuned

Resolves: #586663

* Thu May 6 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-13

- Allow boinc to send mail

* Wed May 5 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-12

- Allow initrc_t to remove dhcpc_state_t

- Fix label on sa-update.cron

- Allow dhcpc to restart chrony initrc

- Don't allow sandbox to send signals to its parent processes

- Fix transition from unconfined_t -> unconfined_mount_t -> rpcd_t

Resolves: #589136

* Mon May 3 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-11

- Fix location of oddjob_mkhomedir

Resolves: #587385

- fix labeling on /root/.shosts and ~/.shosts

- Allow ipsec_mgmt_t to manage net_conf_t

Resolves: #586760

* Fri Apr 30 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-10

- Dontaudit sandbox trying to connect to netlink sockets

Resolves: #587609

- Add policy for piranha

* Thu Apr 29 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-9

- Fixups for xguest policy

- Fixes for running sandbox firefox

* Wed Apr 28 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-8

- Allow ksmtuned to use terminals

Resolves: #586663

- Allow lircd to write to generic usb devices

* Tue Apr 27 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-7

- Allow sandbox_xserver to connectto unconfined stream

Resolves: #585171

* Mon Apr 26 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-6

- Allow initrc_t to read slapd_db_t