-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2011-16023 2011-11-17 22:46:55 --------------------------------------------------------------------------------
Name : selinux-policy Product : Fedora 15 Version : 3.9.16 Release : 48.fc15 URL : http://oss.tresys.com/repos/refpolicy/ Summary : SELinux policy configuration Description : SELinux Reference Policy - modular. Based off of reference policy: Checked out revision 2.20091117 -------------------------------------------------------------------------------- Update Information: - Allow spamd and clamd to steam connect to each other - Allow colord to execute ifconfig - Allow smbcontrol to signal themselves - Make faillog MLS trusted to make sudo_$1_t working -------------------------------------------------------------------------------- ChangeLog: * Wed Nov 16 2011 Miroslav Grepl <[email protected]> 3.9.16-48 - Fix typo in ssh.if * Wed Nov 16 2011 Miroslav Grepl <[email protected]> 3.9.16-47 - Allow spamd and clamd to steam connect to each other - Allow colord to execute ifconfig - Allow smbcontrol to signal themselves - Make faillog MLS trusted to make sudo_$1_t working * Mon Nov 7 2011 Miroslav Grepl <[email protected]> 3.9.16-46 - Backport MCS fixes from F16 - Other chrome fixes from F16 * Wed Oct 26 2011 Miroslav Grepl <[email protected]> 3.9.16-45 - Backport chrome fixes - Backport cloudform policy * Fri Oct 21 2011 Miroslav Grepl <[email protected]> 3.9.16-44 - Fixes for systemd - Add FIPS suppport for dirsrv * Tue Oct 11 2011 Miroslav Grepl <[email protected]> 3.9.16-43 - Allow sa-update to update rules - Allow sa-update to read spamd tmp file - Allow screen to read all domain state - Allow sa-update to execute shell - More fixes for sa-update running out of cron job - Allow initrc to manage cron system spool - Fixes for collectd policy - Fixes added during clean up bugzillas - Dontaudit fail2ban_client_t sys_tty_config capability - Fix for puppet which does execute check on passwd - ricci_modservice send syslog msgs - Fix dev_dontaudit_write_mtrr() interface * Tue Sep 27 2011 Miroslav Grepl <[email protected]> 3.9.16-42 - Make mta_role() active - Add additional gitweb file context labeling - Allow asterisk to connect to jabber client port - Allow sssd to read the contents of /sys/class/net/$IFACE_NAME - Allow fsdaemon dac_override * Thu Sep 22 2011 Miroslav Grepl <[email protected]> 3.9.16-41 - Add logging_syslogd_can_sendmail boolean - Add support for exim and confined users - support for ommail module to send logs via mail - Add execmem_execmod() to execmem role - Allow pptp to send generic signal to kernel threads - Fix kerberos_manage_host_rcache() interface * Mon Sep 12 2011 Miroslav Grepl <[email protected]> 3.9.16-40 - Fixes for mock * Tue Sep 6 2011 Miroslav Grepl <[email protected]> 3.9.16-39 - Backport F16 fixes - livecd fixes - systemd fixes * Thu Aug 11 2011 Miroslav Grepl <[email protected]> 3.9.16-38 - Allow hostname read network state - Allow syslog to manage all log files - Add use_fusefs_home_dirs boolean for chrome - Make vdagent working with confined users - Fix syslog port definition - Allow openvpn to set its process priority when the nice parameter is used - Restorecond should be able to watch and relabel devices in /dev - Alow hddtemp to perform DNS name resolution * Fri Aug 5 2011 Miroslav Grepl <[email protected]> 3.9.16-37 - Fixes for zarafa, postfix policy - Backport collect policy * Wed Jul 27 2011 Miroslav Grepl <[email protected]> 3.9.16-36 - Backport ABRT changes - Make tmux working with scree policy - Allow root cron jobs can't run without unconfined - add interface to dontaudit writes to urand, needed by libra - Add label for /var/cache/krb5rcache directory * Wed Jul 20 2011 Miroslav Grepl <[email protected]> 3.9.16-35 - Allow jabberd_router_t to read system state - Rename oracledb_port to oracle_port - Allow rgmanager executes init script files in initrc_t domain which ensure proper transitions - screen wants to manage sock file in screen home dirs - Make screen working with confined users - Allow gssd to search access on the directory /proc/fs/nfsd * Fri Jul 15 2011 Miroslav Grepl <[email protected]> 3.9.16-34 - More fixes for postfix policy - Allow virsh_t setsched - Add mcelog_log_t type for mcelog log file - Add virt_ptynode attribute * Mon Jul 11 2011 Miroslav Grepl <[email protected]> 3.9.16-33 - Add l2tpd policy - Fixes for abrt - Backport fail2ban_client policy * Fri Jul 1 2011 Miroslav Grepl <[email protected]> 3.9.16-32 - Allow getcap, setcap for syslogd - Fix label for /usr/lib64/opera/opera * Thu Jun 30 2011 Miroslav Grepl <[email protected]> 3.9.16-31 - Make mozilla_plugin_tmpfs_t as userdom_user_tmpfs_content() - Allow init to delete all pid sockets - Allow colord to read /proc/stat - Add label for /var/www/html/wordpress/wp-content/plugins directory - Allow pppd to search /var/lock dir - puppetmaster use nsswitch: #711804 - Update abrt to match rawhide policy - allow privoxy to read network data - support gecko mozilla browser plugin - Allow chrome_sandbox to execute content in nfs homedir - postfix_qmgr needs to read /var/spool/postfix/deferred - abrt_t needs fsetid * Tue Jun 14 2011 Miroslav Grepl <[email protected]> 3.9.16-30 - Fixes for zarafa policy - Other fixes for fail2ban - Allow keyring to drop capabilities - Allow cobblerd to send syslog messages - Allow xserver to read/write the xserver_misk device - ppp also installs /var/log/ppp and /var/run/ppp directories * remove filetrans rules - fix for pppd_lock - Allow fail2ban run ldconfig - Allow lvm to read/write pipes inherited from login programs * Fri Jun 10 2011 Miroslav Grepl <[email protected]> 3.9.16-29 - Fix /var/lock labeling issue * Mon Jun 6 2011 Miroslav Grepl <[email protected]> 3.9.16-28 - Allow ssh to execute systemctl - fail2ban fixes related to /tmp directory - Allow puppetmaster to create dirs in /var/run/puppet * Thu Jun 2 2011 Miroslav Grepl <[email protected]> 3.9.16-27 - Add label for /var/lock/ppp - Fixes for colord policy - Allow sys_chroot for postfix domains * Fri May 27 2011 Miroslav Grepl <[email protected]> 3.9.16-26 - Add label for dev/ati/card* - Allowe secadm to manage selinux config files * Thu May 26 2011 Miroslav Grepl <[email protected]> 3.9.16-25 - Add Dominicks patch for dccp_socket - dnsmasq needs to read nm-dns-dnsmasq.conf in /var/run/ - Colord inherits open file descriptors from the users...' - cgred needs auth_use_nsswitch() - apcupsd lock file was missing file context specificatio... - Make cron work - Allow clamav to manage amavis spool files - Use httpd_can_sendmail boolean also for httpd_suexec_t - Add fenced_can_ssh boolean - Add dev_dontaudit_read_generic_files() for hplip - Allow xauthority to create shared memory - Make postfix user domains application_domains - Allow xend to sys_admin privs - Allow mount to read usr files - Allow logrotate to connect to init script using unix stream socket - Allow nsplugin_t to getattr on gpmctl * Tue May 17 2011 Miroslav Grepl <[email protected]> 3.9.16-24 - Allow logrotate to connect to init script using unix domain stream socket - Allow shorewall read and write inherited user domain pty/tty - virt will attempt to us another virtualizations pulsesaudio tmpfs_t, ignore error - Allow colord to get the attributes of fixed disk device nodes - Allow nsplugin_t to getattr on gpmctl - Allow mozilla_plugin to connect to pcscd over an unix stream socket - Allow logrotate to execute systemctl - colord wants to read files in users homedir - Remote login should create user_tmp_t content not its own tmp files - Allow psad signal - Fix cobbler_read_lib_files interface - Allow rlogind to r/w user terminals - Allow prelink_cron_system_t to relabel content and ignore obj_id - Allow gnomeclock_systemctl_t to list init_var_run_t - Dbus domains will inherit fds from the init system -------------------------------------------------------------------------------- References: [ 1 ] Bug #705279 - SELinux is preventing /usr/bin/who from 'read' accesses on the file utmp. https://bugzilla.redhat.com/show_bug.cgi?id=705279 [ 2 ] Bug #711804 - puppet: Could not find a default provider for user https://bugzilla.redhat.com/show_bug.cgi?id=711804 [ 3 ] Bug #713377 - SELinux is preventing /bin/bash from using the 'dac_override' capabilities. https://bugzilla.redhat.com/show_bug.cgi?id=713377 [ 4 ] Bug #720505 - proftpd and cgroups https://bugzilla.redhat.com/show_bug.cgi?id=720505 [ 5 ] Bug #726899 - A user_u (SELinux) user can't log into XFCE4 https://bugzilla.redhat.com/show_bug.cgi?id=726899 [ 6 ] Bug #728405 - Can't rotate audit logs with logrotate https://bugzilla.redhat.com/show_bug.cgi?id=728405 [ 7 ] Bug #730179 - SELinux is preventing /opt/google/chrome/chrome from execmod access on the file /opt/google/chrome/chrome. https://bugzilla.redhat.com/show_bug.cgi?id=730179 [ 8 ] Bug #730624 - mailman AVCs with unconfined disabled. https://bugzilla.redhat.com/show_bug.cgi?id=730624 [ 9 ] Bug #731116 - SELinux is preventing /usr/bin/abrt-action-save-package-data from 'read' accesses on the file unix. https://bugzilla.redhat.com/show_bug.cgi?id=731116 [ 10 ] Bug #731382 - SELinux is preventing /bin/mkdir from 'write' accesses on the directory /dev. https://bugzilla.redhat.com/show_bug.cgi?id=731382 [ 11 ] Bug #732224 - AVC problems with spamassassin's nightly update run with unconfined off https://bugzilla.redhat.com/show_bug.cgi?id=732224 [ 12 ] Bug #733830 - SELinux is preventing /usr/sbin/brctl from using the 'sys_module' capabilities. https://bugzilla.redhat.com/show_bug.cgi?id=733830 [ 13 ] Bug #734281 - SELinux is preventing /usr/bin/qemu-kvm from 'write' accesses on the arquivo /home/cesarb/.libvirt/qemu/log/FreeDOS.log. https://bugzilla.redhat.com/show_bug.cgi?id=734281 [ 14 ] Bug #735877 - sudo crontab -e -u breaks the crontab file perms https://bugzilla.redhat.com/show_bug.cgi?id=735877 [ 15 ] Bug #736049 - SELinux is preventing /usr/sbin/saslauthd from 'ioctl' accesses on the file /proc/fs/openafs/afs_ioctl. https://bugzilla.redhat.com/show_bug.cgi?id=736049 [ 16 ] Bug #736719 - SELinux is preventing /usr/libexec/postfix/bounce from 'search' accesses on the directory /var/spool/postfix/defer. https://bugzilla.redhat.com/show_bug.cgi?id=736719 [ 17 ] Bug #737476 - SELinux is preventing /bin/systemd-tmpfiles from 'read' accesses on the directory isolinux. https://bugzilla.redhat.com/show_bug.cgi?id=737476 [ 18 ] Bug #737802 - SELinux is preventing /usr/sbin/collectd from 'getattr' accesses on the filesystem /dev/mqueue. https://bugzilla.redhat.com/show_bug.cgi?id=737802 [ 19 ] Bug #737803 - SELinux is preventing /usr/sbin/collectd from 'read' accesses on the lnk_file hwmon0. https://bugzilla.redhat.com/show_bug.cgi?id=737803 [ 20 ] Bug #737909 - SELinux is preventing /usr/libexec/postfix/bounce from 'lock' accesses on the file /var/spool/postfix/defer/8/81D4FE0DF0. https://bugzilla.redhat.com/show_bug.cgi?id=737909 [ 21 ] Bug #738118 - something wrong with exim + selinux + no unconfined https://bugzilla.redhat.com/show_bug.cgi?id=738118 [ 22 ] Bug #739346 - SELinux is preventing /usr/sbin/pptp from using the 'signal' accesses on a process. https://bugzilla.redhat.com/show_bug.cgi?id=739346 [ 23 ] Bug #739647 - No support for gitweb-caching package https://bugzilla.redhat.com/show_bug.cgi?id=739647 [ 24 ] Bug #740150 - More mail (mailman, procmail) woes with unconfined disabled https://bugzilla.redhat.com/show_bug.cgi?id=740150 [ 25 ] Bug #740274 - SELinux is preventing /usr/libexec/postfix/bounce from 'write' accesses on the directory /var/spool/postfix/defer/A. https://bugzilla.redhat.com/show_bug.cgi?id=740274 [ 26 ] Bug #740462 - More tmux + unconfined issues https://bugzilla.redhat.com/show_bug.cgi?id=740462 [ 27 ] Bug #740534 - SELinux is preventing /usr/sbin/sssd from 'read' accesses on the lnk_file tun0. https://bugzilla.redhat.com/show_bug.cgi?id=740534 [ 28 ] Bug #740905 - SELinux is preventing /usr/sbin/asterisk from 'name_connect' accesses on the tcp_socket port 5222. https://bugzilla.redhat.com/show_bug.cgi?id=740905 [ 29 ] Bug #741082 - sendmail, selinux, unconfined, restricted users https://bugzilla.redhat.com/show_bug.cgi?id=741082 [ 30 ] Bug #741493 - SELinux is preventing /opt/google/chrome/chrome from 'execute' accesses on the file /opt/google/chrome/nacl_helper_bootstrap. https://bugzilla.redhat.com/show_bug.cgi?id=741493 [ 31 ] Bug #741893 - SELinux is preventing /opt/google/chrome/chrome from 'execute_no_trans' accesses on the file /opt/google/chrome/nacl_helper_bootstrap. https://bugzilla.redhat.com/show_bug.cgi?id=741893 [ 32 ] Bug #742213 - Error between postfix's local and ddclient cache directory https://bugzilla.redhat.com/show_bug.cgi?id=742213 [ 33 ] Bug #742625 - SELinux is preventing sh from 'execute_no_trans' accesses on the plik /bin/ls. https://bugzilla.redhat.com/show_bug.cgi?id=742625 [ 34 ] Bug #744379 - SELinux is preventing /usr/bin/gpg from 'read' accesses on the file .spamassassin6872XIpEnbtmp. https://bugzilla.redhat.com/show_bug.cgi?id=744379 [ 35 ] Bug #744514 - SELinux is preventing /bin/bash from 'getattr' accesses on the file /bin/bash. https://bugzilla.redhat.com/show_bug.cgi?id=744514 [ 36 ] Bug #744515 - SELinux is preventing /bin/bash from 'getattr' accesses on the file /proc/meminfo. https://bugzilla.redhat.com/show_bug.cgi?id=744515 [ 37 ] Bug #744517 - SELinux is preventing /usr/bin/perl from 'name_connect' accesses on the tcp_socket port 80. https://bugzilla.redhat.com/show_bug.cgi?id=744517 [ 38 ] Bug #744959 - SELinux is preventing /sbin/iscsid from 'link' accesses on the file lock. https://bugzilla.redhat.com/show_bug.cgi?id=744959 [ 39 ] Bug #746127 - SELinux is preventing fail2ban from using shorewall for actions https://bugzilla.redhat.com/show_bug.cgi?id=746127 [ 40 ] Bug #746524 - SELinux is preventing /usr/lib/chromium-browser/chromium-browser from execmod access on the fichier /usr/lib/chromium-browser/chromium-browser https://bugzilla.redhat.com/show_bug.cgi?id=746524 [ 41 ] Bug #746763 - SELinux is preventing /usr/libexec/accounts-daemon from 'read' accesses on the file /var/log/wtmp. https://bugzilla.redhat.com/show_bug.cgi?id=746763 [ 42 ] Bug #747933 - SELinux is preventing /usr/bin/perl from 'read' accesses on the directory /var/log/varnish. https://bugzilla.redhat.com/show_bug.cgi?id=747933 [ 43 ] Bug #749111 - SELinux is preventing nacl_helper_boo from 'mmap_zero' accesses on the memprotect Unknown. https://bugzilla.redhat.com/show_bug.cgi?id=749111 [ 44 ] Bug #749602 - SELinux is preventing nacl_helper_boo from using the 'share' accesses on a process. https://bugzilla.redhat.com/show_bug.cgi?id=749602 [ 45 ] Bug #749644 - SELinux is preventing /opt/google/chrome/chrome from 'execmod' accesses on the file /opt/google/chrome/libffmpegsumo.so. https://bugzilla.redhat.com/show_bug.cgi?id=749644 [ 46 ] Bug #749738 - SELinux is preventing /usr/sbin/slapd from 'write' accesses on the directory /var/cache/coolkey. https://bugzilla.redhat.com/show_bug.cgi?id=749738 [ 47 ] Bug #749780 - SELinux is preventing /usr/lib/nspluginwrapper/npviewer.bin from 'execmod' accesses on the file /usr/lib/flash-plugin/libflashplayer.so. https://bugzilla.redhat.com/show_bug.cgi?id=749780 [ 48 ] Bug #749829 - SELinux is preventing plymouthd from 'search' accesses on the directory 1277. https://bugzilla.redhat.com/show_bug.cgi?id=749829 [ 49 ] Bug #749905 - SELinux is preventing /opt/google/chrome/nacl_helper_bootstrap from 'execute_no_trans' accesses on the file /opt/google/chrome/nacl_helper_bootstrap. https://bugzilla.redhat.com/show_bug.cgi?id=749905 [ 50 ] Bug #749967 - SELinux is preventing /usr/sbin/pptp from 'read' accesses on the file unix. https://bugzilla.redhat.com/show_bug.cgi?id=749967 [ 51 ] Bug #750429 - SELinux is preventing /usr/bin/tor from 'read' accesses on the directory cpu. https://bugzilla.redhat.com/show_bug.cgi?id=750429 [ 52 ] Bug #751245 - SELinux is preventing /usr/libexec/gnome-session-check-accelerated-helper from 'execmod' accesses on the file /usr/lib/dri/fglrx_dri.so. https://bugzilla.redhat.com/show_bug.cgi?id=751245 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update selinux-policy' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list [email protected] https://admin.fedoraproject.org/mailman/listinfo/package-announce
