Merged userspace AVC patch to follow kernel's behavior for permissive mode
in caching previous denials from Eamon Walsh.
Merged sidput(NULL) patch from Eamon Walsh.
the use of the non-standard format %as. (original patch changed for
style).
Merged patch from Todd Miller to fix memory leak in matchpathcon.c.
Fri Jan 19 2007 Dan Walsh <dwalsh@redhat.com> - 1.34.0-2
- Add context function to python to split context into 4 parts
Merged man page updates to make "apropos selinux" work from Dan Walsh.
Mon Jan 15 2007 Dan Walsh <dwalsh@redhat.com> - 1.33.5-1
- Upgrade to upstream
Merged getdefaultcon utility from Dan Walsh.
Merged updated flask definitions from Darrel Goeddel. This adds the context
security class, and also adds the string definitions for setsockcreate
and polmatch.
Merged patch to not log avc stats upon a reset from Steve Grubb.
Applied patch to revert compat_net setting upon policy load.
Merged file context homedir and local path functions from Chris PeBenito.
Merged file context homedir and local path functions from Chris PeBenito.
Rework functions that access /proc/pid/attr to access the per-thread nodes,
and unify the code to simplify maintenance.
Lindent.
Merged {get,set}procattrcon patch set from Eric Paris.
Merged re-base of keycreate patch originally by Michael LeMay from Eric
Paris.
Regenerated Flask headers from refpolicy.
- Added selinux_file_context_{cmp,verify}.
- Added selinux_lsetfilecon_default.
- Delay translation of contexts in matchpathcon.
Added selinux_getpolicytype() function.
Modified setrans code to skip processing if !mls_enabled.
Set errno in the !selinux_mnt case.
Allocate large buffers from the heap, not on stack. Affects
is_context_customizable, selinux_init_load_policy, and
selinux_getenforcemode.
Merged simple setrans client cache from Dan Walsh. Merged avcstat patch
from Russell Coker.
Modified selinux_mkload_policy() to also set /selinux/compat_net
appropriately for the loaded policy.
Merged simple setrans client cache from Dan Walsh. Merged avcstat patch
from Russell Coker.
Modified selinux_mkload_policy() to also set /selinux/compat_net
appropriately for the loaded policy.
Merged getfscreatecon man page fix from Dan Walsh.
Updated booleans(8) man page to drop references to the old booleans file
and to note that setsebool can be used to set the boot-time defaults
via -P.
Merged setrans client support from Dan Walsh. This removes use of
libsetrans.
Merged patch to eliminate use of PAGE_SIZE constant from Dan Walsh.
Merged swig typemap fixes from Glauber de Oliveira Costa.
Added distclean target to Makefile.
Regenerated swig files.
Changed matchpathcon_init to verify that the spec file is a regular file.
Merged python binding t_output_helper removal patch from Dan Walsh.
- Upgrade to latest from NSA
Updated version for release.
Altered rpm_execcon fallback logic for permissive mode to also handle case
where /selinux/enforce is not available.
- Upgrade to latest from NSA
Updated version for release.
Altered rpm_execcon fallback logic for permissive mode to also handle case
where /selinux/enforce is not available.
- corrected use of getline
- further calls to __fsetlocking for local files
- use of strdupa and asprintf
- proper handling of dirent in booleans code
- use of -z relro
- several other optimizations
Merged getpidcon python wrapper from Dan Walsh (Red Hat).
Added MATCHPATHCON_VALIDATE flag for set_matchpathcon_flags() and modified
matchpathcon implementation to make context validation/
canonicalization optional at matchpathcon_init time, deferring it to a
successful matchpathcon by default unless the new flag is set by the
caller.
Added matchpathcon_init_prefix() interface, and reworked matchpathcon
implementation to support selective loading of file contexts entries
based on prefix matching between the pathname regex stems and the
specified path prefix (stem must be a prefix of the specified path
prefix).
Added -f file_contexts option to matchpathcon util. Fixed warning message
in matchpathcon_init().
Merged Makefile python definitions patch from Dan Walsh.
Added security_canonicalize_context() interface and
set_matchpathcon_canoncon() interface for obtaining canonical contexts.
Changed matchpathcon internals to obtain canonical contexts by default.
Provided fallback for kernels that lack extended selinuxfs context
interface.
- Patch to not translate mls when calling setfiles
Merged seusers parser changes from Ivan Gyurdiev.
Merged setsebool to libsemanage patch from Ivan Gyurdiev.
Changed seusers parser to reject empty fields.
Merged get_default_context_with_rolelevel and man pages from Dan Walsh (Red
Hat).
Updated call to sepol_policydb_to_image for sepol changes.
Changed getseuserbyname to ignore empty lines and to handle no matching
entry in the same manner as no seusers file.
Changed selinux_mkload_policy to try downgrading the latest policy version
available to the kernel-supported version.
Changed selinux_mkload_policy to fall back to the maximum policy version
supported by libsepol if the kernel policy version falls outside of the
supported range.
Changed getseuserbyname to fall back to the Linux username and NULL level
if seusers config file doesn't exist unless REQUIRESEUSERS=1 is set in
/etc/selinux/config.
Moved seusers.conf under $SELINUXTYPE and renamed to seusers.
Changed getseuserbyname to fall back to the Linux username and NULL level
if seusers config file doesn't exist unless REQUIRESEUSERS=1 is set in
/etc/selinux/config.
Moved seusers.conf under $SELINUXTYPE and renamed to seusers.
Added selinux_init_load_policy() function as an even higher level interface
for the initial policy load by /sbin/init. This obsoletes the
load_policy() function in the sysvinit-selinux.patch.
Added selinux_mkload_policy() function as a higher level interface for
loading policy than the security_load_policy() interface.
Merged fix for matchpathcon (regcomp error checking) from Johan Fischer.
Also added use of regerror to obtain the error string for inclusion in
the error message.
Merged modified form of patch to avoid dlopen/dlclose by the static
libselinux from Dan Walsh. Users of the static libselinux will not have
any context translation by default.
Merged modified form of patch to avoid dlopen/dlclose by the static
libselinux from Dan Walsh. Users of the static libselinux will not have
any context translation by default.
Hid translation-related symbols entirely and ensured that raw functions
have hidden definitions for internal use.
Allowed setting NULL via context_set* functions.
Allowed whitespace in MLS component of context.
Changed rpm_execcon to use translated functions to workaround lack of MLS
level on upgraded systems.
Merged several fixes for error handling paths in the AVC sidtab,
matchpathcon, booleans, context, and get_context_list code from Serge
Hallyn (IBM). Bugs found by Coverity.
Removed setupns; migrated to pam.
Merged patches to rename checkPasswdAccess() from Joshua Brindle. Original
symbol is temporarily retained for compatibility until all callers are
updated.
Merged avcstat and selinux man page from Dan Walsh.
Changed security_load_booleans to process booleans.local even if booleans
file doesn't exist.
Fri Apr 26 2005 Dan Walsh <dwalsh@redhat.com> 1.23.10-3
- Fix avcstat to clear totals
Merged set_selinuxmnt patch from Bill Nottingham (Red Hat).
Rewrote get_ordered_context_list and helpers, including changing logic to
allow variable MLS fields.
Merged set_selinuxmnt patch from Bill Nottingham (Red Hat).
Rewrote get_ordered_context_list and helpers, including changing logic to
allow variable MLS fields.
Added set_matchpathcon_flags() function for setting flags controlling
operation of matchpathcon. MATCHPATHCON_BASEONLY means only process the
base file_contexts file, not file_contexts.homedirs or
file_contexts.local, and is for use by setfiles -c.
Updated matchpathcon.3 man page.
Merged matchpathcon patch for file_contexts.homedir from Dan Walsh.
Added selinux_users_path() for path to directory containing system.users
and local.users.
Modified avc_dump_av to explicitly check for any permissions that cannot be
mapped to string names and display them as a hex value.
Regenerated av_permissions.h.
Generalized matchpathcon internals, exported more interfaces, and moved
additional code from setfiles into libselinux so that setfiles can
directly use matchpathcon.
Prevent overflow of spec array in matchpathcon.
Fixed several uses of internal functions to avoid relocations.
Changed rpm_execcon to check is_selinux_enabled() and fallback to a regular
execve if not enabled (or unable to determine due to a lack of /proc,
e.g. chroot'd environment).
Removed some trivial utils that were not useful or redundant.
Changed BINDIR default to /usr/sbin to match change in Fedora.
Added security_compute_member.
Added man page for setcon.
