{"push_id":736809739,"size":72,"distinct_size":72,"ref":"refs/heads/master","head":"d3ef27f991b30f742d485806eecdfd1c8e572fa3","before":"b8b7889b11af9377589963dfc4756f80aa1dff71","commits":[{"sha":"da19f4dbdc54c44a30ecc218dc1dd01169efe08e","author":{"email":"b6c9b998acbbd27a0c842dba916d9e7587cf3504@siphos.be","name":"Sven Vermeulen"},"message":"Fix bug #549004 - Add /dev/shm support to salt master\n\nThe salt master daemon now uses /dev/shm for its semaphore definitions.\nAdd in the right salt_master_tmpfs_t type and grant salt_master_t the\nright set of privileges (manage salt_master_tmpfs_t files as well as\ninteract with tmpfs_t).\n\nX-Gentoo-Bug-URL: https://bugs.gentoo.org/show_bug.cgi?id=549004","distinct":true,"url":"https://api.github.com/repos/Feandil/hardened-refpolicy/commits/da19f4dbdc54c44a30ecc218dc1dd01169efe08e"},{"sha":"4181d381fa9d12a6c7836c6acbc06ccc8b26e6b6","author":{"email":"b6c9b998acbbd27a0c842dba916d9e7587cf3504@siphos.be","name":"Sven Vermeulen"},"message":"Remove catch-all for postfix libraries\n\nThe postfix libraries in /usr/lib/postfix were by default marked as\npostfix_exec_t. This however is a design mistake. Libraries should be\nof a library type (of which lib_t is a default) so that applications\nthat use it have the proper read/execute rights without needing those on\nthe *real* executable types of an application.","distinct":true,"url":"https://api.github.com/repos/Feandil/hardened-refpolicy/commits/4181d381fa9d12a6c7836c6acbc06ccc8b26e6b6"},{"sha":"105c5c80ee234d6bed09a47fa36746382e3830f7","author":{"email":"b6c9b998acbbd27a0c842dba916d9e7587cf3504@siphos.be","name":"Sven Vermeulen"},"message":"postmap is a user command\n\nWhen a postfix admin updates a postfix database, he has to call\n\"postmap hash:/etc/postfix/databasename\" in order to regenerate the\ndatabase (in case of a hash database in the example).\n\nTo allow postmap to give feedback on errors, grant it access to the user\nterminals and private file descriptors of the admin.","distinct":true,"url":"https://api.github.com/repos/Feandil/hardened-refpolicy/commits/105c5c80ee234d6bed09a47fa36746382e3830f7"},{"sha":"7f4df16703908b51f8a290532f1902a5981134ce","author":{"email":"b6c9b998acbbd27a0c842dba916d9e7587cf3504@siphos.be","name":"Sven Vermeulen"},"message":"Move specifics to ifdef distro_gentoo","distinct":true,"url":"https://api.github.com/repos/Feandil/hardened-refpolicy/commits/7f4df16703908b51f8a290532f1902a5981134ce"},{"sha":"115949be334ab475bf97fa29ad8dc2bc88b71c4c","author":{"email":"b6c9b998acbbd27a0c842dba916d9e7587cf3504@siphos.be","name":"Sven Vermeulen"},"message":"Add bugfix number to policy change for tracking","distinct":true,"url":"https://api.github.com/repos/Feandil/hardened-refpolicy/commits/115949be334ab475bf97fa29ad8dc2bc88b71c4c"},{"sha":"a2a70a8441dcf2d226c6f35ee8549acc420b0be1","author":{"email":"b6c9b998acbbd27a0c842dba916d9e7587cf3504@siphos.be","name":"Sven Vermeulen"},"message":"Fix bug #549640 - Add dontaudit getattr on chr and blk devices for sudo domain","distinct":true,"url":"https://api.github.com/repos/Feandil/hardened-refpolicy/commits/a2a70a8441dcf2d226c6f35ee8549acc420b0be1"},{"sha":"94b22b5403841d31a3eeb61bab332e81c3afb69d","author":{"email":"b6c9b998acbbd27a0c842dba916d9e7587cf3504@siphos.be","name":"Sven Vermeulen"},"message":"Add postfix operations to postfix_admin\n\nAllow postfix administrator to execute postfix:\n\n  ~# /usr/sbin/postfix reload\n\nThis also requires the administrative domain to have the ability to send\nlog messages.","distinct":true,"url":"https://api.github.com/repos/Feandil/hardened-refpolicy/commits/94b22b5403841d31a3eeb61bab332e81c3afb69d"},{"sha":"39073b3161feea2f4e2cbe3c36579127fc235ed6","author":{"email":"b6c9b998acbbd27a0c842dba916d9e7587cf3504@siphos.be","name":"Sven Vermeulen"},"message":"Additional rights for postfix admin","distinct":true,"url":"https://api.github.com/repos/Feandil/hardened-refpolicy/commits/39073b3161feea2f4e2cbe3c36579127fc235ed6"},{"sha":"2d0945fd8690985bd52af6f783df3289cdf61606","author":{"email":"172f6efbab1d24956eecf9b10e7705d05ebfa863@bigon.be","name":"Laurent Bigonville"},"message":"Add fc for /sys/kernel/debug as debugfs_t","distinct":true,"url":"https://api.github.com/repos/Feandil/hardened-refpolicy/commits/2d0945fd8690985bd52af6f783df3289cdf61606"},{"sha":"c2986eed04bbae7ef6ff1bdad6df31022abdc970","author":{"email":"68c46a606457643eab92053c1c05574abb26f861@perfinion.com","name":"Jason Zaman"},"message":"Introduce init_startstop_service interface\n\nThis is to be used where a role needs to start and stop a labeled\nservice. It centralizes all the rules for redhat < 6 sysvinit that\nwere used in the _admin interfaces. The rules for other inits will\nbe added later.","distinct":true,"url":"https://api.github.com/repos/Feandil/hardened-refpolicy/commits/c2986eed04bbae7ef6ff1bdad6df31022abdc970"},{"sha":"63a65bb081bc37f5f67316ea844e899f17fbc74c","author":{"email":"afd0674be3d8ca6f9a3bdb7b57fdb0c886370bc8@tresys.com","name":"Chris PeBenito"},"message":"Module version bump for debufs mount point fc entry from Laurent Bigonville.","distinct":true,"url":"https://api.github.com/repos/Feandil/hardened-refpolicy/commits/63a65bb081bc37f5f67316ea844e899f17fbc74c"},{"sha":"f160686cb9df39cb59dda8c3178fd70f9c4a1b48","author":{"email":"172f6efbab1d24956eecf9b10e7705d05ebfa863@bigon.be","name":"Laurent Bigonville"},"message":"Add \"binder\" security class and access vectors","distinct":true,"url":"https://api.github.com/repos/Feandil/hardened-refpolicy/commits/f160686cb9df39cb59dda8c3178fd70f9c4a1b48"},{"sha":"5d7e4b4d3aaaa9c10ad44b821125b050def062e8","author":{"email":"d6e1285e1c84d3d5885c2124fdacc780e9fc0a94@tycho.nsa.gov","name":"Stephen Smalley"},"message":"Update netlink socket classes.\n\nDefine new netlink socket security classes introduced by kernel commit\n223ae516404a7a65f09e79a1c0291521c233336e.\n\nNote that this does not remove the long-since obsolete\nnetlink_firewall_socket and netlink_ip6_fw_socket classes\nfrom refpolicy in case they are still needed for legacy\ndistribution policies.\n\nAdd the new socket classes to socket_class_set.\nUpdate ubac and mls constraints for the new socket classes.\nAdd allow rules for a few specific known cases (netutils, iptables,\nnetlabel, ifconfig, udev) in core policy that require access.\nFurther refinement for the contrib tree will be needed.  Any allow\nrule previously written on :netlink_socket may need to be rewritten or\nduplicated for one of the more specific classes.  For now, we retain the\nexisting :netlink_socket rules for compatibility on older kernels.\n\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>","distinct":true,"url":"https://api.github.com/repos/Feandil/hardened-refpolicy/commits/5d7e4b4d3aaaa9c10ad44b821125b050def062e8"},{"sha":"10c63ed8138317cf7a362ca1102290d37ad6def7","author":{"email":"afd0674be3d8ca6f9a3bdb7b57fdb0c886370bc8@tresys.com","name":"Chris PeBenito"},"message":"Module version bump for updated netlink sockets from Stephen Smalley","distinct":true,"url":"https://api.github.com/repos/Feandil/hardened-refpolicy/commits/10c63ed8138317cf7a362ca1102290d37ad6def7"},{"sha":"5454b1692fd734babb5b459922136c7dfc7c4aa2","author":{"email":"68c46a606457643eab92053c1c05574abb26f861@perfinion.com","name":"Jason Zaman"},"message":"Introduce init_startstop_service interface\n\nThis is to be used where a role needs to start and stop a labeled\nservice. It centralizes all the rules for redhat < 6 sysvinit that\nwere used in the _admin interfaces. The rules for other inits will\nbe added later.","distinct":true,"url":"https://api.github.com/repos/Feandil/hardened-refpolicy/commits/5454b1692fd734babb5b459922136c7dfc7c4aa2"},{"sha":"9e474937977d0e21a9b63eee5717d8b4837dba32","author":{"email":"afd0674be3d8ca6f9a3bdb7b57fdb0c886370bc8@tresys.com","name":"Chris PeBenito"},"message":"Module version bump for init_startstop_service from Jason Zaman.","distinct":true,"url":"https://api.github.com/repos/Feandil/hardened-refpolicy/commits/9e474937977d0e21a9b63eee5717d8b4837dba32"},{"sha":"0e289ab8f74c478433de2a755082464a740d537b","author":{"email":"d6e1285e1c84d3d5885c2124fdacc780e9fc0a94@tycho.nsa.gov","name":"Stephen Smalley"},"message":"contrib: networkmanager: allow netlink_generic_socket access\n\nrefpolicy commit 58b302957652322288618ceda0771d39e74a9e46\ndefined the new netlink socket security classes introduced by\nkernel commit 223ae516404a7a65f09e79a1c0291521c233336e.\nNetworkManager requires netlink_generic_socket access when\nrunning on a kernel with this change.  Add an allow rule for it,\nwhile retaining the existing :netlink_socket rule for compatibility\non older kernels.\n\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>","distinct":true,"url":"https://api.github.com/repos/Feandil/hardened-refpolicy/commits/0e289ab8f74c478433de2a755082464a740d537b"},{"sha":"9dbeafd6f528951c4d47edc6a2b2a6482d0c9eaf","author":{"email":"2abdb4d04bf3f7fa0abfd70dd782bba1774a9329@gmail.com","name":"Dominick Grift"},"message":"Module version bump for update to the networkmanager policy module by Stephen Smalley.","distinct":true,"url":"https://api.github.com/repos/Feandil/hardened-refpolicy/commits/9dbeafd6f528951c4d47edc6a2b2a6482d0c9eaf"},{"sha":"d6a80852487e87428cb97f9d9f776bd2f7ac4348","author":{"email":"68c46a606457643eab92053c1c05574abb26f861@perfinion.com","name":"Jason Zaman"},"message":"Use init_startstop_service in admin interfaces A-M\n\nMost foo_admin interfaces have transitions on the\nfoo_initrc_exec_t to system_r. These are only applicable\nfor RedHat <6. This replaces them with the interface\ninit_startstop_service which can easily be changed for\nother init systems.\n\nmake validate passes for all combinations of distros,\nstandard/mcs/mls, monolithic y/n and direct_initrc y/n\n\nThis patch is for files starting with A-M.","distinct":true,"url":"https://api.github.com/repos/Feandil/hardened-refpolicy/commits/d6a80852487e87428cb97f9d9f776bd2f7ac4348"},{"sha":"0b86dd6784975e36e51eec9b37a18c731adb0bd3","author":{"email":"68c46a606457643eab92053c1c05574abb26f861@perfinion.com","name":"Jason Zaman"},"message":"Use init_startstop_service in admin interfaces N-Z\n\nMost foo_admin interfaces have transitions on the\nfoo_initrc_exec_t to system_r. These are only applicable\nfor RedHat <6. This replaces them with the interface\ninit_startstop_service which can easily be changed for\nother init systems.\n\nmake validate passes for all combinations of distros,\nstandard/mcs/mls, monolithic y/n and direct_initrc y/n\n\nThis patch is for files starting with N-Z.","distinct":true,"url":"https://api.github.com/repos/Feandil/hardened-refpolicy/commits/0b86dd6784975e36e51eec9b37a18c731adb0bd3"}]}