Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package selinux-policy for openSUSE:Factory checked in at 2026-11-03 17:52:15 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/selinux-policy (Old) and /work/SRC/openSUSE:Factory/.selinux-policy.new.1257 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "selinux-policy" Tue Nov 3 17:52:15 2026 rev:183 rq:1394394 version:20261030 Changes: -------- --- /work/SRC/openSUSE:Factory/selinux-policy/selinux-policy.changes 2026-10-20 12:57:02.003501246 +0200 +++ /work/SRC/openSUSE:Factory/.selinux-policy.new.1257/selinux-policy.changes 2026-11-03 17:52:22.308311113 +0100 @@ -1,0 +2,41 @@ +Mon Nov 02 07:10:54 UTC 2026 - Robert Frohl <[email protected]> + +- Update to version 20261030: + * Allow rebootmgr to initialize reboot and soft-reboot (bsc#1287746) + * Allow httpd map its private runtime files + * Allow qatlib get attributes of a hugetlbfs filesystem + * Allow rhsmcertd list insights-client config dirs + * Allow svirt_tcg_t to use the passt user-mode networking backend + * Allow sshd_session_t to forward connections to a container runtime socket + * Allow systemd-oomd the kill capability in the user namespace + * Allow systemd-oomd signull all domains + * Revert "Allow systemd-oomd signull systemd-resolved" + * Update the nvme block devices regex in file context specification + * Allow keepalived getpgid of its unconfined scripts + * Allow init mounton system dbus pid socket files + * Allow systemd-oomd signull systemd-resolved + * Allow login_userdomain watch localization files for changes + * Allow login_userdomain mounton gnome generic data home dirs + * Revert Allow sdbootutil_t write access to /var/lib/sdbootutil (bsc#1281087) + * Label /run/gnome-remote-desktop with gnome_remote_desktop_var_run_t + * Allow systemd_nsresourced_t setuid/setgid inside a userns (bsc#1285095) + * Allow access to systemd-nsresourced runtime socket (bsc#1284651) + * Allow smbd watch public directories used for file transfer services + * Allow sshd-session read systemd-nsresourced runtime socket file + * Allow chrome_sandbox_t map its private tmpfs files + * Allow sysadm_t to create iSCSI netlink sockets + * Allow ktlshd connect to pcscd over a unix stream socket + * Add iptables_dontaudit_read_var_run_dirs() interface + * Allow polkit-auth read systemd-nsresourced runtime socket file + * Allow systemd-nsresourced the sys_admin capability + * Label /var/cache/boomaga with cupsd_rw_etc_t + * Allow dirsrv to read filesystem sysctls + * Allow cupsd create bluetooth sockets + * Allow gnome-remote-desktop handle kerberos replay cache files + * Allow multiple domains read systemd-nsresourced runtime socket file + * Update mount_nnp_domtrans() with nosuid_transition + * Label /run/systemd/coredump socket with systemd_coredump_var_run_t +- Syncing with upstream rawhide selinux-policy up to: + * 8a22f4474f77c7cb32cd6d18e3da75eaef8696de + +------------------------------------------------------------------- Old: ---- selinux-policy-20261019.tar.xz New: ---- selinux-policy-20261030.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ selinux-policy.spec ++++++ --- /var/tmp/diff_new_pack.MzzT56/_old 2026-11-03 17:52:23.817374190 +0100 +++ /var/tmp/diff_new_pack.MzzT56/_new 2026-11-03 17:52:23.820374315 +0100 @@ -37,7 +37,7 @@ License: GPL-2.0-or-later Group: System/Management Name: selinux-policy -Version: 20261019 +Version: 20261030 Release: 0 Source0: %{name}-%{version}.tar.xz Source1: container.fc ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.MzzT56/_old 2026-11-03 17:52:23.898377576 +0100 +++ /var/tmp/diff_new_pack.MzzT56/_new 2026-11-03 17:52:23.900377659 +0100 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://gitlab.suse.de/selinux/selinux-policy.git</param> - <param name="changesrevision">ac53459b5d38a6c9e481c1d2c28e27f40aeac0bd</param></service></servicedata> + <param name="changesrevision">c3751029217f912fb022a3945dc0b3ca83e552db</param></service></servicedata> (No newline at EOF) ++++++ selinux-policy-20261019.tar.xz -> selinux-policy-20261030.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/contrib/accountsd.te new/selinux-policy-20261030/policy/modules/contrib/accountsd.te --- old/selinux-policy-20261019/policy/modules/contrib/accountsd.te 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/contrib/accountsd.te 2026-10-30 12:42:57.000000000 +0100 @@ -113,6 +113,7 @@ optional_policy(` systemd_read_generic_unit_lnk_files(accountsd_t) + systemd_read_nsresourced_sock_files(accountsd_t) ') optional_policy(` diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/contrib/apache.te new/selinux-policy-20261030/policy/modules/contrib/apache.te --- old/selinux-policy-20261019/policy/modules/contrib/apache.te 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/contrib/apache.te 2026-10-30 12:42:57.000000000 +0100 @@ -592,6 +592,7 @@ allow httpd_t httpd_var_lib_t:file map; files_var_lib_filetrans(httpd_t, httpd_var_lib_t, { dir file }) +allow httpd_t httpd_var_run_t:file map; setattr_dirs_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t) manage_dirs_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t) manage_files_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/contrib/chrome.te new/selinux-policy-20261030/policy/modules/contrib/chrome.te --- old/selinux-policy-20261019/policy/modules/contrib/chrome.te 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/contrib/chrome.te 2026-10-30 12:42:57.000000000 +0100 @@ -55,6 +55,7 @@ manage_files_pattern(chrome_sandbox_t, chrome_sandbox_tmpfs_t, chrome_sandbox_tmpfs_t) fs_tmpfs_filetrans(chrome_sandbox_t, chrome_sandbox_tmpfs_t, { file dir }) +allow chrome_sandbox_t chrome_sandbox_tmpfs_t:file map; kernel_read_system_state(chrome_sandbox_t) kernel_read_kernel_sysctls(chrome_sandbox_t) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/contrib/colord.te new/selinux-policy-20261030/policy/modules/contrib/colord.te --- old/selinux-policy-20261019/policy/modules/contrib/colord.te 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/contrib/colord.te 2026-10-30 12:42:57.000000000 +0100 @@ -163,6 +163,7 @@ optional_policy(` systemd_hwdb_read_config(colord_t) + systemd_read_nsresourced_sock_files(colord_t) ') optional_policy(` diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/contrib/cups.fc new/selinux-policy-20261030/policy/modules/contrib/cups.fc --- old/selinux-policy-20261019/policy/modules/contrib/cups.fc 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/contrib/cups.fc 2026-10-30 12:42:57.000000000 +0100 @@ -51,6 +51,7 @@ /usr/share/hplip/.*\.py -- gen_context(system_u:object_r:cupsd_exec_t,s0) /var/cache/alchemist/printconf.* gen_context(system_u:object_r:cupsd_rw_etc_t,s0) +/var/cache/boomaga(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0) /var/cache/foomatic(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0) /var/cache/cups(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,mls_systemhigh) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/contrib/cups.te new/selinux-policy-20261030/policy/modules/contrib/cups.te --- old/selinux-policy-20261019/policy/modules/contrib/cups.te 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/contrib/cups.te 2026-10-30 12:42:57.000000000 +0100 @@ -320,6 +320,10 @@ allow cupsd_t self:process { execmem execstack }; ') +tunable_policy(`deny_bluetooth',`',` + allow cupsd_t self:bluetooth_socket create_socket_perms; +') + optional_policy(` apm_domtrans_client(cupsd_t) ') @@ -393,6 +397,10 @@ ') optional_policy(` + systemd_read_nsresourced_sock_files(cupsd_t) +') + +optional_policy(` snmp_manage_var_lib_files(cupsd_t) ') diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/contrib/dbus.if new/selinux-policy-20261030/policy/modules/contrib/dbus.if --- old/selinux-policy-20261019/policy/modules/contrib/dbus.if 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/contrib/dbus.if 2026-10-30 12:42:57.000000000 +0100 @@ -612,6 +612,24 @@ ######################################## ## <summary> +## Mounton system dbus pid socket files +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`dbus_mounton_pid_sock_files',` + gen_require(` + type system_dbusd_var_run_t; + ') + + allow $1 system_dbusd_var_run_t:sock_file mounton; +') + +######################################## +## <summary> ## Watch system dbus pid directory ## </summary> ## <param name="domain"> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/contrib/dirsrv.te new/selinux-policy-20261030/policy/modules/contrib/dirsrv.te --- old/selinux-policy-20261019/policy/modules/contrib/dirsrv.te 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/contrib/dirsrv.te 2026-10-30 12:42:57.000000000 +0100 @@ -109,6 +109,7 @@ kernel_read_system_state(dirsrv_t) kernel_read_kernel_sysctls(dirsrv_t) kernel_read_net_sysctls(dirsrv_t) +kernel_read_fs_sysctls(dirsrv_t) kernel_dontaudit_search_fs_sysctl(dirsrv_t) corecmd_search_bin(dirsrv_t) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/contrib/gnome.if new/selinux-policy-20261030/policy/modules/contrib/gnome.if --- old/selinux-policy-20261019/policy/modules/contrib/gnome.if 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/contrib/gnome.if 2026-10-30 12:42:57.000000000 +0100 @@ -822,6 +822,24 @@ watch_dirs_pattern($1, data_home_t, data_home_t) ') +###################################### +## <summary> +## Mounton generic data home dirs. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`gnome_mounton_generic_data_home_dirs',` + gen_require(` + type data_home_t; + ') + + allow $1 data_home_t:dir mounton; +') + ####################################### ## <summary> ## Manage gconf data home files diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/contrib/gnome_remote_desktop.fc new/selinux-policy-20261030/policy/modules/contrib/gnome_remote_desktop.fc --- old/selinux-policy-20261019/policy/modules/contrib/gnome_remote_desktop.fc 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/contrib/gnome_remote_desktop.fc 2026-10-30 12:42:57.000000000 +0100 @@ -1,4 +1,6 @@ /usr/libexec/gnome-remote-desktop-daemon -- gen_context(system_u:object_r:gnome_remote_desktop_exec_t,s0) /usr/libexec/grd-pcscd -- gen_context(system_u:object_r:gnome_remote_desktop_exec_t,s0) +/run/gnome-remote-desktop(/.*)? gen_context(system_u:object_r:gnome_remote_desktop_var_run_t,s0) + /var/lib/gnome-remote-desktop(/.*)? gen_context(system_u:object_r:gnome_remote_desktop_var_lib_t,s0) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/contrib/gnome_remote_desktop.te new/selinux-policy-20261030/policy/modules/contrib/gnome_remote_desktop.te --- old/selinux-policy-20261019/policy/modules/contrib/gnome_remote_desktop.te 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/contrib/gnome_remote_desktop.te 2026-10-30 12:42:57.000000000 +0100 @@ -16,6 +16,9 @@ type gnome_remote_desktop_var_lib_t; files_type(gnome_remote_desktop_var_lib_t) +type gnome_remote_desktop_var_run_t; +files_pid_file(gnome_remote_desktop_var_run_t) + ######################################## # # gnome_remote_desktop local policy @@ -28,6 +31,9 @@ manage_lnk_files_pattern(gnome_remote_desktop_t, gnome_remote_desktop_var_lib_t, gnome_remote_desktop_var_lib_t) files_var_lib_filetrans(gnome_remote_desktop_t, gnome_remote_desktop_var_lib_t, { dir file lnk_file }) +manage_files_pattern(gnome_remote_desktop_t, gnome_remote_desktop_var_run_t, gnome_remote_desktop_var_run_t) +files_pid_filetrans(gnome_remote_desktop_t, gnome_remote_desktop_var_run_t, dir) + #============= gnome_remote_desktop_t ============== corenet_tcp_bind_gnome_remote_desktop_port(gnome_remote_desktop_t) allow gnome_remote_desktop_t self:netlink_route_socket r_netlink_socket_perms; @@ -59,8 +65,7 @@ optional_policy(` kerberos_use(gnome_remote_desktop_t) kerberos_read_host_rcache(gnome_remote_desktop_t) - kerberos_tmp_filetrans_host_rcache(gnome_remote_desktop_t, "krb5_983.rcache2") - kerberos_tmp_filetrans_host_rcache(gnome_remote_desktop_t, "krb5_988.rcache2") + kerberos_tmp_filetrans_host_rcache(gnome_remote_desktop_t) ') optional_policy(` diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/contrib/insights_client.if new/selinux-policy-20261030/policy/modules/contrib/insights_client.if --- old/selinux-policy-20261019/policy/modules/contrib/insights_client.if 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/contrib/insights_client.if 2026-10-30 12:42:57.000000000 +0100 @@ -190,6 +190,26 @@ ######################################## ## <summary> +## List insights_client config directories. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`insights_client_list_config_dirs',` + gen_require(` + type insights_client_etc_t, insights_client_etc_rw_t; + ') + + files_search_etc($1) + allow $1 insights_client_etc_t:dir list_dir_perms; + allow $1 insights_client_etc_rw_t:dir list_dir_perms; +') + +######################################## +## <summary> ## Create insights_client config files. ## </summary> ## <param name="domain"> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/contrib/keepalived.te new/selinux-policy-20261030/policy/modules/contrib/keepalived.te --- old/selinux-policy-20261019/policy/modules/contrib/keepalived.te 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/contrib/keepalived.te 2026-10-30 12:42:57.000000000 +0100 @@ -142,7 +142,7 @@ domain_entry_file(keepalived_unconfined_script_t, keepalived_unconfined_script_exec_t) role system_r types keepalived_unconfined_script_t; - allow keepalived_t keepalived_unconfined_script_t:process { sigkill signal }; + allow keepalived_t keepalived_unconfined_script_t:process { setpgid sigkill signal }; domtrans_pattern(keepalived_t, keepalived_unconfined_script_exec_t, keepalived_unconfined_script_t) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/contrib/ktls.te new/selinux-policy-20261030/policy/modules/contrib/ktls.te --- old/selinux-policy-20261019/policy/modules/contrib/ktls.te 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/contrib/ktls.te 2026-10-30 12:42:57.000000000 +0100 @@ -40,6 +40,10 @@ ') optional_policy(` + pcscd_stream_connect(ktlshd_t) +') + +optional_policy(` rpc_tcp_rw_nfs_sockets(ktlshd_t) ') diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/contrib/networkmanager.te new/selinux-policy-20261030/policy/modules/contrib/networkmanager.te --- old/selinux-policy-20261019/policy/modules/contrib/networkmanager.te 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/contrib/networkmanager.te 2026-10-30 12:42:57.000000000 +0100 @@ -521,6 +521,7 @@ systemd_dbus_chat_logind(NetworkManager_t) systemd_dbus_chat_hostnamed(NetworkManager_t) systemd_hostnamed_manage_config(NetworkManager_t) + systemd_read_nsresourced_sock_files(NetworkManager_t) ') optional_policy(` diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/contrib/policykit.te new/selinux-policy-20261030/policy/modules/contrib/policykit.te --- old/selinux-policy-20261019/policy/modules/contrib/policykit.te 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/contrib/policykit.te 2026-10-30 12:42:57.000000000 +0100 @@ -157,6 +157,7 @@ optional_policy(` systemd_read_logind_sessions_files(policykit_t) + systemd_read_nsresourced_sock_files(policykit_t) systemd_login_list_pid_dirs(policykit_t) systemd_login_read_pid_files(policykit_t) systemd_status_all_unit_files(policykit_t) @@ -256,6 +257,10 @@ ') optional_policy(` + systemd_read_nsresourced_sock_files(policykit_auth_t) +') + +optional_policy(` udev_read_db(policykit_auth_t) ') diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/contrib/qatlib.te new/selinux-policy-20261030/policy/modules/contrib/qatlib.te --- old/selinux-policy-20261019/policy/modules/contrib/qatlib.te 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/contrib/qatlib.te 2026-10-30 12:42:57.000000000 +0100 @@ -59,6 +59,7 @@ files_map_kernel_modules(qatlib_t) files_read_kernel_modules(qatlib_t) +fs_getattr_hugetlbfs(qatlib_t) fs_manage_hugetlbfs_dirs(qatlib_t) optional_policy(` diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/contrib/rebootmgr.te new/selinux-policy-20261030/policy/modules/contrib/rebootmgr.te --- old/selinux-policy-20261019/policy/modules/contrib/rebootmgr.te 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/contrib/rebootmgr.te 2026-10-30 12:42:57.000000000 +0100 @@ -38,6 +38,7 @@ systemd_start_power_services(rebootmgr_t) systemd_dbus_chat_logind(rebootmgr_t) +systemd_logind_stream_connect(rebootmgr_t) kernel_read_system_state(rebootmgr_t) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/contrib/rhsmcertd.te new/selinux-policy-20261030/policy/modules/contrib/rhsmcertd.te --- old/selinux-policy-20261019/policy/modules/contrib/rhsmcertd.te 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/contrib/rhsmcertd.te 2026-10-30 12:42:57.000000000 +0100 @@ -172,6 +172,7 @@ ') optional_policy(` + insights_client_list_config_dirs(rhsmcertd_t) insights_client_read_config(rhsmcertd_t) ') diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/contrib/samba.te new/selinux-policy-20261030/policy/modules/contrib/samba.te --- old/selinux-policy-20261019/policy/modules/contrib/samba.te 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/contrib/samba.te 2026-10-30 12:42:57.000000000 +0100 @@ -511,6 +511,7 @@ logging_send_syslog_msg(smbd_t) miscfiles_read_public_files(smbd_t) +miscfiles_watch_public_dirs(smbd_t) sysnet_use_ldap(smbd_t) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/contrib/sdbootutil.fc new/selinux-policy-20261030/policy/modules/contrib/sdbootutil.fc --- old/selinux-policy-20261019/policy/modules/contrib/sdbootutil.fc 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/contrib/sdbootutil.fc 2026-10-30 12:42:57.000000000 +0100 @@ -1,3 +1,2 @@ /usr/bin/sdbootutil -- gen_context(system_u:object_r:sdbootutil_exec_t,s0) /run/sdbootutil(/.*)? gen_context(system_u:object_r:sdbootutil_var_run_t,s0) -/var/lib/sdbootutil(/.*)? gen_context(system_u:object_r:systemd_pcrlock_var_lib_t,s0) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/contrib/sdbootutil.te new/selinux-policy-20261030/policy/modules/contrib/sdbootutil.te --- old/selinux-policy-20261019/policy/modules/contrib/sdbootutil.te 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/contrib/sdbootutil.te 2026-10-30 12:42:57.000000000 +0100 @@ -108,7 +108,6 @@ optional_policy(` systemd_domtrans_pcrlock(sdbootutil_t) systemd_manage_pcrlock_files(sdbootutil_t) - filetrans_pattern(sdbootutil_t, systemd_pcrlock_var_lib_t, systemd_pcrlock_var_lib_t, file) ') optional_policy(` diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/contrib/virt.te new/selinux-policy-20261030/policy/modules/contrib/virt.te --- old/selinux-policy-20261019/policy/modules/contrib/virt.te 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/contrib/virt.te 2026-10-30 12:42:57.000000000 +0100 @@ -1342,6 +1342,7 @@ optional_policy(` userdom_write_user_tmp_sockets(svirt_t) + userdom_write_user_tmp_sockets(svirt_tcg_t) ') optional_policy(` diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/kernel/storage.fc new/selinux-policy-20261030/policy/modules/kernel/storage.fc --- old/selinux-policy-20261019/policy/modules/kernel/storage.fc 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/kernel/storage.fc 2026-10-30 12:42:57.000000000 +0100 @@ -39,7 +39,7 @@ /dev/nb[^/]+ -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) /dev/ng[0-9]+n[0-9]+ -c gen_context(system_u:object_r:fixed_disk_device_t,s0) /dev/nvme[0-9]+ -c gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) -/dev/nvme[0-9]n[^/]+ -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) +/dev/nvme[0-9][0-9]?n[^/]+ -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) /dev/nvme-fabrics -c gen_context(system_u:object_r:fixed_disk_device_t,s0) /dev/nvme-subsys[0-9]+ -c gen_context(system_u:object_r:fixed_disk_device_t,s0) /dev/optcd -b gen_context(system_u:object_r:removable_device_t,s0) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/roles/sysadm.te new/selinux-policy-20261030/policy/modules/roles/sysadm.te --- old/selinux-policy-20261019/policy/modules/roles/sysadm.te 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/roles/sysadm.te 2026-10-30 12:42:57.000000000 +0100 @@ -13,6 +13,7 @@ allow sysadm_t self:netlink_tcpdiag_socket create_netlink_socket_perms; allow sysadm_t self:netlink_selinux_socket create_socket_perms; allow sysadm_t self:netlink_generic_socket create_socket_perms; +allow sysadm_t self:netlink_iscsi_socket create_socket_perms; allow sysadm_t self:tipc_socket create_socket_perms; allow sysadm_t self:sctp_socket create_socket_perms; allow sysadm_t self:rawip_socket create_socket_perms; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/services/ssh.te new/selinux-policy-20261030/policy/modules/services/ssh.te --- old/selinux-policy-20261019/policy/modules/services/ssh.te 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/services/ssh.te 2026-10-30 12:42:57.000000000 +0100 @@ -123,6 +123,9 @@ fs_getattr_all_fs(sshd_session_t) +# connect to a forwarded container runtime socket (e.g. podman.sock) +files_write_generic_pid_sockets(sshd_session_t) + tunable_policy(`ssh_sysadm_login',` # Relabel and access ptys created by sshd # ioctl is necessary for logout() processing for utmp entry and for w to @@ -148,6 +151,10 @@ ') optional_policy(` + container_stream_connect(sshd_session_t) +') + +optional_policy(` ftp_dyntrans_sftpd(sshd_session_t) ftp_dyntrans_anon_sftpd(sshd_session_t) ') @@ -158,6 +165,7 @@ optional_policy(` systemd_dbus_chat_hostnamed(sshd_session_t) + systemd_read_nsresourced_sock_files(sshd_session_t) systemd_userdbd_stream_connect(sshd_session_t) ') diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/services/xserver.te new/selinux-policy-20261030/policy/modules/services/xserver.te --- old/selinux-policy-20261019/policy/modules/services/xserver.te 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/services/xserver.te 2026-10-30 12:42:57.000000000 +0100 @@ -768,6 +768,7 @@ systemd_hwdb_read_config(xdm_t) systemd_coredump_domtrans(xdm_t) systemd_login_watch_session_dirs(xdm_t) +systemd_read_nsresourced_sock_files(xdm_t) systemd_userdbd_named_runtime_filetrans(xdm_t, xdm_var_run_t, sock_file, "org.gnome.DisplayManager") userdom_dontaudit_use_unpriv_user_fds(xdm_t) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/system/authlogin.te new/selinux-policy-20261030/policy/modules/system/authlogin.te --- old/selinux-policy-20261019/policy/modules/system/authlogin.te 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/system/authlogin.te 2026-10-30 12:42:57.000000000 +0100 @@ -205,6 +205,7 @@ optional_policy(` systemd_machined_rw_devpts_chr_files(chkpwd_t) + systemd_read_nsresourced_sock_files(chkpwd_t) ') ######################################## diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/system/init.te new/selinux-policy-20261030/policy/modules/system/init.te --- old/selinux-policy-20261019/policy/modules/system/init.te 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/system/init.te 2026-10-30 12:42:57.000000000 +0100 @@ -843,6 +843,7 @@ dbus_system_bus_client(init_t) dbus_delete_pid_files(init_t) dbus_manage_session_tmp_dirs(init_t) + dbus_mounton_pid_sock_files(init_t) dbus_read_pid_sock_files(init_t) dbus_watch_pid_sock_files(init_t) dbus_use_system_bus_fds(init_t) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/system/iptables.if new/selinux-policy-20261030/policy/modules/system/iptables.if --- old/selinux-policy-20261019/policy/modules/system/iptables.if 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/system/iptables.if 2026-10-30 12:42:57.000000000 +0100 @@ -243,6 +243,24 @@ ##################################### ## <summary> +## Dontaudit read iptables run dirs. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`iptables_dontaudit_read_var_run_dirs',` + gen_require(` + type iptables_var_run_t; + ') + + dontaudit $1 iptables_var_run_t:dir read; +') + +##################################### +## <summary> ## Send iptables a general signal. ## </summary> ## <param name="domain"> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/system/logging.te new/selinux-policy-20261030/policy/modules/system/logging.te --- old/selinux-policy-20261019/policy/modules/system/logging.te 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/system/logging.te 2026-10-30 12:42:57.000000000 +0100 @@ -278,6 +278,7 @@ sysnet_dns_name_resolve(auditd_t) +systemd_read_nsresourced_sock_files(auditd_t) systemd_start_systemd_services(auditd_t) systemd_start_power_services(auditd_t) systemd_status_power_services(auditd_t) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/system/miscfiles.if new/selinux-policy-20261030/policy/modules/system/miscfiles.if --- old/selinux-policy-20261019/policy/modules/system/miscfiles.if 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/system/miscfiles.if 2026-10-30 12:42:57.000000000 +0100 @@ -729,6 +729,7 @@ type locale_t; ') + allow $1 locale_t:lnk_file read_lnk_file_perms; watch_files_pattern($1, locale_t, locale_t) ') @@ -1054,6 +1055,26 @@ ') ######################################## +## <summary> +## Watch public directories used for file +## transfer services. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +## <rolecap/> +# +interface(`miscfiles_watch_public_dirs',` + gen_require(` + type public_content_t, public_content_rw_t; + ') + + allow $1 { public_content_t public_content_rw_t }:dir watch_dir_perms; +') + +######################################## ## <summary> ## Create, read, write, and delete public files ## and directories used for file transfer services. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/system/mount.if new/selinux-policy-20261030/policy/modules/system/mount.if --- old/selinux-policy-20261019/policy/modules/system/mount.if 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/system/mount.if 2026-10-30 12:42:57.000000000 +0100 @@ -40,7 +40,7 @@ type mount_t; ') - allow $1 mount_t:process2 nnp_transition; + allow $1 mount_t:process2 { nnp_transition nosuid_transition }; ') ######################################## diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/system/systemd.fc new/selinux-policy-20261030/policy/modules/system/systemd.fc --- old/selinux-policy-20261019/policy/modules/system/systemd.fc 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/system/systemd.fc 2026-10-30 12:42:57.000000000 +0100 @@ -149,6 +149,7 @@ /run/systemd/.+\.conf\.d/.+\.conf -- gen_context(system_u:object_r:systemd_conf_t,s0) /run/systemd/.+\.conf\.d/.+\.conf -l gen_context(system_u:object_r:systemd_conf_t,s0) /run/.*nologin.* gen_context(system_u:object_r:systemd_logind_var_run_t,s0) +/run/systemd/coredump -s gen_context(system_u:object_r:systemd_coredump_var_run_t,s0) /run/systemd/coredumpd(/.*)? gen_context(system_u:object_r:systemd_coredump_var_run_t,s0) /run/systemd/default-hostname -- gen_context(system_u:object_r:hostname_etc_t,s0) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/system/systemd.if new/selinux-policy-20261030/policy/modules/system/systemd.if --- old/selinux-policy-20261019/policy/modules/system/systemd.if 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/system/systemd.if 2026-10-30 12:42:57.000000000 +0100 @@ -3414,6 +3414,26 @@ ####################################### ## <summary> +## Allow the specified domain to read sockets +## in systemd-nsresourced run directory. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`systemd_read_nsresourced_sock_files', ` + gen_require(` + type systemd_nsresourced_runtime_t; + ') + + files_search_pids($1) + read_sock_files_pattern($1, systemd_nsresourced_runtime_t, systemd_nsresourced_runtime_t) +') + +####################################### +## <summary> ## Allow the specified domain to connect to ## systemd-nsresourced over a unix socket. ## </summary> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/system/systemd.te new/selinux-policy-20261030/policy/modules/system/systemd.te --- old/selinux-policy-20261019/policy/modules/system/systemd.te 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/system/systemd.te 2026-10-30 12:42:57.000000000 +0100 @@ -482,6 +482,7 @@ systemd_config_generic_services(systemd_logind_t) systemd_read_efivarfs(systemd_logind_t) +systemd_read_nsresourced_sock_files(systemd_logind_t) systemd_userdbd_stream_connect(systemd_logind_t) # /run/user/.* @@ -2062,6 +2063,7 @@ allow systemd_userdbd_t self:capability { dac_read_search sys_resource }; allow systemd_userdbd_t systemd_nsresourced_t:unix_stream_socket connectto; +allow systemd_userdbd_t systemd_nsresourced_runtime_t:sock_file read; manage_dirs_pattern(systemd_userdbd_t, systemd_userdbd_runtime_t, systemd_userdbd_runtime_t) manage_files_pattern(systemd_userdbd_t, systemd_userdbd_runtime_t, systemd_userdbd_runtime_t) @@ -2186,6 +2188,7 @@ # dontaudit systemd_oomd_t self:capability dac_override; +allow systemd_oomd_t self:cap_userns kill; allow systemd_oomd_t systemd_oomd_var_run_t:sock_file manage_sock_file_perms; manage_files_pattern(systemd_oomd_t, systemd_oomd_tmpfs_t, systemd_oomd_tmpfs_t) @@ -2197,6 +2200,7 @@ domain_read_all_domains_state(systemd_oomd_t) domain_kill_all_domains(systemd_oomd_t) +domain_signull_all_domains(systemd_oomd_t) files_watch_tmpfs_dirs(systemd_oomd_t) @@ -2217,7 +2221,7 @@ # allow systemd_nsresourced_t self:bpf { map_create map_read map_write prog_load prog_run }; -allow systemd_nsresourced_t self:capability { setgid setuid sys_resource }; +allow systemd_nsresourced_t self:capability { setgid setuid sys_admin sys_resource }; allow systemd_nsresourced_t self:capability2 { bpf perfmon }; allow systemd_nsresourced_t self:cap_userns { sys_admin setgid setuid }; allow systemd_nsresourced_t self:perf_event manage_perf_event_perms; @@ -2323,6 +2327,7 @@ allow systemd_user_runtimedir_t self:unix_dgram_socket create_socket_perms; systemd_dbus_chat_logind(systemd_user_runtimedir_t) +systemd_read_nsresourced_sock_files(systemd_user_runtimedir_t) kernel_dgram_send(systemd_user_runtimedir_t) kernel_stream_connect(systemd_user_runtimedir_t) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20261019/policy/modules/system/userdomain.te new/selinux-policy-20261030/policy/modules/system/userdomain.te --- old/selinux-policy-20261019/policy/modules/system/userdomain.te 2026-10-19 17:00:14.000000000 +0200 +++ new/selinux-policy-20261030/policy/modules/system/userdomain.te 2026-10-30 12:42:57.000000000 +0100 @@ -458,6 +458,7 @@ optional_policy(` gnome_exec_atspi(login_userdomain) + gnome_mounton_generic_data_home_dirs(login_userdomain) gnome_watch_generic_data_home_dirs(login_userdomain) gnome_watch_home_config_dirs(login_userdomain) gnome_watch_home_config_files(login_userdomain) @@ -478,6 +479,7 @@ miscfiles_mounton_fonts_dirs(login_userdomain) miscfiles_mounton_fonts_cache_dirs(login_userdomain) miscfiles_mounton_locale_files(login_userdomain) + miscfiles_watch_localization_files(login_userdomain) ') optional_policy(`
