-
Tue May 10 2022 EL Errata <el-errata_ww@oracle.com> - 3.14.3-95.0.1
- Allow tuned_t to read the process state of all domains [Orabug: 33520684]
- Allow initrc_t to manage pid files used by chronyd [Orabug: 33520623]
- Make import-state work with mls policy [Orabug: 32636699]
- Add map permission to lvm_t on lvm_metadata_t. [Orabug: 31405325]
- Add comment for map on lvm_metadata_t. [Orabug: 31405325]
- Add file context for /var/run/fsck [Orabug: 32789338]
- Make iscsiadm work with mls policy [Orabug: 32725411]
- Make cloud-init work with mls policy [Orabug: 32430460]
- Allow systemd-pstore to transfer files from /sys/fs/pstore [Orabug: 31594666]
- Make smartd work with mls policy [Orabug: 32430379]
- Allow sysadm_t to mmap modules_object_t files [Orabug: 32411855]
- Allow tuned_t to execute systemd_systemctl_exec_t files [Orabug: 32355342]
- Make logrotate work with mls policy [Orabug: 32343731]
- Add interface kernel_relabelfrom_usermodehelper() [Orabug: 31396031]
- Allow systemd_tmpfiles_t domain to relabel from usermodehelper_t files [Orabug: 31396031]
- Make udev work with mls policy [Orabug: 31405299]
- Make tuned work with mls policy [Orabug: 31396024]
- Make lsmd, rngd, and kdumpctl work with mls policy [Orabug: 31405378]
- Allow virt_domain to mmap virt_content_t files [Orabug: 30932671]
- Enable NetworkManager and dhclient to use initramfs-configured DHCP connection [Orabug: 30537515]
- Enable policykit and sssd policy modules with minimum policy [Orabug: 29744511]
- Allow udev_t to load modules [Orabug: 28260775]
- Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
- Fix container selinux policy [Orabug: 26427364]
- Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type. [Orabug: 13333429]
-
Thu Mar 24 2022 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-95
- Allow hostapd talk with unconfined user over unix domain dgram socket
Resolves: rhbz#2064284
-
Thu Mar 10 2022 Nikola Knazekova nknazeko@redhat.com - 3.14.3-94
- Allow chronyd send a message to sosreport over datagram socket
- Allow systemd-logind dbus chat with sosreport
Resolves: rhbz#1949493
-
Thu Feb 24 2022 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-93
- Allow systemd-networkd dbus chat with sosreport
Resolves: rhbz#1949493
- Allow sysadm_passwd_t to relabel passwd and group files
Resolves: rhbz#2053457
- Allow confined sysadmin to use tool vipw
Resolves: rhbz#2053457
- Allow sosreport dbus chat with abrt and timedatex
Resolves: rhbz#1949493
- Remove unnecessary /etc file transitions for insights-client
Resolves: rhbz#2031853
- Label all content in /var/lib/insights with insights_client_var_lib_t
Resolves: rhbz#2031853
- Update insights-client policy
Resolves: rhbz#2031853
- Update insights-client: fc pattern, motd, writing to etc
Resolves: rhbz#2031853
- Remove permissive domain for insights_client_t
Resolves: rhbz#2031853
- New policy for insight-client
Resolves: rhbz#2031853
- Add the insights_client module
Resolves: rhbz#2031853
- Update specfile to buildrequire policycoreutils-devel >= 2.9-19
- Add modules_checksum to %files
-
Wed Feb 16 2022 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-92
- Allow postfix_domain read dovecot certificates 1/2
Resolves: rhbz#2043599
- Dontaudit dirsrv search filesystem sysctl directories 1/2
Resolves: rhbz#2042568
- Allow chage domtrans to sssd
Resolves: rhbz#2054718
- Allow postfix_domain read dovecot certificates 2/2
Resolves: rhbz#2043599
- Allow ctdb create cluster logs
Resolves: rhbz#2049481
- Allow alsa bind mixer controls to led triggers
Resolves: rhbz#2049730
- Allow alsactl set group Process ID of a process
Resolves: rhbz#2049730
- Dontaudit mdadm list dirsrv tmpfs dirs
Resolves: rhbz#2011174
- Dontaudit dirsrv search filesystem sysctl directories 2/2
Resolves: rhbz#2042568
- Revert "Label NetworkManager-dispatcher service with separate context"
Related: rhbz#1989070
- Revert "Allow NetworkManager-dispatcher dbus chat with NetworkManager"
Related: rhbz#1989070
-
Wed Feb 09 2022 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-91
- Allow NetworkManager-dispatcher dbus chat with NetworkManager
Resolves: rhbz#1989070
-
Fri Feb 04 2022 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-90
- Fix badly indented used interfaces
Resolves: rhbz#2030156
- Allow domain transition to sssd_t 1/2
Resolves: rhbz#2022690
- Allow confined users to use kinit,klist and etc.
Resolves: rhbz#2026598
- Allow login_userdomain open/read/map system journal
Resolves: rhbz#2046481
- Allow init read stratis data symlinks 2/2
Resolves: rhbz#2048514
- Label new utility of NetworkManager nm-priv-helper
Resolves: rhbz#1986076
- Label NetworkManager-dispatcher service with separate context
Resolves: rhbz#1989070
- Allow domtrans to sssd_t and role access to sssd
Resolves: rhbz#2030156
- Creating interface sssd_run_sssd()
Resolves: rhbz#2030156
- Allow domain transition to sssd_t 2/2
Resolves: rhbz#2022690
- Allow timedatex dbus chat with xdm
Resolves: rhbz#2040214
- Associate stratisd_data_t with device filesystem
Resolves: rhbz#2048514
- Allow init read stratis data symlinks 1/2
Resolves: rhbz#2048514
- Allow rhsmcertd create rpm hawkey logs with correct label
Resolves: rhbz#1949871
-
Wed Jan 26 2022 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-89
- Allow NetworkManager talk with unconfined user over unix domain dgram socket
Resolves: rhbz#2044048
- Allow system_mail_t read inherited apache system content rw files
Resolves: rhbz#1988339
- Add apache_read_inherited_sys_content_rw_files() interface
Related: rhbz#1988339
- Allow rhsm-service execute its private memfd: objects
Resolves: rhbz#2029873
- Allow dirsrv read configfs files and directories
Resolves: rhbz#2042568
- Label /run/stratisd with stratisd_var_run_t
Resolves: rhbz#1879585
- Fix path for excluding container.if from selinux-policy-devel
Resolves: rhbz#1861968
-
Thu Jan 20 2022 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-88
- Revert "Label /etc/cockpit/ws-certs.d with cert_t"
Related: rhbz#1907473
-
Tue Jan 18 2022 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-87
- Set default file context for /sys/firmware/efi/efivars
Resolves: rhbz#2039458
- Allow sysadm_t start and stop transient services
Resolves: rhbz#2031065
- Label /etc/cockpit/ws-certs.d with cert_t
Resolves: rhbz#1907473
- Allow smbcontrol read the network state information
Resolves: rhbz#2033873
- Allow rhsm-service read/write its private memfd: objects
Resolves: rhbz#2029873
- Allow fcoemon request the kernel to load a module
Resolves: rhbz#1940317
- Allow radiusd connect to the radacct port
Resolves: rhbz#2038955
- Label /var/lib/shorewall6-lite with shorewall_var_lib_t
Resolves: rhbz#2041447
- Exclude container.if from selinux-policy-devel
Resolves: rhbz#1861968