Changelog

   1 - Fix httpd_enable_homedirs to actually provide the access it is supposed to
   2   provide.
   3 - Add unused interface/template parameter metadata in XML.
   4 - Patch to handle postfix data_directory from Vaclav Ovsik.
   5 - SE-Postgresql policy from KaiGai Kohei.
   6 - Patch for X.org dbus support from Martin Orr.
   7 - Patch for labeled networking controls in 2.6.25 from Paul Moore.
   8 - Module loading now requires setsched on kernel threads.
   9 - Patch to allow gpg agent --write-env-file option from Vaclav Ovsik.
  10 - X application data class from Eamon Walsh and Ted Toth.
  11 - Move user roles into individual modules.
  12 - Make hald_log_t a log file.
  13 - Cryptsetup runs shell scripts.  Patch from Martin Orr.
  14 - Add file for enabling policy capabilities.
  15 - Patch to fix leaky interface/template call depth calculator from Vaclav
  16   Ovsik.
  17 - Added modules:
  18         kerneloops (Dan Walsh)
  19         kismet (Dan Walsh)
  20         podsleuth (Dan Walsh)
  21         prelude (Dan Walsh)
  22         qemu (Dan Walsh)
  23         virt (Dan Walsh)
  24
  25 * Wed Apr 02 2008 Chris PeBenito <selinux@tresys.com> - 20080402
  26 - Add core Security Enhanced X Windows support.
  27 - Fix winbind socket connection interface for default location of the
  28   sock_file.
  29 - Add wireshark module based on ethereal module.
  30 - Revise upstart support in init module to use a tunable, as upstart is now
  31   used in Fedora too.
  32 - Add iferror.m4 rather generate it out of the Makefiles.
  33 - Definitions for open permisson on file and similar objects from Eric
  34   Paris.
  35 - Apt updates for ptys and logs, from Martin Orr.
  36 - RPC update from Vaclav Ovsik.
  37 - Exim updates on Debian from Devin Carrawy.
  38 - Pam and samba updates from Stefan Schulze Frielinghaus.
  39 - Backup update on Debian from Vaclav Ovsik.
  40 - Cracklib update on Debian from Vaclav Ovsik.
  41 - Label /proc/kallsyms with system_map_t.
  42 - 64-bit capabilities from Stephen Smalley.
  43 - Labeled networking peer object class updates.
  44
  45 * Fri Dec 14 2007 Chris PeBenito <selinux@tresys.com> - 20071214
  46 - Patch for debian logrotate to handle syslogd-listfiles, from Vaclav Ovsik.
  47 - Improve several tunables descriptions from Dan Walsh.
  48 - Patch to clean up ns switch usage in the policy from Dan Walsh.
  49 - More complete labeled networking infrastructure from KaiGai Kohei.
  50 - Add interface for libselinux constructor, for libselinux-linked
  51   SELinux-enabled programs.
  52 - Patch to restructure user role templates to create restricted user roles
  53   from Dan Walsh.
  54 - Russian man page translations from Andrey Markelov.
  55 - Remove unused types from dbus.
  56 - Add infrastructure for managing all user web content.
  57 - Deprecate some old file and dir permission set macros in favor of the
  58   newer, more consistently-named macros.
  59 - Patch to clean up unescaped periods in several file context entries from
  60   Jan-Frode Myklebust.
  61 - Merge shlib_t into lib_t.
  62 - Merge strict and targeted policies.  The policy will now behave like the
  63   strict policy if the unconfined module is not present.  If it is, it will
  64   behave like the targeted policy.  Added an unconfined role to have a mix
  65   of confined and unconfined users.
  66 - Added modules:
  67         exim (Dan Walsh)
  68         postfixpolicyd (Jan-Frode Myklebust)
  69
  70 * Fri Sep 28 2007 Chris PeBenito <selinux@tresys.com> - 20070928
  71 - Add support for setting the unknown permissions handling.
  72 - Fix XML building for external reference builds and headers builds.
  73 - Patch to add missing requirements in userdomain interfaces from Shintaro
  74   Fujiwara.
  75 - Add tcpd_wrapped_domain() for services that use tcp wrappers.
  76 - Update MLS constraints from LSPP evaluated policy.
  77 - Allow initrc_t file descriptors to be inherited regardless of MLS level.
  78   Accordingly drop MLS permissions from daemons that inherit from any level.
  79 - Files and radvd updates from Stefan Schulze Frielinghaus.
  80 - Deprecate mls_file_write_down() and mls_file_read_up(), replaced with
  81   mls_write_all_levels() and mls_read_all_levels(), for consistency.
  82 - Add make kernel and init ranged interfaces pass the range transition MLS
  83   constraints.  Also remove calls to mls_rangetrans_target() in modules that use
  84   the kernel and init interfaces, since its redundant.
  85 - Add interfaces for all MLS attributes except X object classes.
  86 - Require all sensitivities and categories for MLS and MCS policies, not just
  87   the low and high sensitivity and category.
  88 - Database userspace object manager classes from KaiGai Kohei.
  89 - Add third-party interface for Apache CGI.
  90 - Add getserv and shmemserv nscd permissions.
  91 - Add debian apcupsd binary location, from Stefan Schulze Frielinghaus.
  92 - Added modules:
  93         application
  94         awstats (Stefan Schulze Frielinghaus)
  95         bitlbee (Devin Carraway)
  96         brctl (Dan Walsh)
  97
  98 * Fri Jun 29 2007 Chris PeBenito <selinux@tresys.com> - 20070629
  99 - Fix incorrectly named files_lib_filetrans_shared_lib() interface in the
 100   libraries module.
 101 - Unified labeled networking policy from Paul Moore.
 102 - Use netmsg initial SID for MLS-only Netlabel packets, from Paul Moore.
 103 - Xen updates from Dan Walsh.
 104 - Filesystem updates from Dan Walsh.
 105 - Large samba update from Dan Walsh.
 106 - Drop snmpd_etc_t.
 107 - Confine sendmail and logrotate on targeted.
 108 - Tunable connection to postgresql for users from KaiGai Kohei.
 109 - Memprotect support patch from Stephen Smalley.
 110 - Add logging_send_audit_msgs() interface and deprecate
 111   send_audit_msgs_pattern().
 112 - Openct updates patch from Dan Walsh.
 113 - Merge restorecon into setfiles.
 114 - Patch to begin separating out hald helper programs from Dan Walsh.
 115 - Fixes for squid, dovecot, and snmp from Dan Walsh.
 116 - Miscellaneous consolekit fixes from Dan Walsh.
 117 - Patch to have avahi use the nsswitch interface rather than individual
 118   permissions from Dan Walsh.
 119 - Patch to dontaudit logrotate searching avahi pid directory from Dan Walsh.
 120 - Patch to allow insmod to mount kvmfs and dontaudit rw unconfined_t pipes
 121   to handle usage from userhelper from Dan Walsh.
 122 - Patch to allow amavis to read spamassassin libraries from Dan Walsh.
 123 - Patch to allow slocate to getattr other filesystems and directories on those
 124   filesystems from Dan Walsh.
 125 - Fixes for RHEL4 from the CLIP project.
 126 - Replace the old lrrd fc entries with munin ones.
 127 - Move program admin template usage out of userdom_admin_user_template() to
 128   sysadm policy in userdomain.te to fix usage of the template for third
 129   parties.
 130 - Fix clockspeed_run_cli() declaration, it was incorrectly defined as a
 131   template instead of an interface.
 132 - Added modules:
 133         amtu (Dan Walsh)
 134         apcupsd (Dan Walsh)
 135         rpcbind (Dan Walsh)
 136         rwho (Nalin Dahyabhai)
 137
 138 * Tue Apr 17 2007 Chris PeBenito <selinux@tresys.com> - 20070417
 139 - Patch for sasl's use of kerberos from Dan Walsh.
 140 - Patches to confine ldconfig, udev, and insmod in the targeted policy from Dan Walsh.
 141 - Man page updates from Dan Walsh.
 142 - Two patches from Paul Moore to for ipsec to remove redundant rules and
 143   have setkey read the config file.
 144 - Move booleans and tunables to modules when it is only used in a single
 145   module.
 146 - Add support for tunables and booleans local to a module.
 147 - Merge sbin_t and ls_exec_t into bin_t.
 148 - Remove disable_trans booleans.
 149 - Output different header sets for kernel and userland from flask headers.
 150 - Marked the pax class as deprecated, changed it to userland so
 151   it will be removed from the kernel.
 152 - Stop including netfilter contexts by default.
 153 - Add dontaudits for init fds and console to init_daemon_domain().
 154 - Patch to allow gpg to create user keys dir.
 155 - Patch to support kvmfs from Dan Walsh.
 156 - Patch for misc fixes in sudo from Dan Walsh.
 157 - Patch to fix netlabel recvfrom MLS constraint from Paul Moore.
 158 - Patch for handling restart of nscd when ran from useradd, groupadd, and
 159   admin passwd, from Dan Walsh.
 160 - Patch for procmail, spamassassin, and pyzor updates from Dan Walsh.
 161 - Patch for setroubleshoot for validating file contexts from Dan Walsh.
 162 - Patch for gssd fixes from Dan Walsh.
 163 - Patch for lvm fixes from Dan Walsh.
 164 - Patch for ricci fixes from Dan Walsh.
 165 - Patch for postfix lmtp labeling and pickup rule fix from Dan Walsh.
 166 - Patch for kerberized telnet fixes from Dan Walsh.
 167 - Patch for kerberized ftp and other ftp fixes from Dan Walsh.
 168 - Patch for an additional wine executable from Dan Walsh.
 169 - Eight patches for file contexts in games, wine, networkmanager, miscfiles,
 170   corecommands, devices, and java from Dan Walsh.
 171 - Add support for libselinux 2.0.5 init_selinuxmnt() changes.
 172 - Patch for misc fixes to bluetooth from Dan Walsh.
 173 - Patch for misc fixes to kerberos from Dan Walsh.
 174 - Patch to start deprecating usercanread attribute from Ryan Bradetich.
 175 - Add dccp_socket object class which was added in kernel 2.6.20.
 176 - Patch for prelink relabefrom it's temp files from Dan Walsh.
 177 - Patch for capability fix for auditd and networking fix for syslogd from
 178   Dan Walsh.
 179 - Patch to remove redundant mls_trusted_object() call from Dan Walsh.
 180 - Patch for misc fixes to nis ypxfr policy from Dan Walsh.
 181 - Patch to allow apmd to telinit from Dan Walsh.
 182 - Patch for additional labeling of samba files from Stefan Schulze
 183   Frielinghaus.
 184 - Patch to remove incorrect cron labeling in apache.fc from Ryan Bradetich.
 185 - Fix ptys and ttys to be device nodes.
 186 - Fix explicit use of httpd_t in openca_domtrans().
 187 - Clean up file context regexes in apache and java, from Eamon Walsh.
 188 - Patches from Dan Walsh:
 189         Thu, 25 Jan 2007
 190 - Added modules:
 191         consolekit (Dan Walsh)
 192         fail2ban (Dan Walsh)
 193         zabbix (Dan Walsh)
 194
 195 * Tue Dec 12 2006 Chris PeBenito <selinux@tresys.com> - 20061212
 196 - Add policy patterns support macros.  This changes the behavior of
 197   the create_dir_perms and create_file_perms permission sets.
 198 - Association polmatch MLS constraint making unlabeled_t an exception
 199   is no longer needed, patch from Venkat Yekkirala.
 200 - Context contains checking for PAM and cron from James Antill.
 201 - Add a reload target to Modules.devel and change the load
 202   target to only insert modules that were changed.
 203 - Allow semanage to read from /root on strict non-MLS for
 204   local policy modules.
 205 - Gentoo init script fixes for udev.
 206 - Allow udev to read kernel modules.inputmap.
 207 - Dnsmasq fixes from testing.
 208 - Allow kernel NFS server to getattr filesystems so df can work
 209   on clients.
 210 - Patch from Matt Anderson for a MLS constraint exemption on a
 211   file that can be written to from a subject whose range is
 212   within the object's range.
 213 - Enhanced setransd support from Darrel Goeddel.
 214 - Patches from Dan Walsh:
 215         Tue, 24 Oct 2006
 216         Wed, 29 Nov 2006
 217 - Added modules:
 218         aide (Matt Anderson)
 219         ccs (Dan Walsh)
 220         iscsi (Dan Walsh)
 221         ricci (Dan Walsh)
 222
 223 * Wed Oct 18 2006 Chris PeBenito <selinux@tresys.com> - 20061018
 224 - Patch from Russell Coker Thu, 5 Oct 2006
 225 - Move range transitions to modules.
 226 - Make number of MLS sensitivities, and number of MLS and MCS
 227   categories configurable as build options.
 228 - Add role infrastructure.
 229 - Debian updates from Erich Schubert.
 230 - Add nscd_socket_use() to auth_use_nsswitch().
 231 - Remove old selopt rules.
 232 - Full support for netfilter_contexts.
 233 - MRTG patch for daemon operation from Stefan.
 234 - Add authlogin interface to abstract common access for login programs.
 235 - Remove setbool auditallow, except for RHEL4.
 236 - Change eventpollfs to task SID labeling.
 237 - Add key support from Michael LeMay.
 238 - Add ftpdctl domain to ftp, from Paul Howarth.
 239 - Fix build system to not move type declarations out of optionals.
 240 - Add gcc-config domain to portage.
 241 - Add packet object class and support in corenetwork.
 242 - Add a copy of genhomedircon for monolithic policy building, so that a
 243   policycoreutils package update is not required for RHEL4 systems.
 244 - Add appletalk sockets for use in cups.
 245 - Add Make target to validate module linking.
 246 - Make duplicate template and interface declarations a fatal error.
 247 - Patch to stabilize modules.conf `make conf` output, from Erich Schubert.
 248 - Move xconsole_device_t from devices to xserver since it is
 249   not actually a device, it is a named pipe.
 250 - Handle nonexistant .fc and .if files in devel Makefile by
 251   automatically creating empty files.
 252 - Remove unused devfs_control_t.
 253 - Add rhel4 distro, which also implies redhat distro.
 254 - Remove unneeded range_transition for su_exec_t and move the
 255   type declaration back to the su module.
 256 - Constrain transitions in MCS so unconfined_t cannot have
 257   arbitrary category sets.
 258 - Change reiserfs from xattr filesystem to genfscon as it's xattrs
 259   are currently nonfunctional.
 260 - Change files and filesystem modules to use their own interfaces.
 261 - Add user fonts to xserver.
 262 - Additional interfaces in corecommands, miscfiles, and userdomain
 263   from Joy Latten.
 264 - Miscellaneous fixes from Thomas Bleher.
 265 - Deprecate module name as first parameter of optional_policy()
 266   now that optionals are allowed everywhere.
 267 - Enable optional blocks in base module and monolithic policy.
 268   This requires checkpolicy 1.30.1.
 269 - Fix vpn module declaration.
 270 - Numerous fixes from Dan Walsh.
 271 - Change build order to preserve m4 line number information so policy
 272   compile errors are useful again.
 273 - Additional MLS interfaces from Chad Hanson.
 274 - Move some rules out of domain_type() and domain_base_type()
 275   to the TE file, to use the domain attribute to take advantage
 276   of space savings from attribute use.
 277 - Add global stack smashing protector rule for urandom access from
 278   Petre Rodan.
 279 - Fix temporary rules at the bottom of portmap.
 280 - Updated comments in mls file from Chad Hanson.
 281 - Patches from Dan Walsh:
 282         Fri, 17 Mar 2006
 283         Wed, 29 Mar 2006
 284         Tue, 11 Apr 2006
 285         Fri, 14 Apr 2006
 286         Tue, 18 Apr 2006
 287         Thu, 20 Apr 2006
 288         Tue, 02 May 2006
 289         Mon, 15 May 2006
 290         Thu, 18 May 2006
 291         Tue, 06 Jun 2006
 292         Mon, 12 Jun 2006
 293         Tue, 20 Jun 2006
 294         Wed, 26 Jul 2006
 295         Wed, 23 Aug 2006
 296         Thu, 31 Aug 2006
 297         Fri, 01 Sep 2006
 298         Tue, 05 Sep 2006
 299         Wed, 20 Sep 2006
 300         Fri, 22 Sep 2006
 301         Mon, 25 Sep 2006
 302 - Added modules:
 303         afs
 304         amavis (Erich Schubert)
 305         apt (Erich Schubert)
 306         asterisk
 307         audioentropy
 308         authbind
 309         backup
 310         calamaris
 311         cipe
 312         clamav (Erich Schubert)
 313         clockspeed (Petre Rodan)
 314         courier
 315         dante
 316         dcc
 317         ddclient
 318         dpkg (Erich Schubert)
 319         dnsmasq
 320         ethereal
 321         evolution
 322         games
 323         gatekeeper
 324         gift
 325         gnome (James Carter)
 326         imaze
 327         ircd
 328         jabber
 329         monop
 330         mozilla
 331         mplayer
 332         munin
 333         nagios
 334         nessus
 335         netlabel (Paul Moore)
 336         nsd
 337         ntop
 338         nx
 339         oav
 340         oddjob (Dan Walsh)
 341         openca
 342         openvpn (Petre Rodan)
 343         perdition
 344         portslave
 345         postgrey
 346         pxe
 347         pyzor (Dan Walsh)
 348         qmail (Petre Rodan)
 349         razor
 350         resmgr
 351         rhgb
 352         rssh
 353         snort
 354         soundserver
 355         speedtouch
 356         sxid
 357         thunderbird
 358         tor (Erich Schubert)
 359         transproxy
 360         tripwire
 361         uptime
 362         uwimap
 363         vmware
 364         watchdog
 365         xen (Dan Walsh)
 366         xprint
 367         yam
 368
 369 * Tue Mar 07 2006 Chris PeBenito <selinux@tresys.com> - 20060307
 370 - Make all interface parameters required.
 371 - Move boot_t, system_map_t, and modules_object_t to files module,
 372   and move bootloader to admin layer.
 373 - Add semanage policy for semodule from Dan Walsh.
 374 - Remove allow_execmem from targeted policy domain_base_type().
 375 - Add users_extra and seusers support.
 376 - Postfix fixes from Serge Hallyn.
 377 - Run python and shell directly to interpret scripts so policy
 378   sources need not be executable.
 379 - Add desc tag XML to booleans and tunables, and add summary
 380   to param XML tag, to make future translations possible.
 381 - Remove unused lvm_vg_t.
 382 - Many interface renames to improve naming consistency.
 383 - Merge xdm into xserver.
 384 - Remove kernel module reversed interfaces.
 385 - Add filename attribute to module XML tag and lineno attribute to
 386   interface XML tag.
 387 - Changed QUIET build option to a yes or no option.
 388 - Add a Makefile used for compiling loadable modules in a
 389   user's development environment, building against policy headers.
 390 - Add Make target for installing policy headers.
 391 - Separate per-userdomain template expansion from the userdomain
 392   module and add infrastructure to expand templates in the modules
 393   that own the template.
 394 - Enable secadm only for MLS policies.
 395 - Remove role change rules in su and sudo since this functionality has been
 396   removed from these programs.
 397 - Add ctags Make target from Thomas Bleher.
 398 - Collapse commands with grep piped to sed into one sed command.
 399 - Fix type_change bug in term_user_pty().
 400 - Move ice_tmp_t from miscfiles to xserver.
 401 - Login fixes from Serge Hallyn.
 402 - Move xserver_log_t from xdm to xserver.
 403 - Add lpr per-userdomain policy to lpd.
 404 - Miscellaneous fixes from Dan Walsh.
 405 - Change initrc_var_run_t interface noun from script_pid to utmp,
 406   for greater clarity.
 407 - Added modules:
 408         certwatch
 409         mono (Dan Walsh)
 410         mrtg
 411         portage
 412         tvtime
 413         userhelper
 414         usernetctl
 415         wine (Dan Walsh)
 416         xserver
 417
 418 * Tue Jan 17 2006 Chris PeBenito <selinux@tresys.com> - 20060117
 419 - Adds support for generating corenetwork interfaces based on attributes
 420   in addition to types.
 421 - Permits the listing of multiple nodes in a network_node() that will be
 422   given the same type.
 423 - Add two new permission sets for stream sockets.
 424 - Rename file type transition interfaces verb from create to
 425   filetrans to differentiate it from create interfaces without
 426   type transitions.
 427 - Fix expansion of interfaces from disabled modules.
 428 - Rsync can be long running from init,
 429   added rules to allow this.
 430 - Add polyinstantiation build option.
 431 - Add setcontext to the association object class.
 432 - Add apache relay and db connect tunables.
 433 - Rename texrel_shlib_t to textrel_shlib_t.
 434 - Add swat to samba module.
 435 - Numerous miscellaneous fixes from Dan Walsh.
 436 - Added modules:
 437         alsa
 438         automount
 439         cdrecord
 440         daemontools (Petre Rodan)
 441         ddcprobe
 442         djbdns (Petre Rodan)
 443         fetchmail
 444         irc
 445         java
 446         lockdev
 447         logwatch (Dan Walsh)
 448         openct
 449         prelink (Dan Walsh)
 450         publicfile (Petre Rodan)
 451         readahead
 452         roundup
 453         screen
 454         slocate (Dan Walsh)
 455         slrnpull
 456         smartmon
 457         sysstat
 458         ucspitcp (Petre Rodan)
 459         usbmodules
 460         vbetool (Dan Walsh)
 461
 462 * Wed Dec 07 2005 Chris PeBenito <selinux@tresys.com> - 20051207
 463 - Add unlabeled IPSEC association rule to domains with
 464   networking permissions.
 465 - Merge systemuser back in to users, as these files
 466   do not need to be split.
 467 - Add check for duplicate interface/template definitions.
 468 - Move domain, files, and corecommands modules to kernel
 469   layer to resolve some layering inconsistencies.
 470 - Move policy build options out of Makefile into build.conf.
 471 - Add yppasswd to nis module.
 472 - Change optional_policy() to refer to the module name
 473   rather than modulename.te.
 474 - Fix labeling targets to use installed file_contexts rather
 475   than partial file_contexts in the policy source directory.
 476 - Fix build process to use make's internal vpath functions
 477   to detect modules rather than using subshells and find.
 478 - Add install target for modular policy.
 479 - Add load target for modular policy.
 480 - Add appconfig dependency to the load target.
 481 - Miscellaneous fixes from Dan Walsh.
 482 - Fix corenetwork gen_context()'s to expand during the policy
 483   build phase instead of during the generation phase.
 484 - Added policies:
 485         amanda
 486         avahi
 487         canna
 488         cyrus
 489         dbskk
 490         dovecot
 491         distcc
 492         i18n_input
 493         irqbalance
 494         lpd
 495         networkmanager
 496         pegasus
 497         postfix
 498         procmail
 499         radius
 500         rdisc
 501         rpc
 502         spamassassin
 503         timidity
 504         xdm
 505         xfs
 506
 507 * Wed Oct 19 2005 Chris PeBenito <selinux@tresys.com> - 20051019
 508 - Many fixes to make loadable modules build.
 509 - Add targets for sechecker.
 510 - Updated to sedoctool to read bool files and tunable
 511   files separately.
 512 - Changed the xml tag of <boolean> to <bool> to be consistent
 513   with gen_bool().
 514 - Modified the implementation of segenxml to use regular
 515   expressions.
 516 - Rename context_template() to gen_context() to clarify
 517   that its not a Reference Policy template, but a support
 518   macro.
 519 - Add disable_*_trans bool support for targeted policy.
 520 - Add MLS module to handle MLS constraint exceptions,
 521   such as reading up and writing down.
 522 - Fix errors uncovered by sediff.
 523 - Added policies:
 524         anaconda
 525         apache
 526         apm
 527         arpwatch
 528         bluetooth
 529         dmidecode
 530         finger
 531         ftp
 532         kudzu
 533         mailman
 534         ppp
 535         radvd
 536         sasl
 537         webalizer
 538
 539 * Thu Sep 22 2005 Chris PeBenito <selinux@tresys.com> - 20050922
 540 - Make logrotate, sendmail, sshd, and rpm policies
 541   unconfined in the targeted policy so no special
 542   modules.conf is required.
 543 - Add experimental MCS support.
 544 - Add appconfig for MLS.
 545 - Add equivalents for old can_resolve(), can_ldap(), and
 546   can_portmap() to sysnetwork.
 547 - Fix base module compile issues.
 548 - Added policies:
 549         cpucontrol
 550         cvs
 551         ktalk
 552         portmap
 553         postgresql
 554         rlogin
 555         samba
 556         snmp
 557         stunnel
 558         telnet
 559         tftp
 560         uucp
 561         vpn
 562         zebra
 563
 564 * Wed Sep 07 2005 Chris PeBenito <selinux@tresys.com> - 20050907
 565 - Fix errors uncovered by sediff.
 566 - Doc tool will explicitly say a module does not have interfaces
 567   or templates on the module page.
 568 - Added policies:
 569         comsat
 570         dbus
 571         dhcp
 572         dictd
 573         hal
 574         inn
 575         ntp
 576         squid
 577
 578 * Fri Aug 26 2005 Chris PeBenito <selinux@tresys.com> - 20050826
 579 - Add Makefile support for building loadable modules.
 580 - Add genclassperms.py tool to add require blocks
 581   for loadable modules.
 582 - Change sedoctool to make required modules part of base
 583   by default, otherwise make as modules, in modules.conf.
 584 - Fix segenxml to handle modules with no interfaces.
 585 - Rename ipsec connect interface for consistency.
 586 - Add missing parts of unix stream socket connect interface
 587   of ipsec.
 588 - Rename inetd connect interface for consistency.
 589 - Rename interface for purging contents of tmp, for clarity,
 590   since it allows deletion of classes other than file.
 591 - Misc. cleanups.
 592 - Added policies:
 593         acct
 594         bind
 595         firstboot
 596         gpm
 597         howl
 598         ldap
 599         loadkeys
 600         mysql
 601         privoxy
 602         quota
 603         rshd
 604         rsync
 605         su
 606         sudo
 607         tcpd
 608         tmpreaper
 609         updfstab
 610
 611 * Tue Aug 2 2005 Chris PeBenito <selinux@tresys.com> - 20050802
 612 - Fix comparison bug in fc_sort.
 613 - Fix handling of ordered and unordered HTML lists.
 614 - Corenetwork now supports multiple network interfaces having the
 615   same type.
 616 - Doc tool now creates pages for global Booleans and global tunables.
 617 - Doc tool now links directly to the interface/template in the
 618   module page when it is selected in the interface/template index.
 619 - Added support for layer summaries.
 620 - Added policies:
 621         ipsec
 622         nscd
 623         pcmcia
 624         raid
 625
 626 * Thu Jul 7 2005 Chris PeBenito <selinux@tresys.com> - 20050707
 627 - Changed xml to have modules encapsulated by layer tags, rather
 628   than putting layer="foo" in the module tags.  Also in the future
 629   we can put a summary and description for each layer.
 630 - Added tool to infer interface, module, and layer tags.  This will
 631   now list all interfaces, even if they are missing xml docs.
 632 - Shortened xml tag names.
 633 - Added macros to declare interfaces and templates.
 634 - Added interface call trace.
 635 - Updated all xml documentation for shorter and inferred tags.
 636 - Doc tool now displays templates in the web pages.
 637 - Doc tool retains the user's settings in modules.conf and
 638   tunables.conf if the files already exist.
 639 - Modules.conf behavior has been changed to be a list of all
 640   available modules, and the user can specify if the module is
 641   built as a loadable module, included in the monolithic policy,
 642   or excluded.
 643 - Added policies:
 644         fstools (fsck, mkfs, swapon, etc. tools)
 645         logrotate
 646         inetd
 647         kerberos
 648         nis (ypbind and ypserv)
 649         ssh (server, client, and agent)
 650         unconfined
 651 - Added infrastructure for targeted policy support, only missing
 652         transition boolean support.
 653
 654 * Wed Jun 15 2005 Chris PeBenito <selinux@tresys.com> - 20050615
 655         - Initial release