Stephen Smalley | 41be6cf | 2009-07-07 08:25:53 -0400 | [diff] [blame^] | 1 | 2.0.83 2009-07-07 |
| 2 | * Check /proc/filesystems before /proc/mounts for selinuxfs from Eric |
| 3 | Paris. |
| 4 | |
Joshua Brindle | 33844aa | 2009-06-22 11:32:27 -0400 | [diff] [blame] | 5 | 2.0.82 2009-06-19 |
| 6 | * Fix improper use of thread local storage from Tomas Mraz <tmraz@redhat.com>. |
| 7 | * Label substitution support from Dan Walsh. |
| 8 | * Support for labeling virtual machine images from Dan Walsh. |
| 9 | |
Joshua Brindle | 99afa3c | 2009-05-05 20:19:43 -0400 | [diff] [blame] | 10 | 2.0.81 2009-05-15 |
| 11 | * Trim / from the end of input paths to matchpathcon from Dan Walsh. |
| 12 | * Fix leak in process_line in label_file.c from Hiroshi Shinji. |
| 13 | * Move matchpathcon to /sbin, add matchpathcon to clean target from Dan Walsh. |
| 14 | * getdefaultcon to print just the correct match and add verbose option from Dan Walsh. |
| 15 | |
Eamon Walsh | a07493d | 2009-04-07 22:53:50 -0400 | [diff] [blame] | 16 | 2.0.80 2009-04-07 |
| 17 | * deny_unknown wrapper function from KaiGai Kohei. |
| 18 | * security_compute_av_flags API from KaiGai Kohei. |
| 19 | * Netlink socket management and callbacks from KaiGai Kohei. |
| 20 | |
Eamon Walsh | 3028bc3 | 2009-03-11 19:06:12 -0400 | [diff] [blame] | 21 | 2.0.79 2009-03-11 |
| 22 | * Netlink socket handoff patch from Adam Jackson. |
| 23 | * AVC caching of compute_create results by Eric Paris. |
| 24 | |
Eamon Walsh | 5032faa | 2009-02-27 18:08:55 -0500 | [diff] [blame] | 25 | 2.0.78 2009-02-27 |
| 26 | * Fix incorrect conversion in discover_class code. |
| 27 | |
Joshua Brindle | c8a1880 | 2009-01-12 10:53:11 -0500 | [diff] [blame] | 28 | 2.0.77 2009-01-12 |
Joshua Brindle | a9e6fbd | 2009-01-12 10:44:08 -0500 | [diff] [blame] | 29 | * add restorecon to python bindings from Dan Walsh. |
| 30 | |
Eamon Walsh | 7817c92 | 2009-01-05 18:31:55 -0500 | [diff] [blame] | 31 | 2.0.76 2009-01-08 |
| 32 | * Client support for translating raw contexts to colors via setrans. |
| 33 | |
Eamon Walsh | aa92cfb | 2008-11-18 18:59:20 -0500 | [diff] [blame] | 34 | 2.0.75 2008-11-18 |
| 35 | * Allow shell-style wildcards in x_contexts file. |
| 36 | |
Eamon Walsh | cc50281 | 2008-11-03 13:45:19 -0500 | [diff] [blame] | 37 | 2.0.74 2008-11-03 |
| 38 | * Correct message types in AVC log messages. |
| 39 | |
Joshua Brindle | 3d431ae | 2008-10-14 08:12:59 -0400 | [diff] [blame] | 40 | 2.0.73 2008-10-14 |
| 41 | * Make matchpathcon -V pass mode from Dan Walsh. |
| 42 | * Add man page for selinux_file_context_cmp from Dan Walsh. |
| 43 | |
Joshua Brindle | 922103e | 2008-09-29 18:20:51 -0400 | [diff] [blame] | 44 | 2.0.72 2008-09-29 |
| 45 | * New man pages from Dan Walsh. |
| 46 | * Update flask headers from refpolicy trunk from Dan Walsh. |
| 47 | |
Joshua Brindle | 13cd4c8 | 2008-08-19 15:30:36 -0400 | [diff] [blame] | 48 | 2.0.71 2008-08-05 |
| 49 | * Add group support to seusers using %groupname syntax from Dan Walsh. |
| 50 | * Mark setrans socket close-on-exec from Stephen Smalley. |
| 51 | * Only apply nodups checking to base file contexts from Stephen Smalley. |
| 52 | |
| 53 | 2.0.70 2008-07-30 |
| 54 | * Merge ruby bindings from Dan Walsh. |
| 55 | |
| 56 | 2.0.69 2008-07-29 |
| 57 | * Handle duplicate file context regexes as a fatal error from Stephen Smalley. |
| 58 | This prevents adding them via semanage. |
| 59 | |
| 60 | 2.0.68 2008-07-18 |
| 61 | * Fix audit2why shadowed variables from Stephen Smalley. |
| 62 | * Note that freecon NULL is legal in man page from Karel Zak. |
| 63 | |
| 64 | 2.0.67 2008-06-13 |
| 65 | * New and revised AVC, label, and mapping man pages from Eamon Walsh. |
| 66 | |
| 67 | 2.0.66 2008-06-11 |
| 68 | * Add swig python bindings for avc interfaces from Dan Walsh. |
| 69 | |
| 70 | 2.0.65 2008-05-27 |
| 71 | * Fix selinux_file_context_verify() and selinux_lsetfilecon_default() to call matchpathcon_init_prefix if not already initialized. |
| 72 | * Add -q qualifier for -V option of matchpathcon and change it to indicate whether verification succeeded or failed via exit status. |
| 73 | |
| 74 | 2.0.64 2008-04-21 |
| 75 | * Fixed selinux_set_callback man page. |
| 76 | |
| 77 | 2.0.63 2008-04-18 |
| 78 | * Try loading the max of the kernel-supported version and the libsepol-supported version when no manipulation of the binary policy is needed from Stephen Smalley. |
| 79 | |
| 80 | 2.0.62 2008-04-18 |
| 81 | * Fix memory leaks in matchpathcon from Eamon Walsh. |
| 82 | |
| 83 | 2.0.61 2008-03-31 |
| 84 | * Man page typo fix from Jim Meyering. |
| 85 | |
| 86 | 2.0.60 2008-03-20 |
| 87 | * Changed selinux_init_load_policy() to not warn about a failed mount of selinuxfs if selinux was disabled in the kernel. |
| 88 | |
| 89 | 2.0.59 2008-02-29 |
| 90 | * Merged new X label "poly_selection" namespace from Eamon Walsh. |
| 91 | |
| 92 | 2.0.58 2008-02-28 |
| 93 | * Merged reset_selinux_config() for load policy from Dan Walsh. |
| 94 | |
| 95 | 2.0.57 2008-02-25 |
| 96 | * Merged avc_has_perm() errno fix from Eamon Walsh. |
| 97 | |
| 98 | 2.0.56 2008-02-21 |
| 99 | * Regenerated Flask headers from refpolicy flask definitions. |
| 100 | |
| 101 | 2.0.55 2008-02-08 |
| 102 | * Merged compute_member AVC function and manpages from Eamon Walsh. |
| 103 | |
| 104 | 2.0.54 2008-02-08 |
| 105 | * Provide more error reporting on load policy failures from Stephen Smalley. |
| 106 | |
| 107 | 2.0.53 2008-02-07 |
| 108 | * Merged new X label "poly_prop" namespace from Eamon Walsh. |
| 109 | |
| 110 | 2.0.52 2008-02-06 |
| 111 | * Disable setlocaldefs if no local boolean or users files are present from Stephen Smalley. |
| 112 | |
| 113 | 2.0.51 2008-02-05 |
| 114 | * Skip userspace preservebools processing for Linux >= 2.6.22 from Stephen Smalley. |
| 115 | |
| 116 | 2.0.50 2008-01-28 |
| 117 | * Merged fix for audit2why from Dan Walsh. |
| 118 | |
| 119 | 2.0.49 2008-01-23 |
| 120 | * Merged audit2why python binding from Dan Walsh. |
| 121 | |
| 122 | 2.0.48 2008-01-23 |
| 123 | * Merged updated swig bindings from Dan Walsh, including typemap for pid_t. |
| 124 | |
| 125 | 2.0.47 2007-12-21 |
| 126 | * Fix for the avc: granted null message bug from Stephen Smalley. |
| 127 | |
| 128 | 2.0.46 2007-12-07 |
| 129 | * matchpathcon(8) man page update from Dan Walsh. |
| 130 | |
| 131 | 2.0.45 2007-11-20 |
| 132 | * dlopen libsepol.so.1 rather than libsepol.so from Stephen Smalley. |
| 133 | |
| 134 | 2.0.44 2007-11-20 |
| 135 | * Based on a suggestion from Ulrich Drepper, defer regex compilation until we have a stem match, by Stephen Smalley. |
| 136 | A further optimization would be to defer regex compilation until we have a complete match of the constant prefix of the regex - TBD. |
| 137 | |
| 138 | 2.0.43 2007-11-15 |
| 139 | * Regenerated Flask headers from policy. |
| 140 | |
| 141 | 2.0.42 2007-11-08 |
| 142 | * AVC enforcing mode override patch from Eamon Walsh. |
| 143 | |
| 144 | 2.0.41 2007-11-06 |
| 145 | * Aligned attributes in AVC netlink code from Eamon Walsh. |
| 146 | |
| 147 | 2.0.40 2007-11-01 |
| 148 | * Merged refactored AVC netlink code from Eamon Walsh. |
| 149 | |
| 150 | 2.0.39 2007-10-19 |
| 151 | * Merged new X label namespaces from Eamon Walsh. |
| 152 | |
| 153 | 2.0.38 2007-10-15 |
| 154 | * Bux fix and minor refactoring in string representation code. |
| 155 | |
| 156 | 2.0.37 2007-10-05 |
| 157 | * Merged selinux_get_callback, avc_open, empty string mapping from Eamon Walsh. |
| 158 | |
| 159 | 2.0.36 2007-09-27 |
| 160 | * Fix segfault resulting from missing file_contexts file. |
| 161 | |
| 162 | 2.0.35 2007-09-24 |
| 163 | * Make netlink socket close-on-exec to avoid descriptor leakage from Dan Walsh. |
| 164 | * Pass CFLAGS when using gcc for linking from Dennis Gilmore. |
| 165 | |
| 166 | 2.0.34 2007-09-18 |
| 167 | * Fix selabel option flag setting for 64-bit from Stephen Smalley. |
| 168 | |
| 169 | 2.0.33 2007-09-12 |
| 170 | * Re-map a getxattr return value of 0 to a getfilecon return value of -1 with errno EOPNOTSUPP from Stephen Smalley. |
| 171 | * Fall back to the compat code for security_class_to_string and security_av_perm_to_string from Stephen Smalley. |
| 172 | |
| 173 | 2.0.32 2007-09-10 |
| 174 | * Fix swig binding for rpm_execcon from James Athey. |
| 175 | |
| 176 | 2.0.31 2007-08-23 |
| 177 | * Fix file_contexts.homedirs path from Todd Miller. |
| 178 | |
| 179 | 2.0.30 2007-08-06 |
| 180 | * Fix segfault resulting from uninitialized print-callback pointer. |
| 181 | |
| 182 | 2.0.29 2007-08-02 |
| 183 | * Added x_contexts path function patch from Eamon Walsh. |
| 184 | |
| 185 | 2.0.28 2007-08-01 |
| 186 | * Fix build for EMBEDDED=y from Yuichi Nakamura. |
| 187 | |
| 188 | 2.0.27 2007-07-25 |
| 189 | * Fix markup problems in selinux man pages from Dan Walsh. |
| 190 | |
| 191 | 2.0.26 2007-07-23 |
| 192 | * Updated av_permissions.h and flask.h to include new nscd permissions from Dan Walsh. |
| 193 | * Added swigify to top-level Makefile from Dan Walsh. |
| 194 | |
| 195 | 2.0.25 2007-07-23 |
| 196 | * Fix for string_to_security_class segfault on x86_64 from Stephen |
| 197 | Smalley. |
| 198 | |
| 199 | 2.0.24 2007-09-07 |
| 200 | * Fix for getfilecon() for zero-length contexts from Stephen Smalley. |
| 201 | |
| 202 | 2.0.23 2007-06-22 |
| 203 | * Refactored SWIG bindings from James Athey. |
| 204 | |
| 205 | 2.0.22 2007-06-20 |
| 206 | * Labeling and callback interface patches from Eamon Walsh. |
| 207 | |
| 208 | 2.0.21 2007-06-11 |
| 209 | * Class and permission mapping support patches from Eamon Walsh. |
| 210 | |
| 211 | 2.0.20 2007-06-07 |
| 212 | * Object class discovery support patches from Chris PeBenito. |
| 213 | |
| 214 | 2.0.19 2007-06-05 |
| 215 | * Refactoring and errno support in string representation code. |
| 216 | |
| 217 | 2.0.18 2007-05-31 |
| 218 | * Merged patch to reduce size of libselinux and remove need for libsepol for embedded systems from Yuichi Nakamura. |
| 219 | This patch also turns the link-time dependency on libsepol into a runtime (dlopen) dependency even in the non-embedded case. |
| 220 | |
| 221 | 2.0.17 2007-05-31 |
| 222 | * Updated Lindent script and reindented two header files. |
| 223 | |
| 224 | 2.0.16 2007-05-09 |
| 225 | * Merged additional swig python bindings from Dan Walsh. |
| 226 | |
| 227 | 2.0.15 2007-04-27 |
| 228 | * Merged helpful message when selinuxfs mount fails patch from Dax Kelson. |
| 229 | |
| 230 | 2.0.14 2007-04-24 |
| 231 | * Merged build fix for avc_internal.c from Joshua Brindle. |
| 232 | |
| 233 | 2.0.13 2007-04-12 |
| 234 | * Merged rpm_execcon python binding fix, matchpathcon man page fix, and getsebool -a handling for EACCES from Dan Walsh. |
| 235 | |
| 236 | 2.0.12 2007-04-09 |
| 237 | * Merged support for getting initial contexts from James Carter. |
| 238 | |
| 239 | 2.0.11 2007-04-05 |
| 240 | * Merged userspace AVC patch to follow kernel's behavior for permissive mode in caching previous denials from Eamon Walsh. |
| 241 | |
| 242 | |
| 243 | 2.0.10 2007-04-05 |
| 244 | * Merged sidput(NULL) patch from Eamon Walsh. |
| 245 | |
| 246 | 2.0.9 2007-03-30 |
| 247 | * Merged class/av string conversion and avc_compute_create patch from Eamon Walsh. |
| 248 | |
| 249 | 2.0.8 2007-03-20 |
| 250 | * Merged fix for avc.h #include's from Eamon Walsh. |
| 251 | |
| 252 | 2.0.7 2007-03-12 |
| 253 | * Merged patch to drop support for CACHETRANS=0 config option from Steve Grubb. |
| 254 | |
| 255 | 2.0.6 2007-03-12 |
| 256 | * Merged patch to drop support for old /etc/sysconfig/selinux and |
| 257 | /etc/security policy file layout from Steve Grubb. |
| 258 | |
| 259 | 2.0.5 2007-02-27 |
| 260 | * Merged init_selinuxmnt() and is_selinux_enabled() improvements from Steve Grubb. |
| 261 | |
| 262 | 2.0.4 2007-02-23 |
| 263 | * Removed sending of setrans init message. |
| 264 | |
| 265 | 2.0.3 2007-02-22 |
| 266 | * Merged matchpathcon memory leak fix from Steve Grubb. |
| 267 | |
| 268 | 2.0.2 2007-02-21 |
| 269 | * Merged more swig initializers from Dan Walsh. |
| 270 | |
| 271 | 2.0.1 2007-02-20 |
| 272 | * Merged patch from Todd Miller to convert int types over to C99 style. |
| 273 | |
| 274 | 2.0.0 2007-02-01 |
| 275 | * Merged patch from Todd Miller to remove sscanf in matchpathcon.c because |
| 276 | of the use of the non-standard format %as. (original patch changed |
| 277 | for style). |
| 278 | * Merged patch from Todd Miller to fix memory leak in matchpathcon.c. |
| 279 | |
| 280 | 1.34.1 2007-01-26 |
| 281 | * Merged python binding fixes from Dan Walsh. |
| 282 | |
| 283 | 1.34.0 2007-01-18 |
| 284 | * Updated version for stable branch. |
| 285 | |
| 286 | 1.33.6 2007-01-17 |
| 287 | * Merged man page updates to make "apropos selinux" work from Dan Walsh. |
| 288 | |
| 289 | 1.33.5 2007-01-16 |
| 290 | * Merged getdefaultcon utility from Dan Walsh. |
| 291 | |
| 292 | 1.33.4 2007-01-11 |
| 293 | * Merged selinux_check_securetty_context() and support from Dan Walsh. |
| 294 | |
| 295 | 1.33.3 2007-01-04 |
| 296 | * Merged patch for matchpathcon utility to use file mode information |
| 297 | when available from Dan Walsh. |
| 298 | |
| 299 | 1.33.2 2006-11-27 |
| 300 | * Merged patch to compile with -fPIC instead of -fpic from |
| 301 | Manoj Srivastava to prevent hitting the global offset table |
| 302 | limit. Patch changed to include libsepol and libsemanage in |
| 303 | addition to libselinux. |
| 304 | |
| 305 | 1.33.1 2006-10-19 |
| 306 | * Merged updated flask definitions from Darrel Goeddel. |
| 307 | This adds the context security class, and also adds |
| 308 | the string definitions for setsockcreate and polmatch. |
| 309 | |
| 310 | 1.32 2006-10-17 |
| 311 | * Updated version for release. |
| 312 | |
| 313 | 1.30.30 2006-10-05 |
| 314 | * Merged patch from Darrel Goeddel to always use untranslated |
| 315 | contexts in the userspace AVC. |
| 316 | |
| 317 | 1.30.29 2006-09-29 |
| 318 | * Merged av_permissions.h update from Steve Grubb, |
| 319 | adding setsockcreate and polmatch definitions. |
| 320 | |
| 321 | 1.30.28 2006-09-13 |
| 322 | * Merged patch from Steve Smalley to fix SIGPIPE in setrans_client |
| 323 | * Merged c++ class identifier fix from Joe Nall. |
| 324 | |
| 325 | 1.30.27 2006-08-24 |
| 326 | * Merged patch to not log avc stats upon a reset from Steve Grubb. |
| 327 | * Applied patch to revert compat_net setting upon policy load. |
| 328 | |
| 329 | 1.30.26 2006-08-11 |
| 330 | * Merged file context homedir and local path functions from |
| 331 | Chris PeBenito. |
| 332 | |
| 333 | 1.30.25 2006-08-11 |
| 334 | * Rework functions that access /proc/pid/attr to access the |
| 335 | per-thread nodes, and unify the code to simplify maintenance. |
| 336 | |
| 337 | 1.30.24 2006-08-10 |
| 338 | * Merged return value fix for *getfilecon() from Dan Walsh. |
| 339 | |
| 340 | 1.30.23 2006-08-10 |
| 341 | * Merged sockcreate interfaces from Eric Paris. |
| 342 | |
| 343 | 1.30.22 2006-08-03 |
| 344 | * Merged no-tls-direct-seg-refs patch from Jeremy Katz. |
| 345 | |
| 346 | 1.30.21 2006-08-03 |
| 347 | * Merged netfilter_contexts support patch from Chris PeBenito. |
| 348 | |
| 349 | 1.30.20 2006-08-01 |
| 350 | * Merged context_*_set errno patch from Jim Meyering. |
| 351 | |
| 352 | 1.30.19 2006-06-29 |
| 353 | * Lindent. |
| 354 | |
| 355 | 1.30.18 2006-06-27 |
| 356 | * Merged {get,set}procattrcon patch set from Eric Paris. |
| 357 | * Merged re-base of keycreate patch originally by Michael LeMay from Eric Paris. |
| 358 | |
| 359 | 1.30.17 2006-06-27 |
| 360 | * Regenerated Flask headers from refpolicy. |
| 361 | |
| 362 | 1.30.16 2006-06-26 |
| 363 | * Merged patch from Dan Walsh with: |
| 364 | - Added selinux_file_context_{cmp,verify}. |
| 365 | - Added selinux_lsetfilecon_default. |
| 366 | - Delay translation of contexts in matchpathcon. |
| 367 | |
| 368 | 1.30.15 2006-06-16 |
| 369 | * Merged patch from Dan Walsh with: |
| 370 | * Added selinux_getpolicytype() function. |
| 371 | * Modified setrans code to skip processing if !mls_enabled. |
| 372 | |
| 373 | 1.30.14 2006-06-16 |
| 374 | * Set errno in the !selinux_mnt case. |
| 375 | |
| 376 | 1.30.13 2006-06-02 |
| 377 | * Allocate large buffers from the heap, not on stack. |
| 378 | Affects is_context_customizable, selinux_init_load_policy, |
| 379 | and selinux_getenforcemode. |
| 380 | |
| 381 | 1.30.12 2006-06-02 |
| 382 | * Merged !selinux_mnt checks from Ian Kent. |
| 383 | |
| 384 | 1.30.11 2006-05-24 |
| 385 | * Merged matchmediacon and trans_to_raw_context fixes from |
| 386 | Serge Hallyn. |
| 387 | |
| 388 | 1.30.10 2006-05-22 |
| 389 | * Merged simple setrans client cache from Dan Walsh. |
| 390 | Merged avcstat patch from Russell Coker. |
| 391 | |
| 392 | 1.30.9 2006-05-22 |
| 393 | * Modified selinux_mkload_policy() to also set /selinux/compat_net |
| 394 | appropriately for the loaded policy. |
| 395 | |
| 396 | 1.30.8 2006-05-17 |
| 397 | * Added matchpathcon_fini() function to free memory allocated by |
| 398 | matchpathcon_init(). |
| 399 | |
| 400 | 1.30.7 2006-05-16 |
| 401 | * Merged setrans client cleanup patch from Steve Grubb. |
| 402 | |
| 403 | 1.30.6 2006-05-08 |
| 404 | * Merged getfscreatecon man page fix from Dan Walsh. |
| 405 | * Updated booleans(8) man page to drop references to the old |
| 406 | booleans file and to note that setsebool can be used to set |
| 407 | the boot-time defaults via -P. |
| 408 | |
| 409 | 1.30.5 2006-05-05 |
| 410 | * Merged fix warnings patch from Karl MacMillan. |
| 411 | |
| 412 | 1.30.4 2006-05-05 |
| 413 | * Merged setrans client support from Dan Walsh. |
| 414 | This removes use of libsetrans. |
| 415 | * Merged patch to eliminate use of PAGE_SIZE constant from Dan Walsh. |
| 416 | * Merged swig typemap fixes from Glauber de Oliveira Costa. |
| 417 | |
| 418 | 1.30.3 2006-04-12 |
| 419 | * Added distclean target to Makefile. |
| 420 | * Regenerated swig files. |
| 421 | |
| 422 | 1.30.2 2006-04-11 |
| 423 | * Changed matchpathcon_init to verify that the spec file is |
| 424 | a regular file. |
| 425 | * Merged python binding t_output_helper removal patch from Dan Walsh. |
| 426 | |
| 427 | 1.30.1 2006-03-20 |
| 428 | * Merged Makefile PYLIBVER definition patch from Dan Walsh. |
| 429 | |
| 430 | 1.30 2006-03-14 |
| 431 | * Updated version for release. |
| 432 | |
| 433 | 1.29.8 2006-02-27 |
| 434 | * Altered rpm_execcon fallback logic for permissive mode to also |
| 435 | handle case where /selinux/enforce is not available. |
| 436 | |
| 437 | 1.29.7 2006-01-20 |
| 438 | * Merged install-pywrap Makefile patch from Joshua Brindle. |
| 439 | |
| 440 | 1.29.6 2006-01-18 |
| 441 | * Merged pywrap Makefile patch from Dan Walsh. |
| 442 | |
| 443 | 1.29.5 2006-01-11 |
| 444 | * Added getseuser test program. |
| 445 | |
| 446 | 1.29.4 2006-01-06 |
| 447 | * Added format attribute to myprintf in matchpathcon.c and |
| 448 | removed obsoleted rootlen variable in init_selinux_config(). |
| 449 | |
| 450 | 1.29.3 2006-01-04 |
| 451 | * Merged several fixes and improvements from Ulrich Drepper |
| 452 | (Red Hat), including: |
| 453 | - corrected use of getline |
| 454 | - further calls to __fsetlocking for local files |
| 455 | - use of strdupa and asprintf |
| 456 | - proper handling of dirent in booleans code |
| 457 | - use of -z relro |
| 458 | - several other optimizations |
| 459 | * Merged getpidcon python wrapper from Dan Walsh (Red Hat). |
| 460 | |
| 461 | 1.29.2 2005-12-14 |
| 462 | * Merged call to finish_context_translations from Dan Walsh. |
| 463 | This eliminates a memory leak from failing to release memory |
| 464 | allocated by libsetrans. |
| 465 | |
| 466 | 1.29.1 2005-12-08 |
| 467 | * Merged patch for swig interfaces from Dan Walsh. |
| 468 | |
| 469 | 1.28 2005-12-07 |
| 470 | * Updated version for release. |
| 471 | |
| 472 | 1.27.28 2005-12-01 |
| 473 | * Added MATCHPATHCON_VALIDATE flag for set_matchpathcon_flags() and |
| 474 | modified matchpathcon implementation to make context validation/ |
| 475 | canonicalization optional at matchpathcon_init time, deferring it |
| 476 | to a successful matchpathcon by default unless the new flag is set |
| 477 | by the caller. |
| 478 | |
| 479 | 1.27.27 2005-12-01 |
| 480 | * Added matchpathcon_init_prefix() interface, and |
| 481 | reworked matchpathcon implementation to support selective |
| 482 | loading of file contexts entries based on prefix matching |
| 483 | between the pathname regex stems and the specified path |
| 484 | prefix (stem must be a prefix of the specified path prefix). |
| 485 | |
| 486 | 1.27.26 2005-11-29 |
| 487 | * Merged getsebool patch from Dan Walsh. |
| 488 | |
| 489 | 1.27.25 2005-11-29 |
| 490 | * Added -f file_contexts option to matchpathcon util. |
| 491 | Fixed warning message in matchpathcon_init(). |
| 492 | |
| 493 | 1.27.24 2005-11-29 |
| 494 | * Merged Makefile python definitions patch from Dan Walsh. |
| 495 | |
| 496 | 1.27.23 2005-11-28 |
| 497 | * Merged swigify patch from Dan Walsh. |
| 498 | |
| 499 | 1.27.22 2005-11-15 |
| 500 | * Merged make failure in rpm_execcon non-fatal in permissive mode |
| 501 | patch from Ivan Gyurdiev. |
| 502 | |
| 503 | 1.27.21 2005-11-08 |
| 504 | * Added MATCHPATHCON_NOTRANS flag for set_matchpathcon_flags() |
| 505 | and modified matchpathcon_init() to skip context translation |
| 506 | if it is set by the caller. |
| 507 | |
| 508 | 1.27.20 2005-11-07 |
| 509 | * Added security_canonicalize_context() interface and |
| 510 | set_matchpathcon_canoncon() interface for obtaining |
| 511 | canonical contexts. Changed matchpathcon internals |
| 512 | to obtain canonical contexts by default. Provided |
| 513 | fallback for kernels that lack extended selinuxfs context |
| 514 | interface. |
| 515 | |
| 516 | 1.27.19 2005-11-04 |
| 517 | * Merged seusers parser changes from Ivan Gyurdiev. |
| 518 | * Merged setsebool to libsemanage patch from Ivan Gyurdiev. |
| 519 | * Changed seusers parser to reject empty fields. |
| 520 | |
| 521 | 1.27.18 2005-11-03 |
| 522 | * Merged seusers empty level handling patch from Jonathan Kim (TCS). |
| 523 | |
| 524 | 1.27.17 2005-10-27 |
| 525 | * Changed default entry for seusers to use __default__ to avoid |
| 526 | ambiguity with users named "default". |
| 527 | |
| 528 | 1.27.16 2005-10-27 |
| 529 | * Fixed init_selinux_config() handling of missing /etc/selinux/config |
| 530 | or missing SELINUXTYPE= definition. |
| 531 | * Merged selinux_translations_path() patch from Dan Walsh. |
| 532 | |
| 533 | 1.27.15 2005-10-25 |
| 534 | * Added hidden_proto/def for get_default_context_with_role. |
| 535 | |
| 536 | 1.27.14 2005-10-25 |
| 537 | * Merged selinux_path() and selinux_homedir_context_path() |
| 538 | functions from Joshua Brindle. |
| 539 | |
| 540 | 1.27.13 2005-10-19 |
| 541 | * Merged fixes for make DESTDIR= builds from Joshua Brindle. |
| 542 | |
| 543 | 1.27.12 2005-10-18 |
| 544 | * Merged get_default_context_with_rolelevel and man pages from |
| 545 | Dan Walsh (Red Hat). |
| 546 | |
| 547 | 1.27.11 2005-10-18 |
| 548 | * Updated call to sepol_policydb_to_image for sepol changes. |
| 549 | |
| 550 | 1.27.10 2005-10-17 |
| 551 | * Changed getseuserbyname to ignore empty lines and to handle |
| 552 | no matching entry in the same manner as no seusers file. |
| 553 | |
| 554 | 1.27.9 2005-10-13 |
| 555 | * Changed selinux_mkload_policy to try downgrading the |
| 556 | latest policy version available to the kernel-supported version. |
| 557 | |
| 558 | 1.27.8 2005-10-11 |
| 559 | * Changed selinux_mkload_policy to fall back to the maximum |
| 560 | policy version supported by libsepol if the kernel policy version |
| 561 | falls outside of the supported range. |
| 562 | |
| 563 | 1.27.7 2005-10-06 |
| 564 | * Changed getseuserbyname to fall back to the Linux username and |
| 565 | NULL level if seusers config file doesn't exist unless |
| 566 | REQUIRESEUSERS=1 is set in /etc/selinux/config. |
| 567 | * Moved seusers.conf under $SELINUXTYPE and renamed to seusers. |
| 568 | |
| 569 | 1.27.6 2005-10-06 |
| 570 | * Added selinux_init_load_policy() function as an even higher level |
| 571 | interface for the initial policy load by /sbin/init. This obsoletes |
| 572 | the load_policy() function in the sysvinit-selinux.patch. |
| 573 | |
| 574 | 1.27.5 2005-10-06 |
| 575 | * Added selinux_mkload_policy() function as a higher level interface |
| 576 | for loading policy than the security_load_policy() interface. |
| 577 | |
| 578 | 1.27.4 2005-10-05 |
| 579 | * Merged fix for matchpathcon (regcomp error checking) from Johan |
| 580 | Fischer. Also added use of regerror to obtain the error string |
| 581 | for inclusion in the error message. |
| 582 | |
| 583 | 1.27.3 2005-10-03 |
| 584 | * Changed getseuserbyname to not require (and ignore if present) |
| 585 | the MLS level in seusers.conf if MLS is disabled, setting *level |
| 586 | to NULL in this case. |
| 587 | |
| 588 | 1.27.2 2005-09-30 |
| 589 | * Merged getseuserbyname patch from Dan Walsh. |
| 590 | |
| 591 | 1.27.1 2005-09-19 |
| 592 | * Merged STRIP_LEVEL patch for matchpathcon from Dan Walsh. |
| 593 | This allows file_contexts with MLS fields to be processed on |
| 594 | non-MLS-enabled systems with policies that are otherwise |
| 595 | identical (e.g. same type definitions). |
| 596 | * Merged get_ordered_context_list_with_level() function from |
| 597 | Dan Walsh, and added get_default_context_with_level(). |
| 598 | This allows MLS level selection for users other than the |
| 599 | default level. |
| 600 | |
| 601 | 1.26 2005-09-06 |
| 602 | * Updated version for release. |
| 603 | |
| 604 | 1.25.7 2005-09-01 |
| 605 | * Merged modified form of patch to avoid dlopen/dlclose by |
| 606 | the static libselinux from Dan Walsh. Users of the static libselinux |
| 607 | will not have any context translation by default. |
| 608 | |
| 609 | 1.25.6 2005-08-31 |
| 610 | * Added public functions to export context translation to |
| 611 | users of libselinux (selinux_trans_to_raw_context, |
| 612 | selinux_raw_to_trans_context). |
| 613 | |
| 614 | 1.25.5 2005-08-26 |
| 615 | * Remove special definition for context_range_set; use |
| 616 | common code. |
| 617 | |
| 618 | 1.25.4 2005-08-25 |
| 619 | * Hid translation-related symbols entirely and ensured that |
| 620 | raw functions have hidden definitions for internal use. |
| 621 | * Allowed setting NULL via context_set* functions. |
| 622 | * Allowed whitespace in MLS component of context. |
| 623 | * Changed rpm_execcon to use translated functions to workaround |
| 624 | lack of MLS level on upgraded systems. |
| 625 | |
| 626 | 1.25.3 2005-08-23 |
| 627 | * Merged context translation patch, originally by TCS, |
| 628 | with modifications by Dan Walsh (Red Hat). |
| 629 | |
| 630 | 1.25.2 2005-08-11 |
| 631 | * Merged several fixes for error handling paths in the |
| 632 | AVC sidtab, matchpathcon, booleans, context, and get_context_list |
| 633 | code from Serge Hallyn (IBM). Bugs found by Coverity. |
| 634 | |
| 635 | 1.25.1 2005-08-10 |
| 636 | * Removed setupns; migrated to pam. |
| 637 | * Merged patches to rename checkPasswdAccess() from Joshua Brindle. |
| 638 | Original symbol is temporarily retained for compatibility until |
| 639 | all callers are updated. |
| 640 | |
| 641 | 1.24 2005-06-20 |
| 642 | * Updated version for release. |
| 643 | |
| 644 | 1.23.12 2005-06-13 |
| 645 | * Merged security_setupns() from Chad Sellers. |
| 646 | |
| 647 | 1.23.11 2005-05-19 |
| 648 | * Merged avcstat and selinux man page from Dan Walsh. |
| 649 | * Changed security_load_booleans to process booleans.local |
| 650 | even if booleans file doesn't exist. |
| 651 | |
| 652 | 1.23.10 2005-04-29 |
| 653 | * Merged set_selinuxmnt patch from Bill Nottingham (Red Hat). |
| 654 | |
| 655 | 1.23.9 2005-04-26 |
| 656 | * Rewrote get_ordered_context_list and helpers, including |
| 657 | changing logic to allow variable MLS fields. |
| 658 | |
| 659 | 1.23.8 2005-04-25 |
| 660 | * Merged matchpathcon and man page patch from Dan Walsh. |
| 661 | |
| 662 | 1.23.7 2005-04-12 |
| 663 | * Changed boolean functions to return -1 with errno ENOENT |
| 664 | rather than assert on a NULL selinux_mnt (i.e. selinuxfs not |
| 665 | mounted). |
| 666 | |
| 667 | 1.23.6 2005-04-08 |
| 668 | * Fixed bug in matchpathcon_filespec_destroy. |
| 669 | |
| 670 | 1.23.5 2005-04-05 |
| 671 | * Fixed bug in rpm_execcon error handling path. |
| 672 | |
| 673 | 1.23.4 2005-04-04 |
| 674 | * Merged fix for set_matchpathcon* functions from Andreas Steinmetz. |
| 675 | * Merged fix for getconlist utility from Andreas Steinmetz. |
| 676 | |
| 677 | 1.23.3 2005-03-29 |
| 678 | * Merged security_set_boolean_list patch from Dan Walsh. |
| 679 | This introduces booleans.local support for setsebool. |
| 680 | |
| 681 | 1.23.2 2005-03-17 |
| 682 | * Merged destructors patch from Tomas Mraz. |
| 683 | |
| 684 | 1.23.1 2005-03-16 |
| 685 | * Added set_matchpathcon_flags() function for setting flags |
| 686 | controlling operation of matchpathcon. MATCHPATHCON_BASEONLY |
| 687 | means only process the base file_contexts file, not |
| 688 | file_contexts.homedirs or file_contexts.local, and is for use by |
| 689 | setfiles -c. |
| 690 | * Updated matchpathcon.3 man page. |
| 691 | |
| 692 | 1.22 2005-03-09 |
| 693 | * Updated version for release. |
| 694 | |
| 695 | 1.21.13 2005-03-08 |
| 696 | * Fixed bug in matchpathcon_filespec_add() - failure to clear fl_head. |
| 697 | |
| 698 | 1.21.12 2005-03-01 |
| 699 | * Changed matchpathcon_common to ignore any non-format bits in the mode. |
| 700 | |
| 701 | 1.21.11 2005-02-22 |
| 702 | * Merged several fixes from Ulrich Drepper. |
| 703 | |
| 704 | 1.21.10 2005-02-17 |
| 705 | * Merged matchpathcon patch for file_contexts.homedir from Dan Walsh. |
| 706 | * Added selinux_users_path() for path to directory containing |
| 707 | system.users and local.users. |
| 708 | |
| 709 | 1.21.9 2005-02-09 |
| 710 | * Changed relabel Makefile target to use restorecon. |
| 711 | |
| 712 | 1.21.8 2005-02-07 |
| 713 | * Regenerated av_permissions.h. |
| 714 | |
| 715 | 1.21.7 2005-02-01 |
| 716 | * Modified avc_dump_av to explicitly check for any permissions that |
| 717 | cannot be mapped to string names and display them as a hex value. |
| 718 | |
| 719 | 1.21.6 2005-01-31 |
| 720 | * Regenerated av_permissions.h. |
| 721 | |
| 722 | 1.21.5 2005-01-28 |
| 723 | * Generalized matchpathcon internals, exported more interfaces, |
| 724 | and moved additional code from setfiles into libselinux so that |
| 725 | setfiles can directly use matchpathcon. |
| 726 | |
| 727 | 1.21.4 2005-01-27 |
| 728 | * Prevent overflow of spec array in matchpathcon. |
| 729 | |
| 730 | 1.21.3 2005-01-26 |
| 731 | * Fixed several uses of internal functions to avoid relocations. |
| 732 | * Changed rpm_execcon to check is_selinux_enabled() and fallback to |
| 733 | a regular execve if not enabled (or unable to determine due to a lack |
| 734 | of /proc, e.g. chroot'd environment). |
| 735 | |
| 736 | |
| 737 | 1.21.2 2005-01-24 |
| 738 | * Merged minor fix for avcstat from Dan Walsh. |
| 739 | |
| 740 | 1.21.1 2005-01-19 |
| 741 | * Merged patch from Dan Walsh, including: |
| 742 | - new is_context_customizable function |
| 743 | - changed matchpathcon to also use file_contexts.local if present |
| 744 | - man page cleanups |
| 745 | |
| 746 | 1.20 2005-01-04 |
| 747 | * Changed matchpathcon to return -1 with errno ENOENT for |
| 748 | <<none>> entries, and also for an empty file_contexts configuration. |
| 749 | * Removed some trivial utils that were not useful or redundant. |
| 750 | * Changed BINDIR default to /usr/sbin to match change in Fedora. |
| 751 | * Added security_compute_member. |
| 752 | * Added man page for setcon. |
| 753 | * Merged more man pages from Dan Walsh. |
| 754 | * Merged avcstat from James Morris. |
| 755 | * Merged build fix for mips from Manoj Srivastava. |
| 756 | * Merged C++ support from John Ramsdell of MITRE. |
| 757 | * Merged setcon() function from Darrel Goeddel of TCS. |
| 758 | * Merged setsebool/togglesebool enhancement from Steve Grubb. |
| 759 | * Merged cleanup patches from Steve Grubb. |
| 760 | |
| 761 | 1.18 2004-11-01 |
| 762 | * Merged cleanup patches from Steve Grubb. |
| 763 | * Added rpm_execcon. |
| 764 | * Merged setenforce and removable context patch from Dan Walsh. |
| 765 | * Merged build fix for alpha from Ulrich Drepper. |
| 766 | * Removed copyright/license from selinux_netlink.h - definitions only. |
| 767 | * Merged matchmediacon from Dan Walsh. |
| 768 | * Regenerated headers for new nscd permissions. |
| 769 | * Added get_default_context_with_role. |
| 770 | * Added set_matchpathcon_printf. |
| 771 | * Reworked av_inherit.h to allow easier re-use by kernel. |
| 772 | * Changed avc_has_perm_noaudit to not fail on netlink errors. |
| 773 | * Changed avc netlink code to check pid based on patch by Steve Grubb. |
| 774 | * Merged second optimization patch from Ulrich Drepper. |
| 775 | * Changed matchpathcon to skip invalid file_contexts entries. |
| 776 | * Made string tables private to libselinux. |
| 777 | * Merged strcat->stpcpy patch from Ulrich Drepper. |
| 778 | * Merged matchpathcon man page from Dan Walsh. |
| 779 | * Merged patch to eliminate PLTs for local syms from Ulrich Drepper. |
| 780 | * Autobind netlink socket. |
| 781 | * Dropped compatibility code from security_compute_user. |
| 782 | * Merged fix for context_range_set from Chad Hanson. |
| 783 | * Merged allocation failure checking patch from Chad Hanson. |
| 784 | * Merged avc netlink error message patch from Colin Walters. |
| 785 | |
| 786 | 1.16 2004-08-19 |
| 787 | * Regenerated headers for nscd class. |
| 788 | * Merged man pages from Dan Walsh. |
| 789 | * Merged context_new bug fix for MLS ranges from Chad Hanson. |
| 790 | * Merged toggle_bool from Chris PeBenito, renamed to togglesebool. |
| 791 | * Renamed change_bool and show_bools to setsebool and getsebool. |
| 792 | * Merged security_load_booleans() function from Dan Walsh. |
| 793 | * Added selinux_booleans_path() function. |
| 794 | * Changed avc_init function prototype to use const. |
| 795 | * Regenerated headers for crontab permission. |
| 796 | * Added checkAccess from Dan Walsh. |
| 797 | * Merged getenforce patch from Dan Walsh. |
| 798 | * Regenerated headers for dbus classes. |
| 799 | |
| 800 | 1.14 2004-06-16 |
| 801 | * Regenerated headers for fine-grained netlink classes. |
| 802 | * Merged selinux_config bug fix from Dan Walsh. |
| 803 | * Added userspace AVC man pages. |
| 804 | * Added man links for API calls to existing man pages documenting them. |
| 805 | * Replaced $HOME/.default_contexts support with /etc/selinux/contexts/users/$USER support. |
| 806 | * Merged patch to determine config file paths at runtime to support |
| 807 | reorganized layout. |
| 808 | * Regenerated flask headers with stable ordering. |
| 809 | * Merged patch for man pages from Russell Coker. |
| 810 | |
| 811 | 1.12 2004-05-10 |
| 812 | * Updated flask files to include new SE-X security classes. |
| 813 | * Added security_disable function for runtime disable of SELinux prior |
| 814 | to initial policy load (for /sbin/init). |
| 815 | * Changed get_ordered_context_list to omit any reachable contexts |
| 816 | that are not explicitly listed in default_contexts, unless there |
| 817 | are no matches. |
| 818 | * Merged man pages from Russell Coker and Dan Walsh. |
| 819 | * Merged memory leak fixes from Dan Walsh. |
| 820 | * Merged policyvers errno patch from Chris PeBenito. |
| 821 | |
| 822 | 1.10 2004-04-05 |
| 823 | * Merged getenforce patch from Dan Walsh. |
| 824 | * Fixed init_selinuxmnt to correctly handle use of "selinuxfs" as |
| 825 | the device specification, i.e. mount selinuxfs /selinux -t selinuxfs. |
| 826 | Based on a patch by Russell Coker. |
| 827 | * Merged matchpathcon buffer size fix from Dan Walsh. |
| 828 | |
| 829 | 1.8 2004-03-09 |
| 830 | * Merged is_selinux_mls_enabled() from Chad Hanson of TCS. |
| 831 | * Added matchpathcon function. |
| 832 | * Updated userspace AVC to handle netlink selinux notifications. |
| 833 | |
| 834 | 1.6 2004-02-18 |
| 835 | * Merged conditional policy extensions from Tresys Technology. |
| 836 | * Added userspace avc and SID table implementation. |
| 837 | * Fixed type on size in getpeercon per Thorsten Kukuk's advice. |
| 838 | * Fixed use of getpwnam_r per Thorsten Kukuk's advice. |
| 839 | * Changed to use getpwnam_r rather than getpwnam internally to |
| 840 | avoid clobbering any existing pwd struct obtained by the caller. |
| 841 | * Added getpeercon function to encapsulate getsockopt SO_PEERSEC |
| 842 | and handle allocation ala getfilecon. |
| 843 | * Changed is_selinux_enabled to return -1 on errors. |
| 844 | * Changed to discover selinuxfs mount point via /proc/mounts |
| 845 | so that the mount point can be changed without rebuilding. |
| 846 | |
| 847 | 1.4 2003-12-01 |
| 848 | * Merged another cleanup patch from Bastian Blank and Joerg Hoh. |
| 849 | * Regenerate headers for new permissions. |
| 850 | * Merged static lib build patch from Bastian Blank and Joerg Hoh. |
| 851 | * Export SELINUXMNT definition, add SELINUXPOLICY definition. |
| 852 | * Add functions to provide access to enforce and policyvers. |
| 853 | * Changed is_selinux_enabled to check /proc/filesystems for selinuxfs. |
| 854 | * Fixed type for 'size' in *getfilecon. |
| 855 | * Dropped -lattr and changed #include's to <sys/xattr.h> |
| 856 | * Merged patch to move shared library to /lib from Dan Walsh. |
| 857 | * Changed get_ordered_context_list to support a failsafe context. |
| 858 | * Added selinuxenabled utility. |
| 859 | * Merged const patch from Thorsten Kukuk. |
| 860 | |
| 861 | 1.2 2003-09-30 |
| 862 | * Change is_selinux_enabled to fail if policy isn't loaded. |
| 863 | * Changed Makefiles to allow non-root rpm builds. |
| 864 | * Added -lattr for libselinux.so to ensure proper binding. |
| 865 | |
| 866 | 1.1 2003-08-13 |
| 867 | * Ensure that context strings are padded with a null byte |
| 868 | in case the kernel didn't include one. |
| 869 | * Regenerate headers, update helpers.c for code cleanup. |
| 870 | * Pass soname flag to linker (Colin Walters). |
| 871 | * Fixes for various items: add const as appropriate, handle missed OOM condition, clean up compile warnings (Colin Walters). |
| 872 | |
| 873 | 1.0 2003-07-11 |
| 874 | * Initial public release. |