|
Lokesh Mandvekar |
7fa12a |
%global debug_package %{nil}
|
|
Lokesh Mandvekar |
7fa12a |
|
|
Lokesh Mandvekar |
7fa12a |
# container-selinux
|
|
Lokesh Mandvekar |
7fa12a |
%global git0 https://github.com/projectatomic/container-selinux
|
|
Daniel J Walsh |
883282 |
%global commit0 d7a3f33548ae5c5912006dc2b14270d650f5e52f
|
|
Lokesh Mandvekar |
4c7ed6 |
%global shortcommit0 %(c=%{commit0}; echo ${c:0:7})
|
|
Lokesh Mandvekar |
7fa12a |
|
|
Lokesh Mandvekar |
7fa12a |
# container-selinux stuff (prefix with ds_ for version/release etc.)
|
|
Lokesh Mandvekar |
7fa12a |
# Some bits borrowed from the openstack-selinux package
|
|
Lokesh Mandvekar |
7fa12a |
%global selinuxtype targeted
|
|
Lokesh Mandvekar |
7fa12a |
%global moduletype services
|
|
Lokesh Mandvekar |
7fa12a |
%global modulenames container
|
|
Lokesh Mandvekar |
7fa12a |
|
|
Lokesh Mandvekar |
7fa12a |
# Usage: _format var format
|
|
Lokesh Mandvekar |
7fa12a |
# Expand 'modulenames' into various formats as needed
|
|
Lokesh Mandvekar |
7fa12a |
# Format must contain '$x' somewhere to do anything useful
|
|
Lokesh Mandvekar |
7fa12a |
%global _format() export %1=""; for x in %{modulenames}; do %1+=%2; %1+=" "; done;
|
|
Lokesh Mandvekar |
7fa12a |
|
|
Lokesh Mandvekar |
7fa12a |
# Relabel files
|
|
Daniel J Walsh |
cbb3d2 |
%global relabel_files() %{_sbindir}/restorecon -R %{_bindir}/*podman* %{_bindir}/*runc* %{_bindir}/*crio %{_bindir}/docker* %{_localstatedir}/run/containerd.sock %{_localstatedir}/run/docker.sock %{_localstatedir}/run/docker.pid %{_sysconfdir}/docker %{_sysconfdir}/crio %{_localstatedir}/log/docker %{_localstatedir}/log/lxc %{_localstatedir}/lock/lxc %{_unitdir}/docker.service %{_unitdir}/docker-containerd.service %{_unitdir}/docker-latest.service %{_unitdir}/docker-latest-containerd.service %{_sysconfdir}/docker %{_libexecdir}/docker* &> /dev/null || :
|
|
Lokesh Mandvekar |
7fa12a |
|
|
Lokesh Mandvekar |
7fa12a |
# Version of SELinux we were using
|
|
Lokesh Mandvekar |
7fa12a |
%global selinux_policyver 3.13.1-220
|
|
Lokesh Mandvekar |
7fa12a |
|
|
Lokesh Mandvekar |
7fa12a |
Name: container-selinux
|
|
Lokesh Mandvekar |
efac8b |
%if 0%{?fedora}
|
|
Lokesh Mandvekar |
7fa12a |
Epoch: 2
|
|
Lokesh Mandvekar |
7fa12a |
%endif
|
|
Daniel J Walsh |
883282 |
Version: 2.73
|
|
Daniel J Walsh |
90d38a |
Release: 1.git%{shortcommit0}%{?dist}
|
|
Lokesh Mandvekar |
7fa12a |
License: GPLv2
|
|
Lokesh Mandvekar |
7fa12a |
URL: %{git0}
|
|
Lokesh Mandvekar |
7fa12a |
Summary: SELinux policies for container runtimes
|
|
Lokesh Mandvekar |
7fa12a |
Source0: %{git0}/archive/%{commit0}/%{name}-%{shortcommit0}.tar.gz
|
|
Lokesh Mandvekar |
7fa12a |
BuildArch: noarch
|
|
Lokesh Mandvekar |
4c7ed6 |
BuildRequires: git
|
|
Lokesh Mandvekar |
7fa12a |
BuildRequires: pkgconfig(systemd)
|
|
Lokesh Mandvekar |
8602eb |
BuildRequires: selinux-policy >= %{selinux_policyver}
|
|
Lokesh Mandvekar |
8602eb |
BuildRequires: selinux-policy-devel >= %{selinux_policyver}
|
|
Lokesh Mandvekar |
7fa12a |
# RE: rhbz#1195804 - ensure min NVR for selinux-policy
|
|
Lokesh Mandvekar |
7fa12a |
Requires: selinux-policy >= %{selinux_policyver}
|
|
Lokesh Mandvekar |
7fa12a |
Requires(post): selinux-policy-base >= %{selinux_policyver}
|
|
Lokesh Mandvekar |
8602eb |
Requires(post): selinux-policy-targeted >= %{selinux_policyver}
|
|
Lokesh Mandvekar |
7fa12a |
Requires(post): policycoreutils
|
|
Lokesh Mandvekar |
7fa12a |
Requires(post): policycoreutils-python-utils
|
|
Lokesh Mandvekar |
7fa12a |
Requires(post): libselinux-utils
|
|
Daniel J Walsh |
be54b1 |
Requires(post): sed
|
|
Lokesh Mandvekar |
7fa12a |
Obsoletes: %{name} <= 2:1.12.5-13
|
|
Lokesh Mandvekar |
7fa12a |
Obsoletes: docker-selinux <= 2:1.12.4-28
|
|
Lokesh Mandvekar |
7fa12a |
Provides: docker-selinux = %{epoch}:%{version}-%{release}
|
|
Lokesh Mandvekar |
7fa12a |
|
|
Lokesh Mandvekar |
7fa12a |
%description
|
|
Lokesh Mandvekar |
7fa12a |
SELinux policy modules for use with container runtimes.
|
|
Lokesh Mandvekar |
7fa12a |
|
|
Lokesh Mandvekar |
7fa12a |
%prep
|
|
Lokesh Mandvekar |
4c7ed6 |
%autosetup -Sgit -n %{name}-%{commit0}
|
|
Lokesh Mandvekar |
7fa12a |
|
|
Lokesh Mandvekar |
7fa12a |
%build
|
|
Lokesh Mandvekar |
7fa12a |
make
|
|
Lokesh Mandvekar |
7fa12a |
|
|
Lokesh Mandvekar |
7fa12a |
%install
|
|
Lokesh Mandvekar |
7fa12a |
# install policy modules
|
|
Lokesh Mandvekar |
7fa12a |
%_format MODULES $x.pp.bz2
|
|
Lokesh Mandvekar |
7fa12a |
install -d %{buildroot}%{_datadir}/selinux/packages
|
|
Lokesh Mandvekar |
7fa12a |
install -d -p %{buildroot}%{_datadir}/selinux/devel/include/services
|
|
Lokesh Mandvekar |
7fa12a |
install -p -m 644 container.if %{buildroot}%{_datadir}/selinux/devel/include/services
|
|
Lokesh Mandvekar |
7fa12a |
install -m 0644 $MODULES %{buildroot}%{_datadir}/selinux/packages
|
|
Lokesh Mandvekar |
7fa12a |
|
|
Jonathan Lebon |
6028cc |
# remove spec file
|
|
Lokesh Mandvekar |
7fa12a |
rm -rf container-selinux.spec
|
|
Lokesh Mandvekar |
7fa12a |
|
|
Lokesh Mandvekar |
7fa12a |
%check
|
|
Lokesh Mandvekar |
7fa12a |
|
|
Lokesh Mandvekar |
7fa12a |
%post
|
|
Lokesh Mandvekar |
7fa12a |
# Install all modules in a single transaction
|
|
Lokesh Mandvekar |
7fa12a |
if [ $1 -eq 1 ]; then
|
|
Lokesh Mandvekar |
7fa12a |
%{_sbindir}/setsebool -P -N virt_use_nfs=1 virt_sandbox_use_all_caps=1
|
|
Lokesh Mandvekar |
7fa12a |
fi
|
|
Lokesh Mandvekar |
7fa12a |
%_format MODULES %{_datadir}/selinux/packages/$x.pp.bz2
|
|
Daniel J Walsh |
85f5b3 |
%{_sbindir}/semodule -n -s %{selinuxtype} -r container 2> /dev/null
|
|
Jonathan Lebon |
6028cc |
%{_sbindir}/semodule -n -s %{selinuxtype} -d docker 2> /dev/null
|
|
Daniel J Walsh |
85f5b3 |
%{_sbindir}/semodule -n -s %{selinuxtype} -d gear 2> /dev/null
|
|
Daniel J Walsh |
85f5b3 |
%{_sbindir}/semodule -n -X 200 -s %{selinuxtype} -i $MODULES > /dev/null
|
|
Lokesh Mandvekar |
7fa12a |
if %{_sbindir}/selinuxenabled ; then
|
|
Lokesh Mandvekar |
7fa12a |
%{_sbindir}/load_policy
|
|
Lokesh Mandvekar |
7fa12a |
%relabel_files
|
|
Lokesh Mandvekar |
7fa12a |
if [ $1 -eq 1 ]; then
|
|
Jonathan Lebon |
6028cc |
restorecon -R %{_sharedstatedir}/docker &> /dev/null || :
|
|
Daniel J Walsh |
5c3953 |
restorecon -R %{_sharedstatedir}/containers &> /dev/null || :
|
|
Lokesh Mandvekar |
7fa12a |
fi
|
|
Lokesh Mandvekar |
7fa12a |
fi
|
|
Daniel J Walsh |
be54b1 |
. %{_sysconfdir}/selinux/config
|
|
Daniel J Walsh |
be54b1 |
sed -e "\|container_file_t|h; \${x;s|container_file_t||;{g;t};a\\" -e "container_file_t" -e "}" -i /etc/selinux/${SELINUXTYPE}/contexts/customizable_types
|
|
Daniel J Walsh |
5c3953 |
matchpathcon -qV %{_sharedstatedir}/containers || restorecon -R %{_sharedstatedir}/containers &> /dev/null || :
|
|
Daniel J Walsh |
be54b1 |
|
|
Lokesh Mandvekar |
7fa12a |
|
|
Lokesh Mandvekar |
7fa12a |
%postun
|
|
Lokesh Mandvekar |
7fa12a |
if [ $1 -eq 0 ]; then
|
|
Lokesh Mandvekar |
7fa12a |
%{_sbindir}/semodule -n -r %{modulenames} docker &> /dev/null || :
|
|
Lokesh Mandvekar |
7fa12a |
if %{_sbindir}/selinuxenabled ; then
|
|
Lokesh Mandvekar |
7fa12a |
%{_sbindir}/load_policy
|
|
Lokesh Mandvekar |
7fa12a |
%relabel_files
|
|
Lokesh Mandvekar |
7fa12a |
fi
|
|
Lokesh Mandvekar |
7fa12a |
fi
|
|
Lokesh Mandvekar |
7fa12a |
|
|
Lokesh Mandvekar |
7fa12a |
#define license tag if not already defined
|
|
Lokesh Mandvekar |
7fa12a |
%{!?_licensedir:%global license %doc}
|
|
Lokesh Mandvekar |
7fa12a |
|
|
Lokesh Mandvekar |
7fa12a |
%files
|
|
Lokesh Mandvekar |
7fa12a |
%doc README.md
|
|
Lokesh Mandvekar |
7fa12a |
%{_datadir}/selinux/*
|
|
Lokesh Mandvekar |
7fa12a |
|
|
Lokesh Mandvekar |
7fa12a |
%changelog
|
|
Daniel J Walsh |
883282 |
* Wed Sep 12 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.73-1
|
|
Daniel J Walsh |
883282 |
- Define spc_t as a container_domain, so that container_runtime will transition
|
|
Daniel J Walsh |
883282 |
to spc_t even when setup with nosuid.
|
|
Daniel J Walsh |
883282 |
|
|
Daniel J Walsh |
90d38a |
* Wed Sep 12 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.72-1
|
|
Daniel J Walsh |
90d38a |
- Allow container_runtimes to setattr on callers fifo_files
|
|
Daniel J Walsh |
90d38a |
|
|
Daniel J Walsh |
5c3953 |
* Mon Aug 27 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.71-2
|
|
Daniel J Walsh |
5c3953 |
- Fix restorecon to not error on missing directory
|
|
Daniel J Walsh |
5c3953 |
|
|
Daniel J Walsh |
1c6b7e |
* Wed Aug 22 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.71-1
|
|
Daniel J Walsh |
1c6b7e |
- Allow unconfined_r to transition to system_r over container_runtime_exec_t
|
|
Daniel J Walsh |
1c6b7e |
|
|
Daniel J Walsh |
e6bf4b |
* Wed Aug 22 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.70-1
|
|
Daniel J Walsh |
e6bf4b |
- Allow unconfined_t to transition to container_runtime_t over container_runtime_exec_t
|
|
Daniel J Walsh |
e6bf4b |
|
|
Daniel J Walsh |
4ed365 |
* Wed Jul 25 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.69-1
|
|
Daniel J Walsh |
4ed365 |
- dontaudit attempts to write to sysctl_kernel_t
|
|
Daniel J Walsh |
4ed365 |
|
|
Lokesh Mandvekar (Bot) |
08b0e7 |
* Wed Jul 18 2018 Lokesh Mandvekar (Bot) <lsm5+bot@fedoraproject.org> - 2:2.68-2.gitc139a3d
|
|
Lokesh Mandvekar (Bot) |
08b0e7 |
- autobuilt c139a3d
|
|
Lokesh Mandvekar (Bot) |
08b0e7 |
|
|
Daniel J Walsh |
be54b1 |
* Mon Jul 16 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.67-1
|
|
Daniel J Walsh |
be54b1 |
- Add label for /var/lib/origin
|
|
Daniel J Walsh |
be54b1 |
- Add customizable_file_t to customizable_types
|
|
Daniel J Walsh |
be54b1 |
|
|
Fedora Release Engineering |
49aa68 |
* Thu Jul 12 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.67-3.dev.git042f7cf
|
|
Fedora Release Engineering |
49aa68 |
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
|
|
Fedora Release Engineering |
49aa68 |
|
|
Lokesh Mandvekar (Bot) |
814ce6 |
* Mon Jul 09 2018 Lokesh Mandvekar (Bot) <lsm5+bot@fedoraproject.org> - 2:2.67-2.git042f7cf
|
|
Lokesh Mandvekar (Bot) |
814ce6 |
- autobuilt 042f7cf
|
|
Lokesh Mandvekar (Bot) |
814ce6 |
|
|
Lokesh Mandvekar (Bot) |
da11a8 |
* Sat Jul 07 2018 Lokesh Mandvekar (Bot) <lsm5+bot@fedoraproject.org> - 2:2.67-1.git0407867
|
|
Lokesh Mandvekar (Bot) |
da11a8 |
- bump to 2.67
|
|
Lokesh Mandvekar (Bot) |
da11a8 |
- autobuilt 0407867
|
|
Lokesh Mandvekar (Bot) |
da11a8 |
|
|
Daniel J Walsh |
e3d623 |
* Sat Jun 30 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.66-1
|
|
Daniel J Walsh |
e3d623 |
- Allow container runtimes to dbus chat with systemd-resolved
|
|
Daniel J Walsh |
e3d623 |
|
|
Lokesh Mandvekar (Bot) |
ee88cd |
* Tue Jun 12 2018 Lokesh Mandvekar (Bot) <lsm5+bot@fedoraproject.org> - 2:2.64-1.gitdfaf8fd
|
|
Lokesh Mandvekar (Bot) |
ee88cd |
- bump to 2.64
|
|
Lokesh Mandvekar (Bot) |
ee88cd |
- autobuilt dfaf8fd
|
|
Lokesh Mandvekar (Bot) |
ee88cd |
|
|
Daniel J Walsh |
781a8d |
* Mon Jun 11 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.65-1
|
|
Daniel J Walsh |
781a8d |
- Add new type to handle containers running with a non priv user in a userns
|
|
Daniel J Walsh |
781a8d |
- allow containers to map all sockets
|
|
Daniel J Walsh |
781a8d |
|
|
Lokesh Mandvekar (Bot) |
ee88cd |
* Sun Jun 3 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.64-1.gitdfaf8fd
|
|
Daniel J Walsh |
91cc6a |
- Allow containers to create all socket classes
|
|
Daniel J Walsh |
91cc6a |
|
|
Daniel J Walsh |
71d866 |
* Wed May 30 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.63-1
|
|
Daniel J Walsh |
71d866 |
- Allow containers to create icmp packets
|
|
Daniel J Walsh |
71d866 |
|
|
Lokesh Mandvekar (Bot) |
c23464 |
* Fri May 25 2018 Lokesh Mandvekar (Bot) <lsm5+bot@fedoraproject.org> - 2:2.62-1.git1ecf953
|
|
Lokesh Mandvekar (Bot) |
c23464 |
- bump to 2.62
|
|
Lokesh Mandvekar (Bot) |
c23464 |
- autobuilt 1ecf953
|
|
Lokesh Mandvekar (Bot) |
c23464 |
|
|
Daniel J Walsh |
25c4cb |
* Mon May 21 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.61-1
|
|
Daniel J Walsh |
25c4cb |
- Allow spc_t to load kernel modules from inside of container
|
|
Daniel J Walsh |
25c4cb |
|
|
Daniel J Walsh |
59df2c |
* Mon May 21 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.60-1
|
|
Daniel J Walsh |
59df2c |
- Allow containers to list cgroup directories
|
|
Daniel J Walsh |
59df2c |
|
|
Daniel J Walsh |
2be920 |
* Mon May 21 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.59-1
|
|
Daniel J Walsh |
2be920 |
- Transition for unconfined_service_t to container_runtime_t when executing container_runtime_exec_t.
|
|
Daniel J Walsh |
2be920 |
|
|
Daniel J Walsh |
cbb3d2 |
* Mon May 21 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.58-2
|
|
Daniel J Walsh |
cbb3d2 |
- Run restorecon /usr/bin/podman in postinstall
|
|
Daniel J Walsh |
cbb3d2 |
|
|
Daniel J Walsh |
cbb3d2 |
* Fri May 18 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.58-1
|
|
Daniel J Walsh |
1f65da |
- Add labels to allow podman to be run from a systemd unit file
|
|
Daniel J Walsh |
1f65da |
|
|
Lokesh Mandvekar (Bot) |
cbb99a |
* Tue Apr 17 2018 Lokesh Mandvekar (Bot) <lsm5+bot@fedoraproject.org> - 2:2.55-12.gitd248f91
|
|
Lokesh Mandvekar (Bot) |
cbb99a |
- autobuilt commit d248f91
|
|
Lokesh Mandvekar (Bot) |
cbb99a |
|
|
Lokesh Mandvekar (Bot) |
68364b |
* Tue Apr 17 2018 Lokesh Mandvekar (Bot) <lsm5+bot@fedoraproject.org> - 2:2.55-11.gitd248f91
|
|
Lokesh Mandvekar (Bot) |
68364b |
- autobuilt commit d248f91
|
|
Lokesh Mandvekar (Bot) |
68364b |
|
|
Lokesh Mandvekar (Bot) |
654515 |
* Mon Apr 16 2018 Lokesh Mandvekar (Bot) <lsm5+bot@fedoraproject.org> - 2:2.55-10.gitd248f91
|
|
Lokesh Mandvekar (Bot) |
654515 |
- autobuilt commit d248f91
|
|
Lokesh Mandvekar (Bot) |
654515 |
|
|
Lokesh Mandvekar (Bot) |
6d73ab |
* Mon Apr 16 2018 Lokesh Mandvekar (Bot) <lsm5+bot@fedoraproject.org> - 2:2.55-9.gitd248f91
|
|
Lokesh Mandvekar (Bot) |
6d73ab |
- autobuilt commit d248f91
|
|
Lokesh Mandvekar (Bot) |
6d73ab |
|
|
Lokesh Mandvekar (Bot) |
95b2b1 |
* Mon Apr 16 2018 Lokesh Mandvekar (Bot) <lsm5+bot@fedoraproject.org> - 2:2.55-8
|
|
Lokesh Mandvekar (Bot) |
95b2b1 |
- autobuilt commit d248f91
|
|
Lokesh Mandvekar (Bot) |
95b2b1 |
|
|
Lokesh Mandvekar (Bot) |
357bc5 |
* Mon Apr 16 2018 Lokesh Mandvekar (Bot) <lsm5+bot@fedoraproject.org> - 2:2.55-7
|
|
Lokesh Mandvekar (Bot) |
357bc5 |
- autobuilt commit d248f91
|
|
Lokesh Mandvekar (Bot) |
357bc5 |
|
|
Lokesh Mandvekar (Bot) |
03bdc4 |
* Mon Apr 16 2018 Lokesh Mandvekar (Bot) <lsm5+bot@fedoraproject.org> - 2:2.55-6
|
|
Lokesh Mandvekar (Bot) |
03bdc4 |
- autobuilt commit d248f91
|
|
Lokesh Mandvekar (Bot) |
03bdc4 |
|
|
Lokesh Mandvekar (Bot) |
e49a7c |
* Mon Apr 09 2018 Lokesh Mandvekar (Bot) <lsm5+bot@fedoraproject.org> - 2:2.55-5
|
|
Lokesh Mandvekar (Bot) |
e49a7c |
- autobuilt commit d248f91
|
|
Lokesh Mandvekar (Bot) |
e49a7c |
|
|
Lokesh Mandvekar (Bot) |
af3606 |
* Mon Apr 09 2018 Lokesh Mandvekar (Bot) <lsm5+bot@fedoraproject.org> - 2:2.55-4
|
|
Lokesh Mandvekar (Bot) |
af3606 |
- autobuilt commit d248f91
|
|
Lokesh Mandvekar (Bot) |
af3606 |
|
|
Lokesh Mandvekar |
7c6163 |
* Mon Apr 09 2018 Lokesh Mandvekar <lsm5@fedoraproject.org> - 2:2.55-3
|
|
Lokesh Mandvekar |
7c6163 |
- autobuilt commit d248f91
|
|
Lokesh Mandvekar |
7c6163 |
|
|
Lokesh Mandvekar |
802379 |
* Mon Apr 09 2018 Lokesh Mandvekar <lsm5@fedoraproject.org> - 2:2.55-2
|
|
Lokesh Mandvekar |
802379 |
- autobuilt commit d248f91
|
|
Lokesh Mandvekar |
802379 |
|
|
Daniel J Walsh |
c46266 |
* Thu Mar 15 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.55-1
|
|
Daniel J Walsh |
c46266 |
- Dontaudit attempts by containers to write to /proc/self
|
|
Daniel J Walsh |
c46266 |
|
|
Daniel J Walsh |
37b78d |
* Wed Mar 14 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.54-1
|
|
Daniel J Walsh |
37b78d |
- Add rules for container domains to make writing custom policy easier
|
|
Daniel J Walsh |
37b78d |
- Allow shell_exec_t as a container_runtime_t entrypoint
|
|
Daniel J Walsh |
37b78d |
|
|
Daniel J Walsh |
69afd1 |
* Thu Mar 8 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.52-1
|
|
Daniel J Walsh |
69afd1 |
- Add rules for container domains to make writing custom policy easier
|
|
Daniel J Walsh |
69afd1 |
|
|
Daniel J Walsh |
b658ae |
* Thu Mar 8 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.51-1
|
|
Daniel J Walsh |
b658ae |
- Allow shell_exec_t as a container_runtime_t entrypoint
|
|
Daniel J Walsh |
b658ae |
|
|
Daniel J Walsh |
5a5bf6 |
* Wed Mar 7 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.50-1
|
|
Daniel J Walsh |
5a5bf6 |
- Allow bin_t as a container_runtime_t entrypoint
|
|
Daniel J Walsh |
5a5bf6 |
- Add rules for running container runtimes on mls
|
|
Daniel J Walsh |
5a5bf6 |
|
|
Daniel J Walsh |
9a7a65 |
* Thu Feb 15 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.48-1
|
|
Daniel J Walsh |
9a7a65 |
- Allow container domains to map container_file_t directories
|
|
Daniel J Walsh |
9a7a65 |
|
|
Daniel J Walsh |
f8193b |
* Sat Feb 10 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.47-1
|
|
Daniel J Walsh |
f8193b |
- Change default label of /exports to container_var_lib_t
|
|
Daniel J Walsh |
f8193b |
|
|
Igor Gnatenko |
a7071b |
* Fri Feb 09 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 2:2.46-3
|
|
Lokesh Mandvekar |
c9ddfc |
- Escape macros in %%CHANGELOG
|
|
Igor Gnatenko |
a7071b |
|
|
Fedora Release Engineering |
07b680 |
* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.46-2
|
|
Fedora Release Engineering |
07b680 |
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
|
|
Fedora Release Engineering |
07b680 |
|
|
Daniel J Walsh |
3b45b2 |
* Sat Feb 03 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.46-1
|
|
Daniel J Walsh |
3b45b2 |
- Add support for nosuid_transition flags for container_runtime and unconfined domains
|
|
Daniel J Walsh |
1b2065 |
* Fri Feb 02 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.45-1
|
|
Daniel J Walsh |
1b2065 |
- Allow containers to sendto their own stream sockets
|
|
Daniel J Walsh |
1b2065 |
|
|
Daniel J Walsh |
5b2867 |
* Mon Jan 29 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.44-1
|
|
Daniel J Walsh |
5b2867 |
- Allow container domains to read kernel ipc info
|
|
Daniel J Walsh |
5b2867 |
|
|
Daniel J Walsh |
a7ce31 |
* Mon Jan 22 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.43-1
|
|
Daniel J Walsh |
a7ce31 |
- Allow containers to memory map the fifo_files leaked into container from
|
|
Daniel J Walsh |
a7ce31 |
container runtimes.
|
|
Daniel J Walsh |
a7ce31 |
|
|
Daniel J Walsh |
a4c374 |
* Tue Jan 16 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.42-1
|
|
Daniel J Walsh |
a4c374 |
- Allow unconfined domains to transition to container types, when no-new-privs is set.
|
|
Daniel J Walsh |
a4c374 |
|
|
Daniel J Walsh |
155783 |
* Tue Jan 9 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.41-1
|
|
Daniel J Walsh |
155783 |
- Add support to nnp_transition for container domains
|
|
Daniel J Walsh |
155783 |
- Eliminates need for typebounds.
|
|
Daniel J Walsh |
155783 |
|
|
Daniel J Walsh |
a85180 |
* Tue Jan 9 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.40-1
|
|
Daniel J Walsh |
a85180 |
- Allow container_runtime_t to use user ttys
|
|
Daniel J Walsh |
a85180 |
- Fixes bounds check for container_t
|
|
Daniel J Walsh |
a85180 |
|
|
Daniel J Walsh |
64fe9d |
* Mon Jan 8 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.39-1
|
|
Daniel J Walsh |
64fe9d |
- Allow container runtimes to use interited terminals. This helps
|
|
Daniel J Walsh |
64fe9d |
satisfy the bounds check of container_t versus container_runtime_t.
|
|
Daniel J Walsh |
64fe9d |
|
|
Daniel J Walsh |
98e715 |
* Sat Jan 6 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.38-1
|
|
Daniel J Walsh |
98e715 |
- Allow container runtimes to mmap container_file_t devices
|
|
Daniel J Walsh |
98e715 |
- Add labeling for rhel push plugin
|
|
Daniel J Walsh |
98e715 |
|
|
Daniel J Walsh |
e0502d |
* Tue Dec 12 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.37-1
|
|
Daniel J Walsh |
e0502d |
- Allow containers to use inherited ttys
|
|
Daniel J Walsh |
e0502d |
- Allow ostree to handle labels under /var/lib/containers/ostree
|
|
Daniel J Walsh |
e0502d |
|
|
Daniel J Walsh |
7f79cf |
* Mon Nov 27 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.36-1
|
|
Daniel J Walsh |
7f79cf |
- Allow containers to relabelto/from all file types to container_file_t
|
|
Daniel J Walsh |
7f79cf |
|
|
Daniel J Walsh |
8ed545 |
* Mon Nov 27 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.35-1
|
|
Daniel J Walsh |
8ed545 |
- Allow container to map chr_files labeled container_file_t
|
|
Daniel J Walsh |
8ed545 |
|
|
Daniel J Walsh |
4e9b7c |
* Wed Nov 22 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.34-1
|
|
Daniel J Walsh |
4e9b7c |
- Dontaudit container processes getattr on kernel file systems
|
|
Daniel J Walsh |
4e9b7c |
|
|
Daniel J Walsh |
cc32ba |
* Sun Nov 19 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.33-1
|
|
Daniel J Walsh |
cc32ba |
- Allow containers to read /etc/resolv.conf and /etc/hosts if volume
|
|
Daniel J Walsh |
cc32ba |
- mounted into container.
|
|
Daniel J Walsh |
cc32ba |
|
|
Daniel J Walsh |
be0a39 |
* Wed Nov 8 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.32-1
|
|
Daniel J Walsh |
be0a39 |
- Make sure users creating content in /var/lib with right labels
|
|
Daniel J Walsh |
be0a39 |
|
|
Daniel J Walsh |
31963a |
* Thu Oct 26 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.31-1
|
|
Daniel J Walsh |
31963a |
- Allow the container runtime to dbus chat with dnsmasq
|
|
Daniel J Walsh |
31963a |
- add dontaudit rules for container trying to write to /proc
|
|
Daniel J Walsh |
31963a |
|
|
Daniel J Walsh |
b99f18 |
* Tue Oct 10 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.29-1
|
|
Daniel J Walsh |
b99f18 |
- Add support for lxcd
|
|
Daniel J Walsh |
b99f18 |
- Add support for labeling of tmpfs storage created within a container.
|
|
Daniel J Walsh |
b99f18 |
|
|
Daniel J Walsh |
ecb176 |
* Mon Oct 9 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.28-1
|
|
Daniel J Walsh |
ecb176 |
- Allow a container to umount a container_file_t filesystem
|
|
Daniel J Walsh |
ecb176 |
|
|
Daniel J Walsh |
5a61b6 |
* Fri Sep 22 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.27-1
|
|
Daniel J Walsh |
5a61b6 |
- Allow container runtimes to work with the netfilter sockets
|
|
Daniel J Walsh |
5a61b6 |
- Allow container_file_t to be an entrypoint for VM's
|
|
Daniel J Walsh |
5a61b6 |
- Allow spc_t domains to transition to svirt_t
|
|
Daniel J Walsh |
5a61b6 |
|
|
Daniel J Walsh |
c6e706 |
* Fri Sep 22 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.24-1
|
|
Daniel J Walsh |
c6e706 |
- Make sure container_runtime_t has all access of container_t
|
|
Daniel J Walsh |
c6e706 |
|
|
Daniel J Walsh |
b74f4a |
* Thu Sep 7 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.23-1
|
|
Daniel J Walsh |
b74f4a |
- Allow container runtimes to create sockets in tmp dirs
|
|
Daniel J Walsh |
b74f4a |
|
|
Daniel J Walsh |
1aad22 |
* Tue Sep 5 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.22-1
|
|
Daniel J Walsh |
1aad22 |
- Add additonal support for crio labeling.
|
|
Daniel J Walsh |
1aad22 |
|
|
Troy Dawson |
9a3633 |
* Mon Aug 14 2017 Troy Dawson <tdawson@redhat.com> - 2.21-3
|
|
Troy Dawson |
9a3633 |
- Fixup spec file conditionals
|
|
Troy Dawson |
9a3633 |
|
|
Fedora Release Engineering |
5cb66e |
* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2:2.21-2
|
|
Fedora Release Engineering |
5cb66e |
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
|
|
Fedora Release Engineering |
5cb66e |
|
|
Daniel J Walsh |
bb6875 |
* Thu Jul 6 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.21-1
|
|
Daniel J Walsh |
bb6875 |
- Allow containers to execmod on container_share_t files.
|
|
Daniel J Walsh |
bb6875 |
|
|
Daniel J Walsh |
852a09 |
* Thu Jul 6 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.20-2
|
|
Daniel J Walsh |
852a09 |
- Relabel runc and crio executables
|
|
Daniel J Walsh |
852a09 |
|
|
Daniel J Walsh |
ef7772 |
* Fri Jun 30 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.20-1
|
|
Daniel J Walsh |
ef7772 |
- Allow container processes to getsession
|
|
Daniel J Walsh |
ef7772 |
|
|
Daniel J Walsh |
fbb3cf |
* Mon Jun 12 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.19-1
|
|
Daniel J Walsh |
fbb3cf |
- Allow containers to create tun sockets
|
|
Daniel J Walsh |
fbb3cf |
|
|
Daniel J Walsh |
35b539 |
* Tue Jun 6 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.18-1
|
|
Daniel J Walsh |
35b539 |
- Fix labeling for CRI-O files in overlay subdirs
|
|
Daniel J Walsh |
35b539 |
|
|
Daniel J Walsh |
590def |
* Mon Jun 5 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.17-1
|
|
Daniel J Walsh |
590def |
- Revert change to run the container_runtime as ranged
|
|
Daniel J Walsh |
590def |
|
|
Daniel J Walsh |
486876 |
* Thu Jun 1 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.16-1
|
|
Daniel J Walsh |
486876 |
- Add default labeling for cri-o in /etc/crio directories
|
|
Daniel J Walsh |
486876 |
|
|
Daniel J Walsh |
379ddc |
* Wed May 31 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.15-1
|
|
Daniel J Walsh |
379ddc |
- Allow container types to read/write container_runtime fifo files
|
|
Daniel J Walsh |
379ddc |
- Allow a container runtime to mount on top of its own /proc
|
|
Daniel J Walsh |
379ddc |
|
|
Dan Walsh |
ed21ef |
* Fri May 19 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.14-1
|
|
Dan Walsh |
ed21ef |
- Add labels for crio rename
|
|
Dan Walsh |
ed21ef |
- Break container_t rules out to use a separate container_domain
|
|
Dan Walsh |
ed21ef |
- Allow containers to be able to set namespaced SYCTLS
|
|
Dan Walsh |
ed21ef |
- Allow sandbox containers manage fuse files.
|
|
Dan Walsh |
ed21ef |
- Fixes to make container_runtimes work on MLS machines
|
|
Dan Walsh |
ed21ef |
- Bump version to allow handling of container_file_t filesystems
|
|
Dan Walsh |
ed21ef |
- Allow containers to mount, remount and umount container_file_t file systems
|
|
Dan Walsh |
ed21ef |
- Fixes to handle cap_userns
|
|
Dan Walsh |
ed21ef |
- Give container_t access to XFRM sockets
|
|
Dan Walsh |
ed21ef |
- Allow spc_t to dbus chat with init system
|
|
Dan Walsh |
ed21ef |
- Allow spc_t to dbus chat with init system
|
|
Dan Walsh |
ed21ef |
- Add rules to allow container runtimes to run with unconfined disabled
|
|
Dan Walsh |
ed21ef |
- Add rules to support cgroup file systems mounted into container.
|
|
Dan Walsh |
ed21ef |
- Fix typebounds entrypoint problems
|
|
Dan Walsh |
ed21ef |
- Fix typebounds problems
|
|
Dan Walsh |
ed21ef |
- Add typebounds statement for container_t from container_runtime_t
|
|
Dan Walsh |
ed21ef |
- We should only label runc not runc*
|
|
Dan Walsh |
ed21ef |
|
|
Daniel J Walsh |
d6c9f1 |
* Tue Feb 28 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.10-1
|
|
Daniel J Walsh |
d6c9f1 |
- Add rules to allow container runtimes to run with unconfined disabled
|
|
Daniel J Walsh |
d6c9f1 |
- Add rules to support cgroup file systems mounted into container.
|
|
Daniel J Walsh |
d6c9f1 |
|
|
Daniel J Walsh |
d6c9f1 |
* Mon Feb 13 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2.9-1
|
|
Daniel J Walsh |
4e04f9 |
- Add rules to allow container_runtimes to run with unconfined disabled
|
|
Daniel J Walsh |
4e04f9 |
|
|
Daniel J Walsh |
e6af90 |
* Thu Feb 9 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2:8.1-1
|
|
Daniel J Walsh |
e6af90 |
- Allow container_file_t to be stored on cgroup_t file systems
|
|
Daniel J Walsh |
e6af90 |
|
|
Daniel J Walsh |
afcdd3 |
* Tue Feb 7 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2:7.1-1
|
|
Daniel J Walsh |
afcdd3 |
- Fix type in container interface file
|
|
Daniel J Walsh |
afcdd3 |
|
|
Daniel J Walsh |
761ca4 |
* Mon Feb 6 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2:6.1-1
|
|
Daniel J Walsh |
761ca4 |
- Fix typebounds entrypoint problems
|
|
Daniel J Walsh |
761ca4 |
|
|
Daniel J Walsh |
a2fe41 |
* Fri Jan 27 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2:5.1-1
|
|
Daniel J Walsh |
3fcf74 |
- Fix typebounds problems
|
|
Daniel J Walsh |
3fcf74 |
|
|
Daniel J Walsh |
c06c92 |
* Thu Jan 19 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2:4.1-1
|
|
Daniel J Walsh |
c06c92 |
- Add typebounds statement for container_t from container_runtime_t
|
|
Daniel J Walsh |
c06c92 |
- We should only label runc not runc*
|
|
Daniel J Walsh |
c06c92 |
|
|
Daniel J Walsh |
c8e82c |
* Tue Jan 17 2017 Dan Walsh <dwalsh@fedoraproject.org> - 2:3.1-1
|
|
Daniel J Walsh |
c8e82c |
- Fix labeling on /usr/bin/runc.*
|
|
Daniel J Walsh |
c8e82c |
- Add sandbox_net_domain access to container.te
|
|
Daniel J Walsh |
c8e82c |
- Remove containers ability to look at /etc content
|
|
Daniel J Walsh |
c8e82c |
|
|
Lokesh Mandvekar |
dc5c39 |
* Wed Jan 11 2017 Lokesh Mandvekar <lsm5@fedoraproject.org> - 2:2.2-4
|
|
Lokesh Mandvekar |
dc5c39 |
- use upstream's RHEL-1.12 branch, commit 56c32da for CentOS 7
|
|
Lokesh Mandvekar |
dc5c39 |
|
|
Jonathan Lebon |
6028cc |
* Tue Jan 10 2017 Jonathan Lebon <jlebon@redhat.com> - 2:2.2-3
|
|
Igor Gnatenko |
a7071b |
- properly disable docker module in %%post
|
|
Jonathan Lebon |
6028cc |
|
|
Lokesh Mandvekar |
8602eb |
* Sat Jan 07 2017 Lokesh Mandvekar <lsm5@fedoraproject.org> - 2:2.2-2
|
|
Lokesh Mandvekar |
8602eb |
- depend on selinux-policy-targeted
|
|
Lokesh Mandvekar |
8602eb |
- relabel docker-latest* files as well
|
|
Lokesh Mandvekar |
8602eb |
|
|
Lokesh Mandvekar |
98c88e |
* Fri Jan 06 2017 Lokesh Mandvekar <lsm5@fedoraproject.org> - 2:2.2-1
|
|
Lokesh Mandvekar |
98c88e |
- bump to v2.2
|
|
Lokesh Mandvekar |
98c88e |
- additional labeling for ocid
|
|
Lokesh Mandvekar |
98c88e |
|
|
Lokesh Mandvekar |
57ea4c |
* Fri Jan 06 2017 Lokesh Mandvekar <lsm5@fedoraproject.org> - 2:2.0-2
|
|
Lokesh Mandvekar |
57ea4c |
- install policy at level 200
|
|
Lokesh Mandvekar |
57ea4c |
- From: Dan Walsh <dwalsh@redhat.com>
|
|
Lokesh Mandvekar |
57ea4c |
|
|
Lokesh Mandvekar |
7fa12a |
* Fri Jan 06 2017 Lokesh Mandvekar <lsm5@fedoraproject.org> - 2:2.0-1
|
|
Lokesh Mandvekar |
7fa12a |
- Resolves: #1406517 - bump to v2.0 (first upload to Fedora as a
|
|
Lokesh Mandvekar |
7fa12a |
standalone package)
|
|
Lokesh Mandvekar |
7fa12a |
- include projectatomic/RHEL-1.12 branch commit for building on centos/rhel
|
|
Lokesh Mandvekar |
7fa12a |
|
|
Lokesh Mandvekar |
7fa12a |
* Mon Dec 19 2016 Lokesh Mandvekar <lsm5@fedoraproject.org> - 2:1.12.4-29
|
|
Lokesh Mandvekar |
7fa12a |
- new package (separated from docker)
|