1 * setfiles/restorecon: fix -r/-R option, from Petr Lautrbach. 2 * org.selinux.policy: Require auth_admin_keep for all actions, from Stephen Smalley. 3 * hll: Move core functions of pp to libsepol, from James Carter 4 * run_init: Use a ring buffer in open_init_pty, from Jason Zaman. 5 * run_init: fix open_init_pty availability check, from Nicolas Iooss. 6 * Widen Xen IOMEM context entries, from Daniel De Graaf. 7 * Fix -Wformat errors with gcc-5.0.0, from Petr Lautrbach. 8 * Fixed typo/grammatical error, from Christopher Peterson. 9 * Fix typo in semanage-port man page, from Andrew Spiers. 10 11 2.4 2015-02-02 12 * Fix bugs found by hardened gcc flags, from Nicolas Iooss. 13 * Improve support for building with different versions of python from 14 Nicolas Iooss. 15 * Ensure XDG_RUNTIME_DIR is passed through to the sandbox in seunshare, 16 from Dan Walsh 17 * Remove cgroups from sandbox, from Dan Walsh 18 * Try to use setcurrent before setexec in seunshare, from Andy Lutomirski 19 * Stop using the now deprecated flask.h and av_permissions.h, from Stephen Smalley 20 * Add a store root path in semodule, from Yuli Khodorkovskiy 21 * Add a flag to ignore cached CIL files and recompile HLL modules, from 22 Yuli Khodorkovskiy 23 * Add and install HLL compiler for policy packages to CIL. The compiler is 24 installed in /var/libexec/selinux/hll/ by default, from Steve Lawrence 25 * Fixes to pp compiler to better support roles and type attributes, from 26 Yuli Khodorkovskiy 27 * Deprecate base/upgrade/version in semodule. Calling these commands will 28 now call --install on the backend, from Yuli Khodorkovskiy 29 * Add ability to install modules with a specified priority, from Caleb 30 Case 31 * Use /tmp for permissive module creation, by Caleb Case 32 * Update semanage to use new source policy infrastructure, from Jason Dana 33 * Add RuntimeDirectory to mcstrans systemd unit file, from Laurent 34 Bigonville 35 36 2.3 2014-05-06 37 * Add -P semodule option to man page from Dan Walsh. 38 * selinux_current_policy_path will return none on a disabled SELinux system from Dan Walsh. 39 * Add new icons for sepolicy gui from Dan Walsh. 40 * Only return writeable files that are enabled from Dan Walsh. 41 * Add domain to short list of domains, when -t and -d from Dan Walsh. 42 * Fix up desktop files to match current standards from Dan Walsh. 43 * Add support to return sensitivities and categories for python from Dan Walsh. 44 * Cleanup whitespace from Dan Walsh. 45 * Add message to tell user to install sandbox policy from Dan Walsh. 46 * Add systemd unit file for mcstrans from Laurent Bigonville. 47 * Improve restorecond systemd unit file from Laurent Bigonville. 48 * Minor man pages improvements from Laurent Bigonville. 49 50 2.2.5 2013-12-09 51 * Ignore selevel/serange if MLS is disabled from Sven Vermeulen. 52 53 2.2.4 2013-11-26 54 * Revert automatic setting of serange and seuser in seobject; was breaking non-MLS systems. 55 56 2.2.3 2013-11-13 57 * Apply polkit check on all dbus interfaces and restrict to active user from Dan Walsh. 58 * Fix typo in sepolicy gui dbus.relabel_on_boot call from Dan Walsh. 59 60 2.2.2 2013-11-06 61 * Remove import policycoreutils.default_encoding_utf8 from semanage from Dan Walsh. 62 63 2.2.1 2013-10-31 64 * Make yum/extract_rpms optional for sepolicy generate from Dan Walsh. 65 * Add test suite for audit2allow and sepolgen-ifgen from Dan Walsh. 66 67 2.2 2013-10-30 68 * Properly build the swig exception file from Laurent Bigonville. 69 * Fix man pages from Laurent Bigonville. 70 * Support overriding PATH and INITDIR in Makefile from Laurent Bigonville. 71 * Fix LDFLAGS usage from Laurent Bigonville. 72 * Fix init_policy warning from Laurent Bigonville. 73 * Fix semanage logging from Laurent Bigonville. 74 * Open newrole stdin as read/write from Sven Vermeulen. 75 * Fix sepolicy transition from Sven Vermeulen. 76 * Support overriding CFLAGS from Simon Ruderich. 77 * Create correct man directory for run_init from Russell Coker. 78 * restorecon GLOB_BRACE change from Michal Trunecka. 79 * Extend audit2why to report additional constraint information. 80 * Catch IOError errors within audit2allow from Dan Walsh. 81 * semanage export/import fixes from Dan Walsh. 82 * Improve setfiles progress reporting from Dan Walsh. 83 * Document setfiles -o option in usage from Dan Walsh. 84 * Change setfiles to always return -1 on failure from Dan Walsh. 85 * Improve setsebool error r eporting from Dan Walsh. 86 * Major overhaul of gui from Dan Walsh. 87 * Fix sepolicy handling of non-MLS policy from Dan Walsh. 88 * Support returning type aliases from Dan Walsh. 89 * Add sepolicy tests from Dan Walsh. 90 * Add org.selinux.config.policy from Dan Walsh. 91 * Improve range and user input checking by semanage from Dan Walsh. 92 * Prevent source or target arguments that end with / for substitutions from Dan Walsh. 93 * Allow use of <<none>> for semanage fcontext from Dan Walsh. 94 * Report customized user levels from Dan Walsh. 95 * Support deleteall for restoring disabled modules from Dan Walsh. 96 * Improve semanage error reporting from Dan Walsh. 97 * Only list disabled modules for module locallist from Dan Walsh. 98 * Fix logging from Dan Walsh. 99 * Define new constants for file type character codes from Dan Walsh. 100 * Improve bash completions from Dan Walsh. 101 * Convert semanage to argparse from Dan Walsh (originally by Dave Quigley). 102 * Add semanage tests from Dan Walsh. 103 * Split semanage man pages from Dan Walsh. 104 * Move bash completion scripts from Dan Walsh. 105 * Replace genhomedircon script with a link to semodule from Dan Walsh. 106 * Fix fixfiles from Dan Walsh. 107 * Add support for systemd service for restorecon from Dan Walsh. 108 * Spelling corrections from Dan Walsh. 109 * Improve sandbox support for home dir symlinks and file caps from Dan Walsh. 110 * Switch sandbox to openbox window manager from Dan Walsh. 111 * Coalesce audit2why and audit2allow from Dan Walsh. 112 * Change audit2allow to append to output file from Dan Walsh. 113 * Update translations from Dan Walsh. 114 * Change audit2why to use selinux_current_policy_path from Dan Walsh. 115 116 2.1.14 2013-02-01 117 * setfiles: estimate percent progress 118 * load_policy: make link at the destination directory 119 * Rebuild polgen.glade with glade-3 120 * sepolicy: new command to unite small utilities 121 * sepolicy: Update Makefiles and po files 122 * sandbox: use sepolicy to look for sandbox_t 123 * gui: switch to use sepolicy 124 * gui: sepolgen: use sepolicy to generate 125 * semanage: use sepolicy for boolean dictionary 126 * add po file configuration information 127 * po: stop running update-po on all 128 * semanage: seobject verify policy types before allowing you to assign them. 129 * gui: Start using Popen, instead of os.spawnl 130 * sandbox: Copy /var/tmp to /tmp as they are the same inside 131 * qualifier to shred content 132 * semanage: Fix handling of boolean_sub names when using the -F flag 133 * semanage: man: roles instead of role 134 * gui: system-config-selinux: Catch no DISPLAY= error 135 * setfiles: print error if no default label found 136 * semanage: list logins file entries in semanage login -l 137 * semanage: good error message is sepolgen python module missing 138 * gui: system-config-selinux: do not use lokkit 139 * secon: add support for setrans color information in prompt output 140 * restorecond: remove /etc/mtab from default list 141 * gui: If you are not able to read enforcemode set it to False 142 * genhomedircon: regenerate genhomedircon more often 143 * restorecond: Add /etc/udpatedb.conf to restorecond.conf 144 * genhomedircon generation to allow spec file to pass in SEMODULE_PATH 145 * fixfiles: relabel only after specific date 146 * po: update translations 147 * sandbox: seunshare: do not reassign realloc value 148 * seunshare: do checking on setfsuid 149 * sestatus: rewrite to shut up coverity 150 151 2.1.13 2012-09-13 152 * genhomedircon: manual page improvements 153 * setfiles/restorecon minor improvements 154 * run_init: If open_init_pty is not available then just use exec 155 * newrole: do not drop capabilities when newrole is run as 156 * restorecon: only update type by default 157 * scripts: Don't syslog setfiles changes on a fixfiles restore 158 * setfiles: do not syslog if no changes 159 * Disable user restorecond by default 160 * Make restorecon return 0 when a file has changed context 161 * setfiles: Fix process_glob error handling 162 * semanage: allow enable/disable under -m 163 * add .tx to gitignore 164 * translations: commit translations from Fedora community 165 * po: silence build process 166 * gui: Checking in policy to support polgengui and sepolgen. 167 * gui: polgen: search for systemd subpackage when generating policy 168 * gui: for exploring booleans 169 * gui: system-config-selinux gui 170 * Add Makefiles to support new gui code 171 * gui: remove lockdown wizard 172 * return equivalency records in fcontext customized 173 * semanage: option to not load new policy into kernel after 174 * sandbox: manpage update to describe standard types 175 * setsebool: -N should not reload policy on changes 176 * semodule: Add -N qualifier to no reload kernel policy 177 * gui: polgen: sort selinux types of user controls 178 * gui: polgen: follow symlinks and get the real path to 179 * gui: Fix missing error function 180 * setfiles: return errors when bad paths are given 181 * fixfiles: tell restorecon to ignore missing paths 182 * setsebool: error when setting multiple options 183 * semanage: use boolean subs. 184 * sandbox: Make sure Xephyr never listens on tcp ports 185 * sepolgen: return and output constraint violation information 186 * semanage: skip comments while reading external configuration files 187 * restorecond: relabel all mount runtime files in the restorecond example 188 * genhomedircon: dynamically create genhomedircon 189 190 2.1.12 2012-06-28 191 * restorecond: wrong options should exit with non-zero error code 192 * restorecond: Add -h option to get usage command 193 * resorecond: user: fix fd leak 194 * mcstrans: add -f to run in foreground 195 * semanage: fix man page range and level defaults 196 * semanage: bash completion for modules should include -a,-m, -d 197 * semanage: manpage update for -e 198 * semanage: dontaudit off should work 199 * semanage: locallist option does not take an argument 200 * sepolgen: Make use of setools optional within sepolgen 201 202 2.1.11 2012-03-28 203 * sandbox: do not propogate inside mounts outside 204 * sandbox: Removing sandbox init script, should no longer be necessary 205 * restorecond: Stop using deprecated interfaces for g_io 206 * semanage: proper auditting of user changes for LSPP 207 * semanage: audit message to show what record(s) and item(s) have chaged 208 * scripts: Update Makefiles to handle /usrmove 209 * mcstrans: Version should have been bumped on last check in 210 * seunshare: Only drop caps not the Bounding Set from seunshare 211 * Add bash-completion scripts for setsebool and semanage 212 * newrole: Use correct capng calls in newrole 213 * Fix infinite loop with inotify on 2.6.31 kernels 214 * fix ftbfs with hardening flags 215 * Only run setfiles if we found read-write filesystems to run it on 216 * update .po files 217 * remove empty po files 218 * do not fail to install if unable to make load_policy lnk file 219 220 2.1.10 2011-12-21 221 * Remove excess whitespace 222 * sandbox: Add back in . functions to sandbox.init script 223 * Fix Makefile to match other policycoreutils Makefiles 224 * semanage: drop unused translation getopt 225 226 2.1.9 2011-12-05 227 * sandbox: move sandbox.conf.5 to just sandbox.5 228 * po: Makefile use -p to preserve times to allow multilib simultatious installs 229 * of po files 230 * sandbox: Allow user to specify the DPI value for X in a sandbox 231 * sandbox: make sure the domain launching sandbox has at least 100 categories 232 * sandbox: do not try forever to find available category set 233 * sandbox: only complain if sandbox unable to launch 234 * sandbox: init script run twice is still successful 235 * semanage: print local and dristo equiv rules 236 * semanage: check file equivalence rules for conflict 237 * semanage: Make sure semanage fcontext -l -C prints even if local keys 238 * are not defined 239 * semanage: change src,dst to target,substitute for equivalency 240 * sestatus: Updated sestatus and man pages. 241 * Added SELinux config file man page. 242 * add clean target to man Makefile 243 244 2.1.8 2011-11-03 245 * sandbox: Maintain the LANG environment into the sandbox 246 * audit2allow: use audit2why internally 247 * fixfiles: label /root but not /var/lib/BackupPC 248 * semanage: update local boolean settings is dealing with localstore 249 * semanage: missing modify=True 250 * semanage: set modified correctly 251 * restorecond: make restorecond dbuss-able 252 * restorecon: Always check return code on asprintf 253 * restorecond: make restorecond -u exit when terminal closes 254 * sandbox: introduce package name and language stuff 255 * semodule_package: remove semodule_unpackage on clean 256 * fix sandbox Makefile to support DESTDIR 257 * semanage: Add -o description to the semanage man page 258 * make use of the new realpath_not_final function 259 * setfiles: close /proc/mounts file when finished 260 * semodule: Document semodule -p in man page 261 * setfiles: fix use before initialized 262 * restorecond: Add .local/share as a directory to watch 263 264 2.1.7 2011-09-27 265 * semanage: fix indentation error in seobject 266 267 2.1.6 2011-09-15 268 * sepolgen-ifgen: new attr-helper does something 269 * audit2allow: use alternate policy file 270 * audit2allow: sepolgen-ifgen use the attr helper 271 * setfiles: switch from stat to stat64 272 * setfiles: Fix potential crash using dereferenced ftsent 273 * setfiles: do not wrap * output at 80 characters 274 * sandbox: add -Wall and -Werror to makefile 275 * sandbox: add sandbox cgroup support 276 * sandbox: rewrite /tmp handling 277 * sandbox: do not bind mount so much 278 * sandbox: add level based kill option 279 * sandbox: cntrl-c should kill entire process control group 280 * Create a new preserve_tunables flag in sepol_handle_t. 281 * semanage: show running and disk setting for booleans 282 * semanage: Dont print heading if no items selected 283 * sepolgen: audit2allow is mistakakenly not allowing valid module names 284 * semanage: Catch RuntimeErrors, that can be generated when SELinux is disabled 285 * More files to ignore 286 * tree: default make target to all not install 287 * sandbox: do not load unused generic init functions 288 289 2.1.5 2011-08-26 290 * setfiles: Fix process_glob to handle error situations 291 * sandbox: Allow seunshare to run as root 292 * sandbox: trap sigterm to make sure sandbox 293 * sandbox: pass DPI from the desktop 294 * sandbox: seunshare: introduce helper spawn_command 295 * sandbox: seunshare: introduce new filesystem helpers 296 * sandbox: add -C option to not drop 297 * sandbox: split seunshare caps dropping 298 * sandbox: use dbus-launch 299 * sandbox: numerous simple updates to sandbox 300 * sandbox: do not require selinux context 301 * sandbox: Makefile: new man pages 302 * sandbox: rename dir to srcdir 303 * sandbox: allow users specify sandbox window size 304 * sandbox: check for paths up front 305 * sandbox: use defined values for paths rather 306 * sandbox: move seunshare globals to the top 307 * sandbox: whitespace fix 308 * semodule_package: Add semodule_unpackage executable 309 * setfiles: get rid of some stupid globals 310 * setfiles: move exclude_non_seclabel_mounts to a generic location 311 312 2.1.4 2011-08-17 313 * run_init: clarification of the usage in the 314 * semanage: fix usage header around booleans 315 * semanage: remove useless empty lines 316 * semanage: update man page with new examples 317 * semanage: update usage text 318 * semanage: introduce file context equivalencies 319 * semanage: enable and disable modules 320 * semanage: output all local modifications 321 * semanage: introduce extraction of local configuration 322 * semanage: cleanup error on invalid operation 323 * semanage: handle being called with no arguments 324 * semanage: return sooner to save CPU time 325 * semanage: surround getopt with try/except 326 * semanage: use define/raise instead of lots of 327 * semanage: some options are only valid for 328 * semanage: introduce better deleteall support 329 * semanage: do not allow spaces in file 330 * semanage: distinguish between builtin and local permissive 331 * semanage: centralized ip node handling 332 * setfiles: make the restore function exclude() non-static 333 * setfiles: use glob to handle ~ and 334 * fixfiles: do not hard code types 335 * fixfiles: stop trying to be smart about 336 * fixfiles: use new kernel seclabel option 337 * fixfiles: pipe everything to cat before sending 338 * fixfiles: introduce /etc/selinux/fixfiles_exclude_dirs 339 * semodule: support for alternative root paths 340 341 2.1.3 2011-08-03 342 * semanage: fix indention 343 * semodule_package: fix man page typo 344 * semodule_expand: update man page with -a 345 * semanage: handle os errors 346 * semanage: fix traceback with bad options 347 * semanage: show usage on -h or --help 348 * semanage: introduce more deleteall options 349 * semanage: verify ports < 65536 350 * transaction into semanageRecords 351 * make get_handle a method of semanageRecords 352 * remove a needless blank line 353 * make process_one error if not initialized correctly 354 * fixfiles: correct usage for r_opts.rootpath 355 * put -p in help for restorecon and 356 * fixfiles: do not try to only label 357 * fixfiles clean up /var/run and /var/lib/debug 358 * fixfiles delete tmp sockets and pipes rather 359 * fixfile use find -delete instead of pipe 360 * chcat man page typo 361 * add man page for genhomedircon 362 * setfiles fix typo 363 * setsebool should inform users they need to 364 * setsebool typos 365 * open_init_tty man page typos 366 * Don't add user site directory to sys.path 367 * newrole retain CAP_SETPCAP 368 369 2.1.2 2011-08-02 370 * seunshare: define _GNU_SOURCE earlier 371 * make ignore_enoent do something 372 * restorecond: first user logged in is not noticed 373 * Repo: update .gitignore 374 375 2.1.1 2011-08-01 376 * Man page updates 377 * restorecon fix for bad inotify assumptions 378 379 2.1.0 2011-07-27 380 * Release, minor version bump 381 382 2.0.86 2011-04-11 383 * Use correct color range in mcstrand by Richard Haines. 384 385 2.0.85 2010-12-20 386 * Move newrole to use libcap-ng from Dan Walsh 387 388 2.0.84 2010-11-16 389 * Add mcstrans support from Ted Toth with modifications from Steve Lawrence. 390 391 2.0.83 2010-06-10 392 * Add sandbox support from Dan Walsh with modifications from Steve Lawrence. 393 394 2.0.82 2010-03-12 395 * Add avc's since boot from Dan Walsh. 396 397 2.0.81 2010-03-12 398 * Add dontaudit flag to audit2allow from Dan Walsh. 399 400 2.0.80 2010-03-06 401 * Module enable/disable support from Dan Walsh. 402 403 2.0.79 2010-01-26 404 * Fix double-free in newrole 405 406 2.0.78 2009-11-27 407 * Remove non-working OUTFILE from fixfiles from Dan Walsh. 408 * Additional exception handling in chcat from Dan Walsh. 409 410 2.0.77 2009-11-19 411 * Fixed bug preventing semanage node -a from working 412 from Chad Sellers 413 * Fixed bug preventing semanage fcontext -l from working 414 from Chad Sellers 415 416 2.0.76 2009-11-18 417 * Remove setrans management from semanage, as it does not work 418 from Dan Walsh. 419 * Move load_policy from /usr/sbin to /sbin from Dan Walsh. 420 421 2.0.75 2009-11-02 422 * Factor out restoring logic from setfiles.c into restore.c 423 424 2.0.74 2009-09-16 425 * Change semodule upgrade behavior to install even if the module 426 is not present from Dan Walsh. 427 * Make setfiles label if selinux is disabled and a seclabel aware 428 kernel is running from Caleb Case. 429 * Clarify forkpty() error message in run_init from Manoj Srivastava. 430 431 2.0.73 2009-09-04 432 * Add semanage dontaudit to turn off dontaudits from Dan Walsh. 433 * Fix semanage to set correct mode for setrans file from Dan Walsh. 434 * Fix malformed dictionary in portRecord from Dan Walsh. 435 436 2.0.72 2009-09-03 437 * Restore symlink handling support to restorecon based on a patch by 438 Martin Orr. This fixes the restorecon /dev/stdin performed by Debian 439 udev scripts that was broken by policycoreutils 2.0.70. 440 441 2.0.71 2009-08-11 442 * Modify setfiles/restorecon checking of exclude paths. Only check 443 user-supplied exclude paths (not automatically generated ones based on 444 lack of seclabel support), don't require them to be directories, and 445 ignore permission denied errors on them (it is ok to exclude a path to 446 which the caller lacks permission). 447 448 2.0.70 2009-08-04 449 * Modify restorecon to only call realpath() on user-supplied pathnames 450 from Stephen Smalley. 451 452 2.0.69 2009-07-30 453 * Fix typo in fixfiles that prevented it from relabeling btrfs 454 filesystems from Dan Walsh. 455 456 2.0.68 2009-07-24 457 * Modify setfiles to exclude mounts without seclabel option in 458 /proc/mounts on kernels >= 2.6.30 from Thomas Liu. 459 460 2.0.67 2009-07-07 461 * Re-enable disable_dontaudit rules upon semodule -B from Christopher 462 Pardy and Dan Walsh. 463 464 2.0.66 2009-07-07 465 * setfiles converted to fts from Thomas Liu. 466 467 2.0.65 2009-06-24 468 * Remove gui from po/Makefile and po/POTFILES and regenerate po files 469 470 2.0.64 2009-06-22 471 * Keep setfiles from spamming console from Dan Walsh. 472 * Fix chcat's category expansion for users from Dan Walsh. 473 474 2.0.63 2009-05-15 475 * Fix transaction checking from Dan Walsh. 476 * Make fixfiles -R (for rpm) recursive. 477 * Make semanage permissive clean up after itself from Dan Walsh. 478 * add /root/.ssh/* to restorecond.conf 479 480 2.0.62 2009-02-19 481 * Add btrfs to fixfiles from Dan Walsh. 482 * Remove restorecond error for matching globs with multiple hard links 483 and fix some error messages from Dan Walsh. 484 * Make removing a non-existant module a warning rather than an error 485 from Dan Walsh. 486 * Man page fixes from Dan Walsh. 487 488 2.0.61 2009-01-12 489 * chcat: cut categories at arbitrary point (25) from Dan Walsh 490 * semodule: use new interfaces in libsemanage for compressed files 491 from Dan Walsh 492 * audit2allow: string changes for usage 493 494 2.0.60 2008-11-12 495 * semanage: use semanage_mls_enabled() from Stephen Smalley. 496 497 2.0.59 2008-11-11 498 * fcontext add checked local records twice, fix from Dan Walsh. 499 500 2.0.58 2008-11-09 501 * Allow local file context entries to override policy entries in 502 semanage from Dan Walsh. 503 * Newrole error message corrections from Dan Walsh. 504 * Add exception to audit2why call in audit2allow from Dan Walsh. 505 506 2.0.57 2008-09-18 507 * Update po files from Dan Walsh. 508 509 2.0.56 2008-09-12 510 * fixfiles will now remove all files in /tmp and will check for 511 unlabeled_t in /tmp and /var/tmp from Dan Walsh. 512 * add glob support to restorecond from Dan Walsh. 513 * allow semanage to handle multi-line commands in a single transaction 514 from Dan Walsh. 515 516 2.0.55 2008-08-26 517 * Merged semanage node support from Christian Kuester. 518 519 2.0.54 2008-08-05 520 * Add support for boolean files and group support for seusers from Dan Walsh. 521 * Ensure that setfiles -p output is newline terminated from Russell Coker. 522 523 2.0.53 2008-07-29 524 * Change setfiles to validate all file_contexts files when using -c from Stephen Smalley. 525 526 2.0.52 2008-07-02 527 * Add permissive domain capability to semanage from Dan Walsh. 528 529 2.0.51 2008-06-28 530 * Add onboot option to fixfiles from Dan Walsh. 531 * Change restorecon.init to not run on boot by default from Dan Walsh. 532 533 2.0.50 2008-06-30 534 * Fix audit2allow generation of role-type rules from Karl MacMillan. 535 536 2.0.49 2008-05-16 537 * Remove security_check_context calls for prefix validation from semanage. 538 539 2.0.48 2008-05-16 540 * Change setfiles and restorecon to not relabel if the file already has the correct context value even if -F/force is specified. 541 542 2.0.47 2008-04-18 543 * Update semanage man page for booleans from Dan Walsh. 544 * Add further error checking to seobject.py for setting booleans. 545 546 2.0.46 2008-03-18 547 * Update audit2allow to report dontaudit cases from Dan Walsh. 548 549 2.0.45 2008-03-18 550 * Fix semanage port to use --proto from Caleb Case. 551 552 2.0.44 2008-02-22 553 * Fixed semodule to correctly handle error when unable to create a handle. 554 555 2.0.43 2008-02-08 556 * Merged fix fixfiles option processing from Vaclav Ovsik. 557 558 2.0.42 2008-02-02 559 * Make semodule_expand use sepol_set_expand_consume_base to reduce 560 peak memory usage. 561 562 2.0.41 2008-01-28 563 * Merged audit2why fix and semanage boolean --on/--off/-1/-0 support from Dan Walsh. 564 565 2.0.40 2008-01-25 566 * Merged a second fixfiles -C fix from Marshall Miller. 567 568 2.0.39 2008-01-24 569 * Merged fixfiles -C fix from Marshall Miller. 570 571 2.0.38 2008-01-24 572 * Merged audit2allow cleanups and boolean descriptions from Dan Walsh. 573 * Merged setfiles -0 support by Benny Amorsen via Dan Walsh. 574 * Merged fixfiles fixes and support for ext4 and gfs2 from Dan Walsh. 575 576 2.0.37 2008-01-23 577 * Merged replacement for audit2why from Dan Walsh. 578 579 2.0.36 2008-01-23 580 * Merged update to chcat, fixfiles, and semanage scripts from Dan Walsh. 581 582 2.0.35 2007-12-21 583 * Merged support for non-interactive newrole command invocation from Tim Reed. 584 585 2.0.34 2007-12-14 586 * Update Makefile to not build restorecond if 587 /usr/include/sys/inotify.h is not present 588 589 2.0.33 2007-12-07 590 * Drop verbose output on fixfiles -C from Dan Walsh. 591 * Fix argument handling in fixfiles from Dan Walsh. 592 * Enhance boolean support in semanage, including using the .xml description when available, from Dan Walsh. 593 594 2.0.32 2007-10-16 595 * load_policy initial load option from Chad Sellers. 596 597 2.0.31 2007-10-15 598 * Fix semodule option handling from Dan Walsh. 599 600 2.0.30 2007-10-11 601 * Add deleteall support for ports and fcontexts in semanage from Dan Walsh. 602 603 2.0.29 2007-10-05 604 * Add genhomedircon script to invoke semodule -Bn from Dan Walsh. 605 606 2.0.28 2007-10-05 607 * Update semodule man page for -D from Dan Walsh. 608 * Add boolean, locallist, deleteall, and store support to semanage from Dan Walsh. 609 610 2.0.27 2007-09-19 611 * Improve semodule reporting of system errors from Stephen Smalley. 612 613 2.0.26 2007-09-18 614 * Fix setfiles selabel option flag setting for 64-bit from Stephen Smalley. 615 616 2.0.25 2007-08-23 617 * Remove genhomedircon script (functionality is now provided 618 within libsemanage) from Todd Miller. 619 620 2.0.24 2007-08-23 621 * Fix genhomedircon searching for USER from Todd Miller 622 * Install run_init with mode 0755 from Dan Walsh. 623 * Fix chcat from Dan Walsh. 624 * Fix fixfiles pattern expansion and error reporting from Dan Walsh. 625 * Optimize genhomedircon to compile regexes once from Dan Walsh. 626 * Fix semanage gettext call from Dan Walsh. 627 628 2.0.23 2007-08-16 629 * Disable dontaudits via semodule -D 630 631 2.0.22 2007-06-20 632 * Rebase setfiles to use new labeling interface. 633 634 2.0.21 2007-06-13 635 * Fixed setsebool (falling through to error path on success). 636 637 2.0.20 2007-06-05 638 * Merged genhomedircon fixes from Dan Walsh. 639 * Merged setfiles -c usage fix from Dan Walsh. 640 * Merged restorecon fix from Yuichi Nakamura. 641 * Dropped -lsepol where no longer needed. 642 643 2.0.19 2007-05-11 644 * Merge newrole support for alternate pam configs from Ted X Toth. 645 646 2.0.18 2007-05-11 647 * Merged merging of restorecon into setfiles from Stephen Smalley. 648 649 2.0.17 2007-05-09 650 * Merged genhomedircon fix to find conflicting directories correctly from Dan Walsh. 651 652 2.0.16 2007-05-03 653 * Merged support for modifying the prefix via semanage from Dan Walsh. 654 655 2.0.15 2007-04-26 656 * Merged move of audit2why to /usr/bin from Dan Walsh. 657 658 2.0.14 2007-04-25 659 * Build fix for setsebool. 660 661 2.0.13 2007-04-24 662 * Merged setsebool patch to only use libsemanage for persistent boolean changes from Stephen Smalley. 663 664 2.0.12 2007-04-24 665 * Merged genhomedircon patch to use the __default__ setting from Dan Walsh. 666 667 2.0.11 2007-04-24 668 * Dropped -b option from load_policy in preparation for always preserving booleans across reloads in the kernel. 669 670 2.0.10 2007-04-24 671 * Merged chcat, fixfiles, genhomedircon, restorecond, and restorecon patches from Dan Walsh. 672 673 2.0.9 2007-04-12 674 * Merged seobject setransRecords patch to return the first alias from Xavier Toth. 675 676 2.0.8 2007-04-10 677 * Merged updates to sepolgen-ifgen from Karl MacMillan. 678 679 2.0.7 2007-03-01 680 * Merged restorecond init script LSB compliance patch from Steve Grubb. 681 682 2.0.6 2007-02-22 683 * Merged newrole O_NONBLOCK fix from Linda Knippers. 684 685 2.0.5 2007-02-22 686 * Merged sepolgen and audit2allow patches to leave generated files 687 in the current directory from Karl MacMillan. 688 689 2.0.4 2007-02-22 690 * Merged restorecond memory leak fix from Steve Grubb. 691 692 2.0.3 2007-02-21 693 * Merged translations update from Dan Walsh. 694 * Merged chcat fixes from Dan Walsh. 695 * Merged man page fixes from Dan Walsh. 696 * Merged seobject prefix validity checking from Dan Walsh. 697 698 2.0.2 2007-02-20 699 * Merged seobject exception handler fix from Caleb Case. 700 * Merged setfiles memory leak patch from Todd Miller. 701 702 2.0.1 2007-02-08 703 * Merged small fix to correct include of errcodes.h in semodule_deps from Dan Walsh. 704 705 2.0.0 2007-02-05 706 * Merged new audit2allow from Karl MacMillan. 707 This audit2allow depends on the new sepolgen python module. 708 Note that you must run the sepolgen-ifgen tool to generate 709 the data needed by audit2allow to generate refpolicy. 710 711 1.34.1 2007-01-22 712 * Fixed newrole non-pam build. 713 714 1.34.0 2007-01-18 715 * Updated version for stable branch. 716 717 1.33.16 2007-01-18 718 * Merged po file updates from Dan Walsh. 719 * Removed update-po from all target in po/Makefile. 720 721 1.33.15 2007-01-17 722 * Merged unicode-to-string fix for seobject audit from Dan Walsh. 723 * Merged man page updates to make "apropos selinux" work from Dan Walsh. 724 725 1.33.14 2007-01-16 726 * Merged newrole man page patch from Michael Thompson. 727 728 1.33.13 2007-01-16 729 * Merged patch to fix python unicode problem from Dan Walsh. 730 731 1.33.12 2007-01-11 732 * Merged newrole securetty check from Dan Walsh. 733 * Merged semodule patch to generalize list support from Karl MacMillan. 734 735 1.33.11 2007-01-09 736 * Merged fixfiles and seobject fixes from Dan Walsh. 737 * Merged semodule support for list of modules after -i from Karl MacMillan. 738 739 1.33.10 2007-01-08 740 * Merged patch to correctly handle a failure during semanage handle 741 creation from Karl MacMillan. 742 743 1.33.9 2007-01-05 744 * Merged patch to fix seobject role modification from Dan Walsh. 745 746 1.33.8 2007-01-04 747 * Merged patches from Dan Walsh to: 748 - omit the optional name from audit2allow 749 - use the installed python version in the Makefiles 750 - re-open the tty with O_RDWR in newrole 751 752 1.33.7 2007-01-03 753 * Patch from Dan Walsh to correctly suppress warnings in load_policy. 754 755 1.33.6 2006-11-29 756 * Patch from Dan Walsh to add an pam_acct_msg call to run_init 757 * Patch from Dan Walsh to fix error code returns in newrole 758 * Patch from Dan Walsh to remove verbose flag from semanage man page 759 * Patch from Dan Walsh to make audit2allow use refpolicy Makefile 760 in /usr/share/selinux/<SELINUXTYPE> 761 762 1.33.5 2006-11-27 763 * Merged patch from Michael C Thompson to clean up genhomedircon 764 error handling. 765 1.33.4 2006-11-21 766 * Merged po file updates from Dan Walsh. 767 768 1.33.3 2006-11-21 769 * Merged setsebool patch from Karl MacMillan. 770 This fixes a bug reported by Yuichi Nakamura with 771 always setting booleans persistently on an unmanaged system. 772 773 1.33.2 2006-11-20 774 * Merged patch from Dan Walsh (via Karl MacMillan): 775 * Added newrole audit message on login failure 776 * Add /var/log/wtmp to restorecond.conf watch list 777 * Fix genhomedircon, semanage, semodule_expand man pages. 778 779 1.33.1 2006-11-13 780 * Merged newrole patch set from Michael Thompson. 781 782 1.32 2006-10-17 783 * Updated version for release. 784 785 1.30.31 2006-10-17 786 * Merged audit2allow -l fix from Yuichi Nakamura. 787 * Merged restorecon -i and -o - support from Karl MacMillan. 788 * Merged semanage/seobject fix from Dan Walsh. 789 * Merged fixfiles -R and verify changes from Dan Walsh. 790 791 1.30.30 2006-09-29 792 * Merged newrole auditing of failures due to user actions from 793 Michael Thompson. 794 795 1.30.29 2006-09-13 796 * Man page corrections from Dan Walsh 797 * Change all python invocations to /usr/bin/python -E 798 * Add missing getopt flags to genhomedircon 799 800 1.30.28 2006-09-01 801 * Merged fix for restorecon // handling from Erich Schubert. 802 * Merged translations update and fixfiles fix from Dan Walsh. 803 804 1.30.27 2006-08-24 805 * Merged fix for restorecon symlink handling from Erich Schubert. 806 807 1.30.26 2006-08-11 808 * Merged semanage local file contexts patch from Chris PeBenito. 809 810 1.30.25 2006-08-03 811 * Merged patch from Dan Walsh with: 812 * audit2allow: process MAC_POLICY_LOAD events 813 * newrole: run shell with - prefix to start a login shell 814 * po: po file updates 815 * restorecond: bail if SELinux not enabled 816 * fixfiles: omit -q 817 * genhomedircon: fix exit code if non-root 818 * semodule_deps: install man page 819 820 1.30.24 2006-08-03 821 * Merged secon Makefile fix from Joshua Brindle. 822 823 1.30.23 2006-08-03 824 * Merged netfilter contexts support patch from Chris PeBenito. 825 826 1.30.22 2006-07-28 827 * Merged restorecond size_t fix from Joshua Brindle. 828 829 1.30.21 2006-07-28 830 * Merged secon keycreate patch from Michael LeMay. 831 832 1.30.20 2006-07-26 833 * Merged restorecond fixes from Dan Walsh. 834 Merged updated po files from Dan Walsh. 835 836 1.30.19 2006-07-26 837 * Merged python gettext patch from Stephen Bennett. 838 839 1.30.18 2006-07-25 840 * Merged semodule_deps from Karl MacMillan. 841 842 1.30.17 2006-06-29 843 * Lindent. 844 845 1.30.16 2006-06-26 846 * Merged patch from Dan Walsh with: 847 * -p option (progress) for setfiles and restorecon. 848 * disable context translation for setfiles and restorecon. 849 * on/off values for setsebool. 850 851 1.30.15 2006-06-26 852 * Merged setfiles and semodule_link fixes from Joshua Brindle. 853 854 1.30.14 2006-06-16 855 * Merged fix for setsebool error path from Serge Hallyn. 856 857 1.30.13 2006-06-16 858 * Merged patch from Dan Walsh with: 859 * Updated po files. 860 * Fixes for genhomedircon and seobject. 861 * Audit message for mass relabel by setfiles. 862 863 1.30.12 2006-06-02 864 * Updated fixfiles script for new setfiles location in /sbin. 865 866 1.30.11 2006-05-26 867 * Merged more translations from Dan Walsh. 868 * Merged patch to relocate setfiles to /sbin for early relabel 869 when /usr might not be mounted from Dan Walsh. 870 * Merged semanage/seobject patch to preserve fcontext ordering in list. 871 * Merged secon patch from James Antill. 872 873 1.30.10 2006-05-22 874 * Merged patch with updates to audit2allow, secon, genhomedircon, 875 and semanage from Dan Walsh. 876 877 1.30.9 2006-05-08 878 * Fixed audit2allow and po Makefiles for DESTDIR= builds. 879 * Merged .po file patch from Dan Walsh. 880 * Merged bug fix for genhomedircon. 881 882 1.30.8 2006-05-08 883 * Merged patch from Dan Walsh. 884 This includes audit2allow changes for analysis plugins, 885 internationalization support for several additional programs 886 and added po files, some fixes for semanage, and several cleanups. 887 It also adds a new secon utility. 888 889 1.30.7 2006-05-05 890 * Merged fix warnings patch from Karl MacMillan. 891 892 1.30.6 2006-04-14 893 * Merged semanage prefix support from Russell Coker. 894 895 1.30.5 2006-04-11 896 * Added a test to setfiles to check that the spec file is 897 a regular file. 898 899 1.30.4 2006-03-29 900 * Merged audit2allow fixes for refpolicy from Dan Walsh. 901 * Merged fixfiles patch from Dan Walsh. 902 * Merged restorecond daemon from Dan Walsh. 903 904 1.30.3 2006-03-29 905 * Merged semanage non-MLS fixes from Chris PeBenito. 906 907 1.30.2 2006-03-29 908 * Merged semanage and semodule man page examples from Thomas Bleher. 909 910 1.30.1 2006-03-20 911 * Merged semanage labeling prefix patch from Ivan Gyurdiev. 912 913 1.30 2006-03-14 914 * Updated version for release. 915 916 1.29.28 2006-03-13 917 * Merged German translations (de.po) by Debian translation team from Manoj Srivastava. 918 919 1.29.27 2006-03-08 920 * Merged audit2allow -R support, chcat fix, semanage MLS checks 921 and semanage audit calls from Dan Walsh. 922 923 1.29.26 2006-02-15 924 * Merged semanage bug fix patch from Ivan Gyurdiev. 925 926 1.29.25 2006-02-14 927 * Merged improve bindings patch from Ivan Gyurdiev. 928 929 1.29.24 2006-02-14 930 * Merged semanage usage patch from Ivan Gyurdiev. 931 * Merged use PyList patch from Ivan Gyurdiev. 932 933 1.29.23 2006-02-13 934 * Merged newrole -V/--version support from Glauber de Oliveira Costa. 935 936 1.29.22 2006-02-13 937 * Merged genhomedircon prefix patch from Dan Walsh. 938 939 1.29.21 2006-02-13 940 * Merged optionals in base patch from Joshua Brindle. 941 942 1.29.20 2006-02-07 943 * Merged seuser/user_extra support patch to semodule_package 944 from Joshua Brindle. 945 946 1.29.19 2006-02-06 947 * Merged getopt type fix for semodule_link/expand and sestatus 948 from Chris PeBenito. 949 950 1.29.18 2006-02-02 951 * Merged clone record on set_con patch from Ivan Gyurdiev. 952 953 1.29.17 2006-01-30 954 * Merged genhomedircon fix from Dan Walsh. 955 956 1.29.16 2006-01-30 957 * Merged seusers.system patch from Ivan Gyurdiev. 958 * Merged improve port/fcontext API patch from Ivan Gyurdiev. 959 * Merged genhomedircon patch from Dan Walsh. 960 961 1.29.15 2006-01-27 962 * Merged newrole audit patch from Steve Grubb. 963 964 1.29.14 2006-01-27 965 * Merged seuser -> seuser local rename patch from Ivan Gyurdiev. 966 967 1.29.13 2006-01-27 968 * Merged semanage and semodule access check patches from Joshua Brindle. 969 970 1.29.12 2006-01-26 971 * Merged restorecon, chcat, and semanage patches from Dan Walsh. 972 973 1.29.11 2006-01-25 974 * Modified newrole and run_init to use the loginuid when 975 supported to obtain the Linux user identity to re-authenticate, 976 and to fall back to real uid. Dropped the use of the SELinux 977 user identity, as Linux users are now mapped to SELinux users 978 via seusers and the SELinux user identity space is separate. 979 980 1.29.10 2006-01-20 981 * Merged semanage bug fixes from Ivan Gyurdiev. 982 * Merged semanage fixes from Russell Coker. 983 * Merged chcat.8 and genhomedircon patches from Dan Walsh. 984 985 1.29.9 2006-01-19 986 * Merged chcat, semanage, and setsebool patches from Dan Walsh. 987 988 1.29.8 2006-01-18 989 * Merged semanage fixes from Ivan Gyurdiev. 990 * Merged semanage fixes from Russell Coker. 991 * Merged chcat, genhomedircon, and semanage diffs from Dan Walsh. 992 993 1.29.7 2006-01-13 994 * Merged newrole cleanup patch from Steve Grubb. 995 * Merged setfiles/restorecon performance patch from Russell Coker. 996 * Merged genhomedircon and semanage patches from Dan Walsh. 997 998 1.29.6 2006-01-12 999 * Merged remove add_local/set_local patch from Ivan Gyurdiev. 1000 1001 1.29.5 2006-01-05 1002 * Added filename to semodule error reporting. 1003 1004 1.29.4 2006-01-05 1005 * Merged genhomedircon and semanage patch from Dan Walsh. 1006 * Changed semodule error reporting to include argv[0]. 1007 1008 1.29.3 2006-01-04 1009 * Merged semanage getpwnam bug fix from Serge Hallyn (IBM). 1010 * Merged patch series from Ivan Gyurdiev. 1011 This includes patches to: 1012 - cleanup setsebool 1013 - update setsebool to apply active booleans through libsemanage 1014 - update semodule to use the new semanage_set_rebuild() interface 1015 - fix various bugs in semanage 1016 * Merged patch from Dan Walsh (Red Hat). 1017 This includes fixes for restorecon, chcat, fixfiles, genhomedircon, 1018 and semanage. 1019 1020 1.29.2 2005-12-14 1021 * Merged patch for chcat script from Dan Walsh. 1022 1023 1.29.1 2005-12-08 1024 * Merged fix for audit2allow long option list from Dan Walsh. 1025 * Merged -r option for restorecon (alias for -R) from Dan Walsh. 1026 * Merged chcat script and man page from Dan Walsh. 1027 1028 1.28 2005-12-07 1029 * Updated version for release. 1030 1031 1.27.37 2005-12-07 1032 * Clarified the genhomedircon warning message. 1033 1034 1.27.36 2005-12-05 1035 * Changed genhomedircon to warn on use of ROLE in homedir_template 1036 if using managed policy, as libsemanage does not yet support it. 1037 1038 1.27.35 2005-12-02 1039 * Merged genhomedircon bug fix from Dan Walsh. 1040 1041 1.27.34 2005-12-02 1042 * Revised semodule* man pages to refer to checkmodule and 1043 to include example sections. 1044 1045 1.27.33 2005-12-01 1046 * Merged audit2allow --tefile and --fcfile support from Dan Walsh. 1047 * Merged genhomedircon fix from Dan Walsh. 1048 * Merged semodule* man pages from Dan Walsh, and edited them. 1049 1050 1.27.32 2005-12-01 1051 * Changed setfiles to set the MATCHPATHCON_VALIDATE flag to 1052 retain validation/canonicalization of contexts during init. 1053 1054 1.27.31 2005-11-29 1055 * Changed genhomedircon to always use user_r for the role in the 1056 managed case since user_get_defrole is broken. 1057 1058 1.27.30 2005-11-29 1059 * Merged sestatus, audit2allow, and semanage patch from Dan Walsh. 1060 * Fixed semodule -v option. 1061 1062 1.27.29 2005-11-28 1063 * Merged audit2allow python script from Dan Walsh. 1064 (old script moved to audit2allow.perl, will be removed later). 1065 * Merged genhomedircon fixes from Dan Walsh. 1066 * Merged semodule quieting patch from Dan Walsh 1067 (inverts default, use -v to restore original behavior). 1068 1069 1.27.28 2005-11-15 1070 * Merged genhomedircon rewrite from Dan Walsh. 1071 1072 1.27.27 2005-11-09 1073 * Merged setsebool cleanup patch from Ivan Gyurdiev. 1074 1075 1.27.26 2005-11-09 1076 * Added -B (--build) option to semodule to force a rebuild. 1077 1078 1.27.25 2005-11-08 1079 * Reverted setsebool patch to call semanage_set_reload_bools(). 1080 * Changed setsebool to disable policy reload and to call 1081 security_set_boolean_list to update the runtime booleans. 1082 1083 1.27.24 2005-11-08 1084 * Changed setfiles -c to use new flag to set_matchpathcon_flags() 1085 to disable context translation by matchpathcon_init(). 1086 1087 1.27.23 2005-11-07 1088 * Changed setfiles for the context canonicalization support. 1089 1090 1.27.22 2005-11-07 1091 * Changed setsebool to call semanage_is_managed() interface 1092 and fall back to security_set_boolean_list() if policy is 1093 not managed. 1094 1095 1.27.21 2005-11-07 1096 * Merged setsebool memory leak fix from Ivan Gyurdiev. 1097 * Merged setsebool patch to call semanage_set_reload_bools() 1098 interface from Ivan Gyurdiev. 1099 1100 1.27.20 2005-11-04 1101 * Merged setsebool patch from Ivan Gyurdiev. 1102 This moves setsebool from libselinux/utils to policycoreutils, 1103 and rewrites it to use libsemanage for permanent boolean changes. 1104 1105 1.27.19 2005-10-25 1106 * Merged semodule support for reload, noreload, and store options 1107 from Joshua Brindle. 1108 * Merged semodule_package rewrite from Joshua Brindle. 1109 1110 1.27.18 2005-10-20 1111 * Cleaned up usage and error messages and releasing of memory by 1112 semodule_* utilities. 1113 1114 1.27.17 2005-10-20 1115 * Corrected error reporting by semodule. 1116 1117 1.27.16 2005-10-19 1118 * Updated semodule_expand for change to sepol interface. 1119 1120 1.27.15 2005-10-19 1121 * Merged fixes for make DESTDIR= builds from Joshua Brindle. 1122 1123 1.27.14 2005-10-18 1124 * Updated semodule_package for sepol interface changes. 1125 1126 1.27.13 2005-10-17 1127 * Updated semodule_expand/link for sepol interface changes. 1128 1129 1.27.12 2005-10-14 1130 * Merged non-PAM Makefile support for newrole and run_init from Timothy Wood. 1131 1132 1.27.11 2005-10-13 1133 * Updated semodule_expand to use get interfaces for hidden sepol_module_package type. 1134 1135 1.27.10 2005-10-13 1136 * Merged newrole and run_init pam config patches from Dan Walsh (Red Hat). 1137 1138 1.27.9 2005-10-13 1139 * Merged fixfiles patch from Dan Walsh (Red Hat). 1140 1141 1.27.8 2005-10-13 1142 * Updated semodule for removal of semanage_strerror. 1143 1144 1.27.7 2005-10-11 1145 * Updated semodule_link and semodule_expand to use shared libsepol. 1146 Fixed audit2why to call policydb_init prior to policydb_read (still 1147 uses the static libsepol). 1148 1149 1.27.6 2005-10-07 1150 * Updated for changes to libsepol. 1151 Changed semodule and semodule_package to use the shared libsepol. 1152 Disabled build of semodule_link and semodule_expand for now. 1153 Updated audit2why for relocated policydb internal headers, 1154 still needs to be converted to a shared lib interface. 1155 1156 1.27.5 2005-10-06 1157 * Fixed warnings in load_policy. 1158 1159 1.27.4 2005-10-06 1160 * Rewrote load_policy to use the new selinux_mkload_policy() 1161 interface provided by libselinux. 1162 1163 1.27.3 2005-09-28 1164 * Merged patch to update semodule to the new libsemanage API 1165 and improve the user interface from Karl MacMillan (Tresys). 1166 * Modified semodule for the create/connect API split. 1167 1168 1.27.2 2005-09-20 1169 * Merged run_init open_init_pty bug fix from Manoj Srivastava 1170 (unblock SIGCHLD). Bug reported by Erich Schubert. 1171 1172 1.27.1 2005-09-20 1173 * Merged error shadowing bug fix for restorecon from Dan Walsh. 1174 * Merged setfiles usage/man page update for -r option from Dan Walsh. 1175 * Merged fixfiles -C patch to ignore :s0 addition on update 1176 to a MCS/MLS policy from Dan Walsh. 1177 1178 1.26 2005-09-06 1179 * Updated version for release. 1180 1181 1.25.9 2005-08-31 1182 * Changed setfiles -c to translate the context to raw format 1183 prior to calling libsepol. 1184 1185 1.25.8 2005-08-31 1186 * Changed semodule to report errors even without -v, 1187 to detect extraneous arguments, and corrected usage message. 1188 1189 1.25.7 2005-08-25 1190 * Merged patch for fixfiles -C from Dan Walsh. 1191 1192 1.25.6 2005-08-22 1193 * Merged fixes for semodule_link and sestatus from Serge Hallyn (IBM). 1194 Bugs found by Coverity. 1195 1196 1.25.5 2005-08-02 1197 * Merged patch to move module read/write code from libsemanage 1198 to libsepol from Jason Tang (Tresys). 1199 1200 1.25.4 2005-07-27 1201 * Changed semodule* to link with libsemanage. 1202 1203 1.25.3 2005-07-26 1204 * Merged restorecon patch from Ivan Gyurdiev. 1205 1206 1.25.2 2005-07-11 1207 * Merged load_policy, newrole, and genhomedircon patches from Red Hat. 1208 1209 1.25.1 2005-07-06 1210 * Merged loadable module support from Tresys Technology. 1211 1212 1.24 2005-06-20 1213 * Updated version for release. 1214 1215 1.23.11 2005-05-19 1216 * Merged fixfiles and newrole patch from Dan Walsh. 1217 * Merged audit2why man page from Dan Walsh. 1218 1219 1.23.10 2005-05-16 1220 * Extended audit2why to incorporate booleans and local user 1221 settings when analyzing audit messages. 1222 1223 1.23.9 2005-05-13 1224 * Updated audit2why for sepol_ prefixes on Flask types to 1225 avoid namespace collision with libselinux, and to 1226 include <selinux/selinux.h> now. 1227 1228 1.23.8 2005-05-13 1229 * Added audit2why utility. 1230 1231 1.23.7 2005-04-29 1232 * Merged patch for fixfiles from Dan Walsh. 1233 Allow passing -F to force reset of customizable contexts. 1234 1235 1.23.6 2005-04-13 1236 * Fixed signed/unsigned pointer bug in load_policy. 1237 * Reverted context validation patch for genhomedircon. 1238 1239 1.23.5 2005-04-12 1240 * Reverted load_policy is_selinux_enabled patch from Dan Walsh. 1241 Otherwise, an initial policy load cannot be performed using 1242 load_policy, e.g. for anaconda. 1243 1244 1.23.4 2005-04-08 1245 * Merged load_policy is_selinux_enabled patch from Dan Walsh. 1246 * Merged restorecon verbose output patch from Dan Walsh. 1247 * Merged setfiles altroot patch from Chris PeBenito. 1248 1249 1.23.3 2005-03-17 1250 * Merged context validation patch for genhomedircon from Eric Paris. 1251 1252 1.23.2 2005-03-16 1253 * Changed setfiles -c to call set_matchpathcon_flags(3) to 1254 turn off processing of .homedirs and .local. 1255 1256 1.23.1 2005-03-14 1257 * Merged rewrite of genhomedircon by Eric Paris. 1258 * Changed fixfiles to relabel jfs since it now supports security xattrs 1259 (as of 2.6.11). Removed reiserfs until 2.6.12 is released with 1260 fixed support for reiserfs and selinux. 1261 1262 1.22 2005-03-09 1263 * Updated version for release. 1264 1265 1.21.22 2005-03-07 1266 * Merged restorecon and genhomedircon patch from Dan Walsh. 1267 1268 1.21.21 2005-02-28 1269 * Merged load_policy and genhomedircon patch from Dan Walsh. 1270 1271 1.21.20 2005-02-24 1272 * Merged fixfiles and genhomedircon patch from Dan Walsh. 1273 1274 1.21.19 2005-02-22 1275 * Merged several fixes from Ulrich Drepper. 1276 1277 1.21.18 2005-02-18 1278 * Changed load_policy to fall back to the original policy upon 1279 an error from sepol_genusers(). 1280 1281 1.21.17 2005-02-17 1282 * Merged new genhomedircon script from Dan Walsh. 1283 1284 1.21.16 2005-02-17 1285 * Changed load_policy to call sepol_genusers(). 1286 1287 1.21.15 2005-02-09 1288 * Changed relabel Makefile target to use restorecon. 1289 1290 1.21.14 2005-02-08 1291 * Merged restorecon patch from Dan Walsh. 1292 1293 1.21.13 2005-02-07 1294 * Merged sestatus patch from Dan Walsh. 1295 * Merged further change to fixfiles -C from Dan Walsh. 1296 1297 1.21.12 2005-02-02 1298 * Merged further patches for restorecon/setfiles -e and fixfiles -C. 1299 1300 1.21.11 2005-02-02 1301 * Merged patch for fixfiles -C option from Dan Walsh. 1302 * Merged patch -e support for restorecon from Dan Walsh. 1303 * Merged updated -e support for setfiles from Dan Walsh. 1304 1305 1.21.10 2005-01-31 1306 * Merged patch for open_init_pty from Manoj Srivastava. 1307 1308 1.21.9 2005-01-28 1309 * Merged updated fixfiles script from Dan Walsh. 1310 * Merged updated man page for fixfiles from Dan Walsh and re-added unzipped. 1311 * Reverted fixfiles patch for file_contexts.local; 1312 obsoleted by setfiles rewrite. 1313 * Merged error handling patch for restorecon from Dan Walsh. 1314 * Merged semi raw mode for open_init_pty helper from Manoj Srivastava. 1315 1316 1.21.8 2005-01-28 1317 * Rewrote setfiles to use matchpathcon and the new interfaces 1318 exported by libselinux (>= 1.21.5). 1319 1320 1.21.7 2005-01-27 1321 * Prevent overflow of spec array in setfiles. 1322 1323 1.21.6 2005-01-27 1324 * Merged genhomedircon STARTING_UID bug fix from Dan Walsh. 1325 1326 1.21.5 2005-01-26 1327 * Merged newrole -l support from Darrel Goeddel (TCS). 1328 1329 1.21.4 2005-01-25 1330 * Merged fixfiles patch for file_contexts.local from Dan Walsh. 1331 1332 1.21.3 2005-01-21 1333 * Fixed restorecon to not treat errors from is_context_customizable() 1334 as a customizable context. 1335 * Merged setfiles/restorecon patch to not reset user field unless 1336 -F option is specified from Dan Walsh. 1337 1338 1.21.2 2005-01-21 1339 * Merged open_init_pty helper for run_init from Manoj Srivastava. 1340 * Merged audit2allow and genhomedircon man pages from Manoj Srivastava. 1341 1342 1.21.1 2005-01-19 1343 * Merged customizable contexts patch for restorecon/setfiles from Dan Walsh. 1344 1345 1.20 2005-01-06 1346 * Merged fixfiles rewrite from Dan Walsh. 1347 * Merged restorecon patch from Dan Walsh. 1348 * Merged fixfiles and restorecon patches from Dan Walsh. 1349 * Changed restorecon to ignore ENOENT errors from matchpathcon. 1350 * Merged nonls patch from Chris PeBenito. 1351 * Removed fixfiles.cron. 1352 * Merged run_init.8 patch from Dan Walsh. 1353 1354 1.18 2004-11-01 1355 * Merged audit2allow patch from Thomas Bleher, with mods by Dan Walsh. 1356 * Merged sestatus patch from Steve Grubb. 1357 * Merged fixfiles patch from Dan Walsh. 1358 * Added -l option to setfiles to log changes via syslog. 1359 * Merged -e option to setfiles to exclude directories. 1360 * Merged -R option to restorecon for recursive descent. 1361 * Merged sestatus patch from Steve Grubb via Dan Walsh. 1362 * Merged load_policy and fixfiles.cron patches from Dan Walsh. 1363 * Merged fix for setfiles context validation patch from Colin Walters. 1364 * Merged setfiles context validation patch from Colin Walters. 1365 * Merged genhomedircon patch from Russell Coker. 1366 * Merged restorecon patch from Russell Coker. 1367 1368 1.16 2004-08-13 1369 * Merged audit2allow fix from Tom London. 1370 * Merged load_policy man page from Dan Walsh. 1371 * Merged newrole bug fix from Chad Hanson. 1372 * Changed load_policy to preserve booleans by default. 1373 * Changed load_policy to invoke sepol_genbools() instead. 1374 * Changed load_policy to also invoke security_load_booleans(). 1375 * Merged genhomedircon fixes from Dan Walsh. 1376 * Changed restorecon to use realpath. 1377 * Merged fixfiles patch from Dan Walsh. 1378 * Merged genhomedircon patch from Russell Coker and Dan Walsh. 1379 * Merged fixfiles patch and fixfiles.cron script from Dan Walsh. 1380 * Merged stat fix for setfiles -s from Russell Coker. 1381 1382 1.14 2004-06-25 1383 * Merged fix for fixfiles. 1384 * Merged enhancements to setfiles, fixfiles and restorecon from Dan Walsh. 1385 * Merged updated genhomedircon script from Russell Coker. 1386 * Merged run_init patch to find initrc_context from Dan Walsh. 1387 * Merged fixfiles patch for /etc/selinux from Dan Walsh. 1388 * Merged restorecon patch from Dan Walsh. 1389 * Merged fixfiles patch from Dan Walsh. 1390 1391 1.12 2004-05-10 1392 * Merged newrole patch from Colin Walters. 1393 * Merged fixfiles from Dan Walsh. 1394 1395 1.10 2004-04-05 1396 * Changed setfiles to not abort upon lsetfilecon failures. 1397 * Merged sestatus from Chris PeBenito. 1398 * Merged fixes for restorecon. 1399 * Merged setfiles verbosity patch from Dan Walsh and Stephen Tweedie. 1400 * Merged restorecon patch from Dan Walsh. 1401 * Revert add_assoc change from setfiles. 1402 * Moved restorecon to /sbin. 1403 * Disable add_assoc in setfiles by default, use -a to enable. 1404 * Merged genhomedircon patch from Dan Walsh. 1405 * Merged restorecon patch from Dan Walsh. 1406 * Merged setfiles buffer size change from Dan Walsh. 1407 * Merged genhomedircon fix from Karl MacMillan of Tresys. 1408 This generates separate lines for each prefix. 1409 1410 1.8 2004-03-09 1411 * Merged genhomedircon patch from Karl MacMillan of Tresys. 1412 * Removed checkcon script (obsoleted by restorecon -nv). 1413 * Replaced restorecon script with C program from Dan Walsh. 1414 Uses the new matchpathcon function from libselinux. 1415 1416 1.6 2004-02-18 1417 * Fixed setfiles sorting problem reported by Colin Walters. 1418 * Merged setfiles patch from Robert Bihlmeyer, amended by Russell Coker. 1419 * Added scripts (checkcon, restorecon, genhomedircon) from Dan Walsh. 1420 * Quiet warning about duplicate same specifications if -q is used. 1421 * Fixed usage message of audit2allow. 1422 1423 1.4 2003-12-01 1424 * Merged patch from Russell Coker. 1425 * Added audit2allow (formerly newrules.pl from policy). 1426 * Dropped -lattr from Makefiles. 1427 * Merged setfiles check type first patch by Russell Coker. 1428 1429 1.2 2003-09-30 1430 * Merged run_init close file patch from Chris PeBenito. 1431 * Merged setfiles stem compression patch by Russell Coker. 1432 * Merged setfiles usage/getopt/err patch by Russell Coker. 1433 * Merged setfiles altroot patch by Hardened Gentoo team. 1434 * Merged i18n patch by Dan Walsh. 1435 * Changed Makefiles to allow non-root rpm builds. 1436 1437 1.1 2003-08-13 1438 * Dropped obsolete psid code from setfiles. 1439 1440 1.0 2003-07-11 1441 * Initial public release. 1442 1443
