refpolicy (2:2.20250213-13) unstable; urgency=medium

  * Source only upload for testing migration

 -- Yifei Zhan <debian@zhan.science>  Sat, 16 May 2026 10:09:26 +0000

refpolicy (2:2.20250213-12) unstable; urgency=medium

  [ Russell Coker ]
  * Fix for usbguard
  * Label /var/lib/dbconfig-common/sqlite3/sympa/sympa
  * Allow pam sessions to create wtmp.db-journal

 -- Yifei Zhan <debian@zhan.science>  Tue, 17 Mar 2026 07:25:31 +0000

refpolicy (2:2.20250213-11) unstable; urgency=medium

  * Added usbguard policy
  * Allow chromium to stat xattr filesystems, read xkb libs, and give fifo
    files to the window manager (to stop it crashing on paste)
  * Allow pulseaudio_client domains (including the $1_wm_t domains) to mmap
    the tmpfs files related to pulseaudio (for Chrome mostly)
  * Allow systemd_passwd_agent_t to watch user runtime dirs for systemd
    daemon restart
  * Allow dhcpd_t to execute ntpd_exec_t in ntpd_t for dhcp scripts and start
    generic units
  * Allow systemd-nspawn to use user terminal devices for directly running by
    sysadmin and allow managing mnt_t files

 -- Russell Coker <russell@coker.com.au>  Sun, 19 Oct 2025 16:57:18 +1100

refpolicy (2:2.20250213-10) unstable; urgency=medium

  * Allow user_bubblewrap_t to transition to user_t via user_home_t and
    user_bin_t
  * Fixes for evolution, colord, dbus, wm, and xdm.  Now the GNOME desktop
    is fully functional and sddm works as a graphical login.

 -- Russell Coker <russell@coker.com.au>  Fri, 25 Jul 2025 22:36:54 +1000

refpolicy (2:2.20250213-9) unstable; urgency=medium

  * Allow sympa_t to signal itself, create udp sockets, and bind to a generic
    node
  * Fixed labelling for /var/log/opensnitchd.log.* and
    /var/cache/apt-xapian-index/*
  * Allow systemd-logind to receive fds from xdm - needed for SDDM to function
  * Labelled /usr/bin/efibootmgr as bootloader_exec_t
  * Labelled /usr/bin/screendump as screen_exec_t
  * Labelled /usr/sbin/veritysetup as lvm_exec_t
  * Add a user login for Debian-gdm that gets the xdm identity
  * Add some user_wm_t permissions for GNOME and PHOC logins, PHOC and KDE
    Plasma with gdm3 are fully functional and GNOME is mostly functional.
  * Add labels for /var/lib/lxc and /var/lib/misc/dnsmasq.[a-z0-9]+.leases

 -- Russell Coker <russell@coker.com.au>  Sat, 19 Jul 2025 22:55:24 +1000

refpolicy (2:2.20250213-8) unstable; urgency=medium

  * Fix syntax errors
  * Allow dovecot_auth_t to mape dovecot_runtime_t files
  * Allow mon_net_test_t to run netutils
  * removed unused interfaces fs_mounton_memory_pressure and
    userdom_watch_user_ttys
  * Remove systemd_logind_use_fds and use systemd_use_logind_fds instead
  * Allow dhcpc_t to list resolved runtime dir and stat generic units files
  * Allow systemd-logind and systemd-user-runtime-dir stat /proc as logind
    failing to do so can cause difficult to diagnose dbus issues with
    pam_login
  * Allow fwupd to signal itself

 -- Russell Coker <russell@coker.com.au>  Sun, 06 Jul 2025 19:29:50 +1000

refpolicy (2:2.20250213-7) unstable; urgency=medium

  * Allow user systemd domains to list user tmp, watch root, read usr files,
    and create sockets for gpg_t and user_ssh_agent_t
  * Allow needrestart to list init var lib dirs
  * Allow dhcpc_t to connect to itself via a unix stream socket
  * Allow systemd_user_runtime_dir_t to unlink ssh_agent_tmp_t sock files
  * Allow systemd_machine_id_setup_t to send syslog messages

 -- Russell Coker <russell@coker.com.au>  Tue, 03 Jun 2025 20:58:37 +1000

refpolicy (2:2.20250213-6) unstable; urgency=medium

  * Allow fail2ban to watch the audit log
  * Dontaudit needrestart statting device nodes and writing /var dirs
  * Allow needrestart to read vm overcommit sysctl and logind sessions
    allow it to send signull to sshd and xdm, allow it to stat generic ptys
  * Allow semanage to read vm overcommit sysctl
  * Allow utempter to create dgram sockets and stat localisaton files
  * Allow systemd-nspawn to read init runtime files (for MAC generation),
    to write to /dev/kmsg, to send syslog messages
  * Allow systemd-machined to create dirs of type systemd_machined_runtime_t
    under init_runtime_t, to see systemd-nspawn processes, to manage it's
    runtime dirs, and to create and unlink runtime sock_files.
  * Add policy for opensnitch
  * Label /etc/kernel/entry-tokenaas etc_runtime_t
  * Allow NetworkManager_t to read systemd networkd runtime and to get init
    status

 -- Russell Coker <russell@coker.com.au>  Sat, 24 May 2025 16:54:19 +1000

refpolicy (2:2.20250213-5) unstable; urgency=medium

  * allow user_wm_t and similar domains the sys_nice capability.
  * Allow needrestart to signal all systemd --user processes
  * Make the dir type transition for var_lib_t when dpkg_script_t creates
    subdirs only apply to dirs named "ntpsec" to avoid breaking dkms postinst
  * Label /var/lib/dkms as src_t
  * Allow mozilla to talk to ntpd and systemd-logind via dbus
  * Allow systemd-logind to change ownership of dma_device_t
  * Allow policykit to get the systemd status
  * Allow sshd to create /var/lib/wtmpdb

 -- Russell Coker <russell@coker.com.au>  Wed, 30 Apr 2025 13:00:58 +1000

refpolicy (2:2.20250213-4) unstable; urgency=medium

  * Allow chromium_t to start and get status of user_systemd_t
  * Allow user_dbusd_t to receive chromium_t file handles and write to them
  * Allow user_t to write chromium_t fifos
  * Allow accountsd_t to search init units
  * Allow cupsd_config_t to connect to cups via stream sockets and to send dbus
    messages to unconfined_t
  * Allow power_profilesd_t to dbus message devicekit power
  * Allow unconfined_t to inherit file handles from systmd_logind_t
  * Allow gpg_agent_t to read gpg_t files (process status)
  * Allow acpid to read logind sessions files
  * Give capability kill to needrestart
  * Label /var/lib/wtmpdb as faillog_t and allow pam_domain to manage faillog
  * Allow policykit_t to get status of transient units

 -- Russell Coker <russell@coker.com.au>  Thu, 24 Apr 2025 17:07:06 +1000

refpolicy (2:2.20250213-3) unstable; urgency=medium

  * allow user_systemd_t to read logind state
  * allow ntpd to read the vm_overcommit sysctl
  * allow system_dbusd_t the kill capability and init read runtime files so
    the latest version of dbus-broker will work
  * Allow mon local tests to stat dos filesystems
    Allow mon_t to manage mon_var_lib_t dirs
  * Allow fail2ban client to read kernel overcommit sysctl
  * Added type labels for kea dhcp server
  * Allow modemmanager to setopt on netlink_route_socket
  * Allow dhcpc_t to get system status and read networkd runtime
  * Allow fwupd_t to bind and stat netlink route sockets, connect to it's own
    tcp sockets, and stat it's own udp sockets.
  * Lots of minor changes to dhcpd policy to support the new kea server
  * Added label for /run/lock/ntpsec-ntpdate and transition for initrc creation
  * Allow certbot to read vm overcommit sysctl
  * Label /usr/lib/openssh/sshd-auth needed by openssh-server 10.0p1-1

 -- Russell Coker <russell@coker.com.au>  Sat, 12 Apr 2025 17:12:29 +1000

refpolicy (2:2.20250213-2) unstable; urgency=medium

  * add crio kubernetes openarc podman to the module exclusion list for
    handsets, previous version failed postinst on handsets

 -- Russell Coker <russell@coker.com.au>  Thu, 06 Mar 2025 23:36:47 +1100

refpolicy (2:2.20250213-1) unstable; urgency=medium

  * 20250213 new upstream release.
  * Build-depend on sepol-utils for chkcon
  * Changed all depends and build-depends to 3.8 of all the SE Linux packages
    Biggest problem is that libselinux1 3.8 and libsemanage2 3.7 breaks
    install with "Re-declaration of role unconfined_r" .. "Failed to build AST"
  * Allow mon_local_test_t to get devicekit power information from dbus
  * As a temporary measure comment out the validateappconfig in the Makefile
    to work around a SEGV so we can build this without bugs in other packages
    getting in the way.

 -- Russell Coker <russell@coker.com.au>  Fri, 14 Feb 2025 18:51:19 +1100

refpolicy (2:2.20250115-1) unstable; urgency=medium

  * Latest git policy
  * Allow needrestart to reload init
  * Label /etc/xdg/Xwayland-session.d/* as xsession_exec_t
  * Remove the etc_t label for /var/spool/postfix/etc as postfix_master_t
    needs to write to it and we don't want to grant write access to etc_t

 -- Russell Coker <russell@coker.com.au>  Wed, 15 Jan 2025 19:22:34 +1100

refpolicy (2:2.20241211-2) unstable; urgency=medium

  * More systemd patches
  * Allow plymouthd to signal init
  * Add policy for needrestart

 -- Russell Coker <russell@coker.com.au>  Tue, 31 Dec 2024 19:14:26 +1100

refpolicy (2:2.20241211-1) unstable; urgency=medium

  * Latest git policy
  * Allow gpsd_t to getsession
  * Run gdm-runtime-config as xdm_t
  * Allow fwupd_t to watch sysctl etc and fwupdmgr_t to manage dconf dirs
  * Add filetrans pattern for systemd_passwd_agent_t creating
    systemd_passwd_runtime_t dirs under systemd_user_runtime_t dirs
  * Label /usr/libexec/gnome-remote-desktop-daemon as xdm_exec_t

 -- Russell Coker <russell@coker.com.au>  Sat, 21 Dec 2024 16:51:08 +1100

refpolicy (2:2.20241119-1) unstable; urgency=medium

  * Latest git policy
  * Allow systemd_binfmt_t to read usr files
  * Allow boinc_t to read vm sysctls
  * label the new qt6 sddm greeter

 -- Russell Coker <russell@coker.com.au>  Wed, 04 Dec 2024 23:21:34 +1100

refpolicy (2:2.20241013-1) unstable; urgency=medium

  * Latest git policy
  * Build-depend on python3-setools >= 4.5.1 due to upstream changes in git
    refpolicy

 -- Russell Coker <russell@coker.com.au>  Sun, 13 Oct 2024 19:00:53 +1100

refpolicy (2:2.20241008-1) unstable; urgency=medium

  * Latest git policy, types for /dev/dma_heap/* /dev/udmabuf /dev/userfaultfd
  * Allow ntpd_t to start and stop generic units for timedatectl set-ntp
  * Label /opt/microsoft/msedge/microsoft-edge
  * Remove sys_admin from cups

 -- Russell Coker <russell@coker.com.au>  Tue, 08 Oct 2024 18:44:35 +1100

refpolicy (2:2.20240919-1) unstable; urgency=medium

  * Latest git policy, systemd changes mostly for namespace resourced
  * Allow bubblewrap to use user ttys
  * Allow systemd_machine_id_setup_t to write to kmsg and have dac_override
    capability for setting systemd.machine_id on the kernel command line.
    Without this you get system hangs on boot with systemd-boot.
  * Allow user_wm_t etc to send syslog messages,
  * Allow lvm_t access to class alg_socket for cryptsetup benchmark
  * Allow daemon domains to read-write initrc_t unix stream sockets

 -- Russell Coker <russell@coker.com.au>  Sun, 22 Sep 2024 16:53:50 +1000

refpolicy (2:2.20240830-1) unstable; urgency=medium

  * Latest git policy, mostly container related changes
  * allow fwupd to write to fixed disks and fwupdmgr to dbus talk to network
    manager
  * Allow systemd_nspawn_t to sendto it's own unix dgram sockets, search
    autofs mounts, and write to systemd notify socket
  * Give ndc_t access to anon_inode and io_uring
  * Label shared objects under /opt/brother/scanner/brscan5/ as lib_t
  * Added label for /usr/libexec/qemu/qemu-bridge-helper for version
    1:9.0.2+ds-2 of qemu-system-common
  * Allow fwupd_t to get it's scheduling, create udp sockets, and read sysnet config
  * Allow rasdaemon to write sysfs files for
    /sys/devices/system/memory/soft_offline_page
  * Allow bubblewrap domains to read sysctl_t for max_user_namespaces
  * Label /usr/sbin/fsidd as nfsd_exec_t

 -- Russell Coker <russell@coker.com.au>  Fri, 30 Aug 2024 13:31:54 +1000

refpolicy (2:2.20240723-2) unstable; urgency=medium

  * Allow chromium_t execheap access which Chrome now needs, presumably for
    JIT
  * Allow systemd_coredump_t to read cgroup dirs.  Dontaudit it for sys_admin
    capability
  * Allow all users to chat to fprintd via dbus
  * Allow boinc_t self getsched
  * Allow mysqld to read/write memory_pressure_t files
  * Label /usr/lib/openssh/sshd-session as sshd_exec_t for openssh-server >=
    1:9.8p1-1

 -- Russell Coker <russell@coker.com.au>  Thu, 01 Aug 2024 22:30:43 +1000

refpolicy (2:2.20240723-1) unstable; urgency=medium

  * Latest git policy which reorders many process permissions so lots of
    patches needed changes.  Also added haproxy module
  * Label btrfs utility as fsadm_exec_t
  * Changed to debhelper-compat in build-depends
  * Allow virtd_t anon_inode access, to read cpuid, to watch etc dirs, also
    allow it to read vm sysctls
  * Allow virtlockd_t and virtlogd_t to self getsched, to create unix dgram
    sockets, to read sysfs files, to read kernel sysfs files, stat /proc, and
    log to syslogd
  * Allow systemd_generator_t to create vsock_socket objects
  * Added some policy for fprintd_t
  * Label nm-dispatcher as NetworkManager_exec_t
  * Allow user_systemd_t etc to do netlink_route_socket operations (needed for
    KDE login)
  * Allow systemd_logind_t to search it's own proc dirs

 -- Russell Coker <russell@coker.com.au>  Fri, 26 Jul 2024 08:34:15 +1000

refpolicy (2:2.20240607-1) unstable; urgency=medium

  * Latest git policy with patches needed for latest systemd
  * Allow apt to setattr it's lib dirs, map it's cache, getsched for itself,
    and manage apt_tmp_t link files
    Allow apt to read init state for ischroot
  * dontaudit apt net_admin because of buffer tweaking
  * Allow dpkg_script_t to map the man cache, read the apt cache, watch
    passwd runtime dirs, sys_resource capability, setrlimit, getattr procfs,
    relabel non auth files, read fonts, stat tmpfs, and be a system bus client
  * Allow dpkg and dpkg_script_t to read selinux status and file contexts
  * Allow apt_t to receive logind fds and write to logind pipes
  * Allow plymouth_t the checkpoint_restore and to signal init
  * Allow systemd_backlight_t to talk to polkit and unconfined domains via
    dbus, and read localisation files
  * Made /usr/lib/kauth/libexec/backlighthelper run in systemd_backlight_t
  * Allow networkmanager to watch it's main config dir
  * Allow systemd_t to send dgrams to itself - needed for GUI login with
    latest systemd setup.  Allow it to statfs /proc and stat /usr files

 -- Russell Coker <russell@coker.com.au>  Wed, 12 Jun 2024 11:50:27 +1000

refpolicy (2:2.20240415-1) unstable; urgency=medium

  * Latest git policy, works with latest systemd
  * Allow eg25manager_t to use pipes
  * Allow kernel_t the new capability2 checkpoint_restore permission
  * Added label for/var/lib/phog - xdm greeter
  * Added labels for ms-edge
  * Include module iiosensorproxy for laptops as touch screens need it
  * Allow systemd_locale_t to read SE Linux config
  * Give unconfined domains the checkpoint_restore capability
  * Allow devicekit_disk_t to read generic certificates
  * Allow local_login_t to receive file handles from systemd-logind, and read
    apt db
  * Allow sshd to stat the systemd notify socket
  * Allow systemd_resolved to write to systemd notify socket
  * Allow users anon_inode { create read write map } for user mysql etc

 -- Russell Coker <russell@coker.com.au>  Thu, 18 Apr 2024 16:38:02 +1000

refpolicy (2:2.20240202-1) unstable; urgency=medium

  * label /run/boltd
  * label /etc/letsencrypt/renewal-hooks files as bin_t
  * Add label for /usr/lib/chromium/chrome_crashpad_handler
  * Enabled module hostapd
  * Changed fwupd policy to have a separate domain for fwupdmgr
  * Lots of policy needed to support login with the latest systemd-user
  * Latest git policy

 -- Russell Coker <russell@coker.com.au>  Fri, 02 Feb 2024 16:55:45 +1100

refpolicy (2:2.20231119-2) unstable; urgency=medium

  * Allow initrc_t to mounton memory_pressure_t files
    Hopefully the last thing needed to make the latest systemd work correctly

 -- Russell Coker <russell@coker.com.au>  Sun, 19 Nov 2023 22:39:04 +1100

refpolicy (2:2.20231119-1) unstable; urgency=medium

  * new git ver
  * systemd 255~rc2-1 in unstable uses initrc_t to launch daemons so needed
    transition rules for that, initrc_t needs to watch unallocated ttys as
    part of the getty launch operation, and it needs nnp_transition to all
    daemon domains for the combination of systemd restrictions on privileges
    and SE Linux domain transition.
    Also domains need access to unix_stream_socket file handles created by
    initrc_t.
    Systemd versions after 254.5-1 break badly without this.

 -- Russell Coker <russell@coker.com.au>  Sun, 19 Nov 2023 17:27:44 +1100

refpolicy (2:2.20231010-1) unstable; urgency=medium

  * new git ver
  * Added more checks for "hostnamectl chassis" output, conainer is vm,
    convertible/watch/embedded are considered as handset for now, and server
    has an entry.

 -- Russell Coker <russell@coker.com.au>  Sun, 22 Oct 2023 15:31:53 +1100

refpolicy (2:2.20230929-1) unstable; urgency=medium

  * new git ver
  * Upstream merged powerprofiles and rasdaemon and anti-spam and motd patches
  * Changed preinst to work when /etc/selinux/config doesn't exist

 -- Russell Coker <russell@coker.com.au>  Fri, 29 Sep 2023 01:15:21 +1000

refpolicy (2:2.20230919-1) unstable; urgency=medium

  * new git ver
  * Upstream merged eg25manager, iiosensorproxy, lowmemorymonitor, switcheroo,
    and thunderbolt

 -- Russell Coker <russell@coker.com.au>  Tue, 19 Sep 2023 15:01:19 +1000

refpolicy (2:2.20230821-1) unstable; urgency=medium

  * new git ver
  * Add policy for Mobian
    Allow system_r:init_t:s0 to transition to user context xdm_r:xdm_t:s0 for
    systemd --user
    Add consolesetup, eg25manager, feedbackd, geoclue, and iiosensorproxy
    policy modules for Mobian
    Lots of other policy changes related to Mobian
  * Added msdos_t label for exfat
  * Add bubblewrap, container, and docker modules
    Consider bubblewrap exerimental at this time
  * Add support for relabelling files on policy package changes to file
    contexts, made the policy packages depend on policycoreutils >= 3.5-2 for
    /usr/libexec/selinux/remove-leaf-dirs
  * Use -19 and -T0 for zstd for policy source
  * Use "hostnamectl chassis" to determine list of default policy modules,
    exclude many things from "handset".

 -- Russell Coker <russell@coker.com.au>  Sat, 26 Aug 2023 12:54:10 +1000

refpolicy (2:2.20221101-10) unstable; urgency=medium

  * Team upload.
  [ Christian Göttsche ]
  * d/patches: drop addition of existent file context (Closes: #1038968)
  * d/tests: simulate policy building
  * d/rules: validate build policy (Closes: #1030804)

  [ Vagrant Cascadian ]
  * debian/rules: Pass arguments to tar to use a consistent uid and gid.
    (Closes: #1030057)

  [ Laurent Bigonville ]
  * debian/control: Bump Standards-Version to 4.6.2 (no further changes)

 -- Laurent Bigonville <bigon@debian.org>  Sat, 15 Jul 2023 09:47:27 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog selinux-policy-mls`.
