rpm/selinux-policy
SHA256
1
0
Fork 0
forked from pool/selinux-policy
Code Pull Requests Activity

Accepting request 1180132 from home:cahu:branches:security:SELinux

Browse Source 
- Update to version 20240612:
  * Allow all domains read and write z90crypt device
  * Allow tpm2 generator setfscreate
  * Allow systemd (PID 1) manage systemd conf files
  * Allow pulseaudio map its runtime files
  * Update policy for getty-generator
  * Allow systemd-hwdb send messages to kernel unix datagram sockets
  * Allow systemd-machined manage runtime sockets
  * Allow fstab-generator create unit file symlinks
  * Update policy for cryptsetup-generator
  * Update policy for fstab-generator
  * Allow virtqemud read vm sysctls
  * Allow collectd to trace processes in user namespace
  * Allow bootupd search efivarfs dirs
  * Add policy for systemd-mountfsd
  * Add policy for systemd-nsresourced
  * Update policy generators
  * Add policy for anaconda-generator
  * Update policy for fstab and gpt generators
  * Add policy for kdump-dep-generator
  * Add policy for a generic generator
  * Add policy for tpm2 generator
  * Add policy for ssh-generator
  * Add policy for second batch of generators
  * Update policy for systemd generators
  * ci: Adjust Cockpit test plans
  * Allow journald read systemd config files and directories
  * Allow systemd_domain read systemd_conf_t dirs
  * Fix bad Python regexp escapes
  * Allow fido services connect to postgres database
  * Revert "Update the README.md file with the c10s branch information"
  * Update the README.md file with the c10s branch information
  * Allow postfix smtpd map aliases file
  * Ensure dbus communication is allowed bidirectionally
  * Label systemd configuration files with systemd_conf_t
  * Label /run/systemd/machine with systemd_machined_var_run_t
  * Allow systemd-hostnamed read the vsock device
  * Allow sysadm execute dmidecode using sudo
  * Allow sudodomain list files in /var
  * Allow setroubleshootd get attributes of all sysctls
  * Allow various services read and write z90crypt device
  * Allow nfsidmap connect to systemd-homed
  * Allow sandbox_x_client_t dbus chat with accountsd
  * Allow system_cronjob_t dbus chat with avahi_t
  * Allow staff_t the io_uring sqpoll permission
  * Allow staff_t use the io_uring API
  * Add support for secretmem anon inode
  * Allow virtqemud read vfio devices
  * Allow virtqemud get attributes of a tmpfs filesystem
  * Allow svirt_t read vm sysctls
  * Allow virtqemud create and unlink files in /etc/libvirt/
  * Allow virtqemud get attributes of cifs files
  * Allow virtqemud get attributes of filesystems with extended attributes
  * Allow virtqemud get attributes of NFS filesystems
  * Allow virt_domain read and write usb devices conditionally
  * Allow virtstoraged use the io_uring API
  * Allow virtstoraged execute lvm programs in the lvm domain
  * Allow virtnodevd_t map /var/lib files
  * Allow svirt_tcg_t map svirt_image_t files
  * Allow abrt-dump-journal-core connect to systemd-homed
  * Allow abrt-dump-journal-core connect to systemd-machined
  * Allow sssd create and use io_uring
  * Allow selinux-relabel-generator create units dir
  * Allow dbus-broker read/write inherited user ttys
  * Define transitions for /run/libvirt/common and /run/libvirt/qemu
  * Allow systemd-sleep read raw disk data
  * Allow numad to trace processes in user namespace
  * Allow abrt-dump-journal-core connect to systemd-userdbd
  * Allow plymouthd read efivarfs files
  * Update the auth_dontaudit_read_passwd_file() interface
  * Label /dev/mmcblk0rpmb character device with removable_device_t
  * fix hibernate on btrfs swapfile (F40)
  * Allow nut to statfs()
  * Allow system dbusd service status systemd services
  * Allow systemd-timedated get the timemaster service status
  * Allow keyutils-dns-resolver connect to the system log service
  * Allow qemu-ga read vm sysctls
  * postfix: allow qmgr to delete mails in bounce/ directory

OBS-URL: https://build.opensuse.org/request/show/1180132
OBS-URL: https://build.opensuse.org/package/show/security:SELinux/selinux-policy?expand=0&rev=225
This commit is contained in:
Cathy Hu 2024-06-12 08:45:42 +00:00 committed by Git OBS Bridge
parent 9e5280b8c1
commit 773eae054e
5 changed files with 87 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
_servicedata
View File

@ -1,7 +1,7 @@
<servicedata> <servicedata>
<service name="tar_scm"> <service name="tar_scm">
<param name="url">https://gitlab.suse.de/selinux/selinux-policy.git</param> <param name="url">https://gitlab.suse.de/selinux/selinux-policy.git</param>
<param name="changesrevision">7eb64de2191880e9d2207fa60c9605268d6fc8ce</param></service><service name="tar_scm"> <param name="changesrevision">4e2aae8d6a013a92737bddfbf0f0d65fdaabdc5d</param></service><service name="tar_scm">
<param name="url">https://github.com/containers/container-selinux.git</param> <param name="url">https://github.com/containers/container-selinux.git</param>
<param name="changesrevision">07b3034f6d9625ab84508a2f46515d8ff79b4204</param></service><service name="tar_scm"> <param name="changesrevision">07b3034f6d9625ab84508a2f46515d8ff79b4204</param></service><service name="tar_scm">
<param name="url">https://gitlab.suse.de/jsegitz/selinux-policy.git</param> <param name="url">https://gitlab.suse.de/jsegitz/selinux-policy.git</param>

3
selinux-policy-20240411.tar.xz
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:3570c8520464f6d7719a016ea1d7b65c1a276102d75fbdaf7be4e7decaa1307d
size 768484

3
selinux-policy-20240612.tar.xz Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:ec4fe6a787325c5f2e917b023434d9a7c0d182447f47dd635b7cc4aac70c40cf
size 770332

82
selinux-policy.changes
View File

@ -1,3 +1,85 @@
-------------------------------------------------------------------
Wed Jun 12 08:43:02 UTC 2024 - cathy.hu@suse.com
- Update to version 20240612:
* Allow all domains read and write z90crypt device
* Allow tpm2 generator setfscreate
* Allow systemd (PID 1) manage systemd conf files
* Allow pulseaudio map its runtime files
* Update policy for getty-generator
* Allow systemd-hwdb send messages to kernel unix datagram sockets
* Allow systemd-machined manage runtime sockets
* Allow fstab-generator create unit file symlinks
* Update policy for cryptsetup-generator
* Update policy for fstab-generator
* Allow virtqemud read vm sysctls
* Allow collectd to trace processes in user namespace
* Allow bootupd search efivarfs dirs
* Add policy for systemd-mountfsd
* Add policy for systemd-nsresourced
* Update policy generators
* Add policy for anaconda-generator
* Update policy for fstab and gpt generators
* Add policy for kdump-dep-generator
* Add policy for a generic generator
* Add policy for tpm2 generator
* Add policy for ssh-generator
* Add policy for second batch of generators
* Update policy for systemd generators
* ci: Adjust Cockpit test plans
* Allow journald read systemd config files and directories
* Allow systemd_domain read systemd_conf_t dirs
* Fix bad Python regexp escapes
* Allow fido services connect to postgres database
* Revert "Update the README.md file with the c10s branch information"
* Update the README.md file with the c10s branch information
* Allow postfix smtpd map aliases file
* Ensure dbus communication is allowed bidirectionally
* Label systemd configuration files with systemd_conf_t
* Label /run/systemd/machine with systemd_machined_var_run_t
* Allow systemd-hostnamed read the vsock device
* Allow sysadm execute dmidecode using sudo
* Allow sudodomain list files in /var
* Allow setroubleshootd get attributes of all sysctls
* Allow various services read and write z90crypt device
* Allow nfsidmap connect to systemd-homed
* Allow sandbox_x_client_t dbus chat with accountsd
* Allow system_cronjob_t dbus chat with avahi_t
* Allow staff_t the io_uring sqpoll permission
* Allow staff_t use the io_uring API
* Add support for secretmem anon inode
* Allow virtqemud read vfio devices
* Allow virtqemud get attributes of a tmpfs filesystem
* Allow svirt_t read vm sysctls
* Allow virtqemud create and unlink files in /etc/libvirt/
* Allow virtqemud get attributes of cifs files
* Allow virtqemud get attributes of filesystems with extended attributes
* Allow virtqemud get attributes of NFS filesystems
* Allow virt_domain read and write usb devices conditionally
* Allow virtstoraged use the io_uring API
* Allow virtstoraged execute lvm programs in the lvm domain
* Allow virtnodevd_t map /var/lib files
* Allow svirt_tcg_t map svirt_image_t files
* Allow abrt-dump-journal-core connect to systemd-homed
* Allow abrt-dump-journal-core connect to systemd-machined
* Allow sssd create and use io_uring
* Allow selinux-relabel-generator create units dir
* Allow dbus-broker read/write inherited user ttys
* Define transitions for /run/libvirt/common and /run/libvirt/qemu
* Allow systemd-sleep read raw disk data
* Allow numad to trace processes in user namespace
* Allow abrt-dump-journal-core connect to systemd-userdbd
* Allow plymouthd read efivarfs files
* Update the auth_dontaudit_read_passwd_file() interface
* Label /dev/mmcblk0rpmb character device with removable_device_t
* fix hibernate on btrfs swapfile (F40)
* Allow nut to statfs()
* Allow system dbusd service status systemd services
* Allow systemd-timedated get the timemaster service status
* Allow keyutils-dns-resolver connect to the system log service
* Allow qemu-ga read vm sysctls
* postfix: allow qmgr to delete mails in bounce/ directory
------------------------------------------------------------------- -------------------------------------------------------------------
Mon Jun 3 13:42:13 UTC 2024 - Johannes Segitz <jsegitz@suse.com> Mon Jun 3 13:42:13 UTC 2024 - Johannes Segitz <jsegitz@suse.com>

2
selinux-policy.spec
View File

@ -33,7 +33,7 @@ Summary: SELinux policy configuration
License: GPL-2.0-or-later License: GPL-2.0-or-later
Group: System/Management Group: System/Management
Name: selinux-policy Name: selinux-policy
Version: 20240411 Version: 20240612
Release: 0 Release: 0
Source0: %{name}-%{version}.tar.xz Source0: %{name}-%{version}.tar.xz
Source1: container.fc Source1: container.fc