Skip to content

Commit 5343d31

Browse files
pebenitopebenito
committed
Update Changelog and VERSION for release 2.20220106.
Signed-off-by: Chris PeBenito <[email protected]>
1 parent bfc448e commit 5343d31

File tree

2 files changed

+169
-1
lines changed

2 files changed

+169
-1
lines changed

‎Changelog‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,171 @@
1+
* Thu Jan 06 2022 Chris PeBenito <[email protected]> - 2.20220106
2+
Björn Esser (1):
3+
authlogin: add fcontext for tcb
4+
5+
Chris PeBenito (72):
6+
0xC0ncord/bugfix/systemd-user-exec-apps-hookup
7+
systemd, ssh, ntp: Read fips_enabled crypto sysctl.
8+
systemd: Unit generator fixes.
9+
systemd: Revise tmpfiles factory to allow writing all configs.
10+
systemd: User runtime reads user cgroup files.
11+
logging: Add audit_control for journald.
12+
udev: Manage EFI variables.
13+
ntp: Handle symlink to drift directory.
14+
logging: Allow auditd to stat() dispatcher executables.
15+
Drop module versioning.
16+
tests.yml: Disable policy_module() selint checks.
17+
18+
Christian Goettsche (1):
19+
check_fc_files: allow optional @ character
20+
21+
Christian Göttsche (2):
22+
filesystem: add fs_use_trans for ramfs
23+
Ignore umask on when installing headers
24+
25+
Dave Sugar (4):
26+
Allow iscsid to request kernel module load
27+
Allow iscsid to check fips_enabled
28+
sshd: allow to run /usr/bin/fipscheck (to check fips state)
29+
systemd: resolve error with systemd-sysctl
30+
31+
Fabrice Fontaine (2):
32+
policy/modules/services/samba.te: make crack optional
33+
policy/modules/services/wireguard.te: make iptables optional
34+
35+
Gao Xiang (1):
36+
Add erofs as a SELinux capable file system
37+
38+
Jonathan Davies (7):
39+
chronyd.te: Added chronyd_hwtimestamp boolean for chronyd_t to access
40+
net_admin capability, this is required for its `hwtimestamp` option,
41+
which otherwise returns:
42+
virt.te: Fixed typo in virtlogd_t virt_common_runtime_t
43+
manage_files_pattern.
44+
obfs4proxy: Added policy.
45+
tor: Added interfaces and types for obfs4proxy support.
46+
corenetwork.te.in: Added ntske port.
47+
chronyd.te: Added support for bind/connect/recv/send NTS packets.
48+
chronyd: Allow access to read certs.
49+
50+
Kenton Groombridge (83):
51+
userdomain: add user exec domain attribute and interface
52+
systemd: assign user exec attribute to systemd --user instances
53+
systemd: add interface to support monitoring and output capturing of child
54+
processes
55+
wm: add user exec domain attribute to wm domains
56+
ssh: add interface to execute and transition to ssh client
57+
userdomain: add interface to allow mapping all user home content
58+
git, roles: add policy for git client
59+
apache, roles: use user exec domain attribute
60+
screen, roles: use user exec domain attribute
61+
git, roles: use user exec domain attribute
62+
postgresql, roles: use user exec domain attribute
63+
ssh, roles: use user exec domain attribute
64+
sudo, roles: use user exec domain attribute
65+
syncthing, roles: use user exec domain attribute
66+
xscreensaver, roles: use user exec domain attribute
67+
xserver, roles, various: use user exec domain attribute
68+
authlogin, roles: use user exec domain attribute
69+
bluetooth, roles: use user exec domain attribute
70+
cdrecord, roles: use user exec domain attribute
71+
chromium, roles: use user exec domain attribute
72+
cron, roles: use user exec domain attribute
73+
dirmngr, roles: use user exec domain attribute
74+
evolution, roles: use user exec domain attribute
75+
games, roles: use user exec domain attribute
76+
gnome, roles: use user exec domain attribute
77+
gpg, roles: use user exec domain attribute
78+
irc, roles: use user exec domain attribute
79+
java, roles: use user exec domain attribute
80+
libmtp, roles: use user exec domain attribute
81+
lpd, roles: use user exec domain attribute
82+
mozilla, roles: use user exec domain attribute
83+
mplayer, roles: use user exec domain attribute
84+
mta, roles: use user exec domain attribute
85+
openoffice, roles: use user exec domain attribute
86+
pulseaudio, roles: use user exec domain attribute
87+
pyzor, roles: use user exec domain attribute
88+
razor, roles: use user exec domain attribute
89+
rssh, roles: use user exec domain attribute
90+
spamassassin, roles: use user exec domain attribute
91+
su, roles: use user exec domain attribute
92+
telepathy, roles: use user exec domain attribute
93+
thunderbird, roles: use user exec domain attribute
94+
tvtime, roles: use user exec domain attribute
95+
uml, roles: use user exec domain attribute
96+
userhelper, roles: use user exec domain attribute
97+
vmware, roles: use user exec domain attribute
98+
wireshark, roles: use user exec domain attribute
99+
wm, roles: use user exec domain attribute
100+
hadoop, roles: use user exec domain attribute
101+
shutdown, roles: use user exec domain attribute
102+
cryfs, roles: use user exec domain attribute
103+
wine: use user exec domain attribute
104+
mono: use user exec domain attribute
105+
sudo: add tunable to control user exec domain access
106+
su: add tunable to control user exec domain access
107+
shutdown: add tunable to control user exec domain access
108+
mpd, pulseaudio: split domtrans and client access
109+
mcs: deprecate mcs overrides
110+
mcs: restrict create, relabelto on mcs files
111+
fs: add pseudofs attribute and interfaces
112+
devices: make usbfs pseudofs instead of noxattrfs
113+
git: fix typo in git hook exec access
114+
dovecot, spamassassin: allow dovecot to execute spamc
115+
mta, spamassassin: fixes for rspamd
116+
certbot, various: allow various services to read certbot certs
117+
usbguard, sysadm: misc fixes
118+
ssh: fix for polyinstantiation
119+
sysadm, systemd: fixes for systemd-networkd
120+
asterisk: allow reading generic certs
121+
bind: fixes for unbound
122+
netutils: fix ping
123+
policykit, systemd: allow policykit to watch systemd logins and sessions
124+
spamassassin: fix file contexts for rspamd symlinks
125+
mcs: add additional constraints to databases
126+
mcs: constrain misc IPC objects
127+
mcs: combine single-level object creation constraints
128+
various: deprecate mcs override interfaces
129+
corenet: make netlabel_peer_t mcs constrained
130+
mcs: constrain context contain access
131+
mcs: only constrain mcs_constrained_type for db accesses
132+
guest, xguest: remove apache role access
133+
wine: fix roleattribute statement
134+
testing: accept '@' as a valid ending character in filecon checker
135+
136+
Pedro (1):
137+
File context for nginx cache files
138+
139+
Vit Mojzis (1):
140+
Improve error message on duplicate definition of interface
141+
142+
Yi Zhao (24):
143+
rpc: remove obsolete comment line
144+
secadm: allow secadm to read selinux policy
145+
rpcbind: allow sysadm to run rpcinfo
146+
samba: allow smbd_t to send and receive messages from avahi over dbus
147+
rpc: add dac_read_search capability for rpcd_t
148+
bluetooth: fixes for bluetoothd
149+
avahi: allow avahi_t to watch /etc/avahi directory
150+
udev: allow udev_t to watch udev_rules_t dir
151+
rpc: allow rpc.mountd to list/watch NFS server directory
152+
usermanage: do not audit attempts to getattr of proc for passwd_t and
153+
useradd_t
154+
selinuxutil: allow setfiles_t to read kernel sysctl
155+
rngd: fixes for rngd
156+
dbus: allow dbus-daemon to map SELinux status page
157+
bind: fixes for bind
158+
passwd: allow passwd to map SELinux status page
159+
ipsec: fixes for strongswan
160+
samba: fixes for smbd/nmbd
161+
ntp: allow ntpd to set rlimit_memlock
162+
ssh: do not audit attempts by ssh-keygen to read proc
163+
acpid: allow acpid to watch the directories in /dev
164+
bluetooth: allow bluetoothd to create alg_socket
165+
systemd: allow systemd-hostnamed to read udev runtime files
166+
su: allow su to map SELinux status page
167+
modutils: allow kmod_t to write keys
168+
1169
* Wed Sep 08 2021 Chris PeBenito <[email protected]> - 2.20210908
2170
Andreas Freimuth (2):
3171
Prefer user_fonts_config_t over xdg_config_t

‎VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
2.20210908
1+
2.20220106

0 commit comments

Comments
 (0)