SELinux Archive on lore.kernel.org
 help / Atom feed
* ANN: Reference Policy release
@ 2019-02-01 20:22 Chris PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Chris PeBenito @ 2019-02-01 20:22 UTC (permalink / raw)
  To: selinux, refpolicy

This release includes three new modules (chromium, hostapd, and sigrok) 
among other miscellaneous fixes.

142 files changed, 2499 insertions, 270 deletions

<https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20190201>

-- 
Chris PeBenito

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy release
@ 2018-07-01 17:40 Chris PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Chris PeBenito @ 2018-07-01 17:40 UTC (permalink / raw)
  To: SELinux, refpolicy

In this release, the refpolicy and refpolicy-contrib repositories were 
remerged; the modules were moved out of the contrib layer. It also 
includes a large update for the X Desktop Group base directory 
specification and SCTP support, among various other fixes.

Refpolicy now requires SELinux userspace v2.8 to compile.

<https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20180701>

-- 
Chris PeBenito

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2017-02-04 19:02 Chris PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Chris PeBenito @ 2017-02-04 19:02 UTC (permalink / raw)
  To: refpolicy, SELinux

A new release, 2.20170204, of the SELinux Reference Policy is now 
available on the GitHub site:

https://github.com/TresysTechnology/refpolicy/wiki/DownloadRelease

The full changelog is too long to include in this email, so here's the
diffstat instead:

Core:
155 files changed, 1930 insertions(+), 813 deletions(-)

Contrib:
505 files changed, 1840 insertions(+), 903 deletions(-)

-- 
Chris PeBenito

^ permalink raw reply	[flat|nested] 43+ messages in thread

* Re: ANN: Reference Policy Release
  2016-11-02  4:13 ` Russell Coker
@ 2016-11-02 22:19   ` Chris PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Chris PeBenito @ 2016-11-02 22:19 UTC (permalink / raw)
  To: russell, selinux; +Cc: refpolicy

On 11/02/16 00:13, Russell Coker wrote:
> On Sunday, 23 October 2016 5:29:25 PM AEDT Chris PeBenito wrote:
>> A new release of the SELinux Reference Policy is now available on the
>> GitHub site, https://github.com/TresysTechnology/refpolicy.
>
> https://github.com/TresysTechnology/refpolicy/wiki/DownloadRelease
>
> The archive at the above page has the files policy.28 and policy.30.orig which
> comprise more than half the compressed archive size.
>
> Could you make a new release without them?  Otherwise we are going to have
> that in all the distribution archives and mirror sites.

I've fixed the release package; sorry about that.

> Also in future could we have more frequent releases?  More frequent upstream
> releases makes it easier for distribution people to send changes upstream and
> gives a greater incentive to do so.

Yes, I'd like to get back closer to 4/year at least.

-- 
Chris PeBenito

^ permalink raw reply	[flat|nested] 43+ messages in thread

* Re: ANN: Reference Policy Release
  2016-10-23 21:29 Chris PeBenito
@ 2016-11-02  4:13 ` Russell Coker
  2016-11-02 22:19   ` Chris PeBenito
  0 siblings, 1 reply; 43+ messages in thread
From: Russell Coker @ 2016-11-02  4:13 UTC (permalink / raw)
  To: selinux; +Cc: Chris PeBenito, refpolicy

On Sunday, 23 October 2016 5:29:25 PM AEDT Chris PeBenito wrote:
> A new release of the SELinux Reference Policy is now available on the
> GitHub site, https://github.com/TresysTechnology/refpolicy.

https://github.com/TresysTechnology/refpolicy/wiki/DownloadRelease

The archive at the above page has the files policy.28 and policy.30.orig which 
comprise more than half the compressed archive size.

Could you make a new release without them?  Otherwise we are going to have 
that in all the distribution archives and mirror sites.

Also in future could we have more frequent releases?  More frequent upstream 
releases makes it easier for distribution people to send changes upstream and 
gives a greater incentive to do so.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2016-10-23 21:29 Chris PeBenito
  2016-11-02  4:13 ` Russell Coker
  0 siblings, 1 reply; 43+ messages in thread
From: Chris PeBenito @ 2016-10-23 21:29 UTC (permalink / raw)
  To: refpolicy, SELinux

A new release of the SELinux Reference Policy is now available on the
GitHub site, https://github.com/TresysTechnology/refpolicy.

The full changelog is too long to include in this email, so here's the
diffstat instead:

Core:
82 files changed, 1411 insertions(+), 225 deletions(-)

Contrib:
125 files changed, 1275 insertions(+), 133 deletions(-)

-- 
Chris PeBenito

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2015-12-08 15:49 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2015-12-08 15:49 UTC (permalink / raw)
  To: refpolicy, selinux

A new release of the SELinux Reference Policy is now available on the
Tresys GitHub site, https://github.com/TresysTechnology/refpolicy.

The full changelog is too long to include in this email, so here's the
diffstat instead:

Core:
81 files changed, 3566 insertions(+), 204 deletions(-)

Contrib:
451 files changed, 957 insertions(+), 1092 deletions(-)

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2014-12-03 19:31 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2014-12-03 19:31 UTC (permalink / raw)
  To: refpolicy, selinux

A new release of the SELinux Reference Policy is now available on the
Tresys GitHub site, https://github.com/TresysTechnology/refpolicy.

The full changelog is too long to include in this email, so here's the
diffstat instead:

Core:
87 files changed, 897 insertions(+), 321 deletions(-)

Contrib:
104 files changed, 558 insertions(+), 137 deletions(-)

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2014-03-11 13:33 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2014-03-11 13:33 UTC (permalink / raw)
  To: refpolicy, selinux

A new release of the SELinux Reference Policy is now available on the Tresys OSS site, http://oss.tresys.com.

The full change log is too long to include in this email, so here's the diffstat instead:

Core:
77 files changed, 1176 insertions(+), 349 deletions(-)

Contrib:
212 files changed, 2509 insertions(+), 370 deletions(-)


-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2013-04-24 20:56 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2013-04-24 20:56 UTC (permalink / raw)
  To: refpolicy, selinux

A new release of the SELinux Reference Policy is now available on the Tresys OSS site, http://oss.tresys.com.

The major change is by Dominick Grift merging a significant amount of the Fedora policy.

The full change log is too long to include in this email, so here's the diffstat instead:

Core:
79 files changed, 2233 insertions(+), 1153 deletions(-)

Contrib:
1031 files changed, 37796 insertions(+), 16448 deletions(-)


-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2012-07-26 16:41 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2012-07-26 16:41 UTC (permalink / raw)
  To: refpolicy, selinux

A new release of the SELinux Reference Policy is now available on the Tresys OSS site, http://oss.tresys.com.

* Wed Jul 25 2012 Chris PeBenito <selinux@tresys.com> - 2.20120725
- Rename epollwakeup capability2 permission to block_suspend to match the
  corresponding kernel capability rename.
- Udev and init changes to support /run, from Sven Vermeulen.
- auth_use_nsswitch updates from Miroslav Grepl.
- Mount runtime files fix from Guido Trentalancia.
- Update Python scripts to support Python 3, from Sven Vermeulen.
- Update capability2 object class for new wake_alarm and epollwakeup
  capabilities.
- SEPostgresql updates from Kohei KaiGai.
- Simplify file contexts based on file context path substitutions, from Sven
  Vermeulen.
- Add optional name for kernel and system filetrans interfaces.
- Non-auth file attribute to eliminate set expressions, from James Carter.
- Virt updates from Sven Vermeulen.
- Various dontaudits from Sven Vermeulen.
- Fix base module and monolithic role declaration ordering issue now that
  role declarations must be explicit, from Harry Ciao.
- Added contrib modules:
        bacula (Stan Sander/Sven Vermeulen)
        bcfg2 (Miroslav Grepl)
        blueman (Miroslav Grepl)


-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2012-02-15 20:19 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2012-02-15 20:19 UTC (permalink / raw)
  To: refpolicy, selinux

A new release of the SELinux Reference Policy is now available on the Tresys OSS site, http://oss.tresys.com.  This release reflects the git repository restructuring for core/contrib modules[1].

The complete change log for this release follows at the end of the email.

For people interested in helping Reference Policy development, the X desktop and role separation needs testing, in addition to general testing.

[1] http://oss.tresys.com/pipermail/refpolicy/2011-September/004619.html

* Wed Feb 15 2012 Chris PeBenito <selinux@tresys.com> - 2.20120215
- Sshd usage of mkhomedir_helper via oddjob, from Sven Vermeulen.
- Add slim and lxdm file contexts to xserver, from Sven Vermeulen.
- Add userdom interfaces for user application domains, user tmp files,
  and user tmpfs files.
- Asterisk administration fixes from Sven Vermeulen.
- Fix makefiles to install files with the correct DAC permissions if the
  umask is not 022.
- Remove deprecated support macros.
- Remove rolemap and per-role template support.
- Change corenetwork port declaration to apply the reserved port type
  attribute only, when the type has ports above and below 1024.
- Change secure_mode_policyload to disable only toggling of this Boolean
  rather than disabling all Boolean toggling permissions.
- Use role attributes to assist with domain transitions in interactive
  programs.
- Milter ports patch from Paul Howarth.
- Separate portage fetch rules out of portage_run() and portage_domtrans()
  from Sven Vermeulen.
- Enhance corenetwork network_port() macro to support ports that do not have
  a well defined port number, such as stunnel.
- Opendkim support in dkim module from Paul Howarth.
- Wireshark updates from Sven Vermeulen.
- Change secure_mode_insmod to control sys_module capability rather than
  controlling domain transitions to insmod.
- Openrc and portage updates from Sven Vermeulen.
- Allow user and role changes on dynamic transitions with the same
  constraints as regular transitions.
- New git service features from Dominick Grift.
- Corenetwork policy size optimization from Dan Walsh.
- Silence spurious udp_socket listen denials.
- Fix unexpanded MLS/MCS fields in monolithic seusers file.
- Type transition fix in Postgresql database objects from KaiGai Kohei.
- Support for file context path substitutions (file_contexts.subs).
- Added contrib modules:
        glance (Dan Walsh)
        rhsmcertd (Dan Walsh)
        sanlock (Dan Walsh)
        sblim (Dan Walsh)
        uuidd (Dan Walsh)
        vdagent (Dan Walsh)


-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2011-07-26 18:44 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2011-07-26 18:44 UTC (permalink / raw)
  To: refpolicy, selinux

A new release of the SELinux Reference Policy is now available on
the Tresys OSS site, http://oss.tresys.com.  This release primarily
focused on general maintenance.

The complete change log for this release follows at the end of the
email.

For people interested in helping Reference Policy development, the X
desktop and role separation needs testing, in addition to general
testing.

* Tue Jul 26 2011 Chris PeBenito <selinux@tresys.com> - 2.20110726
- Fix role declarations to handle role attribute compilers.
- Rename audioentropy module to entropyd due to haveged support.
- Add haveged support from Sven Vermeulen.
- Authentication file patch from Matthew Ife.
- Add agent support to zabbix from Sven Vermeulen.
- Cyrus file context update for Gentoo from Corentin Labbe.
- Portage updates from Sven Vermeulen.
- Fix init_system_domain() description, pointed out by Elia Pinto.
- Postgresql selabel_lookup update from KaiGai Kohei.
- Dovecot managesieve support from Mika Pfluger.
- Semicolon after interface/template calls cleanup from Elia Pinto.
- Gentoo courier updates from Sven Vermeulen.
- Amavis patch for connecting to nslcd from Miroslav Grepl.
- Shorewall patch from Miroslav Grepl.
- Cpufreqselector dbus patch from Guido Trentalancia.
- Cron pam_namespace and pam_loginuid support from Harry Ciao.
- Xserver update for startx from Sven Vermeulen.
- Fix MLS constraint for contains permission from Harry Ciao.
- Apache user webpages fix from Dominick Grift.
- Change default build.conf to modular policy from Stephen Smalley.
- Xen refinement patch from Stephen Smalley.
- Sudo timestamp file location update from Sven Vermeulen.
- XServer keyboard event patch from Sven Vermeulen.
- RAID uevent patch from Sven Vermeulen.
- Gentoo ALSA init script usage patch from Sven Vermeulen.
- LVM semaphore usage patch from Sven Vermeulen.
- Module load request patch for insmod from Sven Vermeulen.
- Cron default contexts fix from Harry Ciao.
- Man page fixes from Justin Mattock.
- Add syslog capability.
- Support for logging in to /dev/console, from Harry Ciao.
- Database object class updates and associated SEPostgreSQL changes from
   KaiGai Kohei.
- IPSEC SPD and Hadoop IPSEC updates from Paul Nuzzi.
- Mount updates from Harry Ciao.
- Semanage update for MLS systems from Harry Ciao.
- Vlock terminal use update from Harry Ciao.
- Hadoop CDH3 updates from Paul Nuzzi.
- Add sepgsql_contexts appconfig files from KaiGai Kohei.
- Added modules:
         aiccu
         bugzilla (Dan Walsh)
         colord (Dan Walsh)
         cmirrord (Miroslav Grepl)
         mediawiki (Miroslav Grepl)
         mpd (Miroslav Grepl)
         ncftool
         passenger (Miroslav Grepl)
         qpid (Dan Walsh)
         samhain (Harry Ciao)
         telepathy (Dominick Grift)
         tcsd (Stephen Smalley)
         vnstatd (Dan Walsh)
         zarafa (Miroslav Grepl)


-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2010-12-14 16:39 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2010-12-14 16:39 UTC (permalink / raw)
  To: refpolicy, selinux

A new release of the SELinux Reference Policy is now available on
the Tresys OSS site, http://oss.tresys.com.  This release primarily
focused on general maintenance.

The complete change log for this release follows at the end of the
email.

For people interested in helping Reference Policy development, the X
desktop and role separation needs testing, in addition to general
testing.

* Mon Dec 13 2010 Chris PeBenito <selinux@tresys.com> - 2.20101213
- Git man page from Dominick Grift.
- Alsa and oident home content cleanup from Dominick Grift.
- Add support for custom build options.
- Unconditional staff and user oidentd home config access from Dominick
Grift.
- Conditional mmap_zero support from Dominick Grift.
- Added devtmpfs support.
- Dbadm updates from KaiGai Kohei.
- Virtio disk file context update from Mika Pfluger.
- Increase bindreservport range to 512-1024 in corenetwork, from Dan Walsh.
- Add JIT usage for freshclam.
- Remove ethereal module since the application was renamed to wireshark.
- Remove duplicate/redundant rules, from Russell Coker.
- Increased default number of categories to 1024, from Russell Coker.
- Added modules:
        accountsd (Dan Walsh)
        cgroup (Dominick Grift)
        hadoop (Paul Nuzzi)
        kdumpgui (Dan Walsh)
        livecd (Dan Walsh)
        mojomojo (Lain Arnell)
        sambagui (Dan Walsh)
        shutdown (Dan Walsh)
        sosreport (Dan Walsh)
        vlock (Harry Ciao)

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2010-05-25 20:02 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2010-05-25 20:02 UTC (permalink / raw)
  To: refpolicy, selinux

A new release of the SELinux Reference Policy is now available on
the Tresys OSS site, http://oss.tresys.com.  This release primarily
focused on reducing the differences between the Fedora policy and
Reference Policy.

The complete change log for this release follows at the end of the
email.

For people interested in helping Reference Policy development, the X
desktop and role separation needs testing, in addition to general
testing.

* Mon May 24 2010 Chris PeBenito <selinux@tresys.com> - 2.20100524
- Merged a significant portion of Fedora policy.
- Move rules from mta mailserver delivery from interface to .te to use
  attributes.
- Remove concept of users from terminal module interfaces since the
  attributes are not specific to users.
- Add non-drawing X client support, for consolekit usage.
- Misc Gentoo fixes from Chris Richards.
- AFS and abrt fixes from Dominick Grift.
- Improved the XML docs of 55 most-used interfaces.
- Apcupsd and amavis fixes from Dominick Grift.
- Fix network_port() in corenetwork to correctly handle port ranges.
- SE-Postgresql updates from KaiGai Kohei.
- X object manager revisions from Eamon Walsh.
- Added modules:
        chronyd (Miroslav Grepl)
        cobbler (Dominick Grift)
        dbadm (KaiGai Kohei)
        denyhosts (Dan Walsh)
        nut (Stefan Schulze Frielinghaus, Miroslav Grepl)
        likewise (Scott Salley)
        plymouthd (Dan Walsh)
        pyicqt (Stefan Schulze Frielinghaus)
        sectoolm (Miroslav Grepl)
        usbmuxd (Dan Walsh)
        vhostmd (Dan Walsh)


-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2009-11-17 15:28 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2009-11-17 15:28 UTC (permalink / raw)
  To: refpolicy, selinux

A new release of the SELinux Reference Policy is now available on
the Tresys OSS site, http://oss.tresys.com.  This release primarily
focused on general policy development for supporting new applications
and improving support of current ones.

The complete change log for this release follows at the end of the
email.

For people interested in helping Reference Policy development, the X
desktop and role separation needs testing.

* Tue Nov 17 2009 Chris PeBenito <selinux@tresys.com> - 2.20091117
- Add separate x_pointer and x_keyboard classes inheriting from x_device. 
  From Eamon Walsh.
- Deprecated the userdom_xwindows_client_template().
- Misc Gentoo fixes from Corentin Labbe.
- Debian policykit fixes from Martin Orr.
- Fix unconfined_r use of unconfined_java_t.
- Add missing x_device rules for XI2 functions, from Eamon Walsh.
- Add missing rules to make unconfined_cronjob_t a valid cron job domain.
- Add btrfs and ext4 to labeling targets.
- Fix infrastructure to expand macros in initrc_context when installing.
- Handle unix_chkpwd usage by useradd and groupadd.
- Add missing compatibility aliases for xdm_xserver*_t types.
- Added modules:
        abrt (Dan Walsh)
        dkim (Stefan Schulze Frielinghaus)
        gitosis (Miroslav Grepl)
        gnomeclock (Dan Walsh)
        hddtemp (Dan Walsh)
        kdump (Dan Walsh)
        modemmanager(Dan Walsh)
        nslcd (Dan Walsh)
        puppet (Craig Grube)
        rtkit (Dan Walsh)
        seunshare (Dan Walsh)
        shorewall (Dan Walsh)
        tgtd (Matthew Ife)
        tuned (Miroslav Grepl)
        xscreensaver (Corentin Labbe)


-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150




--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2009-07-30 18:45 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2009-07-30 18:45 UTC (permalink / raw)
  To: refpolicy, selinux

A new release of the SELinux Reference Policy is now available on
the Tresys OSS site, http://oss.tresys.com.  This release primarily
focused on general policy development for supporting new applications
and improving support of current ones.  In addition, support for labeled
Booleans was added.

The complete change log for this release follows at the end of the
email.

For people interested in helping Reference Policy development, the X
desktop and role separation needs testing.

* Thu Jul 30 2009 Chris PeBenito <selinux@tresys.com> - 2.20090730
- Gentoo fixes for init scripts and system startup.
- Remove read_default_t tunable.
- Greylist milter from Paul Howarth.
- Crack db access for su to handle password expiration, from Brandon Whalen.
- Misc fixes for unix_update from Brandon Whalen.
- Add x_device permissions for XI2 functions, from Eamon Walsh.
- MLS constraints for the x_selection class, from Eamon Walsh.
- Postgresql updates from KaiGai Kohei.
- Milter state directory patch from Paul Howarth.
- Add MLS constrains for ingress/egress and secmark from Paul Moore.
- Drop write permission from fs_read_rpc_sockets().
- Remove unused udev_runtime_t type.
- Patch for RadSec port from Glen Turner.
- Enable network_peer_controls policy capability from Paul Moore.
- Btrfs xattr support from Paul Moore.
- Add db_procedure install permission from KaiGai Kohei.
- Add support for network interfaces with access controlled by a Boolean
  from the CLIP project.
- Several fixes from the CLIP project.
- Add support for labeled Booleans.
- Remove node definitions and change node usage to generic nodes.
- Add kernel_service access vectors, from Stephen Smalley.
- Added modules:
        certmaster (Dan Walsh)
        cpufreqselector (Dan Walsh)
        devicekit (Dan Walsh)
        fprintd (Dan Walsh)
        git (Dan Walsh)
        gpsd (Miroslav Grepl)
        guest (Dan Walsh)
        ifplugd (Dan Walsh)
        lircd (Miroslav Grepl)
        logadm (Dan Walsh)
        pads (Dan Walsh)
        pingd (Dan Walsh)
        policykit (Dan Walsh)
        pulseaudio (Dan Walsh)
        psad (Dan Walsh)
        portreserve (Dan Walsh)
        sssd (Dan Walsh)
        ulogd (Dan Walsh)
        varnishd (Dan Walsh)
        webadm (Dan Walsh)
        wm (Dan Walsh)
        xguest (Dan Walsh)
        zosremote (Dan Walsh)


-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2008-12-10 20:24 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2008-12-10 20:24 UTC (permalink / raw)
  To: refpolicy, selinux

A new, major release of the SELinux Reference Policy is now available on
the Tresys OSS site, http://oss.tresys.com.  In this release, the type
enforcement-based role separation was replaced with SELinux user-based
access control (UBAC) role separation.  This support deprecates the
per-role templates and rolemap support of the policy.  It also breaks
some compatibility in the interfaces API; however, the compatibility for
types and other policy symbols has been preserved.

Due to the magnitude of this change, the Reference Policy version scheme
has slightly changed, by adding a major number (2) to the version.
Previous versions are considered 1.yyyymmdd releases.

The The complete change log for this release follows at the end of the
email.

For people interested in helping Reference Policy development, the X
desktop and role separation needs testing.

* Wed Dec 10 2008 Chris PeBenito <selinux@tresys.com> - 2.20081210
- Fix consistency of audioentropy and iscsi module naming.
- Debian file context fix for xen from Russell Coker.
- Xserver MLS fix from Eamon Walsh.
- Add omapi port for dhcpcd.
- Deprecate per-role templates and rolemap support.
- Implement user-based access control for use as role separations.
- Move shared library calls from individual modules to the domain module.
- Enable open permission checks policy capability.
- Remove hierarchy from portage module as it is not a good example of
  hierarchy.
- Remove enableaudit target from modular build as semodule -DB supplants it.
- Added modules:
        milter (Paul Howarth)

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2008-10-14 18:34 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2008-10-14 18:34 UTC (permalink / raw)
  To: refpolicy, selinux

A new release of the SELinux Reference Policy is now available on the
Tresys OSS site, http://oss.tresys.com.  In this release, support for
init scripts with different labels was added.  For example, this enables
an Apache admin to restart only the Apache service, not all services.
The complete change log for this release follows at the end of the
email.

For people interested in helping Reference Policy development, the X
desktop and user-based role separation areas need attention.

* Tue Oct 14 2008 Chris PeBenito <selinux@tresys.com> - 20081014
- Debian update for NetworkManager/wpa_supplicant from Martin Orr.
- Logrotate and Bind updates from Vaclav Ovsik.
- Init script file and domain support.
- Glibc 2.7 fix from Vaclav Ovsik.
- Samba/winbind update from Mike Edenfield.
- Policy size optimization with a non-security file attribute from James
  Carter.
- Database labeled networking update from KaiGai Kohei.
- Several misc changes from the Fedora policy, cherry picked by David
  Hardeman.
- Large whitespace fix from Dominick Grift.
- Pam_mount fix for local login from Stefan Schulze Frielinghaus.
- Issuing commands to upstart is over a datagram socket, not the initctl
  named pipe.  Updated init_telinit() to match.
- Added modules:
        cyphesis (Dan Walsh)
        memcached (Dan Walsh)
        oident (Dominick Grift)
        w3c (Dan Walsh)


-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2008-07-02 15:37 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2008-07-02 15:37 UTC (permalink / raw)
  To: SELinux Mail List

A new release of the SELinux Reference Policy is now available on the
Tresys OSS site, http://oss.tresys.com.  In this release, the user roles
were moved into individual modules.  This enables the policy writer to
easily configure which roles to include in their policy.  It also makes
audit and security administrator roles available in non MLS policies.
The complete change log for this release follows at the end of the
email.

For people interested in helping Reference Policy development, the X
desktop area needs attention.

* Wed Jul 02 2008 Chris PeBenito <selinux@tresys.com> - 20080702
- Fix httpd_enable_homedirs to actually provide the access it is supposed to
  provide.
- Add unused interface/template parameter metadata in XML.
- Patch to handle postfix data_directory from Vaclav Ovsik.
- SE-Postgresql policy from KaiGai Kohei.
- Patch for X.org dbus support from Martin Orr.
- Patch for labeled networking controls in 2.6.25 from Paul Moore.
- Module loading now requires setsched on kernel threads.
- Patch to allow gpg agent --write-env-file option from Vaclav Ovsik.
- X application data class from Eamon Walsh and Ted Toth.
- Move user roles into individual modules.
- Make hald_log_t a log file.
- Cryptsetup runs shell scripts.  Patch from Martin Orr.
- Add file for enabling policy capabilities.
- Patch to fix leaky interface/template call depth calculator from Vaclav
  Ovsik.
- Added modules:
        kerneloops (Dan Walsh)
        kismet (Dan Walsh)
        podsleuth (Dan Walsh)
        prelude (Dan Walsh)
        qemu (Dan Walsh)
        virt (Dan Walsh)

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2008-04-02 18:14 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2008-04-02 18:14 UTC (permalink / raw)
  To: SELinux Mail List

A new release of the SELinux Reference Policy is now available on the
Tresys OSS site, http://oss.tresys.com.  In this release, core
infrastructure for the X Windows userspace object manager (aka XSELinux
or Security Enhanced X Windows) was added.  This release focused on the
structure of the X policy and thus is not complete (it won't run in
enforcing).  Inter-domain accesses, for example, copying from evolution
and pasting to firefox, have not yet been added to the policy.  The
complete change log for this release follows at the end of the email.

For people interested in helping develop the X policy, the
xserver_object_manager tunable should be enabled, along with the object
manager support in Xorg.

* Wed Apr 02 2008 Chris PeBenito <selinux@tresys.com> - 20080402
- Add core Security Enhanced X Windows support.
- Fix winbind socket connection interface for default location of the
  sock_file.
- Add wireshark module based on ethereal module.
- Revise upstart support in init module to use a tunable, as upstart is now
  used in Fedora too.
- Add iferror.m4 rather generate it out of the Makefiles.
- Definitions for open permisson on file and similar objects from Eric
  Paris.
- Apt updates for ptys and logs, from Martin Orr.
- RPC update from Vaclav Ovsik.
- Exim updates on Debian from Devin Carrawy.
- Pam and samba updates from Stefan Schulze Frielinghaus.
- Backup update on Debian from Vaclav Ovsik.
- Cracklib update on Debian from Vaclav Ovsik.
- Label /proc/kallsyms with system_map_t.
- 64-bit capabilities from Stephen Smalley.
- Labeled networking peer object class updates.


-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2007-12-14 18:56 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2007-12-14 18:56 UTC (permalink / raw)
  To: SELinux Mail List

A new release of the SELinux Reference Policy is now available on the
Tresys OSS site, http://oss.tresys.com.  In this release, the strict and
targeted policies were merged.  If the unconfined module is present, the
policy will act similar to the old targeted policy.  The difference is
that the roles that are available in the old strict policy continue to
be available, allowing a mix of confined and unconfined users.  If the
unconfined module is not present, the policy will act like the old
strict policy.  The merge also eases the transition from a targeted
policy to a strict policy, as the policy does not need to be replaced.
The complete change log for this release follows.

* Fri Dec 14 2007 Chris PeBenito <selinux@tresys.com> - 20071214
- Patch for debian logrotate to handle syslogd-listfiles, from Vaclav Ovsik.
- Improve several tunables descriptions from Dan Walsh.
- Patch to clean up ns switch usage in the policy from Dan Walsh.
- More complete labeled networking infrastructure from KaiGai Kohei.
- Add interface for libselinux constructor, for libselinux-linked
  SELinux-enabled programs.
- Patch to restructure user role templates to create restricted user roles
  from Dan Walsh.
- Russian man page translations from Andrey Markelov.
- Remove unused types from dbus.
- Add infrastructure for managing all user web content.
- Deprecate some old file and dir permission set macros in favor of the
  newer, more consistently-named macros.
- Patch to clean up unescaped periods in several file context entries from
  Jan-Frode Myklebust.
- Merge shlib_t into lib_t.
- Merge strict and targeted policies.  The policy will now behave like the
  strict policy if the unconfined module is not present.  If it is, it will
  behave like the targeted policy.  Added an unconfined role to have a mix
  of confined and unconfined users.
- Added modules:
        exim (Dan Walsh)
        postfixpolicyd (Jan-Frode Myklebust)


-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* Re: ANN: Reference Policy Release
  2007-09-28 15:19 Christopher J. PeBenito
@ 2007-10-02 15:29 ` Shintaro Fujiwara
  0 siblings, 0 replies; 43+ messages in thread
From: Shintaro Fujiwara @ 2007-10-02 15:29 UTC (permalink / raw)
  To: Christopher J. PeBenito, selinux

Thank you very much, for including my name on it.
I think everybody would be more encouraged
if you could make a page like this of refpolicy.

http://www.nsa.gov/selinux/info/contrib.cfm

p.s.
I'm encouraging people in my country to get involved in refpolicy.
Not in Akihabara, but on SecureOS-Japan-ML, though...


2007/9/29, Christopher J. PeBenito <cpebenito@tresys.com>:
> A new release of the SELinux Reference Policy is now available on the
> Tresys OSS site, http://oss.tresys.com.  In this release, an option for
> unknown permissions handling was added, several minor MLS enhancements
> were merged, and XML building issues for external reference and headers
> builds were fixed.  The complete change log for this release follows.
>
> * Fri Sep 28 2007 Chris PeBenito <selinux@tresys.com> - 20070928
> - Add support for setting the unknown permissions handling.
> - Fix XML building for external reference builds and headers builds.
> - Patch to add missing requirements in userdomain interfaces from Shintaro
>   Fujiwara.
> - Add tcpd_wrapped_domain() for services that use tcp wrappers.
> - Update MLS constraints from LSPP evaluated policy.
> - Allow initrc_t file descriptors to be inherited regardless of MLS level.
>   Accordingly drop MLS permissions from daemons that inherit from any level.
> - Files and radvd updates from Stefan Schulze Frielinghaus.
> - Deprecate mls_file_write_down() and mls_file_read_up(), replaced with
>   mls_write_all_levels() and mls_read_all_levels(), for consistency.
> - Add make kernel and init ranged interfaces pass the range transition MLS
>   constraints.  Also remove calls to mls_rangetrans_target() in modules that use
>   the kernel and init interfaces, since its redundant.
> - Add interfaces for all MLS attributes except X object classes.
> - Require all sensitivities and categories for MLS and MCS policies, not just
>   the low and high sensitivity and category.
> - Database userspace object manager classes from KaiGai Kohei.
> - Add third-party interface for Apache CGI.
> - Add getserv and shmemserv nscd permissions.
> - Add debian apcupsd binary location, from Stefan Schulze Frielinghaus.
> - Added modules:
>         application
>         awstats (Stefan Schulze Frielinghaus)
>         bitlbee (Devin Carraway)
>         brctl (Dan Walsh)
>
> --
> Chris PeBenito
> Tresys Technology, LLC
> (410) 290-1411 x150
>
>
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2007-09-28 15:19 Christopher J. PeBenito
  2007-10-02 15:29 ` Shintaro Fujiwara
  0 siblings, 1 reply; 43+ messages in thread
From: Christopher J. PeBenito @ 2007-09-28 15:19 UTC (permalink / raw)
  To: SELinux Mail List

A new release of the SELinux Reference Policy is now available on the
Tresys OSS site, http://oss.tresys.com.  In this release, an option for
unknown permissions handling was added, several minor MLS enhancements
were merged, and XML building issues for external reference and headers
builds were fixed.  The complete change log for this release follows.

* Fri Sep 28 2007 Chris PeBenito <selinux@tresys.com> - 20070928
- Add support for setting the unknown permissions handling.
- Fix XML building for external reference builds and headers builds.
- Patch to add missing requirements in userdomain interfaces from Shintaro
  Fujiwara.
- Add tcpd_wrapped_domain() for services that use tcp wrappers.
- Update MLS constraints from LSPP evaluated policy.
- Allow initrc_t file descriptors to be inherited regardless of MLS level.
  Accordingly drop MLS permissions from daemons that inherit from any level.
- Files and radvd updates from Stefan Schulze Frielinghaus.
- Deprecate mls_file_write_down() and mls_file_read_up(), replaced with
  mls_write_all_levels() and mls_read_all_levels(), for consistency.
- Add make kernel and init ranged interfaces pass the range transition MLS
  constraints.  Also remove calls to mls_rangetrans_target() in modules that use
  the kernel and init interfaces, since its redundant.
- Add interfaces for all MLS attributes except X object classes.
- Require all sensitivities and categories for MLS and MCS policies, not just
  the low and high sensitivity and category.
- Database userspace object manager classes from KaiGai Kohei.
- Add third-party interface for Apache CGI.
- Add getserv and shmemserv nscd permissions.
- Add debian apcupsd binary location, from Stefan Schulze Frielinghaus.
- Added modules:
        application
        awstats (Stefan Schulze Frielinghaus)
        bitlbee (Devin Carraway)
        brctl (Dan Walsh)

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2007-06-29 17:30 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2007-06-29 17:30 UTC (permalink / raw)
  To: SELinux Mail List

A new release of the SELinux Reference Policy is now available on the
Tresys OSS site, http://oss.tresys.com.  In this release, the restorecon
and setfiles policies were merged, and unified labeled networking
support for IPSEC and NetLabel implementations was added.  The complete
change log for this release follows.

* Fri Jun 29 2007 Chris PeBenito <selinux@tresys.com> - 20070629
- Fix incorrectly named files_lib_filetrans_shared_lib() interface in the
  libraries module.
- Unified labeled networking policy from Paul Moore.
- Use netmsg initial SID for MLS-only Netlabel packets, from Paul Moore.
- Xen updates from Dan Walsh.
- Filesystem updates from Dan Walsh.
- Large samba update from Dan Walsh.
- Drop snmpd_etc_t.
- Confine sendmail and logrotate on targeted.
- Tunable connection to postgresql for users from KaiGai Kohei.
- Memprotect support patch from Stephen Smalley.
- Add logging_send_audit_msgs() interface and deprecate
  send_audit_msgs_pattern().
- Openct updates patch from Dan Walsh.
- Merge restorecon into setfiles.
- Patch to begin separating out hald helper programs from Dan Walsh.
- Fixes for squid, dovecot, and snmp from Dan Walsh.
- Miscellaneous consolekit fixes from Dan Walsh.
- Patch to have avahi use the nsswitch interface rather than individual
  permissions from Dan Walsh.
- Patch to dontaudit logrotate searching avahi pid directory from Dan Walsh.
- Patch to allow insmod to mount kvmfs and dontaudit rw unconfined_t pipes
  to handle usage from userhelper from Dan Walsh.
- Patch to allow amavis to read spamassassin libraries from Dan Walsh.
- Patch to allow slocate to getattr other filesystems and directories on those
  filesystems from Dan Walsh.
- Fixes for RHEL4 from the CLIP project.
- Replace the old lrrd fc entries with munin ones.
- Move program admin template usage out of userdom_admin_user_template() to
  sysadm policy in userdomain.te to fix usage of the template for third
  parties.
- Fix clockspeed_run_cli() declaration, it was incorrectly defined as a
  template instead of an interface.
- Added modules:
        amtu (Dan Walsh)
        apcupsd (Dan Walsh)
        rpcbind (Dan Walsh)
        rwho (Nalin Dahyabhai)


-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* Re: ANN: Reference Policy Release
  2007-04-19 20:56   ` Karl MacMillan
@ 2007-04-19 23:10     ` Manoj Srivastava
  0 siblings, 0 replies; 43+ messages in thread
From: Manoj Srivastava @ 2007-04-19 23:10 UTC (permalink / raw)
  To: selinux

On Thu, 19 Apr 2007 16:56:22 -0400, Karl MacMillan
<kmacmillan@mentalrootkit.com> said:  

>> 
>> Since this is very early in the lenny release cycle, I would not be
>> averse to packaging the development release for lenny (surely our
>> release cycles are faster than Debian's), and will do so unless there
>> are vocal objections.
>> 

> Stable is at 1.16.3 - no reason to package trunk. Or am I missing your
> intent?

        Argh. I forgot to look at subversion.  I guess this is a
 Freudean slip -- I must really want to get back on the bleeding edge.

        I think, on balance, that I'll package 2.0.X versions for lenny
 after all. Anyone at all who wants a stable system is running Etch, and
 only us crazy folk are running Debian unstable just after a release,
 and the trunk versions don't seem to harm my box, so ...

        Anyway, people who run Debian unstable _and_ run SELinux
 machines are probably just a handful, and I suspect almost all of them
 are on this list.

        manoj
-- 
"Here's something to think about: How come you never see a headline like
`Psychic Wins Lottery'?" -- Jay Leno
Manoj Srivastava <manoj.srivastava@stdc.com> <srivasta@acm.org> 
1024D/BF24424C print 4966 F272 D093 B493 410B  924B 21BA DABB BF24 424C

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* Re: ANN: Reference Policy Release
  2007-04-19 20:45 ` Manoj Srivastava
@ 2007-04-19 20:56   ` Karl MacMillan
  2007-04-19 23:10     ` Manoj Srivastava
  0 siblings, 1 reply; 43+ messages in thread
From: Karl MacMillan @ 2007-04-19 20:56 UTC (permalink / raw)
  To: Manoj Srivastava; +Cc: selinux

On Thu, 2007-04-19 at 15:45 -0500, Manoj Srivastava wrote:
> On Tue, 17 Apr 2007 11:07:16 -0400, Christopher J PeBenito
> <cpebenito@tresys.com> said:  
> 
> > A new release of the SELinux Reference Policy is now available on the
> > Tresys OSS site, http://oss.tresys.com.  The primary change in this
> > release is the addition of support for Booleans and tunables in
> > modules.  For proper use of modules with Booleans, libsepol 1.16.2 or
> 
>         I had hoped that was a typo, since I have just upgraded Debian
>  Sid to the stable release, and that means libsepol at
>  1.16.1. Unfortunately, I am running into errors trying to  play around
>  with the refpolicy, for instance, semodule_deps with the new strict
>  policy gives:
> 

<snip>

> 
>         Since this is very early in the lenny release cycle, I would not
>  be averse to packaging the development release for lenny (surely our
>  release cycles are faster than Debian's), and will do so unless there
>  are vocal objections.
> 

Stable is at 1.16.3 - no reason to package trunk. Or am I missing your
intent?

Karl


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* Re: ANN: Reference Policy Release
  2007-04-17 15:07 Christopher J. PeBenito
@ 2007-04-19 20:45 ` Manoj Srivastava
  2007-04-19 20:56   ` Karl MacMillan
  0 siblings, 1 reply; 43+ messages in thread
From: Manoj Srivastava @ 2007-04-19 20:45 UTC (permalink / raw)
  To: selinux

On Tue, 17 Apr 2007 11:07:16 -0400, Christopher J PeBenito
<cpebenito@tresys.com> said:  

> A new release of the SELinux Reference Policy is now available on the
> Tresys OSS site, http://oss.tresys.com.  The primary change in this
> release is the addition of support for Booleans and tunables in
> modules.  For proper use of modules with Booleans, libsepol 1.16.2 or

        I had hoped that was a typo, since I have just upgraded Debian
 Sid to the stable release, and that means libsepol at
 1.16.1. Unfortunately, I am running into errors trying to  play around
 with the refpolicy, for instance, semodule_deps with the new strict
 policy gives:

,----
| libsepol.scope_copy_callback: miscfiles: Duplicate declaration in
|    module: type/attribute public_content_rw_t 
| semodule_deps:  Error while linking packages
`----

	And loading modules fails on me as well:
,----
| libsepol.expand_module: Error while indexing out symbols
| libsemanage.semanage_expand_sandbox: Expand module failed
| semodule:  Failed!
| Failed to load module rpc.pp
`----

> newer is required.  Smaller changes include the merging of ls_exec_t
> and sbin_t into bin_t, and the removal of disable_trans Booleans in
> the targeted policy.  The complete change log for this release follows
> at the bottom of the email.

        Since this is very early in the lenny release cycle, I would not
 be averse to packaging the development release for lenny (surely our
 release cycles are faster than Debian's), and will do so unless there
 are vocal objections.

        manoj
--
I'm also pre-POURED pre-MEDITATED and pre-RAPHAELITE!!
Manoj Srivastava <manoj.srivastava@stdc.com> <srivasta@acm.org> 
1024D/BF24424C print 4966 F272 D093 B493 410B  924B 21BA DABB BF24 424C

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2007-04-17 15:07 Christopher J. PeBenito
  2007-04-19 20:45 ` Manoj Srivastava
  0 siblings, 1 reply; 43+ messages in thread
From: Christopher J. PeBenito @ 2007-04-17 15:07 UTC (permalink / raw)
  To: SELinux Mail List

A new release of the SELinux Reference Policy is now available on the
Tresys OSS site, http://oss.tresys.com.  The primary change in this
release is the addition of support for Booleans and tunables in modules.
For proper use of modules with Booleans, libsepol 1.16.2 or newer is
required.  Smaller changes include the merging of ls_exec_t and sbin_t
into bin_t, and the removal of disable_trans Booleans in the targeted
policy.  The complete change log for this release follows at the bottom
of the email.

For those that are interested in contributing, right now the best help
would be to test the strict policy.

* Tue Apr 17 2007 Chris PeBenito <selinux@tresys.com> - 20070417
- Patch for sasl's use of kerberos from Dan Walsh.
- Patches to confine ldconfig, udev, and insmod in the targeted policy from Dan Walsh.
- Man page updates from Dan Walsh.
- Two patches from Paul Moore to for ipsec to remove redundant rules and
  have setkey read the config file.
- Move booleans and tunables to modules when it is only used in a single
  module.
- Add support for tunables and booleans local to a module.
- Merge sbin_t and ls_exec_t into bin_t.
- Remove disable_trans booleans.
- Output different header sets for kernel and userland from flask headers.
- Marked the pax class as deprecated, changed it to userland so
  it will be removed from the kernel.
- Stop including netfilter contexts by default.
- Add dontaudits for init fds and console to init_daemon_domain().
- Patch to allow gpg to create user keys dir.
- Patch to support kvmfs from Dan Walsh.
- Patch for misc fixes in sudo from Dan Walsh.
- Patch to fix netlabel recvfrom MLS constraint from Paul Moore.
- Patch for handling restart of nscd when ran from useradd, groupadd, and
  admin passwd, from Dan Walsh.
- Patch for procmail, spamassassin, and pyzor updates from Dan Walsh.
- Patch for setroubleshoot for validating file contexts from Dan Walsh.
- Patch for gssd fixes from Dan Walsh.
- Patch for lvm fixes from Dan Walsh.
- Patch for ricci fixes from Dan Walsh.
- Patch for postfix lmtp labeling and pickup rule fix from Dan Walsh.
- Patch for kerberized telnet fixes from Dan Walsh.
- Patch for kerberized ftp and other ftp fixes from Dan Walsh.
- Patch for an additional wine executable from Dan Walsh.
- Eight patches for file contexts in games, wine, networkmanager, miscfiles,
  corecommands, devices, and java from Dan Walsh.
- Add support for libselinux 2.0.5 init_selinuxmnt() changes.
- Patch for misc fixes to bluetooth from Dan Walsh.
- Patch for misc fixes to kerberos from Dan Walsh.
- Patch to start deprecating usercanread attribute from Ryan Bradetich.
- Add dccp_socket object class which was added in kernel 2.6.20.
- Patch for prelink relabefrom it's temp files from Dan Walsh.
- Patch for capability fix for auditd and networking fix for syslogd from
  Dan Walsh.
- Patch to remove redundant mls_trusted_object() call from Dan Walsh.
- Patch for misc fixes to nis ypxfr policy from Dan Walsh.
- Patch to allow apmd to telinit from Dan Walsh.
- Patch for additional labeling of samba files from Stefan Schulze
  Frielinghaus.
- Patch to remove incorrect cron labeling in apache.fc from Ryan Bradetich.
- Fix ptys and ttys to be device nodes.
- Fix explicit use of httpd_t in openca_domtrans().
- Clean up file context regexes in apache and java, from Eamon Walsh.
- Patches from Dan Walsh:
        Thu, 25 Jan 2007
- Added modules:
        consolekit (Dan Walsh)
        fail2ban (Dan Walsh)
        zabbix (Dan Walsh)


-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2006-12-12 22:35 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2006-12-12 22:35 UTC (permalink / raw)
  To: SELinux Mail List

A new release of the SELinux Reference Policy is now available on the
Tresys OSS site, http://oss.tresys.com.  The primary change in this
release is the addition of support macros for common policy patterns.
These support macros create a blueprint of rules for a more abstract
access (for example, manage_files_pattern), and are similar to the old
rw_dir_create_file() and r_dir_file() macros of the example policy.
Policy patterns and new permission sets have been created for each
filesystem-based object class individually (file, lnk_file, dir, etc.),
so if a permission set change is needed for a particular class it will
not affect other classes.  As a result, the old permission sets
create_dir_perms and create_file_perms have changed; manage_dir_perms
and manage_file_perms should be used instead.  The complete change log
for this release follows at the bottom of the email.

For those that are interested in contributing, right now the best help
would be to test the strict policy.

* Tue Dec 12 2006 Chris PeBenito <selinux@tresys.com> - 20061212
- Add policy patterns support macros.  This changes the behavior of
  the create_dir_perms and create_file_perms permission sets.
- Association polmatch MLS constraint making unlabeled_t an exception
  is no longer needed, patch from Venkat Yekkirala.
- Context contains checking for PAM and cron from James Antill.
- Add a reload target to Modules.devel and change the load
  target to only insert modules that were changed.
- Allow semanage to read from /root on strict non-MLS for
  local policy modules.
- Gentoo init script fixes for udev.
- Allow udev to read kernel modules.inputmap.
- Dnsmasq fixes from testing.
- Allow kernel NFS server to getattr filesystems so df can work
  on clients.
- Patch from Matt Anderson for a MLS constraint exemption on a
  file that can be written to from a subject whose range is
  within the object's range.
- Enhanced setransd support from Darrel Goeddel.
- Patches from Dan Walsh:
        Tue, 24 Oct 2006
        Wed, 29 Nov 2006
- Added modules:
        aide (Matt Anderson)
        ccs (Dan Walsh)
        iscsi (Dan Walsh)
        ricci (Dan Walsh)


-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2006-10-19 12:57 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2006-10-19 12:57 UTC (permalink / raw)
  To: SELinux Mail List

A new release of the SELinux Reference Policy is now available on the
Tresys OSS site, from http://oss.tresys.com.  This release was delayed
due to its dependence on the release of checkpolicy 1.32, for it's
support for optionals in the base module.  Since the last release was in
March, the change log is correspondingly long.  There have been several
improvements, notably the completion of the conversion of modules from
the example policy, improved infrastructure for defining roles, and
support for the new netfilter-based network access controls (secmark).
The change log for this release follows at the bottom of the email.  

For those that are interested in contributing, right now the best help
would be to test the strict policy.

* Wed Oct 18 2006 Chris PeBenito <selinux@tresys.com> - 20061018
- Patch from Russell Coker Thu, 5 Oct 2006
- Move range transitions to modules.
- Make number of MLS sensitivities, and number of MLS and MCS
  categories configurable as build options.
- Add role infrastructure.
- Debian updates from Erich Schubert.
- Add nscd_socket_use() to auth_use_nsswitch().
- Remove old selopt rules.
- Full support for netfilter_contexts.
- MRTG patch for daemon operation from Stefan.
- Add authlogin interface to abstract common access for login programs.
- Remove setbool auditallow, except for RHEL4.
- Change eventpollfs to task SID labeling.
- Add key support from Michael LeMay.
- Add ftpdctl domain to ftp, from Paul Howarth.
- Fix build system to not move type declarations out of optionals.
- Add gcc-config domain to portage.
- Add packet object class and support in corenetwork.
- Add a copy of genhomedircon for monolithic policy building, so that a
  policycoreutils package update is not required for RHEL4 systems.
- Add appletalk sockets for use in cups.
- Add Make target to validate module linking.
- Make duplicate template and interface declarations a fatal error.
- Patch to stabilize modules.conf `make conf` output, from Erich Schubert.
- Move xconsole_device_t from devices to xserver since it is
  not actually a device, it is a named pipe.
- Handle nonexistant .fc and .if files in devel Makefile by
  automatically creating empty files.
- Remove unused devfs_control_t.
- Add rhel4 distro, which also implies redhat distro.
- Remove unneeded range_transition for su_exec_t and move the
  type declaration back to the su module.
- Constrain transitions in MCS so unconfined_t cannot have
  arbitrary category sets.
- Change reiserfs from xattr filesystem to genfscon as it's xattrs
  are currently nonfunctional.
- Change files and filesystem modules to use their own interfaces.
- Add user fonts to xserver.
- Additional interfaces in corecommands, miscfiles, and userdomain
  from Joy Latten.
- Miscellaneous fixes from Thomas Bleher.
- Deprecate module name as first parameter of optional_policy()
  now that optionals are allowed everywhere.
- Enable optional blocks in base module and monolithic policy.
  This requires checkpolicy 1.30.1.
- Fix vpn module declaration.
- Numerous fixes from Dan Walsh.
- Change build order to preserve m4 line number information so policy
  compile errors are useful again.
- Additional MLS interfaces from Chad Hanson.
- Move some rules out of domain_type() and domain_base_type()
  to the TE file, to use the domain attribute to take advantage
  of space savings from attribute use.
- Add global stack smashing protector rule for urandom access from
  Petre Rodan.
- Fix temporary rules at the bottom of portmap.
- Updated comments in mls file from Chad Hanson.
- Patches from Dan Walsh:
        Fri, 17 Mar 2006
        Wed, 29 Mar 2006
        Tue, 11 Apr 2006
        Fri, 14 Apr 2006
        Tue, 18 Apr 2006
        Thu, 20 Apr 2006
        Tue, 02 May 2006
        Mon, 15 May 2006
        Thu, 18 May 2006
        Tue, 06 Jun 2006
        Mon, 12 Jun 2006
        Tue, 20 Jun 2006
        Wed, 26 Jul 2006
        Wed, 23 Aug 2006
        Thu, 31 Aug 2006
        Fri, 01 Sep 2006
        Tue, 05 Sep 2006
        Wed, 20 Sep 2006
        Fri, 22 Sep 2006
        Mon, 25 Sep 2006
- Added modules:
        afs
        amavis (Erich Schubert)
        apt (Erich Schubert)
        asterisk
        audioentropy
        authbind
        backup
        calamaris
        cipe
        clamav (Erich Schubert)
        clockspeed (Petre Rodan)
        courier
        dante
        dcc
        ddclient
        dpkg (Erich Schubert)
        dnsmasq
        ethereal
        evolution
        games
        gatekeeper
        gift
        gnome (James Carter)
        imaze
        ircd
        jabber
        monop
        mozilla
        mplayer
        munin
        nagios
        nessus
        netlabel (Paul Moore)
        nsd
        ntop
        nx
        oav
        oddjob (Dan Walsh)
        openca
        openvpn (Petre Rodan)
        perdition
        portslave
        postgrey
        pxe
        pyzor (Dan Walsh)
        qmail (Petre Rodan)
        razor
        resmgr
        rhgb
        rssh
        snort
        soundserver
        speedtouch
        sxid
        thunderbird
        tor (Erich Schubert)
        transproxy
        tripwire
        uptime
        uwimap
        vmware
        watchdog
        xen (Dan Walsh)
        xprint
        yam

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2006-03-07 15:28 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2006-03-07 15:28 UTC (permalink / raw)
  To: SELinux Mail List

A new release of the SELinux Reference Policy is now available on
SourceForge from http://serefpolicy.sourceforge.net.  The primary
activity for this release has been renaming interfaces to improve the
naming consistency, in an effort to stabilize the API.  The change log
follows at the bottom of the email.

Again, for those that are interesting in contributing, right now the
best help would be to either test the policy or convert remaining
modules from the example policy over to Reference Policy; there is a
list of modules on the Reference Policy status page on SourceForge.

* Tue Mar 07 2006 Chris PeBenito <selinux@tresys.com> - 20060307
- Make all interface parameters required.
- Move boot_t, system_map_t, and modules_object_t to files module,
  and move bootloader to admin layer.
- Add semanage policy for semodule from Dan Walsh.
- Remove allow_execmem from targeted policy domain_base_type().
- Add users_extra and seusers support.
- Postfix fixes from Serge Hallyn.
- Run python and shell directly to interpret scripts so policy
  sources need not be executable.
- Add desc tag XML to booleans and tunables, and add summary
  to param XML tag, to make future translations possible.
- Remove unused lvm_vg_t.
- Many interface renames to improve naming consistency.
- Merge xdm into xserver.
- Remove kernel module reversed interfaces.
- Add filename attribute to module XML tag and lineno attribute to
  interface XML tag.
- Changed QUIET build option to a yes or no option.
- Add a Makefile used for compiling loadable modules in a
  user's development environment, building against policy headers.
- Add Make target for installing policy headers.
- Separate per-userdomain template expansion from the userdomain
  module and add infrastructure to expand templates in the modules
  that own the template.
- Enable secadm only for MLS policies.
- Remove role change rules in su and sudo since this functionality has been
  removed from these programs.
- Add ctags Make target from Thomas Bleher.
- Collapse commands with grep piped to sed into one sed command.
- Fix type_change bug in term_user_pty().
- Move ice_tmp_t from miscfiles to xserver.
- Login fixes from Serge Hallyn.
- Move xserver_log_t from xdm to xserver.
- Add lpr per-userdomain policy to lpd.
- Miscellaneous fixes from Dan Walsh.
- Change initrc_var_run_t interface noun from script_pid to utmp,
  for greater clarity.
- Added modules:
        certwatch
        mono (Dan Walsh)
        mrtg
        portage
        tvtime
        userhelper
        usernetctl
        wine (Dan Walsh)
        xserver

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2006-01-17 21:31 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2006-01-17 21:31 UTC (permalink / raw)
  To: SELinux Mail List

A new release of the SELinux Reference Policy is now available on
SourceForge from http://serefpolicy.sourceforge.net.  The primary
activity for this release has been converting modules needed for Fedora
Core 5's MLS policy.  The change log follows at the bottom of the email.

Again, for those that are interesting in contributing, right now the
best help would be to convert existing policies over to reference
policy; there is a list of modules on the reference policy status page
on SourceForge.

* Tue Jan 17 2006 Chris PeBenito <selinux@tresys.com> - 20060117
- Adds support for generating corenetwork interfaces based on attributes 
  in addition to types.
- Permit the listing of multiple nodes in a network_node() that will be
  given the same type.
- Add two new permission sets for stream sockets.
- Rename file type transition interfaces verb from create to
  filetrans to differentiate it from create interfaces without
  type transitions.
- Fix expansion of interfaces from disabled modules.
- Rsync can be long running from init, added rules to allow this.
- Add polyinstantiation build option.
- Add setcontext to the association object class.
- Add apache relay and db connect tunables.
- Rename texrel_shlib_t to textrel_shlib_t.
- Add swat to samba module.
- Numerous miscellaneous fixes from Dan Walsh.
- Added modules:
	alsa
	automount
	cdrecord
	daemontools (Petre Rodan)
	ddcprobe
	djbdns (Petre Rodan)
	fetchmail
	irc
	java
	lockdev
	logwatch (Dan Walsh)
	openct
	prelink (Dan Walsh)
	publicfile (Petre Rodan)
	readahead
	roundup
	screen
	slocate (Dan Walsh)
	slrnpull
	smartmon
	sysstat
	ucspitcp (Petre Rodan)
	usbmodules
	vbetool (Dan Walsh)

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* Re: ANN: Reference Policy Release
  2005-12-15 22:28 ` Serge E. Hallyn
  2005-12-16 17:59   ` Daniel J Walsh
  2005-12-18 23:20   ` Serge E. Hallyn
@ 2006-01-03 15:48   ` Christopher J. PeBenito
  2 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2006-01-03 15:48 UTC (permalink / raw)
  To: Serge E. Hallyn; +Cc: SELinux Mail List

On Thu, 2005-12-15 at 16:28 -0600, Serge E. Hallyn wrote:
> Hmm, I'm trying to compile this as a modular policy.  I've selected
> "nis = off" in my modules.conf.  But I get
> 
> 	policy/modules/admin/netutils.te:88:ERROR 'syntax error' at token
> 	'nis_use_ypbind' on line 33005:
> 	#line 88
> 		nis_use_ypbind(netutils_t)
> 
> when I try 'make load'.

Looks like the interfaces for disabled modules are not being expanded
properly.  After a quick glance, the disabled modules are not being
included in the ALL_MODULES variable in the Rules.modular, so fixing it
should be fairly straightforward.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* Re: ANN: Reference Policy Release
  2005-12-15 22:28 ` Serge E. Hallyn
  2005-12-16 17:59   ` Daniel J Walsh
@ 2005-12-18 23:20   ` Serge E. Hallyn
  2006-01-03 15:48   ` Christopher J. PeBenito
  2 siblings, 0 replies; 43+ messages in thread
From: Serge E. Hallyn @ 2005-12-18 23:20 UTC (permalink / raw)
  To: Christopher J. PeBenito; +Cc: SELinux Mail List

Quoting Serge E. Hallyn (serue@us.ibm.com):
> Hmm, I'm trying to compile this as a modular policy.  I've selected
> "nis = off" in my modules.conf.  But I get
> 
> 	policy/modules/admin/netutils.te:88:ERROR 'syntax error' at token
> 	'nis_use_ypbind' on line 33005:
> 	#line 88
> 		nis_use_ypbind(netutils_t)
> 
> when I try 'make load'.

Also, I needed the following patch to get cvs refpolicy to compile as a
static policy without unconfined.  Of course the offending statement was
"cjp: temporary hack"  :)

thanks,
-serge

Index: refpolicy/policy/modules/system/selinuxutil.te
===================================================================
--- refpolicy.orig/policy/modules/system/selinuxutil.te	2005-12-17 22:24:11.000000000 -0600
+++ refpolicy/policy/modules/system/selinuxutil.te	2005-12-18 17:13:38.000000000 -0600
@@ -198,7 +198,9 @@ ifdef(`targeted_policy', `
 # cjp: temporary hack to cover
 # up stray file descriptors.
 dontaudit load_policy_t selinux_config_t:file write;
-unconfined_dontaudit_read_pipe(load_policy_t)
+optional_policy(`unconfined',`
+	unconfined_dontaudit_read_pipe(load_policy_t)
+')
 
 ########################################
 #

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* Re: ANN: Reference Policy Release
  2005-12-15 22:28 ` Serge E. Hallyn
@ 2005-12-16 17:59   ` Daniel J Walsh
  2005-12-18 23:20   ` Serge E. Hallyn
  2006-01-03 15:48   ` Christopher J. PeBenito
  2 siblings, 0 replies; 43+ messages in thread
From: Daniel J Walsh @ 2005-12-16 17:59 UTC (permalink / raw)
  To: Serge E. Hallyn; +Cc: Christopher J. PeBenito, SELinux Mail List

Serge E. Hallyn wrote:
> Hmm, I'm trying to compile this as a modular policy.  I've selected
> "nis = off" in my modules.conf.  But I get
>
> 	policy/modules/admin/netutils.te:88:ERROR 'syntax error' at token
> 	'nis_use_ypbind' on line 33005:
> 	#line 88
> 		nis_use_ypbind(netutils_t)
>
> when I try 'make load'.
>
> Is this me misunderstanding how I can use modules.conf, or is
> the module policy mostly unsupported?  (I'm happy to help get it
> working, just am not sure how it's supposed to work now :)  My first
> instinct of course is that the "optional_policy" macro in
> policy/support/loadable_module.spt would need to be more complicated
> to handle using modules.conf...  But man that's one ugly macro.
>   
Looks like this should be optional.
> thanks,
> -serge
>
> Quoting Christopher J. PeBenito (cpebenito@tresys.com):
>   
>> A new release of the SELinux Reference Policy is now available on
>> SourceForge from http://serefpolicy.sourceforge.net.  The primary
>> activity for this release has been preparing and testing Reference
>> Policy for inclusion in Fedora Core 5 as it's targeted policy.  In
>> addition, several build issues have been fixed.  The change log follows
>> at the bottom of the email.
>>
>> Again, for those that are interesting in contributing, right now the
>> best help would be to convert existing policies over to reference
>> policy; there is a list of modules on the reference policy status page
>> on SourceForge.
>>
>> * Wed Dec 07 2005 Chris PeBenito <selinux@tresys.com> - 20051207
>> - Add unlabeled IPSEC association rule to domains with
>>   networking permissions.
>> - Merge systemuser back in to users, as these files
>>   do not need to be split.
>> - Add check for duplicate interface/template definitions.
>> - Move domain, files, and corecommands modules to kernel
>>   layer to resolve some layering inconsistencies.
>> - Move policy build options out of Makefile into build.conf.
>> - Add yppasswd to nis module.
>> - Change optional_policy() to refer to the module name
>>   rather than modulename.te.
>> - Fix labeling targets to use installed file_contexts rather
>>   than partial file_contexts in the policy source directory.
>> - Fix build process to use make's internal vpath functions
>>   to detect modules rather than using subshells and find.
>> - Add install target for modular policy.
>> - Add load target for modular policy.
>> - Add appconfig dependency to the load target.
>> - Miscellaneous fixes from Dan Walsh.
>> - Fix corenetwork gen_context()'s to expand during the policy
>>   build phase instead of during the generation phase.  
>> - Added policies:
>> 	amanda
>> 	avahi
>> 	canna
>> 	cyrus
>> 	dbskk
>> 	dovecot
>> 	distcc
>> 	i18n_input
>> 	irqbalance
>> 	lpd
>> 	networkmanager
>> 	pegasus
>> 	postfix
>> 	procmail
>> 	radius
>> 	rdisc
>> 	rpc
>> 	spamassassin
>> 	timidity
>> 	xdm
>> 	xfs
>>
>>
>> -- 
>> Chris PeBenito
>> Tresys Technology, LLC
>> (410) 290-1411 x150
>>
>>
>> --
>> This message was distributed to subscribers of the selinux mailing list.
>> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
>> the words "unsubscribe selinux" without quotes as the message.
>>
>>     
>
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
>   


-- 



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* Re: ANN: Reference Policy Release
  2005-12-07 16:40 Christopher J. PeBenito
@ 2005-12-15 22:28 ` Serge E. Hallyn
  2005-12-16 17:59   ` Daniel J Walsh
                     ` (2 more replies)
  0 siblings, 3 replies; 43+ messages in thread
From: Serge E. Hallyn @ 2005-12-15 22:28 UTC (permalink / raw)
  To: Christopher J. PeBenito; +Cc: SELinux Mail List

Hmm, I'm trying to compile this as a modular policy.  I've selected
"nis = off" in my modules.conf.  But I get

	policy/modules/admin/netutils.te:88:ERROR 'syntax error' at token
	'nis_use_ypbind' on line 33005:
	#line 88
		nis_use_ypbind(netutils_t)

when I try 'make load'.

Is this me misunderstanding how I can use modules.conf, or is
the module policy mostly unsupported?  (I'm happy to help get it
working, just am not sure how it's supposed to work now :)  My first
instinct of course is that the "optional_policy" macro in
policy/support/loadable_module.spt would need to be more complicated
to handle using modules.conf...  But man that's one ugly macro.

thanks,
-serge

Quoting Christopher J. PeBenito (cpebenito@tresys.com):
> A new release of the SELinux Reference Policy is now available on
> SourceForge from http://serefpolicy.sourceforge.net.  The primary
> activity for this release has been preparing and testing Reference
> Policy for inclusion in Fedora Core 5 as it's targeted policy.  In
> addition, several build issues have been fixed.  The change log follows
> at the bottom of the email.
> 
> Again, for those that are interesting in contributing, right now the
> best help would be to convert existing policies over to reference
> policy; there is a list of modules on the reference policy status page
> on SourceForge.
> 
> * Wed Dec 07 2005 Chris PeBenito <selinux@tresys.com> - 20051207
> - Add unlabeled IPSEC association rule to domains with
>   networking permissions.
> - Merge systemuser back in to users, as these files
>   do not need to be split.
> - Add check for duplicate interface/template definitions.
> - Move domain, files, and corecommands modules to kernel
>   layer to resolve some layering inconsistencies.
> - Move policy build options out of Makefile into build.conf.
> - Add yppasswd to nis module.
> - Change optional_policy() to refer to the module name
>   rather than modulename.te.
> - Fix labeling targets to use installed file_contexts rather
>   than partial file_contexts in the policy source directory.
> - Fix build process to use make's internal vpath functions
>   to detect modules rather than using subshells and find.
> - Add install target for modular policy.
> - Add load target for modular policy.
> - Add appconfig dependency to the load target.
> - Miscellaneous fixes from Dan Walsh.
> - Fix corenetwork gen_context()'s to expand during the policy
>   build phase instead of during the generation phase.  
> - Added policies:
> 	amanda
> 	avahi
> 	canna
> 	cyrus
> 	dbskk
> 	dovecot
> 	distcc
> 	i18n_input
> 	irqbalance
> 	lpd
> 	networkmanager
> 	pegasus
> 	postfix
> 	procmail
> 	radius
> 	rdisc
> 	rpc
> 	spamassassin
> 	timidity
> 	xdm
> 	xfs
> 
> 
> -- 
> Chris PeBenito
> Tresys Technology, LLC
> (410) 290-1411 x150
> 
> 
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
> 

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2005-12-07 16:40 Christopher J. PeBenito
  2005-12-15 22:28 ` Serge E. Hallyn
  0 siblings, 1 reply; 43+ messages in thread
From: Christopher J. PeBenito @ 2005-12-07 16:40 UTC (permalink / raw)
  To: SELinux Mail List

A new release of the SELinux Reference Policy is now available on
SourceForge from http://serefpolicy.sourceforge.net.  The primary
activity for this release has been preparing and testing Reference
Policy for inclusion in Fedora Core 5 as it's targeted policy.  In
addition, several build issues have been fixed.  The change log follows
at the bottom of the email.

Again, for those that are interesting in contributing, right now the
best help would be to convert existing policies over to reference
policy; there is a list of modules on the reference policy status page
on SourceForge.

* Wed Dec 07 2005 Chris PeBenito <selinux@tresys.com> - 20051207
- Add unlabeled IPSEC association rule to domains with
  networking permissions.
- Merge systemuser back in to users, as these files
  do not need to be split.
- Add check for duplicate interface/template definitions.
- Move domain, files, and corecommands modules to kernel
  layer to resolve some layering inconsistencies.
- Move policy build options out of Makefile into build.conf.
- Add yppasswd to nis module.
- Change optional_policy() to refer to the module name
  rather than modulename.te.
- Fix labeling targets to use installed file_contexts rather
  than partial file_contexts in the policy source directory.
- Fix build process to use make's internal vpath functions
  to detect modules rather than using subshells and find.
- Add install target for modular policy.
- Add load target for modular policy.
- Add appconfig dependency to the load target.
- Miscellaneous fixes from Dan Walsh.
- Fix corenetwork gen_context()'s to expand during the policy
  build phase instead of during the generation phase.  
- Added policies:
	amanda
	avahi
	canna
	cyrus
	dbskk
	dovecot
	distcc
	i18n_input
	irqbalance
	lpd
	networkmanager
	pegasus
	postfix
	procmail
	radius
	rdisc
	rpc
	spamassassin
	timidity
	xdm
	xfs


-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2005-10-19 21:50 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2005-10-19 21:50 UTC (permalink / raw)
  To: SELinux Mail List

A new release of the SELinux Reference Policy is now available on
Sourceforge from http://serefpolicy.sourceforge.net.  All loadable
modules can now be compiled with a compiler that has the
require-in-conditional, declare-then-require, and stack-overflow patches
applied; however, the linked policy has not been thoroughly tested.  We
attempted to load the policy once, but the kernel oopsed; we will try to
reproduce this and investigate it.  The change log follows at the bottom
of the email.

Again, for those that are interesting in contributing, right now the
best help would be to convert existing policies over to reference
policy; there is a list of modules on the reference policy status page
on Sourceforge.  We are now using the Dan Walsh's Rawhide policy
(ftp://people.redhat.com/dwalsh/SELinux/Fedora/) as a baseline for the
policies.

* Wed Oct 19 2005 Chris PeBenito <selinux@tresys.com> - 20051019
- Many fixes to make loadable modules build.
- Add targets for sechecker.
- Updated to sedoctool to read bool files and tunable
  files separately.
- Changed the xml tag of <boolean> to <bool> to be consistent
  with gen_bool().
- Modified the implementation of segenxml to use regular
  expressions.
- Rename context_template() to gen_context() to clarify
  that its not a Reference Policy template, but a support
  macro.
- Add disable_*_trans bool support for targeted policy.
- Add MLS module to handle MLS constraint exceptions,
  such as reading up and writing down.
- Fix errors uncovered by sediff and sechecker.
- Added policies:
        anaconda
        apache
        apm
        arpwatch
        bluetooth
        dmidecode
        finger
        ftp
        kudzu
        mailman
        ppp
        radvd
        radius
        sasl
        webalizer

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2005-09-22 20:56 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2005-09-22 20:56 UTC (permalink / raw)
  To: SELinux Mail List

A new release of the SELinux Reference Policy is now available on
Sourceforge from http://serefpolicy.sourceforge.net.  This release
includes the changes in the NSA CVS policy made since the previous
1.23.2 baseline policy.  In addition, several modules were added, and
many problems with compiling loadable modules have been fixed.  However,
not all modules can be compiled as loadable modules yet, due to a few
compiler issues that are being worked on now.  Initial support for MCS
was also added; the policy compiles, but it is untested.  The change log
follows at the bottom of the email.

Again, for those that are interesting in contributing, right now the
best help would be to convert existing policies over to reference
policy; there is a list of modules on the reference policy status page
on Sourceforge.  We are now using the NSA example policy in the
SourceForge CVS (http://selinux.sf.net) as a baseline for the policies.

* Thu Sep 22 2005 Chris PeBenito <selinux@tresys.com> - 20050922
- Make logrotate, sendmail, sshd, and rpm policies
  unconfined in the targeted policy so no special
  modules.conf is required.
- Add experimental MCS support.
- Add appconfig for MLS.
- Add equivalents for old can_resolve(), can_ldap(), and
  can_portmap() to sysnetwork.
- Fix base module compile issues.
- Added policies:
        cpucontrol
        cvs
        ktalk
        portmap
        postgresql
        rlogin
        samba
        snmp
        stunnel
        telnet
        tftp
        uucp
        vpn
        zebra

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2005-09-07 17:22 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2005-09-07 17:22 UTC (permalink / raw)
  To: SELinux Mail List

A new release of the SELinux Reference Policy is now available on
Sourceforge from http://serefpolicy.sourceforge.net.  This release
focused on the addition of policies.  The change log follows at the
bottom of the email.

Again, for those that are interesting in contributing, right now the
best help would be to convert existing policies over to reference
policy; there is a list of modules on the status page on Sourceforge.
We are using the NSA example policy 1.23.2 as a baseline for the
policies (also available on the download page), and we ask that these
policies are used when converting modules.  After all of the policies
are converted over, then we will update reference policy to the current
NSA CVS policy.

- Fix errors uncovered by sediff.
- Doc tool will explicitly say a module does not have interfaces
  or templates on the module page.
- Added policies:
        comsat
        dbus
        dhcp
        dictd
        hal
        inn
        ntp
        squid

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2005-08-26 15:57 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2005-08-26 15:57 UTC (permalink / raw)
  To: SELinux Mail List

A new release of the SELinux Reference Policy is now available on
Sourceforge from http://serefpolicy.sourceforge.net.  The change log
follows at the bottom of the email.  In particular, Makefile support for
building loadable policy modules has been added, in addition to several
policies.

Again, for those that are interesting in contributing, right now the
best help would be to convert existing policies over to reference
policy; there is a list of modules on the status page on Sourceforge.
We are using the NSA example policy 1.23.2 as a baseline for the
policies (also available on the download page), and we ask that these
policies are used when converting modules.  After all of the policies
are converted over, then we will update reference policy to the current
NSA CVS policy.

- Add Makefile support for building loadable modules.
- Add genclassperms.py tool to add require blocks
  for loadable modules.
- Change sedoctool to make required modules part of base
  by default, otherwise make as modules, in modules.conf.
- Fix segenxml to handle modules with no interfaces.
- Rename ipsec connect interface for consistency.
- Add missing parts of unix stream socket connect interface
  of ipsec.
- Rename inetd connect interface for consistency.
- Rename interface for purging contents of tmp, for clarity,
  since it allows deletion of classes other than file.
- Misc. cleanups.
- Added policies:
	acct
	bind
	firstboot
	gpm
	howl
	ldap
	loadkeys
	mysql
	privoxy
	quota
	rshd
	rsync
	su
	sudo
	tcpd
	tmpreaper
	updfstab

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

* ANN: Reference Policy Release
@ 2005-08-02 15:49 Christopher J. PeBenito
  0 siblings, 0 replies; 43+ messages in thread
From: Christopher J. PeBenito @ 2005-08-02 15:49 UTC (permalink / raw)
  To: SELinux Mail List

A new release of the SELinux Reference Policy is now available on
Sourceforge from http://serefpolicy.sourceforge.net.  The change log
follows at the bottom of the email.  In particular, the policy now works
as a targeted policy so that people can begin testing it on
non-production machines.  There is a guide to switching a Fedora Core 4
system over to a targeted Reference Policy on Sourceforge
(http://serefpolicy.sourceforge.net/index.php?page=switch).

Again, for those that are interesting in contributing, right now the
best help would be to convert existing policies over to reference
policy; there is a list of modules on the status page on Sourceforge.
We are using the NSA example policy 1.23.2 as a baseline for the
policies (also available on the download page), and we ask that these
policies are used when converting modules.  After all of the policies
are converted over, then we will update reference policy to the current
NSA CVS policy.

20050802 (2 Aug 2005)
        * Fix comparison bug in fc_sort.
        * Fix handling of ordered and unordered HTML lists.
        * Corenetwork now supports multiple network interfaces having the
          same type.
        * Doc tool now creates pages for global Booleans and global tunables.
        * Doc tool now links directly to the interface/template in the
          module page when it is selected in the interface/template index.
        * Added support for layer summaries.
        * Added policies:
                ipsec
                nscd
                pcmcia
                raid

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 43+ messages in thread

end of thread, back to index

Thread overview: 43+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-02-01 20:22 ANN: Reference Policy release Chris PeBenito
  -- strict thread matches above, loose matches on Subject: below --
2018-07-01 17:40 Chris PeBenito
2017-02-04 19:02 ANN: Reference Policy Release Chris PeBenito
2016-10-23 21:29 Chris PeBenito
2016-11-02  4:13 ` Russell Coker
2016-11-02 22:19   ` Chris PeBenito
2015-12-08 15:49 Christopher J. PeBenito
2014-12-03 19:31 Christopher J. PeBenito
2014-03-11 13:33 Christopher J. PeBenito
2013-04-24 20:56 Christopher J. PeBenito
2012-07-26 16:41 Christopher J. PeBenito
2012-02-15 20:19 Christopher J. PeBenito
2011-07-26 18:44 Christopher J. PeBenito
2010-12-14 16:39 Christopher J. PeBenito
2010-05-25 20:02 Christopher J. PeBenito
2009-11-17 15:28 Christopher J. PeBenito
2009-07-30 18:45 Christopher J. PeBenito
2008-12-10 20:24 Christopher J. PeBenito
2008-10-14 18:34 Christopher J. PeBenito
2008-07-02 15:37 Christopher J. PeBenito
2008-04-02 18:14 Christopher J. PeBenito
2007-12-14 18:56 Christopher J. PeBenito
2007-09-28 15:19 Christopher J. PeBenito
2007-10-02 15:29 ` Shintaro Fujiwara
2007-06-29 17:30 Christopher J. PeBenito
2007-04-17 15:07 Christopher J. PeBenito
2007-04-19 20:45 ` Manoj Srivastava
2007-04-19 20:56   ` Karl MacMillan
2007-04-19 23:10     ` Manoj Srivastava
2006-12-12 22:35 Christopher J. PeBenito
2006-10-19 12:57 Christopher J. PeBenito
2006-03-07 15:28 Christopher J. PeBenito
2006-01-17 21:31 Christopher J. PeBenito
2005-12-07 16:40 Christopher J. PeBenito
2005-12-15 22:28 ` Serge E. Hallyn
2005-12-16 17:59   ` Daniel J Walsh
2005-12-18 23:20   ` Serge E. Hallyn
2006-01-03 15:48   ` Christopher J. PeBenito
2005-10-19 21:50 Christopher J. PeBenito
2005-09-22 20:56 Christopher J. PeBenito
2005-09-07 17:22 Christopher J. PeBenito
2005-08-26 15:57 Christopher J. PeBenito
2005-08-02 15:49 Christopher J. PeBenito

SELinux Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/selinux/0 selinux/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 selinux selinux/ https://lore.kernel.org/selinux \
		selinux@vger.kernel.org selinux@archiver.kernel.org
	public-inbox-index selinux


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.selinux


AGPL code for this site: git clone https://public-inbox.org/ public-inbox