refpolicy (2:2.20171228-1) unstable; urgency=medium * New upstream from git with lots of Debian patches merged. This policy is not a candidate for Buster or anything, I'm uploading it to facilitate SE Linux development. The next time Tresys make an official release I'll put it in Debian Git and make it a candidate for Buster. * Removed authbind policy * Set WERROR=y to remove deprecated interfaces * Enable UBAC for mcs policy * Use compat level 11 -- Russell Coker Thu, 28 Dec 2017 17:46:57 +1100 refpolicy (2:2.20161023.1-9) unstable; urgency=medium * Dontaudit dkim_milter_t binding to labeled udp ports * Allow passwd_t to inherit fd from unconfined_t for package scripts * Allow httpd_sys_script_t to talk to itself via unix datagrams and send syslog messages * Allow logwatch_mail_t to rw system_cronjob_t pipes Allow logwatch_t to run mdadm * Label /etc/postfixadmin as httpd_config_t * Allow system_cronjob_t to create directories under /tmp * Allow spamass_milter_t to read the overcommit sysctl * Allow unconfined domains the capability2:wake_alarm. * Added ~/DovecotMail to the list of mail_home_rw_t directories * Allow systemd_logind_t to get dpkg_script_t process state and talk to it via dbus * For https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851933 allow udev_t to read default_t. Still need that udev bug fixed! -- Russell Coker Thu, 26 Jan 2017 00:52:00 +1100 refpolicy (2:2.20161023.1-8) unstable; urgency=medium * Fixed mistake in previous changelog (attributed a -7 change to -6) * Label /usr/sbin/apache2ctl as well. Allow apache to read overcommit sysctl * Allow clamd_t to read the overcommit sysctl * Allow postfix_postdrop_t to write to postfix_public_t socket, allow postfix_master_t to bind to udp generic nodes * Allow dovecot_auth_t to write to dovecot_var_run_t fifos and read selinux config (needed for pop/imap login) * Allow mon local tests to search /var/spool/postfix and autofs mountpoints, and to read nfs content. Allow mon net tests to read certs. dontaudit when mon local tests try to stat tmpfs files. Allow mon local tests to access /dev/xconsole and search mnt_t and boot_t * Allow mount_t to getattr nfs filesystems and manage mount_var_run_t dirs and files * Allow setfiles_t to getattr nfs filesystems. * Allow postgrey_t to exec bin_t files, to read netlink_route_sockets, and to access udp sockets * Allow login programs to share fds with systemd_passwd_agent_t * Allow postfix_master_t to stat the spamass_milter_data_t dir * Allow dpkg_script_t to tell init_t to stop services * Allow initrc_t to tell init_t to halt and get system status - allows poweroff!!! * Make port 8953 be rndc type for unbound. * Lots of policy for systemd_nspawn_t * More policy for systemd_coredump_t to do what it wants * Allow dkim_milter_t to read vm overcommit sysctl * Allow mandb_t to search init pid dirs for systemd * Allow initrc_t to reload systemdunit types * Make init_manage_all_units() include file:getattr access * Allow logrotate to init_manage_all_units for restarting daemons, to stat tmpfs filesystems, to get init system status, and capability net_admin that systemctl wants * Allow network manager to inherit logind pids * Allow devicekit_power_t to search init pid dirs * Allow named to read vm sysctls * Allow mysqld_safe_t to read dpkg db, it inherits cwd from dpkg_script_t alow is to read sysfs and kill mysqld_t Make mysql_signal interface include signull permission and grant that to logrotate * Allow rpcd_t to write /proc/fs/lockd/nlm_end_grace * Make apache use the new interfaces for nfs access and to read httpd_var_lib_t symlinks. Allow httpd_sys_script_t to search init pid dirs * Allow auth to send sigchild to xdm * Allow chkpwd_t to getattr the selinuxfs * Allow system_cronjob_t net_admin capability, manage acct data, and manage initrc services * Allow crontab domains fsetid capability. Use a separate $2_crontab_t domain for each role's crontab program. Give ntp_admin access to system_cronjob_t and allow it to manage var_log_t and cron log files * Label /var/lib/sddm as xdm_var_lib_t * Don't label acct cron job scripts as acct_exec_t * Allow systemd-tmpfiles to create /dev/xconsole * Create new type for /var/run/iodine * Allow logrotate to restart services * Made init_script_service_restart() include reload access * Dontaudit systemd_logind_t statting files under /dev/shm Allow it to setattr unallocated terminals and unlink user_runtime_t files * Added boolean allow_smbd_read_shadow for the obvious purpose Allow smbd_t to read cupsd_var_run_t socket as well as write to it * Allow NetworkManager_t to send dbus messages to unconfined_t * Grant access to dri and input_dev devices to system_dbusd_t, gdm3 makes it want this -- Russell Coker Mon, 23 Jan 2017 01:55:57 +1100 refpolicy (2:2.20161023.1-7) unstable; urgency=medium [ Laurent Bigonville and cgzones ] * Sort the files in the files in the selinux-policy-src.tar.gz tarball by name, this should fix the last issue for reproducible build * Add genfscon for cpu/online. Closes: #849637 [ Russell Coker ] * Make the boinc patch like the one upstream accepted and make it last in the list. * Label /etc/sddm/Xsession as xsession_exec_t * Label ~/.xsession-errors as xauth_home_t and use a type-trans rule for it * Allow devicekit_power_t to chat to xdm_t via dbus * Allow rtkit_daemon_t to stat the selinuxfs and seach default contexts * Allow loadkeys_t to read tmp files created by init scripts * Allow systemd_tmpfiles_t to delete usr_t files for a file copied to /tmp and to read dbus lib files for /var/lib/dbus * Allow systemd_logind_t to list tmpfs_t dirs, relabelto user runtime, relabel to/from user_tmpfs_t, and manage wireless_device_t * Allow xauth_t to inherit file handles from xdm_t, read an inherited fifo and read/write an inherited socket. * Allow xdm_t to send dbus messages to unconfined_t * Give crond_t sys_resource so it can set hard ulimit for jobs * Allow systemd_logind_t to setattr on the kvm device and user ttys, to manage user_tmp_t and user_tmpfs_t files, to read/write the dri device * Allow systemd_passwd_agent_t to stat the selinuxfs and search the contexts dir * Make systemd_read_machines() also allow listing directory * Make auth_login_pgm_domain() include userdom_read_user_tmpfs_files() * Allow setfiles_t to inherit apt_t file handles * Allow system_mail_t to use ptys from apt_t and unconfined_t * Label /run/agetty.reload as getty_var_run_t * Allow systemd_tmpfiles_t to relabel directories to etc_t * Made sysnet_create_config() include { relabelfrom relabelto manage_file_perms }, allow systemd_tmpfiles_t to create config, and set file contexts entries for /var/run/resolvconf. Makes policy work with resolvconf (but requires resolvconf changes) Closes: #740685 * Allow dpkg_script_t to restart init services * Allow shell_exec_t to be an entrypoint for unconfined_cronjob_t * Allow named to read network sysctls and usr files * Label /lib/systemd/systemd-timedated and /lib/systemd/systemd-timesyncd as ntpd_exec_t and allow ntpd_t to talk to dbus and talk to sysadm_t and unconfined_t over dbus. Allow ntpd_t capabilities fowner and setpcap when building with systemd support, also allow listing init pid dirs. Label /var/lib/systemd/clock as ntp_drift_t * Allow systemd_nspawn_t to read system state, search init pid dirs (for /run/systemd) and capability net_admin * Allow backup_t capabilities chown and fsetid to cp files and preserve ownership * Allow logrotate_t to talk to dbus and connect to init streams for systemctl, also allow setrlimit for systemctl and get service status of all unit files * Allow mon_net_test_t to bind to generic UDP nodes. Allow mon_local_test_t to execute all applications (for ps to getattr mostly) * Label /var/lib/wordpress as httpd_var_lib_t * Label apachectl as httpd_exec_t so it correctly creates pid dirs etc and allow it to manage dirs of type httpd_lock_t [ Russell Coker Important ] * sddm is now working (gdm3 SEGVs, not a policy bug), closes: #781779 * Support usrmerge, lots of fc changes and subst_dist changes Closes: #850032 -- Russell Coker Thu, 12 Jan 2017 18:01:40 +1100 refpolicy (2:2.20161023.1-6) unstable; urgency=medium * Label /var/lib/unbound as named_cache_t, closes: #740657 * Merge patch for gbp.conf from cgzones closes: #849459 * Merge patch from cgzones to add new .basemodules file. Closes: #849460 * Make the package build fail when a file is missing. Closes: #849461 * Replaced domain_auto_trans with domain_auto_transition_pattern. Closes: #849463 * New type systemd_machined_var_run_t for /run/systemd/machines * Allow initrc_t to get the status of null device service files (for symlinks) and to reload systemd_unit_t services. * Allow systemd_logind_t to manage user_runtime_t directories. allow it sys_admin capability. Allow it to list udev_var_run_t dirs for /run/udev/tags/power-switch. * Label /run/console-setup as udev_var_run_t * Label lvmetad as lvm_exec_t * Made it conflict with mcstrans because we currently can't get mcstrans, dbus, and systemd to work together. * Allow systemd_logind_t to create /run/systemd/inhibit and to manage systemd_logind_var_run_t dirs and mount/umount,relabelfrom tmpfs_t * Allow systemd_machined_t to manage symlinks in it's pid dir * Allow systemd_machined_t to stat tmpfs_t and cgroup_t filesystems * Updated monit patch from cgzones. * Allow policykit_t to stat tmpfs_t and cgroup_t filesystems and to read urandom * Change auth_login_pgm_domain() to include writing to sessions fifo. and searching user_runtime_t * Allow systemd_logind_t and systemd_machined_t to read initrc_t files to get cgroup and sessionid * Allow systemd_logind_t to read xserver_t files to get cgroup and sessionid * Allow system_mail_t to access unix_stream_sockets inherited from init for error messages on startup * Allow system_cronjob_t to get systemd unit status * Allow logrotate to talk to dbus and talk to the private systemd socket for systemctl * Allow console_device_t to associate with devpts_t:filesystem for /dev/pts/0 * Allow systemd_logind_t to read all users state for cgroup and sessionid files * Label /var/run/sddm and /usr/bin/sddm * Allow systemd_logind_t to talk to policykit_t and xserver_t by dbus * Allow systemd_logind_t to send messages to initrc_t by dbus * Allow policykit_t to send dbus messages to all userdomains -- Russell Coker Sun, 01 Jan 2017 15:33:26 +1100 refpolicy (2:2.20161023.1-5) unstable; urgency=medium * Allowed system_munin_plugin_t to read usr_t files and have capability net_admin for mii-tool. Thanks joerg Closes: #619855 * Allow rsync_t to stat all sock_files and fifo_files when rsync_export_all_ro is set. Thanks joerg Closes: #619979 * Allow bitlbee_t to read FIPS state. Closes: #697814 * Allow mono_t to be in role unconfined_r. Closes: #734192 * Allow dpkg_script_t to manage null_device_t services for service scripts linked to /dev/null. Closes: #757994 * Give systemd_tmpfiles_t sys_admin capability for adjusting quotas. * Included initrc_t as a source domain in init_ranged_domain() so that old XDM packages that lack a systemd service file will work. * Use xserver_role() for unconfined_t so the xdm can start the session. * Allow user domains to talk to devicekit_disk_t and devicekit_power_t via dbus * Label /run/lvm as lvm_var_run_t * Allow dhcpc_t to manage samba config -- Russell Coker Thu, 29 Dec 2016 01:08:24 +1100 refpolicy (2:2.20161023.1-4) unstable; urgency=medium * Allow mon_t to read sysfs. * Made gpm_getattr_gpmctl also allow getattr on the fifo_file * Allow mount_t to getattr tmpfs_t and rpc_pipefs_t filesystems * Allow systemd_logind_t to change identities of files * Allow systemd_logind_t to read the cgroups files of all login processes * Added monit policy from cgzones . Closes: #691283 * Allow udev_t to transition to initrc_t for hotplug scripts, and label /etc/network/ip-ip.d/* etc as initrc_exec_t. Policy taken from Wheezy at the recommendation of Devin Carraway Closes: #739590 -- Russell Coker Wed, 28 Dec 2016 00:36:11 +1100 refpolicy (2:2.20161023.1-3) unstable; urgency=medium * Allow ntpd_t to create sockets. * Allow systemd_hostnamed_t and systemd_logind_t to talk to NetworkManager_t via dbus. * Allow systemd_backlight_t to send syslog messages, read sysfs, read etc_t files, read init state, read udev_var_run_t files (udev data). * Allow systemd_machined_t to send messages to init_t and initrc_t via dbus, connect to the system dbus, read etc_t files, and start and stop init_var_run_t services and init_t system * Allow systemd_logind_t to talk to devicekit_power_t and unconfined_t over dbus * Allow systemd_tmpfiles_t to read proc_net_t * Use /sbin/ldconfig instead of /sbin/ldconfig.real * Give devicekit_disk_t wake_alarm capability * Write policy for systemd_coredump_t * Allow systemd_logind_t to read xdm_t files for XDM state and talk to xdm via dbus. * Change /lib/systemd/systemd-cryptsetup to /usr/lib/systemd/systemd-cryptsetup so file_contexts.subs_dist doesn't cause the wrong name to match. Allow lvm_t to load modules for systemd-cryptsetup * Allow mon_local_test_t to stat gpmctl_t socket. Generally allow the local tests to access most things that can't do any harm. * Allow systemd_passwd_agent_t to use getty_t fds and read init state. * Allow unconfined domains to start and stop etc_t units -- Russell Coker Wed, 21 Dec 2016 18:35:33 +1100 refpolicy (2:2.20161023.1-2) unstable; urgency=medium * Only label files as NetworkManager_initrc_exec_t * Use separate domains mon_net_test_t and mon_local_test_t for network and local tests * Allow boinc to read xdm tmp dirs and connect to the X server, allow it to read crypto sysctl for some of it's libraries * Allow unconfined_t to request init to reload it's config * Make bin_t an entrypoint for inetd_child_t * Allow systemd_tmpfiles_t to read selinuxfs and selinux_config_t to find correct context Closes: #834228 * Allow systemd_cgroups_t to read selinux_config_t * Allow systemd_sessions_t to get contexts for sessions and default contexts for files for correct labeling * Allow systemd_logind_t to read cgroup files and getattr cgroupfs, and to start and stop user sessions * Allow systemd_tmpfiles_t to read kmod_var_run_t for /run/tmpfiles.d/kmod.conf * Allow syslogd_t to read SE Linux config * Allow dpkg_script_t to reload systemd configuration and to restart initrc_exec_t units. * Allow sulogin to read crypto sysctls and set booleans * Allow cron jobs append and ioctl access to crond_tmp_t * Allow systemd_hostnamed_t to read sysfs * Policy to allow systemd_backlight_t and systemd_machined_t to do things * Give initrc_t, xserver_t, and devicekit_power_t wake_alarm capability. * Allow tor to search tmpfs. * Allow system_mail_t to inherit file handles from init. -- Russell Coker Thu, 08 Dec 2016 23:16:14 +1100 refpolicy (2:2.20161023.1-1) unstable; urgency=medium * New upstream to remove unwanted files from the archive. * Type mon_test_exec_t for /usr/lib/mon/helper/* * Give init_t and udev_t capability2:wake_alarm for systemd and systemd-udevd * logging_manage_generic_logs(systemd_tmpfiles_t) for /var/log/?tmp * Make bin_t an entrypoint for mon_test_t for scripts run from sudo. * Allow postfix_master_t to getsched for sort and other programs from startup shell scripts -- Russell Coker Sun, 04 Dec 2016 22:41:31 +1100 refpolicy (2:2.20161023-1) unstable; urgency=medium * Rebase to new release -- Russell Coker Wed, 02 Nov 2016 15:15:07 +1100 refpolicy (2:2.20160808-0.1) experimental; urgency=medium * Rebase to git repository from 20160808, this removes some patches that have already been accepted upstream. * Allow systemd_logind_t to get init status and read /dev/urandom * Allow initrc_t to reload init_t and request reboot * Allow systemd_tmpfiles_t to manage /etc/mtab * Allow mon_test_t to read sysfs. -- Russell Coker Mon, 08 Aug 2016 20:54:09 +1000 refpolicy (2:2.20151208-1.1) unstable; urgency=medium * Rename the patches that are included upstream to 9xxx for easier tracking and easier removal when it's time to rebase. * Remove the patch for ifconfig to load kernel modules, shouldn't be needed. * Backported kernel_read_vm_overcommit_sysctl() etc from git. * Removed class proxy, don't know why we had it * This policy can't be installed without policycoreutils 2.5 or newer, made it depend and build-depend on version 2.5 of everything just in case. * Made the policy postinst not redirect stdout/stderr to /dev/null. All the output will be ignored when things go well and when things break we need it. * New patch 9999-random-backports for stuff backported from upstream git. Added validate_trans to class security * Allow init_t to stop all systemd units and reload init_t. * Allow systemd_tmpfiles_t to create and manage all pidfiles directories, relabel /home, relabel man cache, create lock dirs, create xdm and xfs tmp files * Labeling dpkg-statoverride as setfiles_exec_t was a bad idea, reverting * Changed labelling for Postfix 3.x * Set SYSTEMD=y in the build options -- Russell Coker Wed, 03 Aug 2016 12:34:23 +1000 refpolicy (2:2.20151208-1) unstable; urgency=medium * Rebase to new upstream * Move locallogin, sysadm, udev, and modutils to base * Add /lib/systemd to file_contexts.subs_dist and remove duplicate fcontexts * Allow unconfined_t to manage all init units * Allow dmesg_t and sysadm_t to read /dev/kmsg * Label /usr/lib/selinux/hll/pp as bin_t * Allow udev_t to create /var/run/network with type net_conf_t * Allow auditctl_t to getcap * Allow auditd_t setattr on /var/log/audit * Allow semanage_t to search policy_src_t dirs for /usr/lib/selinux/hll * Label /lib/systemd/libsystemd-shared-.*.so as lib_t * Allow systemd_tmpfiles_t and systemd_cgroups_t to read /proc/1/environ and /proc/cmdline, and have capability net_admin * Allow systemd_tmpfiles_t to create and relabel var_t directories * Allow systemd_cgroups_t to send unix dgrams to init. * Label /var/run/alsa as alsa_var_lock_t and use type trans for alsa_t to create it * Allow syslogd_t to create syslogd_var_run_t dirs for /run/systemd/journal/streams/ * Allow alsa_t to manage directories and lnk_files of type alsa_var_lock_t for directories under /run/alsa * This policy works well for a VM but is known to not work on bare metal. I'll upload a new version that fixes this soon. -- Russell Coker Wed, 03 Aug 2016 10:42:57 +1000 refpolicy (2:2.20140421-14) jessie; urgency=medium * Allow mon_test_t to get RAID status and write to mon_var_lib_t Allow mon_test_t to exec mon_test_exec_t (for chained tests) Allow mon_test_t to read BIND config files * Added auth_read_var_auth(mozilla_t) and allowed mozilla to create mozilla_tmpfs_t directories for /var/run/auth/PID/pulse. Allow mozilla_t setcap and exec of mozilla_home_t for plugins. Allow mozilla to read vm_sysctls for overcommit memory status. * Label /usr/bin/boinc as boinc_exec_t and /var/lib/boinc-client(/.*)? as boinc_var_lib_t. Allow boinc to exec itself. Allow boinc to exec lib_t. Label /var/log/boincerr.log. Allow boinc-client to write to /etc/boinc-client/global_prefs_override.xml Allow boinc to event_device_t, mouse_device_t, ptmx_t, devpts_t, and user_tty_device_t character devices to find out when system is idle * Merge my stuff with git repository -- Russell Coker Tue, 10 May 2016 00:40:21 +1000 refpolicy (2:2.20140421-13) jessie; urgency=medium * Allow dovecot_auth_t to get the SE Linux mount point for PAM authentication * Allow unconfined domains to get the service status for etc_t. * Allow mailman_queue_t to read bin_t symlinks * Allow clamd_t and spamass_milter_t to read sysfs_t files * Allow system_cronjob_t to read mrtg_etc_t to see if it's enabled * Allow httpd_t to send signull to httpd_sys_script_t Allow httpd_sys_script_t to read/write stream sockets it inherits from httpd_t Allow httpd_t to read httpd_script_exec_type symlinks * Allow postgrey_t to read bin_t for perl * Label /usr/bin/prosody, /var/run/prosody, /var/lib/prosody, and /var/log/prosody as jabber types. Allow jabberd_t to exec bin_t (to run env), read usr_t (for lua modules), and have netlink read access. * Set context for /var/run/spamassassin.pid * Allow passwd_t to be in unconfined_r for dpkg to create new users * Reserve port 10023 for postgrey too * Allow semanage_t to execute a shell for "semanage permissive" commands. * Allow ping to read /dev/urandom * Make create_chr_file_perms include setattr access for autofs device * Allow initrc_t to create and setattr var_run_t dirs * Allow initrc_t to create dirs under /dev for /dev/net (needed for 6to4) * Allow initrc_t to create tmpfs_t files * Added policy for mon network monitoring -- Russell Coker Thu, 05 May 2016 16:27:38 +1000 refpolicy (2:2.20140421-12) jessie; urgency=medium * Allow init_t to manage init_var_run_t symlinks and self getsched to relabel files and dirs to etc_runtime_t for /run/blkid to read/write init_var_run_t fifos for /run/initctl kernel_rw_unix_sysctls() for setting max_dgram_qlen (and eventually other sysctls) * Allow restorecond_t and setfiles_t to getattr pstore_t and debugfs_t filesystems * Allow kernel_t to setattr/getattr/unlink tty_device_t for kdevtmpfs * Label /usr/share/bug/.* files as bin_t for reportbug in strict configuration * Label /run/tmpfiles.d/kmod.conf as kmod_var_run_t and allow insmod_t to create it * apache_unlink_var_lib() now includes write access to httpd_var_lib_t:dir * Allow apache to read sysctl_vm_t for overcommit_memory Allow httpd_sys_script_t to read sysfs_t. allow httpd_t to manage httpd_log_t files and directories for mod_pagespeed. * Removed bogus .* in mailman file context that was breaking the regex * Lots of mailman changes * Allow system_mail_t read/write access to crond_tmp_t * Allow postfix_pipe_t to write to postfix_public_t sockets * Label /usr/share/mdadm/checkarray as bin_t * Let systemd_passwd_agent_t, chkpwd_t, and dovecot_auth_t get enforcing status * Allow systemd_tmpfiles_t to create the cpu_device_t device * Allow init_t to manage init_var_run_t links * Allow groupadd_t the fsetid capability * Allow dpkg_script_t to transition to passwd_t. Label dpkg-statoverride as setfiles_exec_t for changing SE Linux context. Allow setfiles_t to read dpkg_var_lib_t so dpkg-statoverride can do it's job * Allow initrc_t to write to fsadm_log_t for logsave in strict configuration * Allow webalizer to read fonts and allow logrotate to manage webaliser_usage_t files also allow it to be run by logrotate_t. * Allow jabber to read ssl certs and give it full access to it's log files Don't audit jabber running ps. * Made logging_search_logs() allow reading var_log_t:lnk_file for symlinks in log dir * Allow webalizer to read usr_t and created webalizer_log_t for it's logs * Made logging_log_filetrans and several other logging macros also allow reading var_log_t links so a variety of sysadmin symlinks in /var/log won't break things * Allow postfix_policyd_t to execute bin_t, read urandom, and capability chown. New type postfix_policyd_tmp_t * Added user_udp_server boolean * Allow apt_t to manage dirs of type apt_var_cache_t -- Russell Coker Sun, 28 Feb 2016 12:39:36 +1100 refpolicy (2:2.20140421-11) unstable; urgency=medium * Allow jabber to connect to the jabber_interserver_port_t TCP port Closes: #697843 * Allow xm_t to create xen_lock_t files for creating the first Xen DomU * Allow init_t to manage init_var_run_t for service file symlinks * Add init_telinit(dpkg_script_t) for upgrading systemd * Allow dpkg_script_t the setfcap capability for systemd postinst. * Add domain_getattr_all_domains(init_t) for upgrading strict mode systems * Allow *_systemctl_t domains read initrc_var_run_t (/run/utmp), read proc_t, and have capability net_admin. Allow logrotate_systemctl_t to manage all services. * Give init_t the audit_read capability for systemd * Allow iodined_t access to netlink_route_socket. * add init_read_state(systemd_cgroups_t) and init_read_state(systemd_tmpfiles_t) for /proc/1/environ * Label /etc/openvpn/openvpn-status.log as openvpn_status_t as it seems to be some sort of default location. /var/log is a better directory for this * Allow syslogd_t to write to a netlink_audit_socket for systemd-journal * Allow mandb_t to get filesystem attributes * Allow syslogd to rename and unlink init_var_run_t files for systemd temporary files -- Russell Coker Wed, 16 Sep 2015 17:02:34 +1000 refpolicy (2:2.20140421-10.1) unstable; urgency=medium * Allow ntpd_t to delete files for peerstats and loopstats * Add correct file labels for squid3 and tunable for squid pinger raw net access (default true) * Allow qemu_t to read crypto sysctls, rw xenfs files, and connect to xenstored unix sockets * Allow qemu_t to read sysfs files for cpu online * Allow qemu to append xend_var_log_t for /var/log/xen/qemu-dm-* * Allow xm_t (xl program) to create and rename xend_var_log_t files, read kernel images, execute qemu, and inherit fds from sshd etc. * Allow xm_t and iptables_t to manage udev_var_run_t to communicate via /run/xen-hotplug/iptables for when vif-bridge runs iptables * Allow xm_t to write to xen_lock_t files not var_lock_t * Allow xm_t to load kernel modules * Allow xm_t to signal qemu_t, talk to it by unix domain sockets, and unlink it's sockets * dontaudit xm_t searching home dir content * Label /run/xen as xend_var_run_t and allow qemu_t to create sock_files in xend_var_run_t directory * Label /var/lock/xl as xen_lock_t * allow unconfined_t to execute xl/xm in xm_t domain. * Allow system_cronjob_t to configure all systemd services (restart all daemons) * Allow dpkg_script_t and unconfined_t to manage systemd service files of type null_device_t (symlinks to /dev/null) * Label /var/run/lwresd/lwresd.pid as named_var_run_t * Label /run/xen/qmp* as qemu_var_run_t * Also label squid3.pid * Allow iptables_t to be in unconfined_r (for Xen) * Allow udev_t to restart systemd services Closes: #756729 * Merge Laurent's changes with mine -- Russell Coker Mon, 14 Sep 2015 10:54:43 +1000 refpolicy (2:2.20140421-12) unstable; urgency=medium * Team upload. * Install the policy.dtd and policy.xml files in the -dev package, it is used by some userspace tools -- Laurent Bigonville Fri, 27 May 2016 20:23:35 +0200 refpolicy (2:2.20140421-11) unstable; urgency=medium * Team upload. * debian/rules: - Make sure the content of the .modules file is sorted independently of the locale where the package is built. - Force the mode of the files and directories when building the selinux-policy-src tarball to make the build reproducible. * debian/postinst.policy: List the loaded modules from the expected store not from the one configured in the config file * debian/NEWS: Add some information about the new policy store. * debian/postrm.policy: Remove the /var/lib/selinux/final/ directory when purging the package. This directory is created when loading the modules. -- Laurent Bigonville Mon, 16 May 2016 17:49:03 +0200 refpolicy (2:2.20140421-10) unstable; urgency=medium * Team upload. [ Laurent Bigonville ] * Fix the maintainer script to support the new policy store from libsemnage 2.4 (Closes: #805492) * debian/gbp.conf: Sign tags by default (Closes: #781670) * debian/control: Adjust and cleanup the {build-}dependencies (Closes: #805496) * debian/control: Bump Standards-Version to 3.9.8 (no further changes) * debian/rules: Make the build reproducible (Closes: #778232) * Remove deprecated system.users and local.users files * debian/control: Update Homepage URL (Closes: #780934) * debian/rules: Allow parallel build now that the build system is supporting it, see #677689 * debian/policygentool: Remove string exceptions so the script is Python >= 2.6 compatible (Closes: #585355) * Do not install semanage.read.LOCK, semanage.trans.LOCK and file_contexts.local in /etc/selinux/* this is not needed anymore with the new policy store. * debian/control: Use https for the Vcs-* URL's to please lintian * debian/watch: Fix watch file URL now that the project has moved to github [ Russell Coker ] * Allow init_t to manage init_var_run_t symlinks and self getsched to relabel files and dirs to etc_runtime_t for /run/blkid to read/write init_var_run_t fifos for /run/initctl kernel_rw_unix_sysctls() for setting max_dgram_qlen (and eventually other sysctls) * Allow restorecond_t and setfiles_t to getattr pstore_t and debugfs_t filesystems * Allow kernel_t to setattr/getattr/unlink tty_device_t for kdevtmpfs * Label /usr/share/bug/.* files as bin_t for reportbug in strict configuration * Label /run/tmpfiles.d/kmod.conf as kmod_var_run_t and allow insmod_t to create it * apache_unlink_var_lib() now includes write access to httpd_var_lib_t:dir * Allow apache to read sysctl_vm_t for overcommit_memory Allow httpd_sys_script_t to read sysfs_t. allow httpd_t to manage httpd_log_t files and directories for mod_pagespeed. * Removed bogus .* in mailman file context that was breaking the regex * Lots of mailman changes * Allow system_mail_t read/write access to crond_tmp_t * Allow postfix_pipe_t to write to postfix_public_t sockets * Label /usr/share/mdadm/checkarray as bin_t * Let systemd_passwd_agent_t, chkpwd_t, and dovecot_auth_t get enforcing status * Allow systemd_tmpfiles_t to create the cpu_device_t device * Allow init_t to manage init_var_run_t links * Allow groupadd_t the fsetid capability * Allow dpkg_script_t to transition to passwd_t. Label dpkg-statoverride as setfiles_exec_t for changing SE Linux context. Allow setfiles_t to read dpkg_var_lib_t so dpkg-statoverride can do it's job * Allow initrc_t to write to fsadm_log_t for logsave in strict configuration * Allow webalizer to read fonts and allow logrotate to manage webaliser_usage_t files also allow it to be run by logrotate_t. * Allow jabber to read ssl certs and give it full access to it's log files Don't audit jabber running ps. * Made logging_search_logs() allow reading var_log_t:lnk_file for symlinks in log dir * Allow webalizer to read usr_t and created webalizer_log_t for it's logs * Made logging_log_filetrans and several other logging macros also allow reading var_log_t links so a variety of sysadmin symlinks in /var/log won't break things * Allow postfix_policyd_t to execute bin_t, read urandom, and capability chown. New type postfix_policyd_tmp_t * Added user_udp_server boolean * Allow apt_t to manage dirs of type apt_var_cache_t * Allow jabber to connect to the jabber_interserver_port_t TCP port Closes: #697843 * Allow xm_t to create xen_lock_t files for creating the first Xen DomU * Allow init_t to manage init_var_run_t for service file symlinks * Add init_telinit(dpkg_script_t) for upgrading systemd * Allow dpkg_script_t the setfcap capability for systemd postinst. * Add domain_getattr_all_domains(init_t) for upgrading strict mode systems * Allow *_systemctl_t domains read initrc_var_run_t (/run/utmp), read proc_t, and have capability net_admin. Allow logrotate_systemctl_t to manage all services. * Give init_t the audit_read capability for systemd * Allow iodined_t access to netlink_route_socket. * add init_read_state(systemd_cgroups_t) and init_read_state(systemd_tmpfiles_t) for /proc/1/environ * Label /etc/openvpn/openvpn-status.log as openvpn_status_t as it seems to be some sort of default location. /var/log is a better directory for this * Allow syslogd_t to write to a netlink_audit_socket for systemd-journal * Allow mandb_t to get filesystem attributes * Allow syslogd to rename and unlink init_var_run_t files for systemd temporary files * Allow ntpd_t to delete files for peerstats and loopstats * Add correct file labels for squid3 and tunable for squid pinger raw net access (default true) * Allow qemu_t to read crypto sysctls, rw xenfs files, and connect to xenstored unix sockets * Allow qemu_t to read sysfs files for cpu online * Allow qemu to append xend_var_log_t for /var/log/xen/qemu-dm-* * Allow xm_t (xl program) to create and rename xend_var_log_t files, read kernel images, execute qemu, and inherit fds from sshd etc. * Allow xm_t and iptables_t to manage udev_var_run_t to communicate via /run/xen-hotplug/iptables for when vif-bridge runs iptables * Allow xm_t to write to xen_lock_t files not var_lock_t * Allow xm_t to load kernel modules * Allow xm_t to signal qemu_t, talk to it by unix domain sockets, and unlink it's sockets * dontaudit xm_t searching home dir content * Label /run/xen as xend_var_run_t and allow qemu_t to create sock_files in xend_var_run_t directory * Label /var/lock/xl as xen_lock_t * allow unconfined_t to execute xl/xm in xm_t domain. * Allow system_cronjob_t to configure all systemd services (restart all daemons) * Allow dpkg_script_t and unconfined_t to manage systemd service files of type null_device_t (symlinks to /dev/null) * Label /var/run/lwresd/lwresd.pid as named_var_run_t * Label /run/xen/qmp* as qemu_var_run_t * Also label squid3.pid * Allow iptables_t to be in unconfined_r (for Xen) * Allow udev_t to restart systemd services Closes: #756729 * Merge Laurent's changes with mine -- Laurent Bigonville Fri, 13 May 2016 22:29:59 +0200 refpolicy (2:2.20140421-9) unstable; urgency=medium * Allow dovecot_t to read /usr/share/dovecot/protocols.d Allow dovecot_t capability sys_resource Label /usr/lib/dovecot/* as bin_t unless specified otherwise Allow dovecot_auth_t to manage dovecot_var_run_t for auth tokens * Allow clamd_t capability { chown fowner fsetid } Allow clamd_t to read sysctl_vm_t * Allow dkim_milter_t capability dac_override and read sysctl_vm_t allow dkim_milter_t to bind to unreserved UDP ports * Label all hard-links of perdition perdition_exec_t Allow perdition to read /dev/urandom and capabilities dac_override, chown, and fowner Allow perdition file trans to perdition_var_run_t for directories Also proxy the sieve service - sieve_port_t Allow connecting to mysql for map data * Allow nrpe_t to read nagios_etc_t and have capability dac_override * Allow httpd_t to write to initrc_tmp_t files Label /var/lib/php5(/.*)? as httpd_var_lib_t * Allow postfix_cleanup_t to talk to the dkim filter allow postfix_cleanup_t to use postfix_smtpd_t fds (for milters) allow postfix_smtpd_t to talk to clamd_t via unix sockets allow postfix_master_t to execute hostname for Debian startup scripts * Allow unconfined_cronjob_t role system_r and allow it to restart daemons via systemd Allow system_cronjob_t to unlink httpd_var_lib_t files (for PHP session cleanup) * Allow spamass_milter_t to search the postfix spool and sigkill itself allow spamc_t to be in system_r for when spamass_milter runs it * Allow courier_authdaemon_t to execute a shell * Label /usr/bin/maildrop as procmail_exec_t Allow procmail_t to connect to courier authdaemon for the courier maildrop, also changed courier_stream_connect_authdaemon to use courier_var_run_t for the type of the socket file Allow procmail_t to read courier config for maildrop. * Allow system_mail_t to be in role unconfined_r * Label ldconfig.real instead of ldconfig as ldconfig_exec_t * Allow apt_t to list directories of type apt_var_log_t * Allow dpkg_t to execute dpkg_tmp_t and load kernel modules for dpkg-preconfigure * Allow dpkg_script_t to create udp sockets, netlink audit sockets, manage shadow files, process setfscreate, and capabilities audit_write net_admin sys_ptrace * Label /usr/lib/xen-*/xl as xm_exec_t -- Russell Coker Fri, 06 Feb 2015 02:31:05 +1100 refpolicy (2:2.20140421-8) unstable; urgency=medium * Make all of /etc/ssl apart from /etc/ssl/private etc_t * Allow systemd_logind_t to search xdm_tmp_t:dir Allow systemd_tmpfiles_t to create xdm_tmp_t:dir Make xserver_create_xdm_tmp_socket also allow unlinking the socket Allow systemd_tmpfiles_t to create xdm_tmp_t dir Allow systemd_logind_t to search xdm_tmp_t Allow system_dbusd_t to write to systemd_logind_var_run_t:fifo_file for /run/systemd/inhibit/*.ref also added fc for /run/systemd/inhibit Allow system_dbusd_t to write to /run/systemd/inhibit/* pipes Allow user_t to talk to user_dbusd_t via unix sockets and also all dbus clients Allow systemd_tmpfiles_t to create xfs_tmp_t dirs Closes: #771482 * Allow userdomains netlink_audit_socket access for logging of X unlock * Allow $1_user_ssh_agent_t to send sigchld to xdm_t * Allow local_login_t to write to systemd sessions pipes * Allow policykit_t to read /run/systemd/machines and /run/systemd/seats/* * Allow init_status() for user domains for kdeinit * Remove most of the gpg stuff that I put in 2:2.20140421-7. Just remove gpg_helper_t, merge gpg_pinentry_t with the main gpg domain, and make the gpg_t domain only used from user_t. Domain trans from gpg_agent_t to user_t when running bin_t such as ck-launch-session. Allow gpg_agent_t and *_ssh_agent_t to append to an inherited user_home_t file Closes: #771484 * Allow user_dbusd_t to append to user_home_t * Allow load_policy_t to read /dev/urandom. * Label /usr/lib/dovecot/(log)|(ssl-params)|(anvil) dovecot_exec_t so they can be executed by the main dovecot daemon. Closes: #775223 * Allow alsa_t to create lockfiles and added fc for /run/lock/asound.state.lock * Allow local_login_t capability net_admin * Allow systemd_logind_t capability sys_admin and mount tmpfs_t * Allow mozilla_t (Chrome) to manage symlinks in /tmp and create sockets Allow chrome_sandbox_t to use user_t fd. Allow mozilla_t to use netlink_kobject_uevent_socket. Label ~/.config/google-chrome as mozilla_home_t Label /opt/google/chrome/nacl_helper as chrome_browser_exec_t Allow chrome_sandbox_t to write to users pty (for startup error messages) Closes: #771483 * Allow userdomains to read vm sysctls and to create a netlink_kobject_uevent_socket. * Allow initrc_t to perform systemd service start/stop operations on initrc_var_run_t files. This may be a bug in systemd. * Label .xsession-errors as user_home_t when xdm_t creates it. * Label /usr/sbin/dhcp6c as dhcpc_exec_t /run/dhcp6c.pid as dhcpc_var_run_t and /var/lib/dhcpv6 as dhcpc_state_t * Dontaudit getty_t capability sys_admin * Allow cronjob_t read-write access to crond_tmp_t. * Allow gconfd_t to read /var/lib/gconf/defaults and /proc/filesystems * Allow fsadm_t to stat mount_var_run_t for /run/mount/utab -- Russell Coker Mon, 19 Jan 2015 16:27:05 +1100 refpolicy (2:2.20140421-7) unstable; urgency=medium * Label /run/systemd/journal/dev-log and /run/systemd/journal/stdout as devlog_t * Allow bootloadter_t to load kernel modules and run apt-cache * Allow systemd_cgroups_t to read /proc/cmdline * Allow sshd net_admin capability * Allow systemd_logind_t to read kernel sysctls, list tmpfs, and mount on /var/auth, and systemd_unit_file_t:service stop. * Allow dpkg_script_t to restart systemd unit files of type init_var_run_t * Allow local_login_t and user_t to talk to systemd_logind via dbus * Allow user_ssh_agent_t to read/write it's own fifo files * Allow user_t to talk to gconfd_t via dbus * Allow gpg_agent_t to send sigchld to xdm_t, to be a system dbus client, to use nsswitch, and to read user xauth file * Allow $1_dbusd_t domains systemd_login_read_pid_files access * Remove gpg_helper_t, merge gpg_pinentry_t with the main gpg domain, and create user_gpg_t, staff_gpg_t, etc. * Allow userdomains to talk to kerneloops via dbus * Allow sysstat_t to search all mountpoints * Allow udev_t self:netlink_route_socket nlmsg_write for interface rename * Allow systemd_tmpfiles_t to read kernel sysctls for boot_id * Allow setfiles_t to read /dev/urandom * Label /var/run/blkid as etc_runtime_t * TLDR: Make everything work with latest systemd and allow KDE login with latest X11 configuration. -- Russell Coker Mon, 13 Oct 2014 09:41:44 +1100 refpolicy (2:2.20140421-6) unstable; urgency=medium [ Laurent Bigonville ] * debian/patches/0046-misc-not-systemd: Remove duplicate dev_associate(hugetlbfs_t) rule [ Russell Coker ] * Allow dpkg_script_t to restart all daemons under systemd * Allow ndc_t the block_suspend capability * Allow systemd_logind_t self:process signal access * allow systemd_logind_t systemd_unit_file_t:service start; * allow systemd_tmpfiles_t and systemd_cgroups_t capability net_admin * allow systemd_tmpfiles_t process getcap * storage_getattr_fixed_disk_dev(xend_t) for running lsscsi * Allow xenstored_t to search bin_t * New type systemd_journal_log_t for /var/log/journal and /var/run/log/journal * Added audit_read to capability2 class * Allow kerneloops_t, systemd_tmpfiles_t, and systemd_logind_t to read /dev/urandom * Allow all user domains to read /var/lib/dpkg * Allow udev_t to read kernel module files for systemd-udevd * Allow alsa_t to search locks * Allow systemd-tmpfilesd to setattr many device types and create /dev/xconsole * Allow unconfined_t to get statyus of systemd jobs * Add FC entry for /var/run/wd_keepalive.pid and /var/run/sm-notify.pid -- Russell Coker Sat, 13 Sep 2014 16:15:12 +1000 refpolicy (2:2.20140421-5) unstable; urgency=medium * Allow system_cronjob_t to read apt_var_lib_t and ntp_conf_t. * Allow init_t to create /dev/log and netlink_audit_socket accesss * Allow init_t to manage systemd_passwd_var_run_t links * Allow freshclam_t to talk to http_cache_port_t * Allow system_cronjob_t to talk to init socket for restarting daemons under systemd * allow init_t setsched access for (tmpfiles) from systemd * Allow dpkg_t to transition to dpkg_script_t when running dpkg_var_lib_t (postinst etc scripts) * Allow init_t netlink_selinux_socket access for commands like "halt" in strict mode * Allow initrc_t to perform service operations on init_script_file_type * Label /opt/google/chrome/cron/google-chrome bin_t * Make Chrome/Chromium run in the correct domain * Add domain systemd_cgroups_t for kernel executing /lib/systemd/systemd-cgroups-agent * Allow dpkg_script_t to read the policy * Allow systemd_passwd_agent_t to write to /dev/kmsg and log to syslogd * Allow init_t to write to watchdog_device_t for systemd shutdown * Allow initrc_t to write net_conf_t for network boot scripts * Allow init_t to create var_auth_t directories for systemd * Allow initrc_t to read postfix config on Debian * Allow initrc_t to talk to init_t via unix sockets * Allow init_t to read udev_var_run_t files for systemd to read udev output * Allow init_t to read all pidfiles, for systemd * Allow postfix_postqueue_t to send sigchld to all userdomains -- Russell Coker Thu, 03 Jul 2014 20:45:34 +1000 refpolicy (2:2.20140421-4) unstable; urgency=medium * Team upload. * debian/rules: Properly expand flavour directory during build * debian/rules: Properly remove postrm scripts in clean target * debian/postinst.policy: Remove the modules that are not built anymore from the notdefault list * debian/postinst.policy: Remove the .disabled file for the modules that are now built in the base.pp or not built anymore at all. -- Laurent Bigonville Sun, 29 Jun 2014 17:33:39 +0200 refpolicy (2:2.20140421-3) unstable; urgency=medium * Allow sysadm_t to read policy * Make systemd_login_list_pid_dirs() call init_search_pid_dirs() as it doesn't work without it * Added chromium/google-chrome policy * dev_getattr_sysfs(sysstat_t) for Debian cron job * Allow sysstat_t to manage it's log files * Allow dpkg_script_t to config all systemd services and get init status * Allow dpkg_script_t to dirmngr_admin * really added systemd_login_list_pid_dirs(system_dbusd_t) (somehow missed this last time) * Allow sshd to chat with systemd via dbus * Allow unconfined_t to restart services * systemd_write_inherited_logind_sessions_pipes(system_dbusd_t) * systemd_dbus_chat_logind(sshd_t) * Allow xend to read vm sysctls * Allow udev_t to manage xenfs_t files for xenstore-read * Allow system_dbusd_t systemd_login_read_pid_files access for /run/systemd/users/* files * Allow systemd_logind_t to stat tmpfs_t filesystems for /run/user * Remove the "genfscon selinuxfs" line from selinux.if in selinux-policy-dev to stop sepolgen-ifgen errors. * Make udev_relabelto_db() include lnk_file relabeling * Allow kernel_t to fs_search_tmpfs, selinux_compute_create_context, and kernel_read_unlabeled_state for booting without unconfined.pp * Allow system_cronjob_t to manage the apt cache * Allow modutils_read_module_config(init_t) and create cgroup_t links for strict config. Allow it to relabel from tmpfs_t symlinks * Allow init_run_all_scripts_domain (initrc_t) the service { status start stop } for all the daemon _initrc_exec_t scripts. * Allow sysadm_r to have domain system_mail_t for strict policy * Allow init_t to relabel device_t symlinks and pstore_t dirs, load kernel modules, manage init_var_run_t sock_files, read /usr, read /dev/urandom, systemd_manage_passwd_run, and domain_read_all_domains_state -- Russell Coker Sun, 29 Jun 2014 19:11:45 +1000 refpolicy (2:2.20140421-2) unstable; urgency=medium * Fix systemd support * Made init, logging, authlogin, application, userdomain, systemd, dmesg, dpkg, usermanage, libraries, fstools, miscfiles, mount, selinuxutil, storage and sysnetwork be base modules - some of this is needed for systemd, some just makes sense. * Disabled modules anaconda, authbind, kudzu, portage, rhgb, speedtouch * Allow syslogd_t to read /dev/urandom (for systemd) * Change unit files to use .*\.service * Default trans syslogd_tmp_t for name /run/log (for systemd) * Make /var/auth a mountpoint * Allow systemd_tmpfiles_t to relabelto xconsole_device_t * Allow init_t to start and stop service systemd_unit_file_t * Allow udev_t to write to init_t stream sockets for systemctl * Allow syslogd_t to read udev_var_run_t so systemd_journal can get seat data * Allow systemd_logind_t to read udev_var_run_t for seat data * Allow syslogd_t setgid and setgid for systemd_journal * Allow udev_t to read cgroup files for systemd-udevd to read it's own cgroup * Give logrotate_t the systemd_systemctl_domain access to restart daemons * Make transition from unconfined_t to insmod_t for running modutils and remove all unused modutils domains. Make unconfined_t transition to insmod_t, this makes depmod run as insmod_t. Make insmod_t write modules dep files with the correct context. * Allow udev_t to load kernel modules for systemd-udevd * Allow initrc_t to systemd_config_all_services * Allow lvm_t to talk to init_t via unix socket for systemd * Allow allow lvm_t to read sysctl_crypto_t * Allow udev_t to read modules_object_t for systemd-udevd * Allow udev_t to search /run/systemd for systemd-udevd * Allow systemd_tmpfiles_t to relabel man_cache_t * Allow initrc_t to get status of init_t for systemd * Allow udev_t to get initrc_exec_t service status for when udev runs hdparm script * Allow ifconfig_t to load kernel modules * Allow named_t to read vm sysctls * Allow tor_t capabilities chown dac_read_search dac_override fowner * Allow fetchmail_t to manage dirs of type fetchmail_uidl_cache_t * Allow mysqld_t to connect to itself on unix_stream_socket * Allow mysqld_t kernel_read_vm_sysctls for overcommit_memory * Allow sysstat_t read and write access to crond_tmp_t (for cron to capture stdout/stderr). * Allow sysstat_t to read it's own log files and read shell_exec_t * Included file context for /run/kdm.pid * Allow kerneloops_t to read /proc/filesystems * Label /var/cache/dirmngr as dirmngr_var_lib_t * systemd_login_list_pid_dirs(system_dbusd_t) -- Russell Coker Wed, 25 Jun 2014 15:38:58 +1000 refpolicy (2:2.20140421-1) unstable; urgency=medium * Team upload. * New GIT snapshot of the policy - Drop debian/patches/upstream/*.patch: Applied upstream - Label /etc/locale.alias as locale_t (Closes: #707246) - Allow xdm_t to execute gkeyringd_domains and to transition to them - Label postgresql manpages properly (Closes: #740591) - Allow setfiles_t and restorecond_t to getattr from all fs that support xattr (Closes: #740682) * Refresh debian/modules.conf.default, debian/modules.conf.mls: Start building the shibboleth module -- Laurent Bigonville Mon, 21 Apr 2014 23:37:53 +0200 refpolicy (2:2.20140311-1) unstable; urgency=medium * Team upload. * New upstream release * d/p/u/0001-Properly-label-git-shell-and-other-git-commands-for-.patch: Properly label git commands as bin_t and git-shell as shell_exec_t * d/p/u/0002-Label-usr-sbin-lightdm-as-xdm_exec_t.patch: Properly label lightdm executable as xdm_exec_t (Closes: #739163) * d/p/u/0003-Add-several-fcontext-for-debian-specific-paths-for-n.patch: Properly label ntp initscript and other ntp related files (Closes: #740656) -- Laurent Bigonville Sat, 15 Mar 2014 09:56:53 +0100 refpolicy (2:2.20140206-1) unstable; urgency=medium * Team upload. * New GIT snapshot of the policy - Allow unconfined_u user to enter system_r role again (Closes: #732857) - Allow unconfined user to transition to dpkg_t and transitively to dpkg_script_t (Closes: #707214) - Refresh 0004-init-startpar-initrc_t-gets-attributes-of-dev-dm-0-d.patch - Drop d/p/0005-add-missing-newline.patch, d/p/0006-allow-udev-write-rulesd.patch: Applied upstream * debian/selinux-policy-dev.post{inst,rm}: Call sepolgen-ifgen after selinux-policy-dev installation if SELinux is enabled * debian/selinux-policy-dev.install, debian/rules: Install headers in /usr/share/selinux/devel, there is no differences between default and mls headers, so it's not necessary to install both. * debian/rules, debian/example/Makefile, debian/Makefile.devel: Fix development Makefile to work with new headers location * debian/control: Bump Standards-Version to 3.9.5 (no further changes) -- Laurent Bigonville Thu, 06 Feb 2014 21:56:55 +0100 refpolicy (2:2.20131214-1) unstable; urgency=low * Team upload. [ Laurent Bigonville ] * New GIT snapshot of the policy - Drop all the Debian specific patches, some of the patches have been merged upstream, but the rest was making it really difficult to upgrade the policy to the new upstream versions. - Add block_suspend access vectors (Closes: #722700) - libvirt should now run when compiled with selinux support (Closes: #559356) - Allow smartd daemon to write in /var/lib/smartmontools directory (Closes: #720631) - NetworkManager should now be able to write /run/network/ifstate (Closes: #711083) - Allow dovecot self:process setsched permission (Closes: #716753) - Add denyhosts policy package (Closes: #700403) - deny_ptrace boolean is now gone (Closes: #691284) - Allow fail2ban dac_read_search and dac_override capabilities (Closes: #700326) - irqbalance has now the getsched permission (Closes: #707243) * Refresh debian/modules.conf.* for new release, build all the policy packages as modules now * Drop debian/file_contexts.subs_dist, install upstream one instead * debian/rules: policy/rolemap file is gone * debian/control: Bump {build-}dependencies to the last userspace release * debian/rules: Disable UBAC for the default policy * debian/rules: Build the default policy with UNK_PERMS=allow * debian/control: Add dependency against selinux-utils for selinuxenabled * debian/NEWS: Add some information about the proper way to permanently disable a module * d/p/0004-init-startpar-initrc_t-gets-attributes-of-dev-dm-0-d.patch: Fix FTBFS and allow startpar can getattr of some devices * Add d/p/0005-add-missing-newline.patch: Add missing newline at the end of the file, this is causing weird behaviour, thanks M4 * d/p/0006-allow-udev-write-rulesd.patch: Allow udev to write in /etc/udev/rules.d (Closes: #712970) [ Mika Pflüger ] * debian/postinst.policy: Rewrite the postinst script for the selinux-policy-* packages to automatically upgrade the running policy. (Closes: #552147) * debian/copyright: Update to machine-readable copyright format. * debian/postrm.policy: Use common postrm script for selinux-policy-* packages. -- Laurent Bigonville Sun, 15 Dec 2013 22:53:06 +0100 refpolicy (2:2.20110726-13) unstable; urgency=low * Team upload. [ Mika Pflüger ] * Allow dhcpc_t to bind to all udp ports (Closes: #707658). [ Laurent Bigonville ] * Rework the build system * Compress modules files with bzip2 * debian/control: - Bump Standards-Version to 3.9.4 (no further changes) - Drop really old Conflicts - Add a Breaks against selinux-basics (<< 0.5.2~) so we are sure it supports .bz2 compressed modules * debian/source/lintian-overrides: Add an override for maintainer-script-lacks-debhelper-token -- Laurent Bigonville Fri, 20 Sep 2013 19:18:57 +0200 refpolicy (2:2.20110726-12) unstable; urgency=low * Team upload. [ Russel Coker ] * Label ~/.adobe(/.*)? as mozilla_home_t for flash * Label /usr/sbin/opendkim as dkim_milter_exec_t * Label postalias as postfix_master_exec_t for newaliases * Make postfix.pp not depend on unconfined.pp for "strict" configurations * Label port 5546 as dhcpc_port_t and allow dhcpc_t to bind to TCP for client control * Label /usr/lib/kde4/libexec/* and /usr/lib/gvfs/* as bin_t for desktops * Label /run/pm-utils(/.*)? as devicekit_var_run_t not hald_var_run_t * Allow user roles access to mozilla_t classes shm and sem for sharing the sound device * Allow user roles access to mozilla_tmp_t * Label /sbin/xtables-multi (the new iptables) * Allow watchdog_t to read syslog pid files for process watching * Allow lvm_t (systemd-cryptsetup) systemd_manage_passwd_run() access * Allow systemd_passwd_agent_t access to search selinuxfs and write to the console for getting a password for encrypted filesystems * Label /usr/lib/dovecot/auth as dovecot_auth_exec_t. Label /usr/lib/dovecot/dovecot-lda as lda_exec_t Label /usr/lib/dovecot/libdovecot.*\.so.* as lib_t Closes: #690225 -- Mika Pflüger Fri, 30 Nov 2012 00:28:21 +0100 refpolicy (2:2.20110726-11) unstable; urgency=low * Team upload [ Mika Pflüger ] * Drop incomplete patch adding debian specific gdm3 locations and cherry-pick Laurent's complete patch from upstream instead. Slightly edit the patch to work around an issue in file context ordering. -- Laurent Bigonville Sun, 30 Sep 2012 22:43:12 +0200 refpolicy (2:2.20110726-10) unstable; urgency=low * Team upload. [ Mika Pflüger ] * xserver.fc: Add debian specific /usr/sbin/gdm3 as a location for gdm3. Closes: #683756 * debian/control: Update Vcs-* fields. [ Laurent Bigonville ] * d/p/0079-Allow-iptables_t-to-do-module_request.patch: Dropped, the code present in this patch was already present later in the code. * d/p/0048-Alsa-debian-locations.patch: Dropped, changes merged upstream, and was breaking module loading due to duplicate paths (Closes: #686670) * debian/watch: Fix watch file uversionmangle -- Laurent Bigonville Fri, 07 Sep 2012 17:51:13 +0200 refpolicy (2:2.20110726-9) unstable; urgency=high * Enable UBAC as roles aren't useful. I recommend using only roles user_r and unconfined_r and using UBAC (constraining users from sharing files between identities) where you would previously have used roles. * Made cron jobs run in regular user domains such as unconfined_t and user_t Closes: #679277 * Had the wrong timestamp on the last upload, corrected it for the record. * Allow ftpd to create sock_file objects under /var/run for proftpd * Change readahead policy to support memlockd. * Allow devicekit_power_t, devicekit_disk_t, kerneloops_t, and policykit_t to send dbus messages to users. * Grant systemd utilities access to selinuxfs so they can correctly label directories. Closes: #678392 * Assigned type consolekit_var_run_t to /var/run/console(/.*)? because it's created and managed by consolekit nowadays. * Created tunable allow_ssh_connect_reserved_ports to allow ssh client to connect to reserved ports. * Correctly label all perdition binaries, give perdition_t dac_override, and allow perdition_t to create it's own pid directories. * Label /etc/dansguardian as squid_etc_t * Allow devicekit_power_t to access acpi device and read udev tables and allow devicekit_disk_t to read udev tables. * Allow sshd_t to write to fifos inherited from systemd * High urgency because we really need to have working cron jobs!!! * Removed the postinst code to upgrade from pre-squeeze packages. -- Russell Coker Sat, 30 Jun 2012 19:19:57 +1000 refpolicy (2:2.20110726-8) unstable; urgency=high * Allow dbus domains to search cgroup dirs and init_var_run_t * Have init_t transition to devicekit_power_t and devicekit_disk_t for systemd. * Allow user domains to create netlink_kobject_uevent_socket objects * Put dansguardian in squid_t * Fixed error in portslave.te that prevented module insertion * Allow postgrey_t to exec bin_t for perl and self:netlink_route_socket access * Allow dac_override access to arpwatch_t * Add tcsd.pp (for trousers) to the policy packages * Add nut.pp for the nut-server package to the policy packages * Load irqbalance.pp if irqbalance Debian package is installed, same for kerneloops, tcsd.pp/trousers, nut.pp/nut-server, and smartmon.pp/smartmontools. * High urgency because the support for tcsd and nut really needs to be tested (and it's broken badly for those people) and portslave.pp is also badly broken in previous versions. -- Russell Coker Mon, 25 Jun 2012 16:37:45 +1000 refpolicy (2:2.20110726-7) unstable; urgency=high [Russell Coker] * Got Chromium working! * Allow user_dbusd_t to access /run/console * Got systemd working Closes: #677578 * Added policy for dirmngr. * Added support for wide-dhcpv6-client. * Remove all refpolicyerr and almost all refpolicywarn instances, removed all obsolete interfaces and fixed syntax errors. Closes: #678237 * Allow all users to run the Postfix mailq command * Lots of little changes. [Mika Pflüger] * Do not ship pyplate.pyc. Closes: #676852 -- Russell Coker Thu, 21 Jun 2012 23:15:59 +1000 refpolicy (2:2.20110726-6) unstable; urgency=low * Added deny_ptrace tunable which some modules depend on * Fixed squid and nrpe policy * Made all necessary changes to allow a KDE login Closes: #677589 * Made all necessary changes for a mail server running Postfix, Courier Maildrop, and Dovecot. Not all mail server configurations will work (MTAs tend to be complex and have lots of interactions) but getting other configurations will be easier now. -- Russell Coker Sun, 17 Jun 2012 06:18:01 +0000 refpolicy (2:2.20110726-5) unstable; urgency=high * Add systemd support - incomplete. Closes: #660577. I opened another bug for systemd not working. * Depend on the latest SE Linux libraries * Fix many problems that prevented successful boot, now should be quite functional for servers. Closes: #677579, #613977 * Fix djbdns port access. Closes: #620718 -- Russell Coker Sat, 16 Jun 2012 00:17:13 +1000 refpolicy (2:2.20110726-4) unstable; urgency=low [Russell Coker] * Build and upload based on Laurent and Mika's good work. * Hopefully will have a new version released very soon, but it's good to just upload when there have been significant changes that have no down-side. [Laurent Bigonville] * debian/control: - Bump Standards-Version to 3.9.2 * Add debian/gbp.conf file * Switch to dpkg-source 3.0 (quilt) format - Split out existing patches [Mika Pflüger] * Switch to team maintenance * Update Vcs-* fields (Closes: #660328) -- Russell Coker Sun, 10 Jun 2012 12:07:17 +1000 refpolicy (2:2.20110726-3) unstable; urgency=low * Label /run/mdadm/map . Closes: #643490 * Stop conflicting with ancient "selinux" package. Closes: #576598 -- Russell Coker Wed, 25 Jan 2012 23:52:15 +1100 refpolicy (2:2.20110726-2) unstable; urgency=low * Merged all the patches from 2:0.2.20100524-13. * Allow mozilla_t to search user_home_t for ~/.config/chromium * Allow mozilla_t to create sym links in /tmp * Use a separate default setrans.conf for mls * Allow inetd_t setrlimit access * Allow mozilla_t to create socket files in /tmp, for chromium * Remove the hack for /run etc that was introduced in 2:0.2.20100524-10 * Correctly label nrpe.cfg as nrpe_etc_t -- Russell Coker Wed, 02 Nov 2011 12:57:17 +1100 refpolicy (2:2.20110726-1) unstable; urgency=low * New upstream policy * Built for Wheezy, made it depend on all Wheezy versions. It won't work on Squeeze and can't be easily backported. * Label /dev/xconsole as xconsole_device_t * Allow syslogd_t capability sys_nice and process:{ getsched setsched } * Allow xconsole_device_t to be associated with device_t filesystems * This version is a bit rough, you can boot unstable in enforcing mode and login via ssh but I won't guarantee any more. -- Russell Coker Mon, 31 Oct 2011 21:54:20 +1100 refpolicy (2:0.2.20100524-13) unstable; urgency=low * Labeled awffull as webalizer_exec_t. * Removed nx.pp from unstable as it doesn't build with latest utils. -- Russell Coker Thu, 15 Sep 2011 11:53:02 +1000 refpolicy (2:0.2.20100524-12) unstable; urgency=low * Allow perdition to bind to sieve port, read /dev/urandom, and capabilities chown and fowner. * Allow nrpe_t to manage nagios_var_run_t files. * Change the in_unconfined_r() interface so that postfix_postqueue_t can read and write unconfined_t fifos. * Allow quota_t to load kernel modules. -- Russell Coker Tue, 30 Aug 2011 23:10:50 +1000 refpolicy (2:0.2.20100524-11) unstable; urgency=low * Allow snmpd to setuid and setgid. * Allow nagios services to connect to mysql servers via tcp and read /etc files for mysql. * Allow nagios_mail_plugin_t to read usr files. * Allow postfix_postqueue_t to use a fd from nagios_mail_plugin_t. * Allow crond_t the sys_resource capability to set resource limits for children. * Allow user_t to manage httpd_user_content_t, also allow httpd_t the same access to httpd_user_content_t sym-links as to files. * Allow gpg_agent_t to create sock_files under ~/.gnupg Allow gpg_pinentry_t to read var_lib_t files for fonts.conf * Allow perdition to authenticate with mysql, read directories of type perdition_etc_t, connect to the pop ports * Allow nagios_checkdisk_plugin_t to getattr all mountpoint dirs, so it can check the root directory of a filesystem. -- Russell Coker Fri, 19 Aug 2011 16:36:17 +1000 refpolicy (2:0.2.20100524-10) unstable; urgency=low * Label gpgsm as gpg_exec_t * Add policy for /run etc, thanks to Martin Orr for working on this, even though we can't use subst now. Closes: #629066, #628039, #626720 -- Russell Coker Sun, 24 Jul 2011 15:50:23 +1000 refpolicy (2:0.2.20100524-9) unstable; urgency=low * Make gnome.pp not be autoloaded and revert some of the gnome stuff from the previous version. Getting gnome (gconfd) policy to work correctly is too hard for Squeeze. * Allow user_t to talk to xdm_var_run_t sockets so switch user can work. * Allow mailman_mail_t to read /dev/urandom and usr_t files * Allow xenconsoled_t capability sys_tty_config and create unix_dgram_socket * Allow iodine_t to read /proc/filesystems * Allow jabber_t to write it's fifos, process set/getsched, connect to generic tcp ports, and bind to udp ports. * Label /var/lib/sudo as pam_var_run_t * Allow sshd_t to read gitosis files. * Made the gitosis label apply to /srv/gitosis. * Allow webalizer to read usr_t files for geoip database. * Allow user_t and staff_t consolekit_dbus_chat() access so they can determine their session status - necessary to login in KDE sometimes. * Label ~/.gnupg/gpg.conf as user_home_t and allow user_t to list directories of type gpg_secret_t so gpg-agent can start. * Allow gpg_agent_t to launch a user session and send sigchld to xdm_t * Allow user_ssh_agent_t to send sigchld to xdm_t and allow it to run the gpg agent. * Add new paths for chromium-browser to support the version in unstable, needed for backports. * Allow user_mail_t to transition to postfix_master_t for postalias, confined by roles. Uses domain_system_change_exemption() for user_mail_t via postfix_domtrans_master() which isn't ideal. -- Russell Coker Wed, 11 May 2011 11:58:46 +1000 refpolicy (2:0.2.20100524-8) unstable; urgency=low * Add tunable user_manage_dos_files which defaults to true * Correctly label /usr/lib/xulrunner-1.9.1/xulrunner-stub * Allow mozilla to create directories under /tmp * Use correct label for /usr/lib/libgconf2-4/gconfd-2 and load gnome.pp on installation if libgconf2-4 is installed * Use correct label for /usr/lib/upower/upowerd * Dontaudit bind_t write attempts to / for lwresd calling access(".", W_OK) * Allow user domains to execute mysqld_exec_t, for KDE * Allow user_dbusd_t to execute gconfd_exec_t in user_gconfd_t. * Label /var/lib/fetchmail as fetchmail_uidl_cache_t and allow fetchmail_t to search /var/lib and manage fetchmail_uidl_cache_t dirs * Allow xm_t to read kernel image files, needed for DomU startup on boot * Allow gpg_agent_t to read etc_t files and sysctl_crypto_t. * Allow network manager to run wpa_cli_exec_t programs. -- Russell Coker Fri, 11 Mar 2011 14:28:58 +1100 refpolicy (2:0.2.20100524-7) unstable; urgency=low * Allow crontab_t to create a directory of type crontab_tmp_t, necessary to allow crontab -e to work -- Russell Coker Thu, 13 Jan 2011 21:32:24 +1100 refpolicy (2:0.2.20100524-6) unstable; urgency=low * Allow mysqld_safe_t to send messages to syslogd * Allow mysqld_t to run shell scripts (shell_exec_t and bin_t) * Fixed a bug in the previous release that stopped MTAs from talking to the dkim-milter, the .if file had the wrong type. * Made it load ipsec.pp if ipsec-tools or racoon is installed * Include policy for the iodine IP over DNS tunnel daemon * Allow saslauthd_t to talk to mysqld via TCP * Allow freshclam_t to read proc_t files * Allow postfix_local_t to write to mail_spool_t files for locking * Allow system_mail_t (sendmail) to get read/write access to crond_tmp_t -- Russell Coker Thu, 13 Jan 2011 12:41:00 +1100 refpolicy (2:0.2.20100524-5) unstable; urgency=low * Label /usr/bin/tcsh as shell_exec_t * Domain trans from unconfined_t to depmod_t * Don't include /usr/lib/dovecot/deliver in dovecot.fc/te as it's in lda.pp * Don't include /usr/sbin/spamass-milter and /var/spool/postfix/spamass in spamassassin.fc as they are in milter.fc * Label /var/run/spamass as spamass_milter_data_t * Allow lvm_t rw access to unconfined_t semaphores. * Added in_unconfined_r() interface and made postfix user domains use it so they can be in the role unconfined_r. Ugly but no better solution at this time Closes: #592038 #599053 * Include Chromium policy in mozilla.pp * Allow sshd getcap and setcap access * Correctly label ~/.xsession-errors * Allow spamc_t to be in system_r and allow it access to netlink_route_socket * Allow lda_t to talk to the Courier Authdaemon - for courier maildrop * Allow fetchmail_t to read usr_t for certificates and to create /tmp files * Allow cron jobs to write to crond_tmp_t * Label courier socket files as courier_var_run_t * Run /usr/sbin/authdaemond as courier_authdaemon_t * Allow dkim_milter_t to read proc_t files and create /tmp files * Allow dovecot domains to search dovecot_etc_t dirs * Allow dovecot_auth_t to talk to mysqld via TCP and read /etc/mysql/my.cnf * Label /etc/network/run as etc_t * Label X as spamass_milter_var_run_t * Remove unconfined_exec_t label from /usr/bin/qemu Closes: #601686 * Label /usr/lib/apache2/mpm-*/apache2 as httpd_exec_t Closes: #608291 * Allow nagios.pp to be installed without apache.pp Closes: #587596 * Removed amavis.pp because it doesn't work and it's functionality is covered by clamav.pp Closes: #559860 * Allow mono_t to be in role unconfined_r Closes: #540143 -- Russell Coker Sat, 08 Jan 2011 14:13:43 +1100 refpolicy (2:0.2.20100524-4) unstable; urgency=low * Label /dev/vd* as fixed_disk_device_t, closes: #589997 * Remove mcskillall and mcsptraceall from unconfined_t, the sysadmin should have unconfined_t:SystemLow-SystemHigh. -- Russell Coker Mon, 26 Jul 2010 11:18:00 +1000 refpolicy (2:0.2.20100524-3) unstable; urgency=low * Give freshclam_t and clamd_t the same access WRT execmem. * Install lvm.pp when dmsetup is installed. * Add label for /usr/lib/udisks/udisks-daemon . * Made devicekit.pp and ricci.pp not depend on consoletype.pp and don't build consoletype. * label /usr/lib/udisks/.* as bin_t * label /etc/kde4 the same way as /etc/kde3. * Escape the . in /etc/init.d/mount... * Allow insmod_t the capability sys_admin. * Label all of /etc/network/run/* as etc_runtime_t and allow udev_t to manage such files. * Label /etc/network/if-(up|down).d/postfix as initrc_exec_t so that udev can reload Postfix and push the queue. * Label /usr/lib/ConsoleKit(/.*)? as bin_t to avoid an error message on graphical login. * On initial install load module policykit.pp when policykit-1 is installed. * label /lib/init/rw(/.*)? as var_run_t. * label /var/run/xauth as xdm_var_run_t. * label /var/run/motd as initrc_var_run_t. -- Russell Coker Sat, 25 Jul 2010 09:39:00 +1000 refpolicy (2:0.2.20100524-2) unstable; urgency=low * Include tmpreaper in base policy as mountnfs-bootclean.sh and mountall-bootclean.sh need to run as tmpreaper_t. * Added a new mcsdeleteall attribute for tmpreaper_t so that it can delete files and directories regardless of mcs level. * Allow perdition netlink_route_socket access. * Allow nrpe_t to execute sudo and search /var/spool also don't audit capability sys_resource. * Allow postfix_local_t to run sendmail for programs like vacation * Make the milter module be loaded if the milter-greylist or spamass-milter package is installed. Make spamassassin policy optional when using the milter module. * Added a bunch of fixes from git mostly trivial stuff but also allowed bootloader_t to load modules, allowed kismet_t to search home directories, * Don't allow cron daemon to search /var/lib/logrotate. * Fixed a typo in gitosis.if * Commented out the genfscon line in selinux.if for the includes directory, now sepolgen-ifgen works without error. -- Russell Coker Fri, 9 Jul 2010 09:47:00 +1000 refpolicy (2:0.2.20100524-1) unstable; urgency=low * New Upstream release. This version has had a good deal of testing for server use but almost no testing for desktop use. The usual "Unstable" disclaimers apply. * Disable UBAC - see http://etbe.coker.com.au/2010/05/26/ubac-selinux-debian/ * Allow mount_t to read sysfs_t. * Allow lvm_t to create semaphores. * Allow mount_t and setfiles_t to read/write device_t chr_file. * Allow udev to read sym-links in it's config directory. * Allow vbetool_t to read inotify directories. * Allow gpm_t self signull and signal access. -- Russell Coker Tue, 29 Jun 2010 10:42:00 +1000 refpolicy (2:0.2.20091117-3) unstable; urgency=low * label Google Chrome as unconfined_execmem_exec_t * Change the apache_content_template() macro to not define the type httpd_$1_script_exec_t, now the caller must unconditionally define it and can therefore use it in it's .fc file without making a .fc dependency. * Allow setrans_t to read proc_t files. * Allow pppd to load modules. * Allow watchdog_t to read/write /dev/watchdog * Allow rpcd_t getcap and setcap access. * Allow insmod_t to mount a rpc_pipefs_t filesystem. * Correctly label kdm.log.* pm-*log* aptitude* * Allow consolekit_t to access pam console data. * Correctly label consolekit scripts * Allow mount_t to set the scheduling for kernel threads. -- Russell Coker Tue, 18 May 2010 19:06:24 +1000 refpolicy (2:0.2.20091117-2) unstable; urgency=low * Label /etc/gdm/Xsession, /etc/gdm/PostSession/* and /etc/gdm/PreSession/* as xsession_exec_t. * Label /usr/lib/dbus-1.0/dbus-daemon-launch-helper as dbusd_exec_t. * Allow syslogd_t to read/write access to xconsole_device_t. * Allow system_dbusd_t list access to inotifyfs. * Allow udev to manage symlinks under /dev * Treat devtmpfs the same way as tmpfs. * Changed upstream to http://oss.tresys.com/projects/refpolicy/wiki/DownloadRelease * Allow iptables_t, insmod_t and mount_t to do module_request * Use lib32 instead of lib64 Closes: #569297 * Make manage_lnk_file_perms allow write access for setting the timestamp. * Use filesystem transitions for hugetlbfs_t. * Label xenfs_t and allow xend etc to use it. * Use lda_t for mail local delivery * Allow udev to manage xenfs_t files, to write to etc_runtime_t (for ifstate), and to load modules. * Allow ifconfig to load modules. * Made auth_domtrans_chk_passwd() specify dontaudit for shadow_t file open. -- Russell Coker Mon, 22 Feb 2010 07:58:07 +1100 refpolicy (2:0.2.20091117-1) unstable; urgency=low * New upstream release. -- Manoj Srivastava Thu, 19 Nov 2009 23:08:14 -0600 refpolicy (2:0.2.20091013-1) unstable; urgency=low * New upstream VCS snapshot * Added modules: hddtemp, shorewall, kdump, gnomeclock, nslcd, rtkit, seunshare (Dan Walsh); dkim (Stefan Schulze Frielinghaus); gitosis (Miroslav Grepl); xscreensaver (Corentin Labbe) * [dd26539]: [topic--urand-fix]: Fix issues related to /dev/{urandom,console} + Allow: load_policy_t, audisp_t, auditd_t, restorecond_t, portmap_t, hwclock_t, auditctl_t, hostname_t, portmap_helper_t, ndc_t, mount_t, dmidecode_t, getty_t, and setfiles_t to read /dev/urandom + Allow: portmap_helper_t, insmod_t, ifconfig_t, setfiles_t and portmap_t to read /dev/console + Allow udev_t to access anon_inodefs_t These changes take care of most of the problems encountered in recent reference policy packages in Debian. Thanks to Russell Coker for the fixes. -- Manoj Srivastava Tue, 13 Oct 2009 15:29:54 -0500 refpolicy (2:0.2.20090828-1) unstable; urgency=low * New upstream snapshot. - Deprecated the userdom_xwindwos_client_template(). * Modified the list of modules we build (added consolekit, and added a dependency on consolekit to the devicekit policymodule. Turned off ddcprobe, since it needs kudzu. * Bug fix: "linking policy fails", thanks to Jonathan Nieder (Closes: #544079). * Bug fix: "linking policy fails (with a statement to file a bug)", thanks to Philipp Kern (Closes: #543148). * Bug fix: "module cvs appears to depend on module apache", thanks to Russell Coker (Closes: #539855). * Bug fix: "SELinux prevented console-kit-dae from using the terminal /dev/tty0", thanks to Ritesh Raj Sarraf. We now have: policy/modules/services/consolekit.te:term_use_all_terms(consolekit_t) This should allow access to all terms and ttys. (Closes: #515167). * Bug fix: "SELinux is preventing pulseaudio from loading /usr/lib/libFLAC.so.8.2.0 which requires text relocation", thanks to Ritesh Raj Sarraf. /usr/lib/libFLAC\.so.* now has the context system_u:object_r:textrel_shlib_t, so this should now work. (Closes: #515166). * [1ba2425]: nscd cache location changed from /var/db/nscd to /var/cache/nscd. The nscd policy module uses the old nscd cache location. The cache location changed with glibc 2.7-1, and the current nscd does place the files in /var/cache/nscd/. Bug fix: "nscd cache location changed from /var/db/nscd to /var/cache/nscd", thanks to Sami Haahtinen (Closes: #506779). -- Manoj Srivastava Fri, 28 Aug 2009 15:10:50 -0500 refpolicy (2:0.2.20090818-1) unstable; urgency=low * New upstream snapshot, with a number of improvements. - Misc Gentoo fixes from Corentin Labbe. - Debian policykit fixes from Martin Orr. - Fix unconfined_r use of unconfined_java_t. - Add missing x_device rules for XI2 functions, from Eamon Walsh. - Add missing rules to make unconfined_cronjob_t a valid cron job domain. - Add btrfs and ext4 to labeling targets. - Fix infrastructure to expand macros in initrc_context when installing. - Handle unix_chkpwd usage by useradd and groupadd. - Add missing compatibility aliases for xdm_xserver*_t types. -- Manoj Srivastava Wed, 26 Aug 2009 16:31:37 -0500 refpolicy (2:0.2.20090730-2.1) unstable; urgency=low * Build policykit policy and default to loading it when the policykit package is installed. * Default to loading the consolekit module when the consolekit package is installed. -- Russell Coker Wed, 26 Aug 2009 18:55:23 +1000 refpolicy (2:0.2.20090730-2) unstable; urgency=low * Bug fix: "selinux policy violation "Unknown" fo rs2ram (hald_t)", thanks to Ritesh Raj Sarraf. This has been fixed for a while, but I only just tested it. (Closes: #515566). * Re-enable building in parallel. The current statge should be friendlier to jobserver mode, disabling which causewd all the issues with the previous state. -- Manoj Srivastava Sat, 22 Aug 2009 19:47:20 -0500 refpolicy (2:0.2.20090730-1) unstable; urgency=low * New upstream release. * Updated the location of dovecot's configuration files. * Bug fix: "dovecot's etc files are in unexpected location", thanks to Frank Engler (Closes: #517712). * Fixed rules to note that parallel=N fails. * Bug fix: "FTBFS: tmp/rolemap.conf":2194:ERROR 'syntax error' at token 'genfscon' on line 704548:", thanks to Lucas Nussbaum (Closes: #536899). * Bug fix: "dpkg-buildpackage -j2 fails on AMD64", thanks to Russell Coker (Closes: #538789). -- Manoj Srivastava Sun, 09 Aug 2009 15:03:37 -0500 refpolicy (2:0.0.20090629-1) unstable; urgency=low * New upstream snapshot. * [82f63f3]: Removed the lda policy package. There were a number of reasons for doing so: this package was created in order to deal with local mail delivery in Debian, and has not been adopted upstream. I would like to remove the divergence from upstream policy, and not maintian it. so that was incentive. Also, upstream policy for mail-related packages has been improved in the meanwhile, and the lda package was conflicting with some of the changes, so that was added reason for it to go. -- Manoj Srivastava Mon, 29 Jun 2009 02:14:30 -0500 refpolicy (2:0.0.20090621-1) unstable; urgency=low * New upstream snapshot. - Greylist milter from Paul Howarth. - Crack db access for su to handle password expiration, from Brandon Whalen. - Misc fixes for unix_update from Brandon Whalen. - Add x_device permissions for XI2 functions, from Eamon Walsh. - MLS constraints for the x_selection class, from Eamon Walsh. - Postgresql updates from KaiGai Kohei. - Milter state directory patch from Paul Howarth. - Add MLS constrains for ingress/egress and secmark from Paul Moore. - Drop write permission from fs_read_rpc_sockets(). - Remove unused udev_runtime_t type. - Patch for RadSec port from Glen Turner. - Enable network_peer_controls policy capability from Paul Moore. - Btrfs xattr support from Paul Moore. - Add db_procedure install permission from KaiGai Kohei. - Add support for network interfaces with access controlled by a Boolean from the CLIP project. - Several fixes from the CLIP project. - Add support for labeled Booleans. - Remove node definitions and change node usage to generic nodes. - Add kernel_service access vectors, from Stephen Smalley. - Added modules: certmaster (Dan Walsh) git (Dan Walsh) gpsd (Miroslav Grepl) guest (Dan Walsh) ifplugd (Dan Walsh) lircd (Miroslav Grepl) logadm (Dan Walsh) pingd (Dan Walsh) psad (Dan Walsh) portreserve (Dan Walsh) ulogd (Dan Walsh) webadm (Dan Walsh) xguest (Dan Walsh) zosremote (Dan Walsh) - Fix consistency of audioentropy and iscsi module naming. - Debian file context fix for xen from Russell Coker. - Xserver MLS fix from Eamon Walsh. - Add omapi port for dhcpcd. - Deprecate per-role templates and rolemap support. - Implement user-based access control for use as role separations. - Move shared library calls from individual modules to the domain module. - Enable open permission checks policy capability. - Remove hierarchy from portage module as it is not a good example of hieararchy. - Remove enableaudit target from modular build as semodule -DB supplants it. - Added modules: milter (Paul Howarth) * Sync'd with Russell Coker -- Manoj Srivastava Mon, 22 Jun 2009 02:42:42 -0500 refpolicy (2:0.0.20081014-1) unstable; urgency=low * New upstream release - Fix httpd_enable_homedirs to actually provide the access it is supposed to provide. - Add unused interface/template parameter metadata in XML. - Patch to handle postfix data_directory from Vaclav Ovsik. - SE-Postgresql policy from KaiGai Kohei. - Patch for X.org dbus support from Martin Orr. - Patch for labeled networking controls in 2.6.25 from Paul Moore. - Module loading now requires setsched on kernel threads. - Patch to allow gpg agent --write-env-file option from Vaclav Ovsik. - X application data class from Eamon Walsh and Ted Toth. - Move user roles into individual modules. - Make hald_log_t a log file. - Cryptsetup runs shell scripts. Patch from Martin Orr. - Add file for enabling policy capabilities. - Patch to fix leaky interface/template call depth calculator from Vaclav Ovsik. - Added modules: kerneloops (Dan Walsh) kismet (Dan Walsh) podsleuth (Dan Walsh) prelude (Dan Walsh) qemu (Dan Walsh) virt (Dan Walsh) * Updated the link to the shared copyright file. -- Manoj Srivastava Sat, 14 Feb 2009 15:42:48 -0600 refpolicy (2:0.0.20080702-16) unstable; urgency=low * Allow system_dbusd_t to read /proc/X/cmdline so it knows the client name * Label /usr/lib/gnome-vfs-2.0/gnome-vfs-daemon as bin_t * Allow $1_gpg_t to read inotifyfs_t directories * Allow user_t signull access to xdm_t for gdmflexiserver * Fix the path for deliver in lda.fc * Load lda.pp when dovecot-common is installed and dovecot.pp when other dovecot packages are installed. Allow lda_t to use dovecot auth socket * Allow dovecot_auth_t to create sockets labeled as dovecot_var_run_t, also allow chown capability to apply correct ownership * Label /usr/sbin/nrpe and allow it to search nagios_etc_t:dir, read etc_t files, do setgid() and setuid(), create a pidfile, bind to port 5666, stat filesystems, get a list of processes, and check mysql and postgresql databases. * Make mail_spool_t a filesystem_type. * Allow snmpd_t capabilities setuid and chown * Allow xdm_xserver_t to send dbus messages to unconfined_t * Allow postfix_cleanup_t shutdown access to a postfix_smtpd_t unix_stream_socket * Allow clamd_t access to inherit it's own fds. * Enable the watchdog policy in the build. * Grant capability ipc_lock to dpkg_t -- Russell Coker Wed, 13 May 2009 09:13:38 +1000 refpolicy (2:0.0.20080702-15) unstable; urgency=low * Gave every domain that has process:setcap access also have process:getcap. * Set the type of /etc/network/run/ifstate to etc_runtime_t and allow udev_t to write to it. * allow apt_t to manage directories of type apt_var_log_t * allow initrc_t postfix_etc_t:file ioctl; * allow postfix_showq_t to be used from user roles. * allow postfix_virtual_t to connect to postfix_private_t sockets * allow postfix_pipe_t to execute bin_t * allow initrc_t udev_tbl_t:file unlink and device_t:dir rmdir * allow the Courier POP server fill rw_file_perms access to courier_var_lib_t. * allow jabberd_t to connect to jabber_interserver_port_t. * allow fcrond to do all the funky things it desires. * allow cupsd_t to read/write generic USB devices. * allow webalizer to read /usr files (for GeoIP). * Enable dovecot_t for daemon_access_unconfined_home * dontaudit logrotate stating terminal devices. * allow dpkg_t to set rlimit * Label /var/lib/squirrelmail/data(/.*)? as httpd_squirrelmail_t. * allow apmd_t to talk to hald_t via dbus. * allow dovecot to connect to Mysql and PostgreSQL * label most /usr/lib/dovecot/* files as bin_t * Added new "lda" module for email local delivery agents such as maildrop and procmail and don't build procmail.pp any more. * Label /var/run/xauth/* as xdm_var_run_t. * Label /var/run/openvpn.client* as openvpn_var_run_t. * Make /var/log/?dm.log.* files get the type xserver_log_t * Make /var/log/aptitude* files get the type apt_var_log_t * Make /var/run/gdm_socket get the type xdm_var_run_t * Labelled the entrypoint scripts under /etc/gdm as xsession_exec_t * Fixed Debian labelling for atspool * allow openvpn_t to access var_lib_t and usr_t files for vulnkey. * allow user domains to access the xdm socket of type xdm_var_run_t for switch user. * allow unconfined_t to transition to system_dbusd_t. Closes: #498965 -- Russell Coker Wed, 04 Mar 2009 23:10:14 +1100 refpolicy (2:0.0.20080702-14.1) unstable; urgency=low * Fix FTBS problems when building in parallel, by moving to the new, make -j friendly targets in debian/rules. These rules have been tested in several packages, and have been tested often with "fakeroot make -j4 -f ./debian/rules binary". * Updated the VCS-* variables in control to point to the git repo. -- Manoj Srivastava Wed, 07 Jan 2009 11:58:44 -0600 refpolicy (2:0.0.20080702-14) unstable; urgency=high * Allow noatsecure for Xen domains so that LD_PRELOAD will work across a domain transition. Also dontaudit searching of the sysadm home dir and allow xend_t to manage xenstored_var_run_t. Allow losetup (fsadm_t) and udev access to Xen image files * Add support for Exim. * Add support for Jabber, including adding the epmd_t domain for the Erlang Port Mapper Daemon (used by ejabberd). Label port 5280 as being for Jabber (the ejabberd web administration service) and port 7777 (SOCKS5 Bytestreams (XEP-0065) for proxy file transfer). * Allow cron to search httpd_sys_content_t * Dontaudit logrotate search access to unconfined_home_dir_t. * Fixed labelling of /var/lock/mailman * Allow courier_pop_t to read /dev/urandom and to do ioctl on it's fifos. Also allow it to talk to portmap so the IMAP server can do FAM. -- Russell Coker Mon, 27 Oct 2008 23:01:33 +1100 refpolicy (2:0.0.20080702-13) unstable; urgency=high * Allow spamd_t to create a Unix domain socket. * Allow clamd_t to read files under /usr (for Perl). Allow it to connect to amavisd_send_port_t. Allow it to talk to itself by unix stream sockets and bind to UDP nodes. Closes: #502274 * Allow logrotate_t to transition to webalizer_t for web log processing. * Allow initrc_t to create fixed_disk_device_t nodes under var_run_t, for the case where /etc/fstab has an error regarding the root fs. * Use the Lenny paths for xm, xend, xenstored, and xenconsoled. Add some extra permissions that Xen needs. -- Russell Coker Tue, 21 Oct 2008 00:36:00 +1100 refpolicy (2:0.0.20080702-12) unstable; urgency=low * Allow procmail to deliver mail to the unconfined home directories if daemon_access_unconfined_home is set. * Add the audioentropy module for use with the randomsound package. * Allow spamd_t the kill capability. * Make the default range for MCS __default__ users be s0-s0:c0.c1023, this fixes a problem with restarting daemons after logging in as non-root and running "su -". -- Russell Coker Tue, 07 Oct 2008 13:17:01 +1100 refpolicy (2:0.0.20080702-11) unstable; urgency=high * Create new interface crond_search_dir() and use it to allow crond_t to search clamd_var_lib_t for amavis cron jobs. * Allow postfix_cleanup_t to talk to dkim for signing local messages. * Allow freshclam_t to read the routing table and talk to http_cache_port_t. * Allow clamd_t to search bin_t and read bin_t links. * Allow clamd_t to search postfix_spool_t for creation of Unix domain socket in the sub-directory, this is ugly and a little bit wrong but makes it easier to configure Postfix. * Allow semanage_t (for setsebool and semodule) to call statfs(). * Add Asterisk policy module, and grant setcap access. * Copy the Fedora 10 cron changes to reduce the policy size. Allow user_t to send sigchld to user_crontab_t and to write to user_crontab_tmp_t files. Necessary for full functionality! -- Russell Coker Sat, 27 Sep 2008 18:52:00 +1000 refpolicy (2:0.0.20080702-10) unstable; urgency=low * Allow mailserver local delivery agent to manage_file_perm access to mail_spool_t Closes: #499218 * Build a module for xen, and make lvm support optional in it. * Make the postinst link the xen, lvm, and pcmcia modules if appropriate. * Added the clamav module to the policy. * Wrote a new DKIM module. * Allowed crontab to create directories under /tmp. * Made unconfined_crond_t an alias for unconfined_t and made unconfined cron jobs work. * Built the NAGIOS module and include the suggested change from #493979. NB I won't have time to do any testing of this so someone else will need to deploy it on a fully functional NAGIOS system. Closes: #493979 -- Russell Coker Fri, 19 Sep 2008 22:25:00 +1000 refpolicy (2:0.0.20080702-9) unstable; urgency=low * Allow the Postfix newaliases to create new /etc/aliases.db file so that the postinst for Postfix can work. * The last update broke unconfined_mail_t for systems not running postfix, fixing that (thanks Martin Orr). Closes: #499064 * Fix a check for syslogd being executable by logrotate (thanks Václav Ovsk). Closes: #496809 -- Russell Coker Tue, 16 Sep 2008 20:42:00 +1000 refpolicy (2:0.0.20080702-8) unstable; urgency=low * Made the postinst faster on machines with small amounts of memory. 5% improvement on AMD64 with 64M of RAM. Not sure how much benefit it might give for a NSLUG. * Allowed dictd to create pid file. * Allowed mcstransd to getcap. * Revert part of the change from 2:0.0.20080702-7, we don't want /etc/init.d scripts running as run_init_t. Closes: #498965 * Makes Postfix work correctly. Closes: #473043 * Allow $1_mail_t to read proc_t:file (for Postfix). -- Russell Coker Fri, 12 Sep 2008 10:51:01 +1000 refpolicy (2:0.0.20080702-7) unstable; urgency=low * Polish updates, added labelling for /lib/udev/create_static_nodes, /var/log/prelink.log, and corrected labelling for /var/run/kdm * Made Postfix work with unconfined_t. * Made spamass-milter run in the spamd_t domain, and allow postfix_smtpd_t to talk to it. * Labelled /var/cache/sqwebmail and allowed courier_sqwebmail_t to access it. Also allowed courier_sqwebmail_t to access /dev/urandom. * Allowed courier-pop and apache to access unconfined home directories. * Changed the policy for /var/cache/ldconfig to match upstream. * Allowed unconfined_t to run run_init. -- Russell Coker Wed, 10 Sep 2008 11:10:00 +1000 refpolicy (2:0.0.20080702-6) unstable; urgency=low * Made it build-depend on policycoreutils 2.0.49 and checkpolicy 2.0.16. Closes: #494234 * Made xserver.pp be loaded whenevedr xbase-clients is installed so that /tmp/.ICE-unix gets the right context. * Policy updates, allowed rsyslogd to work correctly Allow gpg to read/write user files under /tmp Set the context of /var/run/portmap_mapping and /var/cache/ldconfig Allow users to read symlinks under /var/lib (for python) Make udev_t transition when running initrc_exec_t. Changed the type of /var/init/rw to var_run_t Changed r_dir_perms to list_dir_perms and r_file_perms to read_file_perms to avoid warnings. Changed read_file_perms to read_lnk_file_perms for lnk_file class. Set the contexts for /var/run/hotkey-setup, /var/run/motd, /var/run/kdm/*, and /var/lib/gdm/* Dontaudit logrotate_t trying to write initrc_var_run_t. -- Russell Coker Wed, 13 Aug 2008 08:20:08 +1000 refpolicy (2:0.0.20080702-5) unstable; urgency=low * Allow unconfined_r to transition to system_r. -- Russell Coker Tue, 29 Jul 2008 18:02:33 +1000 refpolicy (2:0.0.20080702-4) unstable; urgency=low * Policy updates. * Depend on libsepol1 version 2.0.30-2. -- Russell Coker Tue, 29 Jul 2008 15:16:46 +1000 refpolicy (2:0.0.20080702-3) unstable; urgency=low * More policy fixes. * Made it build-depend and depend on libsepol1 (>=2.0.30-2) Closes: #492318 * Made it automatically change the SELINUXTYPE if the old value is obsolete and the policy was linked successfully. -- Russell Coker Sat, 26 Jul 2008 10:01:00 +1000 refpolicy (2:0.0.20080702-2) unstable; urgency=low * Made the mls package extra and made some other packages optional. Closes: #490760 * Merged some patches from older policy packages. -- Russell Coker Sun, 20 Jul 2008 16:48:19 +1000 refpolicy (2:0.0.20080702-1) unstable; urgency=low * Update to latest upstream and take over the package as Manoj seems busy on other things. * Change the policy package names to selinux-policy-default and selinux-policy-mls. Made selinux-policy-default do strict and targeted (targeted by default). * Optimise module loading to halve postinst time. * Depend on the latest policycoreutils (which sets the right default in /etc/selinux/config). -- Russell Coker Sun, 13 Jul 2008 12:49:00 +1000 refpolicy (0.0.20080314-1) unstable; urgency=low * New upstream SVN HEAD - Add wireshark module based on ethereal module. - Revise upstart support in init module to use a tunable, as upstart is now used in Fedora too. - Add iferror.m4 rather generate it out of the Makefiles. - Definitions for open permisson on file and similar objects from Eric Paris. - Apt updates for ptys and logs, from Martin Orr. - RPC update from Vaclav Ovsik. - Exim updates on Debian from Devin Carrawy. - Pam and samba updates from Stefan Schulze Frielinghaus. - Backup update on Debian from Vaclav Ovsik. - Cracklib update on Debian from Vaclav Ovsik. - Label /proc/kallsyms with system_map_t. - 64-bit capabilities from Stephen Smalley. - Labeled networking peer object class updates. * refpolicy includes an Exim policy, but did not install it on a fresh refpolicy installation, because the module package is exim.pp, while Debian calls its exim package 'exim4'. Thanks to Devin Carraway for the heavy lifting. Closes: #465208 * Bug fix: "selinux-policy-refpolicy-dev: Installed build.conf specifies MCS build type", thanks to Devin Carraway. Closes: #465215 * Bug fix: "newer policycoreutils required", thanks to Max Kellermann Closes: #469123 * The latest set of packages also seem to resolve the consolekit issues. Bug fix: "consolekit gives error messages when running with SELinux enabled", thanks to Ritesh Raj Sarraf. Closes: #463995 * Bug fix: "selinux-policy-refpolicy-targeted: descriptions seems to misplace '.' to split paragraphs (debian/control)", thanks to Felipe Augusto van de Wiel (faw). Closes: #466638,#466978 -- Manoj Srivastava Wed, 19 Mar 2008 18:27:23 -0500 refpolicy (0.0.20071214-1) unstable; urgency=low * New upstream release. This has updated policy for ssh, which Closes: #433972 * The new policy also permits postfix to read files on anon_inodefs file systems, which then Closes: #435497 * Allow use of wildcards when trying to map package names to policy modules. Thanks to Vaclav Ovsik for the heavy lifting. Closes: #427906 * Debian puts hpssd.py in /usr/lib -- not /usr/share. Thanks to Frodo Looijaard. Closes: #443177 * Alsa needs changes in file context as well. Thanks to Martin Orr for pointing this out. Closes: #428464 * Allow apache to read munin files. Thanks to Vesa-Pekka Palmu for pointing this out. Closes: #433886 * Fix targeted policies priority in control file. Thanks to Stas Myasnikov for pointing this out. Closes: #447253 * Several files in /usr/lib/cups/backend are hard links to files in /usr/lib/cups/backend-available. In the cups.fc, only the files in backend are tagged with the cupsd_exec_t, so the files in backend-available are tagged with lib_t. This results in somewhat undefined behaviour: depending on the order of directory traversal the files are tagged with either lib_t or cupsd_exec_t. Thanks to Frodo Looijaard. Closes: #442898 * selinux-policy-refpolicy-dev now also depends on make and m4, since those are required to actually build policy. Thanks to Erik Johansson. Closes: #449203 * Similarly, the source package recommends make and gcc, since those are needed to build policy. Closes: #436211 * The bug mentioned in 437139 does not exist in the new policy. A versioned close will allow the bug to remain open for Etch. Closes: #437139 * The duplicate declaration of system_chkpwd_t does not appear to be in the sources, based in a find/grep. Closes: #463818 * There was a spurious + sign in policy/modules/kernel/devices.if. Thanks to Frans Pop for pointing this out. Closes: #438887 -- Manoj Srivastava Sat, 09 Feb 2008 20:28:43 -0600 refpolicy (0.0.20070507-5) unstable; urgency=low * Allow users to read the dpkg database. With this change, every user of the strict policy now has access to dpkg-checkbuildeps, grep-dctrl, etc, which was not the case previously. * Change the example localStrict.te policy file to silently ignore apt searching for something in /var/lib. With this example policy loaded in my strict policy UML virtual machine, I can compile packages in enforcing mode. Based on advice on the mailing list, allow more things to access /selinux * Merge in changes from Russell Coker. These include a better fix for /lib.init/rw. -- Manoj Srivastava Fri, 18 May 2007 00:34:07 -0500 refpolicy (0.0.20070507-4) unstable; urgency=low * Allow apt to run update by giving r_netlink_socket_perms to self:netlink_route_socket. * Allow apt/aptitude to update, and install files - Added an interface to apt.if allow silently ignoring processes that attempt to use file descriptors from apt. - Bump the apt policy module version number, since we have added to the interface. - Added some stuff to dpkg.te to allow debconf .config file interactions back to the user - Add an optional dontaudit rule to libraries.te to allow apt-get/aptitude to install packages silently. * Very early in boot, /lib/init/rw is created as a mandatory tmpfs for state information. Label that directory as initrc_tmp_t to allow mount.te to be permitted to mount a tmpfs there. * In init.te, allow /etc/network/if-up.d/mountnfs to create /var/run/network/mountnfs as a poor mans lock. -- Manoj Srivastava Fri, 11 May 2007 00:55:07 -0500 refpolicy (0.0.20070507-3) unstable; urgency=low * Add hostfs as a recognized remote file-system. This should allow a UML virtual machine to function in a fully enforcing mode. -- Manoj Srivastava Wed, 9 May 2007 15:48:26 -0500 refpolicy (0.0.20070507-2) unstable; urgency=medium * Keep track of modules that are really built into the base policy in Debian. We then use this list to remove the modules .pp files from the policy shipped, since they can not be installed along with the base policy anyway. Make sure we don't add such modules hen considering module dependencies either. * Added Module ricci to modules.conf for both strict and targeted. -- Manoj Srivastava Mon, 7 May 2007 09:07:36 -0500 refpolicy (0.0.20070507-1) unstable; urgency=low * New upstream SVN HEAD. - Miscellaneous consolekit fixes from Dan Walsh. - Patch to have avahi use the nsswitch interface rather than individual permissions from Dan Walsh. - Patch to dontaudit logrotate searching avahi pid directory from Dan Walsh. - Patch to allow insmod to mount kvmfs and dontaudit rw unconfined_t pipes to handle usage from userhelper from Dan Walsh. - Patch to allow amavis to read spamassassin libraries from Dan Walsh. - Patch to allow slocate to getattr other filesystems and directories on those filesystems from Dan Walsh. - Fixes for RHEL4 from the CLIP project. - Replace the old lrrd fc entries with munin ones. - Move program admin template usage out of userdom_admin_user_template() to sysadm policy in userdomain.te to fix usage of the template for third parties. - Fix clockspeed_run_cli() declaration, it was incorrectly defined as a template instead of an interface. - Added modules: rwho (Nalin Dahyabhai) * Updated dependencies, since this refpolicy needs newer toolchain, -- Manoj Srivastava Mon, 7 May 2007 01:47:44 -0500 refpolicy (0.0.20070417-1) unstable; urgency=low * New upstream release. * Added XS-VCS-Arch and XS-VCS-Browse to debian/control, and updated build dependencies. * Bug fix: "selinux-policy-refpolicy-targeted: need file_contexts for gcj-dbtool-4.1 and /var/log/account", thanks to Russell Coker (Closes: #416910). -- Manoj Srivastava Thu, 19 Apr 2007 02:28:29 -0500 refpolicy (0.0.20061018-5) unstable; urgency=high * Add policy for log and lock files for aptitude. This is needed for proper function; so one does not need to go into permissive mode to run aptitude. Stolen from Erich. This is a low risk change. * Debian puts grub in /usr/sbin/grub. Reflect that in the initial file context. * Debian creates /dev/xconsole independently of whether or not a xserver has been installed or not. So move the policy related to /dev/sconsole out of the xserver policy, and into places where relevant (init.te, logging.fc), to reflect the status that /dev/console is present anyway. * Add support for /etc/network/run and /dev/shm/network, which seem to be Debian specific as well. * Allow udev to manage configuration files. -- Manoj Srivastava Fri, 9 Mar 2007 00:22:19 -0600 refpolicy (0.0.20061018-4) unstable; urgency=low * Bug fix: "selinux-policy-refpolicy-targeted: does not suggest a way to fix the 'maybe failing' attempt in postinst", thanks to Eddy Petrisor. While this does not belong in the postinst, I have addedthis to the README.Debian file. This should be a low risk change. (Closes: #407691). * Bug fix: "Default build.conf doesn't match default strict/targeted policy", thanks to Stefan.The build.conf included in the reference source policy describe to build a policy of the type "strict". The default binary policies coming with Debian are build with the policy type "strict-mcs" or "targeted-mcs". Change the build.conf shipped in source to conform to what we really use. (changes TYPE=strict to TYPE=strict-mcs, very low risk change. (Closes: #411256). * Bug fix: "selinux-policy-refpolicy-targeted: openvpn policy do not allow tcp connection mode", thanks to Rafal Kupka. This bug really should be at least important, and we should fully support a class of security product like OpenVPN on machines which are running SELinux, and this is a very low risk change. (Closes: #409041). * Install header files required for policy building for both strict and targeted policies in a new -dev package, so it becomes really useful to work with the source package. Moved the examples from the -src package to this new -dev package, since the example is only useful in with the headers provided. This is a new package, but it contains only files already in the sources (No upstream changes at all), and is the result of make install-headers. This new package has no rdepends, and should be a very low risk addition to Debian. * This release should be a whole lot better for building local policies, including the policygentool for creating a new policy from scratch, and ability to build local policy modular packages. The build.conf files have been cleaned up, and the source policy defaults to targeted policy, which is standard in Debian, as opposed to the strict policy, which has priority optional. -- Manoj Srivastava Mon, 26 Feb 2007 22:37:17 -0600 refpolicy (0.0.20061018-3) unstable; urgency=high * Bug fix: "refpolicy: FTBFS: /bin/sh: debian/stamp/config-strict: No such file or directory", thanks to Lucas Nussbaum. This was fixed by moving all the stamps into ./debian instead. I'll re-visit the ./debian/stamp/ directory in lenny. This is a pretty minor packaging change. (Closes: #405613). * Bug fix: "selinux-policy-refpolicy-targeted: Policy for dcc misses Debian's FHS paths", thanks to Devin Carraway. From the bug report: Many of the files in these packages are overlooked when labelling files, because refpolicy's dcc module stipulates paths not consistent with the Debian FHS layout. The files go unlabelled and dcc-client (at least) stops working. The two major problems are the references to /usr/libexec/dcc (damons, placed in /usr/sbin by the Debian packages) and to /var/dcc (all sorts of things, placed under /var/lib/dcc). A side effect of the latter is that dccifd_t and probably others need search on var_lib_t, through which it must pass to get to /var/lib/dcc. Fixed the policy; will send upstream. (Closes: #404309). * Bug fix: "selinux-policy-refpolicy-targeted: clamav policy forbids clamd_t search on /var/lib", thanks to Devin Carraway. This is a simple one line change, and obviously an oversight; I think getting clamd to work is fairly important. (Closes: #404895). * Bug fix: "selinux-policy-refpolicy-targeted: Multiple problems with courier policy", thanks to Devin Carraway. There is detailed information of the changes made in the bug report, and in the commit logs. Again, fixing courier daemons seems pretty important; SELinux tends to get used a lot on remote mail servers, and this fixes issues with the policy. (Closes: #405103). -- Manoj Srivastava Mon, 15 Jan 2007 13:20:30 -0600 refpolicy (0.0.20061018-2) unstable; urgency=high * The This update enables MCS for targeted and strict, uses 1024 categories (as Fedora uses - necessary for compatability). Please note that enabling MCS categories is required for compatibility with filesystems created on Fedora Core 5 and above, RHEL 5 and above, and CentOS 5 and above. MCS categories is also a feature that we plan for all future releases of SE Linux and does not have a nice upgrade path - releasing etch without MCS will make things painful for SE Linux users on the upgrade to lenny. This feature has been extensively tested by Russel Coker and myself, and does not otherwise impact the install. * Allow semanage to use the initrd file descriptor in targeted policy. * Fix a bug with restorecon. * Bug fix: "refpolicy: qemu should have execmem permissions", thanks to David Härdeman (Closes: #402293). -- Manoj Srivastava Fri, 22 Dec 2006 10:33:22 -0600 refpolicy (0.0.20061018-1) unstable; urgency=low * New upstream release * Updated copyright file with the new location of the sources, and added a watch file. * Bug fix: "selinux-policy-refpolicy-targeted: postinst package list retrieval suggestion", thanks to Alexander Buerger. Thanks to the provided suggestion, the selection of policy modules to install is not only faster, it is actually correct :) (Closes: #388744). * Bug fix: "Makefile for building policy modules?", thanks to Uwe Hermann. Provided an intial version, may have bugs. (Closes: #389116). -- Manoj Srivastava Tue, 24 Oct 2006 14:31:22 -0500 refpolicy (0.0.20060911-2) unstable; urgency=low * Fixed a typo in policy postinst that made all the policies reload at every update. -- Manoj Srivastava Tue, 12 Sep 2006 10:28:11 -0500 refpolicy (0.0.20060911-1) unstable; urgency=low * New upstream SCM HEAD. * Synched with Erich Schubert + Added first draft of python-support. You'll want to relabel these files. + Build python-support and setroubleshoot modules + Removed modules from guessing hintfile that are included in base. * Bug fix: "Defaults should match the strict/targeted policy", thanks to Uwe Hermann. Makde them match strict. (Closes: #386931). * Bug fix: "selinux-policy-refpolicy-src: Duplicate entries in policy files", thanks to Simon Richard Grint (Closes: #386909). * Bug fix: "modules.conf vs. modules.conf.dist", thanks to Uwe Hermann (Closes: #386887). * Bug fix: "OUTPUT_POLICY and policy-version comments", thanks to Uwe Hermann (Closes: #386930). * Bug fix: "s/bzip2/gzip/?", thanks to Uwe Hermann (Closes: #386885). * Bug fix: "selinux-refpolicy-src: include modules.conf files of strict and targeted for -src package", thanks to Erich Schubert (Closes: #386573). -- Manoj Srivastava Mon, 11 Sep 2006 17:46:10 -0500 refpolicy (0.0.20060907-3) unstable; urgency=low * Updated a few more policy modules to latest versions for Debian. -- Manoj Srivastava Fri, 8 Sep 2006 12:42:22 -0500 refpolicy (0.0.20060907-2) unstable; urgency=low * Update the module/package mapping. * In the selinux-policy-refpolicy-src package, now ship the modules.conf.strict and the modules.conf.targeted files which are used to build the corresponding policy packages, snce the raw modules.conf package has issues on Debian. * With this version, we no longer ship the selinux-policy-refpolicy-src unpacked into /etc with a gazillion conffiles; instead, we now ship a compressed tarball in /usr/src, which the user may unpack where they wish, and install policies as they wish. -- Manoj Srivastava Fri, 8 Sep 2006 10:49:40 -0500 refpolicy (0.0.20060907-1) unstable; urgency=low * New upstream SCM HEAD. * Bug fix: "selinux-policy-refpolicy-src: Compile failure of modular targeted policy", thanks to Simon Richard Grint. Put a wrapper around the offending lines to only take effect when running a strict policy. (Closes: #384502). * Bug fix: "make: /usr/sbin/setfiles: Command not found", thanks to Uwe Hermann. Fixed upstream. (Closes: #384850). -- Manoj Srivastava Fri, 8 Sep 2006 00:27:39 -0500 refpolicy (0.0.20060813-2) unstable; urgency=low * Bug fix: "Needs gawk", thanks to Simon Richard Grint (Closes: #382821). * Bug fix: "Move /etc/selinux/refpolicy/src/policy/man/man8/* manpages?", thanks to Uwe Hermann (Closes: #372789). * Fix errors in post installation initial policy creation process in the postinst. * Add directories required during policy build during postinst. This bug prevented any policies being built when the package was initially installed. Also, create an empty file_contexts.local file if it does not already exist. * Make selinux-policy-refpolicy-targeted provide and replace the obsolete package selinux-policy-default; which should in the future be just a virtual package. * Added postrm packages to strict and targeted policy packages, in order to clean out the directories in which files are created during policy build. * Rewrote the postinst in perl to allow us to do module dependency checks, and to map policy modules to debian packages, in order to better detect the modules that would be necessary for the target machine. * Also, compiling with either MCS or MLS produced errors while installing policy, since we lack setrans daemon. So we are now building with out them, created an easy to modify option to re-enable it later. * Updated modules.conf to use the latest offerings from Erich. -- Manoj Srivastava Mon, 21 Aug 2006 14:59:52 -0500 refpolicy (0.0.20060813-1) unstable; urgency=low * New upstream SCM HEAD. * Bug fix: "refpolicy: FTBFS: tmp/generated_definitions.conf:597:ERROR 'syntax error' at token '' on line 3416:", thanks to Andreas Jochens (Closes: #379559). * Bug fix: "FTBFS while generating selinux-policy-refpolicy-strict", thanks to Devin Carraway (Closes: #379376). * Python transition (#2): you are building a private python module. (Closes: #380930). -- Manoj Srivastava Tue, 15 Aug 2006 09:53:06 -0500 refpolicy (0.0.20060509-2) unstable; urgency=low * Modified some paths to be more in line with upstream standards. -- Manoj Srivastava Fri, 12 May 2006 08:30:08 -0500 refpolicy (0.0.20060509-1) unstable; urgency=low * New upstream release. First packaging for Sid. -- Manoj Srivastava Tue, 9 May 2006 13:56:10 -0500 refpolicy (20060506-1) sesarge; urgency=low * New upstream checkout from CVS. * Even more new modules. -- Erich Schubert Sat, 6 May 2006 21:44:07 +0200 refpolicy (20060418-2) sesarge; urgency=low * New upstream checkout from CVS. -- Erich Schubert Fri, 21 Apr 2006 19:17:05 +0200 refpolicy (20060417-1) sesarge; urgency=low * New upstream checkout from CVS. * Until module linking is fixed, build everything into base. (Sorry, this will result in a much larger policy than necessary. Feel free to use the -src package to build your own!) -- Erich Schubert Mon, 17 Apr 2006 21:04:49 +0200 refpolicy (20060414-1) sesarge; urgency=low * New upstream version with tons of new policy files -- Erich Schubert Mon, 17 Apr 2006 20:48:50 +0200 refpolicy (20060329-2) sesarge; urgency=low * Merge upstream 20060329-2 -- Erich Schubert Mon, 3 Apr 2006 00:44:06 +0200 refpolicy (20060324-2) sesarge; urgency=low * Merge upstream 20060324-4 -- Erich Schubert Sat, 25 Mar 2006 03:34:36 +0100 refpolicy (20060324-1) sesarge; urgency=low * Merge upstream 20060323-2 * Merge changes by Thomas Bleher * Build with checkpolicy 1.30.1 * Sorry, still doesn't work with make > 3.80 -- Erich Schubert Sat, 25 Mar 2006 02:21:00 +0100 refpolicy (20060315-2) sesarge; urgency=low * Make modular policy actually work. Hopefully. (Up to now, optional_policy(`module') in base was not working upstream!) * Revamp build process, don't use CDBS anymore since I didn't figure out how to do two clean runs of the same source tree, and there is little benefit here without any autotools or library magic needed -- Erich Schubert Fri, 17 Mar 2006 20:51:55 +0100 refpolicy (20060315-1.1) sesarge; urgency=low * Small tweaks and bugfixes to policy -- Erich Schubert Thu, 16 Mar 2006 23:13:40 +0100 refpolicy (20060315-1) sesarge; urgency=low * Merge with upstream and debian changes as of 20060309, rev 50 * Merge with upstream and debian changes as of 20060315, rev 55 * Added "netuser" role, similar to user_tcp_server boolean, but you can enable it for single users only. -- Erich Schubert Thu, 16 Mar 2006 00:23:54 +0100 refpolicy (20060306-1) sesarge; urgency=low * Merge with upstream and debian policy changes as of 20060306, Rev 31 * Try to auto-build a policy after a fresh install in postinst * Add inetd module to base for now * Increase policycoreutils build-dep to hopefully solve the users_extra issues by using a newer policycoreutils for building... -- Erich Schubert Mon, 6 Mar 2006 17:10:43 +0100 refpolicy (20060227-1) sesarge; urgency=low * Merge with upstream and debian policy changes as of 20060227, Rev 20 -- Erich Schubert Tue, 28 Feb 2006 03:48:48 +0100 refpolicy (20060224-2) sesarge; urgency=low * Update build process to not require a tarball, include previous patches into our "branch" of the reference policy instead. -- Erich Schubert Tue, 28 Feb 2006 03:13:51 +0100 refpolicy (20060224-1) sesarge; urgency=low * New upstream CVS checkout. * Move policy src from /etc to /usr/share/selinux/refpolicy This avoids an apt-get size limitation and follows Fedora. * Ship edited build.conf with policy source. * Use debhelper for installing documentation. * Add dependency for source onto gawk. -- Erich Schubert Sat, 25 Feb 2006 01:01:44 +0100 refpolicy (20060222-1) sesarge; urgency=low * New upstream CVS checkout. * Thomas also provided a workaround for the make issues in his version. * Update dpkg/apt policy to interface renamings * Remove dpkg_script_exec_t, as supporting this would require bad hacks to dpkg and/or tar. Use dpkg_var_lib_t instead. -- Erich Schubert Thu, 23 Feb 2006 02:01:35 +0100 refpolicy (20060217-3) sesarge; urgency=low * Create selinux-policy-refpolicy-doc package * DIRECT_INITRC=y -- Thomas Bleher Mon, 20 Feb 2006 23:43:53 +0000 refpolicy (20060217-2) sesarge; urgency=low * Added first drafts of dpkg, apt policy -- Erich Schubert Sat, 18 Feb 2006 03:20:59 +0100 refpolicy (20060217-1) sesarge; urgency=low * New upstream CVS checkout * Document make incompaibility via build-dep * Don't build some redhat specific policy modules, minor tweaks -- Erich Schubert Tue, 14 Feb 2006 02:35:04 +0100 refpolicy (20060213-1) sesarge; urgency=low * New upstream CVS checkout. * Still not really useable -- Erich Schubert Tue, 14 Feb 2006 02:35:04 +0100 refpolicy (20060117-1) sesarge; urgency=low * Experimental release -- Erich Schubert Mon, 13 Feb 2006 22:50:03 +0100