Fedora 20 Update: dragonegg-3.4-0.4.rc0.fc20
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2014-7741
2014-06-26 00:52:06
--------------------------------------------------------------------------------
Name : dragonegg
Product : Fedora 20
Version : 3.4
Release : 0.4.rc0.fc20
URL : http://dragonegg.llvm.org/
Summary : GCC plugin to use LLVM optimizers and code generators
Description :
DragonEgg is a GCC plugin that replaces GCC's optimizers and code generators
with those from the LLVM project.
--------------------------------------------------------------------------------
Update Information:
This update updates gcc to 4.8.3, fixing over 270 bugs since gcc-4.8.2-7.fc20.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jun 25 2014 Jakub Jelinek <jakub(a)redhat.com> - 3.4-0.4
- Rebuild for gcc-4.8.3-1.
* Sun Feb 2 2014 Kyle McMartin <kyle(a)redhat.com> - 3.4-0.3
- Fix compile failure by removing unused code from src/x86/ABIHack.inc
which GCC has moved around.
* Sun Feb 2 2014 Kyle McMartin <kyle(a)redhat.com> - 3.4-0.2
- Rebuild for new gcc.
- Fix armv7hl to compile. No promises. Guarantee void in Tennessee.
* Tue Jan 14 2014 Dave Airlie <airlied(a)redhat.com> 3.4-0.1
- rebase to latest git for llvm 3.4
* Tue Dec 31 2013 Eric Smith <spacewar(a)gmail.com> - 3.3-12
- Rebuild for gcc-4.8.2-7.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1107972 - Segmentation fault when compiling gmic with openmp
https://bugzilla.redhat.com/show_bug.cgi?id=1107972
[ 2 ] Bug #1111781 - internal compiler error: Segmentation fault
https://bugzilla.redhat.com/show_bug.cgi?id=1111781
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update dragonegg' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 11 months
Fedora 20 Update: gcc-4.8.3-1.fc20
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2014-7741
2014-06-26 00:52:06
--------------------------------------------------------------------------------
Name : gcc
Product : Fedora 20
Version : 4.8.3
Release : 1.fc20
URL : http://gcc.gnu.org
Summary : Various compilers (C, C++, Objective-C, Java, ...)
Description :
The gcc package contains the GNU Compiler Collection version 4.8.
You'll need this package in order to compile C code.
--------------------------------------------------------------------------------
Update Information:
This update updates gcc to 4.8.3, fixing over 270 bugs since gcc-4.8.2-7.fc20.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jun 24 2014 Jakub Jelinek <jakub(a)redhat.com> 4.8.3-1
- update from the 4.8 branch
- GCC 4.8.3 release
- PRs c++/60605, c++/60731, c++/61134, fortran/45187, ipa/61393,
libfortran/61187, libfortran/61310, libstdc++/60734, libstdc++/60966,
rtl-optimization/60866, rtl-optimization/60901, rtl-optimization/61094,
rtl-optimization/61446, target/61044, target/61193, target/61202,
target/61208, target/61231, target/61239, target/61249, target/61300,
target/61415, target/61423, target/61431, target/61443, target/61483,
target/61545, target/61570, tree-optimization/61383
* Thu May 15 2014 Jakub Jelinek <jakub(a)redhat.com> 4.8.2-18
- update from the 4.8 branch
- PRs c++/60367, c++/60628, c++/60689, c++/60708, c++/60713, debug/60603,
driver/61106, libfortran/56919, libfortran/60810, libstdc++/60497,
libstdc++/60594, libstdc++/61117, middle-end/36282, middle-end/55022,
middle-end/60635, middle-end/60729, middle-end/60750,
middle-end/60849, middle-end/60895, rtl-optimization/60769,
target/57589, target/58595, target/59952, target/60516, target/60609,
target/60672, target/60693, target/60839, target/60909, target/60941,
target/60991, target/61026, target/61055, tree-optimization/57864,
tree-optimization/59817, tree-optimization/60453,
tree-optimization/60502, tree-optimization/60740,
tree-optimization/60766, tree-optimization/60836,
tree-optimization/60903, tree-optimization/60930,
tree-optimization/60960
- backport OpenMP 4.0 support to libgomp (library only; PR libgomp/58691)
* Fri Apr 11 2014 Jakub Jelinek <jakub(a)redhat.com> 4.8.2-17
- update from the 4.8 branch
- PRs ada/51483, ada/60703, c/37743, c/59891, c/60101, c++/37140, c++/41174,
c++/54652, c++/55800, c++/57043, c++/57524, c++/57899, c++/58466,
c++/58504, c++/58606, c++/58632, c++/58639, c++/58672, c++/58812,
c++/58814, c++/58835, c++/58837, c++/58845, c++/58873, c++/58965,
c++/59097, c++/59224, c++/59646, c++/59989, c++/60108, c++/60146,
c++/60182, c++/60187, c++/60216, c++/60219, c++/60248, debug/59776,
fortran/49397, fortran/52370, fortran/55907, fortran/57033,
fortran/58007, fortran/58803, fortran/59395, fortran/59414,
fortran/59599, fortran/59700, fortran/59906, fortran/60231,
fortran/60283, fortran/60341, fortran/60450, fortran/60522,
fortran/60543, fortran/60576, fortran/60677, ipa/55260, ipa/60026,
ipa/60419, ipa/60640, libfortran/38199, libfortran/58324,
libfortran/59700, libfortran/59764, libfortran/59771,
libfortran/59774, libfortran/59836, libfortran/60128, libgcc/60166,
libgcj/55637, libstdc++/59215, libstdc++/59392, libstdc++/59548,
libstdc++/59680, libstdc++/59738, libstdc++/60564, libstdc++/60658,
middle-end/57499, middle-end/58809, middle-end/60004,
middle-end/60221, middle-end/60291, objc/56870, other/56653,
preprocessor/56824, preprocessor/58844, preprocessor/60400,
rtl-optimization/56356, rtl-optimization/57422,
rtl-optimization/57425, rtl-optimization/57569,
rtl-optimization/57637, rtl-optimization/60116,
rtl-optimization/60452, rtl-optimization/60601,
rtl-optimization/60700, target/43546, target/48094, target/54083,
target/54407, target/55426, target/56843, target/57052, target/57935,
target/57949, target/58675, target/58710, target/59054, target/59379,
target/59396, target/59462, target/59718, target/59777, target/59844,
target/59880, target/59909, target/59929, target/60017, target/60032,
target/60039, target/60062, target/60151, target/60193, target/60203,
target/60207, target/60486, target/60568, target/60735,
tree-optimization/56490, tree-optimization/59903,
tree-optimization/60115, tree-optimization/60183,
tree-optimization/60276, tree-optimization/60382,
tree-optimization/60429, tree-optimization/60454,
tree-optimization/60485
- powerpc64 little endian support
- enable ppc64le in the spec file
* Mon Mar 3 2014 Jakub Jelinek <jakub(a)redhat.com> 4.8.2-16
- fix up compare_exchange_* in libatomic too (PR c++/60272)
* Thu Feb 20 2014 Jakub Jelinek <jakub(a)redhat.com> 4.8.2-15
- fix exception spec instantiation ICE (#1067398, PR c++/60046)
- fix pch on aarch64 (#1058991, PR pch/60010)
- configure with --enable-gnu-indirect-function on architectures
and distros that support it and don't support it by default
yet (#1067245)
- fix vector permutation handling on i?86/x86_64 (PR target/57896)
- fix __atomic_compare_exchange_* not to store into *expected
on success (PR c++/60272)
- fix -march=native on VMs where saving/restoring of YMM state
is not supported, yet CPU supports f16c (PR driver/60233)
- add ref7.C testcase (PR c++/60274)
* Wed Feb 19 2014 Jakub Jelinek <jakub(a)redhat.com> 4.8.2-14
- remove libgo P.224 elliptic curve (#1066539)
- fix -mcpu=power8 ICE (#1064242, PR target/60137)
* Tue Jan 21 2014 Jakub Jelinek <jakub(a)redhat.com> 4.8.2-13
- when removing -Wall from CXXFLAGS, if -Werror=format-security
is present, add -Wformat to it, so that GCC builds on F21
* Mon Jan 20 2014 Jakub Jelinek <jakub(a)redhat.com> 4.8.2-12
- update from the 4.8 branch (#1052892)
- PRs c++/59838, debug/54694, fortran/34547, fortran/58410,
middle-end/59827, middle-end/59860, target/58139, target/59142,
target/59695, target/59794, target/59826, target/59839
- fix handling of initialized vars with flexible array members
(#1035413, PR middle-end/28865)
* Wed Jan 15 2014 Jakub Jelinek <jakub(a)redhat.com> 4.8.2-11
- update from the 4.8 branch
- fix s390x reload bug (#1052372, PR target/59803)
* Tue Jan 14 2014 Jakub Jelinek <jakub(a)redhat.com> 4.8.2-10
- update from the 4.8 branch (#1052892)
- PRs ada/55946, ada/59772, c++/56060, c++/58954, c++/59255, c++/59730,
fortran/57042, fortran/58998, fortran/59493, fortran/59612,
fortran/59654, ipa/59610, middle-end/59584, pch/59436,
rtl-optimization/54300, rtl-optimization/58668,
rtl-optimization/59137, rtl-optimization/59647,
rtl-optimization/59724, target/57386, target/59587, target/59625,
target/59652, testsuite/58630, tree-optimization/54570,
tree-optimization/59125, tree-optimization/59362,
tree-optimization/59715, tree-optimization/59745
- default to -march=z196 instead of -march=z10 on s390/s390x (#1052890)
* Fri Jan 10 2014 Jakub Jelinek <jakub(a)redhat.com> 4.8.2-9
- define %global _performance_build 1 (#1051064)
* Tue Jan 7 2014 Jakub Jelinek <jakub(a)redhat.com> 4.8.2-8
- treat ppc64p7 as ppc64 (#1048859)
* Thu Dec 12 2013 Jakub Jelinek <jakub(a)redhat.com> 4.8.2-7
- update from the 4.8 branch
- PRs libgomp/59467, rtl-optimization/58295, target/56807,
testsuite/59442
- fix LRA coalescing for real (PR middle-end/59470)
* Wed Dec 11 2013 Jakub Jelinek <jakub(a)redhat.com> 4.8.2-6
- temporarily revert PR middle-end/58956 to avoid libstdc++
miscompilation on i?86 (PR middle-end/59470)
* Mon Dec 9 2013 Jakub Jelinek <jakub(a)redhat.com> 4.8.2-5
- update from the 4.8 branch
- PRs ada/59382, bootstrap/57683, c++/58162, c++/59031, c++/59032,
c++/59044, c++/59052, c++/59268, c++/59297, c/59280, c/59351,
fortran/57445, fortran/58099, fortran/58471, fortran/58771,
middle-end/58742, middle-end/58941, middle-end/58956,
middle-end/59011, middle-end/59037, middle-end/59138,
rtl-optimization/58726, target/50751, target/51244, target/56788,
target/58854, target/58864, target/59021, target/59088,
target/59101, target/59153, target/59163, target/59207,
target/59343, target/59405, tree-optimization/57517,
tree-optimization/58137, tree-optimization/58143,
tree-optimization/58653, tree-optimization/58794,
tree-optimization/59014, tree-optimization/59047,
tree-optimization/59139, tree-optimization/59164,
tree-optimization/59288, tree-optimization/59330,
tree-optimization/59334, tree-optimization/59358,
tree-optimization/59388
- aarch64 gcj enablement (#1023789)
- look for libgfortran.spec and libitm.spec in %{_lib} rather than lib
subdirs (#1023789)
* Mon Nov 11 2013 Jakub Jelinek <jakub(a)redhat.com> 4.8.2-4
- update from the 4.8 branch
- PRs plugins/52872, regression/58985, target/59034
* Wed Nov 6 2013 Jakub Jelinek <jakub(a)redhat.com> 4.8.2-3
- update from the 4.8 branch
- PRs c++/58282, c++/58979, fortran/58355, fortran/58989, libstdc++/58839,
libstdc++/58912, libstdc++/58952, lto/57084, middle-end/58789,
rtl-optimization/58079, rtl-optimization/58831, rtl/58542,
target/58690, target/58779, target/58792, target/58838,
tree-optimization/57488, tree-optimization/58805,
tree-optimization/58984
- fix ICEs in get_bit_range (PR middle-end/58970)
- fix ICEs in RTL loop unswitching (PR rtl-optimization/58997)
* Sun Oct 20 2013 Jakub Jelinek <jakub(a)redhat.com> 4.8.2-2
- update from the 4.8 branch
- PRs c++/58596, libstdc++/58800
- power8 TImode fix (#1014053, PR target/58673)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1107972 - Segmentation fault when compiling gmic with openmp
https://bugzilla.redhat.com/show_bug.cgi?id=1107972
[ 2 ] Bug #1111781 - internal compiler error: Segmentation fault
https://bugzilla.redhat.com/show_bug.cgi?id=1111781
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update gcc' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 11 months
Fedora 20 Update: gcc-python-plugin-0.12-16.fc20
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2014-7741
2014-06-26 00:52:06
--------------------------------------------------------------------------------
Name : gcc-python-plugin
Product : Fedora 20
Version : 0.12
Release : 16.fc20
URL : https://fedorahosted.org/gcc-python-plugin/
Summary : GCC plugin that embeds Python
Description :
Plugins for embedding various versions of Python within GCC
--------------------------------------------------------------------------------
Update Information:
This update updates gcc to 4.8.3, fixing over 270 bugs since gcc-4.8.2-7.fc20.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jun 25 2014 Jakub Jelinek <jakub(a)redhat.com> - 0.12-16
- rebuild against latest gcc
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1107972 - Segmentation fault when compiling gmic with openmp
https://bugzilla.redhat.com/show_bug.cgi?id=1107972
[ 2 ] Bug #1111781 - internal compiler error: Segmentation fault
https://bugzilla.redhat.com/show_bug.cgi?id=1111781
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update gcc-python-plugin' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 11 months
Fedora 20 Update: spatialite-tools-4.1.1-5.fc20
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2014-7474
2014-06-18 21:30:41
--------------------------------------------------------------------------------
Name : spatialite-tools
Product : Fedora 20
Version : 4.1.1
Release : 5.fc20
URL : https://www.gaia-gis.it/fossil/spatialite-tools
Summary : A set of useful CLI tools for SpatiaLite
Description :
Spatialite-Tools is a set of useful CLI tools for SpatiaLite.
--------------------------------------------------------------------------------
Update Information:
Rebuilt for latest sqlite version
--------------------------------------------------------------------------------
ChangeLog:
* Sat Jun 14 2014 Volker Fröhlich <volker27(a)gmx.at> - 4.1.1-5
- Rebuild for sqlite 3.8.5
* Sun Jun 8 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 4.1.1-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
* Thu Jun 5 2014 Volker Fröhlich <volker27(a)gmx.at> - 4.1.1-3
- Solve BZ 1048587 (spatialite command complains about sqlite version)
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update spatialite-tools' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 11 months
Fedora 19 Update: selinux-policy-3.12.1-74.26.fc19
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2014-6075
2014-05-08 09:09:19
--------------------------------------------------------------------------------
Name : selinux-policy
Product : Fedora 19
Version : 3.12.1
Release : 74.26.fc19
URL : http://oss.tresys.com/repos/refpolicy/
Summary : SELinux policy configuration
Description :
SELinux Reference Policy - modular.
Based off of reference policy: Checked out revision 2.20091117
--------------------------------------------------------------------------------
Update Information:
Update sandbox_transition() to call sandbox_dyntrasition().
See http://koji.fedoraproject.org/koji/buildinfo?buildID=506047
--------------------------------------------------------------------------------
ChangeLog:
* Fri May 2 2014 Miroslav Grepl <mgrepl(a)redhat.com> 3.12.1-74.26
- Update sandbox_transition() to call sandbox_dyntrasition().
* Fri May 2 2014 Lukas Vrabec <lvrabec(a)redhat.com> 3.12.1-74.25
- Add interface sysnet_manage_ifconfig_run
- Added sysnet_filetrans_named_content_ifconfig interface
- Added dnsmasq_read_state interface
- Add some rules from F20 branch in quantum policy
- Allow exim to use pam stack to check passwords
* Mon Apr 14 2014 Lukas Vrabec <lvrabec(a)redhat.com> 3.12.1-74.24
- Add modutils_dontaudit_exec_insmod interface
- Allow rabbitmq to bind to amanda port
- Allow kill capability to winbind_t
- Dontaudit exec insmod in boinc policy
- Allow exim to use pam stack to check passwords
* Fri Mar 21 2014 Lukas Vrabec <lvrabec(a)redhat.com> 3.12.1-74.23
- Add bumblebee to unconfined_domain
* Thu Mar 20 2014 Lukas Vrabec <lvrabec(a)redhat.com> 3.12.1-74.22
- Allow couchdb to listen on port 6984
- Added kernel_dontaudit_access_check_proc interface
- Added modutils_signal_insmod interface
- Add xserver_manage_xkb_libs interface
- Fixed ftp_home_dir boolean
- Added policy for bumblebee
* Mon Mar 17 2014 Lukas Vrabec <lvrabec(a)redhat.com> 3.12.1-74.21
- Added sysnet_domtrans_ifconfig in neutron policy
* Mon Mar 17 2014 Lukas Vrabec <lvrabec(a)redhat.com> 3.12.1-74.20
- Backported quantum and neutron rules from rawhide
- Allow couchdb can manage rabbitmq files
- Added couchdb_manage_files interface
- Fixed quantum policy
- Allow snort to manage its log files
- Allow procman to list doveconf_etc_t
- Dontaudit unpriv users creating rawip_socket, will be blocked by DAC
- Allow postgresql to read network state
* Mon Feb 24 2014 Lukas Vrabec <lvrabec(a)redhat.com> 3.12.1-74.19
- Added var_lib filetrans in iscsi policy
- Allow iscsi to manage iscsi_var_lib_t files and dirs
- Fixed openvswitch policy
- zabbix_agent uses nsswitch
- Allow procmail and dovecot to work together to deliver mail
- Allow spamd to execute files in homedir if boolean turned on
- Allow openvswitch to listen on port 6634
- Allow mailserver_domains to manage and transition to mailman data
- Add label for openvswitch port
* Tue Feb 11 2014 Lukas Vrabec <lvrabec(a)redhat.com> 3.12.1-74.18
- Allow mailserver_domains to manage and transition to mailman data
- Fixed broken interface in milter policy
- Allow dkim-milter to bind udp ports
- Allow milter domains to send signull itself
- Add labeling for /var/log/php_errors.log
- Allow neutron domtrans to iptables
- Allow fenced_t to bind on zented udp port
* Fri Jan 10 2014 Lukas Vrabec <lvrabec(a)redhat.com> 3.12.1-74.17
- Allow polipo to connect to http_cache_ports
- Add new access for mythtv
- Allow tor to bind to hplip port
- Allow showall_t to send itself signals
- Add zabbix_var_lib_t for /var/lib/zabbixsrv, also allow zabix to connect to smtp port
- Fixed filetrans in zabbix policy
- Allow httpd to read ldap certs
- passwd to create gnome-keyring passwd socket
- Allow sytemd_tmpfiles_t to delete all directories
* Fri Dec 20 2013 Lukas Vrabec <lvrabec(a)redhat.com> 3.12.1-74.16
- Allow amanda to do backups over UDP
- Add log support for sensord
* Tue Dec 10 2013 Lukas Vrabec <lvrabec(a)redhat.com> 3.12.1-74.15
- Add file transition rules for content created by f5link
- Allow cloud_init to transition to rpm_script_t
- Add antivirus_db_t labeling for /var/lib/clamav-unofficial-sigs
- Allow dkim-milter to create files/dirs in /tmp
- Dontaudit mandb searching all mountpoints
* Tue Nov 26 2013 Lukas Vrabec <lvrabec(a)redhat.com> 3.12.1-74.14
- Allow apmd to request the kernel load module
- Allow sssd to request the kernel loads modules
- label mate-keyring-daemon with gkeyringd_exec_t
- Allow procmail_t to connect to dovecot stream sockets
- Allow smoltclient to execute ldconfig
- Allow condor domains to read/write condor_master udp_socket
- sendmail can attempt to block suspend, but will complete successfully
- Add support for texlive2013
- Allow passwd_t to connect to gnome keyring to change password
- Should allow domains to lock the terminal device
* Mon Nov 11 2013 Miroslav Grepl <mgrepl(a)redhat.com> 3.12.1-74.13
- Update xserver.te to make GDM working
* Fri Nov 8 2013 Lukas Vrabec <lvrabec(a)redhat.com> 3.12.1-74.12
- Fixed userdom_dontaudit_delete_user_tmp_files
- Add auth_exec_chkpwd interface
- Add interface to dontaudit attempts to delete user_tmp_t files on thumbnails
- Add tcp/8893 as milter port
- Dontaudit leaked write descriptor to dmesg
- Add rpc_kill_rpcd interface
- Dontaudit attempts to write/delete user_tmp_t files
- Dontaudit attempts by system_mail to modify network config
- Allow ipc_lock for abrt to run journalctl.
- Update zoneminder policy
- Add policy for motion service
- Allow glusterd_t to mounton glusterd_tmp_t
- Allow glusterd to unmout al filesystems
- Allow xenstored to read virt config
* Tue Oct 22 2013 Lukas Vrabec <lvrabec(a)redhat.com> 3.12.1-74.11
- Back port piranha tmpfs fixes from RHEL6
- Fix piranha_domain_template()
- Allow mozilla_plugin to bind to the vnc port if running with spice
- Allow svirt_domains to read sysctl_net_t
- Update ppp_manage_pid_files interface
- Allow ctdbd to create udp_socket. Allow ndmbd to access ctdbd var files.
- Allow dovecot-auth to read nologin
- Allow mailserver_domains to manage and transition to mailman data
- Allow thin_t to block suspend
- Create resolv.conf in the pppd_var_run_t with the net_conf_t label
- wicd.pid should be labeled as networkmanager_var_run_t
- Label /sbin/xfs_growfs as fsadm_exec_t
- Allow SELinux users to create coolkeypk11sE-Gate in /var/cache/coolkey
- Create resolv.conf in the pppd_var_run_t with the net_conf_t label
- Fix labeling for /etc/strongswan/ipsec.d
- Add labeling for /var/run/charon.ctl socket
- Allow syslogd_t to connect to the syslog_tls port
* Tue Oct 15 2013 Lukas Vrabec <lvrabec(a)redhat.com> 3.12.1-74.10
- Add kill capability in glusterfs policy
- Add postfix_rw_spool_maildrop_files interface
- Update httpd_can_sendmail boolean to allow read/write postfix spool maildrop
- Dontaudit setroubleshoot_fixit_t execmem, since it does not seem to really need it.
- Allow init_t to read gnome home data
- Allow svirt sandbox domains to setattr on chr_file and blk_file svirt_sandbox_file_t, so sshd will work within
- Allow httpd_t to read also git sys content symlinks
- Remove httpd_cobbler_content * from cobbler_admin interface
- allow openshift_cgroup_t to read/write inherited openshift file types
- fix gnome_read_generic_data_home_files interface
- Make sure if systemd_logind creates nologin file with the correct label
- Allow syslog to bind to tls ports
- Clean up ipsec.te
- Allow init_t to read gnome home data
- Allow to su_domain to read init states
- Update labeling for /dev/cdc-wdm
* Tue Oct 8 2013 Lukas Vrabec <lvrabec(a)redhat.com> 3.12.1-74.9
- Allow systemd domains to read /dev/urand
- Remove duplicated interfaces
- Fix port definition for ctdb ports
- Dontaudit attempts for mozilla_plugin to append to /dev/random
- Allow domains that communicate with systemd_logind_sessions to use systemd_logind_t fd
- Match upstream labeling
- Fix labeling for mgetty.* logs
- glusterd binds to random unreserved ports
- add type defintion for ctdbd_var_t
- Fix ctdb.te
- Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file
- apcupsd needs to send a message to all users on the system so needs to look them up
- Allow polipo_daemon to connect to flash ports
- Dontaudit attempts for mozilla_plugin to append to /dev/random
- Fix the label on ~/.juniper_networks
- Allow readahead to read /dev/urand
- Fix lots of avcs about tuned
- Any file names xenstored in /var/log should be treated as xenstored_var_log_t
- Allow condor domains to list etc rw dirs
- Allow cobblerd to connect to mysql
- Label zarafa-search as zarafa-indexer
- Openshift cgroup wants to read /etc/passwd
- Allow mpd to interact with pulseaudio if mpd_enable_homedirs is turned on
- Fix labeling for /usr/libexec/kde4/kcmdatetimehelper
- Allow tuned to search all file system directories
- Allow alsa_t to sys_nice, to get top performance for sound management
- Dontaudit leaked unix_stream_sockets into gnome keyring
- Allow telepathy domains to inhibit pipes on telepathy domains
- Allow dirsrv_t to create tmpfs_t directories
- Allow openvpn_t to manage openvpn_var_log_t files.
* Thu Sep 26 2013 Lukas Vrabec <lvrabec(a)redhat.com> 3.12.1-74.8
- Get labeling right on ipsec.secrets
- Allow systemd to read dhcpc_state
- Allow amanda to write to /etc/amanda/DailySet1 directory
- Fix english on gssd_read_tmp boolean descriptions
- Allow cloud-init to domtrans to rpm
- Allow abrt daemon to manage abrt-watch tmp files
- Allow abrt-upload-watcher to search /var/spool directory
- Fix typo in abrt.te
* Wed Sep 25 2013 Miroslav Grepl <mgrepl(a)redhat.com> 3.12.1-74.7
- Allow setroubleshoot to look at /proc
- Allow telepathy domains to dbus with systemd logind
- Fix handling of fifo files of rpm
- Allow certwatch to write to cert_t directories
- New abrt application
- Allow mozilla_plugin to transition to itself
- Allow mdadm_t to read images labeled svirt_image_t
- Allow NetworkManager to set the kernel scheduler
- Allow abrt daemon to manage abrt-watch tmp files
- Allow abrt-upload-watcher to search /var/spool directory
- More handling of ther kernel keyring required by kerberos
* Fri Sep 20 2013 Miroslav Grepl <mgrepl(a)redhat.com> 3.12.1-74.6
- Keep initrc_domain if init_t executes bin_t
* Fri Sep 20 2013 Lukas Vrabec <lvrabec(a)redhat.com> 3.12.1-74.5
- Fix label on pam_krb5 helper apps
- Allow apps that read ipsec_mgmt_var_run_t to search ipsec_var_run_t
- Allow init_t to run crash utility
- Fix label on pam_krb5 helper apps
- Allow init_t to run crash utility
- Call neutron interfaces instead of quantum
- Allow users to communicate with journald using tmpfs files
- Allow nslcd to send signull to itself
- Fix virtd_lxc_t to be able to communicate with hal, need backport to rhel6 ASAP, for docker stuff
- Fix missing types in virt_admin interface
- Dontaudit attempts by sosreport to read shadow_t
- Allow cobbler to exec rsync and communicate with sssd, using nsswitch
- Add new label mpd_home_t
- Label /srv/www/logs as httpd_log_t
- Allow irc_t to use tcp sockets
- Add labels for apache logs under miq package
- Allow fetchmail to send mails
- allow neutron to connect to amqp ports
- Fix to use quantum port
- Rename quantum to neutron
- Allow virt_qemu_ga_t to read meminfo
- Allow kdump_manage_crash to list the kdump_crash_t directory
- Allow ldconfig to write to kdumpctl fifo files
- Allow openshift_cron_t to run ssh-keygen in ssh_keygen_t to access host keys
* Mon Sep 16 2013 Lukas Vrabec <lvrabec(a)redhat.com> 3.12.1-74.4
- fix bad labels in puppet.if
- Allow tcsd to read utmp file
- Define svirt_socket_t as a domain_type
- Fix puppet_domtrans_master() interface to make passenger working correctly if it wants to read puppet config file
- Allow passenger to execute ifconfig
* Wed Sep 11 2013 Lukas Vrabec <lvrabec(a)redhat.com> 3.12.1-74.3
- Treat usr_t just like bin_t for transitions and executions
- Allow memcache to read sysfs data
- openct needs to be able to create netlink_object_uevent_sockets
- Allow nslcd to read /sys/devices/system/cpu
- Allow mdadm to read /dev/mei
- amanda_exec_t needs to be executable file
- Add additional labeling for qemu-ga/fsfreeze-hook.d scripts
- Allow setpgid and r/w cluster tmpfs for fenced_t
- Allow block_suspend cap for samba-net
- Allow mpd setcap which is needed by pulseaudio
- Add antivirus_home_t type for antivirus date in HOMEDIRS
- Allow glance-api to connect to amqp port
- Fix wrong capabilities in rhcs policy
* Fri Sep 6 2013 Lukas Vrabec <lvrabec(a)redhat.com> 3.12.1-74.2
- Fix lsm.fc for pid files
- Allow init_t to transition to all inetd domains
- Allow tgtd_t to connect to isns ports
- Lots of new access required for sosreport
- svirt domains neeed to create kobject_uevint_sockets
- Use just init_domain instead of init_daemon_domain in inetd_core_service_domain
- Cleanup related to init_domain()+inetd_domain fixes
- Allow cvs to bind to the cvs_port
- Allow ktalkd to bind to the ktalkd_port
- Allow telnetd to bind to the telnetd_port
- Allow rlogind to bind to the rlogin_port
- Allow apache domain to connect to gssproxy socket
- Dontaudit attempts to bind to ports < 1024 when nis is turned on
- Allow cupsd_lpd_t to bind to the printer port
- Allow a confined domain to executes mozilla_exec_t via dbus
- Allow mdadm to getattr any file system
- Allow sandbox domain to read/write mozilla_plugin_tmpfs_t so pulseaudio will work
- Allow all domains that can read gnome_config to read kde config
- Call the correct interface - corenet_udp_bind_ktalkd_port()
- Fix mozilla_plugin_rw_tmpfs_files()
- Allow systemd running as git_systemd to bind git port
- Allow firewalld to read NM state
- Add interface couchdb_search_pid_dirs
- Add support for couchdb in rabbitmq policy
- Add boolean boinc_execmem
- Add interface netowrkmanager_initrc_domtrans
- Dontaudit leaks into ldconfig_t
- Dontaudit inherited lock files in ifconfig o dhcpc_t
- Move kernel_stream_connect into all Xwindow using users
- Dontaudit su domains getattr on /dev devices, move su domains to attribute based calls
- Add interface to read authorization data in the users homedir
- Allow ipsec_t to read .google authenticator data
- Allow staff_t to read login config
- Treat files labeld as usr_t like bin_t when it comes to transitions
- Split out rlogin ports from inetd
- Add interface seutil_dbus_chat_semanage
- Fix selinuxutil.if
* Tue Sep 3 2013 Lukas Vrabec <lvrabec(a)redhat.com> 3.12.1-74.1
- Allow xdm_t to delete gkeyringd_tmp_t files on logout
- Fix polipo.te
- Add trans rules for lsm pid files/dirs
- Fix labeling for fetchmail pid files/dirs
- Add additional fixes for abrt-upload-watch
- Fix transition rules in asterisk policy
- Add fowner capability to networkmanager policy
- Cleanup openhpid policy
- Fix kdump_read_crash() interface
- Make more domains as init domain
- Allow sosreport to getattr everything in /dev and send rawip packets
- Allow sosreport to transition to brctl
- Add missing alias for amavis_etc_t
- Fix requires in rpm_rw_script_inherited_pipes
- Fix interfaces in lsm.if
- Fix cupsd.te
- Allow munin service plugins to manage own tmpfs files/dirs
- Allow virtd_t also relabel unix stream sockets for virt_image_type
- Fix to define ktalkd_unit_file_t correctly
- Add systemd support for talk-server
- Allow glusterd to create sock_file in /run
- Allow xdm_t to delete gkeyringd_tmp_t files on logout
- Add support for tmp directories to openvswitch
- Add logwatch_can_sendmail boolean
- Allow telpathy_domains to search user homedirs and tmp dirs
- Allow mysqld_safe_t to handle also symlinks in /var/log/mariadb
* Thu Aug 29 2013 Lukas Vrabec <lvrabec(a)redhat.com> 3.12.1-74
- Rename svirt_lxc_file_t to svirt_sandbox_file_t
- Allow virt_domain with USB devices to look at dos file systems
- Dontaudit thumb_t trying to look in /proc
- Change svirt_lxc_domain to svirt_sandbox_domain, and add svirt_qemu_net_t type
- Rename interface virt_transition_svirt_lxc to virt_transition_svirt_sanbox
- Allow ipsec_t to domtrans to iptables_t
- dontaudit users running nautilus on /proc
- Dontaudit hostname inheriting any terminal
- Label polgengui as a bin_t
- Allow semanage to create /.autorelabel file
- Label systemd unit files under dracut correctly
- Allow systemd domain to read /proc
- Allow sssd to write to user keyrings for managing kerberos
- Allow rhsmcertd to read init state
- Allow fetchmail to create own pid with correct labeling
- Fix rhcs_domain_template()
- Allow roles which can run mock to read mock lib files to view results
- Allow rpcbind to use nsswitch
* Fri Aug 23 2013 Miroslav Grepl <mgrepl(a)redhat.com> 3.12.1-73
- Update rules for condor domains
* Fri Aug 23 2013 Miroslav Grepl <mgrepl(a)redhat.com> 3.12.1-72
- Fix collectd_t can read /etc/passwd file
- Fix lsm.if summary
- Add policy for lsmd
- Cleanup raid.te
- Add support for abrt-upload-watch
- Dontaudit access check on cert_t for httpd_t
- Add support for /var/log/mariadb dir and allow mysqld_safe to list this directory
- Allow glusterd to read domains state
- Allow swift to crete cache dirs with correct labeling
- Add support for pam_mount to mount user's encrypted home When a user logs in and logs out using ssh
- Add support for .Xauthority-n
* Tue Aug 20 2013 Miroslav Grepl <mgrepl(a)redhat.com> 3.12.1-71
- Allow boinc to connect to @/tmp/.X11-unix/X0
- Allow beam.smp to connect to tcp/5984
- Allow named to manage own log files
- Add label for /usr/libexec/dcc/start-dccifd and domtrans to dccifd_t
- Add virt_transition_userdomain boolean decl
- Allow httpd_t to sendto unix_dgram sockets on its children
- Allow nova domains to execute ifconfig
- bluetooth wants to create fifo_files in /tmp
- exim needs to be able to manage mailman data
- Allow sysstat to getattr on all file systems
- Looks like bluetoothd has moved
- Allow collectd to send ping packets
- Allow svirt_lxc domains to getpgid
- Remove virt-sandbox-service labeling as virsh_exec_t, since it no longer does virsh_t stuff
- Allow frpintd_t to read /dev/urandom
- Allow asterisk_t to create sock_file in /var/run
- Allow usbmuxd to use netlink_kobject
- sosreport needs to getattr on lots of devices, and needs access to netlink_kobject_uevent_socket
- More cleanup of svirt_lxc policy
- virtd_lxc_t now talks to dbus
- Dontaudit leaked ptmx_t
- Allow processes to use inherited fifo files
- Allow openvpn_t to connect to squid ports
- Allow prelink_cron_system_t to ask systemd to reloaddd miscfiles_dontaudit_access_check_cert()
- Allow ssh_t to use /dev/ptmx
- Make sure /run/pluto dir is created with correct labeling
- Allow syslog to run shell and bin_t commands
- Allow ip to relabel tun_sockets
- Allow mount to create directories in files under /run
- Allow processes to use inherited fifo files
- Allow user roles to connect to the journal socket
- xauth_t should be allowed to create xauth_home_t
- selinux_set_enforce_mode needs to be used with type
- Add append to the dontaudit for unix_stream_socket of xdm_t leak
- Allow xdm_t to create symlinks in log direcotries
- Allow login programs to read afs config
* Thu Aug 8 2013 Miroslav Grepl <mgrepl(a)redhat.com> 3.12.1-70
- Add label for /var/crash
- Allow fenced to domtrans to sanclok_t
- Allow nagios to manage nagios spool files
- Make tfptd as home_manager
- Allow kdump to read kcore on MLS system
- Allow mysqld-safe sys_nice/sys_resource caps
- Allow apache to search automount tmp dirs if http_use_nfs is enabled
- Allow crond to transition to named_t, for use with unbound
- Allow crond to look at named_conf_t, for unbound
- Allow mozilla_plugin_t to transition its home content
- Allow dovecot_domain to read all system and network state
- Allow semanage to read pid files
- Dontaudit leaked file descriptors from user domain into thumb
- Add fixes for rabbit to fix ##992920,#99293
- Make NFS home, NIS authentication and dbus-daemon working
- Fix thumb_run()
- winbind wants block_suspend
- Fix typo in smokeping.te
- Fix rabbit.te
- Remove dup rule for dovecot.te
- Fix abrt.te
- Allow afs domains to read afs_config files
- Allow login programs to read afs config
- Allow virt_domain to read virt_var_run_t symlinks
- Allow smokeping to send its process signals
- Allow fetchmail to setuid
- Add kdump_manage_crash() interface
- Allow abrt domain to write abrt.socket
- Add append to the dontaudit for unix_stream_socket of xdm_t leak
- Allow xdm_t to create symlinks in log direcotries
- Allow login programs to read afs config
- Fix rules for creating pluto pid files
- Fix userdom_relabel_user_tmp_files()
- Label 10933 as a pop port, for dovecot
* Fri Aug 2 2013 Miroslav Grepl <mgrepl(a)redhat.com> 3.12.1-69
- Add fix for pand service
- Fix pegasus.te
- shorewall touches own log
- Allow nrpe to list /var
- Add additional fixes for pegasus_openlmi_storage_t. Domtrans to demicode. A type for openlmi_storage lib files.
- Dontaudit attempts by thumb_t to check access on files/dirs in user homedir
* Tue Jul 30 2013 Miroslav Grepl <mgrepl(a)redhat.com> 3.12.1-68
- Add more aliases in pegasus.te
- Add more fixes for *_admin interfaces
- Add interface fixes
- Allow nscd to stream connect to nmbd
- Allow gnupg apps to write to pcscd socket
- Add more fixes for openlmi provides. Fix naming and support for additionals
- Allow fetchmail to resolve host names
- Allow firewalld to interact also with lnk files labeled as firewalld_etc_rw_t
- Add labeling for cmpiLMI_Fan-cimprovagt
- Allow net_admin for glusterd
- Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/
- Add pegasus_openlmi_system_t
- Fix puppet_domtrans_master() to make all puppet calling working in passenger.te
- Fix corecmd_exec_chroot()
- Fix logging_relabel_syslog_pid_socket interface
- Fix typo in unconfineduser.te
- Allow system_r to access unconfined_dbusd_t to run hp_chec
* Fri Jul 26 2013 Miroslav Grepl <mgrepl(a)redhat.com> 3.12.1-67
- Add support for cmpiLMI_Service-cimprovagt
- Allow pegasus domtrans to rpm_t to make pycmpiLMI_Software-cimprovagt running as rpm_t
- Label pycmpiLMI_Software-cimprovagt as rpm_exec_t
- Add support for pycmpiLMI_Storage-cimprovagt
- Add support for cmpiLMI_Networking-cimprovagt
- Allow system_cronjob_t to create user_tmpfs_t to make pulseaudio working
- Allow virtual machines and containers to run as user doains, needed for virt-sandbox
- Allow buglist.cgi to read cpu info
* Wed Jul 24 2013 Miroslav Grepl <mgrepl(a)redhat.com> 3.12.1-66
- Allow systemd-tmpfile to handle tmp content in print spool dir
- Allow systemd-sysctl to send system log messages
- Add support for RTP media ports and fmpro-internal
- Make auditd working if audit is configured to perform SINGLE action on disk error
- Add interfaces to handle systemd units
- Make systemd-notify working if pcsd is used
- Add support for netlabel and label /usr/sbin/netlabelctl as iptables_exec_t
- Instead of having all unconfined domains get all of the named transition rules,
- Only allow unconfined_t, init_t, initrc_t and rpm_script_t by default.
- Add definition for the salt ports
- Allow xdm_t to create link files in xdm_var_run_t
- Dontaudit reads of blk files or chr files leaked into ldconfig_t
- Allow sys_chroot for useradd_t
- Allow net_raw cap for ipsec_t
- Allow sysadm_t to reload services
- Add additional fixes to make strongswan working with a simple conf
- Allow sysadm_t to enable/disable init_t services
- Add additional glusterd perms
- Allow apache to read lnk files in the /mnt directory
- Allow glusterd to ask the kernel to load a module
- Fix description of ftpd_use_fusefs boolean
- Allow svirt_lxc_net_t to sys_chroot, modify policy to tighten up svirt_lxc_domain capabilties and process controls, but add them to svirt_lxc_net_t
- Allow glusterds to request load a kernel module
- Allow boinc to stream connect to xserver_t
- Allow sblim domains to read /etc/passwd
- Allow mdadm to read usb devices
- Allow collectd to use ping plugin
- Make foghorn working with SNMP
- Allow sssd to read ldap certs
- Allow haproxy to connect to RTP media ports
- Add additional trans rules for aide_db
- Add labeling for /usr/lib/pcsd/pcsd
- Add labeling for /var/log/pcsd
- Add support for pcs which is a corosync and pacemaker configuration tool
* Tue Jul 16 2013 Miroslav Grepl <mgrepl(a)redhat.com> 3.12.1-65
- Label /var/lib/ipa/pki-ca/publish as pki_tomcat_cert_t
- Add labeling for /usr/libexec/kde4/polkit-kde-authentication-agent-1
- Allow all domains that can domtrans to shutdown, to start the power services script to shutdown
- consolekit needs to be able to shut down system
- Move around interfaces
- Remove nfsd_rw_t and nfsd_ro_t, they don't do anything
- Add additional fixes for rabbitmq_beam to allow getattr on mountpoints
- Allow gconf-defaults-m to read /etc/passwd
- Fix pki_rw_tomcat_cert() interface to support lnk_files
* Fri Jul 12 2013 Miroslav Grepl <mgrepl(a)redhat.com> 3.12.1-64
- Add support for gluster ports
- Make sure that all keys located in /etc/ssh/ are labeled correctly
- Make sure apcuspd lock files get created with the correct label
- Use getcap in gluster.te
- Fix gluster policy
- add additional fixes to allow beam.smp to interact with couchdb files
- Additional fix for #974149
- Allow gluster to user gluster ports
- Allow glusterd to transition to rpcd_t and add additional fixes for #980683
- Allow tgtd working when accessing to the passthrough device
- Fix labeling for mdadm unit files
* Wed Jul 10 2013 Miroslav Grepl <mgrepl(a)redhat.com> 3.12.1-63
- Add systemd support for mdadm
* Tue Jul 9 2013 Miroslav Grepl <mgrepl(a)redhat.com> 3.12.1-62
- Fix definition of sandbox.disabled to sandbox.pp.disabled
* Mon Jul 8 2013 Miroslav Grepl <mgrepl(a)redhat.com> 3.12.1-61
- Allow mdamd to execute systemctl
- Allow mdadm to read /dev/kvm
- Allow ipsec_mgmt_t to read l2tpd pid content
* Mon Jul 8 2013 Miroslav Grepl <mgrepl(a)redhat.com> 3.12.1-60
- Allow nsd_t to read /dev/urand
- Allow mdadm_t to read framebuffer
- Allow rabbitmq_beam_t to read process info on rabbitmq_epmd_t
- Allow mozilla_plugin_config_t to create tmp files
- Cleanup openvswitch policy
- Allow mozilla plugin to getattr on all executables
- Allow l2tpd_t to create fifo_files in /var/run
- Allow samba to touch/manage fifo_files or sock_files in a samba_share_t directory
- Allow mdadm to connecto its own unix_stream_socket
- FIXME: nagios changed locations to /log/nagios which is wrong. But we need to have this workaround for now.
- Allow apache to access smokeping pid files
- Allow rabbitmq_beam_t to getattr on all filesystems
- Add systemd support for iodined
- Allow nup_upsdrvctl_t to execute its entrypoint
- Allow fail2ban_client to write to fail2ban_var_run_t, Also allow it to use nsswitch
- add labeling for ~/.cache/libvirt-sandbox
- Add interface to allow domains transitioned to by confined users to send sigchld to screen program
- Allow sysadm_t to check the system status of files labeled etc_t, /etc/fstab
- Allow systemd_localed to start /usr/lib/systemd/system/systemd-vconsole-setup.service
- Allow an domain that has an entrypoint from a type to be allowed to execute the entrypoint without a transition, I can see no case where this is a bad thing, and elminiates a whole class of AVCs.
- Allow staff to getsched all domains, required to run htop
- Add port definition for redis port
- fix selinuxuser_use_ssh_chroot boolean
- Fix bootloader.fc
- Additional fix
- Fix with xserver_stream_connect_xdm() calling
* Wed Jul 3 2013 Miroslav Grepl <mgrepl(a)redhat.com> 3.12.1-59
- Add prosody policy written by Michael Scherer
- Allow nagios plugins to read /sys info
- ntpd needs to manage own log files
- Add support for HOME_DIR/.IBMERS
- Allow iptables commands to read firewalld config
- Allow consolekit_t to read utmp
- Fix filename transitions on .razor directory
- Add additional fixes to make DSPAM with LDA working
- Allow snort to read /etc/passwd
- Allow fail2ban to communicate with firewalld over dbus
- Dontaudit openshift_cgreoup_file_t read/write leaked dev
- Allow nfsd to use mountd port
- Call th proper interface
- Allow openvswitch to read sys and execute plymouth
- Allow tmpwatch to read /var/spool/cups/tmp
- Add support for /usr/libexec/telepathy-rakia
- Add systemd support for zoneminder
- Allow mysql to create files/directories under /var/log/mysql
- Allow zoneminder apache scripts to rw zoneminder tmpfs
- Allow httpd to manage zoneminder lib files
- Add zoneminder_run_sudo boolean to allow to start zoneminder
- Allow zoneminder to send mails
- gssproxy_t sock_file can be under /var/lib
- Allow web domains to connect to whois port.
- Allow sandbox_web_type to connect to the same ports as mozilla_plugin_t.
- We really need to add an interface to corenet to define what a web_client_domain is and
- then define chrome_sandbox_t, mozilla_plugin_t and sandbox_web_type to that domain.
- Add labeling for cmpiLMI_LogicalFile-cimprovagt
- Also make pegasus_openlmi_logicalfile_t as unconfined to have unconfined_domain attribute for filename trans rules
- Update policy rules for pegasus_openlmi_logicalfile_t
- Add initial types for logicalfile/unconfined OpenLMI providers
- mailmanctl needs to read own log
- Allow logwatch manage own lock files
- Allow nrpe to read meminfo
- Allow httpd to read certs located in pki-ca
- Add pki_read_tomcat_cert() interface
- Add support for nagios openshift plugins
- Add port definition for redis port
- fix selinuxuser_use_ssh_chroot boolean
* Fri Jun 28 2013 Miroslav Grepl <mgrepl(a)redhat.com> 3.12.1-58
- Shrink the size of policy by moving to attributes, also add dridomain so that mozilla_plugin can follow selinuxuse_dri boolean.
- Allow bootloader to manage generic log files
- Allow ftp to bind to port 989
- Fix label of new gear directory
- Add support for new directory /var/lib/openshift/gears/
- Add openshift_manage_lib_dirs()
- allow virtd domains to manage setrans_var_run_t
- Allow useradd to manage all openshift content
- Add support so that mozilla_plugin_t can use dri devices
- Allow chronyd to change the scheduler
- Allow apmd to shut downthe system
- Devicekit_disk_t needs to manage /etc/fstab
* Wed Jun 26 2013 Miroslav Grepl <mgrepl(a)redhat.com> 3.12.1-57
- Make DSPAM to act as a LDA working
- Allow ntop to create netlink socket
- Allow policykit to send a signal to policykit-auth
- Allow stapserver to dbus chat with avahi/systemd-logind
- Fix labeling on haproxy unit file
- Clean up haproxy policy
- A new policy for haproxy and placed it to rhcs.te
- Add support for ldirectord and treat it with cluster_t
- Make sure anaconda log dir is created with var_log_t
* Mon Jun 24 2013 Miroslav Grepl <mgrepl(a)redhat.com> 3.12.1-56
- Allow lvm_t to create default targets for filesystem handling
- Fix labeling for razor-lightdm binaries
- Allow insmod_t to read any file labeled var_lib_t
- Add policy for pesign
- Activate policy for cmpiLMI_Account-cimprovagt
- Allow isnsd syscall=listen
- /usr/libexec/pegasus/cimprovagt needs setsched caused by sched_setscheduler
- Allow ctdbd to use udp/4379
- gatherd wants sys_nice and setsched
- Add support for texlive2012
- Allow NM to read file_t (usb stick with no labels used to transfer keys for example)
- Allow cobbler to execute apache with domain transition
* Fri Jun 21 2013 Miroslav Grepl <mgrepl(a)redhat.com> 3.12.1-55
- condor_collector uses tcp/9000
- Label /usr/sbin/virtlockd as virtd_exec_t for now
- Allow cobbler to execute ldconfig
- Allow NM to execute ssh
- Allow mdadm to read /dev/crash
- Allow antivirus domains to connect to snmp port
- Make amavisd-snmp working correctly
- Allow nfsd_t to mounton nfsd_fs_t
- Add initial snapper policy
- We still need to have consolekit policy
- Dontaudit firefox attempting to connect to the xserver_port_t if run within sandbox_web_t
- Dontaudit sandbox apps attempting to open user_devpts_t
- Allow dirsrv to read network state
- Fix pki_read_tomcat_lib_files
- Add labeling for /usr/libexec/nm-ssh-service
- Add label cert_t for /var/lib/ipa/pki-ca/publish
- Lets label /sys/fs/cgroup as cgroup_t for now, to keep labels consistant
- Allow nfsd_t to mounton nfsd_fs_t
- Dontaudit sandbox apps attempting to open user_devpts_t
- Allow passwd_t to change role to system_r from unconfined_r
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #993279 - SELinux is preventing /usr/lib64/erlang/erts-5.10.1/bin/beam from 'name_bind' accesses on the tcp_socket .
https://bugzilla.redhat.com/show_bug.cgi?id=993279
[ 2 ] Bug #1076250 - SELinux policy for freeipa does not work when admin is in sysadm_t
https://bugzilla.redhat.com/show_bug.cgi?id=1076250
[ 3 ] Bug #1082631 - SELinux is preventing /usr/bin/bash from 'read' accesses on the file /usr/bin/kmod.
https://bugzilla.redhat.com/show_bug.cgi?id=1082631
[ 4 ] Bug #1083111 - Upcoming varnish-4.0.0 release needs changes in selinux policy
https://bugzilla.redhat.com/show_bug.cgi?id=1083111
[ 5 ] Bug #1023610 - SELinux is preventing /usr/bin/postgres from 'read' accesses on the file unix.
https://bugzilla.redhat.com/show_bug.cgi?id=1023610
[ 6 ] Bug #1026851 - selinux with procmail and doveadm
https://bugzilla.redhat.com/show_bug.cgi?id=1026851
[ 7 ] Bug #1028178 - SELinux is preventing /usr/lib64/chromium-browser/chromium-browser from 'write' accesses on the sock_file bumblebee.socket.
https://bugzilla.redhat.com/show_bug.cgi?id=1028178
[ 8 ] Bug #1066124 - ftp_home_dir set to off allows FTP login to user home directory
https://bugzilla.redhat.com/show_bug.cgi?id=1066124
[ 9 ] Bug #1072642 - SELinux is preventing /usr/lib64/erlang/erts-5.10.4/bin/beam.smp from 'create' accesses on the file couchdb.pid.
https://bugzilla.redhat.com/show_bug.cgi?id=1072642
[ 10 ] Bug #1072983 - Wrong SELinux policies set for neutron-dhcp-agent
https://bugzilla.redhat.com/show_bug.cgi?id=1072983
[ 11 ] Bug #1076672 - SELinux is preventing /usr/sbin/snort-plain from 'write' accesses on the file /var/log/snort/snort.log.1394809020.
https://bugzilla.redhat.com/show_bug.cgi?id=1076672
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update selinux-policy' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 11 months
[SECURITY] Fedora 20 Update: python-simplejson-3.5.3-1.fc20
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2014-7715
2014-06-26 00:51:07
--------------------------------------------------------------------------------
Name : python-simplejson
Product : Fedora 20
Version : 3.5.3
Release : 1.fc20
URL : http://undefined.org/python/#simplejson
Summary : Simple, fast, extensible JSON encoder/decoder for Python
Description :
simplejson is a simple, fast, complete, correct and extensible JSON
<http://json.org> encoder and decoder for Python 2.5+. It is pure Python code
with no dependencies, but includes an optional C extension for a serious speed
boost.
The encoder may be subclassed to provide serialization in any kind of
situation, without any special support by the objects to be serialized
(somewhat like pickle).
The decoder can handle incoming JSON strings of any specified encoding (UTF-8
by default).
simplejson is the externally maintained development version of the json library
included with Python 2.6 and Python 3.0, but maintains backwards compatibility
with Python 2.5. It gets updated more regularly than the json module in the
python stdlib.
--------------------------------------------------------------------------------
Update Information:
Fixes a potential security issue https://github.com/simplejson/simplejson/issues/98
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jun 24 2014 Luke Macken <lmacken(a)redhat.com> - 3.5.3-1
- Update to 3.5.3 (#1093685, #1112285)
* Sat Jun 7 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 3.4.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
* Wed May 14 2014 Bohuslav Kabrda <bkabrda(a)redhat.com> - 3.4.0-2
- Rebuilt for https://fedoraproject.org/wiki/Changes/Python_3.4
* Mon Apr 7 2014 Luke Macken <lmacken(a)redhat.com> - 3.4.0-1
- Update to 3.4.0 (#1083979)
* Wed Feb 19 2014 Luke Macken <lmacken(a)redhat.com> - 3.3.3-1
- Update to 3.3.3 (#960949)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1093685 - python-simplejson-3.5.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1093685
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update python-simplejson' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 11 months
Fedora 20 Update: sqlite-3.8.5-1.fc20
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2014-7242
2014-06-11 15:34:31
--------------------------------------------------------------------------------
Name : sqlite
Product : Fedora 20
Version : 3.8.5
Release : 1.fc20
URL : http://www.sqlite.org/
Summary : Library that implements an embeddable SQL database engine
Description :
SQLite is a C library that implements an SQL database engine. A large
subset of SQL92 is supported. A complete database is stored in a
single disk file. The API is designed for convenience and ease of use.
Applications that link against SQLite can enjoy the power and
flexibility of an SQL database without the administrative hassles of
supporting a separate database server. Version 2 and version 3 binaries
are named to permit each to be installed on a single host
--------------------------------------------------------------------------------
Update Information:
Update to latest upstream version.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jun 10 2014 Jan Stanek <jstanek(a)redhat.com> - 3.8.5-1
- Update to version 3.8.5 (http://www.sqlite.org/releaselog/3_8_5.html)
- Dropped patch already included upstream
* Sun Jun 8 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 3.8.4.3-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
* Thu Jun 5 2014 Peter Robinson <pbrobinson(a)fedoraproject.org> 3.8.4.3-4
- Don't make tests fail the build on aarch64 like some of the other arches
* Wed May 28 2014 Jan Stanek <jstanek(a)redhat.com> - 3.8.4.3-3
- Rebuilt for https://fedoraproject.org/wiki/Changes/f21tcl86 with correct tcl_version
* Wed May 21 2014 Jaroslav Škarvada <jskarvad(a)redhat.com> - 3.8.4.3-2
- Rebuilt for https://fedoraproject.org/wiki/Changes/f21tcl86
* Tue Apr 29 2014 Jan Stanek <jstanek(a)redhat.com> - 3.8.4.3-1
- Update to version 3.8.4.3 (http://www.sqlite.org/releaselog/3_8_4_3.html)
- Changed patch for rhbz#1075889 to upstream version
Related: #1075889
* Fri Apr 25 2014 Honza Horak <hhorak(a)redhat.com> - 3.8.4.2-3
- Revert part of the upstream commit dca1945aeb3fb005, since it causes
nautilus to crash
Related: #1075889
* Wed Apr 2 2014 Jan Stanek <jstanek(a)redhat.com> 3.8.4.2-2
- Added building and shipping of sqlite3_analyzer (#1007159)
* Fri Mar 28 2014 Jan Stanek <jstanek(a)redhat.com> 3.8.4.2-1
- Update to 3.8.4 (http://www.sqlite.org/releaselog/3_8_4_2.html)
* Tue Mar 11 2014 Jan Stanek <jstanek(a)redhat.com> 3.8.4-1
- Update to 3.8.4 (http://www.sqlite.org/releaselog/3_8_4.html)
* Sun Feb 23 2014 Peter Robinson <pbrobinson(a)fedoraproject.org> 3.8.3-2
- Re-enable check on ARM/aarch64 as failing test fixed upstream for non x86 arches
- Modernise spec
* Tue Feb 11 2014 Jan Stanek <jstanek(a)redhat.com> 3.8.3-1
- Update to 3.8.3 (http://www.sqlite.org/releaselog/3_8_3.html)
- Dropped man-page patch - included upstream
* Mon Jan 6 2014 Peter Robinson <pbrobinson(a)fedoraproject.org> 3.8.2-2
- Add aarch64 to all the other arch excludes for tests
* Tue Dec 10 2013 Jan Stanek <jstanek(a)redhat.com> - 3.8.2-1
- Update to 3.8.2 (http://www.sqlite.org/releaselog/3_8_2.html)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1105824 - sqlite-3.8.5 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1105824
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update sqlite' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 11 months
Fedora 20 Update: php-Slim-2.4.3-1.fc20
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2014-6247
2014-05-12 04:39:30
--------------------------------------------------------------------------------
Name : php-Slim
Product : Fedora 20
Version : 2.4.3
Release : 1.fc20
URL : http://www.slimframework.com/
Summary : PHP micro framework
Description :
Slim is a PHP micro framework that helps you quickly write simple yet
powerful web applications and APIs.
Features:
- Powerful router
- Standard and custom HTTP methods
- Route parameters with wildcards and conditions
- Route redirect, halt, and pass
- Route middleware
- Template rendering with custom views
- Flash messages
- Secure cookies with AES-256 encryption
- HTTP caching
- Logging with custom log writers
- Error handling and debugging
- Middleware and hook architecture
- Simple configuration
--------------------------------------------------------------------------------
Update Information:
New upstream release
--------------------------------------------------------------------------------
ChangeLog:
* Sat May 10 2014 Johan Cwiklinski <johan AT x-tnd DOT be> - 2.4.3-1
- New upstream release
* Sun Dec 8 2013 Johan Cwiklinski <johan AT x-tnd DOT be> - 2.4.0-1
- New upstream release
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update php-Slim' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 11 months
Fedora 19 Update: php-Slim-2.4.3-1.fc19
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2014-6259
2014-05-12 04:40:15
--------------------------------------------------------------------------------
Name : php-Slim
Product : Fedora 19
Version : 2.4.3
Release : 1.fc19
URL : http://www.slimframework.com/
Summary : PHP micro framework
Description :
Slim is a PHP micro framework that helps you quickly write simple yet
powerful web applications and APIs.
Features:
- Powerful router
- Standard and custom HTTP methods
- Route parameters with wildcards and conditions
- Route redirect, halt, and pass
- Route middleware
- Template rendering with custom views
- Flash messages
- Secure cookies with AES-256 encryption
- HTTP caching
- Logging with custom log writers
- Error handling and debugging
- Middleware and hook architecture
- Simple configuration
--------------------------------------------------------------------------------
Update Information:
New upstream release
--------------------------------------------------------------------------------
ChangeLog:
* Sat May 10 2014 Johan Cwiklinski <johan AT x-tnd DOT be> - 2.4.3-1
- New upstream release
* Sun Dec 8 2013 Johan Cwiklinski <johan AT x-tnd DOT be> - 2.4.0-1
- New upstream release
* Thu Aug 8 2013 Johan Cwiklinski <johan AT x-tnd DOT be> - 2.3.0-1
- New upstream release
* Wed Apr 17 2013 Johan Cwiklinski <johan AT x-tnd DOT be> - 2.2.0-1
- New upstream release
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update php-Slim' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 11 months
Fedora 20 Update: php-Smarty-3.1.18-1.fc20
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2014-6236
2014-05-12 04:38:59
--------------------------------------------------------------------------------
Name : php-Smarty
Product : Fedora 20
Version : 3.1.18
Release : 1.fc20
URL : http://www.smarty.net
Summary : Template/Presentation Framework for PHP
Description :
Although Smarty is known as a "Template Engine", it would be more accurately
described as a "Template/Presentation Framework." That is, it provides the
programmer and template designer with a wealth of tools to automate tasks
commonly dealt with at the presentation layer of an application. I stress the
word Framework because Smarty is not a simple tag-replacing template engine.
Although it can be used for such a simple purpose, its focus is on quick and
painless development and deployment of your application, while maintaining
high-performance, scalability, security and future growth.
--------------------------------------------------------------------------------
Update Information:
New upstream release
--------------------------------------------------------------------------------
ChangeLog:
* Sat May 10 2014 Johan Cwiklinski <johan AT x-tnd DOT be> - 3.1.18-1
- Last upstream release
* Sun Dec 22 2013 Johan Cwiklinski <johan AT x-tnd DOT be> - 3.1.16-1
- Last upstream release
* Sun Dec 8 2013 Johan Cwiklinski <johan AT x-tnd DOT be> - 3.1.15-1
- Last upstream release
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update php-Smarty' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 11 months