A complete SELinux policy that can be used as the system policy for a variety
of systems and used as the basis for creating other policies.
Provides
Requires
License
GPL-2.0-or-later
Changelog
* Mon Nov 02 2026 Robert Frohl <rfrohl@suse.com>
- Update to version 20261030:
* Allow rebootmgr to initialize reboot and soft-reboot (bsc#1287746)
* Allow httpd map its private runtime files
* Allow qatlib get attributes of a hugetlbfs filesystem
* Allow rhsmcertd list insights-client config dirs
* Allow svirt_tcg_t to use the passt user-mode networking backend
* Allow sshd_session_t to forward connections to a container runtime socket
* Allow systemd-oomd the kill capability in the user namespace
* Allow systemd-oomd signull all domains
* Revert "Allow systemd-oomd signull systemd-resolved"
* Update the nvme block devices regex in file context specification
* Allow keepalived getpgid of its unconfined scripts
* Allow init mounton system dbus pid socket files
* Allow systemd-oomd signull systemd-resolved
* Allow login_userdomain watch localization files for changes
* Allow login_userdomain mounton gnome generic data home dirs
* Revert Allow sdbootutil_t write access to /var/lib/sdbootutil (bsc#1281087)
* Label /run/gnome-remote-desktop with gnome_remote_desktop_var_run_t
* Allow systemd_nsresourced_t setuid/setgid inside a userns (bsc#1285095)
* Allow access to systemd-nsresourced runtime socket (bsc#1284651)
* Allow smbd watch public directories used for file transfer services
* Allow sshd-session read systemd-nsresourced runtime socket file
* Allow chrome_sandbox_t map its private tmpfs files
* Allow sysadm_t to create iSCSI netlink sockets
* Allow ktlshd connect to pcscd over a unix stream socket
* Add iptables_dontaudit_read_var_run_dirs() interface
* Allow polkit-auth read systemd-nsresourced runtime socket file
* Allow systemd-nsresourced the sys_admin capability
* Label /var/cache/boomaga with cupsd_rw_etc_t
* Allow dirsrv to read filesystem sysctls
* Allow cupsd create bluetooth sockets
* Allow gnome-remote-desktop handle kerberos replay cache files
* Allow multiple domains read systemd-nsresourced runtime socket file
* Update mount_nnp_domtrans() with nosuid