< back to search

critical Recommended update for selinux-policy
SUSE-SL-Micro-6.2-154

This update for selinux-policy fixes the following issues: Changes in selinux-policy: Update to version 20250627+git345.3965b24b0: * Allow 'mysql-systemd-helper upgrade' to work correctly (bsc#1255024) Update to version 20250627+git343.b66ec7135: * Allow snapper_tu_etc_plugin_t to connect to machined varlink socket (bsc#1254889) Update to version 20250627+git341.4beeb2d65: * Allow virtlogd_t dac_override (bsc#1253389) * Introduce systemd_cryptsetup_generator_var_run_t file type (bsc#1244459) * Allow virtqemud_t to read/write device_t (bsc#1251789) * update support for polkit agent helper (bsc#1251931) * Allow system_mail_t read apache system content conditionally * Allow login_userdomain read lastlog * Allow sshd-net read and write to sshd vsock socket * Update ktls policy * Add comprehensive SELinux policy module for bwrap thumbnail generation * Revert "Allow thumb_t create permission in the user namespace" * Allow systemd-machined read svirt process state * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992) * Allow sysadm access to TPM * Allow tlp get the attributes of the pidfs filesystem * Allow kmscon to read netlink_kobject_uevent_socket * Allow systemd-ssh-issue read kernel sysctls * fix: bz2279215 Allow speech-dispatcher access to user home/cache files * Allow create kerberos files in postgresql db home * Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern * Allow shell comamnds in locate systemd service (bsc#1246559) * Introduce initrc_nnp_daemon_domain interface * Label /var/lib/cosmic-greeter with xdm_var_lib_t * Allow setroubleshoot-fixit get attributes of xattr fs * Allow insights-client manage /etc symlinks * Allow insights-client get attributes of the rpm executable * Allow nfsidmapd search virt lib directories * Allow iotop stream connect to systemd-userdbd * Allow snapper_sdbootutil_plugin_t manage unlabeled_t files,dirs,symlinks (bsc#1252993) * Allow gnome-remote-desktop read sssd public files * Allow thumb_t stream connect to systemd-userdbd * Add auth_nnp_domtrans_chkpwd() * Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992) * Allow bluez dbus API passing unix domain sockets * Allow bluez dbus api pass sockets over dbus * Dontaudit systemd-generator connect to sssd over a unix stream socket * Allow init watch/watch_reads systemd-machined user ptys * Introduce sap_service_transition_to_unconfined_user boolean * allow init to read sap symlinks * Allow SAP domain to relocation text in all files - Fix macros.selinux-policy to allow changing booleans when policy is not loaded. Previous logic was broken (bsc#1254395) Update to version 20250627+git293.3432d4834: * Allow pcscd_t to search cgroup (bsc#1253098) * Fix syntax error in userdomain.if * Allow nnp_transition for OpenSMTPD (bsc#1252431) * Allow ras-mc-ctl get attributes of the kmod executable * Define file equivalency for /var/opt * Allow virtnodedev_t the perfmon capability * Allow nut_upsdrvctl_t the sys_ptrace capability * Label /usr/lib/systemd/user/graphical-session-pre.target with xdm_unit_file_t * Allow snapper sdbootutil plugin read emmc devices (bsc#1231354) * Allow pcrlock to delete pid entries * Allow systemd_pcrlock_t to manage its pid files * Mark snapper_sdbootutil_plugin_t as permissive * Drop unnamed filetrans, should be done upstream (bsc#1241964) * Label pcrlock pid file correctly (bsc#1241964) * Allow snapper sdbootutil plugin send msg to system bus (bsc#1241964) * snapper takes output from stdout/err, allow pcrlock to write * Add tpm2_getcap permissions to snapper sdbootutil (bsc#1244573) * Allow snapper sdbootutil plugin to read snapper data and conf * Allow snapper sdbootutil plugin to grep /proc/stat (bsc#1241964) * Replace snapper tmp file access for pcrlock (bsc#1241964) * Allow snapper sdbootutil read kernel module dirs (bsc#1241964) * Allow snapper sdbootutil plugin use bootctl (bsc#1241964) * Allow snapper sdbootutil plugin to list and read sysfs (bsc#1241964) * Allow snapper sdbootutil sys_admin (bsc#1241964) * Allow snapper sdbootutils plugin to findmnt (bsc#1241964) * Allow snapper sdbootutil plugin rw tpm (bsc#1233358) * Move manage dos permissions and dontaudit execmem to snapper sdbootutils plugin (bsc#1241964) * Move snapper domtrans to sdbootutil to plugin (bsc#1241964) * Revert snapper access to keys, move to sdbootutils plugin policy (bsc#1241964) * Add initial seperate policy for sdbootutil called by snapper (bsc#1233358) * Allow sort in snapper_grub_plugin_t read cpu.max (bsc#1252095) * systemd-sysctl: allow rw on binfm_misc_fs_t to set binfmt_misc status * Allow cupsd to manage cupsd_rw_etc_t lnk_files * Set temporary no-stub resolv.conf file from NetworkManager as net_conf_t * Allow spamc read aliases file * Mark configfs_t as mountpoint (bsc#1246080) * Allow systemd-machined watch cgroup files * Allow sshd-auth read generic proc files * Allow sshd-auth read and write user domain ptys * Allow logwatch read and write sendmail unix stream sockets * Allow logwatch domain transition on rpm execution * Allow thumb_t mounton its private tmpfs files * Allow thumb_t create permission in the user namespace * Allow corenet_unconfined_type name_bind to icmp_socket * Allow systemd-networkd to manage systemd_networkd_var_lib_t files * Allow sshd-session get attributes of sshd vsock socket

cloud_download Downloads

SUSE Linux Micro 6.2 ppc64le
SUSE Linux Micro 6.2 aarch64
SUSE Linux Micro 6.2 s390x
SUSE Linux Micro 6.2 x86_64