* Thu Sep 15 2016 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-191.16
- Allow attach usb device to virtual machine BZ(1276873)
- Dontaudit mozilla_plugin to sys_ptrace
- Allow nut_upsdrvctl_t domain to read udev db BZ(1375636)
- Fix typo
- Allow geoclue to send msgs to syslog. BZ(1371818)
- Allow abrt to read rpm_tmp_t dirs
- Add interface rpm_read_tmp_files()
- Update oracleasm SELinux module that can manage oracleasmfs_t blk files. Add dac_override cap to oracleasm_t domain.
- Add few rules to pcp SELinux module to make ti able to start pcp_pmlogger service
- Add oracleasm_conf_t type and allow oracleasm_t to create /dev/oracleasm
- Label /usr/share/pcp/lib/pmie as pmie_exec_t and /usr/share/pcp/lib/pmlogger as pmlogger_exec_t
- Allow mdadm_t to getattr all device nodes
- Dontaudit gkeyringd_domain to connect to system_dbusd_t
- Add interface dbus_dontaudit_stream_connect_system_dbusd()
- Allow guest-set-user-passwd to set users password.
- Allow domains using kerberos to read also kerberos config dirs
- Add kdymp_t domain sys_admin capability BZ(1357949)
- Allow dnssec_trigger to exec ldconfig
- Allow svirt_sandbox_domains to r/w onload sockets
- Fix typo bugs in rsync and inetd SELinux modules
- Fixes for containers
- Idenitfy these domains as init daemons
- Allow samdbox domains to use msg class
- Allow add new interface to new namespace BZ(1375124)
- Dontaudit domain to create any file in /proc. This is kernel bug.
- Add new interface fs_getattr_oracleasmfs_fs()
- Add interface fs_manage_oracleasm()
- Label /dev/kfd as hsa_device_t
- Update seutil_manage_file_contexts() interface that caller domain can also manage file_context_t dirs
- Add transition rule that caller domain can create resolv.conf link file with correct label in sysnet_filetrans_named_content() interface
- Allow run sulogin_t in range mls_systemlow-mls_systemhigh.