SELinux userspace release 3.5-rc3

RELEASE 3.5-rc3

User-visible changes

• libselinux: add getpidprevcon()

• libselinux: restorecon hashtable and other misc fixes

• sepolicy: Cache queries to speed up manpage generation

• mcstrans: preserve runtime directory

• Many updated translations

• Build optimizations and other bug fixes

Development-relevant changes

• ci: Run on Python3.11 and drop py3.5, py3.6

SELinux userspace release 3.5-rc2

RELEASE 3.5-rc2

User-visible changes

• libselinux: Add workaround to reduce pcre2 heap memory usage

• sepolicy: Add missing booleans to man pages

• libsepol: reject attributes in type av rules for kernel policies

• libsepol: do not write empty class definitions to allow simpler round-trip
  tests

• Translation updated for generated descriptions

• Lots of code and spelling issues fixed

• Bug fixes

SELinux userspace release 3.5-rc1

RELEASE 3.5-rc1

User-visible changes

• Maintainer GPG fingerprints added to /SECURITY.md

• Remove dependency on the deprecated Python module distutils and install via pip

• semodule option --rebuild-if-modules-changed was renamed to --refresh

• Translation updated and better handling for unsupported languages

• fixfiles: Unmount temporary bind mounts on SIGINT

• sepolicy: Several python and GTK updates

• libsepol: Stricter policy validation

• A lot of static code analyse issues, fuzzer issues and compiler warnings fixed

• Bug fixes

Development-relevant changes

• ci: Run on Fedora36 instead of F34

SELinux userspace release 3.4

RELEASE 3.4

User-visible changes

• A new selinux_restorecon_parallel(3) function that allows to run relabeling over multiple threads

• setfiles/restorecon/fixfiles support parallel relabeling via [ -T ] threads option

• A new semodule options [ -m | --checksum ] to get SHA256 hashes of modules

• mcstrans ported to PCRE2

• libsepol/cil supports IPv4/IPv6 address embedding

• Add a new semodule option [ --rebuild-if-modules-changed ] to optionally rebuild policy when modules
  are changed externally

• A lot of static code analyse issues, fuzzer issues and compiler warnings fixed

• Translations split into sub-packages and updated from
  https://translate.fedoraproject.org/projects/selinux/

• New policy utilities in libsepol - sepol_check_access,
  sepol_compute_av, sepol_compute_member, sepol_compute_relabel,
  sepol_validate_transition

• A new setfiles option [-C] for distinguishing file tree walk errors

• Improved code quality and bug fixes

Development-relevant changes

• ci: run the tests under ASan/UBsan on GHActions

SELinux userspace release 3.4-rc3

RELEASE 3.4-rc3

User-visible changes

• A new setfiles option [-C] for distinguishing file tree walk errors

• Added missing sandbox translations

SELinux userspace release 3.4-rc2

RELEASE 3.4-rc2

User-visible changes

• New policy utilities in libsepol - sepol_check_access,
  sepol_compute_av, sepol_compute_member, sepol_compute_relabel,
  sepol_validate_transition

• Improved code quality and bug fixes

3.4-rc1

RELEASE 3.4-rc1

User-visible changes

• A new selinux_restorecon_parallel(3) function that allows to run relabeling over multiple threads

• setfiles/restorecon/fixfiles support parallel relabeling via [ -T ] threads option

• A new semodule options [ -m | --checksum ] to get SHA256 hashes of modules

• mcstrans ported to PCRE2

• libsepol/cil supports IPv4/IPv6 address embedding

• Add a new semodule option [ --rebuild-if-modules-changed ] to optionally rebuild policy when modules
  are changed externally

• A lot of static code analyse issues, fuzzer issues and compiler warnings fixed

• Translations split into sub-packages and updated from
  https://translate.fedoraproject.org/projects/selinux/

• Bug fixes

Development-relevant changes

• ci: run the tests under ASan/UBsan on GHActions

SELinux userspace release 3.3

RELEASE 3.3

User-visible changes

• When reading a binary policy by checkpolicy, do not automatically change the version
  to the max policy version supported by libsepol or, if specified, the value given
  using the "-c" flag.

• fixfiles -C doesn't exclude /dev and /run anymore

• CIL: Lists are allowed in constraint expressions

• CIL: Improved situation with duplicate macro and block declarations

• Added the new secilc2tree program to write out CIL AST.

• Improved documentation

• A lot of static code analyse issues, fuzzer issues and compiler warnings fixed

• Updated checkpolicy documentation

• checkpolicy prints the reason why opening a source policy file failed

• Bug fixes

Development-relevant changes

• CIFuzz is turned on in CI
  https://google.github.io/oss-fuzz/getting-started/continuous-integration/

• Fedora 34 image is used in CI

Issues fixed

• #293
• #307

SELinux userspace release 3.3-rc3

RELEASE 3.3-rc3

• Updated checkpolicy documentation
• checkpolicy prints the reason why opening a source policy file failed
• Bug fixes

SELinux userspace release 3.3-rc2

RELEASE 3.3-rc2

• Bug fixes