Fedora 22 Update: selinux-policy-3.13.1-128.12.fc22
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2015-14076
2015-08-27 17:52:04.306212
--------------------------------------------------------------------------------
Name : selinux-policy
Product : Fedora 22
Version : 3.13.1
Release : 128.12.fc22
URL : http://github.com/TresysTechnology/refpolicy/wiki
Summary : SELinux policy configuration
Description :
SELinux Reference Policy - modular.
Based off of reference policy: Checked out revision 2.20091117
--------------------------------------------------------------------------------
Update Information:
selinux-policy-3.13.1-128.12.fc22 - Allow pmlogger to create
pmlogger.primary.socket link file. BZ(1254080) - Allow NetworkManager send
sigkill to dnssec-trigger. BZ(1251764) - Add interface dnssec_trigger_sigkill -
Allow smsd use usb ttys. BZ(#1250536) - Fix
postfix_spool_maildrop_t,postfix_spool_flush_t contexts in postfix.fc file. -
Allow exec pidof under hypervkvp domain. Allow hypervkvp daemon create
connection to the system DBUS - Allow openhpid_t to read system state. - Add
temporary fixes for sandbox related to #1103622. It allows to run everything
under one sandbox type. - Added labels for files provided by rh-nginx18
collection - Dontaudit block_suspend capability for ipa_helper_t, this is kernel
bug. Allow ipa_helper_t capability net_admin. Allow ipa_helper_t to list /tmp.
Allow ipa_helper_t to read rpm db. - Allow rhsmcertd exec rhsmcertd_var_run_t
files and rhsmcerd_tmp_t files. This rules are in hide_broken_sympthons until we
find better solution. - Allow abrt_dump_oops_t to read proc_security_t files. -
Allow abrt_dump_oops to signull all domains Allow abrt_dump_oops to read all
domains state Allow abrt_dump_oops to ptrace all domains - Add interface
abrt_dump_oops_domtrans() - Allow systemd-sysctl cap. sys_ptrace BZ(1253926) -
Add label for kernel module dep files in /usr/lib/modules - Allow kernel_t
domtrans to abrt_dump_oops_t - Added to files_dontaudit_write_all_mountpoints
intefface new dontaudit rule, that domain included this interface dontaudit
capability dac_override.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1254080 - SELinux is preventing pmlogger from 'create' accesses on
the lnk_file pmlogger.primary.socket.
https://bugzilla.redhat.com/show_bug.cgi?id=1254080
[ 2 ] Bug #1245477 - SELinux is preventing abrt-hook-ccpp from using the
'sigchld' accesses on a process.
https://bugzilla.redhat.com/show_bug.cgi?id=1245477
[ 3 ] Bug #1165713 - Disabling the 'unconfined' module broke setroubleshootd
https://bugzilla.redhat.com/show_bug.cgi?id=1165713
[ 4 ] Bug #1250536 - SELinux is preventing smsd from read, write access on the chr_file
ttyUSB0.
https://bugzilla.redhat.com/show_bug.cgi?id=1250536
[ 5 ] Bug #1253926 - SELinux is preventing /usr/lib/systemd/systemd-sysctl from using
the 'sys_ptrace' capabilities.
https://bugzilla.redhat.com/show_bug.cgi?id=1253926
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update selinux-policy' at the command line.
For more information, refer to "Managing Software with yum",
available at https://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------