[ol9_baseos_latest] selinux-policy-mls-38.1.53-2.0.1.el9.noarch

SELinux MLS (Multi Level Security) policy package.

Changelog (Show File list) (Show related packages)

• Fri Mar 07 2025 Pooja Senthil Kumar <pooja.senthil.kumar@oracle.com> - 38.1.53-2.0.1

  - Fixed avc for agetty checkpoint restore denied [Orabug: 36893425]
  - Change reference in /etc/selinux/config to point to Oracle doc [Orabug: 36899915]
  - Allow user_mail_domain to manage exim_log_t and exim_spool_t link files [Orabug: 36617121]
  - Allow exim read network sysctls [Orabug: 36606051]
  - Allow exim_t to read exim_log_t and manage exim_spool_t link files [Orabug: 36430005]
  - Allow cgred_t to get attributes of cgroup filesystems [Orabug: 36176655]
  - Allow kdumpctl_t to execmem [Orabug: 35381156]
  - Allow NetworkManager_dispatcher_dhclient_t to execute shells without a domain transition [Orabug: 35091334]
  - Allow NetworkManager_dispatcher_dhclient_t to read the DHCP configuration files [Orabug: 35122619]
  - Label /var/log/kdump.log with kdump_log_t [Orabug: 33810371]
  - Allow rpm_t sys_admin capability [Orabug: 34250651]
  - Make systemd_tmpfiles_t MLS trusted for lowering the level of files [Orabug: 33841245]
  - Allow nfsd_t to list exports_t dirs [Orabug: 33844301]
  - Allow fsadm_t to get attributes of cgroup filesystems [Orabug: 33841268]
  - Allow tuned_t to read the process state of all domains [Orabug: 33520684]
  - Make import-state work with mls policy [Orabug: 32636699]
  - Add map permission to lvm_t on lvm_metadata_t. [Orabug: 31405325]
  - Add comment for map on lvm_metadata_t. [Orabug: 31405325]
  - Make iscsiadm work with mls policy [Orabug: 32725411]
  - Make cloud-init work with mls policy [Orabug: 32430460]
  - Allow systemd-pstore to transfer files from /sys/fs/pstore [Orabug: 31594666]
  - Make smartd work with mls policy [Orabug: 32430379]
  - Allow sysadm_t to mmap modules_object_t files [Orabug: 32411855]
  - Allow tuned_t to execute systemd_systemctl_exec_t files [Orabug: 32355342]
  - Make udev work with mls policy [Orabug: 31405299]
  - Make tuned work with mls policy [Orabug: 31396024]
  - Make lsmd, rngd, and kdumpctl work with mls policy [Orabug: 31405378]
  - Allow virt_domain to mmap virt_content_t files [Orabug: 30932671]
  - Enable NetworkManager and dhclient to use initramfs-configured DHCP connection [Orabug: 30537515]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Fix container selinux policy [Orabug: 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type. [Orabug: 13333429]

• Fri Feb 07 2025 Zdenek Pytela <zpytela@redhat.com> - 38.1.53-1

  - Allow svirt_t to connect to nbdkit over a unix stream socket
  Resolves: RHEL-56029
  - Allow power-profiles-daemon the bpf capability
  Resolves: RHEL-61117
  - Allow systemd-machined the kill user-namespace capability
  Resolves: RHEL-76352

• Fri Jan 31 2025 Zdenek Pytela <zpytela@redhat.com> - 38.1.52-1

  - Add the files_read_root_files() interface
  Resolves: RHEL-70849
  - Dontaudit systemd-logind remove all files
  Resolves: RHEL-59145
  - Add the files_dontaudit_read_all_dirs() interface
  Resolves: RHEL-59145
  - Add the files_dontaudit_delete_all_files() interface
  Resolves: RHEL-59145
  - Allow rhsmcertd notify virt-who
  Resolves: RHEL-77152
  - Allow irqbalance to run unconfined scripts conditionally
  Resolves: RHEL-1556
  - Backport bootupd policy from current Fedora rawhide
  Resolves: RHEL-70849
  - Support using systemd containers
  Resolves: RHEL-76352
  - Allow svirt_t connect to unconfined_t over a unix domain socket
  Resolves: RHEL-37539
  - Allow virt_domain to use pulseaudio - conditional
  Resolves: RHEL-1379
  - Allow telnetd read network sysctls
  Resolves: RHEL-58825
  - Allow alsa watch generic device directories
  Resolves: RHEL-61472
  - Update switcheroo policy
  Resolves: RHEL-24268

• Wed Jan 15 2025 Zdenek Pytela <zpytela@redhat.com> - 38.1.51-1

  - Allow rsyslog read systemd-logind session files
  Resolves: RHEL-73839
  - Allow samba-bgqd connect to cupsd over an unix domain stream socket
  Resolves: RHEL-72860
  - Allow svirt_t read sysfs files
  Resolves: RHEL-70839
  - Allow xdm dbus chat with power-profiles-daemon
  Resolves: RHEL-61117
  - Update power-profiles-daemon policy
  Resolves: RHEL-61117
  - Confine power-profiles-daemon
  Resolves: RHEL-61117
  - Allow virtqemud domain transition to nbdkit
  Resolves: RHEL-56029
  - Add nbdkit interfaces defined conditionally
  Resolves: RHEL-56029
  - Confine the switcheroo-control service
  Resolves: RHEL-24268

• Fri Dec 13 2024 Zdenek Pytela <zpytela@redhat.com> - 38.1.50-1

  - Allow auditctl signal auditd
  Resolves: RHEL-68969
  - Fix the cups_read_pid_files() interface to use read_files_pattern
  Resolves: RHEL-69517
  - Dontaudit systemd-coredump the sys_resource capability
  Resolves: RHEL-46339
  - Allow rpcd read network sysctls
  Resolves: RHEL-1558
  - Allow irqbalance setpcap capability in the user namespace
  Resolves: RHEL-69564
  - Allow traceroute_t bind rawip sockets to unreserved ports
  Resolves: RHEL-54561
  - Allow svirt_t the sys_rawio capability
  Resolves: RHEL-56955
  - Change /run/sysctl\.d(/.*)? fc entry to /var/run/sysctl\.d(/.*)?
  Resolves: RHEL-56988
  - Exclude container-selinux manpage from selinux-policy-doc
  Resolves: RHEL-69916

• Fri Dec 06 2024 Zdenek Pytela <zpytela@redhat.com> - 38.1.49-1

  - Update virtlogd policy
  Resolves: RHEL-69433
  - Allow svirt_t the sys_rawio capability
  Resolves: RHEL-56955
  - Allow qemu-ga the dac_override and dac_read_search capabilities
  Resolves: RHEL-52476
  - Allow ip the setexec permission
  Resolves: RHEL-62923
  - Allow alsa get attributes filesystems with extended attributes
  Resolves: RHEL-61472
  - Allow bacula execute container in the container domain
  Resolves: RHEL-21168
  - Allow httpd get attributes of dirsrv unit files
  Resolves: RHEL-46808
  - Update samba-bgqd policy
  Resolves: RHEL-69517
  - Allow samba-bgqd read cups config files
  Resolves: RHEL-69517
  - Update policy for samba-bgqd
  Resolves: RHEL-69517
  - Update bootupd policy for the removing-state-file test
  Resolves: RHEL-66584
  - Allow qatlib search the content of the kernel debugging filesystem
  Resolves: RHEL-53864
  - Allow qatlib connect to systemd-machined over a unix socket
  Resolves: RHEL-53864
  - Update qatlib policy for v24.02 with new features
  Resolves: RHEL-53864

• Tue Nov 12 2024 Zdenek Pytela <zpytela@redhat.com> - 38.1.48-1

  - Revert "Allow unconfined_t execute kmod in the kmod domain"
  Resolves: RHEL-65008
  - Add policy for /usr/libexec/samba/samba-bgqd
  Resolves: RHEL-53124

• Wed Oct 23 2024 Zdenek Pytela <zpytela@redhat.com> - 38.1.47-1

  - Label /etc/sysctl.d and /run/sysctl.d with system_conf_t
  Resolves: RHEL-56988
  - Allow lldpad create and use netlink_generic_socket
  Resolves: RHEL-61832
  - Allow unconfined_t execute kmod in the kmod domain
  Resolves: RHEL-54710
  - Allow confined users r/w to screen unix stream socket
  Resolves: RHEL-50379
  - Label /root/.screenrc and /root/.tmux.conf with screen_home_t
  Resolves: RHEL-50375
  - Allow iio-sensor-proxy the bpf capability
  Resolves: RHEL-17346

• Fri Oct 11 2024 Zdenek Pytela <zpytela@redhat.com> - 38.1.46-1

  - Rebuild

• Thu Oct 10 2024 Zdenek Pytela <zpytela@redhat.com> - 35.1.46-1

  - Label /run/modprobe.d with modules_conf_t
  Resolves: RHEL-61453
  - Allow boothd connect to kernel over a unix socket
  Resolves: RHEL-57104
  - Allow boothd connect to systemd-userdbd over a unix socket
  Resolves: RHEL-57104
  - Additional updates stalld policy for bpf usage
  Resolves: RHEL-57075
  - Update stalld policy for bpf usage
  Resolves: RHEL-57075
  - Allow ptp4l the sys_admin capability
  Resolves: RHEL-55133
  - Label /dev/hfi1_[0-9]+ devices
  Resolves: RHEL-54996
  - Confine iio-sensor-proxy
  Resolves: RHEL-17346