Fedora Core 6 Test Update: selinux-policy-2.4.6-52.fc6

[Daniel J Walsh]

---------------------------------------------------------------------
Fedora Test Update Notification
FEDORA-2007-429
2007-04-10
---------------------------------------------------------------------

Product     : Fedora Core 6
Name        : selinux-policy
Version     : 2.4.6
Release     : 52.fc6
Summary     : SELinux policy configuration
Description :
SELinux Reference Policy - modular.

---------------------------------------------------------------------

* Thu Apr  5 2007 Dan Walsh <dwalsh(a)redhat.com&gt; 2.4.6-52
- Don't relabel if selinux is not enabled
- Allow netutils to read sysfs
Resolves: #235357
- Allow samba to work as a PDC
Resolves: #235360
- Allow ypserv to bind to ports 600-1024
Resolves: #235363
- Fix kudzu to be able to telinit
Resolves: #225443
* Tue Apr  3 2007 Dan Walsh <dwalsh(a)redhat.com&gt; 2.4.6-51
- Allow nscd setcap privs
* Mon Apr  2 2007 Dan Walsh <dwalsh(a)redhat.com&gt; 2.4.6-50
- More work to allow kudzu to setup init correctly so getty will work
Resolves: #225443
- Allow pegasus to execute ifconfig
Resolves: #227485
- Allow Aide to look at lnk_files and other fixes
Resolves: #234885
- querying cups jobs with sysadm_r needs override mls restrictions
Resolves: #234889
* Tue Mar 27 2007 Dan Walsh <dwalsh(a)redhat.com&gt; 2.4.6-49
- Change init_daemon_domain(netlabel_mgmt_t,netlabel_mgmt_exec_t)
- to init_system_domain(netlabel_mgmt_t,netlabel_mgmt_exec_t)
Resolves: #233313
- Add fuse support for ntfs

---------------------------------------------------------------------
This update can be downloaded from:
    http://download.fedora.redhat.com/pub/fedora/linux/core/updates/testing/6/

09da2b14e42a1f3e8ee32e1e0a2c30dbe84cadd1  SRPMS/selinux-policy-2.4.6-52.fc6.src.rpm
09da2b14e42a1f3e8ee32e1e0a2c30dbe84cadd1  noarch/selinux-policy-2.4.6-52.fc6.src.rpm
226d1b09eefc1a546a82bac26bb5ce6ed6dcc939 
ppc/selinux-policy-devel-2.4.6-52.fc6.noarch.rpm
489e65146e4fa513e160d67337de09e2119c6b23  ppc/selinux-policy-mls-2.4.6-52.fc6.noarch.rpm
3b3678bd04c0508a229b6292b462f35b48e6e383 
ppc/selinux-policy-targeted-2.4.6-52.fc6.noarch.rpm
8212531292382c8f0d16ea9576323af2e4f297e8  ppc/selinux-policy-2.4.6-52.fc6.noarch.rpm
fe0d3a94e1c1746370bc0495c2b48db2089fffd1 
ppc/selinux-policy-strict-2.4.6-52.fc6.noarch.rpm
226d1b09eefc1a546a82bac26bb5ce6ed6dcc939 
x86_64/selinux-policy-devel-2.4.6-52.fc6.noarch.rpm
489e65146e4fa513e160d67337de09e2119c6b23 
x86_64/selinux-policy-mls-2.4.6-52.fc6.noarch.rpm
3b3678bd04c0508a229b6292b462f35b48e6e383 
x86_64/selinux-policy-targeted-2.4.6-52.fc6.noarch.rpm
8212531292382c8f0d16ea9576323af2e4f297e8  x86_64/selinux-policy-2.4.6-52.fc6.noarch.rpm
fe0d3a94e1c1746370bc0495c2b48db2089fffd1 
x86_64/selinux-policy-strict-2.4.6-52.fc6.noarch.rpm
226d1b09eefc1a546a82bac26bb5ce6ed6dcc939 
i386/selinux-policy-devel-2.4.6-52.fc6.noarch.rpm
489e65146e4fa513e160d67337de09e2119c6b23  i386/selinux-policy-mls-2.4.6-52.fc6.noarch.rpm
3b3678bd04c0508a229b6292b462f35b48e6e383 
i386/selinux-policy-targeted-2.4.6-52.fc6.noarch.rpm
8212531292382c8f0d16ea9576323af2e4f297e8  i386/selinux-policy-2.4.6-52.fc6.noarch.rpm
fe0d3a94e1c1746370bc0495c2b48db2089fffd1 
i386/selinux-policy-strict-2.4.6-52.fc6.noarch.rpm

This update can be installed with the 'yum' update program.  Use 'yum update
package-name' at the command line.  For more information, refer to 'Managing
Software with yum,' available at http://fedora.redhat.com/docs/yum/.
---------------------------------------------------------------------

[Gianluca Sforna]

On 4/10/07, Daniel Walsh <dwalsh(a)redhat.com&gt; wrote:
> ---------------------------------------------------------------------
>
>  * Thu Apr  5 2007 Dan Walsh <dwalsh(a)redhat.com&gt; 2.4.6-52
>  - Don't relabel if selinux is not enabled 
Probably I am missing something, but what if I disable selinux,
update, then re-enable it? Will I use the older labeling?

[Daniel J Walsh]

Gianluca Sforna wrote:
>  On 4/10/07, Daniel Walsh <dwalsh(a)redhat.com&gt; wrote:
> > ---------------------------------------------------------------------
> >
> > * Thu Apr  5 2007 Dan Walsh <dwalsh(a)redhat.com&gt; 2.4.6-52
> > - Don't relabel if selinux is not enabled
>
>  Probably I am missing something, but what if I disable selinux,
>  update, then re-enable it? Will I use the older labeling?
>  
If you disable selinux, update and then reenable, the init scripts will 
trigger an automatic relabeling.

This fix will stop SELinux from taking a lot of cpu time, when you 
update the selinux package but have SELinux disabled.

[Wojtek.Pilorz]

On Tue, 10 Apr 2007, Daniel Walsh wrote:

>  Date: Tue, 10 Apr 2007 12:56:39 -0400
>  From: Daniel Walsh <dwalsh(a)redhat.com&gt;
>  Reply-To: For testers of Fedora Core development releases
>      <fedora-test-list(a)redhat.com&gt;
>  To: fedora-test-list(a)redhat.com
>  Subject: Fedora Core 6 Test Update: selinux-policy-2.4.6-52.fc6
>  
>  ---------------------------------------------------------------------
>  Fedora Test Update Notification
>  FEDORA-2007-429
>  2007-04-10
>  ---------------------------------------------------------------------
>  
>  Product     : Fedora Core 6
>  Name        : selinux-policy
>  Version     : 2.4.6
>  Release     : 52.fc6
>  Summary     : SELinux policy configuration
>  Description :
>  SELinux Reference Policy - modular.
>  
>  ---------------------------------------------------------------------
>  
>  * Thu Apr  5 2007 Dan Walsh <dwalsh(a)redhat.com&gt; 2.4.6-52
>  - Don't relabel if selinux is not enabled
>  - Allow netutils to read sysfs 
I believe this should go to FC6 updates before or at the same time as
iputils-20070202-2.fc6

On an FC6 system with static IP address on eth? interfaces, after iputils-20070202-2.fc6
is installed, 
  service network start
does not define IP addresses on eth? interfaces.

Instead, I get avc messages about arping not being able to read sysfs,
and /etc/sysconfig/network-scripts/ifup-eth at line 245 gets non-zero return
code from arping (because of avc denied), then prints a message
Error, some other host already uses address xxx.yyy.zzz.vvv

and exits, leaving eth? interface without IP address set.

Imagine a remotely administered system which does no longer have network
connectivity after yum update, reboot. Very, err.., non-linux way. Even if
Fedora is not meant as enterprise-class system.


Best regards,

Wojtek

[Daniel J Walsh]

Wojtek.Pilorz wrote:
>  On Tue, 10 Apr 2007, Daniel Walsh wrote:
>
>    
> > Date: Tue, 10 Apr 2007 12:56:39 -0400
> > From: Daniel Walsh <dwalsh(a)redhat.com&gt;
> > Reply-To: For testers of Fedora Core development releases
> >     <fedora-test-list(a)redhat.com&gt;
> > To: fedora-test-list(a)redhat.com
> > Subject: Fedora Core 6 Test Update: selinux-policy-2.4.6-52.fc6
> >
> > ---------------------------------------------------------------------
> > Fedora Test Update Notification
> > FEDORA-2007-429
> > 2007-04-10
> > ---------------------------------------------------------------------
> >
> > Product     : Fedora Core 6
> > Name        : selinux-policy
> > Version     : 2.4.6
> > Release     : 52.fc6
> > Summary     : SELinux policy configuration
> > Description :
> > SELinux Reference Policy - modular.
> >
> > ---------------------------------------------------------------------
> >
> > * Thu Apr  5 2007 Dan Walsh <dwalsh(a)redhat.com&gt; 2.4.6-52
> > - Don't relabel if selinux is not enabled
> > - Allow netutils to read sysfs
> >     
>
>  I believe this should go to FC6 updates before or at the same time as
> iputils-20070202-2.fc6
>
>  On an FC6 system with static IP address on eth? interfaces, after iputils-20070202-2.fc6
>  is installed, 
>    service network start
>  does not define IP addresses on eth? interfaces.
>
>  Instead, I get avc messages about arping not being able to read sysfs,
>  and /etc/sysconfig/network-scripts/ifup-eth at line 245 gets non-zero return
>  code from arping (because of avc denied), then prints a message
>  Error, some other host already uses address xxx.yyy.zzz.vvv
>
>  and exits, leaving eth? interface without IP address set.
>
>  Imagine a remotely administered system which does no longer have network
>  connectivity after yum update, reboot. Very, err.., non-linux way. Even if
>  Fedora is not meant as enterprise-class system.
>
>
>  Best regards,
>
>  Wojtek
>
>
>     
54 Went out today.