| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: selinux-policy | Distribution: Fedora Project |
| Version: 43.9 | Vendor: Fedora Project |
| Release: 1.fc43 | Build date: Mon Jul 27 15:21:44 2026 |
| Group: Unspecified | Build host: buildvm-ppc64le-05.rdu3.fedoraproject.org |
| Size: 32771 | Source RPM: selinux-policy-43.9-1.fc43.src.rpm |
| Packager: Fedora Project | |
| Url: https://github.com/fedora-selinux/selinux-policy | |
| Summary: SELinux policy configuration | |
SELinux core policy package. Originally based off of reference policy, the policy has been adjusted to provide support for Fedora.
GPL-2.0-or-later
* Fri Jul 24 2026 Zdenek Pytela <zpytela@redhat.com> - 43.9-1 - Label /usr/local/share/man with man_t - Allow journald create and use netlink_tcpdiag_socket - Allow aide connect to the GDM userdb provider socket - Allow staff user mounton /var/lib dirs - Allow blueman get the attributes of a tmpfs filesystem - Add missing fc rule for org.gnome.DisplayManager (bsc#1264182) * Fri Jun 05 2026 Zdenek Pytela <zpytela@redhat.com> - 43.8-1 - Update dbus_role_template() with communication over unix dgram socket - Allow staff user read nsfs files - Allow staff user additional sandboxing permissions - Do not audit iptables attempts to read other process state - Allow setroubleshoot_fixit_t to touch /.autorelabel and reboot - Allow systemd-tmpfiles to adjust resource limits * Wed May 20 2026 Rachel Menge <rlmenge@gmail.com> - 43.7-2 - Remove deprecated checkreqprot tmpfiles write in selinux-policy.conf * Tue Apr 28 2026 Zdenek Pytela <zpytela@redhat.com> - 43.7-1 - Allow init nnp domain transition do dirsrv_t and dirsrv_snmp_t - Allow accounts-daemon read accountsd_share_t symlinks - Allow thump_t setattr on thumb_tmp_t lnk_files - Allow gpsd the setcap process capability - Allow accountsd list accountsd_share_t dirs - Allow sshd-auth/sshd-session get attributes of their sshd parent * Fri Apr 03 2026 Zdenek Pytela <zpytela@redhat.com> - 43.6-1 - Allow accountsd dbus chat with systemd-homed - Allow accountsd read accountsd_share_t files - Fix file context specification for /usr/share/accountsservice - Allow xdm_exec_t be an entrypoint of login_userdomain - Allow sshd-session send a generic signal to sshd-auth - Allow virtnetworkd get attributes of filesystems with extended attributes - Allow Polkit to get attributes of user terminals - Allow nfsidmap connect to xdm over a unix stream socket * Thu Apr 02 2026 Zdenek Pytela <zpytela@redhat.com> - 43.5-1 - Allow virtnetworkd get attributes of filesystems with extended attributes - Allow Polkit to get attributes of user terminals - Allow nfsidmap connect to xdm over a unix stream socket - Label /usr/share/accountsservice with accountsd_share_t - Allow systemd-resolved write to systemd-networkd socket - Dontaudit setroubleshootd read root's home files like .rpmmacros - Support sandboxing features for sysadm_t - Allow unconfined_t mounton on itself (bsc#1261035) * Tue Mar 31 2026 Zdenek Pytela <zpytela@redhat.com> - 43.4-2 - Remove unnecessary dependencies * Fri Mar 27 2026 Zdenek Pytela <zpytela@redhat.com> - 43.4-1 - update support for polkit agent helper (bsc#1251931) - Add auth_nnp_domtrans_chkpwd() - Allow staff_sudo_t read PID1's process state - Allow staff_sudo_t read logind sessions files - Allow nfs-server system generator the dac_read_search capability - Allow snmpd create and use netlink tcpdiag socket - Allow systemd-coredump signull containers - Allow named_filetrans_domain filetrans flatpak homedir (bsc#1253682) - Dontaudit logrotate perfmon and sys_admin capabilities - Allow samba-bgqd sendto over a unix dgram socket * Mon Mar 23 2026 Zdenek Pytela <zpytela@redhat.com> - 43.3-1 - Move interfaces from other modules to optional block * Sat Mar 21 2026 Zdenek Pytela <zpytela@redhat.com> - 43.2-1 - Allow fedoratp_exec_t be an entrypoint of unconfined_t - Allow rasdaemon_t to list pstore (bsc#1259742) - Allow virtqemud_t send kill signal to svirt_tcg_t - Allow virtqemud_t get priority of a svirt_t process - Allow sysadm user connect to lvm over a unix stream socket - Allow staff user delete thump_tmp_t files - Allow staff user connect to systemd-logind over a unix stream socket - Allow staff user mount /proc - Allow virtqemud map vhost net device - Dontaudit ps to read proc (bsc#1257527) - Allow dovecot_deliver_t map its private tmp files - Allow rpcbind get attributes of the pidfs filesystem - Fix names in mysql.if - Allow create kerberos files in mysql db home - Allow systemd-resolved connect to systemd-networkd over a unix stream socket * Tue Mar 10 2026 Zdenek Pytela <zpytela@redhat.com> - 43.1-1 - Allow redis_t to create netlink_rdma_socket - Allow systemd create symlinks in /run/varlink/registry - Support hooks in /run/systemd/resolve.hook - Allow virtlogd_t dac_override for virtlock (bsc#1253389) - Allow mdadm use modprobe (bsc#1257793) - Allow systemd-mountfsd the perfmon capability - Allow lttng tracing in default configuration - Allow rtkit-daemon write systemd inhibit pipes - Apply the systemd system generator template to the kdump-dep generator - Apply the systemd system generator template to the anaconda generator * Thu Mar 05 2026 Zdenek Pytela <zpytela@redhat.com> - 42.25-1 - Dontaudit ps permissions that tlp_t does not need (bsc#1257527) - TLP uses ps aux to check for different services (bsc#1257527) - Introduce separate types for generic systemd generators. - Confine system generator nm-initrd-generator.sh (bsc#1257754) - Allow rtkit-daemon dbus chat with systemd-logind - ecryptfs uses /home/.ecryptfs for full homedir encryption (bsc#1258350) - Dontaudit tlshd write generic certificate dirs - Allow systemd-coredump the kill capability in the user namespace - Allow NetworkManager list bpf directories - Allow virtnodedevd the dac_read_search capability - Allow pkcsslotd read files in /proc and /sys - Allow pkcsslotd map its private tmpfs files - Allow dovecoth-auth to connect to systemd-logind over a unix socket - Allow tlshd write generic certificate dirs * Fri Feb 13 2026 Zdenek Pytela <zpytela@redhat.com> - 42.24-1 - Allow mdadm to use CAP_BPF during RAID monitoring - Allow rhsmcertd read anaconda run files - Allow rpc.mountd setuid and setgid capabilities - Use kernel_dgram_send() for systemd_notify_t - Allow lttng-sessiond to use sd_notify - Label /etc/aliases.cdb with etc_aliases_t - Add aliases.lmdb to mta_filetrans_named_content() - Update gpg_role() interface with unix_stream_socket permissions - Allow systemd-hostnamed to create its Varlink socket * Wed Feb 04 2026 Zdenek Pytela <zpytela@redhat.com> - 42.23-1 - Allow thumbnailer mount on fonts cache directories - Support confined users usage of bubblewrap - Allow vdagent get attributes of the pidfs filesystem - Allow sshd-session inherit limits from its parent sshd process - Revert "Allow sshd-session inherit limits from its parent process" - Allow sshd-session read network sysctls - Add the fs_write_tmpfs_files() interface - Update gpg policy for interactions with rhc-playbook-verifier - Allow rhc_playbook_verifier_t stream connect to itself - Update policy for rhc-worker-playbook - Allow sudodomain connect to gkeyringd over a unix stream socket - Allow tlshd communication to unconfined_t over a tcp socket - Allow tlshd write generic certificates - Allow thumbnailer connect to abrt over a unix stream socket * Fri Jan 23 2026 Zdenek Pytela <zpytela@redhat.com> - 42.22-1 - Allow thumb_t stream connect to systemd-machined - Allow thumb_t stream connect to systemd-homed - Allow aide get attributes of tmpfs and devtmpfs filesystems - Allow sshd noatsecure on sshd-session execution - Confine rhc-worker-playbook.worker and rhc-playbook-verifier - Allow kernel_t to read/write all domains' pipes - Allow domain read sysfs files - allow abrt_dump_oops to write to init sockets - Add insights_client service interfaces - Allow plasma login manager stop login services - Allow NM nvme dispatcher script start systemd services * Sat Jan 10 2026 Zdenek Pytela <zpytela@redhat.com> - 42.21-1 - Allow sshd_net_t ioctl on unix_stream_socket of sshd_session_t - Allow sshd-session read, write, and map ica tmpfs files - Allow aide get attributes of a filesystem with extended attributes - Set correct label for glycin fontconfig (bsc#1253682) - Set correct gstreamer directory label for gnome-desktop-thumbnailer (bsc#1253682) - Logwatch zz-runtime uses uptime (bsc#1255862) - Add auth_login_pgm_signull interface (bsc#1255862) - Introduce systemd_cryptsetup_generator_var_run_t file type (bsc#1244459) - Allow l2tpd_t access to netlink and sysfs - Label miscellaneous /dev/papr-* devices - Allow qemu-ga to skip authentication - Revert "Allow systemd-coredump signull containers" - Allow systemd-coredump signull containers - Allow virtqemud setattr dri devices - Allow irqbalance create and use netlink generic socket - Allow thumb_t connect to XDM over a unix domain stream socket - Allow systemd-homework to remove ~/.identity-blob - Revert "Allow kl2tpd create and use netlink_generic_socket" * Fri Dec 19 2025 Zdenek Pytela <zpytela@redhat.com> - 42.20-1 - Support cockpit privileged access for the staff user - Update su_domain_type policy for kerberized su - Allow sshd-session inherit limits from its parent process - Allow systemd-machined read virtd process state - Allow kl2tpd create and use netlink_generic_socket - Update policy for redfish-finder - Label the greetd login manager framework as a display manager - Allow sshd-auth get attributes of sshd vsock socket - Confine redfish_finder - host api discovery service - Allow iptables read firewalld process state - Allow tuned_t use its private tmpfs files - The commit addresses the following AVC denials: * Fri Dec 05 2025 Zdenek Pytela <zpytela@redhat.com> - 42.19-1 - Allow passwd read and write a sshd-session unnamed pipes - Allow sshd-auth capabilities - Allow sshd-auth read network sysctls - Label /run/insights-client.ppid with insights_client_run_t - fix: unbreak thumbnailing for Thunar/tumblerd - Add files_mounton_generic_tmp_dirs() interface - Add the rpm_signal() interface - Allow session_bus_type get the attributes of the pidfs filesystem - Allow pcscd get the attributes of the pidfs filesystem - Allow sssd get the attributes of the pidfs filesystem * Tue Dec 02 2025 Zdenek Pytela <zpytela@redhat.com> - 42.18-1 - Allow KDE Plasma Login Manager to function as a display manager - Allow mdadm search filesystem_type directories - Update policy for dhcpc_hook_t - Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t - Allow staff role read/write cockpit-session unix stream sockets - Allow stap server read virtual memory sysctls - Allow system_mail_t read apache system content conditionally - Allow login_userdomain read lastlog * Wed Nov 26 2025 Zdenek Pytela <zpytela@redhat.com> - 42.17-1 - Allow sshd-net read and write to sshd vsock socket - Update ktls policy - Add comprehensive SELinux policy module for bwrap thumbnail generation - Revert "Allow thumb_t create permission in the user namespace" - Allow systemd-machined read svirt process state - Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992) - Allow sysadm access to TPM - Allow tlp get the attributes of the pidfs filesystem - Allow kmscon to read netlink_kobject_uevent_socket * Thu Nov 20 2025 Zdenek Pytela <zpytela@redhat.com> - 42.16-1 - Allow systemd-ssh-issue read kernel sysctls - fix: bz2279215 Allow speech-dispatcher access to user home/cache files - Allow create kerberos files in postgresql db home - Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern - Allow shell comamnds in locate systemd service (bsc#1246559) - Introduce initrc_nnp_daemon_domain interface - Label /var/lib/cosmic-greeter with xdm_var_lib_t - Allow setroubleshoot-fixit get attributes of xattr fs * Wed Nov 12 2025 Zdenek Pytela <zpytela@redhat.com> - 42.15-1 - Allow insights-client manage /etc symlinks - Allow insights-client get attributes of the rpm executable - Allow nfsidmapd search virt lib directories - Allow iotop stream connect to systemd-userdbd - Allow gnome-remote-desktop read sssd public files - Allow thumb_t stream connect to systemd-userdbd - Allow bluez dbus API passing unix domain sockets - Allow bluez dbus api pass sockets over dbus - Dontaudit systemd-generator connect to sssd over a unix stream socket - Allow init watch/watch_reads systemd-machined user ptys - Fix syntax error in userdomain.if - Allow ras-mc-ctl get attributes of the kmod executable * Fri Oct 24 2025 Zdenek Pytela <zpytela@redhat.com> - 42.14-1 - Define file equivalency for /var/opt - Allow virtnodedev_t the perfmon capability - Allow nut_upsdrvctl_t the sys_ptrace capability - Label /usr/lib/systemd/user/graphical-session-pre.target with xdm_unit_file_t - systemd-sysctl: allow rw on binfm_misc_fs_t to set binfmt_misc status - Allow cupsd to manage cupsd_rw_etc_t lnk_files - Set temporary no-stub resolv.conf file from NetworkManager as net_conf_t - Allow spamc read aliases file - Mark configfs_t as mountpoint (bsc#1246080) - Allow systemd-machined watch cgroup files * Mon Oct 20 2025 Michael Catanzaro <mcatanzaro@redhat.com> - 42.13-2 - Fix unexpanded macro in selinux_requires * Tue Oct 14 2025 Zdenek Pytela <zpytela@redhat.com> - 42.13-1 - Allow sshd-auth read generic proc files - Allow sshd-auth read and write user domain ptys - Allow logwatch read and write sendmail unix stream sockets - Allow logwatch domain transition on rpm execution - Allow thumb_t mounton its private tmpfs files - Allow thumb_t create permission in the user namespace - Allow corenet_unconfined_type name_bind to icmp_socket - Allow systemd-networkd to manage systemd_networkd_var_lib_t files - Allow sshd-session get attributes of sshd vsock socket * Sat Oct 04 2025 Zdenek Pytela <zpytela@redhat.com> - 42.12-1 - Adjust guest and xguest users policy for sshd-session - Allow valkey-server create and use netlink_rdma_socket - Allow blueman get attributes of filesystems with extended attributes - Update files_search_base_file_types() - Allow geoclue get attributes of the /dev/shm filesystem - Allow apcupsd get attributes of the /dev/shm filesystem - Allow sshd-session read cockpit pid files * Wed Sep 24 2025 Zdenek Pytela <zpytela@redhat.com> - 42.11-1 - Allow nfs generator create and use netlink sockets - Conditionally allow virt guests to read certificates in user home directories - xenstored_t needs CAP_SYS_ADMIN for XENSTORETYPE=domain (bsc#1247875) - Allow nfs-generator create and use udp sockets - Allow kdump search kdumpctl_tmp_t directories - Allow init open and read user tmp files - Fix the systemd_logind_stream_connect() interface - Allow staff and sysadm execute iotop using sudo - Allow sudodomains connect to systemd-logind over a unix socket * Tue Sep 16 2025 Zdenek Pytela <zpytela@redhat.com> - 42.10-1 - Add default contexts for sshd-seesion - Define types for new openssh executables * Mon Sep 15 2025 Zdenek Pytela <zpytela@redhat.com> - 42.9-1 - Fix systemd_manage_unit_symlinks() interface definition - Support coreos installation methods - Add a new type for systemd-ssh-issue PID files - Allow gnome-remote-desktop connect to unreserved ports - Allow mdadm the CAP_SYS_PTRACE capability - Allow iptables manage its private fifo_files in /tmp - Allow auditd manage its private run dirs - Revert "Allow virt_domain write to virt_image_t files" - Exclude tabrmd.if from interfaces list * Thu Sep 04 2025 Zdenek Pytela <zpytela@redhat.com> - 42.8-1 - Allow gdm create /etc/.pwd.lock with a file transition - Allow gdm bind a socket in the /run/systemd/userdbd directory - Allow nsswitch_domain connect to xdm over a unix domain socket - Allow systemd homed getattr all tmpfs files (bsc#1240883) - Allow systemd (PID 1) create lastlog entries - Allow systemd_homework_t transition pid files to lvm_var_run_t (bsc#1240883) - Allow gnome-remote-desktop speak with tabrmd over dbus (bsc#1244573) - Allow nm-dispatcher iscsi and sendmail plugins get pidfs attributes - Allow systemd-oomd watch tmpfs dirs - Allow chronyc the setgid and setuid capabilities * Fri Aug 29 2025 Zdenek Pytela <zpytela@redhat.com> - 42.7-1 - Label /usr/lib/systemd/systemd-ssh-issue with systemd_ssh_issue_exec_t - Allow stalld map sysfs files - Allow NetworkManager-dispatcher-winbind get pidfs attributes - Allow openvpn create and use generic netlink socket - policy_capabilities: remove estimated from released versions - policy_capabilities: add stub for userspace_initial_context - add netlink_xperm policy capability and nlmsg permission definitions - policy_capabilities: add ioctl_skip_cloexec - selinux-policy: add allow rule for tuned_ppd_t - selinux-policy: add allow rule for switcheroo_control_t - Label /run/audit with auditd_var_run_t * Tue Aug 12 2025 Zdenek Pytela <zpytela@redhat.com> - 42.6-1 - Allow virtqemud start a vm which uses nbdkit - Add nbdkit_signal() and nbdkit_signull() interfaces - Fix insights_client interfaces names - Add insights_core and insights_client interfaces - dist/targeted/modules.conf: enable slrnpull module - Allow bootupd delete symlinks in the /boot directory - Allow systemd-coredumpd capabilities in the user namespace - Allow openvswitch read virtqemud process state - Allow systemd-networkd to create leases directory * Fri Aug 08 2025 Zdenek Pytela <zpytela@redhat.com> - 42.5-1 - Apply generator template to selinux-autorelabel generator - Support virtqemud handle hotplug hostdev devices - Allow virtstoraged create qemu /var/run files - Allow unconfined_domain_type cap2_userns capabilities - Label /usr/libexec/postfix/tlsproxy with postfix_smtp_exec_t - Remove the mysql module sources - dist/targeted/modules.conf: Enable kmscon module (bsc#1238137) - Update kmscon policy module to kmscon version 9 (bsc#1238137) - Allow login to getattr pidfs - Allow systemd to map files under /sys - systemd: drop duplicate init_nnp_daemon_domain lines - Fix typo - Allow logwatch stream connect to opensmtpd - Allow geoclue read NetworkManager pid files * Mon Aug 04 2025 Zdenek Pytela <zpytela@redhat.com> - 42.4-1 - Allow unconfined user a file transition for creating sudo log directory - Allow virtqemud read/write inherited dri devices - Allow xdm_t create user namespaces - Update policy for login_userdomain - Add ppd_base_profile to file transition to get tuned_rw_etc_t type - Update policy for bootupd - Allow logwatch work with opensmtpd - Update dovecot policy for dovecot 2.4.1 - Allow ras-mc-ctl write to sysfs files - Allow anaconda-generator get attributes of all filesystems - Add the rhcd_rw_fifo_files() interface - Allow systemd-coredump the sys_chroot capability - Allow hostapd write to socket files in /tmp - Recognize /var/home as an alternate path for /home - Label /var/lib/lastlog with lastlog_t * Mon Jul 28 2025 Zdenek Pytela <zpytela@redhat.com> - 42.3-1 - Allow virtqemud write to sysfs files - Allow irqbalance search sssd lib directories - Allow samba-dcerpcd send sigkills to passwd - Allow systemd-oomd watch dbus pid sock files - Allow some confined users read and map generic log files - Allow login_userdomain watch the /run/log/journal directory - Allow login_userdomain dbus chat with tuned-ppd - Allow login_userdomain dbus chat with switcheroo-control - Allow userdomain to connect to systemd-oomd over a unix socket - Add insights_client_delete_lib_dirs() interface * Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 42.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild * Mon Jul 21 2025 Zdenek Pytela <zpytela@redhat.com> - 42.2-1 - Allow virtqemud_t use its private tmpfs files (bsc#1242998) - Allow virtqemud_t setattr to /dev/userfaultfd (bsc#1242998) - Allow virtqemud_t read and write /dev/ptmx (bsc#1242998) - Extend virtqemud_t tcp_socket permissions (bsc#1242998) - Allow virtqemud_t to read and write generic pty (bsc#1242998) - Allow systemd-importd create and unlink init pid socket - Allow virtqemud handle virt_content_t chr files - Allow svirt read virtqemud fifo files - All sblim-sfcbd the dac_read_search capability - Allow sblim domain read systemd session files - Allow sblim-sfcbd execute dnsdomainname - Confine nfs-server generator - Allow systemd-timedated start/stop timemaster services - Allow "hostapd_cli ping" run as a systemd service - Allow power-profiles-daemon get attributes of filesystems with extended attributes - Allow 'oomctl dump' to interact with systemd-oomd - Basic functionality for systemd-oomd - Basic enablement for systemd-oomd - Allow samba-bgqd send to smbd over a unix datagram socket - Update kernel_secretmem_use() - Add the file/watch_mountns permission * Tue Jul 15 2025 Zdenek Pytela <zpytela@redhat.com> - 42.1-1 - Update systemd-generators policy - Allow plymouthd_t read proc files of systemd_passwd_agent (bsc#1245470) - Allow insights-client file transition for files in /var/tmp - Allow tuned-ppd manage tuned log files - Allow systemd-coredump mount on tmpfs filesystems - Update sssd_dontaudit_read_public_files() - Allow zram-generator raw read fixed disk device * Fri Jul 04 2025 Zdenek Pytela <zpytela@redhat.com> - 41.45-1 - Add fs_write_cgroup_dirs() and fs_setattr_cgroup_dirs() interfaces - Allow irqbalance execute shell if irqbalance_run_unconfined is on - Allow openvswitch ioctl vduse devices - Label /dev/vduse/control and /dev/vduse/NAME devices - Allow virtstoraged the sys_rawio capability - Allow virtqemud read insights-core state files - Allow virtnodedev create mdevctl config dirs - Allow virtqemud additional permissions on scsi generic chr files - Allow local login execute gnome keyring daemon - Allow virtqemud send a generic signal to passt - Allow svirt-tcg read init state - Allow irqbalance execute shell if irqbalance_run_unconfined is on - Label /run/opendkim with dkim_milter_data_t - Allow sa-update status systemd services - Allow updpwd logging send audit messages - Temporary dontaudit iio-sensor-proxy sys_admin. - Allow iio-sensor-proxy sendto to journald over a unix datagram socket - Revert "Allow iio-sensor-proxy sendto to journald over a unix datagram socket" * Fri Jul 04 2025 Petr Lautrbach <lautrbach@redhat.com> - 41.44-2 - Rebuilt with SELinux userspace 3.9-rc2 release * Tue Jun 17 2025 Zdenek Pytela <zpytela@redhat.com> - 41.44-1 - virt: allow QEMU use of the qgs daemon for attestation - qgs: add contrib module for TDX "qgs" daemon - kernel: add interfaces for using SGX enclaves - Define file equivalency for /usr/etc - Allow mongod to receive pressure stall information - Dontaudit systemd_generator read sssd public files - Allow plymouthd read/write input event devices - Label 99-nvme-nbft-connect.sh with NetworkManager_dispatcher_nvme_script_t - Allow systemd-user-runtime-dir sendto to syslogd - Remove pcp module - Update irqbalance policy for using unconfined scripts - Allow utempter use terminal multiplexor - Allow virtqemud execute ovs-vsctl with a domain transition - Update the files_search_mnt() interface * Wed Jun 04 2025 Zdenek Pytela <zpytela@redhat.com> - 41.43-1 - Allow nmbd read network sysctls - Allow iio-sensor-proxy sendto to journald over a unix datagram socket - Allow logrotate stop all systemd services - systemd: rework systemd_manage_random_seed - Allow tuned-ppd connect to sssd over a unix stream socket * Tue Jun 03 2025 Zdenek Pytela <zpytela@redhat.com> - 41.42-1 - Drop config for /run/random-seed - Update file location for systemd random-seed file - Allow tomcat execute cracklib-check with a domain transition - Allow sssd watch lib dirs - Confine systemd-hibernate-resume - Allow login_userdomain create /run/tlog directory with user_tmp_t - Allow login_pgm read filesystem sysctls - Allow gconfd connect to system dbus - Allow NetworkManager manage NetworkManager_etc_rw_t symlinks * Thu May 22 2025 Zdenek Pytela <zpytela@redhat.com> - 41.41-1 - Allow mdadm nosuid_transition - Label plasma user service files as xdm_unit_file_t. - Revert "Allow systemd-homed to start services." - Allow virtstoraged write qemu runtime files - Allow virtqemud read/write/setattr input event devices - Allow systemd create journal pid files - Allow networkmanager send a general signal to iptables - Allow syslogd watch syslog_conf_t directories - Allow systemd-machined work with its private tmp and tmpfs files - Allow geoclue read virt lib files - Fix files_dontaudit_delete_all_files() - Label /run/polkit-1 with policykit_var_run_t - Label /dev/diag as diagnostic_device_t - Allow systemd-homed to start services. - Allow named_t to read NetworkManager's runtime files - Improve README* documentation * Tue May 13 2025 Zdenek Pytela <zpytela@redhat.com> - 41.40-1 - Add missing permissions for ftpd_anon_write to manage NFS directories - Add missing permissions for ftpd_anon_write to manage CIFS directories - Allow nut-upsmon write systemd inhibit pipes - Allow systemd-user-runtime-dir connect to systemd-userdbd over a unix socket - Remove permissive domain for systemd_vsftpd_generator_t - Change generator-specific rules to apply to systemd_generator - Define file equivalency for /var/etc - Allow tuned-ppd create ppd_base_profile with a file transition - Allow lldpd connect to systemd-homed over a unix socket - Allow sysadm_sudo_t signal rpm script - Fix the "/var/cache/systemd/home(/.*)?" regex * Wed Apr 30 2025 Zdenek Pytela <zpytela@redhat.com> - 41.39-1 - Allow collectd accept and listen to tcp sockets - Allow init_t nnp domain transition to redis_t - Allow tlshd read network sysctls - Allow NetworkManager create and use icmp_socket - Allow varnishd execute the prlimit64() syscall - Allow rhsmcertd connect to systemd-machined - Allow virt_domain write to virt_image_t files - Allow system-dbusd list systemd-machined directories - Allow asterisk read network sysctls - Allow virtstoraged fsetid capability - Allow xdm watch a mnt_t directory - Allow collectd bind TCP sockets to the collectd port - Allow virtqemud relabel from tmpfs lnk files - Allow gnome-remote-desktop additional sockets permissions - Update insights-core policy - Update systemd-homed policy - Allow xenstored_t manage xend_var_lib_t files (bsc#1228540) * Thu Apr 17 2025 Zdenek Pytela <zpytela@redhat.com> - 41.38-1 - Allow init and login_pgm connect to systemd-logind over a unix socket - Allow login_userdomain read pressure stall information - Allow systemd-journald create and use vsock socket - Update systemd-pcrextend policy - Allow systemd watch/watch_reads usb ttys - Update coreos-installer-generator policy - Update systemd-homed policy - Allow systemd-user-runtime-dir get/set tmpfs quotas - Allow systemd-rfkill read nsfs files - Dontaudit bootc-systemd-generator search sssd lib directories - Allow systemd-user-runtime-dir delete gnome homedir content * Fri Apr 11 2025 Zdenek Pytela <zpytela@redhat.com> - 41.37-1 - Allow tuned-ppd read sssd public files - Allow tuned-ppd watch_reads sysfs directories - Confine /usr/lib/systemd/systemd-user-runtime-dir - Revert "Dontaudit systemd-logind remove all files" - Make bootupd use bootupd_tmp_t as its private type for files in /tmp - Label SetroubleshootPrivileged.py with setroubleshootd_exec_t - Allow power-profiles-daemon watch sysfs directories - systemd: allow reading /dev/cpu/0/msr - Update the pcmsensor policy - Allow chronyd-restricted sendto to chronyc - Allow system_dbusd_t r/w unix stream sockets of unconfined_service_t - Allow dovecot-deliver read mail aliases * Mon Apr 07 2025 Zdenek Pytela <zpytela@redhat.com> - 41.36-1 - Confine systemd-factory-reset system generator - Allow systemd debug generator read tmpfs files - Allow gnome-shell get attributes of systemd inhibit pipes - Allow tuned-ppd watch sysfs directories - Fix the storage_rw_inherited_removable_device() interface - Allow sadc read global pressure stall information - Allow virtqemud read sblim-gatherd process state - Allow switcheroo-control dbus chat with xdm - Fix typo in calling unconfined_dbus_chat for switcheroo-control - Allow sysadm_t to write to /dev/kmsg - Allow init_t nnp domain transition to pcscd_t - Fix the genfscon statement for pidfs filesystem - Allow tuned-ppd dbus chat with xdm * Fri Mar 28 2025 Zdenek Pytela <zpytela@redhat.com> - 41.35-1 - Update INSTALL to describe necessary steps to build it - Rename the default policy to fedora-selinux - Update COPYING to the latest version of GPLv2 - Allow traceroute_t bind rawip sockets to unreserved ports - Revert "Allow traceroute_t bind rawip sockets to unreserved ports" - Change the bootc system generator name to bootc-systemd-generator - Allow mpd use the io_uring API - Confine tuned-ppd - Add the switcheroo module - Label wine's windows libraries as textrel_shlib_t - Allow systemd domains write global pressure stall information - Add label and interfaces for kernel PSI files - Update bootupd policy - Update ktls policy - Add policy for systemd-bootc-generator - Allow blueman the kill capability * Fri Mar 07 2025 Zdenek Pytela <zpytela@redhat.com> - 41.34-1 - Add context for plymouth debug log files - Allow rlimit inheritance for domains transitioning to local_login_t - Update insights-core policy - Allow insights-core map all non-security files - Allow insights-core map audit config and log files - Allow insights-client manage insights_client_var_log_t files - Remove duplicate dev_rw_dma_dev(xdm_t) - Allow thumbnailer read and write the dma device - Allow named_filetrans_domain filetrans raid/mdadm named content - Allow afterburn to mount and read config drives - Allow mptcpd the net_admin capability * Fri Feb 07 2025 Zdenek Pytela <zpytela@redhat.com> - 41.33-1 - Allow systemd-networkd the sys_admin capability - Update systemd-networkd policy in systemd v257 - Separate insights-core from insights-client - Removed unused insights_client interfaces calls from other modules - Update policy for insights_client wrt new rules for insights_core_t - Add policy for insights-core - Allow systemd-networkd use its private tmpfs files - Allow boothd connect to systemd-machined over a unix socket - Update init_explicit_domain() interface - Allow tlp to read/write nmi_watchdog state information - Allow power-profiles-daemon the bpf capability - Allow svirt_t to connect to nbdkit over a unix stream socket - Update ktlshd policy to read /proc/keys and domain keyrings - Allow virt_domain read hardware state information unconditionally - Allow init mounton crypto sysctl files - Rename winbind_rpcd_* types to samba_dcerpcd_* - Support peer-to-peer migration of vms using ssh * Wed Feb 05 2025 Zdenek Pytela <zpytela@redhat.com> - 41.32-1 - Allow virtqemud use hostdev usb devices conditionally - Allow virtqemud map svirt_image_t plain files - Allow virtqemud work with nvdimm devices - Support saving and restoring a VM to/from a block device - Allow virtnwfilterd dbus chat with firewalld - Dontaudit systemd-logind remove all files - Add the files_dontaudit_read_all_dirs() interface - Add the files_dontaudit_delete_all_files() interface - Allow rhsmcertd notify virt-who - Allow irqbalance to run unconfined scripts conditionally - Fix binsbin-convert.sh to handle exceptions * Fri Jan 31 2025 Zdenek Pytela <zpytela@redhat.com> - 41.31-1 - Allow snapperd execute systemctl in the caller domain - Allow svirt_tcg_t to connect to nbdkit over a unix stream socket - Allow iio-sensor-proxy read iio devices - Label /dev/iio:device[0-9]+ devices - Allow systemd-coredump the sys_admin capability - Allow apcupsd's apccontrol to send messages using wall - contrib/thumb: also allow per-user thumbnailers - contrib/thumb: fix thunar thumbnailer (rhbz#2315893) - Allow virt_domain to use pulseaudio - conditional - Allow pcmsensor read nmi_watchdog state information - Allow init_t nnp domain transition to gssproxy_t * Mon Jan 27 2025 Zdenek Pytela <zpytela@redhat.com> - 41.30-1 - Allow systemd-generator connect to syslog over a unix stream socket - Allow virtqemud manage fixed disk device nodes - Allow iio-sensor-proxy connect to syslog over a unix stream socket - Allow virtstoraged write to sysfs files - Allow power-profiles-daemon write sysfs files - Update iiosensorproxy policy - Allow pcmsensor write nmi_watchdog state information - Label /proc/sys/kernel/nmi_watchdog with sysctl_nmi_watchdog_t - Allow virtnodedev create /etc/mdevctl.d/scripts.d with bin_t type - Add the gpg_read_user_secrets() interface - Allow gnome-remote-desktop read resolv.conf - Update switcheroo policy - Allow nfsidmap connect to systemd-homed over a unix socket - Add the auth_write_motd_var_run_files() interface - Add the bind_exec_named_checkconf() interface - Add the virt_exec_virsh() interface * Wed Jan 15 2025 Zdenek Pytela <zpytela@redhat.com> - 41.29-1 - Allow virtqemud domain transition to nbdkit - Add nbdkit interfaces defined conditionally - Allow samba-bgqd connect to cupsd over an unix domain stream socket - Confine the switcheroo-control service - Allow svirt_t read sysfs files - Add rhsmcertd interfaces - Add the ssh_exec_sshd() interface - Add the gpg_domtrans_agent() interface - Label /usr/bin/dnf5 with rpm_exec_t - Label /dev/pmem[0-9]+ with fixed_disk_device_t - allow kdm to create /root/.kde/ with correct label - Change /usr/sbin entries to use /usr/bin or remove them - Allow systemd-homed get filesystem quotas - Allow login_userdomain getattr nsfs files - Allow virtqemud send a generic signal to the ssh client domain - Dontaudit request-key read /etc/passwd * Fri Jan 03 2025 Zdenek Pytela <zpytela@redhat.com> - 41.28-1 - Update virtqemud policy regarding the svirt_tcg_t domain - Allow virtqemud domain transition on numad execution - Support virt live migration using ssh - Allow virtqemud permissions needed for live migration - Allow virtqemud the getpgid process permission - Allow virtqemud manage nfs dirs when virt_use_nfs boolean is on - Allow virtqemud relabelfrom virt_log_t files - Allow virtqemud relabel tun_socket - Add policy for systemd-import-generator - Confine vsftpd systemd system generator - Allow virtqemud read and write sgx_vepc devices - Allow systemd-networkd list cgroup directories - Allow xdm dbus chat with power-profiles-daemon - Allow ssh_t read systemd config files - Add Valkey rules to Redis module * Tue Dec 17 2024 Zdenek Pytela <zpytela@redhat.com> - 41.27-1 - Update ktlsh policy - Allow request-key to read /etc/passwd - Allow request-key to manage all domains' keys - Add support for the KVM guest memfd anon inodes - Allow auditctl signal auditd - Dontaudit systemd-coredump the sys_resource capability - Allow traceroute_t bind rawip sockets to unreserved ports - Fix the cups_read_pid_files() interface to use read_files_pattern - Allow virtqemud additional permissions for tmpfs_t blk devices - Allow virtqemud rw access to svirt_image_t chr files - Allow virtqemud rw and setattr access to fixed block devices - Label /etc/mdevctl.d/scripts.d with bin_t - Allow virtqemud open svirt_devpts_t char files - Allow virtqemud relabelfrom virt_log_t files - Allow svirt_tcg_t read virtqemud_t fifo_files - Allow virtqemud rw and setattr access to sev devices - Allow virtqemud directly read and write to a fixed disk - Allow virtqemud_t relabel virt_var_lib_t files - Allow virtqemud_t relabel virtqemud_var_run_t sock_files - Add gnome_filetrans_gstreamer_admin_home_content() interface - Label /dev/swradio, /dev/v4l-subdev, /dev/v4l-touch with v4l_device_t - Make bootupd_t permissive - Allow init_t nnp domain transition to locate_t - allow gdm and iiosensorproxy talk to each other via D-bus - Allow systemd-journald getattr nsfs files - Allow sendmail to map mail server configuration files - Allow procmail to read mail aliases - Allow cifs.idmap helper to set attributes on kernel keys - Allow irqbalance setpcap capability in the user namespace - Allow sssd_selinux_manager_t the setcap process permission - Allow systemd-sleep manage efivarfs files - Allow systemd-related domains getattr nsfs files - Allow svirt_t the sys_rawio capability - Allow alsa watch generic device directories - Move systemd-homed interfaces to seperate optional_policy block - Update samba-bgqd policy - Update virtlogd policy - Allow svirt_t the sys_rawio capability - Allow qemu-ga the dac_override and dac_read_search capabilities - Allow bacula execute container in the container domain - Allow httpd get attributes of dirsrv unit files - Allow samba-bgqd read cups config files - Add label rshim_var_run_t for /run/rshim.pid * Mon Dec 02 2024 Petr Lautrbach <lautrbach@redhat.com> - 41.26-2 - Rebuild with SELinux Userspace 3.8 * Tue Nov 19 2024 Zdenek Pytela <zpytela@redhat.com> - 41.26-1 - [5/5][sync from 'mysql-selinux'] Add mariadb-backup - [4/5][sync from 'mysql-selinux'] Fix regex to also match '/var/lib/mysql/mysqlx.sock' - [3/5][sync from 'mysql-selinux'] Allow mysqld_t to read and write to the 'memory.pressure' file in cgroup2 - [2/5][sync from 'mysql-selinux'] 2nd attempt to fix rhbz#2186996 rhbz#2221433 rhbz#2245705 - [1/5][sync from 'mysql-selinux'] Allow 'mysqld' to use '/usr/bin/hostname' - Allow systemd-networkd read mount pid files - Update policy for samba-bgqd - Allow chronyd read networkmanager's pid files - Allow staff user connect to generic tcp ports - Allow gnome-remote-desktop dbus chat with policykit - Allow tlp the setpgid process permission - Update the bootupd policy - Allow sysadm_t use the io_uring API - Allow sysadm user dbus chat with virt-dbus - Allow virtqemud_t read virsh_t files - Allow virt_dbus_t connect to virtd_t over a unix stream socket - Allow systemd-tpm2-generator read hardware state information - Allow coreos-installer-generator execute generic programs - Allow coreos-installer domain transition on udev execution - Revert "Allow unconfined_t execute kmod in the kmod domain" - Allow iio-sensor-proxy create and use unix dgram socket - Allow virtstoraged read vm sysctls - Support ssh connections via systemd-ssh-generator - Label all semanage store files in /etc as semanage_store_t - Add file transition for nvidia-modeset * Fri Oct 25 2024 Zdenek Pytela <zpytela@redhat.com> - 41.25-1 - Allow dirsrv-snmp map dirsv_tmpfs_t files - Label /usr/lib/node_modules_22/npm/bin with bin_t - Add policy for /usr/libexec/samba/samba-bgqd - Allow gnome-remote-desktop watch /etc directory - Allow rpcd read network sysctls - Allow journalctl connect to systemd-userdbd over a unix socket - Allow some confined users send to lldpad over a unix dgram socket - Allow lldpad send to unconfined_t over a unix dgram socket - Allow lldpd connect to systemd-machined over a unix socket - Confine the ktls service * Wed Oct 23 2024 Zdenek Pytela <zpytela@redhat.com> - 41.24-1 - Allow dirsrv read network sysctls - Label /run/sssd with sssd_var_run_t - Label /etc/sysctl.d and /run/sysctl.d with system_conf_t - Allow unconfined_t execute kmod in the kmod domain - Allow confined users r/w to screen unix stream socket - Label /root/.screenrc and /root/.tmux.conf with screen_home_t - Allow virtqemud read virtd_t files - Allow ping_t read network sysctls * Mon Oct 21 2024 Zdenek Pytela <zpytela@redhat.com> - 41.23-1 - Allow systemd-homework connect to init over a unix socket - Fix systemd-homed blobs directory permissions - Allow virtqemud read sgx_vepc devices - Allow lldpad create and use netlink_generic_socket * Wed Oct 16 2024 Zdenek Pytela <zpytela@redhat.com> - 41.22-1 - Allow systemd-homework write to init pid socket - Allow init create /var/cache/systemd/home - Confine the pcm service - Allow login_userdomain read thumb tmp files - Update power-profiles-daemon policy - Fix the /etc/mdevctl\.d(/.*)? regexp - Grant rhsmcertd chown capability & userdb access - Allow iio-sensor-proxy the bpf capability - Allow systemd-machined the kill user-namespace capability * Fri Oct 11 2024 Zdenek Pytela <zpytela@redhat.com> - 41.21-1 - Remove the fail2ban module sources - Remove the linuxptp module sources - Remove legacy rules for slrnpull - Remove the aiccu module sources - Remove the bcfg2 module sources - Remove the amtu module sources - Remove the rhev module sources - Remove all file context entries for /bin and /lib - Allow ptp4l the sys_admin capability - Confine power-profiles-daemon - Label /var/cache/systemd/home with systemd_homed_cache_t - Allow login_userdomain connect to systemd-homed over a unix socket - Allow boothd connect to systemd-homed over a unix socket - Allow systemd-homed get attributes of a tmpfs filesystem - Allow abrt-dump-journal-core connect to systemd-homed over a unix socket - Allow aide connect to systemd-homed over a unix socket - Label /dev/hfi1_[0-9]+ devices - Suppress semodule's stderr * Thu Oct 03 2024 Zdenek Pytela <zpytela@redhat.com> - 41.20-1 - Remove the openct module sources - Remove the timidity module sources - Enable the slrn module - Remove i18n_input module sources - Enable the distcc module - Remove the ddcprobe module sources - Remove the timedatex module sources - Remove the djbdns module sources - Confine iio-sensor-proxy - Allow staff user nlmsg_write - Update policy for xdm with confined users - Allow virtnodedev watch mdevctl config dirs - Allow ssh watch home config dirs - Allow ssh map home configs files - Allow ssh read network sysctls - Allow chronyc sendto to chronyd-restricted - Allow cups sys_ptrace capability in the user namespace * Tue Sep 24 2024 Zdenek Pytela <zpytela@redhat.com> - 41.19-1 - Add policy for systemd-homed - Remove fc entry for /usr/bin/pump - Label /usr/bin/noping and /usr/bin/oping with ping_exec_t - Allow accountsd read gnome-initial-setup tmp files - Allow xdm write to gnome-initial-setup fifo files - Allow rngd read and write generic usb devices - Allow qatlib search the content of the kernel debugging filesystem - Allow qatlib connect to systemd-machined over a unix socket * Wed Sep 18 2024 Petr Lautrbach <lautrbach@redhat.com> - 41.18-1 - Drop ru man pages - mls/modules.conf - fix typo - Allow unprivileged user watch /run/systemd - Allow boothd connect to kernel over a unix socket * Mon Sep 16 2024 Zdenek Pytela <zpytela@redhat.com> - 41.17-2 - Relabel /etc/mdevctl.d * Thu Sep 12 2024 Petr Lautrbach <lautrbach@redhat.com> - 41.17-1 - Clean up and sync securetty_types - Bring config files from dist-git into the source repo - Confine gnome-remote-desktop - Allow virtstoraged execute mount programs in the mount domain - Make mdevctl_conf_t member of the file_type attribute * Fri Sep 06 2024 Zdenek Pytela <zpytela@redhat.com> - 41.16-1 - Label /etc/mdevctl.d with mdevctl_conf_t - Sync users with Fedora targeted users - Update policy for rpc-virtstorage - Allow virtstoraged get attributes of configfs dirs - Fix SELinux policy for sandbox X server to fix 'sandbox -X' command - Update bootupd policy when ESP is not mounted - Allow thumb_t map dri devices - Allow samba use the io_uring API - Allow the sysadm user use the secretmem API - Allow nut-upsmon read systemd-logind session files - Allow sysadm_t to create PF_KEY sockets - Update bootupd policy for the removing-state-file test - Allow coreos-installer-generator manage mdadm_conf_t files * Thu Aug 29 2024 Zdenek Pytela <zpytela@redhat.com> - 41.15-1 - Allow setsebool_t relabel selinux data files - Allow virtqemud relabelfrom virtqemud_var_run_t dirs - Use better escape method for "interface" - Allow init and systemd-logind to inherit fds from sshd - Allow systemd-ssh-generator read sysctl files - Sync modules.conf with Fedora targeted modules - Allow virtqemud relabel user tmp files and socket files - Add missing sys_chroot capability to groupadd policy - Label /run/libvirt/qemu/channel with virtqemud_var_run_t - Allow virtqemud relabelfrom also for file and sock_file - Add virt_create_log() and virt_write_log() interfaces - Call binaries without full path * Mon Aug 12 2024 Zdenek Pytela <zpytela@redhat.com> - 41.14-1 - Update libvirt policy - Add port 80/udp and 443/udp to http_port_t definition - Additional updates stalld policy for bpf usage - Label systemd-pcrextend and systemd-pcrlock properly - Allow coreos_installer_t work with partitions - Revert "Allow coreos-installer-generator work with partitions" - Add policy for systemd-pcrextend - Update policy for systemd-getty-generator - Allow ip command write to ipsec's logs - Allow virt_driver_domain read virtd-lxc files in /proc - Revert "Allow svirt read virtqemud fifo files" - Update virtqemud policy for libguestfs usage - Allow virtproxyd create and use its private tmp files - Allow virtproxyd read network state - Allow virt_driver_domain create and use log files in /var/log - Allow samba-dcerpcd work with ctdb cluster * Tue Aug 06 2024 Zdenek Pytela <zpytela@redhat.com> - 41.13-1 - Allow NetworkManager_dispatcher_t send SIGKILL to plugins - Allow setroubleshootd execute sendmail with a domain transition - Allow key.dns_resolve set attributes on the kernel key ring - Update qatlib policy for v24.02 with new features - Label /var/lib/systemd/sleep with systemd_sleep_var_lib_t - Allow tlp status power services - Allow virtqemud domain transition on passt execution - Allow virt_driver_domain connect to systemd-userdbd over a unix socket - Allow boothd connect to systemd-userdbd over a unix socket - Update policy for awstats scripts - Allow bitlbee execute generic programs in system bin directories - Allow login_userdomain read aliases file - Allow login_userdomain read ipsec config files - Allow login_userdomain read all pid files - Allow rsyslog read systemd-logind session files - Allow libvirt-dbus stream connect to virtlxcd * Wed Jul 31 2024 Zdenek Pytela <zpytela@redhat.com> - 41.12-1 - Update bootupd policy - Allow rhsmcertd read/write access to /dev/papr-sysparm - Label /dev/papr-sysparm and /dev/papr-vpd - Allow abrt-dump-journal-core connect to winbindd - Allow systemd-hostnamed shut down nscd - Allow systemd-pstore send a message to syslogd over a unix domain - Allow postfix_domain map postfix_etc_t files - Allow microcode create /sys/devices/system/cpu/microcode/reload - Allow rhsmcertd read, write, and map ica tmpfs files - Support SGX devices - Allow initrc_t transition to passwd_t - Update fstab and cryptsetup generators policy - Allow xdm_t read and write the dma device - Update stalld policy for bpf usage - Allow systemd_gpt_generator to getattr on DOS directories * Thu Jul 25 2024 Zdenek Pytela <zpytela@redhat.com> - 41.11-1 - Make cgroup_memory_pressure_t a part of the file_type attribute - Allow ssh_t to change role to system_r - Update policy for coreos generators - Allow init_t nnp domain transition to firewalld_t - Label /run/modprobe.d with modules_conf_t - Allow virtnodedevd run udev with a domain transition - Allow virtnodedev_t create and use virtnodedev_lock_t - Allow virtstoraged manage files with virt_content_t type - Allow virtqemud unmount a filesystem with extended attributes - Allow svirt_t connect to unconfined_t over a unix domain socket
/etc/selinux /etc/selinux/config /etc/sysconfig/selinux /usr/lib/rpm/macros.d/macros.selinux-policy /usr/lib/systemd/system/selinux-check-proper-disable.service /usr/lib/tmpfiles.d/selinux-policy.conf /usr/libexec/selinux/binsbin-convert.sh /usr/libexec/selinux/varrun-convert.sh /usr/share/licenses/selinux-policy /usr/share/licenses/selinux-policy/COPYING /usr/share/selinux /usr/share/selinux/packages
Generated by rpm2html 1.8.1
Fabrice Bellet, Fri Jul 31 00:43:51 2026