commit: b2be5a0bf0017b0189a0c9870880ae4f0ba674aa Author: Chris PeBenito <pebenito <AT> ieee <DOT> org> AuthorDate: Thu Feb 13 13:42:37 2025 +0000 Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> CommitDate: Sat Mar 8 23:01:08 2025 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=b2be5a0b
Update Changelog and VERSION for release 2.20250213. Signed-off-by: Chris PeBenito <pebenito <AT> ieee.org> Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org> Changelog | 113 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ VERSION | 2 +- 2 files changed, 114 insertions(+), 1 deletion(-) diff --git a/Changelog b/Changelog index 1e9edc872..0527405ac 100644 --- a/Changelog +++ b/Changelog @@ -1,3 +1,116 @@ +* Thu Feb 13 2025 Chris PeBenito <[email protected]> - 2.20250213 +Björn Esser (1): + authlogin: fix regex for /etc/tcb + +Chris PeBenito (54): + Makefile: Build all appconfig files. + Add tool for validating contexts in appconfig files. + userhelper_context: Fix invalid context. + lxc_contexts: Fix invalid contexts in standard version. + validate-appconfig.py: Add default_type and failsafe_context validation. + validate-appconfig.py: Add default_contexts validation. + xserver: Fix xdm seuser role association. + build-policy.yml: Add setools to policy builds for appconfig validation. + validate-appconfig.py: Add GitHub actions logging. + users: Move unconfined_u definition to unconfined module. + guest/xguest: Add seusers. + INSTALL: Update dependencies. + build-userspace/setools.yml: Cache built userspace. + systemd: Fix systemd_write_notify_socket(). + Revert "systemd: Fix systemd_write_notify_socket()." + systemd: Fix systemd_write_notify_socket(). + init: Move common rules out of daemon/system interfaces. + +Christian Göttsche (17): + unconfined: permit io_uring access + userdomain: include map in userdom_manage_user_home_content_files() + systemd: permit ssh generator to request vsock module + locallogin: permit login process to signal itself + ssh: label sshd-session helper on Debian + kernel: create /dev/vsock with correct context + Reorder permissions to please SELint + bootloader: get scheduling information + Fix typos + policy_capabilities: add stub for userspace_initial_context + validate-appconfig: replace tab indentation by spaces + check_fc_files: support trailing optional version number + Build appconfig files in default target + systemd: permit sd-sysuser access to admin terminal + github: add codespell check + systemd: permit sysusers to create /etc/group + systemd: getattr namespace files + +Dave Sugar (12): + Fix complaints in STIG about unlabeled device files + Make quemu optional in virt + Make mta optional in container policy + Changes to support python 3.9 (RHEL9) + Setup sudo log file type + Need search perms on cert_t/tls_privkey_t when using private types + Communicate with locale via dbus + mozilla adds .mozilla directory to /etc/skel which useradd tries to copy + Add support for open-vm-tools + If mta module is not installed useradd fails to create mailbox files + label jspawnhelper bin_t + Allow fapolicyd to watch /run/netns directory + +Hans-Christian Noren Egtvedt (1): + devices: add more video4linux related devices as v4l_device_t + +Henrik Grindal Bakken (1): + cron: Remove too greedy file context grab + +Nicolas PARLANT (2): + files context : few fixes for merged-usr distro_gentoo + fixdep dbus + +Rahul Sandhu (23): + systemd_stream_connect_homed: new interface to access account info + locallogin: allow talking to systemd-homed user record APIs + systemd_homed_t, systemd_homework_t: allow reading of /etc/machine-id + systemd-homed: label LUKS home images as systemd_homed_storage_t + authlogin: connect to homed + systemd_homed_runtime_work_dir_t: new type for systemd-homed workdir + lvm_manage_runtime_dirs: new interface for managing LVM runtime dirs + systemd_homework_t: allow managing of lvm_runtime_t files and dirs + systemd_homed_record_t: new type for user records + systemd_stream_connect_homed: make use of stream_connect_pattern + systemd-homed: make lvm related policy optional + systemd-homework: reformat *_files_pattern block + systemd-homed: use files_read_etc_runtime_files to read machine-id + systemd-homed: fix filecontexts for systemd_home_storage_t objects + systemd_stream_connect_homed: genrequire systemd_userdbd_runtime_t + systemd-homework: move optional policy to end of block + authlogin: connect to nsresourced + systemd: appropriately label /run/log/systemd as systemd_log_t + bootloader_t: allow getattr for autofs_t + systemd-logind: allow getattr for autofs_t for get bootloader + bootloader_t: use fs_list_auto_mountpoints for autofs_t:dir + NetworkManager: add /usr/lib/NetworkManager/dispatcher.d to filecon + systemd: allow getattr of namespace files for more components + +Stephen Smalley (1): + add netlink_xperm policy capability and nlmsg permission definitions + +Tianjia Zhang (9): + secadm: remove duplicate policies + userdomain: allow grant mac_admin capability to security admin + lvm: allow to grant capability and create alg_socket + mount: allow mount_t to readwrite fifo file + authlogin: allow unix_chkpwd to run + usermanage: grant passwd_t dac_read_search capability + tpm2: add correct fcontext for tpm2 tools + tpm2: allow tpm-abrmd to access urandom + tpm2: Add the necessary policy to run tpm2 tools + +Yi Zhao (3): + systemd: allow more components to get attributes of nsfs inodes + systemd: allow systemd-resolve to watch /run/systemd dir + ntp: allow systemd-timesyncd to watch /run/systemd dir + +lquidfire (1): + Add is a policy for the ARC milter + * Mon Sep 16 2024 Chris PeBenito <[email protected]> - 2.20240916 Amisha Jain (1): Sepolicy changes for bluez to access uhid diff --git a/VERSION b/VERSION index 3cbd6b36e..22fcf3aad 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.20240916 +2.20250213
