---------------------------------------------------------------------------= ----- Fedora Update Notification FEDORA-2011-14639 2011-10-20 09:34:15 ---------------------------------------------------------------------------= -----
Name : selinux-policy Product : Fedora 15 Version : 3.9.16 Release : 44.fc15 URL : http://oss.tresys.com/repos/refpolicy/ Summary : SELinux policy configuration Description : SELinux Reference Policy - modular. Based off of reference policy: Checked out revision 2.20091117
---------------------------------------------------------------------------= ----- Update Information:
2011-10-21: Added selinux-policy and updated SSSD with explicit Requires
2011-10-23: Changed Requires: to Conflicts: for selinux-policy in sssd
FreeIPA:
=3D=3D What happened to 2.1.2!? =3D=3D
Right after tagging 2.1.2 we found an upgrade issue that would have =
affected any users using the selfsign CA (installed with --selfsign). We =
decided to hold back the release, fix a few more bugs, and just push out =
2.1.3 instead about a week later. So here we are.
=3D=3D Highlights in 2.1.3 =3D=3D
* Enforce that system hostname matches hostname of IPA server. * Require that /etc/hosts is sane even when configuring DNS. * Increase default server-side LDAP search limits. * Client enrollment improvements including longer wait for sssd to =
start, recovery if discovered IPA server is not responsive and when =
anonymous bind is disabled in 389-ds.
=3D=3D Highlights in 2.1.2 =3D=3D
* Upgrade older dogtag installs to use new PKI proxy configuration * hbactest improvements * Added platform-independent code to make ipa-client-install more portable * Make client uninstaller more robust, should restore state more completely. * UI usability improvements * Tool for Enabling/Disabling Managed Entry Plugins * Managed Entries configuration is now replicated * IPv6 client enrollment improvements * Man page improvements * Performance improvements when calculating indirect membership * Improved handling of disabled anonymous binds in 389-ds * user is now prompted to enter current password when changing to a new password * ipa server now support multiple namingContexts. ipa-client-install and password migration were fixed
=3D=3D Upgrading =3D=3D
=3D=3D=3D Server =3D=3D=3D
To upgrade a 2.0.0, 2.0.1 or 2.1.0 server do the following: # yum update freeipa-server --enablerepo=3Dupdates-testing
This will pull in updated freeIPA, 389-ds, dogtag, libcurl and xmlrpc-c =
packages (and perhaps some others). A script will be executed in the rpm =
postinstall phase to update the IPA LDAP server with any required changes.
There is a bug reported against 389-ds, =
https://bugzilla.redhat.com/show_bug.cgi?id=3D730387, related to =
read-write locks. The NSPR RW lock implementation does not safely allow =
re-entrant use of reader locks. This is a timing issue so it is difficult to predict. During =
testing one user experienced this and the upgrade hung. To break the =
hang kill the ns-slapd process for your realm, wait for the yum =
transaction to complete, then restart 389-ds and manually run the update =
process:
# service dirsrv start # ipa-ldap-updater --update
=3D=3D=3D Client =3D=3D=3D
The ipa-client-install tool in the ipa-client package is just a =
configuration tool. There should be no need to re-run this on every =
client already enrolled.
SSSD: =3D=3D Highlights =3D=3D * Improved handling of users and groups with multi-valued name attributes (aliases) * Performance enhancements * Initgroups on RFC2307bis/FreeIPA * HBAC rule processing * Improved process-hang detection and restarting * Enabled the midpoint cache refresh by default (fewer cache misses on commonly-used entries) * Cleaned up the example configuration
389-ds-base: * fix config del/add mods * memberof is transaction aware resource * limits for simple paged results * Native systemd support * Fix for managed entry * Fixed source tarball * fix transaction support in ldbm_delete
---------------------------------------------------------------------------= ----- ChangeLog:
* Fri Oct 21 2011 Miroslav Grepl mgrepl@redhat.com 3.9.16-44 - Fixes for systemd - Add FIPS suppport for dirsrv * Tue Oct 11 2011 Miroslav Grepl mgrepl@redhat.com 3.9.16-43 - Allow sa-update to update rules - Allow sa-update to read spamd tmp file - Allow screen to read all domain state - Allow sa-update to execute shell - More fixes for sa-update running out of cron job - Allow initrc to manage cron system spool - Fixes for collectd policy - Fixes added during clean up bugzillas - Dontaudit fail2ban_client_t sys_tty_config capability - Fix for puppet which does execute check on passwd - ricci_modservice send syslog msgs - Fix dev_dontaudit_write_mtrr() interface * Tue Sep 27 2011 Miroslav Grepl mgrepl@redhat.com 3.9.16-42 - Make mta_role() active - Add additional gitweb file context labeling - Allow asterisk to connect to jabber client port - Allow sssd to read the contents of /sys/class/net/$IFACE_NAME - Allow fsdaemon dac_override * Thu Sep 22 2011 Miroslav Grepl mgrepl@redhat.com 3.9.16-41 - Add logging_syslogd_can_sendmail boolean - Add support for exim and confined users - support for ommail module to send logs via mail - Add execmem_execmod() to execmem role - Allow pptp to send generic signal to kernel threads - Fix kerberos_manage_host_rcache() interface * Mon Sep 12 2011 Miroslav Grepl mgrepl@redhat.com 3.9.16-40 - Fixes for mock * Tue Sep 6 2011 Miroslav Grepl mgrepl@redhat.com 3.9.16-39 - Backport F16 fixes - livecd fixes - systemd fixes * Thu Aug 11 2011 Miroslav Grepl mgrepl@redhat.com 3.9.16-38 - Allow hostname read network state - Allow syslog to manage all log files - Add use_fusefs_home_dirs boolean for chrome - Make vdagent working with confined users - Fix syslog port definition - Allow openvpn to set its process priority when the nice parameter is used - Restorecond should be able to watch and relabel devices in /dev - Alow hddtemp to perform DNS name resolution * Fri Aug 5 2011 Miroslav Grepl mgrepl@redhat.com 3.9.16-37 - Fixes for zarafa, postfix policy - Backport collect policy * Wed Jul 27 2011 Miroslav Grepl mgrepl@redhat.com 3.9.16-36 - Backport ABRT changes - Make tmux working with scree policy - Allow root cron jobs can't run without unconfined - add interface to dontaudit writes to urand, needed by libra - Add label for /var/cache/krb5rcache directory * Wed Jul 20 2011 Miroslav Grepl mgrepl@redhat.com 3.9.16-35 - Allow jabberd_router_t to read system state - Rename oracledb_port to oracle_port - Allow rgmanager executes init script files in initrc_t domain which ensur= e proper transitions - screen wants to manage sock file in screen home dirs - Make screen working with confined users - Allow gssd to search access on the directory /proc/fs/nfsd * Fri Jul 15 2011 Miroslav Grepl mgrepl@redhat.com 3.9.16-34 - More fixes for postfix policy - Allow virsh_t setsched - Add mcelog_log_t type for mcelog log file - Add virt_ptynode attribute * Mon Jul 11 2011 Miroslav Grepl mgrepl@redhat.com 3.9.16-33 - Add l2tpd policy - Fixes for abrt - Backport fail2ban_client policy * Fri Jul 1 2011 Miroslav Grepl mgrepl@redhat.com 3.9.16-32 - Allow getcap, setcap for syslogd - Fix label for /usr/lib64/opera/opera * Thu Jun 30 2011 Miroslav Grepl mgrepl@redhat.com 3.9.16-31 - Make mozilla_plugin_tmpfs_t as userdom_user_tmpfs_content() - Allow init to delete all pid sockets - Allow colord to read /proc/stat - Add label for /var/www/html/wordpress/wp-content/plugins directory - Allow pppd to search /var/lock dir - puppetmaster use nsswitch: #711804 - Update abrt to match rawhide policy - allow privoxy to read network data - support gecko mozilla browser plugin - Allow chrome_sandbox to execute content in nfs homedir - postfix_qmgr needs to read /var/spool/postfix/deferred - abrt_t needs fsetid * Tue Jun 14 2011 Miroslav Grepl mgrepl@redhat.com 3.9.16-30 - Fixes for zarafa policy - Other fixes for fail2ban - Allow keyring to drop capabilities - Allow cobblerd to send syslog messages - Allow xserver to read/write the xserver_misk device - ppp also installs /var/log/ppp and /var/run/ppp directories * remove filetrans rules - fix for pppd_lock - Allow fail2ban run ldconfig - Allow lvm to read/write pipes inherited from login programs * Fri Jun 10 2011 Miroslav Grepl mgrepl@redhat.com 3.9.16-29 - Fix /var/lock labeling issue * Mon Jun 6 2011 Miroslav Grepl mgrepl@redhat.com 3.9.16-28 - Allow ssh to execute systemctl - fail2ban fixes related to /tmp directory - Allow puppetmaster to create dirs in /var/run/puppet * Thu Jun 2 2011 Miroslav Grepl mgrepl@redhat.com 3.9.16-27 - Add label for /var/lock/ppp - Fixes for colord policy - Allow sys_chroot for postfix domains * Fri May 27 2011 Miroslav Grepl mgrepl@redhat.com 3.9.16-26 - Add label for dev/ati/card* - Allowe secadm to manage selinux config files * Thu May 26 2011 Miroslav Grepl mgrepl@redhat.com 3.9.16-25 - Add Dominicks patch for dccp_socket - dnsmasq needs to read nm-dns-dnsmasq.conf in /var/run/ - Colord inherits open file descriptors from the users...' - cgred needs auth_use_nsswitch() - apcupsd lock file was missing file context specificatio... - Make cron work - Allow clamav to manage amavis spool files - Use httpd_can_sendmail boolean also for httpd_suexec_t - Add fenced_can_ssh boolean - Add dev_dontaudit_read_generic_files() for hplip - Allow xauthority to create shared memory - Make postfix user domains application_domains - Allow xend to sys_admin privs - Allow mount to read usr files - Allow logrotate to connect to init script using unix stream socket - Allow nsplugin_t to getattr on gpmctl * Tue May 17 2011 Miroslav Grepl mgrepl@redhat.com 3.9.16-24 - Allow logrotate to connect to init script using unix domain stream socket - Allow shorewall read and write inherited user domain pty/tty - virt will attempt to us another virtualizations pulsesaudio tmpfs_t, igno= re error - Allow colord to get the attributes of fixed disk device nodes - Allow nsplugin_t to getattr on gpmctl - Allow mozilla_plugin to connect to pcscd over an unix stream socket - Allow logrotate to execute systemctl - colord wants to read files in users homedir - Remote login should create user_tmp_t content not its own tmp files - Allow psad signal - Fix cobbler_read_lib_files interface - Allow rlogind to r/w user terminals - Allow prelink_cron_system_t to relabel content and ignore obj_id - Allow gnomeclock_systemctl_t to list init_var_run_t - Dbus domains will inherit fds from the init system ---------------------------------------------------------------------------= ----- References:
[ 1 ] Bug #743035 - HBAC processing is very slow when dealing with FreeIP= A deployments with large numbers of hosts. https://bugzilla.redhat.com/show_bug.cgi?id=3D743035 [ 2 ] Bug #741744 - MOD operations with chained delete/add get back error= 53 on backend config https://bugzilla.redhat.com/show_bug.cgi?id=3D741744 [ 3 ] Bug #743966 - Compiler warnings in account usability plugin https://bugzilla.redhat.com/show_bug.cgi?id=3D743966 [ 4 ] Bug #740942 - allow resource limits to be set for paged searches in= dependently of limits for other searches/operations https://bugzilla.redhat.com/show_bug.cgi?id=3D740942 [ 5 ] Bug #742324 - allow nsslapd-idlistscanlimit to be set dynamically a= nd per-user https://bugzilla.redhat.com/show_bug.cgi?id=3D742324 [ 6 ] Bug #739172 - Allow separate fractional attrs to be defined for inc= remental and total protocols https://bugzilla.redhat.com/show_bug.cgi?id=3D739172 [ 7 ] Bug #736712 - Modifying ruv entry deadlocks server https://bugzilla.redhat.com/show_bug.cgi?id=3D736712 [ 8 ] Bug #590826 - Reloading database from ldif causes changelog to emit= "data no longer matches" errors https://bugzilla.redhat.com/show_bug.cgi?id=3D590826 [ 9 ] Bug #730387 - Use POSIX RW locks instead of NSPR implementation https://bugzilla.redhat.com/show_bug.cgi?id=3D730387 [ 10 ] Bug #611438 - [RFE] [CRM#2027194] adding Account Usable Request Co= ntrol '1.3.6.1.4.1.42.2.27.9.5.8' in RHDS https://bugzilla.redhat.com/show_bug.cgi?id=3D611438 [ 11 ] Bug #735114 - renaming a managed entry does not update mepmanagedby https://bugzilla.redhat.com/show_bug.cgi?id=3D735114 ---------------------------------------------------------------------------= -----
This update can be installed with the "yum" update program. Use =
su -c 'yum update selinux-policy' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on t= he GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys ---------------------------------------------------------------------------= -----
package-announce@lists.fedoraproject.org
-
updates＠fedoraproject.org