Hu
9dc19e60e0
- Enable sap module
- Add equivalency in file_contexts.subs_dist
* /bin /usr/bin
* /sbin /usr/bin
* /usr/sbin /usr/bin
- Update to version 20240710:
* Change fc in rebootmgr module for /sbin -> /usr/bin
* Change fc in rpm module for /sbin -> /usr/bin
* Change fc in rsync module for /sbin -> /usr/bin
* Change fc in wicked module for /sbin -> /usr/bin
* Confine libvirt-dbus
* Allow virtqemud the kill capability in user namespace
* Allow rshim get options of the netlink class for KOBJECT_UEVENT family
* Allow dhcpcd the kill capability
* Allow systemd-networkd list /var/lib/systemd/network
* Allow sysadm_t run systemd-nsresourced bpf programs
* Update policy for systemd generators interactions
* Allow create memory.pressure files with cgroup_memory_pressure_t
* Add support for libvirt hooks
* Allow certmonger read and write tpm devices
* Allow all domains to connect to systemd-nsresourced over a unix socket
* Allow systemd-machined read the vsock device
* Update policy for systemd generators
* Allow ptp4l_t request that the kernel load a kernel module
* Allow sbd to trace processes in user namespace
* Allow request-key execute scripts
* Update policy for haproxyd
* Update policy for systemd-nsresourced
* Correct sbin-related file context entries
* Allow login_userdomain execute systemd-tmpfiles in the caller domain
* Allow virt_driver_domain read files labeled unconfined_t
* Allow virt_driver_domain dbus chat with policykit
* Allow virtqemud manage nfs files when virt_use_nfs boolean is on
* Add rules for interactions between generators
* Label memory.pressure files with cgroup_memory_pressure_t
* Revert "Allow some systemd services write to cgroup files"
* Update policy for systemd-nsresourced
* Label /usr/bin/ntfsck with fsadm_exec_t
* Allow systemd_fstab_generator_t read tmpfs files
* Update policy for systemd-nsresourced
* Alias /usr/sbin to /usr/bin and change all /usr/sbin paths to /usr/bin
* Remove a few lines duplicated between {dkim,milter}.fc
* Alias /bin → /usr/bin and remove redundant paths
* Drop duplicate line for /usr/sbin/unix_chkpwd
* Drop duplicate paths for /usr/sbin
* Update systemd-generator policy
* Remove permissive domain for bootupd_t
* Remove permissive domain for coreos_installer_t
* Remove permissive domain for afterburn_t
* Add the sap module to modules.conf
* Move unconfined_domain(sap_unconfined_t) to an optional block
* Create the sap module
* Allow systemd-coredumpd sys_admin and sys_resource capabilities
* Allow systemd-coredump read nsfs files
* Allow generators auto file transition only for plain files
* Allow systemd-hwdb write to the kernel messages device
* Escape "interface" as a file name in a virt filetrans pattern
* Allow gnome-software work for login_userdomain
* Allow systemd-machined manage runtime sockets
* Revert "Allow systemd-machined manage runtime sockets"
* Allow postfix_domain connect to postgresql over a unix socket
* Dontaudit systemd-coredump sys_admin capability
- Update container-selinux
OBS-URL: https://build.opensuse.org/request/show/1186574
OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=233
55 lines
2.3 KiB
Plaintext
55 lines
2.3 KiB
Plaintext
allow_auditadm_exec_content auditadm_exec_content
|
|
allow_console_login login_console_enabled
|
|
allow_cvs_read_shadow cvs_read_shadow
|
|
allow_daemons_dump_core daemons_dump_core
|
|
allow_daemons_use_tcp_wrapper daemons_use_tcp_wrapper
|
|
allow_daemons_use_tty daemons_use_tty
|
|
allow_domain_fd_use domain_fd_use
|
|
allow_execheap selinuxuser_execheap
|
|
allow_execmod selinuxuser_execmod
|
|
allow_execstack selinuxuser_execstack
|
|
allow_ftpd_anon_write ftpd_anon_write
|
|
allow_ftpd_full_access ftpd_full_access
|
|
allow_ftpd_use_cifs ftpd_use_cifs
|
|
allow_ftpd_use_nfs ftpd_use_nfs
|
|
allow_gssd_read_tmp gssd_read_tmp
|
|
allow_guest_exec_content guest_exec_content
|
|
allow_httpd_anon_write httpd_anon_write
|
|
allow_httpd_mod_auth_ntlm_winbind httpd_mod_auth_ntlm_winbind
|
|
allow_httpd_mod_auth_pam httpd_mod_auth_pam
|
|
allow_httpd_sys_script_anon_write httpd_sys_script_anon_write
|
|
allow_kerberos kerberos_enabled
|
|
allow_mplayer_execstack mplayer_execstack
|
|
allow_mount_anyfile mount_anyfile
|
|
allow_nfsd_anon_write nfsd_anon_write
|
|
allow_polyinstantiation polyinstantiation_enabled
|
|
allow_postfix_local_write_mail_spool postfix_local_write_mail_spool
|
|
allow_rsync_anon_write rsync_anon_write
|
|
allow_saslauthd_read_shadow saslauthd_read_shadow
|
|
allow_secadm_exec_content secadm_exec_content
|
|
allow_smbd_anon_write smbd_anon_write
|
|
allow_ssh_keysign ssh_keysign
|
|
allow_staff_exec_content staff_exec_content
|
|
allow_sysadm_exec_content sysadm_exec_content
|
|
allow_user_exec_content user_exec_content
|
|
allow_user_mysql_connect selinuxuser_mysql_connect_enabled
|
|
allow_user_postgresql_connect selinuxuser_postgresql_connect_enabled
|
|
allow_write_xshm xserver_clients_write_xshm
|
|
allow_xguest_exec_content xguest_exec_content
|
|
allow_xserver_execmem xserver_execmem
|
|
allow_ypbind nis_enabled
|
|
allow_zebra_write_config zebra_write_config
|
|
user_direct_dri selinuxuser_direct_dri_enabled
|
|
user_ping selinuxuser_ping
|
|
user_share_music selinuxuser_share_music
|
|
user_tcp_server selinuxuser_tcp_server
|
|
sepgsql_enable_pitr_implementation postgresql_can_rsync
|
|
sepgsql_enable_users_ddl postgresql_selinux_users_ddl
|
|
sepgsql_transmit_client_label postgresql_selinux_transmit_client_label
|
|
sepgsql_unconfined_dbadm postgresql_selinux_unconfined_dbadm
|
|
clamd_use_jit antivirus_use_jit
|
|
amavis_use_jit antivirus_use_jit
|
|
logwatch_can_sendmail logwatch_can_network_connect_mail
|
|
puppet_manage_all_files puppetagent_manage_all_files
|
|
virt_sandbox_use_nfs virt_use_nfs
|