refpolicy (2:2.20140421-9) unstable; urgency=medium

  * Allow dovecot_t to read /usr/share/dovecot/protocols.d
    Allow dovecot_t capability sys_resource
    Label /usr/lib/dovecot/* as bin_t unless specified otherwise
    Allow dovecot_auth_t to manage dovecot_var_run_t for auth tokens
  * Allow clamd_t capability { chown fowner fsetid }
    Allow clamd_t to read sysctl_vm_t
  * Allow dkim_milter_t capability dac_override and read sysctl_vm_t
    allow dkim_milter_t to bind to unreserved UDP ports
  * Label all hard-links of perdition perdition_exec_t
    Allow perdition to read /dev/urandom and capabilities dac_override, chown,
    and fowner
    Allow perdition file trans to perdition_var_run_t for directories
    Also proxy the sieve service - sieve_port_t
    Allow connecting to mysql for map data
  * Allow nrpe_t to read nagios_etc_t and have capability dac_override
  * Allow httpd_t to write to initrc_tmp_t files
    Label /var/lib/php5(/.*)? as httpd_var_lib_t
  * Allow postfix_cleanup_t to talk to the dkim filter
    allow postfix_cleanup_t to use postfix_smtpd_t fds (for milters)
    allow postfix_smtpd_t to talk to clamd_t via unix sockets
    allow postfix_master_t to execute hostname for Debian startup scripts
  * Allow unconfined_cronjob_t role system_r and allow it to restart daemons
    via systemd
    Allow system_cronjob_t to unlink httpd_var_lib_t files (for PHP session
    cleanup)
  * Allow spamass_milter_t to search the postfix spool and sigkill itself
    allow spamc_t to be in system_r for when spamass_milter runs it
  * Allow courier_authdaemon_t to execute a shell
  * Label /usr/bin/maildrop as procmail_exec_t
    Allow procmail_t to connect to courier authdaemon for the courier maildrop,
    also changed courier_stream_connect_authdaemon to use courier_var_run_t
    for the type of the socket file
    Allow procmail_t to read courier config for maildrop.
  * Allow system_mail_t to be in role unconfined_r
  * Label ldconfig.real instead of ldconfig as ldconfig_exec_t
  * Allow apt_t to list directories of type apt_var_log_t
  * Allow dpkg_t to execute dpkg_tmp_t and load kernel modules for
    dpkg-preconfigure
  * Allow dpkg_script_t to create udp sockets, netlink audit sockets, manage
    shadow files, process setfscreate, and capabilities audit_write net_admin
    sys_ptrace
  * Label /usr/lib/xen-*/xl as xm_exec_t

 -- Russell Coker <russell@coker.com.au>  Fri, 06 Feb 2015 02:31:05 +1100

refpolicy (2:2.20140421-8) unstable; urgency=medium

  * Make all of /etc/ssl apart from /etc/ssl/private etc_t
  * Allow systemd_logind_t to search xdm_tmp_t:dir
    Allow systemd_tmpfiles_t to create xdm_tmp_t:dir
    Make xserver_create_xdm_tmp_socket also allow unlinking the socket
    Allow systemd_tmpfiles_t to create xdm_tmp_t dir
    Allow systemd_logind_t to search xdm_tmp_t
    Allow system_dbusd_t to write to systemd_logind_var_run_t:fifo_file
    for /run/systemd/inhibit/*.ref also added fc for /run/systemd/inhibit
    Allow system_dbusd_t to write to /run/systemd/inhibit/* pipes
    Allow user_t to talk to user_dbusd_t via unix sockets and also all
    dbus clients
    Allow systemd_tmpfiles_t to create xfs_tmp_t dirs
    Closes: #771482
  * Allow userdomains netlink_audit_socket access for logging of X unlock
  * Allow $1_user_ssh_agent_t to send sigchld to xdm_t
  * Allow local_login_t to write to systemd sessions pipes
  * Allow policykit_t to read /run/systemd/machines and /run/systemd/seats/*
  * Allow init_status() for user domains for kdeinit
  * Remove most of the gpg stuff that I put in 2:2.20140421-7.
    Just remove gpg_helper_t, merge gpg_pinentry_t with the main gpg domain,
    and make the gpg_t domain only used from user_t. Domain trans from
    gpg_agent_t to user_t when running bin_t such as ck-launch-session.
    Allow gpg_agent_t and *_ssh_agent_t to append to an inherited user_home_t
    file
    Closes: #771484
  * Allow user_dbusd_t to append to user_home_t
  * Allow load_policy_t to read /dev/urandom.
  * Label /usr/lib/dovecot/(log)|(ssl-params)|(anvil) dovecot_exec_t so they
    can be executed by the main dovecot daemon.
    Closes: #775223
  * Allow alsa_t to create lockfiles and added fc for
    /run/lock/asound.state.lock
  * Allow local_login_t capability net_admin
  * Allow systemd_logind_t capability sys_admin and mount tmpfs_t
  * Allow mozilla_t (Chrome) to manage symlinks in /tmp and create sockets
    Allow chrome_sandbox_t to use user_t fd.
    Allow mozilla_t to use netlink_kobject_uevent_socket.
    Label ~/.config/google-chrome as mozilla_home_t
    Label /opt/google/chrome/nacl_helper as chrome_browser_exec_t
    Allow chrome_sandbox_t to write to users pty (for startup error messages)
    Closes: #771483
  * Allow userdomains to read vm sysctls and to create a
    netlink_kobject_uevent_socket.
  * Allow initrc_t to perform systemd service start/stop operations on
    initrc_var_run_t files. This may be a bug in systemd.
  * Label .xsession-errors as user_home_t when xdm_t creates it.
  * Label /usr/sbin/dhcp6c as dhcpc_exec_t /run/dhcp6c.pid as dhcpc_var_run_t
    and /var/lib/dhcpv6 as dhcpc_state_t
  * Dontaudit getty_t capability sys_admin
  * Allow cronjob_t read-write access to crond_tmp_t.
  * Allow gconfd_t to read /var/lib/gconf/defaults and /proc/filesystems
  * Allow fsadm_t to stat mount_var_run_t for /run/mount/utab

 -- Russell Coker <russell@coker.com.au>  Mon, 19 Jan 2015 16:27:05 +1100

refpolicy (2:2.20140421-7) unstable; urgency=medium

  * Label /run/systemd/journal/dev-log and /run/systemd/journal/stdout as
    devlog_t
  * Allow bootloadter_t to load kernel modules and run apt-cache
  * Allow systemd_cgroups_t to read /proc/cmdline
  * Allow sshd net_admin capability
  * Allow systemd_logind_t to read kernel sysctls, list tmpfs, and mount on
    /var/auth, and systemd_unit_file_t:service stop.
  * Allow dpkg_script_t to restart systemd unit files of type init_var_run_t
  * Allow local_login_t and user_t to talk to systemd_logind via dbus
  * Allow user_ssh_agent_t to read/write it's own fifo files
  * Allow user_t to talk to gconfd_t via dbus
  * Allow gpg_agent_t to send sigchld to xdm_t, to be a system dbus client,
    to use nsswitch, and to read user xauth file
  * Allow $1_dbusd_t domains systemd_login_read_pid_files access
  * Remove gpg_helper_t, merge gpg_pinentry_t with the main gpg domain, and
    create user_gpg_t, staff_gpg_t, etc.
  * Allow userdomains to talk to kerneloops via dbus
  * Allow sysstat_t to search all mountpoints
  * Allow udev_t self:netlink_route_socket nlmsg_write for interface rename
  * Allow systemd_tmpfiles_t to read kernel sysctls for boot_id
  * Allow setfiles_t to read /dev/urandom
  * Label /var/run/blkid as etc_runtime_t

  * TLDR: Make everything work with latest systemd and allow KDE login with
    latest X11 configuration.

 -- Russell Coker <russell@coker.com.au>  Mon, 13 Oct 2014 09:41:44 +1100

refpolicy (2:2.20140421-6) unstable; urgency=medium

  [ Laurent Bigonville ]
  * debian/patches/0046-misc-not-systemd: Remove duplicate
    dev_associate(hugetlbfs_t) rule

  [ Russell Coker ]
  * Allow dpkg_script_t to restart all daemons under systemd
  * Allow ndc_t the block_suspend capability
  * Allow systemd_logind_t self:process signal access
  * allow systemd_logind_t systemd_unit_file_t:service start;
  * allow systemd_tmpfiles_t and systemd_cgroups_t capability net_admin
  * allow systemd_tmpfiles_t process getcap
  * storage_getattr_fixed_disk_dev(xend_t) for running lsscsi
  * Allow xenstored_t to search bin_t
  * New type systemd_journal_log_t for /var/log/journal and
    /var/run/log/journal
  * Added audit_read to capability2 class
  * Allow kerneloops_t, systemd_tmpfiles_t, and systemd_logind_t to read
    /dev/urandom
  * Allow all user domains to read /var/lib/dpkg
  * Allow udev_t to read kernel module files for systemd-udevd
  * Allow alsa_t to search locks
  * Allow systemd-tmpfilesd to setattr many device types and create
    /dev/xconsole
  * Allow unconfined_t to get statyus of systemd jobs
  * Add FC entry for /var/run/wd_keepalive.pid and /var/run/sm-notify.pid

 -- Russell Coker <russell@coker.com.au>  Sat, 13 Sep 2014 16:15:12 +1000

refpolicy (2:2.20140421-5) unstable; urgency=medium

  * Allow system_cronjob_t to read apt_var_lib_t and ntp_conf_t.
  * Allow init_t to create /dev/log and netlink_audit_socket accesss
  * Allow init_t to manage systemd_passwd_var_run_t links
  * Allow freshclam_t to talk to http_cache_port_t
  * Allow system_cronjob_t to talk to init socket for restarting daemons under
    systemd
  * allow init_t setsched access for (tmpfiles) from systemd
  * Allow dpkg_t to transition to dpkg_script_t when running dpkg_var_lib_t
    (postinst etc scripts)
  * Allow init_t netlink_selinux_socket access for commands like "halt" in
    strict mode
  * Allow initrc_t to perform service operations on init_script_file_type
  * Label /opt/google/chrome/cron/google-chrome bin_t
  * Make Chrome/Chromium run in the correct domain
  * Add domain systemd_cgroups_t for kernel executing
    /lib/systemd/systemd-cgroups-agent
  * Allow dpkg_script_t to read the policy
  * Allow systemd_passwd_agent_t to write to /dev/kmsg and log to syslogd
  * Allow init_t to write to watchdog_device_t for systemd shutdown
  * Allow initrc_t to write net_conf_t for network boot scripts
  * Allow init_t to create var_auth_t directories for systemd
  * Allow initrc_t to read postfix config on Debian
  * Allow initrc_t to talk to init_t via unix sockets
  * Allow init_t to read udev_var_run_t files for systemd to read udev output
  * Allow init_t to read all pidfiles, for systemd
  * Allow postfix_postqueue_t to send sigchld to all userdomains

 -- Russell Coker <russell@coker.com.au>  Thu, 03 Jul 2014 20:45:34 +1000

refpolicy (2:2.20140421-4) unstable; urgency=medium

  * Team upload.
  * debian/rules: Properly expand flavour directory during build
  * debian/rules: Properly remove postrm scripts in clean target
  * debian/postinst.policy: Remove the modules that are not built anymore from
    the notdefault list
  * debian/postinst.policy: Remove the .disabled file for the modules that are
    now built in the base.pp or not built anymore at all.

 -- Laurent Bigonville <bigon@debian.org>  Sun, 29 Jun 2014 17:33:39 +0200

refpolicy (2:2.20140421-3) unstable; urgency=medium

  * Allow sysadm_t to read policy
  * Make systemd_login_list_pid_dirs() call init_search_pid_dirs() as it
    doesn't work without it
  * Added chromium/google-chrome policy
  * dev_getattr_sysfs(sysstat_t) for Debian cron job
  * Allow sysstat_t to manage it's log files
  * Allow dpkg_script_t to config all systemd services and get init status
  * Allow dpkg_script_t to dirmngr_admin
  * really added systemd_login_list_pid_dirs(system_dbusd_t) (somehow missed
    this last time)
  * Allow sshd to chat with systemd via dbus
  * Allow unconfined_t to restart services
  * systemd_write_inherited_logind_sessions_pipes(system_dbusd_t)
  * systemd_dbus_chat_logind(sshd_t)
  * Allow xend to read vm sysctls
  * Allow udev_t to manage xenfs_t files for xenstore-read
  * Allow system_dbusd_t systemd_login_read_pid_files access for
    /run/systemd/users/* files
  * Allow systemd_logind_t to stat tmpfs_t filesystems for /run/user
  * Remove the "genfscon selinuxfs" line from selinux.if in selinux-policy-dev
    to stop sepolgen-ifgen errors.
  * Make udev_relabelto_db() include lnk_file relabeling
  * Allow kernel_t to fs_search_tmpfs, selinux_compute_create_context, and
    kernel_read_unlabeled_state for booting without unconfined.pp
  * Allow system_cronjob_t to manage the apt cache
  * Allow modutils_read_module_config(init_t) and create cgroup_t links for
    strict config. Allow it to relabel from tmpfs_t symlinks
  * Allow init_run_all_scripts_domain (initrc_t) the service { status start
    stop } for all the daemon _initrc_exec_t scripts.
  * Allow sysadm_r to have domain system_mail_t for strict policy
  * Allow init_t to relabel device_t symlinks and pstore_t dirs, load kernel
    modules, manage init_var_run_t sock_files, read /usr, read /dev/urandom,
    systemd_manage_passwd_run, and domain_read_all_domains_state

 -- Russell Coker <russell@coker.com.au>  Sun, 29 Jun 2014 19:11:45 +1000

refpolicy (2:2.20140421-2) unstable; urgency=medium

  * Fix systemd support
  * Made init, logging, authlogin, application, userdomain, systemd, dmesg,
    dpkg, usermanage, libraries, fstools, miscfiles, mount, selinuxutil,
    storage and sysnetwork be base modules - some of this is needed for
    systemd, some just makes sense.
  * Disabled modules anaconda, authbind, kudzu, portage, rhgb, speedtouch
  * Allow syslogd_t to read /dev/urandom (for systemd)
  * Change unit files to use .*.service
  * Default trans syslogd_tmp_t for name /run/log (for systemd)
  * Make /var/auth a mountpoint
  * Allow systemd_tmpfiles_t to relabelto xconsole_device_t
  * Allow init_t to start and stop service systemd_unit_file_t
  * Allow udev_t to write to init_t stream sockets for systemctl
  * Allow syslogd_t to read udev_var_run_t so systemd_journal can get seat data
  * Allow systemd_logind_t to read udev_var_run_t for seat data
  * Allow syslogd_t setgid and setgid for systemd_journal
  * Allow udev_t to read cgroup files for systemd-udevd to read it's own cgroup
  * Give logrotate_t the systemd_systemctl_domain access to restart daemons
  * Make transition from unconfined_t to insmod_t for running modutils and
    remove all unused modutils domains. Make unconfined_t transition to
    insmod_t, this makes depmod run as insmod_t. Make insmod_t write modules
    dep files with the correct context.
  * Allow udev_t to load kernel modules for systemd-udevd
  * Allow initrc_t to systemd_config_all_services
  * Allow lvm_t to talk to init_t via unix socket for systemd
  * Allow allow lvm_t to read sysctl_crypto_t
  * Allow udev_t to read modules_object_t for systemd-udevd
  * Allow udev_t to search /run/systemd for systemd-udevd
  * Allow systemd_tmpfiles_t to relabel man_cache_t
  * Allow initrc_t to get status of init_t for systemd
  * Allow udev_t to get initrc_exec_t service status for when udev runs hdparm
    script
  * Allow ifconfig_t to load kernel modules
  * Allow named_t to read vm sysctls
  * Allow tor_t capabilities chown dac_read_search dac_override fowner
  * Allow fetchmail_t to manage dirs of type fetchmail_uidl_cache_t
  * Allow mysqld_t to connect to itself on unix_stream_socket
  * Allow mysqld_t kernel_read_vm_sysctls for overcommit_memory
  * Allow sysstat_t read and write access to crond_tmp_t (for cron to capture
    stdout/stderr).
  * Allow sysstat_t to read it's own log files and read shell_exec_t
  * Included file context for /run/kdm.pid
  * Allow kerneloops_t to read /proc/filesystems
  * Label /var/cache/dirmngr as dirmngr_var_lib_t
  * systemd_login_list_pid_dirs(system_dbusd_t)

 -- Russell Coker <russell@coker.com.au>  Wed, 25 Jun 2014 15:38:58 +1000

refpolicy (2:2.20140421-1) unstable; urgency=medium

  * Team upload.
  * New GIT snapshot of the policy
    - Drop debian/patches/upstream/*.patch: Applied upstream
    - Label /etc/locale.alias as locale_t (Closes: #707246)
    - Allow xdm_t to execute gkeyringd_domains and to transition to them
    - Label postgresql manpages properly (Closes: #740591)
    - Allow setfiles_t and restorecond_t to getattr from all fs that support
      xattr (Closes: #740682)
  * Refresh debian/modules.conf.default, debian/modules.conf.mls: Start
    building the shibboleth module

 -- Laurent Bigonville <bigon@debian.org>  Mon, 21 Apr 2014 23:37:53 +0200

refpolicy (2:2.20140311-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
  * d/p/u/0001-Properly-label-git-shell-and-other-git-commands-for-.patch:
    Properly label git commands as bin_t and git-shell as shell_exec_t
  * d/p/u/0002-Label-usr-sbin-lightdm-as-xdm_exec_t.patch: Properly label
    lightdm executable as xdm_exec_t (Closes: #739163)
  * d/p/u/0003-Add-several-fcontext-for-debian-specific-paths-for-n.patch:
    Properly label ntp initscript and other ntp related files (Closes: #740656)

 -- Laurent Bigonville <bigon@debian.org>  Sat, 15 Mar 2014 09:56:53 +0100

# For older changelog entries, run 'apt-get changelog selinux-policy-default'
