-
Wed May 22 2024 Pooja Senthil Kumar <pooja.senthil.kumar@oracle.com> - 3.14.3-139.0.1
- Allow kdump create and use its memfd: objects [Orabug: 36538844]
- Allow cgred_t to get attributes of cgroup filesystems [Orabug: 36226040]
- Allow exim_t to read exim_log_t and manage exim_spool_t link files [Orabug: 36170954]
- Allow mailman_domain to manage mailman_log_t link files [Orabug: 36160497]
- Label /var/log/kdump.log with kdump_log_t [Orabug: 32911792]
- Allow tuned_t to manage information from the debugging filesystem [Orabug: 34685730]
- Allow kdumpctl_t to execmem [Orabug: 34712872]
- Allow svirt_t domain to mmap svirt_image_t character files [Orabug: 34314421]
- Allow tuned_t to read the process state of all domains [Orabug: 33520684]
- Allow initrc_t to manage pid files used by chronyd [Orabug: 33520623]
- Make import-state work with mls policy [Orabug: 32636699]
- Add map permission to lvm_t on lvm_metadata_t. [Orabug: 31405325]
- Add comment for map on lvm_metadata_t. [Orabug: 31405325]
- Make iscsiadm work with mls policy [Orabug: 32725411]
- Make cloud-init work with mls policy [Orabug: 32430460]
- Allow systemd-pstore to transfer files from /sys/fs/pstore [Orabug: 31594666]
- Make smartd work with mls policy [Orabug: 32430379]
- Allow sysadm_t to mmap modules_object_t files [Orabug: 32411855]
- Allow tuned_t to execute systemd_systemctl_exec_t files [Orabug: 32355342]
- Make logrotate work with mls policy [Orabug: 32343731]
- Add interface kernel_relabelfrom_usermodehelper() [Orabug: 31396031]
- Allow systemd_tmpfiles_t domain to relabel from usermodehelper_t files [Orabug: 31396031]
- Make udev work with mls policy [Orabug: 31405299]
- Make tuned work with mls policy [Orabug: 31396024]
- Make lsmd, rngd, and kdumpctl work with mls policy [Orabug: 31405378]
- Allow virt_domain to mmap virt_content_t files [Orabug: 30932671]
- Enable NetworkManager and dhclient to use initramfs-configured DHCP connection [Orabug: 30537515]
- Enable policykit and sssd policy modules with minimum policy [Orabug: 29744511]
- Allow udev_t to load modules [Orabug: 28260775]
- Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
- Fix container selinux policy [Orabug: 26427364]
- Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type. [Orabug: 13333429]
-
Fri Mar 08 2024 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-139
- Allow wdmd read hardware state information
Resolves: RHEL-27507
-
Fri Mar 08 2024 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-138
- Allow wdmd list the contents of the sysfs directories
Resolves: RHEL-27507
- Allow linuxptp configure phc2sys and chronyd over a unix domain socket
Resolves: RHEL-27394
-
Thu Feb 22 2024 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-137
- Differentiate between staff and sysadm when executing crontab with sudo
Resolves: RHEL-1388
- Allow su domains write login records
Resolves: RHEL-2606
- Revert "Allow su domains write login records"
Resolves: RHEL-2606
- Add crontab_admin_domtrans interface
Resolves: RHEL-1388
- Allow gpg manage rpm cache
Resolves: RHEL-11249
-
Thu Feb 15 2024 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-136
- Transition from sudodomains to crontab_t when executing crontab_exec_t
Resolves: RHEL-1388
- Fix label of pseudoterminals created from sudodomain
Resolves: RHEL-1388
- Allow login_userdomain to manage session_dbusd_tmp_t dirs/files
Resolves: RHEL-22500
- Label /dev/ngXnY and /dev/nvme-subsysX with nvme_device_t
Resolves: RHEL-23442
- Allow admin user read/write on fixed_disk_device_t
Resolves: RHEL-23434
- Only allow confined user domains to login locally without unconfined_login
Resolves: RHEL-1628
- Add userdom_spec_domtrans_confined_admin_users interface
Resolves: RHEL-1628
- Only allow admindomain to execute shell via ssh with ssh_sysadm_login
Resolves: RHEL-1628
- Add userdom_spec_domtrans_admin_users interface
Resolves: RHEL-1628
- Move ssh dyntrans to unconfined inside unconfined_login tunable policy
Resolves: RHEL-1628
- Allow utempter_t use ptmx
Resolves: RHEL-25002
- Dontaudit subscription manager setfscreate and read file contexts
Resolves: RHEL-21639
- Don't audit crontab_domain write attempts to user home
Resolves: RHEL-1388
- Add crontab_domtrans interface
Resolves: RHEL-1388
- Add dbus_manage_session_tmp_files interface
Resolves: RHEL-22500
- Allow httpd read network sysctls
Resolves: RHEL-22748
- Allow keepalived_unconfined_script_t dbus chat with init
Resolves: RHEL-22843
-
Fri Jan 26 2024 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-135
- Label /tmp/libdnf.* with user_tmp_t
Resolves: RHEL-11249
- Allow su domains write login records
Resolves: RHEL-2606
- Allow gpg read rpm cache
Resolves: RHEL-11249
- Allow unix dgram sendto between exim processes
Resolves: RHEL-21903
- Allow hypervkvp_t write access to NetworkManager_etc_rw_t
Resolves: RHEL-17687
- Add interface for write-only access to NetworkManager rw conf
Resolves: RHEL-17687
- Allow conntrackd_t to use sys_admin capability
Resolves: RHEL-22276
-
Fri Jan 12 2024 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-134
- Allow syslog to run unconfined scripts conditionally
Resolves: RHEL-10087
- Allow syslogd_t nnp_transition to syslogd_unconfined_script_t
Resolves: RHEL-10087
- Allow collectd connect to statsd port
Resolves: RHEL-19482
- Allow collectd_t read network state symlinks
Resolves: RHEL-19482
- Allow collectd_t domain to create netlink_generic_socket sockets
Resolves: RHEL-19482
- Allow opafm search nfs directories
Resolves: RHEL-19426
- Allow mdadm list stratisd data directories
Resolves: RHEL-21374
-
Wed Dec 13 2023 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-133
- Label /dev/acpi_thermal_rel char device with acpi_device_t
Resolves: RHEL-18027
- Allow sysadm execute traceroute in sysadm_t domain using sudo
Resolves: RHEL-9947
- Allow sysadm execute tcpdump in sysadm_t domain using sudo
Resolves: RHEL-15398
- Add support for syslogd unconfined scripts
Resolves: RHEL-10087
- Label /dev/wmi/dell-smbios as acpi_device_t
Resolves: RHEL-18027
- Make named_zone_t and named_var_run_t a part of the mountpoint attribute
Resolves: RHEL-1954
- Dontaudit rhsmcertd write memory device
Resolves: RHEL-17721
-
Tue Nov 28 2023 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-132
- Allow sudodomain read var auth files
Resolves: RHEL-16567
- Update cifs interfaces to include fs_search_auto_mountpoints()
Resolves: RHEL-14072
- Allow systemd-localed create Xserver config dirs
Resolves: RHEL-16715
- Label /var/run/auditd.state as auditd_var_run_t
Resolves: RHEL-14376
- Allow auditd read all domains process state
Resolves: RHEL-14471
- Allow sudo userdomain to run rpm related commands
Resolves: RHEL-1679
- Remove insights_client_watch_lib_dirs() interface
Resolves: RHEL-16185
-
Wed Nov 08 2023 Zdenek Pytela <zpytela@redhat.com> - 3.14.3-131
- Additional permissions for ip-vrf
Resolves: RHEL-9981
- Allow ip an explicit domain transition to other domains
Resolves: RHEL-9981
- Allow winbind_rpcd_t processes access when samba_export_all_* is on
Resolves: RHEL-5845
- Allow system_mail_t manage exim spool files and dirs
Resolves: RHEL-14186