import selinux-policy-38.1.33-1.el9

.gitignore

@@ -1,2 +1,2 @@
 SOURCES/container-selinux.tgz
-SOURCES/selinux-policy-edf0eb4.tar.gz
+SOURCES/selinux-policy-d1f3f7d.tar.gz

.selinux-policy.metadata

@@ -1,2 +1,2 @@
-57d4e2a5363716c35460855ec3534c2c0fc65e13 SOURCES/container-selinux.tgz
-56904e29b53ee59bd96c21662583398adb39e7da SOURCES/selinux-policy-edf0eb4.tar.gz
+648298cca69b51546fe991f56fb6b965d35f3f70 SOURCES/container-selinux.tgz
+b24565482a167a86d3b3973ee8d4b2e299ba4895 SOURCES/selinux-policy-d1f3f7d.tar.gz

SOURCES/file_contexts.subs_dist

@@ -21,3 +21,4 @@
 /sysroot/tmp         /tmp
 /var/usrlocal        /usr/local
 /var/mnt             /mnt
+/bin                 /usr/bin

SOURCES/modules-targeted-contrib.conf

@@ -706,13 +706,6 @@ git = module
 # 
 glance = module
 
-# Layer: contrib
-# Module: glusterd
-#  
-#  policy for glusterd service
-#
-glusterd =  module
-
 # Layer: apps
 # Module: gnome
 #
@@ -2719,3 +2712,31 @@ fdo = module
 #  qatlib - Intel QuickAssist technology library and resources management
 #
 qatlib = module
+
+# Layer: contrib
+# Module: nvme_stas
+#
+# nvme_stas
+#
+nvme_stas = module
+
+# Layer: contrib
+# Module: coreos_installer
+#
+# coreos_installer
+#
+coreos_installer = module
+
+# Layer: contrib
+# Module: afterburn
+#
+# afterburn
+#
+afterburn = module
+
+# Layer: contrib
+# Module: sap_unconfined
+#
+#  sap_unconfined
+#
+sap = module

SPECS/selinux-policy.spec

@@ -1,6 +1,6 @@
 # github repo with selinux-policy sources
 %global giturl https://github.com/fedora-selinux/selinux-policy
-%global commit edf0eb42087eadd8c9fb8cb9b67a07023fffd00b
+%global commit d1f3f7d9fe7f0759f7f2a3f721616aa211b27274
 %global shortcommit %(c=%{commit}; echo ${c:0:7})
 
 %define distro redhat
@@ -23,7 +23,7 @@
 %define CHECKPOLICYVER 3.2
 Summary: SELinux policy configuration
 Name: selinux-policy
-Version: 38.1.23
+Version: 38.1.33
 Release: 1%{?dist}
 License: GPLv2+
 Source: %{giturl}/archive/%{commit}/%{name}-%{shortcommit}.tar.gz
@@ -809,6 +809,180 @@ exit 0
 %endif
 
 %changelog
+* Thu Feb 22 2024 Juraj Marcin <jmarcin@redhat.com> - 38.1.33-1
+- Allow thumb_t to watch and watch_reads mount_var_run_t
+Resolves: RHEL-26073
+- Allow opafm create NFS files and directories
+Resolves: RHEL-17820
+- Label /tmp/libdnf.* with user_tmp_t
+Resolves: RHEL-11250
+
+* Thu Feb 15 2024 Juraj Marcin <jmarcin@redhat.com> - 38.1.32-1
+- Dontaudit subscription manager setfscreate and read file contexts
+Resolves: RHEL-21635
+- Allow xdm_t to watch and watch_reads mount_var_run_t
+Resolves: RHEL-24841
+- Allow unix dgram sendto between exim processes
+Resolves: RHEL-21902
+- Allow utempter_t use ptmx
+Resolves: RHEL-24946
+- Only allow confined user domains to login locally without unconfined_login
+Resolves: RHEL-1551
+- Add userdom_spec_domtrans_confined_admin_users interface
+Resolves: RHEL-1551
+- Only allow admindomain to execute shell via ssh with ssh_sysadm_login
+Resolves: RHEL-1551
+- Add userdom_spec_domtrans_admin_users interface
+Resolves: RHEL-1551
+- Move ssh dyntrans to unconfined inside unconfined_login tunable policy
+Resolves: RHEL-1551
+
+* Thu Jan 25 2024 Juraj Marcin <jmarcin@redhat.com> - 38.1.31-1
+- Allow chronyd-restricted read chronyd key files
+Resolves: RHEL-18219
+- Allow conntrackd_t to use bpf capability2
+Resolves: RHEL-22277
+- Allow smbd_t to watch user_home_dir_t if samba_enable_home_dirs is on
+Resolves: RHEL-14735
+- Allow hypervkvp_t write access to NetworkManager_etc_rw_t
+Resolves: RHEL-14505
+- Add interface for write-only access to NetworkManager rw conf
+Resolves: RHEL-14505
+- Allow unconfined_domain_type use IORING_OP_URING_CMD on all device nodes
+Resolves: RHEL-11792
+
+* Fri Jan 12 2024 Zdenek Pytela <zpytela@redhat.com> - 38.1.30-1
+- Allow sysadm execute traceroute in sysadm_t domain using sudo
+Resolves: RHEL-14077
+- Allow qatlib set attributes of vfio device files
+Resolves: RHEL-19051
+- Allow qatlib load kernel modules
+Resolves: RHEL-19051
+- Allow qatlib run lspci
+Resolves: RHEL-19051
+- Allow qatlib manage its private runtime socket files
+Resolves: RHEL-19051
+- Allow qatlib read/write vfio devices
+Resolves: RHEL-19051
+- Allow syslog to run unconfined scripts conditionally
+Resolves: RHEL-11174
+- Allow syslogd_t nnp_transition to syslogd_unconfined_script_t
+Resolves: RHEL-11174
+- Allow sendmail MTA connect to sendmail LDA
+Resolves: RHEL-15175
+- Allow sysadm execute tcpdump in sysadm_t domain using sudo
+Resolves: RHEL-15432
+- Allow opafm search nfs directories
+Resolves: RHEL-17820
+- Allow mdadm list stratisd data directories
+Resolves: RHEL-19276
+- Update cyrus_stream_connect() to use sockets in /run
+Resolves: RHEL-19282
+- Allow collectd connect to statsd port
+Resolves: RHEL-21044
+- Allow insights-client transition to sap unconfined domain
+Resolves: RHEL-21452
+- Create the sap module
+Resolves: RHEL-21452
+
+* Thu Dec 14 2023 Juraj Marcin <jmarcin@redhat.com> - 38.1.29-1
+- Add init_explicit_domain() interface
+Resolves: RHEL-18219
+- Allow dovecot_auth_t connect to postgresql using UNIX socket
+Resolves: RHEL-16850
+- Allow keepalived_t to use sys_ptrace of cap_userns
+Resolves: RHEL-17156
+- Make `bootc` be `install_exec_t`
+Resolves: RHEL-19199
+- Add support for chronyd-restricted
+Resolves: RHEL-18219
+- Label /dev/vas with vas_device_t
+Resolves: RHEL-17336
+- Allow gpsd use /dev/gnss devices
+Resolves: RHEL-16676
+- Allow sendmail manage its runtime files
+Resolves: RHEL-15175
+- Add support for syslogd unconfined scripts
+Resolves: RHEL-11174
+
+* Thu Nov 30 2023 Juraj Marcin <jmarcin@redhat.com> - 38.1.28-1
+- Create interface selinux_watch_config and add it to SELinux users
+Resolves: RHEL-1555
+- Allow  winbind_rpcd_t processes access when samba_export_all_* is on
+Resolves: RHEL-16273
+- Allow samba-dcerpcd connect to systemd_machined over a unix socket
+Resolves: RHEL-16273
+- Allow winbind-rpcd make a TCP connection to the ldap port
+Resolves: RHEL-16273
+- Allow sudodomain read var auth files
+Resolves: RHEL-16708
+- Allow auditd read all domains process state
+Resolves: RHEL-14285
+- Allow rsync read network sysctls
+Resolves: RHEL-14638
+- Add dhcpcd bpf capability to run bpf programs
+Resolves: RHEL-15326
+- Allow systemd-localed create Xserver config dirs
+Resolves: RHEL-16716
+- Label /var/run/tmpfiles.d/static-nodes.conf with kmod_var_run_t
+Resolves: RHEL-1553
+- Update sendmail policy module for opensmtpd
+Resolves: RHEL-15175
+
+* Tue Nov 14 2023 Juraj Marcin <jmarcin@redhat.com> - 38.1.27-1
+- Remove glusterd module
+Resolves: RHEL-1548
+- Improve default file context(None) of /var/lib/authselect/backups
+Resolves: RHEL-15220
+- Set default file context of /var/lib/authselect/backups to <<none>>
+Resolves: RHEL-15220
+- Create policy for afterburn
+Resolves: RHEL-12591
+- Allow unconfined_domain_type use io_uring cmd on domain
+Resolves: RHEL-11792
+- Add policy for coreos installer
+Resovles: RHEL-5164
+- Add policy for nvme-stas
+Resolves: RHEL-1557
+- Label /var/run/auditd.state as auditd_var_run_t
+Resolves: RHEL-14374
+- Allow ntp to bind and connect to ntske port.
+Resolves: RHEL-15085
+- Allow ip an explicit domain transition to other domains
+Resolves: RHEL-14246
+- Label /usr/libexec/selinux/selinux-autorelabel with semanage_exec_t
+Resolves: RHEL-14289
+- Allow sssd domain transition on passkey_child execution conditionally
+Resolves: RHEL-14014
+- Allow sssd use usb devices conditionally
+Resolves: RHEL-14014
+- Allow kdump create and use its memfd: objects
+Resolves: RHEL-14413
+
+* Tue Oct 31 2023 Zdenek Pytela <zpytela@redhat.com> - 38.1.26-1
+- Allow kdump create and use its memfd: objects
+Resolves: RHEL-14413
+
+* Fri Oct 20 2023 Zdenek Pytela <zpytela@redhat.com> - 38.1.25-1
+- Add map_read map_write to kernel_prog_run_bpf
+Resolves: RHEL-2653
+- Allow sysadm_t read nsfs files
+Resolves: RHEL-5146
+- Dontaudit keepalived setattr on keepalived_unconfined_script_exec_t
+Resolves: RHEL-14029
+- Allow system_mail_t manage exim spool files and dirs
+Resolves: RHEL-14110
+- Label /run/pcsd.socket with cluster_var_run_t
+Resolves: RHEL-1664
+
+* Fri Sep 29 2023 Juraj Marcin <jmarcin@redhat.com> - 38.1.24-1
+- Allow cupsd_t to use bpf capability
+Resolves: RHEL-3633
+- Label /dev/gnss[0-9] with gnss_device_t
+Resolves: RHEL-9936
+- Dontaudit rhsmcertd write memory device
+Resolves: RHEL-1547
+
 * Fri Aug 25 2023 Nikola Knazekova <nknazeko@redhat.com> - 38.1.23-1
 - Allow cups-pdf connect to the system log service
 Resolves: rhbz#2234765