- Update to version 2.232.1:
* Bump to v2.232.1
* TMT: fix srpm download syntax on rawhide
* Bump to 2.232.0
* Packit: remove `update_release` key from downstream jobs (#313)
* Update container-selinux.8 man page
* Add ownership of /usr/share/udica (#312)
* Packit/TMT: upstream maintenance of downstream gating tests
* extend container_engine_t again
* Allow spc_t to use localectl
* Allow spc_t to use timedatectl
* introduce container_use_xserver_devices boolean to allow GPU access
OBS-URL: https://build.opensuse.org/request/show/1186575
OBS-URL: https://build.opensuse.org/package/show/security:SELinux/container-selinux?expand=0&rev=36
- Manual update to version 2.230.0+git4.a8e389d to include this
commit that is needed for the main selinux-policy update to work:
* Rename all /var/run file context entries to /run
- Update to version 2.230.0:
* Move to tar_scm based packaging: added _service and _servicedata
* Allow containers to unmount file systems
* Add buildah as a container_runtime_exec_t label
* Additional rules for container_user_t
* improve container_engine_t
OBS-URL: https://build.opensuse.org/request/show/1166916
OBS-URL: https://build.opensuse.org/package/show/security:SELinux/container-selinux?expand=0&rev=34
- Update to version 2.228:
* Allow container domains to watch fifo_files
* container_engine_t: improve for podman in kubernetes case
* Allow spc_t to transition to install_t domain
* Default to allowing containers to use dri devices
* Allow access to BPF Filesystems
* Fix kubernetes transition rule
* Label kubensenter as well as kubenswrapper
* Allow container domains to execute container_runtime_tmpfs_t files
* Allow container domains to ptrace themselves
* Allow container domains to use container_runtime_tmpfs_t as an entrypoint
* Add boolean to allow containers to use dri devices
* Give containers access to pod resources endpoint
* Label kubenswrapper kubelet_exec_t
OBS-URL: https://build.opensuse.org/request/show/1138075
OBS-URL: https://build.opensuse.org/package/show/security:SELinux/container-selinux?expand=0&rev=33
- Update to version 2.206.0:
* Allow unconfined domains to transition to container_runtime_t
* Allow container domains to transition to install_t
* Allow avirt_sandbox_domain to manage container_file_t types
* Allow containers to watch sysfs_t directories
* Allow spc_t to transption to rpm_script_t
* Add support to new user_namespace access check
* Smaller permission changes for container_init_t
- Drop spc.patch, is now included
OBS-URL: https://build.opensuse.org/request/show/1075435
OBS-URL: https://build.opensuse.org/package/show/security:SELinux/container-selinux?expand=0&rev=27
- Update to version 2.198.0:
* Fix spc_t transition rules on tmpfs_t
- Changes from 2.197.0:
* Add boolean containers_use_ecryptfs policy
- Changes from 2.195.1:
* Readd missing allow rules for container_t
- Changes from 2.194.0:
* Allow syslogd_t to use tmpfs files created by container runtime
- Changes from 2.193.0:
* Allow containers to mount tmpfs_t file systems
* Label spc_t as a init initrc daemon
* Allow userdomains to run containers
- Changes from 2.191.0:
* Create container_logwriter_t type
- Changes from 2.190.1:
* Support BuildKit
* container.fc: Set label for kata-agent
* support nerdctl
- Changes from 2.190.0:
* Packit: initial enablement
* Allow iptables to list directories labeled as container_file_t
- Changes from 2.189.0:
* Dont audit searching other processes in /proc.
OBS-URL: https://build.opensuse.org/request/show/1058701
OBS-URL: https://build.opensuse.org/package/show/security:SELinux/container-selinux?expand=0&rev=26
- Update to version 2.187.0:
* Allow container domains to use /dev/zero
- Changes from 2.186.0:
* Create policy for a container_device_t
* Allow containers to shutdown & setopt userdomain:sockets
- Changes from 2.183.0:
* Allow containers to inherit all socket classes from container runtimes.
- Changes from 2.182.0:
* Allow containers to inherit all socket classes
- Changes from 2.181.0:
* Allow socket activated domains for tcp sockets from init_t and userdomains.
OBS-URL: https://build.opensuse.org/request/show/984493
OBS-URL: https://build.opensuse.org/package/show/security:SELinux/container-selinux?expand=0&rev=22
- Update to version 2.180.0
* Allow container domains to read/write kvm_device_t
* Update kublet mappings to inlcude /usr/local/*
* Allow container domains to use container runtime tcp and udp sockets
* Alow containers to use unix_stream_sockets leaked from container runtimes
* Allow userdomains to execute conmon_exec_t and use it as an entrypoint
* Allow conmon_exec_t as an entrypoint
* Add container_use_devices boolean to allow containers to use any device
* Add explicit range transition for conmon
* Add missing dbus class declaration into container_runtime_run()
* Remove lockdown allow rules
* Remove k3s fcontexts
* Allow container domains to be used by user roles
- Changed source url to allow for download via source service (forwarded request 962680 from jsegitz)
OBS-URL: https://build.opensuse.org/request/show/962685
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/container-selinux?expand=0&rev=10
- Update to version 2.180.0
* Allow container domains to read/write kvm_device_t
* Update kublet mappings to inlcude /usr/local/*
* Allow container domains to use container runtime tcp and udp sockets
* Alow containers to use unix_stream_sockets leaked from container runtimes
* Allow userdomains to execute conmon_exec_t and use it as an entrypoint
* Allow conmon_exec_t as an entrypoint
* Add container_use_devices boolean to allow containers to use any device
* Add explicit range transition for conmon
* Add missing dbus class declaration into container_runtime_run()
* Remove lockdown allow rules
* Remove k3s fcontexts
* Allow container domains to be used by user roles
- Changed source url to allow for download via source service
OBS-URL: https://build.opensuse.org/request/show/962680
OBS-URL: https://build.opensuse.org/package/show/security:SELinux/container-selinux?expand=0&rev=17
