From 328d37031b01487ca5996bca6f94ae9f01048da6 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Dec 19 2022 15:56:42 +0000 Subject: * Mon Dec 19 2022 Zdenek Pytela - 38.4-1 - Allow NetworkManager and wpa_supplicant the bpf capability - Allow systemd-rfkill the bpf capability - Allow winbind-rpcd manage samba_share_t files and dirs - Label /var/lib/httpd/md(/.*)? with httpd_sys_rw_content_t - Allow gpsd the sys_ptrace userns capability - Introduce gpsd_tmp_t for sockfiles managed by gpsd_t - Allow load_policy_t write to unallocated ttys - Allow ndc read hardware state information - Allow system mail service read inherited certmonger runtime files - Add lpr_roles to system_r roles - Revert "Allow insights-client run lpr and allow the proper role" - Allow stalld to read /sys/kernel/security/lockdown file - Allow keepalived to set resource limits - Add policy for mptcpd - Add policy for rshim - Allow admin users to create user namespaces - Allow journalctl relabel with var_log_t and syslogd_var_run_t files - Do not run restorecon /etc/NetworkManager/dispatcher.d in targeted - Trim changelog so that it starts at F35 time - Add mptcpd and rshim modules --- diff --git a/selinux-policy.spec b/selinux-policy.spec index 1d651dc..47c5ddf 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -1,6 +1,6 @@ # github repo with selinux-policy sources %global giturl https://github.com/fedora-selinux/selinux-policy -%global commit 4343b56750c77ff3fc562c1dddc24ad5da115a12 +%global commit b42deb870faaa63be41cd6b6b9d8a5846205e6ea %global shortcommit %(c=%{commit}; echo ${c:0:7}) %define distro redhat @@ -23,7 +23,7 @@ %define CHECKPOLICYVER 3.2 Summary: SELinux policy configuration Name: selinux-policy -Version: 38.3 +Version: 38.4 Release: 1%{?dist} License: GPL-2.0-or-later Source: %{giturl}/archive/%{commit}/%{name}-%{shortcommit}.tar.gz @@ -813,6 +813,28 @@ exit 0 %endif %changelog +* Mon Dec 19 2022 Zdenek Pytela - 38.4-1 +- Allow NetworkManager and wpa_supplicant the bpf capability +- Allow systemd-rfkill the bpf capability +- Allow winbind-rpcd manage samba_share_t files and dirs +- Label /var/lib/httpd/md(/.*)? with httpd_sys_rw_content_t +- Allow gpsd the sys_ptrace userns capability +- Introduce gpsd_tmp_t for sockfiles managed by gpsd_t +- Allow load_policy_t write to unallocated ttys +- Allow ndc read hardware state information +- Allow system mail service read inherited certmonger runtime files +- Add lpr_roles to system_r roles +- Revert "Allow insights-client run lpr and allow the proper role" +- Allow stalld to read /sys/kernel/security/lockdown file +- Allow keepalived to set resource limits +- Add policy for mptcpd +- Add policy for rshim +- Allow admin users to create user namespaces +- Allow journalctl relabel with var_log_t and syslogd_var_run_t files +- Do not run restorecon /etc/NetworkManager/dispatcher.d in targeted +- Trim changelog so that it starts at F35 time +- Add mptcpd and rshim modules + * Wed Dec 14 2022 Zdenek Pytela - 38.3-1 - Allow insights-client dbus chat with various services - Allow insights-client tcp connect to various ports diff --git a/sources b/sources index d6bb51b..fbb1c75 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (selinux-policy-4343b56.tar.gz) = ca8107d98eacd3b4e101958fb9f341c0ee37501855484d37536764044d38310ad9cf17f12fe68150d9fd7047e01f51e86a26fb6f3f41f634b7b650de80607201 -SHA512 (container-selinux.tgz) = 9ec574c1441e656930c25e5e6decf71c89327c520b0b9af9cf3286e377bc1aad7efaf0c221fab49315d47946c5ca6313f162631def7c7981466c7646fcf3ce5a +SHA512 (selinux-policy-b42deb8.tar.gz) = 30ee807d451dac182392f4a47254c576fb1ea617c0f86081cc061cfb09f4a5126ebab11f352efe0bad310b2ce9a74743e2a76dde6809829ac945c20c969ba302 SHA512 (macro-expander) = 243ee49f1185b78ac47e56ca9a3f3592f8975fab1a2401c0fcc7f88217be614fe31805bacec602b728e7fcfc21dcc17d90e9a54ce87f3a0c97624d9ad885aea4 +SHA512 (container-selinux.tgz) = 4eb975c285c791a5f7a005a52d54f788cb8b4ca4abcbe891caa67f28c5ef4b7be35dec749d1dc261ba112ff84e749dd2efcc067c5f300c5094efb398f57ad665