File history - forks/psss/rpms/selinux-policy

Dan Berrange asked that we allow compromize_kernel for all virt domains, and says virt_use_sysfs is no longer needed. Needs back port to F18.

Dan Walsh • 11 years ago

c02f178

Remove duplicate rules from contrib *.te files

Miroslav Grepl • 11 years ago

0c593c2

Remove redundant files_read_usr_file calling

Miroslav Grepl • 11 years ago

24c32b2

Remove redundant files_read_etc_file calling

Miroslav Grepl • 11 years ago

0235b95

Allow svirt_t images to compromise_kernel when using pci-passthrough

Dan Walsh • 11 years ago

63e5fc1

Allow svirt_tcg_t to create netlink_route_socket

Miroslav Grepl • 11 years ago

ad3b1c5

Allow lxc domains to read fusefs, since libvirt is mounding a fuse file system at /proc/meminfo

Dan Walsh • 11 years ago

2d5e8d9

Merge branch 'master_contrib' of ssh://git.fedorahosted.org/git/selinux-policy into master_contrib

Dan Walsh • 11 years ago

ae44e53

Allow virtd_t to setattr on virt_image_t directory

Miroslav Grepl • 11 years ago

205b0f3

Allow virtd_lxc_t to execute ifconfig

Dan Walsh • 11 years ago

0099626

Allow svirt_t to read generic certs

Miroslav Grepl • 11 years ago

720157d

Allow virtd_lxc_t to request the kernel to load modules

Dan Walsh • 11 years ago

f7daf1f

Backport virt_qemu_ga_t changes from RHEL

Miroslav Grepl • 11 years ago

85ecd40

We need to back port this policy to RHEL6, for lxc domains

Dan Walsh • 11 years ago

ce5c22b

libvirt needs to inhibit systemd

Dan Walsh • 11 years ago

2d66d36

virtd_lxc_t is using /dev/fuse

Dan Walsh • 11 years ago

039cc9a

libvirt is communicating with logind

Dan Walsh • 11 years ago

c973c92

Allow svirt domains to use nscd

Miroslav Grepl • 11 years ago

f04972d

Allow svirt to use netlink_route_socket which was a part of auth_use_nsswitch

Miroslav Grepl • 11 years ago

d3e8d7f

Allow virt_domain to read /etc/resolve.conf

Miroslav Grepl • 11 years ago

b52c314

Change guestfs_socket_t to svirt_socket_t label to be more generic

Dan Walsh • 11 years ago

f003e42

Add svirt_socket_t type, and allow svirt_t to communicate with it. Allow

Dan Walsh • 11 years ago

0824cb9

Change name of svirt_nokvm_t to svirt_tcg_t

Dan Walsh • 11 years ago

ed1d2b2

Take away svirt_t ability to use nsswitch.

Dan Walsh • 11 years ago

1eebd6a

Miroslav Grepl • 11 years ago

9d36b8e

Change svirt_prot_exec_t to svirt_nokvm_t, and fix policy so the only difference between svirt_t and svirt_nokvm_t is execmem,execstack

Dan Walsh • 11 years ago

0806bec

Testing virt with lxc requiers additional access for virtsh_t

Dan Walsh • 11 years ago

48599ad

New allow rules requied for latest libvirt, libvirt talks directly to journald, lxc setup tool needs compromize_kernel, and we need ipc_lock in the container

Dan Walsh • 11 years ago

40b914e

Allow lxc domains to use /dev/random and /dev/urandom, as well as netlink_sockets

Dan Walsh • 11 years ago

8fabd8c

virt_qemu_ga_t executes pm-is-supported, pm-hibernate, pm-suspend, pm-suspend-hybrid and /sbin/shutdown

Miroslav Grepl • 11 years ago

813e3dc

Add boolean to allow virt to use rawip

rhatdan • 11 years ago

9d8bbc1

Allow libvirt to set the kernel sched algorythm

rhatdan • 11 years ago

e509cdc

Remove calls to miscfiles_read_localization all domains get this

rhatdan • 11 years ago

e90ea67

CLeanup parens

rhatdan • 11 years ago

7f05e52

Allow virsh_t to read /root/.pki/ content

rhatdan • 11 years ago

74242eb

A couple of more compromise_kernel for virt and devicekit_power

rhatdan • 11 years ago

d5d1d79

Add policy for qemu-qa

Miroslav Grepl • 11 years ago

f2d9166

allow containers to send audit messages

rhatdan • 11 years ago

936b5cb

Add missing sanlock unit file type and fixup virt and nscd unit file context

rhatdan • 11 years ago

e491048

Add labels for virtd unit files

rhatdan • 11 years ago

7736298

Allow virsh_t to interact with new fenced daemon

rhatdan • 11 years ago

fc0b426

kernel_read_system_state() needs to be called for types not for attributes

Miroslav Grepl • 11 years ago

1bafb67

Need to allow svirt_t to write to svirt_image_t sock_files

rhatdan • 11 years ago

d45bbfe

Stop using attributes form netlabel_peer and syslog, auth_use_nsswitch setsup netlabel_peer, cleanup whitespace

rhatdan • 11 years ago

ab85b47

Stop using attributes form netlabel_peer and syslog, auth_use_nsswitch setsup netlabel_peer

rhatdan • 11 years ago

6a213c4

Remove use of attributes when calling syslog call

rhatdan • 11 years ago

05b4f84

Move -miscfiles_read_localization to domain.te to save hundreds of allow rules

rhatdan • 11 years ago

51fa205

Allow svirt_t domains to read alsa configuration files

rhatdan • 11 years ago

701e528

Allow virt_bridgehelper_t to manage content in the svirt_home_t labeled directories

rhatdan • 11 years ago

e786db2

Allow virsh_t to send syslog messages

rhatdan • 11 years ago

ecac44b

Fix typo

Miroslav Grepl • 11 years ago

0d9e80e

Allow svirt domains to manage the network since this is containerized

rhatdan • 11 years ago

51c13b4

Allow svirt_lxc_net_t to send audit messages, we need to create a audit subsystem namespace to prevent confusion on where audit messages are coming from

rhatdan • 11 years ago

95e6250

Allow virtd to send dbus messages to firewalld so it can configure the firewall

rhatdan • 11 years ago

e28a2a3

Fix labeling of content in /run created by virsh_t

rhatdan • 11 years ago

432dac7

Allow virsh_t to manage virt_lxc_var_run_t

rhatdan • 11 years ago

58f9f2a

Allow libvirt-lxc containers to read apache content

rhatdan • 11 years ago

8ff7f37

Fix svirt to be allowed to use fusefs file system

rhatdan • 11 years ago

71fa09b

Need to allow svirt_t ability to getattr on nfs_t file system

rhatdan • 11 years ago

847d938

Change virt interface so confined users can optionally manage virt content

rhatdan • 11 years ago

0f295e2

Dontaudit block_suspend from containers, they should not be allowed to block suspend

Dan Walsh • 11 years ago

d4dbfce

More rules required for containers

Dan Walsh • 11 years ago

fcfe6bb

Fix virt_transition_svirt_lxc() calling in virt.te

Miroslav Grepl • 11 years ago

faff1ba

Allow virsh_t to manage svirt_lxc containers

Dan Walsh • 11 years ago

7592ee4

Fix cron interface

Dan Walsh • 11 years ago

c5c52b1

Merge branch 'master_contrib' of ssh://git.fedorahosted.org/git/selinux-policy into master_contrib

Dan Walsh • 11 years ago

560aac0

More fixes to allow virt-sandbox-service to run as virsh_t, and virtsh_t to be run as a cron job

Dan Walsh • 11 years ago

9c6953b

Merge http://oss.tresys.com/git/refpolicy-contrib into master_contrib_merge

Miroslav Grepl • 11 years ago

b25a519

New access required to get containers to work in enforcing mode

Dan Walsh • 11 years ago

b6c47b6

The ability to sys_boot is not containerized

Dan Walsh • 11 years ago

44d31dc

Remove corenet_all_recvfrom_unlabeled() calling fro policy files we moved it to domain.if for all domain_type

Miroslav Grepl • 11 years ago

e913b17

Label virt-sandbox-service* as virsh_exec_t

Dan Walsh • 11 years ago

59e40b0

Bump module versions for release.

Chris PeBenito • 11 years ago

1a411e9

Virt seems to be using lock files

Dan Walsh • 11 years ago

91b5298

The kernel hands an svirt domains /SYSxxxxx which is a tmpfs that httpd wants to read and write

Dan Walsh • 11 years ago

0e8d941

Add a bunch of dontaudit rules to quiet svirt_lxc domains

Dan Walsh • 11 years ago

b8b3f0e

Additional perms needed to run svirt_lxc domains

Dan Walsh • 11 years ago

b6f81c0

Additional allow rules for svirt_lxc

Dan Walsh • 11 years ago

00eef8a

nss_domain attribute patch 2, Miroslav Grepl

Chris PeBenito • 11 years ago

7b2152c

Remove files_read_etc_files() calling from all policies which have auth_use_nsswith()

Miroslav Grepl • 11 years ago

0addc21

Revert "remove files_read_etc_files() calling from all policies which have auth_use_nsswith()"

Miroslav Grepl • 11 years ago

4a1862e

remove files_read_etc_files() calling from all policies which have auth_use_nsswith()

Miroslav Grepl • 11 years ago

dd98158

Alow virt_lxc_t to read urand

Dan Walsh • 11 years ago

f5f28af

Allow virtd to exec xend_exec_t without transition

Dan Walsh • 11 years ago

be2ae3b

Allow virtd_lxc_t to unmount all file systems

Dan Walsh • 11 years ago

1e105ad

virtd_lxc_t unmounts kernel file systems

Dan Walsh • 11 years ago

e4ec94b

libvirt now needs to manage dnsmasq files

Dan Walsh • 11 years ago

bcb07b1

Allow virsh to read /etc/passwd

Dan Walsh • 11 years ago

4ef54f7

Merge others

Miroslav Grepl • 11 years ago

c3af651

Merge http://oss.tresys.com/git/refpolicy-contrib into master_contrib

Miroslav Grepl • 11 years ago

0057dfd

Remove files which are not part of refpolicy-contrib

Miroslav Grepl • 11 years ago

1ec3d1a

Module version update for virt updates from Sven Vermeulen.

Chris PeBenito • 12 years ago

6c192c7

Let libvirt write its own tmp files (and execute them)

Sven Vermeulen • 12 years ago

2557ee4

Module version bump for virt patch from Sven Vermeulen.

Chris PeBenito • 12 years ago

ba7eb3b

Allow virtd to read the selinux config

Sven Vermeulen • 12 years ago

d236194

Add modules from refpolicy core repository.

Chris PeBenito • 12 years ago

9401ae1

psss / rpms / selinux-policy

History virt.te

psss / rpms / selinux-policy

Source Code

History virt.te