# changelog

author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-145
changelog:
  - Allow watchdog execute fenced python script.
  - Added inferface watchdog_unconfined_exec_read_lnk_files()
  - Allow pmweb daemon to exec shell. BZ(1256127)
  - Allow pmweb daemon to read system state. BZ(#1256128)
  - Add file transition that cermonger can create /run/ipa/renewal.lock with label ipa_var_run_t.
  - Revert "Revert default_range change in targeted policy"
  - Allow dhcpc_t domain transition to chronyd_t


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-146
changelog:
  - Allow passenger to getattr filesystem xattr
  - Revert "Allow pegasus_openlmi_storage_t create mdadm.conf.anacbak file in /etc."
  - Label mdadm.conf.anackbak as mdadm_conf_t file.
  - Allow dnssec-ttrigger to relabel net_conf_t files. BZ(1251765)
  - Allow dnssec-trigger to exec pidof. BZ(#1256737)
  - Allow blueman to create own tmp files in /tmp. (#1234647)
  - Add new audit_read access vector in capability2 class
  - Add "binder" security class and access vectors
  - Update netlink socket classes.
  - Allow getty to read network state. BZ(#1255177)
  - Remove labeling for /var/db/.*\.db as etc_t to label db files as system_db_t.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-147
changelog:
  - named wants to access /proc/sys/net/ipv4/ip_local_port_range to get ehphemeral range. BZ(#1260272)
  - Allow user screen domains to list directorires in HOMEDIR wit user_home_t labeling.
  - Dontaudit fenced search gnome config
  - Allow teamd running as NetworkManager_t to access netlink_generic_socket to allow multiple network interfaces to be teamed together. BZ(#1259180)
  - Fix for watchdog_unconfined_exec_read_lnk_files, Add also dir search perms in watchdog_unconfined_exec_t.
  - Sanlock policy update. #1255307   - New sub-domain for sanlk-reset daemon
  - Fix labeling for fence_scsi_check script
  - Allow openhpid to read system state Aloow openhpid to connect to tcp http port.
  - Allow openhpid to read snmp var lib files.
  - Allow openvswitch_t domains read kernel dependencies due to openvswitch run modprobe
  - Fix regexp in chronyd.fc file
  - systemd-logind needs to be able to act with /usr/lib/systemd/system/poweroff.target to allow shutdown system. BZ(#1260175)
  - Allow systemd-udevd to access netlink_route_socket to change names for network interfaces without unconfined.pp module. It affects also MLS.
  - Allow unconfined_t domains to create /var/run/xtables.lock with iptables_var_run_t
  - Remove bin_t label for /usr/share/cluster/fence_scsi_check\.pl


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-148
changelog:
  - Update config.tgz to reflect changes in default context for SELinux users related to pam_selinux.so which is now used in systemd-users.
  - Added support for permissive domains
  - Allow rpcbind_t domain to change file owner and group
  - rpm-ostree has a daemon mode now and need to speak to polkit/logind for authorization. BZ(#1264988)
  - Allow dnssec-trigger to send generic signal to Network-Manager. BZ(#1242578)
  - Allow smbcontrol to create a socket in /var/samba which uses for a communication with smbd, nmbd and winbind.
  - Revert "Add apache_read_pid_files() interface"
  - Allow dirsrv-admin read httpd pid files.
  - Add apache_read_pid_files() interface
  - Add label for dirsrv-admin unit file.
  - Allow qpid daemon to connect on amqp tcp port.
  - Allow dirsrvadmin-script read /etc/passwd file Allow dirsrvadmin-script exec systemctl
  - Add labels for afs binaries: dafileserver, davolserver, salvageserver, dasalvager
  - Add lsmd_plugin_t sys_admin capability, Allow lsmd_plugin_t getattr from sysfs filesystem.
  - Allow rhsmcertd_t send signull to unconfined_service_t domains.
  - Revert "Allow pcp to read docker lib files."
  - Label /usr/libexec/dbus-1/dbus-daemon-launch-helper  as dbusd_exec_t to have systemd dbus services running in the correct domain instead of unconfined_service_t if unconfined.pp module is enabled. BZ(#1262993)
  - Allow pcp to read docker lib files.
  - Revert "init_t needs to be login_pgm domain because of systemd-users + pam_selinux.so"
  - Add login_userdomain attribute also for unconfined_t.
  - Add userdom_login_userdomain() interface.
  - Label /etc/ipa/nssdb dir as cert_t
  - init_t needs to be login_pgm domain because of systemd-users + pam_selinux.so
  - Add interface unconfined_server_signull() to allow domains send signull to unconfined_service_t
  - Call userdom_transition_login_userdomain() instead of userdom_transition() in init.te related to pam_selinux.so+systemd-users.
  - Add userdom_transition_login_userdomain() interface
  - Allow user domains with login_userdomain to have entrypoint access on init_exec. It is needed by pam_selinux.so call in systemd-users. BZ(#1263350)
  - Add init_entrypoint_exec() interface.
  - Allow init_t to have transition allow rule for userdomain if pam_selinux.so is used in /etc/pam.d/systemd-user. It ensures that systemd user sessions will run with correct userdomain types instead of init_t. BZ(#1263350)


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-149
changelog:
  - Add few rules related to new policy for pkcs11proxyd
  - Added new policy for pkcs11proxyd daemon
  - We need to require sandbox_web_type attribute in sandbox_x_domain_template().
  - Dontaudit abrt_t to rw lvm_lock_t dir.
  - Allow abrt_d domain to write to kernel msg device.
  - Add interface lvm_dontaudit_rw_lock_dir()
  - Merge pull request #35 from lkundrak/lr-libreswan


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-150
changelog:
  - Allow acpid to attempt to connect to the Linux kernel via generic netlink socket.
  - Clean up pkcs11proxyd policy.
  - We need to require sandbox_web_type attribute in sandbox_x_domain_template().
  - Revert "depmod is a symlink to insmod so it runs as insmod_t. It causes that dep kernel modules files are not created with the correct labeling modules_dep_t. This fix adds filenamtrans rules for insmod_t."
  - depmod is a symlink to insmod so it runs as insmod_t. It causes that dep kernel modules files are not created with the correct labeling modules_dep_t. This fix adds filenamtrans rules for insmod_t.
  - Update files_read_kernel_modules() to contain modutils_read_module_deps() calling because module deps labeling has been updated and it allows to avoid regressions.
  - Update modules_filetrans_named_content() interface to cover more modules.* files.
  - New policy for systemd-machined. #1255305
  - In Rawhide/F24, we added pam_selinux.so support for systemd-users to have user sessions running under correct SELinux labeling. It also supports another new feature with systemd+dbus and we have sessions dbuses running with the correct labeling - unconfined_dbus_t for example.
  - Allow systemd-logind read access to efivarfs - Linux Kernel configuration options for UEFI systems (UEFI Runtime Variables). #1244973, #1267207 (partial solution)
  - Merge pull request #42 from vmojzis/rawhide-base
  - Add interface to allow reading files in efivarfs - contains Linux Kernel configuration options for UEFI systems (UEFI Runtime Variables)


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-151
changelog:
  - Update modules_filetrans_named_content() to make sure we don't get modules_dep labeling by filename transitions.
  - Remove /usr/lib/modules/[^/]+/modules\..+ labeling
  - Add modutils_read_module_deps_files() which is called from files_read_kernel_modules() for module deps which are still labeled as modules_dep_t.
  - Remove modules_dep_t labeling for kernel module deps. depmod is a symlink to kmod which is labeled as insmod_exec_t which handles modules_object_t and there is no transition to modules_dep_t. Also some of these module deps are placed by cpio during install/update of kernel package.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-152
changelog:
  - Allow pcp_pmlogger to read system state. BZ(1258699)
  - Allow cupsd to connect on socket. BZ(1258089)
  - Allow named to bind on ephemeral ports. BZ(#1259766)
  - Allow iscsid create netlink iscsid sockets.
  - We need allow connect to xserver for all sandbox_x domain because we have one type for all sandbox processes.
  - Allow NetworkManager_t and policykit_t read access to systemd-machined pid files. #1255305
  - Add missing labeling for /usr/libexec/abrt-hook-ccpp as a part of #1245477 and #1242467 bugs.
  - Allow search dirs in sysfs types in kernel_read_security_state.
  - Fix kernel_read_security_state interface that source domain of this interface can search sysctl_fs_t dirs.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-153
changelog:
  - Allow abrt_t to read sysctl_net_t files. BZ(#1194280)
  - Merge branch 'rawhide-contrib' of github.com:fedora-selinux/selinux-policy into rawhide-contrib
  - Add abrt_stub interface.
  - Add support for new mock location - /usr/libexec/mock/mock. BZ(#1270972)
  - Allow usbmuxd to access /run/udev/data/+usb:*. BZ(#1269633)
  - Allow qemu-bridge-helper to read /dev/random and /dev/urandom. BZ(#1267217)
  - Allow sssd_t to manage samba var files/dirs to SSSD's GPO support which is enabled against an Active Directory domain. BZ(#1225200).
  - Add samba_manage_var_dirs() interface.
  - Allow pcp_pmlogger to exec bin_t BZ(#1258698)
  - Allow spamd to read system network state. BZ(1260234)
  - Allow fcoemon to create netlink scsitransport sockets BZ(#1260882)
  - Allow networkmanager to create networkmanager_var_lib_t files. BZ(1270201)
  - Allow systemd-networkd to read XEN state for Xen hypervisor. BZ(#1269916)
  - Add fs_read_xenfs_files() interface.
  - Allow systemd_machined_t to send dbus msgs to all users and read/write /dev/ptmx to make 'machinectl shell' working correctly.
  - Allow systemd running as init_t to override the default context for key creation. BZ(#1267850)


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-154
changelog:
  - Allow winbindd to send signull to kernel. BZ(#1269193)
  - Merge branch 'rawhide-contrib-chrony' into rawhide-contrib
  - Fixes for chrony version 2.2 BZ(#1259636)
    * Allow chrony chown capability
    * Allow sendto dgram_sockets to itself and to unconfined_t domains.
  - Merge branch 'rawhide-contrib-chrony' into rawhide-contrib
  - Add boolean allowing mysqld to connect to http port. #1262125
  - Merge pull request #52 from 1dot75cm/rawhide-base
  - Allow systemd_hostnamed to read xenfs_t files. BZ(#1233877)
  - Fix attribute in corenetwork.if.in


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-156
changelog:
  - Allow fail2ban-client to execute ldconfig. #1268715
  - Add interface virt_sandbox_domain()
  - Use mmap_file_perms instead of exec_file_perms in setroubleshoot policy to shave off the execute_no_trans permission. Based on a github communication with Dominick Grift.
  -all userdom_dontaudit_user_getattr_tmp_sockets instead() of usedom_dontaudit_user_getattr_tmp_sockets().
  - Rename usedom_dontaudit_user_getattr_tmp_sockets() to userdom_dontaudit_user_getattr_tmp_sockets().
  - Remove auth_login_pgm_domain(init_t) which has been added by accident.
  - init_t needs to able to change SELinux identity because it is used as login_pgm domain because of systemd-user and PAM. It allows security_compute_user() returns a list of possible context and then a correct default label is returned by "selinux.get_default_context(sel_user,fromcon)" defined in the policy user config files.
  - Add interface auth_use_nsswitch() to systemd_domain_template.
  - Revert "auth_use_nsswitch can be used with attribute systemd_domain."
  - auth_use_nsswitch can be used with attribute systemd_domain.
  - ipsec: fix stringSwan charon-nm
  - docker is communicating with systemd-machined
  - Add missing systemd_dbus_chat_machined, needed by docker


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-157
changelog:
  - The ABRT coredump handler has code to emulate default core file creation The handler runs in a separate process with abrt_dump_oops_t SELinux process type. abrt-hook-ccpp also saves the core dump file in the very same way as kernel does and a user can specify CWD location for a coredump. abrt-hook-ccpp has been made as a SELinux aware apps to create this coredumps with correct labeling and with this commit the policy rules have been updated to allow access all non security files on a system.
  - Since /dev/log is a symlink, we need to allow relabelto also symlink. This commit update logging_relabel_devlog_dev() interface to allow it.
  - systemd-user has pam_selinux support and needs to able to compute user security context if init_t is not unconfined domain.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-158
changelog:
  - Merge pull request #48 from lkundrak/contrib-openfortivpn
  - unbound wants to use ephemeral ports as a default configuration. Allow to use also udp sockets.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-159
changelog:
  - Allow antivirus_t to bind to all unreserved ports. Clamd binds to random unassigned port (by default in range 1024-2048)
  - Allow abrt-hook-ccpp to change SELinux user identity for created objects.
  - Allow abrt-hook-ccpp to get attributes of all processes because of core_pattern.
  - Allow setuid/setgid capabilities for abrt-hook-ccpp.
  - Add default labeling for /etc/Pegasus/cimserver_current.conf. It is a correct patch instead of the current /etc/Pegasus/pegasus_current.conf.
  - Allow fenced node dbus msg when using foghorn witch configured foghorn, snmpd, and snmptrapd.
  - cockpit has grown content in /var/run directory
  - Add support for /dev/mptctl device used to check RAID status.
  - Allow systemd-hostnamed to communicate with dhcp via dbus.
  - systemd-logind remove all IPC objects owned by a user on a logout. This covers also SysV memory. This change allows to destroy unpriviledged user SysV shared memory segments.
  - Add userdom_destroy_unpriv_user_shared_mem() interface.
  - Label /var/run/systemd/shutdown directory as systemd_logind_var_run_t to allow systemd-logind to access it if shutdown is invoked.
  - Access needed by systemd-machine to manage docker containers
  - Allow systemd-logind to read /run/utmp when shutdown is invoked.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-160
changelog:
  - Allow apcupsd sending mails about battery state. BZ(1274018)
  - Allow pcp_pmcd_t domain transition to lvm_t. BZ(1277779)
  - Merge pull request #68 from rhatdan/rawhide-contrib
  - Allow antivirus_t to bind to all unreserved ports. Clamd binds to random unassigned port (by default in range 1024-2048). #1248785
  -  Allow systemd-networkd to bind dhcpd ports if DHCP=yes in *.network conf file. BZ(#1280092)
  - systemd-tmpfiles performs operations on System V IPC objects which requires sys_admin capability. BZ(#1279269)


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-162
changelog:
  - Label /usr/sbin/lvmlockd binary file as lvm_exec_t. BZ(1287739)
  - Adding support for dbus communication between systemd-networkd and systemd-hostnamed. BZ(1279182)
  - Update init policy to have userdom_noatsecure_login_userdomain() and userdom_sigchld_login_userdomain() called for init_t.
  - init_t domain should be running without unconfined_domain attribute.
  - Add a new SELinux policy for /usr/lib/systemd/systemd-rfkill.
  - Update userdom_transition_login_userdomain() to have "sigchld" and "noatsecure" permissions.
  - systemd needs to access /dev/rfkill on early boot.
  - Allow dspam to read /etc/passwd


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-163
changelog:
  - Allow whack executed by sysadm SELinux user to access /var/run/pluto/pluto.ctl. It fixes "ipsec auto --status" executed by sysadm_t.
  - Add ipsec_read_pid() interface


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-164
changelog:
  - Allow firewalld to create firewalld_var_run_t directory. BZ(1291243)
  - Add interface firewalld_read_pid_files()
  - Allow iptables to read firewalld pid files. BZ(1291243)
  - Allow the user cronjobs to run in their userdomain
  - Label ssdm binaries storedin /etc/sddm/ as bin_t. BZ(1288111)
  - Merge pull request #81 from rhatdan/rawhide-base
  - New access needed by systemd domains


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-165
changelog:
  - Allow sddm-helper running as xdm_t to create .wayland-errors with correct labeling. BZ(#1291085)
  - Revert "Allow arping running as netutils_t sys_module capability for removing tap devices."
  - Allow arping running as netutils_t sys_module capability for removing tap devices.
  - Add userdom_connectto_stream() interface.
  - Allow systemd-logind to read /run/utmp. BZ(#1278662)
  - Allow sddm-helper running as xdm_t to create .wayland-errors with correct labeling. BZ(#1291085)
  - Revert "Allow arping running as netutils_t sys_module capability for removing tap devices."
  - Allow arping running as netutils_t sys_module capability for removing tap devices.
  - Add userdom_connectto_stream() interface.
  - Allow systemd-logind to read /run/utmp. BZ(#1278662)


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-166
changelog:
  - Allow logrotate to systemctl rsyslog service. BZ(1284173)
  - Allow condor_master_t domain capability chown. BZ(1297048)
  - Allow chronyd to be dbus bus client. BZ(1297129)
  - Allow openvswitch read/write hugetlb filesystem.
  - Revert "Allow openvswitch read/write hugetlb filesystem."
  - Allow smbcontrol domain to send sigchld to ctdbd domain.
  - Allow openvswitch read/write hugetlb filesystem.
  - Merge branch 'rawhide-contrib' of github.com:fedora-selinux/selinux-policy into rawhide-contrib
  - Label /var/log/ipareplica-conncheck.log file as ipa_log_t Allow ipa_helper_t domain to manage logs labeledas ipa_log_t Allow ipa_helper_t to connect on http and kerberos_passwd ports. BZ(1289930)
  - Allow keepalived to connect to 3306/tcp port - mysqld_port_t.
  - Merge remote-tracking branch 'refs/remotes/origin/rawhide-contrib' into rawhide-contrib
  - Merge remote-tracking branch 'refs/remotes/origin/rawhide-contrib' into rawhide-contrib
  - Merge pull request #86 from rhatdan/rawhide-contrib
  - Label some new nsd binaries as nsd_exec_t Allow nsd domain net_admin cap. Create label nsd_tmp_t for nsd tmp files/dirs BZ (1293146)
  - Added interface logging_systemctl_syslogd
  - Label rsyslog unit file
  - Added policy for systemd-coredump service. Added domain transition from kernel_t to systemd_coredump_t. Allow syslogd_t domain to read/write tmpfs systemd-coredump files. Make new domain uconfined for now.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-167
changelog:
  - Add fwupd policy for daemon to allow session software to update device firmware
  - Label /usr/libexec/ipa/oddjob/org.freeipa.server.conncheck as ipa_helper_exec_t. BZ(1289930)
  - Allow systemd services to use PrivateNetwork feature
  - Add a type and genfscon for nsfs.
  - Fix SELinux context for rsyslog unit file. BZ(1284173)


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-168
changelog:
  - Label virtlogd binary as virtd_exec_t. BZ(1291940)
  - Allow iptables to read nsfs files. BZ(1296826)


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-169
changelog:
  - Allow openvswitch domain capability sys_rawio.
  - Revert "Allow NetworkManager create dhcpc pid files. BZ(1229755)"
  - Allow openvswitch to manage hugetlfs files and dirs.
  - Allow NetworkManager create dhcpc pid files. BZ(1229755)
  - Allow apcupsd to read kernel network state. BZ(1282003)
  - Label /sys/kernel/debug/tracing filesystem
  - Add fs_manage_hugetlbfs_files() interface.
  - Add sysnet_filetrans_dhcpc_pid() interface.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-170
changelog:
  - Allow abrt_dump_oops_t to getattr filesystem nsfs files. rhbz#1300334
  - Allow ulogd_t to create netlink_netfilter sockets. rhbz#1305426
  - Create new type fwupd_cert_t Label /etc/pki/(fwupd|fwupd-metadata) dirs as fwupd_cert_t Allow fwupd_t domain to read fwupd_cert_t files|lnk_files rhbz#1303533
  - Add interface to dontaudit leaked files from firewalld
  - fwupd needs to dbus chat with policykit
  - Allow fwupd domain transition to gpg domain. Fwupd signing firmware updates by gpg. rhbz#1303531
  - Allow abrt_dump_oops_t to check permissions for a /usr/bin/Xorg. rhbz#1284967
  - Allow prelink_cron_system_t domain set resource limits. BZ(1190364)
  - Allow pppd_t domain to create sockfiles in /var/run labeled as pppd_var_run_t label. BZ(1302666)
  - Fix wrong name for openqa_websockets tcp port.
  - Allow run sshd-keygen on second boot if first boot fails after some reason and content is not syncedon the disk. These changes are reflecting this commit in sshd. http://pkgs.fedoraproject.org/cgit/rpms/openssh.git/commit/?id=af94f46861844cbd6ba4162115039bebcc8f78ba rhbz#1299106
  - Add interface ssh_getattr_server_keys() interface. rhbz#1299106
  - Added Label openqa for tcp port (9526) Added Label openqa-websockets for tcp port (9527) rhbz#1277312
  - Add interface fs_getattr_nsfs_files()
  - Add interface xserver_exec().
  - Revert "Allow all domains some process flags."BZ(1190364)


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-172
changelog:
  - Fix macro name from snmp_manage_snmp_var_lib_files to snmp_manage_var_lib_files in cupsd policy.
  - Allow hplip driver to write to its MIB index files stored in the /var/lib/net-snmp/mib_indexes. Resolves: rhbz#1291033
  - Allow collectd setgid capability Resolves:#1310896
  - Allow adcli running as sssd_t to write krb5.keytab file.
  - Allow abrt-hook-ccpp to getattr on all executables. BZ(1284304)
  - Allow kexec to read kernel module files in /usr/lib/modules.
  - Add httpd_log_t for /var/log/graphite-web rhbz#1306981
  - Remove redudant rules and fix _admin interface.
  - Add SELinux policy for LTTng 2.x central tracing registry session daemon.
  - Allow create mongodb unix dgram sockets. rhbz#1306819
  - Support for InnoDB Tablespace Encryption.
  - Dontaudit leaded file descriptors from firewalld
  - Add port for rkt services
  - Add support for the default lttng-sessiond port - tcp/5345.  This port is used by LTTng 2.x central tracing registry session daemon.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-173
changelog:
  - Allow amanda to manipulate the tape changer to load the necessary tapes. rhbz#1311759
  - Allow keepalived to create netlink generic sockets. rhbz#1311756
  - Allow modemmanager to read /etc/passwd file.
  - Label all files named /var/run/.*nologin.* as systemd_logind_var_run_t.
  - Add filename transition to interface systemd_filetrans_named_content() that domain will create rfkill dir labeled as systemd_rfkill_var_lib_t instead of init_var_lib_t. rhbz #1290255
  - Allow systemd-logind to create .#nologinXXXXXX labeled as systemd_logind_var_run_t in /var/run/systemd/ rhbz#1285019
  - Allow systemd_networkd_t to write kmsg, when kernel was started with following params: systemd.debug systemd.log_level=debug systemd.log_target=kmsg rhbz#1311444
  - Allow ipsec to read home certs, when connecting to VPN. rhbz#1301319


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-174
changelog:
  - Revert "Allow systemd-logind to create .#nologinXXXXXX labeled as systemd_logind_var_run_t in /var/run/systemd/ rhbz#1285019"
  - Allow systemd-logind to create .#nologinXXXXXX labeled as systemd_logind_var_run_t in /var/run/ rhbz#1285019


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-175
changelog:
  - Fix new rkt policy (Remove some redundant rules, Fix cosmetic issues in interface file)
  - Add policy for rkt services


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-176
changelog:
  - Add new boolean tmpreaper_use_cifs() to allow tmpreaper to run on local directories being shared with Samba.
  - Merge pull request #105 from rhatdan/NO_NEW_PRIV
  - Fix new rkt policy
  - Remove some redundant rules.
  - Fix cosmetic issues in interface file.
  - Merge pull request #100 from rhatdan/rawhide-contrib
  - Add interface fs_setattr_cifs_dirs().
  - Merge pull request #106 from rhatdan/NO_NEW_PRIV_BASE
  - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
  -Build file_contexts.bin file_context.local.bin file_context.homedir.bin during build phase.
   This fix issue in Fedora live images when selinux-policy-targeted is not installed but just unpackaged, since there's no .bin files,
   file_contexts is parsed in selabel_open().
  Resolves: rhbz#1314372


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-177
changelog:
  - Allow spice-vdagent to getattr on tmpfs_t filesystems Resolves: rhbz#1276251
  - Allow sending dbus msgs between firewalld and system_cronjob domains.
  - Allow zabbix-agentd to connect to following tcp sockets. One of zabbix-agentd functions is get service status of ftp,http,innd,pop,smtp protocols. rhbz#1315354
  - Allow snapperd mounton permissions for snapperd_data_t. BZ(#1314972)
  - Add support for systemd-gpt-auto-generator. rhbz#1314968
  - Add interface dev_read_nvme() to allow reading Non-Volatile Memory Host Controller devices.
  - Add support for systemd-hwdb daemon. rhbz#1306243


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-178
changelog:
  - Label tcp port 5355 as llmnr-> Link-Local Multicast Name Resolution
  - Add support systemd-resolved.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-179
changelog:
  - Add filename transition that /etc/princap will be created with cupsd_rw_etc_t label in cups_filetrans_named_content() interface.
  - Revert "Add filename transition that /etc/princap will be created with cupsd_rw_etc_t label in cups_filetrans_named_content."
  - Add filename transition that /etc/princap will be created with cupsd_rw_etc_t label in cups_filetrans_named_content.
  - Allow pcp_pmie and pcp_pmlogger to read all domains state.
  - Make fwupd domain unconfined. We need to discuss solution related to using gpg. rhbz#1316717
  - Merge pull request #108 from rhatdan/rkt
  - Merge pull request #109 from rhatdan/virt_sandbox
  - Add new interface to define virt_sandbox_network domains
  - Label /etc/redis-sentinel.conf as redis_conf_t. Allow redis_t write to redis_conf_t. Allow redis_t to connect on redis tcp port.
  - Fix typo in drbd policy
  - Remove declaration of empty booleans in virt policy.
  - Add new drbd file type: drbd_var_run_t. Allow drbd_t to manage drbd_var_run_t files/dirs.
  - Label /etc/ctdb/events.d/* as ctdb_exec_t. Allow ctdbd_t to setattr on ctdbd_exec_t files.
  - Additional rules to make rkt work in enforcing mode
  - Allow to log out to gdm after screen was resized in session via vdagent. Resolves: rhbz#1249020
  - Allow ipsec to use pam. rhbz#1317988
  - Allow systemd-gpt-generator to read fixed_disk_device_t. rhbz#1314968
  - Allow setrans daemon to read /proc/meminfo.
  - Merge pull request #107 from rhatdan/rkt-base
  - Allow systemd_notify_t to write to kmsg_device_t when 'systemd.log_target=kmsg' option is used.
  - Remove bin_t label for /etc/ctdb/events.d/. We need to label this scripts as ctdb_exec_t.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-180
changelog:
  - Allow dovecot_auth_t domain to manage also dovecot_var_run_t fifo files. BZ(1320415)
  - Allow colord to read /etc/udev/hwdb.bin. rhzb#1316514
  - sandboxX.te: Allow sandbox domain to have entrypoint access only for executables and mountpoints.
  - Allow sandbox domain to have entrypoint access only for executables and mountpoints.
  - Allow bitlee to create bitlee_var_t dirs.
  - Allow CIM provider to read sssd public files.
  - Fix some broken interfaces in distro policy.
  - Allow power button to shutdown the laptop.
  - Allow lsm plugins to create named fixed disks. rhbz#1238066
  - Allow hyperv domains to rw hyperv devices. rhbz#1241636
  - Label /var/www/html(/.*)?/wp_backups(/.*)? as httpd_sys_rw_content_t.
  - Create conman_unconfined_script_t type for conman script stored in /use/share/conman/exec/
  - Allow rsync_export_all_ro boolean to read also non_auth_dirs/files/symlinks.
  - Allow pmdaapache labeled as pcp_pmcd_t access to port 80 for apache diagnostics
  - Label nagios scripts as httpd_sys_script_exec_t.
  - Allow nsd_t to bind on nsf_control tcp port. Allow nsd_crond_t to read nsd pid.
  - Fix couple of cosmetic thing in new virtlogd_t policy. rhbz #1311576
  - Merge pull request #104 from berrange/rawhide-contrib-virtlogd
  - Label /var/run/ecblp0 as cupsd_var_run_t due to this fifo_file is used by epson drivers. rhbz#1310336
  - Dontaudit logrotate to setrlimit itself. rhbz#1309604
  - Add filename transition that /etc/princap will be created with cupsd_rw_etc_t label in cups_filetrans_named_content() interface.
  - Allow pcp_pmie and pcp_pmlogger to read all domains state.
  - Allow systemd-gpt-generator to create and manage systemd gpt generator unit files. BZ(1319446)
  - Merge pull request #115 from rhatdan/nvidea
  - Label all nvidia binaries as xserver_exec_t
  - Add new systemd_hwdb_read_config() interface. rhbz#1316514
  - Add back corecmd_read_all_executables() interface.
  - Call files_type() instead of file_type() for unlabeled_t.
  - Add files_entrypoint_all_mountpoint() interface.
  - Make unlabeled only as a file_type type. It is a type for fallback if there is an issue with labeling.
  - Add corecmd_entrypoint_all_executables() interface.
  - Create hyperv* devices and create rw interfaces for this devices. rhbz#1309361
  - Add neverallow assertion for unlabaled_t to increase policy security.
  - Allow systemd-rfkill to create /var/lib/systemd/rfkill dir. rhbz#1319499
  - Label 8952 tcp port as nsd_control.
  - Allow to log out to gdm after screen was resized in session via vdagent. Resolves: rhbz#1249020


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-181
changelog:
  - Label /usr/libexec/rpm-ostreed as rpm_exec_t. BZ(1309075)
  - /bin/mailx is labeled sendmail_exec_t, and enters the sendmail_t domain on execution.  If /usr/sbin/sendmail does not have its own domain to transition to, and is not one of several products whose behavior is allowed by the sendmail_t policy, execution will fail. In this case we need to label /bin/mailx as bin_t. BZ(1323224)
  - Label all run tgtd files, not just socket files.
  - Allow prosody to stream connect to sasl. This will allow using cyrus authentication in prosody.
  - Allow prosody to listen on port 5000 for mod_proxy65. BZ(1322815)
  - Allow targetd to read/write to /dev/mapper/control device. BZ(1241415)
  - Label /etc/selinux/(minimum|mls|targeted)/active/ as semanage_store_t.
  - Allow systemd_resolved to read systemd_networkd run files. BZ(1322921)
  - New cgroup2 file system in Rawhide


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-182
changelog:
  - rename several contrib modules according to their filenames
  - Add interface gnome_filetrans_cert_home_content()
  - By default container domains should not be allowed to create devices
  - Allow unconfined_t to create ~/.local/share/networkmanagement/certificates/ as home_cert_t instead of data_home_t.
  - Allow systemd_resolved_t to read /etc/passwd file. Allow systemd_resolved_t to write to kmsg_device_t when 'systemd.log_target=kmsg' option is used
  - Allow systemd gpt generator to read removable devices. BZ(1323458)
  - Allow systemd_gpt_generator_t sys_rawio capability. This access is needed to allow systemd gpt generator various device commands  BZ(1323454)


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-183
changelog:
  - Allow modemmanager to talk to logind
  - Dontaudit tor daemon needs net_admin capability. rhbz#1311788
  - Allow GDM write to event devices. This rule is needed for GDM, because other display managers runs the X server as root, GDM instead runs the X server as the unprivileged user, within the user session. rhbz#1232042
  - Xorg now writes content in users homedir.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-184
changelog:
  - Remove ftpd_home_dir() boolean from distro policy. Reason is that we cannot make this working due to m4 macro language limits.
  - Create new apache content template for files stored in user homedir. This change is needed to make working booleans: - httpd_enable_homedirs - httpd_read_user_content Resolves: rhbz#1330448
  - Label /usr/lib/snapper/systemd-helper as snapperd_exec_t. rhbz#1323732
  - Make virt_use_pcscd boolean off by default.
  - Create boolean to allow virtual machine use smartcards. rhbz#1029297
  - Allow snapperd to relabel btrfs snapshot subvolume to snapperd_data_t. rhbz#1323754
  - Allow mongod log to syslog.
  - Allow nsd daemon to create log file in /var/log as nsd_log_t
  - unlabeled_t can not be an entrypoint.
  - Modify interface den_read_nvme() to allow also read nvme_device_t block files. rhbz#1327909
  - Add new permissions stop/start to class system. rhbz#1324453


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-185
changelog:
  - Allow runnig php7 in fpm mode. From selinux-policy side, we need to allow httpd to read/write hugetlbfs.
  - Allow openvswitch daemons to run under openvswitch Linux user instead of root. This change needs allow set capabilities: chwon, setgid, setuid, setpcap. BZ(1330895)
  - Allow KDM to get status about power services. This change allow kdm to be able do shutdown BZ(1330970)
  - Add mls support for some db classes


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-186
changelog:
  - Allow snapperd sys_admin capability Allow snapperd to set scheduler. BZ(1323732)
  - Label named-pkcs11 binary as named_exec_t. BZ(1331316)
  - Revert "Add new permissions stop/start to class system. rhbz#1324453"
  - Fix typo in module compilation message


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-187
changelog:
  - Allow stunnel create log files. BZ(1333033)
  - Label dev/shm/squid-cf__metadata.shm as squid_tmpfs_t. BZ(1331574)
  - Allow stunnel sys_nice capability. Stunnel sched_* syscalls in some cases. BZ(1332287)
  - Label /usr/bin/ganesha.nfsd as glusterd_exec_t to run ganesha as glusterd_t. Allow glusterd_t stream connect to rpbind_t. Allow cluster_t to create symlink /var/lib/nfs labeled as var_lib_nfs_t. Add interface rpc_filetrans_var_lib_nfs_content() Add new boolean: rpcd_use_fusefs to allow rpcd daemon use fusefs.
  - Allow systemd-user-sessions daemon to mamange systemd_logind_var_run_t pid files. BZ(1331980)
  - Modify kernel_steam_connect() interface by adding getattr permission. BZ(1331927)
  - Label /usr/sbin/xrdp* files as bin_t BZ(1258453)
  - Allow rpm-ostree domain transition to install_t domain from init_t. rhbz#1330318


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-188
changelog:
  - Label tcp port 8181 as intermapper_port_t.
  - Label /usr/libexec/storaged/storaged as lvm_exec_t to run storaged daemon in lvm_t SELinux domain. BZ(1333588)
  - Label tcp/udp port 2024 as xinuexpansion4_port_t
  - Label tcp port 7002 as afs_pt_port_t Label tcp/udp port 2023 as xinuexpansion3_port_t


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-189
changelog:
  - Revert temporary fix: Replace generating man/html pages with pages from actual build. This is due to broken userspace with python3 in F23/Rawhide. Please Revert when userspace will be fixed


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-190
changelog:
  - Label /var/log/ganesha.log as gluster_log_t Allow glusterd_t domain to create glusterd_log_t files. Label /var/run/ganesha.pid as gluster_var_run_t.
  - Allow zabbix to connect to postgresql port
  - Label /usr/libexec/openssh/sshd-keygen as sshd_keygen_exec_t. BZ(1335149)
  - Allow systemd to read efivarfs. Resolve: #121


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-191
changelog:
  - Label /usr/share/ovirt-guest-agent/ovirt-guest-agent.py as rhev_agentd_exec_t
  - Allow dnssec_trigger_t to create lnk_file labeled as dnssec_trigger_var_run_t. BZ(1335954)
  - Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus.
  - Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t.
  - Merge pull request #122 from NetworkManager/th/nm-dnsmasq-dbus
  - Merge pull request #125 from rhatdan/typebounds
  - Typebounds user domains
  - Allow systemd_resolved_t to check if ipv6 is disabled.
  - systemd added a new directory for unit files /run/systemd/transient. It should be labelled system_u:object_r:systemd_unit_file_t:s0, the same as /run/systemd/system, PID 1 will write units there. Resolves: #120
  - Label /dev/xen/privcmd as xen_device_t. BZ(1334115)


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-192
changelog:
  - Create new SELinux type for /usr/libexec/ipa/ipa-dnskeysyncd BZ(1333106)
  - Add SELinux policy for opendnssec service. BZ(1333106)


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-193
changelog:
  - Directory Server (389-ds-base) has been updated to use systemd-ask-password. In order to function correctly we need the following added to dirsrv.te
  - Update opendnssec_manage_config() interface to allow caller domain also manage opendnssec_conf_t dirs
  - Allow gssproxy to get attributes on all filesystem object types. BZ(1333778)
  - Allow ipa_dnskey_t search httpd config files.
  - Dontaudit certmonger to write to etc_runtime_t
  - Update opendnssec_read_conf() interface to allow caller domain also read opendnssec_conf_t dirs.
  - Add interface ipa_delete_tmp()
  - Allow systemd_hostanmed_t to read /proc/sysinfo labeled as sysctl_t.
  - Allow systemd to remove ipa temp files during uinstalling ipa. BZ(1333106)


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-194
changelog:
  - Allow boinc to use dri devices. This allows use Boinc for a openCL GPU calculations. BZ(1340886)
  - Add nrpe_dontaudit_write_pipes()
  - Merge pull request #129 from rhatdan/onload
  - Add support for onloadfs
  - Merge pull request #127 from rhatdan/device-node
  - Additional access required for unconfined domains
  - Dontaudit ping attempts to write to nrpe unnamed pipes
  - Allow ifconfig_t to mounton also ifconfig_var_run_t dirs, not just files. Needed for: #ip netns add foo BZ(1340952)


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-195
changelog:
  - Add hwloc-dump-hwdata SELinux policy
  - Add labels for mediawiki123
  - Fix label for all fence_scsi_check scripts
  - Allow setcap for fenced
  - Allow glusterd domain read krb5_keytab_t files.
  - Allow tmpreaper_t to read/setattr all non_security_file_type dirs
  - Update refpolicy to handle hwloc
  - Fix typo in files_setattr_non_security_dirs.
  - Add interface files_setattr_non_security_dirs()


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-196
changelog:
  - Allow svirt_sandbox_domains to r/w onload sockets
  - Add filetrans rule that NetworkManager_t can create net_conf_t files in /etc.
  - Add interface sysnet_filetrans_named_net_conf()
  - Rawhide fails to boot, systemd-logind needs to config transient config files
  - User Namespace is requires create on process domains


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-197
changelog:
  - Allow conman to kill conman_unconfined_script.
  - Make conman_unconfined_script_t as init_system_domain.
  - Allow init dbus chat with apmd.
  - Patch /var/lib/rpm is symlink to /usr/share/rpm on Atomic, due to this change we need to label also /usr/share/rpm as rpm_var_lib_t.
  - Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_t
  - Allow collectd_t to stream connect to postgresql.
  - Allow mysqld_safe to inherit rlimit information from mysqld
  - Allow ip netns to mounton root fs and unmount proc_t fs.
  - Allow sysadm_t to run newaliases command.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-198
changelog:
  - Allow firewalld_t to create entries in net_conf_t dirs.
  - Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals
  - Allow rhsmcertd connect to port tcp 9090
  - Label for /bin/mail(x) was removed but /usr/bin/mail(x) not. This path is also needed to remove.
  - Label /usr/libexec/mimedefang-wrapper as spamd_exec_t.
  - Add new boolean spamd_update_can_network.
  - Add proper label for /var/log/proftpd.log
  - Allow rhsmcertd connect to tcp netport_port_t
  - Fix SELinux context for /usr/share/mirrormanager/server/mirrormanager to Label all binaries under dir as mirrormanager_exec_t.
  - Allow prosody to bind to fac_restore tcp port.
  - Fix SELinux context for usr/share/mirrormanager/server/mirrormanager
  - Allow ninfod to read raw packets
  - Fix broken hostapd policy
  - Allow hostapd to create netlink_generic sockets. BZ(1343683)
  - Merge pull request #133 from vinzent/allow_puppet_transition_to_shorewall
  - Allow pegasus get attributes from qemu binary files.
  - Allow tuned to use policykit. This change is required by cockpit.
  - Allow conman_t to read dir with conman_unconfined_script_t binary files.
  - Allow pegasus to read /proc/sysinfo.
  - Allow puppet_t transtition to shorewall_t
  - Allow conman to kill conman_unconfined_script.
  - Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals.
  - Merge remote-tracking branch 'refs/remotes/origin/rawhide-base' into rawhide-base
  - Allow systemd to execute all init daemon executables.
  - Add init_exec_notrans_direct_init_entry() interface.
  - Label tcp ports:16379, 26379 as redis_port_t
  - Allow systemd to relabel /var and /var/lib directories during boot.
  - Add files_relabel_var_dirs() and files_relabel_var_dirs() interfaces.
  - Add files_relabelto_var_lib_dirs() interface.
  - Label tcp and udp port 5582 as fac_restore_port_t
  - Allow sysadm_t user to run postgresql-setup.
  - Allow sysadm_t user to dbus chat with oddjob_t. This allows confined admin run oddjob mkhomedirfor script.
  - Allow systemd-resolved to connect to llmnr tcp port. BZ(1344849)
  - Allow passwd_t also manage user_tmp_t dirs, this change is needed by gnome-keyringd


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-199
changelog:
  - Label /var/lib/softhsm as named_cache_t. Allow named_t to manage named_cache_t dirs.
  - Allow glusterd daemon to get systemd status
  - Merge branch 'rawhide-contrib' of github.com:fedora-selinux/selinux-policy into rawhide-contrib
  - Merge pull request #135 from rhatdan/rawip_socket
  - Allow logrotate dbus-chat with system_logind daemon
  - Allow pcp_pmlogger to read kernel network state Allow pcp_pmcd to read cron pid files
  - Add interface cron_read_pid_files()
  - Allow pcp_pmlogger to create unix dgram sockets
  - Add interface dirsrv_run()
  - Remove non-existing jabberd_spool_t() interface and add new jabbertd_var_spool_t.
  - Remove non-existing interface salk_resetd_systemctl() and replace it with sanlock_systemctl_sanlk_resetd()
  - Create label for openhpid log files.
  - Container processes need to be able to listen on rawip sockets
  - Label /var/lib/ganglia as httpd_var_lib_t
  - Allow firewalld_t to create entries in net_conf_t dirs.
  - Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals
  - Label /etc/dhcp/scripts dir as bin_t
  - Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-200
changelog:
  - Fix typo in brltty policy
  - Add new SELinux module sbd
  - Allow pcp dmcache metrics collection
  - Allow pkcs_slotd_t to create dir in /var/lock Add label pkcs_slotd_log_t
  - Allow openvpn to create sock files labeled as openvpn_var_run_t
  - Allow hypervkvp daemon to getattr on  all filesystem types.
  - Allow firewalld to create net_conf_t files
  - Allow mock to use lvm
  - Allow mirromanager creating log files in /tmp
  - Allow vmtools_t to transition to rpm_script domain
  - Allow nsd daemon to manage nsd_conf_t dirs and files
  - Allow cluster to create dirs in /var/run labeled as cluster_var_run_t
  - Allow sssd read also sssd_conf_t dirs
  - Allow opensm daemon to rw infiniband_mgmt_device_t
  - Allow krb5kdc_t to communicate with sssd
  - Allow prosody to bind on prosody ports
  - Add dac_override caps for fail2ban-client Resolves: rhbz#1316678
  - dontaudit read access for svirt_t on the file /var/db/nscd/group Resolves: rhbz#1301637
  - Allow inetd child process to communicate via dbus with systemd-logind Resolves: rhbz#1333726
  - Add label for brltty log file Resolves: rhbz#1328818
  - Allow snort_t to communicate with sssd Resolves: rhbz#1284908
  - Add interface lttng_sessiond_tmpfs_t()
  - Dontaudit su_role_template interface to getattr /proc/kcore Dontaudit su_role_template interface to getattr /dev/initctl
  - Add interface lvm_getattr_exec_files()
  - Make label for new infiniband_mgmt deivices
  - Add prosody ports Resolves: rhbz#1304664


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-201
changelog:
  - Allow lttng tools to block suspending
  - Allow creation of vpnaas in openstack
  - remove rules with compromised_kernel permission
  - Allow dnssec-trigger to chat with NetworkManager over DBUS BZ(1350100)
  - Allow virtual machines to rw infiniband devices. Resolves: rhbz#1210263
  - Update makefile to support snapperd_contexts file
  - Remove compromize_kernel permission Remove unused mac_admin permission Add undefined system permission
  - Remove duplicate declaration of class service
  - Fix typo in access_vectors file
  - Merge branch 'rawhide-base-modules-load' into rawhide-base
  - Add new policy for systemd-modules-load
  - Add systemd access vectors.
  - Revert "Revert "Revert "Missed this version of exec_all"""
  - Revert "Revert "Missed this version of exec_all""
  - Revert "Missed this version of exec_all"
  - Revert "Revert "Fix name of capability2 secure_firmware->compromise_kernel"" BZ(1351624) This reverts commit 3e0e7e70de481589440f3f79cccff08d6e62f644.
  - Revert "Fix name of capability2 secure_firmware->compromise_kernel" BZ(1351624) This reverts commit 7a0348a2d167a72c8ab8974a1b0fc33407f72c48.
  - Revert "Allow xserver to compromise_kernel access"BZ(1351624)
  - Revert "Allow anyone who can load a kernel module to compromise_kernel"BZ(1351624)
  - Revert "add ptrace_child access to process" (BZ1351624)
  - Add user namespace capability object classes.
  - Allow udev to manage systemd-hwdb files
  - Add interface systemd_hwdb_manage_config()
  - Fix paths to infiniband devices. This allows use more then two infiniband interfaces.
  - corecmd: Remove fcontext for /etc/sysconfig/libvirtd
  - iptables: add fcontext for nftables


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-202
changelog:
  - Allow systemd_logind_t to start init_t BZ(1355861)
  - Add init_start() interface
  - Allow sysadm user to run systemd-tmpfiles
  - Add interface systemd_tmpfiles_run


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-203
changelog:
  - Allow hypervkvp domain to run restorecon.
  - Allow firewalld to manage net_conf_t files
  - Remove double graphite-web context declaration
  - Fix typo in rhsmcertd SELinux policy
  - Allow logrotate read logs inside containers.
  - Allow sssd to getattr on fs_t
  - Allow opendnssec domain to manage bind chace files
  - Allow systemd to get status of systemd-logind daemon
  - Label more ndctl devices not just ndctl0


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-204
changelog:
  - Allow lsmd_plugin_t to exec ldconfig.
  - Allow vnstatd domain to read /sys/class/net/ files
  - Remove duplicate allow rules in spamassassin SELinux module
  - Allow spamc_t and spamd_t domains create .spamassassin file in user homedirs
  - Allow ipa_dnskey domain to search cache dirs
  - Allow dogtag-ipa-ca-renew-agent-submit labeled as certmonger_t to create /var/log/ipa/renew.log file
  - Allow ipa-dnskey read system state.
  - Allow sshd setcap capability. This is needed due to latest changes in sshd Resolves: rhbz#1356245
  - Add interface to write to nsfs inodes
  - Allow init_t domain to read rpm db. This is needed due dnf-upgrade process failing. BZ(1349721)
  - Allow systemd_modules_load_t to read /etc/modprobe.d/lockd.conf
  - sysadmin should be allowed to use docker.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-205
changelog:
  - Dontaudit mock_build_t can list all ptys.
  - Allow ftpd_t to mamange userhome data without any boolean.
  - Add logrotate permissions for creating netlink selinux sockets.
  - Add new MLS attribute to allow relabeling objects higher than system low. This exception is needed for package managers when processing sensitive data.
  - Label all VBox libraries stored in /var/lib/VBoxGuestAdditions/lib/ as textrel_shlib_t BZ(1356654)
  - Allow systemd gpt generator to run fstools BZ(1353585)
  - Label /usr/lib/systemd/libsystemd-shared-231.so as lib_t. BZ(1360716)
  - Allow gnome-keyring also manage user_tmp_t sockets.
  - Allow systemd to mounton /etc filesystem. BZ(1341753)


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-206
changelog:
  - collectd: update policy for 5.5
  - Allow puppet_t transtition to shorewall_t
  - Grant certmonger "chown" capability
  - Boinc updates from Russell Coker.
  - Allow sshd setcap capability. This is needed due to latest changes in sshd.
  - Revert "Allow sshd setcap capability. This is needed due to latest changes in sshd"
  - Revert "Fix typo in ssh policy"
  - Get attributes of generic ptys, from Russell Coker.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-208
changelog:
  - Allow cups_config_t domain also mange sock_files. BZ(1361299)
  - Add wake_alarm capability to fprintd domain BZ(1362430)
  - Allow firewalld_t to relabel net_conf_t files. BZ(1365178)
  - Allow nut_upsmon_t domain to chat with logind vie dbus about scheduleing a shutdown when UPS battery is low. BZ(1361802)
  - Allow virtual machines to use dri devices. This allows use openCL GPU calculations. BZ(1337333)
  - Allow crond and cronjob domains to creating mail_home_rw_t objects in admin_home_t BZ(1366173)
  - Dontaudit mock to write to generic certs.
  - Add labeling for corosync-qdevice and corosync-qnetd daemons, to run as cluster_t
  - Revert "Label corosync-qnetd and corosync-qdevice as corosync_t domain"
  - Merge pull request #144 from rhatdan/modemmanager
  - Allow modemmanager to write to systemd inhibit pipes
  - Label corosync-qnetd and corosync-qdevice as corosync_t domain
  - Allow ipa_helper to read network state
  - Label oddjob_reqiest as oddjob_exec_t
  - Add interface oddjob_run()
  - Allow modemmanager chat with systemd_logind via dbus
  - Allow NetworkManager chat with puppetagent via dbus
  - Allow NetworkManager chat with kdumpctl via dbus
  - Allow sbd send msgs to syslog Allow sbd create dgram sockets. Allow sbd to communicate with kernel via dgram socket Allow sbd r/w kernel sysctls.
  - Allow ipmievd_t domain to re-create ipmi devices Label /usr/libexec/openipmi-helper as ipmievd_exec_t
  - Allow rasdaemon to use tracefs filesystem
  - Fix typo bug in dirsrv policy
  - Some logrotate scripts run su and then su runs unix_chkpwd. Allow logrotate_t domain to check passwd.
  - Add ipc_lock capability to sssd domain. Allow sssd connect to http_cache_t
  - Allow dirsrv to read dirsrv_share_t content
  - Allow virtlogd_t to append svirt_image_t files.
  - Allow hypervkvp domain to read hugetlbfs dir/files.
  - Allow mdadm daemon to read nvme_device_t blk files
  - Allow systemd_resolved to connect on system bus. BZ(1366334)
  - Allow systemd to create netlink_route_socket and communicate with systemd_networkd BZ(1306344)
  - Allow systemd-modules-load to load kernel modules in early boot. BZ(1322625)
  - label tcp/udp port 853 as dns_port_t. BZ(1365609)
  - Merge pull request #145 from rhatdan/init
  - systemd is doing a gettattr on blk and chr devices in /run
  - Allow selinuxusers and unconfineduser to run oddjob_request
  - Allow sshd server to acces to Crypto Express 4 (CEX4) devices.
  - Fix typo in device interfaces
  - Add interfaces for managing ipmi devices
  - Add interfaces to allow mounting/umounting tracefs filesystem
  - Add interfaces to allow rw tracefs filesystem
  - Merge branch 'rawhide-base' of github.com:fedora-selinux/selinux-policy into rawhide-base
  - Merge pull request #138 from rhatdan/userns
  - Allow iptables to creating netlink generic sockets.
  - Fix filecontext for systemd shared lib.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-209
changelog:
  - Fix lsm SELinux module
  - Dontaudit firewalld to create dirs in /root/ BZ(1340611)
  - Label /run/corosync-qdevice and /run/corosync-qnetd as corosync_var_run_t
  - Allow fprintd and cluster domains to cummunicate via dbus BZ(1355774)
  - Allow cupsd_config_t domain to read cupsd_var_run_t sock_file. BZ(1361299)
  - Add sys_admin capability to sbd domain
  - Allow vdagent to comunnicate with systemd-logind via dbus
  - Allow lsmd_plugin_t domain to create fixed_disk device.
  - Allow opendnssec domain to create and manage own tmp dirs/files
  - Allow opendnssec domain to read system state
  - Allow systemd_logind stop system init_t
  - Add interface init_stop()
  - Add interface userdom_dontaudit_create_admin_dir()
  - Label /var/run/storaged as lvm_var_run_t.
  - Allow unconfineduser to run ipa_helper_t.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-210
changelog:
  - Add few interfaces to cloudform.if file
  - Label /var/run/corosync-qnetd and /var/run/corosync-qdevice as cluster_var_run_t. Note: corosync policy is now par of rhcs module
  - Allow krb5kdc_t to read krb4kdc_conf_t dirs.
  - Update networkmanager_filetrans_named_content() interface to allow source domain to create also temad dir in /var/run.
  - Make confined users working again
  - Fix hypervkvp module
  - Allow ipmievd domain to create lock files in /var/lock/subsys/
  - Update policy for ipmievd daemon. Contain:    Allowing reading sysfs, passwd,kernel modules   Execuring bin_t,insmod_t
  - A new version of cloud-init that supports the effort to provision RHEL Atomic on Microsoft Azure requires some a new rules that allows dhclient/dhclient hooks to call cloud-init.
  - Allow systemd to stop systemd-machined daemon. This allows stop virtual machines.
  - Label /usr/libexec/iptables/iptables.init as iptables_exec_t Allow iptables creating lock file in /var/lock/subsys/


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-211
changelog:
  - Add new domain ipa_ods_exporter_t BZ(1366640)
  - Create new interface opendnssec_stream_connect()
  - Allow systemd-machined to communicate to lxc container using dbus
  - Dontaudit accountsd domain creating dirs in /root
  - Add new policy for Disk Manager called udisks2
  - Dontaudit firewalld wants write to /root
  - Label /etc/pki/pki-tomcat/ca/ as pki_tomcat_cert_t
  - Allow certmonger to manage all systemd unit files
  - Allow ipa_helper_t stream connect to dirsrv_t domain
  - Update oracleasm SELinux module
  - label /var/lib/kubelet as svirt_sandbox_file_t
  - Allow systemd to create blk and chr files with correct label in /var/run/systemd/inaccessible BZ(1367280)
  - Label /usr/libexec/gsd-backlight-helper as xserver_exec_t. This allows also confined users to manage screen brightness
  - Add new userdom_dontaudit_manage_admin_dir() interface
  - Label /dev/oracleasmfs as oracleasmfs_t. Add few interfaces related to oracleasmfs_t type


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-212
changelog:
  - udisk2 module is part of devicekit module now
  - Fix file context for /etc/pki/pki-tomcat/ca/
  - new interface oddjob_mkhomedir_entrypoint()
  - Allow mdadm to get attributes from all devices.
  - Label /etc/puppetlabs as puppet_etc_t.
  - quota: allow init to run quota tools
  - Add new domain ipa_ods_exporter_t BZ(1366640)
  - Create new interface opendnssec_stream_connect()
  - Allow VirtualBox to manage udev rules.
  - Allow systemd_resolved to send dbus msgs to userdomains
  - Make entrypoint oddjob_mkhomedir_exec_t for unconfined_t
  - Label all files in /dev/oracleasmfs/ as oracleasmfs_t


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-213
changelog:
  - Label /var/lib/docker/vfs as svirt_sandbox_file_t in virt SELinux module
  - Label /usr/bin/pappet as puppetagent_exec_t
  - Allow amanda to create dir in /var/lib/ with amanda_var_lib_t label
  - Allow run sulogin_t in range mls_systemlow-mls_systemhigh.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-214
changelog:
  - Allow attach usb device to virtual machine BZ(1276873)
  - Dontaudit mozilla_plugin to sys_ptrace
  - Allow nut_upsdrvctl_t domain to read udev db BZ(1375636)
  - Fix typo
  - Allow geoclue to send msgs to syslog. BZ(1371818)
  - Allow abrt to read rpm_tmp_t dirs
  - Add interface rpm_read_tmp_files()
  - Remove labels for somr docker sandbox files for now. This needs to be reverted after fixes in docker-selinux
  - Update oracleasm SELinux module that can manage oracleasmfs_t blk files. Add dac_override cap to oracleasm_t domain.
  - Add few rules to pcp SELinux module to make ti able to start pcp_pmlogger service
  - Revert "label /var/lib/kubelet as svirt_sandbox_file_t"
  - Remove file context for /var/lib/kubelet. This filecontext is part of docker now
  - Add oracleasm_conf_t type and allow oracleasm_t to create /dev/oracleasm
  - Label /usr/share/pcp/lib/pmie as pmie_exec_t and /usr/share/pcp/lib/pmlogger as pmlogger_exec_t
  - Allow mdadm_t to getattr all device nodes
  - Dontaudit gkeyringd_domain to connect to system_dbusd_t
  - Add interface dbus_dontaudit_stream_connect_system_dbusd()
  - Allow guest-set-user-passwd to set users password.
  - Allow domains using kerberos to read also kerberos config dirs
  - Allow add new interface to new namespace BZ(1375124)
  - Allow systemd to relalbel files stored in /run/systemd/inaccessible/
  -  Add interface fs_getattr_tmpfs_blk_file()
  - Dontaudit domain to create any file in /proc. This is kernel bug.
  - Improve regexp for power_unit_file_t files. To catch just systemd power unit files.
  - Add new interface fs_getattr_oracleasmfs_fs()
  - Add interface fs_manage_oracleasm()
  - Label /dev/kfd as hsa_device_t
  - Update seutil_manage_file_contexts() interface that caller domain can also manage file_context_t dirs


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-215
changelog:
  - Make tor_var_run_t as mountpoint. BZ(1368621)
  - Fix typo in ftpd SELinux module.
  - Allow cockpit-session to reset expired passwords BZ(1374262)
  - Allow ftp daemon to manage apache_user_content
  - Label /etc/sysconfig/oracleasm as oracleasm_conf_t
  - Allow oracleasm to rw inherited fixed disk device
  - Allow collectd to connect on unix_stream_socket
  - Add abrt_dump_oops_t kill user namespace capability. BZ(1376868)
  - Dontaudit systemd is mounting unlabeled dirs BZ(1367292)
  - Add interface files_dontaudit_mounton_isid()


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-216
changelog:
  - Allow devicekit to chat with policykit via DBUS. BZ(1377113)
  - Add interface virt_rw_stream_sockets_svirt() BZ(1379314)
  - Allow xdm_t to read mount pid files. BZ(1377113)
  - Allow staff to rw svirt unix stream sockets. BZ(1379314)
  - Allow staff_t to read tmpfs files BZ(1378446)


author: Colin Walters <walters@redhat.com> - 3.13.1-218
changelog:
  - Revert addition of systemd service for factory reset, since it is
    basically worse than what we had before.  BZ(1290659)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-219
changelog:
  - Dontaudit leaked file descriptors for thumb. BZ(1383071)
  - Fix typo in cobbler SELinux module
  - Merge pull request #165 from rhatdan/container
  - Allow cockpit_ws_t to manage cockpit_lib_t dirs and files. BZ(1375156)
  - Allow cobblerd_t to delete dirs labeled as tftpdir_rw_t
  - Rename svirt_lxc_net_t to container_t
  - Rename docker.pp to container.pp, causes change in interface name
  - Allow httpd_t domain to list inotify filesystem.
  - Fix couple AVC to start roundup properly
  - Allow dovecot_t send signull to dovecot_deliver_t
  - Add sys_ptrace capability to pegasus domain
  - Allow firewalld to stream connect to NetworkManager. BZ(1380954)
  - rename docker intefaces to container
  - Merge pull request #164 from rhatdan/docker-base
  - Rename docker.pp to container.pp, causes change in interface name
  - Allow gvfs to read /dev/nvme* devices BZ(1380951)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-220
changelog:
  - Disable container_runtime_typebounds() due to typebounds issues which can not be resolved during build.
  - Disable unconfined_typebounds in sandbox.te due to entrypoint check which exceed for sandbox domains unconfined_t domain.
  - Disable unconfined_typebounds due to entrypoint check which exceed for sandbox domains unconfined_t domain.
  - Merge pull request #167 from rhatdan/container
  - Add transition rules for sandbox domains
  - container_typebounds() should be part of sandbox domain template
  - Fix broken container_* interfaces
  - unconfined_typebounds() should be part of sandbox domain template
  - Fixed unrecognized characters at sandboxX module
  - unconfined_typebounds() should be part of sandbox domain template
  - svirt_file_type is atribute no type.
  - Merge pull request #166 from rhatdan/container
  - Allow users to transition from unconfined_t to container types
  - Add dbus_stream_connect_system_dbusd() interface.
  - Merge pull request #152 from rhatdan/network_filetrans
  - Fix typo in filesystem module
  - Allow nss_plugin to resolve host names via the systemd-resolved. BZ(1383473)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-222
changelog:
  - Allow abrt_dump_oops_t to drop capabilities. bz(1391040)
  - Add named_t domain net_raw capability bz(1389240)
  - Allow geoclue to read system info. bz(1389320)
  - Make openfortivpn_t as init_deamon_domain. bz(1159899)
  - Allow nfsd domain to create nfsd_unit_file_t files. bz(1382487)
  - Merge branch 'rawhide-contrib' of github.com:fedora-selinux/selinux-policy into rawhide-contrib
  - Add interace lldpad_relabel_tmpfs
  - Merge pull request #155 from rhatdan/sandbox_nfs
  - Add pscsd_t wake_alarm capability2
  - Allow sandbox domains to mount fuse file systems
  - Add boolean to allow sandbox domains to mount nfs
  - Allow hypervvssd_t to read all dirs.
  - Allow isnsd_t to connect to isns_port_t
  - Merge branch 'rawhide-contrib' of github.com:fedora-selinux/selinux-policy into rawhide-contrib
  - Allow GlusterFS with RDMA transport to be started correctly. It requires ipc_lock capability together with rw permission on rdma_cm device.
  - Make tor_var_lib_t and tor_var_log_t as mountpoints.
  - Allow systemd-rfkill to write to /proc/kmsg bz(1388669)
  - Allow init_t to relabel /dev/shm/lldpad.state
  - Merge pull request #168 from rhatdan/docker
  - Label tcp 51954 as isns_port_t
  - Lots of new domains like OCID and RKT are user container processes


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-223
changelog:
  - nmbd_t needs net_admin capability like smbd
  - Add interface chronyd_manage_pid() Allow logrotate to manage chrony pids
  - Add wake_alarm capability2 to openct_t domain
  - Allow abrt_t to getattr on nsfs_t files.
  - Add cupsd_t domain wake_alarm capability.
  - Allow sblim_reposd_t domain to read cert_f files.
  - Allow abrt_dump_oops_t to drop capabilities. bz(1391040)
  - Revert "Allow abrt_dump_oops_t to drop capabilities. bz(1391040)"
  - Allow isnsd_t to accept tcp connections


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-226
changelog:
  - Adding policy for tlp
  - Add interface  dev_manage_sysfs()
  - Allow ifconfig domain to manage tlp pid files.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-227
changelog:
  - Dontaudit logrotate_t to getattr nsfs_t BZ(1399081)
  - Allow pmie daemon to send signal pcmd daemon BZ(1398078)
  - Allow spamd_t to manage /var/spool/mail. BZ(1398437)
  - Label /run/rpc.statd.lock as rpcd_lock_t and allow rpcd_t domain to manage it. BZ(1397254)
  - Merge pull request #171 from t-woerner/rawhide-contrib
  - Allow firewalld to getattr open search read modules_object_t:dir
  - Allow systemd create /dev/log in own mount-namespace. BZ(1383867)
  - Add interface fs_dontaudit_getattr_nsfs_files()
  - Label /usr/lib/systemd/resolv.conf as lib_t to allow all domains read this file. BZ(1398853)
  - Dontaudit systemd_journal sys_ptrace userns capability. BZ(1374187)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-228
changelog:
  - Fix some boolean descriptions.
  - Add fwupd_dbus_chat() interface
  - Allow tgtd_t domain wake_alarm
  - Merge pull request #172 from vinzent/allow_puppetagent_timedated
  - Dontaudit logrotate_t to getattr nsfs_t BZ(1399081)
  - Allow systemd_machined_t to start unit files labeled as init_var_run_t
  - Add init_manage_config_transient_files() interface
  - In Atomic /usr/local is a soft symlink to /var/usrlocal, so the default policy to apply bin_t on /usr/...bin doesn't work and binaries dumped here get mislabeled as var_t.
  - Allow systemd to raise rlimit to all domains.BZ(1365435)
  - Add interface domain_setrlimit_all_domains() interface
  - Allow staff_t user to chat with fwupd_t domain via dbus
  - Update logging_create_devlog_dev() interface to allow calling domain create also sock_file dev-log. BZ(1393774)
  - Allow systemd-networkd to read network state BZ(1400016)
  - Allow systemd-resolved bind to dns port. BZ(1400023)
  - Allow systemd create /dev/log in own mount-namespace. BZ(1383867)
  - Add interface fs_dontaudit_getattr_nsfs_files()
  - Label /usr/lib/systemd/resolv.conf as lib_t to allow all domains read this file. BZ(1398853)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229
changelog:
  - Label /usr/bin/rpcbind as rpcbind_exec_t. Label /usr/lib/systemd/systemd/rpcbind.service
  - Allot tlp domain to create unix_dgram sockets BZ(1401233)
  - Allow antivirus domain to create lnk_files in /tmp
  - Allow cupsd_t to create lnk_files in /tmp. BZ(1401634)
  - Allow svnserve_t domain to read /dev/random BZ(1401827)
  - Allow lircd to use nsswitch. BZ(1401375)
  - Allow hostname_t domain to manage cluster_tmp_t files


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-230
changelog:
  - Label /usr/bin/rpcbind as rpcbind_exec_t
  - Dontaudit mozilla plugin rawip socket creation. BZ(1275961)
  - Merge pull request #174 from rhatdan/netlink


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-231
changelog:
  - Allow pptp_t to read /dev/random BZ(1404248)
  - Allow glusterd_t send signals to userdomain. Label new glusterd binaries as glusterd_exec_t
  - Allow systemd to stop glusterd_t domains.
  - Merge branch 'rawhide-base' of github.com:fedora-selinux/selinux-policy into rawhide-base
  - Label /usr/sbin/sln as ldconfig_exec_t BZ(1378323)
  - Revert "Allow an domain that has an entrypoint from a type to be allowed to execute the entrypoint without a transition,  I can see no case where this is  a bad thing, and elminiates a whole class of AVCs."


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-232
changelog:
  - Add tlp_var_lib_t label for /var/lib/tlp directory BZ(1409977)
  - Allow tlp_t domain to read proc_net_t BZ(1403487)
  - Merge pull request #179 from rhatdan/virt1
  - Allow tlp_t domain to read/write cpu microcode BZ(1403103)
  - Allow virt domain to use interited virtlogd domains fifo_file
  - Fixes for containers
  - Allow glusterd_t to bind on glusterd_port_t udp ports.
  - Update ctdbd_t policy to reflect all changes.
  - Allow ctdbd_t domain transition to rpcd_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-233
changelog:
  -Allow thumb domain sendto via dgram sockets. BZ(1398813)
  - Add condor_procd_t domain sys_ptrace cap_userns BZ(1411077)
  - Allow cobbler domain to create netlink_audit sockets BZ(1384600)
  - Allow networkmanager to manage networkmanager_var_lib_t lnk files BZ(1408626)
  - Add dhcpd_t domain fowner capability BZ(1409963)
  - Allow thumb to create netlink_kobject_uevent sockets. BZ(1410942)
  - Fix broken interfaces
  - Allow setfiles_t domain rw inherited kdumpctl tmp pipes BZ(1356456)
  - Allow user_t run systemctl --user BZ(1401625)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-234
changelog:
  - After the latest changes in nfsd. We should allow nfsd_t to read raw fixed disk. For more info see: BZ(1403017)
  - Tighten security on containe types
  - Make working cracklib_password_check for MariaDB service
  - Label 20514 tcp/udp ports as syslogd_port_t Label 10514 tcp/udp portas as syslog_tls_port_t BZ(1410505)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-235
changelog:
  - Allow libvirt daemon to create /var/chace/libvirt dir.
  - Allow systemd using ProtectKernelTunables securit feature. BZ(1392161)
  - F26 Wide change: Coredumps enabled by default. Allowing inherits process limits to enable coredumps.BZ(1341829)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-236
changelog:
  - Allow kdumpgui domain to read nvme device
  - Add amanda_tmpfs_t label. BZ(1243752)
  - Fix typo in sssd interface file
  - Allow sssd_t domain setpgid BZ(1411437)
  - Allow ifconfig_t domain read nsfs_t
  - Allow ping_t domain to load kernel modules.
  - Allow systemd to send user information back to pid1. BZ(1412750)
  - rawhide-base: Fix wrong type/attribute flavors in require blocks


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-237
changelog:
  - Merge pull request #187 from rhatdan/container-selinux
  - Allow rhsmcertd domain signull kernel.
  - Allow container-selinux to handle all policy for container processes
  - Fix label for nagios plugins in nagios file conxtext file
  - su using libselinux and creating netlink_selinux socket is needed to allow libselinux initialization. Resolves: rhbz#1146987
  - Add SELinux support for systemd-initctl daemon
  - Add SELinux support for systemd-bootchart
  - su using libselinux and creating netlink_selinux socket is needed to allow libselinux initialization. Resolves: rhbz#1146987
  - Add module_load permission to can_load_kernmodule
  - Add module_load permission to class system
  - Add the validate_trans access vector to the security class
  - Restore connecto permssions for init_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-238
changelog:
  - Allow shiftfs to use xattr SELinux labels
  - Fix ssh_server_template by add sshd_t to require section.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-240
changelog:
  - Dontaudit xdm_t wake_alarm capability2
  - Allow systemd_initctl_t to create and connect unix_dgram sockets
  - Allow ifconfig_t to mount/unmount nsfs_t filesystem
  - Add interfaces allowing mount/unmount nsfs_t filesystem
  - Label /usr/lib/libGLdispatch.so.0.0.0 as textrel_shlib_t BZ(1419944)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-241
changelog:
  - Remove ganesha from gluster module and create own module for ganesha
  - FIx label for /usr/lib/libGLdispatch.so.0.0.0


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-242
changelog:
  - Add radius_use_jit boolean
  - Allow nfsd_t domain to create sysctls_rpc_t files
  - add the policy required for nextcloud
  - Allow can_load_kernmodule to load kernel modules. BZ(1426741)
  - Create kernel_create_rpc_sysctls() interface


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-244
changelog:
  - Update fwupd policy
  - /usr/libexec/udisks2/udisksd should be labeled as devicekit_disk_exec_t
  - Update ganesha policy
  - Allow chronyd to read adjtime
  - Merge pull request #194 from hogarthj/certbot_policy
  - get the correct cert_t context on certbot certificates bz#1289778
  - Label /dev/ss0 as gpfs_device_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-245
changelog:
  - Allow vdagent domain to getattr cgroup filesystem
  - Allow abrt_dump_oops_t stream connect to sssd_t domain
  - Allow cyrus stream connect to gssproxy
  - Label /usr/libexec/cockpit-ssh as cockpit_session_exec_t and allow few rules
  - Allow colord_t to read systemd hwdb.bin file
  - Allow dirsrv_t to create /var/lock/dirsrv labeled as dirsrc_var_lock_t
  - Allow certmonger to manage /etc/krb5kdc_conf_t
  - Allow kdumpctl to getenforce
  - Allow ptp4l wake_alarm capability
  - Allow ganesha to chat with unconfined domains via dbus
  - Add nmbd_t capability2 block_suspend
  - Add domain transition from sosreport_t to iptables_t
  - Dontaudit init_t to mounton modules_object_t
  - Add interface files_dontaudit_mounton_modules_object
  - Allow xdm_t to execute files labeled as xdm_var_lib_t
  - Make mtrr_device_t mountpoint.
  - Fix path to /usr/lib64/erlang/erts-5.10.4/bin/epmd


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-246
changelog:
  - Label all files containing hostname substring in /etc/ created by systemd_hostnamed_t as hostname_etc_t. BZ(1433555)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-247
changelog:
  - Make fwupd_var_lib_t type mountpoint. BZ(1429341)
  - Remove tomcat_t domain from unconfined domains
  - Create new boolean: sanlock_enable_home_dirs()
  - Allow mdadm_t domain to read/write nvme_device_t
  - Remove httpd_user_*_content_t domains from user_home_type attribute. This tighten httpd policy and acces to user data will be more strinct, and also fix mutual influente between httpd_enable_homedirs and httpd_read_user_content
  - Add interface dev_rw_nvme
  - Label all files containing hostname substring in /etc/ created by systemd_hostnamed_t as hostname_etc_t. BZ(1433555)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-249
changelog:
  - Merge pull request #4 from lslebodn/sssd_socket_activated
  - Remove /proc <<none>> from fedora policy, it's no longer necessary
  - Allow iptables get list of kernel modules
  - Allow unconfined_domain_type to enable/disable transient unit
  - Add interfaces init_enable_transient_unit() and init_disable_transient_unit
  - Revert "Allow sshd setcap capability. This is needed due to latest changes in sshd"
  - Label sysroot dir under ostree as root_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-250
changelog:
  - Allow tlp_t domain to ioctl removable devices BZ(1436830)
  - Allow tlp_t domain domtrans into mount_t BZ(1442571)
  - Allow lircd_t to read/write to sysfs BZ(1442443)
  - Fix policy to reflect all changes in new IPA release
  - Allow virtlogd_t to creating tmp files with virt_tmp_t labels.
  - Allow sbd_t to read/write fixed disk devices
  - Add sys_ptrace capability to radiusd_t domain
  - Allow cockpit_session_t domain connects to ssh tcp ports.
  - Update tomcat policy to make working ipa install process
  - Allow pcp_pmcd_t net_admin capability. Allow pcp_pmcd_t read net sysctls Allow system_cronjob_t create /var/run/pcp with pcp_var_run_t
  - Fix all AVC denials during pkispawn of CA Resolves: rhbz#1436383
  - Update pki interfaces and tomcat module
  - Allow sendmail to search network sysctls
  - Add interface gssd_noatsecure()
  - Add interface gssproxy_noatsecure()
  - Allow chronyd_t net_admin capability to allow support HW timestamping.
  - Update tomcat policy.
  - Allow certmonger to start haproxy service
  - Fix init Module
  - Make groupadd_t domain as system bus client BZ(1416963)
  - Make useradd_t domain as system bus client BZ(1442572)
  - Allow xdm_t to gettattr /dev/loop-control device BZ(1385090)
  - Dontaudit gdm-session-worker to view key unknown. BZ(1433191)
  - Allow init noatsecure for gssd and gssproxy
  - Allow staff user to read fwupd_cache_t files
  - Remove typo bugs
  - Remove /proc <<none>> from fedora policy, it's no longer necessary


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-253
changelog:
  - auth_use_nsswitch can call only domain not attribute
  - Dontaudit net_admin cap for winbind_t
  - Allow tlp_t domain to stream connect to system bus
  - Allow tomcat_t domain read pki_common_t files
  - Add interface pki_read_common_files()
  - Fix broken cermonger module
  - Fix broken apache module
  - Allow hypervkvp_t domain execute hostname
  - Dontaudit sssd_selinux_manager_t use of net_admin capability
  - Allow tomcat_t stream connect to pki_common_t
  - Dontaudit xguest_t's attempts to listen to its tcp_socket
  - Allow sssd_selinux_manager_t to ioctl init_t sockets
  - Improve ipa_cert_filetrans_named_content() interface to also allow caller domain manage ipa_cert_t type.
  - Allow pki_tomcat_t domain read /etc/passwd.
  - Allow tomcat_t domain read ipa_tmp_t files
  - Label new path for ipa-otpd
  - Allow radiusd_t domain stream connect to postgresql_t
  - Allow rhsmcertd_t to execute hostname_exec_t binaries.
  - Allow virtlogd to append nfs_t files when virt_use_nfs=1
  - Allow httpd_t domain read also httpd_user_content_type lnk_files.
  - Allow httpd_t domain create /etc/httpd/alias/ipaseesion.key with label ipa_cert_t
  - Dontaudit <user>_gkeyringd_t stream connect to system_dbusd_t
  - Label /var/www/html/nextcloud/data as httpd_sys_rw_content_t
  - Add interface ipa_filetrans_named_content()
  - Allow tomcat use nsswitch
  - Allow certmonger_t start/status generic services
  - Allow dirsrv read cgroup files.
  - Allow ganesha_t domain read/write infiniband devices.
  - Allow sendmail_t domain sysctl_net_t files
  - Allow targetd_t domain read network state and getattr on loop_control_device_t
  - Allow condor_schedd_t domain send mails.
  - Allow ntpd to creating sockets. BZ(1434395)
  - Alow certmonger to create own systemd unit files.
  - Add kill namespace capability to xdm_t domain
  - Revert "su using libselinux and creating netlink_selinux socket is needed to allow libselinux initialization."
  - Revert "Allow <role>_su_t to create netlink_selinux_socket"
  - Allow <role>_su_t to create netlink_selinux_socket
  - Allow unconfined_t to module_load any file
  - Allow staff to systemctl virt server when staff_use_svirt=1
  - Allow unconfined_t create /tmp/ca.p12 file with ipa_tmp_t context
  - Allow netutils setpcap capability
  - Dontaudit leaked file descriptor happening in setfiles_t domain BZ(1388124)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-254
changelog:
  - Allow svirt_t to read raw fixed_disk_device_t to make working blockcommit
  - ejabberd small fixes
  - Update targetd policy to accommodate changes in the service
  - Allow tomcat_domain connect to    * postgresql_port_t    * amqp_port_t Allow tomcat_domain read network sysctls
  - Allow virt_domain to read raw fixed_disk_device_t to make working blockcommit
  - Allow glusterd_t domain start ganesha service
  - Made few cosmetic changes in sssd SELinux module
  - Merge pull request #11 from lslebodn/sssd_kcm
  - Update virt_rw_stream_sockets_svirt() interface to allow confined users set socket options.
  - Allow keepalived_t domain read usermodehelper_t
  - Allow radius domain stream connec to postgresql
  - Merge pull request #8 from bowlofeggs/142-rawhide
  - Add fs_manage_configfs_lnk_files() interface


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-255
changelog:
  - Dontaudit net_admin capability for domains postfix_master_t and postfix_qmgr_t
  - Add interface pki_manage_common_files()
  - Allow rngd domain read sysfs_t
  - Allow tomcat_t domain to manage pki_common_t files and dirs
  - Merge pull request #3 from rhatdan/devicekit
  - Merge pull request #12 from lslebodn/sssd_sockets_fc
  - Allow certmonger reads httpd_config_t files
  - Allow keepalived_t domain creating netlink_netfilter_socket.
  - Use stricter fc rules for sssd sockets in /var/run
  - Allow tomcat domain read rpm_var_lib_t files Allow tomcat domain exec rpm_exec_t files Allow tomcat domain name connect on oracle_port_t Allow tomcat domain read cobbler_var_lib_t files.
  - Allow sssd_t domain creating sock files labeled as sssd_var_run_t in /var/run/
  - Allow svirt_t to read raw fixed_disk_device_t to make working blockcommit
  - ejabberd small fixes
  - Update targetd policy to accommodate changes in the service
  - Allow tomcat_domain connect to    * postgresql_port_t    * amqp_port_t Allow tomcat_domain read network sysctls
  - Allow virt_domain to read raw fixed_disk_device_t to make working blockcommit
  - Dontaudit net_admin capability for useradd_t domain
  - Allow systemd_localed_t and systemd_timedated_t create files in /etc with label locate_t BZ(1443723)
  - Make able deply overcloud via neutron_t to label nsfs as fs_t
  - Add fs_manage_configfs_lnk_files() interface


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-256
changelog:
  - Allow keepalived domain connect to squid tcp port
  - Allow krb5kdc_t domain read realmd lib files.
  - Allow tomcat to connect on all unreserved ports
  - Allow keepalived domain connect to squid tcp port
  - Allow krb5kdc_t domain read realmd lib files.
  - Allow tomcat to connect on all unreserved ports
  - Allow ganesha to connect to all rpc ports
  - Update ganesha with few allow rules
  - Update rpc_read_nfs_state_data() interface to allow read also lnk_files.
  - virt_use_glusterd boolean should be in optional block
  - Add new boolean virt_use_glusterd
  - Add capability sys_boot for sbd_t domain Allow sbd_t domain to create rpc sysctls.
  - Allow ganesha_t domain to manage glusterd_var_run_t pid files.
  - Create new interface: glusterd_read_lib_files() Allow ganesha read glusterd lib files. Allow ganesha read network sysctls
  - Add few allow rules to ganesha module
  - Allow condor_master_t to read sysctls.
  - Add dac_override cap to ctdbd_t domain
  - Add ganesha_use_fusefs boolean.
  - Allow httpd_t reading kerberos kdc config files
  - Allow tomcat_t domain connect to ibm_dt_2 tcp port.
  - Allow stream connect to initrc_t domains
  - Add pki_exec_common_files() interface
  - Allow  dnsmasq_t domain to read systemd-resolved pid files.
  - Allow tomcat domain name_bind on tcp bctp_port_t
  - Allow smbd_t domain generate debugging files under /var/run/gluster. These files are created through the libgfapi.so library that provides integration of a GlusterFS client in the Samba (vfs_glusterfs) process.
  - Allow condor_master_t write to sysctl_net_t
  - Allow nagios check disk plugin read /sys/kernel/config/
  - Allow pcp_pmie_t domain execute systemctl binary
  - Allow nagios to connect to stream sockets. Allow nagios start httpd via systemctl
  - xdm_t should view kernel keys
  - Hide broken symptoms when machine is configured with network bounding.
  - Label 8750 tcp/udp port as dey_keyneg_port_t
  - Label tcp/udp port 1792 as ibm_dt_2_port_t
  - Add interface fs_read_configfs_dirs()
  - Add interface fs_read_configfs_files()
  - Fix systemd_resolved_read_pid interface
  - Add interface systemd_resolved_read_pid()
  - Allow sshd_net_t domain read/write into crypto devices
  - Label 8999 tcp/udp as bctp_port_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-257
changelog:
  - Merge pull request #10 from mscherer/fix_tor_dac
  - Merge pull request #9 from rhatdan/rawhide
  - Merge pull request #13 from vinzent/allow_zabbix_t_to_kill_zabbix_script_t
  - Allow kdumpgui to read removable disk device
  - Allow systemd_dbusd_t domain read/write to nvme devices
  - Allow udisks2 domain to read removable devices BZ(1443981)
  - Allow virtlogd_t to execute itself
  - Allow keepalived to read/write usermodehelper state
  - Allow named_t to bind on udp 4321 port
  - Fix interface tlp_manage_pid_files()
  - Allow collectd domain read lvm config files. BZ(1459097)
  - Merge branch 'rawhide' of github.com:wrabcak/selinux-policy-contrib into rawhide
  - Allow samba_manage_home_dirs boolean to manage user content
  - Merge pull request #14 from lemenkov/rabbitmq_systemd_notify
  - Allow pki_tomcat_t execute ldconfig.
  - Merge pull request #191 from rhatdan/udev
  - Allow systemd_modules_load_t to load modules


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-258
changelog:
  - Allow rpcbind_t to execute systemd_tmpfiles_exec_t binary files.
  - Merge branch 'rawhide' of github.com:wrabcak/selinux-policy-contrib into rawhide
  - Allow qemu to authenticate SPICE connections with SASL GSSAPI when SSSD is in use
  - Fix dbus_dontaudit_stream_connect_system_dbusd() interface to require TYPE rather than ATTRIBUTE for systemd_dbusd_t.
  - Allow httpd_t to read realmd_var_lib_t files
  - Allow unconfined_t user all user namespace capabilties.
  - Add interface systemd_tmpfiles_exec()
  - Add interface libs_dontaudit_setattr_lib_files()
  - Dontaudit xdm_t domain to setattr on lib_t dirs
  - Allow sysadm_r role to jump into dirsrv_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-260
changelog:
  - Allow sssd_t to read realmd lib files.
  - Fix init interface file. init_var_run_t is type not attribute


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-261
changelog:
  - Allow boinc_t nsswitch
  - Dontaudit firewalld to write to lib_t dirs
  - Allow modemmanager_t domain to write to raw_ip file labeled as sysfs_t
  - Allow thumb_t domain to allow create dgram sockets
  - Disable mysqld_safe_t secure mode environment cleansing
  - Allow couple rules needed to start targetd daemon with SELinux in enforcing mode
  - Allow dirsrv domain setrlimit
  - Dontaudit staff_t user read admin_home_t files.
  - Add interface lvm_manage_metadata
  - Add permission open to files_read_inherited_tmp_files() interface


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-262
changelog:
  - Allow cluster_t and glusterd_t domains to dbus chat with ganesha service
  - Allow iptables to read container runtime files


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-265
changelog:
  - Allow llpdad send dgram to libvirt
  - Allow abrt_t domain dac_read_search capability
  - Allow init_t domain mounton dirs labeled as init_var_lib_t BZ(1471476)
  - Allow xdm_t domain read unique machine-id generated during system installation. BZ(1467036)
  - Dontaudit xdm_t to setattr lib_t dirs. BZ(#1458518)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-267
changelog:
  - After fix in kernel where LSM hooks for dac_override and dac_search_read capability was swaped we need to fix it also in policy


author: Petr Lautrbach <plautrba@redhat.com> - 3.13.1-268
changelog:
  - Update for SELinux userspace release 20170804 / 2.7
  - Omit precompiled regular expressions from file_contexts.bin files


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-269
changelog:
  - Allow osad make executable an anonymous mapping or private file mapping that is writable BZ(1425524)
  - After fix in kernel where LSM hooks for dac_override and dac_search_read capability was swaped we need to fix it also in policy
  - refpolicy: Define and allow map permission
  - init: Add NoNewPerms support for systemd.
  - Add nnp_nosuid_transition policycap and related class/perm definitions.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-271
changelog:
  - Allow tomcat_t domain couple capabilities to make working tomcat-jsvc
  - Label /usr/libexec/sudo/sesh as shell_exec_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-272
changelog:
  - Allow sssd_t domain to map sssd_var_lib_t files
  - allow map permission where needed
  - contrib: allow map permission where needed
  - Allow syslogd_t to map syslogd_var_run_t files
  - allow map permission where needed


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-273
changelog:
  - Allow dirsrv_t domain use mmap on files labeled as dirsrv_var_run_t BZ(1483170)
  - Allow just map permission insead of using mmap_file_pattern because mmap_files_pattern allows also executing objects.
  - Label /var/run/agetty.reload as getty_var_run_t
  - Add missing filecontext for sln binary
  - Allow systemd to read/write to event_device_t BZ(1471401)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-274
changelog:
  - Allow postgrey to execute bin_t files and add postgrey into nsswitch_domain
  - Allow nscd_t domain to search network sysctls
  - Allow iscsid_t domain to read mount pid files
  - Allow ksmtuned_t domain manage sysfs_t files/dirs
  - Allow keepalived_t domain domtrans into iptables_t
  - Allow rshd_t domain reads net sysctls
  - Allow systemd to create syslog netlink audit socket
  - Allow ifconfig_t domain unmount fs_t
  - Label /dev/gpiochip* devices as gpio_device_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-275
changelog:
  - Make confined users working
  - Allow ipmievd_t domain to load kernel modules
  - Allow logrotate to reload transient systemd unit


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-277
changelog:
  - Allow cupsd_t to execute ld_so_cache
  - Add cgroup_seclabel policycap.
  - Allow xdm_t to read systemd hwdb
  - Add new interface systemd_hwdb_mmap_config()
  - Allow auditd_t domain to mmap conf files labeled as auditd_etc_t BZ(1485050)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-278
changelog:
  - Add couple rules related to map permissions
  - Allow ddclient use nsswitch BZ(1456241)
  - Allow thumb_t domain getattr fixed_disk device. BZ(1379137)
  - Add interface dbus_manage_session_tmp_dirs()
  - Dontaudit useradd_t sys_ptrace BZ(1480121)
  - Allow ipsec_t can exec ipsec_exec_t
  - Allow systemd_logind_t to mamange session_dbusd_tmp_t dirs


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-279
changelog:
  - Allow abrt_dump_oops_t to read sssd_public_t files
  - Allow cockpit_ws_t to mmap usr_t files
  - Allow systemd to read/write dri devices.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-280
changelog:
  - Add rules fixing installing ipa-server-install with SELinux in Enforcing. BZ(1488404)
  - Fix denials during ipa-server-install process on F27+
  - Allow httpd_t to mmap cert_t
  - Add few rules to make tlp_t domain working in enforcing mode
  - Allow cloud_init_t to dbus chat with systemd_timedated_t
  - Allow logrotate_t to write to kmsg
  - Add capability kill to rhsmcertd_t
  - Allow winbind to manage smbd_tmp_t files
  - Allow groupadd_t domain to dbus chat with systemd.BZ(1488404)
  - Add interface miscfiles_map_generic_certs()


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-282
changelog:
  - Add new bunch of map rules
  - Merge pull request #25 from NetworkManager/nm-ovs
  - Make working webadm_t userdomain
  - Allow redis domain to execute shell scripts.
  - Allow system_cronjob_t to create redhat-access-insights.log with var_log_t
  - Add couple capabilities to keepalived domain and allow get attributes of all domains
  - Allow dmidecode read rhsmcertd lock files
  - Add new interface rhsmcertd_rw_lock_files()
  - Add new bunch of map rules
  - Merge pull request #199 from mscherer/add_conntrackd
  - Add support labeling for vmci and vsock device
  - Add userdom_dontaudit_manage_admin_files() interface


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-283
changelog:
  - Allow passwd_t domain mmap /etc/shadow and /etc/passwd
  - Allow pulseaudio_t domain to map user tmp files
  - Allow mozilla plugin to mmap mozilla tmpfs files


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-284
changelog:
  - Allow mozilla_plugins_t domain mmap mozilla_plugin_tmpfs_t files
  - Allow automount domain to manage mount pid files
  - Allow stunnel_t domain setsched
  - Add keepalived domain setpgid capability
  - Merge pull request #24 from teg/rawhide
  - Merge pull request #28 from lslebodn/revert_1e8403055
  - Allow sysctl_irq_t assciate with proc_t
  - Enable cgourp sec labeling
  - Allow sshd_t domain to send signull to xdm_t processes


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-286
changelog:
  - Add new boolean tomcat_read_rpm_db()
  - Allow tomcat to connect on mysqld tcp ports
  - Add new interface apache_delete_tmp()
  - Add interface fprintd_exec()
  - Add interface fprintd_mounton_var_lib()
  - Allow mozilla plugin to mmap video devices BZ(1492580)
  - Add ctdbd_t domain sys_source capability and allow setrlimit
  - Allow systemd-logind to use ypbind
  - Allow systemd to remove apache tmp files
  - Allow ldconfig domain to mmap ldconfig cache files
  - Allow systemd to exec fprintd BZ(1491808)
  - Allow systemd to mounton fprintd lib dir


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-287
changelog:
  - Allow init noatsecure httpd_t
  - Allow mysqld_t domain to mmap mysqld db files. BZ(1483331)
  - Allow unconfined_t domain to create new users with proper SELinux lables
  -  Allow init noatsecure httpd_t
  - Label tcp port 3269 as ldap_port_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-289
changelog:
  - Allow tlp_t domain stream connect to sssd_t domain
  - Add missing dac_override capability
  - Add systemd_tmpfiles_t dac_override capability


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-290
changelog:
  - Allow virtlogd_t domain to write inhibit systemd pipes.
  - Add dac_override capability to openvpn_t domain
  - Add dac_override capability to xdm_t domain
  - Allow dac_override to groupadd_t domain BZ(1497081)
  - Allow cloud-init to create /var/run/cloud-init dir with net_conf_t SELinux label.BZ(1489166)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-292
changelog:
  - Allow cupsd_t to execute ld_so_cache_t BZ(1478602)
  - Allow firewalld_t domain to change object identity because of relabeling after using firewall-cmd BZ(1469806)
  - Allow postfix_cleanup_t domain to stream connect to all milter sockets BZ(1436026)
  - Allow nsswitch_domain to read virt_var_lib_t files, because of libvirt NSS plugin. BZ(1487531)
  - Add unix_stream_socket recvfrom perm for init_t domain BZ(1496318)
  - Allow systemd to maange sysfs BZ(1471361)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-294
changelog:
  - Allow cloud-init to create content in /var/run/cloud-init
  - Dontaudit VM to read gnome-boxes process data BZ(1415975)
  - Allow winbind_t domain mmap samba_var_t files
  - Allow cupsd_t to execute ld_so_cache_t BZ(1478602)
  - Update dev_rw_xserver_misc() interface to allo source domains to mmap xserver devices BZ(1334035)
  - Add dac_override capability to groupadd_t domain BZ(1497091)
  - Allow unconfined_service_t to start containers


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-295
changelog:
  - Allow boinc_t to mmap files with label boinc_project_var_lib_t BZ(1500088)
  - Allow fail2ban_t domain to mmap journals. BZ(1500089)
  - Add dac_override to abrt_t domain BZ(1499860)
  - Allow pppd domain to mmap own pid files BZ(1498587)
  - Allow webserver services to mmap files with label httpd_sys_content_t BZ(1498451)
  - Allow tlp domain to read sssd public files Allow tlp domain to mmap kernel modules
  - Allow systemd to read sysfs sym links. BZ(1499327)
  - Allow systemd to mmap systemd_networkd_exec_t files BZ(1499863)
  - Make systemd_networkd_var_run as mountpoint BZ(1499862)
  - Allow noatsecure for java-based unconfined services. BZ(1358476)
  - Allow systemd_modules_load_t domain to mmap kernel modules. BZ(1490015)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-296
changelog:
  - Merge pull request #19 from RodrigoQuesadaDev/snapper-fix-1
  - Allow httpd_t domain to mmap httpd_user_content_t files. BZ(1494852)
  - Add nnp transition rule for services using NoNewPrivileges systemd feature
  - Add map permission into dev_rw_infiniband_dev() interface to allow caller domain mmap infiniband chr device BZ(1500923)
  - Add init_nnp_daemon_domain interface
  - Allow nnp transition capability
  - Merge pull request #204 from konradwilk/rhbz1484908
  - Label postgresql-check-db-dir as postgresql_exec_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-297
changelog:
  - Fix typo in virt file contexts file
  - allow ipa_dnskey_t to read /proc/net/unix file
  - Allow openvswitch to run setfiles in setfiles_t domain.
  - Allow openvswitch_t domain to read process data of neutron_t domains
  - Fix typo in ipa_cert_filetrans_named_content() interface
  - Fix typo bug in summary of xguest SELinux module
  - Allow virtual machine with svirt_t label to stream connect to openvswitch.
  - Label qemu-pr-helper script as virt_exec_t so this script won't run as unconfined_service_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-298
changelog:
  - Drop *.lst files from file list
  - Ship file_contexts.homedirs in store
  - Allow proper transition when systems starting pdns to pdns_t domain. BZ(1305522)
  - Allow haproxy daemon to reexec itself. BZ(1447800)
  - Allow conmand to use usb ttys.
  - Allow systemd_machined to read mock lib files. BZ(1504493)
  - Allow systemd_resolved_t to dbusd chat with NetworkManager_t BZ(1505081)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-299
changelog:
  - Label /usr/libexec/bluetooth/obexd as bluetoothd_exec_t to run process as bluetooth_t
  - Allow chronyd_t do request kernel module and block_suspend capability
  - Allow system_cronjob_t to create /var/lib/letsencrypt dir with right label
  - Allow slapd_t domain to mmap files labeled as slpad_db_t BZ(1505414)
  - Allow dnssec_trigger_t domain to execute binaries with dnssec_trigeer_exec_t BZ(1487912)
  - Allow l2tpd_t domain to send SIGKILL to ipsec_mgmt_t domains BZ(1505220)
  - Allow thumb_t creating thumb_home_t files in user_home_dir_t direcotry BZ(1474110)
  - Allow httpd_t also read httpd_user_content_type dirs when httpd_enable_homedirs is enables
  - Allow svnserve to use kerberos
  - Allow conman to use ptmx. Add conman_use_nfs boolean
  - Allow nnp transition for amavis and tmpreaper SELinux domains
  - Allow chronyd_t to mmap chronyc_exec_t binary files
  - Add dac_read_search capability to openvswitch_t domain
  - Allow svnserve to manage own svnserve_log_t files/dirs
  - Allow keepalived_t to search network sysctls
  - Allow puppetagent_t domain dbus chat with rhsmcertd_t domain
  - Add kill capability to openvswitch_t domain
  - Label also compressed logs in /var/log for different services
  - Allow inetd_child_t and system_cronjob_t to run chronyc.
  - Allow chrony to create netlink route sockets
  - Add SELinux support for chronyc
  - Add support for running certbot(letsencrypt) in crontab
  - Allow nnp trasintion for unconfined_service_t
  - Allow unpriv user domains and unconfined_service_t to use chronyc


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-300
changelog:
  - Allow zabbix_t domain to change its resource limits
  - Add new boolean nagios_use_nfs
  - Allow system_mail_t to search network sysctls
  - Hide all allow rules with ptrace inside deny_ptrace boolean
  - Allow nagios_script_t to read nagios_spool_t files
  - Allow sbd_t to create own sbd_tmpfs_t dirs/files
  - Allow firewalld and networkmanager to chat with hypervkvp via dbus
  - Allow dmidecode to read rhsmcert_log_t files
  - Allow mail system to connect mariadb sockets.
  - Allow nmbd_t domain to mmap files labeled as samba_var_t. BZ(1505877)
  - Make user account setup in gnome-initial-setup working in Workstation Live system. BZ(1499170)
  - Allow iptables_t to run setfiles to restore context on system
  - Updatre unconfined_dontaudit_read_state() interface to dontaudit also acess to files. BZ(1503466)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-301
changelog:
  - Merge pull request #37 from milosmalik/rawhide
  - Allow mozilla_plugin_t domain to dbus chat with devicekit
  - Dontaudit leaked logwatch pipes
  - Label /usr/bin/VGAuthService as vmtools_exec_t to confine this daemon.
  - Allow httpd_t domain to execute hugetlbfs_t files BZ(1444546)
  - Allow chronyd daemon to execute chronyc. BZ(1507478)
  - Allow pdns to read network system state BZ(1507244)
  - Allow gssproxy to read network system state Resolves: rhbz#1507191
  - Allow nfsd_t domain to read configfs_t files/dirs
  - Allow tgtd_t domain to read generic certs
  - Allow ptp4l to send msgs via dgram socket to unprivileged user domains
  - Allow dirsrv_snmp_t to use inherited user ptys and read system state
  - Allow glusterd_t domain to create own tmpfs dirs/files
  - Allow keepalived stream connect to snmp


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-302
changelog:
  - Allow jabber domains to connect to postgresql ports
  - Dontaudit slapd_t to block suspend system
  - Allow spamc_t to stream connect to cyrys.
  - Allow passenger to connect to mysqld_port_t
  - Allow ipmievd to use nsswitch
  - Allow chronyc_t domain to use user_ptys
  - Label all files /var/log/opensm.* as opensm_log_t because opensm creating new log files with name opensm-subnet.lst
  - Fix typo bug in tlp module
  - Allow userdomain gkeyringd domain to create stream socket with userdomain


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-303
changelog:
  - Allow pcp_pmlogger to send logs to journal BZ(1512367)
  - Merge pull request #40 from lslebodn/kcm_kerberos
  - Allow services to use kerberos KCM BZ(1512128)
  - Allow system_mail_t domain to be system_dbus_client BZ(1512476)
  - Allow aide domain to stream connect to sssd_t BZ(1512500)
  - Allow squid_t domain to mmap files with label squid_tmpfs_t BZ(1498809)
  - Allow nsd_t domain to mmap files with labels nsd_tmp_t and nsd_zone_t BZ(1511269)
  - Include cupsd_config_t domain into cups_execmem boolean. BZ(1417584)
  - Allow samba_net_t domain to mmap samba_var_t files BZ(1512227)
  - Allow lircd_t domain to execute shell BZ(1512787)
  - Allow thumb_t domain to setattr on cache_home_t dirs BZ(1487814)
  - Allow redis to creating tmp files with own label BZ(1513518)
  - Create new interface thumb_nnp_domtrans allowing domaintransition with NoNewPrivs. This interface added to thumb_run() BZ(1509502)
  - Allow httpd_t to mmap httpd_tmp_t files BZ(1502303)
  - Add map permission to samba_rw_var_files interface. BZ(1513908)
  - Allow cluster_t domain creating bundles directory with label var_log_t instead of cluster_var_log_t
  - Add dac_read_search and dac_override capabilities to ganesha
  - Allow ldap_t domain to manage also slapd_tmp_t lnk files
  - Allow snapperd_t domain to relabeling from snapperd_data_t BZ(1510584)
  - Add dac_override capability to dhcpd_t doamin BZ(1510030)
  - Allow snapperd_t to remove old snaps BZ(1510862)
  - Allow chkpwd_t domain to mmap system_db_t files and be dbus system client BZ(1513704)
  - Allow xdm_t send signull to all xserver unconfined types BZ(1499390)
  - Allow fs associate for sysctl_vm_t BZ(1447301)
  - Label /etc/init.d/vboxdrv as bin_t to run virtualbox as unconfined_service_t BZ(1451479)
  - Allow xdm_t domain to read usermodehelper_t state BZ(1412609)
  - Allow dhcpc_t domain to stream connect to userdomain domains BZ(1511948)
  - Allow systemd to mmap kernel modules BZ(1513399)
  - Allow userdomains to mmap fifo_files BZ(1512242)
  - Merge pull request #205 from rhatdan/labels
  - Add map permission to init_domtrans() interface BZ(1513832)
  - Allow xdm_t domain to mmap and execute files in xdm_var_run_t BZ(1513883)
  - Unconfined domains, need to create content with the correct labels
  - Container runtimes are running iptables within a different user namespace
  - Add interface files_rmdir_all_dirs()


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-304
changelog:
  - Add interface raid_relabel_mdadm_var_run_content()
  - Fix iscsi SELinux module
  - Allow spamc_t domain to read home mail content BZ(1414366)
  - Allow sendmail_t to list postfix config dirs BZ(1514868)
  - Allow dovecot_t domain to mmap mail content in homedirs BZ(1513153)
  - Allow iscsid_t domain to requesting loading kernel modules BZ(1448877)
  - Allow svirt_t domain to mmap svirt_tmpfs_t files BZ(1515304)
  - Allow cupsd_t domain to localization BZ(1514350)
  - Allow antivirus_t nnp domain transition because of systemd security features. BZ(1514451)
  - Allow tlp_t domain transition to systemd_rfkill_t domain BZ(1416301)
  - Allow abrt_t domain to mmap fusefs_t files BZ(1515169)
  - Allow memcached_t domain nnp_transition becuase of systemd security features BZ(1514867)
  - Allow httpd_t domain to mmap all httpd content type BZ(1514866)
  - Allow mandb_t to read /etc/passwd BZ(1514903)
  - Allow mandb_t domain to mmap files with label mandb_cache_t BZ(1514093)
  - Allow abrt_t domain to mmap files with label syslogd_var_run_t BZ(1514975)
  - Allow nnp transition for systemd-networkd daemon to run in proper SELinux domain BZ(1507263)
  - Allow systemd to read/write to mount_var_run_t files BZ(1515373)
  - Allow systemd to relabel mdadm_var_run_t sock files BZ(1515373)
  - Allow home managers to mmap nfs_t files BZ(1514372)
  - Add interface fs_mmap_nfs_files()
  - Allow systemd-mount to create new directory for mountpoint BZ(1514880)
  - Allow getty to use usbttys
  - Add interface systemd_rfkill_domtrans()
  - Allow syslogd_t to mmap files with label syslogd_var_lib_t BZ(1513403)
  - Add interface fs_mmap_fusefs_files()
  - Allow ipsec_t domain to mmap files with label ipsec_key_file_t BZ(1514251)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-306
changelog:
  - Allow thumb_t domain to dosfs_t BZ(1517720)
  - Allow gssd_t to read realmd_var_lib_t files BZ(1521125)
  - Allow domain transition from logrotate_t to chronyc_t BZ(1436013)
  - Allow git_script_t to mmap git_sys_content_t BZ(1517541)
  - Label /usr/bin/mysqld_safe_helper as mysqld_exec_t instead of bin_t BZ(1464803)
  - Label /run/openvpn-server/ as openvpn_var_run_t BZ(1478642)
  - Allow colord_t to mmap xdm pid files BZ(1518382)
  - Allow arpwatch to mmap usbmon device BZ(152456)
  - Allow mandb_t to read public sssd files BZ(1514093)
  - Allow ypbind_t stream connect to rpcbind_t domain BZ(1508659)
  - Allow qpid to map files.
  - Allow plymouthd_t to mmap firamebuf device BZ(1517405)
  - Dontaudit pcp_pmlogger_t to sys_ptrace capability BZ(1416611)
  - Update mta_manage_spool() interface to allow caller domain also mmap mta_spool_t files BZ(1517449)
  - Allow antivirus_t domain to mmap antivirus_db_t files BZ(1516816)
  - Allow cups_pdf_t domain to read cupd_etc_t dirs BZ(1516282)
  - Allow openvpn_t domain to relabel networkmanager tun device BZ(1436048)
  - Allow mysqld_t to mmap mysqld_tmp_t files BZ(1516899)
  - Update samba_manage_var_files() interface by adding map permission. BZ(1517125)
  - Allow pcp_pmlogger_t domain to execute itself. BZ(1517395)
  - Dontaudit sys_ptrace capability for mdadm_t BZ(1515849)
  - Allow pulseaudio_t domain to mmap pulseaudio_home_t files BZ(1515956)
  - Allow bugzilla_script_t domain to create netlink route sockets and udp sockets BZ(1427019)
  - Add interface fs_map_dos_files()
  - Update interface userdom_manage_user_home_content_files() to allow caller domain to mmap user_home_t files. BZ(1519729)
  - Add interface xserver_map_xdm_pid() BZ(1518382)
  - Add new interface dev_map_usbmon_dev() BZ(1524256)
  - Update miscfiles_read_fonts() interface to allow also mmap fonts_cache_t for caller domains BZ(1521137)
  - Allow ipsec_t to mmap cert_t and home_cert_t files BZ(1519810)
  - Fix typo in filesystem.if
  - Add interface dev_map_framebuffer()
  - Allow chkpwd command to mmap /etc/shadow BZ(1513704)
  - Fix systemd-resolved to run properly with SELinux in enforcing state BZ(1517529)
  - Allow thumb_t domain to mmap fusefs_t files BZ(1517517)
  - Allow userdom_home_reader_type attribute to mmap cifs_t files BZ(1517125)
  - Add interface fs_map_cifs_files()
  - Merge pull request #207 from rhatdan/labels
  - Merge pull request #208 from rhatdan/logdir
  - Allow domains that manage logfiles to man logdirs


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-307
changelog:
  - Allow crond_t to read pcp lib files BZ(1525420)
  - Allow mozilla plugin domain to mmap user_home_t files BZ(1452783)
  - Allow certwatch_t to mmap generic certs. BZ(1527173)
  - Allow dspam_t to manage dspam_rw_conent_t objects. BZ(1290876)
  - Add interface userdom_map_user_home_files()
  - Sytemd introduced new feature when journald(syslogd_t) is trying to read symlinks to unit files in /run/systemd/units. This commit label /run/systemd/units/* as systemd_unit_file_t and allow syslogd_t to read this content. BZ(1527202)
  - Allow xdm_t dbus chat with modemmanager_t BZ(1526722)
  - All domains accessing home_cert_t objects should also mmap it. BZ(1519810)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-308
changelog:
  - Make working SELinux sandbox with Wayland. BZ(1474082)
  - Allow postgrey_t domain to mmap postgrey_spool_t files BZ(1529169)
  - Allow dspam_t to mmap dspam_rw_content_t files BZ(1528723)
  - Allow collectd to connect to lmtp_port_t BZ(1304029)
  - Allow httpd_t to mmap httpd_squirrelmail_t files BZ(1528776)
  - Allow thumb_t to mmap removable_t files. BZ(1522724)
  - Allow sssd_t and login_pgm attribute to mmap auth_cache_t files BZ(1530118)
  - Add interface fs_mmap_removable_files()


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-309
changelog:
  - auth_use_nsswitch() interface cannot be used for attributes fixing munin policy
  - Allow git_script_t to mmap git_user_content_t files BZ(1530937)
  - Allow certmonger domain to create temp files BZ(1530795)
  - Improve interface mock_read_lib_files() to include also symlinks. BZ(1530563)
  - Allow fsdaemon_t to read nvme devices BZ(1530018)
  - Dontaudit fsdaemon_t to write to admin homedir. BZ(153030)
  - Update munin plugin policy BZ(1528471)
  - Allow sendmail_t domain to be system dbusd client BZ(1478735)
  - Allow amanda_t domain to getattr on tmpfs filesystem BZ(1527645)
  - Allow named file transition to create rpmrebuilddb dir with proper SELinux context BZ(1461313)
  - Dontaudit httpd_passwd_t domain to read state of systemd BZ(1522672)
  - Allow thumb_t to mmap non security files BZ(1517393)
  - Allow smbd_t to mmap files with label samba_share_t BZ(1530453)
  - Fix broken sysnet_filetrans_named_content() interface
  - Allow init_t to create tcp sockets for unconfined services BZ(1366968)
  - Allow xdm_t to getattr on xserver_t process files BZ(1506116)
  - Allow domains which can create resolv.conf file also create it in systemd_resolved_var_run_t dir BZ(1530297)
  - Allow X userdomains to send dgram msgs to xserver_t BZ(1515967)
  - Add interface files_map_non_security_files()


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-310
changelog:
  - Use python3 package in BuildRequires to ensure python version 3 will be used for compiling SELinux policy


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-1
changelog:
  - Removed big SELinux policy patches against tresys refpolicy and use tarballs from fedora-selinux github organisation


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-2
changelog:
  - Allow aide to mmap usr_t files BZ(1534182)
  - Allow ypserv_t domain to connect to tcp ports BZ(1534245)
  - Allow vmtools_t domain creating vmware_log_t files
  - Allow openvswitch_t domain to acces infiniband devices
  - Allow dirsrv_t domain to create tmp link files
  - Allow pcp_pmie_t domain to exec itself. BZ(153326)
  - Update openvswitch SELinux module
  - Allow virtd_t to create also sock_files with label virt_var_run_t
  - Allow chronyc_t domain to manage chronyd_keys_t files.
  - Allow logwatch to exec journal binaries BZ(1403463)
  - Allow sysadm_t and staff_t roles to manage user systemd services BZ(1531864)
  - Update logging_read_all_logs to allow mmap all logfiles BZ(1403463)
  - Add Label systemd_unit_file_t for /var/run/systemd/units/


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-3
changelog:
  - Merge pull request #45 from jlebon/pr/rot-sd-dbus-rawhide
  - Allow virt_domains to acces infiniband pkeys.
  - Allow systemd to relabelfrom tmpfs_t link files in /var/run/systemd/units/ BZ(1535180)
  - Label /usr/libexec/ipsec/addconn as ipsec_exec_t to run this script as ipsec_t instead of init_t
  - Allow audisp_remote_t domain write to files on all levels


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-4
changelog:
  - rpm: Label /usr/share/rpm usr_t (ostree/Atomic systems)
  - Update dbus_role_template() BZ(1536218)
  - Allow lldpad_t domain to mmap own tmpfs files BZ(1534119)
  - Allow blueman_t dbus chat with policykit_t BZ(1470501)
  - Expand virt_read_lib_files() interface to allow list dirs with label virt_var_lib_t BZ(1507110)
  - Allow postfix_master_t and postfix_local_t to connect to system dbus. BZ(1530275)
  - Allow system_munin_plugin_t domain to read sssd public files and allow stream connect to ssd daemon BZ(1528471)
  - Allow rkt_t domain to bind on rkt_port_t tcp BZ(1534636)
  - Allow jetty_t domain to mmap own temp files BZ(1534628)
  - Allow sslh_t domain to read sssd public files and stream connect to sssd. BZ(1534624)
  - Consistently label usr_t for kernel/initrd in /usr
  - kernel/files.fc: Label /usr/lib/sysimage as usr_t
  - Allow iptables sysctl load list support with SELinux enforced
  - Label HOME_DIR/.config/systemd/user/* user unit files as systemd_unit_file_t BZ(1531864)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-6
changelog:
  - Allow openvswitch_t domain to read cpuid, write to sysfs files and creating openvswitch_tmp_t sockets
  - Add new interface ppp_filetrans_named_content()
  - Allow keepalived_t read sysctl_net_t files
  - Allow puppetmaster_t domtran to puppetagent_t
  - Allow kdump_t domain to read kernel ring buffer
  - Allow boinc_t to mmap boinc tmpfs files BZ(1540816)
  - Merge pull request #47 from masatake/keepalived-signal
  - Allow keepalived_t create and write a file under /tmp
  - Allow ipsec_t domain to exec ifconfig_exec_t binaries.
  - Allow unconfined_domain_typ to create pppd_lock_t directory in /var/lock
  - Allow updpwd_t domain to create files in /etc with shadow_t label


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-7
changelog:
  - Label /usr/sbin/ldap-agent as dirsrv_snmp_exec_t
  - Allow certmonger_t domain to access /etc/pki/pki-tomcat BZ(1542600)
  - Allow keepalived_t domain getattr proc filesystem
  - Allow init_t to create UNIX sockets for unconfined services (BZ1543049)
  - Allow ipsec_mgmt_t execute ifconfig_exec_t binaries Allow ipsec_mgmt_t nnp domain transition to ifconfig_t
  - Allow ipsec_t nnp transistions to domains ipsec_mgmt_t and ifconfig_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-9
changelog:
  - Fix broken cups Security Module
  - Allow dnsmasq_t domain dbus chat with unconfined users. BZ(1532079)
  - Allow geoclue to connect to tcp nmea port BZ(1362118)
  - Allow pcp_pmcd_t to read mock lib files BZ(1536152)
  - Allow abrt_t domain to mmap passwd file BZ(1540666)
  - Allow gpsd_t domain to get session id of another process BZ(1540584)
  - Allow httpd_t domain to mmap httpd_tmpfs_t files BZ(1540405)
  - Allow cluster_t dbus chat with systemd BZ(1540163)
  - Add interface raid_stream_connect()
  - Allow nscd_t to mmap nscd_var_run_t files BZ(1536689)
  - Allow dovecot_delivery_t to mmap mail_home_rw_t files BZ(1531911)
  - Make cups_pdf_t domain system dbusd client BZ(1532043)
  - Allow logrotate to read auditd_log_t files BZ(1525017)
  - Improve snapperd SELinux policy BZ(1514272)
  - Allow virt_domain to read virt_image_t files BZ(1312572)
  - Allow openvswitch_t stream connect svirt_t
  - Update dbus_dontaudit_stream_connect_system_dbusd() interface
  - Allow openvswitch domain to manage svirt_tmp_t sock files
  - Allow named_filetrans_domain domains to create .heim_org.h5l.kcm-socket sock_file with label sssd_var_run_t BZ(1538210)
  - Merge pull request #50 from dodys/pkcs
  - Label tcp and udp ports 10110 as nmea_port_t BZ(1362118)
  - Allow systemd to access rfkill lib dirs BZ(1539733)
  - Allow systemd to mamange raid var_run_t sockfiles and files BZ(1379044)
  - Allow vxfs filesystem to use SELinux labels
  - Allow systemd to setattr on systemd_rfkill_var_lib_t dirs BZ(1512231)
  - Allow few services to dbus chat with snapperd BZ(1514272)
  - Allow systemd to relabel system unit symlink to systemd_unit_file_t. BZ(1535180)
  - Fix logging as staff_u into Fedora 27
  - Fix broken systemd_tmpfiles_run() interface


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-10
changelog:
  - refpolicy: Define extended_socket_class policy capability and socket classes
  - Make bluetooth_var_lib_t as mountpoint BZ(1547416)
  - Allow systemd to request load kernel module BZ(1547227)
  - Allow ipsec_t domain to read l2tpd pid files
  - Allow sysadm to read/write trace filesystem BZ(1547875)
  - Allow syslogd_t to mmap systemd coredump tmpfs files BZ(1547761)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-11
changelog:
  - Allow vdagent_t domain search cgroup dirs BZ(1541564)
  - Allow bluetooth_t domain listen on bluetooth sockets BZ(1549247)
  - Allow bluetooth domain creating bluetooth sockets BZ(1551577)
  - pki_log_t should be log_file
  - Allow gpgdomain to unix_stream socket connectto
  - Make working gpg agent in gpg_agent_t domain
  - Dontaudit thumb_t to rw lvm pipes BZ(154997)
  - Allow start cups_lpd via systemd socket activation BZ(1532015)
  - Improve screen_role_template Resolves: rhbz#1534111
  - Dontaudit modemmanager to setpgid. BZ(1520482)
  - Dontaudit kernel bug when systemd requesting load kernel module BZ(1547227)
  - Allow systemd-networkd to create netlink generic sockets BZ(1551578)
  - refpolicy: Define getrlimit permission for class process
  - refpolicy: Define smc_socket security class
  - Allow transition from sysadm role into mdadm_t domain.
  - ssh_t trying to communicate with gpg agent not sshd_t
  - Allow sshd_t communicate with gpg_agent_t
  - Allow initrc domains to mmap binaries with direct_init_entry attribute BZ(1545643)
  - Revert "Allow systemd_rfkill_t domain to reguest kernel load module BZ(1543650)"
  - Revert "Allow systemd to request load kernel module BZ(1547227)"
  - Allow systemd to write to all pidfile socketes because of SocketActivation unit option ListenStream= BZ(1543576)
  - Add interface lvm_dontaudit_rw_pipes() BZ(154997)
  - Add interfaces for systemd socket activation
  - Allow systemd-resolved to create stub-resolv.conf with right label net_conf_t BZ(1547098)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-12
changelog:
  - Allow l2tpd_t domain to create pppox sockets
  - Update dbus_system_bus_client() so calling domain could read also system_dbusd_var_lib_t link files BZ(1544251)
  - Add interface abrt_map_cache()
  - Update gnome_manage_home_config() to allow also map permission BZ(1544270)
  - Allow oddjob_mkhomedir_t domain to be dbus system client BZ(1551770)
  - Dontaudit kernel bug when several services requesting load kernel module
  - Allow traceroute and unconfined domains creating sctp sockets
  - Add interface corenet_sctp_bind_generic_node()
  - Allow ping_t domain to create icmp sockets
  - Allow staff_t to mmap abrt_var_cache_t BZ(1544273)
  - Fix typo bug in dev_map_framebuffer() interface BZ(1551842)
  - Dontaudit kernel bug when several services requesting load kernel module


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-13
changelog:
  - allow bluetooth_t domain to create alg_socket bz(1554410)
  - allow tor_t domain to execute bin_t files bz(1496274)
  - allow iscsid_t domain to mmap kernel modules bz(1553759)
  - update minidlna selinux policy bz(1554087)
  - allow motion_t domain to read sysfs_t files bz(1554142)
  - allow snapperd_t domain to getattr on all files,dirs,sockets,pipes bz(1551738)
  - allow l2tp_t domain to read ipsec config files bz(1545348)
  - allow colord_t to mmap home user files bz(1551033)
  - dontaudit httpd_t creating kobject uevent sockets bz(1552536)
  - allow ipmievd_t to mmap kernel modules bz(1552535)
  - allow boinc_t domain to read cgroup files bz(1468381)
  - backport allow rules from refpolicy upstream repo
  - allow gpg_t domain to bind on all unereserved udp ports
  - allow systemd to create systemd_rfkill_var_lib_t dirs bz(1502164)
  - allow netlabel_mgmt_t domain to read sssd public files, stream connect to sssd_t bz(1483655)
  - allow xdm_t domain to sys_ptrace bz(1554150)
  - allow application_domain_type also mmap inherited user temp files bz(1552765)
  - update ipsec_read_config() interface
  - fix broken sysadm selinux module
  - allow ipsec_t to search for bind cache bz(1542746)
  - allow staff_t to send sigkill to mount_t domain bz(1544272)
  - label /run/systemd/resolve/stub-resolv.conf as net_conf_t bz(1471545)
  - label ip6tables.init as iptables_exec_t bz(1551463)
  - allow hostname_t to use usb ttys bz(1542903)
  - add fsetid capability to updpwd_t domain bz(1543375)
  - allow systemd machined send signal to all domains bz(1372644)
  - dontaudit create netlink selinux sockets for unpriv selinux users bz(1547876)
  - allow sysadm_t to create netlink generic sockets bz(1547874)
  - allow passwd_t domain chroot
  - dontaudit confined unpriviliged users setuid capability


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-14
changelog:
  - Allow rpcd_t domain dac override
  - Allow rpm domain to mmap rpm_var_lib_t files
  - Allow arpwatch domain to create bluetooth sockets
  - Allow secadm_t domain to mmap audit config and log files
  - Update init_abstract_socket_activation() to allow also creating tcp sockets
  - getty_t should be ranged in MLS. Then also local_login_t runs as ranged domain.
  - Add SELinux support for systemd-importd
  - Create new type bpf_t and label /sys/fs/bpf with this type


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-15
changelog:
  - Update screen_role_template() to allow also creating sockets in HOMEDIR/screen/
  - Allow newrole_t dacoverride capability
  - Allow traceroute_t domain to mmap packet sockets
  - Allow netutils_t domain to mmap usmmon device
  - Allow netutils_t domain to use mmap on packet_sockets
  - Allow traceroute to create icmp packets
  - Allos sysadm_t domain to create tipc sockets
  - Allow confined users to use new socket classes for bluetooth, alg and tcpdiag sockets


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-16
changelog:
  - Improve bluetooth_stream_socket interface to allow caller domain also send bluetooth sockets
  - Allow tcpd_t bind on sshd_port_t if ssh_use_tcpd() is enabled
  - Allow semanage_t domain mmap usr_t files
  - Add new boolean: ssh_use_tcpd()


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-17
changelog:
  - Allow smbcontrol_t to mmap samba_var_t files and allow winbind create sockets BZ(1559795)
  - Allow nagios to exec itself and mmap nagios spool files BZ(1559683)
  - Allow nagios to mmap nagios config files BZ(1559683)
  - Fixing Ganesha module
  - Fix typo in NetworkManager module
  - Fix bug in gssproxy SELinux module
  - Allow abrt_t domain to mmap container_file_t files BZ(1525573)
  - Allow networkmanager to be run ssh client BZ(1558441)
  - Allow pcp domains to do dc override BZ(1557913)
  - Dontaudit pcp_pmie_t to reaquest lost kernel module
  - Allow pcp_pmcd_t to manage unpriv userdomains semaphores BZ(1554955)
  - Allow httpd_t to read httpd_log_t dirs BZ(1554912)
  - Allow fail2ban_t to read system network state BZ(1557752)
  - Allow dac override capability to mandb_t domain BZ(1529399)
  - Allow collectd_t domain to mmap collectd_var_lib_t files BZ(1556681)
  - Dontaudit bug in kernel 4.16 when domains requesting loading kernel modules BZ(1555369)
  - Add Domain transition from gssproxy_t to httpd_t domains BZ(1548439)
  - Allow httpd_t to mmap user_home_type files if boolean httpd_read_user_content is enabled BZ(1555359)
  - Allow snapperd to relabel snapperd_data_t
  - Improve bluetooth_stream_socket interface to allow caller domain also send bluetooth sockets
  - Allow tcpd_t bind on sshd_port_t if ssh_use_tcpd() is enabled
  - Allow insmod_t to load modules BZ(1544189)
  - Allow systemd_rfkill_t domain sys_admin capability BZ(1557595)
  - Allow systemd_networkd_t to read/write tun tap devices
  - Add shell_exec_t file as domain entry for init_t
  - Label also /run/systemd/resolved/ as systemd_resolved_var_run_t BZ(1556862)
  - Dontaudit kernel 4.16 bug when lot of domains requesting load kernel module BZ(1557347)
  - Improve userdom_mmap_user_home_content_files
  - Allow systemd_logind_t domain to setattributes on fixed disk devices BZ(1555414)
  - Dontaudit kernel 4.16 bug when lot of domains requesting load kernel module
  - Allow semanage_t domain mmap usr_t files
  - Add new boolean: ssh_use_tcpd()


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-18
changelog:
  Fedora Atomic host using for temp files /sysroot/tmp patch, we should label same as /tmp adding file context equivalence BZ(1559531)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-19
changelog:
  - Allow accountsd_t domain to dac override BZ(1561304)
  - Allow cockpit_ws_t domain to read system state BZ(1561053)
  - Allow postfix_map_t domain to use inherited user ptys BZ(1561295)
  - Allow abrt_dump_oops_t domain dac override BZ(1561467)
  - Allow l2tpd_t domain to run stream connect for sssd_t BZ(1561755)
  - Allow crontab domains to do dac override
  - Allow snapperd_t domain to unmount fs_t filesystems
  - Allow pcp processes to read fixed_disk devices BZ(1560816)
  - Allow unconfined and confined users to use dccp sockets
  - Allow systemd to manage bpf dirs/files
  - Allow traceroute_t to create dccp_sockets


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-20
changelog:
  - Add new boolean redis_enable_notify()
  - Label  /var/log/shibboleth-www(/.*) as httpd_sys_rw_content_t
  - Add new label for vmtools scripts and label it as vmtools_unconfined_t stored in /etc/vmware-tools/
  - Allow svnserve_t domain to manage kerberos rcache and read krb5 keytab
  - Add dac_override and dac_read_search capability to hypervvssd_t domain
  - Label /usr/lib/systemd/systemd-fence_sanlockd as fenced_exec_t
  - Allow samba to create /tmp/host_0 as krb5_host_rcache_t
  - Add dac_override capability to fsdaemon_t BZ(1564143)
  - Allow abrt_t domain to map dos files BZ(1564193)
  - Add dac_override capability to automount_t domain
  - Allow keepalived_t domain to connect to system dbus bus
  - Allow nfsd_t to read nvme block devices BZ(1562554)
  - Allow lircd_t domain to execute bin_t files BZ(1562835)
  - Allow l2tpd_t domain to read sssd public files BZ(1563355)
  - Allow logrotate_t domain to do dac_override BZ(1539327)
  - Remove labeling for /etc/vmware-tools to bin_t it should be vmtools_unconfined_exec_t
  - Add capability sys_resource to systemd_sysctl_t domain
  - Label all /dev/rbd* devices as fixed_disk_device_t
  - Allow xdm_t domain to mmap xserver_log_t files BZ(1564469)
  - Allow local_login_t domain to rread udev db
  - Allow systemd_gpt_generator_t to read /dev/random device
  - add definition of bpf class and systemd perms


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-21
changelog:
  - Allow certwatch to manage cert files BZ(1561418)
  - Allow abrt_dump_oops_t domain to mmap all non security files BZ(1565748)
  - Allow gpg_t domain mmap cert_t files Allow gpg_t mmap gpg_agent_t files
  - Allow NetworkManager_ssh_t domain use generic ptys. BZ(1565851)
  - Allow pppd_t domain read/write l2tpd pppox sockets BZ(1566096)
  - Allow xguest user use bluetooth sockets if xguest_use_bluetooth boolean is turned on.
  - Allow pppd_t domain creating pppox sockets BZ(1566271)
  - Allow abrt to map var_lib_t files
  - Allow chronyc to read system state BZ(1565217)
  - Allow keepalived_t domain to chat with systemd via dbus
  - Allow git to mmap git_(sys|user)_content_t files BZ(1518027)
  - removed boinc dev_getattr_*_dev
  - Allow iptables_t domain to create dirs in etc_t with system_conf_t labels
  - Allow x userdomain to mmap xserver_tmpfs_t files
  - Allow sysadm_t to mount tracefs_t
  - Allow unconfined user all perms under bpf class BZ(1565738)
  - Allow SELinux users (except guest and xguest) to using bluetooth sockets
  - Add new interface files_map_var_lib_files()
  - Allow user_t and staff_t domains create netlink tcpdiag sockets
  - Allow systemd-networkd to read sysctl_t files
  - Allow systemd_networkd_t to read/write tun tap devices
  - refpolicy: Update for kernel sctp support


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-22
changelog:
  - Allow networkmanager domain to write to ecryptfs_t files BZ(1566706)
  - Allow l2tpd domain to stream connect to sssd BZ(1568160)
  - Dontaudit abrt_t to write to lib_t dirs BZ(1566784)
  - Allow NetworkManager_ssh_t domain transition to insmod_t BZ(1567630)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-23
changelog:
  - Allow dnssec_trigger_t domain to read system network state BZ(1570205)
  - Add dac_override capability to mailman_mail_t domain
  - Add dac_override capability to radvd_t domain
  - Update openvswitch policy
  - Add dac_override capability to oddjob_homedir_t domain
  - Allow slapd_t domain to mmap slapd_var_run_t files
  - Rename tang policy to tangd
  - Allow virtd_t domain to relabel virt_var_lib_t files
  - Allow logrotate_t domain to stop services via systemd
  - Add tang policy
  - Allow mozilla_plugin_t to create mozilla.pdf file in user homedir with label mozilla_home_t
  - Allow snapperd_t daemon to create unlabeled dirs.
  - Make httpd_var_run_t mountpoint
  - Allow hsqldb_t domain to mmap own temp files
  - We have inconsistency in cgi templates with upstream, we use _content_t, but refpolicy use httpd__content_t. Created aliasses to make it consistence
  - Allow Openvswitch adding netdev bridge ovs 2.7.2.10 FDP
  - Add new Boolean tomcat_use_execmem
  - Allow nfsd_t domain to read/write sysctl fs files
  - Allow conman to read system state
  - Allow brltty_t domain to be dbusd system client
  - Allow zebra_t domain to bind on babel udp port
  - Allow freeipmi domain to read sysfs_t files
  - Allow targetd_t domain mmap lvm config files
  - Allow abrt_t domain to manage kdump crash files
  - gnome_data_filetrans macro should be in optional block
  - Allow netutils_t domain to create bluetooth sockets
  - Allow traceroute to bind on generic sctp node
  - Allow traceroute to search network sysctls
  - Allow systemd to use virtio console
  - Label /dev/op_panel and /dev/opal-prd as opal_device_t
  - Label /run/ebtables.lock as iptables_var_run_t
  - Allow udev_t domain to manage udev_rules_t char files.
  - Assign babel_port_t label to udp port 6696
  - Add new interface lvm_map_config
  - Merge pull request #212 from stlaz/patch-1
  - Allow local_login_t reads of udev_var_run_t context


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-25
changelog:
  - Add dac_override capability to remote_login_t domain
  - Allow chrome_sandbox_t to mmap tmp files
  - Update ulogd SELinux security policy
  - Allow rhsmcertd_t domain send signull to apache processes
  - Allow systemd socket activation for modemmanager
  - Allow geoclue to dbus chat with systemd
  - Fix file contexts on conntrackd policy
  - Temporary fix for varnish and apache adding capability for DAC_OVERRIDE
  - Allow lsmd_plugin_t domain to getattr lsm_t unix stream sockets
  - Add label for  /usr/sbin/pacemaker-remoted to have cluster_exec_t
  - Allow nscd_t domain to be system dbusd client
  - Allow abrt_t domain to read sysctl
  - Add dac_read_search capability for tangd
  - Allow systemd socket activation for rshd domain
  - Add label for /usr/libexec/cyrus-imapd/master as cyrus_exec_t to have proper SELinux domain transition from init_t to cyrus_t
  - Allow kdump_t domain to map /boot files
  - Allow conntrackd_t domain to send msgs to syslog
  - Label /usr/sbin/nhrpd and /usr/sbin/pimd binaries as zebra_exec_t
  - Allow swnserve_t domain to stream connect to sasl domain
  - Allow smbcontrol_t to create dirs with samba_var_t label
  - Remove execstack,execmem and execheap from domains setroubleshootd_t, locate_t and podsleuth_t to increase security. BZ(1579760)
  - Allow tangd to read public sssd files BZ(1509054)
  - Allow geoclue start with nnp systemd security feature with proper SELinux Domain transition BZ(1575212)
  - Allow ctdb_t domain modify ctdb_exec_t files
  - Allow firewalld_t domain to create netlink_netfilter sockets
  - Allow radiusd_t domain to read network sysctls
  - Allow pegasus_t domain to mount tracefs_t filesystem
  - Allow psad_t domain to read all domains state
  - Allow tomcat_t domain to connect to mongod_t tcp port
  - Allow dovecot and postfix to connect to systemd stream sockets
  - Make nmbd_t domain dbus system client BZ(1569856)
  - Merge pull request #55 from SISheogorath/fix/tlp-policy
  - Merge pull request #54 from tmzullinger/rawhide
  - Allow also listing system_dbusd_var_run_t dirs in dbusd_read_pid_files macro BZ(1566168)
  - Allow gssproxy_t domain to read gssd_t state BZ(1572945)
  - Allow create systemd to mount pid files
  - Add files_map_boot_files() interface
  - Remove execstack,execmem and execheap from domain fsadm_t to increase security. BZ(1579760)
  - Fix typo xserver SELinux module
  - Allow systemd to mmap files with var_log_t label
  - Allow x_userdomains read/write to xserver session
  - Allow users staff and sysadm to run wireshark on own domain
  - Fix typos s/xserver/xdm/ for allow creating xserver misc devices
  - Allow systemd-bootchart to create own tmpfs files
  - Merge pull request #213 from tmzullinger/rawhide
  - Allow xdm_t domain to install Nouveau drivers BZ(1570996)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-26
changelog:
  - Disable secure mode environment cleansing for dirsrv_t
  - - Allow udev execute /usr/libexec/gdm-disable-wayland in xdm_t domain which allows create /run/gdm/custom.conf with proper xdm_var_run_t label.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-27
changelog:
  - Add dac_override to exim policy BZ(1574303)
  - Fix typo in conntrackd.fc file
  - Allow sssd_t to kill sssd_selinux_manager_t
  - Allow httpd_sys_script_t to connect to mongodb_port_t if boolean httpd_can_network_connect_db  is turned on
  - Allow chronyc_t to redirect ourput to /var/lib /var/log and /tmp
  - Allow policykit_auth_t to read udev db files BZ(1574419)
  - Allow varnishd_t do be dbus client BZ(1582251)
  - Allow cyrus_t domain to mmap own pid files BZ(1582183)
  - Allow user_mail_t domain to mmap etc_aliases_t files
  - Allow gkeyringd domains to run ssh agents
  - Allow gpg_pinentry_t domain read ssh state
  - Allow gpg_agent_t to send msgs to syslog/journal
  - Add dac_override capability to dovecot_t domain
  - Allow nscd_t domain to mmap system_db_t files
  - Allow tangd_t domain to create tcp sockets and add new interface tangd_read_db_files
  - Allow mailman_mail_t domain to search for apache configs
  - Allow mailman_cgi_t domain to ioctl an httpd with a unix domain stream sockets.
  - Improve procmail_domtrans() to allow mmaping procmail_exec_t
  - Allow ptrace arbitrary processes
  - Allow jabberd_router_t domain read kerberos keytabs BZ(1573945)
  - Allow certmonger to geattr of filesystems BZ(1578755)
  - Allow hypervvssd_t domain to read fixed disk devices
  - Allow several domains to manage ecryptfs_t filesystem
  - Allow userdom_use_user_ttys for loadkeys_t domain
  - Add dac_override capability to cachefiles_kernel_t domain
  - Allow blueman to execute ldconfig BZ(1577581)
  - Allow gpg_pinentry_t domain to read state of gpg_t processes
  - Add dac_override capability to cgconfig_t domain BZ(1574649)
  - Add dac_override to glusterd_t domain BZ(1578501)
  - Allow fsdaemon_t to create own fsdaemon_var_lib_t dirs BZ(1569724)
  - Allow plymouth_t domain to read/write systemd sockets BZ(1578882)
  - Allow use of U2F Yubikey as authentication for a sudo command BZ(1578915)
  - Append map permission to apache_read_modules() interface
  - Allow certwatch_t domain to getattr of extended attributes fs_t filesystem
  - Add new interface: dirsrv_noatsecure()
  - Add dac_override capability to remote_login_t domain
  - Allow chrome_sandbox_t to mmap tmp files
  - Update ulogd SELinux security policy
  - Allow sysadm_u use xdm
  - Allow xdm_t domain to listen ofor unix dgram sockets BZ(1581495)
  - Add interface ssh_read_state()
  - Fix typo in sysnetwork.if file
  - Update dev_map_xserver_misc interface to allo mmaping char devices instead of files
  - Allow noatsecure permission for all domain transitions from systemd.
  - Allow systemd to read tangd db files
  - Fix typo in ssh.if file
  - Allow xdm_t domain to mmap xserver_misc_device_t files
  - Allow xdm_t domain to execute systemd-coredump binary
  - Add bridge_socket, dccp_socket, ib_socket and mpls_socket to socket_class_set
  - Improve modutils_domtrans_insmod() interface to mmap insmod_exec_t binaries
  - Improve iptables_domtrans() interface to allow mmaping iptables_exec_t binary
  - Improve auth_domtrans_login_programinterface to allow also mmap login_exec_t binaries
  - Improve auth_domtrans_chk_passwd() interface to allow also mmaping chkpwd_exec_t binaries.
  - Allow mmap dhcpc_exec_t binaries in sysnet_domtrans_dhcpc interface
  - Improve running xorg with proper SELinux domain even if systemd security feature NoNewPrivileges is used
  - Associate sysctl_vm_overcommit_t with fs_t
  - Allow systemd creating bluetooth sockets
  - Allow ssh client to read network sysctl BZ(1574170)
  - Allow systemd_resolved_t and systemd_networkd_t to read dbus pid files
  - Allow sysadm user to sys_ptrace cap_userns
  - Allow udev execute /usr/libexec/gdm-disable-wayland in xdm_t domain which allows create /run/gdm/custom.conf with proper xdm_var_run_t label.
  - Allow ssh client to read network state BZ(1574174)
  - Allow ssh basic client to read/write to tun tap devices BZ(1574184)
  - Allow ssh basic client to create tun sockets BZ(1574186)
  - Disable secure mode environment cleansing for dirsrv_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-28
changelog:
  - Update ctdb domain to support gNFS setup
  - Allow authconfig_t dbus chat with policykit
  - Allow lircd_t domain to read system state
  - Revert "Allow fsdaemon_t do send emails BZ(1582701)"
  - Typo in uuidd policy
  - Allow tangd_t domain read certs
  - Allow vpnc_t domain to read configfs_t files/dirs BZ(1583107)
  - Allow vpnc_t domain to read generic certs BZ(1583100)
  - Label /var/lib/phpMyAdmin directory as httpd_sys_rw_content_t BZ(1584811)
  - Allow NetworkManager_ssh_t domain to be system dbud client
  - Allow virt_qemu_ga_t read utmp
  - Add capability dac_override to system_mail_t domain
  - Update uuidd policy to reflect last changes from base branch
  - Add cap dac_override to procmail_t domain
  - Allow sendmail to mmap etc_aliases_t files BZ(1578569)
  - Add new interface dbus_read_pid_sock_files()
  - Allow mpd_t domain read config_home files if mpd_enable_homedirs boolean will be enabled
  - Allow fsdaemon_t do send emails BZ(1582701)
  - Allow firewalld_t domain to request kernel module BZ(1573501)
  - Allow chronyd_t domain to send send msg via dgram socket BZ(1584757)
  - Add sys_admin capability to fprint_t SELinux domain
  - Allow cyrus_t domain to create own files under /var/run BZ(1582885)
  - Allow cachefiles_kernel_t domain to have capability dac_override
  - Update policy for ypserv_t domain
  - Allow zebra_t domain to bind on tcp/udp ports labeled as qpasa_agent_port_t
  - Allow cyrus to have dac_override capability
  - Dontaudit action when abrt-hook-ccpp is writing to nscd sockets
  - Fix homedir polyinstantion under mls
  - Fixed typo in init.if file
  - Allow systemd to remove generic tmpt files BZ(1583144)
  - Update init_named_socket_activation() interface to also allow systemd create objects in /var/run with proper label during socket activation
  - Allow systemd-networkd and systemd-resolved services read system-dbusd socket BZ(1579075)
  - Fix typo in authlogin SELinux security module
  - Allod nsswitch_domain attribute to be system dbusd client BZ(1584632)
  - Allow audisp_t domain to mmap audisp_exec_t binary
  - Update ssh_domtrans_keygen interface to allow mmap ssh_keygen_exec_t binary file
  - Label tcp/udp ports 2612 as qpasa_agetn_port_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-29
changelog:
  - Fix typos in zabbix.te file
  - Add missing requires
  - Allow tomcat domain sends email
  - Fix typo in sge policy
  - Allow certmonger to sends emails
  - Allow tomcat_t do mmap tomcat_tmp_t files
  - Improve sge_rw_tcp_sockets interface
  - Adding new interface: sge_rw_tcp_sockets()
  - Update sge_execd_t domain with few rules
  - Add new zabbix_run_sudo boolean
  - Allow virtual machines to manage cephfs filesystems.
  - Allow rhsmcertd_t domain to read sssd public files and stream connect to sssd
  - Add dac_override capability to sendmail_t domain
  - Fix typo in netutils.te file
  - Update traceroute_t domain to allow create dccp sockets
  - Update ssh_keysign policy
  - Allow sshd_t domain to read/write sge tcp sockets


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-30
changelog:
  - Add ibacm policy
  - Label /usr/sbin/rhn_check-[0-9]+.[0-9]+ as rpm_exec_t
  - Allow kdumpgui_t domain to allow execute and mmap all binaries labeled as kdumpgui_tmp_t
  - Allow rpm to check if SELinux will check original protection mode or modified protection mode (read-implies-exec) for mmap/mprotect. Allow rpm to reload systemd services
  - Allow crond_t domain to create netlink selinux sockets and dac_override cap.
  - Allow radiusd_t domain to have dac_override capability
  - Allow amanda_t domain to have setgid capability
  - Allow psad domain to setrlimit. Allow psad domain to stream connect to dbus Allow psad domain to exec journalctl_exec_t binary
  - Update cups_filetrans_named_content() to allow caller domain create ppd directory with cupsd_etc_rw_t label
  - Allow abrt_t domain to write to rhsmcertd pid files
  - Allow pegasus_t domain to eexec lvm binaries and allow read/write access to lvm control
  - Add vhostmd_t domain to read/write to svirt images
  - Update kdump_manage_kdumpctl_tmp_files() interface to allow caller domain also mmap kdumpctl_tmp_t files
  - Allow sssd_t and slpad_t domains to mmap generic certs
  - Allow chronyc_t domain use inherited user ttys
  - Allow stapserver_t domain to mmap own tmp files
  - Update nscd_dontaudit_write_sock_file() to dontaudit also stream connect to nscd_t domain
  - Merge pull request #60 from vmojzis/rawhide
  - Allow tangd_t domain stream connect to sssd
  - Allow oddjob_t domain to chat with systemd via dbus
  - Allow freeipmi domains to mmap sysfs files
  - Fix typo in logwatch interface file
  - Allow spamd_t to manage logwatch_cache_t files/dirs
  - Allow dnsmasw_t domain to create own tmp files and manage mnt files
  - Allow fail2ban_client_t to inherit rlimit information from parent process
  - Allow nscd_t to read kernel sysctls
  - Label /var/log/conman.d as conman_log_t
  - Add dac_override capability to tor_t domain
  - Allow certmonger_t to readwrite to user_tmp_t dirs
  - Allow abrt_upload_watch_t domain to read general certs
  - Allow chornyd_t read phc2sys_t shared memory
  - Add several allow rules for pesign policy:
  - Add setgid and setuid capabilities to mysqlfd_safe_t domain
  - Add tomcat_can_network_connect_db boolean
  - Update virt_use_sanlock() boolean to read sanlock state
  - Add sanlock_read_state() interface
  - Allow zoneminder_t to getattr of fs_t
  - Allow rhsmcertd_t domain to send signull to postgresql_t domain
  - Add log file type to collectd and allow corresponding access
  - Allow policykit_t domain to dbus chat with dhcpc_t
  - Adding new boolean keepalived_connect_any()
  - Allow amanda to create own amanda_tmpfs_t files
  - Allow gdomap_t domain to connect to qdomap_port_t
  - /usr/libexec/bluetooth/obexd should have only obexd_exec_t instead of bluetoothd_exec_t type
  - Allow ntop_t domain to create/map various sockets/files.
  - Enable the dictd to communicate via D-bus.
  - Allow inetd_child process to chat via dbus with abrt
  - Allow zabbix_agent_t domain to connect to redis_port_t
  - Allow rhsmcertd_t domain to read xenfs_t files
  - Allow zabbix_agent_t to run zabbix scripts
  - Fix openvswith SELinux module
  - Fix wrong path in tlp context file BZ(1586329)
  - Update brltty SELinux module
  - Allow rabbitmq_t domain to create own tmp files/dirs
  - Allow policykit_t mmap policykit_auth_exec_t files
  - Allow ipmievd_t domain to read general certs
  - Add sys_ptrace capability to pcp_pmie_t domain
  - Allow squid domain to exec ldconfig
  - Update gpg SELinux policy module
  - Allow mailman_domain to read system network state
  - Allow openvswitch_t domain to read neutron state and read/write fixed disk devices
  - Allow antivirus_domain to read all domain system state
  - Allow targetd_t domain to red gconf_home_t files/dirs
  - Label /usr/libexec/bluetooth/obexd as obexd_exec_t
  - Allow init_t domain to create netlink rdma sockets for ibacm policy
  - Update corecmd_exec_shell() interface to allow caller domain to mmap shell_exec_t files
  - Allow lvm_t domain to write files to all mls levels
  - Add to su_role_template allow rule for creating netlink_selinux sockets
  - Allow sysadm_t domain to mmap hwdb db
  - Allow udev_t domain to mmap kernel modules
  - Allow sysadm_screen_t to have capability dac_override and chown
  - Allow sysadm_t domain to mmap journal
  - Merge branch 'rawhide' of github.com:fedora-selinux/selinux-policy into rawhide
  - Label /etc/systemd/system.control/ dir as systemd_unit_file_t
  - Merge pull request #215 from bachradsusi/merge-conf-from-fedora
  - Allow sysadm_t and staff_t domains to use sudo io logging
  - Allow sysadm_t domain create sctp sockets
  - Add snapperd_contexts to the policy
  - Use system_u:system_r:unconfined_t:s0 in userhelper_context
  - Remove unneeded system_u seusers mapping.
  - Fedora targeted default user is unconfined_u, root is unconfined_u as well
  - Update config to reflect changes in default context for SELinux users related to pam_selinux.so which is now used in systemd-users.
  - Change failsafe_context to unconfined_r:unconfined_t:s0
  - Update lxc_contexts from Fedora config.tgz
  - Add lxc_contexts config file
  - Allow traceroute_t domain to exec bin_t binaries
  - Allow systemd_passwd_agent_t domain to list sysfs Allow systemd_passwd_agent_t domain to dac_override
  - Add new interface dev_map_sysfs()
  - Allow sshd_keygen_t to execute plymouthd
  - Allow systemd_networkd_t create and relabel tun sockets
  - Add new interface postgresql_signull()
  - Merge pull request #214 from wrabcak/fb-dhcpc
  - Allow dhcpc_t creating own socket files inside /var/run/ Allow dhcpc_t creating netlink_kobject_uevent_socket, netlink_generic_socket, rawip_socket BZ(1585971)
  - Allow confined users get AFS tokens
  - Allow sysadm_t domain to chat via dbus
  - Associate sysctl_kernel_t type with filesystem attribute


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-31
changelog:
  - Allow cupsd_t domain to mmap cupsd_etc_t files
  - Allow kadmind_t domain to mmap krb5kdc_principal_t
  - Allow virtlogd_t domain to read virt_etc_t link files
  - Allow dirsrv_t domain to read crack db
  - Dontaudit pegasus_t to require sys_admin capability
  - Allow mysqld_t domain to exec mysqld_exec_t binary files
  - Allow abrt_t odmain to read rhsmcertd lib files
  - Allow winbind_t domain to request kernel module loads
  - Allow tomcat_domain to read cgroup_t files
  - Allow varnishlog_t domain to mmap varnishd_var_lib_t files
  - Allow innd_t domain to mmap news_spool_t files
  - Label HOME_DIR/mozilla.pdf file as mozilla_home_t instead of user_home_t
  - Allow fenced_t domain to reboot
  - Allow amanda_t domain to read network system state
  - Allow abrt_t domain to read rhsmcertd logs
  - Fix typo in radius policy
  - Update zoneminder policy to reflect latest features in zoneminder BZ(1592555)
  - Label /usr/bin/esmtp-wrapper as sendmail_exec_t
  - Update raid_access_check_mdadm() interface to dontaudit caller domain to mmap mdadm_exec_t binary files
  - Dontaudit thumb to read mmap_min_addr
  - Allow chronyd_t to send to system_cronjob_t via unix dgram socket BZ(1494904)
  - Allow mpd_t domain to mmap mpd_tmpfs_t files BZ(1585443)
  - Allow collectd_t domain to use ecryptfs files BZ(1592640)
  - Dontaudit mmap home type files for abrt_t domain
  - Allow fprintd_t domain creating own tmp files BZ(1590686)
  - Allow collectd_t domain to bind on bacula_port_t BZ(1590830)
  - Allow fail2ban_t domain to getpgid BZ(1591421)
  - Allow nagios_script_t domain to mmap nagios_log_t files BZ(1593808)
  - Allow pcp_pmcd_t domain to use sys_ptrace usernamespace cap
  - Allow sssd_selinux_manager_t to read/write to systemd sockets BZ(1595458)
  - Allow radiusd_t domain to mmap radius_etc_rw_t files
  - Allow git_script_t domain to read and mmap gitosis_var_lib_t files BZ(1591729)
  - Add dac_read_search capability to thumb_t domain
  - Add dac_override capability to cups_pdf_t domain BZ(1594271)
  - Add net_admin capability to connntrackd_t domain BZ(1594221)
  - Allow gssproxy_t domain to domtrans into gssd_t domain BZ(1575234)
  - Fix interface init_dbus_chat in oddjob SELinux policy BZ(1590476)
  - Allow motion_t to mmap video devices BZ(1590446)
  - Add dac_override capability to mpd_t domain BZ(1585358)
  - Allow fsdaemon_t domain to write to mta home files BZ(1588212)
  - Allow virtlogd_t domain to chat via dbus with systemd_logind BZ(1589337)
  - Allow sssd_t domain to write to general cert files BZ(1589339)
  - Allow l2tpd_t domain to sends signull to ipsec domains BZ(1589483)
  - Allow cockpit_session_t to read kernel network state BZ(1596941)
  - Allow devicekit_power_t start with nnp systemd security feature with proper SELinux Domain transition BZ(1593817)
  - Allows systemd to get attribues of core kernel interface BZ(1596928)
  - Dontaudit syslogd to watching top llevel dirs when imfile module is enabled
  - Revert "Allow unconfined and sysadm users to use bpftool BZ(1591440)"
  - Allow userdomain sudo domains to use generic ptys
  - Allow systemd labeled as init_t to get sysvipc info BZ(1600877)
  - Label /sbin/xtables-legacy-multi and /sbin/xtables-nft-multi as iptables_exec_t BZ(1600690)
  - Remove duplicated userdom_delete_user_home_content_files
  - Add systemd_dbus_chat_resolved interface
  - Allow load_policy_t domain to read/write to systemd sockets BZ(1582812)
  - Add new interface init_prog_run_bpf()
  - Allow unconfined and sysadm users to use bpftool BZ(1591440)
  - Label /run/cockpit/motd as etc_t BZ(1584167)
  - Allow systemd_machined_t domain to sendto syslogd_t over unix dgram sockets
  - Add interface userdom_dontaudit_mmap_user_home_content_files()
  - Allow systemd to listen bluetooth sockets BZ(1592223)
  - Allow systemd to remove user_home_t files BZ(1418463)
  - Allow xdm_t domain to mmap and read cert_t files BZ(1553761)
  - Allow nsswitch_domain to mmap passwd_file_t files BZ(1518655)
  - Allow systemd to delete user temp files BZ(1595189)
  - Allow systemd to mounton core kernel interface
  - Add dac_override capability to ipsec_t domain BZ(1589534)
  - Allow systemd domain to mmap lvm config files BZ(1594584)
  - Allow systemd to write systemd_logind_inhibit_var_run_t fifo files
  - Allow systemd_modules_load_t to access unabeled infiniband pkeys


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-32
changelog:
  - Allow aide to mmap all files
  - Revert "Allow firewalld_t do read iptables_var_run_t files"
  - Revert "Allow firewalld to create rawip sockets"
  - Allow svirt_tcg_t domain to read system state of virtd_t domains
  - Update rhcs contexts to reflects the latest fenced changes
  - Allow httpd_t domain to rw user_tmp_t files
  - Fix typo in openct policy
  - Allow winbind_t domian to connect to all ephemeral ports
  - Allow firewalld_t do read iptables_var_run_t files
  - Allow abrt_t domain to mmap data_home files
  - Allow glusterd_t domain to mmap user_tmp_t files
  - Allow mongodb_t domain to mmap own var_lib_t files
  - Allow firewalld to read kernel usermodehelper state
  - Allow modemmanager_t to read sssd public files
  - Allow openct_t domain to mmap own var_run_t files
  - Allow nnp transition for devicekit daemons
  - Allow firewalld to create rawip sockets
  - Allow firewalld to getattr proc filesystem
  - Dontaudit sys_admin capability for pcscd_t domain
  - Revert "Allow pcsd_t domain sys_admin capability"
  - Allow fetchmail_t domain to stream connect to sssd
  - Allow pcsd_t domain sys_admin capability
  - Allow cupsd_t to create cupsd_etc_t dirs
  - Allow varnishlog_t domain to list varnishd_var_lib_t dirs
  - Allow mongodb_t domain to read system network state BZ(1599230)
  - Allow zoneminder_t to getattr of fs_t
  - Allow tgtd_t domain to create dirs in /var/run labeled as tgtd_var_run_t BZ(1492377)
  - Allow iscsid_t domain to mmap sysfs_t files
  - Allow httpd_t domain to mmap own cache files
  - Add sys_resource capability to nslcd_t domain
  - Fixed typo in logging_audisp_domain interface
  - Add interface files_mmap_all_files()
  - Add interface iptables_read_var_run()
  - Allow systemd to mounton init_var_run_t files
  - Update policy rules for auditd_t based on changes in audit version 3
  - Allow systemd_tmpfiles_t do mmap system db files
  - Don't setup unlabeled_t as an entry_type
  - Allow unconfined_service_t to transition to container_runtime_t
  - Improve domain_transition_pattern to allow mmap entrypoint bin file.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-33
changelog:
  - Allow sblim_sfcbd_t domain to mmap own tmpfs files
  - Allow nfsd_t domain to read krb5 keytab files
  - Allow nfsd_t domain to manage fadm pid files
  - Allow virt_domain to create icmp sockets BZ(1609142)
  - Dontaudit oracleasm_t domain to request sys_admin capability
  - Update logging_manage_all_logs() interface to allow caller domain map all logfiles


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-34
changelog:
  - Fix issue with aliases in apache interface file
  Resolves: rhbz#1596618
  - Add same context for symlink as binary
  - Allow boltd_t to send logs to journal
  - Allow colord_use_nfs to allow colord also mmap nfs_t files
  - Allow mysqld_safe_t do execute itself
  - Allow smbd_t domain to chat via dbus with avahi daemon
  - cupsd_t domain will create /etc/cupsd/ppd as cupsd_etc_rw_t
  - Update screen_role_template to allow caller domain to have screen_exec_t as entrypoint do new domain
  - Add alias httpd__script_t to _script_t to make sepolicy generate working
  - Allow gpg_t domain to mmap gpg_agent_tmp_t files
  - Allow kprop_t domain to read network state
  - Add support boltd policy
  - Allow kpropd domain to exec itself
  - Allow pdns_t to bind on tcp transproxy port
  - Add support for opafm service
  - Allow hsqldb_t domain to read cgroup files
  - Allow rngd_t domain to read generic certs
  - Allow innd_t domain to mmap own var_lib_t files
  - Update screen_role_temaplate interface
  - Allow chronyd_t domain to mmap own tmpfs files
  - Allow chronyd_t domain to mmap own tmpfs files
  - label /var/lib/pgsql/data/log as postgresql_log_t
  - Allow sysadm_t domain to accept socket
  - Allow systemd to manage passwd_file_t
  - Allow sshd_t domain to mmap user_tmp_t files
  - Allow systemd to mounont boltd lib dirs
  - Allow sysadm_t domain to create rawip sockets
  - Allow sysadm_t domain to listen on socket
  - Update sudo_role_template() to allow caller domain also setattr generic ptys


author: Daniel Kopeček <dkopecek@redhat.com> - 3.14.1-35
changelog:
  - Use explicit path BuildRequires to get /usr/bin/python3 inside the buildroot
  Resolves: rhbz#1615312


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-37
changelog:
  - Dontaudit abrt_t domain to write to usr_t dirs
  - Revert "Allow rpcbind to bind on all unreserved udp ports"
  - Allow rpcbind to bind on all unreserved udp ports
  - Allow virtlogd to execute itself
  - Allow stapserver several actions: - execute own tmp files - mmap stapserver_var_lib_t files - create stapserver_tmpfs_t files
  - Allow ypxfr_t domain to stream connect to rpcbind and allos search sssd libs
  - Allos systemd to socket activate ibacm service
  - Allow dirsrv_t domain to mmap user_t files
  - Allow kdumpctl_t domain to manage kdumpctl_tmp_t fifo files
  - Allow kdumpctl to write to files on all levels
  - Allow httpd_t domain to mmap httpd_config_t files
  - Allow sanlock_t domain to connectto to unix_stream_socket
  - Revert "Add same context for symlink as binary"
  - Allow mysql execute rsync
  - Update nfsd_t policy because of ganesha features
  - Allow conman to getattr devpts_t
  - Allow tomcat_domain to connect to smtp ports
  - Allow tomcat_t domain to mmap tomcat_var_lib_t files
  - Allow nagios_t domain to mmap nagios_log_t files
  - Allow kpropd_t domain to mmap krb5kdc_principal_t files
  - Allow kdumpctl_t domain to read fixed disk storage
  - Allow xserver_t domain to start using systemd socket activation
  - Tweak SELinux policy for systemd to allow DynamicUsers systemd feature
  - Associate several proc labels to fs_t
  - Update init_named_socket_activation() interface to allow systemd also create link files in /var/run
  - Fix typo in syslogd policy
  - Update syslogd policy to make working elasticsearch
  - Label tcp and udp ports 9200 as wap_wsp_port
  - Allow few domains to rw inherited kdumpctl tmp pipes


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-38
changelog:
  - Allow ovs-vswitchd labeled as openvswitch_t domain communicate with qemu-kvm via UNIX stream socket
  Resolves: rhbz#1621142
  - Add interface devicekit_mounton_var_lib()
  - Allow httpd_t domain to mmap tmp files
  - Allow tcsd_t domain to have dac_override capability
  - Allow cupsd_t to rename cupsd_etc_t files
  - Allow iptables_t domain to create rawip sockets
  - Allow amanda_t domain to mmap own tmpfs files
  - Allow fcoemon_t domain to write to sysfs_t dirs
  - Allow dovecot_auth_t domain to have dac_override capability
  - Allow geoclue_t domain to mmap own tmp files
  - Allow chronyc_t domain to read network state
  - Allow apcupsd_t domain to execute itself
  - Allow modemmanager_t domain to stream connect to sssd
  - Allow chonyc_t domain to rw userdomain pipes
  - Update dirsrv_read_share() interface to allow caller domain to mmap dirsrv_share_t files
  - Update dirsrvadmin_script_t policy to allow read httpd_tmp_t symlinks
  - Allow nagios_script_t domain to mmap nagios_spool_t files
  - Allow geoclue_t domain to mmap geoclue_var_lib_t files
  - Allow geoclue_t domain to map generic certs
  - Update munin_manage_var_lib_files to allow manage also dirs
  - Allow nsd_t domain to create new socket file in /var/run/nsd.ctl
  - Fix typo in virt SELinux policy module
  - Allow virtd_t domain to create netlink_socket
  - Allow rpm_t domain to write to audit
  - Allow nagios_script_t domain to mmap nagios_etc_t files
  - Update nscd_socket_use() to allow caller domain to stream connect to nscd_t
  - Allow kdumpctl_t domain to getattr fixed disk device in mls
  - Fix typo in stapserver policy
  - Dontaudit abrt_t domain to write to usr_t dirs
  - Revert "Allow rpcbind to bind on all unreserved udp ports"
  - Allow rpcbind to bind on all unreserved udp ports
  - Allow virtlogd to execute itself
  - Allow stapserver several actions: - execute own tmp files - mmap stapserver_var_lib_t files - create stapserver_tmpfs_t files
  - Allow ypxfr_t domain to stream connect to rpcbind and allos search sssd libs
  - Allos systemd to socket activate ibacm service
  - Allow dirsrv_t domain to mmap user_t files
  - Allow dhcpc_t domain to read /dev/random
  - Allow systemd to mounton device_var_lib_t dirs
  - Allow systemd to mounton kernel system table
  - Label also chr_file /dev/mtd.* devices as fixed_disk_device_t
  - Allow syslogd_t domain to create netlink generic sockets
  - Label /dev/tpmrm[0-9]* as tpm_device_t
  - Update dev_filetrans_all_named_dev() to allow create event22-30 character files with label event_device_t
  - Update userdom_security_admin() and userdom_security_admin_template() to allow use auditctl
  - Allow insmod_t domain to read iptables pid files
  - Allow systemd to mounton /etc
  - Allow initrc_domain to mmap all binaries labeled as systemprocess_entry
  - Allow xserver_t domain to start using systemd socket activation
  - Tweak SELinux policy for systemd to allow DynamicUsers systemd feature
  - Associate several proc labels to fs_t
  - Update init_named_socket_activation() interface to allow systemd also create link files in /var/run


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-39
changelog:
  - Merge remote-tracking branch 'fedora-contrib/f28' into rhel8.0-contrib
  - Tomcat should not be unconfined domain
  - Update ibacm_read_pid_files interface to allow also reading link files
  - Allow zebra_t domain to create packet_sockets
  - Allow opafm_t domain to list sysfs
  - Label /usr/libexec/cyrus-imapd/cyrus-master as cyris_exec_t
  - Allow tomcat Tomcat to delete a temporary file used when compiling class files for JSPs.
  - Allow chronyd_t domain to read virt_var_lib_t files
  - Allow tomcat services create link file in /tmp
  - Label /etc/shorewall6 as shorewall_etc_t
  - Allow winbind_t domain kill in user namespaces
  - Allow firewalld_t domain to read random device
  - Allow abrt_t domain to do execmem
  - Allow geoclue_t domain to execute own var_lib_t files
  - Allow openfortivpn_t domain to read system network state
  - Allow dnsmasq_t domain to read networkmanager lib files
  - sssd: Allow to limit capabilities using libcap
  - sssd: Remove unnecessary capability
  - sssd: Do not audit usage of lib nss_systemd.so
  - Fix bug in nsd.fc, /var/run/nsd.ctl is socket file not file
  - Add correct namespace_init_exec_t context to /etc/security/namespace.d/*
  - Update nscd_socket_use to allow caller domain to mmap nscd_var_run_t files
  - Allow exim_t domain to mmap bin files
  - Allow mysqld_t domain to executed with nnp transition
  - Allow svirt_t domain to mmap svirt_image_t block files
  - Add caps dac_read_search and dav_override to pesign_t domain
  - Allow iscsid_t domain to mmap userio chr files
  - Merge remote-tracking branch 'fedora-base/f28' into rhel8.0-base
  - Revert "Add new interface dev_map_userio()"
  - Add new interface dev_map_userio()
  - Allow systemd to read ibacm pid files
  - Allow systemd to create symlinks in for /var/lib
  - Add comment to show that template call also allows changing shells
  - Document userdom_change_password_template() behaviour
  - Merge remote-tracking branch 'fedora-base/f28' into rhel8.0-base
  - update files_mounton_kernel_symbol_table() interface to allow caller domain also mounton system_map_t file
  - Fix typo in logging SELinux module
  - Allow usertype to mmap user_tmp_type files
  - In domain_transition_pattern there is no permission allowing caller domain to execu_no_trans on entrypoint, this patch fixing this issue
  - Revert "Add execute_no_trans permission to mmap_exec_file_perms pattern"
  - Add boolean: domain_can_mmap_files.
  - Allow ipsec_t domian to mmap own tmp files
  - Add .gitignore file
  - Add execute_no_trans permission to mmap_exec_file_perms pattern
  - Allow sudodomain to search caller domain proc info
  - Allow audisp_remote_t domain to read auditd_etc_t
  - netlabel: Remove unnecessary sssd nsswitch related macros
  - Allow to use sss module in auth_use_nsswitch
  - Limit communication with init_t over dbus
  - Add actual modules.conf to the git repo
  - Add few interfaces to optional block
  - Allow sysadm_t and staff_t domain to manage systemd unit files
  - Add interface dev_map_userio_dev()
  Resolves: rhbz#1623411
  Resolves: rhbz#1624648
  Resolves: rhbz#1596618
  Resolves: rhbz#1574878
  Resolves: rhbz#1577324
  Resolves: rhbz#1625202
  Resolves: rhbz#1581715
  Resolves: rhbz#1625127


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-40
changelog:
  - Tomcat should not be unconfined domain
  - Allow cockpit_t domain to read systemd state
  - Allow abrt_t domain to write to usr_t files
  - Allow cockpit to create motd file in /var/run/cockpit
  - Label /usr/sbin/pcsd as cluster_exec_t
  - Allow pesign_t domain to getattr all fs
  - Allow tomcat servers to manage usr_t files
  - Dontaudit tomcat serves to append to /dev/random device
  - Allow dirsrvadmin_script_t domain to read httpd tmp files
  - Allow sbd_t domain to getattr of all char files in /dev and read sysfs_t files and dirs
  - Revert "Allow firewalld_t domain to read random device"
  - Allow postfix domains to mmap system db files
  - Allow geoclue_t domain to execute own tmp files
  - Allow virt_qemu_ga_t domain to read network state BZ(1592145)
  - Update ibacm_read_pid_files interface to allow also reading link files
  - Allow zebra_t domain to create packet_sockets
  - Allow opafm_t domain to list sysfs
  - Label /usr/libexec/cyrus-imapd/cyrus-master as cyris_exec_t
  - Add boolean: domain_can_mmap_files.
  - Allow sshd_t domain to read cockpit pid files
  - Allow syslogd_t domain to manage cert_t files
  - Allow getattr as part of files_mounton_kernel_symbol_table.
  - Fix typo "aduit" -> "audit"
  - Revert "Add new interface dev_map_userio()"
  - Add new interface dev_map_userio()
  - Allow systemd to read ibacm pid files
  Resolves: rhbz#1615318
  Resolves: rhbz#1619001
  Resolves: rhbz#1627646


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-41
changelog:
  - Tomcat should not be unconfined domain
  - Fix typo in cockpit interfaces we have cockpit_var_run_t files not cockpit_var_pid_t
  - Add interface apcupsd_read_power_files()
  - Allow systemd labeled as init_t to execute logrotate in logrotate_t domain
  - Allow dac_override capability to amanda_t domain
  - Allow geoclue_t domain to get attributes of fs_t filesystems
  - Update selinux policy for rhnsd_t domain based on changes in spacewalk-2.8-client
  Resolves: rhbz#1629678
  Resolves: rhbz#1629685
  Resolves: rhbz#1626100
  Resolves: rhbz#1629588
  Resolves: rhbz#1630317


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-42
changelog:
  - Allow cockpit to create motd file in /var/run/cockpit
  Resolves: rhbz#1629678
  - Allow cockpit_t domain to read systemd state
  Resolves: rhbz#1629588


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-43
changelog:
  - Allow ibacm_t domain to read/write to infiniband devices Allow ibacm_t domain to getattr tmpfs_t filesystem.
  Resolves: rhbz#1635674
  - Update SELinux policy for libreswan based on the latest rebase 3.26
  Resolves: rhbz#1637089


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-44
changelog:
  - Update rpm macros for selinux policy from sources repository: https://github.com/fedora-selinux/selinux-policy-macros
  Resolves: rhbz#1633198
  - Allow boltd_t to read fwupd_t processes state
  - Turn named_write_master_zones boolean on by default.
  Resolves: rhbz#1633158
  - Label /etc/rhsm as rhsmcertd_config_t
  Resolves: rhbz#1636212
  - Allow httpd_t domain to write to httpd_config_t dirs if httpd_run_ipa boolean is turned on
  Resolves: rhbz#1624930
  - Allow dhcpd_t domain to mmap dhcpd_state_t files
  Resolves: rhbz#1635643
  - Allow abrt_t domain to manage usr_t dirs
  Resolves: rhbz#1619001
  - Allow certmonger_t domain to manage cockpit pid files
  Resolves: rhbz#1629685
  - Update opafm_t domain after basic testing this service
  Resolves: rhbz#1627861
  - Allow systemd-tty-ask to ask for password of encrypted partions during boot
  Resolves: rhbz#1638666
  - Update sysnet_read_dhcp_config interface to allow caller domain also mmap dhcp_etc_t files
  - Add interface files_manage_usr_dirs()


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-45
changelog:
  - Allow gpg_t to create own tmpfs dirs and sockets
  - Allow rhsmcertd_t domain to relabel cert_t files
  - Add SELinux policy for kpatch
  Resolves: rhbz#1630198
  - Allow nova_t domain to use pam
  - sysstat: grant sysstat_t the search_dir_perms set
  - Allow boltd_t domain to dbus chat with fwupd_t domain BZ(1633786)
  - Allow caller domains using cron_*_role to have entrypoint permission on system_cron_spool_t files BZ(1625645)
  - Add interface cron_system_spool_entrypoint()
  - Bolt added d-bus API for force-powering the thunderbolt controller, so system-dbusd needs acces to boltd pipes BZ(1637676)
  - Add interfaces for boltd SELinux module
  - Add dac_override capability to modemmanager_t domain BZ(1636608)
  - Add interface miscfiles_relabel_generic_cert()
  - Make kpatch policy active
  - Fix userdom_write_user_tmp_dirs() to allow caller domain also read/write user_tmp_t dirs
  - Dontaudit sys_admin capability for netutils_t domain
  - Label tcp and udp ports 2611 as qpasa_agent_port_t
  - Allow systemd to mount boltd_var_run_t dirs BZ(1636823)
  - Label correctly /var/named/chroot*/dev/unrandom in bind chroot.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-46
changelog:
  - Add dac_override capability to ftpd_t domain
  Resolves: rhbz#1641049
  - Allow X display manager to check status and reload services which are part of x_domain attribute
  Resolves: rhbz#1641082


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-47
changelog:
  - Update pesign policy to allow pesign_t domain to read bind cache files/dirs
  Resolves: rhbz#1644796
  - Add dac_override capability to mdadm_t domain
  Resolves: rhbz#1599646
  - Create ibacm_tmpfs_t type for the ibacm policy
  Resolves: rhbz#1581715
  - Dontaudit capability sys_admin for dhcpd_t domain
  Resolves: rhbz#1635643
  - Makes rhsmcertd_t domain an exception to the constraint preventing changing the user identity in object contexts.
  Resolves: rhbz#1639181
  - Allow abrt_t domain to mmap generic tmp_t files
  Resolves:rhbz#1644727
  - Label /usr/sbin/wpa_cli as wpa_cli_exec_t
  Resolves: rhbz#1644899
  - Allow sandbox_xserver_t domain write to user_tmp_t files
  Resolves:rhbz#1644315
  - Dontaudit thumb_t domain to setattr on lib_t dirs BZ(1643672)
  - Dontaudit cupsd_t domain to setattr lib_t dirs BZ(1636766)
  - Add dac_override capability to postgrey_t domain BZ(1638954)
  - Allow thumb_t domain to execute own tmpfs files BZ(1643698)
  - Add nnp transition rule for vnstatd_t domain using NoNewPrivileges systemd feature BZ(1643063)
  - Allow l2tpd_t domain to mmap /etc/passwd file BZ(1638948)
  - Allow certutil running as ipsec_mgmt_t domain to mmap ipsec_mgmt pid files Dontaudit ipsec_mgmt_t domain to write to the all mountpoints
  Resolves: rhbz#1644727
  - Add interface files_map_generic_tmp_files()
  - Add dac_override capability to the syslogd_t domain
  Resolves: rhbz#1644373
  - Create systemd_timedated_var_run_t label
  - Update systemd_timedated_t domain to allow create own pid files/access init_var_lib_t files and read dbus files BZ(1646202)
  - Improve fs_manage_ecryptfs_files to allow caller domain also mmap ecryptfs_t files BZ(1630675)
  - kernel/files.fc: Label /run/motd.d(/.*)? as etc_t
  - Allow ipsec_mgmt_t process to send signals other than SIGKILL, SIGSTOP, or SIGCHLD to the ipsec_t domains BZ(1638949)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-48
changelog:
  - Allow sanlock_t domain to read/write sysfs_t files
  Resolves: rhbz#1647594
  - Add dac_override capability to postfix_local_t domain
  - Allow ypbind_t to search sssd_var_lib_t dirs
  - Allow virt_qemu_ga_t domain to write to user_tmp_t files
  - Allow systemd_logind_t to dbus chat with virt_qemu_ga_t
  - Update sssd_manage_lib_files() interface to allow also mmap sssd_var_lib_t files
  - Label /var/lib/private/systemd/ as init_var_lib_t
  Resolves: rhbz#1649312
  - Allow initrc_t domain to create new socket labeled as init_t
  - Allow audisp_remote_t domain remote logging client to read local audit events from relevant socket.
  Resolves: rhbz#1639675
  - Add tracefs_t type to mountpoint attribute
  Resolves: rhbz#1647819
  - Allow useradd_t and groupadd_t domains to send signals to sssd_t
  Resolves: rhbz#1651531
  - Allow systemd_logind_t domain to remove directories labeled as tmpfs_t BZ(1648636)
  - Allow useradd_t and groupadd_t domains to access sssd files because of the new feature in shadow-utils
  Resolves: rhbz#1651531


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-49
changelog:
  - Update nslcd_t domain to allow view kernel and systemd keyrings
  Resolves: rhbz#1657916
  - Allow arpwatch_t domains to execute shell BZ(1644568)
  - Allow processes labeled as ipa_otpd_t stream connect to sssd.
  - Add new SELinux domain pcp_plugin_t.
  Resolves: rhbz#1648386
  - Remove all ganesha bits from gluster and rpc policy
  Resolves: rhbz#1639227
  - Label /usr/share/spamassassin/sa-update.cron as spamd_update_exec_t
  Resolves: rhbz#1656837
  - Add dac_override capability to ssad_t domains
  Resolves: rhbz#1655551
  - Allow pesign_t domain to read gnome home configs
  Resolves: rhbz#1644796
  - Label /usr/libexec/lm_sensors/sensord-service-wrapper as lsmd_exec_t
  Resolves: rhbz#1656055
  - Allow rngd_t domains read kernel state
  Resolves: rhbz#1656054
  - Allow certmonger_t domains to read bind cache
  Resolves: rhbz#1655077
  - Allow ypbind_t domain to stream connect to sssd
  Resolves: rhbz#1583953
  - Allow rngd_t domain to setsched
  Resolves: rhbz#1653872
  - Add interface init_view_key()
  - Allow systemd to mmap all pidfiles
  Resolves: rhbz#1622548
  - Add files_map_all_pids() interface
  - Allow passwd_t domain mamange sssd public nad lib files, read pid files and send signals to sssd_t domains
  Resolves: rhbz#1657291
  - Update xserver_filetrans_home_content() and xserver_filetrans_admin_home_content() unterfaces to allow caller domain to create .vnc dir in users homedir labeled as xdm_home_t
  Resolves: rhbz#1639846
  - Update logging_filetrans_named_content() to allow caller domains of this interface to create /var/log/journal/remote directory labeled as var_log_t
  - Add sys_resource capability to the systemd_passwd_agent_t domain
  Resolves: rhbz#1590981
  - Allow ipsec_t domains to read bind cache
  Resolves: rhbz#1654692
  - kernel/files.fc: Label /run/motd as etc_t
  - Allow systemd to stream connect to userdomain processes
  Resolves: rhbz#1644733


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-50
changelog:
  - Change label of /usr/libexec/lm_sensors/sensord-service-wrapper from lsmd_exec_t to sensord_exec_t
  Resolves: rhbz#1656055
  - Make kpatch_t domain application domain to allow users to execute kpatch in kpatch_t domain.
  Resolves: rhbz#1630198
  - Allow confined users to use new socket classes for bluetooth, alg and tcpdiag sockets
  Resolves: rhbz#1557301
  - Allow sysadm_t,staff_t and unconfined_t domain to execute kpatch as kpatch_t domain
  Resolves: rhbz#1630198


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-51
changelog:
  - Allow tangd_t domain to bind on tcp ports labeled as tangd_port_t
  Resolves: rhbz#1664345
  - Create tangd_port_t with default label tcp/7406
  Resolves: rhbz#1664345
  - Remove tangd_t domain from permissive domains.
  Resolves: rhbz#1664345


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-52
changelog:
  - Fix userdom_admin_user_template() interface by adding bluetooth,alg,dccp create_stream_socket permissions.
  Resolves: rhbz#1557301


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-53
changelog:
  - Update dbus_role_template interface to allow userdomains to accept data from userdomain dbus domains
  Resolves: rhbz#1664448
  - Allow systemd to read selinux logind config
  Resolves: rhbz#1664448
  - Fix userdom_admin_user_template() interface by adding bluetooth,alg,dccp create_stream_socket permissions.
  - Allow transition from init_t domain to user_t domain during ssh login with confined user user_u
  Resolves: rhbz#1664448


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-54
changelog:
  - Allow sensord_t domain to use nsswitch and execute shell
  Resolves: rhbz#1656055
  - Allow opafm_t domain to execute lib_t files
  Resolves: rhbz#1627861


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-55
changelog:
  - Fix broken config files because of missing level specification in user_t contexts
  Resolves: rhbz#1664448


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-56
changelog:
  - Allow virt_doamin to read/write dev device
  Resolves: rhbz#1672188
  - Update ibacm_t policy after testing lastest version of this component
  Resolves: rhbz#1635674
  - Allow sensord_t domain to mmap own log files
  Resolves:rhbz#1656055
  - Add dac_override capability for ipa_helper_t
  Resolves: rhbz#1668168
  - Allow sensord_t domain to use nsswitch and execute shell
  Resolves: rhbz#1656055
  - Allow opafm_t domain to execute lib_t files
  Resolves: rhbz#1627861
  - Allow opafm_t domain to manage kdump_crash_t files and dirs
  Resolves: rhbz#1627861
  - Label /dev/sev char device as sev_device_t
  Resolves: rhbz#1672188


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-57
changelog:
  - Allow read network state of system for processes labeled as ibacm_t
  Resolves: rhbz#1635674
  - Allow ibacm_t domain to send dgram sockets to kernel processes
  Resolves: rhbz#1635674
  - Allow virt_doamin to read/write dev device
  Resolves: rhbz#1672188
  - Update ibacm_t policy after testing lastest version of this component
  Resolves: rhbz#1635674
  - Allow sensord_t domain to mmap own log files
  Resolves:rhbz#1656055
  - Label /dev/sev char device as sev_device_t
  Resolves: rhbz#1672188


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-58
changelog:
  - Allow ibacm_t domain to read system state and label all ibacm sockets and symlinks as ibacm_var_run_t in /var/run
  Resolves: rhbz#1635674
  - Update mount_read_pid_files macro to allow also list mount_var_run_t dirs
  Resolves: rhbz#1664448
  - Allow userdomain to stop systemd user session during logout.
  Resolves: rhbz#1664448


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-60
changelog:
  - Update kdump_manage_crash() interface to allow also manage dirs by caller domain
  Resolves: rhbz#1627861


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-61
changelog:
  - Add dac_override capability for sbd_t SELinux domain
  Resolves: rhbz#1677325
  - Allow syslogd_t domain to send null signal to all domains on system
  Resolves: rhbz#1676923


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-5
changelog:
  - Add domain transition that systemd labeled as init_t can execute spamd_update_exec_t binary to run newly created process as spamd_update_t
  Resolves :rhbz#1656837
  - Remove allow rule for virt_qemu_ga_t to write/append user_tmp_t files
  Resolves: rhbz#1648854
  - Label /var/run/user/*/dbus-1 as session_dbusd_tmp_t
  Resolves:rhbz#1688671
  - Add dac_override capability to namespace_init_t domain
  Resolves: rhbz#1557420
  - Label /usr/sbin/corosync-qdevice as cluster_exec_t
  Resolves: rhbz#1690925
  - Label /usr/libexec/dnf-utils as debuginfo_exec_t
  Resolves: rhbz#1711183
  - Label /usr/bin/tshark as wireshark_exec_t
  Resolves: rhbz#1710962
  - Allow rhsmcertd_t domain to read rpm cache files
  Resolves: rhbz#1641648
  - Allow associate all filesystem_types with fs_t
  Resolves: rhbz#1614209
  - Allow init_t to manage session_dbusd_tmp_t dirs
  Resolves: rhbz#1688671
  - Allow systemd_gpt_generator_t to read/write to clearance
  Resolves: rhbz#1558573
  - Allow su_domain_type to getattr to /dev/gpmctl
  Resolves: rhbz#1593667
  - Update userdom_login_user_template() template to make working systemd user session for guest and xguest SELinux users
  Resolves: rhbz#1709372


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-6
changelog:
  - Allow kadmind_t domain to read pkcs11 module configs
  Resolves: rhbz#1664983
  - Allow kadmind_t domain to read named_cache_t files
  Resolves: rhbz#1703241
  - Fix bind_read_cache() interface to allow only read perms to caller domains
  - Allow chronyc_t domain to create own tmpfiles and allow communicate send data over unix dgram sockets
  Resolves: rhbz#1711909
  - Allow wireshark_t domain to create fifo temp files
  Resolves: rhbz#1711005
  - Add domain transition that systemd labeled as init_t can execute spamd_update_exec_t binary to run newly created process as spamd_update_t
  Resolves :rhbz#1656837
  - Remove allow rule for virt_qemu_ga_t to write/append user_tmp_t files
  Resolves: rhbz#1648854
  - Label /var/run/user/*/dbus-1 as session_dbusd_tmp_t
  Resolves:rhbz#1688671
  - Add dac_override capability to namespace_init_t domain
  Resolves: rhbz#1557420
  - Label /usr/sbin/corosync-qdevice as cluster_exec_t
  Resolves: rhbz#1690925
  - Label /usr/libexec/dnf-utils as debuginfo_exec_t
  Resolves: rhbz#1711183
  - Allow rtkit_scheduled for sysadm
  Resolves: rhbz#1703241
  - Fix find commands in Makefiles
  - Allow associate all filesystem_types with fs_t
  Resolves: rhbz#1614209
  - Allow init_t to manage session_dbusd_tmp_t dirs
  Resolves: rhbz#1688671
  - Allow systemd_gpt_generator_t to read/write to clearance
  Resolves: rhbz#1558573
  - Allow su_domain_type to getattr to /dev/gpmctl
  Resolves: rhbz#1593667


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-7
changelog:
  - Allow kadmind_t domain to read home config data
  Resolves: rhbz#1664983
  - Allow sbd_t domain to readwrite cgroups
  Resolves: rhbz#1715134
  - Label /var/log/pacemaker/pacemaker as cluster_var_log_t
  Resolves: rhbz#1712058
  - Allow certmonger_t domain to manage named cache files/dirs


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-9
changelog:
  - Allow redis_t domain to read public sssd files
  Resolves: rhbz#1718200
  - Label /usr/sbin/nft as iptables_exec_t
  Resolves: rhbz#1656891


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-10
changelog:
  - Allow qpidd_t domain to getattr all fs_t filesystem and mmap usr_t files
  - Label /var/kerberos/krb5 as krb5_keytab_t
  Resolves: rhbz#1669975
  - Allow sbd_t domain to manage cgroup dirs
  Resolves: rhbz#1715134
  - Allow wireshark_t domain to create netlink netfilter sockets
  Resolves: rhbz#1711005
  - Allow gpg_agent_t domain to use nsswitch
  Resolves: rhbz#1567073
  - Allow httpd script types to mmap httpd rw content
  Resolves: rhbz#1693137
  - Allow confined users to login via cockpit
  Resolves: rhbz#1718814
  - Replace "-" by "_" in speechdispatcher types names
  - Change condor_domain declaration in condor_systemctl
  - Update interface networkmanager_manage_pid_files() to allow manage also dirs
  Resolves: rhbz#1720070
  - Update virt_use_nfs() boolean to allow virt_t to mmap nfs_t files
  Resolves: rhbz#1719083
  - Fix all interfaces which cannot by compiled because of typos
  Resolves: rhbz#1687460
  - Allow auditd_t domain to send signals to audisp_remote_t domain
  Resolves: rhbz#1726659
  - Allow associate efivarfs_t on sysfs_t
  Resolves: rhbz#1709747
  - Allow userdomain attribute to manage cockpit_ws_t stream sockets
  Resolves: rhbz#1718814
  - Allow ssh_agent_type to read/write cockpit_session_t unnamed pipes
  - Add interface ssh_agent_signal()
  - Dontaudit unpriv_userdomain to manage boot_t files
  Resolves: rhbz#1723773
  - Allow crack_t domain read /et/passwd files
  Resolves: rhbz#1721132
  - Allow dhcpc_t domain to manage network manager pid files
  Resolves: rhbz#1720070


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-12
changelog:
  - Make working wireshark execute byt confined users staff_t and sysadm_t
  Resolves: rhbz#1712788
  - Label user cron spool file with user_cron_spool_t
  Resolves: rhbz#1727342
  - Allow ptp4l_t domain to write to pmc socket which is created by pmc command line tool
  Resolves: rhbz#1668667
  - Update svnserve_t policy to make working svnserve hooks
  Resolves: rhbz#1729955
  - Allow varnishlog_t domain to check for presence of varnishd_t domains
  Resolves: rhbz#1730270
  - Allow lsmd_t domain to execute /usr/bin/debuginfo-install
  Resolves: rhbz#1720648
  - Update sandboxX policy to make working firefox inside SELinux sandbox
  Resolves: rhbz#1663874
  - Remove allow rule from svirt_transition_svirt_sandbox interface to don't allow containers to connect to random services
  Resolves: rhbz#1695248
  - Allow httpd_t domain to read /var/lib/softhsm/tokens to allow httpd daemon to use pkcs#11 devices
  Resolves: rhbz#1690484
  - Allow opafm_t domain to modify scheduling information of another process.
  Resolves: rhbz#1725874
  - Allow gssd_t domain to list tmpfs_t dirs
  Resolves: rhbz#1674470
  - Allow mdadm_t domain to read tmpfs_t files
  Resolves: rhbz#1669996
  - Allow sbd_t domain to check presence of processes labeled as cluster_t
  Resolves: rhbz#1669595
  - Dontaudit httpd_sys_script_t to read systemd unit files
  Resolves: rhbz#1670139
  - Allow blkmapd_t domain to read nvme devices
  Resolves: rhbz#1669985
  - Update cpucontrol_t domain to make working microcode service
  Resolves: rhbz#1669485
  - Allow domain transition from logwatch_t do postfix_postqueue_t
  Resolves: rhbz#1669162
  - Allow chronyc_t domain to create and write to non_security files in case when sysadmin is redirecting output to file e.g: 'chronyc -n tracking > /var/lib/test'
  Resolves: rhbz#1696252
  - Allow httpd_sys_script_t domain to mmap httpdcontent
  Resolves: rhbz#1693137
  - Allow sbd_t to manage cgroups_t files
  Resolves: rhbz#1715134
  - Update wireshark policy to make working tshar labeled as wireshark_t
  Resolves: rhbz#1711005
  - Update virt_use_nfs boolean to allow svirt_t domain to mmap nfs_t files
  Resolves: rhbz#1719083
  - Allow sbd_t domain to use nsswitch
  Resolves: rhbz#1723498
  - Allow sysadm_t and staff_t domains to read wireshark shared memory
  Resolves: rhbz#1712788
  - Label /usr/libexec/utempter/utempter  as utemper_exec_t
  Resolves: rhbz#1729571
  - Allow unconfined_domain_type to setattr own process lnk files.
  Resolves: rhbz#1730500
  - Add interface files_write_generic_pid_sockets()
  - Dontaudit writing to user home dirs by gnome-keyring-daemon
  Resolves: rhbz#1689797
  - Allow staff and admin domains to setpcap in user namespace
  Resolves: rhbz#1673922
  - Allow staff and sysadm to use lockdev
  Resolves: rhbz#1673269
  - Allow staff and sysadm users to run iotop.
  Resolves: rhbz#1671241
  - Dontaudit traceroute_t domain require sys_admin capability
  Resolves: rhbz#1671672
  - Dontaudit dbus chat between kernel_t and init_t
  Resolves: rhbz#1669095
  - Allow systemd labeled as init_t to create mountpoints without any specific label as default_t
  Resolves: rhbz#1696144


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-13
changelog:
  - Allow search krb5_keytab_t dirs for interfaces kerberos_read_keytab() and kerberos_rw_keytab
  Resolves: rhbz#1730144
  - Allow virtlockd process read virtlockd.conf file
  Resolves: rhbz#1733185
  - Relabel  /usr/sbin/virtlockd from virt_exec_t to virtlogd_exec_t.
  Resolves: rhbz#1733185
  - Allow brltty to request to load kernel module
  Resolves: rhbz#1689955
  - Add svnserve_tmp_t label forl svnserve temp files to system private tmp
  Resolves: rhbz#1729955
  - Dontaudit svirt_tcg_t domain to read process state of libvirt
  Resolves: rhbz#1732500
  - Allow mysqld_t domain to domtrans to ifconfig_t domain when executing ifconfig tool
  Resolves: rhbz#1732381
  - Allow cyrus work with PrivateTmp
  Resolves: rhbz#1725023
  - Make cgdcbxd_t domain working with SELinux enforcing.
  Resolves: rhbz#1651991
  - Remove system_r role from staff_u user.
  Resolves: rhbz#1677052
  - Add systemd_private_tmp_type attribute
  Resolves: rhbz#1725023
  - Allow systemd to load kernel modules during boot process.
  Resolves: rhbz#1644805


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-15
changelog:
  - Dontaudit abrt_t domain to read root_t files
  Resolves: rhbz#1734403
  - Allow ipa_dnskey_t domain to read kerberos keytab
  Resolves: rhbz#1730144
  - Update ibacm_t policy
  - Allow dlm_controld_t domain setgid capability
  Resolves: rhbz#1738608
  - Allow auditd_t domain to create auditd_tmp_t temporary files and dirs in /tmp or /var/tmp
  Resolves: rhbz#1740146
  - Update systemd_dontaudit_read_unit_files() interface to dontaudit alos listing dirs
  Resolves: rhbz#1670139


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-17
changelog:
  - Label /usr/libexec/microcode_ctl/reload_microcode as cpucontrol_exec_t
  Resolves: rhbz#1669485
  - Fix typo in networkmanager_append_log() interface
  Resolves: rhbz#1687460
  - Update gpg policy to make ti working with confined users
  Resolves: rhbz#1640296


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-20
changelog:
  - Label /var/log/hawkey.log as rpm_log_t and update rpm named filetrans interfaces.
  - Allow sysadm_t to create hawkey log file with rpm_log_t SELinux label
  Resolves: rhbz#1720639


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-21
changelog:
  - Allow user_mail_domain attribute to manage files labeled as etc_aliases_t.
  Resolves: rhbz#1750405
  - Allow dlm_controld_t domain to read random device
  Resolves: rhbz#1752943
  - Allow haproxy_t domain to read network state of system
  Resolves: rhbz#1746974
  - Allow avahi_t to send msg to lpr_t
  Resolves: rhbz#1752843
  - Create new type ipmievd_helper_t domain for loading kernel modules.
  Resolves: rhbz#1673804
  - networkmanager: allow NetworkManager_t to create bluetooth_socket
  Resolves: rhbz#1747768
  - Label /etc/named direcotory as named_conf_t
  Resolves: rhbz#1759505
  - Update aide_t domain to allow this tool to analyze also /dev filesystem
  Resolves: rhbz#1758265
  - Update zebra SELinux policy to make it work also with frr service
  Resolves: rhbz#1714984
  - Allow chronyd_t domain to manage and create chronyd_tmp_t dirs,files,sock_file objects.
  Resolves: rhbz#1711909
  - Allow chronyc_t domain to append to all non_security files
   Resolves: rhbz#1696252
  - Allow httpd_t domain to read/write named_cache_t files
  Resolves: rhbz#1690484
  - Add new interface bind_rw_cache()
  Resolves: rhbz#1690484
  - Label /var/run/mysql as mysqld_var_run_t
  Resolves: rhbz#1687867
  - Allow cupsd_t domain to create directory with name ppd in dirs labeled as cupsd_etc_t with label cupsd_rw_etc_t.
  Resolves: rhbz#1612552
  - Update cron_role, cron_admin_role and cron_unconfined_role to avoid *_t_t types
  Resolves: rhbz#1647971
  - Allow sandbox_web_type domains to sys_ptrace and sys_chroot in user namespaces
  Resolves: rhbz#1663874
  - Update gnome_dontaudit_read_config
  Resolves: rhbz#1663874
  - Update  tomcat_can_network_connect_db boolean to allow tomcat domains also connect to redis ports
  Resolves: rhbz#1687499
  - Update keepalived policy
  Resolves: rhbz#1728332
  - Add sys_admin capability for keepalived_t labeled processes
  Resolves: rhbz#1729174
  - Fix abrt_upload_watch_t in abrt policy
  Resolves: rhbz#1737419
  - Label /dev/shm/dirsrv/ with dirsrv_tmpfs_t label
  Resolves: rhbz#1737550
  - Allow amanda_t to manage its var lib files and read random_device_t
  Resolves: rhbz#1739137
  - Allow zebrat_t domain to read state of NetworkManager_t processes BZ(1739983)
  Resolves: rhbz#1743684
  - Allow pesign_t domain to read/write named cache files.
  Resolves: rhbz#1745429
  - Allow login user type to use systemd user session
  Resolves: rhbz#1727887
  - Allow avahi_t to send msg to xdm_t
  Resolves: rhbz#1755401
  - Allow ldconfig_t domain to manage initrc_tmp_t objects
  Resolves: rhbz#1756006
  - Add new interface init_write_initrc_tmp_pipes()
  - Add new interface init_manage_script_tmp_files()
  - Add new interface udev_getattr_rules_chr_files()
  - Run lvmdbusd service as lvm_t
  Resolves: rhbz#1726166
  - Label 2618/tcp and 2618/udp as priority_e_com_port_t
  - Label 2616/tcp and 2616/udp as appswitch_emp_port_t
  - Label 2615/tcp and 2615/udp as firepower_port_t
  - Label 2610/tcp and 2610/udp as versa_tek_port_t
  - Label 2613/tcp and 2613/udp as smntubootstrap_port_t
  - Label 3784/tcp and 3784/udp as bfd_control_port_t
  - Allow systemd labeled as init_t domain to remount rootfs filesystem
  Resolves: rhbz#1698197
  - Add interface files_remount_rootfs()
  - New interface files_append_non_security_files()
  - Allow domains systemd_networkd_t and systemd_logind_t to chat over dbus
  Resolves: rhbz#1612552
  - Update userdomains to pass correct parametes based on updates from cron_*_role interfaces
   Resolves: rhbz#1647971
  - Dontaudit sys_admin capability for iptables_t SELinux domain
  Resolves: rhbz#1669040
  - Allow systemd labeled as init_t domain to read/write faillog_t. BZ(1723132)
  Resolves: rhbz#1671019
  - Allow userdomains to dbus chat with policykit daemon
  Resolves: rhbz#1727902
  - Allow ipsec_t domain to read/write named cache files
  Resolves: rhbz#1743777
  - Add sys_admin capability for ipsec_t domain
  Resolves: rhbz#1753662


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-22
changelog:
  - Allow ldconfig_t domain to manage initrc_tmp_t link files Allow netutils_t domain to write to initrc_tmp_t fifo files
  Resolves: rhbz#1756006
  - Allow user domains to manage user session services
  Resolves: rhbz#1727887
  - Allow staff and user users to get status of user systemd session
  Resolves: rhbz#1727887


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-23
changelog:
  - Label only regular files inside /usr/lib/frr direcotry as zebra_exec_t
  Resolves: rhbz#1714984
  - Dontaudit and disallow sys_admin capability for keepalived_t domain
  Resolves: rhbz#1729174
  - Allow processes labeled as keepalived_t domain to get process group
  Resolves: rhbz#1746955


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-24
changelog:
  - Allow confined users to run newaliases
  Resolves:rhbz#1750405
  - Add interface mysql_dontaudit_rw_db()
  Resolves: rhbz#1747926
  - Label /var/lib/xfsdump/inventory as amanda_var_lib_t
  Resolves: rhbz#1739137
  - Allow tmpreaper_t domain to read all domains state
  Resolves: rhbz#1765065
  - Allow ipa_ods_exporter_t domain to read krb5_keytab files
  Resolves: rhbz#1759900
  - Allow rhsmcertd_t domain to read rtas_errd lock files
  Resolves: rhbz#1744234
  - Add new interface rtas_errd_read_lock()
  Resolves: rhbz#1744234
  - Donaudit ifconfig_t domain to read/write mysqld_db_t files
  Resolves: rhbz#1747926


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-25
changelog:
  - Allow sssd_t domain to read gnome config and named cache files
  Resolves: rhbz#1743907
  - Allow httpd_t to signull mailman_cgi_t process
  Resolves: rhbz#1686462
  - Update virt_read_content interface to allow caller domain mmap virt_content_t block devices and files
  Resolves: rhbz#1758545
  - Allow cachefilesd_t domain to read/write cachefiles_device_t devices
  Resolves: rhbz#1750096
  - Remove setting label for /dev/cachefilesd char device from cachefilesd policy. This should be added in base policy
  Resolves: rhbz#1750096
  - Allow pcp_pmcd_t domain to bind on udp port labeled as statsd_port_t
  Resolves:rhbz#1746511
  - Label libvirt drivers as virtd_exec_t
  Resolves: rhbz#1745076
  - Update apache and pkcs policies to make active opencryptoki rules
  Resolves: rhbz#1744198
  - Introduce new bolean httpd_use_opencryptoki
  Resolves: rhbz#1744198
  - Allow gssproxy_t domain read state of all processes on system
  Resolves: rhbz#1752031
  - Dontaudit tmpreaper_t getting attributes from sysctl_type files
  Resolves: rhbz#1730204
  - Added macro for timedatex to chat over dbus.
  Resolves: rhbz#1730204
  - Run timedatex service as timedatex_t
  Resolves: rhbz#1730204
  - Run lldpd service as lldpad_t.
  Resolves: rhbz#1726246
  - Allow abrt_upload_watch_t domain to send dgram msgs to kernel processes and stream connect to journald
  - Allow tmpreaper_t domain to getattr files labeled as mtrr_device_t
  Resolves: rhbz#1765065
  - Allow rhsmcertd_t domain to read/write rtas_errd_var_lock_t files
  Resolves: rhbz#1744234
  - Allow tmpwatch process labeled as tmpreaper_t domain to execute fuser command.
  Resolves: rhbz#1765065
  - Update tmpreaper_t policy due to fuser command
  Resolves: rhbz#1765065
  - Allow fail2ban_t domain to create netlink netfilter sockets.
  Resolves: rhbz#1766415
  - Label /dev/cachefilesd as cachefiles_device_t
  Resolves: rhbz#1750096
  - Label udp 8125 port as statsd_port_t
  Resolves: rhbz#1746511
  - Allow systemd(init_t) to load kernel modules
  Resolves: rhbz#1758255
  - Dontaudit sys_admin capability for auditd_t domains
  Resolves: rhbz#1669040
  - Allow x_userdomain to dbus_chat with timedatex.
  Resolves: rhbz#1730204


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-26
changelog:
  - New policy for rrdcached
  Resolves: rhbz#1726255
  - Update timedatex policy
  - Update timedatex SELinux policy to to sychronizate time with GNOME and add new macro chronyd_service_status to chronyd.if
  - Add new macro systemd_timedated_status to systemd.if to get timedated service status
  Resolves: rhbz#1730204
  - Update lldpad_t policy module
  Resolves: rhbz#1726246
  - Dontaudit sandbox web types to setattr lib_t dirs
  Resolves: rhbz#1739858
  - Fix typo in cachefiles device
  Resolves: rhbz#1750096


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-27
changelog:
  - Allow timedatex_t domain dbus chat with both confined and unconfined users
  Resolves: rhbz#1771513
  - Fix typo bugs in rtas_errd_read_lock() interface
  Resolves: rhbz#1750096
  - Allow timedatex_t domain to systemctl chronyd domains
  Resolves: rhbz#1771513
  - Fix typo in dev_filetrans_all_named_dev()
  Resolves: rhbz#1750096


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-30
changelog:
  - Allow userdomain dbus chat with systemd_resolved_t
  Resolves: rhbz#1773463
  - Allow init_t read and setattr on /var/lib/fprintd
  Resolves: rhbz#1781696
  - Allow sysadm_t dbus chat with colord_t
  Resolves: rhbz#1772669
  - Allow confined users run fwupdmgr
  Resolves: rhbz#1772619
  - Allow confined users run machinectl
  Resolves: rhbz#1772625
  - Allow systemd labeled as init_t domain to create dirs labeled as var_t
  Resolves: rhbz#1778126
  - Allow systemd labeled as init_t domain to manage faillog_t objects
  Resolves: rhbz#1671019
  - Add fprintd_read_var_lib_dir and fprintd_setattr_var_lib_dir interfaces
  Resolves: rhbz#1781696
  - Allow pulseaudio create .config and dgram sendto to unpriv_userdomain
  Resolves: rhbz#1703231
  - Allow abrt_dump_oops_t domain to create udp sockets BZ(1778030)
  Resolves: rhbz#1777761
  - Change type in transition for /var/cache/{dnf,yum} directory
  Resolves: rhbz#1686833
  - Revert "Update zebra SELinux policy to make it work also with frr service"
  This reverts commit 73653250a252ad6eefcb3aae00749017e396ab8d.
  - Revert "Label only regular files inside /usr/lib/frr direcotry as zebra_exec_t"
  This reverts commit a19eb1021cbd6c637344954cead54caae081e07c.
  - Allow stratis_t domain to request load modules
  Resolves: rhbz#1726259
  - Allow stratisd to connect to dbus
  Resolves: rhbz#1726259
  - Run stratisd service as stratisd_t
  Resolves: rhbz#1726259
  - Add support for smart card authentication in cockpit BZ(1690444)
  Resolves: rhbz#1771414
  - cockpit: Support split-out TLS proxy
  Resolves: rhbz#1771414
  - cockpit: Allow cockpit-session to read cockpit-tls state
  Resolves: rhbz#1771414
  - Update cockpit policy
  Resolves: rhbz#1771414
  - cockpit: Support https instance factory
  Resolves: rhbz#1771414
  - cockpit: Allow cockpit-session to read cockpit-tls state directory
  Resolves: rhbz#1771414
  - Fix nonexisting types in rtas_errd_rw_lock interface
  Resolves: rhbz#1744234


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-33
changelog:
  - Update files_create_var_lib_dirs() interface to allow caller domain also set attributes of var_lib_t directory
  Resolves: rhbz#1778126


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-34
changelog:
  - Added macro for stratisd to chat over dbus
  - Add dac_override capability to stratisd_t domain
  - Allow userdomain to chat with stratisd over dbus.
  Resolves: rhbz#1787298


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-35
changelog:
  - Allow stratisd_t domain to read/write fixed disk devices and removable devices.
  Resolves: rhbz#1790795


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-37
changelog:
  - Make stratisd_t domain unconfined for RHEL-8.2
  Resolves: rhbz#1791557
  - stratisd_t policy updates
  Resolves: rhbz#1791557


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-39
changelog:
  - Allow vhostmd communication with hosted virtual machines
  - Add and update virt interfaces
  Resolves: rhbz#1782925


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-41
changelog:
  - Allow NetworkManager read its unit files and manage services
  - Mark nm-cloud-setup systemd units as NetworkManager_unit_file_t
  Resolves: rhbz#1806894


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-42
changelog:
  - Allow ssh-keygen create file in /var/lib/glusterd
  Resolves: rhbz#1816663
  - Update ctdbd_manage_lib_files() to also allow mmap ctdbd_var_lib_t files
  Resolves: rhbz#1819243
  - Remove container interface calling by named_filetrans_domain.
  - Makefile: fix tmp/%.mod.fc target
  Resolves: rhbz#1821191


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-43
changelog:
  - Update radiusd policy
  Resolves: rhbz#1803407
  - Allow sssd read NetworkManager's runtime directory
  Resolves: rhbz#1781818
  - Label /usr/lib/NetworkManager/dispatcher as NetworkManager_initrc_exec_t
  Resolves: rhbz#1777506
  - Allow ipa_helper_t to read kr5_keytab_t files
  Resolves: rhbz#1769423
  - Add ibacm_t ipc_lock capability
  Resolves: rhbz#1754719
  - Allow opafm_t to create and use netlink rdma sockets.
  Resolves: rhbz#1786670
  - Allow ptp4l_t create and use packet_socket sockets
  Resolves: rhbz#1759214
  - Update ctdbd_t policy
  Resolves: rhbz#1735748
  - Allow glusterd synchronize between master and slave
  Resolves: rhbz#1824662
  - Allow auditd poweroff or switch to single mode
  Resolves: rhbz#1826788
  - Allow init_t set the nice level of all domains
  Resolves: rhbz#1819121
  - Label /etc/sysconfig/ip6?tables\.save as system_conf_t
  Resolves: rhbz#1776873
  - Add file context entry and file transition for /var/run/pam_timestamp
  Resolves: rhbz#1791957


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-44
changelog:
  - Make boinc_var_lib_t label system mountdir attribute
  Resolves: rhbz#1779070
  - Allow aide to be executed by systemd with correct (aide_t) domain
  Resolves: rhbz#1814809
  - Allow chronyc_t domain to use nsswitch
  Resolves: rhbz#1772852
  - Allow nscd_socket_use() for domains in nscd_use() unconditionally
  Resolves: rhbz#1772852
  - Allow gluster geo-replication in rsync mode
  Resolves: rhbz#1831109
  - Update networkmanager_read_pid_files() to allow also list_dir_perms
  Resolves: rhbz#1781818
  - Allow associating all labels with CephFS
  Resolves: bz#1814689
  - Allow tcpdump sniffing offloaded (RDMA) traffic
  Resolves: rhbz#1834773


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-45
changelog:
  - Remove files_mmap_usr_files() call for particular domains
  Related: rhbz#1801214
  - Allow dirsrv_t list cgroup directories
  Resolves: rhbz#1836795
  - Create the kerberos_write_kadmind_tmp_files() interface
  Related: rhbz#1841488
  - Allow realmd_t dbus chat with accountsd_t
  Resolves: rhbz#1792895
  - Allow nagios_plugin_domain execute programs in bin directories
  Resolves: rhbz#1815621
  - Update allow rules set for nrpe_t domain
  Resolves: rhbz#1750821
  - Allow Gluster mount client to mount files_type
  Resolves: rhbz#1753626
  - Allow qemu-kvm read and write /dev/mapper/control
  Resolves: rhbz#1835909
  - Introduce logrotate_use_cifs boolean
  Resolves: rhbz#1795923
  - Allow ptp4l_t sys_admin capability to run bpf programs
  Resolves: rhbz#1759214
  - Allow rhsmd mmap /etc/passwd
  Resolves: rhbz#1814644
  - Remove files_mmap_usr_files() call for systemd_localed_t
  Related: rhbz#1801214
  - Allow domain mmap usr_t files
  Resolves: rhbz#1801214
  - Allow libkrb5 lib read client keytabs
  Resolves: rhbz#1831769
  - Add files_dontaudit_manage_boot_dirs() interface
  Related: rhbz#1803868
  - Create files_create_non_security_dirs() interface
  Related: rhbz#1840265
  - Add new interface dev_mounton_all_device_nodes()
  Related: rhbz#1840265
  - Add new interface dev_create_all_files()
  Related: rhbz#1840265
  - Allow sshd write to kadmind temporary files
  Resolves: rhbz#1841488
  - Create init_create_dirs boolean to allow init create directories
  Resolves: rhbz#1832231
  - Do not audit staff_t and user_t attempts to manage boot_t entries
  Resolves: rhbz#1803868
  - Allow systemd to relabel all files on system.
  Resolves: rhbz#1818981
  - Make dbus-broker service working on s390x arch
  Resolves: rhbz#1840265


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-46
changelog:
  - Fix description tag for the sssd_connect_all_unreserved_ports tunable
  Related: rhbz#1826748
  - Allow journalctl process set its resource limits
  Resolves: rhbz#1825894
  - Add sssd_access_kernel_keys tunable to conditionally access kernel keys
  Resolves: rhbz#1802062
  - Make keepalived work with network namespaces
  Resolves: rhbz#1815281
  - Create sssd_connect_all_unreserved_ports boolean
  Resolves: rhbz#1826748
  - Allow hypervkvpd to request kernel to load a module
  Resolves: rhbz#1842414
  - Allow systemd_private_tmp(dirsrv_tmp_t)
  Resolves: rhbz#1836820
  - Allow radiusd connect to gssproxy over unix domain stream socket
  Resolves: rhbz#1813572
  - Add fwupd_cache_t file context for '/var/cache/fwupd(/.*)?'
  Resolves: rhbz#1832231
  - Modify kernel_rw_key() not to include append permission
  Related: rhbz#1802062
  - Add kernel_rw_key() interface to access to kernel keyrings
  Related: rhbz#1802062
  - Modify systemd_delete_private_tmp() to use delete_*_pattern macros
  Resolves: rhbz#1836820
  - Allow systemd-modules to load kernel modules
  Resolves: rhbz#1823246
  - Add cachefiles_dev_t as a typealias to cachefiles_device_t
  Resolves: rhbz#1814796


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-47
changelog:
  - Allow virtlogd_t manage virt lib files
  Resolves: rhbz#1832756
  - Allow pdns server to read system state
  Resolves: rhbz#1801214
  - Support systemctl --user in machinectl
  Resolves: rhbz#1788616
  - Allow chkpwd_t read and write systemd-machined devpts character nodes
  Resolves: rhbz#1788616
  - Allow init_t write to inherited systemd-logind sessions pipes
  Resolves: rhbz#1788616
  - Label systemd-growfs and systemd-makefs as fsadm_exec_t
  Resolves: rhbz#1820798
  - Allow staff_u and user_u setattr generic usb devices
  Resolves: rhbz#1783325
  - Allow sysadm_t dbus chat with accountsd
  Resolves: rhbz#1828809


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-49
changelog:
  - Additional support for keepalived running in a namespace
  Resolves: rhbz#1815281
  - Allow keepalived manage its private type runtime directories
  Resolves: rhbz#1815281
  - Run ipa_helper_noatsecure(oddjob_t) only if the interface exists
  Resolves: rhbz#1853432
  - Allow oddjob_t process noatsecure permission for ipa_helper_t
  Resolves: rhbz#1853432
  - Allow domain dbus chat with systemd-resolved
  Resolves: rhbz#1852378
  - Define file context for /var/run/netns directory only
  Related: rhbz#1815281


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-50
changelog:
  - Revert "Allow qemu-kvm read and write /dev/mapper/control"
  This reverts commit f948eaf3d010215fc912e42013e4f88870279093.
  - Allow smbd get attributes of device files labeled samba_share_t
  Resolves: rhbz#1851816
  - Allow tomcat read user temporary files
  Resolves: rhbz#1857675
  - Revert "Dontaudit and disallow sys_admin capability for keepalived_t domain"
  Resolves: rhbz#1815281
  - Label /tmp/krb5_0.rcache2 with krb5_host_rcache_t
  Resolves: rhbz#1848953
  - Allow auditd manage kerberos host rcache files
  Resolves: rhbz#1855770


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-51
changelog:
  - Allow kadmind manage kerberos host rcache
  Resolves: rhbz#1863043
  - Allow virtlockd only getattr and lock block devices
  Resolves: rhbz#1832756
  - Allow qemu-ga read all non security file types conditionally
  Resolves: rhbz#1747960
  - Allow virtlockd manage VMs posix file locks
  Resolves: rhbz#1832756
  - Add dev_lock_all_blk_files() interface
  Resolves: rhbz#1832756
  - Allow systemd-logind dbus chat with fwupd
  Resolves: rhbz#1851932
  - Update xserver_rw_session macro
  Resolves: rhbz#1851448


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-52
changelog:
  - Add ipa_helper_noatsecure() interface unconditionally
  Resolves: rhbz#1853432
  - Conditionally allow nagios_plugin_domain dbus chat with init
  Resolves: rhbz#1750821
  - Revert "Update allow rules set for nrpe_t domain"
  Resolves: rhbz#1750821
  - Add ipa_helper_noatsecure() interface to ipa.if
  Resolves: rhbz#1853432
  - Allow tomcat map user temporary files
  Resolves: rhbz#1857675
  - Allow tomcat manage user temporary files
  Resolves: rhbz#1857675
  - Add file context for /sys/kernel/tracing
  Resolves: rhbz#1847331
  - Define named file transition for sshd on /tmp/krb5_0.rcache2
  Resolves: rhbz#1848953


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-53
changelog:
  - Allow certmonger fowner capability
  Resolves: rhbz#1870596
  - Define named file transition for saslauthd on /tmp/krb5_0.rcache2
  Resolves: rhbz#1870300
  - Label /usr/libexec/qemu-pr-helper with virtd_exec_t
  Resolves: rhbz#1867115


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-55
changelog:
  - Allow init dbus chat with kernel
  Resolves: rhbz#1694681
  - Confine systemd-sleep service
  Resolves: rhbz#1850177
  - Add default file context for /usr/libexec/pcp/lib/*
  Resolves: rhbz#1886369
  - Allow rtkit_daemon_t to uise sys_ptrace usernamespace capability
  Resolves: rhbz#1873658
  - Add fstools_rw_swap_files() interface
  Resolves: rhbz#1850177


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-56
changelog:
  - Let keepalived bind a raw socket
  Resolves: rhbz#1895130
  - Add fetchmail_uidl_cache_t type for /var/mail/.fetchmail.pid
  Resolves: rhbz#1853389
  - Allow arpwatch create and use rdma socket
  Resolves: rhbz#1843409
  - Set correct default file context for /usr/libexec/pcp/lib/*
  Resolves: rhbz#1886369
  - Allow systemd-logind manage efivarfs files
  Resolves: rhbz#1869979
  - Allow systemd_resolved_t to read efivarfs
  Resolves: rhbz#1869979
  - Allow systemd_modules_load_t to read efivarfs
  Resolves: rhbz#1869979
  - Allow read efivarfs_t files by domains executing systemctl file
  Resolves: rhbz#1869979
  - Introduce systemd_read_efivarfs_type attribute
  Resolves: rhbz#1869979


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-57
changelog:
  - Allow dovecot bind to smtp ports
  Resolves: rhbz#1881884
  - Change fetchmail temporary files path to /var/spool/mail
  Resolves: rhbz#1853389
  - Set file context for symlinks in /etc/httpd to etc_t
  Resolves: rhbz#1900650
  - Allow dnsmasq read public files
  Resolves: rhbz#1782539
  - Fix range for unreserved ports
  Resolves: rhbz#1794531
  - Introduce logging_syslogd_append_public_content tunable
  Resolves: rhbz#1823672
  - Add files_search_non_security_dirs() interface
  Resolves: rhbz#1823672
  - Add miscfiles_append_public_files() interface
  Resolves: rhbz#1823672


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-58
changelog:
  - Allow kexec manage generic tmp files
  Resolves: rhbz#1896424
  - Update systemd-sleep policy
  Resolves: rhbz#1850177
  - Add groupadd_t fowner capability
  Resolves: rhbz#1884179


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-59
changelog:
  - Add cron_dbus_chat_system_job() interface
  Resolves: rhbz#1883906
  - Dontaudit firewalld dac_override capability
  Resolves: rhbz#1759010
  - Allow tcsd the setgid capability
  Resolves: rhbz#1898694
  - Allow timedatex dbus chat with cron system domain
  Resolves: rhbz#1883906
  - Allow systemd_hostnamed_t domain to dbus chat with sosreport_t domain
  Resolves: rhbz#1854299
  - Allow pcp-pmcd manage perf_events
  Resolves: rhbz#1901958
  - Label /dev/isst_interface as cpu_device_t
  Resolves: rhbz#1902227
  - Allow ipsec set the context of a SPD entry to the default context
  Resolves: rhbz#1880474
  - Allow sysadm_u user and unconfined_domain_type manage perf_events
  Resolves: rhbz#1901958
  - Add manage_perf_event_perms object permissions set
  Resolves: rhbz#1901958
  - Add perf_event access vectors.
  Resolves: rhbz#1901958
  - Remove "ipa = module" from modules-targeted-contrib.conf
  Resolves: rhbz#1461914


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-60
changelog:
  - Allow wireshark create and use rdma socket
  Resolves: rhbz#1844370
  - Allow to use nnp_transition in pulseaudio_role
  Resolves: rhbz#1854471
  - Allow certmonger fsetid capability
  Resolves: rhbz#1873211
  - Add rsync_sys_admin tunable to allow rsync sys_admin capability
  Resolves: rhbz#1889673
  - Allow sysadm read and write /dev/rfkill
  Resolves: rhbz#1831630
  - Allow staff_u run pam_console_apply
  Resolves: rhbz#1817690
  - Label /dev/vhost-vdpa-[0-9]+ as vhost_device_t
  Resolves: rhbz#1907485


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-61
changelog:
  - Add kpatch_exec() interface
  Resolves: rhbz#1895322
  - Allow rhsmcertd execute kpatch
  Resolves: rhbz#1895322
  - Allow openvswitch_t perf_event open permission
  Resolves: rhbz#1916046
  - Allow openvswitch fowner capability and create netlink sockets
  Resolves: rhbz#1883980
  - Add net_broadcast capability to openvswitch_t domain
  Resolves: rhbz#1883980
  - Update interface modutils_read_module_deps to allow caller domain also mmap modules_dep_t files
  Resolves: rhbz#1883980
  - Allow machinectl to run pull-tar
  Resolves: rhbz#1788055


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-62
changelog:
  - Allow rhsmcertd_t domain transition to kpatch_t
  Resolves: rhbz#1895322
  - Revert "Add kpatch_exec() interface"
  Resolves: rhbz#1895322
  - Revert "Allow rhsmcertd execute kpatch"
  Resolves: rhbz#1895322
  - Dontaudit NetworkManager_t domain to write to kdump temp pipies
  Resolves: rhbz#1842897
  - Allow NetworkManager_t domain to get status of samba services
  Resolves: rhbz#1781806
  - Allow openvswitch create and use xfrm netlink sockets
  Resolves: rhbz#1916046
  - Allow openvswitch_t perf_event write permission
  Resolves: rhbz#1916046
  - Add write_perf_event_perms object permission set
  Related: rhbz#1916046


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-63
changelog:
  - Allow rtkit_daemon_t domain set process nice value in user namespaces
  Resolves: rhbz#1910507
  - Allow gpsd read and write ptp4l_t shared memory.
  Resolves: rhbz#1803845
  - Label /var/run/pcsd-ruby.socket socket with cluster_var_run_t type
  Resolves: rhbz#1804626
  - Allow Certmonger to use opencryptoki services
  Resolves: rhbz#1894132
  - Dontaudit vhostmd to write in /var/lib/rpm/ dir and allow signull rpm
  Resolves: rhbz#1815603
  - Allow rhsmcertd_t read kpatch lib files
  Resolves: rhbz#1895322
  - Allow ipsec_t connectto ipsec_mgmt_t
  Resolves: rhbz#1848355
  - Allow IPsec to use opencryptoki services
  Resolves: rhbz#1894132
  - Allow systemd-importd create /run/systemd/machines.lock file
  Resolves: rhbz#1788055


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-64
changelog:
  - Allow unconfined_t and kprop_t to create krb5_0.rcache2 with the right context
  Resolves: rhbz#1874527
  Resolves: rhbz#1877044
  - Allow rhsmcertd bind tcp sockets to a generic node
  Resolves: rhbz#1923985
  - Allow ipsec_mgmt_t mmap ipsec_conf_file_t files
  Resolves: rhbz#1889542
  - Allow strongswan start using swanctl method
  Resolves: rhbz#1889542
  - Allow systemd-importd manage machines.lock file
  Resolves: rhbz#1788055


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-68
changelog:
  - Allow pluto IKEv2 / ESP over TCP
  Resolves: rhbz#1931848
  - Label SDC(scini) Dell Driver
  Resolves: rhbz#1936882
  - Add file context specification for /var/tmp/tmp-inst
  Resolves: rhbz#1919253
  - Allow virtlogd_t to create virt_var_lockd_t dir
  Resolves: rhbz#1941464
  - Allow cups-lpd read its private runtime socket files
  Resolves: rhbz#1919399


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-69
changelog:
  - Add /var/usrlocal equivalency rule
  Resolves: rhbz#1943381
  - Label '/var/usrlocal/(.*/)?sbin(/.*)?' as bin_t
  Resolves: rhbz#1943381
  - Label /dev/trng with random_device_t
  Resolves: rhbz#1934483
  - Allow systemd-sleep transition to sysstat_t
  Resolves: rhbz#1927551
  - Allow systemd-sleep transition to tlp_t
  Resolves: rhbz#1927551
  - Allow systemd-sleep transition to unconfined_service_t on bin_t executables
  Resolves: rhbz#1927551
  - Allow systemd-sleep execute generic programs
  Resolves: rhbz#1948070
  - Allow systemd-sleep execute shell
  Resolves: rhbz#1954358
  - Allow nsswitch_domain read init pid lnk_files
  Resolves: rhbz#1860924
  - Introduce logging_syslogd_list_non_security_dirs tunable
  Resolves: rhbz#1823669
  - Add sysstat_domtrans() to allow systemd-sleep transition to sysstat_t
  Resolves: rhbz#1927551
  - Change param description in cron interfaces to userdomain_prefix
  Resolves: rhbz#1801249
  - Add missing declaration in rpm_named_filetrans()
  Resolves: rhbz#1801249


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-70
changelog:
  - Allow using opencryptoki for ipsec
  Resolves: rhbz#1894132
  - Remove all kernel_getattr_proc() interface calls
  Resolves: rhbz#1967125
  - Allow domain stat /proc filesystem
  Resolves: rhbz#1967125
  - Allow pkcs-slotd create and use netlink_kobject_uevent_socket
  Resolves: rhbz#1969725
  - Label var.lib.opencryptoki.* files and create pkcs_tmpfs_filetrans()
  Resolves: rhbz#1894132
  - Allow using opencryptoki for certmonger
  Resolves: rhbz#1894132
  - install_t: Allow NoNewPriv transition from systemd
  Resolves: rhbz#1955547
  - Remove all kernel_getattr_proc() interface calls
  Resolves: rhbz#1967125
  - Allow httpd_sys_script_t read, write, and map hugetlbfs files
  Resolves: rhbz#1966133


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-71
changelog:
  - Allow nmap create and use rdma socket
  Resolves: rhbz#1844530
  - Label /.k5identity file allow read of this file to rpc.gssd
  Resolves: rhbz#1951093
  - Label /var/lib/kdump with kdump_var_lib_t
  Resolves: rhbz#1965985
  - Label /run/libvirt/common with virt_common_var_run_t
  Resolves: rhbz#1966842


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-72
changelog:
  - Allow systemd-sleep get attributes of fixed disk device nodes
  Resolves: rhbz#1931460
  - Allow systemd-sleep create hardware state information files
  Resolves: rhbz#1968610
  - virtiofs supports Xattrs and SELinux
  Resolves: rhbz#1899703
  - Label 4460/tcp port as ntske_port_t
  Resolves: rhbz#1961207
  - Add the miscfiles_map_generic_certs macro to the sysnet_dns_name_resolve macro.
  Resolves: rhbz#1961207
  - Allow chronyd_t to accept and make NTS-KE connections
  Resolves: rhbz#1961207
  - Dontaudit NetworkManager write to initrc_tmp_t pipes
  Resolves: rhbz#1963162
  - Allow logrotate rotate container log files
  Resolves: rhbz#1892170
  - Allow rhsmd read process state of all domains and kernel threads
  Resolves: rhbz#1878020


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-73
changelog:
  - Removed adding to attribute unpriv_userdomain from userdom_unpriv_type template
  Resolves: rhbz#1947841
  - Allow transition from xdm domain to unconfined_t domain.
  Resolves: rhbz#1947841
  - Allow nftables read NetworkManager unnamed pipes
  Resolves: rhbz#1967857
  - Create a policy for systemd-journal-upload
  Resolves: rhbz#1913414
  - Add dev_getattr_infiniband_dev() interface.
  Resolves: rhbz#1972522
  - Allow tcpdump and nmap get attributes of infiniband_device_t
  Resolves: rhbz#1972522
  - Allow fcoemon create sysfs files
  Resolves: rhbz#1978562
  - Allow nftables read NetworkManager unnamed pipes
  Resolves: rhbz#1967857
  - Allow radius map its library files
  Resolves: rhbz#1854650
  - Allow arpwatch get attributes of infiniband_device_t devices
  Resolves: rhbz#1936522


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-75
changelog:
  - Add the unconfined_dgram_send() interface
  Resolves: rhbz#1978562
  - Change dev_getattr_infiniband_dev() to use getattr_chr_files_pattern()
  Resolves: rhbz#1936522
  - Add checkpoint_restore cap2 capability
  Resolves: rhbz#1973325
  - Allow fcoemon talk with unconfined user over unix domain datagram socket
  Resolves: rhbz#1978562
  - Allow hostapd bind UDP sockets to the dhcpd port
  Resolves: rhbz#1977676
  - Allow NetworkManager read and write z90crypt device
  Resolves: rhbz#1938203
  - Allow abrt_domain read and write z90crypt device
  Resolves: rhbz#1938203
  - Label /usr/lib/pcs/pcs_snmp_agent with cluster_exec_t
  Resolves: rhbz#1937111
  - Allow mdadm read iscsi pid files
  Resolves: rhbz#1924716


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-76
changelog:
  - Allow login_userdomain read and map /var/lib/systemd files
  Resolves: rhbz#1965251
  - Allow sysadm acces to kernel module resources
  Resolves: rhbz#1965251
  - Allow sysadm to read/write scsi files and manage shadow
  Resolves: rhbz#1965251
  - Allow sysadm access to files_unconfined and bind rpc ports
  Resolves: rhbz#1965251
  - Allow sysadm read and view kernel keyrings
  Resolves: rhbz#1965251
  - Allow bootloader to read tuned etc files
  Resolves: rhbz#1965251
  - Update the policy for systemd-journal-upload
  Resolves: rhbz#1913414
  - Allow journal mmap and read var lib files
  Resolves: rhbz#1965251
  - Allow tuned to read rhsmcertd config files
  Resolves: rhbz#1965251
  - Allow bootloader to read tuned etc files
  Resolves: rhbz#1965251
  - Confine rhsm service and rhsm-facts service as rhsmcertd_t
  Resolves: rhbz#1846081
  - Allow virtlogd_t read process state of user domains
  Resolves: rhbz#1797899
  - Allow cockpit_ws_t get attributes of fs_t filesystems
  Resolves: rhbz#1979182


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-77
changelog:
  - Revert "update libs_filetrans_named_content() to have support for /usr/lib/debug directory"
  Resolves: rhbz#1887739
  - Allow sysadm to read/write scsi files and manage shadow
  Resolves: rhbz#1956302
  - Allow rhsmcertd execute gpg
  Resolves: rhbz#1887572
  - Allow lldpad send to kdump over a unix dgram socket
  Resolves: rhbz#1979121
  - Remove glusterd SELinux module from distribution policy
  Resolves: rhbz#1816718


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-78
changelog:
  - Label /usr/bin/Xwayland with xserver_exec_t
  Resolves: rhbz#1984584
  - Label /usr/libexec/gdm-runtime-config with xdm_exec_t
  Resolves: rhbz#1984584
  - Allow D-bus communication between avahi and sosreport
  Resolves: rhbz#1916397
  - Allow lldpad send to kdumpctl over a unix dgram socket
  Resolves: rhbz#1979121
  - Revert "Allow lldpad send to kdump over a unix dgram socket"
  Resolves: rhbz#1979121
  - Allow chronyc respond to a user chronyd instance
  Resolves: rhbz#1993104
  - Allow ptp4l respond to pmc
  Resolves: rhbz#1993104
  - Allow lldpad send to unconfined_t over a unix dgram socket
  Resolves: rhbz#1993270


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-79
changelog:
  - Introduce xdm_manage_bootloader booelan
  Resolves: rhbz#1994096
  - Rename samba_exec() to samba_exec_net()
  Resolves: rhbz#1855215
  - Allow sssd to set samba setting
  Resolves: rhbz#1855215
  - Allow dirsrv read slapd tmpfs files
  Resolves: rhbz#1843238
  - Allow rhsmcertd to create cache file in /var/cache/cloud-what
  Resolves: rhbz#1994718


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-81
changelog:
  - Allow unconfined domains to bpf all other domains
  Resolves: rhbz#1991443
  - Allow vmtools_unconfined_t domain transition to rpm_script_t
  Resolves: rhbz#1872245
  - Allow unbound connectto unix_stream_socket
  Resolves: rhbz#1905441
  - Label /usr/sbin/virtproxyd as virtd_exec_t
  Resolves: rhbz#1854332
  - Allow postfix_domain to sendto unix dgram sockets.
  Resolves: rhbz#1920521


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-82
changelog:
  - Support sanlock VG automated recovery on storage access loss
  Resolves: rhbz#1985000
  - Allow proper function sosreport in sysadmin role
  Resolves: rhbz#1965251
  - Allow systemd execute user bin files
  Resolves: rhbz#1860443
  - Label /dev/crypto/nx-gzip with accelerator_device_t
  Resolves: rhbz#2011166
  - Allow ipsec_t and login_userdomain named file transition in tmpfs
  Resolves: rhbz#2001599
  - Support sanlock VG automated recovery on storage access loss
  Resolves: rhbz#1985000
  - Allow proper function sosreport via iotop
  Resolves: rhbz#1965251
  - Call pkcs_tmpfs_named_filetrans for certmonger
  Resolves: rhbz#2001599
  - Allow ibacm the net_raw and sys_rawio capabilities
  Resolves: rhbz#2010644
  - Support new PING_CHECK health checker in keepalived
  Resolves: rhbz#2010873
  - Update spamassasin policy to make working /usr/share/spamassassin/sa-update.cron script
  Resolves: rhbz#2011239


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-83
changelog:
  - VQP: Include IANA-assigned TCP/1589
  Resolves: rhbz#1924038
  - Label port 3785/udp with bfd_echo
  Resolves: rhbz#1924038
  - Allow sysadm_t dbus chat with realmd_t
  Resolves: rhbz#2000488
  - Support sanlock VG automated recovery on storage access loss 1/2
  Resolves: rhbz#1985000
  - Revert "Support sanlock VG automated recovery on storage access loss"
  Resolves: rhbz#1985000
  - Support sanlock VG automated recovery on storage access loss
  Resolves: rhbz#1985000
  - radius: Lexical sort of service-specific corenet rules by service name
  Resolves: rhbz#1924038
  - radius: Allow binding to the BDF Control and Echo ports
  Resolves: rhbz#1924038
  - radius: Allow binding to the DHCP client port
  Resolves: rhbz#1924038
  - radius: Allow net_raw; allow binding to the DHCP server ports
  Resolves: rhbz#1924038
  - Support hitless reloads feature in haproxy
  Resolves: rhbz#2015423
  - Allow redis get attributes of filesystems with extended attributes
  Resolves: rhbz#2015435
  - Support sanlock VG automated recovery on storage access loss 2/2
  Resolves: rhbz#1985000
  - Revert "Support sanlock VG automated recovery on storage access loss"
  Resolves: rhbz#1985000


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-84
changelog:
  - Allow sysadm_t read/write pkcs shared memory segments
  Resolves: rhbz#1965251
  - Allow sysadm_t connect to sanlock over a unix stream socket
  Resolves: rhbz#1965251
  - Allow sysadm_t dbus chat with sssd
  Resolves: rhbz#1965251
  - Allow sysadm_t set attributes on character device nodes
  Resolves: rhbz#1965251
  - Allow sysadm_t read and write watchdog devices
  Resolves: rhbz#1965251
  - Allow sysadm_t connect to cluster domains over a unix stream socket
  Resolves: rhbz#1965251
  - Allow sysadm_t dbus chat with tuned 2/2
  Resolves: rhbz#1965251
  - Update userdom_exec_user_tmp_files() with an entrypoint rule
  Resolves: rhbz#1920883
  - Allow sudodomain send a null signal to sshd processes
  Resolves: rhbz#1966945
  - Allow sysadm_t dbus chat with tuned 1/2
  Resolves: rhbz#1965251
  - Allow cloud-init dbus chat with systemd-logind
  Resolves: rhbz#2009769
  - Allow svnserve send mail from the system
  Resolves: rhbz#2004843
  - Allow svnserve_t domain to read system state
  Resolves: rhbz#2004843


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-85
changelog:
  - Allow unconfined_t to node_bind icmp_sockets in node_t domain
  Resolves: rhbz#2025445
  - Allow rhsmcertd get attributes of tmpfs_t filesystems
  Resolves: rhbz#2015820
  - The nfsdcld service is now confined by SELinux
  Resolves: rhbz#2026588
  - Allow smbcontrol use additional socket types
  Resolves: rhbz#2027740
  - Allow lldpd use an snmp subagent over a tcp socket
  Resolves: rhbz#2028379


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-86
changelog:
  - Allow sysadm execute sysadmctl in sysadm_t domain using sudo
  Resolves: rhbz#2013749
  - Allow local_login_t get attributes of tmpfs filesystems
  Resolves: rhbz#2015539
  - Allow local_login_t get attributes of filesystems with ext attributes
  Resolves: rhbz#2015539
  - Allow local_login_t domain to getattr cgroup filesystem
  Resolves: rhbz#2015539
  - Allow systemd read unlabeled symbolic links
  Resolves: rhbz#2021835
  - Allow userdomains use pam_ssh_agent_auth for passwordless sudo
  Resolves: rhbz#1917879
  - Allow sudodomains execute passwd in the passwd domain
  Resolves: rhbz#1943572
  - Label authcompat.py with authconfig_exec_t
  Resolves: rhbz#1919122
  - Dontaudit pkcsslotd sys_admin capability
  Resolves: rhbz#2021887
  - Allow lldpd connect to snmpd with a unix domain stream socket
  Resolves: rhbz#1991029


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-87
changelog:
  - Set default file context for /sys/firmware/efi/efivars
  Resolves: rhbz#2039458
  - Allow sysadm_t start and stop transient services
  Resolves: rhbz#2031065
  - Label /etc/cockpit/ws-certs.d with cert_t
  Resolves: rhbz#1907473
  - Allow smbcontrol read the network state information
  Resolves: rhbz#2033873
  - Allow rhsm-service read/write its private memfd: objects
  Resolves: rhbz#2029873
  - Allow fcoemon request the kernel to load a module
  Resolves: rhbz#1940317
  - Allow radiusd connect to the radacct port
  Resolves: rhbz#2038955
  - Label /var/lib/shorewall6-lite with shorewall_var_lib_t
  Resolves: rhbz#2041447
  - Exclude container.if from selinux-policy-devel
  Resolves: rhbz#1861968


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-89
changelog:
  - Allow NetworkManager talk with unconfined user over unix domain dgram socket
  Resolves: rhbz#2044048
  - Allow system_mail_t read inherited apache system content rw files
  Resolves: rhbz#1988339
  - Add apache_read_inherited_sys_content_rw_files() interface
  Related: rhbz#1988339
  - Allow rhsm-service execute its private memfd: objects
  Resolves: rhbz#2029873
  - Allow dirsrv read configfs files and directories
  Resolves: rhbz#2042568
  - Label /run/stratisd with stratisd_var_run_t
  Resolves: rhbz#1879585
  - Fix path for excluding container.if from selinux-policy-devel
  Resolves: rhbz#1861968


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-90
changelog:
  - Fix badly indented used interfaces
  Resolves: rhbz#2030156
  - Allow domain transition to sssd_t 1/2
  Resolves: rhbz#2022690
  - Allow confined users to use kinit,klist and etc.
  Resolves: rhbz#2026598
  - Allow login_userdomain open/read/map system journal
  Resolves: rhbz#2046481
  - Allow init read stratis data symlinks 2/2
  Resolves: rhbz#2048514
  - Label new utility of NetworkManager nm-priv-helper
  Resolves: rhbz#1986076
  - Label NetworkManager-dispatcher service with separate context
  Resolves: rhbz#1989070
  - Allow domtrans to sssd_t and role access to sssd
  Resolves: rhbz#2030156
  - Creating interface sssd_run_sssd()
  Resolves: rhbz#2030156
  - Allow domain transition to sssd_t 2/2
  Resolves: rhbz#2022690
  - Allow timedatex dbus chat with xdm
  Resolves: rhbz#2040214
  - Associate stratisd_data_t with device filesystem
  Resolves: rhbz#2048514
  - Allow init read stratis data symlinks 1/2
  Resolves: rhbz#2048514
  - Allow rhsmcertd create rpm hawkey logs with correct label
  Resolves: rhbz#1949871


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-92
changelog:
  - Allow postfix_domain read dovecot certificates 1/2
  Resolves: rhbz#2043599
  - Dontaudit dirsrv search filesystem sysctl directories 1/2
  Resolves: rhbz#2042568
  - Allow chage domtrans to sssd
  Resolves: rhbz#2054718
  - Allow postfix_domain read dovecot certificates 2/2
  Resolves: rhbz#2043599
  - Allow ctdb create cluster logs
  Resolves: rhbz#2049481
  - Allow alsa bind mixer controls to led triggers
  Resolves: rhbz#2049730
  - Allow alsactl set group Process ID of a process
  Resolves: rhbz#2049730
  - Dontaudit mdadm list dirsrv tmpfs dirs
  Resolves: rhbz#2011174
  - Dontaudit dirsrv search filesystem sysctl directories 2/2
  Resolves: rhbz#2042568
  - Revert "Label NetworkManager-dispatcher service with separate context"
  Related: rhbz#1989070
  - Revert "Allow NetworkManager-dispatcher dbus chat with NetworkManager"
  Related: rhbz#1989070


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-93
changelog:
  - Allow systemd-networkd dbus chat with sosreport
  Resolves: rhbz#1949493
  - Allow sysadm_passwd_t to relabel passwd and group files
  Resolves: rhbz#2053457
  - Allow confined sysadmin to use tool vipw
  Resolves: rhbz#2053457
  - Allow sosreport dbus chat with abrt and timedatex
  Resolves: rhbz#1949493
  - Remove unnecessary /etc file transitions for insights-client
  Resolves: rhbz#2031853
  - Label all content in /var/lib/insights with insights_client_var_lib_t
  Resolves: rhbz#2031853
  - Update insights-client policy
  Resolves: rhbz#2031853
  - Update insights-client: fc pattern, motd, writing to etc
  Resolves: rhbz#2031853
  - Remove permissive domain for insights_client_t
  Resolves: rhbz#2031853
  - New policy for insight-client
  Resolves: rhbz#2031853
  - Add the insights_client module
  Resolves: rhbz#2031853
  - Update specfile to buildrequire policycoreutils-devel >= 2.9-19
  - Add modules_checksum to %files


author: Nikola Knazekova nknazeko@redhat.com - 3.14.3-94
changelog:
  - Allow chronyd send a message to sosreport over datagram socket
  - Allow systemd-logind dbus chat with sosreport
  Resolves: rhbz#2062607


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-96
changelog:
  - Add interface rpc_manage_exports
  Resolves: rhbz#2062183
  - Allow sshd read filesystem sysctl files
  Resolves: rhbz#2061403
  - Update targetd nfs & lvm
  Resolves: rhbz#2062183
  - Allow dhcpd_t domain to read network sysctls.
  Resolves: rhbz#2059509
  - Allow chronyd talk with unconfined user over unix domain dgram socket
  Resolves: rhbz#2065313
  - Allow fenced read kerberos key tables
  Resolves: rhbz#1964839


author: Nikola Knazekova <nknazeko@redhat.com> - 3.14.3-97
changelog:
  - Create macro corenet_icmp_bind_generic_node()
  Resolves: rhbz#2070870
  - Allow traceroute_t and ping_t to bind generic nodes.
  Resolves: rhbz#2070870
  - Allow administrative users the bpf capability
  Resolves: rhbz#2070983
  - Allow insights-client search rhnsd configuration directory
  Resolves: rhbz#2073395
  - Allow ntlm_auth read the network state information
  Resolves: rhbz#2073349
  - Allow keepalived setsched and sys_nice
  Resolves: rhbz#2008033
  - Revert "Allow administrative users the bpf capability"
  Resolves: rhbz#2070983


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-98
changelog:
  - Allow sysadm user execute init scripts with a transition
  Resolves: rhbz#2039662
  - Change invalid type redisd_t to redis_t in redis_stream_connect()
  Resolves: rhbz#1897517
  - Allow php-fpm write access to /var/run/redis/redis.sock
  Resolves: rhbz#1897517
  - Allow sssd read systemd-resolved runtime directory
  Resolves: rhbz#2060721
  - Allow postfix stream connect to cyrus through runtime socket
  Resolves: rhbz#2066005
  - Allow insights-client create_socket_perms for tcp/udp sockets
  Resolves: rhbz#2073395
  - Allow insights-client read rhnsd config files
  Resolves: rhbz#2073395
  - Allow sblim-sfcbd connect to sblim-reposd stream
  Resolves: rhbz#2075810
  - Allow rngd drop privileges via setuid/setgid/setcap
  Resolves: rhbz#2076641
  - Allow rngd_t domain to use nsswitch
  Resolves: rhbz#2076641


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-99
changelog:
  - Allow ifconfig_t domain to manage vmware logs
  Resolves: rhbz#1721943
  - Allow insights-client manage gpg admin home content
  Resolves: rhbz#2060834
  - Add the gpg_manage_admin_home_content() interface
  Resolves: rhbz#2060834
  - Label /var/cache/insights with insights_client_cache_t
  Resolves: rhbz#2063195
  - Allow insights-client search gconf homedir
  Resolves: rhbz#2087069
  - Allow insights-client create and use unix_dgram_socket
  Resolves: rhbz#2087069
  - Label more vdsm utils with virtd_exec_t
  Resolves: rhbz#2063871
  - Label /usr/libexec/vdsm/supervdsmd and vdsmd with virtd_exec_t
  Resolves: rhbz#2063871
  - Allow sblim-gatherd the kill capability
  Resolves: rhbz#2082677
  - Allow privoxy execmem
  Resolves: rhbz#2083940


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-100
changelog:
  - Update logging_create_generic_logs() to use create_files_pattern()
  Resolves: rhbz#2081907
  - Add the auth_read_passwd_file() interface
  Resolves: rhbz#2083504
  - Allow auditd_t noatsecure for a transition to audisp_remote_t
  Resolves: rhbz#2081907
  - Add support for samba-dcerpcd
  Resolves: rhbz#2083504
  - Allow rhsmcertd create generic log files
  Resolves: rhbz#1852086
  - Allow ctdbd nlmsg_read on netlink_tcpdiag_socket
  Resolves: rhbz#2090800


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-101
changelog:
  - Add the init_status_config_transient_files() interface
  Resolves: rhbz#2091117
  - Allow init_t to rw insights_client unnamed pipe
  Resolves: rhbz#2091117
  - Update kernel_read_unix_sysctls() for sysctl_net_unix_t handling
  Resolves: rhbz#2091117
  - Allow insights-client get status of the systemd transient scripts
  Resolves: rhbz#2091117
  - Allow insights-client execute its private memfd: objects
  Resolves: rhbz#2091117
  - Update policy for insights-client to run additional commands 2
  Resolves: rhbz#2091117
  - Do not call systemd_userdbd_stream_connect() for insights-client
  Resolves: rhbz#2091117
  - Use insights_client_tmp_t instead of insights_client_var_tmp_t
  Resolves: rhbz#2091117
  - Change space indentation to tab in insights-client
  Resolves: rhbz#2091117
  - Use socket permissions sets in insights-client
  Resolves: rhbz#2091117
  - Update policy for insights-client to run additional commands
  Resolves: rhbz#2091117
  - Change rpm_setattr_db_files() to use a pattern
  Resolves: rhbz#2091117
  - Add rpm setattr db files macro
  Resolves: rhbz#2091117
  - Fix insights client
  Resolves: rhbz#2091117
  - Do not let system_cronjob_t create redhat-access-insights.log with var_log_t
  Resolves: rhbz#2091117


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-102
changelog:
  - Allow transition to insights_client named content
  Resolves: rhbz#2091117
  - Add the insights_client_filetrans_named_content() interface
  Resolves: rhbz#2091117
  - Update policy for insights-client to run additional commands 3
  Resolves: rhbz#2091117


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-103
changelog:
  - Allow domain read usermodehelper state information
  Resolves: rhbz#2083504
  - Remove all kernel_read_usermodehelper_state() interface calls
  Resolves: rhbz#2083504
  - Allow samba-dcerpcd work with sssd
  Resolves: rhbz#2096825
  - Allow winbind_rpcd_t connect to self over a unix_stream_socket
  Resolves: rhbz#2096825
  - Update samba-dcerpcd policy for kerberos usage
  Resolves: rhbz#2096825
  - Allow keepalived read the contents of the sysfs filesystem
  Resolves: rhbz#2098189
  - Update policy for samba-dcerpcd
  Resolves: rhbz#2083504
  - Remove all kernel_read_usermodehelper_state() interface calls 2/2
  Resolves: rhbz#2083504
  - Update insights_client_filetrans_named_content()
  Resolves: rhbz#2091117


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-105
changelog:
  - Do not call systemd_userdbd_stream_connect() for winbind-rpcd
  Resolves: rhbz#2108383
  - Update winbind_rpcd_t
  Resolves: rhbz#2108383
  - Allow irqbalance file transition for pid sock_files and directories
  Resolves: rhbz#2111916
  - Update irqbalance runtime directory file context
  Resolves: rhbz#2111916


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-106
changelog:
  - Allow networkmanager to signal unconfined process
  Resolves: rhbz#1918148
  - Allow sa-update to get init status and start systemd files
  Resolves: rhbz#2011239
  - Allow samba-bgqd get a printer list
  Resolves: rhbz#2114737
  - Allow insights-client rpm named file transitions
  Resolves: rhbz#2104913
  - Add /var/tmp/insights-archive to insights_client_filetrans_named_content
  Resolves: rhbz#2104913
  - Use insights_client_filetrans_named_content
  Resolves: rhbz#2104913
  - Make default file context match with named transitions
  Resolves: rhbz#2104913
  - Allow rhsmcertd to read insights config files
  Resolves: rhbz#2104913
  - Label /etc/insights-client/machine-id
  Resolves: rhbz#2104913


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-107
changelog:
  - Label 319/udp port with ptp_event_port_t
  Resolves: rhbz#2118628
  - Allow unconfined and sysadm users transition for /root/.gnupg
  Resolves: rhbz#2119507
  - Add the kernel_read_proc_files() interface
  Resolves: rhbz#2119507
  - Add userdom_view_all_users_keys() interface
  Resolves: rhbz#2119507
  - Allow system_cronjob_t domtrans to rpm_script_t
  Resolves: rhbz#2118362
  - Allow smbd_t process noatsecure permission for winbind_rpcd_t
  Resolves: rhbz#2117199
  - Allow chronyd bind UDP sockets to ptp_event ports
  Resolves: rhbz#2118628
  - Allow samba-bgqd to read a printer list
  Resolves: rhbz#2118958
  - Add gpg_filetrans_admin_home_content() interface
  Resolves: rhbz#2119507
  - Update insights-client policy for additional commands execution
  Resolves: rhbz#2119507
  - Allow gpg read and write generic pty type
  Resolves: rhbz#2119507
  - Allow chronyc read and write generic pty type
  Resolves: rhbz#2119507
  - Disable rpm verification on interface_info
  Resolves: rhbz#2119472


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-108
changelog:
  - Allow unconfined_service_t insights client content filetrans
  Resolves: rhbz#2119507
  - Allow nsswitch_domain to connect to systemd-machined using a unix socket
  Resolves: rhbz#2119507
  - Add init_status_all_script_files() interface
  Resolves: rhbz#2119507
  - Add dev_dontaudit_write_raw_memory() and dev_read_vsock() interfaces
  Resolves: rhbz#2119507
  - Update insights-client policy for additional commands execution 5
  Resolves: rhbz#2119507
  - Confine insights-client systemd unit
  Resolves: rhbz#2119507
  - Update insights-client policy for additional commands execution 4
  Resolves: rhbz#2119507
  - Change rhsmcertd_t to insights_client_t in insights-client policy
  Resolves: rhbz#2119507
  - Allow insights-client send signull to unconfined_service_t
  Resolves: rhbz#2119507
  - Update insights-client policy for additional commands execution 3
  Resolves: rhbz#2119507
  - Allow journalctl read init state
  Resolves: rhbz#2119507
  - Update insights-client policy for additional commands execution 2
  Resolves: rhbz#2119507


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-109
changelog:
  - Add the files_map_read_etc_files() interface
  Resolves: rhbz#2132230
  - Allow insights-client manage samba var dirs
  Resolves: rhbz#2132230
  - Allow insights-client send null signal to rpm and system cronjob
  Resolves: rhbz#2132230
  - Update rhcd policy for executing additional commands 4
  Resolves: rhbz#2132230
  - Allow insights-client connect to postgresql with a unix socket
  Resolves: rhbz#2132230
  - Allow insights-client domtrans on unix_chkpwd execution
  Resolves: rhbz#2132230
  - Add file context entries for insights-client and rhc
  Resolves: rhbz#2132230
  - Allow snmpd_t domain to trace processes in user namespace
  Resolves: rhbz#2121084
  - Allow sbd the sys_ptrace capability
  Resolves: rhbz#2124552
  - Allow pulseaudio create gnome content (~/.config)
  Resolves: rhbz#2124387


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-110
changelog:
  - Add the systemd_connectto_socket_proxyd_unix_sockets() interface
  Resolves: rhbz#208441
  - Add the dev_map_vhost() interface
  Resolves: rhbz#2122920
  - Allow init remount all file_type filesystems
  Resolves: rhbz#2122239
  - added policy for systemd-socket-proxyd
  Resolves: rhbz#2088441
  - Allow virt_domain map vhost devices
  Resolves: rhbz#2122920
  - Allow virt domains to access xserver devices
  Resolves: rhbz#2122920
  - Allow rotatelogs read httpd_log_t symlinks
  Resolves: rhbz#2030633
  - Allow vlock search the contents of the /dev/pts directory
  Resolves: rhbz#2122838
  - Allow system cronjobs dbus chat with setroubleshoot
  Resolves: rhbz#2125008
  - Allow ptp4l_t name_bind ptp_event_port_t
  Resolves: rhbz#2130168
  - Allow pcp_domain execute its private memfd: objects
  Resolves: rhbz#2090711
  - Allow samba-dcerpcd use NSCD services over a unix stream socket
  Resolves: rhbz#2121709
  - Allow insights-client manage samba var dirs
  Resolves: rhbz#2132230


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-111
changelog:
  - Add domain_unix_read_all_semaphores() interface
  Resolves: rhbz#2141311
  - Allow iptables list cgroup directories
  Resolves: rhbz#2134820
  - Allow systemd-hostnamed dbus chat with init scripts
  Resolves: rhbz#2111632
  - Allow systemd to read symlinks in /var/lib
  Resolves: rhbz#2118784
  - Allow insights-client domain transition on semanage execution
  Resolves: rhbz#2141311
  - Allow insights-client create gluster log dir with a transition
  Resolves: rhbz#2141311
  - Allow insights-client manage generic locks
  Resolves: rhbz#2141311
  - Allow insights-client unix_read all domain semaphores
  Resolves: rhbz#2141311
  - Allow winbind-rpcd use the terminal multiplexor
  Resolves: rhbz#2107106
  - Allow mrtg send mails
  Resolves: rhbz#2103675
  - Allow sssd dbus chat with system cronjobs
  Resolves: rhbz#2132922
  - Allow postfix/smtp and postfix/virtual read kerberos key table
  Resolves: rhbz#1983308


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-112
changelog:
  - Allow ipsec_t only read tpm devices
  Resolves: rhbz#2147380
  - Allow ipsec_t read/write tpm devices
  Resolves: rhbz#2147380
  - Label udf tools with fsadm_exec_t
  Resolves: rhbz#1972230
  - Allow the spamd_update_t domain get generic filesystem attributes
  Resolves: rhbz#2144501
  - Allow cdcc mmap dcc-client-map files
  Resolves: rhbz#2144505
  - Allow insights client communicate with cupsd, mysqld, openvswitch, redis
  Resolves: rhbz#2143878
  - Allow insights client read raw memory devices
  Resolves: rhbz#2143878
  - Allow winbind-rpcd get attributes of device and pty filesystems
  Resolves: rhbz#2107106
  - Allow postfix/smtpd read kerberos key table
  Resolves: rhbz#1983308


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-113
changelog:
  - Allow systemd-socket-proxyd get attributes of cgroup filesystems
  Resolves: rhbz#2088441
  - Allow systemd-socket-proxyd get filesystems attributes
  Resolves: rhbz#2088441
  - Allow sysadm read ipmi devices
  Resolves: rhbz#2148561
  - Allow system mail service read inherited certmonger runtime files
  Resolves: rhbz#2143337
  - Add lpr_roles  to system_r roles
  Resolves: rhbz#2151111
  - Allow insights-client tcp connect to various ports
  Resolves: rhbz#2151111
  - Allow insights-client work with pcp and manage user config files
  Resolves: rhbz#2151111
  - Allow insights-client dbus chat with various services
  Resolves: rhbz#2152867
  - Allow insights-client dbus chat with abrt
  Resolves: rhbz#2152867
  - Allow redis get user names
  Resolves: rhbz#2112228
  - Add winbind-rpcd to samba_enable_home_dirs boolean
  Resolves: rhbz#2143696


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-114
changelog:
  - Add interfaces in domain, files, and unconfined modules
  Resolves: rhbz#2141311
  - Allow sysadm_t read/write ipmi devices
  Resolves: rhbz#2148561
  - Allow sudodomain use sudo.log as a logfile
  Resolves: rhbz#2143762
  - Add insights additional capabilities
  Resolves: rhbz#2158779
  - Allow insights client work with gluster and pcp
  Resolves: rhbz#2141311
  - Allow prosody manage its runtime socket files
  Resolves: rhbz#2157902
  - Allow system mail service read inherited certmonger runtime files
  Resolves: rhbz#2143337
  - Add lpr_roles  to system_r roles
  Resolves: rhbz#2151111


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-115
changelog:
  - Fix syntax problem in redis.te
  Resolves: rhbz#2112228
  - Allow unconfined user filetransition for sudo log files
  Resolves: rhbz#2164047
  - Allow winbind-rpcd make a TCP connection to the ldap port
  Resolves: rhbz#2152642
  - Allow winbind-rpcd manage samba_share_t files and dirs
  Resolves: rhbz#2152642
  - Allow insights-client work with su and lpstat
  Resolves: rhbz#2134125
  - Allow insights-client read nvme devices
  Resolves: rhbz#2143878
  - Allow insights-client tcp connect to all ports
  Resolves: rhbz#2143878
  - Allow redis-sentinel execute a notification script
  Resolves: rhbz#2112228


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-116
changelog:
  - Allow sysadm_t run initrc_t script and sysadm_r role access
  Resolves: rhbz#2039662
  - Allow insights-client manage fsadm pid files
  Resolves: rhbz#2166802
  - Add journalctl the sys_resource capability
  Resolves: rhbz#2136189


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-117
changelog:
  - Fix opencryptoki file names in /dev/shm
  Resolves: rhbz#2028637
  - Allow system_cronjob_t transition to rpm_script_t
  Resolves: rhbz#2154242
  - Revert "Allow system_cronjob_t domtrans to rpm_script_t"
  Resolves: rhbz#2154242
  - Allow httpd work with tokens in /dev/shm
  Resolves: rhbz#2028637
  - Allow keepalived to set resource limits
  Resolves: rhbz#2168638
  - Allow insights-client manage fsadm pid files


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-118
changelog:
  - Allow login_pgm setcap permission
  Resolves: rhbz#2172541
  - Label /run/fsck with fsadm_var_run_t
  Resolves: rhbz#2184348
  - Add boolean qemu-ga to run unconfined script
  Resolves: rhbz#2028762
  - Allow dovecot-deliver write to the main process runtime fifo files
  Resolves: rhbz#2170495
  - Allow certmonger dbus chat with the cron system domain
  Resolves: rhbz#2173289
  - Allow insights-client read all sysctls
  Resolves: rhbz#2177607


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-119
changelog:
  - Add unconfined_server_read_semaphores() interface
  Resolves: rhbz#2183351
  - Allow systemd-pstore read kernel persistent storage files
  Resolves: rhbz#2181558
  - Add fs_read_pstore_files() interface
  Resolves: rhbz#2181558
  - Allow insights-client work with teamdctl
  Resolves: rhbz#2185158
  - Allow insights-client read unconfined service semaphores
  Resolves: rhbz#2183351
  - Allow insights-client get quotas of all filesystems
  Resolves: rhbz#2183351


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-120
changelog:
  - Allow unconfined service inherit signal state from init
  Resolves: rhbz#2177254
  - Allow systemd-pstore delete kernel persistent storage files
  Resolves: rhbz#2181558
  - Add fs_delete_pstore_files() interface
  Resolves: rhbz#2181558
  - Allow certmonger manage cluster library files
  Resolves: rhbz#2177836
  - Allow samba-rpcd work with passwords
  Resolves: rhbz#2107106
  - Allow snmpd read raw disk data
  Resolves: rhbz#2160000
  - Allow cluster_t dbus chat with various services
  Resolves: rhbz#2196524


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-121
changelog:
  - Update pkcsslotd policy for sandboxing 2/2
  Resolves: rhbz#2208162
  - Update pkcsslotd policy for sandboxing 1/2
  Resolves: rhbz#2208162
  - Allow abrt_t read kernel persistent storage files
  Resolves: rhbz#2207914
  - Add allow rules for lttng-sessiond domain
  Resolves: rhbz#2203509
  - Allow rpcd_lsad setcap and use generic ptys
  Resolves: rhbz#2107106
  - Allow samba-dcerpcd connect to systemd_machined over a unix socket
  Resolves: rhbz#2107106
  - Dontaudit targetd search httpd config dirs
  Resolves: rhbz#2203720


author: Nikola Knazekova <nknazeko@redhat.com> - 3.14.3-122
changelog:
  - Update cyrus_stream_connect() to use sockets in /run
  Resolves: rhbz#2165752
  - Allow insights-client map generic log files
  Resolves: rhbz#2214572
  - Allow insights-client work with pipe and socket tmp files
  Resolves: rhbz#2207819
  - Allow insights-client getsession process permission
  Resolves: rhbz#2207819
  - Allow keepalived to manage its tmp files
  Resolves: rhbz#2179335


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-123
changelog:
  - Label only /usr/sbin/ripd and ripngd with zebra_exec_t
  Resolves: rhbz#2213606
  - Allow httpd tcp connect to redis port conditionally
  Resolves: rhbz#2213965
  - Exclude container-selinux manpage from selinux-policy-doc
  Resolves: rhbz#2218362


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-124
changelog:
  - Add the files_getattr_non_auth_dirs() interface
  Resolves: rhbz#2076937
  - Update policy for the sblim-sfcb service
  Resolves: rhbz#2076937
  - Dontaudit sfcbd sys_ptrace cap_userns
  Resolves: rhbz#2076937
  - Label /usr/sbin/sos with sosreport_exec_t
  Resolves: rhbz#2167731
  - Allow sa-update manage spamc home files
  Resolves: rhbz#2222200
  - Allow sa-update connect to systemlog services
  Resolves: rhbz#2222200
  - Label /usr/lib/systemd/system/mimedefang.service with antivirus_unit_file_t
  Resolves: rhbz#2222200


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-125
changelog:
  - Allow user_u and staff_u get attributes of non-security dirs
  Resolves: rhbz#2216151
  - Allow unconfined user filetrans chrome_sandbox_home_t 1/2
  Resolves: rhbz#2221573
  - Allow unconfined user filetrans chrome_sandbox_home_t 2/2
  Resolves: rhbz#2221573
  - Allow insights-client execmem
  Resolves: rhbz#2225233
  - Allow svnserve execute postdrop with a transition
  Resolves: rhbz#2004843
  - Do not make postfix_postdrop_t type an MTA executable file
  Resolves: rhbz#2004843
  - Allow samba-dcerpc service manage samba tmp files
  Resolves: rhbz#2210771
  - Update samba-dcerpc policy for printing
  Resolves: rhbz#2210771


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-126
changelog:
  - Allow cloud_init create dhclient var files and init_t manage net_conf_t 1/2
  Resolves: rhbz#2229726
  - Label /usr/libexec/openssh/ssh-pkcs11-helper with ssh_agent_exec_t
  Resolves: rhbz#2177704
  - Allow cloud_init create dhclient var files and init_t manage net_conf_t 2/2
  Resolves: rhbz#2229726
  - Make insights_client_t an unconfined domain
  Resolves: rhbz#2225527
  - Allow insights-client create all rpm logs with a correct label
  Resolves: rhbz#2229559
  - Allow insights-client manage generic logs
  Resolves: rhbz#2229559


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-128
changelog:
  - Allow ssh_agent_type manage generic cache home files
  Resolves: rhbz#2177704
  - Add chromium_sandbox_t setcap capability
  Resolves: rhbz#2221573


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-128.1
changelog:
  - Additional permissions for ip-vrf
  Resolves: RHEL-15427
  - Allow ip an explicit domain transition to other domains
  Resolves: RHEL-15427
  - Allow  winbind_rpcd_t processes access when samba_export_all_* is on
  Resolves: RHEL-16274


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-129
changelog:
  - Set default file context of /var/lib/authselect/backups to <<none>>
  Resolves: RHEL-3539
  - Add file context specification for /usr/libexec/realmd
  Resolves: RHEL-2147
  - Add numad the ipc_owner capability
  Resolves: RHEL-2415


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-130
changelog:
  - Label msmtp and msmtpd with sendmail_exec_t
  Resolves: RHEL-1678
  - Set default file context of HOME_DIR/tmp/.* to <<none>>
  Resolves: RHEL-1099
  - Improve default file context(None) of /var/lib/authselect/backups
  Resolves: RHEL-3539


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-131
changelog:
  - Additional permissions for ip-vrf
  Resolves: RHEL-9981
  - Allow ip an explicit domain transition to other domains
  Resolves: RHEL-9981
  - Allow  winbind_rpcd_t processes access when samba_export_all_* is on
  Resolves: RHEL-5845
  - Allow system_mail_t manage exim spool files and dirs
  Resolves: RHEL-14186


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-132
changelog:
  - Allow sudodomain read var auth files
  Resolves: RHEL-16567
  - Update cifs interfaces to include fs_search_auto_mountpoints()
  Resolves: RHEL-14072
  - Allow systemd-localed create Xserver config dirs
  Resolves: RHEL-16715
  - Label /var/run/auditd.state as auditd_var_run_t
  Resolves: RHEL-14376
  - Allow auditd read all domains process state
  Resolves: RHEL-14471
  - Allow sudo userdomain to run rpm related commands
  Resolves: RHEL-1679
  - Remove insights_client_watch_lib_dirs() interface
  Resolves: RHEL-16185


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-133
changelog:
  - Label /dev/acpi_thermal_rel char device with acpi_device_t
  Resolves: RHEL-18027
  - Allow sysadm execute traceroute in sysadm_t domain using sudo
  Resolves: RHEL-9947
  - Allow sysadm execute tcpdump in sysadm_t domain using sudo
  Resolves: RHEL-15398
  - Add support for syslogd unconfined scripts
  Resolves: RHEL-10087
  - Label /dev/wmi/dell-smbios as acpi_device_t
  Resolves: RHEL-18027
  - Make named_zone_t and named_var_run_t a part of the mountpoint attribute
  Resolves: RHEL-1954
  - Dontaudit rhsmcertd write memory device
  Resolves: RHEL-17721


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-134
changelog:
  - Allow syslog to run unconfined scripts conditionally
  Resolves: RHEL-10087
  - Allow syslogd_t nnp_transition to syslogd_unconfined_script_t
  Resolves: RHEL-10087
  - Allow collectd connect to statsd port
  Resolves: RHEL-19482
  - Allow collectd_t read network state symlinks
  Resolves: RHEL-19482
  - Allow collectd_t domain to create netlink_generic_socket sockets
  Resolves: RHEL-19482
  - Allow opafm search nfs directories
  Resolves: RHEL-19426
  - Allow mdadm list stratisd data directories
  Resolves: RHEL-21374


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-135
changelog:
  - Label /tmp/libdnf.* with user_tmp_t
  Resolves: RHEL-11249
  - Allow su domains write login records
  Resolves: RHEL-2606
  - Allow gpg read rpm cache
  Resolves: RHEL-11249
  - Allow unix dgram sendto between exim processes
  Resolves: RHEL-21903
  - Allow hypervkvp_t write access to NetworkManager_etc_rw_t
  Resolves: RHEL-17687
  - Add interface for write-only access to NetworkManager rw conf
  Resolves: RHEL-17687
  - Allow conntrackd_t to use sys_admin capability
  Resolves: RHEL-22276


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-136
changelog:
  - Transition from sudodomains to crontab_t when executing crontab_exec_t
  Resolves: RHEL-1388
  - Fix label of pseudoterminals created from sudodomain
  Resolves: RHEL-1388
  - Allow login_userdomain to manage session_dbusd_tmp_t dirs/files
  Resolves: RHEL-22500
  - Label /dev/ngXnY and /dev/nvme-subsysX with nvme_device_t
  Resolves: RHEL-23442
  - Allow admin user read/write on fixed_disk_device_t
  Resolves: RHEL-23434
  - Only allow confined user domains to login locally without unconfined_login
  Resolves: RHEL-1628
  - Add userdom_spec_domtrans_confined_admin_users interface
  Resolves: RHEL-1628
  - Only allow admindomain to execute shell via ssh with ssh_sysadm_login
  Resolves: RHEL-1628
  - Add userdom_spec_domtrans_admin_users interface
  Resolves: RHEL-1628
  - Move ssh dyntrans to unconfined inside unconfined_login tunable policy
  Resolves: RHEL-1628
  - Allow utempter_t use ptmx
  Resolves: RHEL-25002
  - Dontaudit subscription manager setfscreate and read file contexts
  Resolves: RHEL-21639
  - Don't audit crontab_domain write attempts to user home
  Resolves: RHEL-1388
  - Add crontab_domtrans interface
  Resolves: RHEL-1388
  - Add dbus_manage_session_tmp_files interface
  Resolves: RHEL-22500
  - Allow httpd read network sysctls
  Resolves: RHEL-22748
  - Allow keepalived_unconfined_script_t dbus chat with init
  Resolves: RHEL-22843


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-137
changelog:
  - Differentiate between staff and sysadm when executing crontab with sudo
  Resolves: RHEL-1388
  - Allow su domains write login records
  Resolves: RHEL-2606
  - Revert "Allow su domains write login records"
  Resolves: RHEL-2606
  - Add crontab_admin_domtrans interface
  Resolves: RHEL-1388
  - Allow gpg manage rpm cache
  Resolves: RHEL-11249


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-138
changelog:
  - Allow wdmd list the contents of the sysfs directories
  Resolves: RHEL-27507
  - Allow linuxptp configure phc2sys and chronyd over a unix domain socket
  Resolves: RHEL-27394


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-139.1
changelog:
  - Allow setsebool_t relabel selinux data files
  Resolves: RHEL-55432
  - Allow dirsrv-snmp map dirsv_tmpfs_t files
  Resolves: RHEL-32441
  - Allow dirsrv_snmp_t to manage dirsrv_config_t & dirsrv_var_run_t files
  Resolves: RHEL-32441


author: Ondrej Vasik <ovasik@redhat.com> - 2.12.2-2
changelog:
  - do not ship /etc/hosts.allow and /etc/hosts.deny (no need for them
    as we don't allow tcp_wrappers in RHEL8, #1663556)


author: Martin Osvald <mosvald@redhat.com> - 2.12.2-3
changelog:
  - add pcp user to /etc/aliases (#1744089)
  - set PATH if it is empty in csh.login (#1744104)
  - lang.csh: prevent grep from failing so scripts do not end
    prematurely when tcsh -e option in use (#1678706)
  - use full path for non-builtins (#1688302)
  - add nrpe tcp port 5666 to /etc/services (#1730396)


author: Martin Osvald <mosvald@redhat.com> - 2.12.2-7
changelog:
  - Move /var/log/lastlog ownership to systemd (#2044589)
  - tcsh sets variable p to /usr/sbin from /etc/csh.login (#1945400)
  - bashrc: Don't set up VTE-specific PROMPT_COMMAND (#1917934)


author: Tomas Bzatek <tbzatek@redhat.com> - 1.44-3
changelog:
  - Fix sg_turs help invocation in an old mode (#1683343)
  - Fix sg_raw printing error about device not specified on version request (#1627657)


author: Jan Synáček <jsynacek@redhat.com> - 1.2.0.10-9
changelog:
  - dos2unix'ed the patch
  - Call dos2unix before patching and dos2unix Makefile as well
  - Use %{_sbindir} instead of '/sbin'


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-12
changelog:
  - lib/sssd: redirect warning message to file (#1749001)
  - useradd: clarify valid usernames/groupnames (#1869432)
  - login.defs: link login specific information to its own package (#1804766)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-15
changelog:
  - Creation of subid and subid-devel subpackages (#2013009)
  - libsubid: creation and nsswitch support
  - libsubid: don't print error messages on stderr by default
  - libsubid: libsubid_init return false if out of memory
  - libsubid: don't return owner in list_owner_ranges API call
  - libsubid: libsubid_init don't print messages on error
  - libsubid: fix newusers when nss provides subids
  - libsubid: make shadow_logfd not extern
  - useradd: fix SUB_UID_COUNT=0
  - man: mention NSS in new[ug]idmap manpages
  - man: clarify subid delegation


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-16
changelog:
  - getsubids: provide system binary and man page. Resolves: #2013016
  - groupdel: fix SIGSEGV when passwd does not exist. Resolves: #1986782


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-17
changelog:
  - subordinateio: also compare the owner ID. Resolves: #2093311
  - Fix release sources
  - Add subid requirement for subid-devel


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-18
changelog:
  - Update patch to close label to reset libselinux state. Resolves: #1984740
  - useradd: check if subid range exists for user. Resolves: #2012929
  - find_new_[gu]id: Skip over IDs that are reserved for legacy reasons. Resolves: #1994269


author: Erik Troan <ewt@redhat.com>
changelog:
  - added patch for XOPEN oddities in glibc headers
  - check for ut_user before checking for ut_name -- this works around some
    confusion on glibc 2.1 due to the utmpx header not defining the ut_name
    compatibility stuff. I used a gross sed hack here because I couldn't make
    automake work properly on the sparc (this could be a glibc 2.0.99 problem
    though). The utuser patch works fine, but I don't apply it.
  - sleep after running autoconf


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - updated the spec file
  - updated the patch so that new accounts created on shadowed system won't
    confuse pam_pwdb anymore ('!!' default password instead on '!')
  - fixed a bug that made useradd -G segfault
  - the check for the ut_user is now patched into configure


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - Note that /usr/sbin/mkpasswd conflicts with /usr/bin/mkpasswd;
    one of these (I think /usr/sbin/mkpasswd but other opinions are valid)
    should probably be renamed.  In any case, mkpasswd.8 from this package
    needs to be installed. (problem #823)


author: Michael K. Johnson <johnsonm@redhat.com>
changelog:
  - have userdel remove user private groups when it is safe to do so
  - allow -f to force user removal even when user appears busy in utmp


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - Serial: 1 because now we are using 19990827 (why the heck can't they have
    a normal version just like everybody else?!)
  - ported all patches to the new code base


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix usermod patch to check for shadow before doing any shadow-specific stuff
    and merge it into the pwlock patch


author: Matt Wilson <msw@redhat.com>
changelog:
  - use mandir for FHS
  - added patches in src/ and po/ to honor DESTDIR
  - use make install DESTDIR=$RPM_BUILD_ROOT


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - change symlinked man pages to includers
  - require /usr/bin/newgrp (util-linux) so that /usr/bin/sg isn't left dangling


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - Remove a fixed-size buffer that caused problems when adding a huge number
    of users to a group (>8192 bytes) (Bugs #3809, #11930)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - take LOG_CONS out of the openlog() call so that we don't litter the
    screen during text-mode upgrades


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - don't overwrite user dot files in useradd (#19982)
  - truncate new files when moving overwriting files with the contents of other
    files while moving directories (keeps files from looking weird later on)
  - configure using %{_prefix} as the prefix


author: Bernhard Rosenkraenzer <bero@redhat.com> 20000902-1
changelog:
  - Create an empty mailspool when creating a user so non-setuid/non-setgid
    MDAs (postfix+procmail) can deliver mail (#41811)
  - 20000902
  - adapt patches


author: Nalin Dahyabhai <nalin@redhat.com> 20000902-4
changelog:
  - use -O0 instead of -O on ia64
  - build in source directory
  - don't leave lock files on the filesystem when useradd creates a group for
    the user (#50269)
  - fix the -o option to check for duplicate UIDs instead of login names (#52187)


author: Nalin Dahyabhai <nalin@redhat.com> 20000902-12
changelog:
  - force .mo files to be regenerated with current gettext to flush out possible
    problems
  - fixup non-portable encodings in translations
  - make sv translation header non-fuzzy so that it will be included (#71281)


author: Nalin Dahyabhai <nalin@redhat.com> 20000902-13
changelog:
  - prevent libshadow from being built more than once, to keep automake happy
  - change how md5 and md5crypt are enabled, to keep autoconf happy
  - remove unpackaged files after %install


author: Nalin Dahyabhai <nalin@redhat.com> 4.0.3-6
changelog:
  - adjust mailspool patch to complain if no group named "mail" exists, even
    though that should never happen


author: Nalin Dahyabhai <nalin@redhat.com> 4.0.3-14
changelog:
  - lastlog: don't pass a possibly-smaller field to localtime (#109648)
  - configure: call AC_SYS_LARGEFILE to get large file support


author: Nalin Dahyabhai <nalin@redhat.com> 4.0.3-15
changelog:
  - don't convert man pages to UTF-8 for RHEL 3, conditionalized using macro
  - fixup dangling man page references


author: Dan Walsh <dwalsh@redhat.com> 4.0.3-23
changelog:
  - Add get_enforce checks
  - Clean up patch for potential upstream submission
  - Add removemalloc patch to get it to build on 3.4


author: Adrian Havill <havill@redhat.com> 2:4.0.3-31
changelog:
  - check for non-standard legacy place for ncsd HUP (/var/run/nscd.pid) and
    then the std FHS place (/var/run/nscd.pid) (#125421)


author: Adrian Havill <havill@redhat.com> 2:4.0.3-33
changelog:
  - allow for mixed case and dots in usernames (#135401)
  - all man pages to UTF-8, not just Japanese (#133883)
  - add Polish blurb for useradd -n man page option (#82177)


author: Adrian Havill <havill@redhat.com> 2:4.0.3-35
changelog:
  - make the limit for the group name the same as the username (determined
    by the header files, rather than a constant) (#56850)


author: Peter Vrabec <pvrabec@redhat.com> 2:4.0.7-4
changelog:
  - use newgrp binary
  - newgrp don't ask for password if user's default GID = group ID,
    ask for password if there is some in /etc/gshadow
    and in /etc/group is 'x' (#149997)


author: Peter Vrabec <pvrabec@redhat.com> 2:4.0.7-5
changelog:
  - fix memory leak, and CPU spinning when grp_update() and
    duplicate group entries in /etc/group (#151484)


author: Peter Vrabec <pvrabec@redhat.com> 2:4.0.17-6
changelog:
  - fix regression. Permissions on user* group* binaries
    should be 0750, because of CAPP/LSPP certification
  - fix groupdel man page


author: Peter Vrabec <pvrabec@redhat.com> 2:4.0.18.1-2
changelog:
  - improve audit logging (#211659)
  - improve "-l" option. Do not reset faillog if it's used (#213450).


author: Peter Vrabec <pvrabec@redhat.com> 2:4.1.2-8
changelog:
  - groupmems: check username for valid character (#455603)
  - groupmems: don't segfault on nonexistent group (#456088)


author: Peter Vrabec <pvrabec@redhat.com> 2:4.1.2-11
changelog:
  - fix license tag (#226416)
  - get rid of tabs in spec file (#226416)
  - convert HOWTO to UTF8 (#226416)


author: Peter Vrabec <pvrabec@redhat.com> - 2:4.1.4.2-5
changelog:
  - newusers man page more informative
  - userdel should not need to run semanage
    Resolves: #586330 #586408


author: Peter Vrabec <pvrabec@redhat.com> - 2:4.1.4.2-9
changelog:
  - fix gshadow functions from shadow utils
  - make shadow utils use gshadow functions from glibc
    Resolves: #665780


author: Peter Vrabec <pvrabec@redhat.com> - 2:4.1.4.2-10
changelog:
  - do not use  gshadow functions from glibc, there is a bug
    in glibc sgetsgent(#674361)
    Resolves: #674234


author: Peter Vrabec <pvrabec@redhat.com> - 2:4.1.4.2-11
changelog:
  - useradd man page (-m option)
  - create home directory on fs with noacl
  - remove faillog app (pam_tally.so is no longer shipped)
    Resolves: #523265, #622320


author: Peter Vrabec <pvrabec@redhat.com> - 2:4.1.4.3-5
changelog:
  - userdel option to remove Linux login <-> SELinux login mapping (#639900)
  - useradd special exit value if SELinux user mapping is invalid (#639975)
  - usermod special exit value if SELinux user mapping is invalid (#639976)


author: Tomas Mraz <tmraz@redhat.com> - 2:4.1.5.1-6
changelog:
  - report error to stdout when SELinux context for home directory
    cannot be determined (#973647)
  - audit the changing home directory owner (#885797)
  - do not set the default SELinux MLS range (#852676)


author: Tomas Mraz <tmraz@redhat.com> - 2:4.1.5.1-8
changelog:
  - slightly more meaningful error messages if crypt() returns NULL (#988184)
  - explicit suid permissions


author: Tomas Mraz <tmraz@redhat.com> - 2:4.1.5.1-14
changelog:
  - put system users and groups into /usr/lib/{passwd,group} if
    the files exist and SHADOW_USE_USRLIB environment variable is set
    Patch by Colin Walters


author: Tomas Mraz <tmraz@redhat.com> - 2:4.1.5.1-18
changelog:
  - label the newly created home dir correctly (#1077809)
  - mention that chage -d 0 forces password change (#1135010)
  - improve date parsing and error detecting in chage
  - avoid full group database scanning in newgrp in most common case
  - report error if usermod asked for moving homedir and it does not exist


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.1.5.1-21
changelog:
  - update auditing to cover more events and fix some incorrect audit
    records - patch by Steve Grubb (#1151580)
  - apply the same new allocation algorithm to uids as for gids


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.2.1-3
changelog:
  - unlock also passwords locked with passwd -l
  - prevent breaking user entry by entering a password containing colon
  - fix possible DoS when locking the database files for update
  - properly use login.defs from the chroot in useradd


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.2.1-4
changelog:
  - document that groupmems is not setuid root
  - document that expiration of the password after inactivity period
    locks the user account completely


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.2.1-5
changelog:
  - do not use obscure permissions for binaries
  - remove unused commands from login.defs(5) cross-reference


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.5-4
changelog:
  - allow switching to secondary group without checking the membership
    explicitly (patch from upstream)


author: Björn Esser <besser82@fedoraproject.org> - 2:4.5-9
changelog:
  - Add patch to include crypt.h, if present
  - Use %make_{build,install} macros
  - Refresh other patches for proper alignment


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.6-1
changelog:
  - Update to current upstream release 4.6
  - Raise limit for passwd and shadow entry length but also prevent
    writing longer entries (#1422497)


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.6-5
changelog:
  - use cap_setxid file capabilities for newxidmap instead of making them setuid
  - limit the SYS_U/GID_MIN value to 1 as the algorithm does not work with 0
    and the 0 is always used by root anyway
  - manual page improvements
  - flush sssd caches - patch by Jakub Hrozek


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.6-8
changelog:
  - properly audit group password change
  - do not add uid of a new (not yet added) user to the audit message
  - use lckpwdf() again to disable concurrent edits of databases by
    other applications
  - clarify chage manual page in regards to shadow and passwd
    inconsistency
  - fix minor issues in groupadd and login.defs manual pages
  - Ignore LOGIN_PLAIN_PROMPT variable in login.defs
  - force regeneration of getdate.c otherwise the date parsing fix
    is not applied


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-9
changelog:
  - do not mistake a regular user process for a namespaced one (#1788696)
  - add HOME_MODE support in login.defs (#1777718)


author: Tomas Mraz <tmraz@redhat.com> 1:5.33-2
changelog:
  - Spec file cleanup by Robert Scheck <redhat@linuxnetz.de> (#170959)
  - manual release numbering
  - remove bogus patch of non-installed file
  - only non-removable drives should be added to smartd.conf
  - smartd.conf should be owned (#171498)


author: Tomas Mraz <tmraz@redhat.com> 1:5.33-3
changelog:
  - add libata disks with -d ata if the libata version
    is new enough otherwise do not add them (#145859, #174095)


author: Tomas Mraz <tmraz@redhat.com> - 1:5.33-5
changelog:
  - add default /etc/sysconfig/smartmontools file
  - ignore errors on startup (#186130)
  - test drive for SMART support before adding it to smartd.conf


author: Tomas Mraz <tmraz@redhat.com> - 1:5.36-2
changelog:
  - kudzu is deprecated, replace it with HAL (#195752)
  - moved later in the boot process so haldaemon is already running
    when drives are being detected


author: Tomas Mraz <tmraz@redhat.com> - 1:5.36-5
changelog:
  - set cloexec on device descriptor so it doesn't leak to sendmail (#214182)
  - fixed minor bug in initscript (#213683)
  - backported SATA disk detection from upstream


author: Tomas Smetana <tsmetana@redhat.com> - 1:5.37-3
changelog:
  - fix #241385 - smartmontools missing dependency on mailx
  - fix #241388 - unneeded smartd-conf.py[co] installed in /usr/sbin


author: Tomas Smetana <tsmetana@redhat.com> - 1:5.37-4
changelog:
  - fix #241389 - smartd-conf.py pulls in a big dependency chain, so
    build a separate config package


author: Tomas Smetana <tsmetana@redhat.com> - 1:5.37-5
changelog:
  - add support for 24 disks on 3ware RAID controllers (related #252055)
  - fix #245442 - add %{arm} to smartmontools's set of build archs
  - update license tag


author: Tomas Smetana <tsmetana@redhat.com> - 1:5.37-6
changelog:
  - fix #271741 - smartd-conf.py should allow customization of parameters
  - fix #253753 - service starting by default, perhaps shouldn't
  - update initscript (related #247058 - initscript review)


author: Čestmír Kalina <ckalina@redhat.com> - 1.6.0-1
changelog:
  - Resolves: #1869292 Statistics Support - smc-tools part
  - Resolves: #1919225 Add SMC-D Setup Check (smc-tools)
  - Resolves: #1919240 Upgrade smc-tools to latest version


author: Čestmír Kalina <ckalina@redhat.com> - 1.6.0-3
changelog:
  - Patch stats.c to fix overruns
  - Patch stats.c to fix leaks
  - Patch stats.c to fix fallback counter values
  - Resolves: #1993469


author: Čestmír Kalina <ckalina@redhat.com> - 1.8.1-1
changelog:
  - Upgrade smc-tools to latest version
  - Add User-defined EID (Enterprise ID) Support
  - Resolves: #1919228
  - Resolves: #2043841


author: Čestmír Kalina <ckalina@redhat.com> - 1.8.3-1
changelog:
  - Resolves: RHEL-11417 Upgrade smc-tools to latest version
  - smc_stats: Fix man page name
  - Bump version.


author: Xiaoping Liu <liuxiaoping@alibaba-inc.com> - 1.8.3-1.0.1
changelog:
  - Add doc sub package
  - Support smc-ebpf (alibuda@linux.alibaba.com)
  - fix spec on smc-ebpf, fix issues where smc-ebpf can not works (alibuda@linux.alibaba.com)


author: Wen Gu <guwen.gu@alibaba-inc.com> - 1.8.3-1.0.4
changelog:
  - Fix segmentation fault in concurrent socket creation
  - Add statistics for ringbuf usage of conns and LGRs
  - Remove stats cache file if it is corrupted
  - Add smc_monitor_ex tool
  - Add tools for smc traffic capture


author: Bhupesh Sharma <bhsharma@redhat.com> - 1.1.8-1
changelog:
  - Rebase to latest github version Snappy-1.1.8
  - Also change the URL to reflect to the updated github location.


author: Jan Jansky <jjansky@redhat.com> = 4.6.0-1
changelog:
  - [ultrapath] Add new plugin for Huawei UltraPath
    Resolves: bz2187407
  - [cleaner] Use data filter for extraction
    Resolves: bz2217906
  - [discovery] Enable the plugin by containers
    Resolves: bz2222134


author: Pavel Moravec <pmoravec@redhat.com> = 4.0-2
changelog:
  - [cleaner] more streamlined sanitize_item method
    Resolves: bz1827801
  - [openstack_ironic] Missing ironic-inspector configs
    Resolves: bz1874295
  - Add support to collect hardware component logs
    Resolves: bz1880372
  - [crio] collect /etc/crio/crio.conf.d/
    Resolves: bz1881118
  - [policy] Handle additional failure conditions for FTP uploads
    Resolves: bz1882368
  - [filesys] never collect content of /proc/fs/panfs
    Resolves: bz1886782
  - [kdump] Collect new kdump logfiles
    Resolves: bz1887390
  - [stratis] Collect key list and report engine
    Resolves: bz1888012
  - return tmp-dir with absolute path
    Resolves: bz1891562


author: Pavel Moravec <pmoravec@redhat.com> = 4.0-3
changelog:
  - [ovirt] collect /etc/pki/ovirt-engine/.truststore
    Resolves: bz1848095
  - [collector] allow overriding plain --cluster-type
    Resolves: bz1895316
  - [component] Add log verbosity from presets
    Resolves: bz1904045
  - [options] Fix --log-size=0 being ignored and unreported
    Resolves: bz1905657
  - [report] collect broken symlinks
    Resolves: bz1906598


author: Pavel Moravec <pmoravec@redhat.com> = 4.0-5
changelog:
  - [component] honour plugopts from config file
    Resolves: bz1912889
  - [collector] declare sysroot for each component
    Resolves: bz1912821
  - [plugins] Dont stop collecting by empty specfile when sizelimit=0
    Resolves: bz1912910


author: Pavel Moravec <pmoravec@redhat.com> = 4.0-7
changelog:
  - [kdump] Gather the file kexec-dmesg.log
    Resolves: bz1887402
  - [Policy] Handle additional FTP authentication issues
    Resolves: bz1916729


author: Pavel Moravec <pmoravec@redhat.com> = 4.1-2
changelog:
  - Load maps from all archives before obfuscation
    Resolves: bz1930181
  - Multiple fixes in man pages
    Resolves: bz1935603
  - [ds] Mask password and encryption keys in ldif files
    Resolves: bz1937298
  - [report] add --cmd-timeout option
    Resolves: bz1937418
  - [cups] Add gathering cups-browsed logs
    Resolves: bz1939963
  - [sssd] Collect memory cache / individual logfiles
    Resolves: bz1940502
  - Collect ibmvNIC dynamic_debugs
    Resolves: bz1942276
  - [pulpcore] add plugin for pulp-3
    Resolves: bz1956673
  - [saphana] remove redundant unused argument of get_inst_info
    Resolves: bz1959413
  - [networking] Add nstat command support
    Resolves: bz1961458
  - [snapper] add a new plugin
    Resolves: bz1961229


author: Pavel Moravec <pmoravec@redhat.com> = 4.1-3
changelog:
  - [gluster] collect public keys from the right dir
    Resolves: bz1925419
  - [cleaner] Only skip packaging-based files for the IP parse
    Resolves: bz1964499
  - [networking] collect also tc filter show ingress
    Resolves: bz1886711
  - [archive] skip copying SELinux context for /proc and /sys
    Resolves: bz1965001
  - [sssd] sssd plugin when sssd-common
    Resolves: bz1967613
  - Various OCP/cluster/cleanup enhancements
    Resolves: bz1973675


author: Pavel Moravec <pmoravec@redhat.com> = 4.1-4
changelog:
  - [options] allow variant option names in config file
    Resolves: bz1923938
  - [plugins] Set default predicate instead of None
    Resolves: bz1985986
  - [MigrationResults] collect info about conversions
    Resolves: bz1959598


author: Pavel Moravec <pmoravec@redhat.com> = 4.1-5
changelog:
  - [report,collect] unify --map-file arguments
    Resolves: bz1923938
  - [rhui] add new plugin for RHUI 4
    Resolves: bz1665947
  - [username parser] Load usernames from `last` for LDAP users
    Resolves: bz1985037


author: Pavel Moravec <pmoravec@redhat.com> = 4.2-1
changelog:
  - Rebase on upstream 4.2
    Resolves: bz1998133
  - [report] Implement --estimate-only
    Resolves: bz1873185
  - [omnipath_client] Opacapture to run only with allow changes
    Resolves: bz1998433
  - [unpackaged] deal with recursive loop of symlinks properly
    Resolves: bz1998521
  - [networking] prevent iptables-save commands to load nf_tables
    Resolves: bz2001096
  - [kernel] Capture Pressure Stall Information
    Resolves: bz2002145
  - [processor] Apply sizelimit to /sys/devices/system/cpu/cpuX
    Resolves: bz2011413


author: Pavel Moravec <pmoravec@redhat.com> = 4.2-2
changelog:
  - [firewall_tables] call iptables -t <table> based on nft
    Resolves: bz2005195
  - [report] Count with sos_logs and sos_reports in
    Resolves: bz1873185
  - [foreman] Collect puma status and stats
    Resolves: bz2011506
  - [report] Overwrite pred=None before refering predicate
    Resolves: bz2012856
  - [openvswitch] add commands for offline analysis
    Resolves: bz2004929


author: Pavel Moravec <pmoravec@redhat.com> = 4.2-4
changelog:
  - [report] Calculate sizes of dirs, symlinks and manifest in
    Resolves: bz1873185
  - [report] shutdown threads for timeouted plugins
    Resolves: bz2012857
  - [report] fix filter_namespace per pattern
    Resolves: bz2020777
  - Ensure specific plugin timeouts are only set
    Resolves: bz2018033


author: Pavel Moravec <pmoravec@redhat.com> = 4.2-5
changelog:
  - [clean,hostname_parser] Source /etc/hosts for obfuscation
    Resolves: bz2023867
  - [clean, hostname] Fix unintentionally case sensitive
    Resolves: bz2023863
  - [redhat] update SFTP API version to v2
    Resolves: bz2025610


author: Pavel Moravec <pmoravec@redhat.com> = 4.2-8
changelog:
  - [rhui] New log folder
    Resolves: bz2030741
  - nvidia]:Patch to update nvidia plugin for GPU info
    Resolves: bz2025403
  - [hostname] Fix edge case for new hosts in a known subdomain
    Resolves: bz2023867


author: Pavel Moravec <pmoravec@redhat.com> = 4.2-9
changelog:
  - add oc transport, backport various PRs for OCP
    Resolves: bz2036697
  - [report] Provide better warning about estimate-mode
    Resolves: bz1873185
  - [hostname] Fix loading and detection of long base domains
    Resolves: bz2023867


author: Pavel Moravec <pmoravec@redhat.com> = 4.2-12
changelog:
  - [foreman] Use psql-msgpack-decode wrapper for dynflow >= 1.6
    Resolves: bz2043102
  - [virsh] Call virsh commands in the foreground / with a TTY
    Resolves: bz2041488
  - [ovn_central] Account for Red Hat ovn package naming
    Resolves: bz2042966
  - [clean,parsers] Build regex lists for static items only once
    Resolves: bz2036697


author: Pavel Moravec <pmoravec@redhat.com> = 4.2-15
changelog:
  - [sosnode] Handle downstream versioning for runtime option
    Resolves: bz2036697
  - [options] Fix logging on plugopts in effective sos command
    Resolves: bz2054882
  - [report] Honor plugins' hardcoded plugin_timeout
    Resolves: bz2055547
  - [policies] Set fallback to None sysroot, don't chroot to '/'
    Resolves: bz1873185
  - [ovn_central] Rename container responsable of Red Hat
    Resolves: bz2042966


author: Pavel Moravec <pmoravec@redhat.com> = 4.3-1
changelog:
  - Rebase on upstream 4.3
    Resolves: bz2055002
  - [sapnw] Fix IndexError exception
    Resolves: bz1992938
  - [Plugin, utilities] Allow writing command output directly to disk
    Resolves: bz1726023
  - [Ceph] Add support for containerized Ceph setup
    Resolves: bz1882544
  - [unbound] Add new plugin for Unbound DNS resolver
    Resolves: bz2018228
  - [discovery] Add new discovery plugin
    Resolves: bz2018549
  - [vdsm] Exclude /var/lib/vdsm/storage/transient_disks
    Resolves: bz2029154


author: Pavel Moravec <pmoravec@redhat.com> = 4.3-2
changelog:
  - [ovirt] answer files: Filter out all password keys
    Resolves: bz2095263
  - [plugins] Allow 'str' PlugOpt type to accept any value
    Resolves: bz2079485
  - [tigervnc] Update collections for newer versions of TigerVNC
    Resolves: bz2062908
  - [pacemaker] Redesign node enumeration logic
    Resolves: bz2065805
  - crio: switch from parsing output in table format to json
    Resolves: bz2092969
  - [report] Honor plugins' hardcoded plugin_timeout
    Resolves: bz2079187
  - [report] --list-plugins should report used, not default,
    Resolves: bz2079484
  - [utilities] Close file only when storing to file
    Resolves: bz2079486
  - [presets] Adjust OCP preset options, more OCP backports
    Resolves: bz2058279


author: Pavel Moravec <pmoravec@redhat.com> = 4.3-3
changelog:
  - [vdsm] Set LVM option use_devicesfile=0
    Resolves: bz2093993
  - [Plugin] Make forbidden path checks more efficient
    Resolves: bz2099598


author: Pavel Moravec <pmoravec@redhat.com> = 4.4-1
changelog:
  - Rebase on upstream 4.4
    Resolves: bz2082614
  - [redhat] Honour credential-less --upload-url on RedHat distro properly
    Resolves: bz2059572
  - [sos] Fix unhandled exception when concurrently removing temp dir
    Resolves: bz2088439
  - [specfile] drop python3-libxml2 dependency
    Resolves: bz2125486
  - [md] Restrict data capture to raid members
    Resolves: bz2125485
  - [cleaner] Use compiled regex lists for parsers by default
    Resolves: bz2043233
  - [cgroups] not collect memory.kmem.slabinfo
    Resolves: bz1995120
  - [report] Fix loop devices data gathering
    Resolves: bz2010735
  - [insights] Collect /var/lib/insights
    Resolves: bz2103233
  - [candlepin] collect information about SCA
    Resolves: bz2060925
  - [manpages] Clarify --upload-directory applicable to FTP protocol only
    Resolves: bz2063259
  - [cleaner] Dont obfuscate tmpdir path of local private_map
    Resolves: bz2064815
  - [fibrechannel] collect Cisco fnic statistics
    Resolves: bz2074715
  - [pulpcore] Collect db_tables_sizes
    Resolves: bz2081433
  - [fibrechannel]: Update fibrechannel plugin to collect HBA logs
    Resolves: bz2089591
  - [arcconf]: Update arcconf plugin to collect UART logs
    Resolves: bz2090283
  - [pulpcore] Stop collecting commands relevant to old taskig system
    Resolves: bz2093191
  - [dnf,yum] Merge plugins into dnf, remove yum plugin
    Resolves: bz2100154
  - [policies] Simplify flow in _container_init()
    Resolves: bz2100480
  - [pacemaker] Update collect cluster profile for pacemaker
    Resolves: bz2065821


author: Pavel Moravec <pmoravec@redhat.com> = 4.4-2
changelog:
  - [utilities] Relax from hard dependency of python3-magic
    Resolves: bz2129038
  - [dnf] Collect legacy yum config symlinks, properly obfuscate pwds
    Resolves: bz2100154


author: Pavel Moravec <pmoravec@redhat.com> = 4.5.1-3
changelog:
  - Rebase on upstream 4.5.1
    Resolves: bz2175806
  - [composer] Capure /etc/osbuild-composer file
    Resolves: bz2169776
  - [ostree] Collect "ostree fsck" under plugin specific opt
    Resolves: bz2161533
  - [iprconfig] guard whole plugin by sg kmod predicate
    Resolves: bz2176086
  - [cleaner] dont clean sys_tmp from final_path
    Resolves: bz2176218


author: Jan Jansky <jjansky@redhat.com> = 4.5.3-1
changelog:
  - [report] Ignore case when scrubbing via do_file_sub
    Resolves: bz2143272
  - [subscription_manager] Scrub proxy passwords from repo_server_val
    Resolves: bz2177282
  - [virsh] Scrub passwords in virt-manager logs
    Resolves: bz2184062


author: Pavel Moravec <pmoravec@redhat.com> = 4.5.4-1
changelog:
  - [plugins] collect strings before commands
    Resolves: bz2203141
  - [collector] collect report from primary node if in node_list
    Resolves: bz2186460
  - [powerpc] collect invscout logs
    Resolves: bz2210543
  - [rhc] New plugin for RHC
    Resolves: bz2196649


author: Jan Jansky <jjansky@redhat.com> = 4.5.5-1
changelog:
  - [clean] Respect permissions of sanitised files
    Resolves: bz2218279
  - [plugin] Fix exception when calling os.makedirs
    Resolves: bz2216608
  - [cleaner] Enhance trailing characters list after AMC address
    Resolves: bz2207562


author: Jan Jansky <jjansky@redhat.com> = 4.5.5-2
changelog:
  - Adding patch for mac obfuscation
    Resolves: bz2218279
    Resolves: bz2216608
    Resolves: bz2207562


author: Pavel Moravec <pmoravec@redhat.com> = 4.6.1-1
changelog:
  - rebase to upstream 4.6.1
    Resolves: RHEL-21173
  - [redhat] Change authentication method for RHEL
    Resolves: RHEL-21177


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-10
changelog:
  - Fixed CVE-2020-13632 (#1845572)
  - Fixed CVE-2020-13631 (#1845474)
  - Fixed CVE-2020-13630 (#1845153)


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-14
changelog:
  - Fixed CVE-2019-5827 (#1710184)
  - Fixed CVE-2019-13750 (#1786510)
  - Fixed CVE-2019-13751 (#1786522)
  - Fixed CVE-2019-19603 (#1792013)
  - Fixed CVE-2020-13435 (#1841233)


author: Bruno Wolff III <bruno@wolff.to> - 4.1-0.1.20100607
changelog:
  - Rebase to 4.1 prerelease with xz wrapper
  - Provides lzma compression as an option.
  - squashfs-fix-unsquashing-v3.patch is part of the 4.1 prerelease


author: Bruno Wolff III <bruno@wolff.to> - 4.1-0.3.20100803
changelog:
  - Rebase to latest upstream
  - Prevent warning message for xattr for virtual directory
  - Fix issue with large inodes - BZ 619020


author: Bruno Wolff III <bruno@wolff.to> - 4.1-0.4.20100827
changelog:
  - Rebase to latest upstream.
  - The main reason is to pick up a fix for large xattr similar to the large inode fix. This doesn't need to get backported as 4.0 doesn't have xattr support.
  - An option was added to build without xattr support.
  - Various source cleanups have been done as well.


author: Bruno Wolff III <bruno@wolff.to> - 4.2-0.1.20101223
changelog:
  - Switch to 4.2 development snapshot to get new XZ support
  - LZMA and XZ (LZMA2) support are now different


author: Bruno Wolff III <bruno@wolff.to> - 4.2-0.2.20101231
changelog:
  - Pull latest upstream snapshot
  - Includes check for matching compression type when adding to an existing image
  - Sample cvs command now includes timezone and specifies when on the date to use for the snapshot


author: Bruno Wolff III <bruno@wolff.to> - 4.2-1
changelog:
  - 4.2 is released.
  - Bugfix for bad data causing crash.
  - Include doc files added for release.
  - Big endian patch is now upstream.
  - Buildroot tag isn't needed any more.
  - We can now specify CFLAGS on the make call.
  - Compressor options are now passed with the make call.


author: Bruno Wolff III <bruno@wolff.to> - 4.3-0.1.git0be606be
changelog:
  - Pre-release of 4.3 to get early testing
  - This update includes a bit of internal code infrastructure changes
  - There are lots of fixes to better handle bad data
  - The final release is expected sometime in December
  - Until the release only the README doc file is available


author: Bruno Wolff III <bruno@wolff.to> - 4.3-0.8.gitca6a1c90
changelog:
  - Latest pre 4.3 snapshot
  - New option to display compression options used
  - Some error message improvements


author: Bruno Wolff III <bruno@wolff.to> - 4.3-0.17.git5c6f0024
changelog:
  - Latest pre 4.3 snapshot
  - Includes fix for mksquashfs hangs
  - Switch to get pre-release updates from the stable branch at kernel.org


author: Bruno Wolff III <bruno@wolff.to> - 4.3-0.18.gitaae0aff4
changelog:
  - Latest pre 4.3 stable snapshot
  - A few minor bug fixes
  - Improvements in getting status info while running unsquashfs


author: Bruno Wolff III <bruno@wolff.to> 4.3-1
changelog:
  - Update to real 4.3 release
  - Added support for lz4 since the stable snapshot
  - Added support for alternate zlib compression strategies


author: Bruno Wolff III <bruno@wolff.to> 4.3-6
changelog:
  - Apply a couple of upstream patches.
  - Fixes issue issue with too much memory use under PAE kernels


author: Abhi Das <adas@redhat.com> - 4.3-19
changelog:
  - rhbz#1602698 - Fix coverity issues
    rhbz#1624173 - Fix annocheck failures
    rhbz#1716278 - limit max cpus in mksquashfs
    Resolves: rhbz#1602698, rhbz#1624173, rhbz#1716278


author: Abhi Das <adas@redhat.com> - 4.3-20
changelog:
  - rhbz#1895017 - unsquashfs does not preserve file capabilities
    rhbz#1754815 - Kdump: Building kdump initramfs img may fail with 'dracut: Failed making squash image' occasionally
    Resolves: rhbz#1895017, rhbz#1754815


author: wuxiat <nijie@wwxiat.com> -4.3-20.0.2
changelog:
  * Mon Dec 13 2021 Weitao Zhou <zhouwt@linux.alibaba.com> - 4.3-20.0.1
  - use extern in header files when declaring global variables for compatible gcc10 build


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.13-1
changelog:
  - Rebase to v5.13; drop upstream patches on top of 5.7 (#2015917).
  - Address some issues reported by covscan.


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - added the umoven patch from James Youngman <jay@gnu.org>
  - fixed build problems on newer glibc releases


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - upgrade to 3.99 in order to
  -    add new 2.2.x open flags (#2955).
  -    add new 2.2.x syscalls (#2866).
  - strace 3.1 patches carried along for now.


author: Jakub Jelinek <jakub@redhat.com>
changelog:
  - doh, actually apply the 2.4 syscalls patch
  - make it compile with 2.4.0-test7-pre4+ headers, add
    getdents64 and fcntl64


author: Preston Brown <pbrown@redhat.com> 4.3-1
changelog:
  - new upstream version.  Seems to have integrated most new syscalls
  - tracing threaded programs is now functional.


author: Jakub Jelinek <jakub@redhat.com> 4.4-8
changelog:
  - newer version of the clone fixing patch (Roland McGrath)
  - aio syscalls for i386/ia64/ppc (Ben LaHaise)


author: Roland McGrath <roland@redhat.com> 4.5.3-1
changelog:
  - new upstream version, mq_* calls (#120701), -p vs NPTL (#120462), more fixes (#118694, #120541, #118685)


author: Roland McGrath <roland@redhat.com> 4.5.6-1
changelog:
  - new upstream version, updates ioctl lists (#127398), fixes quotactl (#127393), more ioctl decoding (#126917)


author: Roland McGrath <roland@redhat.com> - 4.5.7-2
changelog:
  - new upstream version, misc fixes and updates (#128091, #129166, #128391, #129378, #130965, #131177)


author: Roland McGrath <roland@redhat.com> - 4.5.8-1
changelog:
  - fix multithreaded exit handling (#132150, #135254)
  - fix ioctl name matching (#129808)
  - print RTC_* ioctl structure contents (#58606)
  - grok epoll_* syscalls (#134463)
  - grok new RLIMIT_* values (#133594)
  - print struct cmsghdr contents for sendmsg (#131689)
  - fix clock_* and timer_* argument output (#131420)


author: Roland McGrath <roland@redhat.com> - 4.5.9-2
changelog:
  - update ia64 syscall list (#146245)
  - fix x86_64 syscall argument extraction for 32-bit processes (#146093)
  - fix -e signal=NAME parsing (#143362)
  - fix x86_64 exit_group syscall handling
  - improve socket ioctl printing (#138223)
  - code cleanups (#143369, #143370)
  - improve mount flags printing (#141932)
  - support symbolic printing of x86_64 arch_prctl parameters (#142667)
  - fix potential crash in getxattr printing


author: Roland McGrath <roland@redhat.com> - 4.5.10-1
changelog:
  - Fix select handling on nonstandard fd_set sizes.
  - Don't print errors for null file name pointers.
  - Fix initial execve output with -i (#143365).


author: Roland McGrath <roland@redhat.com> - 4.5.12-1
changelog:
  - Fix known syscall recognition for IA32 processes on x86-64 (#158934).
  - Fix bad output for ptrace on x86-64 (#159787).
  - Fix potential buffer overruns (#151570, #159196).
  - Make some diagnostics more consistent (#159308).
  - Update PowerPC system calls.
  - Better printing for Linux aio system calls.
  - Don't truncate statfs64 fields to 32 bits in output (#158243).
  - Cosmetic code cleanups (#159688).


author: Roland McGrath <roland@redhat.com> - 4.5.13-1
changelog:
  - Fix setsockopt decoding on 64-bit (#162449).
  - Fix typos in socket option name strings (#161578).
  - Display more IPV6 socket options by name (#162450).
  - Don't display inappropriate syscalls for -e trace=file (#159340).
  - New selector type -e trace=desc for file-descriptor using calls (#159400).
  - Fix 32-bit old_mmap syscall decoding on x86-64 (#162467, #164215).
  - Fix errors detaching from multithreaded process on interrupt (#161919).
  - Note 4.5.12 fix for crash handling bad signal numbers (#162739).


author: Roland McGrath <roland@redhat.com> - 4.5.14-1
changelog:
  - Fix biarch decoding of socket syscalls (#174354).
  - Fix biarch -e support (#173986).
  - Accept numeric syscalls in -e (#174798).
  - Fix ipc syscall decoding (#164755).
  - Improve msgrcv printing (#164757).
  - Man page updates (#165375).
  - Improve mount syscall printing (#165377).
  - Correct printing of restarting syscalls (#165469).


author: Jakub Jelinek <jakub@redhat.com> - 4.5.14-4
changelog:
  - Fix ia64 syscall decoding (#206768)
  - Fix build with glibc-2.4.90-33 and up on all arches but ia64
  - Fix build against 2.6.18+ headers


author: Roland McGrath <roland@redhat.com> - 4.5.15-1
changelog:
  - biarch fixes (#179740, #192193, #171626, #173050, #218433, #218043)
  - fix -ff -o behavior (#204950, #218435, #193808, #219423)
  - better quotactl printing (#118696)
  - *at, inotify*, pselect6, ppoll and unshare syscalls (#178633, #191275)
  - glibc-2.5 build fixes (#209856)
  - memory corruption fixes (#200621
  - fix race in child setup under -f (#180293)
  - show ipc key values in hex (#198179, #192182)
  - disallow -c with -ff (#187847)
  - Resolves: RHBZ #179740, RHBZ #192193, RHBZ #204950, RHBZ #218435
  - Resolves: RHBZ #193808, RHBZ #219423, RHBZ #171626, RHBZ #173050
  - Resolves: RHBZ #218433, RHBZ #218043, RHBZ #118696, RHBZ #178633
  - Resolves: RHBZ #191275, RHBZ #209856, RHBZ #200621, RHBZ #180293
  - Resolves: RHBZ #198179, RHBZ #198182, RHBZ #187847


author: Roland McGrath <roland@redhat.com> - 4.5.16-1
changelog:
  - fix multithread issues (#240962, #240961, #247907)
  - fix spurious SIGSTOP on early interrupt (#240986)
  - fix utime for biarch (#247185)
  - fix -u error message (#247170)
  - better futex syscall printing (##241467)
  - fix argv/envp printing with small -s settings, and for biarch
  - new syscalls: getcpu, eventfd, timerfd, signalfd, epoll_pwait,
    move_pages, utimensat


author: Roland McGrath <roland@redhat.com> - 4.5.17-1
changelog:
  - handle O_CLOEXEC, MSG_CMSG_CLOEXEC (#365781)
  - fix biarch stat64 decoding (#222275)
  - fix spurious "..." in printing of environment strings (#358241)
  - improve prctl decoding (#364401)
  - fix hang wait on exited child with exited child (#354261)
  - fix biarch fork/vfork (-f) tracing (#447475)
  - fix biarch printing of negative argument kill (#430585)
  - fix biarch decoding of error return values (#447587)
  - fix -f tracing of CLONE_VFORK (#455078)
  - fix ia64 register clobberation in -f tracing (#453438)
  - print SO_NODEFER, SA_RESETHAND instead of SA_NOMASK, SA_ONESHOT (#455821)
  - fix futex argument decoding (#448628, #448629)


author: Roland McGrath <roland@redhat.com> - 4.5.18-1
changelog:
  - build fix for newer kernel headers (#457291)
  - fix CLONE_VFORK handling (#455078)
  - Support new Linux/PPC system call subpage_prot and PROT_SAO flag.
  - In sigaction system call, display sa_flags value along with SIG_DFL/SIG_IGN.


author: Roland McGrath <roland@redhat.com> - 4.5.19-1
changelog:
  - New upstream release, work mostly by Dmitry V. Levin <ldv@altlinux.org>
    + exit/kill strace with traced process exitcode/signal (#105371);
    + fixed build on ARM EABI (#507576);
    + fixed display of 32-bit argv array on 64-bit architectures (#519480);
    + fixed display of 32-bit fcntl(F_SETLK) on 64-bit architectures (#471169);
    + fixed several bugs in strings decoder, including potential heap
      memory corruption (#470529, #478324, #511035).


author: Roland McGrath <roland@redhat.com> - 4.5.20-1
changelog:
  - New upstream release, work mostly by Andreas Schwab and Dmitry V. Levin.
    + fixed potential stack buffer overflow in select decoder (#556678);
    + fixed FTBFS (#539044).


author: Dmitry V. Levin <ldv@altlinux.org> - 4.8-1
changelog:
  - New upstream release:
    + fixed ERESTARTNOINTR leaking to userspace on ancient kernels (#659382);
    + fixed decoding of *xattr syscalls (#885233);
    + fixed handling of files with 64-bit inode numbers by 32-bit strace (#912790);
    + added aarch64 support (#969858).


author: Dmitry V. Levin <ldv@altlinux.org> - 4.9-1
changelog:
  - New upstream release:
    + fixed build when <sys/ptrace.h> and <linux/ptrace.h> conflict (#993384);
    + updated CLOCK_* constants (#1088455);
    + enabled ppc64le support (#1122323);
    + fixed attach to a process on ppc64le (#1129569).


author: Dmitry V. Levin <ldv@altlinux.org> - 4.11-1
changelog:
  - New upstream release:
    + print nanoseconds along with seconds in stat family syscalls (#1251176).


author: Dmitry V. Levin <ldv@altlinux.org> - 4.11.0.163.9720-1
changelog:
  - New upstream snapshot v4.11-163-g972018f:
    + fixed decoding of syscalls unknown to the kernel on s390/s390x (#1298294).


author: Dmitry V. Levin <ldv@altlinux.org> - 4.14-1
changelog:
  - v4.13 -> v4.14:
    + added printing of the mode argument of open and openat syscalls
      when O_TMPFILE flag is set (#1377846).


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.23-4
changelog:
  - Fix tests build with fresh glibc that now provides struct statx in sys/stat.h.
  - Resolves #1611749.


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-2
changelog:
  - Add transition for strace32 package pn those architectures that
    provided it in RHEL 7 (ppc64 and s390x).


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-4
changelog:
  - Sync up thread handling unfairness fix with the upstream version.
  - Fix "xlat_idx: Unexpected xlat value 0 at index ..." messages (#1660759).
  - Remove "ptrace(SYSCALL): No such process" messages (#1662936).
  - Wire up rseq and kexec_file_load on aarch64 (#1676045).


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-6
changelog:
  - Pull upstream fix for ioctl evdev bitset decoding, fix the tests (#1747214).
  - Include commit v4.26~65 "s390x: beautify sthyi data tail prints" (#1747514).
  - Include upstream patches that fix issues reported by covscan (#1747526):
    91281fec "v4l2: avoid shifting left a signed number by 31 bit",
    522ad3a0 "syscall.c: avoid infinite loop in subcalls parsing",
    9446038e "kvm: avoid bogus vcpu_info assignment in vcpu_register", and
    2b64854e "xlat: use unsgined type for mount_flags fallback values".


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-7
changelog:
  - Fix printing stack traces for early syscalls on process attach (#1790053):
    69b2c33a "unwind-libdw: fix initialization of libdwfl cache" and
    8e515c74 "tests: add strace-k-p test".
  - Properly decode struct sockaddr_hci without hci_channel field.
  - Update tests-m32/ioctl_evdev.c and tests-mx32/ioctl_evdev.c
    in 0002-evdev-fix-decoding-of-EVIOCGBIT-0.patch.
  - Update tests-m32/Makefile.in and tests-mx32/Makefile.in
    in 0032-tests-check-decoding-of-successful-evdev-ioctl.patch.


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-8
changelog:
  - Fix expected alignment for IPC tests (#1795251):
    4377e3a1 "tests: fix expected output for some ipc tests", and
    a75c7c4b "tests: fix -a argument in ipc_msgbuf-Xraw test".
  - Update tests-m32/looping_threads.test and tests-mx32/looping_threads.test
    in 0025-tests-check-tracing-of-looping-threads.patch.
  - Update the bpf syscall decoder:
    d6c71dd0 "Fix preprocessor indentation",
    cabd6955 "bpf: print struct bpf_prog_info.gpl_compatible",
    14a9b6ca "bpf: add support for btf_* fields in BPF_MAP_CREATE",
    27bd13d3 "bpf: add support for btf_* fields in struct bpf_map_info",
    d1f90bcd "bpf: add support for *jited_ksyms and *jited_func_lens fields
             in struct bpf_prog_info", and
    940fe50f "bpf: add support for new twelve fields in struct bpf_prog_info".
    c661605b "tests: robustify bpf-obj_get_info_by_fd test against future kernels"


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-9
changelog:
  - Fix the "extra tokens at end of #ifdef directive" warning:
    579f2702 "bpf: exclude bit fields from the check".


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.18-2
changelog:
  - Fix the issues reported by covscan (#2103068).
  - Fix SELinux context matching for the deleted paths (#2087693).
  - Fix sloppy FD usage in the bpf test (#2103137).


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.18-2.1
changelog:
  - Fix incorrect syscall name reporting in restart_syscall() on attach when
    PTRACE_GET_SYSCALL_INFO is in use (RHEL-8570).
  - Update net-yy-inet*, linkat--secontext_mismatch, and prctl-sve tests.


author: Hangbo Fan <fanhangbo.fhb@alibaba-inc.com> - 5.18-2.1.0.1
changelog:
  - Add doc sub package
  - Improve support for loongarch64 (lihui@loongson.cn)
  - cherry-pick `add sw patch #757f9ac5303eba4f95fb2221cae6eb2688b4bc3e`. (nijie@wuxiat.com)
  - Handle failed testsuite strace-k for loongarch64 (lihui@loongson.cn)


author: Sahana Prasad <sahana@redhat.com> - 5.56-5
changelog:
  - Fix CVE-2021-20230 stunnel: client certificate not
    correctly verified when redirect and verifyChain options are used.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move to Applications/Internet group
  - clean up %post script
  - make stunnel.pem %ghost %config(noreplace)
  - provide a sample file for use with xinetd


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 3.11
  - chuck the SIGHUP patch (went upstream)
  - chuck parts of the 64-bit clean patch (went upstream)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - remove explicit requirement on openssl (specific version isn't enough,
    we have to depend on shared library version anyway)


author: Nalin Dahyabhai <nalin@redhat.com> 3.19-1
changelog:
  - update to 3.19 to avoid problems with stunnel being multithreaded, but
    tcp wrappers not being thrad-safe


author: Nalin Dahyabhai <nalin@redhat.com> 3.20-1
changelog:
  - log using LOG_AUTHPRIV facility by default (#47289)
  - make permissions on stunnel binary 0755
  - implicitly trust certificates in %{_datadir}/ssl/trusted (#24034)


author: Miloslav Trmac <mitr@redhat.com> - 4.11-1
changelog:
  - Update to stunnel-4.11
  - Fix int/size_t mismatches in stack_info ()
  - Update Certificate-Creation for /etc/pki


author: Miloslav Trmac <mitr@redhat.com> - 4.14-1
changelog:
  - Update to stunnel-4.14
  - Override changed default pid file location, keep it in %{_localstatedir}/run


author: Miloslav Trmač <mitr@redhat.com> - 4.20-4
changelog:
  - Revert the port to NSS, wait for NSS-based stunnel 5.x instead
    Resolves: #301971
  - Mark localized man pages with %lang (patch by Ville Skyttä)
    Resolves: #322281


author: Avesh Agarwal <avagarwa@redhat.com> - 4.29-1
changelog:
  - New upstream realease 4.29
  - Updated authpriv and sample patches for the new release
  - Modified spec file to include dist tag


author: Avesh Agarwal <avagarwa@redhat.com> - 4.33-1
changelog:
  - New upstream realease 4.33
  - Updated authpriv and sample patches to match the new release
  - Addresses bz 580117 (inted mode support issue)


author: Avesh Agarwal <avagarwa@redhat.com> - 4.55-1
changelog:
  - New upstream realease 4.55
  - Updated local patches
  - enabled fips mode
  - Fixed for pod2man as it build-requires perl-podlators


author: Avesh Agarwal <avagarwa@redhat.com> - 4.56-1
changelog:
  - New upstream realease 4.56.
  - Updated local patches.
  - Fixed upstream URL in spec file.
  - Sourced URL of sha256 hash file in spec file.


author: Avesh Agarwal <avagarwa@redhat.com> - 5.00-1
changelog:
  - New upstream realease 5.00
  - Updated local patches.
  - Fix for CVE-2014-0016
  - Fixed changelog date errors
  - Fixes rhbz #1006819


author: Avesh Agarwal <avagarwa@redhat.com> - 5.01-1
changelog:
  - New upstream realease 5.01
  - Supports OpenSSL DLLs 1.0.1g.
  - Fixes to take care of OpenSSL,s TLS heartbeat
    read overrun (CVE-2014-0160).


author: Avesh Agarwal <avagarwa@redhat.com> - 5.01-2
changelog:
  - Integration with systemd.
  - Spec file clean up
  - Patched stunnel systemd unit file to have dependency on
    network.target.
  - rhbz#455815: Packaged systemd service file
  - rhbz#782535: Fixed private tmp issue.
  - rhbz#995831: Fixed wrong encoding of french man page.


author: Avesh Agarwal <avagarwa@redhat.com> - 5.02-1
changelog:
  - rhbz#1108818: New upstream realease 5.02
  - Updated local patches
  - The rhbz#530950 is tested and seems to work. STRLEN has
    been no longer allocated statically since 4.36 version.
    So it is possible that this bz might have got fixed
    around 4.36 release.
  - Fixes rpmlint errors


author: Avesh Agarwal <avagarwa@redhat.com> - 5.04-1
changelog:
  - New upstream realease 5.04
  - Updates local patches so that they apply cleanly to
    avoud hunk errors


author: Avesh Agarwal <avagarwa@redhat.com> - 5.08b6-1
changelog:
  - 1163349: New upstream beta release 5.08b6
  - Fixed incorrect reporting of fips status in configure.ac
    at compile time, requires autoconf automake at buildtime
  - Fixed default OpenSSL directory issue by using with-ssl
  - Updates local patches
  - 1155977: Fixes man page issues


author: Avesh Agarwal <avagarwa@redhat.com> - 5.15-1
changelog:
  - New upstream release 5.15.
  - 1155977: Fixed upstream too so removed the associated patch
  - Updates other patches too.


author: Avesh Agarwal <avagarwa@redhat.com> - 5.18-1
changelog:
  - New upstream release 5.18.
  - Finally deleted the patch stunnel-5-sample.patch as upstream
    has merged those changes.
  - Fixes patches as per new code changes.
  - Fixed systemd service file related changes.


author: Neal Gompa <ngompa@datto.com> - 5.40-1
changelog:
  - New upstream release 5.40
  - Properly mark license files
  - Rebase patches
  - Eliminate unnecessary Provides
  - Small spec cleanups and fixes


author: Sahana Prasad <sahana@redhat.com> - 5.56-5
changelog:
  - Fixes CVE-2021-20230 stunnel: client certificate not
    correctly verified when redirect and verifyChain options are used.


author: Clemens Lang <cllang@redhat.com> - 5.71-1
changelog:
  - New upstream release 5.71
    Resolves: RHEL-2340
  - Enable socket activation support
  - verify upstream source in %prep
  - clean up stale conditionals


author: Radovan Sroka <rsroka@redhat.com> - 1.8.28p1-1
changelog:
  - RHEL 8.2 ERRATUM
  - rebase to 1.8.28p1
  Resolves: rhbz#1733961
  - fixed man page for always_set_home
  Resolves: rhbz#1576880
  - sudo does not work with notbefore/after
  Resolves: rhbz#1679508
  - NOTBEFORE showing value of sudoNotAfter Ldap attribute
  Resolves: rhbz#1715516
  - CVE-2019-14287 sudo
  - Privilege escalation via 'Runas' specification with 'ALL' keyword
  Resolves: rhbz#1760697


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29-7
changelog:
  - RHEL 8.4 ERRATUM
  - CVE-2021-3156
  Resolves: rhbz#1917734
  - CVE-2021-23239 sudo: possible directory existence test due to race condition in sudoedit
  Resolves: rhzb#1916434
  - CVE-2021-23240 sudo: symbolic link attack in SELinux-enabled sudoedit
  Resolves: rhbz#1917038
  - updated upstream url
  Resolves: rhbz#1923825


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29-8
changelog:
  RHEL 8.6.0 ERRATUM
  - sudoedit does not work with selinux args
  Resolves: rhbz#2029551
  - Make sure SIGCHLD is not ignored when sudo is executed
  Resolves: rhbz#1999751
  - [RFE] pass KRB5CCNAME to pam_authenticate environment if available
  Resolves: rhbz#1917379
  - utmp resource leak in sudo
  Resolves: rhbz#1986572


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29.9
changelog:
  RHEL 8.8.0 ERRATUM
  - CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user
  Resolves: rhbz#2161221
  - sudo digest check fails incorrectly for certain file sizes (SHA512/SHA384)
  Resolves: rhbz#2114576


author: Radovan Sroka <rsroka@redhat.com> - 1.9.5p2-1
changelog:
  RHEL 8.9.0.Z ERRATUM
  - Rebase to 1.9.5p2
  - CVE-2023-28486 sudo: Sudo does not escape control characters in log messages
  Resolves: RHEL-21825
  - CVE-2023-28487 sudo: Sudo does not escape control characters in sudoreplay output
  Resolves: RHEL-21831
  - CVE-2023-42465 sudo: Targeted Corruption of Register and Stack Variables
  Resolves: RHEL-21820


author: Kalev Lember <klember@redhat.com> - 3.39.92-2
changelog:
  - Split sysprof-capture library and header files out to sysprof-capture-devel
  - Update minimum required glib2 version


author: Jan Tulak <jtulak@redhat.com> - 1.2-1
changelog:
  - Upstream release 1.2 which fixes:
  - use pwquality to test password strength for cryptsetup (#1141871)
  - add multipath detection support (#1309729)
  - add migrate command (#1014708)


author: Jan Tulak <jtulak@redhat.com> - 1.2-3:
changelog:
  - Gating tests implementation, which meant adding few more changes
    to the existing patches (#1681969)
  - sphinx patch was merged to python3 change
  - add seq numbers to patch files


author: Jan Tulak <jtulak@redhat.com> - 1.4-1:
changelog:
  - Bring changes from upstream 1.4 (mostly bugfixes)
  - Remove multipath from the list of default backends (rhbz#1685019)
  - Fix locale issue (rhbz#1679587)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-70
changelog:
  - basic: recognize pdfs filesystem as a network filesystem (#2094661)
  - core: move reset_arguments() to the end of main's finish (#2127131)
  - manager: move inc. of n_reloading into a function (#2136869)
  - core: Add new DBUS properties UnitsReloadStartTimestamp and UnitsLoadTimestampMontonic (#2136869)
  - core: Indicate the time when the manager started loading units the last time (#2136869)
  - core: do not touch /run/systemd/systemd-units-load from user session instances (#2136869)
  - sysctl: downgrade message when we have no permission (#2158160)
  - core: respect SELinuxContext= for socket creation (#2136738)
  - manager: use target process context to set socket context (#2136738)
  - virt: detect Amazon EC2 Nitro instance (#2117948)
  - machine-id-setup: generate machine-id from DMI product ID on Amazon EC2 (#2117948)
  - virt: use string table to detect VM or container (#2117948)
  - fileio: introduce read_full_virtual_file() for reading virtual files in sysfs, procfs (#2117948)
  - Use BIOS characteristics to distinguish EC2 bare-metal from VMs (#2117948)
  - device: drop refuse_after (#2043524)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-71
changelog:
  - manager: limit access to private dbus socket (#2119405)
  - journalctl: do not treat EINTR as an error when waiting for events (#2161683)
  - core: bring manager_startup() and manager_reload() more inline (#2059633)
  - pam: add a call to pam_namespace (#1861836)
  - virt: Support detection for ARM64 Hyper-V guests (#2158307)
  - virt: Fix the detection for Hyper-V VMs (#2158307)
  - basic: add STRERROR() wrapper for strerror_r() (#2155520)
  - coredump: put context array into a struct (#2155520)
  - coredump: do not allow user to access coredumps with changed uid/gid/capabilities (#2155520)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-72
changelog:
  - test: import logind test from debian/ubuntu test suite (#1866955)
  - test: introduce inst_recursive() helper function (#1866955)
  - tests: verify that Lock D-Bus signal is sent when IdleAction=lock (#1866955)
  - systemctl: simplify halt_main() (#2053273)
  - systemctl: shutdown don't fallback on auth fail (#2053273)
  - systemctl: reintroduce the original halt_main() (#2053273)
  - systemctl: preserve old behavior unless requested (#2053273)
  - pam_systemd: suppress LOG_DEBUG log messages if debugging is off (#2170084)
  - udev/net_id: introduce naming scheme for RHEL-8.8 (#2170499)
  - pam: add a call to pam_namespace (#1861836)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-73
changelog:
  - journald: add API to move logging from /var to /run again (#1873540)
  - journalctl: add new --relinquish and --smart-relinquish options (#1873540)
  - units: automatically revert to /run logging on shutdown if necessary (#1873540)
  - pstore: Tool to archive contents of pstore (#2158832)
  - meson: drop redundant line (#2158832)
  - pstore: drop unnecessary initializations (#2158832)
  - pstopre: fix return value of list_files() (#2158832)
  - pstore: remove temporary file on failure (#2158832)
  - pstore: do not add FILE= journal entry if content_size == 0 (#2158832)
  - pstore: run only when /sys/fs/pstore is not empty (#2158832)
  - pstore: fix use after free (#2158832)
  - pstore: refuse to run if arguments are specified (#2158832)
  - pstore: allow specifying src and dst dirs are arguments (#2158832)
  - pstore: rework memory handling for dmesg (#2158832)
  - pstore: fixes for dmesg.txt reconstruction (#2158832)
  - pstore: Don't start systemd-pstore.service in containers (#2158832)
  - units: pull in systemd-pstore.service from sysinit.target (#2158832)
  - units: drop dependency on systemd-remount-fs.service from systemd-pstore.service (#2158832)
  - units: make sure systemd-pstore stops at shutdown (#2158832)
  - pstore: Run after modules are loaded (#2158832)
  - pstore: do not try to load all known pstore modules (#2158832)
  - logind-session: make stopping of idle session visible to admins (#2156780)
  - journald: Increase stdout buffer size sooner, when almost full (#2029426)
  - journald: rework end of line marker handling to use a field table (#2029426)
  - journald: use the fact that client_context_release() returns NULL (#2029426)
  - journald: rework pid change handling (#2029426)
  - test: Add a test case for #15654 (#2029426)
  - test: Stricter test case for #15654 (Add more checks) (#2029426)
  - man: document the new _LINE_BREAK= type (#2029426)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-74
changelog:
  - journald-server: always create state file in signal handler (#2174645)
  - journald-server: move relinquish code into function (#2174645)
  - journald-server: always touch state file in signal handler (#2174645)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-75
changelog:
  - journald-server: always create state file in signal handler (#2176892)
  - journald-server: move relinquish code into function (#2176892)
  - journald-server: always touch state file in signal handler (#2176892)
  - test: make TEST-35-LOGIN stable again (#2179309)
  - pager: set $LESSSECURE whenver we invoke a pager (#2175624)
  - test-login: always test sd_pid_get_owner_uid(), modernize (#2175624)
  - pager: make pager secure when under euid is changed or explicitly requested (#2175624)
  - ci: trigger differential-shellcheck workflow on push (#2179309)
  - ci: codeql `master` -> `main` (#2179309)
  - test: ignore ENOMEDIUM error from sd_pid_get_cgroup() (#2175622)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-76
changelog:
  - ci(Mergify): drop requirements on linting workflows (#2179309)
  - ci: workflow for gathering metadata for source-git automation (#2179309)
  - ci: first part of the source-git automation - commit linter (#2179309)
  - pstore: fix crash and forward dummy arguments instead of NULL (#2190151)
  - test: Disable LUKS devices from initramfs in QEMU tests (#2190151)
  - pstore: explicitly set the base when converting record ID (#2190151)
  - pstore: avoid opening the dmesg.txt file if not requested (#2190151)
  - test: add a couple of tests for systemd-pstore (#2190151)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-77
changelog:
  - ci: update permissions for source-git automation workflows (#2179309)
  - sulogin: fix control lost of the current terminal when default.target is rescue.target (#2169932)
  - parse-util: in parse_permille() check negative earlier (#2178179)
  - tree-wide: increase granularity of percent specifications all over the place to permille (#2178179)
  - errno-util: introduce ERRNO_IS_TRANSIENT() (#2172846)
  - tree-wide: use ERRNO_IS_TRANSIENT() (#2172846)
  - libsystemd: ignore both EINTR and EAGAIN (#2172846)
  - sd-bus: handle -EINTR return from bus_poll() (#2172846)
  - stdio-bridge: don't be bothered with EINTR (#2172846)
  - sd-netlink: handle EINTR from poll() gracefully, as success (#2172846)
  - resolved: handle -EINTR returned from fd_wait_for_event() better (#2172846)
  - utmp-wtmp: fix error in case isatty() fails (#2172846)
  - utmp-wtmp: handle EINTR gracefully when waiting to write to tty (#2172846)
  - journal-vacuum: count size of all journal files (#2180380)
  - resolved: instead of closing DNS UDP transaction fds right-away, add them to a socket "graveyard" (#2156751)
  - resolved: close UDP socket when we received a network error on it (#2156751)
  - ci: allow RHEL-only labels to mark downstream-only commits (#2179309)
  - man: tweak markup in systemd-pstore.service(8) (#2217786)
  - man: add .service suffix to systemd-pstore(8) (#2217786)
  - presets: enable systemd-pstore.service by default (#2217786)
  - logind: simplify code (#2209328)
  - format-table: add TABLE_TIMESTAMP_UTC and _RELATIVE (#2156786)
  - loginctl: shorten variable name (#2156786)
  - loginctl: use bus_map_all_properties (#2156786)
  - loginctl: show session idle status in list-sessions (#2156786)
  - loginctl: list-sessions: fix timestamp for idle hint (#2156786)
  - loginctl: also show idle hint in session-status (#2156786)
  - core/timer: Always use inactive_exit_timestamp if it is set (#1719364)
  - timer: Use dual_timestamp_is_set() in one more place (#1719364)
  - ci: drop systemd-stable from advanced-commit-linter config (#2179309)
  - core/mount: escape invalid UTF8 char in dbus reply (#2158724)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-78
changelog:
  - login: add a missing error check for session_set_leader() (#2158167)
  - logind: reset session leader if we know for a fact that it is gone (#2158167)
  - test-login: skip consistency checks when logind is not active (#2223582)
  - sd-event: remove dead code and use _cleanup_ (#2211358)
  - sd-event: don't destroy inotify data structures from inotify event handler (#2211358)
  - sd-event: add sd_event_add_inotify_fd() call (#2211358)
  - test: add test case for self-destroy inotify handler (#2211358)
  - doc: add downstream CONTRIBUTING document (#2179309)
  - doc: use link with prefilled Jira issue (#2179309)
  - docs: link downstream CONTRIBUTING in README (#2179309)
  - unit drop-in: Fix ordering of special type.d drop-ins (#2156620)
  - Add failing test to show service.d global drop-in does not get overridden by more specific dropins (#2156620)
  - test: set indentation to 4 spaces (#2156620)
  - test/TEST-15: remove all created unit files (#2156620)
  - test: use quotes where necessary (#2156620)
  - tree-wide: drop manually-crafted message for missing variables (#2156620)
  - manager: reformat boolean expression in unit_is_pristine() (#2156620)
  - manager: allow transient units to have drop-ins (#2156620)
  - TEST-15: allow helper functions to accept other unit types (#2156620)
  - TEST-15: also test hierarchical drop-ins for slices (#2156620)
  - TEST-15: add test for transient units with drop-ins (#2156620)
  - TEST-15: add one more test for drop-in precedence (#2156620)
  - udev/net_id: introduce naming scheme for RHEL-8.9 (#2231846)
  - meson: remove libdw dependency from pstore (#2211416)
  - pstore: introduce tmpfiles.d/systemd-pstore.conf (#2211416)
  - tmpfiles: don't complain if we can't enable pstore in containers (#2211416)
  - pstore: don't enable crash_kexec_post_notifiers by default (#2211416)
  - core: when Delegate=yes is set for a unit, run ExecStartPre= and friends in a subcgroup of the unit (#2215925)
  - man: link Delegate= documentation up with the markdown docs (#2215925)


author: Yuanhong Peng <yummypeng@linux.alibaba.com> - 239-78.0.1
changelog:
  - core: fix a null reference case in load_from_path()
  - sysctl: Don't pass null directive argument to '%s'
  - exit-status: introduce EXIT_EXCEPTION mapping to 255
  - main: don't freeze PID 1 in containers, exit with non-zero instead
  - Do not go into freeze when systemd crashd
  - mount-setup: change the system mount propagation to shared by default only at bootup
  - cgroup-util: make definition of CGROUP_CONTROLLER_TO_MASK() unsigned
  - cgroup: update only siblings that got realized once
  - core: add a config item to support setting the value of cpuset.clone_children when systemd is starting
  - support loongarch for systemd
  - test-catalog: Fix coredump when compiled under GCC10
  - add Iluvatar CoreX pci id (Liwei Ge)
  - seccomp: add loongarch64 support (Liwei Ge)
  - seccomp: remove loongarch64 switch(Liwei Ge)
  - umount: check LO_FLAGS_AUTOCLEAR after LOOP_CLR_FD claimed success(yuanhui)
  - fileio: when reading a full file into memory, refuse inner NUL bytes (Guorui Yu)
  - util: introduce explicit_bzero_safe for explicit memset (Guorui Yu)
  - util: introduce erase_and_free() helper (Guorui Yu)
  - util: introduce READ_FULL_FILE_SECURE flag for reading secure data (Guorui Yu)
  - fileio: introduce warn_file_is_world_accessible() (Guorui Yu)
  - fileio: read_full_file_full() also warns when file is world readable and secure flag is set (Guorui Yu)
  - basic/fileio: Fix memory leak if READ_FULL_FILE_SECURE flag is used (Guorui Yu)
  - fileio: add explicit flag for generating world executable warning when reading file (Guorui Yu)
  - fileio: add 'dir_fd' parameter to read_full_file_full() (Guorui Yu)
  - fileio: add support for read_full_file() on AF_UNIX stream sockets (Guorui Yu)
  - fileio: beef up READ_FULL_FILE_CONNECT_SOCKET to allow setting sender socket name (Guorui Yu)
  - fileio: teach read_full_file_full() to read from offset/with maximum size (Guorui Yu)
  - cryptsetup: port cryptsetup's main key file logic over to read_full_file_full() (Guorui Yu)
  - Update upstream parse_hwdb.py to fix parse-hwdb error (Zhongling He)
  - cgroup: do not refresh cgroup devices config when daemon-reload (Zhongling He)
  - core: introduce cgroup full delegation for compability (Zhongling He)


author: Lennart Poettering <lpoetter@redhat.com> - 0-0.7.20100629git4176e5
changelog:
  - New snapshot
  - Split off -units package where other packages can depend on without pulling in the whole of systemd


author: Lennart Poettering <lpoetter@redhat.com> - 8-3
changelog:
  - Reexecute after installation, take ownership of /var/run/user
  - https://bugzilla.redhat.com/show_bug.cgi?id=627457
  - https://bugzilla.redhat.com/show_bug.cgi?id=627634


author: Lennart Poettering <lpoetter@redhat.com> - 10-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=630401
  - https://bugzilla.redhat.com/show_bug.cgi?id=630225
  - https://bugzilla.redhat.com/show_bug.cgi?id=626966
  - https://bugzilla.redhat.com/show_bug.cgi?id=623456


author: Lennart Poettering <lpoetter@redhat.com> - 14-1
changelog:
  - Upstream update
  - Enable hwclock-load by default
  - Obsolete readahead
  - Enable /var/run and /var/lock on tmpfs


author: Lennart Poettering <lpoetter@redhat.com> - 24-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=694079
  - https://bugzilla.redhat.com/show_bug.cgi?id=693289
  - https://bugzilla.redhat.com/show_bug.cgi?id=693274
  - https://bugzilla.redhat.com/show_bug.cgi?id=693161


author: Lennart Poettering <lpoetter@redhat.com> - 25-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=694788
  - https://bugzilla.redhat.com/show_bug.cgi?id=694321
  - https://bugzilla.redhat.com/show_bug.cgi?id=690253
  - https://bugzilla.redhat.com/show_bug.cgi?id=688661
  - https://bugzilla.redhat.com/show_bug.cgi?id=682662
  - https://bugzilla.redhat.com/show_bug.cgi?id=678555
  - https://bugzilla.redhat.com/show_bug.cgi?id=628004


author: Lennart Poettering <lpoetter@redhat.com> - 26-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=699394
  - https://bugzilla.redhat.com/show_bug.cgi?id=698198
  - https://bugzilla.redhat.com/show_bug.cgi?id=698674
  - https://bugzilla.redhat.com/show_bug.cgi?id=699114
  - https://bugzilla.redhat.com/show_bug.cgi?id=699128


author: Lennart Poettering <lpoetter@redhat.com> - 26-2
changelog:
  - Bugfix release
  - https://bugzilla.redhat.com/show_bug.cgi?id=707507
  - https://bugzilla.redhat.com/show_bug.cgi?id=707483
  - https://bugzilla.redhat.com/show_bug.cgi?id=705427
  - https://bugzilla.redhat.com/show_bug.cgi?id=707577


author: Michal Schmidt <mschmidt@redhat.com> - 28-3
changelog:
  - Apply patches from current upstream
  - https://bugzilla.redhat.com/show_bug.cgi?id=709909
  - https://bugzilla.redhat.com/show_bug.cgi?id=710839
  - https://bugzilla.redhat.com/show_bug.cgi?id=711015


author: Michal Schmidt <mschmidt@redhat.com> - 28-4
changelog:
  - Apply patches from current upstream.
  - Fixes memory size detection on 32-bit with >4GB RAM (BZ712341)


author: Lennart Poettering <lpoetter@redhat.com> - 35-1
changelog:
  - New upstream release
  - Update post scripts
  - Resolves: #726683, #713384, #698198, #722803, #727315, #729997, #733706, #734611


author: Michal Schmidt <mschmidt@redhat.com> - 37-2
changelog:
  - A couple of fixes from upstream:
  - Fix a regression in bash-completion reported in Bodhi.
  - Fix a crash in isolating.
  - Resolves: #717325


author: Michal Schmidt <mschmidt@redhat.com> - 38-5
changelog:
  - Build against libgee06. Reenable gtk tools.
  - Delete unused patches.
  - Add easy building of git snapshots.
  - Remove legacy spec file elements.
  - Don't mention implicit BuildRequires.
  - Configure with --disable-static.
  - Merge -units into the main package.
  - Move section 3 manpages to -devel.
  - Fix unowned directory.
  - Run ldconfig in scriptlets.
  - Split systemd-analyze to a subpackage.


author: Lennart Poettering <lpoetter@redhat.com> - 42-1
changelog:
  - New upstream release
  - Save a bit of entropy during system installation (#789407)
  - Don't own /etc/os-release anymore, leave that to fedora-release


author: Dennis Gilmore <dennis@ausil.us> - 43-2
changelog:
  - don't conflict with fedora-release systemd never actually provided
  - /etc/os-release so there is no actual conflict


author: Dennis Gilmore <dennis@ausil.us> - 44-3
changelog:
  - apply patch from upstream so we can build systemd on arm and ppc
  - and likely the rest of the secondary arches


author: Michal Schmidt <mschmidt@redhat.com> - 44-4
changelog:
  - Add triggers from Bill Nottingham to correct the damage done by
    the obsoleted systemd-units's preun scriptlet (#807457).


author: Kay Sievers - 185-1
changelog:
  - New upstream release
    - udev selinux labeling fixes
    - new man pages
    - systemctl help <unit name>


author: Michal Schmidt <mschmidt@redhat.com> - 185-4.gita2368a3
changelog:
  - Update to current git snapshot
    - Add systemd-readahead-analyze
    - Drop upstream patch
  - Split systemd-libs
  - Drop duplicate doc files
  - Fixed License headers of subpackages


author: Lennart Poettering <lpoetter@redhat.com> - 188-1
changelog:
  - New upstream release
  - Enable gdm and avahi by default via the preset file
  - Convert /etc/sysconfig/desktop to display-manager.service symlink
  - Enable hardened build


author: Lennart Poettering <lpoetter@redhat.com> - 188-3
changelog:
  - Remount file systems MS_PRIVATE before switching roots
  - https://bugzilla.redhat.com/show_bug.cgi?id=847418


author: Ray Strode <rstrode@redhat.com> 188-4
changelog:
  - more scriptlet fixes
    (move dm migration logic to %posttrans so the service
     files it's looking for are available at the time
     the logic is run)


author: Lennart Poettering <lpoetter@redhat.com> - 189-3
changelog:
  - Update preset policy
  - Rename preset policy file from 99-default.preset to 90-default.preset so that people can order their own stuff after the Fedora default policy if they wish


author: Lennart Poettering <lpoetter@redhat.com> - 190-1
changelog:
  - New upstream release
  - Take possession of /etc/localtime, and remove /etc/sysconfig/clock
  - https://bugzilla.redhat.com/show_bug.cgi?id=858780
  - https://bugzilla.redhat.com/show_bug.cgi?id=858787
  - https://bugzilla.redhat.com/show_bug.cgi?id=858771
  - https://bugzilla.redhat.com/show_bug.cgi?id=858754
  - https://bugzilla.redhat.com/show_bug.cgi?id=858746
  - https://bugzilla.redhat.com/show_bug.cgi?id=858266
  - https://bugzilla.redhat.com/show_bug.cgi?id=858224
  - https://bugzilla.redhat.com/show_bug.cgi?id=857670
  - https://bugzilla.redhat.com/show_bug.cgi?id=856975
  - https://bugzilla.redhat.com/show_bug.cgi?id=855863
  - https://bugzilla.redhat.com/show_bug.cgi?id=851970
  - https://bugzilla.redhat.com/show_bug.cgi?id=851275
  - https://bugzilla.redhat.com/show_bug.cgi?id=851131
  - https://bugzilla.redhat.com/show_bug.cgi?id=847472
  - https://bugzilla.redhat.com/show_bug.cgi?id=847207
  - https://bugzilla.redhat.com/show_bug.cgi?id=846483
  - https://bugzilla.redhat.com/show_bug.cgi?id=846085
  - https://bugzilla.redhat.com/show_bug.cgi?id=845973
  - https://bugzilla.redhat.com/show_bug.cgi?id=845194
  - https://bugzilla.redhat.com/show_bug.cgi?id=845028
  - https://bugzilla.redhat.com/show_bug.cgi?id=844630
  - https://bugzilla.redhat.com/show_bug.cgi?id=839736
  - https://bugzilla.redhat.com/show_bug.cgi?id=835848
  - https://bugzilla.redhat.com/show_bug.cgi?id=831740
  - https://bugzilla.redhat.com/show_bug.cgi?id=823485
  - https://bugzilla.redhat.com/show_bug.cgi?id=821813
  - https://bugzilla.redhat.com/show_bug.cgi?id=807886
  - https://bugzilla.redhat.com/show_bug.cgi?id=802198
  - https://bugzilla.redhat.com/show_bug.cgi?id=767795
  - https://bugzilla.redhat.com/show_bug.cgi?id=767561
  - https://bugzilla.redhat.com/show_bug.cgi?id=752774
  - https://bugzilla.redhat.com/show_bug.cgi?id=732874
  - https://bugzilla.redhat.com/show_bug.cgi?id=858735


author: Lennart Poettering <lpoetter@redhat.com> - 194-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=859614
  - https://bugzilla.redhat.com/show_bug.cgi?id=859655


author: Lennart Poettering <lpoetter@redhat.com> - 195-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=831665
  - https://bugzilla.redhat.com/show_bug.cgi?id=847720
  - https://bugzilla.redhat.com/show_bug.cgi?id=858693
  - https://bugzilla.redhat.com/show_bug.cgi?id=863481
  - https://bugzilla.redhat.com/show_bug.cgi?id=864629
  - https://bugzilla.redhat.com/show_bug.cgi?id=864672
  - https://bugzilla.redhat.com/show_bug.cgi?id=864674
  - https://bugzilla.redhat.com/show_bug.cgi?id=865128
  - https://bugzilla.redhat.com/show_bug.cgi?id=866346
  - https://bugzilla.redhat.com/show_bug.cgi?id=867407
  - https://bugzilla.redhat.com/show_bug.cgi?id=868603


author: Michal Schmidt <mschmidt@redhat.com> - 195-4
changelog:
  - add dmraid-activation.service to the default preset
  - add yum protected.d fragment
  - https://bugzilla.redhat.com/show_bug.cgi?id=869619
  - https://bugzilla.redhat.com/show_bug.cgi?id=869717


author: Michal Schmidt <mschmidt@redhat.com> - 195-6
changelog:
  - Fix cyclical dep between systemd and systemd-libs.
  - Avoid broken build of test-journal-syslog.
  - https://bugzilla.redhat.com/show_bug.cgi?id=873387
  - https://bugzilla.redhat.com/show_bug.cgi?id=872638


author: Michal Schmidt <mschmidt@redhat.com> - 195-7
changelog:
  - Revert udev killing cgroup patch for F18 Beta.
  - https://bugzilla.redhat.com/show_bug.cgi?id=873576


author: Lennart Poettering <lpoetter@redhat.com> - 195-8
changelog:
  - https://bugzilla.redhat.com/show_bug.cgi?id=873459
  - https://bugzilla.redhat.com/show_bug.cgi?id=878093


author: Michal Schmidt <mschmidt@redhat.com> - 196-2
changelog:
  - added spice-vdagentd.service to presets (Lennart, #876237)
  - BR cryptsetup-devel instead of the legacy cryptsetup-luks-devel provide name
    (requested by Milan Brož).
  - verbose make to see the actual build flags


author: Michal Schmidt <mschmidt@redhat.com> - 196-3
changelog:
  - Disable hardening on s390(x) because PIE is broken there and produces
    text relocations with __thread (#868839).


author: Michal Schmidt <mschmidt@redhat.com> - 197-2
changelog:
  - Added qemu-guest-agent.service to presets (Lennart, #885406).
  - Add missing pygobject3-base to systemd-analyze deps (Lennart).
  - Do not require hwdata, it is all in the hwdb now (Kay).
  - Drop dependency on dbus-python.


author: Michal Schmidt <mschmidt@redhat.com> - 201-2
changelog:
  - Automatically discover whether to run autoreconf and add autotools and git
    BuildRequires based on the presence of patches to be applied.
  - Use find -delete.


author: Harald Hoyer <harald@redhat.com> 202-2
changelog:
  - nspawn create empty /etc/resolv.conf if necessary
  - python wrapper: add sd_journal_add_conjunction()
  - fix s390 booting
  - Resolves: rhbz#953217


author: Harald Hoyer <harald@redhat.com> 202-3
changelog:
  - fix ENOENT for getaddrinfo
  - Resolves: rhbz#954012 rhbz#956035
  - crypt-setup-generator: correctly check return of strdup
  - logind-dbus: initialize result variable
  - prevent library underlinking


author: Lennart Poettering <lpoetter@redhat.com> - 204-5
changelog:
  - Rename 90-display-manager.preset to 85-display-manager.preset so that it actually takes precedence over 90-default.preset's "disable *" line (#903690)


author: Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> - 206-3
changelog:
  - New systemd-python3 package (#976427).
  - Add ownership of a few directories that we create (#894202).


author: Dennis Gilmore <dennis@ausil.us> - 206-9
changelog:
  - Require grubby, Fedora installs require grubby,
  - kernel-install took over from new-kernel-pkg
  - without the Requires we are unable to compose Fedora
  - everyone else says that since kernel-install took over
  - it is responsible for ensuring that grubby is in place
  - this is really what we want for Fedora


author: Harald Hoyer <harald@redhat.com> 206-10
changelog:
  - Do not require grubby, lorax now takes care of grubby
  - cherry-picked a lot of patches from upstream


author: Harald Hoyer <harald@redhat.com> 206-11
changelog:
  - support "debug" kernel command line parameter
  - journald: fix fd leak in journal_file_empty
  - journald: fix vacuuming of archived journals
  - libudev: enumerate - do not try to match against an empty subsystem
  - cgtop: fixup the online help
  - libudev: fix memleak when enumerating childs


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 208-5
changelog:
  - Use unit name in PrivateTmp= directories (#957439)
  - Update manual pages, completion scripts, and hardware database
  - Configurable Timeouts/Restarts default values
  - Support printing of timestamps on the console
  - Fix some corner cases in detecting when writing to the console is safe
  - Python API: convert keyword values to string, fix sd_is_booted() wrapper
  - Do not tread missing /sbin/fsck.btrfs as an error (#1015467)
  - Allow masking of fsck units
  - Advertise hibernation to swap files
  - Fix SO_REUSEPORT settings
  - Prefer converted xkb keymaps to legacy keymaps (#981805, #1026872)
  - Make use of newer kmod
  - Assorted bugfixes: #1017161, #967521, #988883, #1027478, #821723, #1014303


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 208-7
changelog:
  - Backport patches (#1023041, #1036845, #1006386?)
  - HWDB update
  - Some small new features: nspawn --drop-capability=, running PID 1 under
    valgrind, "yearly" and "annually" in calendar specifications
  - Some small documentation and logging updates


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 208-11
changelog:
  - Backport a few fixes, relevant documentation updates, and HWDB changes
    (#1051797, #1051768, #1047335, #1047304, #1047186, #1045849, #1043304,
     - Flip journalctl to --full by default (#984758)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 208-13
changelog:
  - A different fix for #1023820 taken from Mageia
  - Backported fix for #997031
  - Hardward database updates, man pages improvements, a few small memory
    leaks, utf-8 correctness and completion fixes
  - Support for key-slot option in crypttab


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 208-14
changelog:
  - Back out patch which causes user manager to be destroyed when unneeded
    and spams logs (#1053315)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 210-5
changelog:
  - Bugfixes: #1047568, #1047039, #1071128, #1073402
  - Bash completions for more systemd tools
  - Bluetooth database update
  - Manpage fixes


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 210-8
changelog:
  - Fix logind unpriviledged reboot issue and a few other minor fixes
  - Limit generator execution time
  - Recognize buttonless joystick types


author: Michal Sekletar <msekleta@redhat.com> - 213-2
changelog:
  - Create temporary files after installation (#1101983)
  - Add sysstat-collect.timer, sysstat-summary.timer to preset policy (#1101621)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 214-2
changelog:
  - Do not restart systemd-logind on upgrades (#1110697)
  - Add some patches (#1081429, #1054549, #1108568, #928962)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 215-2
changelog:
  - Move systemd-journal-remote to systemd-journal-gateway package (#1114688)
  - Disable /etc/mtab handling temporarily (#1116158)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 215-4
changelog:
  - Various man page updates
  - Static device node logic is conditionalized on CAP_SYS_MODULES instead of CAP_MKNOD
    for better behaviour in containers
  - Some small networkd link handling fixes
  - vconsole-setup runs setfont before loadkeys (https://bugs.freedesktop.org/show_bug.cgi?id=80685)
  - New systemd-escape tool
  - XZ compression settings are tweaked to greatly improve journald performance
  - "watch" is accepted as chassis type
  - Various sysusers fixes, most importantly correct selinux labels
  - systemd-timesyncd bug fix (https://bugs.freedesktop.org/show_bug.cgi?id=80932)
  - Shell completion improvements
  - New udev tag ID_SOFTWARE_RADIO can be used to instruct logind to allow user access
  - XEN and s390 virtualization is properly detected


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 215-5
changelog:
  - Fix SELinux context of /etc/passwd-, /etc/group-, /etc/.updated (#1121806)
  - Add missing BR so gnutls and elfutils are used


author: Michal Schmidt <mschmidt@redhat.com> - 216-5
changelog:
  - Use common CONFIGURE_OPTS for build2 and build3.
  - Configure timesyncd with NTP servers from Fedora/RHEL vendor zone.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 217-4
changelog:
  - Change libgudev1 to only require systemd-libs (#727499), there's
    no need to require full systemd stack.
  - Fixes for bugs #1159448, #1152220, #1158035.
  - Bash completions updates to allow propose more units for start/restart,
    and completions for set-default,get-default.
  - Again allow systemctl enable of instances.
  - Hardware database update and fixes.
  - Udev crash on invalid options and kernel commandline timeout parsing are fixed.
  - Add "embedded" chassis type.
  - Sync before 'reboot -f'.
  - Fix restarting of timer units.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 218-4
changelog:
  - Enable xkbcommon dependency to allow checking of keymaps
  - Fix permissions of /var/log/journal (#1048424)
  - Enable timedatex in presets (#1187072)
  - Disable rpcbind in presets (#1099595)


author: Lennart Poettering <lpoetter@redhat.com> - 219-1
changelog:
  - New upstream release
  - This removes the sysctl/bridge hack, a different solution needs to be found for this (see #634736)
  - This removes the /etc/resolv.conf hack, anaconda needs to fix their handling of /etc/resolv.conf as symlink
  - This enables "%check"
  - disable gold on arm, as that is broken (see #1193212)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 219-8
changelog:
  - Reworked device handling (#1195761)
  - ACL handling fixes (with a script in %post)
  - Various log messages downgraded (#1184712)
  - Allow PIE on s390 again (#1197721)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 219-10
changelog:
  - Fixes for bugs 1186018, 1195294, 1185604, 1196452.
  - Hardware database update.
  - Documentation fixes.
  - A fix for journalctl performance regression.
  - Fix detection of inability to open files in journalctl.
  - Detect SuperH architecture properly.
  - The first of duplicate lines in tmpfiles wins again.
  - Do vconsole setup after loading vconsole driver, not fbcon.
  - Fix problem where some units were restarted during systemd reexec.
  - Fix race in udevadm settle tripping up NetworkManager.
  - Downgrade various log messages.
  - Fix issue where journal-remote would process some messages with a delay.
  - GPT /srv partition autodiscovery is fixed.
  - Reconfigure old Finnish keymaps in post (#1151958)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 219-11
changelog:
  - Move all parts systemd-journal-{remote,upload} to
    systemd-journal-gatewayd subpackage (#1193143).
  - Create /var/lib/systemd/journal-upload directory (#1193145).
  - Cut out lots of stupid messages at debug level which were obscuring more
    important stuff.
  - Apply "tentative" state for devices only when they are added, not removed.
  - Ignore invalid swap pri= settings (#1204336)
  - Fix SELinux check for timedated operations to enable/disable ntp (#1014315)
  - Fix comparing of filesystem paths (#1184016)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 219-14
changelog:
  - Remove presets (#1221340)
  - Fix (potential) crash and memory leak in timedated, locking failure
    in systemd-nspawn, crash in resolved.
  - journalctl --list-boots should be faster
  - zsh completions are improved
  - various ommissions in docs are corrected (#1147651)
  - VARIANT and VARIANT_ID fields in os-release are documented
  - systemd-fsck-root.service is generated in the initramfs (#1201979, #1107818)
  - systemd-tmpfiles should behave better on read-only file systems (#1207083)


author: Lennart Poettering <lpoetter@redhat.com> - 220-1
changelog:
  - New upstream release
  - Drop /etc/mtab hack, as that's apparently fixed in mock now (#1116158)
  - Remove ghosting for %{_sysconfdir}/systemd/system/runlevel*.target, these targets are not configurable anymore in systemd upstream
  - Drop work-around for #1002806, since this is solved upstream now


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 220-4
changelog:
  - systemd-devel should require systemd-libs, not the main package (#1226301)
  - Check for botched translations (#1226566)
  - Make /etc/udev/hwdb.d part of the rpm (#1226379)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 220-8
changelog:
  - Remove gudev which is now provided as separate package (libgudev)
  - Fix for spurious selinux denials (#1224211)
  - Udev change events (#1225905)
  - Patches for some potential crashes
  - ProtectSystem=yes does not touch /home
  - Man page fixes, hwdb updates, shell completion updates
  - Restored persistent device symlinks for bcache, xen block devices
  - Tag all DRM cards as master-of-seat


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 227-7
changelog:
  - Rename journal-gateway subpackage to journal-remote
  - Ignore the access mode on /var/log/journal (#1048424)
  - Do not assume fstab is present (#1281606)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 228-4.gite35a787
changelog:
  - Update to latest upstream git: there is a bunch of fixes
    (nss-mymachines overflow bug, networkd fixes, more completions are
    properly installed), mixed with some new resolved features.
  - Rework file triggers so that they always run before daemons are restarted


author: Dennis Gilmore <dennis@ausil.us> - 229-2
changelog:
  - revert: fixed kernel-install for copying files for grubby
  Resolves: rhbz#1299019
  - this causes the dtb files to not get installed at all and the fdtdir
  - line in extlinux.conf to not get updated correctly


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 229-5
changelog:
  - Split out systemd-container subpackage (#1163412)
  - Split out system-udev subpackage
  - Add various bugfix patches, incl. a tentative fix for #1308771


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 229-7
changelog:
  - Moar patches (#1316964, #1317928)
  - Move vconsole-setup and tmpfiles-setup-dev bits to systemd-udev
  - Protect systemd-udev from deinstallation


author: Zbigniew Jędrzejewski-Szmek <zbyszek@bupkis> - 230-1
changelog:
  - New version
  - Drop compat-libs
  - Require libxkbcommon explictly, since the automatic dependency will
    not be generated anymore


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 230-3
changelog:
  - Update to latest git snapshot (fixes for systemctl set-default,
    polkit lingering policy, reversal of the framebuffer rules,
    unaligned access fixes, fix for StartupBlockIOWeight-over-dbus).
    Those changes are interspersed with other changes and new features
    (mostly in lldp, networkd, and nspawn). Some of those new features
    might not work, but I think that existing functionality should not
    be broken, so it seems worthwile to update to the snapshot.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 231-4
changelog:
  - Fix preset-all (#1363858)
  - Fix issue with daemon-reload messing up graphics (#1367766)
  - A few other bugfixes


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 231-9
changelog:
  - Fix systemctl set-default (#1374371)
  - Prevent systemd-udev-trigger.service from restarting (follow-up for #1378974)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 231-10
changelog:
  - Do not recreate /var/log/journal on upgrades (#1383066)
  - Move nss-myhostname provides to systemd-libs (#1383271)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 232-1
changelog:
  - Update to latest version (#998615, #1181922, #1374371, #1390704, #1384150, #1287161)
  - Add %{_isa} to Provides on arch-full packages (#1387912)
  - Create systemd-coredump user in %pre (#1309574)
  - Replace grubby patch with a short-circuiting install.d "plugin"
  - Enable nss-systemd in the passwd, group lines in nsswith.conf
  - Add [!UNAVAIL=return] fallback after nss-resolve in hosts line in nsswith.conf
  - Move systemd-nspawn man pages to the right subpackage (#1391703)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 232-2
changelog:
  - Fix kernel-install (#1391829)
  - Restore previous systemd-user PAM config (#1391836)
  - Move journal-upload.conf.5 from systemd main to journal-remote subpackage (#1391833)
  - Fix permissions on /var/lib/systemd/journal-upload (#1262665)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 232-9
changelog:
  - Add fake dependency on systemd-pam to systemd-devel to ensure systemd-pam
    is available as multilib (#1414153)


author: zbyszek <zbyszek@in.waw.pl> - 232-11
changelog:
  - Backport a number of patches (#1411299, #1413075, #1415745,
                                  - Fix various memleaks and unitialized variable access
  - Shell completion enhancements
  - Enable TPM logging by default (#1411156)
  - Update hwdb (#1270124)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 232-12
changelog:
  - Backport patch for initrd-switch-root.service getting killed (#1414904)
  - Fix sd-journal-gatewayd -D, --trust, and COREDUMP_CONTAINER_CMDLINE
    extraction by sd-coredump.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 233-1
changelog:
  - New upstream release (#1416201, #1405439, #1420753, many others)
  - New systemd-tests subpackage with "installed tests"


author: Michal Sekletar <msekleta@redhat.com> - 233-3
changelog:
  - Backport bugfixes from upstream
  - Don't return error when machinectl couldn't figure out container IP addresses (#1419501)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 233-4
changelog:
  - Backport a bunch of small fixes (memleaks, wrong format strings,
    man page clarifications, shell completion)
  - Fix systemd-resolved crash on crafted DNS packet (CVE-2017-9217, #1455493)
  - Fix systemd-vconsole-setup.service error on systems with no VGA console (#1272686)
  - Drop soft-static uid for systemd-journal-gateway
  - Use ID from /etc/os-release as ntpvendor


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 234-3
changelog:
  - Fix x-systemd.timeout=0 in /etc/fstab (#1462378)
  - Minor patches (memleaks, --help fixes, seccomp on arm64)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 236-2.git23e14c4
changelog:
  - Backport a bunch of bugfixes from upstream (#1531502, #1531381, #1526621
    various memory corruptions in systemd-networkd)
  - /dev/kvm is marked as a static node which fixes permissions on s390x
    and ppc64 (#1532382)


author: Zbigniew Jędrzejeweski-Szmek <zbyszek@in.waw.pl> - 237-1.git78bd769
changelog:
  - Update to first stable snapshot (various minor memory leaks and misaccesses,
    some documentation bugs, build fixes).


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 237-2.gitdff4849
changelog:
  - Backport a bunch of patches, most notably for the journal and various
    memory issues. Some minor build fixes.
  - Switch to new ldconfig macros that do nothing in F28+
  - /etc/systemd/dont-synthesize-nobody is created in %post if nfsnobody
    or nobody users are defined (#1537262)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 237-3.git84c8da5
changelog:
  - Update some patches for test skipping that were updated upstream
    before merging
  - Add /usr/lib/systemd/purge-nobody-user — a script to check if nobody is defined
    correctly and possibly replace existing mappings


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 238-1
changelog:
  - Update to latest version
  - This fixes a hard-to-trigger potential vulnerability (CVE-2018-6954)
  - New transfiletriggers are installed for udev hwdb and rules, the journal
    catalog, sysctl.d, binfmt.d, sysusers.d, tmpfiles.d.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 238-3
changelog:
  - Revert the patches for GRUB BootLoaderSpec support
  - Add patch for /etc/machine-id creation (#1552843)


author: Michal Sekletar <msekleta@redhat.com> - 238-4
changelog:
  - disable support for qrencode (#1566158)
  - bump default journal rate limit to 10000 messages per 30s (#1563729)
  - fix unit reloads (#1560549)
  - don't create /var/log/journal during package installation (#1523188)


author: Michal Sekletar <msekleta@redhat.com> - 238-6
changelog:
  - forwardport downstream-only udev rules from RHEL-7 (#1523227)
  - set RemoveIPC=no by default (#1523233)


author: Michal Sekletár <msekleta@redhat.com> - 239-1
changelog:
  - rebase to systemd-239
  - Override systemd-user PAM config in install and not prep (patch by Filipe Brandenburger <filbranden@google.com>)
  - use %autosetup -S git_am to apply patches
  - revert upstream default for RemoveIPC (#1523233)
  - bump DefaultTasksMax to 80% of kernel default (#1523236)
  - avoid /tmp being mounted as tmpfs without the user's will (#1578772)
  - bump maximum number of processes in user slice to 80% of pid.max (#1523236)
  - forwardport downstream-only udev rules from RHEL-7 (#1523227)
  - don't ship systemd-networkd
  - don't ship systemd-timesyncd
  - add back support for WAIT_FOR to udev rules (#1523213)


author: Michal Sekletár <msekleta@redhat.com> - 239-2
changelog:
  - 20-grubby.install: populate symvers.gz file (#1609698)
  - net_setup_link: allow renaming interfaces that were renamed already
  - units: drop DynamicUser=yes from systemd-resolved.service
  - journal: remove journal audit socket


author: Michal Sekletár <msekleta@redhat.com> - 239-4
changelog:
  - drop the patch for delayed loading of config in net_setup_link and set NAME in prefixdevname udev rules (#1614681)
  - bus: move BUS_DONT_DESTROY calls after asserts (#1610397)


author: Michal Sekletár <msekleta@redhat.com> - 239-7
changelog:
  - change default cgroup hierarchy to "legacy" (#1638650)
  - we never added mymachines module to passwd: or group: in RHEL8, hence don't try to remove it (#1638450)
  - bump minimal size of random pool to 1024 bytes (#1619268)
  - install RHEL-7 compatible rc.local (#1625209)
  - backport support for sector-size crypttab option (#1572563)
  - units: don't enable per-service IP firewall by default (#1630219)
  - sd-bus: unify three code-paths which free struct bus_container (#1635435)
  - bus-message: do not crash on message with a string of zero length (#1635439)
  - bus-message: stack based buffer overflow in free_and_strdup (#1635428)
  - journal: change support URL shown in the catalog entries (#1550548)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-9
changelog:
  - dissect-image: use right comparison function (#1602706)
  - login: avoid leak of name returned by uid_to_name() (#1602706)
  - firewall-util: add an assert that we're not overwriting a buffer (#1602706)
  - journal-file: avoid calling ftruncate with invalid fd (#1602706)
  - dhcp6: make sure we have enough space for the DHCP6 option header (#1643363)
  - core: rename queued_message → pending_reload_message (#1647359)
  - core: when we can't send the pending reload message, say we ignore it in the warning we log (#1647359)
  - core: make sure we don't throttle change signal generator when a reload is pending (#1647359)
  - proc-cmdline: introduce PROC_CMDLINE_RD_STRICT (#1643429)
  - debug-generator: introduce rd.* version of all options (#1643429)
  - chown-recursive: let's rework the recursive logic to use O_PATH (#1643368)
  - chown-recursive: also drop ACLs when recursively chown()ing (#1643368)
  - chown-recursive: TAKE_FD() is your friend (#1643368)
  - test: add test case for recursive chown()ing (#1643368)
  - Revert "sysctl.d: request ECN on both in and outgoing connections" (#1619790)
  - detect-virt: do not try to read all of /proc/cpuinfo (#1631532)
  - sd-bus: unify three code-paths which free struct bus_container (#1635435)
  - sd-bus: properly initialize containers (#1635435)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-10
changelog:
  - cryptsetup-generator: introduce basic keydev support (#1656869)
  - cryptsetup: don't use %m if there's no error to show (#1656869)
  - cryptsetup-generator: don't return error if target directory already exists (#1656869)
  - cryptsetup-generator: allow whitespace characters in keydev specification (#1656869)
  - rules: watch metadata changes on DASD devices (#1638676)
  - sysctl.d: switch net.ipv4.conf.all.rp_filter from 1 to 2 (#1653824)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-12
changelog:
  - core: when deserializing state always use read_line(…, LONG_LINE_MAX, …) (CVE-2018-15686)
  - coredump: remove duplicate MESSAGE= prefix from message (#1664976)
  - journald: remove unnecessary {} (#1664976)
  - journald: do not store the iovec entry for process commandline on stack (#1664976)
  - basic/process-util: limit command line lengths to _SC_ARG_MAX (#1664976)
  - coredump: fix message when we fail to save a journald coredump (#1664976)
  - procfs-util: expose functionality to query total memory (#1664976)
  - basic/prioq: add prioq_peek_item() (#1664976)
  - journal: limit the number of entries in the cache based on available memory (#1664976)
  - journald: periodically drop cache for all dead PIDs (#1664976)
  - process-util: don't use overly large buffer to store process command line (#1664976)
  - Revert "sysctl.d: switch net.ipv4.conf.all.rp_filter from 1 to 2" (#1653824)
  - journal: fix syslog_parse_identifier() (#1664978)
  - journald: set a limit on the number of fields (1k) (#1664977)
  - journald: when processing a native message, bail more quickly on overbig messages (#1664977)
  - journald: lower the maximum entry size limit to ½ for non-sealed fds (#1664977)
  - µhttpd: use a cleanup function to call MHD_destroy_response (#1664977)
  - journal-remote: verify entry length from header (#1664977)
  - journal-remote: set a limit on the number of fields in a message (#1664977)
  - journald: correctly attribute log messages also with cgroupsv1 (#1658115)
  - rules: add elevator= kernel command line parameter (#1670126)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-14
changelog:
  - rules: implement new memory hotplug policy (#1670728)
  - rules: add the rule that adds elevator= kernel command line parameter (#1670126)
  - bus-socket: Fix line_begins() to accept word matching full string (#1692991)
  - Refuse dbus message paths longer than BUS_PATH_SIZE_MAX limit. (#1678641)
  - Allocate temporary strings to hold dbus paths on the heap (#1678641)
  - sd-bus: if we receive an invalid dbus message, ignore and proceeed (#1678641)
  - Revert "core: one step back again, for nspawn we actually can't wait for cgroups running empty since systemd will get exactly zero notifications about it" (#1703485)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-15
changelog:
  - tree-wide: shorten error logging a bit (#1697893)
  - nspawn: simplify machine terminate bus call (#1697893)
  - nspawn: merge two variable declaration lines (#1697893)
  - nspawn: rework how we allocate/kill scopes (#1697893)
  - unit: enqueue cgroup empty check event if the last ref on a unit is dropped (#1697893)
  - Revert "journal: remove journal audit socket" (#1699287)
  - journal: don't enable systemd-journald-audit.socket by default (#1699287)
  - logs-show: use grey color for de-emphasizing journal log output (#1695601)
  - units: add [Install] section to tmp.mount (#1667065)
  - nss: do not modify errno when NSS_STATUS_NOTFOUND or NSS_STATUS_SUCCESS (#1691691)
  - util.h: add new UNPROTECT_ERRNO macro (#1691691)
  - nss: unportect errno before writing to NSS' *errnop (#1691691)
  - seccomp: reduce logging about failure to add syscall to seccomp (#1658691)
  - format-table: when duplicating a cell, also copy the color (#1689832)
  - format-table: optionally make specific cells clickable links (#1689832)
  - format-table: before outputting a color, check if colors are available (#1689832)
  - format-table: add option to store/format percent and uint64_t values in cells (#1689832)
  - format-table: optionally allow reversing the sort order for a column (#1689832)
  - format-table: add table_update() to update existing entries (#1689832)
  - format-table: add an API for getting the cell at a specific row/column (#1689832)
  - format-table: always underline header line (#1689832)
  - format-table: add calls to query the data in a specific cell (#1689832)
  - format-table: make sure we never call memcmp() with NULL parameters (#1689832)
  - format-table: use right field for display (#1689832)
  - format-table: add option to uppercase cells on display (#1689832)
  - format-table: never try to reuse cells that have color/url/uppercase set (#1689832)
  - locale-util: add logic to output smiley emojis at various happiness levels (#1689832)
  - analyze: add new security verb (#1689832)
  - tests: add a rudimentary fuzzer for server_process_syslog_message (#9979) (#1696224)
  - journald: make it clear that dev_kmsg_record modifies the string passed to it (#1696224)
  - journald: free the allocated memory before returning from dev_kmsg_record (#1696224)
  - tests: rework the code fuzzing journald (#1696224)
  - journald: make server_process_native_message compatible with fuzz_journald_processing_function (#1696224)
  - tests: add a fuzzer for server_process_native_message (#1696224)
  - tests: add a fuzzer for sd-ndisc (#1696224)
  - ndisc: fix two infinite loops (#1696224)
  - tests: add reproducers for several issues uncovered with fuzz-journald-syslog (#1696224)
  - tests: add a reproducer for an infinite loop in ndisc_handle_datagram (#1696224)
  - tests: add a reproducer for another infinite loop in ndisc_handle_datagram (#1696224)
  - fuzz: rename "fuzz-corpus" directory to just "fuzz" (#1696224)
  - test: add testcase for issue 10007 by oss-fuzz (#1696224)
  - fuzz: unify the "fuzz-regressions" directory with the main corpus (#1696224)
  - test-bus-marshal: use cescaping instead of hexmem (#1696224)
  - meson: add -Dlog-trace to set LOG_TRACE (#1696224)
  - meson: allow building resolved and machined without nss modules (#1696224)
  - meson: drop duplicated condition (#1696224)
  - meson: use .source_root() in more places (#1696224)
  - meson: treat all fuzz cases as unit tests (#1696224)
  - fuzz-bus-message: add fuzzer for message parsing (#1696224)
  - bus-message: use structured initialization to avoid use of unitialized memory (#1696224)
  - bus-message: avoid an infinite loop on empty structures (#1696224)
  - bus-message: let's always use -EBADMSG when the message is bad (#1696224)
  - bus-message: rename function for clarity (#1696224)
  - bus-message: use define (#1696224)
  - bus: do not print (null) if the message has unknown type (#1696224)
  - bus-message: fix calculation of offsets table (#1696224)
  - bus-message: remove duplicate assignment (#1696224)
  - bus-message: fix calculation of offsets table for arrays (#1696224)
  - bus-message: drop asserts in functions which are wrappers for varargs version (#1696224)
  - bus-message: output debug information about offset troubles (#1696224)
  - bus-message: fix skipping of array fields in !gvariant messages (#1696224)
  - bus-message: also properly copy struct signature when skipping (#1696224)
  - fuzz-bus-message: add two test cases that pass now (#1696224)
  - bus-message: return -EBADMSG not -EINVAL on invalid !gvariant messages (#1696224)
  - bus-message: avoid wrap-around when using length read from message (#1696224)
  - util: do not use stack frame for parsing arbitrary inputs (#1696224)
  - travis: enable ASan and UBSan on RHEL8 (#1683319)
  - tests: keep SYS_PTRACE when running under ASan (#1683319)
  - tree-wide: various ubsan zero size memory fixes (#1683319)
  - util: introduce memcmp_safe() (#1683319)
  - test-socket-util: avoid "memleak" reported by valgrind (#1683319)
  - sd-journal: escape binary data in match_make_string() (#1683319)
  - capability: introduce CAP_TO_MASK_CORRECTED() macro replacing CAP_TO_MASK() (#1683319)
  - sd-bus: use size_t when dealing with memory offsets (#1683319)
  - sd-bus: call cap_last_cap() only once in has_cap() (#1683319)
  - mount-point: honour AT_SYMLINK_FOLLOW correctly (#1683319)
  - travis: switch from trusty to xenial (#1683319)
  - test-socket-util: Add tests for receive_fd_iov() and friends. (#1683319)
  - socket-util: Introduce send_one_fd_iov() and receive_one_fd_iov() (#1683319)
  - core: swap order of "n_storage_fds" and "n_socket_fds" parameters (#1683334)
  - execute: use our usual syntax for defining bit masks (#1683334)
  - core: introduce new Type=exec service type (#1683334)
  - man: document the new Type=exec type (#1683334)
  - sd-bus: allow connecting to the pseudo-container ".host" (#1683334)
  - sd-login: let's also make sd-login understand ".host" (#1683334)
  - test: add test for Type=exec (#1683334)
  - journal-gateway: explicitly declare local variables (#1705971)
  - tools: drop unused variable (#1705971)
  - journal-gateway: use localStorage["cursor"] only when it has valid value (#1705971)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-16
changelog:
  - sd-bus: deal with cookie overruns (#1694999)
  - journal-remote: do not request Content-Length if Transfer-Encoding is chunked (#1708849)
  - journal: do not remove multiple spaces after identifier in syslog message (#1691817)
  - cryptsetup: Do not fallback to PLAIN mapping if LUKS data device set fails. (#1719153)
  - cryptsetup: call crypt_load() for LUKS only once (#1719153)
  - cryptsetup: Add LUKS2 token support. (#1719153)
  - udev/scsi_id: fix incorrect page length when get device identification VPD page (#1713227)
  - Change job mode of manager triggered restarts to JOB_REPLACE (#11456
  - bash-completion: analyze: support 'security' (#1733395)
  - man: note that journal does not validate syslog fields (#1707175)
  - rules: skip memory hotplug on ppc64 (#1713159)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-17
changelog:
  - mount: simplify /proc/self/mountinfo handler (#1696178)
  - mount: rescan /proc/self/mountinfo before processing waitid() results (#1696178)
  - swap: scan /proc/swaps before processing waitid() results (#1696178)
  - analyze-security: fix potential division by zero (#1734400)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-18
changelog:
  - shared/but-util: drop trusted annotation from bus_open_system_watch_bind_with_description() (#1746857)
  - sd-bus: adjust indentation of comments (#1746857)
  - resolved: do not run loop twice (#1746857)
  - resolved: allow access to Set*Link and Revert methods through polkit (#1746857)
  - resolved: query polkit only after parsing the data (#1746857)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-19
changelog:
  - core: never propagate reload failure to service result (#1735787)
  - man: document systemd-analyze security (#1750343)
  - man: reorder and add examples to systemd-analyze(1) (#1750343)
  - travis: move to CentOS 8 docker images (#1761519)
  - travis: drop SCL remains (#1761519)
  - syslog: fix segfault in syslog_parse_priority() (#1761519)
  - sd-bus: make strict asan shut up (#1761519)
  - travis: don't run slow tests under ASan/UBSan (#1761519)
  - kernel-install: do not require non-empty kernel cmdline (#1701454)
  - ask-password: prevent buffer overrow when reading from keyring (#1752050)
  - core: try to reopen /dev/kmsg again right after mounting /dev (#1749212)
  - buildsys: don't garbage collect sections while linking (#1748258)
  - udev: introduce CONST key name (#1762679)
  - Call getgroups() to know size of supplementary groups array to allocate (#1743230256 KB
  - Consider smb3 as remote filesystem (#1757257)
  - process-util: introduce pid_is_my_child() helper (#1744972)
  - core: reduce the number of stalled PIDs from the watched processes list when possible (#1744972)
  - core: only watch processes when it's really necessary (#1744972)
  - core: implement per unit journal rate limiting (#1719577)
  - path: stop watching path specs once we triggered the target unit (#1763161)
  - journald: fixed assertion failure when system journal rotation fails (#9893) (#1763619)
  - test: use PBKDF2 instead of Argon2 in cryptsetup... (#1761519)
  - test: mask several unnecessary services (#1761519)
  - test: bump the second partition's size to 50M (#1761519)
  - shared/sleep-config: exclude zram devices from hibernation candidates (#1763617)
  - selinux: don't log SELINUX_INFO and SELINUX_WARNING messages to audit (#1763612)
  - sd-device: introduce log_device_*() macros (#1753369)
  - udev: Add id program and rule for FIDO security tokens (#1753369)
  - shared/but-util: drop trusted annotation from bus_open_system_watch_bind_with_description() (#1746857)
  - sd-bus: adjust indentation of comments (#1746857)
  - resolved: do not run loop twice (#1746857)
  - resolved: allow access to Set*Link and Revert methods through polkit (#1746857)
  - resolved: query polkit only after parsing the data (#1746857)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-20
changelog:
  - journal: rely on _cleanup_free_ to free a temporary string used in client_context_read_cgroup (#1764560)
  - basic/user-util: allow dots in user names (#1717603)
  - sd-bus: bump message queue size again (#1770189)
  - tests: put fuzz_journald_processing_function in a .c file (#1764560)
  - tests: add a fuzzer for dev_kmsg_record (#1764560)
  - basic: remove an assertion from cunescape_one (#1764560)
  - journal: fix an off-by-one error in dev_kmsg_record (#1764560)
  - tests: add a reproducer for a memory leak fixed in 30eddcd51b8a472e05d3b8d1 in August (#1764560)
  - tests: add a reproducer for a heap-buffer-overflow fixed in 937b1171378bc1000a (#1764560)
  - test: initialize syslog_fd in fuzz-journald-kmsg too (#1764560)
  - tests: add a fuzzer for process_audit_string (#1764560)
  - journald: check whether sscanf has changed the value corresponding to %n (#1764560)
  - tests: introduce dummy_server_init and use it in all journald fuzzers (#1764560)
  - tests: add a fuzzer for journald streams (#1764560)
  - tests: add a fuzzer for server_process_native_file (#1764560)
  - fuzz-journal-stream: avoid assertion failure on samples which don't fit in pipe (#1764560)
  - journald: take leading spaces into account in syslog_parse_identifier (#1764560)
  - Add a warning about the difference in permissions between existing directories and unit settings. (#1778384)
  - execute: remove one redundant comparison check (#1778384)
  - core: change ownership/mode of the execution directories also for static users (#1778384)
  - core/dbus-execute: remove unnecessary initialization (#1734787)
  - shared/cpu-set-util: move the part to print cpu-set into a separate function (#1734787)
  - shared/cpu-set-util: remove now-unused CPU_SIZE_TO_NUM() (#1734787)
  - Rework cpu affinity parsing (#1734787)
  - Move cpus_in_affinity_mask() to cpu-set-util.[ch] (#1734787)
  - test-cpu-set-util: add simple test for cpus_in_affinity_mask() (#1734787)
  - test-cpu-set-util: add a smoke test for test_parse_cpu_set_extend() (#1734787)
  - pid1: parse CPUAffinity= in incremental fashion (#1734787)
  - pid1: don't reset setting from /proc/cmdline upon restart (#1734787)
  - pid1: when reloading configuration, forget old settings (#1734787)
  - test-execute: use CPUSet too (#1734787)
  - shared/cpu-set-util: drop now-unused cleanup function (#1734787)
  - shared/cpu-set-util: make transfer of cpu_set_t over bus endian safe (#1734787)
  - test-cpu-set-util: add test for dbus conversions (#1734787)
  - shared/cpu-set-util: introduce cpu_set_to_range() (#1734787)
  - systemctl: present CPUAffinity mask as a list of CPU index ranges (#1734787)
  - shared/cpu-set-util: only force range printing one time (#1734787)
  - execute: dump CPUAffinity as a range string instead of a list of CPUs (#1734787)
  - cpu-set-util: use %d-%d format in  cpu_set_to_range_string() only for actual ranges (#1734787)
  - core: introduce NUMAPolicy and NUMAMask options (#1734787)
  - core: disable CPUAccounting by default (#1734787)
  - set kptr_restrict=1 (#1689346)
  - cryptsetup: reduce the chance that we will be OOM killed (#1696602)
  - core, job: fix breakage of ordering dependencies by systemctl reload command (#1766417)
  - debug-generator: enable custom systemd.debug_shell tty (#1723722)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-21
changelog:
  - test-cpu-set-util: fix comparison for allocation size (#1734787)
  - test-cpu-set-util: fix allocation size check on i386 (#1734787)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-23
changelog:
  - catalog: fix name of variable (#1677768)
  - cryptsetup: add keyfile-timeout to allow a keydev timeout and allow to fallback to a password if it fails. (#1763155)
  - cryptsetup: add documentation for keyfile-timeout (#1763155)
  - cryptsetup: use unabbrieviated variable names (#1763155)
  - cryptsetup: don't assert on variable which is optional (#1763155)
  - cryptsetup-generator: guess whether the keyfile argument is two items or one (#1763155)
  - crypt-util: Translate libcryptsetup log level instead of using log_debug() (#1776408)
  - cryptsetup: add some commenting about EAGAIN generation (#1776408)
  - cryptsetup: downgrade a log message we ignore (#1776408)
  - cryptsetup: rework how we log about activation failures (#1776408)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-24
changelog:
  - rules: reintroduce 60-alias-kmsg.rules (#1739353)
  - sd-bus: make rqueue/wqueue sizes of type size_t (CVE-2020-1712)
  - sd-bus: reorder bus ref and bus message ref handling (CVE-2020-1712)
  - sd-bus: make sure dispatch_rqueue() initializes return parameter on all types of success (CVE-2020-1712)
  - sd-bus: drop two inappropriate empty lines (CVE-2020-1712)
  - sd-bus: initialize mutex after we allocated the wqueue (CVE-2020-1712)
  - sd-bus: always go through sd_bus_unref() to free messages (CVE-2020-1712)
  - bus-message: introduce two kinds of references to bus messages (CVE-2020-1712)
  - sd-bus: introduce API for re-enqueuing incoming messages (CVE-2020-1712)
  - sd-event: add sd_event_source_disable_unref() helper (CVE-2020-1712)
  - polkit: when authorizing via PK let's re-resolve callback/userdata instead of caching it (CVE-2020-1712)
  - sysctl: let's by default increase the numeric PID range from 2^16 to 2^22 (#1744214)
  - journal: do not trigger assertion when journal_file_close() get NULL (#1788085)
  - journal: use cleanup attribute at one more place (#1788085)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-25
changelog:
  - sd-bus: use "queue" message references for managing r/w message queues in connection objects (CVE-2020-1712)
  - pid1: make sure to restore correct default values for some rlimits (#1789930)
  - main: introduce a define HIGH_RLIMIT_MEMLOCK similar to HIGH_RLIMIT_NOFILE (#1789930)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-26
changelog:
  - seccomp: introduce seccomp_restrict_suid_sgid() for blocking chmod() for suid/sgid files (#1687512)
  - test: add test case for restrict_suid_sgid() (#1687512)
  - core: expose SUID/SGID restriction as new unit setting RestrictSUIDSGID= (#1687512)
  - analyze: check for RestrictSUIDSGID= in "systemd-analyze security" (#1687512)
  - man: document the new RestrictSUIDSGID= setting (#1687512)
  - units: turn on RestrictSUIDSGID= in most of our long-running daemons (#1687512)
  - core: imply NNP and SUID/SGID restriction for DynamicUser=yes service (#1687512)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-32
changelog:
  - pid1: fix DefaultTasksMax initialization (#1809037)
  - cgroup: make sure that cpuset is supported on cgroup v2 and disabled with v1 (#1808940)
  - test: introduce TEST-36-NUMAPOLICY (#1808940)
  - test: replace `tail -f` with journal cursor which should be... (#1808940)
  - test: support MPOL_LOCAL matching in unpatched strace versions (#1808940)
  - test: make sure the strace process is indeed dead (#1808940)
  - test: skip the test on systems without NUMA support (#1808940)
  - test: give strace some time to initialize (#1808940)
  - test: add a simple sanity check for systems without NUMA support (#1808940)
  - test: drop the missed || exit 1 expression (#1808940)
  - test: replace cursor file with a plain cursor (#1808940)
  - cryptsetup: Treat key file errors as a failed password attempt (#1763155)
  - swap: finish the secondary swap units' jobs if deactivation of the primary swap unit fails (#1749622)
  - resolved: Recover missing PrivateTmp=yes and ProtectSystem=strict (#1810869)
  - bus_open leak sd_event_source when udevadm trigger。 (#1798504)
  - core: rework StopWhenUnneeded= logic (#1798046)
  - pid1: fix the names of AllowedCPUs= and AllowedMemoryNodes= (#1818054)
  - core: fix re-realization of cgroup siblings (#1818054)
  - basic: use comma as separator in cpuset cgroup cpu ranges (#1818054)
  - core: transition to FINAL_SIGTERM state after ExecStopPost= (#1766479)
  - sd-journal: close journal files that were deleted by journald before we've setup inotify watch (#1796128)
  - sd-journal: remove the dead code and actually fix #14695 (#1796128)
  - udev: downgrade message when we fail to set inotify watch up (#1808051)
  - logind: check PolicyKit before allowing VT switch (#1797679)
  - test: do not use global variable to pass error (#1823767)
  - test: install libraries required by tests (#1823767)
  - test: introduce install_zoneinfo() (#1823767)
  - test: replace duplicated Makefile by symbolic link (#1823767)
  - test: add paths of keymaps in install_keymaps() (#1823767)
  - test: make install_keymaps() optionally install more keymaps (#1823767)
  - test-fs-util: skip some tests when running in unprivileged container (#1823767)
  - test-process-util: skip several verifications when running in unprivileged container (#1823767)
  - test-execute: also check python3 is installed or not (#1823767)
  - test-execute: skip several tests when running in container (#1823767)
  - test: introduce test_is_running_from_builddir() (#1823767)
  - test: make test-catalog relocatable (#1823767)
  - test: parallelize tasks in TEST-24-UNIT-TESTS (#1823767)
  - test: try to determine QEMU_SMP dynamically (#1823767)
  - test: store coredumps in journal (#1823767)
  - pid1: add new kernel cmdline arg systemd.cpu_affinity= (#1812894)
  - udev-rules: make tape-changers also apprear in /dev/tape/by-path/ (#1820112)
  - man: be clearer that .timer time expressions need to be reset to override them (#1816908)
  - Add support for opening files for appending (#1809175)
  - nspawn: move payload to sub-cgroup first, then sync cgroup trees (#1837094)
  - core: move unit_status_emit_starting_stopping_reloading() and related calls to job.c (#1737283)
  - job: when a job was skipped due to a failed condition, log about it (#1737283)
  - core: split out all logic that updates a Job on a unit's unit_notify() invocation (#1737283)
  - core: make log messages about units entering a 'failed' state recognizable (#1737283)
  - core: log a recognizable message when a unit succeeds, too (#1737283)
  - tests: always use the right vtable wrapper calls (#1737283)
  - test-execute: allow filtering test cases by pattern (#1737283)
  - test-execute: provide custom failure message (#1737283)
  - core: ExecCondition= for services (#1737283)
  - Drop support for lz4 < 1.3.0 (#1843871)
  - test-compress: add test for short decompress_startswith calls (#1843871)
  - journal: adapt for new improved LZ4_decompress_safe_partial() (#1843871)
  - fuzz-compress: add fuzzer for compression and decompression (#1843871)
  - seccomp: fix __NR__sysctl usage (#1843871)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-33
changelog:
  - tmpfiles: fix crash with NULL in arg_root and other fixes and tests (#1836024)
  - sulogin-shell: Use force if SYSTEMD_SULOGIN_FORCE set (#1625929)
  - resolvconf: fixes for the compatibility interface (#1835594)
  - mount: don't add Requires for tmp.mount (#1748840)
  - core: coldplug possible nop_job (#1829798)
  - core: add IODeviceLatencyTargetSec (#1831519)
  - time-util: Introduce parse_sec_def_infinity (#1770379)
  - cgroup: use structured initialization (#1770379)
  - core: add CPUQuotaPeriodSec= (#1770379)
  - core: downgrade CPUQuotaPeriodSec= clamping logs to debug (#1770379)
  - sd-bus: avoid magic number in SASL length calculation (#1838081)
  - sd-bus: fix SASL reply to empty AUTH (#1838081)
  - sd-bus: skip sending formatted UIDs via SASL (#1838081)
  - core: add MemoryMin (#1763435)
  - core: introduce cgroup_add_device_allow() (#1763435)
  - test: remove support for suffix in get_testdata_dir() (#1763435)
  - cgroup: Implement default propagation of MemoryLow with DefaultMemoryLow (#1763435)
  - cgroup: Create UNIT_DEFINE_ANCESTOR_MEMORY_LOOKUP (#1763435)
  - unit: Add DefaultMemoryMin (#1763435)
  - cgroup: Polish hierarchically aware protection docs a bit (#1763435)
  - cgroup: Readd some plumbing for DefaultMemoryMin (#1763435)
  - cgroup: Support 0-value for memory protection directives (#1763435)
  - cgroup: Test that it's possible to set memory protection to 0 again (#1763435)
  - cgroup: Check ancestor memory min for unified memory config (#1763435)
  - cgroup: Respect DefaultMemoryMin when setting memory.min (#1763435)
  - cgroup: Mark memory protections as explicitly set in transient units (#1763435)
  - meson: allow setting the version string during configuration (#1804252)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-36
changelog:
  - core: don't consider SERVICE_SKIP_CONDITION for abnormal or failure restarts (#1737283)
  - selinux: do preprocessor check only in selinux-access.c (#1830861)
  - basic/cgroup-util: introduce cg_get_keyed_attribute_full() (#1830861)
  - shared: add generic logic for waiting for a unit to enter some state (#1830861)
  - shared: fix assert call (#1830861)
  - shared: Don't try calling NULL callback in bus_wait_for_units_clear (#1830861)
  - shared: add NULL callback check in one more place (#1830861)
  - core: introduce support for cgroup freezer (#1830861)
  - core/cgroup: fix return value of unit_cgorup_freezer_action() (#1830861)
  - core: fix the return value in order to make sure we don't dipatch method return too early (#1830861)
  - test: add test for cgroup v2 freezer support (#1830861)
  - fix mis-merge (#1848421)
  - tests: sleep a bit and give kernel time to perform the action after manual freeze/thaw (#1848421)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-39
changelog:
  - device: make sure we emit PropertiesChanged signal once we set sysfs (#1793533)
  - device: don't emit PropetiesChanged needlessly (#1793533)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-40
changelog:
  - units: add generic boot-complete.target (#1872243)
  - man: document new "boot-complete.target" unit (#1872243)
  - core: make sure to restore the control command id, too (#1829867)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-42
changelog:
  - logind: don't print warning when user@.service template is masked (#1880270)
  - build: use simple project version in pkgconfig files (#1862714)
  - basic/virt: try the /proc/1/sched hack also for PID1 (#1868877)
  - seccomp: rework how the S[UG]ID filter is installed (#1860374)
  - vconsole-setup: downgrade log message when setting font fails on dummy console (#1889996)
  - units: fix systemd.special man page reference in system-update-cleanup.service (#1871827)
  - units: drop reference to sushell man page (#1871827)
  - sd-bus: break the loop in bus_ensure_running() if the bus is not connecting (#1885553)
  - core: add new API for enqueing a job with returning the transaction data (#846319)
  - systemctl: replace switch statement by table of structures (#846319)
  - systemctl: reindent table (#846319)
  - systemctl: Only wait when there's something to wait for. (#846319)
  - systemctl: clean up start_unit_one() error handling (#846319)
  - systemctl: split out extra args generation into helper function of its own (#846319)
  - systemctl: add new --show-transaction switch (#846319)
  - test: add some basic testing that "systemctl start -T" does something (#846319)
  - man: document the new systemctl --show-transaction option (#846319)
  - socket: New option 'FlushPending' (boolean) to flush socket before entering listening state (#1870638)
  - core: remove support for API bus "started outside our own logic" (#1764282)
  - mount-setup: fix segfault in mount_cgroup_controllers when using gcc9 compiler (#1868877)
  - dbus-execute: make transfer of CPUAffinity endian safe (#12711) (#1740657)
  - core: add support for setting CPUAffinity= to special "numa" value (#1740657)
  - basic/user-util: always use base 10 for user/group numbers (#1848373)
  - parse-util: sometimes it is useful to check if a string is a valid integer, but not actually parse it (#1848373)
  - basic/parse-util: add safe_atoux64() (#1848373)
  - parse-util: allow tweaking how to parse integers (#1848373)
  - parse-util: allow '-0' as alternative to '0' and '+0' (#1848373)
  - parse-util: make return parameter optional in safe_atou16_full() (#1848373)
  - parse-util: rewrite parse_mode() on top of safe_atou_full() (#1848373)
  - user-util: be stricter in parse_uid() (#1848373)
  - strv: add new macro STARTSWITH_SET() (#1848373)
  - parse-util: also parse integers prefixed with 0b and 0o (#1848373)
  - tests: beef up integer parsing tests (#1848373)
  - shared/user-util: add compat forms of user name checking functions (#1848373)
  - shared/user-util: emit a warning on names with dots (#1848373)
  - user-util: Allow names starting with a digit (#1848373)
  - shared/user-util: allow usernames with dots in specific fields (#1848373)
  - user-util: switch order of checks in valid_user_group_name_or_id_full() (#1848373)
  - user-util: rework how we validate user names (#1848373)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-43
changelog:
  - man: mention System Administrator's Guide in systemctl manpage (#1623116)
  - udev: introduce udev net_id "naming schemes" (#1827462)
  - meson: make net.naming-scheme= default configurable (#1827462)
  - man: describe naming schemes in a new man page (#1827462)
  - udev/net_id: parse _SUN ACPI index as a signed integer (#1827462)
  - udev/net_id: don't generate slot based names if multiple devices might claim the same slot (#1827462)
  - fix typo in ProtectSystem= option (#1871139)
  - remove references of non-existent man pages (#1876807)
  - log: Prefer logging to CLI unless JOURNAL_STREAM is set (#1865840)
  - locale-util: add new helper locale_is_installed() (#1755287)
  - test: add test case for locale_is_installed() (#1755287)
  - tree-wide: port various bits over to locale_is_installed() (#1755287)
  - install: allow instantiated units to be enabled via presets (#1812972)
  - install: small refactor to combine two function calls into one function (#1812972)
  - test: fix a memleak (#1812972)
  - docs: Add syntax for templated units to systemd.preset man page (#1812972)
  - shared/install: fix preset operations for non-service instantiated units (#1812972)
  - introduce setsockopt_int() helper (#1887181)
  - socket-util: add generic socket_pass_pktinfo() helper (#1887181)
  - core: add new PassPacketInfo= socket unit property (#1887181)
  - resolved: tweak cmsg calculation (#1887181)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-44
changelog:
  - ci: PowerTools repo was renamed to powertools in RHEL 8.3 (#1871827)
  - ci: use quay.io instead of Docker Hub to avoid rate limits (#1871827)
  - ci: move jobs from Travis CI to GH Actions (#1871827)
  - unit: make UNIT() cast function deal with NULL pointers (#1871827)
  - use link to RHEL-8 docs (#1623116)
  - cgroup: Also set blkio.bfq.weight (#1657810)
  - units: make sure initrd-cleanup.service terminates before switching to rootfs (#1657810)
  - core: reload SELinux label cache on daemon-reload (#1888912)
  - selinux: introduce mac_selinux_create_file_prepare_at() (#1888912)
  - selinux: add trigger for policy reload to refresh internal selabel cache (#1888912)
  - udev/net_id: give RHEL-8.4 naming scheme a name (#1827462)
  - basic/stat-util: make mtime check stricter and use entire timestamp (#1642728)
  - udev: make algorithm that selects highest priority devlink less susceptible to race conditions (#1642728)
  - test: create /dev/null in test-udev.pl (#1642728)
  - test: missing "die" (#1642728)
  - udev-test: remove a check for whether the test is run in a container (#1642728)
  - udev-test: skip the test only if it can't setup its environment (#1642728)
  - udev-test: fix test skip condition (#1642728)
  - udev-test: fix missing directory test/run (#1642728)
  - udev-test: check if permitted to create block device nodes (#1642728)
  - test-udev: add a testcase of too long line (#1642728)
  - test-udev: use proper semantics for too long line with continuation (#1642728)
  - test-udev: add more tests for line continuations and comments (#1642728)
  - test-udev: add more tests for line continuation (#1642728)
  - test-udev: fix alignment and drop unnecessary white spaces (#1642728)
  - test/udev-test.pl: cleanup if skipping test (#1642728)
  - test: add test cases for empty string match (#1642728)
  - test: add test case for multi matches when use "||" (#1642728)
  - udev-test: do not rely on "mail" group being defined (#1642728)
  - test/udev-test.pl: allow multiple devices per test (#1642728)
  - test/udev-test.pl: create rules only once (#1642728)
  - test/udev-test.pl: allow concurrent additions and removals (#1642728)
  - test/udev-test.pl: use computed devnode name (#1642728)
  - test/udev-test.pl: test correctness of symlink targets (#1642728)
  - test/udev-test.pl: allow checking multiple symlinks (#1642728)
  - test/udev-test.pl: fix wrong test descriptions (#1642728)
  - test/udev-test.pl: last_rule is unsupported (#1642728)
  - test/udev-test.pl: Make some tests a little harder (#1642728)
  - test/udev-test.pl: remove bogus rules from magic subsys test (#1642728)
  - test/udev-test.pl: merge "space and var with space" tests (#1642728)
  - test/udev-test.pl: merge import parent tests into one (#1642728)
  - test/udev-test.pl: count "good" results (#1642728)
  - tests/udev-test.pl: add multiple device test (#1642728)
  - test/udev-test.pl: add repeat count (#1642728)
  - test/udev-test.pl: generator for large list of block devices (#1642728)
  - test/udev-test.pl: suppress umount error message at startup (#1642728)
  - test/udev_test.pl: add "expected good" count (#1642728)
  - test/udev-test: gracefully exit when imports fail (#1642728)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-45
changelog:
  - Revert "test: add test cases for empty string match" and "test: add test case for multi matches when use ||" (#1935124)
  - test/sys-script.py: add missing DEVNAME entries to uevents (#1935124)
  - sd-event: split out helper functions for reshuffling prioqs (#1937315)
  - sd-event: split out enable and disable codepaths from sd_event_source_set_enabled() (#1937315)
  - sd-event: mention that two debug logged events are ignored (#1937315)
  - sd-event: split clock data allocation out of sd_event_add_time() (#1937315)
  - sd-event: split out code to add/remove timer event sources to earliest/latest prioq (#1937315)
  - sd-event: fix delays assert brain-o (#17790) (#1937315)
  - sd-event: let's suffix last_run/last_log with "_usec" (#1937315)
  - sd-event: refuse running default event loops in any other thread than the one they are default for (#1937315)
  - sd-event: ref event loop while in sd_event_prepare() ot sd_event_run() (#1937315)
  - sd-event: follow coding style with naming return parameter (#1937315)
  - sd-event: remove earliest_index/latest_index into common part of event source objects (#1937315)
  - sd-event: update state at the end in event_source_enable (#1937315)
  - sd-event: increase n_enabled_child_sources just once (#1937315)
  - sd-event: add ability to ratelimit event sources (#1937315)
  - test: add ratelimiting test (#1937315)
  - core: prevent excessive /proc/self/mountinfo parsing (#1937315)
  - udev: run link_update() with increased retry count in second invocation (#1935124)
  - pam-systemd: use secure_getenv() rather than getenv() (#1936866)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-46
changelog:
  - Revert "udev: run link_update() with increased retry count in second invocation" (#1942299)
  - Revert "udev: make algorithm that selects highest priority devlink less susceptible to race conditions" (#1942299)
  - test/udev-test.pl: drop test cases that add mutliple devices (#1942299)


author: Jan Macku <jamacku@redhat.com> - 239-47
changelog:
  - systemd-binfmt: Add safeguard in triggers (#1787144)
  - spec: Requires(post) openssl-libs to fix missing /etc/machine-id (#1947438)
  - spec: Go back to using systemctl preset-all in post (#1783263, #1647172, #1118740)
  - spec: Disable libiptc support (#1817265)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-48
changelog:
  - cgroup: Also set io.bfq.weight (#1927290)
  - seccomp: allow turning off of seccomp filtering via env var (#1916835)
  - meson: remove strange dep that causes meson to enter infinite loop (#1970860)
  - copy: handle copy_file_range() weirdness on procfs/sysfs (#1970860)
  - core: Hide "Deactivated successfully" message (#1954802)
  - util: rework in_initrd() to make use of path_is_temporary_fs() (#1959339)
  - initrd: extend SYSTEMD_IN_INITRD to accept non-ramfs rootfs (#1959339)
  - initrd: do a debug log if failed to detect rootfs type (#1959339)
  - initrd: do a debug log if /etc/initrd-release doesn't take effect (#1959339)
  - units: assign user-runtime-dir@.service to user-%i.slice (#1946453)
  - units: order user-runtime-dir@.service after systemd-user-sessions.service (#1946453)
  - units: make sure user-runtime-dir@.service is Type=oneshot (#1946453)
  - user-runtime-dir: downgrade a few log messages to LOG_DEBUG that we ignore (#1946453)
  - shared/install: Preserve escape characters for escaped unit names (#1952686)
  - basic/virt: Detect PowerVM hypervisor (#1937989)
  - man: document differences in clean exit status for Type=oneshot (#1940078)
  - busctl: add a timestamp to the output of the busctl monitor command (#1909214)
  - basic/cap-list: parse/print numerical capabilities (#1946943)
  - shared/mount-util: convert to libmount (#1885143)
  - mount-util: bind_remount: avoid calling statvfs (#1885143)
  - mount-util: use UMOUNT_NOFOLLOW in recursive umounter (#1885143)
  - test-install-root: create referenced targets (#1835351)
  - install: warn if WantedBy targets don't exist (#1835351)
  - test-install-root: add test for unknown WantedBy= target (#1835351)
  - ceph is a network filesystem (#1952013)
  - sysctl: set kernel.core_pipe_limit=16 (#1949729)
  - core: don't drop timer expired but not yet processed when system date is changed (#1899402)
  - core: Detect initial timer state from serialized data (#1899402)
  - rc-local: order after network-online.target (#1934028)
  - set core ulimit to 0 like on RHEL-7 (#1905582)
  - test-mountpointutil-util: do not assert in test_mnt_id() (#1910425)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-49
changelog:
  - remove a left-over break (#1970860)
  - basic/unit-name: do not use strdupa() on a path (#1974700)
  - sd-event: change ordering of pending/ratelimited events (#1968528)
  - sd-event: drop unnecessary "else" (#1968528)
  - sd-event: use CMP() macro (#1968528)
  - sd-event: use usec_add() (#1968528)
  - sd-event: make event_source_time_prioq_reshuffle() accept all event source type (#1968528)
  - sd-event: always reshuffle time prioq on changing online/offline state (#1968528)
  - ci: run unit tests on z-stream branches as well (#1970860)
  - ci: drop forgotten Travis references (#1934504)
  - ci: run unit tests on CentOS 8 Stream as well (#1934504)
  - ci: add missing test dependencies (#1934504)
  - meson: bump timeout for test-udev to 180s (#1934504)


