217 lines
9.8 KiB
Text
217 lines
9.8 KiB
Text
|
* Wed Apr 24 2013 Chris PeBenito <selinux@tresys.com> - 2.20130424
|
||
|
|
Chris PeBenito (78):
|
||
|
|
Mcelog update from Guido Trentalancia.
|
||
|
|
Add bird contrib module from Dominick Grift.
|
||
|
|
Minor whitespace fix in udev.fc
|
||
|
|
Module version bump for udev binary location update from Sven Vermeulen.
|
||
|
|
clarify the file_contexts.subs_dist configuration file usage from Guido
|
||
|
|
Trentalancia
|
||
|
|
Update contrib.
|
||
|
|
Remove trailing / from paths
|
||
|
|
Module version bump for fc substitutions optimizations from Sven
|
||
|
|
Vermeulen.
|
||
|
|
Update contrib.
|
||
|
|
Module version bump for /run/dhcpc directory creation by dhcp from Sven
|
||
|
|
Vermeulen.
|
||
|
|
Module version bump for fc fixes in devices module from Dominick Grift.
|
||
|
|
Update contrib.
|
||
|
|
Module version bump for /dev/mei type and label from Dominick Grift.
|
||
|
|
Module version bump for init_daemon_run_dirs usage from Sven Vermeulen.
|
||
|
|
Module version bump for lost+found labeling in /var/log from Guido
|
||
|
|
Trentalancia.
|
||
|
|
Module version bump for loop-control patch.
|
||
|
|
Turn off all tunables by default, from Guido Trentalancia.
|
||
|
|
Add /usr/lib to TEST_TOOLCHAIN LD_LIBRARY_PATH.
|
||
|
|
Module version bump for various changes from Sven Vermeulen.
|
||
|
|
Module version bump for ports update from Dominick Grift.
|
||
|
|
Module version bump for Debian file context updates from Laurent
|
||
|
|
Bigonville.
|
||
|
|
Update contrib.
|
||
|
|
Update contrib.
|
||
|
|
split kmod fc into two lines.
|
||
|
|
Module version bump for kmod fc from Laurent Bigonville.
|
||
|
|
Module version bump for cfengine fc change from Dominick Grift.
|
||
|
|
Module verision bump for Debian cert file fc update from Laurent
|
||
|
|
Bigonville.
|
||
|
|
Module version bump for ipsec net sysctls reading from Miroslav Grepl.
|
||
|
|
Module version bump for srvloc port definition from Dominick Grift.
|
||
|
|
Rename cachefiles_dev_t to cachefiles_device_t.
|
||
|
|
Module version bump for cachefiles core support.
|
||
|
|
Module version bump for changes from Dominick Grift and Sven Vermeulen.
|
||
|
|
Module version bump for modutils patch from Dominick Grift.
|
||
|
|
Module version bump for dhcp6 ports, from Russell Coker.
|
||
|
|
Rearrange new xserver interfaces.
|
||
|
|
Rename new xserver interfaces.
|
||
|
|
Module version bump for xserver interfaces from Dominick Grift.
|
||
|
|
Move kernel_stream_connect() declaration.
|
||
|
|
Module version bump for kernel_stream_connect() from Dominick Grift.
|
||
|
|
Rename logging_search_all_log_dirs to logging_search_all_logs
|
||
|
|
Module version bump for minor logging and sysnet changes from Sven
|
||
|
|
Vermeulen.
|
||
|
|
Module version bump for dovecot libs from Mika Pflueger.
|
||
|
|
Rearrange interfaces in files, clock, and udev.
|
||
|
|
Module version bump for interfaces used by virt from Dominick Grift.
|
||
|
|
Module version bump for arping setcap from Dominick Grift.
|
||
|
|
Rearrange devices interfaces.
|
||
|
|
Module version bump/contrib sync.
|
||
|
|
Rearrange lines.
|
||
|
|
Module version bump for user home content fixes from Dominick Grift.
|
||
|
|
Rearrange files interfaces.
|
||
|
|
Module version bump for Gentoo openrc fixes for /run from Sven Vermeulen.
|
||
|
|
Update contrib.
|
||
|
|
Whitespace fix in miscfiles.fc.
|
||
|
|
Adjust man cache interface names.
|
||
|
|
Module version bump for man cache from Dominick Grift.
|
||
|
|
Module version bump for Debian ssh-keysign location from Laurent
|
||
|
|
Bigonville.
|
||
|
|
Module version bump for userdomain portion of XDG updates from Dominick
|
||
|
|
Grift.
|
||
|
|
Module version bump for iptables fc entry from Sven Vermeulen and inn log
|
||
|
|
from Dominick Grift.
|
||
|
|
Module version bump for logging and tcpdump fixes from Sven Vermeulen.
|
||
|
|
Move mcs_constrained() impementation.
|
||
|
|
Module version bump for mcs_constrained from Dominick Grift.
|
||
|
|
Update contrib.
|
||
|
|
Module version bump from Debian changes from Laurent Bigonville.
|
||
|
|
Module version bump for zfs labeling from Matthew Thode.
|
||
|
|
Module version bump for misc updates from Sven Vermeulen.
|
||
|
|
Update contrib.
|
||
|
|
Module version bump for fixes from Dominick Grift.
|
||
|
|
Module version bump for Debian updates from Laurent Bigonville.
|
||
|
|
Fix bug in userdom_delete_all_user_home_content_files() from Kohei KaiGai.
|
||
|
|
Update contrib
|
||
|
|
Fix fc_sort.c warning uncovered by recent gcc
|
||
|
|
Module version bump for chfn fixes from Sven Vermeulen.
|
||
|
|
Add swapoff fc entry.
|
||
|
|
Add conntrack fc entry.
|
||
|
|
Update contrib.
|
||
|
|
Update contrib
|
||
|
|
Archive old Changelog for log format change.
|
||
|
|
Bump module versions for release.
|
||
|
|
|
||
|
|
Dominick Grift (40):
|
||
|
|
There can be more than a single watchdog interface
|
||
|
|
Fix a suspected typo
|
||
|
|
Intel® Active Management Technology
|
||
|
|
Declare a loop control device node type and label /dev/loop-control
|
||
|
|
accordingly
|
||
|
|
Declare port types for ports used by Fedora but use /etc/services for port
|
||
|
|
names rather than using fedora port names. If /etc/services does not
|
||
|
|
have a port name for a port used by Fedora, skip for now.
|
||
|
|
Remove var_log_t file context spec
|
||
|
|
svrloc port type declaration from slpd policy module
|
||
|
|
Declare a cachfiles device node type
|
||
|
|
Implement files_create_all_files_as() for cachefilesd
|
||
|
|
Restricted Xwindows user domains run windows managers in the windows
|
||
|
|
managers domain
|
||
|
|
Declare a cslistener port type for phpfpm
|
||
|
|
Changes to the sysnetwork policy module
|
||
|
|
Changes to the userdomain policy module
|
||
|
|
Changes to the bootloader policy module
|
||
|
|
Changes to the modutils policy module
|
||
|
|
Changes to the xserver policy module
|
||
|
|
Changes to various policy modules
|
||
|
|
Changes to the kernel policy module
|
||
|
|
For svirt_lxc_domain
|
||
|
|
For svirt_lxc_domain
|
||
|
|
For svirt_lxc_domain
|
||
|
|
For virtd lxc
|
||
|
|
For virtd_lxc
|
||
|
|
For virtd_lxc
|
||
|
|
For virtd lxc
|
||
|
|
For virtd lxc
|
||
|
|
For virtd
|
||
|
|
Arping needs setcap to cap_set_proc
|
||
|
|
For virtd
|
||
|
|
Changes to the user domain policy module
|
||
|
|
Samhain_admin() now requires a role for the role_transition from $1 to
|
||
|
|
initrc_t via samhain_initrc_exec_t
|
||
|
|
Changes to the user domain policy module
|
||
|
|
Label /var/cache/man with a private man cache type for mandb
|
||
|
|
Create a attribute user_home_content_type and assign it to all types that
|
||
|
|
are classified userdom_user_home_content()
|
||
|
|
These two attribute are unused
|
||
|
|
System logger creates innd log files with a named file transition
|
||
|
|
Implement mcs_constrained_type
|
||
|
|
Changes to the init policy module
|
||
|
|
Changes to the userdomain policy module
|
||
|
|
NSCD related changes in various policy modules
|
||
|
|
|
||
|
|
Guido Trentalancia (1):
|
||
|
|
add lost+found filesystem labels to support NSA security guidelines
|
||
|
|
|
||
|
|
Laurent Bigonville (21):
|
||
|
|
Add Debian locations for GDM 3
|
||
|
|
Add Debian location for udisks helpers
|
||
|
|
Add insmod_exec_t label for kmod executable
|
||
|
|
Add Debian location for PKI files
|
||
|
|
Add Debian location for ssh-keysign
|
||
|
|
Properly label all the ssh host keys
|
||
|
|
Allow udev_t domain to read files labeled as consolekit_var_run_t
|
||
|
|
authlogin.if: Add auth_create_pam_console_data_dirs and
|
||
|
|
auth_pid_filetrans_pam_var_console interfaces
|
||
|
|
Label /etc/rc.d/init.d/x11-common as xdm_exec_t
|
||
|
|
Drop /etc/rc.d/init.d/xfree86-common filecontext definition
|
||
|
|
Label /var/run/shm as tmpfs_t for Debian
|
||
|
|
Label /var/run/motd.dynamic as initrc_var_run_t
|
||
|
|
Label /var/run/initctl as initctl_t
|
||
|
|
udev.if: Call files_search_pid instead of files_search_var_lib in
|
||
|
|
udev_manage_pid_files
|
||
|
|
Label executables in /usr/lib/NetworkManager/ as bin_t
|
||
|
|
Add support for rsyslog
|
||
|
|
Label var_lock_t as a mountpoint
|
||
|
|
Add mount_var_run_t type and allow mount_t domain to manage the files and
|
||
|
|
directories
|
||
|
|
Add initrc_t to use block_suspend capability
|
||
|
|
Label executables under /usr/lib/gnome-settings-daemon/ as bin_t
|
||
|
|
Label nut drivers that are installed in /lib/nut on Debian as bin_t
|
||
|
|
|
||
|
|
Matthew Thode (1):
|
||
|
|
Implement zfs support
|
||
|
|
|
||
|
|
Mika Pflüger (2):
|
||
|
|
Debian locations of gvfs and kde4 libexec binaries in /usr/lib
|
||
|
|
Explicitly label dovecot libraries lib_t for debian
|
||
|
|
|
||
|
|
Miroslav Grepl (1):
|
||
|
|
Allow ipsec to read kernel sysctl
|
||
|
|
|
||
|
|
Paul Moore (1):
|
||
|
|
flask: add the attach_queue permission to the tun_socket object class
|
||
|
|
|
||
|
|
Russell Coker (1):
|
||
|
|
Label port 5546 as dhcpc_port_t and allow dhcpc_t to bind to TCP for
|
||
|
|
client control
|
||
|
|
|
||
|
|
Sven Vermeulen (27):
|
||
|
|
New location for udevd binary
|
||
|
|
Use substititions for /usr/local/lib and /etc/init.d
|
||
|
|
DHCP client's hooks create /run/dhcpc directory
|
||
|
|
Introduce init_daemon_run_dir transformation
|
||
|
|
Use the init_daemon_run_dir interface for udev
|
||
|
|
Allow initrc_t to create run dirs for core modules
|
||
|
|
Puppet uses mount output for verification
|
||
|
|
Allow syslogd to create /var/lib/syslog and
|
||
|
|
/var/lib/misc/syslog-ng.persist
|
||
|
|
Gentoo's openrc does not require initrc_exec_t for runscripts anymore
|
||
|
|
Allow init scripts to read courier configuration
|
||
|
|
Allow search within postgresql var directory for the stream connect
|
||
|
|
interface
|
||
|
|
Introduce logging_getattr_all_logs interface
|
||
|
|
Introduce logging_search_all_log_dirs interface
|
||
|
|
Support flushing routing cache
|
||
|
|
Allow init to set attributes on device_t
|
||
|
|
Introduce files_manage_all_pids interface
|
||
|
|
Gentoo openrc migrates /var/run and /var/lock data to /run(/lock)
|
||
|
|
Update files_manage_generic_locks with directory permissions
|
||
|
|
Run ipset in iptables domain
|
||
|
|
tcpdump chroots into /var/lib/tcpdump
|
||
|
|
Remove generic log label for cron location
|
||
|
|
Postgresql 9.2 connects to its unix stream socket
|
||
|
|
lvscan creates the /run/lock/lvm directory if nonexisting (v2)
|
||
|
|
Allow syslogger to manage cron log files (v2)
|
||
|
|
Allow initrc_t to read stunnel configuration
|
||
|
|
Introduce exec-check interfaces for passwd binaries and useradd binaries
|
||
|
|
chfn_t reads in file context information and executes nscd
|
||
|
|
|