Skip to content

Releases: SELinuxProject/refpolicy

2.20240916

16 Sep 18:17
RELEASE_2_20240916
2152e9b
Compare
Choose a tag to compare

Notable Changes

  • Added sechecker configuration for GitHub CI actions.
  • Cleaned up concerning permissions uncovered by sechecker
  • Removed extremely deprecated domains in cups (ptal) and xen (xend/xm)
  • Systemd updates up to v256
  • Various container fixes

New Modules

  • haproxy

Full Changelog

RELEASE_2_20240226...RELEASE_2_20240916

Name SHA-256 SUM
refpolicy-2.20240916.tar.bz2 a4e39072ac91bf092a08660b246a49f3e986ca2c16402a5b1fad3ae374e8d747

2.20240226

26 Feb 19:18
Compare
Choose a tag to compare

Notable Changes

  • Many systemd updates up to v255.
  • RPM and dnf fixes
  • Tighten private key handling for Apache
  • Many container and kubernetes improvements
  • Add support for Cilium
  • Update object class definitions up to io_uring:cmd.
  • Add additional rules to cloud-init based on sysadm_t.

New Modules

  • cockpit

Full Changelog

RELEASE_2_20231002...RELEASE_2_20240226

Name SHA-256 SUM
refpolicy-2.20240226.tar.bz2 7ed41f4f45189b9ee9706da8ac357eccc103651b56daabaddb54c436e8117cf9

2.20231002

02 Oct 17:53
Compare
Choose a tag to compare

Notable Changes

  • Several Gentoo fixes ported from Gentoo policy
  • Fixes for containerd/docker
  • Move excessive capabilities in container_t to tunables.
  • Various systemd updates and fixes
  • Updated object class/permission definitions for recent kernels
  • Add support for systemd memory pressure notifications protocol
  • Xscreensaver updates for their newest release
  • Remove interfaces deprecated before 2021
  • Add tunables to control network access in:
    • *_dbusd_t
    • pulseaudio_t
    • spamc_t
    • syslogd_t
    • xdm_t
    • xserver_t

New Modules/Domains

  • crio
  • eg25manager
  • iiosensorproxy
  • kubernetes
  • lomemorymonitor
  • powerprofiles
  • rasdaemon
  • switcheroo
  • systemd-pcrphrase
  • thunderbolt

Full Changelog: RELEASE_2_20221101...RELEASE_2_20231002

Name SHA-256 SUM
refpolicy-2.20231002.tar.bz2 c89cd3b2e5d99765cc24536fd8e76de83951ad23e05472350328b5a4f8bee410

2.20221101

01 Nov 14:17
Compare
Choose a tag to compare

Notable changes:

  • Clean up MCS constraints and add missing checks for IPC and sockers.
  • Many minor fixes across the policy.

New modules:

  • cloud-init
  • fapolicyd
  • opensm
  • sympa
  • zfs
Name SHA-256 SUM
refpolicy-2.20221101.tar.bz2 44f88e62c8efcef54d019b9ca077520d5993de580926bd7575788cfa78515396

2.20220520

20 May 14:01
Compare
Choose a tag to compare

Notable changes:

  • New support for containers using several container engines. Added udica templates.
  • Defined new object classes: mctp_socket, anon_inode, io_uring
  • Many minor fixes across the policy.

New modules:

  • container
  • docker
  • matrixd
  • node_exporter
  • podman
  • rootlesskit
Name SHA-256 SUM
refpolicy-2.20220520.tar.bz2 0ce9771eab8771180c249baaf6e8c55dda383a2ddf94460588f9f16e5d32f1f7

2.20220106

06 Jan 19:35
Compare
Choose a tag to compare

Notable changes:

  • Module versions were dropped. Policy module versions were removed in semodule many years ago, so they no longer serve a purpose in the policy. The policy_module() macro still supports the version argument. If it is missing, a default version is set, to satisfy the policy syntax.
  • The MCS constraints changed to reflect the usage in systems, primarily for separating containers and VMs. To separate a domain by MCS it will now need to opt in using the mcs_constrained() interface.
  • New support for grouping user domains and their surrogates, e.g. user_t surrogates user_wm_t and user_systemd_t, such that allowing the user domain to domain transition to a child domain will be allowed for surrogate domains. See pull requests #365 and #381 for more information.

New module:

  • obfs4proxy
Name SHA-256 SUM
refpolicy-2.20220106.tar.bz2 965f98f0b68a24fd0b8e8d973d319332aea88973e1d6c455ef9c2a31aefaeaa6

2.20210908

08 Sep 19:07
Compare
Choose a tag to compare

Removed Modules:

  • aiccu
  • bcfg2
  • callweaver
  • ccs
  • cipe
  • clockspeed
  • clogd
  • cmirrord
  • dcc
  • denyhosts
  • dspam
  • ddcprobe
  • howl
  • imaze
  • jockey
  • ktalk
  • lockdev
  • mailscanner
  • oav
  • polipo
  • pyicqt
  • rgmanager
  • rhcs
  • ricci

Notable changes:

  • Use user_fonts_config_t in user font dirs, instead of xdg_config_t.
  • Add a secure_mode_boolean to disable boolean changing. Change generic booleans to boolean_t.
  • Drop second parameter of systemd_tmpfilesd_managed().
  • Add a new type for ICMP packets.
  • Add support for the blkmapd RPC service.
  • Set ubifs as an extended attribute handling filesystem.
  • Many other minor rule fixes.
Name SHA-256 SUM
refpolicy-2.20210908.tar.bz2 4d3140d9fbb91322f5de36d73959464ce1d8946dcd149e36fcaf60e92444e902

2.20210203

03 Feb 14:33
Compare
Choose a tag to compare

Added modules:

  • certbot
  • memlockd

Removed modules:

  • consolekit
  • dnssectrigger
  • hal
  • hotplug
  • kdumpgui
  • keyboardd
  • kudzu
  • pcmcia
  • readahead
  • rhgb
  • roundup
  • smoltclient
  • speedtouch
  • firewallgui
  • gift
  • podsleuth
  • ptchown
  • sambagui
  • w3c
  • xprint
  • yam

Changes:

  • ACPI shutdown fixes.
  • Revised policy style based on suggestions from SELint.
  • Add file context specs for unbound.
  • Update systemd for SELinux status page use.
  • Several corosync and pacemaker updates.
  • Improve support for handling cryptsetup and veritysetup devices.
  • Openrc Gentoo updates.
  • Added support for systemd-socket-proxyd.
  • Move XDG rules to userdomain.
  • Add -E option to setfiles commands
  • Dropped deprecated udev_tbl_t support.
  • Chromium updates along with X server DRI.
  • Removed interfaces deprecated 2018 or earlier.
  • Add rspamd support in spamassassin
  • Add support for acme.sh to certbot
  • Improvements to the monolithic build process
  • Several other minor fixes.
Name SHA-256 SUM
refpolicy-2.20210203.tar.bz2 48cbf2c63ff9003bef05e03c8d3cdddb4e8f63fef2a072ae51c987301f0b874d

2.20200818

18 Aug 13:46
Compare
Choose a tag to compare

New modules:

  • usbguard
  • aptcacher

Changes:

  • Renamed "pid" interfaces to "runtime" interfaces to match the *_var_run_t to *_runtime_t rename
  • Merge systemd generator domains
  • Several systemd updates
  • Set value of build options to "true" so m4 ifelse can be used
  • Revise relabeling access to prevent relabeling to unlabeled_t
  • Makefile, Vagrant, and m4 improvements
  • First pass of cleanups from SELint
  • Clean up domains that had user tty or pty access but could be used from either
  • Add various inotify watch permissions
  • Add rules for apt-catcher-ng and acngtool
  • Add support for generating nft tables to gennetfilter
  • Many more minor fixes across the policy

Removals:

  • Drop Python 2 compatibility code from genhomedircon.py
  • Remove unlabeled packet access
  • Remove ada module
Name SHA-256 SUM
refpolicy-2.20200818.tar.bz2 1488f9b94060de28addbcb29fb8437ee0d75cba15e11280dd9dfa3e09986f57b

2.20200229

01 Mar 00:14
Compare
Choose a tag to compare

This release includes several new modules:

  • cryfs
  • consolesetup
  • knot
  • tpm2
  • wireguard

Changes:

  • *_var_run_t types are renamed to *_runtime_t to remove the path from the type name
  • Added inotify watch permissions defined and added to systemd and other common services
  • Defined perf_event object class
  • Reimplemented fc_sort in Python
  • Added file contexts lint tool in Travis CI build
  • Updated Vagrant tooling for refpolicy testing on Fedora and Debian VMs
  • Added general interfaces for systemd bind mount points
  • Many more minor fixes across the policy

Removals:

  • Removed obsolete permissions

This release requires SELinux userspace 2.8 or higher and Python 3.4 to build.

Name SHA-256 SUM
refpolicy-2.20200229.tar.bz2 dec854512ed00cd057408f330c2cea4de7a4405f7a147458f59c994bf578e4b0