Changelog

   1 - Association polmatch MLS constraint making unlabeled_t an exception
   2   is no longer needed, patch from Venkat Yekkirala.
   3 - Context contains checking for PAM and cron from James Antill.
   4 - Add a reload target to Modules.devel and change the load
   5   target to only insert modules that were changed.
   6 - Allow semanage to read from /root on strict non-MLS for
   7   local policy modules.
   8 - Gentoo init script fixes for udev.
   9 - Allow udev to read kernel modules.inputmap.
  10 - Dnsmasq fixes from testing.
  11 - Allow kernel NFS server to getattr filesystems so df can work
  12   on clients.
  13 - Patch from Matt Anderson for a MLS constraint exemption on a
  14   file that can be written to from a subject whose range is
  15   within the object's range.
  16 - Enhanced setransd support from Darrel Goeddel.
  17 - Patches from Dan Walsh:
  18         Tue, 24 Oct 2006
  19 - Added modules:
  20         aide (Matt Anderson)
  21         ccs (Dan Walsh)
  22         iscsi (Dan Walsh)
  23         ricci (Dan Walsh)
  24
  25 * Wed Oct 18 2006 Chris PeBenito <selinux@tresys.com> - 20061018
  26 - Patch from Russell Coker Thu, 5 Oct 2006
  27 - Move range transitions to modules.
  28 - Make number of MLS sensitivities, and number of MLS and MCS
  29   categories configurable as build options.
  30 - Add role infrastructure.
  31 - Debian updates from Erich Schubert.
  32 - Add nscd_socket_use() to auth_use_nsswitch().
  33 - Remove old selopt rules.
  34 - Full support for netfilter_contexts.
  35 - MRTG patch for daemon operation from Stefan.
  36 - Add authlogin interface to abstract common access for login programs.
  37 - Remove setbool auditallow, except for RHEL4.
  38 - Change eventpollfs to task SID labeling.
  39 - Add key support from Michael LeMay.
  40 - Add ftpdctl domain to ftp, from Paul Howarth.
  41 - Fix build system to not move type declarations out of optionals.
  42 - Add gcc-config domain to portage.
  43 - Add packet object class and support in corenetwork.
  44 - Add a copy of genhomedircon for monolithic policy building, so that a
  45   policycoreutils package update is not required for RHEL4 systems.
  46 - Add appletalk sockets for use in cups.
  47 - Add Make target to validate module linking.
  48 - Make duplicate template and interface declarations a fatal error.
  49 - Patch to stabilize modules.conf `make conf` output, from Erich Schubert.
  50 - Move xconsole_device_t from devices to xserver since it is
  51   not actually a device, it is a named pipe.
  52 - Handle nonexistant .fc and .if files in devel Makefile by
  53   automatically creating empty files.
  54 - Remove unused devfs_control_t.
  55 - Add rhel4 distro, which also implies redhat distro.
  56 - Remove unneeded range_transition for su_exec_t and move the
  57   type declaration back to the su module.
  58 - Constrain transitions in MCS so unconfined_t cannot have
  59   arbitrary category sets.
  60 - Change reiserfs from xattr filesystem to genfscon as it's xattrs
  61   are currently nonfunctional.
  62 - Change files and filesystem modules to use their own interfaces.
  63 - Add user fonts to xserver.
  64 - Additional interfaces in corecommands, miscfiles, and userdomain
  65   from Joy Latten.
  66 - Miscellaneous fixes from Thomas Bleher.
  67 - Deprecate module name as first parameter of optional_policy()
  68   now that optionals are allowed everywhere.
  69 - Enable optional blocks in base module and monolithic policy.
  70   This requires checkpolicy 1.30.1.
  71 - Fix vpn module declaration.
  72 - Numerous fixes from Dan Walsh.
  73 - Change build order to preserve m4 line number information so policy
  74   compile errors are useful again.
  75 - Additional MLS interfaces from Chad Hanson.
  76 - Move some rules out of domain_type() and domain_base_type()
  77   to the TE file, to use the domain attribute to take advantage
  78   of space savings from attribute use.
  79 - Add global stack smashing protector rule for urandom access from
  80   Petre Rodan.
  81 - Fix temporary rules at the bottom of portmap.
  82 - Updated comments in mls file from Chad Hanson.
  83 - Patches from Dan Walsh:
  84         Fri, 17 Mar 2006
  85         Wed, 29 Mar 2006
  86         Tue, 11 Apr 2006
  87         Fri, 14 Apr 2006
  88         Tue, 18 Apr 2006
  89         Thu, 20 Apr 2006
  90         Tue, 02 May 2006
  91         Mon, 15 May 2006
  92         Thu, 18 May 2006
  93         Tue, 06 Jun 2006
  94         Mon, 12 Jun 2006
  95         Tue, 20 Jun 2006
  96         Wed, 26 Jul 2006
  97         Wed, 23 Aug 2006
  98         Thu, 31 Aug 2006
  99         Fri, 01 Sep 2006
 100         Tue, 05 Sep 2006
 101         Wed, 20 Sep 2006
 102         Fri, 22 Sep 2006
 103         Mon, 25 Sep 2006
 104 - Added modules:
 105         afs
 106         amavis (Erich Schubert)
 107         apt (Erich Schubert)
 108         asterisk
 109         audioentropy
 110         authbind
 111         backup
 112         calamaris
 113         cipe
 114         clamav (Erich Schubert)
 115         clockspeed (Petre Rodan)
 116         courier
 117         dante
 118         dcc
 119         ddclient
 120         dpkg (Erich Schubert)
 121         dnsmasq
 122         ethereal
 123         evolution
 124         games
 125         gatekeeper
 126         gift
 127         gnome (James Carter)
 128         imaze
 129         ircd
 130         jabber
 131         monop
 132         mozilla
 133         mplayer
 134         munin
 135         nagios
 136         nessus
 137         netlabel (Paul Moore)
 138         nsd
 139         ntop
 140         nx
 141         oav
 142         oddjob (Dan Walsh)
 143         openca
 144         openvpn (Petre Rodan)
 145         perdition
 146         portslave
 147         postgrey
 148         pxe
 149         pyzor (Dan Walsh)
 150         qmail (Petre Rodan)
 151         razor
 152         resmgr
 153         rhgb
 154         rssh
 155         snort
 156         soundserver
 157         speedtouch
 158         sxid
 159         thunderbird
 160         tor (Erich Schubert)
 161         transproxy
 162         tripwire
 163         uptime
 164         uwimap
 165         vmware
 166         watchdog
 167         xen (Dan Walsh)
 168         xprint
 169         yam
 170
 171 * Tue Mar 07 2006 Chris PeBenito <selinux@tresys.com> - 20060307
 172 - Make all interface parameters required.
 173 - Move boot_t, system_map_t, and modules_object_t to files module,
 174   and move bootloader to admin layer.
 175 - Add semanage policy for semodule from Dan Walsh.
 176 - Remove allow_execmem from targeted policy domain_base_type().
 177 - Add users_extra and seusers support.
 178 - Postfix fixes from Serge Hallyn.
 179 - Run python and shell directly to interpret scripts so policy
 180   sources need not be executable.
 181 - Add desc tag XML to booleans and tunables, and add summary
 182   to param XML tag, to make future translations possible.
 183 - Remove unused lvm_vg_t.
 184 - Many interface renames to improve naming consistency.
 185 - Merge xdm into xserver.
 186 - Remove kernel module reversed interfaces.
 187 - Add filename attribute to module XML tag and lineno attribute to
 188   interface XML tag.
 189 - Changed QUIET build option to a yes or no option.
 190 - Add a Makefile used for compiling loadable modules in a
 191   user's development environment, building against policy headers.
 192 - Add Make target for installing policy headers.
 193 - Separate per-userdomain template expansion from the userdomain
 194   module and add infrastructure to expand templates in the modules
 195   that own the template.
 196 - Enable secadm only for MLS policies.
 197 - Remove role change rules in su and sudo since this functionality has been
 198   removed from these programs.
 199 - Add ctags Make target from Thomas Bleher.
 200 - Collapse commands with grep piped to sed into one sed command.
 201 - Fix type_change bug in term_user_pty().
 202 - Move ice_tmp_t from miscfiles to xserver.
 203 - Login fixes from Serge Hallyn.
 204 - Move xserver_log_t from xdm to xserver.
 205 - Add lpr per-userdomain policy to lpd.
 206 - Miscellaneous fixes from Dan Walsh.
 207 - Change initrc_var_run_t interface noun from script_pid to utmp,
 208   for greater clarity.
 209 - Added modules:
 210         certwatch
 211         mono (Dan Walsh)
 212         mrtg
 213         portage
 214         tvtime
 215         userhelper
 216         usernetctl
 217         wine (Dan Walsh)
 218         xserver
 219
 220 * Tue Jan 17 2006 Chris PeBenito <selinux@tresys.com> - 20060117
 221 - Adds support for generating corenetwork interfaces based on attributes
 222   in addition to types.
 223 - Permits the listing of multiple nodes in a network_node() that will be
 224   given the same type.
 225 - Add two new permission sets for stream sockets.
 226 - Rename file type transition interfaces verb from create to
 227   filetrans to differentiate it from create interfaces without
 228   type transitions.
 229 - Fix expansion of interfaces from disabled modules.
 230 - Rsync can be long running from init,
 231   added rules to allow this.
 232 - Add polyinstantiation build option.
 233 - Add setcontext to the association object class.
 234 - Add apache relay and db connect tunables.
 235 - Rename texrel_shlib_t to textrel_shlib_t.
 236 - Add swat to samba module.
 237 - Numerous miscellaneous fixes from Dan Walsh.
 238 - Added modules:
 239         alsa
 240         automount
 241         cdrecord
 242         daemontools (Petre Rodan)
 243         ddcprobe
 244         djbdns (Petre Rodan)
 245         fetchmail
 246         irc
 247         java
 248         lockdev
 249         logwatch (Dan Walsh)
 250         openct
 251         prelink (Dan Walsh)
 252         publicfile (Petre Rodan)
 253         readahead
 254         roundup
 255         screen
 256         slocate (Dan Walsh)
 257         slrnpull
 258         smartmon
 259         sysstat
 260         ucspitcp (Petre Rodan)
 261         usbmodules
 262         vbetool (Dan Walsh)
 263
 264 * Wed Dec 07 2005 Chris PeBenito <selinux@tresys.com> - 20051207
 265 - Add unlabeled IPSEC association rule to domains with
 266   networking permissions.
 267 - Merge systemuser back in to users, as these files
 268   do not need to be split.
 269 - Add check for duplicate interface/template definitions.
 270 - Move domain, files, and corecommands modules to kernel
 271   layer to resolve some layering inconsistencies.
 272 - Move policy build options out of Makefile into build.conf.
 273 - Add yppasswd to nis module.
 274 - Change optional_policy() to refer to the module name
 275   rather than modulename.te.
 276 - Fix labeling targets to use installed file_contexts rather
 277   than partial file_contexts in the policy source directory.
 278 - Fix build process to use make's internal vpath functions
 279   to detect modules rather than using subshells and find.
 280 - Add install target for modular policy.
 281 - Add load target for modular policy.
 282 - Add appconfig dependency to the load target.
 283 - Miscellaneous fixes from Dan Walsh.
 284 - Fix corenetwork gen_context()'s to expand during the policy
 285   build phase instead of during the generation phase.
 286 - Added policies:
 287         amanda
 288         avahi
 289         canna
 290         cyrus
 291         dbskk
 292         dovecot
 293         distcc
 294         i18n_input
 295         irqbalance
 296         lpd
 297         networkmanager
 298         pegasus
 299         postfix
 300         procmail
 301         radius
 302         rdisc
 303         rpc
 304         spamassassin
 305         timidity
 306         xdm
 307         xfs
 308
 309 * Wed Oct 19 2005 Chris PeBenito <selinux@tresys.com> - 20051019
 310 - Many fixes to make loadable modules build.
 311 - Add targets for sechecker.
 312 - Updated to sedoctool to read bool files and tunable
 313   files separately.
 314 - Changed the xml tag of <boolean> to <bool> to be consistent
 315   with gen_bool().
 316 - Modified the implementation of segenxml to use regular
 317   expressions.
 318 - Rename context_template() to gen_context() to clarify
 319   that its not a Reference Policy template, but a support
 320   macro.
 321 - Add disable_*_trans bool support for targeted policy.
 322 - Add MLS module to handle MLS constraint exceptions,
 323   such as reading up and writing down.
 324 - Fix errors uncovered by sediff.
 325 - Added policies:
 326         anaconda
 327         apache
 328         apm
 329         arpwatch
 330         bluetooth
 331         dmidecode
 332         finger
 333         ftp
 334         kudzu
 335         mailman
 336         ppp
 337         radvd
 338         sasl
 339         webalizer
 340
 341 * Thu Sep 22 2005 Chris PeBenito <selinux@tresys.com> - 20050922
 342 - Make logrotate, sendmail, sshd, and rpm policies
 343   unconfined in the targeted policy so no special
 344   modules.conf is required.
 345 - Add experimental MCS support.
 346 - Add appconfig for MLS.
 347 - Add equivalents for old can_resolve(), can_ldap(), and
 348   can_portmap() to sysnetwork.
 349 - Fix base module compile issues.
 350 - Added policies:
 351         cpucontrol
 352         cvs
 353         ktalk
 354         portmap
 355         postgresql
 356         rlogin
 357         samba
 358         snmp
 359         stunnel
 360         telnet
 361         tftp
 362         uucp
 363         vpn
 364         zebra
 365
 366 * Wed Sep 07 2005 Chris PeBenito <selinux@tresys.com> - 20050907
 367 - Fix errors uncovered by sediff.
 368 - Doc tool will explicitly say a module does not have interfaces
 369   or templates on the module page.
 370 - Added policies:
 371         comsat
 372         dbus
 373         dhcp
 374         dictd
 375         hal
 376         inn
 377         ntp
 378         squid
 379
 380 * Fri Aug 26 2005 Chris PeBenito <selinux@tresys.com> - 20050826
 381 - Add Makefile support for building loadable modules.
 382 - Add genclassperms.py tool to add require blocks
 383   for loadable modules.
 384 - Change sedoctool to make required modules part of base
 385   by default, otherwise make as modules, in modules.conf.
 386 - Fix segenxml to handle modules with no interfaces.
 387 - Rename ipsec connect interface for consistency.
 388 - Add missing parts of unix stream socket connect interface
 389   of ipsec.
 390 - Rename inetd connect interface for consistency.
 391 - Rename interface for purging contents of tmp, for clarity,
 392   since it allows deletion of classes other than file.
 393 - Misc. cleanups.
 394 - Added policies:
 395         acct
 396         bind
 397         firstboot
 398         gpm
 399         howl
 400         ldap
 401         loadkeys
 402         mysql
 403         privoxy
 404         quota
 405         rshd
 406         rsync
 407         su
 408         sudo
 409         tcpd
 410         tmpreaper
 411         updfstab
 412
 413 * Tue Aug 2 2005 Chris PeBenito <selinux@tresys.com> - 20050802
 414 - Fix comparison bug in fc_sort.
 415 - Fix handling of ordered and unordered HTML lists.
 416 - Corenetwork now supports multiple network interfaces having the
 417   same type.
 418 - Doc tool now creates pages for global Booleans and global tunables.
 419 - Doc tool now links directly to the interface/template in the
 420   module page when it is selected in the interface/template index.
 421 - Added support for layer summaries.
 422 - Added policies:
 423         ipsec
 424         nscd
 425         pcmcia
 426         raid
 427
 428 * Thu Jul 7 2005 Chris PeBenito <selinux@tresys.com> - 20050707
 429 - Changed xml to have modules encapsulated by layer tags, rather
 430   than putting layer="foo" in the module tags.  Also in the future
 431   we can put a summary and description for each layer.
 432 - Added tool to infer interface, module, and layer tags.  This will
 433   now list all interfaces, even if they are missing xml docs.
 434 - Shortened xml tag names.
 435 - Added macros to declare interfaces and templates.
 436 - Added interface call trace.
 437 - Updated all xml documentation for shorter and inferred tags.
 438 - Doc tool now displays templates in the web pages.
 439 - Doc tool retains the user's settings in modules.conf and
 440   tunables.conf if the files already exist.
 441 - Modules.conf behavior has been changed to be a list of all
 442   available modules, and the user can specify if the module is
 443   built as a loadable module, included in the monolithic policy,
 444   or excluded.
 445 - Added policies:
 446         fstools (fsck, mkfs, swapon, etc. tools)
 447         logrotate
 448         inetd
 449         kerberos
 450         nis (ypbind and ypserv)
 451         ssh (server, client, and agent)
 452         unconfined
 453 - Added infrastructure for targeted policy support, only missing
 454         transition boolean support.
 455
 456 * Wed Jun 15 2005 Chris PeBenito <selinux@tresys.com> - 20050615
 457         - Initial release