-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2011-12365 2011-09-09 04:55:35 --------------------------------------------------------------------------------
Name : selinux-policy Product : Fedora 15 Version : 3.9.16 Release : 39.fc15 URL : http://oss.tresys.com/repos/refpolicy/ Summary : SELinux policy configuration Description : SELinux Reference Policy - modular. Based off of reference policy: Checked out revision 2.20091117 -------------------------------------------------------------------------------- Update Information: - Backport F16 fixes - livecd fixes - systemd fixes -------------------------------------------------------------------------------- ChangeLog: * Tue Sep 6 2011 Miroslav Grepl <[email protected]> 3.9.16-39 - Backport F16 fixes - livecd fixes - systemd fixes * Thu Aug 11 2011 Miroslav Grepl <[email protected]> 3.9.16-38 - Allow hostname read network state - Allow syslog to manage all log files - Add use_fusefs_home_dirs boolean for chrome - Make vdagent working with confined users - Fix syslog port definition - Allow openvpn to set its process priority when the nice parameter is used - Restorecond should be able to watch and relabel devices in /dev - Alow hddtemp to perform DNS name resolution * Fri Aug 5 2011 Miroslav Grepl <[email protected]> 3.9.16-37 - Fixes for zarafa, postfix policy - Backport collect policy * Wed Jul 27 2011 Miroslav Grepl <[email protected]> 3.9.16-36 - Backport ABRT changes - Make tmux working with scree policy - Allow root cron jobs can't run without unconfined - add interface to dontaudit writes to urand, needed by libra - Add label for /var/cache/krb5rcache directory * Wed Jul 20 2011 Miroslav Grepl <[email protected]> 3.9.16-35 - Allow jabberd_router_t to read system state - Rename oracledb_port to oracle_port - Allow rgmanager executes init script files in initrc_t domain which ensure proper transitions - screen wants to manage sock file in screen home dirs - Make screen working with confined users - Allow gssd to search access on the directory /proc/fs/nfsd * Fri Jul 15 2011 Miroslav Grepl <[email protected]> 3.9.16-34 - More fixes for postfix policy - Allow virsh_t setsched - Add mcelog_log_t type for mcelog log file - Add virt_ptynode attribute * Mon Jul 11 2011 Miroslav Grepl <[email protected]> 3.9.16-33 - Add l2tpd policy - Fixes for abrt - Backport fail2ban_client policy * Fri Jul 1 2011 Miroslav Grepl <[email protected]> 3.9.16-32 - Allow getcap, setcap for syslogd - Fix label for /usr/lib64/opera/opera * Thu Jun 30 2011 Miroslav Grepl <[email protected]> 3.9.16-31 - Make mozilla_plugin_tmpfs_t as userdom_user_tmpfs_content() - Allow init to delete all pid sockets - Allow colord to read /proc/stat - Add label for /var/www/html/wordpress/wp-content/plugins directory - Allow pppd to search /var/lock dir - puppetmaster use nsswitch: #711804 - Update abrt to match rawhide policy - allow privoxy to read network data - support gecko mozilla browser plugin - Allow chrome_sandbox to execute content in nfs homedir - postfix_qmgr needs to read /var/spool/postfix/deferred - abrt_t needs fsetid * Tue Jun 14 2011 Miroslav Grepl <[email protected]> 3.9.16-30 - Fixes for zarafa policy - Other fixes for fail2ban - Allow keyring to drop capabilities - Allow cobblerd to send syslog messages - Allow xserver to read/write the xserver_misk device - ppp also installs /var/log/ppp and /var/run/ppp directories * remove filetrans rules - fix for pppd_lock - Allow fail2ban run ldconfig - Allow lvm to read/write pipes inherited from login programs * Fri Jun 10 2011 Miroslav Grepl <[email protected]> 3.9.16-29 - Fix /var/lock labeling issue * Mon Jun 6 2011 Miroslav Grepl <[email protected]> 3.9.16-28 - Allow ssh to execute systemctl - fail2ban fixes related to /tmp directory - Allow puppetmaster to create dirs in /var/run/puppet * Thu Jun 2 2011 Miroslav Grepl <[email protected]> 3.9.16-27 - Add label for /var/lock/ppp - Fixes for colord policy - Allow sys_chroot for postfix domains * Fri May 27 2011 Miroslav Grepl <[email protected]> 3.9.16-26 - Add label for dev/ati/card* - Allowe secadm to manage selinux config files * Thu May 26 2011 Miroslav Grepl <[email protected]> 3.9.16-25 - Add Dominicks patch for dccp_socket - dnsmasq needs to read nm-dns-dnsmasq.conf in /var/run/ - Colord inherits open file descriptors from the users...' - cgred needs auth_use_nsswitch() - apcupsd lock file was missing file context specificatio... - Make cron work - Allow clamav to manage amavis spool files - Use httpd_can_sendmail boolean also for httpd_suexec_t - Add fenced_can_ssh boolean - Add dev_dontaudit_read_generic_files() for hplip - Allow xauthority to create shared memory - Make postfix user domains application_domains - Allow xend to sys_admin privs - Allow mount to read usr files - Allow logrotate to connect to init script using unix stream socket - Allow nsplugin_t to getattr on gpmctl * Tue May 17 2011 Miroslav Grepl <[email protected]> 3.9.16-24 - Allow logrotate to connect to init script using unix domain stream socket - Allow shorewall read and write inherited user domain pty/tty - virt will attempt to us another virtualizations pulsesaudio tmpfs_t, ignore error - Allow colord to get the attributes of fixed disk device nodes - Allow nsplugin_t to getattr on gpmctl - Allow mozilla_plugin to connect to pcscd over an unix stream socket - Allow logrotate to execute systemctl - colord wants to read files in users homedir - Remote login should create user_tmp_t content not its own tmp files - Allow psad signal - Fix cobbler_read_lib_files interface - Allow rlogind to r/w user terminals - Allow prelink_cron_system_t to relabel content and ignore obj_id - Allow gnomeclock_systemctl_t to list init_var_run_t - Dbus domains will inherit fds from the init system -------------------------------------------------------------------------------- References: [ 1 ] Bug #729451 - Restorecond isn't allowed to relabel to xserver_misc_device_t https://bugzilla.redhat.com/show_bug.cgi?id=729451 [ 2 ] Bug #733492 - SELinux is preventing /bin/systemd-tmpfiles from 'unlink' accesses on the file vmci.o. https://bugzilla.redhat.com/show_bug.cgi?id=733492 [ 3 ] Bug #735598 - avc: livecd-creator/python/ldconfig script/program/process transition https://bugzilla.redhat.com/show_bug.cgi?id=735598 [ 4 ] Bug #728405 - Can't rotate audit logs with logrotate https://bugzilla.redhat.com/show_bug.cgi?id=728405 [ 5 ] Bug #728435 - SELinux is preventing /bin/systemd-tmpfiles from 'ioctl' accesses on the unix_stream_socket unix_stream_socket. https://bugzilla.redhat.com/show_bug.cgi?id=728435 [ 6 ] Bug #730163 - SELinux is preventing /usr/libexec/fprintd from 'getattr' accesses on the unix_stream_socket unix_stream_socket. https://bugzilla.redhat.com/show_bug.cgi?id=730163 [ 7 ] Bug #730179 - SELinux is preventing /opt/google/chrome/chrome from execmod access on the file /opt/google/chrome/chrome. https://bugzilla.redhat.com/show_bug.cgi?id=730179 [ 8 ] Bug #730467 - SELinux is preventing /usr/libexec/colord from 'read' accesses on the file unix. https://bugzilla.redhat.com/show_bug.cgi?id=730467 [ 9 ] Bug #730479 - SELinux is preventing /usr/bin/python from 'execute' accesses on the file /bin/ping. https://bugzilla.redhat.com/show_bug.cgi?id=730479 [ 10 ] Bug #730499 - AVC against exim with unconfined off. https://bugzilla.redhat.com/show_bug.cgi?id=730499 [ 11 ] Bug #730624 - mailman AVCs with unconfined disabled. https://bugzilla.redhat.com/show_bug.cgi?id=730624 [ 12 ] Bug #730637 - SELinux is preventing /usr/bin/gnome-keyring-daemon from 'getattr' accesses on the système de fichiers /. https://bugzilla.redhat.com/show_bug.cgi?id=730637 [ 13 ] Bug #732014 - SELinux is preventing /bin/systemd-tmpfiles from 'unlink' accesses on the file cimv2.21.0-interop.mof. https://bugzilla.redhat.com/show_bug.cgi?id=732014 [ 14 ] Bug #732224 - AVC problems with spamassassin's nightly update run with unconfined off https://bugzilla.redhat.com/show_bug.cgi?id=732224 [ 15 ] Bug #732228 - postgresql initdb problems with unconfined disabled https://bugzilla.redhat.com/show_bug.cgi?id=732228 [ 16 ] Bug #733545 - Problems with running pdflatex from a CGI via apache/httpd https://bugzilla.redhat.com/show_bug.cgi?id=733545 [ 17 ] Bug #734237 - cron that comes with mdadm can't run unconfined https://bugzilla.redhat.com/show_bug.cgi?id=734237 [ 18 ] Bug #736225 - Errors from freshclam cron when unconfined is off. https://bugzilla.redhat.com/show_bug.cgi?id=736225 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update selinux-policy' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list [email protected] https://admin.fedoraproject.org/mailman/listinfo/package-announce
