SELinux userspace release 3.2
User-visible changes
-
libsepol implemented a new, more space-efficient form of storing filename
transitions in the binary policy and reduced the size of the binary policy -
libselinux: Use mmap()'ed kernel status page instead of netlink by default.
See "KERNEL STATUS PAGE" section in avc_init(3) for more details.
Note: if you need toumount /sys/fs/selinux
you need to use lazy umount -
umount -l /sys/fs/selinux
as the kernel status page /sys/fs/selinux/status
stays mapped by processes like systemd, dbus, sshd. -
Tools using sepolgen, e.g. audit2allow, print extended permissions in
hexadecimal -
sepolgen sorts extended rules like normal ones
-
New log callback levels for enforcing and policy load notices -
SELINUX_POLICYLOAD, SELINUX_SETENFORCE -
Changed userspace AVC setenforce and policy load messages to audit format.
-
matchpathcon converted to selabel_lookup() - no more matchpathcon is
deprecated warning -
libsepol and libsemanage dropped old and deprecated symbols and functions
libsepol version was bumped to libsepol.so.2
libsemanage version was bumped to libsemanage.so.2 -
Release version for the whole project is same as for subcomponents, e.g.
instead of 20210118 it's 3.2-rc1 -
Improved usability of
getseuser
-
Fixed several issues in cil code found by OSS-FUZZ
-
setfiles
doesn't abort on labeling errors -
libsemanage tries to sync data to prevent empty files in SELinux module store
-
Improved secilc documentation - fenced code blocks, syntax highlighting, custom
color theme, ... -
Better error reporting in getconlist
-
libsepol implemented a new, more space-efficient form of storing filename
transitions in the binary policy and reduced the size of the binary policy -
libselinux: Use mmap()'ed kernel status page instead of netlink by default.
See "KERNEL STATUS PAGE" section in avc_init(3) for more details.
Note: if you need toumount /sys/fs/selinux
you need to use lazy umount -
umount -l /sys/fs/selinux
as the kernel status page /sys/fs/selinux/status
stays mapped by processes like systemd, dbus, sshd. -
Tools using sepolgen, e.g. audit2allow, print extended permissions in
hexadecimal -
sepolgen sorts extended rules like normal ones
-
New log callback levels for enforcing and policy load notices -
SELINUX_POLICYLOAD, SELINUX_SETENFORCE -
Changed userspace AVC setenforce and policy load messages to audit format.
-
matchpathcon converted to selabel_lookup() - no more matchpathcon is
deprecated warning -
libsepol and libsemanage dropped old and deprecated symbols and functions
libsepol version was bumped to libsepol.so.2
libsemanage version was bumped to libsemanage.so.2 -
Release version for the whole project is same as for subcomponents, e.g.
instead of 20210304 it's 3.2 -
Improved man pages
-
Bug fixes
Development-relevant changes
-
License the CI scripts with a permissive, OSI approved license, such as MIT
-
Several CI improvements
-
Added configuration to build and run tests in GitHub Actions
-
CI contains configuration for a Vagrant virtual machine - instructions on how
to use it are documented at the beginning of Vagrantfile. -
scripts/release
was improved to be more robust and release a source repository
Packaging-relevant changes
-
Both libsepol and libsemanage bumped their soname versions. Especially
libsemanage is linked to shadow-utils and direct update might cause problems to
buildroots. Also SETools needs to be rebuilt against libsepol.so.2 -
Source repository snapshot selinux-3.2-rc2.tar.gz is available on the release page
-
sestatus is installed as /usr/bin/sestatus by default. Original /usr/sbin/sestatus is
a relative symlink to the /usr/bin/sestatus.