%define distro redhat

%define polyinstatiate n

%define monolithic n

%if %{?BUILD_TARGETED:0}%{!?BUILD_TARGETED:1}

%define BUILD_TARGETED 1

%endif

%if %{?BUILD_MINIMUM:0}%{!?BUILD_MINIMUM:1}

%define BUILD_MINIMUM 1

%endif

%if %{?BUILD_OLPC:0}%{!?BUILD_OLPC:1}

%define BUILD_OLPC 0

%endif

%if %{?BUILD_MLS:0}%{!?BUILD_MLS:1}

%define BUILD_MLS 1

%endif

%define POLICYVER 24

%define libsepolver 2.0.41-1

%define POLICYCOREUTILSVER 2.0.78-1

%define CHECKPOLICYVER 2.0.21-1

Summary: SELinux policy configuration

Name: selinux-policy

Version: 3.8.1

Release: 3%{?dist}

License: GPLv2+

Group: System Environment/Base

Source: serefpolicy-%{version}.tgz

patch: policy-F14.patch

Source1: modules-targeted.conf

Source2: booleans-targeted.conf

Source3: Makefile.devel

Source4: setrans-targeted.conf

Source5: modules-mls.conf

Source6: booleans-mls.conf

Source8: setrans-mls.conf

Source9: modules-olpc.conf

Source10: booleans-olpc.conf

Source11: setrans-olpc.conf

Source12: securetty_types-olpc

Source13: policygentool

Source14: securetty_types-targeted

Source15: securetty_types-mls

Source16: modules-minimum.conf

Source17: booleans-minimum.conf

Source18: setrans-minimum.conf

Source19: securetty_types-minimum

Source20: customizable_types

Source21: config.tgz

Source22: users-mls

Source23: users-targeted

Source24: users-olpc

Source25: users-minimum

Url: http://oss.tresys.com/repos/refpolicy/

BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)

BuildArch: noarch

BuildRequires: python gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-python >= %{POLICYCOREUTILSVER} bzip2 

Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER} libsemanage >= 2.0.14-3

Requires(post): /usr/bin/bunzip2 /bin/mktemp /bin/awk

Requires: checkpolicy >= %{CHECKPOLICYVER} m4 

Obsoletes: selinux-policy-devel <= %{version}-%{release}

Provides: selinux-policy-devel = %{version}-%{release}

%description 

SELinux Base package

%files 

%defattr(-,root,root,-)

%{_mandir}/man*/*

# policycoreutils owns these manpage directories, we only own the files within them

%{_mandir}/ru/*/*

%dir %{_usr}/share/selinux

%dir %{_usr}/share/selinux/devel

%dir %{_usr}/share/selinux/devel/include

%dir %{_usr}/share/selinux/packages

%dir %{_sysconfdir}/selinux

%ghost %config(noreplace) %{_sysconfdir}/selinux/config

%ghost %{_sysconfdir}/sysconfig/selinux

%{_usr}/share/selinux/devel/include/*

%{_usr}/share/selinux/devel/Makefile

%{_usr}/share/selinux/devel/policygentool

%{_usr}/share/selinux/devel/example.*

%{_usr}/share/selinux/devel/policy.*

%package doc

Summary: SELinux policy documentation

Group: System Environment/Base

Requires(pre): selinux-policy = %{version}-%{release}

Requires: /usr/bin/xdg-open

%description doc

SELinux policy documentation package

%files doc

%defattr(-,root,root,-)

%doc %{_usr}/share/doc/%{name}-%{version}

%attr(755,root,root) %{_usr}/share/selinux/devel/policyhelp

%check

if /usr/sbin/selinuxenabled; then

/usr/bin/sepolgen-ifgen -i %{buildroot}%{_usr}/share/selinux/devel/include -o /dev/null 

fi

%define makeCmds() \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 bare \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024  conf \

cp -f selinux_config/modules-%1.conf  ./policy/modules.conf \

cp -f selinux_config/booleans-%1.conf ./policy/booleans.conf \

cp -f selinux_config/users-%1 ./policy/users \

%define installCmds() \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 base.pp \

make validate UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 modules \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 install \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 install-appconfig \

#%{__cp} *.pp %{buildroot}/%{_usr}/share/selinux/%1/ \

%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/policy \

%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/modules/active \

%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/contexts/files \

touch %{buildroot}/%{_sysconfdir}/selinux/%1/modules/semanage.read.LOCK \

touch %{buildroot}/%{_sysconfdir}/selinux/%1/modules/semanage.trans.LOCK \

rm -rf %{buildroot}%{_sysconfdir}/selinux/%1/booleans \

touch %{buildroot}%{_sysconfdir}/selinux/%1/seusers \

touch %{buildroot}%{_sysconfdir}/selinux/%1/policy/policy.%{POLICYVER} \

touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts \

touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \

install -m0644 selinux_config/securetty_types-%1 %{buildroot}%{_sysconfdir}/selinux/%1/contexts/securetty_types \

install -m0644 selinux_config/setrans-%1.conf %{buildroot}%{_sysconfdir}/selinux/%1/setrans.conf \

install -m0644 selinux_config/customizable_types %{buildroot}%{_sysconfdir}/selinux/%1/contexts/customizable_types \

bzip2 %{buildroot}/%{_usr}/share/selinux/%1/*.pp \

awk '$1 !~ "/^#/" && $2 == "=" && $3 == "module" { printf "%%s.pp.bz2 ", $1 }' ./policy/modules.conf > %{buildroot}/%{_usr}/share/selinux/%1/modules.lst

%nil

%define fileList() \

%defattr(-,root,root) \

%dir %{_usr}/share/selinux/%1 \

%{_usr}/share/selinux/%1/*.pp.bz2 \

%{_usr}/share/selinux/%1/modules.lst \

%dir %{_sysconfdir}/selinux/%1 \

%config(noreplace) %{_sysconfdir}/selinux/%1/setrans.conf \

%ghost %{_sysconfdir}/selinux/%1/seusers \

%dir %{_sysconfdir}/selinux/%1/modules \

%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/semanage.read.LOCK \

%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/semanage.trans.LOCK \

%attr(700,root,root) %dir %{_sysconfdir}/selinux/%1/modules/active \

#%verify(not md5 size mtime) %attr(600,root,root) %config(noreplace) %{_sysconfdir}/selinux/%1/modules/active/seusers \

%dir %{_sysconfdir}/selinux/%1/policy/ \

%ghost %{_sysconfdir}/selinux/%1/policy/policy.* \

%dir %{_sysconfdir}/selinux/%1/contexts \

%config %{_sysconfdir}/selinux/%1/contexts/customizable_types \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/securetty_types \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/dbus_contexts \

%config %{_sysconfdir}/selinux/%1/contexts/x_contexts \

%config %{_sysconfdir}/selinux/%1/contexts/default_contexts \

%config %{_sysconfdir}/selinux/%1/contexts/virtual_domain_context \

%config %{_sysconfdir}/selinux/%1/contexts/virtual_image_context \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/default_type \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/failsafe_context \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/initrc_context \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/removable_context \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/userhelper_context \

%dir %{_sysconfdir}/selinux/%1/contexts/files \

%ghost %{_sysconfdir}/selinux/%1/contexts/files/file_contexts \

%ghost %{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \

%config %{_sysconfdir}/selinux/%1/contexts/files/media \

%dir %{_sysconfdir}/selinux/%1/contexts/users \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/root \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/guest_u \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/xguest_u \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/user_u \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/staff_u 

%define saveFileContext() \

if [ -s /etc/selinux/config ]; then \

     . %{_sysconfdir}/selinux/config; \

     FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \

     if [ "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT} ]; then \

        [ -f ${FILE_CONTEXT}.pre ] || cp -f ${FILE_CONTEXT} ${FILE_CONTEXT}.pre; \

     fi \

fi

%define loadpolicy() \

( cd /usr/share/selinux/%1; \

semodule -b base.pp.bz2 -i %2 -s %1; \

); \

%define relabel() \

. %{_sysconfdir}/selinux/config; \

FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \

selinuxenabled; \

if [ $? = 0  -a "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT}.pre ]; then \

     fixfiles -C ${FILE_CONTEXT}.pre restore; \

     restorecon -R /root /var/log /var/run /var/lib 2> /dev/null; \

     rm -f ${FILE_CONTEXT}.pre; \

fi; 

%description

SELinux Reference Policy - modular.

Based off of reference policy: Checked out revision  2.20091117

%build

%prep 

%setup -n serefpolicy-%{version} -q

%patch -p1

%install

mkdir selinux_config

for i in %{SOURCE1} %{SOURCE2} %{SOURCE3} %{SOURCE4} %{SOURCE5} %{SOURCE6} %{SOURCE8} %{SOURCE9} %{SOURCE10} %{SOURCE11} %{SOURCE12} %{SOURCE13} %{SOURCE14} %{SOURCE15} %{SOURCE16} %{SOURCE17} %{SOURCE18} %{SOURCE19} %{SOURCE20} %{SOURCE21} %{SOURCE22} %{SOURCE23} %{SOURCE24} %{SOURCE25};do

 cp $i selinux_config

done

tar zxvf selinux_config/config.tgz

# Build targeted policy

%{__rm} -fR %{buildroot}

mkdir -p %{buildroot}%{_mandir}

cp -R  man/* %{buildroot}%{_mandir}

mkdir -p %{buildroot}%{_sysconfdir}/selinux

mkdir -p %{buildroot}%{_sysconfdir}/sysconfig

touch %{buildroot}%{_sysconfdir}/selinux/config

touch %{buildroot}%{_sysconfdir}/sysconfig/selinux

# Always create policy module package directories

mkdir -p %{buildroot}%{_usr}/share/selinux/{targeted,mls,minimum,modules}/

# Install devel

make clean

%if %{BUILD_TARGETED}

# Build targeted policy

# Commented out because only targeted ref policy currently builds

%makeCmds targeted mcs n y allow

%installCmds targeted mcs n y allow

%endif

%if %{BUILD_MINIMUM}

# Build minimum policy

# Commented out because only minimum ref policy currently builds

%makeCmds minimum mcs n y allow

%installCmds minimum mcs n y allow

%endif

%if %{BUILD_MLS}

# Build mls policy

%makeCmds mls mls n y deny

%installCmds mls mls n y deny

%endif

%if %{BUILD_OLPC}

# Build olpc policy

# Commented out because only olpc ref policy currently builds

%makeCmds olpc mcs n y allow

%installCmds olpc mcs n y allow

%endif

make UNK_PERMS=allow NAME=targeted TYPE=mcs DISTRO=%{distro} UBAC=n DIRECT_INITRC=n MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} PKGNAME=%{name}-%{version} POLY=y MLS_CATS=1024 MCS_CATS=1024 install-headers install-docs

mkdir %{buildroot}%{_usr}/share/selinux/devel/

mkdir %{buildroot}%{_usr}/share/selinux/packages/

mv %{buildroot}%{_usr}/share/selinux/targeted/include %{buildroot}%{_usr}/share/selinux/devel/include

install -m 755 selinux_config/policygentool %{buildroot}%{_usr}/share/selinux/devel/

install -m 644 selinux_config/Makefile.devel %{buildroot}%{_usr}/share/selinux/devel/Makefile

install -m 644 doc/example.* %{buildroot}%{_usr}/share/selinux/devel/

install -m 644 doc/policy.* %{buildroot}%{_usr}/share/selinux/devel/

echo  "xdg-open file:///usr/share/doc/selinux-policy-%{version}/html/index.html"> %{buildroot}%{_usr}/share/selinux/devel/policyhelp

chmod +x %{buildroot}%{_usr}/share/selinux/devel/policyhelp

rm -rf selinux_config

%clean

%{__rm} -fR %{buildroot}

%post

if [ ! -s /etc/selinux/config ]; then

#

#     New install so we will default to targeted policy

#

echo "

# This file controls the state of SELinux on the system.

# SELINUX= can take one of these three values:

#     enforcing - SELinux security policy is enforced.

#     permissive - SELinux prints warnings instead of enforcing.

#     disabled - No SELinux policy is loaded.

SELINUX=enforcing

# SELINUXTYPE= can take one of these two values:

#     targeted - Targeted processes are protected,

#     mls - Multi Level Security protection.

SELINUXTYPE=targeted 

" > /etc/selinux/config

     ln -sf ../selinux/config /etc/sysconfig/selinux 

     restorecon /etc/selinux/config 2> /dev/null || :

else

     . /etc/selinux/config

     # if first time update booleans.local needs to be copied to sandbox

     [ -f /etc/selinux/${SELINUXTYPE}/booleans.local ] && mv /etc/selinux/${SELINUXTYPE}/booleans.local /etc/selinux/targeted/modules/active/

     [ -f /etc/selinux/${SELINUXTYPE}/seusers ] && cp -f /etc/selinux/${SELINUXTYPE}/seusers /etc/selinux/${SELINUXTYPE}/modules/active/seusers

fi

exit 0

%postun

if [ $1 = 0 ]; then

     setenforce 0 2> /dev/null

     if [ ! -s /etc/selinux/config ]; then

          echo "SELINUX=disabled" > /etc/selinux/config

     else

          sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config

     fi

fi

exit 0

%if %{BUILD_TARGETED}

%package targeted

Summary: SELinux targeted base policy

Provides: selinux-policy-base = %{version}-%{release}

Group: System Environment/Base

Obsoletes: selinux-policy-targeted-sources < 2

Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}

Requires(pre): coreutils

Requires(pre): selinux-policy = %{version}-%{release}

Requires: selinux-policy = %{version}-%{release}

Conflicts:  audispd-plugins <= 1.7.7-1

Obsoletes: mod_fcgid-selinux <= %{version}-%{release}

Obsoletes: cachefilesd-selinux <= 0.10-1

Conflicts:  seedit

%description targeted

SELinux Reference policy targeted base module.

%pre targeted

%saveFileContext targeted

%post targeted

packages=`cat /usr/share/selinux/targeted/modules.lst`

if [ $1 -eq 1 ]; then

   %loadpolicy targeted $packages

   restorecon -R /root /var/log /var/run /var/lib 2> /dev/null

else

   semodule -n -s targeted -r moilscanner -r mailscanner -r gamin -r audio_entropy -r iscsid -r polkit_auth -r polkit -r rtkit_daemon -r ModemManager 2>/dev/null

   %loadpolicy targeted $packages

   %relabel targeted

fi

exit 0

%triggerpostun targeted -- selinux-policy-targeted < 3.2.5-9.fc9

. /etc/selinux/config

[ "${SELINUXTYPE}" != "targeted" ] && exit 0

setsebool -P use_nfs_home_dirs=1

semanage user -l | grep -s unconfined_u > /dev/null

if [ $? -eq 0 ]; then

   semanage user -m -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u

else

   semanage user -a -P user -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u

fi

seuser=`semanage login -l | grep __default__ | awk '{ print $2 }'`

[ "$seuser" != "unconfined_u" ]  && semanage login -m -s "unconfined_u"  -r s0-s0:c0.c1023 __default__

seuser=`semanage login -l | grep root | awk '{ print $2 }'`

[ "$seuser" = "system_u" ] && semanage login -m -s "unconfined_u"  -r s0-s0:c0.c1023 root

restorecon -R /root /etc/selinux/targeted 2> /dev/null

semodule -r qmail 2> /dev/null

exit 0

%files targeted

%defattr(-,root,root,-)

%config(noreplace) %{_sysconfdir}/selinux/targeted/contexts/users/unconfined_u

%fileList targeted

%endif

%if %{BUILD_MINIMUM}

%package minimum

Summary: SELinux minimum base policy

Provides: selinux-policy-base = %{version}-%{release}

Group: System Environment/Base

Requires(post): policycoreutils-python >= %{POLICYCOREUTILSVER}

Requires(pre): coreutils

Requires(pre): selinux-policy = %{version}-%{release}

Requires: selinux-policy = %{version}-%{release}

Conflicts:  seedit

%description minimum

SELinux Reference policy minimum base module.

%pre minimum

%saveFileContext minimum

%post minimum

packages="execmem.pp.bz2 unconfined.pp.bz2 unconfineduser.pp.bz2"

%loadpolicy minimum $packages

if [ $1 -eq 1 ]; then

semanage -S minimum -i - << __eof

login -m  -s unconfined_u -r s0-s0:c0.c1023 __default__

login -m  -s unconfined_u -r s0-s0:c0.c1023 root

__eof

restorecon -R /root /var/log /var/run /var/lib 2> /dev/null

else

%relabel minimum

fi

exit 0

%files minimum

%defattr(-,root,root,-)

%config(noreplace) %{_sysconfdir}/selinux/minimum/contexts/users/unconfined_u

%fileList minimum

%endif

%if %{BUILD_OLPC}

%package olpc 

Summary: SELinux olpc base policy

Group: System Environment/Base

Provides: selinux-policy-base = %{version}-%{release}

Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}

Requires(pre): coreutils

Requires(pre): selinux-policy = %{version}-%{release}

Requires: selinux-policy = %{version}-%{release}

Conflicts:  seedit

%description olpc 

SELinux Reference policy olpc base module.

%pre olpc 

%saveFileContext olpc

%post olpc 

packages=`cat /usr/share/selinux/olpc/modules.lst`

%loadpolicy olpc $packages

if [ $1 -ne 1 ]; then

%relabel olpc

fi

exit 0

%files olpc

%defattr(-,root,root,-)

%fileList olpc

%endif

%if %{BUILD_MLS}

%package mls 

Summary: SELinux mls base policy

Group: System Environment/Base

Provides: selinux-policy-base = %{version}-%{release}

Obsoletes: selinux-policy-mls-sources < 2

Requires: policycoreutils-newrole >= %{POLICYCOREUTILSVER} setransd

Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}

Requires(pre): coreutils

Requires(pre): selinux-policy = %{version}-%{release}

Requires: selinux-policy = %{version}-%{release}

Conflicts:  seedit

%description mls 

SELinux Reference policy mls base module.

%pre mls 

%saveFileContext mls

%post mls 

semodule -n -s mls -r mailscanner -r polkit -r ModemManager 2>/dev/null

packages=`cat /usr/share/selinux/mls/modules.lst`

%loadpolicy mls $packages

if [ $1 -eq 1 ]; then

   restorecon -R /root /var/log /var/run /var/lib 2> /dev/null

else

%relabel mls

fi

exit 0

%files mls

%defattr(-,root,root,-)

%config(noreplace) %{_sysconfdir}/selinux/mls/contexts/users/unconfined_u

%fileList mls

%endif

%changelog

* Thu May 27 2010 Dan Walsh <dwalsh@redhat.com> 3.8.1-3

- Fixes for accountsdialog

- Fixes for boinc

* Thu May 27 2010 Dan Walsh <dwalsh@redhat.com> 3.8.1-2

- Fix label on /var/lib/dokwiki

- Change permissive domains to enforcing

- Fix libvirt policy to allow it to run on mls

* Tue May 25 2010 Dan Walsh <dwalsh@redhat.com> 3.8.1-1

- Update to upstream

* Tue May 25 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-22

- Allow procmail to execute scripts in the users home dir that are labeled home_bin_t

- Fix /var/run/abrtd.lock label

* Mon May 24 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-21

- Allow login programs to read krb5_home_t

Resolves: 594833

- Add obsoletes for cachefilesfd-selinux package

Resolves: #575084

* Thu May 20 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-20

- Allow mount to r/w abrt fifo file

- Allow svirt_t to getattr on hugetlbfs

- Allow abrt to create a directory under /var/spool

* Wed May 19 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-19

- Add labels for /sys

- Allow sshd to getattr on shutdown

- Fixes for munin

- Allow sssd to use the kernel key ring

- Allow tor to send syslog messages

- Allow iptabels to read usr files

- allow policykit to read all domains state

* Thu May 13 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-17

- Fix path for /var/spool/abrt

- Allow nfs_t as an entrypoint for http_sys_script_t

- Add policy for piranha

- Lots of fixes for sosreport

* Wed May 12 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-16

- Allow xm_t to read network state and get and set capabilities

- Allow policykit to getattr all processes

- Allow denyhosts to connect to tcp port 9911

- Allow pyranha to use raw ip sockets and ptrace itself

- Allow unconfined_execmem_t and gconfsd mechanism to dbus

- Allow staff to kill ping process

- Add additional MLS rules

* Mon May 10 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-15

- Allow gdm to edit ~/.gconf dir

Resolves: #590677

- Allow dovecot to create directories in /var/lib/dovecot

Partially resolves 590224

- Allow avahi to dbus chat with NetworkManager

- Fix cobbler labels

- Dontaudit iceauth_t leaks

- fix /var/lib/lxdm file context

- Allow aiccu to use tun tap devices

- Dontaudit shutdown using xserver.log

* Fri May 6 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-14

- Fixes for sandbox_x_net_t  to match access for sandbox_web_t ++

- Add xdm_etc_t for /etc/gdm directory, allow accountsd to manage this directory

- Add dontaudit interface for bluetooth dbus

- Add chronyd_read_keys, append_keys for initrc_t

- Add log support for ksmtuned

Resolves: #586663

* Thu May 6 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-13

- Allow boinc to send mail

* Wed May 5 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-12

- Allow initrc_t to remove dhcpc_state_t

- Fix label on sa-update.cron

- Allow dhcpc to restart chrony initrc

- Don't allow sandbox to send signals to its parent processes

- Fix transition from unconfined_t -> unconfined_mount_t -> rpcd_t

Resolves: #589136

* Mon May 3 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-11

- Fix location of oddjob_mkhomedir

Resolves: #587385

- fix labeling on /root/.shosts and ~/.shosts

- Allow ipsec_mgmt_t to manage net_conf_t

Resolves: #586760

* Fri Apr 30 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-10

- Dontaudit sandbox trying to connect to netlink sockets

Resolves: #587609

- Add policy for piranha

* Thu Apr 29 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-9

- Fixups for xguest policy

- Fixes for running sandbox firefox

* Wed Apr 28 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-8

- Allow ksmtuned to use terminals

Resolves: #586663

- Allow lircd to write to generic usb devices

* Tue Apr 27 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-7

- Allow sandbox_xserver to connectto unconfined stream

Resolves: #585171

* Mon Apr 26 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-6

- Allow initrc_t to read slapd_db_t

Resolves: #585476

- Allow ipsec_mgmt to use unallocated devpts and to create /etc/resolv.conf

Resolves: #585963

* Thu Apr 22 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-5

- Allow rlogind_t to search /root for .rhosts

Resolves: #582760

- Fix path for cached_var_t

- Fix prelink paths /var/lib/prelink	

- Allow confined users to direct_dri

- Allow mls lvm/cryptosetup to work

* Wed Apr 21 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-4

- Allow virtd_t to manage firewall/iptables config

Resolves: #573585

* Tue Apr 20 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-3

- Fix label on /root/.rhosts

Resolves: #582760

- Add labels for Picasa

- Allow openvpn to read home certs

- Allow plymouthd_t to use tty_device_t

- Run ncftool as iptables_t

- Allow mount to unmount unlabeled_t

- Dontaudit hal leaks

* Wed Apr 14 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-2

- Allow livecd to transition to mount

* Tue Apr 13 2010 Dan Walsh <dwalsh@redhat.com> 3.7.19-1

- Update to upstream

- Allow abrt to delete sosreport

Resolves: #579998

- Allow snmp to setuid and gid

Resolves: #582155

- Allow smartd to use generic scsi devices

Resolves: #582145

* Tue Apr 13 2010 Dan Walsh <dwalsh@redhat.com> 3.7.18-3

- Allow ipsec_t to create /etc/resolv.conf with the correct label

- Fix reserved port destination

- Allow autofs to transition to showmount

- Stop crashing tuned

* Mon Apr 12 2010 Dan Walsh <dwalsh@redhat.com> 3.7.18-2

- Add telepathysofiasip policy

* Mon Apr 5 2010 Dan Walsh <dwalsh@redhat.com> 3.7.18-1

- Update to upstream

- Fix label for  /opt/google/chrome/chrome-sandbox

- Allow modemmanager to dbus with policykit

* Mon Apr 5 2010 Dan Walsh <dwalsh@redhat.com> 3.7.17-6

- Fix allow_httpd_mod_auth_pam to use 	auth_use_pam(httpd_t)

- Allow accountsd to read shadow file

- Allow apache to send audit messages when using pam

- Allow asterisk to bind and connect to sip tcp ports

- Fixes for dovecot 2.0

- Allow initrc_t to setattr on milter directories

- Add procmail_home_t for .procmailrc file

* Thu Apr 1 2010 Dan Walsh <dwalsh@redhat.com> 3.7.17-5

- Fixes for labels during install from livecd

* Thu Apr 1 2010 Dan Walsh <dwalsh@redhat.com> 3.7.17-4

- Fix /cgroup file context 

- Fix broken afs use of unlabled_t

- Allow getty to use the console for s390

* Wed Mar 31 2010 Dan Walsh <dwalsh@redhat.com> 3.7.17-3

- Fix cgroup handling adding policy for /cgroup

- Allow confined users to write to generic usb devices, if user_rw_noexattrfile boolean set

* Tue Mar 30 2010 Dan Walsh <dwalsh@redhat.com> 3.7.17-2

- Merge patches from dgrift

* Mon Mar 29 2010 Dan Walsh <dwalsh@redhat.com> 3.7.17-1

- Update upstream

- Allow abrt to write to the /proc under any process

* Fri Mar 26 2010 Dan Walsh <dwalsh@redhat.com> 3.7.16-2

  - Fix ~/.fontconfig label

- Add /root/.cert label

- Allow reading of the fixed_file_disk_t:lnk_file if you can read file

- Allow qemu_exec_t as an entrypoint to svirt_t

* Tue Mar 23 2010 Dan Walsh <dwalsh@redhat.com> 3.7.16-1

- Update to upstream

- Allow tmpreaper to delete sandbox sock files

- Allow chrome-sandbox_t to use /dev/zero, and dontaudit getattr file systems

- Fixes for gitosis

- No transition on livecd to passwd or chfn

- Fixes for denyhosts

* Tue Mar 23 2010 Dan Walsh <dwalsh@redhat.com> 3.7.15-4

- Add label for /var/lib/upower

- Allow logrotate to run sssd

- dontaudit readahead on tmpfs blk files

- Allow tmpreaper to setattr on sandbox files

- Allow confined users to execute dos files

- Allow sysadm_t to kill processes running within its clearance

- Add accountsd policy

- Fixes for corosync policy

- Fixes from crontab policy

- Allow svirt to manage svirt_image_t chr files

- Fixes for qdisk policy

- Fixes for sssd policy

- Fixes for newrole policy

* Thu Mar 18 2010 Dan Walsh <dwalsh@redhat.com> 3.7.15-3

- make libvirt work on an MLS platform

* Thu Mar 18 2010 Dan Walsh <dwalsh@redhat.com> 3.7.15-2

- Add qpidd policy

* Thu Mar 18 2010 Dan Walsh <dwalsh@redhat.com> 3.7.15-1

- Update to upstream

* Tue Mar 16 2010 Dan Walsh <dwalsh@redhat.com> 3.7.14-5

- Allow boinc to read kernel sysctl

- Fix snmp port definitions

- Allow apache to read anon_inodefs

* Sun Mar 14 2010 Dan Walsh <dwalsh@redhat.com> 3.7.14-4

- Allow shutdown dac_override

* Sat Mar 13 2010 Dan Walsh <dwalsh@redhat.com> 3.7.14-3

- Add device_t as a file system

- Fix sysfs association

* Fri Mar 12 2010 Dan Walsh <dwalsh@redhat.com> 3.7.14-2

- Dontaudit ipsec_mgmt sys_ptrace

- Allow at to mail its spool files

- Allow nsplugin to search in .pulse directory

* Fri Mar 12 2010 Dan Walsh <dwalsh@redhat.com> 3.7.14-1

- Update to upstream

* Fri Mar 12 2010 Dan Walsh <dwalsh@redhat.com> 3.7.13-4

- Allow users to dbus chat with xdm

- Allow users to r/w wireless_device_t

- Dontaudit reading of process states by ipsec_mgmt

* Thu Mar 11 2010 Dan Walsh <dwalsh@redhat.com> 3.7.13-3

- Fix openoffice from unconfined_t

* Wed Mar 10 2010 Dan Walsh <dwalsh@redhat.com> 3.7.13-2

- Add shutdown policy so consolekit can shutdown system

* Tue Mar 9 2010 Dan Walsh <dwalsh@redhat.com> 3.7.13-1

- Update to upstream

* Thu Mar 4 2010 Dan Walsh <dwalsh@redhat.com> 3.7.12-1

- Update to upstream

* Thu Mar 4 2010 Dan Walsh <dwalsh@redhat.com> 3.7.11-1

- Update to upstream - These are merges of my patches

- Remove 389 labeling conflicts

- Add MLS fixes found in RHEL6 testing

- Allow pulseaudio to run as a service

- Add label for mssql and allow apache to connect to this database port if boolean set

- Dontaudit searches of debugfs mount point

- Allow policykit_auth to send signals to itself

- Allow modcluster to call getpwnam

- Allow swat to signal winbind

- Allow usbmux to run as a system role

- Allow svirt to create and use devpts

* Mon Mar 1 2010 Dan Walsh <dwalsh@redhat.com> 3.7.10-5

- Add MLS fixes found in RHEL6 testing

- Allow domains to append to rpm_tmp_t

- Add cachefilesfd policy

- Dontaudit leaks when transitioning

* Wed Feb 23 2010 Dan Walsh <dwalsh@redhat.com> 3.7.10-4

- Change allow_execstack and allow_execmem booleans to on

- dontaudit acct using console

- Add label for fping

- Allow tmpreaper to delete sandbox_file_t

- Fix wine dontaudit mmap_zero

- Allow abrt to read var_t symlinks

* Tue Feb 22 2010 Dan Walsh <dwalsh@redhat.com> 3.7.10-3

- Additional policy for rgmanager

* Mon Feb 22 2010 Dan Walsh <dwalsh@redhat.com> 3.7.10-2

- Allow sshd to setattr on pseudo terms

* Mon Feb 22 2010 Dan Walsh <dwalsh@redhat.com> 3.7.10-1

- Update to upstream

* Thu Feb 18 2010 Dan Walsh <dwalsh@redhat.com> 3.7.9-4

- Allow policykit to send itself signals

* Wed Feb 17 2010 Dan Walsh <dwalsh@redhat.com> 3.7.9-3

- Fix duplicate cobbler definition

* Wed Feb 17 2010 Dan Walsh <dwalsh@redhat.com> 3.7.9-2

- Fix file context of /var/lib/avahi-autoipd

* Fri Feb 12 2010 Dan Walsh <dwalsh@redhat.com> 3.7.9-1

- Merge with upstream

* Thu Feb 11 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-11

- Allow sandbox to work with MLS 

* Tue Feb 9 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-9

- Make Chrome work with staff user

* Thu Feb 4 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-8

- Add icecast policy

- Cleanup  spec file

* Wed Feb 3 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-7

- Add mcelog policy

* Mon Feb 1 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-6

- Lots of fixes found in F12

* Thu Jan 27 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-5

- Fix rpm_dontaudit_leaks

* Wed Jan 27 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-4

- Add getsched to hald_t

- Add file context for Fedora/Redhat Directory Server

* Mon Jan 25 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-3

- Allow abrt_helper to getattr on all filesystems

- Add label for /opt/real/RealPlayer/plugins/oggfformat\.so     

* Thu Jan 21 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-2

- Add gstreamer_home_t for ~/.gstreamer

* Mon Jan 18 2010 Dan Walsh <dwalsh@redhat.com> 3.7.8-1

- Update to upstream

* Fri Jan 15 2010 Dan Walsh <dwalsh@redhat.com> 3.7.7-3

- Fix git

* Thu Jan 7 2010 Dan Walsh <dwalsh@redhat.com> 3.7.7-2

- Turn on puppet policy

- Update to dgrift git policy

* Mon Jan 7 2010 Dan Walsh <dwalsh@redhat.com> 3.7.7-1

- Move users file to selection by spec file.

- Allow vncserver to run as unconfined_u:unconfined_r:unconfined_t

* Thu Jan 7 2010 Dan Walsh <dwalsh@redhat.com> 3.7.6-1

- Update to upstream

* Wed Jan 6 2010 Dan Walsh <dwalsh@redhat.com> 3.7.5-8

- Remove most of the permissive domains from F12.

* Tue Jan 5 2010 Dan Walsh <dwalsh@redhat.com> 3.7.5-7

- Add cobbler policy from dgrift

* Mon Jan 4 2010 Dan Walsh <dwalsh@redhat.com> 3.7.5-6

- add usbmon device

- Add allow rulse for devicekit_disk

* Wed Dec 30 2009 Dan Walsh <dwalsh@redhat.com> 3.7.5-5

- Lots of fixes found in F12, fixes from Tom London

* Wed Dec 23 2009 Dan Walsh <dwalsh@redhat.com> 3.7.5-4

- Cleanups from dgrift

* Tue Dec 22 2009 Dan Walsh <dwalsh@redhat.com> 3.7.5-3

- Add back xserver_manage_home_fonts

* Mon Dec 21 2009 Dan Walsh <dwalsh@redhat.com> 3.7.5-2

- Dontaudit sandbox trying to read nscd and sssd

* Fri Dec 18 2009 Dan Walsh <dwalsh@redhat.com> 3.7.5-1

- Update to upstream

* Thu Dec 17 2009 Dan Walsh <dwalsh@redhat.com> 3.7.4-4

- Rename udisks-daemon back to devicekit_disk_t policy

* Wed Dec 16 2009 Dan Walsh <dwalsh@redhat.com> 3.7.4-3

- Fixes for abrt calls

* Fri Dec 11 2009 Dan Walsh <dwalsh@redhat.com> 3.7.4-2

- Add tgtd policy

* Fri Dec 4 2009 Dan Walsh <dwalsh@redhat.com> 3.7.4-1

- Update to upstream release

* Mon Nov 16 2009 Dan Walsh <dwalsh@redhat.com> 3.7.3-1

- Add asterisk policy back in

- Update to upstream release 2.20091117

* Mon Nov 16 2009 Dan Walsh <dwalsh@redhat.com> 3.7.1-1

- Update to upstream release 2.20091117

* Mon Nov 16 2009 Dan Walsh <dwalsh@redhat.com> 3.6.33-2

- Fixup nut policy

* Thu Nov 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.33-1