[DSE-Dev] refpolicy_2.20140421-10_amd64.changes ACCEPTED into unstable

Debian FTP Masters ftpmaster at ftp-master.debian.org
Fri May 13 22:27:37 UTC 2016



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Fri, 13 May 2016 22:29:59 +0200
Source: refpolicy
Binary: selinux-policy-default selinux-policy-mls selinux-policy-src selinux-policy-dev selinux-policy-doc
Architecture: source all
Version: 2:2.20140421-10
Distribution: unstable
Urgency: medium
Maintainer: Debian SELinux maintainers <selinux-devel at lists.alioth.debian.org>
Changed-By: Laurent Bigonville <bigon at debian.org>
Description:
 selinux-policy-default - Strict and Targeted variants of the SELinux policy
 selinux-policy-dev - Headers from the SELinux reference policy for building modules
 selinux-policy-doc - Documentation for the SELinux reference policy
 selinux-policy-mls - MLS (Multi Level Security) variant of the SELinux policy
 selinux-policy-src - Source of the SELinux reference policy for customization
Closes: 585355 697843 756729 778232 780934 781670 805492 805496
Changes:
 refpolicy (2:2.20140421-10) unstable; urgency=medium
 .
   * Team upload.
   [ Laurent Bigonville ]
   * Fix the maintainer script to support the new policy store from libsemnage
     2.4 (Closes: #805492)
   * debian/gbp.conf: Sign tags by default (Closes: #781670)
   * debian/control: Adjust and cleanup the {build-}dependencies (Closes:
     #805496)
   * debian/control: Bump Standards-Version to 3.9.8 (no further changes)
   * debian/rules: Make the build reproducible (Closes: #778232)
   * Remove deprecated system.users and local.users files
   * debian/control: Update Homepage URL (Closes: #780934)
   * debian/rules: Allow parallel build now that the build system is supporting
     it, see #677689
   * debian/policygentool: Remove string exceptions so the script is Python >=
     2.6 compatible (Closes: #585355)
   * Do not install semanage.read.LOCK, semanage.trans.LOCK and
     file_contexts.local in /etc/selinux/* this is not needed anymore with the
     new policy store.
   * debian/control: Use https for the Vcs-* URL's to please lintian
   * debian/watch: Fix watch file URL now that the project has moved to github
 .
   [ Russell Coker ]
   * Allow init_t to manage init_var_run_t symlinks and self getsched
     to relabel files and dirs to etc_runtime_t for /run/blkid
     to read/write init_var_run_t fifos for /run/initctl
     kernel_rw_unix_sysctls() for setting max_dgram_qlen (and eventually other
     sysctls)
   * Allow restorecond_t and setfiles_t to getattr pstore_t and debugfs_t
     filesystems
   * Allow kernel_t to setattr/getattr/unlink tty_device_t for kdevtmpfs
   * Label /usr/share/bug/.* files as bin_t for reportbug in strict configuration
   * Label /run/tmpfiles.d/kmod.conf as kmod_var_run_t and allow insmod_t to
     create it
   * apache_unlink_var_lib() now includes write access to httpd_var_lib_t:dir
   * Allow apache to read sysctl_vm_t for overcommit_memory Allow
     httpd_sys_script_t to read sysfs_t. allow httpd_t to manage httpd_log_t
     files and directories for mod_pagespeed.
   * Removed bogus .* in mailman file context that was breaking the regex
   * Lots of mailman changes
   * Allow system_mail_t read/write access to crond_tmp_t
   * Allow postfix_pipe_t to write to postfix_public_t sockets
   * Label /usr/share/mdadm/checkarray as bin_t
   * Let systemd_passwd_agent_t, chkpwd_t, and dovecot_auth_t get enforcing
     status
   * Allow systemd_tmpfiles_t to create the cpu_device_t device
   * Allow init_t to manage init_var_run_t links
   * Allow groupadd_t the fsetid capability
   * Allow dpkg_script_t to transition to passwd_t. Label dpkg-statoverride as
     setfiles_exec_t for changing SE Linux context. Allow setfiles_t to read
     dpkg_var_lib_t so dpkg-statoverride can do it's job
   * Allow initrc_t to write to fsadm_log_t for logsave in strict configuration
   * Allow webalizer to read fonts and allow logrotate to manage
     webaliser_usage_t files also allow it to be run by logrotate_t.
   * Allow jabber to read ssl certs and give it full access to it's log files
     Don't audit jabber running ps.
   * Made logging_search_logs() allow reading var_log_t:lnk_file for symlinks
     in log dir
   * Allow webalizer to read usr_t and created webalizer_log_t for it's logs
   * Made logging_log_filetrans and several other logging macros also allow
     reading var_log_t links so a variety of sysadmin symlinks in /var/log
     won't break things
   * Allow postfix_policyd_t to execute bin_t, read urandom, and capability
     chown.
     New type postfix_policyd_tmp_t
   * Added user_udp_server boolean
   * Allow apt_t to manage dirs of type apt_var_cache_t
   * Allow jabber to connect to the jabber_interserver_port_t TCP port
     Closes: #697843
   * Allow xm_t to create xen_lock_t files for creating the first Xen DomU
   * Allow init_t to manage init_var_run_t for service file symlinks
   * Add init_telinit(dpkg_script_t) for upgrading systemd
   * Allow dpkg_script_t the setfcap capability for systemd postinst.
   * Add domain_getattr_all_domains(init_t) for upgrading strict mode systems
   * Allow *_systemctl_t domains read initrc_var_run_t (/run/utmp), read proc_t,
     and have capability net_admin.  Allow logrotate_systemctl_t to manage all
     services.
   * Give init_t the audit_read capability for systemd
   * Allow iodined_t access to netlink_route_socket.
   * add init_read_state(systemd_cgroups_t) and
     init_read_state(systemd_tmpfiles_t) for /proc/1/environ
   * Label /etc/openvpn/openvpn-status.log as openvpn_status_t as it seems to
     be some
     sort of default location. /var/log is a better directory for this
   * Allow syslogd_t to write to a netlink_audit_socket for systemd-journal
   * Allow mandb_t to get filesystem attributes
   * Allow syslogd to rename and unlink init_var_run_t files for systemd
     temporary files
   * Allow ntpd_t to delete files for peerstats and loopstats
   * Add correct file labels for squid3 and tunable for squid pinger raw net
     access (default true)
   * Allow qemu_t to read crypto sysctls, rw xenfs files, and connect to
     xenstored unix sockets
   * Allow qemu_t to read sysfs files for cpu online
   * Allow qemu to append xend_var_log_t for /var/log/xen/qemu-dm-*
   * Allow xm_t (xl program) to create and rename xend_var_log_t files, read
     kernel images, execute qemu, and inherit fds from sshd etc.
   * Allow xm_t and iptables_t to manage udev_var_run_t to communicate via
     /run/xen-hotplug/iptables for when vif-bridge runs iptables
   * Allow xm_t to write to xen_lock_t files not var_lock_t
   * Allow xm_t to load kernel modules
   * Allow xm_t to signal qemu_t, talk to it by unix domain sockets, and unlink
     it's sockets
   * dontaudit xm_t searching home dir content
   * Label /run/xen as xend_var_run_t and allow qemu_t to create sock_files in
     xend_var_run_t directory
   * Label /var/lock/xl as xen_lock_t
   * allow unconfined_t to execute xl/xm in xm_t domain.
   * Allow system_cronjob_t to configure all systemd services (restart all
     daemons)
   * Allow dpkg_script_t and unconfined_t to manage systemd service files of
     type null_device_t (symlinks to /dev/null)
   * Label /var/run/lwresd/lwresd.pid as named_var_run_t
   * Label /run/xen/qmp* as qemu_var_run_t
   * Also label squid3.pid
   * Allow iptables_t to be in unconfined_r (for Xen)
   * Allow udev_t to restart systemd services
     Closes: #756729
   * Merge Laurent's changes with mine
Checksums-Sha1:
 6274875f7fdd38d056f1e86a03017fb3549560df 2089 refpolicy_2.20140421-10.dsc
 4c4f27df1524bbf2a9db69ba250cb945f8a5f479 90016 refpolicy_2.20140421-10.debian.tar.xz
 433730c9090b856c1d6dfaaac32e7604717f893e 2821672 selinux-policy-default_2.20140421-10_all.deb
 029ed851edd6d45c11b9fab474f701cfac435959 443666 selinux-policy-dev_2.20140421-10_all.deb
 82df1c4e0a456118dcb670f881b0b2347e93530e 423478 selinux-policy-doc_2.20140421-10_all.deb
 ada7d89622cb470fce3dd6f5e0bc5da63a21fd3b 2871900 selinux-policy-mls_2.20140421-10_all.deb
 8b8a042e4f7d5e2af769a2bd7318b9dc3828c4c2 1183880 selinux-policy-src_2.20140421-10_all.deb
Checksums-Sha256:
 0b83e4e05e8c672b86e928128071727cd152d580b721817ce1a883bb92f85cd6 2089 refpolicy_2.20140421-10.dsc
 e07227169bf110bc045b977dd545a6a84864e431c745696102907b571188036b 90016 refpolicy_2.20140421-10.debian.tar.xz
 274656801d596f8ff71c6745a36c56867f0c9e7f9f3d0e2cea98bb12dec0baea 2821672 selinux-policy-default_2.20140421-10_all.deb
 7a8dbdd541378bdf0c6a66f6d27393a64d1de573672dee5feb8fb053b8b5bec6 443666 selinux-policy-dev_2.20140421-10_all.deb
 987384487836b46863ed20c30864a4b1600af836b762ad3f6489da4c04168a40 423478 selinux-policy-doc_2.20140421-10_all.deb
 ecd9622ede56aabb40370a0bd01d151f5ec09e06a7259783428793fb9847fde4 2871900 selinux-policy-mls_2.20140421-10_all.deb
 1b9c76e0e3521a51698bc5d299ad385cc5b94074e7c477c25a7b3ce4f1f2f276 1183880 selinux-policy-src_2.20140421-10_all.deb
Files:
 cd12eda70b44ee8d827288a8f037c90d 2089 admin optional refpolicy_2.20140421-10.dsc
 daa9bad41935fa9966514a77207ae47e 90016 admin optional refpolicy_2.20140421-10.debian.tar.xz
 26a6719a2e8035f1df277de7da5960a4 2821672 admin optional selinux-policy-default_2.20140421-10_all.deb
 c65f722a18d0225b2e70428a2343fbce 443666 admin optional selinux-policy-dev_2.20140421-10_all.deb
 c75fdf3e201c0fbc03f97c91fb24f679 423478 doc optional selinux-policy-doc_2.20140421-10_all.deb
 6fc180e9a11b5994f09a24b515b973dc 2871900 admin extra selinux-policy-mls_2.20140421-10_all.deb
 744b4acc08ea65d4f9083102e86fb8d3 1183880 admin optional selinux-policy-src_2.20140421-10_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBCAAGBQJXNj1bAAoJEB/FiR66sEPVcGEH/15Pp3PP25YP8g/3KJks5/xG
9CCAfqY0NNMXbonrJVALIRdMn8RJ/9ILP7VqretxuE3WW8hWJ3rgkDwuEJoY/IRt
Wayx6knfJuxz0fuLVmHiKfMt2S2lp4AF5zPpan2bn1VgHYwkGfx3w7orm5TaG2OM
I6p4tLVR9ZArdFObVysOOypg4mzeGzoz1VIjVqgHvnml9kZ7ItfsQ0vWh2GMdl0V
/nbaXG7nLBQA4gR6o8CxS4wZdrBfUkv7WbR8UioYggr5NSytrSpzZd4+C6+nUtnu
ErOp7pSeIudQ08v6yCyEuERQHg4w3lI32mKYIQLiE39pQRk73fT4NHCCgV5QxLU=
=AnqX
-----END PGP SIGNATURE-----


Thank you for your contribution to Debian.



More information about the SELinux-devel mailing list