Allow staff user dbus chat with virt-dbus
73914
Allow virtqemud domain transition to nbdkit
69118
Add nbdkit interfaces defined conditionally
69118
Allow svirt_t read sysfs files
71270
Label /dev/pmem[0-9]+ with fixed_disk_device_t
71656
Add support for the KVM guest memfd anon inodes
69128
Allow sysadm user dbus chat with virt-dbus
73914
Allow initrc_t transition to passwd_t
71665
Allow unconfined_service_t transition to passwd_t
71665

Allow init create vsock socket for sshd
72549
Support ssh connections via systemd-ssh-generator
72549
Allow ssh generator work with systemd unit files
72549
Confine systemd system-ssh-generator
72549
Allow login_userdomain getattr nsfs files
72549
Allow virtqemud send a generic signal to the ssh client domain
53972
Add the auth_dontaudit_read_passwd_file() interface
71490
Dontaudit request-key read /etc/passwd
71490

Allow virtqemud domain transition on numad execution
65789
Support virt live migration using ssh
53972
Allow ssh_t read systemd config files
53972
Allow virtqemud permissions needed for live migration
43217
Allow virtqemud the getpgid process permission
46357
Allow virtqemud manage nfs dirs when virt_use_nfs boolean is on
71068
Allow virtqemud relabelfrom virt_log_t files
48236
Allow virtqemud relabel tun_socket
71394
Allow gnome-remote-desktop dbus chat with policykit
35877
Update ktlsh policy
42672
Confine the ktls service
42672
Allow request-key to read /etc/passwd
71490
Allow request-key to manage all domains' keys
71490

Rebuild with SELinux Userspace 3.8

Allow systemd-journald getattr nsfs files
71803
Allow systemd-related domains getattr nsfs files
71803

Sync dist/targeted/modules.conf with Fedora 42
70850
Add support for sap
70850
Allow sssd_selinux_manager_t the setcap process permission
70822
Allow virtqemud open svirt_devpts_t char files
43446
Fix the cups_read_pid_files() interface to use read_files_pattern
69512

Update samba-bgqd policy
69512
Allow samba-bgqd read cups config files
69512
Allow virtqemud additional permissions for tmpfs_t blk devices
61235
Allow virtqemud rw access to svirt_image_t chr files
61235
Allow virtqemud rw and setattr access to fixed block devices
61235
Label /etc/mdevctl.d/scripts.d with bin_t
39893
39893
Allow virtnodedev watch mdevctl config dirs
39893
Make mdevctl_conf_t member of the file_type attribute
39893
Label /etc/mdevctl.d with mdevctl_conf_t
39893
Allow virtqemud relabelfrom virt_log_t files
48236
Allow virtqemud_t relabel virtqemud_var_run_t sock_files
48236
Allow virtqemud relabelfrom virtqemud_var_run_t dirs
48236
Allow svirt_tcg_t read virtqemud_t fifo_files
48236
Allow virtqemud rw and setattr access to sev devices
69128
Allow virtqemud directly read and write to a fixed disk
61235
Allow svirt_t the sys_rawio capability
61235
Allow svirt_t the sys_rawio capability
61235
Allow virtqemud connect to sanlock over a unix stream socket
44352
allow gdm and iiosensorproxy talk to each other via D-bus
70850
Allow sendmail to map mail server configuration files
54014
Allow procmail to read mail aliases
54014
Grant rhsmcertd chown capability & userdb access
68481

Fix the file type for /run/systemd/generator
68313

Allow qatlib search the content of the kernel debugging filesystem
66334
Allow qatlib connect to systemd-machined over a unix socket
66334
Update policy for samba-bgqd
64908
Allow httpd get attributes of dirsrv unit files
62706
Allow virtstoraged read vm sysctls
61742
Allow virtstoraged execute mount programs in the mount domain
61742
Update policy for rpc-virtstorage
61742
Allow virtstoraged get attributes of configfs dirs
61742
Allow virt_driver_domain read virtd-lxc files in /proc
61742
Allow virtstoraged manage files with virt_content_t type
61742
Allow virtstoraged use the io_uring API
61742
Allow virtstoraged execute lvm programs in the lvm domain
61742
Allow svirt_t connect to unconfined_t over a unix domain socket
61246
Label /usr/lib/node_modules_22/npm/bin with bin_t
56350
Allow bacula execute container in the container domain
39529
Label /run/systemd/generator with systemd_unit_file_t
68313

mls/modules.conf - fix typo
Use dist/targeted/modules.conf in build workflow
Fix default and dist config files
CI: update to actions/checkout@v4
Clean up and sync securetty_types
Bring config files from dist-git into the source repo
Sync users with Fedora targeted users

Revert "Allow unconfined_t execute kmod in the kmod domain"
65190
Add policy for /usr/libexec/samba/samba-bgqd
64908
Label samba certificates with samba_cert_t
64908
Label /usr/bin/samba-gpupdate with samba_gpupdate_exec_t
64908
Allow rpcd read network sysctls
64737
Label all semanage store files in /etc as semanage_store_t
65864

Bump release for October 2024 mass rebuild:
64018

Dontaudit subscription manager setfscreate and read file contexts
58009
Allow the sysadm user use the secretmem API
40953
Allow sudodomain list files in /var
58068
Allow gnome-remote-desktop watch /etc directory
35877
Allow journalctl connect to systemd-userdbd over a unix socket
58072
systemd: allow sys_admin capability for systemd_notify_t
58072
Allow some confined users send to lldpad over a unix dgram socket
61634
Allow lldpad send to sysadm_t over a unix dgram socket
61634
Allow lldpd connect to systemd-machined over a unix socket
61634

Allow ping_t read network sysctls
54299
Label /usr/lib/node_modules/npm/bin with bin_t
56350
Label /run/sssd with sssd_var_run_t
57065
Allow virtqemud read virtd_t files
57713
Allow wdmd read hardware state information
57982
Allow wdmd list the contents of the sysfs directories
57982
Label /etc/sysctl.d and /run/sysctl.d with system_conf_t
58380
Allow dirsrv read network sysctls
58381
Allow lldpad create and use netlink_generic_socket
61634
Allow unconfined_t execute kmod in the kmod domain
61755
Confine the pcm service
52838
Allow iio-sensor-proxy the bpf capability
62355
Confine iio-sensor-proxy
62355

Confine gnome-remote-desktop
35877
Allow virtqemud get attributes of a tmpfs filesystem
40855
Allow virtqemud get attributes of cifs files
40855
Allow virtqemud get attributes of filesystems with extended attributes
39668
Allow virtqemud get attributes of NFS filesystems
40855
Add support for secretmem anon inode
40953
Allow systemd-sleep read raw disk data
49600
Allow systemd-hwdb send messages to kernel unix datagram sockets
50810
Label /run/modprobe.d with modules_conf_t
54591
Allow setsebool_t relabel selinux data files
55412
Don't audit crontab_domain write attempts to user home
56349
Differentiate between staff and sysadm when executing crontab with sudo
56349
Add crontab_admin_domtrans interface
56349
Add crontab_domtrans interface
56349
Allow boothd connect to kernel over a unix socket
58060
Fix label of pseudoterminals created from sudodomain
58068
systemd: allow systemd_notify_t to send data to kernel_t datagram sockets
58072
Allow rsyslog read systemd-logind session files
40961
Label /dev/mmcblk0rpmb character device with removable_device_t
55265
Label /dev/hfi1_[0-9]+ devices
62836
Label /dev/papr-sysparm and /dev/papr-vpd
56908
Support SGX devices
62354
Suppress semodule's stderr
59192

Allow virtqemud relabelfrom also for file and sock_file
49763
Allow virtqemud relabel user tmp files and socket files
49763
Update virtqemud policy for libguestfs usage
49763
Label /run/libvirt/qemu/channel with virtqemud_var_run_t
47274