Changelog

   1 - Man page updates from Dan Walsh.
   2 - Two patches from Paul Moore to for ipsec to remove redundant rules and
   3   have setkey read the config file.
   4 - Move booleans and tunables to modules when it is only used in a single
   5   module.
   6 - Add support for tunables and booleans local to a module.
   7 - Merge sbin_t and ls_exec_t into bin_t.
   8 - Remove disable_trans booleans.
   9 - Output different header sets for kernel and userland from flask headers.
  10 - Marked the pax class as deprecated, changed it to userland so
  11   it will be removed from the kernel.
  12 - Stop including netfilter contexts by default.
  13 - Add dontaudits for init fds and console to init_daemon_domain().
  14 - Patch to allow gpg to create user keys dir.
  15 - Patch to support kvmfs from Dan Walsh.
  16 - Patch for misc fixes in sudo from Dan Walsh.
  17 - Patch to fix netlabel recvfrom MLS constraint from Paul Moore.
  18 - Patch for handling restart of nscd when ran from useradd, groupadd, and
  19   admin passwd, from Dan Walsh.
  20 - Patch for procmail, spamassassin, and pyzor updates from Dan Walsh.
  21 - Patch for setroubleshoot for validating file contexts from Dan Walsh.
  22 - Patch for gssd fixes from Dan Walsh.
  23 - Patch for lvm fixes from Dan Walsh.
  24 - Patch for ricci fixes from Dan Walsh.
  25 - Patch for postfix lmtp labeling and pickup rule fix from Dan Walsh.
  26 - Patch for kerberized telnet fixes from Dan Walsh.
  27 - Patch for kerberized ftp and other ftp fixes from Dan Walsh.
  28 - Patch for an additional wine executable from Dan Walsh.
  29 - Eight patches for file contexts in games, wine, networkmanager, miscfiles,
  30   corecommands, devices, and java from Dan Walsh.
  31 - Add support for libselinux 2.0.5 init_selinuxmnt() changes.
  32 - Patch for misc fixes to bluetooth from Dan Walsh.
  33 - Patch for misc fixes to kerberos from Dan Walsh.
  34 - Patch to start deprecating usercanread attribute from Ryan Bradetich.
  35 - Add dccp_socket object class which was added in kernel 2.6.20.
  36 - Patch for prelink relabefrom it's temp files from Dan Walsh.
  37 - Patch for capability fix for auditd and networking fix for syslogd from
  38   Dan Walsh.
  39 - Patch to remove redundant mls_trusted_object() call from Dan Walsh.
  40 - Patch for misc fixes to nis ypxfr policy from Dan Walsh.
  41 - Patch to allow apmd to telinit from Dan Walsh.
  42 - Patch for additional labeling of samba files from Stefan Schulze
  43   Frielinghaus.
  44 - Patch to remove incorrect cron labeling in apache.fc from Ryan Bradetich.
  45 - Fix ptys and ttys to be device nodes.
  46 - Fix explicit use of httpd_t in openca_domtrans().
  47 - Clean up file context regexes in apache and java, from Eamon Walsh.
  48 - Patches from Dan Walsh:
  49         Thu, 25 Jan 2007
  50 - Added modules:
  51         consolekit (Dan Walsh)
  52         fail2ban (Dan Walsh)
  53
  54 * Tue Dec 12 2006 Chris PeBenito <selinux@tresys.com> - 20061212
  55 - Add policy patterns support macros.  This changes the behavior of
  56   the create_dir_perms and create_file_perms permission sets.
  57 - Association polmatch MLS constraint making unlabeled_t an exception
  58   is no longer needed, patch from Venkat Yekkirala.
  59 - Context contains checking for PAM and cron from James Antill.
  60 - Add a reload target to Modules.devel and change the load
  61   target to only insert modules that were changed.
  62 - Allow semanage to read from /root on strict non-MLS for
  63   local policy modules.
  64 - Gentoo init script fixes for udev.
  65 - Allow udev to read kernel modules.inputmap.
  66 - Dnsmasq fixes from testing.
  67 - Allow kernel NFS server to getattr filesystems so df can work
  68   on clients.
  69 - Patch from Matt Anderson for a MLS constraint exemption on a
  70   file that can be written to from a subject whose range is
  71   within the object's range.
  72 - Enhanced setransd support from Darrel Goeddel.
  73 - Patches from Dan Walsh:
  74         Tue, 24 Oct 2006
  75         Wed, 29 Nov 2006
  76 - Added modules:
  77         aide (Matt Anderson)
  78         ccs (Dan Walsh)
  79         iscsi (Dan Walsh)
  80         ricci (Dan Walsh)
  81
  82 * Wed Oct 18 2006 Chris PeBenito <selinux@tresys.com> - 20061018
  83 - Patch from Russell Coker Thu, 5 Oct 2006
  84 - Move range transitions to modules.
  85 - Make number of MLS sensitivities, and number of MLS and MCS
  86   categories configurable as build options.
  87 - Add role infrastructure.
  88 - Debian updates from Erich Schubert.
  89 - Add nscd_socket_use() to auth_use_nsswitch().
  90 - Remove old selopt rules.
  91 - Full support for netfilter_contexts.
  92 - MRTG patch for daemon operation from Stefan.
  93 - Add authlogin interface to abstract common access for login programs.
  94 - Remove setbool auditallow, except for RHEL4.
  95 - Change eventpollfs to task SID labeling.
  96 - Add key support from Michael LeMay.
  97 - Add ftpdctl domain to ftp, from Paul Howarth.
  98 - Fix build system to not move type declarations out of optionals.
  99 - Add gcc-config domain to portage.
 100 - Add packet object class and support in corenetwork.
 101 - Add a copy of genhomedircon for monolithic policy building, so that a
 102   policycoreutils package update is not required for RHEL4 systems.
 103 - Add appletalk sockets for use in cups.
 104 - Add Make target to validate module linking.
 105 - Make duplicate template and interface declarations a fatal error.
 106 - Patch to stabilize modules.conf `make conf` output, from Erich Schubert.
 107 - Move xconsole_device_t from devices to xserver since it is
 108   not actually a device, it is a named pipe.
 109 - Handle nonexistant .fc and .if files in devel Makefile by
 110   automatically creating empty files.
 111 - Remove unused devfs_control_t.
 112 - Add rhel4 distro, which also implies redhat distro.
 113 - Remove unneeded range_transition for su_exec_t and move the
 114   type declaration back to the su module.
 115 - Constrain transitions in MCS so unconfined_t cannot have
 116   arbitrary category sets.
 117 - Change reiserfs from xattr filesystem to genfscon as it's xattrs
 118   are currently nonfunctional.
 119 - Change files and filesystem modules to use their own interfaces.
 120 - Add user fonts to xserver.
 121 - Additional interfaces in corecommands, miscfiles, and userdomain
 122   from Joy Latten.
 123 - Miscellaneous fixes from Thomas Bleher.
 124 - Deprecate module name as first parameter of optional_policy()
 125   now that optionals are allowed everywhere.
 126 - Enable optional blocks in base module and monolithic policy.
 127   This requires checkpolicy 1.30.1.
 128 - Fix vpn module declaration.
 129 - Numerous fixes from Dan Walsh.
 130 - Change build order to preserve m4 line number information so policy
 131   compile errors are useful again.
 132 - Additional MLS interfaces from Chad Hanson.
 133 - Move some rules out of domain_type() and domain_base_type()
 134   to the TE file, to use the domain attribute to take advantage
 135   of space savings from attribute use.
 136 - Add global stack smashing protector rule for urandom access from
 137   Petre Rodan.
 138 - Fix temporary rules at the bottom of portmap.
 139 - Updated comments in mls file from Chad Hanson.
 140 - Patches from Dan Walsh:
 141         Fri, 17 Mar 2006
 142         Wed, 29 Mar 2006
 143         Tue, 11 Apr 2006
 144         Fri, 14 Apr 2006
 145         Tue, 18 Apr 2006
 146         Thu, 20 Apr 2006
 147         Tue, 02 May 2006
 148         Mon, 15 May 2006
 149         Thu, 18 May 2006
 150         Tue, 06 Jun 2006
 151         Mon, 12 Jun 2006
 152         Tue, 20 Jun 2006
 153         Wed, 26 Jul 2006
 154         Wed, 23 Aug 2006
 155         Thu, 31 Aug 2006
 156         Fri, 01 Sep 2006
 157         Tue, 05 Sep 2006
 158         Wed, 20 Sep 2006
 159         Fri, 22 Sep 2006
 160         Mon, 25 Sep 2006
 161 - Added modules:
 162         afs
 163         amavis (Erich Schubert)
 164         apt (Erich Schubert)
 165         asterisk
 166         audioentropy
 167         authbind
 168         backup
 169         calamaris
 170         cipe
 171         clamav (Erich Schubert)
 172         clockspeed (Petre Rodan)
 173         courier
 174         dante
 175         dcc
 176         ddclient
 177         dpkg (Erich Schubert)
 178         dnsmasq
 179         ethereal
 180         evolution
 181         games
 182         gatekeeper
 183         gift
 184         gnome (James Carter)
 185         imaze
 186         ircd
 187         jabber
 188         monop
 189         mozilla
 190         mplayer
 191         munin
 192         nagios
 193         nessus
 194         netlabel (Paul Moore)
 195         nsd
 196         ntop
 197         nx
 198         oav
 199         oddjob (Dan Walsh)
 200         openca
 201         openvpn (Petre Rodan)
 202         perdition
 203         portslave
 204         postgrey
 205         pxe
 206         pyzor (Dan Walsh)
 207         qmail (Petre Rodan)
 208         razor
 209         resmgr
 210         rhgb
 211         rssh
 212         snort
 213         soundserver
 214         speedtouch
 215         sxid
 216         thunderbird
 217         tor (Erich Schubert)
 218         transproxy
 219         tripwire
 220         uptime
 221         uwimap
 222         vmware
 223         watchdog
 224         xen (Dan Walsh)
 225         xprint
 226         yam
 227
 228 * Tue Mar 07 2006 Chris PeBenito <selinux@tresys.com> - 20060307
 229 - Make all interface parameters required.
 230 - Move boot_t, system_map_t, and modules_object_t to files module,
 231   and move bootloader to admin layer.
 232 - Add semanage policy for semodule from Dan Walsh.
 233 - Remove allow_execmem from targeted policy domain_base_type().
 234 - Add users_extra and seusers support.
 235 - Postfix fixes from Serge Hallyn.
 236 - Run python and shell directly to interpret scripts so policy
 237   sources need not be executable.
 238 - Add desc tag XML to booleans and tunables, and add summary
 239   to param XML tag, to make future translations possible.
 240 - Remove unused lvm_vg_t.
 241 - Many interface renames to improve naming consistency.
 242 - Merge xdm into xserver.
 243 - Remove kernel module reversed interfaces.
 244 - Add filename attribute to module XML tag and lineno attribute to
 245   interface XML tag.
 246 - Changed QUIET build option to a yes or no option.
 247 - Add a Makefile used for compiling loadable modules in a
 248   user's development environment, building against policy headers.
 249 - Add Make target for installing policy headers.
 250 - Separate per-userdomain template expansion from the userdomain
 251   module and add infrastructure to expand templates in the modules
 252   that own the template.
 253 - Enable secadm only for MLS policies.
 254 - Remove role change rules in su and sudo since this functionality has been
 255   removed from these programs.
 256 - Add ctags Make target from Thomas Bleher.
 257 - Collapse commands with grep piped to sed into one sed command.
 258 - Fix type_change bug in term_user_pty().
 259 - Move ice_tmp_t from miscfiles to xserver.
 260 - Login fixes from Serge Hallyn.
 261 - Move xserver_log_t from xdm to xserver.
 262 - Add lpr per-userdomain policy to lpd.
 263 - Miscellaneous fixes from Dan Walsh.
 264 - Change initrc_var_run_t interface noun from script_pid to utmp,
 265   for greater clarity.
 266 - Added modules:
 267         certwatch
 268         mono (Dan Walsh)
 269         mrtg
 270         portage
 271         tvtime
 272         userhelper
 273         usernetctl
 274         wine (Dan Walsh)
 275         xserver
 276
 277 * Tue Jan 17 2006 Chris PeBenito <selinux@tresys.com> - 20060117
 278 - Adds support for generating corenetwork interfaces based on attributes
 279   in addition to types.
 280 - Permits the listing of multiple nodes in a network_node() that will be
 281   given the same type.
 282 - Add two new permission sets for stream sockets.
 283 - Rename file type transition interfaces verb from create to
 284   filetrans to differentiate it from create interfaces without
 285   type transitions.
 286 - Fix expansion of interfaces from disabled modules.
 287 - Rsync can be long running from init,
 288   added rules to allow this.
 289 - Add polyinstantiation build option.
 290 - Add setcontext to the association object class.
 291 - Add apache relay and db connect tunables.
 292 - Rename texrel_shlib_t to textrel_shlib_t.
 293 - Add swat to samba module.
 294 - Numerous miscellaneous fixes from Dan Walsh.
 295 - Added modules:
 296         alsa
 297         automount
 298         cdrecord
 299         daemontools (Petre Rodan)
 300         ddcprobe
 301         djbdns (Petre Rodan)
 302         fetchmail
 303         irc
 304         java
 305         lockdev
 306         logwatch (Dan Walsh)
 307         openct
 308         prelink (Dan Walsh)
 309         publicfile (Petre Rodan)
 310         readahead
 311         roundup
 312         screen
 313         slocate (Dan Walsh)
 314         slrnpull
 315         smartmon
 316         sysstat
 317         ucspitcp (Petre Rodan)
 318         usbmodules
 319         vbetool (Dan Walsh)
 320
 321 * Wed Dec 07 2005 Chris PeBenito <selinux@tresys.com> - 20051207
 322 - Add unlabeled IPSEC association rule to domains with
 323   networking permissions.
 324 - Merge systemuser back in to users, as these files
 325   do not need to be split.
 326 - Add check for duplicate interface/template definitions.
 327 - Move domain, files, and corecommands modules to kernel
 328   layer to resolve some layering inconsistencies.
 329 - Move policy build options out of Makefile into build.conf.
 330 - Add yppasswd to nis module.
 331 - Change optional_policy() to refer to the module name
 332   rather than modulename.te.
 333 - Fix labeling targets to use installed file_contexts rather
 334   than partial file_contexts in the policy source directory.
 335 - Fix build process to use make's internal vpath functions
 336   to detect modules rather than using subshells and find.
 337 - Add install target for modular policy.
 338 - Add load target for modular policy.
 339 - Add appconfig dependency to the load target.
 340 - Miscellaneous fixes from Dan Walsh.
 341 - Fix corenetwork gen_context()'s to expand during the policy
 342   build phase instead of during the generation phase.
 343 - Added policies:
 344         amanda
 345         avahi
 346         canna
 347         cyrus
 348         dbskk
 349         dovecot
 350         distcc
 351         i18n_input
 352         irqbalance
 353         lpd
 354         networkmanager
 355         pegasus
 356         postfix
 357         procmail
 358         radius
 359         rdisc
 360         rpc
 361         spamassassin
 362         timidity
 363         xdm
 364         xfs
 365
 366 * Wed Oct 19 2005 Chris PeBenito <selinux@tresys.com> - 20051019
 367 - Many fixes to make loadable modules build.
 368 - Add targets for sechecker.
 369 - Updated to sedoctool to read bool files and tunable
 370   files separately.
 371 - Changed the xml tag of <boolean> to <bool> to be consistent
 372   with gen_bool().
 373 - Modified the implementation of segenxml to use regular
 374   expressions.
 375 - Rename context_template() to gen_context() to clarify
 376   that its not a Reference Policy template, but a support
 377   macro.
 378 - Add disable_*_trans bool support for targeted policy.
 379 - Add MLS module to handle MLS constraint exceptions,
 380   such as reading up and writing down.
 381 - Fix errors uncovered by sediff.
 382 - Added policies:
 383         anaconda
 384         apache
 385         apm
 386         arpwatch
 387         bluetooth
 388         dmidecode
 389         finger
 390         ftp
 391         kudzu
 392         mailman
 393         ppp
 394         radvd
 395         sasl
 396         webalizer
 397
 398 * Thu Sep 22 2005 Chris PeBenito <selinux@tresys.com> - 20050922
 399 - Make logrotate, sendmail, sshd, and rpm policies
 400   unconfined in the targeted policy so no special
 401   modules.conf is required.
 402 - Add experimental MCS support.
 403 - Add appconfig for MLS.
 404 - Add equivalents for old can_resolve(), can_ldap(), and
 405   can_portmap() to sysnetwork.
 406 - Fix base module compile issues.
 407 - Added policies:
 408         cpucontrol
 409         cvs
 410         ktalk
 411         portmap
 412         postgresql
 413         rlogin
 414         samba
 415         snmp
 416         stunnel
 417         telnet
 418         tftp
 419         uucp
 420         vpn
 421         zebra
 422
 423 * Wed Sep 07 2005 Chris PeBenito <selinux@tresys.com> - 20050907
 424 - Fix errors uncovered by sediff.
 425 - Doc tool will explicitly say a module does not have interfaces
 426   or templates on the module page.
 427 - Added policies:
 428         comsat
 429         dbus
 430         dhcp
 431         dictd
 432         hal
 433         inn
 434         ntp
 435         squid
 436
 437 * Fri Aug 26 2005 Chris PeBenito <selinux@tresys.com> - 20050826
 438 - Add Makefile support for building loadable modules.
 439 - Add genclassperms.py tool to add require blocks
 440   for loadable modules.
 441 - Change sedoctool to make required modules part of base
 442   by default, otherwise make as modules, in modules.conf.
 443 - Fix segenxml to handle modules with no interfaces.
 444 - Rename ipsec connect interface for consistency.
 445 - Add missing parts of unix stream socket connect interface
 446   of ipsec.
 447 - Rename inetd connect interface for consistency.
 448 - Rename interface for purging contents of tmp, for clarity,
 449   since it allows deletion of classes other than file.
 450 - Misc. cleanups.
 451 - Added policies:
 452         acct
 453         bind
 454         firstboot
 455         gpm
 456         howl
 457         ldap
 458         loadkeys
 459         mysql
 460         privoxy
 461         quota
 462         rshd
 463         rsync
 464         su
 465         sudo
 466         tcpd
 467         tmpreaper
 468         updfstab
 469
 470 * Tue Aug 2 2005 Chris PeBenito <selinux@tresys.com> - 20050802
 471 - Fix comparison bug in fc_sort.
 472 - Fix handling of ordered and unordered HTML lists.
 473 - Corenetwork now supports multiple network interfaces having the
 474   same type.
 475 - Doc tool now creates pages for global Booleans and global tunables.
 476 - Doc tool now links directly to the interface/template in the
 477   module page when it is selected in the interface/template index.
 478 - Added support for layer summaries.
 479 - Added policies:
 480         ipsec
 481         nscd
 482         pcmcia
 483         raid
 484
 485 * Thu Jul 7 2005 Chris PeBenito <selinux@tresys.com> - 20050707
 486 - Changed xml to have modules encapsulated by layer tags, rather
 487   than putting layer="foo" in the module tags.  Also in the future
 488   we can put a summary and description for each layer.
 489 - Added tool to infer interface, module, and layer tags.  This will
 490   now list all interfaces, even if they are missing xml docs.
 491 - Shortened xml tag names.
 492 - Added macros to declare interfaces and templates.
 493 - Added interface call trace.
 494 - Updated all xml documentation for shorter and inferred tags.
 495 - Doc tool now displays templates in the web pages.
 496 - Doc tool retains the user's settings in modules.conf and
 497   tunables.conf if the files already exist.
 498 - Modules.conf behavior has been changed to be a list of all
 499   available modules, and the user can specify if the module is
 500   built as a loadable module, included in the monolithic policy,
 501   or excluded.
 502 - Added policies:
 503         fstools (fsck, mkfs, swapon, etc. tools)
 504         logrotate
 505         inetd
 506         kerberos
 507         nis (ypbind and ypserv)
 508         ssh (server, client, and agent)
 509         unconfined
 510 - Added infrastructure for targeted policy support, only missing
 511         transition boolean support.
 512
 513 * Wed Jun 15 2005 Chris PeBenito <selinux@tresys.com> - 20050615
 514         - Initial release