diff --git a/.gitignore b/.gitignore index 27b0d2d..8c4174a 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,3 @@ SOURCES/container-selinux.tgz -SOURCES/selinux-policy-13935d5.tar.gz -SOURCES/selinux-policy-contrib-78ae674.tar.gz +SOURCES/selinux-policy-contrib-fd10e7c.tar.gz +SOURCES/selinux-policy-db25c0e.tar.gz diff --git a/.selinux-policy.metadata b/.selinux-policy.metadata index f93ee2c..f9fba18 100644 --- a/.selinux-policy.metadata +++ b/.selinux-policy.metadata @@ -1,3 +1,3 @@ -b74e206ce51098e33143b874e40c27464e27b49d SOURCES/container-selinux.tgz -8152bb1e073bb4ed468929d2425d542bbb40e6b6 SOURCES/selinux-policy-13935d5.tar.gz -70e0f19da48e9cbbeb6a96e3d27d0dcb8d32dc55 SOURCES/selinux-policy-contrib-78ae674.tar.gz +96c4e7788edd3c312cf691480a58bb403d0a13ef SOURCES/container-selinux.tgz +b3cd1635dfa8d9c1e2a207cad5df4682771d85b6 SOURCES/selinux-policy-contrib-fd10e7c.tar.gz +4ddf11da780b6eaa124536869c85baec229640c1 SOURCES/selinux-policy-db25c0e.tar.gz diff --git a/SPECS/selinux-policy.spec b/SPECS/selinux-policy.spec index 82e8d6a..59e5256 100644 --- a/SPECS/selinux-policy.spec +++ b/SPECS/selinux-policy.spec @@ -1,11 +1,11 @@ # github repo with selinux-policy base sources %global git0 https://github.com/fedora-selinux/selinux-policy -%global commit0 13935d5ca9a5c6d6a7d4a9688af0cc552c2b492d +%global commit0 db25c0eff1c59aff96dd7d14e5d3043dae2aee9e %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # github repo with selinux-policy contrib sources %global git1 https://github.com/fedora-selinux/selinux-policy-contrib -%global commit1 78ae6747c0330040bda2829aac2e5be4bf921670 +%global commit1 fd10e7cb92ddfd82248e1c8f5f68eadfbd74b4f7 %global shortcommit1 %(c=%{commit1}; echo ${c:0:7}) %define distro redhat @@ -29,7 +29,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.14.3 -Release: 41%{?dist}.8 +Release: 54%{?dist} License: GPLv2+ Source: %{git0}/archive/%{commit0}/%{name}-%{shortcommit0}.tar.gz Source29: %{git1}/archive/%{commit1}/%{name}-contrib-%{shortcommit1}.tar.gz @@ -715,42 +715,234 @@ exit 0 %endif %changelog -* Fri Oct 02 2020 Zdenek Pytela - 3.14.3-41.8 -- Allow ptp4l_t sys_admin capability to run bpf programs -Resolves: rhbz#1884267 - -* Thu Oct 01 2020 Zdenek Pytela - 3.14.3-41.7 -- Allow ptp4l_t create and use packet_socket sockets -Resolves: rhbz#1884267 - -* Thu Aug 06 2020 Zdenek Pytela - 3.14.3-41.6 -- Label systemd-growfs and systemd-makefs as fsadm_exec_t -Resolves: rhbz#1859162 +* Thu Sep 17 2020 Zdenek Pytela - 3.14.3-54 +- Allow plymouth sys_chroot capability +Resolves: rhbz#1869814 + +* Sun Aug 23 2020 Zdenek Pytela - 3.14.3-53 +- Allow certmonger fowner capability +Resolves: rhbz#1870596 +- Define named file transition for saslauthd on /tmp/krb5_0.rcache2 +Resolves: rhbz#1870300 +- Label /usr/libexec/qemu-pr-helper with virtd_exec_t +Resolves: rhbz#1867115 + +* Thu Aug 13 2020 Zdenek Pytela - 3.14.3-52 +- Add ipa_helper_noatsecure() interface unconditionally +Resolves: rhbz#1853432 +- Conditionally allow nagios_plugin_domain dbus chat with init +Resolves: rhbz#1750821 +- Revert "Update allow rules set for nrpe_t domain" +Resolves: rhbz#1750821 +- Add ipa_helper_noatsecure() interface to ipa.if +Resolves: rhbz#1853432 +- Allow tomcat map user temporary files +Resolves: rhbz#1857675 +- Allow tomcat manage user temporary files +Resolves: rhbz#1857675 +- Add file context for /sys/kernel/tracing +Resolves: rhbz#1847331 +- Define named file transition for sshd on /tmp/krb5_0.rcache2 +Resolves: rhbz#1848953 + +* Mon Aug 03 2020 Zdenek Pytela - 3.14.3-51 +- Allow kadmind manage kerberos host rcache +Resolves: rhbz#1863043 +- Allow virtlockd only getattr and lock block devices +Resolves: rhbz#1832756 +- Allow qemu-ga read all non security file types conditionally +Resolves: rhbz#1747960 +- Allow virtlockd manage VMs posix file locks +Resolves: rhbz#1832756 +- Add dev_lock_all_blk_files() interface +Resolves: rhbz#1832756 +- Allow systemd-logind dbus chat with fwupd +Resolves: rhbz#1851932 - Update xserver_rw_session macro -Resolves: rhbz#1866362 - -* Mon Jun 29 2020 Zdenek Pytela - 3.14.3-41.5 +Resolves: rhbz#1851448 + +* Wed Jul 29 2020 Zdenek Pytela - 3.14.3-50 +- Revert "Allow qemu-kvm read and write /dev/mapper/control" +This reverts commit f948eaf3d010215fc912e42013e4f88870279093. +- Allow smbd get attributes of device files labeled samba_share_t +Resolves: rhbz#1851816 +- Allow tomcat read user temporary files +Resolves: rhbz#1857675 +- Revert "Dontaudit and disallow sys_admin capability for keepalived_t domain" +Resolves: rhbz#1815281 +- Label /tmp/krb5_0.rcache2 with krb5_host_rcache_t +Resolves: rhbz#1848953 +- Allow auditd manage kerberos host rcache files +Resolves: rhbz#1855770 + +* Thu Jul 09 2020 Zdenek Pytela - 3.14.3-49 +- Additional support for keepalived running in a namespace +Resolves: rhbz#1815281 +- Allow keepalived manage its private type runtime directories +Resolves: rhbz#1815281 +- Run ipa_helper_noatsecure(oddjob_t) only if the interface exists +Resolves: rhbz#1853432 +- Allow oddjob_t process noatsecure permission for ipa_helper_t +Resolves: rhbz#1853432 +- Allow domain dbus chat with systemd-resolved +Resolves: rhbz#1852378 +- Define file context for /var/run/netns directory only +Related: rhbz#1815281 + +* Mon Jun 29 2020 Zdenek Pytela - 3.14.3-48 +- Allow systemd_private_tmp(dirsrv_tmp_t) instead of dirsrv_t +Resolves: rhbz#1836820 + +* Mon Jun 29 2020 Zdenek Pytela - 3.14.3-47 +- Allow virtlogd_t manage virt lib files +Resolves: rhbz#1832756 +- Allow pdns server to read system state +Resolves: rhbz#1801214 +- Support systemctl --user in machinectl +Resolves: rhbz#1788616 +- Allow chkpwd_t read and write systemd-machined devpts character nodes +Resolves: rhbz#1788616 +- Allow init_t write to inherited systemd-logind sessions pipes +Resolves: rhbz#1788616 +- Label systemd-growfs and systemd-makefs as fsadm_exec_t +Resolves: rhbz#1820798 +- Allow staff_u and user_u setattr generic usb devices +Resolves: rhbz#1783325 +- Allow sysadm_t dbus chat with accountsd +Resolves: rhbz#1828809 + +* Tue Jun 23 2020 Zdenek Pytela - 3.14.3-46 +- Fix description tag for the sssd_connect_all_unreserved_ports tunable +Related: rhbz#1826748 +- Allow journalctl process set its resource limits +Resolves: rhbz#1825894 +- Add sssd_access_kernel_keys tunable to conditionally access kernel keys +Resolves: rhbz#1802062 +- Make keepalived work with network namespaces +Resolves: rhbz#1815281 +- Create sssd_connect_all_unreserved_ports boolean +Resolves: rhbz#1826748 +- Allow hypervkvpd to request kernel to load a module +Resolves: rhbz#1842414 +- Allow systemd_private_tmp(dirsrv_tmp_t) +Resolves: rhbz#1836820 +- Allow radiusd connect to gssproxy over unix domain stream socket +Resolves: rhbz#1813572 +- Add fwupd_cache_t file context for '/var/cache/fwupd(/.*)?' +Resolves: rhbz#1832231 +- Modify kernel_rw_key() not to include append permission +Related: rhbz#1802062 +- Add kernel_rw_key() interface to access to kernel keyrings +Related: rhbz#1802062 +- Modify systemd_delete_private_tmp() to use delete_*_pattern macros +Resolves: rhbz#1836820 - Allow systemd-modules to load kernel modules -Resolves: rhbz#1850953 - -* Thu May 14 2020 Zdenek Pytela - 3.14.3-41.4 +Resolves: rhbz#1823246 +- Add cachefiles_dev_t as a typealias to cachefiles_device_t +Resolves: rhbz#1814796 + +* Mon Jun 15 2020 Zdenek Pytela - 3.14.3-45 +- Remove files_mmap_usr_files() call for particular domains +Related: rhbz#1801214 +- Allow dirsrv_t list cgroup directories +Resolves: rhbz#1836795 +- Create the kerberos_write_kadmind_tmp_files() interface +Related: rhbz#1841488 +- Allow realmd_t dbus chat with accountsd_t +Resolves: rhbz#1792895 +- Allow nagios_plugin_domain execute programs in bin directories +Resolves: rhbz#1815621 +- Update allow rules set for nrpe_t domain +Resolves: rhbz#1750821 +- Allow Gluster mount client to mount files_type +Resolves: rhbz#1753626 +- Allow qemu-kvm read and write /dev/mapper/control +Resolves: rhbz#1835909 +- Introduce logrotate_use_cifs boolean +Resolves: rhbz#1795923 +- Allow ptp4l_t sys_admin capability to run bpf programs +Resolves: rhbz#1759214 +- Allow rhsmd mmap /etc/passwd +Resolves: rhbz#1814644 +- Remove files_mmap_usr_files() call for systemd_localed_t +Related: rhbz#1801214 +- Allow domain mmap usr_t files +Resolves: rhbz#1801214 +- Allow libkrb5 lib read client keytabs +Resolves: rhbz#1831769 +- Add files_dontaudit_manage_boot_dirs() interface +Related: rhbz#1803868 +- Create files_create_non_security_dirs() interface +Related: rhbz#1840265 +- Add new interface dev_mounton_all_device_nodes() +Related: rhbz#1840265 +- Add new interface dev_create_all_files() +Related: rhbz#1840265 +- Allow sshd write to kadmind temporary files +Resolves: rhbz#1841488 +- Create init_create_dirs boolean to allow init create directories +Resolves: rhbz#1832231 +- Do not audit staff_t and user_t attempts to manage boot_t entries +Resolves: rhbz#1803868 +- Allow systemd to relabel all files on system. +Resolves: rhbz#1818981 +- Make dbus-broker service working on s390x arch +Resolves: rhbz#1840265 + +* Wed May 20 2020 Zdenek Pytela - 3.14.3-44 +- Make boinc_var_lib_t label system mountdir attribute +Resolves: rhbz#1779070 +- Allow aide to be executed by systemd with correct (aide_t) domain +Resolves: rhbz#1814809 +- Allow chronyc_t domain to use nsswitch +Resolves: rhbz#1772852 +- Allow nscd_socket_use() for domains in nscd_use() unconditionally +Resolves: rhbz#1772852 - Allow gluster geo-replication in rsync mode Resolves: rhbz#1831109 - -* Mon Apr 27 2020 Zdenek Pytela - 3.14.3-41.3 -- Allow init_t set the nice level of all domains -Resolves: rhbz#1827637 - -* Thu Apr 16 2020 Zdenek Pytela - 3.14.3-41.2 +- Update networkmanager_read_pid_files() to allow also list_dir_perms +Resolves: rhbz#1781818 +- Allow associating all labels with CephFS +Resolves: bz#1814689 +- Allow tcpdump sniffing offloaded (RDMA) traffic +Resolves: rhbz#1834773 + +* Fri Apr 17 2020 Zdenek Pytela - 3.14.3-43 +- Update radiusd policy +Resolves: rhbz#1803407 +- Allow sssd read NetworkManager's runtime directory +Resolves: rhbz#1781818 +- Label /usr/lib/NetworkManager/dispatcher as NetworkManager_initrc_exec_t +Resolves: rhbz#1777506 +- Allow ipa_helper_t to read kr5_keytab_t files +Resolves: rhbz#1769423 +- Add ibacm_t ipc_lock capability +Resolves: rhbz#1754719 +- Allow opafm_t to create and use netlink rdma sockets. +Resolves: rhbz#1786670 +- Allow ptp4l_t create and use packet_socket sockets +Resolves: rhbz#1759214 +- Update ctdbd_t policy +Resolves: rhbz#1735748 - Allow glusterd synchronize between master and slave Resolves: rhbz#1824662 +- Allow auditd poweroff or switch to single mode +Resolves: rhbz#1826788 +- Allow init_t set the nice level of all domains +Resolves: rhbz#1819121 +- Label /etc/sysconfig/ip6?tables\.save as system_conf_t +Resolves: rhbz#1776873 +- Add file context entry and file transition for /var/run/pam_timestamp +Resolves: rhbz#1791957 -* Mon Apr 13 2020 Zdenek Pytela - 3.14.3-41.1 +* Wed Apr 08 2020 Zdenek Pytela - 3.14.3-42 - Allow ssh-keygen create file in /var/lib/glusterd -Resolves: rhbz#1821759 +Resolves: rhbz#1816663 - Update ctdbd_manage_lib_files() to also allow mmap ctdbd_var_lib_t files -Resolves: rhbz#1821226 +Resolves: rhbz#1819243 - Remove container interface calling by named_filetrans_domain. +- Makefile: fix tmp/%.mod.fc target +Resolves: rhbz#1821191 * Mon Mar 16 2020 Zdenek Pytela - 3.14.3-41 - Allow NetworkManager read its unit files and manage services