refpolicy (2:2.20250213-10) unstable; urgency=medium

  * Allow user_bubblewrap_t to transition to user_t via user_home_t and
    user_bin_t
  * Fixes for evolution, colord, dbus, wm, and xdm.  Now the GNOME desktop
    is fully functional and sddm works as a graphical login.

 -- Russell Coker <russell@coker.com.au>  Fri, 25 Jul 2025 22:36:54 +1000

refpolicy (2:2.20250213-9) unstable; urgency=medium

  * Allow sympa_t to signal itself, create udp sockets, and bind to a generic
    node
  * Fixed labelling for /var/log/opensnitchd.log.* and
    /var/cache/apt-xapian-index/*
  * Allow systemd-logind to receive fds from xdm - needed for SDDM to function
  * Labelled /usr/bin/efibootmgr as bootloader_exec_t
  * Labelled /usr/bin/screendump as screen_exec_t
  * Labelled /usr/sbin/veritysetup as lvm_exec_t
  * Add a user login for Debian-gdm that gets the xdm identity
  * Add some user_wm_t permissions for GNOME and PHOC logins, PHOC and KDE
    Plasma with gdm3 are fully functional and GNOME is mostly functional.
  * Add labels for /var/lib/lxc and /var/lib/misc/dnsmasq.[a-z0-9]+.leases

 -- Russell Coker <russell@coker.com.au>  Sat, 19 Jul 2025 22:55:24 +1000

refpolicy (2:2.20250213-8) unstable; urgency=medium

  * Fix syntax errors
  * Allow dovecot_auth_t to mape dovecot_runtime_t files
  * Allow mon_net_test_t to run netutils
  * removed unused interfaces fs_mounton_memory_pressure and
    userdom_watch_user_ttys
  * Remove systemd_logind_use_fds and use systemd_use_logind_fds instead
  * Allow dhcpc_t to list resolved runtime dir and stat generic units files
  * Allow systemd-logind and systemd-user-runtime-dir stat /proc as logind
    failing to do so can cause difficult to diagnose dbus issues with
    pam_login
  * Allow fwupd to signal itself

 -- Russell Coker <russell@coker.com.au>  Sun, 06 Jul 2025 19:29:50 +1000

refpolicy (2:2.20250213-7) unstable; urgency=medium

  * Allow user systemd domains to list user tmp, watch root, read usr files,
    and create sockets for gpg_t and user_ssh_agent_t
  * Allow needrestart to list init var lib dirs
  * Allow dhcpc_t to connect to itself via a unix stream socket
  * Allow systemd_user_runtime_dir_t to unlink ssh_agent_tmp_t sock files
  * Allow systemd_machine_id_setup_t to send syslog messages

 -- Russell Coker <russell@coker.com.au>  Tue, 03 Jun 2025 20:58:37 +1000

refpolicy (2:2.20250213-6) unstable; urgency=medium

  * Allow fail2ban to watch the audit log
  * Dontaudit needrestart statting device nodes and writing /var dirs
  * Allow needrestart to read vm overcommit sysctl and logind sessions
    allow it to send signull to sshd and xdm, allow it to stat generic ptys
  * Allow semanage to read vm overcommit sysctl
  * Allow utempter to create dgram sockets and stat localisaton files
  * Allow systemd-nspawn to read init runtime files (for MAC generation),
    to write to /dev/kmsg, to send syslog messages
  * Allow systemd-machined to create dirs of type systemd_machined_runtime_t
    under init_runtime_t, to see systemd-nspawn processes, to manage it's
    runtime dirs, and to create and unlink runtime sock_files.
  * Add policy for opensnitch
  * Label /etc/kernel/entry-tokenaas etc_runtime_t
  * Allow NetworkManager_t to read systemd networkd runtime and to get init
    status

 -- Russell Coker <russell@coker.com.au>  Sat, 24 May 2025 16:54:19 +1000

refpolicy (2:2.20250213-5) unstable; urgency=medium

  * allow user_wm_t and similar domains the sys_nice capability.
  * Allow needrestart to signal all systemd --user processes
  * Make the dir type transition for var_lib_t when dpkg_script_t creates
    subdirs only apply to dirs named "ntpsec" to avoid breaking dkms postinst
  * Label /var/lib/dkms as src_t
  * Allow mozilla to talk to ntpd and systemd-logind via dbus
  * Allow systemd-logind to change ownership of dma_device_t
  * Allow policykit to get the systemd status
  * Allow sshd to create /var/lib/wtmpdb

 -- Russell Coker <russell@coker.com.au>  Wed, 30 Apr 2025 13:00:58 +1000

refpolicy (2:2.20250213-4) unstable; urgency=medium

  * Allow chromium_t to start and get status of user_systemd_t
  * Allow user_dbusd_t to receive chromium_t file handles and write to them
  * Allow user_t to write chromium_t fifos
  * Allow accountsd_t to search init units
  * Allow cupsd_config_t to connect to cups via stream sockets and to send dbus
    messages to unconfined_t
  * Allow power_profilesd_t to dbus message devicekit power
  * Allow unconfined_t to inherit file handles from systmd_logind_t
  * Allow gpg_agent_t to read gpg_t files (process status)
  * Allow acpid to read logind sessions files
  * Give capability kill to needrestart
  * Label /var/lib/wtmpdb as faillog_t and allow pam_domain to manage faillog
  * Allow policykit_t to get status of transient units

 -- Russell Coker <russell@coker.com.au>  Thu, 24 Apr 2025 17:07:06 +1000

refpolicy (2:2.20250213-3) unstable; urgency=medium

  * allow user_systemd_t to read logind state
  * allow ntpd to read the vm_overcommit sysctl
  * allow system_dbusd_t the kill capability and init read runtime files so
    the latest version of dbus-broker will work
  * Allow mon local tests to stat dos filesystems
    Allow mon_t to manage mon_var_lib_t dirs
  * Allow fail2ban client to read kernel overcommit sysctl
  * Added type labels for kea dhcp server
  * Allow modemmanager to setopt on netlink_route_socket
  * Allow dhcpc_t to get system status and read networkd runtime
  * Allow fwupd_t to bind and stat netlink route sockets, connect to it's own
    tcp sockets, and stat it's own udp sockets.
  * Lots of minor changes to dhcpd policy to support the new kea server
  * Added label for /run/lock/ntpsec-ntpdate and transition for initrc creation
  * Allow certbot to read vm overcommit sysctl
  * Label /usr/lib/openssh/sshd-auth needed by openssh-server 10.0p1-1

 -- Russell Coker <russell@coker.com.au>  Sat, 12 Apr 2025 17:12:29 +1000

refpolicy (2:2.20250213-2) unstable; urgency=medium

  * add crio kubernetes openarc podman to the module exclusion list for
    handsets, previous version failed postinst on handsets

 -- Russell Coker <russell@coker.com.au>  Thu, 06 Mar 2025 23:36:47 +1100

refpolicy (2:2.20250213-1) unstable; urgency=medium

  * 20250213 new upstream release.
  * Build-depend on sepol-utils for chkcon
  * Changed all depends and build-depends to 3.8 of all the SE Linux packages
    Biggest problem is that libselinux1 3.8 and libsemanage2 3.7 breaks
    install with "Re-declaration of role unconfined_r" .. "Failed to build AST"
  * Allow mon_local_test_t to get devicekit power information from dbus
  * As a temporary measure comment out the validateappconfig in the Makefile
    to work around a SEGV so we can build this without bugs in other packages
    getting in the way.

 -- Russell Coker <russell@coker.com.au>  Fri, 14 Feb 2025 18:51:19 +1100

refpolicy (2:2.20250115-1) unstable; urgency=medium

  * Latest git policy
  * Allow needrestart to reload init
  * Label /etc/xdg/Xwayland-session.d/* as xsession_exec_t
  * Remove the etc_t label for /var/spool/postfix/etc as postfix_master_t
    needs to write to it and we don't want to grant write access to etc_t

 -- Russell Coker <russell@coker.com.au>  Wed, 15 Jan 2025 19:22:34 +1100

refpolicy (2:2.20241211-2) unstable; urgency=medium

  * More systemd patches
  * Allow plymouthd to signal init
  * Add policy for needrestart

 -- Russell Coker <russell@coker.com.au>  Tue, 31 Dec 2024 19:14:26 +1100

refpolicy (2:2.20241211-1) unstable; urgency=medium

  * Latest git policy
  * Allow gpsd_t to getsession
  * Run gdm-runtime-config as xdm_t
  * Allow fwupd_t to watch sysctl etc and fwupdmgr_t to manage dconf dirs
  * Add filetrans pattern for systemd_passwd_agent_t creating
    systemd_passwd_runtime_t dirs under systemd_user_runtime_t dirs
  * Label /usr/libexec/gnome-remote-desktop-daemon as xdm_exec_t

 -- Russell Coker <russell@coker.com.au>  Sat, 21 Dec 2024 16:51:08 +1100

refpolicy (2:2.20241119-1) unstable; urgency=medium

  * Latest git policy
  * Allow systemd_binfmt_t to read usr files
  * Allow boinc_t to read vm sysctls
  * label the new qt6 sddm greeter

 -- Russell Coker <russell@coker.com.au>  Wed, 04 Dec 2024 23:21:34 +1100

refpolicy (2:2.20241013-1) unstable; urgency=medium

  * Latest git policy
  * Build-depend on python3-setools >= 4.5.1 due to upstream changes in git
    refpolicy

 -- Russell Coker <russell@coker.com.au>  Sun, 13 Oct 2024 19:00:53 +1100

refpolicy (2:2.20241008-1) unstable; urgency=medium

  * Latest git policy, types for /dev/dma_heap/* /dev/udmabuf /dev/userfaultfd
  * Allow ntpd_t to start and stop generic units for timedatectl set-ntp
  * Label /opt/microsoft/msedge/microsoft-edge
  * Remove sys_admin from cups

 -- Russell Coker <russell@coker.com.au>  Tue, 08 Oct 2024 18:44:35 +1100

refpolicy (2:2.20240919-1) unstable; urgency=medium

  * Latest git policy, systemd changes mostly for namespace resourced
  * Allow bubblewrap to use user ttys
  * Allow systemd_machine_id_setup_t to write to kmsg and have dac_override
    capability for setting systemd.machine_id on the kernel command line.
    Without this you get system hangs on boot with systemd-boot.
  * Allow user_wm_t etc to send syslog messages,
  * Allow lvm_t access to class alg_socket for cryptsetup benchmark
  * Allow daemon domains to read-write initrc_t unix stream sockets

 -- Russell Coker <russell@coker.com.au>  Sun, 22 Sep 2024 16:53:50 +1000

refpolicy (2:2.20240830-1) unstable; urgency=medium

  * Latest git policy, mostly container related changes
  * allow fwupd to write to fixed disks and fwupdmgr to dbus talk to network
    manager
  * Allow systemd_nspawn_t to sendto it's own unix dgram sockets, search
    autofs mounts, and write to systemd notify socket
  * Give ndc_t access to anon_inode and io_uring
  * Label shared objects under /opt/brother/scanner/brscan5/ as lib_t
  * Added label for /usr/libexec/qemu/qemu-bridge-helper for version
    1:9.0.2+ds-2 of qemu-system-common
  * Allow fwupd_t to get it's scheduling, create udp sockets, and read sysnet config
  * Allow rasdaemon to write sysfs files for
    /sys/devices/system/memory/soft_offline_page
  * Allow bubblewrap domains to read sysctl_t for max_user_namespaces
  * Label /usr/sbin/fsidd as nfsd_exec_t

 -- Russell Coker <russell@coker.com.au>  Fri, 30 Aug 2024 13:31:54 +1000

refpolicy (2:2.20240723-2) unstable; urgency=medium

  * Allow chromium_t execheap access which Chrome now needs, presumably for
    JIT
  * Allow systemd_coredump_t to read cgroup dirs.  Dontaudit it for sys_admin
    capability
  * Allow all users to chat to fprintd via dbus
  * Allow boinc_t self getsched
  * Allow mysqld to read/write memory_pressure_t files
  * Label /usr/lib/openssh/sshd-session as sshd_exec_t for openssh-server >=
    1:9.8p1-1

 -- Russell Coker <russell@coker.com.au>  Thu, 01 Aug 2024 22:30:43 +1000

refpolicy (2:2.20240723-1) unstable; urgency=medium

  * Latest git policy which reorders many process permissions so lots of
    patches needed changes.  Also added haproxy module
  * Label btrfs utility as fsadm_exec_t
  * Changed to debhelper-compat in build-depends
  * Allow virtd_t anon_inode access, to read cpuid, to watch etc dirs, also
    allow it to read vm sysctls
  * Allow virtlockd_t and virtlogd_t to self getsched, to create unix dgram
    sockets, to read sysfs files, to read kernel sysfs files, stat /proc, and
    log to syslogd
  * Allow systemd_generator_t to create vsock_socket objects
  * Added some policy for fprintd_t
  * Label nm-dispatcher as NetworkManager_exec_t
  * Allow user_systemd_t etc to do netlink_route_socket operations (needed for
    KDE login)
  * Allow systemd_logind_t to search it's own proc dirs

 -- Russell Coker <russell@coker.com.au>  Fri, 26 Jul 2024 08:34:15 +1000

refpolicy (2:2.20240607-1) unstable; urgency=medium

  * Latest git policy with patches needed for latest systemd
  * Allow apt to setattr it's lib dirs, map it's cache, getsched for itself,
    and manage apt_tmp_t link files
    Allow apt to read init state for ischroot
  * dontaudit apt net_admin because of buffer tweaking
  * Allow dpkg_script_t to map the man cache, read the apt cache, watch
    passwd runtime dirs, sys_resource capability, setrlimit, getattr procfs,
    relabel non auth files, read fonts, stat tmpfs, and be a system bus client
  * Allow dpkg and dpkg_script_t to read selinux status and file contexts
  * Allow apt_t to receive logind fds and write to logind pipes
  * Allow plymouth_t the checkpoint_restore and to signal init
  * Allow systemd_backlight_t to talk to polkit and unconfined domains via
    dbus, and read localisation files
  * Made /usr/lib/kauth/libexec/backlighthelper run in systemd_backlight_t
  * Allow networkmanager to watch it's main config dir
  * Allow systemd_t to send dgrams to itself - needed for GUI login with
    latest systemd setup.  Allow it to statfs /proc and stat /usr files

 -- Russell Coker <russell@coker.com.au>  Wed, 12 Jun 2024 11:50:27 +1000

refpolicy (2:2.20240415-1) unstable; urgency=medium

  * Latest git policy, works with latest systemd
  * Allow eg25manager_t to use pipes
  * Allow kernel_t the new capability2 checkpoint_restore permission
  * Added label for/var/lib/phog - xdm greeter
  * Added labels for ms-edge
  * Include module iiosensorproxy for laptops as touch screens need it
  * Allow systemd_locale_t to read SE Linux config
  * Give unconfined domains the checkpoint_restore capability
  * Allow devicekit_disk_t to read generic certificates
  * Allow local_login_t to receive file handles from systemd-logind, and read
    apt db
  * Allow sshd to stat the systemd notify socket
  * Allow systemd_resolved to write to systemd notify socket
  * Allow users anon_inode { create read write map } for user mysql etc

 -- Russell Coker <russell@coker.com.au>  Thu, 18 Apr 2024 16:38:02 +1000

refpolicy (2:2.20240202-1) unstable; urgency=medium

  * label /run/boltd
  * label /etc/letsencrypt/renewal-hooks files as bin_t
  * Add label for /usr/lib/chromium/chrome_crashpad_handler
  * Enabled module hostapd
  * Changed fwupd policy to have a separate domain for fwupdmgr
  * Lots of policy needed to support login with the latest systemd-user
  * Latest git policy

 -- Russell Coker <russell@coker.com.au>  Fri, 02 Feb 2024 16:55:45 +1100

refpolicy (2:2.20231119-2) unstable; urgency=medium

  * Allow initrc_t to mounton memory_pressure_t files
    Hopefully the last thing needed to make the latest systemd work correctly

 -- Russell Coker <russell@coker.com.au>  Sun, 19 Nov 2023 22:39:04 +1100

refpolicy (2:2.20231119-1) unstable; urgency=medium

  * new git ver
  * systemd 255~rc2-1 in unstable uses initrc_t to launch daemons so needed
    transition rules for that, initrc_t needs to watch unallocated ttys as
    part of the getty launch operation, and it needs nnp_transition to all
    daemon domains for the combination of systemd restrictions on privileges
    and SE Linux domain transition.
    Also domains need access to unix_stream_socket file handles created by
    initrc_t.
    Systemd versions after 254.5-1 break badly without this.

 -- Russell Coker <russell@coker.com.au>  Sun, 19 Nov 2023 17:27:44 +1100

refpolicy (2:2.20231010-1) unstable; urgency=medium

  * new git ver
  * Added more checks for "hostnamectl chassis" output, conainer is vm,
    convertible/watch/embedded are considered as handset for now, and server
    has an entry.

 -- Russell Coker <russell@coker.com.au>  Sun, 22 Oct 2023 15:31:53 +1100

refpolicy (2:2.20230929-1) unstable; urgency=medium

  * new git ver
  * Upstream merged powerprofiles and rasdaemon and anti-spam and motd patches
  * Changed preinst to work when /etc/selinux/config doesn't exist

 -- Russell Coker <russell@coker.com.au>  Fri, 29 Sep 2023 01:15:21 +1000

refpolicy (2:2.20230919-1) unstable; urgency=medium

  * new git ver
  * Upstream merged eg25manager, iiosensorproxy, lowmemorymonitor, switcheroo,
    and thunderbolt

 -- Russell Coker <russell@coker.com.au>  Tue, 19 Sep 2023 15:01:19 +1000

refpolicy (2:2.20230821-1) unstable; urgency=medium

  * new git ver
  * Add policy for Mobian
    Allow system_r:init_t:s0 to transition to user context xdm_r:xdm_t:s0 for
    systemd --user
    Add consolesetup, eg25manager, feedbackd, geoclue, and iiosensorproxy
    policy modules for Mobian
    Lots of other policy changes related to Mobian
  * Added msdos_t label for exfat
  * Add bubblewrap, container, and docker modules
    Consider bubblewrap exerimental at this time
  * Add support for relabelling files on policy package changes to file
    contexts, made the policy packages depend on policycoreutils >= 3.5-2 for
    /usr/libexec/selinux/remove-leaf-dirs
  * Use -19 and -T0 for zstd for policy source
  * Use "hostnamectl chassis" to determine list of default policy modules,
    exclude many things from "handset".

 -- Russell Coker <russell@coker.com.au>  Sat, 26 Aug 2023 12:54:10 +1000

refpolicy (2:2.20221101-10) unstable; urgency=medium

  * Team upload.
  [ Christian Göttsche ]
  * d/patches: drop addition of existent file context (Closes: #1038968)
  * d/tests: simulate policy building
  * d/rules: validate build policy (Closes: #1030804)

  [ Vagrant Cascadian ]
  * debian/rules: Pass arguments to tar to use a consistent uid and gid.
    (Closes: #1030057)

  [ Laurent Bigonville ]
  * debian/control: Bump Standards-Version to 4.6.2 (no further changes)

 -- Laurent Bigonville <bigon@debian.org>  Sat, 15 Jul 2023 09:47:27 +0200

refpolicy (2:2.20221101-9) unstable; urgency=medium

  * Added git and thunderbird to the not default modules list
  * Add filetrans to make dpkg_script_t create /var/lib/ntpsec/ as ntp_drift_t
    also add fc entry for /var/lib/ntpsec
  * Allow ndc_t to read vm_overcommit_state and sysfs files
  * Dontaudit certbot_t net_admin capability, it doesn't need to change
    network stuff, probably changing buffer sizes.
  * Allow aptcacher_t to getsched for itself
  * Allow boinc_t to to connect to unconfinged stream sockets for X access
  * Allow systemd_locale_t to talk to unconfined users by dbus
  * Allow xdm_t to talk to systemd-locale via dbus
  * Allow systemd_generator_t to manage files and dirs of type
    systemd_user_runtime_unit_t and to read crypto sysctls
  * Dontaudit writing to lib dirs for fail2ban_t and fail2ban_client_t for
    python attempts to generate cache files
  * Dontaudit mysqld_safe (mysql startup script) attempts to write to root dir
  * Change all toolchain dependencies to >= version 3.4
  * Allow jabberd_domain to create jabberd_var_lib_t:sock_file for prosody
  * Allow dkim_milter_t and clamd_t to get their own scheduling status
  * Allow auditd_t to map it's config files to avoid recursion when dontaudit
    rules are disabled
  * Allow groupadd_t to stat /proc
  * Allow matrixd_t to read sysfs for CPU information
  * Give postfwd_milter_t kill capability
  * Allow unconfined domains the self:anon_inode access.
    Also allow them to manage dirs in their own domain, Chrome does this
  * Allow the postfix_map_t domain to read /dev/urandom
  * Allow mozilla to bind UDP generic nodes, write dbus session runtime
    sockets, read device sysctls for video hardware specs, and map it's cache
    files.
  * Allow fsadm_t to write to boot_t for fstrim
  * Gave nfsd_t the lease capability, taking leases on files is necessary
  * dontaudit bootloader_t accessing /dev/mem, mdadm does this for some reason
    but doesn't need it
  * Allow fwupd_t to read the vm overcommit sysctl
  * Allow setfiles_t to read the vm overcommit sysctl
  * Allow vnstatd_t to read urandom

 -- Russell Coker <russell@coker.com.au>  Wed, 19 Apr 2023 20:24:14 +1000

refpolicy (2:2.20221101-8) unstable; urgency=medium

  * Fix automated tests error on cron.if line 118 mismatched quotes.

 -- Russell Coker <russell@coker.com.au>  Tue, 21 Mar 2023 14:35:34 +1100

refpolicy (2:2.20221101-7) unstable; urgency=medium

  * new upload due to signature problems

 -- Russell Coker <russell@coker.com.au>  Mon, 20 Mar 2023 17:53:37 +1100

refpolicy (2:2.20221101-6) unstable; urgency=medium

  * More work on cron policy
  * Run bzip2 in a way that works with firebuild
  * Allow sshd_t to read the apt database for motd with unattended-upgrades
  * Allow system_dbusd_t to connect to systemd-machined
  * dontaudit crond connectint to systemd-machined
  * Allow mon_t to read xdg config files and to signal itself and getsched
    for sending xmpp alerts
  * allow fwupd_t to access user tty devices

 -- Russell Coker <russell@coker.com.au>  Wed, 15 Mar 2023 23:19:01 +1100

refpolicy (2:2.20221101-5) unstable; urgency=medium

  * Allow fwupd_t to rw the Intel MEI device
  * Allow rasdaemon_t to rw cpu microcode, the sys_rawio capability, and
    self getsched.
  * Run bzip compression with $(NUMJOBS) in parallel
  * Allow memlockd to read net config so it can lock those config files
  * Label /var/lib/unattended-upgrades as apt_var_lib_t
  * Allow chromium_t to dbus chat to systemd_logind_t for PrepareForSleep
  * dontaudit postfix domains connecting to systemd-machined
  * Allow policykit_t to connect to systemd-machined
  * Made the crontab command work for all login domains

 -- Russell Coker <russell@coker.com.au>  Mon, 13 Mar 2023 03:11:03 +1100

refpolicy (2:2.20221101-4) unstable; urgency=medium

  * Allow sshd_t to read var_lib_t files for motd generation
  * Allow systemd_binfmt_t to statfs binfmt filesystems
  * Allow systemd_nspawn_t all_unix_dgram_socket_perms to itself
  * Allow groupdadd_t to read sysctl_kernel_t files
  * Allow local_login_t to read pam motd files
  * Allow nfsd_t to read directories of RPC file system pipes
  * Allow mysqld_t (Mariadb) to create map read write anon_inode objects it creates
  * Allow kmod_t to read modules_conf_t symlinks, for DKMS
  * Remove unused debian/gen-deps.sh script.
    Change to Debhelper compat level 13
    Removed an attempt to delete a non-existant pyplate.pyc file
    Changed to zstd for selinux-policy-src and stopped using a variable for
    compression options.  Why do we even have selinux-policy-src?
    Removed unneeded build depends and changed the SE Linux build depends
    to version >=3.4
    Change VCS to Vcs in debian/control
    Change lintian overrides to match new format
    Change build to not need root
    Tell Lintian to ignore some very long lines in source
    Fix copyright URLs
    Removed trailing whitespace in changelog
    Use kernel_load_module(brctl_t) instead of just adding a capability
    Add autopkgtest.  Closes: #1012841

 -- Russell Coker <russell@coker.com.au>  Sun, 29 Jan 2023 15:07:05 +1100

refpolicy (2:2.20221101-3) unstable; urgency=medium

  * Add auth_write_pam_motd_files() interface for writing to /run/motd.d and
    correctly label /run/motd.d
  * Add policy for fwupd (firmware update)
  * Allow groupadd_t to search kernel fs sysctls
  * Allow rasdaemon to read sysfs_t
  * Allow systemd_machined_t to talk to policykit via dbus
  * Allow systemd_locale_t to write to /run/systemd/notify
  * Allow systemd_sysctl_t and systemd_tmpfiles_t to search ramfs
  * Allow systemd_generator_t udp setopt and sysnet_read_config for postconf
  * Allow systemd_generator_t to stat usr_t files
  * Allow systemd_modules_load_t to search debugfs
  * Allow systemd_sysusers_t to use apt ptys
  * Allow acpid to getsched
  * Add support for /run/motd.d/
  * Allow Chrome to read sysctl_dev_t and write to dbus session runtime
    socket.  Label the Chrome libvulkan.so.1 file as lib_t
  * Allow systemd_logind_t to delete user tmpfs files and manage tmpfs dirs
  * Allow systemd_locale_t to talk to unconfined via dbus

 -- Russell Coker <russell@coker.com.au>  Mon, 09 Jan 2023 18:05:47 +1100

refpolicy (2:2.20221101-2) unstable; urgency=medium

  * Allow $1_dbusd_t to create sock_files under /tmp
  * Remove the deprecated interfaces that had been in Bullseye
  * Allow $1_wm_t to read/write input devices and use logind fds
  * Added systemd_dbus_chat_locale() and allowed xdm and user domains to do it.
  * Allow user domains to unlink xdm_tmp_t socket files
  * Allow systemd-coredump, chkpwd_t, and setfiles_t to statfs /proc
  * Label /usr/lib/NetworkManager/nm-dispatcher* as NetworkManager_exec_t
  * Label /sbin/fstrim as fsadm_exec_t
  * Allow setfiles_t to read bin_t links
  * Make ssh_sysadm_login default to true.  Closes: #1012755
  * Allow fsadm_t to statfs cgroup filesystems and to read /proc/1/environ
    for systemd-fsckd.  Also dontaudit net_admin capability for systemd-fsckd
    trying to change buffer sizes.
  * Allow systemd_sysusers_t to use inherited user terminals and inherit file
    handles from unconfined_t and give it domain_obj_id_change_exemption()
  * Made init_runtime_t an init unit file, for automatically generated units

 -- Russell Coker <russell@coker.com.au>  Mon, 02 Jan 2023 22:02:36 +1100

refpolicy (2:2.20221101-1) unstable; urgency=medium

  * New upstream release
  * Label /lib/systemd/systemd-fsckd as fsadm_exec_t

 -- Russell Coker <russell@coker.com.au>  Sun, 06 Nov 2022 23:02:25 +1100

refpolicy (2:2.20220520-5) unstable; urgency=medium

  * label apt.systemd.daily and apt-helper as apt_exec_t for systemd cron jobs
  * Allow apt_t to get init, systemd-networkd, and network-manager unit status
  * give systemd_generator_t access to nfsd_fs_t files and
    systemd_transient_unit_t dirs
  * Allow kmod_t to read ssl generit certs
  * Allow systemd_machined_t to get status of systemd_transient_t units

 -- Russell Coker <russell@coker.com.au>  Mon, 26 Sep 2022 19:59:14 +1000

refpolicy (2:2.20220520-4) unstable; urgency=medium

  * Add label for /etc/dkimkeys Closes: #900188
  * Allow chronyd_t to send unix datagrams to unconfined_t and gave it
    dac_read_search Closes: #962223
  * Allow firewalld_t to do netlink_netfilter_socket access, watch
    firewalld_etc_rw_t dirs, and read generic certs
  * Allow init_t to watch for reads on console_device_t for autorelabel
    processing.

 -- Russell Coker <russell@coker.com.au>  Sun, 18 Sep 2022 12:48:43 +1000

refpolicy (2:2.20220520-3) unstable; urgency=medium

  * Allow systemd_passwd_agent_t to stat /proc and read sys/kernel/cap_last_cap
  * Allow systemd_backlight_t to stat sysfs and read SE Linux contexts
  * Allow systemd_logind_t to read localization.
  * Allow lvm_t to read generic certificates for systmd-cryptsetup
  * Allow systemd_logind_t to read udev runtime links
  * Allow systemd-udevd to manage cgroup files
  * Allow systemd_machined_t, systemd_locale_t, lvm_t, systemd_binfmt_t, and
    systemd_backlight_t to statfs /proc
  * give the sys_resource capability to systemd_sysctl_t
  * Allow chromium to read the vm_overcommit sysctl
  * Allow systemd_binfmt_t to check executable status of bin files and search
    cgroup dirs

 -- Russell Coker <russell@coker.com.au>  Thu, 15 Sep 2022 00:03:25 +1000

refpolicy (2:2.20220520-2) unstable; urgency=medium

  * Added label for /usr/sbin/nfsdcld and gave nfsd_t setpcap capability
  * Allow syslogd_t to relabel from/to systemd_journal_t
  * Created 0002-upstream patch file for changes that are in the upstream git

 -- Russell Coker <russell@coker.com.au>  Sun, 14 Aug 2022 00:20:28 +1000

refpolicy (2:2.20220520-1) unstable; urgency=medium

  * new upstream release

 -- Russell Coker <russell@coker.com.au>  Sun, 22 May 2022 21:55:06 +1000

refpolicy (2:2.20220403-3) unstable; urgency=medium

  * little policy fixes
  * Changed build-depends from libsepol1 to libsepol2

 -- Russell Coker <russell@coker.com.au>  Tue, 12 Apr 2022 23:38:26 +1000

refpolicy (2:2.20220403-2) unstable; urgency=medium

  * Allow init to watch_reads on terminal devices
  * Allow init_t to mounton files of type init_t
  * Label /usr/share/unattended-upgrades/* as bin_t
  * Allow systemd_backlight_t to search cgroup dirs
  * Allow lvm_t to getattr a cgroup filesystem
  * Make init_t file handles inheritable by most domains because systemd opens
    devices for getty
  * Make xdm_r the default role for SE Linux user xdm

 -- Russell Coker <russell@coker.com.au>  Thu, 07 Apr 2022 23:36:51 +1000

refpolicy (2:2.20220403-1) unstable; urgency=medium

  * New package based on git.  Will have another proper release soon.
  * Lots of Debian policy upstreamed.
  * Depend on the latest versions of the libraries.

 -- Russell Coker <russell@coker.com.au>  Sun, 03 Apr 2022 17:51:30 +1000

refpolicy (2:2.20210203-10) unstable; urgency=medium

  * Allow mon_local_test_t access to domain_getattr_all_domains() to get the
    context of all processes and to have selinux_get_enforce_mode(),
    selinux_getattr_fs(), and seutil_search_default_contexts() to get the
    enforcing mode for selinux.monitor.  Uploading with just this change
    because I already uploaded mon version 1.3.5-8 with selinux.monitor.

 -- Russell Coker <russell@coker.com.au>  Mon, 08 Nov 2021 13:33:52 +1100

refpolicy (2:2.20210203-9) unstable; urgency=medium

  * Label /opt/google/chrome/chrome_crashpad_handler and
    /opt/google/chrome/crashpad_handler as chromium_exec_t
  * Allow kmod_t to manage bootloader_tmp_t files and allow bootloader_t to
    create and delete /dev/null (for initramfs).  Also allow bootloader_t to
    read udev rules and network config.
  * Merged patches from Topi Miettinen for building only one flavour and for
    correctly making a list of modules even when building is asynchronous.
  * Added patch for /usr/libexec/sssd/sssd_.+ from Sam Morris.

 -- Russell Coker <russell@coker.com.au>  Thu, 21 Oct 2021 14:23:40 +1100

refpolicy (2:2.20210203-8) unstable; urgency=medium

  * Label /etc/ppp/ip-pre-up as pppd_initrc_exec_t
  * Allow wireshark to rw DRI devices, read crypto sysctls, rw the xserver
    mesa shader cache, read the kernel network state, have execmem access
    (probably needed for one of the many shared objects it uses), have setsched
    access, execute lib files (for it's helper programs), manage xdg config
    files (gives warning if it can't do this), manage xdg cache, and read xdg
    data files.
  * Allow acngtool_t the dac_override capability for managing log files
  * Allow pppd to connect create and ioctl pppox_socket and allow it to map
    pppd_runtime_t files.
  * Allow kmod_t, ifconfig_t, and ping_t to use unallocated ttys (for sysadmin
    login on boot failure)
  * Allow ntpd_t to start and stop generic units when systemd is used, for
    systemd-timesyncd.

 -- Russell Coker <russell@coker.com.au>  Mon, 04 Oct 2021 15:06:54 +1100

refpolicy (2:2.20210203-7) unstable; urgency=medium

  * Allow certbot to create /var/log/letsencrypt and /var/lib/letsencrypt
  * Label /etc/wide-dhcpv6/dhcp6c-ifupdown /etc/wide-dhcpv6/dhcp6c-script
    /etc/dhcp/dhclient-enter-hooks.d/* and /etc/dhcp/dhclient-exit-hooks.d/*
    as bin_t.
  * Allow mon_local_test_t to run smartctl in fsadm_t for megaraid and other
    corner cases and allowed fsadm_t to read fsdaemon_var_lib_t.  Dontaudit
    fsadm_t inheriting file handles from mon_t.
  * Allow fsadm_t to do a file type trans for creating
    /dev/megaraid_sas_ioctl_node
  * Allow java_t to exec bin_t and lib_t files for jspawnhelper, and to read
    cgroup files.  Needed for JRE 17

 -- Russell Coker <russell@coker.com.au>  Mon, 14 Jun 2021 09:47:05 +1000

refpolicy (2:2.20210203-6) unstable; urgency=medium

  * Add policy for cockpit web admin tool
  * Fixes for puppet policy
  * Allow system_mail_t to be in role unconfined_r for upgrades of the exim
    packages
  * Allow more spamd_log_t access if boolean rspamd_spamd is enabled
  * Allow httpd_sys_script_t to rw sympa_var_t dirs and manage sympa_var_t
    files, and to read sympa conf files.  Also allow it to read generic certs
    for sympa and also for lots of other things
    Allow httpd_t to read sympa conf files, read sympa var files, manage sympa
    runtime files, and manage sympa runtime sockets
    Allow sympa to send signull to itself
  * Allow certbot to search xdg dirs, don't know what it's trying to do but
    searching doesn't do any harm and makes it easier to discover what's
    happening.
  * Allow postgresql to read tls privkey
  * Give systemd_nspawn_t the audit_control capability
  * Allow devicekit_disk_t to read logind sessions and write inherited logind
    inhibit pipes
  * Give capability kill to inetd_t so it can kill child processes under
    different uids
  * Allow chromium_naclhelper_t process access setcap and signal and
    cap_userns access sys_admin and sys_chroot.
    Allow chromium_t to read alsa config.

 -- Russell Coker <russell@coker.com.au>  Sat, 08 May 2021 17:55:06 +1000

refpolicy (2:2.20210203-5) unstable; urgency=medium

  * Add policy for rasdaemon
  * Made mta_manage_mail_home_rw_content() include mail_home_rw_t:file watch
    access, needed by dovecot_t and probably others in future
  * Allow restorecond to watch selinux_config_t files.
  * Allow *_wm_t domains (for window manager processes) to watch xdg_config_t
    files and to execmod wm_tmpfs_t files (stops kwin_x11 SEGV)
  * Allow systemd_tmpfiles_t to relabel colord var lib files and dirs
  * Allow smbcontrol_t to map samba_runtime_t files and send unix datagrams
    to smbd processes
  * Allow systemd_user_runtime_dir_t to delete all user runtime sock files
    and manage pulseaudio_tmp_t dirs
  * Allow system_cronjob_t to manage var_lib dirs
  * Allow dovecot to create ~/mail directories.
  * Label /usr/share/mailman3-web/manage.py as mailman_queue_exec_t
    Allow mailman_queue_t to read usr files and to create it's own tmpfs files
    and allow it to map mailman_data_t files
  * Added systemd policy from upstream git as of 31st Mar to the upstream patch
  * Label /usr/bin/rspamd file not /usr/bin/rspamd symlink
    label /var/log/rspamd(/.*)? as spamd_log_t.  Allow spamd_t self execmem
    access when rspamd_spamd.  Label port 11333 as spamd_port_t for rspam.
  * Label /usr/lib/courier/imapd.* and /usr/lib/courier/pop3d.* as
    courier_pop_exec_t.  Allow courier_pop_t to read generic certs, manage
    courier_var_lib_t files, bind to POP ports, execute courier_exec_t and
    courier_tcpd_exec_t programs, and map courier config files.  Grant
    courier_pop_t the fowner and chown capabilities (for managing user mail)
    but dontaudit the fsetid capability.  Grant courier_pop_t the setrlimit
    process access so it can set it's own resource limits.  Allow
    courier_authdaemon_t to search SE Linux default contexts (needed by pam
    before using unix_chkpwd) and allow it to stat proc files.
  * Add sympa policy
  * Allow exim_t to read/write tmp files inherited from cron.  Allow exim_t
    the dac_read_search capability.
  * Allow apache to map user content files when httpd_read_user_content is set.
    Label /usr/lib/w3m/* as httpd_sys_script_exec_t
  * Dontaudit fsdaemon_t capability net_admin (probably setting buffer size)

 -- Russell Coker <russell@coker.com.au>  Fri, 09 Apr 2021 23:02:14 +1000

refpolicy (2:2.20210203-4) unstable; urgency=medium

  * Allow ntpd_t to get the status of generic systemd units
  * Allow kernel_t self:perf_event cpu.
  * Allow chromium to watch network manager runtime dirs (for resolv.conf)
    Allow chromium to run naclhelper with nnp_transition
    Allow chromium to watch root dirs
    Allow chromium to read/write unix sockets from the calling domain
  * Make Postgresql use postgresql_tmpfs_t for tmpfs files and make
    mon_local_test_t and systemd_logind_t not have getattr access to tmpfs
    files audited.
  * Allow systemd_user_runtime_dir_t to unlink device nodes of type
    user_tmp_t, they probably should not exist, so it's in the hacks patch.
  * Allow the acngtool to read random and urandom devices and search fs sysctls
  * Add wm_write_xdg_data tunable to allow user_wm_t etc to write xdg data.
  * Allow chromium to watch gnome_xdg_config_t dirs
  * Label pinentry programs as gpg_agent_exec_t and allow gpg_agent_t to exec
    them
  * Create new admin_mail_t domain so that newaliases can work with Postfix
  * Added a transition rule so that vipw/vigr gives the right context for
    /etc/passwd and /etc/group
  * Allow acngtool_t to read /proc/sys/kernel/random/uuid
  * Allow unconfined domains lockdown confidentiality and integrity access
  * Allow netutils_t netlink_generic_socket access for tcpdump
  * Allow smbcontrol to create a sock_file in a samba run dir
  * Allow mailman_queue_t to bind to all unreserved TCP ports
  * Allow systemd_coredump_t to mmap all executables and to have cap_userns
    sys_ptrace access. dontaudit systemd_coredump_t capability net_admin
  * Allow mailman_queue_t to connect to port 443

 -- Russell Coker <russell@coker.com.au>  Fri, 05 Mar 2021 21:11:58 +1100

refpolicy (2:2.20210203-3) unstable; urgency=medium

  * Add policy for blkmapd which is part of nfs service (included in upstream)
  * Add interfaces systemd_search_user_runtime()
  * Allow systemd_user_runtime_dir_t to unlink dirmngr sock files
  * Allow sshd_t to talk to systemd_nspawn_t via Unix sockets
  * Allow syslogd_t to search systemd_user_runtime_t dirs
  * Allow acpid_t to rw input device files
  * Allow restorecond_t to watch all dirs
  * Allow mailman_queue_t to search the cron spool dir, also allow it to be
    started as a daemon and to write mailman pid files
  * Included upstream git patches for latest systemd features, this may
    save some pain when Bullseye+1 is released
  * Allow systemd-nspawn to mount on and manage more things when
    systemd_nspawn_labeled_namespace is on.
  * Allow smbcontrol_t to talk to itself via Unix domain sockets
  * Add policy for postfwd
  * Allow aptcacher_t to read urandom and random devices and to read kernel
    sysctls
  * Label /usr/lib/x86_64-linux-gnu/libexec/* as bin_t for KDE/sddm login
    Allow user to execute and execmod user tmpfs files, for KDE
    Allow user to write to user_runtime_t sock files
  * Add policy to run the certbot --nginx which runs nginx, doesn't work
    in all situations but should cover the common cases.
  * Set label for /usr/bin/redis-check-rdb (redis server binary in Debian)
    and allow redis to read certs and read vm and net sysctls.

 -- Russell Coker <russell@coker.com.au>  Tue, 23 Feb 2021 16:57:40 +1100

refpolicy (2:2.20210203-2) unstable; urgency=medium

  * lots of little policy changes

 -- Russell Coker <russell@coker.com.au>  Fri, 12 Feb 2021 10:24:33 +1100

refpolicy (2:2.20210203-1) unstable; urgency=medium

  * Allow unconfined_u and sysadm_u to access other identities.
  * New upstream release!

 -- Russell Coker <russell@coker.com.au>  Thu, 04 Feb 2021 03:34:45 +1100

refpolicy (2:2.20210130-1) unstable; urgency=medium

  * new archive from git
  * More Debian stuff upsteamed
  * Added some filetrans rules to assign the right types when postinst
    scripts don't label things.

 -- Russell Coker <russell@coker.com.au>  Sun, 31 Jan 2021 00:32:23 +1100

refpolicy (2:2.20210126-1) unstable; urgency=medium

  * new archive from git, upstream changes include removing unused modules
  * More Debian stuff upsteamed
  * Remove: abrt callweaver ccs certmaster certwatch cipe clockspeed clogd
    consoletype dcc ddcprobe denyhosts dspam firstboot howl imaze jockey
    ktalk lockdev lsm mailscanner mcelog oav polipo pyicqt resmgr rhcs
    rhsmcertd ricci rpm vhostmd
  * Don't enable by default: amtu bugzilla condor
  * Added SE Linux "user" named xdm for the "sddm" Unix account to be used
    by the sddm greeter process.  This makes the greeter run as xdm_t
    instead of unconfined_t.

 -- Russell Coker <russell@coker.com.au>  Fri, 29 Jan 2021 01:50:16 +1100

refpolicy (2:2.20210120-1) unstable; urgency=medium

  * New archive from git
  * Some Debian stuff upstreamed
  * Lots of little changes

 -- Russell Coker <russell@coker.com.au>  Sat, 23 Jan 2021 22:22:15 +1100

refpolicy (2:2.20210115-1) unstable; urgency=medium

  * New archive from git
  * Added matrixd policy
  * Fixed the crontab problem

 -- Russell Coker <russell@coker.com.au>  Mon, 18 Jan 2021 00:41:23 +1100

refpolicy (2:2.20210112-1) unstable; urgency=medium

  * New archive from git
  * Lots of policy fixes for Debian/Unstable

 -- Russell Coker <russell@coker.com.au>  Thu, 14 Jan 2021 00:28:01 +1100

refpolicy (2:2.20201221-1) unstable; urgency=medium

  * New archive from git

 -- Russell Coker <russell@coker.com.au>  Mon, 21 Dec 2020 22:15:44 +1100

refpolicy (2:2.20200502-1) unstable; urgency=medium

  * New archive taken from upstream git.  Will base it mostly on git for the
    development leading to Buster and then take the latest upstream release
    shortly before release.
  * Lots of new policy patches.
  * Make it depend and build depend on version 3.0 of all libraries
  * Makde the default_contexts have sysadm_r with a higher preference than
    staff_r for sshd_t
  * Made dbus a base module

 -- Russell Coker <russell@coker.com.au>  Sat, 02 May 2020 19:20:27 +1000

refpolicy (2:2.20190201-9) unstable; urgency=medium

  * Some more small policy fixes

 -- Russell Coker <russell@coker.com.au>  Wed, 29 Apr 2020 19:32:04 +1000

refpolicy (2:2.20190201-8) unstable; urgency=medium

  * Team upload.
  * debian/patches/0001-remove-incorrect-usage-of-is.patch: Fix FTBFS with
    python 3.8 (Closes: #954510)

 -- Laurent Bigonville <bigon@debian.org>  Thu, 02 Apr 2020 10:59:43 +0200

refpolicy (2:2.20190201-7.1) unstable; urgency=medium

  * Non-maintainer upload.
  * source only upload to enable migration (Closes: #954018)

 -- Paul Gevers <elbrus@debian.org>  Sun, 15 Mar 2020 20:28:12 +0100

refpolicy (2:2.20190201-7) unstable; urgency=medium

  * Allow sysadm_r to bypass UBAC checks (experimental)
  * Make cron work for sysadm_t
  * Minor policy changes

 -- Russell Coker <russell@coker.com.au>  Wed, 15 Jan 2020 18:53:25 +1100

refpolicy (2:2.20190201-6) unstable; urgency=medium

  * Team upload.
  * debian/rules: Cleanup the support/__pycache__ directory when building the
    selinux-policy-src package
  * debian/rules: Set the timezone to UTC before creating the
    selinux-policy-src tarball, that should make it reproductible

 -- Laurent Bigonville <bigon@debian.org>  Thu, 26 Dec 2019 13:34:27 +0100

refpolicy (2:2.20190201-5) unstable; urgency=medium

  * Team upload.
  * Bump Standards-Version to 4.4.0 (no further changes)
  * debian/control: Remove the package (-1) revision from the
    {build-}dependencies, to please lintian
  * Drop debian/source/lintian-overrides, the postrm perl scripts are gone
    for a long time, not sure why these overrides were reintroduced
  * debian/rules: Do not call dpkg-parsechangelog explicitly to get a
    reproductible build time but rely on SOURCE_DATE_EPOCH variable
  * debian/watch: Fix the URL now that the project has been relocated

 -- Laurent Bigonville <bigon@debian.org>  Tue, 27 Aug 2019 15:54:34 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog selinux-policy-src`.
