%define distro redhat

%define polyinstatiate n

%define monolithic n

%if %{?BUILD_TARGETED:0}%{!?BUILD_TARGETED:1}

%define BUILD_TARGETED 1

%endif

%if %{?BUILD_MINIMUM:0}%{!?BUILD_MINIMUM:1}

%define BUILD_MINIMUM 1

%endif

%if %{?BUILD_OLPC:0}%{!?BUILD_OLPC:1}

%define BUILD_OLPC 0

%endif

%if %{?BUILD_MLS:0}%{!?BUILD_MLS:1}

%define BUILD_MLS 1

%endif

%define POLICYVER 24

%define libsepolver 2.0.41-1

%define POLICYCOREUTILSVER 2.0.78-1

%define CHECKPOLICYVER 2.0.21-1

Summary: SELinux policy configuration

Name: selinux-policy

Version: 3.9.12

Release: 1%{?dist}

License: GPLv2+

Group: System Environment/Base

Source: serefpolicy-%{version}.tgz

patch: policy-F15.patch

Source1: modules-targeted.conf

Source2: booleans-targeted.conf

Source3: Makefile.devel

Source4: setrans-targeted.conf

Source5: modules-mls.conf

Source6: booleans-mls.conf

Source8: setrans-mls.conf

Source9: modules-olpc.conf

Source10: booleans-olpc.conf

Source11: setrans-olpc.conf

Source12: securetty_types-olpc

Source13: policygentool

Source14: securetty_types-targeted

Source15: securetty_types-mls

Source16: modules-minimum.conf

Source17: booleans-minimum.conf

Source18: setrans-minimum.conf

Source19: securetty_types-minimum

Source20: customizable_types

Source21: config.tgz

Source22: users-mls

Source23: users-targeted

Source24: users-olpc

Source25: users-minimum

Url: http://oss.tresys.com/repos/refpolicy/

BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)

BuildArch: noarch

BuildRequires: python gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-python >= %{POLICYCOREUTILSVER} bzip2 

Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER} libsemanage >= 2.0.14-3

Requires(post): /usr/bin/bunzip2 /bin/mktemp /bin/awk

Requires: checkpolicy >= %{CHECKPOLICYVER} m4 

Obsoletes: selinux-policy-devel <= %{version}-%{release}

Provides: selinux-policy-devel = %{version}-%{release}

%description 

SELinux Base package

%files 

%defattr(-,root,root,-)

%{_mandir}/man*/*

# policycoreutils owns these manpage directories, we only own the files within them

%{_mandir}/ru/*/*

%dir %{_usr}/share/selinux

%dir %{_usr}/share/selinux/devel

%dir %{_usr}/share/selinux/devel/include

%dir %{_usr}/share/selinux/packages

%dir %{_sysconfdir}/selinux

%ghost %config(noreplace) %{_sysconfdir}/selinux/config

%ghost %{_sysconfdir}/sysconfig/selinux

%{_usr}/share/selinux/devel/include/*

%{_usr}/share/selinux/devel/Makefile

%{_usr}/share/selinux/devel/policygentool

%{_usr}/share/selinux/devel/example.*

%{_usr}/share/selinux/devel/policy.*

%package doc

Summary: SELinux policy documentation

Group: System Environment/Base

Requires(pre): selinux-policy = %{version}-%{release}

Requires: /usr/bin/xdg-open

%description doc

SELinux policy documentation package

%files doc

%defattr(-,root,root,-)

%doc %{_usr}/share/doc/%{name}-%{version}

%attr(755,root,root) %{_usr}/share/selinux/devel/policyhelp

%check

if /usr/sbin/selinuxenabled; then

/usr/bin/sepolgen-ifgen -i %{buildroot}%{_usr}/share/selinux/devel/include -o /dev/null 

fi

%define makeCmds() \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 bare \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024  conf \

cp -f selinux_config/modules-%1.conf  ./policy/modules.conf \

cp -f selinux_config/booleans-%1.conf ./policy/booleans.conf \

cp -f selinux_config/users-%1 ./policy/users \

%define installCmds() \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 base.pp \

make validate UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 modules \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 install \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 install-appconfig \

#%{__cp} *.pp %{buildroot}/%{_usr}/share/selinux/%1/ \

%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/policy \

%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/modules/active \

%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/contexts/files \

touch %{buildroot}/%{_sysconfdir}/selinux/%1/modules/semanage.read.LOCK \

touch %{buildroot}/%{_sysconfdir}/selinux/%1/modules/semanage.trans.LOCK \

rm -rf %{buildroot}%{_sysconfdir}/selinux/%1/booleans \

touch %{buildroot}%{_sysconfdir}/selinux/%1/seusers \

touch %{buildroot}%{_sysconfdir}/selinux/%1/policy/policy.%{POLICYVER} \

touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts \

touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \

install -m0644 selinux_config/securetty_types-%1 %{buildroot}%{_sysconfdir}/selinux/%1/contexts/securetty_types \

install -m0644 selinux_config/setrans-%1.conf %{buildroot}%{_sysconfdir}/selinux/%1/setrans.conf \

install -m0644 selinux_config/customizable_types %{buildroot}%{_sysconfdir}/selinux/%1/contexts/customizable_types \

bzip2 %{buildroot}/%{_usr}/share/selinux/%1/*.pp \

awk '$1 !~ "/^#/" && $2 == "=" && $3 == "module" { printf "%%s.pp.bz2 ", $1 }' ./policy/modules.conf > %{buildroot}/%{_usr}/share/selinux/%1/modules.lst

%nil

%define fileList() \

%defattr(-,root,root) \

%dir %{_usr}/share/selinux/%1 \

%{_usr}/share/selinux/%1/*.pp.bz2 \

%{_usr}/share/selinux/%1/modules.lst \

%dir %{_sysconfdir}/selinux/%1 \

%config(noreplace) %{_sysconfdir}/selinux/%1/setrans.conf \

%ghost %{_sysconfdir}/selinux/%1/seusers \

%dir %{_sysconfdir}/selinux/%1/modules \

%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/semanage.read.LOCK \

%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/semanage.trans.LOCK \

%attr(700,root,root) %dir %{_sysconfdir}/selinux/%1/modules/active \

#%verify(not md5 size mtime) %attr(600,root,root) %config(noreplace) %{_sysconfdir}/selinux/%1/modules/active/seusers \

%dir %{_sysconfdir}/selinux/%1/policy/ \

%ghost %{_sysconfdir}/selinux/%1/policy/policy.* \

%dir %{_sysconfdir}/selinux/%1/contexts \

%config %{_sysconfdir}/selinux/%1/contexts/customizable_types \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/securetty_types \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/dbus_contexts \

%config %{_sysconfdir}/selinux/%1/contexts/x_contexts \

%config %{_sysconfdir}/selinux/%1/contexts/default_contexts \

%config %{_sysconfdir}/selinux/%1/contexts/virtual_domain_context \

%config %{_sysconfdir}/selinux/%1/contexts/virtual_image_context \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/default_type \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/failsafe_context \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/initrc_context \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/removable_context \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/userhelper_context \

%dir %{_sysconfdir}/selinux/%1/contexts/files \

%ghost %{_sysconfdir}/selinux/%1/contexts/files/file_contexts \

%ghost %{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \

%config %{_sysconfdir}/selinux/%1/contexts/files/media \

%dir %{_sysconfdir}/selinux/%1/contexts/users \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/root \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/guest_u \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/xguest_u \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/user_u \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/staff_u 

%define saveFileContext() \

if [ -s /etc/selinux/config ]; then \

     . %{_sysconfdir}/selinux/config; \

     FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \

     if [ "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT} ]; then \

        [ -f ${FILE_CONTEXT}.pre ] || cp -f ${FILE_CONTEXT} ${FILE_CONTEXT}.pre; \

     fi \

fi

%define loadpolicy() \

( cd /usr/share/selinux/%1; \

semodule -b base.pp.bz2 -i %2 -s %1; \

); \

%define relabel() \

. %{_sysconfdir}/selinux/config; \

FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \

selinuxenabled; \

if [ $? = 0  -a "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT}.pre ]; then \

     fixfiles -C ${FILE_CONTEXT}.pre restore; \

     restorecon -R /root /var/log /var/run /var/lib 2> /dev/null; \

     rm -f ${FILE_CONTEXT}.pre; \

fi; 

%description

SELinux Reference Policy - modular.

Based off of reference policy: Checked out revision  2.20091117

%build

%prep 

%setup -n serefpolicy-%{version} -q

%patch -p1

%install

mkdir selinux_config

for i in %{SOURCE1} %{SOURCE2} %{SOURCE3} %{SOURCE4} %{SOURCE5} %{SOURCE6} %{SOURCE8} %{SOURCE9} %{SOURCE10} %{SOURCE11} %{SOURCE12} %{SOURCE13} %{SOURCE14} %{SOURCE15} %{SOURCE16} %{SOURCE17} %{SOURCE18} %{SOURCE19} %{SOURCE20} %{SOURCE21} %{SOURCE22} %{SOURCE23} %{SOURCE24} %{SOURCE25};do

 cp $i selinux_config

done

tar zxvf selinux_config/config.tgz

# Build targeted policy

%{__rm} -fR %{buildroot}

mkdir -p %{buildroot}%{_mandir}

cp -R  man/* %{buildroot}%{_mandir}

mkdir -p %{buildroot}%{_sysconfdir}/selinux

mkdir -p %{buildroot}%{_sysconfdir}/sysconfig

touch %{buildroot}%{_sysconfdir}/selinux/config

touch %{buildroot}%{_sysconfdir}/sysconfig/selinux

# Always create policy module package directories

mkdir -p %{buildroot}%{_usr}/share/selinux/{targeted,mls,minimum,modules}/

# Install devel

make clean

%if %{BUILD_TARGETED}

# Build targeted policy

# Commented out because only targeted ref policy currently builds

%makeCmds targeted mcs n y allow

%installCmds targeted mcs n y allow

%endif

%if %{BUILD_MINIMUM}

# Build minimum policy

# Commented out because only minimum ref policy currently builds

%makeCmds minimum mcs n y allow

%installCmds minimum mcs n y allow

%endif

%if %{BUILD_MLS}

# Build mls policy

%makeCmds mls mls n y deny

%installCmds mls mls n y deny

%endif

%if %{BUILD_OLPC}

# Build olpc policy

# Commented out because only olpc ref policy currently builds

%makeCmds olpc mcs n y allow

%installCmds olpc mcs n y allow

%endif

make UNK_PERMS=allow NAME=targeted TYPE=mcs DISTRO=%{distro} UBAC=n DIRECT_INITRC=n MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} PKGNAME=%{name}-%{version} POLY=y MLS_CATS=1024 MCS_CATS=1024 install-headers install-docs

mkdir %{buildroot}%{_usr}/share/selinux/devel/

mkdir %{buildroot}%{_usr}/share/selinux/packages/

mv %{buildroot}%{_usr}/share/selinux/targeted/include %{buildroot}%{_usr}/share/selinux/devel/include

install -m 755 selinux_config/policygentool %{buildroot}%{_usr}/share/selinux/devel/

install -m 644 selinux_config/Makefile.devel %{buildroot}%{_usr}/share/selinux/devel/Makefile

install -m 644 doc/example.* %{buildroot}%{_usr}/share/selinux/devel/

install -m 644 doc/policy.* %{buildroot}%{_usr}/share/selinux/devel/

echo  "xdg-open file:///usr/share/doc/selinux-policy-%{version}/html/index.html"> %{buildroot}%{_usr}/share/selinux/devel/policyhelp

chmod +x %{buildroot}%{_usr}/share/selinux/devel/policyhelp

rm -rf selinux_config

%clean

%{__rm} -fR %{buildroot}

%post

if [ ! -s /etc/selinux/config ]; then

#

#     New install so we will default to targeted policy

#

echo "

# This file controls the state of SELinux on the system.

# SELINUX= can take one of these three values:

#     enforcing - SELinux security policy is enforced.

#     permissive - SELinux prints warnings instead of enforcing.

#     disabled - No SELinux policy is loaded.

SELINUX=enforcing

# SELINUXTYPE= can take one of these two values:

#     targeted - Targeted processes are protected,

#     mls - Multi Level Security protection.

SELINUXTYPE=targeted 

" > /etc/selinux/config

     ln -sf ../selinux/config /etc/sysconfig/selinux 

     restorecon /etc/selinux/config 2> /dev/null || :

else

     . /etc/selinux/config

     # if first time update booleans.local needs to be copied to sandbox

     [ -f /etc/selinux/${SELINUXTYPE}/booleans.local ] && mv /etc/selinux/${SELINUXTYPE}/booleans.local /etc/selinux/targeted/modules/active/

     [ -f /etc/selinux/${SELINUXTYPE}/seusers ] && cp -f /etc/selinux/${SELINUXTYPE}/seusers /etc/selinux/${SELINUXTYPE}/modules/active/seusers

fi

exit 0

%postun

if [ $1 = 0 ]; then

     setenforce 0 2> /dev/null

     if [ ! -s /etc/selinux/config ]; then

          echo "SELINUX=disabled" > /etc/selinux/config

     else

          sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config

     fi

fi

exit 0

%if %{BUILD_TARGETED}

%package targeted

Summary: SELinux targeted base policy

Provides: selinux-policy-base = %{version}-%{release}

Group: System Environment/Base

Obsoletes: selinux-policy-targeted-sources < 2

Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}

Requires(pre): coreutils

Requires(pre): selinux-policy = %{version}-%{release}

Requires: selinux-policy = %{version}-%{release}

Conflicts:  audispd-plugins <= 1.7.7-1

Obsoletes: mod_fcgid-selinux <= %{version}-%{release}

Obsoletes: cachefilesd-selinux <= 0.10-1

Conflicts:  seedit

Conflicts:  389-ds-base < 1.2.7, 389-admin < 1.1.12

%description targeted

SELinux Reference policy targeted base module.

%pre targeted

%saveFileContext targeted

%post targeted

packages=`cat /usr/share/selinux/targeted/modules.lst`

if [ $1 -eq 1 ]; then

   %loadpolicy targeted $packages

   restorecon -R /root /var/log /var/run /var/lib 2> /dev/null

else

   semodule -n -s targeted -r pyzor -r razor -r moilscanner mailscanner gamin audio_entropy iscsid polkit_auth polkit rtkit_daemon ModemManager telepathysofiasip ethereal 2>/dev/null

   %loadpolicy targeted $packages

   %relabel targeted

fi

exit 0

%triggerpostun targeted -- selinux-policy-targeted < 3.2.5-9.fc9

. /etc/selinux/config

[ "${SELINUXTYPE}" != "targeted" ] && exit 0

setsebool -P use_nfs_home_dirs=1

semanage user -l | grep -s unconfined_u > /dev/null

if [ $? -eq 0 ]; then

   semanage user -m -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u

else

   semanage user -a -P user -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u

fi

seuser=`semanage login -l | grep __default__ | awk '{ print $2 }'`

[ "$seuser" != "unconfined_u" ]  && semanage login -m -s "unconfined_u"  -r s0-s0:c0.c1023 __default__

seuser=`semanage login -l | grep root | awk '{ print $2 }'`

[ "$seuser" = "system_u" ] && semanage login -m -s "unconfined_u"  -r s0-s0:c0.c1023 root

restorecon -R /root /etc/selinux/targeted 2> /dev/null

semodule -r qmail 2> /dev/null

exit 0

%files targeted

%defattr(-,root,root,-)

%config(noreplace) %{_sysconfdir}/selinux/targeted/contexts/users/unconfined_u

%fileList targeted

%endif

%if %{BUILD_MINIMUM}

%package minimum

Summary: SELinux minimum base policy

Provides: selinux-policy-base = %{version}-%{release}

Group: System Environment/Base

Requires(post): policycoreutils-python >= %{POLICYCOREUTILSVER}

Requires(pre): coreutils

Requires(pre): selinux-policy = %{version}-%{release}

Requires: selinux-policy = %{version}-%{release}

Conflicts:  seedit

%description minimum

SELinux Reference policy minimum base module.

%pre minimum

%saveFileContext minimum

%post minimum

packages="execmem.pp.bz2 unconfined.pp.bz2 unconfineduser.pp.bz2"

%loadpolicy minimum $packages

if [ $1 -eq 1 ]; then

semanage -S minimum -i - << __eof

login -m  -s unconfined_u -r s0-s0:c0.c1023 __default__

login -m  -s unconfined_u -r s0-s0:c0.c1023 root

__eof

restorecon -R /root /var/log /var/run /var/lib 2> /dev/null

else

%relabel minimum

fi

exit 0

%files minimum

%defattr(-,root,root,-)

%config(noreplace) %{_sysconfdir}/selinux/minimum/contexts/users/unconfined_u

%fileList minimum

%endif

%if %{BUILD_OLPC}

%package olpc 

Summary: SELinux olpc base policy

Group: System Environment/Base

Provides: selinux-policy-base = %{version}-%{release}

Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}

Requires(pre): coreutils

Requires(pre): selinux-policy = %{version}-%{release}

Requires: selinux-policy = %{version}-%{release}

Conflicts:  seedit

%description olpc 

SELinux Reference policy olpc base module.

%pre olpc 

%saveFileContext olpc

%post olpc 

packages=`cat /usr/share/selinux/olpc/modules.lst`

%loadpolicy olpc $packages

if [ $1 -ne 1 ]; then

%relabel olpc

fi

exit 0

%files olpc

%defattr(-,root,root,-)

%fileList olpc

%endif

%if %{BUILD_MLS}

%package mls 

Summary: SELinux mls base policy

Group: System Environment/Base

Provides: selinux-policy-base = %{version}-%{release}

Obsoletes: selinux-policy-mls-sources < 2

Requires: policycoreutils-newrole >= %{POLICYCOREUTILSVER} setransd

Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}

Requires(pre): coreutils

Requires(pre): selinux-policy = %{version}-%{release}

Requires: selinux-policy = %{version}-%{release}

Conflicts:  seedit

%description mls 

SELinux Reference policy mls base module.

%pre mls 

%saveFileContext mls

%post mls 

semodule -n -s mls -r pyzor -r razor -r mailscanner polkit ModemManager telepathysofiasip ethereal 2>/dev/null

packages=`cat /usr/share/selinux/mls/modules.lst`

%loadpolicy mls $packages

if [ $1 -eq 1 ]; then

   restorecon -R /root /var/log /var/run /var/lib 2> /dev/null

else

%relabel mls

fi

exit 0

%files mls

%defattr(-,root,root,-)

%config(noreplace) %{_sysconfdir}/selinux/mls/contexts/users/unconfined_u

%fileList mls

%endif

%changelog

* Wed Dec 15 2010 Dan Walsh <dwalsh@redhat.com> 3.9.11-2

- Update selinux policy to handle new /usr/share/sandbox/start script

* Wed Dec 15 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.11-1

- Update to upstream

- Fix version of policy in spec file

* Tue Dec 14 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.10-13

- Allow sandbox to run on nfs partitions, fixes for systemd_tmpfs

- remove per sandbox domains devpts types

- Allow dkim-milter sending signal to itself

* Mon Dec 13 2010 Dan Walsh <dwalsh@redhat.com> 3.9.10-12

- Allow domains that transition to ping or traceroute, kill them

- Allow user_t to conditionally transition to ping_t and traceroute_t

- Add fixes to systemd- tools, including new labeling for systemd-fsck, systemd-cryptsetup

* Mon Dec 13 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.10-11

- Turn on systemd policy

- mozilla_plugin needs to read certs in the homedir.

- Dontaudit leaked file descriptors from devicekit

- Fix ircssi to use auth_use_nsswitch

- Change to use interface without param in corenet to disable unlabelednet packets

- Allow init to relabel sockets and fifo files in /dev

- certmonger needs dac* capabilities to manage cert files not owned by root

- dovecot needs fsetid to change group membership on mail

- plymouthd removes /var/log/boot.log

- systemd is creating symlinks in /dev

- Change label on /etc/httpd/alias to be all cert_t

* Fri Dec 10 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.10-10

- Fixes for clamscan and boinc policy

- Add boinc_project_t setpgid

- Allow alsa to create tmp files in /tmp

* Tue Dec 7 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.10-9

- Push fixes to allow disabling of unlabeled_t packet access

- Enable unlabelednet policy

* Tue Dec 7 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.10-8

- Fixes for lvm to work with systemd

* Mon Dec 6 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.10-7

- Fix the label for wicd log

- plymouthd creates force-display-on-active-vt file

- Allow avahi to request the kernel to load a module

- Dontaudit hal leaks

- Fix gnome_manage_data interface

- Add new interface corenet_packet to define a type as being an packet_type.

- Removed general access to packet_type from icecast and squid.

- Allow mpd to read alsa config

- Fix the label for wicd log

- Add systemd policy

* Fri Dec 3 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.10-6

- Fix gnome_manage_data interface

- Dontaudit sys_ptrace capability for iscsid

- Fixes for nagios plugin policy

* Thu Dec 1 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.10-5

- Fix cron to run ranged when started by init

- Fix devicekit to use log files

- Dontaudit use of devicekit_var_run_t for fstools

- Allow init to setattr on logfile directories

- Allow hald to manage files in /var/run/pm-utils/ dir which is now labeled as devicekit_var_run_t

* Tue Nov 30 2010 Dan Walsh <dwalsh@redhat.com> 3.9.10-4

- Fix up handling of dnsmasq_t creating /var/run/libvirt/network

- Turn on sshd_forward_ports boolean by default

- Allow sysadmin to dbus chat with rpm

- Add interface for rw_tpm_dev

- Allow cron to execute bin

- fsadm needs to write sysfs

- Dontaudit consoletype reading /var/run/pm-utils

- Lots of new privs fro mozilla_plugin_t running java app, make mozilla_plugin

- certmonger needs to manage dirsrv data

- /var/run/pm-utils should be labeled as devicekit_var_run_t

* Tue Nov 30 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.10-3

- fixes to allow /var/run and /var/lock as tmpfs

- Allow chrome sandbox to connect to web ports

- Allow dovecot to listem on lmtp and sieve ports

- Allov ddclient to search sysctl_net_t

- Transition back to original domain if you execute the shell

* Thu Nov 25 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.10-2

- Remove duplicate declaration

* Thu Nov 25 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.10-1

- Update to upstream

- Cleanup for sandbox

- Add attribute to be able to select sandbox types

* Mon Nov 22 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.9-4

- Allow ddclient to fix file mode bits of ddclient conf file

- init leaks file descriptors to daemons

- Add labels for /etc/lirc/ and

- Allow amavis_t to exec shell

- Add label for gssd_tmp_t for /var/tmp/nfs_0

* Thu Nov 18 2010 Dan Walsh <dwalsh@redhat.com> 3.9.9-3

- Put back in lircd_etc_t so policy will install

* Thu Nov 18 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.9-2

- Turn on allow_postfix_local_write_mail_spool

- Allow initrc_t to transition to shutdown_t

- Allow logwatch and cron to mls_read_to_clearance for MLS boxes

- Allow wm to send signull to all applications and receive them from users

- lircd patch from field

- Login programs have to read /etc/samba

- New programs under /lib/systemd

- Abrt needs to read config files

* Tue Nov 16 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.9-1

- Update to upstream

- Dontaudit leaked sockets from userdomains to user domains

- Fixes for mcelog to handle scripts

- Apply patch from Ruben Kerkhof

- Allow syslog to search spool dirs

* Mon Nov 15 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.8-7

- Allow nagios plugins to read usr files

- Allow mysqld-safe to send system log messages

- Fixes fpr ddclient policy

- Fix sasl_admin interface

- Allow apache to search zarafa config

- Allow munin plugins to search /var/lib directory

- Allow gpsd to read sysfs_t

- Fix labels on /etc/mcelog/triggers to bin_t

* Fri Nov 12 2010 Dan Walsh <dwalsh@redhat.com> 3.9.8-6

- Remove saslauthd_tmp_t and transition tmp files to krb5_host_rcache_t

- Allow saslauthd_t to create krb5_host_rcache_t files in /tmp

- Fix xserver interface

- Fix definition of /var/run/lxdm

* Fri Nov 12 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.8-5

- Turn on mediawiki policy

- kdump leaks kdump_etc_t to ifconfig, add dontaudit

- uux needs to transition to uucpd_t

- More init fixes relabels man,faillog

- Remove maxima defs in libraries.fc

- insmod needs to be able to create tmpfs_t files

- ping needs setcap

* Wed Nov 10 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.8-4

- Allow groupd transition to fenced domain when executes fence_node

- Fixes for rchs policy

- Allow mpd to be able to read samba/nfs files

* Tue Nov 9 2010 Dan Walsh <dwalsh@redhat.com> 3.9.8-3

- Fix up corecommands.fc to match upstream

- Make sure /lib/systemd/* is labeled init_exec_t

- mount wants to setattr on all mountpoints

- dovecot auth wants to read dovecot etc files

- nscd daemon looks at the exe file of the comunicating daemon

- openvpn wants to read utmp file

- postfix apps now set sys_nice and lower limits

- remote_login (telnetd/login) wants to use telnetd_devpts_t and user_devpts_t to work correctly

- Also resolves nsswitch

- Fix labels on /etc/hosts.*

- Cleanup to make upsteam patch work

- allow abrt to read etc_runtime_t

* Fri Nov 5 2010 Dan Walsh <dwalsh@redhat.com> 3.9.8-2

- Add conflicts for dirsrv package

* Fri Nov 5 2010 Dan Walsh <dwalsh@redhat.com> 3.9.8-1

- Update to upstream

- Add vlock policy

* Wed Nov 3 2010 Dan Walsh <dwalsh@redhat.com> 3.9.7-10

- Fix sandbox to work on nfs homedirs

- Allow cdrecord to setrlimit

- Allow mozilla_plugin to read xauth

- Change label on systemd-logger to syslogd_exec_t

- Install dirsrv policy from dirsrv package

* Tue Nov 2 2010 Dan Walsh <dwalsh@redhat.com> 3.9.7-9

- Add virt_home_t, allow init to setattr on xserver_tmp_t and relabel it

- Udev needs to stream connect to init and kernel

- Add xdm_exec_bootloader boolean, which allows xdm to execute /sbin/grub and read files in /boot directory

* Mon Nov 1 2010 Dan Walsh <dwalsh@redhat.com> 3.9.7-8

- Allow NetworkManager to read openvpn_etc_t

- Dontaudit hplip to write of /usr dirs

- Allow system_mail_t to create /root/dead.letter as mail_home_t

- Add vdagent policy for spice agent daemon

* Thu Oct 28 2010 Dan Walsh <dwalsh@redhat.com> 3.9.7-7

- Dontaudit sandbox sending sigkill to all user domains

- Add policy for rssh_chroot_helper

- Add missing flask definitions

- Allow udev to relabelto removable_t

- Fix label on /var/log/wicd.log

- Transition to initrc_t from init when executing bin_t

- Add audit_access permissions to file

- Make removable_t a device_node 

- Fix label on /lib/systemd/*

* Fri Oct 22 2010 Dan Walsh <dwalsh@redhat.com> 3.9.7-6

- Fixes for systemd to manage /var/run

- Dontaudit leaks by firstboot

* Tue Oct 19 2010 Dan Walsh <dwalsh@redhat.com> 3.9.7-5

- Allow chome to create netlink_route_socket

- Add additional MATHLAB file context

- Define nsplugin as an application_domain

- Dontaudit sending signals from sandboxed domains to other domains

- systemd requires init to build /tmp /var/auth and /var/lock dirs

- mount wants to read devicekit_power /proc/ entries

- mpd wants to connect to soundd port

- Openoffice causes a setattr on a lib_t file for normal users, add dontaudit

- Treat lib_t and textrel_shlib_t directories the same

- Allow mount read access on virtual images

* Fri Oct 15 2010 Dan Walsh <dwalsh@redhat.com> 3.9.7-4

- Allow sandbox_x_domains to work with nfs/cifs/fusefs home dirs.

- Allow devicekit_power to domtrans to mount

- Allow dhcp to bind to udp ports > 1024 to do named stuff

- Allow ssh_t to exec ssh_exec_t

- Remove telepathy_butterfly_rw_tmp_files(), dev_read_printk() interfaces which are nolonger used

- Fix clamav_append_log() intefaces

- Fix 'psad_rw_fifo_file' interface

* Fri Oct 15 2010 Dan Walsh <dwalsh@redhat.com> 3.9.7-3

- Allow cobblerd to list cobler appache content

* Fri Oct 15 2010 Dan Walsh <dwalsh@redhat.com> 3.9.7-2

- Fixup for the latest version of upowed

- Dontaudit sandbox sending SIGNULL to desktop apps

* Wed Oct 13 2010 Dan Walsh <dwalsh@redhat.com> 3.9.7-1

- Update to upstream

* Tue Oct 12 2010 Dan Walsh <dwalsh@redhat.com> 3.9.6-3

-Mount command from a confined user generates setattr on /etc/mtab file, need to dontaudit this access

- dovecot-auth_t needs ipc_lock

- gpm needs to use the user terminal

- Allow system_mail_t to append ~/dead.letter

- Allow NetworkManager to edit /etc/NetworkManager/NetworkManager.conf

- Add pid file to vnstatd

- Allow mount to communicate with gfs_controld

- Dontaudit hal leaks in setfiles

* Fri Oct 8 2010 Dan Walsh <dwalsh@redhat.com> 3.9.6-2

- Lots of fixes for systemd

- systemd now executes readahead and tmpwatch type scripts

- Needs to manage random seed

* Thu Oct 7 2010 Dan Walsh <dwalsh@redhat.com> 3.9.6-1

- Allow smbd to use sys_admin

- Remove duplicate file context for tcfmgr

- Update to upstream

* Wed Oct 6 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-11

- Fix fusefs handling

- Do not allow sandbox to manage nsplugin_rw_t

- Allow mozilla_plugin_t to connecto its parent

- Allow init_t to connect to plymouthd running as kernel_t

- Add mediawiki policy

- dontaudit sandbox sending signals to itself.  This can happen when they are running at different mcs.

- Disable transition from dbus_session_domain to telepathy for F14

- Allow boinc_project to use shm

- Allow certmonger to search through directories that contain certs

- Allow fail2ban the DAC Override so it can read log files owned by non root users

* Mon Oct 4 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-10

- Start adding support for use_fusefs_home_dirs

- Add /var/lib/syslog directory file context

- Add /etc/localtime as locale file context

* Thu Sep 30 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-9

- Turn off default transition to mozilla_plugin and telepathy domains from unconfined user 

- Turn off iptables from unconfined user 

- Allow sudo to send signals to any domains the user could have transitioned to.

- Passwd in single user mode needs to talk to console_device_t

- Mozilla_plugin_t needs to connect to web ports, needs to write to video device, and read alsa_home_t alsa setsup pulseaudio

- locate tried to read a symbolic link, will dontaudit

- New labels for telepathy-sunshine content in homedir

- Google is storing other binaries under /opt/google/talkplugin

- bluetooth/kernel is creating unlabeled_t socket that I will allow it to use until kernel fixes bug

- Add boolean for unconfined_t transition to mozilla_plugin_t and telepathy domains, turned off in F14 on in F15

- modemmanger and bluetooth send dbus messages to devicekit_power

- Samba needs to getquota on filesystems labeld samba_share_t

* Wed Sep 29 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-8

- Dontaudit attempts by xdm_t to write to bin_t for kdm

- Allow initrc_t to manage system_conf_t

* Mon Sep 27 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-7

- Fixes to allow mozilla_plugin_t to create nsplugin_home_t directory.

- Allow mozilla_plugin_t to create tcp/udp/netlink_route sockets

- Allow confined users to read xdm_etc_t files

- Allow xdm_t to transition to xauth_t for lxdm program

* Sun Sep 26 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-6

- Rearrange firewallgui policy to be more easily updated to upstream, dontaudit search of /home

- Allow clamd to send signals to itself

- Allow mozilla_plugin_t to read user home content.  And unlink pulseaudio shm.

- Allow haze to connect to yahoo chat and messenger port tcp:5050.

Bz #637339

- Allow guest to run ps command on its processes by allowing it to read /proc

- Allow firewallgui to sys_rawio which seems to be required to setup masqerading

- Allow all domains to search through default_t directories, in order to find differnet labels.  For example people serring up /foo/bar to be share via samba.

- Add label for /var/log/slim.log

* Fri Sep 24 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-5

- Pull in cleanups from dgrift

- Allow mozilla_plugin_t to execute mozilla_home_t

- Allow rpc.quota to do quotamod

* Thu Sep 23 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-4

- Cleanup policy via dgrift

- Allow dovecot_deliver to append to inherited log files

- Lots of fixes for consolehelper

* Wed Sep 21 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-3

- Fix up Xguest policy

* Thu Sep 16 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-2

- Add vnstat policy

- allow libvirt to send audit messages

- Allow chrome-sandbox to search nfs_t

* Thu Sep 16 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-1

- Update to upstream

* Wed Sep 15 2010 Dan Walsh <dwalsh@redhat.com> 3.9.4-3

- Add the ability to send audit messages to confined admin policies

- Remove permissive domain from cmirrord and dontaudit sys_tty_config

- Split out unconfined_domain() calls from other unconfined_ calls so we can d

- virt needs to be able to read processes to clearance for MLS

* Tue Sep 14 2010 Dan Walsh <dwalsh@redhat.com> 3.9.4-2

- Allow all domains that can use cgroups to search tmpfs_t directory

- Allow init to send audit messages

* Thu Sep 8 2010 Dan Walsh <dwalsh@redhat.com> 3.9.4-1

- Update to upstream

* Thu Sep 8 2010 Dan Walsh <dwalsh@redhat.com> 3.9.3-4

- Allow mdadm_t to create files and sock files in /dev/md/

* Thu Sep 8 2010 Dan Walsh <dwalsh@redhat.com> 3.9.3-3

- Add policy for ajaxterm

* Wed Sep 8 2010 Dan Walsh <dwalsh@redhat.com> 3.9.3-2

- Handle /var/db/sudo

- Allow pulseaudio to read alsa config

- Allow init to send initrc_t dbus messages

* Tue Sep 7 2010 Dan Walsh <dwalsh@redhat.com> 3.9.3-1

Allow iptables to read shorewall tmp files

Change chfn and passwd to use auth_use_pam so they can send dbus messages to fpr

intd

label vlc as an execmem_exec_t 

Lots of fixes for mozilla_plugin to run google vidio chat

Allow telepath_msn to execute ldconfig and its own tmp files

Fix labels on hugepages

Allow mdadm to read files on /dev

Remove permissive domains and change back to unconfined

Allow freshclam to execute shell and bin_t

Allow devicekit_power to transition to dhcpc

Add boolean to allow icecast to connect to any port

* Thu Aug 31 2010 Dan Walsh <dwalsh@redhat.com> 3.9.2-1

- Merge upstream fix of mmap_zero

- Allow mount to write files in debugfs_t

- Allow corosync to communicate with clvmd via tmpfs

- Allow certmaster to read usr_t files

- Allow dbus system services to search cgroup_t

- Define rlogind_t as a login pgm

* Wed Aug 31 2010 Dan Walsh <dwalsh@redhat.com> 3.9.1-3

- Allow mdadm_t to read/write hugetlbfs

* Tue Aug 30 2010 Dan Walsh <dwalsh@redhat.com> 3.9.1-2

- Dominic Grift Cleanup

- Miroslav Grepl policy for jabberd

- Various fixes for mount/livecd and prelink

* Mon Aug 30 2010 Dan Walsh <dwalsh@redhat.com> 3.9.1-1

- Merge with upstream

* Thu Aug 26 2010 Dan Walsh <dwalsh@redhat.com> 3.9.0-2

- More access needed for devicekit

- Add dbadm policy

* Thu Aug 26 2010 Dan Walsh <dwalsh@redhat.com> 3.9.0-1

- Merge with upstream

* Tue Aug 24 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-21

- Allow seunshare to fowner

* Tue Aug 24 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-20

- Allow cron to look at user_cron_spool links

- Lots of fixes for mozilla_plugin_t

- Add sysv file system

- Turn unconfined domains to permissive to find additional avcs

* Mon Aug 23 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-19

- Update policy for mozilla_plugin_t

* Mon Aug 23 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-18