SELinux Archive on
 help / color / Atom feed
From: Petr Lautrbach <>
To: "SELinux list" <>
Subject: ANN: SELinux userspace release 2019-12-04 / 3.0
Date: Wed, 04 Dec 2019 09:37:27 +0100
Message-ID: <> (raw)

The 2019-12-04 / 3.0 release for the SELinux userspace is now 
available at:

Thanks to all the contributors to this release!

User-visible changes:

* Optional support for kernel policy optimization (enable with
optimize-policy=true in /etc/selinux/semanage.conf for modular policy or -O
option to checkpolicy/secilc for monolithic policy); this is optional because it
provides relatively small savings with non-trivial policy compile-time overhead
for some policies e.g. Android.

* New digest scheme for setfiles/restorecon -D; instead of a single hash of the
entire file contexts configuration stored in a security.restorecon_last xattr on
only the top-level directory, use a hash of all partial matches from file
contexts stored in a security.sehash xattr on each directory,

* Support for default_range glblub in source policy (.te/policy.conf and CIL)
and kernel policy version 32,

* New libselinux APIs for querying validatetrans rules,

* Unknown permissions are now handled as errors in CIL,

* security_av_string() no longer returns immediately upon encountering an
unknown permission and will log all known permissions,

* checkmodule -c support for specifying module policy version,

* mcstransd reverted to original color range matching based on dominance,

* Support for 'dccp' and 'sctp' protocols in semanage port command,

* 'checkpolicy -o -' writes policy to standard output,

* 'semodule -v' sets also cil's log level

* Python 2 code is not be supported in this project anymore and new Python code
should be written only for Python 3.

* Messages about the statement failing to resolve and the optional block being
disabled are displayed at the highest verbosity level.

* Fixed redundant console log output error in restorecond

Issues fixed:


                 reply index

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

SELinux Archive on

Archives are clonable:
	git clone --mirror selinux/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 selinux selinux/ \
	public-inbox-index selinux

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone