refpolicy (2:2.20240202-1) unstable; urgency=medium

  * label /run/boltd
  * label /etc/letsencrypt/renewal-hooks files as bin_t
  * Add label for /usr/lib/chromium/chrome_crashpad_handler
  * Enabled module hostapd
  * Changed fwupd policy to have a separate domain for fwupdmgr
  * Lots of policy needed to support login with the latest systemd-user
  * Latest git policy

 -- Russell Coker <russell@coker.com.au>  Fri, 02 Feb 2024 16:55:45 +1100

refpolicy (2:2.20231119-2) unstable; urgency=medium

  * Allow initrc_t to mounton memory_pressure_t files
    Hopefully the last thing needed to make the latest systemd work correctly

 -- Russell Coker <russell@coker.com.au>  Sun, 19 Nov 2023 22:39:04 +1100

refpolicy (2:2.20231119-1) unstable; urgency=medium

  * new git ver
  * systemd 255~rc2-1 in unstable uses initrc_t to launch daemons so needed
    transition rules for that, initrc_t needs to watch unallocated ttys as
    part of the getty launch operation, and it needs nnp_transition to all
    daemon domains for the combination of systemd restrictions on privileges
    and SE Linux domain transition.
    Also domains need access to unix_stream_socket file handles created by
    initrc_t.
    Systemd versions after 254.5-1 break badly without this.

 -- Russell Coker <russell@coker.com.au>  Sun, 19 Nov 2023 17:27:44 +1100

refpolicy (2:2.20231010-1) unstable; urgency=medium

  * new git ver
  * Added more checks for "hostnamectl chassis" output, conainer is vm,
    convertible/watch/embedded are considered as handset for now, and server
    has an entry.

 -- Russell Coker <russell@coker.com.au>  Sun, 22 Oct 2023 15:31:53 +1100

refpolicy (2:2.20230929-1) unstable; urgency=medium

  * new git ver
  * Upstream merged powerprofiles and rasdaemon and anti-spam and motd patches
  * Changed preinst to work when /etc/selinux/config doesn't exist

 -- Russell Coker <russell@coker.com.au>  Fri, 29 Sep 2023 01:15:21 +1000

refpolicy (2:2.20230919-1) unstable; urgency=medium

  * new git ver
  * Upstream merged eg25manager, iiosensorproxy, lowmemorymonitor, switcheroo,
    and thunderbolt

 -- Russell Coker <russell@coker.com.au>  Tue, 19 Sep 2023 15:01:19 +1000

refpolicy (2:2.20230821-1) unstable; urgency=medium

  * new git ver
  * Add policy for Mobian
    Allow system_r:init_t:s0 to transition to user context xdm_r:xdm_t:s0 for
    systemd --user
    Add consolesetup, eg25manager, feedbackd, geoclue, and iiosensorproxy
    policy modules for Mobian
    Lots of other policy changes related to Mobian
  * Added msdos_t label for exfat
  * Add bubblewrap, container, and docker modules
    Consider bubblewrap exerimental at this time
  * Add support for relabelling files on policy package changes to file
    contexts, made the policy packages depend on policycoreutils >= 3.5-2 for
    /usr/libexec/selinux/remove-leaf-dirs
  * Use -19 and -T0 for zstd for policy source
  * Use "hostnamectl chassis" to determine list of default policy modules,
    exclude many things from "handset".

 -- Russell Coker <russell@coker.com.au>  Sat, 26 Aug 2023 12:54:10 +1000

refpolicy (2:2.20221101-10) unstable; urgency=medium

  * Team upload.
  [ Christian Göttsche ]
  * d/patches: drop addition of existent file context (Closes: #1038968)
  * d/tests: simulate policy building
  * d/rules: validate build policy (Closes: #1030804)

  [ Vagrant Cascadian ]
  * debian/rules: Pass arguments to tar to use a consistent uid and gid.
    (Closes: #1030057)

  [ Laurent Bigonville ]
  * debian/control: Bump Standards-Version to 4.6.2 (no further changes)

 -- Laurent Bigonville <bigon@debian.org>  Sat, 15 Jul 2023 09:47:27 +0200

refpolicy (2:2.20221101-9) unstable; urgency=medium

  * Added git and thunderbird to the not default modules list
  * Add filetrans to make dpkg_script_t create /var/lib/ntpsec/ as ntp_drift_t
    also add fc entry for /var/lib/ntpsec
  * Allow ndc_t to read vm_overcommit_state and sysfs files
  * Dontaudit certbot_t net_admin capability, it doesn't need to change
    network stuff, probably changing buffer sizes.
  * Allow aptcacher_t to getsched for itself
  * Allow boinc_t to to connect to unconfinged stream sockets for X access
  * Allow systemd_locale_t to talk to unconfined users by dbus
  * Allow xdm_t to talk to systemd-locale via dbus
  * Allow systemd_generator_t to manage files and dirs of type
    systemd_user_runtime_unit_t and to read crypto sysctls
  * Dontaudit writing to lib dirs for fail2ban_t and fail2ban_client_t for
    python attempts to generate cache files
  * Dontaudit mysqld_safe (mysql startup script) attempts to write to root dir
  * Change all toolchain dependencies to >= version 3.4
  * Allow jabberd_domain to create jabberd_var_lib_t:sock_file for prosody
  * Allow dkim_milter_t and clamd_t to get their own scheduling status
  * Allow auditd_t to map it's config files to avoid recursion when dontaudit
    rules are disabled
  * Allow groupadd_t to stat /proc
  * Allow matrixd_t to read sysfs for CPU information
  * Give postfwd_milter_t kill capability
  * Allow unconfined domains the self:anon_inode access.
    Also allow them to manage dirs in their own domain, Chrome does this
  * Allow the postfix_map_t domain to read /dev/urandom
  * Allow mozilla to bind UDP generic nodes, write dbus session runtime
    sockets, read device sysctls for video hardware specs, and map it's cache
    files.
  * Allow fsadm_t to write to boot_t for fstrim
  * Gave nfsd_t the lease capability, taking leases on files is necessary
  * dontaudit bootloader_t accessing /dev/mem, mdadm does this for some reason
    but doesn't need it
  * Allow fwupd_t to read the vm overcommit sysctl
  * Allow setfiles_t to read the vm overcommit sysctl
  * Allow vnstatd_t to read urandom

 -- Russell Coker <russell@coker.com.au>  Wed, 19 Apr 2023 20:24:14 +1000

refpolicy (2:2.20221101-8) unstable; urgency=medium

  * Fix automated tests error on cron.if line 118 mismatched quotes.

 -- Russell Coker <russell@coker.com.au>  Tue, 21 Mar 2023 14:35:34 +1100

refpolicy (2:2.20221101-7) unstable; urgency=medium

  * new upload due to signature problems

 -- Russell Coker <russell@coker.com.au>  Mon, 20 Mar 2023 17:53:37 +1100

refpolicy (2:2.20221101-6) unstable; urgency=medium

  * More work on cron policy
  * Run bzip2 in a way that works with firebuild
  * Allow sshd_t to read the apt database for motd with unattended-upgrades
  * Allow system_dbusd_t to connect to systemd-machined
  * dontaudit crond connectint to systemd-machined
  * Allow mon_t to read xdg config files and to signal itself and getsched
    for sending xmpp alerts
  * allow fwupd_t to access user tty devices

 -- Russell Coker <russell@coker.com.au>  Wed, 15 Mar 2023 23:19:01 +1100

refpolicy (2:2.20221101-5) unstable; urgency=medium

  * Allow fwupd_t to rw the Intel MEI device
  * Allow rasdaemon_t to rw cpu microcode, the sys_rawio capability, and
    self getsched.
  * Run bzip compression with $(NUMJOBS) in parallel
  * Allow memlockd to read net config so it can lock those config files
  * Label /var/lib/unattended-upgrades as apt_var_lib_t
  * Allow chromium_t to dbus chat to systemd_logind_t for PrepareForSleep
  * dontaudit postfix domains connecting to systemd-machined
  * Allow policykit_t to connect to systemd-machined
  * Made the crontab command work for all login domains

 -- Russell Coker <russell@coker.com.au>  Mon, 13 Mar 2023 03:11:03 +1100

refpolicy (2:2.20221101-4) unstable; urgency=medium

  * Allow sshd_t to read var_lib_t files for motd generation
  * Allow systemd_binfmt_t to statfs binfmt filesystems
  * Allow systemd_nspawn_t all_unix_dgram_socket_perms to itself
  * Allow groupdadd_t to read sysctl_kernel_t files
  * Allow local_login_t to read pam motd files
  * Allow nfsd_t to read directories of RPC file system pipes
  * Allow mysqld_t (Mariadb) to create map read write anon_inode objects it creates
  * Allow kmod_t to read modules_conf_t symlinks, for DKMS
  * Remove unused debian/gen-deps.sh script.
    Change to Debhelper compat level 13
    Removed an attempt to delete a non-existant pyplate.pyc file
    Changed to zstd for selinux-policy-src and stopped using a variable for
    compression options.  Why do we even have selinux-policy-src?
    Removed unneeded build depends and changed the SE Linux build depends
    to version >=3.4
    Change VCS to Vcs in debian/control
    Change lintian overrides to match new format
    Change build to not need root
    Tell Lintian to ignore some very long lines in source
    Fix copyright URLs
    Removed trailing whitespace in changelog
    Use kernel_load_module(brctl_t) instead of just adding a capability
    Add autopkgtest.  Closes: #1012841

 -- Russell Coker <russell@coker.com.au>  Sun, 29 Jan 2023 15:07:05 +1100

refpolicy (2:2.20221101-3) unstable; urgency=medium

  * Add auth_write_pam_motd_files() interface for writing to /run/motd.d and
    correctly label /run/motd.d
  * Add policy for fwupd (firmware update)
  * Allow groupadd_t to search kernel fs sysctls
  * Allow rasdaemon to read sysfs_t
  * Allow systemd_machined_t to talk to policykit via dbus
  * Allow systemd_locale_t to write to /run/systemd/notify
  * Allow systemd_sysctl_t and systemd_tmpfiles_t to search ramfs
  * Allow systemd_generator_t udp setopt and sysnet_read_config for postconf
  * Allow systemd_generator_t to stat usr_t files
  * Allow systemd_modules_load_t to search debugfs
  * Allow systemd_sysusers_t to use apt ptys
  * Allow acpid to getsched
  * Add support for /run/motd.d/
  * Allow Chrome to read sysctl_dev_t and write to dbus session runtime
    socket.  Label the Chrome libvulkan.so.1 file as lib_t
  * Allow systemd_logind_t to delete user tmpfs files and manage tmpfs dirs
  * Allow systemd_locale_t to talk to unconfined via dbus

 -- Russell Coker <russell@coker.com.au>  Mon, 09 Jan 2023 18:05:47 +1100

refpolicy (2:2.20221101-2) unstable; urgency=medium

  * Allow $1_dbusd_t to create sock_files under /tmp
  * Remove the deprecated interfaces that had been in Bullseye
  * Allow $1_wm_t to read/write input devices and use logind fds
  * Added systemd_dbus_chat_locale() and allowed xdm and user domains to do it.
  * Allow user domains to unlink xdm_tmp_t socket files
  * Allow systemd-coredump, chkpwd_t, and setfiles_t to statfs /proc
  * Label /usr/lib/NetworkManager/nm-dispatcher* as NetworkManager_exec_t
  * Label /sbin/fstrim as fsadm_exec_t
  * Allow setfiles_t to read bin_t links
  * Make ssh_sysadm_login default to true.  Closes: #1012755
  * Allow fsadm_t to statfs cgroup filesystems and to read /proc/1/environ
    for systemd-fsckd.  Also dontaudit net_admin capability for systemd-fsckd
    trying to change buffer sizes.
  * Allow systemd_sysusers_t to use inherited user terminals and inherit file
    handles from unconfined_t and give it domain_obj_id_change_exemption()
  * Made init_runtime_t an init unit file, for automatically generated units

 -- Russell Coker <russell@coker.com.au>  Mon, 02 Jan 2023 22:02:36 +1100

refpolicy (2:2.20221101-1) unstable; urgency=medium

  * New upstream release
  * Label /lib/systemd/systemd-fsckd as fsadm_exec_t

 -- Russell Coker <russell@coker.com.au>  Sun, 06 Nov 2022 23:02:25 +1100

refpolicy (2:2.20220520-5) unstable; urgency=medium

  * label apt.systemd.daily and apt-helper as apt_exec_t for systemd cron jobs
  * Allow apt_t to get init, systemd-networkd, and network-manager unit status
  * give systemd_generator_t access to nfsd_fs_t files and
    systemd_transient_unit_t dirs
  * Allow kmod_t to read ssl generit certs
  * Allow systemd_machined_t to get status of systemd_transient_t units

 -- Russell Coker <russell@coker.com.au>  Mon, 26 Sep 2022 19:59:14 +1000

refpolicy (2:2.20220520-4) unstable; urgency=medium

  * Add label for /etc/dkimkeys Closes: #900188
  * Allow chronyd_t to send unix datagrams to unconfined_t and gave it
    dac_read_search Closes: #962223
  * Allow firewalld_t to do netlink_netfilter_socket access, watch
    firewalld_etc_rw_t dirs, and read generic certs
  * Allow init_t to watch for reads on console_device_t for autorelabel
    processing.

 -- Russell Coker <russell@coker.com.au>  Sun, 18 Sep 2022 12:48:43 +1000

refpolicy (2:2.20220520-3) unstable; urgency=medium

  * Allow systemd_passwd_agent_t to stat /proc and read sys/kernel/cap_last_cap
  * Allow systemd_backlight_t to stat sysfs and read SE Linux contexts
  * Allow systemd_logind_t to read localization.
  * Allow lvm_t to read generic certificates for systmd-cryptsetup
  * Allow systemd_logind_t to read udev runtime links
  * Allow systemd-udevd to manage cgroup files
  * Allow systemd_machined_t, systemd_locale_t, lvm_t, systemd_binfmt_t, and
    systemd_backlight_t to statfs /proc
  * give the sys_resource capability to systemd_sysctl_t
  * Allow chromium to read the vm_overcommit sysctl
  * Allow systemd_binfmt_t to check executable status of bin files and search
    cgroup dirs

 -- Russell Coker <russell@coker.com.au>  Thu, 15 Sep 2022 00:03:25 +1000

refpolicy (2:2.20220520-2) unstable; urgency=medium

  * Added label for /usr/sbin/nfsdcld and gave nfsd_t setpcap capability
  * Allow syslogd_t to relabel from/to systemd_journal_t
  * Created 0002-upstream patch file for changes that are in the upstream git

 -- Russell Coker <russell@coker.com.au>  Sun, 14 Aug 2022 00:20:28 +1000

refpolicy (2:2.20220520-1) unstable; urgency=medium

  * new upstream release

 -- Russell Coker <russell@coker.com.au>  Sun, 22 May 2022 21:55:06 +1000

refpolicy (2:2.20220403-3) unstable; urgency=medium

  * little policy fixes
  * Changed build-depends from libsepol1 to libsepol2

 -- Russell Coker <russell@coker.com.au>  Tue, 12 Apr 2022 23:38:26 +1000

refpolicy (2:2.20220403-2) unstable; urgency=medium

  * Allow init to watch_reads on terminal devices
  * Allow init_t to mounton files of type init_t
  * Label /usr/share/unattended-upgrades/* as bin_t
  * Allow systemd_backlight_t to search cgroup dirs
  * Allow lvm_t to getattr a cgroup filesystem
  * Make init_t file handles inheritable by most domains because systemd opens
    devices for getty
  * Make xdm_r the default role for SE Linux user xdm

 -- Russell Coker <russell@coker.com.au>  Thu, 07 Apr 2022 23:36:51 +1000

refpolicy (2:2.20220403-1) unstable; urgency=medium

  * New package based on git.  Will have another proper release soon.
  * Lots of Debian policy upstreamed.
  * Depend on the latest versions of the libraries.

 -- Russell Coker <russell@coker.com.au>  Sun, 03 Apr 2022 17:51:30 +1000

refpolicy (2:2.20210203-10) unstable; urgency=medium

  * Allow mon_local_test_t access to domain_getattr_all_domains() to get the
    context of all processes and to have selinux_get_enforce_mode(),
    selinux_getattr_fs(), and seutil_search_default_contexts() to get the
    enforcing mode for selinux.monitor.  Uploading with just this change
    because I already uploaded mon version 1.3.5-8 with selinux.monitor.

 -- Russell Coker <russell@coker.com.au>  Mon, 08 Nov 2021 13:33:52 +1100

refpolicy (2:2.20210203-9) unstable; urgency=medium

  * Label /opt/google/chrome/chrome_crashpad_handler and
    /opt/google/chrome/crashpad_handler as chromium_exec_t
  * Allow kmod_t to manage bootloader_tmp_t files and allow bootloader_t to
    create and delete /dev/null (for initramfs).  Also allow bootloader_t to
    read udev rules and network config.
  * Merged patches from Topi Miettinen for building only one flavour and for
    correctly making a list of modules even when building is asynchronous.
  * Added patch for /usr/libexec/sssd/sssd_.+ from Sam Morris.

 -- Russell Coker <russell@coker.com.au>  Thu, 21 Oct 2021 14:23:40 +1100

refpolicy (2:2.20210203-8) unstable; urgency=medium

  * Label /etc/ppp/ip-pre-up as pppd_initrc_exec_t
  * Allow wireshark to rw DRI devices, read crypto sysctls, rw the xserver
    mesa shader cache, read the kernel network state, have execmem access
    (probably needed for one of the many shared objects it uses), have setsched
    access, execute lib files (for it's helper programs), manage xdg config
    files (gives warning if it can't do this), manage xdg cache, and read xdg
    data files.
  * Allow acngtool_t the dac_override capability for managing log files
  * Allow pppd to connect create and ioctl pppox_socket and allow it to map
    pppd_runtime_t files.
  * Allow kmod_t, ifconfig_t, and ping_t to use unallocated ttys (for sysadmin
    login on boot failure)
  * Allow ntpd_t to start and stop generic units when systemd is used, for
    systemd-timesyncd.

 -- Russell Coker <russell@coker.com.au>  Mon, 04 Oct 2021 15:06:54 +1100

refpolicy (2:2.20210203-7) unstable; urgency=medium

  * Allow certbot to create /var/log/letsencrypt and /var/lib/letsencrypt
  * Label /etc/wide-dhcpv6/dhcp6c-ifupdown /etc/wide-dhcpv6/dhcp6c-script
    /etc/dhcp/dhclient-enter-hooks.d/* and /etc/dhcp/dhclient-exit-hooks.d/*
    as bin_t.
  * Allow mon_local_test_t to run smartctl in fsadm_t for megaraid and other
    corner cases and allowed fsadm_t to read fsdaemon_var_lib_t.  Dontaudit
    fsadm_t inheriting file handles from mon_t.
  * Allow fsadm_t to do a file type trans for creating
    /dev/megaraid_sas_ioctl_node
  * Allow java_t to exec bin_t and lib_t files for jspawnhelper, and to read
    cgroup files.  Needed for JRE 17

 -- Russell Coker <russell@coker.com.au>  Mon, 14 Jun 2021 09:47:05 +1000

refpolicy (2:2.20210203-6) unstable; urgency=medium

  * Add policy for cockpit web admin tool
  * Fixes for puppet policy
  * Allow system_mail_t to be in role unconfined_r for upgrades of the exim
    packages
  * Allow more spamd_log_t access if boolean rspamd_spamd is enabled
  * Allow httpd_sys_script_t to rw sympa_var_t dirs and manage sympa_var_t
    files, and to read sympa conf files.  Also allow it to read generic certs
    for sympa and also for lots of other things
    Allow httpd_t to read sympa conf files, read sympa var files, manage sympa
    runtime files, and manage sympa runtime sockets
    Allow sympa to send signull to itself
  * Allow certbot to search xdg dirs, don't know what it's trying to do but
    searching doesn't do any harm and makes it easier to discover what's
    happening.
  * Allow postgresql to read tls privkey
  * Give systemd_nspawn_t the audit_control capability
  * Allow devicekit_disk_t to read logind sessions and write inherited logind
    inhibit pipes
  * Give capability kill to inetd_t so it can kill child processes under
    different uids
  * Allow chromium_naclhelper_t process access setcap and signal and
    cap_userns access sys_admin and sys_chroot.
    Allow chromium_t to read alsa config.

 -- Russell Coker <russell@coker.com.au>  Sat, 08 May 2021 17:55:06 +1000

refpolicy (2:2.20210203-5) unstable; urgency=medium

  * Add policy for rasdaemon
  * Made mta_manage_mail_home_rw_content() include mail_home_rw_t:file watch
    access, needed by dovecot_t and probably others in future
  * Allow restorecond to watch selinux_config_t files.
  * Allow *_wm_t domains (for window manager processes) to watch xdg_config_t
    files and to execmod wm_tmpfs_t files (stops kwin_x11 SEGV)
  * Allow systemd_tmpfiles_t to relabel colord var lib files and dirs
  * Allow smbcontrol_t to map samba_runtime_t files and send unix datagrams
    to smbd processes
  * Allow systemd_user_runtime_dir_t to delete all user runtime sock files
    and manage pulseaudio_tmp_t dirs
  * Allow system_cronjob_t to manage var_lib dirs
  * Allow dovecot to create ~/mail directories.
  * Label /usr/share/mailman3-web/manage.py as mailman_queue_exec_t
    Allow mailman_queue_t to read usr files and to create it's own tmpfs files
    and allow it to map mailman_data_t files
  * Added systemd policy from upstream git as of 31st Mar to the upstream patch
  * Label /usr/bin/rspamd file not /usr/bin/rspamd symlink
    label /var/log/rspamd(/.*)? as spamd_log_t.  Allow spamd_t self execmem
    access when rspamd_spamd.  Label port 11333 as spamd_port_t for rspam.
  * Label /usr/lib/courier/imapd.* and /usr/lib/courier/pop3d.* as
    courier_pop_exec_t.  Allow courier_pop_t to read generic certs, manage
    courier_var_lib_t files, bind to POP ports, execute courier_exec_t and
    courier_tcpd_exec_t programs, and map courier config files.  Grant
    courier_pop_t the fowner and chown capabilities (for managing user mail)
    but dontaudit the fsetid capability.  Grant courier_pop_t the setrlimit
    process access so it can set it's own resource limits.  Allow
    courier_authdaemon_t to search SE Linux default contexts (needed by pam
    before using unix_chkpwd) and allow it to stat proc files.
  * Add sympa policy
  * Allow exim_t to read/write tmp files inherited from cron.  Allow exim_t
    the dac_read_search capability.
  * Allow apache to map user content files when httpd_read_user_content is set.
    Label /usr/lib/w3m/* as httpd_sys_script_exec_t
  * Dontaudit fsdaemon_t capability net_admin (probably setting buffer size)

 -- Russell Coker <russell@coker.com.au>  Fri, 09 Apr 2021 23:02:14 +1000

refpolicy (2:2.20210203-4) unstable; urgency=medium

  * Allow ntpd_t to get the status of generic systemd units
  * Allow kernel_t self:perf_event cpu.
  * Allow chromium to watch network manager runtime dirs (for resolv.conf)
    Allow chromium to run naclhelper with nnp_transition
    Allow chromium to watch root dirs
    Allow chromium to read/write unix sockets from the calling domain
  * Make Postgresql use postgresql_tmpfs_t for tmpfs files and make
    mon_local_test_t and systemd_logind_t not have getattr access to tmpfs
    files audited.
  * Allow systemd_user_runtime_dir_t to unlink device nodes of type
    user_tmp_t, they probably should not exist, so it's in the hacks patch.
  * Allow the acngtool to read random and urandom devices and search fs sysctls
  * Add wm_write_xdg_data tunable to allow user_wm_t etc to write xdg data.
  * Allow chromium to watch gnome_xdg_config_t dirs
  * Label pinentry programs as gpg_agent_exec_t and allow gpg_agent_t to exec
    them
  * Create new admin_mail_t domain so that newaliases can work with Postfix
  * Added a transition rule so that vipw/vigr gives the right context for
    /etc/passwd and /etc/group
  * Allow acngtool_t to read /proc/sys/kernel/random/uuid
  * Allow unconfined domains lockdown confidentiality and integrity access
  * Allow netutils_t netlink_generic_socket access for tcpdump
  * Allow smbcontrol to create a sock_file in a samba run dir
  * Allow mailman_queue_t to bind to all unreserved TCP ports
  * Allow systemd_coredump_t to mmap all executables and to have cap_userns
    sys_ptrace access. dontaudit systemd_coredump_t capability net_admin
  * Allow mailman_queue_t to connect to port 443

 -- Russell Coker <russell@coker.com.au>  Fri, 05 Mar 2021 21:11:58 +1100

refpolicy (2:2.20210203-3) unstable; urgency=medium

  * Add policy for blkmapd which is part of nfs service (included in upstream)
  * Add interfaces systemd_search_user_runtime()
  * Allow systemd_user_runtime_dir_t to unlink dirmngr sock files
  * Allow sshd_t to talk to systemd_nspawn_t via Unix sockets
  * Allow syslogd_t to search systemd_user_runtime_t dirs
  * Allow acpid_t to rw input device files
  * Allow restorecond_t to watch all dirs
  * Allow mailman_queue_t to search the cron spool dir, also allow it to be
    started as a daemon and to write mailman pid files
  * Included upstream git patches for latest systemd features, this may
    save some pain when Bullseye+1 is released
  * Allow systemd-nspawn to mount on and manage more things when
    systemd_nspawn_labeled_namespace is on.
  * Allow smbcontrol_t to talk to itself via Unix domain sockets
  * Add policy for postfwd
  * Allow aptcacher_t to read urandom and random devices and to read kernel
    sysctls
  * Label /usr/lib/x86_64-linux-gnu/libexec/* as bin_t for KDE/sddm login
    Allow user to execute and execmod user tmpfs files, for KDE
    Allow user to write to user_runtime_t sock files
  * Add policy to run the certbot --nginx which runs nginx, doesn't work
    in all situations but should cover the common cases.
  * Set label for /usr/bin/redis-check-rdb (redis server binary in Debian)
    and allow redis to read certs and read vm and net sysctls.

 -- Russell Coker <russell@coker.com.au>  Tue, 23 Feb 2021 16:57:40 +1100

refpolicy (2:2.20210203-2) unstable; urgency=medium

  * lots of little policy changes

 -- Russell Coker <russell@coker.com.au>  Fri, 12 Feb 2021 10:24:33 +1100

refpolicy (2:2.20210203-1) unstable; urgency=medium

  * Allow unconfined_u and sysadm_u to access other identities.
  * New upstream release!

 -- Russell Coker <russell@coker.com.au>  Thu, 04 Feb 2021 03:34:45 +1100

refpolicy (2:2.20210130-1) unstable; urgency=medium

  * new archive from git
  * More Debian stuff upsteamed
  * Added some filetrans rules to assign the right types when postinst
    scripts don't label things.

 -- Russell Coker <russell@coker.com.au>  Sun, 31 Jan 2021 00:32:23 +1100

refpolicy (2:2.20210126-1) unstable; urgency=medium

  * new archive from git, upstream changes include removing unused modules
  * More Debian stuff upsteamed
  * Remove: abrt callweaver ccs certmaster certwatch cipe clockspeed clogd
    consoletype dcc ddcprobe denyhosts dspam firstboot howl imaze jockey
    ktalk lockdev lsm mailscanner mcelog oav polipo pyicqt resmgr rhcs
    rhsmcertd ricci rpm vhostmd
  * Don't enable by default: amtu bugzilla condor
  * Added SE Linux "user" named xdm for the "sddm" Unix account to be used
    by the sddm greeter process.  This makes the greeter run as xdm_t
    instead of unconfined_t.

 -- Russell Coker <russell@coker.com.au>  Fri, 29 Jan 2021 01:50:16 +1100

refpolicy (2:2.20210120-1) unstable; urgency=medium

  * New archive from git
  * Some Debian stuff upstreamed
  * Lots of little changes

 -- Russell Coker <russell@coker.com.au>  Sat, 23 Jan 2021 22:22:15 +1100

refpolicy (2:2.20210115-1) unstable; urgency=medium

  * New archive from git
  * Added matrixd policy
  * Fixed the crontab problem

 -- Russell Coker <russell@coker.com.au>  Mon, 18 Jan 2021 00:41:23 +1100

refpolicy (2:2.20210112-1) unstable; urgency=medium

  * New archive from git
  * Lots of policy fixes for Debian/Unstable

 -- Russell Coker <russell@coker.com.au>  Thu, 14 Jan 2021 00:28:01 +1100

refpolicy (2:2.20201221-1) unstable; urgency=medium

  * New archive from git

 -- Russell Coker <russell@coker.com.au>  Mon, 21 Dec 2020 22:15:44 +1100

refpolicy (2:2.20200502-1) unstable; urgency=medium

  * New archive taken from upstream git.  Will base it mostly on git for the
    development leading to Buster and then take the latest upstream release
    shortly before release.
  * Lots of new policy patches.
  * Make it depend and build depend on version 3.0 of all libraries
  * Makde the default_contexts have sysadm_r with a higher preference than
    staff_r for sshd_t
  * Made dbus a base module

 -- Russell Coker <russell@coker.com.au>  Sat, 02 May 2020 19:20:27 +1000

refpolicy (2:2.20190201-9) unstable; urgency=medium

  * Some more small policy fixes

 -- Russell Coker <russell@coker.com.au>  Wed, 29 Apr 2020 19:32:04 +1000

refpolicy (2:2.20190201-8) unstable; urgency=medium

  * Team upload.
  * debian/patches/0001-remove-incorrect-usage-of-is.patch: Fix FTBFS with
    python 3.8 (Closes: #954510)

 -- Laurent Bigonville <bigon@debian.org>  Thu, 02 Apr 2020 10:59:43 +0200

refpolicy (2:2.20190201-7.1) unstable; urgency=medium

  * Non-maintainer upload.
  * source only upload to enable migration (Closes: #954018)

 -- Paul Gevers <elbrus@debian.org>  Sun, 15 Mar 2020 20:28:12 +0100

refpolicy (2:2.20190201-7) unstable; urgency=medium

  * Allow sysadm_r to bypass UBAC checks (experimental)
  * Make cron work for sysadm_t
  * Minor policy changes

 -- Russell Coker <russell@coker.com.au>  Wed, 15 Jan 2020 18:53:25 +1100

refpolicy (2:2.20190201-6) unstable; urgency=medium

  * Team upload.
  * debian/rules: Cleanup the support/__pycache__ directory when building the
    selinux-policy-src package
  * debian/rules: Set the timezone to UTC before creating the
    selinux-policy-src tarball, that should make it reproductible

 -- Laurent Bigonville <bigon@debian.org>  Thu, 26 Dec 2019 13:34:27 +0100

refpolicy (2:2.20190201-5) unstable; urgency=medium

  * Team upload.
  * Bump Standards-Version to 4.4.0 (no further changes)
  * debian/control: Remove the package (-1) revision from the
    {build-}dependencies, to please lintian
  * Drop debian/source/lintian-overrides, the postrm perl scripts are gone
    for a long time, not sure why these overrides were reintroduced
  * debian/rules: Do not call dpkg-parsechangelog explicitly to get a
    reproductible build time but rely on SOURCE_DATE_EPOCH variable
  * debian/watch: Fix the URL now that the project has been relocated

 -- Laurent Bigonville <bigon@debian.org>  Tue, 27 Aug 2019 15:54:34 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog selinux-policy-doc`.
