%define distro redhat

%define polyinstatiate n

%define monolithic n

%if %{?BUILD_TARGETED:0}%{!?BUILD_TARGETED:1}

%define BUILD_TARGETED 1

%endif

%if %{?BUILD_MINIMUM:0}%{!?BUILD_MINIMUM:1}

%define BUILD_MINIMUM 1

%endif

%if %{?BUILD_MLS:0}%{!?BUILD_MLS:1}

%define BUILD_MLS 1

%endif

%define POLICYVER 26

%define libsepolver 2.0.44-2

%define POLICYCOREUTILSVER 2.0.86-12

%define CHECKPOLICYVER 2.0.26-1

Summary: SELinux policy configuration

Name: selinux-policy

Version: 3.10.0

Release: 5%{?dist}

License: GPLv2+

Group: System Environment/Base

Source: serefpolicy-%{version}.tgz

patch: policy-F16.patch

Source1: modules-targeted.conf

Source2: booleans-targeted.conf

Source3: Makefile.devel

Source4: setrans-targeted.conf

Source5: modules-mls.conf

Source6: booleans-mls.conf

Source8: setrans-mls.conf

Source14: securetty_types-targeted

Source15: securetty_types-mls

Source16: modules-minimum.conf

Source17: booleans-minimum.conf

Source18: setrans-minimum.conf

Source19: securetty_types-minimum

Source20: customizable_types

Source21: config.tgz

Source22: users-mls

Source23: users-targeted

Source25: users-minimum

Source26: file_contexts.subs_dist

Url: http://oss.tresys.com/repos/refpolicy/

BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)

BuildArch: noarch

BuildRequires: python gawk checkpolicy >= %{CHECKPOLICYVER} m4 policycoreutils-python >= %{POLICYCOREUTILSVER} bzip2 

Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER} libsemanage >= 2.0.46-6

Requires(post): /usr/bin/bunzip2 /bin/mktemp /bin/awk /usr/bin/md5sum

Requires: checkpolicy >= %{CHECKPOLICYVER} m4 

Obsoletes: selinux-policy-devel <= %{version}-%{release}

Provides: selinux-policy-devel = %{version}-%{release}

%description 

SELinux Base package

%files 

%defattr(-,root,root,-)

%{_mandir}/man*/*

# policycoreutils owns these manpage directories, we only own the files within them

%{_mandir}/ru/*/*

%dir %{_usr}/share/selinux

%dir %{_usr}/share/selinux/devel

%dir %{_usr}/share/selinux/devel/include

%dir %{_usr}/share/selinux/packages

%dir %{_sysconfdir}/selinux

%ghost %config(noreplace) %{_sysconfdir}/selinux/config

%ghost %{_sysconfdir}/sysconfig/selinux

%{_usr}/share/selinux/devel/include/*

%{_usr}/share/selinux/devel/Makefile

%{_usr}/share/selinux/devel/example.*

%{_usr}/share/selinux/devel/policy.*

%package doc

Summary: SELinux policy documentation

Group: System Environment/Base

Requires(pre): selinux-policy = %{version}-%{release}

Requires: /usr/bin/xdg-open

%description doc

SELinux policy documentation package

%files doc

%defattr(-,root,root,-)

%doc %{_usr}/share/doc/%{name}-%{version}

%attr(755,root,root) %{_usr}/share/selinux/devel/policyhelp

%define makeCmds() \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 bare \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024  conf \

cp -f selinux_config/modules-%1.conf  ./policy/modules.conf \

cp -f selinux_config/booleans-%1.conf ./policy/booleans.conf \

cp -f selinux_config/users-%1 ./policy/users \

%define installCmds() \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 base.pp \

make validate UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 modules \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 install \

make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 install-appconfig \

%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/policy \

%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/modules/active/modules \

%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/contexts/files \

touch %{buildroot}/%{_sysconfdir}/selinux/%1/modules/semanage.read.LOCK \

touch %{buildroot}/%{_sysconfdir}/selinux/%1/modules/semanage.trans.LOCK \

rm -rf %{buildroot}%{_sysconfdir}/selinux/%1/booleans \

touch %{buildroot}%{_sysconfdir}/selinux/%1/seusers \

touch %{buildroot}%{_sysconfdir}/selinux/%1/policy/policy.%{POLICYVER} \

touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.subs \

install -m0644 selinux_config/securetty_types-%1 %{buildroot}%{_sysconfdir}/selinux/%1/contexts/securetty_types \

install -m0644 selinux_config/file_contexts.subs_dist %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files \

install -m0644 selinux_config/setrans-%1.conf %{buildroot}%{_sysconfdir}/selinux/%1/setrans.conf \

install -m0644 selinux_config/customizable_types %{buildroot}%{_sysconfdir}/selinux/%1/contexts/customizable_types \

bzip2 -c %{buildroot}/%{_usr}/share/selinux/%1/base.pp  > %{buildroot}/%{_sysconfdir}/selinux/%1/modules/active/base.pp \

rm -f %{buildroot}/%{_usr}/share/selinux/%1/base.pp  \

for i in %{buildroot}/%{_usr}/share/selinux/%1/*.pp; do bzip2 -c $i > %{buildroot}/%{_sysconfdir}/selinux/%1/modules/active/modules/`basename $i`; done \

rm -f %{buildroot}/%{_usr}/share/selinux/%1/*pp*  \

/usr/sbin/semodule -s %1 -n -B -p %{buildroot}; \

/usr/bin/md5sum %{buildroot}%{_sysconfdir}/selinux/%1/policy/policy.%{POLICYVER} | cut -d' ' -f 1 > %{buildroot}%{_sysconfdir}/selinux/%1/.policymd5 \

rm -rf %{buildroot}%{_sysconfdir}/selinux/%1/contexts/netfilter_contexts 

%nil

%define fileList() \

%defattr(-,root,root) \

%dir %{_usr}/share/selinux/%1 \

%dir %{_sysconfdir}/selinux/%1 \

%config(noreplace) %{_sysconfdir}/selinux/%1/setrans.conf \

%verify(not mtime) %{_sysconfdir}/selinux/%1/seusers \

%dir %{_sysconfdir}/selinux/%1/modules \

%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/semanage.read.LOCK \

%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/semanage.trans.LOCK \

%dir %attr(700,root,root) %dir %{_sysconfdir}/selinux/%1/modules/active \

%dir %{_sysconfdir}/selinux/%1/modules/active/modules \

%config(noreplace) %verify(not mtime) %{_sysconfdir}/selinux/%1/modules/active/policy.kern \

%verify(not md5 size mtime) %{_sysconfdir}/selinux/%1/modules/active/commit_num \

%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/active/base.pp \

%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/active/file_contexts* \

%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/active/seusers.final \

%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/active/netfilter_contexts \

%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/active/users_extra \

%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/active/homedir_template \

%verify(not mtime) %{_sysconfdir}/selinux/%1/modules/active/modules/*.pp \

#%verify(not md5 size mtime) %attr(600,root,root) %config(noreplace) %{_sysconfdir}/selinux/%1/modules/active/seusers \

%dir %{_sysconfdir}/selinux/%1/policy/ \

%verify(not mtime) %{_sysconfdir}/selinux/%1/policy/policy.%{POLICYVER} \

%{_sysconfdir}/selinux/%1/.policymd5 \

%dir %{_sysconfdir}/selinux/%1/contexts \

%config %{_sysconfdir}/selinux/%1/contexts/customizable_types \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/securetty_types \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/dbus_contexts \

%config %{_sysconfdir}/selinux/%1/contexts/x_contexts \

%config %{_sysconfdir}/selinux/%1/contexts/default_contexts \

%config %{_sysconfdir}/selinux/%1/contexts/virtual_domain_context \

%config %{_sysconfdir}/selinux/%1/contexts/virtual_image_context \

%config %{_sysconfdir}/selinux/%1/contexts/sepgsql_contexts \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/default_type \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/failsafe_context \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/initrc_context \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/removable_context \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/userhelper_context \

%dir %{_sysconfdir}/selinux/%1/contexts/files \

%verify(not mtime) %{_sysconfdir}/selinux/%1/contexts/files/file_contexts \

%verify(not mtime) %{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \

%verify(not mtime) %{_sysconfdir}/selinux/%1/contexts/files/file_contexts.subs \

%verify(not mtime) %{_sysconfdir}/selinux/%1/contexts/files/file_contexts.subs_dist \

%config %{_sysconfdir}/selinux/%1/contexts/files/media \

%dir %{_sysconfdir}/selinux/%1/contexts/users \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/root \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/guest_u \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/xguest_u \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/user_u \

%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/staff_u 

%define saveFileContext() \

if [ -s /etc/selinux/config ]; then \

     . %{_sysconfdir}/selinux/config; \

     FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \

     if [ "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT} ]; then \

        [ -f ${FILE_CONTEXT}.pre ] || cp -f ${FILE_CONTEXT} ${FILE_CONTEXT}.pre; \

     fi \

fi;

%define relabel() \

. %{_sysconfdir}/selinux/config; \

FILE_CONTEXT=%{_sysconfdir}/selinux/%1/contexts/files/file_contexts; \

/usr/sbin/selinuxenabled; \

if [ $? = 0  -a "${SELINUXTYPE}" = %1 -a -f ${FILE_CONTEXT}.pre ]; then \

     /sbin/fixfiles -C ${FILE_CONTEXT}.pre restore; \

     /sbin/restorecon -R /root /var/log /var/run 2> /dev/null; \

     rm -f ${FILE_CONTEXT}.pre; \

fi; 

%define postInstall() \

. %{_sysconfdir}/selinux/config; \

rm -f /etc/selinux/%2/modules/active/policy.kern.rpmnew; \

md5=`md5sum /etc/selinux/%2/modules/active/policy.kern | cut -d ' ' -f 1`; \

checkmd5=`cat /etc/selinux/%2/.policymd5`; \

if [ "$md5" != "$checkmd5" ] ; then \

   if [ %1 -ne 1 ]; then \

	/usr/sbin/semodule -n -s %2 -r moilscanner gamin audio_entropy iscsid polkit_auth polkit rtkit_daemon ModemManager telepathysofiasip ethereal passanger qpidd 2>/dev/null; \

   fi \

   /usr/sbin/semodule -B -s %2; \

else \

   [ "${SELINUXTYPE}" == "%2" ] && [ selinuxenabled ] && load_policy; \

fi; \

if [ %1 -eq 1 ]; then \

   /sbin/restorecon -R /root /var/log /var/run 2> /dev/null; \

else \

%relabel %2 \

fi;

%define modulesList() \

awk '$1 !~ "/^#/" && $2 == "=" && $3 == "module" { printf "%%s.pp ", $1 }' ./policy/modules.conf > %{buildroot}/%{_usr}/share/selinux/%1/modules.lst \

%description

SELinux Reference Policy - modular.

Based off of reference policy: Checked out revision  2.20091117

%build

%prep 

%setup -n serefpolicy-%{version} -q

%patch -p1

%install

mkdir selinux_config

for i in %{SOURCE1} %{SOURCE2} %{SOURCE3} %{SOURCE4} %{SOURCE5} %{SOURCE6} %{SOURCE8} %{SOURCE14} %{SOURCE15} %{SOURCE16} %{SOURCE17} %{SOURCE18} %{SOURCE19} %{SOURCE20} %{SOURCE21} %{SOURCE22} %{SOURCE23} %{SOURCE25} %{SOURCE26};do

 cp $i selinux_config

done

tar zxvf selinux_config/config.tgz

# Build targeted policy

%{__rm} -fR %{buildroot}

mkdir -p %{buildroot}%{_mandir}

cp -R  man/* %{buildroot}%{_mandir}

mkdir -p %{buildroot}%{_sysconfdir}/selinux

mkdir -p %{buildroot}%{_sysconfdir}/sysconfig

touch %{buildroot}%{_sysconfdir}/selinux/config

touch %{buildroot}%{_sysconfdir}/sysconfig/selinux

# Always create policy module package directories

mkdir -p %{buildroot}%{_usr}/share/selinux/{targeted,mls,minimum,modules}/

# Install devel

make clean

%if %{BUILD_TARGETED}

# Build targeted policy

# Commented out because only targeted ref policy currently builds

%makeCmds targeted mcs n y allow

%installCmds targeted mcs n y allow

%endif

%if %{BUILD_MINIMUM}

# Build minimum policy

# Commented out because only minimum ref policy currently builds

%makeCmds minimum mcs n y allow

%installCmds minimum mcs n y allow

%modulesList minimum

%endif

%if %{BUILD_MLS}

# Build mls policy

%makeCmds mls mls n y deny

%installCmds mls mls n y deny

%endif

make UNK_PERMS=allow NAME=targeted TYPE=mcs DISTRO=%{distro} UBAC=n DIRECT_INITRC=n MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} PKGNAME=%{name}-%{version} POLY=y MLS_CATS=1024 MCS_CATS=1024 install-headers install-docs

mkdir %{buildroot}%{_usr}/share/selinux/devel/

mkdir %{buildroot}%{_usr}/share/selinux/packages/

mv %{buildroot}%{_usr}/share/selinux/targeted/include %{buildroot}%{_usr}/share/selinux/devel/include

install -m 644 selinux_config/Makefile.devel %{buildroot}%{_usr}/share/selinux/devel/Makefile

install -m 644 doc/example.* %{buildroot}%{_usr}/share/selinux/devel/

install -m 644 doc/policy.* %{buildroot}%{_usr}/share/selinux/devel/

echo  "xdg-open file:///usr/share/doc/selinux-policy-%{version}/html/index.html"> %{buildroot}%{_usr}/share/selinux/devel/policyhelp

chmod +x %{buildroot}%{_usr}/share/selinux/devel/policyhelp

rm -rf selinux_config

%clean

%{__rm} -fR %{buildroot}

%post

if [ ! -s /etc/selinux/config ]; then

#

#     New install so we will default to targeted policy

#

echo "

# This file controls the state of SELinux on the system.

# SELINUX= can take one of these three values:

#     enforcing - SELinux security policy is enforced.

#     permissive - SELinux prints warnings instead of enforcing.

#     disabled - No SELinux policy is loaded.

SELINUX=enforcing

# SELINUXTYPE= can take one of these two values:

#     targeted - Targeted processes are protected,

#     mls - Multi Level Security protection.

SELINUXTYPE=targeted 

" > /etc/selinux/config

     ln -sf ../selinux/config /etc/sysconfig/selinux 

     restorecon /etc/selinux/config 2> /dev/null || :

else

     . /etc/selinux/config

     # if first time update booleans.local needs to be copied to sandbox

     [ -f /etc/selinux/${SELINUXTYPE}/booleans.local ] && mv /etc/selinux/${SELINUXTYPE}/booleans.local /etc/selinux/targeted/modules/active/

     [ -f /etc/selinux/${SELINUXTYPE}/seusers ] && cp -f /etc/selinux/${SELINUXTYPE}/seusers /etc/selinux/${SELINUXTYPE}/modules/active/seusers

fi

exit 0

%postun

if [ $1 = 0 ]; then

     setenforce 0 2> /dev/null

     if [ ! -s /etc/selinux/config ]; then

          echo "SELINUX=disabled" > /etc/selinux/config

     else

          sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config

     fi

fi

exit 0

%if %{BUILD_TARGETED}

%package targeted

Summary: SELinux targeted base policy

Provides: selinux-policy-base = %{version}-%{release}

Group: System Environment/Base

Obsoletes: selinux-policy-targeted-sources < 2

Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}

Requires(pre): coreutils

Requires(pre): selinux-policy = %{version}-%{release}

Requires: selinux-policy = %{version}-%{release}

Conflicts:  audispd-plugins <= 1.7.7-1

Obsoletes: mod_fcgid-selinux <= %{version}-%{release}

Obsoletes: cachefilesd-selinux <= 0.10-1

Conflicts:  seedit

Conflicts:  389-ds-base < 1.2.7, 389-admin < 1.1.12

%description targeted

SELinux Reference policy targeted base module.

%pre targeted

%saveFileContext targeted

%post targeted

%postInstall $1 targeted

exit 0

%triggerpostun targeted -- selinux-policy-targeted < 3.2.5-9.fc9

. /etc/selinux/config

[ "${SELINUXTYPE}" != "targeted" ] && exit 0

setsebool -P use_nfs_home_dirs=1

/usr/sbin/semanage user -l | grep -s unconfined_u > /dev/null

if [ $? -eq 0 ]; then

   /usr/sbin/semanage user -m -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u

else

   /usr/sbin/semanage user -a -P user -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u

fi

seuser=`/usr/sbin/semanage login -l | grep __default__ | awk '{ print $2 }'`

[ "$seuser" != "unconfined_u" ]  && /usr/sbin/semanage login -m -s "unconfined_u"  -r s0-s0:c0.c1023 __default__

seuser=`/usr/sbin/semanage login -l | grep root | awk '{ print $2 }'`

[ "$seuser" = "system_u" ] && /usr/sbin/semanage login -m -s "unconfined_u"  -r s0-s0:c0.c1023 root

restorecon -R /root /etc/selinux/targeted 2> /dev/null

/usr/sbin/semodule -r qmail 2> /dev/null

exit 0

%files targeted

%defattr(-,root,root,-)

%config(noreplace) %{_sysconfdir}/selinux/targeted/contexts/users/unconfined_u

%fileList targeted

%endif

%if %{BUILD_MINIMUM}

%package minimum

Summary: SELinux minimum base policy

Provides: selinux-policy-base = %{version}-%{release}

Group: System Environment/Base

Requires(post): policycoreutils-python >= %{POLICYCOREUTILSVER}

Requires(pre): coreutils

Requires(pre): selinux-policy = %{version}-%{release}

Requires: selinux-policy = %{version}-%{release}

Conflicts:  seedit

%description minimum

SELinux Reference policy minimum base module.

%pre minimum

%saveFileContext minimum

if [ $1 -ne 1 ]; then

   /usr/sbin/semodule -s minimum -l 2>/dev/null | awk '{ print $1 }' > /usr/share/selinux/minimum/instmodules.lst

fi

%post minimum

allpackages=`cat /usr/share/selinux/minimum/modules.lst`

if [ $1 -eq 1 ]; then

packages="clock.pp execmem.pp unconfined.pp unconfineduser.pp application.pp userdomain.pp authlogin.pp logging.pp selinuxutil.pp init.pp systemd.pp sysnetwork.pp miscfiles.pp libraries.pp modutils.pp sysadm.pp locallogin.pp dbus.pp rpm.pp mount.pp fstools.pp usermanage.pp mta.pp"

for p in $allpackages; do 

    touch /etc/selinux/minimum/modules/active/modules/$p.disabled

done

for p in $packages; do 

    rm -f /etc/selinux/minimum/modules/active/modules/$p.disabled

done

/usr/sbin/semanage -S minimum -i - << __eof

login -m  -s unconfined_u -r s0-s0:c0.c1023 __default__

login -m  -s unconfined_u -r s0-s0:c0.c1023 root

__eof

/sbin/restorecon -R /root /var/log /var/run 2> /dev/null

/usr/sbin/semodule -B -s minimum

else

instpackages=`cat /usr/share/selinux/minimum/instmodules.lst`

for p in $allpackages; do 

    touch /etc/selinux/minimum/modules/active/modules/$p.disabled

done

for p in $instpackages; do 

    rm -f /etc/selinux/minimum/modules/active/modules/$p.pp.disabled

done

/usr/sbin/semodule -B -s minimum

%relabel minimum

fi

exit 0

%files minimum

%defattr(-,root,root,-)

%config(noreplace) %{_sysconfdir}/selinux/minimum/contexts/users/unconfined_u

%fileList minimum

%{_usr}/share/selinux/minimum/modules.lst

%endif

%if %{BUILD_MLS}

%package mls 

Summary: SELinux mls base policy

Group: System Environment/Base

Provides: selinux-policy-base = %{version}-%{release}

Obsoletes: selinux-policy-mls-sources < 2

Requires: policycoreutils-newrole >= %{POLICYCOREUTILSVER} setransd

Requires(pre): policycoreutils >= %{POLICYCOREUTILSVER}

Requires(pre): coreutils

Requires(pre): selinux-policy = %{version}-%{release}

Requires: selinux-policy = %{version}-%{release}

Conflicts:  seedit

%description mls 

SELinux Reference policy mls base module.

%pre mls 

%saveFileContext mls

%post mls 

%postInstall $1 mls

%files mls

%defattr(-,root,root,-)

%config(noreplace) %{_sysconfdir}/selinux/mls/contexts/users/unconfined_u

%fileList mls

%endif

%changelog

* Mon Jul 18 2011 Miroslav Grepl <mgrepl@redhat.com> 3.10.0-5

- Initial systemd_logind policy

- Add policy for systemd_logger and additional proivs for systemd_logind

- More fixes for systemd policies

* Thu Jul 14 2011 Miroslav Grepl <mgrepl@redhat.com> 3.10.0-4

- Allow setsched for virsh

- Systemd needs to impersonate cups, which means it needs to create tcp_sockets in cups_t domain, as well as manage spool directories

- iptables: the various /sbin/ip6?tables.* are now symlinks for

/sbin/xtables-multi

* Tue Jul 12 2011 Miroslav Grepl <mgrepl@redhat.com> 3.10.0-3

- A lot of users are running yum -y update while in /root which is causing ldconfig to list the contents, adding dontaudit

- Allow colord to interact with the users through the tmpfs file system

- Since we changed the label on deferred, we need to allow postfix_qmgr_t to be able to create maildrop_t files

- Add label for /var/log/mcelog

- Allow asterisk to read /dev/random if it uses TLS

- Allow colord to read ini files which are labeled as bin_t

- Allow dirsrvadmin sys_resource and setrlimit to use ulimit

- Systemd needs to be able to create sock_files for every label in /var/run directory, cupsd being the first.  

- Also lists /var and /var/spool directories

- Add openl2tpd to l2tpd policy

- qpidd is reading the sysfs file

* Thu Jun 30 2011 Miroslav Grepl <mgrepl@redhat.com> 3.10.0-2

- Change usbmuxd_t to dontaudit attempts to read chr_file

- Add mysld_safe_exec_t for libra domains to be able to start private mysql domains

- Allow pppd to search /var/lock dir

- Add rhsmcertd policy

* Mon Jun 27 2011 Miroslav Grepl <mgrepl@redhat.com> 3.10.0-1

- Update to upstream

* Mon Jun 27 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-30

- More fixes

  * http://git.fedorahosted.org/git/?p=selinux-policy.git

* Thu Jun 16 2011 Dan Walsh <dwalsh@redhat.com> 3.9.16-29.1

- Fix spec file to not report Verify errors

* Thu Jun 16 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-29

- Add dspam policy

- Add lldpad policy

- dovecot auth wants to search statfs #713555

- Allow systemd passwd apps to read init fifo_file

- Allow prelink to use inherited terminals

- Run cherokee in the httpd_t domain

- Allow mcs constraints on node connections

- Implement pyicqt policy

- Fixes for zarafa policy

- Allow cobblerd to send syslog messages

* Wed Jun 8 2011 Dan Walsh <dwalsh@redhat.com> 3.9.16-28.1

- Add policy.26 to the payload

- Remove olpc stuff

- Remove policygentool

* Wed Jun 8 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-27

- Fixes for zabbix

- init script needs to be able to manage sanlock_var_run_...

- Allow sandlock and wdmd to create /var/run directories... 

- mixclip.so has been compiled correctly

- Fix passenger policy module name

* Tue Jun 7 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-26

- Add mailscanner policy from dgrift

- Allow chrome to optionally be transitioned to

- Zabbix needs these rules when starting the zabbix_server_mysql

- Implement a type for freedesktop openicc standard (~/.local/share/icc)

- Allow system_dbusd_t to read inherited icc_data_home_t files.

- Allow colord_t to read icc_data_home_t content. #706975

- Label stuff under /usr/lib/debug as if it was labeled under /

* Thu Jun 2 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-25

- Fixes for sanlock policy

- Fixes for colord policy

- Other fixes

	* http://git.fedorahosted.org/git/?p=selinux-policy.git;a=log

* Thu May 26 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-24

- Add rhev policy module to modules-targeted.conf

* Tue May 24 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-23

- Lot of fixes

	* http://git.fedorahosted.org/git/?p=selinux-policy.git;a=log

* Thu May 17 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-22

- Allow logrotate to execute systemctl

- Allow nsplugin_t to getattr on gpmctl

- Fix dev_getattr_all_chr_files() interface

- Allow shorewall to use inherited terms

- Allow userhelper to getattr all chr_file devices

- sandbox domains should be able to getattr and dontaudit search of sysctl_kernel_t

- Fix labeling for ABRT Retrace Server

* Mon May 9 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-21

- Dontaudit sys_module for ifconfig

- Make telepathy and gkeyringd daemon working with confined users

- colord wants to read files in users homedir

- Remote login should be creating user_tmp_t not its own tmp files

* Thu May 5 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-20

- Fix label for /usr/share/munin/plugins/munin_* plugins

- Add support for zarafa-indexer

- Fix boolean description

- Allow colord to getattr on /proc/scsi/scsi

- Add label for /lib/upstart/init

- Colord needs to list /mnt

* Tue May 3 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-19

- Forard port changes from F15 for telepathy

- NetworkManager should be allowed to use /dev/rfkill

- Fix dontaudit messages to say Domain to not audit

- Allow telepathy domains to read/write gnome_cache files

- Allow telepathy domains to call getpw

- Fixes for colord and vnstatd policy

* Wed Apr 27 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-18

- Allow init_t getcap and setcap

- Allow namespace_init_t to use nsswitch

- aisexec will execute corosync

- colord tries to read files off noxattr file systems

- Allow init_t getcap and setcap

* Thu Apr 21 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-17

- Add support for ABRT retrace server

- Allow user_t and staff_t access to generic scsi to handle locally plugged in scanners

- Allow telepath_msn_t to read /proc/PARENT/cmdline

- ftpd needs kill capability

- Allow telepath_msn_t to connect to sip port

- keyring daemon does not work on nfs homedirs

- Allow $1_sudo_t to read default SELinux context

- Add label for tgtd sock file in /var/run/

- Add apache_exec_rotatelogs interface

- allow all zaraha domains to signal themselves, server writes to /tmp

- Allow syslog to read the process state

- Add label for /usr/lib/chromium-browser/chrome

- Remove the telepathy transition from unconfined_t

- Dontaudit sandbox domains trying to mounton sandbox_file_t, this is caused by fuse mounts

- Allow initrc_t domain to manage abrt pid files

- Add support for AEOLUS project

- Virt_admin should be allowed to manage images and processes

- Allow plymountd to send signals to init

- Change labeling of fping6

* Tue Apr 19 2011 Dan Walsh <dwalsh@redhat.com> 3.9.16-16.1

- Add filename transitions

* Tue Apr 19 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-16

- Fixes for zarafa policy

- Add support for AEOLUS project

- Change labeling of fping6

- Allow plymountd to send signals to init

- Allow initrc_t domain to manage abrt pid files

- Virt_admin should be allowed to manage images and processes

* Fri Apr 15 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-15

- xdm_t needs getsession for switch user 

- Every app that used to exec init is now execing systemdctl 

- Allow squid to manage krb5_host_rcache_t files 

- Allow foghorn to connect to agentx port - Fixes for colord policy

* Mon Apr 11 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-14

- Add Dan's patch to remove 64 bit variants

- Allow colord to use unix_dgram_socket 

- Allow apps that search pids to read /var/run if it is a lnk_file 

- iscsid_t creates its own directory 

- Allow init to list var_lock_t dir 

- apm needs to verify user accounts auth_use_nsswitch

- Add labeling for systemd unit files

- Allow gnomeclok to enable ntpd service using systemctl - systemd_systemctl_t domain was added

- Add label for matahari-broker.pid file

- We want to remove untrustedmcsprocess from ability to read /proc/pid

- Fixes for matahari policy

- Allow system_tmpfiles_t to delete user_home_t files in the /tmp dir

- Allow sshd to transition to sysadm_t if ssh_sysadm_login is turned on

* Tue Apr 5 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-13

- Fix typo

* Mon Apr 4 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-12

- Add /var/run/lock /var/lock definition to file_contexts.subs

- nslcd_t is looking for kerberos cc files

- SSH_USE_STRONG_RNG is 1 which requires /dev/random

- Fix auth_rw_faillog definition

- Allow sysadm_t to set attributes on fixed disks

- allow user domains to execute lsof and look at application sockets

- prelink_cron job calls telinit -u if init is rewritten

- Fixes to run qemu_t from staff_t

* Mon Apr 4 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-11

- Fix label for /var/run/udev to udev_var_run_t

- Mock needs to be able to read network state

* Fri Apr 1 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-10

- Add file_contexts.subs to handle /run and /run/lock

- Add other fixes relating to /run changes from F15 policy

* Fri Mar 25 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-7

- Allow $1_sudo_t and $1_su_t open access to user terminals

- Allow initrc_t to use generic terminals

- Make Makefile/Rules.modular run sepolgen-ifgen during build to check if files for bugs

-systemd is going to be useing /run and /run/lock for early bootup files.

- Fix some comments in rlogin.if

- Add policy for KDE backlighthelper

- sssd needs to read ~/.k5login in nfs, cifs or fusefs file systems

- sssd wants to read .k5login file in users homedir

- setroubleshoot reads executables to see if they have TEXTREL

- Add /var/spool/audit support for new version of audit

- Remove kerberos_connect_524() interface calling

- Combine kerberos_master_port_t and kerberos_port_t

- systemd has setup /dev/kmsg as stderr for apps it executes

- Need these access so that init can impersonate sockets on unix_dgram_socket

* Wed Mar 23 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-6

- Remove some unconfined domains

- Remove permissive domains

- Add policy-term.patch from Dan 

* Thu Mar 17 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-5

- Fix multiple specification for boot.log

- devicekit leaks file descriptors to setfiles_t

- Change all all_nodes to generic_node and all_if to generic_if

- Should not use deprecated interface

- Switch from using all_nodes to generic_node and from all_if to generic_if

- Add support for xfce4-notifyd

- Fix file context to show several labels as SystemHigh

- seunshare needs to be able to mounton nfs/cifs/fusefs homedirs

- Add etc_runtime_t label for /etc/securetty

- Fixes to allow xdm_t to start gkeyringd_USERTYPE_t directly

- login.krb needs to be able to write user_tmp_t

- dirsrv needs to bind to port 7390 for dogtag

- Fix a bug in gpg policy

- gpg sends audit messages

- Allow qpid to manage matahari files

* Tue Mar 15 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-4

- Initial policy for matahari

- Add dev_read_watchdog

- Allow clamd to connect clamd port

- Add support for kcmdatetimehelper

- Allow shutdown to setrlimit and sys_nice

- Allow systemd_passwd to talk to /dev/log before udev or syslog is running

- Purge chr_file and blk files on /tmp

- Fixes for pads

- Fixes for piranha-pulse

- gpg_t needs to be able to encyprt anything owned by the user

* Thu Mar 10 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-3

- mozilla_plugin_tmp_t needs to be treated as user tmp files

- More dontaudits of writes from readahead

- Dontaudit readahead_t file_type:dir write, to cover up kernel bug

- systemd_tmpfiles needs to relabel faillog directory as well as the file

- Allow hostname and consoletype to r/w inherited initrc_tmp_t files handline hostname >> /tmp/myhost

* Thu Mar 10 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-2

- Add policykit fixes from Tim Waugh

- dontaudit sandbox domains sandbox_file_t:dir mounton

- Add new dontaudit rules for sysadm_dbusd_t

- Change label for /var/run/faillock

	* other fixes which relate with this change

* Tue Mar 8 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.16-1

- Update to upstream

- Fixes for telepathy

- Add port defition for ssdp port

- add policy for /bin/systemd-notify from Dan

- Mount command requires users read mount_var_run_t

- colord needs to read konject_uevent_socket

- User domains connect to the gkeyring socket

- Add colord policy and allow user_t and staff_t to dbus chat with it

- Add lvm_exec_t label for kpartx

- Dontaudit reading the mail_spool_t link from sandbox -X

- systemd is creating sockets in avahi_var_run and system_dbusd_var_run

* Tue Mar 1 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.15-5

- gpg_t needs to talk to gnome-keyring

- nscd wants to read /usr/tmp->/var/tmp to generate randomziation in unixchkpwd

- enforce MCS labeling on nodes

- Allow arpwatch to read meminfo

- Allow gnomeclock to send itself signals

- init relabels /dev/.udev files on boot

- gkeyringd has to transition back to staff_t when it runs commands in bin_t or shell_exec_t

- nautilus checks access on /media directory before mounting usb sticks, dontaudit access_check on mnt_t

- dnsmasq can run as a dbus service, needs acquire service

- mysql_admin should  be allowed to connect to mysql service

- virt creates monitor sockets in the users home dir

* Mon Feb 21 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.15-2

- Allow usbhid-ups to read hardware state information

- systemd-tmpfiles has moved

- Allo cgroup to sys_tty_config

- For some reason prelink is attempting to read gconf settings

- Add allow_daemons_use_tcp_wrapper boolean

- Add label for ~/.cache/wocky to make telepathy work in enforcing mode

- Add label for char devices /dev/dasd*

- Fix for apache_role

- Allow amavis to talk to nslcd

- allow all sandbox to read selinux poilcy config files

- Allow cluster domains to use the system bus and send each other dbus messages

* Wed Feb 16 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.15-1

- Update to upstream

* Wed Feb 09 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.9.14-2

- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild

* Tue Feb 8 2011 Dan Walsh <dwalsh@redhat.com> 3.9.14-1

- Update to ref policy

- cgred needs chown capability

- Add /dev/crash crash_dev_t

- systemd-readahead wants to use fanotify which means readahead_t needs sys_admin capability

* Tue Feb 8 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.13-10

- New labeling for postfmulti #675654

- dontaudit xdm_t listing noxattr file systems

- dovecot-auth needs to be able to connect to mysqld via the network as well as locally

- shutdown is passed stdout to a xdm_log_t file

- smartd creates a fixed disk device

- dovecot_etc_t contains a lnk_file that domains need to read

- mount needs to be able to read etc_runtim_t:lnk_file since in rawhide this is a link created at boot

* Thu Feb 3 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.13-9

- syslog_t needs syslog capability

- dirsrv needs to be able to create /var/lib/snmp

- Fix labeling for dirsrv

- Fix for dirsrv policy missing manage_dirs_pattern

- corosync needs to delete clvm_tmpfs_t files

- qdiskd needs to list hugetlbfs

- Move setsched to sandbox_x_domain, so firefox can run without network access

- Allow hddtemp to read removable devices

- Adding syslog and read_policy permissions to policy

	* syslog

		Allow unconfined, sysadm_t, secadm_t, logadm_t

	* read_policy

		allow unconfined, sysadm_t, secadm_t, staff_t on Targeted

		allow sysadm_t (optionally), secadm_t on MLS

- mdadm application will write into /sys/.../uevent whenever arrays are

assembled or disassembled.

* Tue Feb 1 2011 Dan Walsh <dwalsh@redhat.com> 3.9.13-8

- Add tcsd policy

* Tue Feb 1 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.13-7

- ricci_modclusterd_t needs to bind to rpc ports 500-1023

- Allow dbus to use setrlimit to increase resoueces

- Mozilla_plugin is leaking to sandbox

- Allow confined users  to connect to lircd over unix domain stream socket which allow to use remote control

- Allow awstats to read squid logs

- seunshare needs to manage tmp_t

- apcupsd cgi scripts have a new directory

* Thu Jan 27 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.13-6

- Fix xserver_dontaudit_read_xdm_pid

- Change oracle_port_t to oracledb_port_t to prevent conflict with satellite

- Allow dovecot_deliver_t to read/write postfix_master_t:fifo_file. 

	* These fifo_file is passed from postfix_master_t to postfix_local_t to dovecot_deliver_t

- Allow readahead to manage readahead pid dirs

- Allow readahead to read all mcs levels

- Allow mozilla_plugin_t to use nfs or samba homedirs

* Wed Jan 25 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.13-5

- Allow nagios plugin to read /proc/meminfo

- Fix for mozilla_plugin

- Allow samba_net_t to create /etc/keytab

- pppd_t setting up vpns needs to run unix_chkpwd, setsched its process and write wtmp_t

- nslcd can read user credentials

- Allow nsplugin to delete mozilla_plugin_tmpfs_t

- abrt tries to create dir in rpm_var_lib_t

- virt relabels fifo_files

- sshd needs to manage content in fusefs homedir

- mock manages link files in cache dir

* Fri Jan 21 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.13-4

- nslcd needs setsched and to read /usr/tmp

- Invalid call in likewise policy ends up creating a bogus role

- Cannon puts content into /var/lib/bjlib that cups needs to be able to write

- Allow screen to create screen_home_t in /root

- dirsrv sends syslog messages

- pinentry reads stuff in .kde directory

- Add labels for .kde directory in homedir

- Treat irpinit, iprupdate, iprdump services with raid policy

* Wed Jan 19 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.13-3

- NetworkManager wants to read consolekit_var_run_t

- Allow readahead to create /dev/.systemd/readahead

- Remove permissive domains

- Allow newrole to run namespace_init

* Tue Jan 18 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.13-2

- Add sepgsql_contexts file

* Mon Jan 17 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.13-1

- Update to upstream

* Mon Jan 17 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.12-8

- Add oracle ports and allow apache to connect to them if the connect_db boolean is turned on

- Add puppetmaster_use_db boolean

- Fixes for zarafa policy

- Fixes for gnomeclock poliy

- Fix systemd-tmpfiles to use auth_use_nsswitch

* Fri Jan 14 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.12-7

- gnomeclock executes a shell

- Update for screen policy to handle pipe in homedir

- Fixes for polyinstatiated homedir

- Fixes for namespace policy and other fixes related to polyinstantiation

- Add namespace policy

- Allow dovecot-deliver transition to sendmail which is needed by sieve scripts

- Fixes for init, psad policy which relate with confined users

- Do not audit bootloader attempts to read devicekit pid files

- Allow nagios service plugins to read /proc

* Tue Jan 11 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.12-6

- Add firewalld policy

- Allow vmware_host to read samba config

- Kernel wants to read /proc Fix duplicate grub def in cobbler

- Chrony sends mail, executes shell, uses fifo_file and reads /proc

- devicekitdisk getattr all file systems

- sambd daemon writes wtmp file

- libvirt transitions to dmidecode

* Wed Jan 5 2011 Miroslav Grepl <mgrepl@redhat.com> 3.9.12-5

- Add initial policy for system-setup-keyboard which is now daemon

- Label /var/lock/subsys/shorewall as shorewall_lock_t