Fedora 15 Update: selinux-policy-3.9.16-48.fc15

updates at fedoraproject.org updates at fedoraproject.org
Sun Dec 4 02:38:41 UTC 2011 

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-16023
2011-11-17 22:46:55
--------------------------------------------------------------------------------

Name        : selinux-policy
Product     : Fedora 15
Version     : 3.9.16
Release     : 48.fc15
URL         : http://oss.tresys.com/repos/refpolicy/
Summary     : SELinux policy configuration
Description :
SELinux Reference Policy - modular.
Based off of reference policy: Checked out revision  2.20091117

--------------------------------------------------------------------------------
Update Information:

- Allow spamd and clamd to steam connect to each other
- Allow colord to execute ifconfig
- Allow smbcontrol to signal themselves
- Make faillog MLS trusted to make sudo_$1_t working
--------------------------------------------------------------------------------
ChangeLog:

* Wed Nov 16 2011 Miroslav Grepl <mgrepl at redhat.com> 3.9.16-48
- Fix typo in ssh.if
* Wed Nov 16 2011 Miroslav Grepl <mgrepl at redhat.com> 3.9.16-47
- Allow spamd and clamd to steam connect to each other
- Allow colord to execute ifconfig
- Allow smbcontrol to signal themselves
- Make faillog MLS trusted to make sudo_$1_t working
* Mon Nov  7 2011 Miroslav Grepl <mgrepl at redhat.com> 3.9.16-46
- Backport MCS fixes from F16
- Other chrome fixes from F16
* Wed Oct 26 2011 Miroslav Grepl <mgrepl at redhat.com> 3.9.16-45
- Backport chrome fixes
- Backport cloudform policy
* Fri Oct 21 2011 Miroslav Grepl <mgrepl at redhat.com> 3.9.16-44
- Fixes for systemd
- Add FIPS suppport for dirsrv
* Tue Oct 11 2011 Miroslav Grepl <mgrepl at redhat.com> 3.9.16-43
- Allow sa-update to update rules
- Allow sa-update to read spamd tmp file
- Allow screen to read all domain state
- Allow  sa-update to execute shell
- More fixes for sa-update running out of cron job
- Allow initrc to manage cron system spool
- Fixes for collectd policy
- Fixes added during clean up bugzillas
- Dontaudit fail2ban_client_t sys_tty_config capability
- Fix for puppet which does execute check on passwd
- ricci_modservice send syslog msgs
- Fix dev_dontaudit_write_mtrr() interface
* Tue Sep 27 2011 Miroslav Grepl <mgrepl at redhat.com> 3.9.16-42
- Make mta_role() active
- Add additional gitweb file context labeling
- Allow asterisk to connect to jabber client port
- Allow sssd  to read the contents of /sys/class/net/$IFACE_NAME
- Allow fsdaemon dac_override
* Thu Sep 22 2011 Miroslav Grepl <mgrepl at redhat.com> 3.9.16-41
- Add logging_syslogd_can_sendmail boolean
- Add support for exim and confined users
- support for ommail module to send logs via mail
- Add execmem_execmod() to execmem role
- Allow pptp to send generic signal to kernel threads
- Fix kerberos_manage_host_rcache() interface
* Mon Sep 12 2011 Miroslav Grepl <mgrepl at redhat.com> 3.9.16-40
- Fixes for mock
* Tue Sep  6 2011 Miroslav Grepl <mgrepl at redhat.com> 3.9.16-39
- Backport F16 fixes
- livecd fixes
- systemd fixes
* Thu Aug 11 2011 Miroslav Grepl <mgrepl at redhat.com> 3.9.16-38
- Allow hostname read network state
- Allow syslog to manage all log files
- Add use_fusefs_home_dirs boolean for chrome
- Make vdagent working with confined users
- Fix syslog port definition
- Allow openvpn to set its process priority when the nice parameter is used
- Restorecond should be able to watch and relabel devices in /dev
- Alow hddtemp to perform DNS name resolution
* Fri Aug  5 2011 Miroslav Grepl <mgrepl at redhat.com> 3.9.16-37
- Fixes for zarafa, postfix policy
- Backport collect policy
* Wed Jul 27 2011 Miroslav Grepl <mgrepl at redhat.com> 3.9.16-36
- Backport ABRT changes
- Make tmux working with scree policy
- Allow root cron jobs can't run without unconfined
- add interface to dontaudit writes to urand, needed by libra
- Add label for /var/cache/krb5rcache directory
* Wed Jul 20 2011 Miroslav Grepl <mgrepl at redhat.com> 3.9.16-35
- Allow jabberd_router_t to read system state
- Rename oracledb_port to oracle_port
- Allow rgmanager executes init script files in initrc_t domain which ensure proper transitions
- screen wants to manage sock file in screen home dirs
- Make screen working with confined users
- Allow gssd to search access on the directory /proc/fs/nfsd
* Fri Jul 15 2011 Miroslav Grepl <mgrepl at redhat.com> 3.9.16-34
- More fixes for postfix policy
- Allow virsh_t setsched
- Add mcelog_log_t type for mcelog log file
- Add virt_ptynode attribute
* Mon Jul 11 2011 Miroslav Grepl <mgrepl at redhat.com> 3.9.16-33
- Add l2tpd policy
- Fixes for abrt
- Backport fail2ban_client policy
* Fri Jul  1 2011 Miroslav Grepl <mgrepl at redhat.com> 3.9.16-32
- Allow getcap, setcap for syslogd
- Fix label for /usr/lib64/opera/opera
* Thu Jun 30 2011 Miroslav Grepl <mgrepl at redhat.com> 3.9.16-31
- Make mozilla_plugin_tmpfs_t as userdom_user_tmpfs_content()
- Allow init to delete all pid sockets
- Allow colord to read /proc/stat
- Add label for /var/www/html/wordpress/wp-content/plugins directory
- Allow pppd to search /var/lock dir
- puppetmaster use nsswitch: #711804
- Update abrt to match rawhide policy
- allow privoxy to read network data
- support gecko mozilla browser plugin
- Allow chrome_sandbox to execute content in nfs homedir
- postfix_qmgr needs to read /var/spool/postfix/deferred
- abrt_t needs fsetid
* Tue Jun 14 2011 Miroslav Grepl <mgrepl at redhat.com> 3.9.16-30
- Fixes for zarafa policy
- Other fixes for fail2ban
- Allow keyring to drop capabilities
- Allow cobblerd to send syslog messages
- Allow xserver to read/write the xserver_misk device
- ppp also installs /var/log/ppp and /var/run/ppp directories
   * remove filetrans rules
- fix for pppd_lock
- Allow fail2ban run ldconfig
- Allow lvm to read/write pipes inherited from login programs
* Fri Jun 10 2011 Miroslav Grepl <mgrepl at redhat.com> 3.9.16-29
- Fix /var/lock labeling issue
* Mon Jun  6 2011 Miroslav Grepl <mgrepl at redhat.com> 3.9.16-28
- Allow ssh to execute systemctl
- fail2ban fixes related to /tmp directory
- Allow puppetmaster to create dirs in /var/run/puppet
* Thu Jun  2 2011 Miroslav Grepl <mgrepl at redhat.com> 3.9.16-27
- Add label for /var/lock/ppp
- Fixes for colord policy
- Allow sys_chroot for postfix domains
* Fri May 27 2011 Miroslav Grepl <mgrepl at redhat.com> 3.9.16-26
- Add label for dev/ati/card*
- Allowe secadm to manage selinux config files
* Thu May 26 2011 Miroslav Grepl <mgrepl at redhat.com> 3.9.16-25
- Add Dominicks patch for dccp_socket
- dnsmasq needs to read nm-dns-dnsmasq.conf in /var/run/
- Colord inherits open file descriptors from the users...'
- cgred needs auth_use_nsswitch()
- apcupsd lock file was missing file context specificatio...
- Make cron work
- Allow clamav to manage amavis spool files
- Use httpd_can_sendmail boolean also for httpd_suexec_t
- Add fenced_can_ssh boolean
- Add dev_dontaudit_read_generic_files() for hplip
- Allow xauthority to create shared memory
- Make postfix user domains application_domains
- Allow xend to sys_admin privs
- Allow mount to read usr files
- Allow logrotate to connect to init script using unix stream socket
- Allow nsplugin_t to getattr on gpmctl
* Tue May 17 2011 Miroslav Grepl <mgrepl at redhat.com> 3.9.16-24
- Allow logrotate to connect to init script using unix domain stream socket
- Allow shorewall read and write inherited user domain pty/tty
- virt will attempt to us another virtualizations pulsesaudio tmpfs_t, ignore error
- Allow colord to get the attributes of fixed disk device nodes
- Allow nsplugin_t to getattr on gpmctl
- Allow mozilla_plugin to connect to pcscd over an unix stream socket
- Allow logrotate to execute systemctl
- colord wants to read files in users homedir
- Remote login should create user_tmp_t content not its own tmp files
- Allow psad signal
- Fix cobbler_read_lib_files interface
- Allow rlogind to r/w user terminals
- Allow prelink_cron_system_t to relabel content and ignore obj_id
- Allow gnomeclock_systemctl_t to list init_var_run_t
- Dbus domains will inherit fds from the init system
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #705279 - SELinux is preventing /usr/bin/who from 'read' accesses on the file utmp.
        https://bugzilla.redhat.com/show_bug.cgi?id=705279
  [ 2 ] Bug #711804 - puppet: Could not find a default provider for user
        https://bugzilla.redhat.com/show_bug.cgi?id=711804
  [ 3 ] Bug #713377 - SELinux is preventing /bin/bash from using the 'dac_override' capabilities.
        https://bugzilla.redhat.com/show_bug.cgi?id=713377
  [ 4 ] Bug #720505 - proftpd and cgroups
        https://bugzilla.redhat.com/show_bug.cgi?id=720505
  [ 5 ] Bug #726899 - A user_u (SELinux) user can't log into XFCE4
        https://bugzilla.redhat.com/show_bug.cgi?id=726899
  [ 6 ] Bug #728405 - Can't rotate audit logs with logrotate
        https://bugzilla.redhat.com/show_bug.cgi?id=728405
  [ 7 ] Bug #730179 - SELinux is preventing /opt/google/chrome/chrome from execmod access on the file /opt/google/chrome/chrome.
        https://bugzilla.redhat.com/show_bug.cgi?id=730179
  [ 8 ] Bug #730624 - mailman AVCs with unconfined disabled.
        https://bugzilla.redhat.com/show_bug.cgi?id=730624
  [ 9 ] Bug #731116 - SELinux is preventing /usr/bin/abrt-action-save-package-data from 'read' accesses on the file unix.
        https://bugzilla.redhat.com/show_bug.cgi?id=731116
  [ 10 ] Bug #731382 - SELinux is preventing /bin/mkdir from 'write' accesses on the directory /dev.
        https://bugzilla.redhat.com/show_bug.cgi?id=731382
  [ 11 ] Bug #732224 - AVC problems with spamassassin's nightly update run with unconfined off
        https://bugzilla.redhat.com/show_bug.cgi?id=732224
  [ 12 ] Bug #733830 - SELinux is preventing /usr/sbin/brctl from using the 'sys_module' capabilities.
        https://bugzilla.redhat.com/show_bug.cgi?id=733830
  [ 13 ] Bug #734281 - SELinux is preventing /usr/bin/qemu-kvm from 'write' accesses on the arquivo /home/cesarb/.libvirt/qemu/log/FreeDOS.log.
        https://bugzilla.redhat.com/show_bug.cgi?id=734281
  [ 14 ] Bug #735877 - sudo crontab -e -u breaks the crontab file perms
        https://bugzilla.redhat.com/show_bug.cgi?id=735877
  [ 15 ] Bug #736049 - SELinux is preventing /usr/sbin/saslauthd from 'ioctl' accesses on the file /proc/fs/openafs/afs_ioctl.
        https://bugzilla.redhat.com/show_bug.cgi?id=736049
  [ 16 ] Bug #736719 - SELinux is preventing /usr/libexec/postfix/bounce from 'search' accesses on the directory /var/spool/postfix/defer.
        https://bugzilla.redhat.com/show_bug.cgi?id=736719
  [ 17 ] Bug #737476 - SELinux is preventing /bin/systemd-tmpfiles from 'read' accesses on the directory isolinux.
        https://bugzilla.redhat.com/show_bug.cgi?id=737476
  [ 18 ] Bug #737802 - SELinux is preventing /usr/sbin/collectd from 'getattr' accesses on the filesystem /dev/mqueue.
        https://bugzilla.redhat.com/show_bug.cgi?id=737802
  [ 19 ] Bug #737803 - SELinux is preventing /usr/sbin/collectd from 'read' accesses on the lnk_file hwmon0.
        https://bugzilla.redhat.com/show_bug.cgi?id=737803
  [ 20 ] Bug #737909 - SELinux is preventing /usr/libexec/postfix/bounce from 'lock' accesses on the file /var/spool/postfix/defer/8/81D4FE0DF0.
        https://bugzilla.redhat.com/show_bug.cgi?id=737909
  [ 21 ] Bug #738118 - something wrong with exim + selinux + no unconfined
        https://bugzilla.redhat.com/show_bug.cgi?id=738118
  [ 22 ] Bug #739346 - SELinux is preventing /usr/sbin/pptp from using the 'signal' accesses on a process.
        https://bugzilla.redhat.com/show_bug.cgi?id=739346
  [ 23 ] Bug #739647 - No support for gitweb-caching package
        https://bugzilla.redhat.com/show_bug.cgi?id=739647
  [ 24 ] Bug #740150 - More mail (mailman, procmail) woes with unconfined disabled
        https://bugzilla.redhat.com/show_bug.cgi?id=740150
  [ 25 ] Bug #740274 - SELinux is preventing /usr/libexec/postfix/bounce from 'write' accesses on the directory /var/spool/postfix/defer/A.
        https://bugzilla.redhat.com/show_bug.cgi?id=740274
  [ 26 ] Bug #740462 - More tmux + unconfined issues
        https://bugzilla.redhat.com/show_bug.cgi?id=740462
  [ 27 ] Bug #740534 - SELinux is preventing /usr/sbin/sssd from 'read' accesses on the lnk_file tun0.
        https://bugzilla.redhat.com/show_bug.cgi?id=740534
  [ 28 ] Bug #740905 - SELinux is preventing /usr/sbin/asterisk from 'name_connect' accesses on the tcp_socket port 5222.
        https://bugzilla.redhat.com/show_bug.cgi?id=740905
  [ 29 ] Bug #741082 - sendmail, selinux, unconfined, restricted users
        https://bugzilla.redhat.com/show_bug.cgi?id=741082
  [ 30 ] Bug #741493 - SELinux is preventing /opt/google/chrome/chrome from 'execute' accesses on the file /opt/google/chrome/nacl_helper_bootstrap.
        https://bugzilla.redhat.com/show_bug.cgi?id=741493
  [ 31 ] Bug #741893 - SELinux is preventing /opt/google/chrome/chrome from 'execute_no_trans' accesses on the file /opt/google/chrome/nacl_helper_bootstrap.
        https://bugzilla.redhat.com/show_bug.cgi?id=741893
  [ 32 ] Bug #742213 - Error between postfix's local and ddclient cache directory
        https://bugzilla.redhat.com/show_bug.cgi?id=742213
  [ 33 ] Bug #742625 - SELinux is preventing sh from 'execute_no_trans' accesses on the plik /bin/ls.
        https://bugzilla.redhat.com/show_bug.cgi?id=742625
  [ 34 ] Bug #744379 - SELinux is preventing /usr/bin/gpg from 'read' accesses on the file .spamassassin6872XIpEnbtmp.
        https://bugzilla.redhat.com/show_bug.cgi?id=744379
  [ 35 ] Bug #744514 - SELinux is preventing /bin/bash from 'getattr' accesses on the file /bin/bash.
        https://bugzilla.redhat.com/show_bug.cgi?id=744514
  [ 36 ] Bug #744515 - SELinux is preventing /bin/bash from 'getattr' accesses on the file /proc/meminfo.
        https://bugzilla.redhat.com/show_bug.cgi?id=744515
  [ 37 ] Bug #744517 - SELinux is preventing /usr/bin/perl from 'name_connect' accesses on the tcp_socket port 80.
        https://bugzilla.redhat.com/show_bug.cgi?id=744517
  [ 38 ] Bug #744959 - SELinux is preventing /sbin/iscsid from 'link' accesses on the file lock.
        https://bugzilla.redhat.com/show_bug.cgi?id=744959
  [ 39 ] Bug #746127 - SELinux is preventing fail2ban from using shorewall for actions
        https://bugzilla.redhat.com/show_bug.cgi?id=746127
  [ 40 ] Bug #746524 - SELinux is preventing /usr/lib/chromium-browser/chromium-browser from execmod access on the fichier /usr/lib/chromium-browser/chromium-browser
        https://bugzilla.redhat.com/show_bug.cgi?id=746524
  [ 41 ] Bug #746763 - SELinux is preventing /usr/libexec/accounts-daemon from 'read' accesses on the file /var/log/wtmp.
        https://bugzilla.redhat.com/show_bug.cgi?id=746763
  [ 42 ] Bug #747933 - SELinux is preventing /usr/bin/perl from 'read' accesses on the directory /var/log/varnish.
        https://bugzilla.redhat.com/show_bug.cgi?id=747933
  [ 43 ] Bug #749111 - SELinux is preventing nacl_helper_boo from 'mmap_zero' accesses on the memprotect Unknown.
        https://bugzilla.redhat.com/show_bug.cgi?id=749111
  [ 44 ] Bug #749602 - SELinux is preventing nacl_helper_boo from using the 'share' accesses on a process.
        https://bugzilla.redhat.com/show_bug.cgi?id=749602
  [ 45 ] Bug #749644 - SELinux is preventing /opt/google/chrome/chrome from 'execmod' accesses on the file /opt/google/chrome/libffmpegsumo.so.
        https://bugzilla.redhat.com/show_bug.cgi?id=749644
  [ 46 ] Bug #749738 - SELinux is preventing /usr/sbin/slapd from 'write' accesses on the directory /var/cache/coolkey.
        https://bugzilla.redhat.com/show_bug.cgi?id=749738
  [ 47 ] Bug #749780 - SELinux is preventing /usr/lib/nspluginwrapper/npviewer.bin from 'execmod' accesses on the file /usr/lib/flash-plugin/libflashplayer.so.
        https://bugzilla.redhat.com/show_bug.cgi?id=749780
  [ 48 ] Bug #749829 - SELinux is preventing plymouthd from 'search' accesses on the directory 1277.
        https://bugzilla.redhat.com/show_bug.cgi?id=749829
  [ 49 ] Bug #749905 - SELinux is preventing /opt/google/chrome/nacl_helper_bootstrap from 'execute_no_trans' accesses on the file /opt/google/chrome/nacl_helper_bootstrap.
        https://bugzilla.redhat.com/show_bug.cgi?id=749905
  [ 50 ] Bug #749967 - SELinux is preventing /usr/sbin/pptp from 'read' accesses on the file unix.
        https://bugzilla.redhat.com/show_bug.cgi?id=749967
  [ 51 ] Bug #750429 - SELinux is preventing /usr/bin/tor from 'read' accesses on the directory cpu.
        https://bugzilla.redhat.com/show_bug.cgi?id=750429
  [ 52 ] Bug #751245 - SELinux is preventing /usr/libexec/gnome-session-check-accelerated-helper from 'execmod' accesses on the file /usr/lib/dri/fglrx_dri.so.
        https://bugzilla.redhat.com/show_bug.cgi?id=751245
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use 
su -c 'yum update selinux-policy' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------

More information about the package-announce mailing list