7:02 p.m.
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-17464
2011-12-26 19:02:00
--------------------------------------------------------------------------------
Name : selinux-policy
Product : Fedora 16
Version : 3.10.0
Release : 69.fc16
URL : http://oss.tresys.com/repos/refpolicy/
Summary : SELinux policy configuration
Description :
SELinux Reference Policy - modular.
Based off of reference policy: Checked out revision 2.20091117
--------------------------------------------------------------------------------
Update Information:
- Fix bug in the boinc policy
- sssd needs sys_admin capability
--------------------------------------------------------------------------------
ChangeLog:
* Sun Dec 25 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.10.0-69
- Fix bug in the boinc policy
* Wed Dec 21 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.10.0-68
- sssd needs sys_admin capability
* Thu Dec 15 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.10.0-67
- Add httpd_can_connect_ldap() interface
- NetworkManager needs to write to /sys/class/net/ib*/mode
- Dont audit writes to leaked file descriptors or redirected output for nacl
- Add label for /var/lib/iscan/interpreter
- Add labeling for /sbin/iscsiuio
- Allow all jabberd domain to read system state
- Allow munin services plugins to use NSCD services
- More fixes for boinc
* Wed Dec 7 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.10.0-66
- Add fixes for xguest package
* Tue Dec 6 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.10.0-65
- Allow abrt to getattr on blk files
- Add type for rhev-agent log file
- Fix labeling for /dev/dmfm
- Dontaudit wicd leaking
- Allow systemd_logind_t to look at process info of apps that exchange dbus messages with
it
- Label /etc/locale.conf correctly
- Allow user_mail_t to read /dev/random
- Allow postfix-smtpd to read MIMEDefang
- Add label for /var/log/suphp.log
- Allow swat_t to connect and read/write nmbd_t sock_file
- Allow systemd-tmpfiles to setattr for /run/user/gdm/dconf
- Allow systemd-tmpfiles to change user identity in object contexts
- More fixes for rhev_agentd_t consolehelper policy
* Fri Dec 2 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.10.0-64
- Use fs_use_xattr for squashf
- Fix procs_type interface
- Dovecot has a new fifo_file /var/run/dovecot/stats-mail
- Dovecot has a new fifo_file /var/run/stats-mail
- Colord does not need to connect to network
- Allow system_cronjob to dbus chat with NetworkManager
- Puppet manages content, want to make sure it labels everything correctly
* Tue Nov 29 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.10.0-63
- Change port 9050 to tor_socks_port_t and then allow openvpn to connect to it
- Allow all postfix domains to use the fifo_file
- Allow sshd_t to getattr on all file systems in order to generate avc on nfs_t
- Allow apmd_t to read grub.cfg
- Let firewallgui read the selinux config
- Allow systemd-tmpfiles to delete content in /root that has been moved to /tmp
- Fix devicekit_manage_pid_files() interface
- Allow squid to check the network state
- Dontaudit colord getattr on file systems
- Allow ping domains to read zabbix_tmp_t files
* Mon Nov 28 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.10.0-62
- Add fs_read_fusefs_dirs interface
- Allow mailman to read /dev/urandom
- Allow clamd to read spamd pid file
- Allow mount to read /dev/urandom
- Add use_fusefs_home_dirs also for system_dbus_t
* Fri Nov 25 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.10.0-61
- Needs to require new version policycoreutils
* Thu Nov 24 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.10.0-60
- Needs to require new version checkpolicy
* Thu Nov 24 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.10.0-59
- Allow spamd to send mail
- Add ssh_home_t label for /var/lib/nocpulse/.ssh
- Allow puppetmaster to read network state
- Add colord_can_network_connect boolean
- Allow colord to execute shell
- Add bin_t label for "/usr/lib/iscan/network"
- Allow chrome-sandbox ptrace
- winbind needs to be able to talk to ldap directly, not through sssd
- saslauthd_t needs to connect to zarafa_port_t
- dnsmasq wants to read proc_net_t
- Add full DNS support for FreeIPA
* Mon Nov 21 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.10.0-58
- Allow mcelog_t to create dir and file in /var/run and label it correctly
- Allow dbus to manage fusefs
- Mount needs to read process state when mounting gluster file systems
- Allow collectd-web to read collectd lib files
- Allow daemons and system processes started by init to read/write the unix_stream_socket
passed in from as stdin/stdout/stderr
- Allow colord to get the attributes of tmpfs filesystem
- Add sanlock_use_nfs and sanlock_use_samba booleans
- Add bin_t label for /usr/lib/virtualbox/VBoxManage
* Wed Nov 16 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.10.0-57
- We need to treat port_t and unreserved_port_t as generic_port types
* Wed Nov 16 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.10.0-56
- Add ssh_dontaudit_search_home_dir
- Changes to allow namespace_init_t to work
- Add interface to allow exec of mongod, add port definition for mongod port, 27017
- Label .kde/share/apps/networkmanagement/certificates/ as home_cert_t
- Allow spamd and clamd to steam connect to each other
- Add policy label for passwd.OLD
- More fixes for postfix and postfix maildro
- Add ftp support for mozilla plugins
- Useradd now needs to manage policy since it calls libsemanage
- Fix devicekit_manage_log_files() interface
- Allow colord to execute ifconfig
- Allow accountsd to read /sys
- Allow mysqld-safe to execute shell
- Allow openct to stream connect to pcscd
- Add label for /var/run/nm-dns-dnsmasq\.conf
- Allow networkmanager to chat with virtd_t
* Mon Nov 7 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.10.0-55
- Add more MCS fixes to make sandbox working
- Make faillog MLS trusted to make sudo_$1_t working
- Allow sandbox_web_client_t to read passwd_file_t
- Add .mailrc file context
- Remove execheap from openoffice domain
- Allow chrome_sandbox_nacl_t to read cpu_info
- Allow virtd to relabel generic usb which is need if USB device
- Fixes for virt.if interfaces to consider chr_file as image file type
* Fri Nov 4 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.10.0-54
- MCS fixes
- quota fixes
* Tue Nov 1 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.10.0-53
- Make nvidia* to be labeled correctly
- Fix abrt_manage_cache() interface
- Make filetrans rules optional so base policy will build
- Dontaudit chkpwd_t access to inherited TTYS
- Make sure postfix content gets created with the correct label
- Allow gnomeclock to read cgroup
- Fixes for cloudform policy
* Thu Oct 27 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.10.0-52
- Check in fixed for Chrome nacl support
* Thu Oct 27 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.10.0-51
- Begin removing qemu_t domain, we really no longer need this domain.
- systemd_passwd needs dac_overide to communicate with users TTY's
- Allow svirt_lxc domains to send kill signals within their container
* Tue Oct 25 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.10.0-50
- Allow policykit to talk to the systemd via dbus
- Move chrome_sandbox_nacl_t to permissive domains
- Additional rules for chrome_sandbox_nacl
* Tue Oct 25 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.10.0-49
- Change bootstrap name to nacl
- Chrome still needs execmem
- Missing role for chrome_sandbox_bootstrap
- Add boolean to remove execmem and execstack from virtual machines
- Dontaudit xdm_t doing an access_check on etc_t directories
* Mon Oct 24 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.10.0-48
- Allow named to connect to dirsrv by default
- add ldapmap1_0 as a krb5_host_rcache_t file
- Google chrome developers asked me to add bootstrap policy for nacl stuff
- Allow rhev_agentd_t to getattr on mountpoints
- Postfix_smtpd_t needs access to milters and cleanup seems to read/write postfix_smtpd_t
unix_stream_sockets
* Mon Oct 24 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.10.0-47
- Fixes for cloudform policies which need to connect to random ports
- Make sure if an admin creates modules content it creates them with the correct label
- Add port 8953 as a dns port used by unbound
- Fix file name transition for alsa and confined users
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #756187 - AVC for systemd-tmpfile on /var/log/wtmp and btmp
https://bugzilla.redhat.com/show_bug.cgi?id=756187
[ 2 ] Bug #760224 - When using STARTTLS, the confined user need access to
urandom_device_t
https://bugzilla.redhat.com/show_bug.cgi?id=760224
[ 3 ] Bug #770148 - SELinux is preventing
/var/lib/boinc/projects/einstein.phys.uwm.edu/einstein_S6Bucket_1.01_x86_64-pc-linux-gnu
from 'getattr' accesses on the file /etc/localtime.
https://bugzilla.redhat.com/show_bug.cgi?id=770148
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update selinux-policy' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------