forked from pool/container-selinux
Hu
07bb613479
- Update to version 2.232.1: * Bump to v2.232.1 * TMT: fix srpm download syntax on rawhide * Bump to 2.232.0 * Packit: remove `update_release` key from downstream jobs (#313) * Update container-selinux.8 man page * Add ownership of /usr/share/udica (#312) * Packit/TMT: upstream maintenance of downstream gating tests * extend container_engine_t again * Allow spc_t to use localectl * Allow spc_t to use timedatectl * introduce container_use_xserver_devices boolean to allow GPU access OBS-URL: https://build.opensuse.org/request/show/1186575 OBS-URL: https://build.opensuse.org/package/show/security:SELinux/container-selinux?expand=0&rev=36
277 lines
11 KiB
Plaintext
277 lines
11 KiB
Plaintext
-------------------------------------------------------------------
|
|
Wed Jul 10 07:52:16 UTC 2024 - cathy.hu@suse.com
|
|
|
|
- Update to version 2.232.1:
|
|
* Bump to v2.232.1
|
|
* TMT: fix srpm download syntax on rawhide
|
|
* Bump to 2.232.0
|
|
* Packit: remove `update_release` key from downstream jobs (#313)
|
|
* Update container-selinux.8 man page
|
|
* Add ownership of /usr/share/udica (#312)
|
|
* Packit/TMT: upstream maintenance of downstream gating tests
|
|
* extend container_engine_t again
|
|
* Allow spc_t to use localectl
|
|
* Allow spc_t to use timedatectl
|
|
* introduce container_use_xserver_devices boolean to allow GPU access
|
|
|
|
-------------------------------------------------------------------
|
|
Mon May 06 07:36:02 UTC 2024 - jsegitz@suse.com
|
|
|
|
- Update to version 2.231.0:
|
|
* Allow container domains to communicate with spc_t unix_stream_sockets
|
|
* Move to %posttrans to ensure selinux-policy got updated before
|
|
the commands run (bsc#1221720)
|
|
|
|
-------------------------------------------------------------------
|
|
Wed Apr 10 15:47:15 UTC 2024 - Cathy Hu <cathy.hu@suse.com>
|
|
|
|
- Manual update to version 2.230.0+git4.a8e389d to include this
|
|
commit that is needed for the main selinux-policy update to work:
|
|
* Rename all /var/run file context entries to /run
|
|
|
|
-------------------------------------------------------------------
|
|
Wed Apr 10 15:38:24 UTC 2024 - Cathy Hu <cathy.hu@suse.com>
|
|
|
|
- Update to version 2.230.0:
|
|
* Move to tar_scm based packaging: added _service and _servicedata
|
|
* Allow containers to unmount file systems
|
|
* Add buildah as a container_runtime_exec_t label
|
|
* Additional rules for container_user_t
|
|
* improve container_engine_t
|
|
|
|
-------------------------------------------------------------------
|
|
Thu Jan 11 08:37:53 UTC 2024 - Johannes Segitz <jsegitz@suse.com>
|
|
|
|
- Update to version 2.228:
|
|
* Allow container domains to watch fifo_files
|
|
* container_engine_t: improve for podman in kubernetes case
|
|
* Allow spc_t to transition to install_t domain
|
|
* Default to allowing containers to use dri devices
|
|
* Allow access to BPF Filesystems
|
|
* Fix kubernetes transition rule
|
|
* Label kubensenter as well as kubenswrapper
|
|
* Allow container domains to execute container_runtime_tmpfs_t files
|
|
* Allow container domains to ptrace themselves
|
|
* Allow container domains to use container_runtime_tmpfs_t as an entrypoint
|
|
* Add boolean to allow containers to use dri devices
|
|
* Give containers access to pod resources endpoint
|
|
* Label kubenswrapper kubelet_exec_t
|
|
|
|
-------------------------------------------------------------------
|
|
Wed Sep 20 14:21:29 UTC 2023 - Johannes Segitz <jsegitz@suse.com>
|
|
|
|
- Update to version 2.222:
|
|
* Allow containers to read/write inherited dri devices
|
|
|
|
-------------------------------------------------------------------
|
|
Tue Aug 15 05:48:12 UTC 2023 - Johannes Segitz <jsegitz@suse.com>
|
|
|
|
- Update to version 2.221:
|
|
* Allow containers to shutdown sockets inherited from container
|
|
runtimes
|
|
* Allow spc_t to use execmod libraries on container file systems
|
|
* Add boolean to allow containers to read all cert files
|
|
* More MLS Policy allow rules
|
|
* Allow container runtimes using pasta bind icmp_socket to port_t
|
|
* Fix spc_t transitions from container_runtime_domain
|
|
|
|
-------------------------------------------------------------------
|
|
Tue May 23 07:32:16 UTC 2023 - Johannes Segitz <jsegitz@suse.com>
|
|
|
|
- Update to version 2.215.0:
|
|
* Add some MLS rules to policy
|
|
* Allow container runtime to dyntransition to spc_t
|
|
* Tighten controls on confined users
|
|
* Add labels for /var/lib/shared
|
|
* Cleanup entrypoint definitions
|
|
* Allow container_device_plugin_t access to debugfs
|
|
* Allow containers which use devices to map them
|
|
|
|
-------------------------------------------------------------------
|
|
Mon Apr 24 07:24:46 UTC 2023 - Johannes Segitz <jsegitz@suse.com>
|
|
|
|
- Update to version 2.211.0:
|
|
* Don't transition to initrc_t domains from spc_t
|
|
* Add tunable to allow sshd_t to launch container engines
|
|
* Allow syslogd_t gettatr on inheritited runtime tmpfs files
|
|
* Add container_file_t and container_ro_file_t as user_home_type
|
|
* Set default context for local-path-provisioner
|
|
* Allow daemon to send dbus messages to spc_t by
|
|
|
|
-------------------------------------------------------------------
|
|
Wed Mar 29 13:04:36 UTC 2023 - Johannes Segitz <jsegitz@suse.com>
|
|
|
|
- Update to version 2.206.0:
|
|
* Allow unconfined domains to transition to container_runtime_t
|
|
* Allow container domains to transition to install_t
|
|
* Allow avirt_sandbox_domain to manage container_file_t types
|
|
* Allow containers to watch sysfs_t directories
|
|
* Allow spc_t to transption to rpm_script_t
|
|
* Add support to new user_namespace access check
|
|
* Smaller permission changes for container_init_t
|
|
- Drop spc.patch, is now included
|
|
|
|
-------------------------------------------------------------------
|
|
Mon Jan 16 12:47:34 UTC 2023 - Frederic Crozat <fcrozat@suse.com>
|
|
|
|
- Update to version 2.198.0:
|
|
* Fix spc_t transition rules on tmpfs_t
|
|
- Changes from 2.197.0:
|
|
* Add boolean containers_use_ecryptfs policy
|
|
- Changes from 2.195.1:
|
|
* Readd missing allow rules for container_t
|
|
- Changes from 2.194.0:
|
|
* Allow syslogd_t to use tmpfs files created by container runtime
|
|
- Changes from 2.193.0:
|
|
* Allow containers to mount tmpfs_t file systems
|
|
* Label spc_t as a init initrc daemon
|
|
* Allow userdomains to run containers
|
|
- Changes from 2.191.0:
|
|
* Create container_logwriter_t type
|
|
- Changes from 2.190.1:
|
|
* Support BuildKit
|
|
* container.fc: Set label for kata-agent
|
|
* support nerdctl
|
|
- Changes from 2.190.0:
|
|
* Packit: initial enablement
|
|
* Allow iptables to list directories labeled as container_file_t
|
|
- Changes from 2.189.0:
|
|
* Dont audit searching other processes in /proc.
|
|
|
|
-------------------------------------------------------------------
|
|
Thu Jan 12 13:02:32 UTC 2023 - Johannes Segitz <jsegitz@suse.com>
|
|
|
|
- Rename spc_timedated.patch to spc.patch
|
|
- Update spc.patch to allow privileged containers to use
|
|
localectl (bsc#1207077)
|
|
|
|
-------------------------------------------------------------------
|
|
Wed Jan 11 14:15:06 UTC 2023 - Johannes Segitz <jsegitz@suse.com>
|
|
|
|
- Add spc_timedated.patch to allow privileged containers to use
|
|
timedatectl (bsc#1207054)
|
|
|
|
-------------------------------------------------------------------
|
|
Thu Jul 14 08:37:48 UTC 2022 - Johannes Segitz <jsegitz@suse.com>
|
|
|
|
- Update to version 2.188.0:
|
|
* Allow confined containers to mount overlay filesystems
|
|
Fixed bsc#1201348
|
|
|
|
-------------------------------------------------------------------
|
|
Wed Jun 22 13:17:49 UTC 2022 - Frederic Crozat <fcrozat@suse.com>
|
|
|
|
- Update to version 2.187.0:
|
|
* Allow container domains to use /dev/zero
|
|
- Changes from 2.186.0:
|
|
* Create policy for a container_device_t
|
|
* Allow containers to shutdown & setopt userdomain:sockets
|
|
- Changes from 2.183.0:
|
|
* Allow containers to inherit all socket classes from container runtimes.
|
|
- Changes from 2.182.0:
|
|
* Allow containers to inherit all socket classes
|
|
- Changes from 2.181.0:
|
|
* Allow socket activated domains for tcp sockets from init_t and userdomains.
|
|
|
|
-------------------------------------------------------------------
|
|
Tue Mar 22 08:35:54 UTC 2022 - Johannes Segitz <jsegitz@suse.com>
|
|
|
|
- Add udica templates to the package
|
|
|
|
-------------------------------------------------------------------
|
|
Fri Mar 18 12:04:25 UTC 2022 - Johannes Segitz <jsegitz@suse.com>
|
|
|
|
- Update to version 2.180.0
|
|
* Allow container domains to read/write kvm_device_t
|
|
* Update kublet mappings to inlcude /usr/local/*
|
|
* Allow container domains to use container runtime tcp and udp sockets
|
|
* Alow containers to use unix_stream_sockets leaked from container runtimes
|
|
* Allow userdomains to execute conmon_exec_t and use it as an entrypoint
|
|
* Allow conmon_exec_t as an entrypoint
|
|
* Add container_use_devices boolean to allow containers to use any device
|
|
* Add explicit range transition for conmon
|
|
* Add missing dbus class declaration into container_runtime_run()
|
|
* Remove lockdown allow rules
|
|
* Remove k3s fcontexts
|
|
* Allow container domains to be used by user roles
|
|
- Changed source url to allow for download via source service
|
|
|
|
-------------------------------------------------------------------
|
|
Fri Nov 12 16:21:06 UTC 2021 - Richard Brown <rbrown@suse.com>
|
|
|
|
- Update to version 2.171.0
|
|
* Define kubernetes_file_t as a config_type
|
|
* Allow containers to be socket activated by user domains and by systemd.
|
|
* Allow iptables to use fifo files of a container runtime
|
|
* Allow container_runtime create all tmpfs content as container_runtime_tmpfs_t
|
|
* Allow containers to create lnk_file on tmpfs_t directories.
|
|
|
|
-------------------------------------------------------------------
|
|
Mon Aug 9 07:44:17 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
|
|
|
|
- Update to version 2.164.2
|
|
* Don't setup users for writing to pid_sockets
|
|
* Allow container engines to be started from the staff user.
|
|
* Allow spc_t domains to set bpf rules on any domain
|
|
* Add support for k3s
|
|
|
|
-------------------------------------------------------------------
|
|
Fri Apr 23 06:04:48 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
|
|
|
|
- Fix container runtime binary labels (bsc#1185030). You need to
|
|
relable at least /usr/sbin if you're affected
|
|
|
|
-------------------------------------------------------------------
|
|
Tue Feb 23 13:21:19 UTC 2021 - Thorsten Kukuk <kukuk@suse.com>
|
|
|
|
- Update to version 2.158.0
|
|
- Add nfs remount support
|
|
- Allow containers to execmod on nfs, samba and cephs remote shares
|
|
- Allow confined users to send dbus messages to container_runtime
|
|
|
|
-------------------------------------------------------------------
|
|
Mon Jan 11 10:40:32 UTC 2021 - Thorsten Kukuk <kukuk@suse.com>
|
|
|
|
- Update to version 2.154.0
|
|
- Allow confined user domains to run confined container domains.
|
|
- Allow all containers to use nfs shares, iff virt_use_nfs boolean
|
|
is enabled.
|
|
- Allow containers to read nsfs file systems.
|
|
- KVM Container need to use tunnel sockets created by runtime.
|
|
|
|
-------------------------------------------------------------------
|
|
Tue Nov 3 07:53:35 UTC 2020 - Ludwig Nussel <lnussel@suse.de>
|
|
|
|
- Don't use BuildRequires based on shell script output. OBS can't
|
|
evaluate that.
|
|
|
|
-------------------------------------------------------------------
|
|
Thu Oct 29 07:52:21 UTC 2020 - Thorsten Kukuk <kukuk@suse.com>
|
|
|
|
- Update to version 2.150.0
|
|
- Add additional allow rules for kvm based containers using
|
|
virtiofsd.
|
|
|
|
-------------------------------------------------------------------
|
|
Wed Oct 14 12:57:07 UTC 2020 - Thorsten Kukuk <kukuk@suse.com>
|
|
|
|
- Update to version 2.145.0
|
|
- Add support for kubernetes_file_t
|
|
- Allow container_t to open existing tun/tap
|
|
|
|
-------------------------------------------------------------------
|
|
Wed Aug 12 09:11:30 UTC 2020 - Thorsten Kukuk <kukuk@suse.com>
|
|
|
|
- Minimize BuildRequires
|
|
|
|
-------------------------------------------------------------------
|
|
Mon Aug 10 21:11:12 UTC 2020 - Thorsten Kukuk <kukuk@suse.com>
|
|
|
|
- Update to version 2.143.0
|
|
- support containerd/cri
|
|
|
|
-------------------------------------------------------------------
|
|
Wed Aug 5 08:42:45 UTC 2020 - Thorsten Kukuk <kukuk@suse.com>
|
|
|
|
- Initial version
|