refpolicy (2:2.20140206-1) unstable; urgency=medium

  * Team upload.
  * New GIT snapshot of the policy
    - Allow unconfined_u user to enter system_r role again (Closes: #732857)
    - Allow unconfined user to transition to dpkg_t and transitively to
      dpkg_script_t (Closes: #707214)
    - Refresh 0004-init-startpar-initrc_t-gets-attributes-of-dev-dm-0-d.patch
    - Drop d/p/0005-add-missing-newline.patch,
      d/p/0006-allow-udev-write-rulesd.patch: Applied upstream
  * debian/selinux-policy-dev.post{inst,rm}: Call sepolgen-ifgen after
    selinux-policy-dev installation if SELinux is enabled
  * debian/selinux-policy-dev.install, debian/rules: Install headers in
    /usr/share/selinux/devel, there is no differences between default and mls
    headers, so it's not necessary to install both.
  * debian/rules, debian/example/Makefile, debian/Makefile.devel: Fix
    development Makefile to work with new headers location
  * debian/control: Bump Standards-Version to 3.9.5 (no further changes)

 -- Laurent Bigonville <bigon@debian.org>  Thu, 06 Feb 2014 21:56:55 +0100

refpolicy (2:2.20131214-1) unstable; urgency=low

  * Team upload.
  [ Laurent Bigonville ]
  * New GIT snapshot of the policy
    - Drop all the Debian specific patches, some of the patches have been
      merged upstream, but the rest was making it really difficult to upgrade
      the policy to the new upstream versions.
    - Add block_suspend access vectors (Closes: #722700)
    - libvirt should now run when compiled with selinux support
      (Closes: #559356)
    - Allow smartd daemon to write in /var/lib/smartmontools directory
      (Closes: #720631)
    - NetworkManager should now be able to write /run/network/ifstate
      (Closes: #711083)
    - Allow dovecot self:process setsched permission (Closes: #716753)
    - Add denyhosts policy package (Closes: #700403)
    - deny_ptrace boolean is now gone (Closes: #691284)
    - Allow fail2ban dac_read_search and dac_override capabilities
      (Closes: #700326)
    - irqbalance has now the getsched permission (Closes: #707243)
  * Refresh debian/modules.conf.* for new release, build all the policy
    packages as modules now
  * Drop debian/file_contexts.subs_dist, install upstream one instead
  * debian/rules: policy/rolemap file is gone
  * debian/control: Bump {build-}dependencies to the last userspace release
  * debian/rules: Disable UBAC for the default policy
  * debian/rules: Build the default policy with UNK_PERMS=allow
  * debian/control: Add dependency against selinux-utils for selinuxenabled
  * debian/NEWS: Add some information about the proper way to permanently
    disable a module
  * d/p/0004-init-startpar-initrc_t-gets-attributes-of-dev-dm-0-d.patch:
    Fix FTBFS and allow startpar can getattr of some devices
  * Add d/p/0005-add-missing-newline.patch: Add missing newline at the end of
    the file, this is causing weird behaviour, thanks M4
  * d/p/0006-allow-udev-write-rulesd.patch: Allow udev to write in
    /etc/udev/rules.d (Closes: #712970)

  [ Mika Pflüger ]
  * debian/postinst.policy: Rewrite the postinst script for the
    selinux-policy-* packages to automatically upgrade the running policy.
    (Closes: #552147)
  * debian/copyright: Update to machine-readable copyright format.
  * debian/postrm.policy: Use common postrm script for selinux-policy-*
    packages.

 -- Laurent Bigonville <bigon@debian.org>  Sun, 15 Dec 2013 22:53:06 +0100

refpolicy (2:2.20110726-13) unstable; urgency=low

  * Team upload.
  [ Mika Pflüger ]
  * Allow dhcpc_t to bind to all udp ports (Closes: #707658).

  [ Laurent Bigonville ]
  * Rework the build system
  * Compress modules files with bzip2
  * debian/control:
    - Bump Standards-Version to 3.9.4 (no further changes)
    - Drop really old Conflicts
    - Add a Breaks against selinux-basics (<< 0.5.2~) so we are sure it
      supports .bz2 compressed modules
  * debian/source/lintian-overrides: Add an override for
    maintainer-script-lacks-debhelper-token

 -- Laurent Bigonville <bigon@debian.org>  Fri, 20 Sep 2013 19:18:57 +0200

refpolicy (2:2.20110726-12) unstable; urgency=low

  * Team upload.
  [ Russel Coker ]
  * Label ~/.adobe(/.*)? as mozilla_home_t for flash
  * Label /usr/sbin/opendkim as dkim_milter_exec_t
  * Label postalias as postfix_master_exec_t for newaliases
  * Make postfix.pp not depend on unconfined.pp for "strict" configurations
  * Label port 5546 as dhcpc_port_t and allow dhcpc_t to bind to TCP for
    client control
  * Label /usr/lib/kde4/libexec/* and /usr/lib/gvfs/* as bin_t for desktops
  * Label /run/pm-utils(/.*)? as devicekit_var_run_t not hald_var_run_t
  * Allow user roles access to mozilla_t classes shm and sem for sharing
    the sound device
  * Allow user roles access to mozilla_tmp_t
  * Label /sbin/xtables-multi (the new iptables)
  * Allow watchdog_t to read syslog pid files for process watching
  * Allow lvm_t (systemd-cryptsetup) systemd_manage_passwd_run() access
  * Allow systemd_passwd_agent_t access to search selinuxfs and write to
    the console for getting a password for encrypted filesystems
  * Label /usr/lib/dovecot/auth as dovecot_auth_exec_t.
    Label /usr/lib/dovecot/dovecot-lda as lda_exec_t
    Label /usr/lib/dovecot/libdovecot.*.so.* as lib_t
    Closes: #690225

 -- Mika Pflüger <debian@mikapflueger.de>  Fri, 30 Nov 2012 00:28:21 +0100

refpolicy (2:2.20110726-11) unstable; urgency=low

  * Team upload
  [ Mika Pflüger ]
  * Drop incomplete patch adding debian specific gdm3 locations and
    cherry-pick Laurent's complete patch from upstream instead. Slightly
    edit the patch to work around an issue in file context ordering.

 -- Laurent Bigonville <bigon@debian.org>  Sun, 30 Sep 2012 22:43:12 +0200

refpolicy (2:2.20110726-10) unstable; urgency=low

  * Team upload.
  [ Mika Pflüger ]
  * xserver.fc: Add debian specific /usr/sbin/gdm3 as a location for gdm3.
    Closes: #683756
  * debian/control: Update Vcs-* fields.

  [ Laurent Bigonville ]
  * d/p/0079-Allow-iptables_t-to-do-module_request.patch: Dropped, the code
    present in this patch was already present later in the code.
  * d/p/0048-Alsa-debian-locations.patch: Dropped, changes merged upstream,
    and was breaking module loading due to duplicate paths (Closes: #686670)
  * debian/watch: Fix watch file uversionmangle

 -- Laurent Bigonville <bigon@debian.org>  Fri, 07 Sep 2012 17:51:13 +0200

refpolicy (2:2.20110726-9) unstable; urgency=high

  * Enable UBAC as roles aren't useful.  I recommend using only roles user_r
    and unconfined_r and using UBAC (constraining users from sharing files
    between identities) where you would previously have used roles.
  * Made cron jobs run in regular user domains such as unconfined_t and user_t
    Closes: #679277
  * Had the wrong timestamp on the last upload, corrected it for the record.
  * Allow ftpd to create sock_file objects under /var/run for proftpd
  * Change readahead policy to support memlockd.
  * Allow devicekit_power_t, devicekit_disk_t, kerneloops_t, and policykit_t
    to send dbus messages to users.
  * Grant systemd utilities access to selinuxfs so they can correctly label
    directories. Closes: #678392
  * Assigned type consolekit_var_run_t to /var/run/console(/.*)? because it's
    created and managed by consolekit nowadays.
  * Created tunable allow_ssh_connect_reserved_ports to allow ssh client to
    connect to reserved ports.
  * Correctly label all perdition binaries, give perdition_t dac_override, and
    allow perdition_t to create it's own pid directories.
  * Label /etc/dansguardian as squid_etc_t
  * Allow devicekit_power_t to access acpi device and read udev tables and
    allow devicekit_disk_t to read udev tables.
  * Allow sshd_t to write to fifos inherited from systemd
  * High urgency because we really need to have working cron jobs!!!
  * Removed the postinst code to upgrade from pre-squeeze packages.

 -- Russell Coker <russell@coker.com.au>  Sat, 30 Jun 2012 19:19:57 +1000

refpolicy (2:2.20110726-8) unstable; urgency=high

  * Allow dbus domains to search cgroup dirs and init_var_run_t
  * Have init_t transition to devicekit_power_t and devicekit_disk_t for
    systemd.
  * Allow user domains to create netlink_kobject_uevent_socket objects
  * Put dansguardian in squid_t
  * Fixed error in portslave.te that prevented module insertion
  * Allow postgrey_t to exec bin_t for perl and self:netlink_route_socket
    access
  * Allow dac_override access to arpwatch_t
  * Add tcsd.pp (for trousers) to the policy packages
  * Add nut.pp for the nut-server package to the policy packages
  * Load irqbalance.pp if irqbalance Debian package is installed, same for
    kerneloops, tcsd.pp/trousers, nut.pp/nut-server,
    and smartmon.pp/smartmontools.
  * High urgency because the support for tcsd and nut really needs to be
    tested (and it's broken badly for those people) and portslave.pp is also
    badly broken in previous versions.

 -- Russell Coker <russell@coker.com.au>  Mon, 25 Jun 2012 16:37:45 +1000

refpolicy (2:2.20110726-7) unstable; urgency=high

  [Russell Coker]
  * Got Chromium working!
  * Allow user_dbusd_t to access /run/console
  * Got systemd working
    Closes: #677578
  * Added policy for dirmngr.
  * Added support for wide-dhcpv6-client.
  * Remove all refpolicyerr and almost all refpolicywarn instances, removed all
    obsolete interfaces and fixed syntax errors.
    Closes: #678237
  * Allow all users to run the Postfix mailq command
  * Lots of little changes.
  [Mika Pflüger]
  * Do not ship pyplate.pyc. Closes: #676852

 -- Russell Coker <russell@coker.com.au>  Thu, 21 Jun 2012 23:15:59 +1000

refpolicy (2:2.20110726-6) unstable; urgency=low

  * Added deny_ptrace tunable which some modules depend on
  * Fixed squid and nrpe policy
  * Made all necessary changes to allow a KDE login
    Closes: #677589
  * Made all necessary changes for a mail server running Postfix, Courier
    Maildrop, and Dovecot.  Not all mail server configurations will work (MTAs
    tend to be complex and have lots of interactions) but getting other
    configurations will be easier now.

 -- Russell Coker <russell@coker.com.au>  Sun, 17 Jun 2012 06:18:01 +0000

# For older changelog entries, run 'apt-get changelog selinux-policy-mls'
