Sat, 24 Oct 2026 09:34:30 UTC | login

Information for build selinux-policy-45.19-1.fc45

ID199
Package Nameselinux-policy
Version45.19
Release1.fc45
Epoch
DraftFalse
Sourcegit+https://src.fedoraproject.org/rpms/selinux-policy.git#592ede7d097124a98f82d982601f7fd24acc6a05
SummarySELinux policy configuration
DescriptionSELinux core policy package. Originally based off of reference policy, the policy has been adjusted to provide support for Fedora.
Built byguoguo
State complete
Volume DEFAULT
StartedMon, 12 Oct 2026 07:05:32 UTC
CompletedMon, 12 Oct 2026 07:26:33 UTC
Taskbuild (f45, /rpms/selinux-policy.git:592ede7d097124a98f82d982601f7fd24acc6a05)
Extra{'source': {'original_url': 'git+https://src.fedoraproject.org/rpms/selinux-policy.git#592ede7d097124a98f82d982601f7fd24acc6a05'}}
Tags
f45
RPMs
src
selinux-policy-45.19-1.fc45.src.rpm (info) (download)
noarch
selinux-policy-45.19-1.fc45.noarch.rpm (info) (download)
selinux-policy-devel-45.19-1.fc45.noarch.rpm (info) (download)
selinux-policy-doc-45.19-1.fc45.noarch.rpm (info) (download)
selinux-policy-minimum-45.19-1.fc45.noarch.rpm (info) (download)
selinux-policy-mls-45.19-1.fc45.noarch.rpm (info) (download)
selinux-policy-sandbox-45.19-1.fc45.noarch.rpm (info) (download)
selinux-policy-targeted-45.19-1.fc45.noarch.rpm (info) (download)
Logs
noarch
mock_config.log
state.log
build.log
root.log
dnf5.log
noarch_rpmdiff.json
mock_output.log
hw_info.log
installed_pkgs.log
Changelog * Mon Sep 21 2026 Zdenek Pytela <zpytela@redhat.com> - 45.19-1 - Make post-te statement extraction tolerant of leading whitespace - Allow login/pam_systemd started by kmscon to access env vars * Fri Sep 18 2026 Zdenek Pytela <zpytela@redhat.com> - 45.18-1 - Allow sshd-session tcp connect to all reserved ports - Allow sshd-session connect to vnc port - Allow sshd-session transition on passwd execution - Allow dhcpc-hook get init status - Allow kmscon read systemd_ssh_issue PID files - Rearrange kmscon policy to comply with formatting rules - Allow kmscon signal init - Allow systemd-timedated read network sysctls - Add CI check for whitespace on pull requests - Remove commented-out interface calls - Fix whitespace across all policy modules - Move systemd_read_userdbd_runtime_sock_files() to another optional block - Use udev_manage_pid_lnk_files() instead of direct reference * Fri Sep 11 2026 Zdenek Pytela <zpytela@redhat.com> - 45.17-1 - Fix corrupted formatting in files.if - Allow nsswitch_domain connect to read xdm pid socket files - nsresourced fixes for mkosi (bsc#1279902) - Allow sshd-session connect to gnome remote desktop port - Allow sshd-session to connect to all generic ports - Allow sshd-session connect to port 443/tcp (http_port_t) - Allow sshd-session connect to tcp/22 (ssh_port_t) - Allow rsync to getattr pipes and sockes if rsync_export_all_ro is set (bsc#1279051) - Introduce files_getattr_non_auth_sockets - Introduce files_getattr_non_auth_pipes interface - Allow rsync to read var_t (bsc#1279565) - Update udev_manage_pid_files() to include symlinks read - Support vfs_snapper to work with samba_share_t (bsc#1265400) - vfs_samba uses dbus to communicate with snapper (bsc#1265400) - fix NetworkManager dnsmasq-forwarders.conf labeling (bsc#1260038) - Allow cupsd_t to communicate with fprintd via dbus (bsc#1268366) - Allow kmscon read cocpit's pid files - fix vpnc_t setpgid permission for openconnect (bsc#1272934) * Mon Sep 07 2026 Zdenek Pytela <zpytela@redhat.com> - 45.16-1 - Allow systemd-sysctl to create /run/sysctl.d - Allow systemd to create /run/udev/control - Allow systemd-coredumpd to create /run/systemd/coredumpd/kernel - Allow bootupcl nnp transition to mount_t - Networkmanager: Remove files_manage_etc_files for console_t - Networkmanager: Allow NM to manage files under /run - Allow login_userdomain read/write kmscon devpts chr_files - Support console version of initial-setup - ssh-session accesses gitolite ssh config files (bsc#1277259) - Allow kmscon use netlink permissions (#3368) * Wed Sep 02 2026 Adam Williamson <adamwill@fedoraproject.org> - 45.15-2 - Backport PR #3396 to fix initial-setup on kmscon (rhbz#2484542) * Thu Aug 27 2026 Zdenek Pytela <zpytela@redhat.com> - 45.15-1 - Fix NFS mount with xprtsec=tls / xprtsec=mtls (bsc#1275783) - Allow ssh_agent_type manage ssh_home_t files and sock_files - Allow sshd-session manage ssh_home_t socke files - Allow sshd-session X11 forwarding - Allow lsmd-plugin read udev pid files - Allow virtstoraged domain transition on iscsiadm execution - Revert "Allow virtqemud domain transition on iscsiadm execution" - Allow rhsmcertd search gconf home data dirs - Allow rhsmcertd read gconf home files - Revert "Allow rhsmcertd read gconf home files" * Sat Aug 22 2026 Zdenek Pytela <zpytela@redhat.com> - 45.14-1 - Label malware-detection-config.yml with insights_client_etc_rw_t - Add the files_write_system_conf_files() interface - Allow bluez dbus api pass sockets over dbus - Support sandboxing features for sysadm_t - Update dhcpc-hook policy - Allow dhcpc hook query the chronyd service - Support gnome-remote-desktop's smartcard redirection support - Allow gnome-remote-desktop read sssd public files - Allow gnome-remote-desktop connect to unreserved ports - Allow gnome-remote-desktop speak with tabrmd over dbus (bsc#1244573) - Label /run/audit with auditd_var_run_t - Allow auditd manage its private run dirs - Allow virtqemud relabelfrom its private fifo files - Update the ssh_server_template() template - Add rules for sshd vsock socket read/write - Allow sshd-auth/sshd-session get attributes of their sshd parent - Allow qatlib manage hugetlbfs directories - Allow sanlock the sys_admin capability - Allow lsmd-plugin use libStorageMgmt to provision storage - Allow insights-client read gconf home files - rhsmcertd: allow bootc/ostree transient package persistence detection - Allow rhsmcertd read the file_contexts files - Allow rhsmcertd read selinux config and default file contexts - Use NetworkManager_t instead of networkmanager_t * Thu Aug 20 2026 Zdenek Pytela <zpytela@redhat.com> - 45.13-1 - Allow namespace_init_t execute generic programs in bin directories - Update the ssh_server_template() template - Add rules for sshd vsock socket read/write - Allow dhcpc hook query the chronyd service - Allow insights-client read gconf home files - Allow login_userdomain mount, remount, unmount all mount points - Allow login_userdomain mount on all mount points - Revert "Allow userdomain get attributes of files on an nsfs filesystem" - Allow accountsd create and use its private tmpfs files - Add the anaconda_read_state_install() interface * Fri Aug 14 2026 Zdenek Pytela <zpytela@redhat.com> - 45.12-1 - Update qatlib policy - Allow rhsmcertd read the file_contexts files - rhsmcertd: allow bootc/ostree transient package persistence detection - Allow virtproxyd connect to systemd-homed over a unix stream socket - Allow system_mail_t read procmail home content - Label malware-detection-config.yml with insights_client_etc_rw_t - Add bcachefs as a SELinux capable filesystem - Allow unconfined_service_t nnp_transition to container_runtime_t - Add the files_write_system_conf_files() interface - Allow haveged (entropyd_t) create and use its private tmpfs files * Wed Aug 05 2026 Zdenek Pytela <zpytela@redhat.com> - 45.11-1 - Allow ctdbd manage access to Samba PID directories - Allow rhsmcertd read selinux config and default file contexts - Allow staff_t and user_t execute udev without a domain transition - Allow mpd dbus chat with avahi - Allow init_t nnp domain transition to mpd_t - Update tuned-ppd policy - Update policy for virsh_ssh_t to help with live migration - Update sysadm policy for encrypted volumes usage - Allow bootupd read all passwd sources - Allow local login and sshd-session signull cockpit-session - Allow sysadm_t read/write kvm devices - Allow sysadm user run fail2ban-client - Add 2 interfaces helping to handle cloud-what cache files - Allow all domains to use inherited sshd-session pipes - Dontaudit tlp_t dac_override (bsc#1272935) - Use NetworkManager_t instead of networkmanager_t * Fri Jul 24 2026 Zdenek Pytela <zpytela@redhat.com> - 45.10-1 - Changes adapting to bind packages with suffixes - Dontaudit unconfined_t map its private directories - Support cronie create crontab backups - Allow nfsidmapd read virt lib files - Allow sysadm_t run and read/write networkmanager bpf programs - Allow dhcpc_hook_t connect to init_t over a unix stream socket - Allow unconfined_t mounton its lnk_files - Allow wireguard read cgroup files - Label /usr/local/share/man with man_t - Allow pcscd get attributes of a pty filesystem - Allow geoclue read cgroup files * Fri Jul 17 2026 Zdenek Pytela <zpytela@redhat.com> - 45.9-1 - Allow init_t nnp domain transition to postgresql_t - Move bootupd systemd interface to 2 optional blocks - Allow net_admin to the nfsd_t domain - Allow kernel write to unconfined and sysadm users' keys - Allow staff user ioctl cockpit-session stream sockets - Allow the staff user mount on tmpfs directories - Allow staff user the dac_override capability in the user namespace - Allow aide get attributes of all filesystems - Make insights_client_t accessible from the system cronjob - Support systemtap on a UEFI+SecureBoot system - Allow systemd-coredump signull spc container - Allow dhcpcd hook scripts read generic files in /proc * Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild * Tue Jun 30 2026 Zdenek Pytela <zpytela@redhat.com> - 45.8-1 - Include key_socket in socket_class_set - Remove 14 permissive domains - ci: Run cockpit-machines tests in PRs - Remove the lockdown class from the policy * Fri Jun 26 2026 Zdenek Pytela <zpytela@redhat.com> - 45.7-1 - Allow systemd-logind the sys_ptrace capability in the user namespace - Allow systemd-sleep the perfmon capability - Allow sshd_session_t dyntransition to sftpd_t - Allow lttng kernel tracing - Allow loadkeys create and use its private tmpfs files - Allow journald create and use netlink_tcpdiag_socket - Fix typo in the comment of build.conf - Allow gpg_pinentry_t to write session dbus socket files * Mon Jun 22 2026 Zdenek Pytela <zpytela@redhat.com> - 45.6-1 - Allow systemd-hostnamed read hwdb files - Allow systemd-machined to manage nspawn runtime directory - Allow pcm-sensor-server the sys_admin capability - Allow nut/upsmon read nut_conf_t symlinks - Support new sanlock features - using libdm and SG_IO - Allow thumb_t mount proc filesystem - Allow aide connect to the GDM userdb provider socket - Allow postfix_postdrop_t/system_mail_t append to init unix domain stream sockets - Allow nfsd_t to create netlink_generic_socket (bsc#1267826) * Fri Jun 12 2026 Zdenek Pytela <zpytela@redhat.com> - 45.5-1 - Add anaconda_ioctl_fifo_files_install() and anaconda_write_fifo_files_install() - Allow install_t domain transition to insights_client_t - Allow staff user mounton /var/lib dirs - Allow systemd-coredump signull container runtime - Allow blueman get the attributes of a tmpfs filesystem - portage_compile_domain: Require xdm_xserver_tmp_t type - Add missing interface requirements - Dontaudit virt_driver_domain execmem - fixed file after comment from zpytela. - added caddy related paths. - Remove extra parameters from interface headers - Update bootupd policy for running lsblk - Allow pcscd_t to search cgroup * Thu Jun 04 2026 Zdenek Pytela <zpytela@redhat.com> - 45.4-1 - Update dbus_role_template() with communication over unix dgram socket - Allow staff user read nsfs files - Allow staff user additional sandboxing permissions - Dontaudit sa-update perfmon and sys_admin capabilities - packit: Stop notifying martinpitt for Cockpit test failures - Allow the kernel to execute also special files - Bring back execmem permission for svirt_tcg_t - Dontaudit tlp_t requesting dac_read_search (bsc#1265386) - Leave content of virtqemud_use_execmem empty - Dontaudit libvirt-daemons execmem - Allow virtstoraged to setattr fixed disk devices - Dontaudit ksmtuned dac_read_search and dac_override capabilities - Remove unused hypervkvp_unit_file_t - Allow mock create and use its private tmpfs files - Allow samba-bgqd send to nmbd over a unix datagram socket - Dontaudit apcupsd dac_override (bsc#1261232) - Allow virtqemud_t to call and transition into udev * Wed May 20 2026 Rachel Menge <rlmenge@gmail.com> - 45.3-2 - Remove deprecated checkreqprot tmpfiles write in selinux-policy.conf * Mon May 18 2026 Zdenek Pytela <zpytela@redhat.com> - 45.3-1 - Allow sys_resource on execution of generic executables conditionally - Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t - Label /run/coreos with coreos_installer_var_run_t - Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file() - Allow virtnwfilterd_t r/w on packet_socket (bsc#1264273) - Update fstools swap interfaces with dir search - Allow go-fdo-server to read system information - Add missing fc rule for org.gnome.DisplayManager (bsc#1264182) - config: make /etc/systemd/user same as /usr/lib/systemd/user - Do not audit iptables attempts to read other process state - Policy for go-fdo-server - Allow setroubleshoot_fixit_t to touch /.autorelabel and reboot * Mon Apr 27 2026 Zdenek Pytela <zpytela@redhat.com> - 45.2-1 - Allow init nnp domain transition do dirsrv_t and dirsrv_snmp_t - Allow NetworkManager_dispatcher_nvme_t check status of systemd services - Allow iptables_t read state of some processes - Label /dev/HID-SENSOR-.* with hid_sensor_device_t - Allow thump_t setattr on thumb_tmp_t lnk_files - Allow accounts-daemon read accountsd_share_t symlinks - Label /usr/bin/sudo-rs and /usr/bin/su-rs - Allow gpsd the setcap process capability * Mon Apr 20 2026 Zdenek Pytela <zpytela@redhat.com> - 45.1-1 - Do not backslash-escape underscores in file context specifications - Allow systemd_homework_t to delete systemd_homed_record_t dirs (bsc#1261359) - Allow sshd-auth/sshd-session get attributes of their sshd parent - Allow systemd-tmpfiles to adjust resource limits - Allow logwatch to getattr nsfs files - Allow xdm dbus chat with rhsmcertd - Allow dhcpc_hook_t unix_dgram_socket and module_request - Allow accountsd list accountsd_share_t dirs - Allow cloud init to domtrans into ssh keygen (bsc#1249964) * Wed Apr 08 2026 Vit Mojzis <vmojzis@redhat.com> - 43.6-2 - Advertise ownership of DPS-related file paths - Remove trigger{in|preun} triggers for binsbin and varrun - Rebuild policy before running {binsbin|varrun}-convert.sh - Use docdir for documentation data directory - Move the awk post-requires to the minimum subpackage - Fix disabling modules in "%post minimum" * Fri Apr 03 2026 Zdenek Pytela <zpytela@redhat.com> - 43.6-1 - Allow accountsd dbus chat with systemd-homed - Allow accountsd read accountsd_share_t files - Fix file context specification for /usr/share/accountsservice - Allow xdm_exec_t be an entrypoint of login_userdomain - Allow sshd-session send a generic signal to sshd-auth - Allow virtnetworkd get attributes of filesystems with extended attributes - Allow Polkit to get attributes of user terminals - Allow nfsidmap connect to xdm over a unix stream socket * Thu Apr 02 2026 Zdenek Pytela <zpytela@redhat.com> - 43.5-1 - Allow virtnetworkd get attributes of filesystems with extended attributes - Allow Polkit to get attributes of user terminals - Allow nfsidmap connect to xdm over a unix stream socket - Label /usr/share/accountsservice with accountsd_share_t - Allow systemd-resolved write to systemd-networkd socket - Dontaudit setroubleshootd read root's home files like .rpmmacros - Support sandboxing features for sysadm_t - Allow unconfined_t mounton on itself (bsc#1261035) * Tue Mar 31 2026 Zdenek Pytela <zpytela@redhat.com> - 43.4-2 - Remove unnecessary dependencies * Fri Mar 27 2026 Zdenek Pytela <zpytela@redhat.com> - 43.4-1 - update support for polkit agent helper (bsc#1251931) - Add auth_nnp_domtrans_chkpwd() - Allow staff_sudo_t read PID1's process state - Allow staff_sudo_t read logind sessions files - Allow nfs-server system generator the dac_read_search capability - Allow snmpd create and use netlink tcpdiag socket - Allow systemd-coredump signull containers - Allow named_filetrans_domain filetrans flatpak homedir (bsc#1253682) - Dontaudit logrotate perfmon and sys_admin capabilities - Allow samba-bgqd sendto over a unix dgram socket * Mon Mar 23 2026 Zdenek Pytela <zpytela@redhat.com> - 43.3-1 - Move interfaces from other modules to optional block * Sat Mar 21 2026 Zdenek Pytela <zpytela@redhat.com> - 43.2-1 - Allow fedoratp_exec_t be an entrypoint of unconfined_t - Allow rasdaemon_t to list pstore (bsc#1259742) - Allow virtqemud_t send kill signal to svirt_tcg_t - Allow virtqemud_t get priority of a svirt_t process - Allow sysadm user connect to lvm over a unix stream socket - Allow staff user delete thump_tmp_t files - Allow staff user connect to systemd-logind over a unix stream socket - Allow staff user mount /proc - Allow virtqemud map vhost net device - Dontaudit ps to read proc (bsc#1257527) - Allow dovecot_deliver_t map its private tmp files - Allow rpcbind get attributes of the pidfs filesystem - Fix names in mysql.if - Allow create kerberos files in mysql db home - Allow systemd-resolved connect to systemd-networkd over a unix stream socket * Tue Mar 10 2026 Zdenek Pytela <zpytela@redhat.com> - 43.1-1 - Allow redis_t to create netlink_rdma_socket - Allow systemd create symlinks in /run/varlink/registry - Support hooks in /run/systemd/resolve.hook - Allow virtlogd_t dac_override for virtlock (bsc#1253389) - Allow mdadm use modprobe (bsc#1257793) - Allow systemd-mountfsd the perfmon capability - Allow lttng tracing in default configuration - Allow rtkit-daemon write systemd inhibit pipes - Apply the systemd system generator template to the kdump-dep generator - Apply the systemd system generator template to the anaconda generator * Thu Mar 05 2026 Zdenek Pytela <zpytela@redhat.com> - 42.25-1 - Dontaudit ps permissions that tlp_t does not need (bsc#1257527) - TLP uses ps aux to check for different services (bsc#1257527) - Introduce separate types for generic systemd generators. - Confine system generator nm-initrd-generator.sh (bsc#1257754) - Allow rtkit-daemon dbus chat with systemd-logind - ecryptfs uses /home/.ecryptfs for full homedir encryption (bsc#1258350) - Dontaudit tlshd write generic certificate dirs - Allow systemd-coredump the kill capability in the user namespace - Allow NetworkManager list bpf directories - Allow virtnodedevd the dac_read_search capability - Allow pkcsslotd read files in /proc and /sys - Allow pkcsslotd map its private tmpfs files - Allow dovecoth-auth to connect to systemd-logind over a unix socket - Allow tlshd write generic certificate dirs * Fri Feb 13 2026 Zdenek Pytela <zpytela@redhat.com> - 42.24-1 - Allow mdadm to use CAP_BPF during RAID monitoring - Allow rhsmcertd read anaconda run files - Allow rpc.mountd setuid and setgid capabilities - Use kernel_dgram_send() for systemd_notify_t - Allow lttng-sessiond to use sd_notify - Label /etc/aliases.cdb with etc_aliases_t - Add aliases.lmdb to mta_filetrans_named_content() - Update gpg_role() interface with unix_stream_socket permissions - Allow systemd-hostnamed to create its Varlink socket * Wed Feb 04 2026 Zdenek Pytela <zpytela@redhat.com> - 42.23-1 - Allow thumbnailer mount on fonts cache directories - Support confined users usage of bubblewrap - Allow vdagent get attributes of the pidfs filesystem - Allow sshd-session inherit limits from its parent sshd process - Revert "Allow sshd-session inherit limits from its parent process" - Allow sshd-session read network sysctls - Add the fs_write_tmpfs_files() interface - Update gpg policy for interactions with rhc-playbook-verifier - Allow rhc_playbook_verifier_t stream connect to itself - Update policy for rhc-worker-playbook - Allow sudodomain connect to gkeyringd over a unix stream socket - Allow tlshd communication to unconfined_t over a tcp socket - Allow tlshd write generic certificates - Allow thumbnailer connect to abrt over a unix stream socket * Fri Jan 23 2026 Zdenek Pytela <zpytela@redhat.com> - 42.22-1 - Allow thumb_t stream connect to systemd-machined - Allow thumb_t stream connect to systemd-homed - Allow aide get attributes of tmpfs and devtmpfs filesystems - Allow sshd noatsecure on sshd-session execution - Confine rhc-worker-playbook.worker and rhc-playbook-verifier - Allow kernel_t to read/write all domains' pipes - Allow domain read sysfs files - allow abrt_dump_oops to write to init sockets - Add insights_client service interfaces - Allow plasma login manager stop login services - Allow NM nvme dispatcher script start systemd services * Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 42.21-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild