# changelog

author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-169
changelog:
  - Allow openvswitch domain capability sys_rawio.
  - Revert "Allow NetworkManager create dhcpc pid files. BZ(1229755)"
  - Allow openvswitch to manage hugetlfs files and dirs.
  - Allow NetworkManager create dhcpc pid files. BZ(1229755)
  - Allow apcupsd to read kernel network state. BZ(1282003)
  - Label /sys/kernel/debug/tracing filesystem
  - Add fs_manage_hugetlbfs_files() interface.
  - Add sysnet_filetrans_dhcpc_pid() interface.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-170
changelog:
  - Allow abrt_dump_oops_t to getattr filesystem nsfs files. rhbz#1300334
  - Allow ulogd_t to create netlink_netfilter sockets. rhbz#1305426
  - Create new type fwupd_cert_t Label /etc/pki/(fwupd|fwupd-metadata) dirs as fwupd_cert_t Allow fwupd_t domain to read fwupd_cert_t files|lnk_files rhbz#1303533
  - Add interface to dontaudit leaked files from firewalld
  - fwupd needs to dbus chat with policykit
  - Allow fwupd domain transition to gpg domain. Fwupd signing firmware updates by gpg. rhbz#1303531
  - Allow abrt_dump_oops_t to check permissions for a /usr/bin/Xorg. rhbz#1284967
  - Allow prelink_cron_system_t domain set resource limits. BZ(1190364)
  - Allow pppd_t domain to create sockfiles in /var/run labeled as pppd_var_run_t label. BZ(1302666)
  - Fix wrong name for openqa_websockets tcp port.
  - Allow run sshd-keygen on second boot if first boot fails after some reason and content is not syncedon the disk. These changes are reflecting this commit in sshd. http://pkgs.fedoraproject.org/cgit/rpms/openssh.git/commit/?id=af94f46861844cbd6ba4162115039bebcc8f78ba rhbz#1299106
  - Add interface ssh_getattr_server_keys() interface. rhbz#1299106
  - Added Label openqa for tcp port (9526) Added Label openqa-websockets for tcp port (9527) rhbz#1277312
  - Add interface fs_getattr_nsfs_files()
  - Add interface xserver_exec().
  - Revert "Allow all domains some process flags."BZ(1190364)


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-172
changelog:
  - Fix macro name from snmp_manage_snmp_var_lib_files to snmp_manage_var_lib_files in cupsd policy.
  - Allow hplip driver to write to its MIB index files stored in the /var/lib/net-snmp/mib_indexes. Resolves: rhbz#1291033
  - Allow collectd setgid capability Resolves:#1310896
  - Allow adcli running as sssd_t to write krb5.keytab file.
  - Allow abrt-hook-ccpp to getattr on all executables. BZ(1284304)
  - Allow kexec to read kernel module files in /usr/lib/modules.
  - Add httpd_log_t for /var/log/graphite-web rhbz#1306981
  - Remove redudant rules and fix _admin interface.
  - Add SELinux policy for LTTng 2.x central tracing registry session daemon.
  - Allow create mongodb unix dgram sockets. rhbz#1306819
  - Support for InnoDB Tablespace Encryption.
  - Dontaudit leaded file descriptors from firewalld
  - Add port for rkt services
  - Add support for the default lttng-sessiond port - tcp/5345.  This port is used by LTTng 2.x central tracing registry session daemon.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-173
changelog:
  - Allow amanda to manipulate the tape changer to load the necessary tapes. rhbz#1311759
  - Allow keepalived to create netlink generic sockets. rhbz#1311756
  - Allow modemmanager to read /etc/passwd file.
  - Label all files named /var/run/.*nologin.* as systemd_logind_var_run_t.
  - Add filename transition to interface systemd_filetrans_named_content() that domain will create rfkill dir labeled as systemd_rfkill_var_lib_t instead of init_var_lib_t. rhbz #1290255
  - Allow systemd-logind to create .#nologinXXXXXX labeled as systemd_logind_var_run_t in /var/run/systemd/ rhbz#1285019
  - Allow systemd_networkd_t to write kmsg, when kernel was started with following params: systemd.debug systemd.log_level=debug systemd.log_target=kmsg rhbz#1311444
  - Allow ipsec to read home certs, when connecting to VPN. rhbz#1301319


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-174
changelog:
  - Revert "Allow systemd-logind to create .#nologinXXXXXX labeled as systemd_logind_var_run_t in /var/run/systemd/ rhbz#1285019"
  - Allow systemd-logind to create .#nologinXXXXXX labeled as systemd_logind_var_run_t in /var/run/ rhbz#1285019


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-175
changelog:
  - Fix new rkt policy (Remove some redundant rules, Fix cosmetic issues in interface file)
  - Add policy for rkt services


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-176
changelog:
  - Add new boolean tmpreaper_use_cifs() to allow tmpreaper to run on local directories being shared with Samba.
  - Merge pull request #105 from rhatdan/NO_NEW_PRIV
  - Fix new rkt policy
  - Remove some redundant rules.
  - Fix cosmetic issues in interface file.
  - Merge pull request #100 from rhatdan/rawhide-contrib
  - Add interface fs_setattr_cifs_dirs().
  - Merge pull request #106 from rhatdan/NO_NEW_PRIV_BASE
  - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
  -Build file_contexts.bin file_context.local.bin file_context.homedir.bin during build phase.
   This fix issue in Fedora live images when selinux-policy-targeted is not installed but just unpackaged, since there's no .bin files,
   file_contexts is parsed in selabel_open().
  Resolves: rhbz#1314372


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-177
changelog:
  - Allow spice-vdagent to getattr on tmpfs_t filesystems Resolves: rhbz#1276251
  - Allow sending dbus msgs between firewalld and system_cronjob domains.
  - Allow zabbix-agentd to connect to following tcp sockets. One of zabbix-agentd functions is get service status of ftp,http,innd,pop,smtp protocols. rhbz#1315354
  - Allow snapperd mounton permissions for snapperd_data_t. BZ(#1314972)
  - Add support for systemd-gpt-auto-generator. rhbz#1314968
  - Add interface dev_read_nvme() to allow reading Non-Volatile Memory Host Controller devices.
  - Add support for systemd-hwdb daemon. rhbz#1306243


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-178
changelog:
  - Label tcp port 5355 as llmnr-> Link-Local Multicast Name Resolution
  - Add support systemd-resolved.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-179
changelog:
  - Add filename transition that /etc/princap will be created with cupsd_rw_etc_t label in cups_filetrans_named_content() interface.
  - Revert "Add filename transition that /etc/princap will be created with cupsd_rw_etc_t label in cups_filetrans_named_content."
  - Add filename transition that /etc/princap will be created with cupsd_rw_etc_t label in cups_filetrans_named_content.
  - Allow pcp_pmie and pcp_pmlogger to read all domains state.
  - Make fwupd domain unconfined. We need to discuss solution related to using gpg. rhbz#1316717
  - Merge pull request #108 from rhatdan/rkt
  - Merge pull request #109 from rhatdan/virt_sandbox
  - Add new interface to define virt_sandbox_network domains
  - Label /etc/redis-sentinel.conf as redis_conf_t. Allow redis_t write to redis_conf_t. Allow redis_t to connect on redis tcp port.
  - Fix typo in drbd policy
  - Remove declaration of empty booleans in virt policy.
  - Add new drbd file type: drbd_var_run_t. Allow drbd_t to manage drbd_var_run_t files/dirs.
  - Label /etc/ctdb/events.d/* as ctdb_exec_t. Allow ctdbd_t to setattr on ctdbd_exec_t files.
  - Additional rules to make rkt work in enforcing mode
  - Allow to log out to gdm after screen was resized in session via vdagent. Resolves: rhbz#1249020
  - Allow ipsec to use pam. rhbz#1317988
  - Allow systemd-gpt-generator to read fixed_disk_device_t. rhbz#1314968
  - Allow setrans daemon to read /proc/meminfo.
  - Merge pull request #107 from rhatdan/rkt-base
  - Allow systemd_notify_t to write to kmsg_device_t when 'systemd.log_target=kmsg' option is used.
  - Remove bin_t label for /etc/ctdb/events.d/. We need to label this scripts as ctdb_exec_t.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-180
changelog:
  - Allow dovecot_auth_t domain to manage also dovecot_var_run_t fifo files. BZ(1320415)
  - Allow colord to read /etc/udev/hwdb.bin. rhzb#1316514
  - sandboxX.te: Allow sandbox domain to have entrypoint access only for executables and mountpoints.
  - Allow sandbox domain to have entrypoint access only for executables and mountpoints.
  - Allow bitlee to create bitlee_var_t dirs.
  - Allow CIM provider to read sssd public files.
  - Fix some broken interfaces in distro policy.
  - Allow power button to shutdown the laptop.
  - Allow lsm plugins to create named fixed disks. rhbz#1238066
  - Allow hyperv domains to rw hyperv devices. rhbz#1241636
  - Label /var/www/html(/.*)?/wp_backups(/.*)? as httpd_sys_rw_content_t.
  - Create conman_unconfined_script_t type for conman script stored in /use/share/conman/exec/
  - Allow rsync_export_all_ro boolean to read also non_auth_dirs/files/symlinks.
  - Allow pmdaapache labeled as pcp_pmcd_t access to port 80 for apache diagnostics
  - Label nagios scripts as httpd_sys_script_exec_t.
  - Allow nsd_t to bind on nsf_control tcp port. Allow nsd_crond_t to read nsd pid.
  - Fix couple of cosmetic thing in new virtlogd_t policy. rhbz #1311576
  - Merge pull request #104 from berrange/rawhide-contrib-virtlogd
  - Label /var/run/ecblp0 as cupsd_var_run_t due to this fifo_file is used by epson drivers. rhbz#1310336
  - Dontaudit logrotate to setrlimit itself. rhbz#1309604
  - Add filename transition that /etc/princap will be created with cupsd_rw_etc_t label in cups_filetrans_named_content() interface.
  - Allow pcp_pmie and pcp_pmlogger to read all domains state.
  - Allow systemd-gpt-generator to create and manage systemd gpt generator unit files. BZ(1319446)
  - Merge pull request #115 from rhatdan/nvidea
  - Label all nvidia binaries as xserver_exec_t
  - Add new systemd_hwdb_read_config() interface. rhbz#1316514
  - Add back corecmd_read_all_executables() interface.
  - Call files_type() instead of file_type() for unlabeled_t.
  - Add files_entrypoint_all_mountpoint() interface.
  - Make unlabeled only as a file_type type. It is a type for fallback if there is an issue with labeling.
  - Add corecmd_entrypoint_all_executables() interface.
  - Create hyperv* devices and create rw interfaces for this devices. rhbz#1309361
  - Add neverallow assertion for unlabaled_t to increase policy security.
  - Allow systemd-rfkill to create /var/lib/systemd/rfkill dir. rhbz#1319499
  - Label 8952 tcp port as nsd_control.
  - Allow to log out to gdm after screen was resized in session via vdagent. Resolves: rhbz#1249020


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-181
changelog:
  - Label /usr/libexec/rpm-ostreed as rpm_exec_t. BZ(1309075)
  - /bin/mailx is labeled sendmail_exec_t, and enters the sendmail_t domain on execution.  If /usr/sbin/sendmail does not have its own domain to transition to, and is not one of several products whose behavior is allowed by the sendmail_t policy, execution will fail. In this case we need to label /bin/mailx as bin_t. BZ(1323224)
  - Label all run tgtd files, not just socket files.
  - Allow prosody to stream connect to sasl. This will allow using cyrus authentication in prosody.
  - Allow prosody to listen on port 5000 for mod_proxy65. BZ(1322815)
  - Allow targetd to read/write to /dev/mapper/control device. BZ(1241415)
  - Label /etc/selinux/(minimum|mls|targeted)/active/ as semanage_store_t.
  - Allow systemd_resolved to read systemd_networkd run files. BZ(1322921)
  - New cgroup2 file system in Rawhide


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-182
changelog:
  - rename several contrib modules according to their filenames
  - Add interface gnome_filetrans_cert_home_content()
  - By default container domains should not be allowed to create devices
  - Allow unconfined_t to create ~/.local/share/networkmanagement/certificates/ as home_cert_t instead of data_home_t.
  - Allow systemd_resolved_t to read /etc/passwd file. Allow systemd_resolved_t to write to kmsg_device_t when 'systemd.log_target=kmsg' option is used
  - Allow systemd gpt generator to read removable devices. BZ(1323458)
  - Allow systemd_gpt_generator_t sys_rawio capability. This access is needed to allow systemd gpt generator various device commands  BZ(1323454)


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-183
changelog:
  - Allow modemmanager to talk to logind
  - Dontaudit tor daemon needs net_admin capability. rhbz#1311788
  - Allow GDM write to event devices. This rule is needed for GDM, because other display managers runs the X server as root, GDM instead runs the X server as the unprivileged user, within the user session. rhbz#1232042
  - Xorg now writes content in users homedir.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-184
changelog:
  - Remove ftpd_home_dir() boolean from distro policy. Reason is that we cannot make this working due to m4 macro language limits.
  - Create new apache content template for files stored in user homedir. This change is needed to make working booleans: - httpd_enable_homedirs - httpd_read_user_content Resolves: rhbz#1330448
  - Label /usr/lib/snapper/systemd-helper as snapperd_exec_t. rhbz#1323732
  - Make virt_use_pcscd boolean off by default.
  - Create boolean to allow virtual machine use smartcards. rhbz#1029297
  - Allow snapperd to relabel btrfs snapshot subvolume to snapperd_data_t. rhbz#1323754
  - Allow mongod log to syslog.
  - Allow nsd daemon to create log file in /var/log as nsd_log_t
  - unlabeled_t can not be an entrypoint.
  - Modify interface den_read_nvme() to allow also read nvme_device_t block files. rhbz#1327909
  - Add new permissions stop/start to class system. rhbz#1324453


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-185
changelog:
  - Allow runnig php7 in fpm mode. From selinux-policy side, we need to allow httpd to read/write hugetlbfs.
  - Allow openvswitch daemons to run under openvswitch Linux user instead of root. This change needs allow set capabilities: chwon, setgid, setuid, setpcap. BZ(1330895)
  - Allow KDM to get status about power services. This change allow kdm to be able do shutdown BZ(1330970)
  - Add mls support for some db classes


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-186
changelog:
  - Allow snapperd sys_admin capability Allow snapperd to set scheduler. BZ(1323732)
  - Label named-pkcs11 binary as named_exec_t. BZ(1331316)
  - Revert "Add new permissions stop/start to class system. rhbz#1324453"
  - Fix typo in module compilation message


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-187
changelog:
  - Allow stunnel create log files. BZ(1333033)
  - Label dev/shm/squid-cf__metadata.shm as squid_tmpfs_t. BZ(1331574)
  - Allow stunnel sys_nice capability. Stunnel sched_* syscalls in some cases. BZ(1332287)
  - Label /usr/bin/ganesha.nfsd as glusterd_exec_t to run ganesha as glusterd_t. Allow glusterd_t stream connect to rpbind_t. Allow cluster_t to create symlink /var/lib/nfs labeled as var_lib_nfs_t. Add interface rpc_filetrans_var_lib_nfs_content() Add new boolean: rpcd_use_fusefs to allow rpcd daemon use fusefs.
  - Allow systemd-user-sessions daemon to mamange systemd_logind_var_run_t pid files. BZ(1331980)
  - Modify kernel_steam_connect() interface by adding getattr permission. BZ(1331927)
  - Label /usr/sbin/xrdp* files as bin_t BZ(1258453)
  - Allow rpm-ostree domain transition to install_t domain from init_t. rhbz#1330318


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-188
changelog:
  - Label tcp port 8181 as intermapper_port_t.
  - Label /usr/libexec/storaged/storaged as lvm_exec_t to run storaged daemon in lvm_t SELinux domain. BZ(1333588)
  - Label tcp/udp port 2024 as xinuexpansion4_port_t
  - Label tcp port 7002 as afs_pt_port_t Label tcp/udp port 2023 as xinuexpansion3_port_t


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-189
changelog:
  - Revert temporary fix: Replace generating man/html pages with pages from actual build. This is due to broken userspace with python3 in F23/Rawhide. Please Revert when userspace will be fixed


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-190
changelog:
  - Label /var/log/ganesha.log as gluster_log_t Allow glusterd_t domain to create glusterd_log_t files. Label /var/run/ganesha.pid as gluster_var_run_t.
  - Allow zabbix to connect to postgresql port
  - Label /usr/libexec/openssh/sshd-keygen as sshd_keygen_exec_t. BZ(1335149)
  - Allow systemd to read efivarfs. Resolve: #121


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-191
changelog:
  - Label /usr/share/ovirt-guest-agent/ovirt-guest-agent.py as rhev_agentd_exec_t
  - Allow dnssec_trigger_t to create lnk_file labeled as dnssec_trigger_var_run_t. BZ(1335954)
  - Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus.
  - Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t.
  - Merge pull request #122 from NetworkManager/th/nm-dnsmasq-dbus
  - Merge pull request #125 from rhatdan/typebounds
  - Typebounds user domains
  - Allow systemd_resolved_t to check if ipv6 is disabled.
  - systemd added a new directory for unit files /run/systemd/transient. It should be labelled system_u:object_r:systemd_unit_file_t:s0, the same as /run/systemd/system, PID 1 will write units there. Resolves: #120
  - Label /dev/xen/privcmd as xen_device_t. BZ(1334115)


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-192
changelog:
  - Create new SELinux type for /usr/libexec/ipa/ipa-dnskeysyncd BZ(1333106)
  - Add SELinux policy for opendnssec service. BZ(1333106)


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-193
changelog:
  - Directory Server (389-ds-base) has been updated to use systemd-ask-password. In order to function correctly we need the following added to dirsrv.te
  - Update opendnssec_manage_config() interface to allow caller domain also manage opendnssec_conf_t dirs
  - Allow gssproxy to get attributes on all filesystem object types. BZ(1333778)
  - Allow ipa_dnskey_t search httpd config files.
  - Dontaudit certmonger to write to etc_runtime_t
  - Update opendnssec_read_conf() interface to allow caller domain also read opendnssec_conf_t dirs.
  - Add interface ipa_delete_tmp()
  - Allow systemd_hostanmed_t to read /proc/sysinfo labeled as sysctl_t.
  - Allow systemd to remove ipa temp files during uinstalling ipa. BZ(1333106)


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-194
changelog:
  - Allow boinc to use dri devices. This allows use Boinc for a openCL GPU calculations. BZ(1340886)
  - Add nrpe_dontaudit_write_pipes()
  - Merge pull request #129 from rhatdan/onload
  - Add support for onloadfs
  - Merge pull request #127 from rhatdan/device-node
  - Additional access required for unconfined domains
  - Dontaudit ping attempts to write to nrpe unnamed pipes
  - Allow ifconfig_t to mounton also ifconfig_var_run_t dirs, not just files. Needed for: #ip netns add foo BZ(1340952)


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-195
changelog:
  - Add hwloc-dump-hwdata SELinux policy
  - Add labels for mediawiki123
  - Fix label for all fence_scsi_check scripts
  - Allow setcap for fenced
  - Allow glusterd domain read krb5_keytab_t files.
  - Allow tmpreaper_t to read/setattr all non_security_file_type dirs
  - Update refpolicy to handle hwloc
  - Fix typo in files_setattr_non_security_dirs.
  - Add interface files_setattr_non_security_dirs()


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-196
changelog:
  - Allow svirt_sandbox_domains to r/w onload sockets
  - Add filetrans rule that NetworkManager_t can create net_conf_t files in /etc.
  - Add interface sysnet_filetrans_named_net_conf()
  - Rawhide fails to boot, systemd-logind needs to config transient config files
  - User Namespace is requires create on process domains


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-197
changelog:
  - Allow conman to kill conman_unconfined_script.
  - Make conman_unconfined_script_t as init_system_domain.
  - Allow init dbus chat with apmd.
  - Patch /var/lib/rpm is symlink to /usr/share/rpm on Atomic, due to this change we need to label also /usr/share/rpm as rpm_var_lib_t.
  - Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_t
  - Allow collectd_t to stream connect to postgresql.
  - Allow mysqld_safe to inherit rlimit information from mysqld
  - Allow ip netns to mounton root fs and unmount proc_t fs.
  - Allow sysadm_t to run newaliases command.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-198
changelog:
  - Allow firewalld_t to create entries in net_conf_t dirs.
  - Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals
  - Allow rhsmcertd connect to port tcp 9090
  - Label for /bin/mail(x) was removed but /usr/bin/mail(x) not. This path is also needed to remove.
  - Label /usr/libexec/mimedefang-wrapper as spamd_exec_t.
  - Add new boolean spamd_update_can_network.
  - Add proper label for /var/log/proftpd.log
  - Allow rhsmcertd connect to tcp netport_port_t
  - Fix SELinux context for /usr/share/mirrormanager/server/mirrormanager to Label all binaries under dir as mirrormanager_exec_t.
  - Allow prosody to bind to fac_restore tcp port.
  - Fix SELinux context for usr/share/mirrormanager/server/mirrormanager
  - Allow ninfod to read raw packets
  - Fix broken hostapd policy
  - Allow hostapd to create netlink_generic sockets. BZ(1343683)
  - Merge pull request #133 from vinzent/allow_puppet_transition_to_shorewall
  - Allow pegasus get attributes from qemu binary files.
  - Allow tuned to use policykit. This change is required by cockpit.
  - Allow conman_t to read dir with conman_unconfined_script_t binary files.
  - Allow pegasus to read /proc/sysinfo.
  - Allow puppet_t transtition to shorewall_t
  - Allow conman to kill conman_unconfined_script.
  - Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals.
  - Merge remote-tracking branch 'refs/remotes/origin/rawhide-base' into rawhide-base
  - Allow systemd to execute all init daemon executables.
  - Add init_exec_notrans_direct_init_entry() interface.
  - Label tcp ports:16379, 26379 as redis_port_t
  - Allow systemd to relabel /var and /var/lib directories during boot.
  - Add files_relabel_var_dirs() and files_relabel_var_dirs() interfaces.
  - Add files_relabelto_var_lib_dirs() interface.
  - Label tcp and udp port 5582 as fac_restore_port_t
  - Allow sysadm_t user to run postgresql-setup.
  - Allow sysadm_t user to dbus chat with oddjob_t. This allows confined admin run oddjob mkhomedirfor script.
  - Allow systemd-resolved to connect to llmnr tcp port. BZ(1344849)
  - Allow passwd_t also manage user_tmp_t dirs, this change is needed by gnome-keyringd


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-199
changelog:
  - Label /var/lib/softhsm as named_cache_t. Allow named_t to manage named_cache_t dirs.
  - Allow glusterd daemon to get systemd status
  - Merge branch 'rawhide-contrib' of github.com:fedora-selinux/selinux-policy into rawhide-contrib
  - Merge pull request #135 from rhatdan/rawip_socket
  - Allow logrotate dbus-chat with system_logind daemon
  - Allow pcp_pmlogger to read kernel network state Allow pcp_pmcd to read cron pid files
  - Add interface cron_read_pid_files()
  - Allow pcp_pmlogger to create unix dgram sockets
  - Add interface dirsrv_run()
  - Remove non-existing jabberd_spool_t() interface and add new jabbertd_var_spool_t.
  - Remove non-existing interface salk_resetd_systemctl() and replace it with sanlock_systemctl_sanlk_resetd()
  - Create label for openhpid log files.
  - Container processes need to be able to listen on rawip sockets
  - Label /var/lib/ganglia as httpd_var_lib_t
  - Allow firewalld_t to create entries in net_conf_t dirs.
  - Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals
  - Label /etc/dhcp/scripts dir as bin_t
  - Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-200
changelog:
  - Fix typo in brltty policy
  - Add new SELinux module sbd
  - Allow pcp dmcache metrics collection
  - Allow pkcs_slotd_t to create dir in /var/lock Add label pkcs_slotd_log_t
  - Allow openvpn to create sock files labeled as openvpn_var_run_t
  - Allow hypervkvp daemon to getattr on  all filesystem types.
  - Allow firewalld to create net_conf_t files
  - Allow mock to use lvm
  - Allow mirromanager creating log files in /tmp
  - Allow vmtools_t to transition to rpm_script domain
  - Allow nsd daemon to manage nsd_conf_t dirs and files
  - Allow cluster to create dirs in /var/run labeled as cluster_var_run_t
  - Allow sssd read also sssd_conf_t dirs
  - Allow opensm daemon to rw infiniband_mgmt_device_t
  - Allow krb5kdc_t to communicate with sssd
  - Allow prosody to bind on prosody ports
  - Add dac_override caps for fail2ban-client Resolves: rhbz#1316678
  - dontaudit read access for svirt_t on the file /var/db/nscd/group Resolves: rhbz#1301637
  - Allow inetd child process to communicate via dbus with systemd-logind Resolves: rhbz#1333726
  - Add label for brltty log file Resolves: rhbz#1328818
  - Allow snort_t to communicate with sssd Resolves: rhbz#1284908
  - Add interface lttng_sessiond_tmpfs_t()
  - Dontaudit su_role_template interface to getattr /proc/kcore Dontaudit su_role_template interface to getattr /dev/initctl
  - Add interface lvm_getattr_exec_files()
  - Make label for new infiniband_mgmt deivices
  - Add prosody ports Resolves: rhbz#1304664


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-201
changelog:
  - Allow lttng tools to block suspending
  - Allow creation of vpnaas in openstack
  - remove rules with compromised_kernel permission
  - Allow dnssec-trigger to chat with NetworkManager over DBUS BZ(1350100)
  - Allow virtual machines to rw infiniband devices. Resolves: rhbz#1210263
  - Update makefile to support snapperd_contexts file
  - Remove compromize_kernel permission Remove unused mac_admin permission Add undefined system permission
  - Remove duplicate declaration of class service
  - Fix typo in access_vectors file
  - Merge branch 'rawhide-base-modules-load' into rawhide-base
  - Add new policy for systemd-modules-load
  - Add systemd access vectors.
  - Revert "Revert "Revert "Missed this version of exec_all"""
  - Revert "Revert "Missed this version of exec_all""
  - Revert "Missed this version of exec_all"
  - Revert "Revert "Fix name of capability2 secure_firmware->compromise_kernel"" BZ(1351624) This reverts commit 3e0e7e70de481589440f3f79cccff08d6e62f644.
  - Revert "Fix name of capability2 secure_firmware->compromise_kernel" BZ(1351624) This reverts commit 7a0348a2d167a72c8ab8974a1b0fc33407f72c48.
  - Revert "Allow xserver to compromise_kernel access"BZ(1351624)
  - Revert "Allow anyone who can load a kernel module to compromise_kernel"BZ(1351624)
  - Revert "add ptrace_child access to process" (BZ1351624)
  - Add user namespace capability object classes.
  - Allow udev to manage systemd-hwdb files
  - Add interface systemd_hwdb_manage_config()
  - Fix paths to infiniband devices. This allows use more then two infiniband interfaces.
  - corecmd: Remove fcontext for /etc/sysconfig/libvirtd
  - iptables: add fcontext for nftables


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-202
changelog:
  - Allow systemd_logind_t to start init_t BZ(1355861)
  - Add init_start() interface
  - Allow sysadm user to run systemd-tmpfiles
  - Add interface systemd_tmpfiles_run


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-203
changelog:
  - Allow hypervkvp domain to run restorecon.
  - Allow firewalld to manage net_conf_t files
  - Remove double graphite-web context declaration
  - Fix typo in rhsmcertd SELinux policy
  - Allow logrotate read logs inside containers.
  - Allow sssd to getattr on fs_t
  - Allow opendnssec domain to manage bind chace files
  - Allow systemd to get status of systemd-logind daemon
  - Label more ndctl devices not just ndctl0


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-204
changelog:
  - Allow lsmd_plugin_t to exec ldconfig.
  - Allow vnstatd domain to read /sys/class/net/ files
  - Remove duplicate allow rules in spamassassin SELinux module
  - Allow spamc_t and spamd_t domains create .spamassassin file in user homedirs
  - Allow ipa_dnskey domain to search cache dirs
  - Allow dogtag-ipa-ca-renew-agent-submit labeled as certmonger_t to create /var/log/ipa/renew.log file
  - Allow ipa-dnskey read system state.
  - Allow sshd setcap capability. This is needed due to latest changes in sshd Resolves: rhbz#1356245
  - Add interface to write to nsfs inodes
  - Allow init_t domain to read rpm db. This is needed due dnf-upgrade process failing. BZ(1349721)
  - Allow systemd_modules_load_t to read /etc/modprobe.d/lockd.conf
  - sysadmin should be allowed to use docker.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-205
changelog:
  - Dontaudit mock_build_t can list all ptys.
  - Allow ftpd_t to mamange userhome data without any boolean.
  - Add logrotate permissions for creating netlink selinux sockets.
  - Add new MLS attribute to allow relabeling objects higher than system low. This exception is needed for package managers when processing sensitive data.
  - Label all VBox libraries stored in /var/lib/VBoxGuestAdditions/lib/ as textrel_shlib_t BZ(1356654)
  - Allow systemd gpt generator to run fstools BZ(1353585)
  - Label /usr/lib/systemd/libsystemd-shared-231.so as lib_t. BZ(1360716)
  - Allow gnome-keyring also manage user_tmp_t sockets.
  - Allow systemd to mounton /etc filesystem. BZ(1341753)


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-206
changelog:
  - collectd: update policy for 5.5
  - Allow puppet_t transtition to shorewall_t
  - Grant certmonger "chown" capability
  - Boinc updates from Russell Coker.
  - Allow sshd setcap capability. This is needed due to latest changes in sshd.
  - Revert "Allow sshd setcap capability. This is needed due to latest changes in sshd"
  - Revert "Fix typo in ssh policy"
  - Get attributes of generic ptys, from Russell Coker.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-208
changelog:
  - Allow cups_config_t domain also mange sock_files. BZ(1361299)
  - Add wake_alarm capability to fprintd domain BZ(1362430)
  - Allow firewalld_t to relabel net_conf_t files. BZ(1365178)
  - Allow nut_upsmon_t domain to chat with logind vie dbus about scheduleing a shutdown when UPS battery is low. BZ(1361802)
  - Allow virtual machines to use dri devices. This allows use openCL GPU calculations. BZ(1337333)
  - Allow crond and cronjob domains to creating mail_home_rw_t objects in admin_home_t BZ(1366173)
  - Dontaudit mock to write to generic certs.
  - Add labeling for corosync-qdevice and corosync-qnetd daemons, to run as cluster_t
  - Revert "Label corosync-qnetd and corosync-qdevice as corosync_t domain"
  - Merge pull request #144 from rhatdan/modemmanager
  - Allow modemmanager to write to systemd inhibit pipes
  - Label corosync-qnetd and corosync-qdevice as corosync_t domain
  - Allow ipa_helper to read network state
  - Label oddjob_reqiest as oddjob_exec_t
  - Add interface oddjob_run()
  - Allow modemmanager chat with systemd_logind via dbus
  - Allow NetworkManager chat with puppetagent via dbus
  - Allow NetworkManager chat with kdumpctl via dbus
  - Allow sbd send msgs to syslog Allow sbd create dgram sockets. Allow sbd to communicate with kernel via dgram socket Allow sbd r/w kernel sysctls.
  - Allow ipmievd_t domain to re-create ipmi devices Label /usr/libexec/openipmi-helper as ipmievd_exec_t
  - Allow rasdaemon to use tracefs filesystem
  - Fix typo bug in dirsrv policy
  - Some logrotate scripts run su and then su runs unix_chkpwd. Allow logrotate_t domain to check passwd.
  - Add ipc_lock capability to sssd domain. Allow sssd connect to http_cache_t
  - Allow dirsrv to read dirsrv_share_t content
  - Allow virtlogd_t to append svirt_image_t files.
  - Allow hypervkvp domain to read hugetlbfs dir/files.
  - Allow mdadm daemon to read nvme_device_t blk files
  - Allow systemd_resolved to connect on system bus. BZ(1366334)
  - Allow systemd to create netlink_route_socket and communicate with systemd_networkd BZ(1306344)
  - Allow systemd-modules-load to load kernel modules in early boot. BZ(1322625)
  - label tcp/udp port 853 as dns_port_t. BZ(1365609)
  - Merge pull request #145 from rhatdan/init
  - systemd is doing a gettattr on blk and chr devices in /run
  - Allow selinuxusers and unconfineduser to run oddjob_request
  - Allow sshd server to acces to Crypto Express 4 (CEX4) devices.
  - Fix typo in device interfaces
  - Add interfaces for managing ipmi devices
  - Add interfaces to allow mounting/umounting tracefs filesystem
  - Add interfaces to allow rw tracefs filesystem
  - Merge branch 'rawhide-base' of github.com:fedora-selinux/selinux-policy into rawhide-base
  - Merge pull request #138 from rhatdan/userns
  - Allow iptables to creating netlink generic sockets.
  - Fix filecontext for systemd shared lib.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-209
changelog:
  - Fix lsm SELinux module
  - Dontaudit firewalld to create dirs in /root/ BZ(1340611)
  - Label /run/corosync-qdevice and /run/corosync-qnetd as corosync_var_run_t
  - Allow fprintd and cluster domains to cummunicate via dbus BZ(1355774)
  - Allow cupsd_config_t domain to read cupsd_var_run_t sock_file. BZ(1361299)
  - Add sys_admin capability to sbd domain
  - Allow vdagent to comunnicate with systemd-logind via dbus
  - Allow lsmd_plugin_t domain to create fixed_disk device.
  - Allow opendnssec domain to create and manage own tmp dirs/files
  - Allow opendnssec domain to read system state
  - Allow systemd_logind stop system init_t
  - Add interface init_stop()
  - Add interface userdom_dontaudit_create_admin_dir()
  - Label /var/run/storaged as lvm_var_run_t.
  - Allow unconfineduser to run ipa_helper_t.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-210
changelog:
  - Add few interfaces to cloudform.if file
  - Label /var/run/corosync-qnetd and /var/run/corosync-qdevice as cluster_var_run_t. Note: corosync policy is now par of rhcs module
  - Allow krb5kdc_t to read krb4kdc_conf_t dirs.
  - Update networkmanager_filetrans_named_content() interface to allow source domain to create also temad dir in /var/run.
  - Make confined users working again
  - Fix hypervkvp module
  - Allow ipmievd domain to create lock files in /var/lock/subsys/
  - Update policy for ipmievd daemon. Contain:    Allowing reading sysfs, passwd,kernel modules   Execuring bin_t,insmod_t
  - A new version of cloud-init that supports the effort to provision RHEL Atomic on Microsoft Azure requires some a new rules that allows dhclient/dhclient hooks to call cloud-init.
  - Allow systemd to stop systemd-machined daemon. This allows stop virtual machines.
  - Label /usr/libexec/iptables/iptables.init as iptables_exec_t Allow iptables creating lock file in /var/lock/subsys/


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-211
changelog:
  - Add new domain ipa_ods_exporter_t BZ(1366640)
  - Create new interface opendnssec_stream_connect()
  - Allow systemd-machined to communicate to lxc container using dbus
  - Dontaudit accountsd domain creating dirs in /root
  - Add new policy for Disk Manager called udisks2
  - Dontaudit firewalld wants write to /root
  - Label /etc/pki/pki-tomcat/ca/ as pki_tomcat_cert_t
  - Allow certmonger to manage all systemd unit files
  - Allow ipa_helper_t stream connect to dirsrv_t domain
  - Update oracleasm SELinux module
  - label /var/lib/kubelet as svirt_sandbox_file_t
  - Allow systemd to create blk and chr files with correct label in /var/run/systemd/inaccessible BZ(1367280)
  - Label /usr/libexec/gsd-backlight-helper as xserver_exec_t. This allows also confined users to manage screen brightness
  - Add new userdom_dontaudit_manage_admin_dir() interface
  - Label /dev/oracleasmfs as oracleasmfs_t. Add few interfaces related to oracleasmfs_t type


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-212
changelog:
  - udisk2 module is part of devicekit module now
  - Fix file context for /etc/pki/pki-tomcat/ca/
  - new interface oddjob_mkhomedir_entrypoint()
  - Allow mdadm to get attributes from all devices.
  - Label /etc/puppetlabs as puppet_etc_t.
  - quota: allow init to run quota tools
  - Add new domain ipa_ods_exporter_t BZ(1366640)
  - Create new interface opendnssec_stream_connect()
  - Allow VirtualBox to manage udev rules.
  - Allow systemd_resolved to send dbus msgs to userdomains
  - Make entrypoint oddjob_mkhomedir_exec_t for unconfined_t
  - Label all files in /dev/oracleasmfs/ as oracleasmfs_t


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-213
changelog:
  - Label /var/lib/docker/vfs as svirt_sandbox_file_t in virt SELinux module
  - Label /usr/bin/pappet as puppetagent_exec_t
  - Allow amanda to create dir in /var/lib/ with amanda_var_lib_t label
  - Allow run sulogin_t in range mls_systemlow-mls_systemhigh.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-214
changelog:
  - Allow attach usb device to virtual machine BZ(1276873)
  - Dontaudit mozilla_plugin to sys_ptrace
  - Allow nut_upsdrvctl_t domain to read udev db BZ(1375636)
  - Fix typo
  - Allow geoclue to send msgs to syslog. BZ(1371818)
  - Allow abrt to read rpm_tmp_t dirs
  - Add interface rpm_read_tmp_files()
  - Remove labels for somr docker sandbox files for now. This needs to be reverted after fixes in docker-selinux
  - Update oracleasm SELinux module that can manage oracleasmfs_t blk files. Add dac_override cap to oracleasm_t domain.
  - Add few rules to pcp SELinux module to make ti able to start pcp_pmlogger service
  - Revert "label /var/lib/kubelet as svirt_sandbox_file_t"
  - Remove file context for /var/lib/kubelet. This filecontext is part of docker now
  - Add oracleasm_conf_t type and allow oracleasm_t to create /dev/oracleasm
  - Label /usr/share/pcp/lib/pmie as pmie_exec_t and /usr/share/pcp/lib/pmlogger as pmlogger_exec_t
  - Allow mdadm_t to getattr all device nodes
  - Dontaudit gkeyringd_domain to connect to system_dbusd_t
  - Add interface dbus_dontaudit_stream_connect_system_dbusd()
  - Allow guest-set-user-passwd to set users password.
  - Allow domains using kerberos to read also kerberos config dirs
  - Allow add new interface to new namespace BZ(1375124)
  - Allow systemd to relalbel files stored in /run/systemd/inaccessible/
  -  Add interface fs_getattr_tmpfs_blk_file()
  - Dontaudit domain to create any file in /proc. This is kernel bug.
  - Improve regexp for power_unit_file_t files. To catch just systemd power unit files.
  - Add new interface fs_getattr_oracleasmfs_fs()
  - Add interface fs_manage_oracleasm()
  - Label /dev/kfd as hsa_device_t
  - Update seutil_manage_file_contexts() interface that caller domain can also manage file_context_t dirs


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-215
changelog:
  - Make tor_var_run_t as mountpoint. BZ(1368621)
  - Fix typo in ftpd SELinux module.
  - Allow cockpit-session to reset expired passwords BZ(1374262)
  - Allow ftp daemon to manage apache_user_content
  - Label /etc/sysconfig/oracleasm as oracleasm_conf_t
  - Allow oracleasm to rw inherited fixed disk device
  - Allow collectd to connect on unix_stream_socket
  - Add abrt_dump_oops_t kill user namespace capability. BZ(1376868)
  - Dontaudit systemd is mounting unlabeled dirs BZ(1367292)
  - Add interface files_dontaudit_mounton_isid()


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-216
changelog:
  - Allow devicekit to chat with policykit via DBUS. BZ(1377113)
  - Add interface virt_rw_stream_sockets_svirt() BZ(1379314)
  - Allow xdm_t to read mount pid files. BZ(1377113)
  - Allow staff to rw svirt unix stream sockets. BZ(1379314)
  - Allow staff_t to read tmpfs files BZ(1378446)


author: Colin Walters <walters@redhat.com> - 3.13.1-218
changelog:
  - Revert addition of systemd service for factory reset, since it is
    basically worse than what we had before.  BZ(1290659)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-219
changelog:
  - Dontaudit leaked file descriptors for thumb. BZ(1383071)
  - Fix typo in cobbler SELinux module
  - Merge pull request #165 from rhatdan/container
  - Allow cockpit_ws_t to manage cockpit_lib_t dirs and files. BZ(1375156)
  - Allow cobblerd_t to delete dirs labeled as tftpdir_rw_t
  - Rename svirt_lxc_net_t to container_t
  - Rename docker.pp to container.pp, causes change in interface name
  - Allow httpd_t domain to list inotify filesystem.
  - Fix couple AVC to start roundup properly
  - Allow dovecot_t send signull to dovecot_deliver_t
  - Add sys_ptrace capability to pegasus domain
  - Allow firewalld to stream connect to NetworkManager. BZ(1380954)
  - rename docker intefaces to container
  - Merge pull request #164 from rhatdan/docker-base
  - Rename docker.pp to container.pp, causes change in interface name
  - Allow gvfs to read /dev/nvme* devices BZ(1380951)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-220
changelog:
  - Disable container_runtime_typebounds() due to typebounds issues which can not be resolved during build.
  - Disable unconfined_typebounds in sandbox.te due to entrypoint check which exceed for sandbox domains unconfined_t domain.
  - Disable unconfined_typebounds due to entrypoint check which exceed for sandbox domains unconfined_t domain.
  - Merge pull request #167 from rhatdan/container
  - Add transition rules for sandbox domains
  - container_typebounds() should be part of sandbox domain template
  - Fix broken container_* interfaces
  - unconfined_typebounds() should be part of sandbox domain template
  - Fixed unrecognized characters at sandboxX module
  - unconfined_typebounds() should be part of sandbox domain template
  - svirt_file_type is atribute no type.
  - Merge pull request #166 from rhatdan/container
  - Allow users to transition from unconfined_t to container types
  - Add dbus_stream_connect_system_dbusd() interface.
  - Merge pull request #152 from rhatdan/network_filetrans
  - Fix typo in filesystem module
  - Allow nss_plugin to resolve host names via the systemd-resolved. BZ(1383473)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-222
changelog:
  - Allow abrt_dump_oops_t to drop capabilities. bz(1391040)
  - Add named_t domain net_raw capability bz(1389240)
  - Allow geoclue to read system info. bz(1389320)
  - Make openfortivpn_t as init_deamon_domain. bz(1159899)
  - Allow nfsd domain to create nfsd_unit_file_t files. bz(1382487)
  - Merge branch 'rawhide-contrib' of github.com:fedora-selinux/selinux-policy into rawhide-contrib
  - Add interace lldpad_relabel_tmpfs
  - Merge pull request #155 from rhatdan/sandbox_nfs
  - Add pscsd_t wake_alarm capability2
  - Allow sandbox domains to mount fuse file systems
  - Add boolean to allow sandbox domains to mount nfs
  - Allow hypervvssd_t to read all dirs.
  - Allow isnsd_t to connect to isns_port_t
  - Merge branch 'rawhide-contrib' of github.com:fedora-selinux/selinux-policy into rawhide-contrib
  - Allow GlusterFS with RDMA transport to be started correctly. It requires ipc_lock capability together with rw permission on rdma_cm device.
  - Make tor_var_lib_t and tor_var_log_t as mountpoints.
  - Allow systemd-rfkill to write to /proc/kmsg bz(1388669)
  - Allow init_t to relabel /dev/shm/lldpad.state
  - Merge pull request #168 from rhatdan/docker
  - Label tcp 51954 as isns_port_t
  - Lots of new domains like OCID and RKT are user container processes


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-223
changelog:
  - nmbd_t needs net_admin capability like smbd
  - Add interface chronyd_manage_pid() Allow logrotate to manage chrony pids
  - Add wake_alarm capability2 to openct_t domain
  - Allow abrt_t to getattr on nsfs_t files.
  - Add cupsd_t domain wake_alarm capability.
  - Allow sblim_reposd_t domain to read cert_f files.
  - Allow abrt_dump_oops_t to drop capabilities. bz(1391040)
  - Revert "Allow abrt_dump_oops_t to drop capabilities. bz(1391040)"
  - Allow isnsd_t to accept tcp connections


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-226
changelog:
  - Adding policy for tlp
  - Add interface  dev_manage_sysfs()
  - Allow ifconfig domain to manage tlp pid files.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-227
changelog:
  - Dontaudit logrotate_t to getattr nsfs_t BZ(1399081)
  - Allow pmie daemon to send signal pcmd daemon BZ(1398078)
  - Allow spamd_t to manage /var/spool/mail. BZ(1398437)
  - Label /run/rpc.statd.lock as rpcd_lock_t and allow rpcd_t domain to manage it. BZ(1397254)
  - Merge pull request #171 from t-woerner/rawhide-contrib
  - Allow firewalld to getattr open search read modules_object_t:dir
  - Allow systemd create /dev/log in own mount-namespace. BZ(1383867)
  - Add interface fs_dontaudit_getattr_nsfs_files()
  - Label /usr/lib/systemd/resolv.conf as lib_t to allow all domains read this file. BZ(1398853)
  - Dontaudit systemd_journal sys_ptrace userns capability. BZ(1374187)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-228
changelog:
  - Fix some boolean descriptions.
  - Add fwupd_dbus_chat() interface
  - Allow tgtd_t domain wake_alarm
  - Merge pull request #172 from vinzent/allow_puppetagent_timedated
  - Dontaudit logrotate_t to getattr nsfs_t BZ(1399081)
  - Allow systemd_machined_t to start unit files labeled as init_var_run_t
  - Add init_manage_config_transient_files() interface
  - In Atomic /usr/local is a soft symlink to /var/usrlocal, so the default policy to apply bin_t on /usr/...bin doesn't work and binaries dumped here get mislabeled as var_t.
  - Allow systemd to raise rlimit to all domains.BZ(1365435)
  - Add interface domain_setrlimit_all_domains() interface
  - Allow staff_t user to chat with fwupd_t domain via dbus
  - Update logging_create_devlog_dev() interface to allow calling domain create also sock_file dev-log. BZ(1393774)
  - Allow systemd-networkd to read network state BZ(1400016)
  - Allow systemd-resolved bind to dns port. BZ(1400023)
  - Allow systemd create /dev/log in own mount-namespace. BZ(1383867)
  - Add interface fs_dontaudit_getattr_nsfs_files()
  - Label /usr/lib/systemd/resolv.conf as lib_t to allow all domains read this file. BZ(1398853)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229
changelog:
  - Label /usr/bin/rpcbind as rpcbind_exec_t. Label /usr/lib/systemd/systemd/rpcbind.service
  - Allot tlp domain to create unix_dgram sockets BZ(1401233)
  - Allow antivirus domain to create lnk_files in /tmp
  - Allow cupsd_t to create lnk_files in /tmp. BZ(1401634)
  - Allow svnserve_t domain to read /dev/random BZ(1401827)
  - Allow lircd to use nsswitch. BZ(1401375)
  - Allow hostname_t domain to manage cluster_tmp_t files


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-230
changelog:
  - Label /usr/bin/rpcbind as rpcbind_exec_t
  - Dontaudit mozilla plugin rawip socket creation. BZ(1275961)
  - Merge pull request #174 from rhatdan/netlink


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-231
changelog:
  - Allow pptp_t to read /dev/random BZ(1404248)
  - Allow glusterd_t send signals to userdomain. Label new glusterd binaries as glusterd_exec_t
  - Allow systemd to stop glusterd_t domains.
  - Merge branch 'rawhide-base' of github.com:fedora-selinux/selinux-policy into rawhide-base
  - Label /usr/sbin/sln as ldconfig_exec_t BZ(1378323)
  - Revert "Allow an domain that has an entrypoint from a type to be allowed to execute the entrypoint without a transition,  I can see no case where this is  a bad thing, and elminiates a whole class of AVCs."


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-232
changelog:
  - Add tlp_var_lib_t label for /var/lib/tlp directory BZ(1409977)
  - Allow tlp_t domain to read proc_net_t BZ(1403487)
  - Merge pull request #179 from rhatdan/virt1
  - Allow tlp_t domain to read/write cpu microcode BZ(1403103)
  - Allow virt domain to use interited virtlogd domains fifo_file
  - Fixes for containers
  - Allow glusterd_t to bind on glusterd_port_t udp ports.
  - Update ctdbd_t policy to reflect all changes.
  - Allow ctdbd_t domain transition to rpcd_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-233
changelog:
  -Allow thumb domain sendto via dgram sockets. BZ(1398813)
  - Add condor_procd_t domain sys_ptrace cap_userns BZ(1411077)
  - Allow cobbler domain to create netlink_audit sockets BZ(1384600)
  - Allow networkmanager to manage networkmanager_var_lib_t lnk files BZ(1408626)
  - Add dhcpd_t domain fowner capability BZ(1409963)
  - Allow thumb to create netlink_kobject_uevent sockets. BZ(1410942)
  - Fix broken interfaces
  - Allow setfiles_t domain rw inherited kdumpctl tmp pipes BZ(1356456)
  - Allow user_t run systemctl --user BZ(1401625)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-234
changelog:
  - After the latest changes in nfsd. We should allow nfsd_t to read raw fixed disk. For more info see: BZ(1403017)
  - Tighten security on containe types
  - Make working cracklib_password_check for MariaDB service
  - Label 20514 tcp/udp ports as syslogd_port_t Label 10514 tcp/udp portas as syslog_tls_port_t BZ(1410505)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-235
changelog:
  - Allow libvirt daemon to create /var/chace/libvirt dir.
  - Allow systemd using ProtectKernelTunables securit feature. BZ(1392161)
  - F26 Wide change: Coredumps enabled by default. Allowing inherits process limits to enable coredumps.BZ(1341829)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-236
changelog:
  - Allow kdumpgui domain to read nvme device
  - Add amanda_tmpfs_t label. BZ(1243752)
  - Fix typo in sssd interface file
  - Allow sssd_t domain setpgid BZ(1411437)
  - Allow ifconfig_t domain read nsfs_t
  - Allow ping_t domain to load kernel modules.
  - Allow systemd to send user information back to pid1. BZ(1412750)
  - rawhide-base: Fix wrong type/attribute flavors in require blocks


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-237
changelog:
  - Merge pull request #187 from rhatdan/container-selinux
  - Allow rhsmcertd domain signull kernel.
  - Allow container-selinux to handle all policy for container processes
  - Fix label for nagios plugins in nagios file conxtext file
  - su using libselinux and creating netlink_selinux socket is needed to allow libselinux initialization. Resolves: rhbz#1146987
  - Add SELinux support for systemd-initctl daemon
  - Add SELinux support for systemd-bootchart
  - su using libselinux and creating netlink_selinux socket is needed to allow libselinux initialization. Resolves: rhbz#1146987
  - Add module_load permission to can_load_kernmodule
  - Add module_load permission to class system
  - Add the validate_trans access vector to the security class
  - Restore connecto permssions for init_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-238
changelog:
  - Allow shiftfs to use xattr SELinux labels
  - Fix ssh_server_template by add sshd_t to require section.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-240
changelog:
  - Dontaudit xdm_t wake_alarm capability2
  - Allow systemd_initctl_t to create and connect unix_dgram sockets
  - Allow ifconfig_t to mount/unmount nsfs_t filesystem
  - Add interfaces allowing mount/unmount nsfs_t filesystem
  - Label /usr/lib/libGLdispatch.so.0.0.0 as textrel_shlib_t BZ(1419944)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-241
changelog:
  - Remove ganesha from gluster module and create own module for ganesha
  - FIx label for /usr/lib/libGLdispatch.so.0.0.0


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-242
changelog:
  - Add radius_use_jit boolean
  - Allow nfsd_t domain to create sysctls_rpc_t files
  - add the policy required for nextcloud
  - Allow can_load_kernmodule to load kernel modules. BZ(1426741)
  - Create kernel_create_rpc_sysctls() interface


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-244
changelog:
  - Update fwupd policy
  - /usr/libexec/udisks2/udisksd should be labeled as devicekit_disk_exec_t
  - Update ganesha policy
  - Allow chronyd to read adjtime
  - Merge pull request #194 from hogarthj/certbot_policy
  - get the correct cert_t context on certbot certificates bz#1289778
  - Label /dev/ss0 as gpfs_device_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-245
changelog:
  - Allow vdagent domain to getattr cgroup filesystem
  - Allow abrt_dump_oops_t stream connect to sssd_t domain
  - Allow cyrus stream connect to gssproxy
  - Label /usr/libexec/cockpit-ssh as cockpit_session_exec_t and allow few rules
  - Allow colord_t to read systemd hwdb.bin file
  - Allow dirsrv_t to create /var/lock/dirsrv labeled as dirsrc_var_lock_t
  - Allow certmonger to manage /etc/krb5kdc_conf_t
  - Allow kdumpctl to getenforce
  - Allow ptp4l wake_alarm capability
  - Allow ganesha to chat with unconfined domains via dbus
  - Add nmbd_t capability2 block_suspend
  - Add domain transition from sosreport_t to iptables_t
  - Dontaudit init_t to mounton modules_object_t
  - Add interface files_dontaudit_mounton_modules_object
  - Allow xdm_t to execute files labeled as xdm_var_lib_t
  - Make mtrr_device_t mountpoint.
  - Fix path to /usr/lib64/erlang/erts-5.10.4/bin/epmd


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-246
changelog:
  - Label all files containing hostname substring in /etc/ created by systemd_hostnamed_t as hostname_etc_t. BZ(1433555)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-247
changelog:
  - Make fwupd_var_lib_t type mountpoint. BZ(1429341)
  - Remove tomcat_t domain from unconfined domains
  - Create new boolean: sanlock_enable_home_dirs()
  - Allow mdadm_t domain to read/write nvme_device_t
  - Remove httpd_user_*_content_t domains from user_home_type attribute. This tighten httpd policy and acces to user data will be more strinct, and also fix mutual influente between httpd_enable_homedirs and httpd_read_user_content
  - Add interface dev_rw_nvme
  - Label all files containing hostname substring in /etc/ created by systemd_hostnamed_t as hostname_etc_t. BZ(1433555)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-249
changelog:
  - Merge pull request #4 from lslebodn/sssd_socket_activated
  - Remove /proc <<none>> from fedora policy, it's no longer necessary
  - Allow iptables get list of kernel modules
  - Allow unconfined_domain_type to enable/disable transient unit
  - Add interfaces init_enable_transient_unit() and init_disable_transient_unit
  - Revert "Allow sshd setcap capability. This is needed due to latest changes in sshd"
  - Label sysroot dir under ostree as root_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-250
changelog:
  - Allow tlp_t domain to ioctl removable devices BZ(1436830)
  - Allow tlp_t domain domtrans into mount_t BZ(1442571)
  - Allow lircd_t to read/write to sysfs BZ(1442443)
  - Fix policy to reflect all changes in new IPA release
  - Allow virtlogd_t to creating tmp files with virt_tmp_t labels.
  - Allow sbd_t to read/write fixed disk devices
  - Add sys_ptrace capability to radiusd_t domain
  - Allow cockpit_session_t domain connects to ssh tcp ports.
  - Update tomcat policy to make working ipa install process
  - Allow pcp_pmcd_t net_admin capability. Allow pcp_pmcd_t read net sysctls Allow system_cronjob_t create /var/run/pcp with pcp_var_run_t
  - Fix all AVC denials during pkispawn of CA Resolves: rhbz#1436383
  - Update pki interfaces and tomcat module
  - Allow sendmail to search network sysctls
  - Add interface gssd_noatsecure()
  - Add interface gssproxy_noatsecure()
  - Allow chronyd_t net_admin capability to allow support HW timestamping.
  - Update tomcat policy.
  - Allow certmonger to start haproxy service
  - Fix init Module
  - Make groupadd_t domain as system bus client BZ(1416963)
  - Make useradd_t domain as system bus client BZ(1442572)
  - Allow xdm_t to gettattr /dev/loop-control device BZ(1385090)
  - Dontaudit gdm-session-worker to view key unknown. BZ(1433191)
  - Allow init noatsecure for gssd and gssproxy
  - Allow staff user to read fwupd_cache_t files
  - Remove typo bugs
  - Remove /proc <<none>> from fedora policy, it's no longer necessary


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-253
changelog:
  - auth_use_nsswitch can call only domain not attribute
  - Dontaudit net_admin cap for winbind_t
  - Allow tlp_t domain to stream connect to system bus
  - Allow tomcat_t domain read pki_common_t files
  - Add interface pki_read_common_files()
  - Fix broken cermonger module
  - Fix broken apache module
  - Allow hypervkvp_t domain execute hostname
  - Dontaudit sssd_selinux_manager_t use of net_admin capability
  - Allow tomcat_t stream connect to pki_common_t
  - Dontaudit xguest_t's attempts to listen to its tcp_socket
  - Allow sssd_selinux_manager_t to ioctl init_t sockets
  - Improve ipa_cert_filetrans_named_content() interface to also allow caller domain manage ipa_cert_t type.
  - Allow pki_tomcat_t domain read /etc/passwd.
  - Allow tomcat_t domain read ipa_tmp_t files
  - Label new path for ipa-otpd
  - Allow radiusd_t domain stream connect to postgresql_t
  - Allow rhsmcertd_t to execute hostname_exec_t binaries.
  - Allow virtlogd to append nfs_t files when virt_use_nfs=1
  - Allow httpd_t domain read also httpd_user_content_type lnk_files.
  - Allow httpd_t domain create /etc/httpd/alias/ipaseesion.key with label ipa_cert_t
  - Dontaudit <user>_gkeyringd_t stream connect to system_dbusd_t
  - Label /var/www/html/nextcloud/data as httpd_sys_rw_content_t
  - Add interface ipa_filetrans_named_content()
  - Allow tomcat use nsswitch
  - Allow certmonger_t start/status generic services
  - Allow dirsrv read cgroup files.
  - Allow ganesha_t domain read/write infiniband devices.
  - Allow sendmail_t domain sysctl_net_t files
  - Allow targetd_t domain read network state and getattr on loop_control_device_t
  - Allow condor_schedd_t domain send mails.
  - Allow ntpd to creating sockets. BZ(1434395)
  - Alow certmonger to create own systemd unit files.
  - Add kill namespace capability to xdm_t domain
  - Revert "su using libselinux and creating netlink_selinux socket is needed to allow libselinux initialization."
  - Revert "Allow <role>_su_t to create netlink_selinux_socket"
  - Allow <role>_su_t to create netlink_selinux_socket
  - Allow unconfined_t to module_load any file
  - Allow staff to systemctl virt server when staff_use_svirt=1
  - Allow unconfined_t create /tmp/ca.p12 file with ipa_tmp_t context
  - Allow netutils setpcap capability
  - Dontaudit leaked file descriptor happening in setfiles_t domain BZ(1388124)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-254
changelog:
  - Allow svirt_t to read raw fixed_disk_device_t to make working blockcommit
  - ejabberd small fixes
  - Update targetd policy to accommodate changes in the service
  - Allow tomcat_domain connect to    * postgresql_port_t    * amqp_port_t Allow tomcat_domain read network sysctls
  - Allow virt_domain to read raw fixed_disk_device_t to make working blockcommit
  - Allow glusterd_t domain start ganesha service
  - Made few cosmetic changes in sssd SELinux module
  - Merge pull request #11 from lslebodn/sssd_kcm
  - Update virt_rw_stream_sockets_svirt() interface to allow confined users set socket options.
  - Allow keepalived_t domain read usermodehelper_t
  - Allow radius domain stream connec to postgresql
  - Merge pull request #8 from bowlofeggs/142-rawhide
  - Add fs_manage_configfs_lnk_files() interface


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-255
changelog:
  - Dontaudit net_admin capability for domains postfix_master_t and postfix_qmgr_t
  - Add interface pki_manage_common_files()
  - Allow rngd domain read sysfs_t
  - Allow tomcat_t domain to manage pki_common_t files and dirs
  - Merge pull request #3 from rhatdan/devicekit
  - Merge pull request #12 from lslebodn/sssd_sockets_fc
  - Allow certmonger reads httpd_config_t files
  - Allow keepalived_t domain creating netlink_netfilter_socket.
  - Use stricter fc rules for sssd sockets in /var/run
  - Allow tomcat domain read rpm_var_lib_t files Allow tomcat domain exec rpm_exec_t files Allow tomcat domain name connect on oracle_port_t Allow tomcat domain read cobbler_var_lib_t files.
  - Allow sssd_t domain creating sock files labeled as sssd_var_run_t in /var/run/
  - Allow svirt_t to read raw fixed_disk_device_t to make working blockcommit
  - ejabberd small fixes
  - Update targetd policy to accommodate changes in the service
  - Allow tomcat_domain connect to    * postgresql_port_t    * amqp_port_t Allow tomcat_domain read network sysctls
  - Allow virt_domain to read raw fixed_disk_device_t to make working blockcommit
  - Dontaudit net_admin capability for useradd_t domain
  - Allow systemd_localed_t and systemd_timedated_t create files in /etc with label locate_t BZ(1443723)
  - Make able deply overcloud via neutron_t to label nsfs as fs_t
  - Add fs_manage_configfs_lnk_files() interface


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-256
changelog:
  - Allow keepalived domain connect to squid tcp port
  - Allow krb5kdc_t domain read realmd lib files.
  - Allow tomcat to connect on all unreserved ports
  - Allow keepalived domain connect to squid tcp port
  - Allow krb5kdc_t domain read realmd lib files.
  - Allow tomcat to connect on all unreserved ports
  - Allow ganesha to connect to all rpc ports
  - Update ganesha with few allow rules
  - Update rpc_read_nfs_state_data() interface to allow read also lnk_files.
  - virt_use_glusterd boolean should be in optional block
  - Add new boolean virt_use_glusterd
  - Add capability sys_boot for sbd_t domain Allow sbd_t domain to create rpc sysctls.
  - Allow ganesha_t domain to manage glusterd_var_run_t pid files.
  - Create new interface: glusterd_read_lib_files() Allow ganesha read glusterd lib files. Allow ganesha read network sysctls
  - Add few allow rules to ganesha module
  - Allow condor_master_t to read sysctls.
  - Add dac_override cap to ctdbd_t domain
  - Add ganesha_use_fusefs boolean.
  - Allow httpd_t reading kerberos kdc config files
  - Allow tomcat_t domain connect to ibm_dt_2 tcp port.
  - Allow stream connect to initrc_t domains
  - Add pki_exec_common_files() interface
  - Allow  dnsmasq_t domain to read systemd-resolved pid files.
  - Allow tomcat domain name_bind on tcp bctp_port_t
  - Allow smbd_t domain generate debugging files under /var/run/gluster. These files are created through the libgfapi.so library that provides integration of a GlusterFS client in the Samba (vfs_glusterfs) process.
  - Allow condor_master_t write to sysctl_net_t
  - Allow nagios check disk plugin read /sys/kernel/config/
  - Allow pcp_pmie_t domain execute systemctl binary
  - Allow nagios to connect to stream sockets. Allow nagios start httpd via systemctl
  - xdm_t should view kernel keys
  - Hide broken symptoms when machine is configured with network bounding.
  - Label 8750 tcp/udp port as dey_keyneg_port_t
  - Label tcp/udp port 1792 as ibm_dt_2_port_t
  - Add interface fs_read_configfs_dirs()
  - Add interface fs_read_configfs_files()
  - Fix systemd_resolved_read_pid interface
  - Add interface systemd_resolved_read_pid()
  - Allow sshd_net_t domain read/write into crypto devices
  - Label 8999 tcp/udp as bctp_port_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-257
changelog:
  - Merge pull request #10 from mscherer/fix_tor_dac
  - Merge pull request #9 from rhatdan/rawhide
  - Merge pull request #13 from vinzent/allow_zabbix_t_to_kill_zabbix_script_t
  - Allow kdumpgui to read removable disk device
  - Allow systemd_dbusd_t domain read/write to nvme devices
  - Allow udisks2 domain to read removable devices BZ(1443981)
  - Allow virtlogd_t to execute itself
  - Allow keepalived to read/write usermodehelper state
  - Allow named_t to bind on udp 4321 port
  - Fix interface tlp_manage_pid_files()
  - Allow collectd domain read lvm config files. BZ(1459097)
  - Merge branch 'rawhide' of github.com:wrabcak/selinux-policy-contrib into rawhide
  - Allow samba_manage_home_dirs boolean to manage user content
  - Merge pull request #14 from lemenkov/rabbitmq_systemd_notify
  - Allow pki_tomcat_t execute ldconfig.
  - Merge pull request #191 from rhatdan/udev
  - Allow systemd_modules_load_t to load modules


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-258
changelog:
  - Allow rpcbind_t to execute systemd_tmpfiles_exec_t binary files.
  - Merge branch 'rawhide' of github.com:wrabcak/selinux-policy-contrib into rawhide
  - Allow qemu to authenticate SPICE connections with SASL GSSAPI when SSSD is in use
  - Fix dbus_dontaudit_stream_connect_system_dbusd() interface to require TYPE rather than ATTRIBUTE for systemd_dbusd_t.
  - Allow httpd_t to read realmd_var_lib_t files
  - Allow unconfined_t user all user namespace capabilties.
  - Add interface systemd_tmpfiles_exec()
  - Add interface libs_dontaudit_setattr_lib_files()
  - Dontaudit xdm_t domain to setattr on lib_t dirs
  - Allow sysadm_r role to jump into dirsrv_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-260
changelog:
  - Allow sssd_t to read realmd lib files.
  - Fix init interface file. init_var_run_t is type not attribute


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-261
changelog:
  - Allow boinc_t nsswitch
  - Dontaudit firewalld to write to lib_t dirs
  - Allow modemmanager_t domain to write to raw_ip file labeled as sysfs_t
  - Allow thumb_t domain to allow create dgram sockets
  - Disable mysqld_safe_t secure mode environment cleansing
  - Allow couple rules needed to start targetd daemon with SELinux in enforcing mode
  - Allow dirsrv domain setrlimit
  - Dontaudit staff_t user read admin_home_t files.
  - Add interface lvm_manage_metadata
  - Add permission open to files_read_inherited_tmp_files() interface


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-262
changelog:
  - Allow cluster_t and glusterd_t domains to dbus chat with ganesha service
  - Allow iptables to read container runtime files


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-265
changelog:
  - Allow llpdad send dgram to libvirt
  - Allow abrt_t domain dac_read_search capability
  - Allow init_t domain mounton dirs labeled as init_var_lib_t BZ(1471476)
  - Allow xdm_t domain read unique machine-id generated during system installation. BZ(1467036)
  - Dontaudit xdm_t to setattr lib_t dirs. BZ(#1458518)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-267
changelog:
  - After fix in kernel where LSM hooks for dac_override and dac_search_read capability was swaped we need to fix it also in policy


author: Petr Lautrbach <plautrba@redhat.com> - 3.13.1-268
changelog:
  - Update for SELinux userspace release 20170804 / 2.7
  - Omit precompiled regular expressions from file_contexts.bin files


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-269
changelog:
  - Allow osad make executable an anonymous mapping or private file mapping that is writable BZ(1425524)
  - After fix in kernel where LSM hooks for dac_override and dac_search_read capability was swaped we need to fix it also in policy
  - refpolicy: Define and allow map permission
  - init: Add NoNewPerms support for systemd.
  - Add nnp_nosuid_transition policycap and related class/perm definitions.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-271
changelog:
  - Allow tomcat_t domain couple capabilities to make working tomcat-jsvc
  - Label /usr/libexec/sudo/sesh as shell_exec_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-272
changelog:
  - Allow sssd_t domain to map sssd_var_lib_t files
  - allow map permission where needed
  - contrib: allow map permission where needed
  - Allow syslogd_t to map syslogd_var_run_t files
  - allow map permission where needed


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-273
changelog:
  - Allow dirsrv_t domain use mmap on files labeled as dirsrv_var_run_t BZ(1483170)
  - Allow just map permission insead of using mmap_file_pattern because mmap_files_pattern allows also executing objects.
  - Label /var/run/agetty.reload as getty_var_run_t
  - Add missing filecontext for sln binary
  - Allow systemd to read/write to event_device_t BZ(1471401)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-274
changelog:
  - Allow postgrey to execute bin_t files and add postgrey into nsswitch_domain
  - Allow nscd_t domain to search network sysctls
  - Allow iscsid_t domain to read mount pid files
  - Allow ksmtuned_t domain manage sysfs_t files/dirs
  - Allow keepalived_t domain domtrans into iptables_t
  - Allow rshd_t domain reads net sysctls
  - Allow systemd to create syslog netlink audit socket
  - Allow ifconfig_t domain unmount fs_t
  - Label /dev/gpiochip* devices as gpio_device_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-275
changelog:
  - Make confined users working
  - Allow ipmievd_t domain to load kernel modules
  - Allow logrotate to reload transient systemd unit


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-277
changelog:
  - Allow cupsd_t to execute ld_so_cache
  - Add cgroup_seclabel policycap.
  - Allow xdm_t to read systemd hwdb
  - Add new interface systemd_hwdb_mmap_config()
  - Allow auditd_t domain to mmap conf files labeled as auditd_etc_t BZ(1485050)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-278
changelog:
  - Add couple rules related to map permissions
  - Allow ddclient use nsswitch BZ(1456241)
  - Allow thumb_t domain getattr fixed_disk device. BZ(1379137)
  - Add interface dbus_manage_session_tmp_dirs()
  - Dontaudit useradd_t sys_ptrace BZ(1480121)
  - Allow ipsec_t can exec ipsec_exec_t
  - Allow systemd_logind_t to mamange session_dbusd_tmp_t dirs


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-279
changelog:
  - Allow abrt_dump_oops_t to read sssd_public_t files
  - Allow cockpit_ws_t to mmap usr_t files
  - Allow systemd to read/write dri devices.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-280
changelog:
  - Add rules fixing installing ipa-server-install with SELinux in Enforcing. BZ(1488404)
  - Fix denials during ipa-server-install process on F27+
  - Allow httpd_t to mmap cert_t
  - Add few rules to make tlp_t domain working in enforcing mode
  - Allow cloud_init_t to dbus chat with systemd_timedated_t
  - Allow logrotate_t to write to kmsg
  - Add capability kill to rhsmcertd_t
  - Allow winbind to manage smbd_tmp_t files
  - Allow groupadd_t domain to dbus chat with systemd.BZ(1488404)
  - Add interface miscfiles_map_generic_certs()


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-282
changelog:
  - Add new bunch of map rules
  - Merge pull request #25 from NetworkManager/nm-ovs
  - Make working webadm_t userdomain
  - Allow redis domain to execute shell scripts.
  - Allow system_cronjob_t to create redhat-access-insights.log with var_log_t
  - Add couple capabilities to keepalived domain and allow get attributes of all domains
  - Allow dmidecode read rhsmcertd lock files
  - Add new interface rhsmcertd_rw_lock_files()
  - Add new bunch of map rules
  - Merge pull request #199 from mscherer/add_conntrackd
  - Add support labeling for vmci and vsock device
  - Add userdom_dontaudit_manage_admin_files() interface


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-283
changelog:
  - Allow passwd_t domain mmap /etc/shadow and /etc/passwd
  - Allow pulseaudio_t domain to map user tmp files
  - Allow mozilla plugin to mmap mozilla tmpfs files


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-284
changelog:
  - Allow mozilla_plugins_t domain mmap mozilla_plugin_tmpfs_t files
  - Allow automount domain to manage mount pid files
  - Allow stunnel_t domain setsched
  - Add keepalived domain setpgid capability
  - Merge pull request #24 from teg/rawhide
  - Merge pull request #28 from lslebodn/revert_1e8403055
  - Allow sysctl_irq_t assciate with proc_t
  - Enable cgourp sec labeling
  - Allow sshd_t domain to send signull to xdm_t processes


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-286
changelog:
  - Add new boolean tomcat_read_rpm_db()
  - Allow tomcat to connect on mysqld tcp ports
  - Add new interface apache_delete_tmp()
  - Add interface fprintd_exec()
  - Add interface fprintd_mounton_var_lib()
  - Allow mozilla plugin to mmap video devices BZ(1492580)
  - Add ctdbd_t domain sys_source capability and allow setrlimit
  - Allow systemd-logind to use ypbind
  - Allow systemd to remove apache tmp files
  - Allow ldconfig domain to mmap ldconfig cache files
  - Allow systemd to exec fprintd BZ(1491808)
  - Allow systemd to mounton fprintd lib dir


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-287
changelog:
  - Allow init noatsecure httpd_t
  - Allow mysqld_t domain to mmap mysqld db files. BZ(1483331)
  - Allow unconfined_t domain to create new users with proper SELinux lables
  -  Allow init noatsecure httpd_t
  - Label tcp port 3269 as ldap_port_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-289
changelog:
  - Allow tlp_t domain stream connect to sssd_t domain
  - Add missing dac_override capability
  - Add systemd_tmpfiles_t dac_override capability


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-290
changelog:
  - Allow virtlogd_t domain to write inhibit systemd pipes.
  - Add dac_override capability to openvpn_t domain
  - Add dac_override capability to xdm_t domain
  - Allow dac_override to groupadd_t domain BZ(1497081)
  - Allow cloud-init to create /var/run/cloud-init dir with net_conf_t SELinux label.BZ(1489166)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-292
changelog:
  - Allow cupsd_t to execute ld_so_cache_t BZ(1478602)
  - Allow firewalld_t domain to change object identity because of relabeling after using firewall-cmd BZ(1469806)
  - Allow postfix_cleanup_t domain to stream connect to all milter sockets BZ(1436026)
  - Allow nsswitch_domain to read virt_var_lib_t files, because of libvirt NSS plugin. BZ(1487531)
  - Add unix_stream_socket recvfrom perm for init_t domain BZ(1496318)
  - Allow systemd to maange sysfs BZ(1471361)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-294
changelog:
  - Allow cloud-init to create content in /var/run/cloud-init
  - Dontaudit VM to read gnome-boxes process data BZ(1415975)
  - Allow winbind_t domain mmap samba_var_t files
  - Allow cupsd_t to execute ld_so_cache_t BZ(1478602)
  - Update dev_rw_xserver_misc() interface to allo source domains to mmap xserver devices BZ(1334035)
  - Add dac_override capability to groupadd_t domain BZ(1497091)
  - Allow unconfined_service_t to start containers


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-295
changelog:
  - Allow boinc_t to mmap files with label boinc_project_var_lib_t BZ(1500088)
  - Allow fail2ban_t domain to mmap journals. BZ(1500089)
  - Add dac_override to abrt_t domain BZ(1499860)
  - Allow pppd domain to mmap own pid files BZ(1498587)
  - Allow webserver services to mmap files with label httpd_sys_content_t BZ(1498451)
  - Allow tlp domain to read sssd public files Allow tlp domain to mmap kernel modules
  - Allow systemd to read sysfs sym links. BZ(1499327)
  - Allow systemd to mmap systemd_networkd_exec_t files BZ(1499863)
  - Make systemd_networkd_var_run as mountpoint BZ(1499862)
  - Allow noatsecure for java-based unconfined services. BZ(1358476)
  - Allow systemd_modules_load_t domain to mmap kernel modules. BZ(1490015)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-296
changelog:
  - Merge pull request #19 from RodrigoQuesadaDev/snapper-fix-1
  - Allow httpd_t domain to mmap httpd_user_content_t files. BZ(1494852)
  - Add nnp transition rule for services using NoNewPrivileges systemd feature
  - Add map permission into dev_rw_infiniband_dev() interface to allow caller domain mmap infiniband chr device BZ(1500923)
  - Add init_nnp_daemon_domain interface
  - Allow nnp transition capability
  - Merge pull request #204 from konradwilk/rhbz1484908
  - Label postgresql-check-db-dir as postgresql_exec_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-297
changelog:
  - Fix typo in virt file contexts file
  - allow ipa_dnskey_t to read /proc/net/unix file
  - Allow openvswitch to run setfiles in setfiles_t domain.
  - Allow openvswitch_t domain to read process data of neutron_t domains
  - Fix typo in ipa_cert_filetrans_named_content() interface
  - Fix typo bug in summary of xguest SELinux module
  - Allow virtual machine with svirt_t label to stream connect to openvswitch.
  - Label qemu-pr-helper script as virt_exec_t so this script won't run as unconfined_service_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-298
changelog:
  - Drop *.lst files from file list
  - Ship file_contexts.homedirs in store
  - Allow proper transition when systems starting pdns to pdns_t domain. BZ(1305522)
  - Allow haproxy daemon to reexec itself. BZ(1447800)
  - Allow conmand to use usb ttys.
  - Allow systemd_machined to read mock lib files. BZ(1504493)
  - Allow systemd_resolved_t to dbusd chat with NetworkManager_t BZ(1505081)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-299
changelog:
  - Label /usr/libexec/bluetooth/obexd as bluetoothd_exec_t to run process as bluetooth_t
  - Allow chronyd_t do request kernel module and block_suspend capability
  - Allow system_cronjob_t to create /var/lib/letsencrypt dir with right label
  - Allow slapd_t domain to mmap files labeled as slpad_db_t BZ(1505414)
  - Allow dnssec_trigger_t domain to execute binaries with dnssec_trigeer_exec_t BZ(1487912)
  - Allow l2tpd_t domain to send SIGKILL to ipsec_mgmt_t domains BZ(1505220)
  - Allow thumb_t creating thumb_home_t files in user_home_dir_t direcotry BZ(1474110)
  - Allow httpd_t also read httpd_user_content_type dirs when httpd_enable_homedirs is enables
  - Allow svnserve to use kerberos
  - Allow conman to use ptmx. Add conman_use_nfs boolean
  - Allow nnp transition for amavis and tmpreaper SELinux domains
  - Allow chronyd_t to mmap chronyc_exec_t binary files
  - Add dac_read_search capability to openvswitch_t domain
  - Allow svnserve to manage own svnserve_log_t files/dirs
  - Allow keepalived_t to search network sysctls
  - Allow puppetagent_t domain dbus chat with rhsmcertd_t domain
  - Add kill capability to openvswitch_t domain
  - Label also compressed logs in /var/log for different services
  - Allow inetd_child_t and system_cronjob_t to run chronyc.
  - Allow chrony to create netlink route sockets
  - Add SELinux support for chronyc
  - Add support for running certbot(letsencrypt) in crontab
  - Allow nnp trasintion for unconfined_service_t
  - Allow unpriv user domains and unconfined_service_t to use chronyc


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-300
changelog:
  - Allow zabbix_t domain to change its resource limits
  - Add new boolean nagios_use_nfs
  - Allow system_mail_t to search network sysctls
  - Hide all allow rules with ptrace inside deny_ptrace boolean
  - Allow nagios_script_t to read nagios_spool_t files
  - Allow sbd_t to create own sbd_tmpfs_t dirs/files
  - Allow firewalld and networkmanager to chat with hypervkvp via dbus
  - Allow dmidecode to read rhsmcert_log_t files
  - Allow mail system to connect mariadb sockets.
  - Allow nmbd_t domain to mmap files labeled as samba_var_t. BZ(1505877)
  - Make user account setup in gnome-initial-setup working in Workstation Live system. BZ(1499170)
  - Allow iptables_t to run setfiles to restore context on system
  - Updatre unconfined_dontaudit_read_state() interface to dontaudit also acess to files. BZ(1503466)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-301
changelog:
  - Merge pull request #37 from milosmalik/rawhide
  - Allow mozilla_plugin_t domain to dbus chat with devicekit
  - Dontaudit leaked logwatch pipes
  - Label /usr/bin/VGAuthService as vmtools_exec_t to confine this daemon.
  - Allow httpd_t domain to execute hugetlbfs_t files BZ(1444546)
  - Allow chronyd daemon to execute chronyc. BZ(1507478)
  - Allow pdns to read network system state BZ(1507244)
  - Allow gssproxy to read network system state Resolves: rhbz#1507191
  - Allow nfsd_t domain to read configfs_t files/dirs
  - Allow tgtd_t domain to read generic certs
  - Allow ptp4l to send msgs via dgram socket to unprivileged user domains
  - Allow dirsrv_snmp_t to use inherited user ptys and read system state
  - Allow glusterd_t domain to create own tmpfs dirs/files
  - Allow keepalived stream connect to snmp


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-302
changelog:
  - Allow jabber domains to connect to postgresql ports
  - Dontaudit slapd_t to block suspend system
  - Allow spamc_t to stream connect to cyrys.
  - Allow passenger to connect to mysqld_port_t
  - Allow ipmievd to use nsswitch
  - Allow chronyc_t domain to use user_ptys
  - Label all files /var/log/opensm.* as opensm_log_t because opensm creating new log files with name opensm-subnet.lst
  - Fix typo bug in tlp module
  - Allow userdomain gkeyringd domain to create stream socket with userdomain


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-303
changelog:
  - Allow pcp_pmlogger to send logs to journal BZ(1512367)
  - Merge pull request #40 from lslebodn/kcm_kerberos
  - Allow services to use kerberos KCM BZ(1512128)
  - Allow system_mail_t domain to be system_dbus_client BZ(1512476)
  - Allow aide domain to stream connect to sssd_t BZ(1512500)
  - Allow squid_t domain to mmap files with label squid_tmpfs_t BZ(1498809)
  - Allow nsd_t domain to mmap files with labels nsd_tmp_t and nsd_zone_t BZ(1511269)
  - Include cupsd_config_t domain into cups_execmem boolean. BZ(1417584)
  - Allow samba_net_t domain to mmap samba_var_t files BZ(1512227)
  - Allow lircd_t domain to execute shell BZ(1512787)
  - Allow thumb_t domain to setattr on cache_home_t dirs BZ(1487814)
  - Allow redis to creating tmp files with own label BZ(1513518)
  - Create new interface thumb_nnp_domtrans allowing domaintransition with NoNewPrivs. This interface added to thumb_run() BZ(1509502)
  - Allow httpd_t to mmap httpd_tmp_t files BZ(1502303)
  - Add map permission to samba_rw_var_files interface. BZ(1513908)
  - Allow cluster_t domain creating bundles directory with label var_log_t instead of cluster_var_log_t
  - Add dac_read_search and dac_override capabilities to ganesha
  - Allow ldap_t domain to manage also slapd_tmp_t lnk files
  - Allow snapperd_t domain to relabeling from snapperd_data_t BZ(1510584)
  - Add dac_override capability to dhcpd_t doamin BZ(1510030)
  - Allow snapperd_t to remove old snaps BZ(1510862)
  - Allow chkpwd_t domain to mmap system_db_t files and be dbus system client BZ(1513704)
  - Allow xdm_t send signull to all xserver unconfined types BZ(1499390)
  - Allow fs associate for sysctl_vm_t BZ(1447301)
  - Label /etc/init.d/vboxdrv as bin_t to run virtualbox as unconfined_service_t BZ(1451479)
  - Allow xdm_t domain to read usermodehelper_t state BZ(1412609)
  - Allow dhcpc_t domain to stream connect to userdomain domains BZ(1511948)
  - Allow systemd to mmap kernel modules BZ(1513399)
  - Allow userdomains to mmap fifo_files BZ(1512242)
  - Merge pull request #205 from rhatdan/labels
  - Add map permission to init_domtrans() interface BZ(1513832)
  - Allow xdm_t domain to mmap and execute files in xdm_var_run_t BZ(1513883)
  - Unconfined domains, need to create content with the correct labels
  - Container runtimes are running iptables within a different user namespace
  - Add interface files_rmdir_all_dirs()


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-304
changelog:
  - Add interface raid_relabel_mdadm_var_run_content()
  - Fix iscsi SELinux module
  - Allow spamc_t domain to read home mail content BZ(1414366)
  - Allow sendmail_t to list postfix config dirs BZ(1514868)
  - Allow dovecot_t domain to mmap mail content in homedirs BZ(1513153)
  - Allow iscsid_t domain to requesting loading kernel modules BZ(1448877)
  - Allow svirt_t domain to mmap svirt_tmpfs_t files BZ(1515304)
  - Allow cupsd_t domain to localization BZ(1514350)
  - Allow antivirus_t nnp domain transition because of systemd security features. BZ(1514451)
  - Allow tlp_t domain transition to systemd_rfkill_t domain BZ(1416301)
  - Allow abrt_t domain to mmap fusefs_t files BZ(1515169)
  - Allow memcached_t domain nnp_transition becuase of systemd security features BZ(1514867)
  - Allow httpd_t domain to mmap all httpd content type BZ(1514866)
  - Allow mandb_t to read /etc/passwd BZ(1514903)
  - Allow mandb_t domain to mmap files with label mandb_cache_t BZ(1514093)
  - Allow abrt_t domain to mmap files with label syslogd_var_run_t BZ(1514975)
  - Allow nnp transition for systemd-networkd daemon to run in proper SELinux domain BZ(1507263)
  - Allow systemd to read/write to mount_var_run_t files BZ(1515373)
  - Allow systemd to relabel mdadm_var_run_t sock files BZ(1515373)
  - Allow home managers to mmap nfs_t files BZ(1514372)
  - Add interface fs_mmap_nfs_files()
  - Allow systemd-mount to create new directory for mountpoint BZ(1514880)
  - Allow getty to use usbttys
  - Add interface systemd_rfkill_domtrans()
  - Allow syslogd_t to mmap files with label syslogd_var_lib_t BZ(1513403)
  - Add interface fs_mmap_fusefs_files()
  - Allow ipsec_t domain to mmap files with label ipsec_key_file_t BZ(1514251)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-306
changelog:
  - Allow thumb_t domain to dosfs_t BZ(1517720)
  - Allow gssd_t to read realmd_var_lib_t files BZ(1521125)
  - Allow domain transition from logrotate_t to chronyc_t BZ(1436013)
  - Allow git_script_t to mmap git_sys_content_t BZ(1517541)
  - Label /usr/bin/mysqld_safe_helper as mysqld_exec_t instead of bin_t BZ(1464803)
  - Label /run/openvpn-server/ as openvpn_var_run_t BZ(1478642)
  - Allow colord_t to mmap xdm pid files BZ(1518382)
  - Allow arpwatch to mmap usbmon device BZ(152456)
  - Allow mandb_t to read public sssd files BZ(1514093)
  - Allow ypbind_t stream connect to rpcbind_t domain BZ(1508659)
  - Allow qpid to map files.
  - Allow plymouthd_t to mmap firamebuf device BZ(1517405)
  - Dontaudit pcp_pmlogger_t to sys_ptrace capability BZ(1416611)
  - Update mta_manage_spool() interface to allow caller domain also mmap mta_spool_t files BZ(1517449)
  - Allow antivirus_t domain to mmap antivirus_db_t files BZ(1516816)
  - Allow cups_pdf_t domain to read cupd_etc_t dirs BZ(1516282)
  - Allow openvpn_t domain to relabel networkmanager tun device BZ(1436048)
  - Allow mysqld_t to mmap mysqld_tmp_t files BZ(1516899)
  - Update samba_manage_var_files() interface by adding map permission. BZ(1517125)
  - Allow pcp_pmlogger_t domain to execute itself. BZ(1517395)
  - Dontaudit sys_ptrace capability for mdadm_t BZ(1515849)
  - Allow pulseaudio_t domain to mmap pulseaudio_home_t files BZ(1515956)
  - Allow bugzilla_script_t domain to create netlink route sockets and udp sockets BZ(1427019)
  - Add interface fs_map_dos_files()
  - Update interface userdom_manage_user_home_content_files() to allow caller domain to mmap user_home_t files. BZ(1519729)
  - Add interface xserver_map_xdm_pid() BZ(1518382)
  - Add new interface dev_map_usbmon_dev() BZ(1524256)
  - Update miscfiles_read_fonts() interface to allow also mmap fonts_cache_t for caller domains BZ(1521137)
  - Allow ipsec_t to mmap cert_t and home_cert_t files BZ(1519810)
  - Fix typo in filesystem.if
  - Add interface dev_map_framebuffer()
  - Allow chkpwd command to mmap /etc/shadow BZ(1513704)
  - Fix systemd-resolved to run properly with SELinux in enforcing state BZ(1517529)
  - Allow thumb_t domain to mmap fusefs_t files BZ(1517517)
  - Allow userdom_home_reader_type attribute to mmap cifs_t files BZ(1517125)
  - Add interface fs_map_cifs_files()
  - Merge pull request #207 from rhatdan/labels
  - Merge pull request #208 from rhatdan/logdir
  - Allow domains that manage logfiles to man logdirs


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-307
changelog:
  - Allow crond_t to read pcp lib files BZ(1525420)
  - Allow mozilla plugin domain to mmap user_home_t files BZ(1452783)
  - Allow certwatch_t to mmap generic certs. BZ(1527173)
  - Allow dspam_t to manage dspam_rw_conent_t objects. BZ(1290876)
  - Add interface userdom_map_user_home_files()
  - Sytemd introduced new feature when journald(syslogd_t) is trying to read symlinks to unit files in /run/systemd/units. This commit label /run/systemd/units/* as systemd_unit_file_t and allow syslogd_t to read this content. BZ(1527202)
  - Allow xdm_t dbus chat with modemmanager_t BZ(1526722)
  - All domains accessing home_cert_t objects should also mmap it. BZ(1519810)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-308
changelog:
  - Make working SELinux sandbox with Wayland. BZ(1474082)
  - Allow postgrey_t domain to mmap postgrey_spool_t files BZ(1529169)
  - Allow dspam_t to mmap dspam_rw_content_t files BZ(1528723)
  - Allow collectd to connect to lmtp_port_t BZ(1304029)
  - Allow httpd_t to mmap httpd_squirrelmail_t files BZ(1528776)
  - Allow thumb_t to mmap removable_t files. BZ(1522724)
  - Allow sssd_t and login_pgm attribute to mmap auth_cache_t files BZ(1530118)
  - Add interface fs_mmap_removable_files()


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-309
changelog:
  - auth_use_nsswitch() interface cannot be used for attributes fixing munin policy
  - Allow git_script_t to mmap git_user_content_t files BZ(1530937)
  - Allow certmonger domain to create temp files BZ(1530795)
  - Improve interface mock_read_lib_files() to include also symlinks. BZ(1530563)
  - Allow fsdaemon_t to read nvme devices BZ(1530018)
  - Dontaudit fsdaemon_t to write to admin homedir. BZ(153030)
  - Update munin plugin policy BZ(1528471)
  - Allow sendmail_t domain to be system dbusd client BZ(1478735)
  - Allow amanda_t domain to getattr on tmpfs filesystem BZ(1527645)
  - Allow named file transition to create rpmrebuilddb dir with proper SELinux context BZ(1461313)
  - Dontaudit httpd_passwd_t domain to read state of systemd BZ(1522672)
  - Allow thumb_t to mmap non security files BZ(1517393)
  - Allow smbd_t to mmap files with label samba_share_t BZ(1530453)
  - Fix broken sysnet_filetrans_named_content() interface
  - Allow init_t to create tcp sockets for unconfined services BZ(1366968)
  - Allow xdm_t to getattr on xserver_t process files BZ(1506116)
  - Allow domains which can create resolv.conf file also create it in systemd_resolved_var_run_t dir BZ(1530297)
  - Allow X userdomains to send dgram msgs to xserver_t BZ(1515967)
  - Add interface files_map_non_security_files()


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-310
changelog:
  - Use python3 package in BuildRequires to ensure python version 3 will be used for compiling SELinux policy


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-1
changelog:
  - Removed big SELinux policy patches against tresys refpolicy and use tarballs from fedora-selinux github organisation


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-2
changelog:
  - Allow aide to mmap usr_t files BZ(1534182)
  - Allow ypserv_t domain to connect to tcp ports BZ(1534245)
  - Allow vmtools_t domain creating vmware_log_t files
  - Allow openvswitch_t domain to acces infiniband devices
  - Allow dirsrv_t domain to create tmp link files
  - Allow pcp_pmie_t domain to exec itself. BZ(153326)
  - Update openvswitch SELinux module
  - Allow virtd_t to create also sock_files with label virt_var_run_t
  - Allow chronyc_t domain to manage chronyd_keys_t files.
  - Allow logwatch to exec journal binaries BZ(1403463)
  - Allow sysadm_t and staff_t roles to manage user systemd services BZ(1531864)
  - Update logging_read_all_logs to allow mmap all logfiles BZ(1403463)
  - Add Label systemd_unit_file_t for /var/run/systemd/units/


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-3
changelog:
  - Merge pull request #45 from jlebon/pr/rot-sd-dbus-rawhide
  - Allow virt_domains to acces infiniband pkeys.
  - Allow systemd to relabelfrom tmpfs_t link files in /var/run/systemd/units/ BZ(1535180)
  - Label /usr/libexec/ipsec/addconn as ipsec_exec_t to run this script as ipsec_t instead of init_t
  - Allow audisp_remote_t domain write to files on all levels


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-4
changelog:
  - rpm: Label /usr/share/rpm usr_t (ostree/Atomic systems)
  - Update dbus_role_template() BZ(1536218)
  - Allow lldpad_t domain to mmap own tmpfs files BZ(1534119)
  - Allow blueman_t dbus chat with policykit_t BZ(1470501)
  - Expand virt_read_lib_files() interface to allow list dirs with label virt_var_lib_t BZ(1507110)
  - Allow postfix_master_t and postfix_local_t to connect to system dbus. BZ(1530275)
  - Allow system_munin_plugin_t domain to read sssd public files and allow stream connect to ssd daemon BZ(1528471)
  - Allow rkt_t domain to bind on rkt_port_t tcp BZ(1534636)
  - Allow jetty_t domain to mmap own temp files BZ(1534628)
  - Allow sslh_t domain to read sssd public files and stream connect to sssd. BZ(1534624)
  - Consistently label usr_t for kernel/initrd in /usr
  - kernel/files.fc: Label /usr/lib/sysimage as usr_t
  - Allow iptables sysctl load list support with SELinux enforced
  - Label HOME_DIR/.config/systemd/user/* user unit files as systemd_unit_file_t BZ(1531864)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-6
changelog:
  - Allow openvswitch_t domain to read cpuid, write to sysfs files and creating openvswitch_tmp_t sockets
  - Add new interface ppp_filetrans_named_content()
  - Allow keepalived_t read sysctl_net_t files
  - Allow puppetmaster_t domtran to puppetagent_t
  - Allow kdump_t domain to read kernel ring buffer
  - Allow boinc_t to mmap boinc tmpfs files BZ(1540816)
  - Merge pull request #47 from masatake/keepalived-signal
  - Allow keepalived_t create and write a file under /tmp
  - Allow ipsec_t domain to exec ifconfig_exec_t binaries.
  - Allow unconfined_domain_typ to create pppd_lock_t directory in /var/lock
  - Allow updpwd_t domain to create files in /etc with shadow_t label


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-7
changelog:
  - Label /usr/sbin/ldap-agent as dirsrv_snmp_exec_t
  - Allow certmonger_t domain to access /etc/pki/pki-tomcat BZ(1542600)
  - Allow keepalived_t domain getattr proc filesystem
  - Allow init_t to create UNIX sockets for unconfined services (BZ1543049)
  - Allow ipsec_mgmt_t execute ifconfig_exec_t binaries Allow ipsec_mgmt_t nnp domain transition to ifconfig_t
  - Allow ipsec_t nnp transistions to domains ipsec_mgmt_t and ifconfig_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-9
changelog:
  - Fix broken cups Security Module
  - Allow dnsmasq_t domain dbus chat with unconfined users. BZ(1532079)
  - Allow geoclue to connect to tcp nmea port BZ(1362118)
  - Allow pcp_pmcd_t to read mock lib files BZ(1536152)
  - Allow abrt_t domain to mmap passwd file BZ(1540666)
  - Allow gpsd_t domain to get session id of another process BZ(1540584)
  - Allow httpd_t domain to mmap httpd_tmpfs_t files BZ(1540405)
  - Allow cluster_t dbus chat with systemd BZ(1540163)
  - Add interface raid_stream_connect()
  - Allow nscd_t to mmap nscd_var_run_t files BZ(1536689)
  - Allow dovecot_delivery_t to mmap mail_home_rw_t files BZ(1531911)
  - Make cups_pdf_t domain system dbusd client BZ(1532043)
  - Allow logrotate to read auditd_log_t files BZ(1525017)
  - Improve snapperd SELinux policy BZ(1514272)
  - Allow virt_domain to read virt_image_t files BZ(1312572)
  - Allow openvswitch_t stream connect svirt_t
  - Update dbus_dontaudit_stream_connect_system_dbusd() interface
  - Allow openvswitch domain to manage svirt_tmp_t sock files
  - Allow named_filetrans_domain domains to create .heim_org.h5l.kcm-socket sock_file with label sssd_var_run_t BZ(1538210)
  - Merge pull request #50 from dodys/pkcs
  - Label tcp and udp ports 10110 as nmea_port_t BZ(1362118)
  - Allow systemd to access rfkill lib dirs BZ(1539733)
  - Allow systemd to mamange raid var_run_t sockfiles and files BZ(1379044)
  - Allow vxfs filesystem to use SELinux labels
  - Allow systemd to setattr on systemd_rfkill_var_lib_t dirs BZ(1512231)
  - Allow few services to dbus chat with snapperd BZ(1514272)
  - Allow systemd to relabel system unit symlink to systemd_unit_file_t. BZ(1535180)
  - Fix logging as staff_u into Fedora 27
  - Fix broken systemd_tmpfiles_run() interface


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-10
changelog:
  - refpolicy: Define extended_socket_class policy capability and socket classes
  - Make bluetooth_var_lib_t as mountpoint BZ(1547416)
  - Allow systemd to request load kernel module BZ(1547227)
  - Allow ipsec_t domain to read l2tpd pid files
  - Allow sysadm to read/write trace filesystem BZ(1547875)
  - Allow syslogd_t to mmap systemd coredump tmpfs files BZ(1547761)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-11
changelog:
  - Allow vdagent_t domain search cgroup dirs BZ(1541564)
  - Allow bluetooth_t domain listen on bluetooth sockets BZ(1549247)
  - Allow bluetooth domain creating bluetooth sockets BZ(1551577)
  - pki_log_t should be log_file
  - Allow gpgdomain to unix_stream socket connectto
  - Make working gpg agent in gpg_agent_t domain
  - Dontaudit thumb_t to rw lvm pipes BZ(154997)
  - Allow start cups_lpd via systemd socket activation BZ(1532015)
  - Improve screen_role_template Resolves: rhbz#1534111
  - Dontaudit modemmanager to setpgid. BZ(1520482)
  - Dontaudit kernel bug when systemd requesting load kernel module BZ(1547227)
  - Allow systemd-networkd to create netlink generic sockets BZ(1551578)
  - refpolicy: Define getrlimit permission for class process
  - refpolicy: Define smc_socket security class
  - Allow transition from sysadm role into mdadm_t domain.
  - ssh_t trying to communicate with gpg agent not sshd_t
  - Allow sshd_t communicate with gpg_agent_t
  - Allow initrc domains to mmap binaries with direct_init_entry attribute BZ(1545643)
  - Revert "Allow systemd_rfkill_t domain to reguest kernel load module BZ(1543650)"
  - Revert "Allow systemd to request load kernel module BZ(1547227)"
  - Allow systemd to write to all pidfile socketes because of SocketActivation unit option ListenStream= BZ(1543576)
  - Add interface lvm_dontaudit_rw_pipes() BZ(154997)
  - Add interfaces for systemd socket activation
  - Allow systemd-resolved to create stub-resolv.conf with right label net_conf_t BZ(1547098)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-12
changelog:
  - Allow l2tpd_t domain to create pppox sockets
  - Update dbus_system_bus_client() so calling domain could read also system_dbusd_var_lib_t link files BZ(1544251)
  - Add interface abrt_map_cache()
  - Update gnome_manage_home_config() to allow also map permission BZ(1544270)
  - Allow oddjob_mkhomedir_t domain to be dbus system client BZ(1551770)
  - Dontaudit kernel bug when several services requesting load kernel module
  - Allow traceroute and unconfined domains creating sctp sockets
  - Add interface corenet_sctp_bind_generic_node()
  - Allow ping_t domain to create icmp sockets
  - Allow staff_t to mmap abrt_var_cache_t BZ(1544273)
  - Fix typo bug in dev_map_framebuffer() interface BZ(1551842)
  - Dontaudit kernel bug when several services requesting load kernel module


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-13
changelog:
  - allow bluetooth_t domain to create alg_socket bz(1554410)
  - allow tor_t domain to execute bin_t files bz(1496274)
  - allow iscsid_t domain to mmap kernel modules bz(1553759)
  - update minidlna selinux policy bz(1554087)
  - allow motion_t domain to read sysfs_t files bz(1554142)
  - allow snapperd_t domain to getattr on all files,dirs,sockets,pipes bz(1551738)
  - allow l2tp_t domain to read ipsec config files bz(1545348)
  - allow colord_t to mmap home user files bz(1551033)
  - dontaudit httpd_t creating kobject uevent sockets bz(1552536)
  - allow ipmievd_t to mmap kernel modules bz(1552535)
  - allow boinc_t domain to read cgroup files bz(1468381)
  - backport allow rules from refpolicy upstream repo
  - allow gpg_t domain to bind on all unereserved udp ports
  - allow systemd to create systemd_rfkill_var_lib_t dirs bz(1502164)
  - allow netlabel_mgmt_t domain to read sssd public files, stream connect to sssd_t bz(1483655)
  - allow xdm_t domain to sys_ptrace bz(1554150)
  - allow application_domain_type also mmap inherited user temp files bz(1552765)
  - update ipsec_read_config() interface
  - fix broken sysadm selinux module
  - allow ipsec_t to search for bind cache bz(1542746)
  - allow staff_t to send sigkill to mount_t domain bz(1544272)
  - label /run/systemd/resolve/stub-resolv.conf as net_conf_t bz(1471545)
  - label ip6tables.init as iptables_exec_t bz(1551463)
  - allow hostname_t to use usb ttys bz(1542903)
  - add fsetid capability to updpwd_t domain bz(1543375)
  - allow systemd machined send signal to all domains bz(1372644)
  - dontaudit create netlink selinux sockets for unpriv selinux users bz(1547876)
  - allow sysadm_t to create netlink generic sockets bz(1547874)
  - allow passwd_t domain chroot
  - dontaudit confined unpriviliged users setuid capability


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-14
changelog:
  - Allow rpcd_t domain dac override
  - Allow rpm domain to mmap rpm_var_lib_t files
  - Allow arpwatch domain to create bluetooth sockets
  - Allow secadm_t domain to mmap audit config and log files
  - Update init_abstract_socket_activation() to allow also creating tcp sockets
  - getty_t should be ranged in MLS. Then also local_login_t runs as ranged domain.
  - Add SELinux support for systemd-importd
  - Create new type bpf_t and label /sys/fs/bpf with this type


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-15
changelog:
  - Update screen_role_template() to allow also creating sockets in HOMEDIR/screen/
  - Allow newrole_t dacoverride capability
  - Allow traceroute_t domain to mmap packet sockets
  - Allow netutils_t domain to mmap usmmon device
  - Allow netutils_t domain to use mmap on packet_sockets
  - Allow traceroute to create icmp packets
  - Allos sysadm_t domain to create tipc sockets
  - Allow confined users to use new socket classes for bluetooth, alg and tcpdiag sockets


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-16
changelog:
  - Improve bluetooth_stream_socket interface to allow caller domain also send bluetooth sockets
  - Allow tcpd_t bind on sshd_port_t if ssh_use_tcpd() is enabled
  - Allow semanage_t domain mmap usr_t files
  - Add new boolean: ssh_use_tcpd()


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-17
changelog:
  - Allow smbcontrol_t to mmap samba_var_t files and allow winbind create sockets BZ(1559795)
  - Allow nagios to exec itself and mmap nagios spool files BZ(1559683)
  - Allow nagios to mmap nagios config files BZ(1559683)
  - Fixing Ganesha module
  - Fix typo in NetworkManager module
  - Fix bug in gssproxy SELinux module
  - Allow abrt_t domain to mmap container_file_t files BZ(1525573)
  - Allow networkmanager to be run ssh client BZ(1558441)
  - Allow pcp domains to do dc override BZ(1557913)
  - Dontaudit pcp_pmie_t to reaquest lost kernel module
  - Allow pcp_pmcd_t to manage unpriv userdomains semaphores BZ(1554955)
  - Allow httpd_t to read httpd_log_t dirs BZ(1554912)
  - Allow fail2ban_t to read system network state BZ(1557752)
  - Allow dac override capability to mandb_t domain BZ(1529399)
  - Allow collectd_t domain to mmap collectd_var_lib_t files BZ(1556681)
  - Dontaudit bug in kernel 4.16 when domains requesting loading kernel modules BZ(1555369)
  - Add Domain transition from gssproxy_t to httpd_t domains BZ(1548439)
  - Allow httpd_t to mmap user_home_type files if boolean httpd_read_user_content is enabled BZ(1555359)
  - Allow snapperd to relabel snapperd_data_t
  - Improve bluetooth_stream_socket interface to allow caller domain also send bluetooth sockets
  - Allow tcpd_t bind on sshd_port_t if ssh_use_tcpd() is enabled
  - Allow insmod_t to load modules BZ(1544189)
  - Allow systemd_rfkill_t domain sys_admin capability BZ(1557595)
  - Allow systemd_networkd_t to read/write tun tap devices
  - Add shell_exec_t file as domain entry for init_t
  - Label also /run/systemd/resolved/ as systemd_resolved_var_run_t BZ(1556862)
  - Dontaudit kernel 4.16 bug when lot of domains requesting load kernel module BZ(1557347)
  - Improve userdom_mmap_user_home_content_files
  - Allow systemd_logind_t domain to setattributes on fixed disk devices BZ(1555414)
  - Dontaudit kernel 4.16 bug when lot of domains requesting load kernel module
  - Allow semanage_t domain mmap usr_t files
  - Add new boolean: ssh_use_tcpd()


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-18
changelog:
  Fedora Atomic host using for temp files /sysroot/tmp patch, we should label same as /tmp adding file context equivalence BZ(1559531)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-19
changelog:
  - Allow accountsd_t domain to dac override BZ(1561304)
  - Allow cockpit_ws_t domain to read system state BZ(1561053)
  - Allow postfix_map_t domain to use inherited user ptys BZ(1561295)
  - Allow abrt_dump_oops_t domain dac override BZ(1561467)
  - Allow l2tpd_t domain to run stream connect for sssd_t BZ(1561755)
  - Allow crontab domains to do dac override
  - Allow snapperd_t domain to unmount fs_t filesystems
  - Allow pcp processes to read fixed_disk devices BZ(1560816)
  - Allow unconfined and confined users to use dccp sockets
  - Allow systemd to manage bpf dirs/files
  - Allow traceroute_t to create dccp_sockets


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-20
changelog:
  - Add new boolean redis_enable_notify()
  - Label  /var/log/shibboleth-www(/.*) as httpd_sys_rw_content_t
  - Add new label for vmtools scripts and label it as vmtools_unconfined_t stored in /etc/vmware-tools/
  - Allow svnserve_t domain to manage kerberos rcache and read krb5 keytab
  - Add dac_override and dac_read_search capability to hypervvssd_t domain
  - Label /usr/lib/systemd/systemd-fence_sanlockd as fenced_exec_t
  - Allow samba to create /tmp/host_0 as krb5_host_rcache_t
  - Add dac_override capability to fsdaemon_t BZ(1564143)
  - Allow abrt_t domain to map dos files BZ(1564193)
  - Add dac_override capability to automount_t domain
  - Allow keepalived_t domain to connect to system dbus bus
  - Allow nfsd_t to read nvme block devices BZ(1562554)
  - Allow lircd_t domain to execute bin_t files BZ(1562835)
  - Allow l2tpd_t domain to read sssd public files BZ(1563355)
  - Allow logrotate_t domain to do dac_override BZ(1539327)
  - Remove labeling for /etc/vmware-tools to bin_t it should be vmtools_unconfined_exec_t
  - Add capability sys_resource to systemd_sysctl_t domain
  - Label all /dev/rbd* devices as fixed_disk_device_t
  - Allow xdm_t domain to mmap xserver_log_t files BZ(1564469)
  - Allow local_login_t domain to rread udev db
  - Allow systemd_gpt_generator_t to read /dev/random device
  - add definition of bpf class and systemd perms


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-21
changelog:
  - Allow certwatch to manage cert files BZ(1561418)
  - Allow abrt_dump_oops_t domain to mmap all non security files BZ(1565748)
  - Allow gpg_t domain mmap cert_t files Allow gpg_t mmap gpg_agent_t files
  - Allow NetworkManager_ssh_t domain use generic ptys. BZ(1565851)
  - Allow pppd_t domain read/write l2tpd pppox sockets BZ(1566096)
  - Allow xguest user use bluetooth sockets if xguest_use_bluetooth boolean is turned on.
  - Allow pppd_t domain creating pppox sockets BZ(1566271)
  - Allow abrt to map var_lib_t files
  - Allow chronyc to read system state BZ(1565217)
  - Allow keepalived_t domain to chat with systemd via dbus
  - Allow git to mmap git_(sys|user)_content_t files BZ(1518027)
  - removed boinc dev_getattr_*_dev
  - Allow iptables_t domain to create dirs in etc_t with system_conf_t labels
  - Allow x userdomain to mmap xserver_tmpfs_t files
  - Allow sysadm_t to mount tracefs_t
  - Allow unconfined user all perms under bpf class BZ(1565738)
  - Allow SELinux users (except guest and xguest) to using bluetooth sockets
  - Add new interface files_map_var_lib_files()
  - Allow user_t and staff_t domains create netlink tcpdiag sockets
  - Allow systemd-networkd to read sysctl_t files
  - Allow systemd_networkd_t to read/write tun tap devices
  - refpolicy: Update for kernel sctp support


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-22
changelog:
  - Allow networkmanager domain to write to ecryptfs_t files BZ(1566706)
  - Allow l2tpd domain to stream connect to sssd BZ(1568160)
  - Dontaudit abrt_t to write to lib_t dirs BZ(1566784)
  - Allow NetworkManager_ssh_t domain transition to insmod_t BZ(1567630)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-23
changelog:
  - Allow dnssec_trigger_t domain to read system network state BZ(1570205)
  - Add dac_override capability to mailman_mail_t domain
  - Add dac_override capability to radvd_t domain
  - Update openvswitch policy
  - Add dac_override capability to oddjob_homedir_t domain
  - Allow slapd_t domain to mmap slapd_var_run_t files
  - Rename tang policy to tangd
  - Allow virtd_t domain to relabel virt_var_lib_t files
  - Allow logrotate_t domain to stop services via systemd
  - Add tang policy
  - Allow mozilla_plugin_t to create mozilla.pdf file in user homedir with label mozilla_home_t
  - Allow snapperd_t daemon to create unlabeled dirs.
  - Make httpd_var_run_t mountpoint
  - Allow hsqldb_t domain to mmap own temp files
  - We have inconsistency in cgi templates with upstream, we use _content_t, but refpolicy use httpd__content_t. Created aliasses to make it consistence
  - Allow Openvswitch adding netdev bridge ovs 2.7.2.10 FDP
  - Add new Boolean tomcat_use_execmem
  - Allow nfsd_t domain to read/write sysctl fs files
  - Allow conman to read system state
  - Allow brltty_t domain to be dbusd system client
  - Allow zebra_t domain to bind on babel udp port
  - Allow freeipmi domain to read sysfs_t files
  - Allow targetd_t domain mmap lvm config files
  - Allow abrt_t domain to manage kdump crash files
  - gnome_data_filetrans macro should be in optional block
  - Allow netutils_t domain to create bluetooth sockets
  - Allow traceroute to bind on generic sctp node
  - Allow traceroute to search network sysctls
  - Allow systemd to use virtio console
  - Label /dev/op_panel and /dev/opal-prd as opal_device_t
  - Label /run/ebtables.lock as iptables_var_run_t
  - Allow udev_t domain to manage udev_rules_t char files.
  - Assign babel_port_t label to udp port 6696
  - Add new interface lvm_map_config
  - Merge pull request #212 from stlaz/patch-1
  - Allow local_login_t reads of udev_var_run_t context


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-25
changelog:
  - Add dac_override capability to remote_login_t domain
  - Allow chrome_sandbox_t to mmap tmp files
  - Update ulogd SELinux security policy
  - Allow rhsmcertd_t domain send signull to apache processes
  - Allow systemd socket activation for modemmanager
  - Allow geoclue to dbus chat with systemd
  - Fix file contexts on conntrackd policy
  - Temporary fix for varnish and apache adding capability for DAC_OVERRIDE
  - Allow lsmd_plugin_t domain to getattr lsm_t unix stream sockets
  - Add label for  /usr/sbin/pacemaker-remoted to have cluster_exec_t
  - Allow nscd_t domain to be system dbusd client
  - Allow abrt_t domain to read sysctl
  - Add dac_read_search capability for tangd
  - Allow systemd socket activation for rshd domain
  - Add label for /usr/libexec/cyrus-imapd/master as cyrus_exec_t to have proper SELinux domain transition from init_t to cyrus_t
  - Allow kdump_t domain to map /boot files
  - Allow conntrackd_t domain to send msgs to syslog
  - Label /usr/sbin/nhrpd and /usr/sbin/pimd binaries as zebra_exec_t
  - Allow swnserve_t domain to stream connect to sasl domain
  - Allow smbcontrol_t to create dirs with samba_var_t label
  - Remove execstack,execmem and execheap from domains setroubleshootd_t, locate_t and podsleuth_t to increase security. BZ(1579760)
  - Allow tangd to read public sssd files BZ(1509054)
  - Allow geoclue start with nnp systemd security feature with proper SELinux Domain transition BZ(1575212)
  - Allow ctdb_t domain modify ctdb_exec_t files
  - Allow firewalld_t domain to create netlink_netfilter sockets
  - Allow radiusd_t domain to read network sysctls
  - Allow pegasus_t domain to mount tracefs_t filesystem
  - Allow psad_t domain to read all domains state
  - Allow tomcat_t domain to connect to mongod_t tcp port
  - Allow dovecot and postfix to connect to systemd stream sockets
  - Make nmbd_t domain dbus system client BZ(1569856)
  - Merge pull request #55 from SISheogorath/fix/tlp-policy
  - Merge pull request #54 from tmzullinger/rawhide
  - Allow also listing system_dbusd_var_run_t dirs in dbusd_read_pid_files macro BZ(1566168)
  - Allow gssproxy_t domain to read gssd_t state BZ(1572945)
  - Allow create systemd to mount pid files
  - Add files_map_boot_files() interface
  - Remove execstack,execmem and execheap from domain fsadm_t to increase security. BZ(1579760)
  - Fix typo xserver SELinux module
  - Allow systemd to mmap files with var_log_t label
  - Allow x_userdomains read/write to xserver session
  - Allow users staff and sysadm to run wireshark on own domain
  - Fix typos s/xserver/xdm/ for allow creating xserver misc devices
  - Allow systemd-bootchart to create own tmpfs files
  - Merge pull request #213 from tmzullinger/rawhide
  - Allow xdm_t domain to install Nouveau drivers BZ(1570996)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-26
changelog:
  - Disable secure mode environment cleansing for dirsrv_t
  - - Allow udev execute /usr/libexec/gdm-disable-wayland in xdm_t domain which allows create /run/gdm/custom.conf with proper xdm_var_run_t label.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-27
changelog:
  - Add dac_override to exim policy BZ(1574303)
  - Fix typo in conntrackd.fc file
  - Allow sssd_t to kill sssd_selinux_manager_t
  - Allow httpd_sys_script_t to connect to mongodb_port_t if boolean httpd_can_network_connect_db  is turned on
  - Allow chronyc_t to redirect ourput to /var/lib /var/log and /tmp
  - Allow policykit_auth_t to read udev db files BZ(1574419)
  - Allow varnishd_t do be dbus client BZ(1582251)
  - Allow cyrus_t domain to mmap own pid files BZ(1582183)
  - Allow user_mail_t domain to mmap etc_aliases_t files
  - Allow gkeyringd domains to run ssh agents
  - Allow gpg_pinentry_t domain read ssh state
  - Allow gpg_agent_t to send msgs to syslog/journal
  - Add dac_override capability to dovecot_t domain
  - Allow nscd_t domain to mmap system_db_t files
  - Allow tangd_t domain to create tcp sockets and add new interface tangd_read_db_files
  - Allow mailman_mail_t domain to search for apache configs
  - Allow mailman_cgi_t domain to ioctl an httpd with a unix domain stream sockets.
  - Improve procmail_domtrans() to allow mmaping procmail_exec_t
  - Allow ptrace arbitrary processes
  - Allow jabberd_router_t domain read kerberos keytabs BZ(1573945)
  - Allow certmonger to geattr of filesystems BZ(1578755)
  - Allow hypervvssd_t domain to read fixed disk devices
  - Allow several domains to manage ecryptfs_t filesystem
  - Allow userdom_use_user_ttys for loadkeys_t domain
  - Add dac_override capability to cachefiles_kernel_t domain
  - Allow blueman to execute ldconfig BZ(1577581)
  - Allow gpg_pinentry_t domain to read state of gpg_t processes
  - Add dac_override capability to cgconfig_t domain BZ(1574649)
  - Add dac_override to glusterd_t domain BZ(1578501)
  - Allow fsdaemon_t to create own fsdaemon_var_lib_t dirs BZ(1569724)
  - Allow plymouth_t domain to read/write systemd sockets BZ(1578882)
  - Allow use of U2F Yubikey as authentication for a sudo command BZ(1578915)
  - Append map permission to apache_read_modules() interface
  - Allow certwatch_t domain to getattr of extended attributes fs_t filesystem
  - Add new interface: dirsrv_noatsecure()
  - Add dac_override capability to remote_login_t domain
  - Allow chrome_sandbox_t to mmap tmp files
  - Update ulogd SELinux security policy
  - Allow sysadm_u use xdm
  - Allow xdm_t domain to listen ofor unix dgram sockets BZ(1581495)
  - Add interface ssh_read_state()
  - Fix typo in sysnetwork.if file
  - Update dev_map_xserver_misc interface to allo mmaping char devices instead of files
  - Allow noatsecure permission for all domain transitions from systemd.
  - Allow systemd to read tangd db files
  - Fix typo in ssh.if file
  - Allow xdm_t domain to mmap xserver_misc_device_t files
  - Allow xdm_t domain to execute systemd-coredump binary
  - Add bridge_socket, dccp_socket, ib_socket and mpls_socket to socket_class_set
  - Improve modutils_domtrans_insmod() interface to mmap insmod_exec_t binaries
  - Improve iptables_domtrans() interface to allow mmaping iptables_exec_t binary
  - Improve auth_domtrans_login_programinterface to allow also mmap login_exec_t binaries
  - Improve auth_domtrans_chk_passwd() interface to allow also mmaping chkpwd_exec_t binaries.
  - Allow mmap dhcpc_exec_t binaries in sysnet_domtrans_dhcpc interface
  - Improve running xorg with proper SELinux domain even if systemd security feature NoNewPrivileges is used
  - Associate sysctl_vm_overcommit_t with fs_t
  - Allow systemd creating bluetooth sockets
  - Allow ssh client to read network sysctl BZ(1574170)
  - Allow systemd_resolved_t and systemd_networkd_t to read dbus pid files
  - Allow sysadm user to sys_ptrace cap_userns
  - Allow udev execute /usr/libexec/gdm-disable-wayland in xdm_t domain which allows create /run/gdm/custom.conf with proper xdm_var_run_t label.
  - Allow ssh client to read network state BZ(1574174)
  - Allow ssh basic client to read/write to tun tap devices BZ(1574184)
  - Allow ssh basic client to create tun sockets BZ(1574186)
  - Disable secure mode environment cleansing for dirsrv_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-28
changelog:
  - Update ctdb domain to support gNFS setup
  - Allow authconfig_t dbus chat with policykit
  - Allow lircd_t domain to read system state
  - Revert "Allow fsdaemon_t do send emails BZ(1582701)"
  - Typo in uuidd policy
  - Allow tangd_t domain read certs
  - Allow vpnc_t domain to read configfs_t files/dirs BZ(1583107)
  - Allow vpnc_t domain to read generic certs BZ(1583100)
  - Label /var/lib/phpMyAdmin directory as httpd_sys_rw_content_t BZ(1584811)
  - Allow NetworkManager_ssh_t domain to be system dbud client
  - Allow virt_qemu_ga_t read utmp
  - Add capability dac_override to system_mail_t domain
  - Update uuidd policy to reflect last changes from base branch
  - Add cap dac_override to procmail_t domain
  - Allow sendmail to mmap etc_aliases_t files BZ(1578569)
  - Add new interface dbus_read_pid_sock_files()
  - Allow mpd_t domain read config_home files if mpd_enable_homedirs boolean will be enabled
  - Allow fsdaemon_t do send emails BZ(1582701)
  - Allow firewalld_t domain to request kernel module BZ(1573501)
  - Allow chronyd_t domain to send send msg via dgram socket BZ(1584757)
  - Add sys_admin capability to fprint_t SELinux domain
  - Allow cyrus_t domain to create own files under /var/run BZ(1582885)
  - Allow cachefiles_kernel_t domain to have capability dac_override
  - Update policy for ypserv_t domain
  - Allow zebra_t domain to bind on tcp/udp ports labeled as qpasa_agent_port_t
  - Allow cyrus to have dac_override capability
  - Dontaudit action when abrt-hook-ccpp is writing to nscd sockets
  - Fix homedir polyinstantion under mls
  - Fixed typo in init.if file
  - Allow systemd to remove generic tmpt files BZ(1583144)
  - Update init_named_socket_activation() interface to also allow systemd create objects in /var/run with proper label during socket activation
  - Allow systemd-networkd and systemd-resolved services read system-dbusd socket BZ(1579075)
  - Fix typo in authlogin SELinux security module
  - Allod nsswitch_domain attribute to be system dbusd client BZ(1584632)
  - Allow audisp_t domain to mmap audisp_exec_t binary
  - Update ssh_domtrans_keygen interface to allow mmap ssh_keygen_exec_t binary file
  - Label tcp/udp ports 2612 as qpasa_agetn_port_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-29
changelog:
  - Fix typos in zabbix.te file
  - Add missing requires
  - Allow tomcat domain sends email
  - Fix typo in sge policy
  - Allow certmonger to sends emails
  - Allow tomcat_t do mmap tomcat_tmp_t files
  - Improve sge_rw_tcp_sockets interface
  - Adding new interface: sge_rw_tcp_sockets()
  - Update sge_execd_t domain with few rules
  - Add new zabbix_run_sudo boolean
  - Allow virtual machines to manage cephfs filesystems.
  - Allow rhsmcertd_t domain to read sssd public files and stream connect to sssd
  - Add dac_override capability to sendmail_t domain
  - Fix typo in netutils.te file
  - Update traceroute_t domain to allow create dccp sockets
  - Update ssh_keysign policy
  - Allow sshd_t domain to read/write sge tcp sockets


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-30
changelog:
  - Add ibacm policy
  - Label /usr/sbin/rhn_check-[0-9]+.[0-9]+ as rpm_exec_t
  - Allow kdumpgui_t domain to allow execute and mmap all binaries labeled as kdumpgui_tmp_t
  - Allow rpm to check if SELinux will check original protection mode or modified protection mode (read-implies-exec) for mmap/mprotect. Allow rpm to reload systemd services
  - Allow crond_t domain to create netlink selinux sockets and dac_override cap.
  - Allow radiusd_t domain to have dac_override capability
  - Allow amanda_t domain to have setgid capability
  - Allow psad domain to setrlimit. Allow psad domain to stream connect to dbus Allow psad domain to exec journalctl_exec_t binary
  - Update cups_filetrans_named_content() to allow caller domain create ppd directory with cupsd_etc_rw_t label
  - Allow abrt_t domain to write to rhsmcertd pid files
  - Allow pegasus_t domain to eexec lvm binaries and allow read/write access to lvm control
  - Add vhostmd_t domain to read/write to svirt images
  - Update kdump_manage_kdumpctl_tmp_files() interface to allow caller domain also mmap kdumpctl_tmp_t files
  - Allow sssd_t and slpad_t domains to mmap generic certs
  - Allow chronyc_t domain use inherited user ttys
  - Allow stapserver_t domain to mmap own tmp files
  - Update nscd_dontaudit_write_sock_file() to dontaudit also stream connect to nscd_t domain
  - Merge pull request #60 from vmojzis/rawhide
  - Allow tangd_t domain stream connect to sssd
  - Allow oddjob_t domain to chat with systemd via dbus
  - Allow freeipmi domains to mmap sysfs files
  - Fix typo in logwatch interface file
  - Allow spamd_t to manage logwatch_cache_t files/dirs
  - Allow dnsmasw_t domain to create own tmp files and manage mnt files
  - Allow fail2ban_client_t to inherit rlimit information from parent process
  - Allow nscd_t to read kernel sysctls
  - Label /var/log/conman.d as conman_log_t
  - Add dac_override capability to tor_t domain
  - Allow certmonger_t to readwrite to user_tmp_t dirs
  - Allow abrt_upload_watch_t domain to read general certs
  - Allow chornyd_t read phc2sys_t shared memory
  - Add several allow rules for pesign policy:
  - Add setgid and setuid capabilities to mysqlfd_safe_t domain
  - Add tomcat_can_network_connect_db boolean
  - Update virt_use_sanlock() boolean to read sanlock state
  - Add sanlock_read_state() interface
  - Allow zoneminder_t to getattr of fs_t
  - Allow rhsmcertd_t domain to send signull to postgresql_t domain
  - Add log file type to collectd and allow corresponding access
  - Allow policykit_t domain to dbus chat with dhcpc_t
  - Adding new boolean keepalived_connect_any()
  - Allow amanda to create own amanda_tmpfs_t files
  - Allow gdomap_t domain to connect to qdomap_port_t
  - /usr/libexec/bluetooth/obexd should have only obexd_exec_t instead of bluetoothd_exec_t type
  - Allow ntop_t domain to create/map various sockets/files.
  - Enable the dictd to communicate via D-bus.
  - Allow inetd_child process to chat via dbus with abrt
  - Allow zabbix_agent_t domain to connect to redis_port_t
  - Allow rhsmcertd_t domain to read xenfs_t files
  - Allow zabbix_agent_t to run zabbix scripts
  - Fix openvswith SELinux module
  - Fix wrong path in tlp context file BZ(1586329)
  - Update brltty SELinux module
  - Allow rabbitmq_t domain to create own tmp files/dirs
  - Allow policykit_t mmap policykit_auth_exec_t files
  - Allow ipmievd_t domain to read general certs
  - Add sys_ptrace capability to pcp_pmie_t domain
  - Allow squid domain to exec ldconfig
  - Update gpg SELinux policy module
  - Allow mailman_domain to read system network state
  - Allow openvswitch_t domain to read neutron state and read/write fixed disk devices
  - Allow antivirus_domain to read all domain system state
  - Allow targetd_t domain to red gconf_home_t files/dirs
  - Label /usr/libexec/bluetooth/obexd as obexd_exec_t
  - Allow init_t domain to create netlink rdma sockets for ibacm policy
  - Update corecmd_exec_shell() interface to allow caller domain to mmap shell_exec_t files
  - Allow lvm_t domain to write files to all mls levels
  - Add to su_role_template allow rule for creating netlink_selinux sockets
  - Allow sysadm_t domain to mmap hwdb db
  - Allow udev_t domain to mmap kernel modules
  - Allow sysadm_screen_t to have capability dac_override and chown
  - Allow sysadm_t domain to mmap journal
  - Merge branch 'rawhide' of github.com:fedora-selinux/selinux-policy into rawhide
  - Label /etc/systemd/system.control/ dir as systemd_unit_file_t
  - Merge pull request #215 from bachradsusi/merge-conf-from-fedora
  - Allow sysadm_t and staff_t domains to use sudo io logging
  - Allow sysadm_t domain create sctp sockets
  - Add snapperd_contexts to the policy
  - Use system_u:system_r:unconfined_t:s0 in userhelper_context
  - Remove unneeded system_u seusers mapping.
  - Fedora targeted default user is unconfined_u, root is unconfined_u as well
  - Update config to reflect changes in default context for SELinux users related to pam_selinux.so which is now used in systemd-users.
  - Change failsafe_context to unconfined_r:unconfined_t:s0
  - Update lxc_contexts from Fedora config.tgz
  - Add lxc_contexts config file
  - Allow traceroute_t domain to exec bin_t binaries
  - Allow systemd_passwd_agent_t domain to list sysfs Allow systemd_passwd_agent_t domain to dac_override
  - Add new interface dev_map_sysfs()
  - Allow sshd_keygen_t to execute plymouthd
  - Allow systemd_networkd_t create and relabel tun sockets
  - Add new interface postgresql_signull()
  - Merge pull request #214 from wrabcak/fb-dhcpc
  - Allow dhcpc_t creating own socket files inside /var/run/ Allow dhcpc_t creating netlink_kobject_uevent_socket, netlink_generic_socket, rawip_socket BZ(1585971)
  - Allow confined users get AFS tokens
  - Allow sysadm_t domain to chat via dbus
  - Associate sysctl_kernel_t type with filesystem attribute


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-31
changelog:
  - Allow cupsd_t domain to mmap cupsd_etc_t files
  - Allow kadmind_t domain to mmap krb5kdc_principal_t
  - Allow virtlogd_t domain to read virt_etc_t link files
  - Allow dirsrv_t domain to read crack db
  - Dontaudit pegasus_t to require sys_admin capability
  - Allow mysqld_t domain to exec mysqld_exec_t binary files
  - Allow abrt_t odmain to read rhsmcertd lib files
  - Allow winbind_t domain to request kernel module loads
  - Allow tomcat_domain to read cgroup_t files
  - Allow varnishlog_t domain to mmap varnishd_var_lib_t files
  - Allow innd_t domain to mmap news_spool_t files
  - Label HOME_DIR/mozilla.pdf file as mozilla_home_t instead of user_home_t
  - Allow fenced_t domain to reboot
  - Allow amanda_t domain to read network system state
  - Allow abrt_t domain to read rhsmcertd logs
  - Fix typo in radius policy
  - Update zoneminder policy to reflect latest features in zoneminder BZ(1592555)
  - Label /usr/bin/esmtp-wrapper as sendmail_exec_t
  - Update raid_access_check_mdadm() interface to dontaudit caller domain to mmap mdadm_exec_t binary files
  - Dontaudit thumb to read mmap_min_addr
  - Allow chronyd_t to send to system_cronjob_t via unix dgram socket BZ(1494904)
  - Allow mpd_t domain to mmap mpd_tmpfs_t files BZ(1585443)
  - Allow collectd_t domain to use ecryptfs files BZ(1592640)
  - Dontaudit mmap home type files for abrt_t domain
  - Allow fprintd_t domain creating own tmp files BZ(1590686)
  - Allow collectd_t domain to bind on bacula_port_t BZ(1590830)
  - Allow fail2ban_t domain to getpgid BZ(1591421)
  - Allow nagios_script_t domain to mmap nagios_log_t files BZ(1593808)
  - Allow pcp_pmcd_t domain to use sys_ptrace usernamespace cap
  - Allow sssd_selinux_manager_t to read/write to systemd sockets BZ(1595458)
  - Allow radiusd_t domain to mmap radius_etc_rw_t files
  - Allow git_script_t domain to read and mmap gitosis_var_lib_t files BZ(1591729)
  - Add dac_read_search capability to thumb_t domain
  - Add dac_override capability to cups_pdf_t domain BZ(1594271)
  - Add net_admin capability to connntrackd_t domain BZ(1594221)
  - Allow gssproxy_t domain to domtrans into gssd_t domain BZ(1575234)
  - Fix interface init_dbus_chat in oddjob SELinux policy BZ(1590476)
  - Allow motion_t to mmap video devices BZ(1590446)
  - Add dac_override capability to mpd_t domain BZ(1585358)
  - Allow fsdaemon_t domain to write to mta home files BZ(1588212)
  - Allow virtlogd_t domain to chat via dbus with systemd_logind BZ(1589337)
  - Allow sssd_t domain to write to general cert files BZ(1589339)
  - Allow l2tpd_t domain to sends signull to ipsec domains BZ(1589483)
  - Allow cockpit_session_t to read kernel network state BZ(1596941)
  - Allow devicekit_power_t start with nnp systemd security feature with proper SELinux Domain transition BZ(1593817)
  - Allows systemd to get attribues of core kernel interface BZ(1596928)
  - Dontaudit syslogd to watching top llevel dirs when imfile module is enabled
  - Revert "Allow unconfined and sysadm users to use bpftool BZ(1591440)"
  - Allow userdomain sudo domains to use generic ptys
  - Allow systemd labeled as init_t to get sysvipc info BZ(1600877)
  - Label /sbin/xtables-legacy-multi and /sbin/xtables-nft-multi as iptables_exec_t BZ(1600690)
  - Remove duplicated userdom_delete_user_home_content_files
  - Add systemd_dbus_chat_resolved interface
  - Allow load_policy_t domain to read/write to systemd sockets BZ(1582812)
  - Add new interface init_prog_run_bpf()
  - Allow unconfined and sysadm users to use bpftool BZ(1591440)
  - Label /run/cockpit/motd as etc_t BZ(1584167)
  - Allow systemd_machined_t domain to sendto syslogd_t over unix dgram sockets
  - Add interface userdom_dontaudit_mmap_user_home_content_files()
  - Allow systemd to listen bluetooth sockets BZ(1592223)
  - Allow systemd to remove user_home_t files BZ(1418463)
  - Allow xdm_t domain to mmap and read cert_t files BZ(1553761)
  - Allow nsswitch_domain to mmap passwd_file_t files BZ(1518655)
  - Allow systemd to delete user temp files BZ(1595189)
  - Allow systemd to mounton core kernel interface
  - Add dac_override capability to ipsec_t domain BZ(1589534)
  - Allow systemd domain to mmap lvm config files BZ(1594584)
  - Allow systemd to write systemd_logind_inhibit_var_run_t fifo files
  - Allow systemd_modules_load_t to access unabeled infiniband pkeys


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-32
changelog:
  - Allow aide to mmap all files
  - Revert "Allow firewalld_t do read iptables_var_run_t files"
  - Revert "Allow firewalld to create rawip sockets"
  - Allow svirt_tcg_t domain to read system state of virtd_t domains
  - Update rhcs contexts to reflects the latest fenced changes
  - Allow httpd_t domain to rw user_tmp_t files
  - Fix typo in openct policy
  - Allow winbind_t domian to connect to all ephemeral ports
  - Allow firewalld_t do read iptables_var_run_t files
  - Allow abrt_t domain to mmap data_home files
  - Allow glusterd_t domain to mmap user_tmp_t files
  - Allow mongodb_t domain to mmap own var_lib_t files
  - Allow firewalld to read kernel usermodehelper state
  - Allow modemmanager_t to read sssd public files
  - Allow openct_t domain to mmap own var_run_t files
  - Allow nnp transition for devicekit daemons
  - Allow firewalld to create rawip sockets
  - Allow firewalld to getattr proc filesystem
  - Dontaudit sys_admin capability for pcscd_t domain
  - Revert "Allow pcsd_t domain sys_admin capability"
  - Allow fetchmail_t domain to stream connect to sssd
  - Allow pcsd_t domain sys_admin capability
  - Allow cupsd_t to create cupsd_etc_t dirs
  - Allow varnishlog_t domain to list varnishd_var_lib_t dirs
  - Allow mongodb_t domain to read system network state BZ(1599230)
  - Allow zoneminder_t to getattr of fs_t
  - Allow tgtd_t domain to create dirs in /var/run labeled as tgtd_var_run_t BZ(1492377)
  - Allow iscsid_t domain to mmap sysfs_t files
  - Allow httpd_t domain to mmap own cache files
  - Add sys_resource capability to nslcd_t domain
  - Fixed typo in logging_audisp_domain interface
  - Add interface files_mmap_all_files()
  - Add interface iptables_read_var_run()
  - Allow systemd to mounton init_var_run_t files
  - Update policy rules for auditd_t based on changes in audit version 3
  - Allow systemd_tmpfiles_t do mmap system db files
  - Don't setup unlabeled_t as an entry_type
  - Allow unconfined_service_t to transition to container_runtime_t
  - Improve domain_transition_pattern to allow mmap entrypoint bin file.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-33
changelog:
  - Allow sblim_sfcbd_t domain to mmap own tmpfs files
  - Allow nfsd_t domain to read krb5 keytab files
  - Allow nfsd_t domain to manage fadm pid files
  - Allow virt_domain to create icmp sockets BZ(1609142)
  - Dontaudit oracleasm_t domain to request sys_admin capability
  - Update logging_manage_all_logs() interface to allow caller domain map all logfiles


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-34
changelog:
  - Fix issue with aliases in apache interface file
  Resolves: rhbz#1596618
  - Add same context for symlink as binary
  - Allow boltd_t to send logs to journal
  - Allow colord_use_nfs to allow colord also mmap nfs_t files
  - Allow mysqld_safe_t do execute itself
  - Allow smbd_t domain to chat via dbus with avahi daemon
  - cupsd_t domain will create /etc/cupsd/ppd as cupsd_etc_rw_t
  - Update screen_role_template to allow caller domain to have screen_exec_t as entrypoint do new domain
  - Add alias httpd__script_t to _script_t to make sepolicy generate working
  - Allow gpg_t domain to mmap gpg_agent_tmp_t files
  - Allow kprop_t domain to read network state
  - Add support boltd policy
  - Allow kpropd domain to exec itself
  - Allow pdns_t to bind on tcp transproxy port
  - Add support for opafm service
  - Allow hsqldb_t domain to read cgroup files
  - Allow rngd_t domain to read generic certs
  - Allow innd_t domain to mmap own var_lib_t files
  - Update screen_role_temaplate interface
  - Allow chronyd_t domain to mmap own tmpfs files
  - Allow chronyd_t domain to mmap own tmpfs files
  - label /var/lib/pgsql/data/log as postgresql_log_t
  - Allow sysadm_t domain to accept socket
  - Allow systemd to manage passwd_file_t
  - Allow sshd_t domain to mmap user_tmp_t files
  - Allow systemd to mounont boltd lib dirs
  - Allow sysadm_t domain to create rawip sockets
  - Allow sysadm_t domain to listen on socket
  - Update sudo_role_template() to allow caller domain also setattr generic ptys


author: Daniel Kopeček <dkopecek@redhat.com> - 3.14.1-35
changelog:
  - Use explicit path BuildRequires to get /usr/bin/python3 inside the buildroot
  Resolves: rhbz#1615312


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-37
changelog:
  - Dontaudit abrt_t domain to write to usr_t dirs
  - Revert "Allow rpcbind to bind on all unreserved udp ports"
  - Allow rpcbind to bind on all unreserved udp ports
  - Allow virtlogd to execute itself
  - Allow stapserver several actions: - execute own tmp files - mmap stapserver_var_lib_t files - create stapserver_tmpfs_t files
  - Allow ypxfr_t domain to stream connect to rpcbind and allos search sssd libs
  - Allos systemd to socket activate ibacm service
  - Allow dirsrv_t domain to mmap user_t files
  - Allow kdumpctl_t domain to manage kdumpctl_tmp_t fifo files
  - Allow kdumpctl to write to files on all levels
  - Allow httpd_t domain to mmap httpd_config_t files
  - Allow sanlock_t domain to connectto to unix_stream_socket
  - Revert "Add same context for symlink as binary"
  - Allow mysql execute rsync
  - Update nfsd_t policy because of ganesha features
  - Allow conman to getattr devpts_t
  - Allow tomcat_domain to connect to smtp ports
  - Allow tomcat_t domain to mmap tomcat_var_lib_t files
  - Allow nagios_t domain to mmap nagios_log_t files
  - Allow kpropd_t domain to mmap krb5kdc_principal_t files
  - Allow kdumpctl_t domain to read fixed disk storage
  - Allow xserver_t domain to start using systemd socket activation
  - Tweak SELinux policy for systemd to allow DynamicUsers systemd feature
  - Associate several proc labels to fs_t
  - Update init_named_socket_activation() interface to allow systemd also create link files in /var/run
  - Fix typo in syslogd policy
  - Update syslogd policy to make working elasticsearch
  - Label tcp and udp ports 9200 as wap_wsp_port
  - Allow few domains to rw inherited kdumpctl tmp pipes


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-38
changelog:
  - Allow ovs-vswitchd labeled as openvswitch_t domain communicate with qemu-kvm via UNIX stream socket
  Resolves: rhbz#1621142
  - Add interface devicekit_mounton_var_lib()
  - Allow httpd_t domain to mmap tmp files
  - Allow tcsd_t domain to have dac_override capability
  - Allow cupsd_t to rename cupsd_etc_t files
  - Allow iptables_t domain to create rawip sockets
  - Allow amanda_t domain to mmap own tmpfs files
  - Allow fcoemon_t domain to write to sysfs_t dirs
  - Allow dovecot_auth_t domain to have dac_override capability
  - Allow geoclue_t domain to mmap own tmp files
  - Allow chronyc_t domain to read network state
  - Allow apcupsd_t domain to execute itself
  - Allow modemmanager_t domain to stream connect to sssd
  - Allow chonyc_t domain to rw userdomain pipes
  - Update dirsrv_read_share() interface to allow caller domain to mmap dirsrv_share_t files
  - Update dirsrvadmin_script_t policy to allow read httpd_tmp_t symlinks
  - Allow nagios_script_t domain to mmap nagios_spool_t files
  - Allow geoclue_t domain to mmap geoclue_var_lib_t files
  - Allow geoclue_t domain to map generic certs
  - Update munin_manage_var_lib_files to allow manage also dirs
  - Allow nsd_t domain to create new socket file in /var/run/nsd.ctl
  - Fix typo in virt SELinux policy module
  - Allow virtd_t domain to create netlink_socket
  - Allow rpm_t domain to write to audit
  - Allow nagios_script_t domain to mmap nagios_etc_t files
  - Update nscd_socket_use() to allow caller domain to stream connect to nscd_t
  - Allow kdumpctl_t domain to getattr fixed disk device in mls
  - Fix typo in stapserver policy
  - Dontaudit abrt_t domain to write to usr_t dirs
  - Revert "Allow rpcbind to bind on all unreserved udp ports"
  - Allow rpcbind to bind on all unreserved udp ports
  - Allow virtlogd to execute itself
  - Allow stapserver several actions: - execute own tmp files - mmap stapserver_var_lib_t files - create stapserver_tmpfs_t files
  - Allow ypxfr_t domain to stream connect to rpcbind and allos search sssd libs
  - Allos systemd to socket activate ibacm service
  - Allow dirsrv_t domain to mmap user_t files
  - Allow dhcpc_t domain to read /dev/random
  - Allow systemd to mounton device_var_lib_t dirs
  - Allow systemd to mounton kernel system table
  - Label also chr_file /dev/mtd.* devices as fixed_disk_device_t
  - Allow syslogd_t domain to create netlink generic sockets
  - Label /dev/tpmrm[0-9]* as tpm_device_t
  - Update dev_filetrans_all_named_dev() to allow create event22-30 character files with label event_device_t
  - Update userdom_security_admin() and userdom_security_admin_template() to allow use auditctl
  - Allow insmod_t domain to read iptables pid files
  - Allow systemd to mounton /etc
  - Allow initrc_domain to mmap all binaries labeled as systemprocess_entry
  - Allow xserver_t domain to start using systemd socket activation
  - Tweak SELinux policy for systemd to allow DynamicUsers systemd feature
  - Associate several proc labels to fs_t
  - Update init_named_socket_activation() interface to allow systemd also create link files in /var/run


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-39
changelog:
  - Merge remote-tracking branch 'fedora-contrib/f28' into rhel8.0-contrib
  - Tomcat should not be unconfined domain
  - Update ibacm_read_pid_files interface to allow also reading link files
  - Allow zebra_t domain to create packet_sockets
  - Allow opafm_t domain to list sysfs
  - Label /usr/libexec/cyrus-imapd/cyrus-master as cyris_exec_t
  - Allow tomcat Tomcat to delete a temporary file used when compiling class files for JSPs.
  - Allow chronyd_t domain to read virt_var_lib_t files
  - Allow tomcat services create link file in /tmp
  - Label /etc/shorewall6 as shorewall_etc_t
  - Allow winbind_t domain kill in user namespaces
  - Allow firewalld_t domain to read random device
  - Allow abrt_t domain to do execmem
  - Allow geoclue_t domain to execute own var_lib_t files
  - Allow openfortivpn_t domain to read system network state
  - Allow dnsmasq_t domain to read networkmanager lib files
  - sssd: Allow to limit capabilities using libcap
  - sssd: Remove unnecessary capability
  - sssd: Do not audit usage of lib nss_systemd.so
  - Fix bug in nsd.fc, /var/run/nsd.ctl is socket file not file
  - Add correct namespace_init_exec_t context to /etc/security/namespace.d/*
  - Update nscd_socket_use to allow caller domain to mmap nscd_var_run_t files
  - Allow exim_t domain to mmap bin files
  - Allow mysqld_t domain to executed with nnp transition
  - Allow svirt_t domain to mmap svirt_image_t block files
  - Add caps dac_read_search and dav_override to pesign_t domain
  - Allow iscsid_t domain to mmap userio chr files
  - Merge remote-tracking branch 'fedora-base/f28' into rhel8.0-base
  - Revert "Add new interface dev_map_userio()"
  - Add new interface dev_map_userio()
  - Allow systemd to read ibacm pid files
  - Allow systemd to create symlinks in for /var/lib
  - Add comment to show that template call also allows changing shells
  - Document userdom_change_password_template() behaviour
  - Merge remote-tracking branch 'fedora-base/f28' into rhel8.0-base
  - update files_mounton_kernel_symbol_table() interface to allow caller domain also mounton system_map_t file
  - Fix typo in logging SELinux module
  - Allow usertype to mmap user_tmp_type files
  - In domain_transition_pattern there is no permission allowing caller domain to execu_no_trans on entrypoint, this patch fixing this issue
  - Revert "Add execute_no_trans permission to mmap_exec_file_perms pattern"
  - Add boolean: domain_can_mmap_files.
  - Allow ipsec_t domian to mmap own tmp files
  - Add .gitignore file
  - Add execute_no_trans permission to mmap_exec_file_perms pattern
  - Allow sudodomain to search caller domain proc info
  - Allow audisp_remote_t domain to read auditd_etc_t
  - netlabel: Remove unnecessary sssd nsswitch related macros
  - Allow to use sss module in auth_use_nsswitch
  - Limit communication with init_t over dbus
  - Add actual modules.conf to the git repo
  - Add few interfaces to optional block
  - Allow sysadm_t and staff_t domain to manage systemd unit files
  - Add interface dev_map_userio_dev()
  Resolves: rhbz#1623411
  Resolves: rhbz#1624648
  Resolves: rhbz#1596618
  Resolves: rhbz#1574878
  Resolves: rhbz#1577324
  Resolves: rhbz#1625202
  Resolves: rhbz#1581715
  Resolves: rhbz#1625127


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-40
changelog:
  - Tomcat should not be unconfined domain
  - Allow cockpit_t domain to read systemd state
  - Allow abrt_t domain to write to usr_t files
  - Allow cockpit to create motd file in /var/run/cockpit
  - Label /usr/sbin/pcsd as cluster_exec_t
  - Allow pesign_t domain to getattr all fs
  - Allow tomcat servers to manage usr_t files
  - Dontaudit tomcat serves to append to /dev/random device
  - Allow dirsrvadmin_script_t domain to read httpd tmp files
  - Allow sbd_t domain to getattr of all char files in /dev and read sysfs_t files and dirs
  - Revert "Allow firewalld_t domain to read random device"
  - Allow postfix domains to mmap system db files
  - Allow geoclue_t domain to execute own tmp files
  - Allow virt_qemu_ga_t domain to read network state BZ(1592145)
  - Update ibacm_read_pid_files interface to allow also reading link files
  - Allow zebra_t domain to create packet_sockets
  - Allow opafm_t domain to list sysfs
  - Label /usr/libexec/cyrus-imapd/cyrus-master as cyris_exec_t
  - Add boolean: domain_can_mmap_files.
  - Allow sshd_t domain to read cockpit pid files
  - Allow syslogd_t domain to manage cert_t files
  - Allow getattr as part of files_mounton_kernel_symbol_table.
  - Fix typo "aduit" -> "audit"
  - Revert "Add new interface dev_map_userio()"
  - Add new interface dev_map_userio()
  - Allow systemd to read ibacm pid files
  Resolves: rhbz#1615318
  Resolves: rhbz#1619001
  Resolves: rhbz#1627646


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-41
changelog:
  - Tomcat should not be unconfined domain
  - Fix typo in cockpit interfaces we have cockpit_var_run_t files not cockpit_var_pid_t
  - Add interface apcupsd_read_power_files()
  - Allow systemd labeled as init_t to execute logrotate in logrotate_t domain
  - Allow dac_override capability to amanda_t domain
  - Allow geoclue_t domain to get attributes of fs_t filesystems
  - Update selinux policy for rhnsd_t domain based on changes in spacewalk-2.8-client
  Resolves: rhbz#1629678
  Resolves: rhbz#1629685
  Resolves: rhbz#1626100
  Resolves: rhbz#1629588
  Resolves: rhbz#1630317


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-42
changelog:
  - Allow cockpit to create motd file in /var/run/cockpit
  Resolves: rhbz#1629678
  - Allow cockpit_t domain to read systemd state
  Resolves: rhbz#1629588


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-43
changelog:
  - Allow ibacm_t domain to read/write to infiniband devices Allow ibacm_t domain to getattr tmpfs_t filesystem.
  Resolves: rhbz#1635674
  - Update SELinux policy for libreswan based on the latest rebase 3.26
  Resolves: rhbz#1637089


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-44
changelog:
  - Update rpm macros for selinux policy from sources repository: https://github.com/fedora-selinux/selinux-policy-macros
  Resolves: rhbz#1633198
  - Allow boltd_t to read fwupd_t processes state
  - Turn named_write_master_zones boolean on by default.
  Resolves: rhbz#1633158
  - Label /etc/rhsm as rhsmcertd_config_t
  Resolves: rhbz#1636212
  - Allow httpd_t domain to write to httpd_config_t dirs if httpd_run_ipa boolean is turned on
  Resolves: rhbz#1624930
  - Allow dhcpd_t domain to mmap dhcpd_state_t files
  Resolves: rhbz#1635643
  - Allow abrt_t domain to manage usr_t dirs
  Resolves: rhbz#1619001
  - Allow certmonger_t domain to manage cockpit pid files
  Resolves: rhbz#1629685
  - Update opafm_t domain after basic testing this service
  Resolves: rhbz#1627861
  - Allow systemd-tty-ask to ask for password of encrypted partions during boot
  Resolves: rhbz#1638666
  - Update sysnet_read_dhcp_config interface to allow caller domain also mmap dhcp_etc_t files
  - Add interface files_manage_usr_dirs()


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-45
changelog:
  - Allow gpg_t to create own tmpfs dirs and sockets
  - Allow rhsmcertd_t domain to relabel cert_t files
  - Add SELinux policy for kpatch
  Resolves: rhbz#1630198
  - Allow nova_t domain to use pam
  - sysstat: grant sysstat_t the search_dir_perms set
  - Allow boltd_t domain to dbus chat with fwupd_t domain BZ(1633786)
  - Allow caller domains using cron_*_role to have entrypoint permission on system_cron_spool_t files BZ(1625645)
  - Add interface cron_system_spool_entrypoint()
  - Bolt added d-bus API for force-powering the thunderbolt controller, so system-dbusd needs acces to boltd pipes BZ(1637676)
  - Add interfaces for boltd SELinux module
  - Add dac_override capability to modemmanager_t domain BZ(1636608)
  - Add interface miscfiles_relabel_generic_cert()
  - Make kpatch policy active
  - Fix userdom_write_user_tmp_dirs() to allow caller domain also read/write user_tmp_t dirs
  - Dontaudit sys_admin capability for netutils_t domain
  - Label tcp and udp ports 2611 as qpasa_agent_port_t
  - Allow systemd to mount boltd_var_run_t dirs BZ(1636823)
  - Label correctly /var/named/chroot*/dev/unrandom in bind chroot.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-46
changelog:
  - Add dac_override capability to ftpd_t domain
  Resolves: rhbz#1641049
  - Allow X display manager to check status and reload services which are part of x_domain attribute
  Resolves: rhbz#1641082


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-47
changelog:
  - Update pesign policy to allow pesign_t domain to read bind cache files/dirs
  Resolves: rhbz#1644796
  - Add dac_override capability to mdadm_t domain
  Resolves: rhbz#1599646
  - Create ibacm_tmpfs_t type for the ibacm policy
  Resolves: rhbz#1581715
  - Dontaudit capability sys_admin for dhcpd_t domain
  Resolves: rhbz#1635643
  - Makes rhsmcertd_t domain an exception to the constraint preventing changing the user identity in object contexts.
  Resolves: rhbz#1639181
  - Allow abrt_t domain to mmap generic tmp_t files
  Resolves:rhbz#1644727
  - Label /usr/sbin/wpa_cli as wpa_cli_exec_t
  Resolves: rhbz#1644899
  - Allow sandbox_xserver_t domain write to user_tmp_t files
  Resolves:rhbz#1644315
  - Dontaudit thumb_t domain to setattr on lib_t dirs BZ(1643672)
  - Dontaudit cupsd_t domain to setattr lib_t dirs BZ(1636766)
  - Add dac_override capability to postgrey_t domain BZ(1638954)
  - Allow thumb_t domain to execute own tmpfs files BZ(1643698)
  - Add nnp transition rule for vnstatd_t domain using NoNewPrivileges systemd feature BZ(1643063)
  - Allow l2tpd_t domain to mmap /etc/passwd file BZ(1638948)
  - Allow certutil running as ipsec_mgmt_t domain to mmap ipsec_mgmt pid files Dontaudit ipsec_mgmt_t domain to write to the all mountpoints
  Resolves: rhbz#1644727
  - Add interface files_map_generic_tmp_files()
  - Add dac_override capability to the syslogd_t domain
  Resolves: rhbz#1644373
  - Create systemd_timedated_var_run_t label
  - Update systemd_timedated_t domain to allow create own pid files/access init_var_lib_t files and read dbus files BZ(1646202)
  - Improve fs_manage_ecryptfs_files to allow caller domain also mmap ecryptfs_t files BZ(1630675)
  - kernel/files.fc: Label /run/motd.d(/.*)? as etc_t
  - Allow ipsec_mgmt_t process to send signals other than SIGKILL, SIGSTOP, or SIGCHLD to the ipsec_t domains BZ(1638949)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-48
changelog:
  - Allow sanlock_t domain to read/write sysfs_t files
  Resolves: rhbz#1647594
  - Add dac_override capability to postfix_local_t domain
  - Allow ypbind_t to search sssd_var_lib_t dirs
  - Allow virt_qemu_ga_t domain to write to user_tmp_t files
  - Allow systemd_logind_t to dbus chat with virt_qemu_ga_t
  - Update sssd_manage_lib_files() interface to allow also mmap sssd_var_lib_t files
  - Label /var/lib/private/systemd/ as init_var_lib_t
  Resolves: rhbz#1649312
  - Allow initrc_t domain to create new socket labeled as init_t
  - Allow audisp_remote_t domain remote logging client to read local audit events from relevant socket.
  Resolves: rhbz#1639675
  - Add tracefs_t type to mountpoint attribute
  Resolves: rhbz#1647819
  - Allow useradd_t and groupadd_t domains to send signals to sssd_t
  Resolves: rhbz#1651531
  - Allow systemd_logind_t domain to remove directories labeled as tmpfs_t BZ(1648636)
  - Allow useradd_t and groupadd_t domains to access sssd files because of the new feature in shadow-utils
  Resolves: rhbz#1651531


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-49
changelog:
  - Update nslcd_t domain to allow view kernel and systemd keyrings
  Resolves: rhbz#1657916
  - Allow arpwatch_t domains to execute shell BZ(1644568)
  - Allow processes labeled as ipa_otpd_t stream connect to sssd.
  - Add new SELinux domain pcp_plugin_t.
  Resolves: rhbz#1648386
  - Remove all ganesha bits from gluster and rpc policy
  Resolves: rhbz#1639227
  - Label /usr/share/spamassassin/sa-update.cron as spamd_update_exec_t
  Resolves: rhbz#1656837
  - Add dac_override capability to ssad_t domains
  Resolves: rhbz#1655551
  - Allow pesign_t domain to read gnome home configs
  Resolves: rhbz#1644796
  - Label /usr/libexec/lm_sensors/sensord-service-wrapper as lsmd_exec_t
  Resolves: rhbz#1656055
  - Allow rngd_t domains read kernel state
  Resolves: rhbz#1656054
  - Allow certmonger_t domains to read bind cache
  Resolves: rhbz#1655077
  - Allow ypbind_t domain to stream connect to sssd
  Resolves: rhbz#1583953
  - Allow rngd_t domain to setsched
  Resolves: rhbz#1653872
  - Add interface init_view_key()
  - Allow systemd to mmap all pidfiles
  Resolves: rhbz#1622548
  - Add files_map_all_pids() interface
  - Allow passwd_t domain mamange sssd public nad lib files, read pid files and send signals to sssd_t domains
  Resolves: rhbz#1657291
  - Update xserver_filetrans_home_content() and xserver_filetrans_admin_home_content() unterfaces to allow caller domain to create .vnc dir in users homedir labeled as xdm_home_t
  Resolves: rhbz#1639846
  - Update logging_filetrans_named_content() to allow caller domains of this interface to create /var/log/journal/remote directory labeled as var_log_t
  - Add sys_resource capability to the systemd_passwd_agent_t domain
  Resolves: rhbz#1590981
  - Allow ipsec_t domains to read bind cache
  Resolves: rhbz#1654692
  - kernel/files.fc: Label /run/motd as etc_t
  - Allow systemd to stream connect to userdomain processes
  Resolves: rhbz#1644733


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-50
changelog:
  - Change label of /usr/libexec/lm_sensors/sensord-service-wrapper from lsmd_exec_t to sensord_exec_t
  Resolves: rhbz#1656055
  - Make kpatch_t domain application domain to allow users to execute kpatch in kpatch_t domain.
  Resolves: rhbz#1630198
  - Allow confined users to use new socket classes for bluetooth, alg and tcpdiag sockets
  Resolves: rhbz#1557301
  - Allow sysadm_t,staff_t and unconfined_t domain to execute kpatch as kpatch_t domain
  Resolves: rhbz#1630198


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-51
changelog:
  - Allow tangd_t domain to bind on tcp ports labeled as tangd_port_t
  Resolves: rhbz#1664345
  - Create tangd_port_t with default label tcp/7406
  Resolves: rhbz#1664345
  - Remove tangd_t domain from permissive domains.
  Resolves: rhbz#1664345


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-52
changelog:
  - Fix userdom_admin_user_template() interface by adding bluetooth,alg,dccp create_stream_socket permissions.
  Resolves: rhbz#1557301


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-53
changelog:
  - Update dbus_role_template interface to allow userdomains to accept data from userdomain dbus domains
  Resolves: rhbz#1664448
  - Allow systemd to read selinux logind config
  Resolves: rhbz#1664448
  - Fix userdom_admin_user_template() interface by adding bluetooth,alg,dccp create_stream_socket permissions.
  - Allow transition from init_t domain to user_t domain during ssh login with confined user user_u
  Resolves: rhbz#1664448


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-54
changelog:
  - Allow sensord_t domain to use nsswitch and execute shell
  Resolves: rhbz#1656055
  - Allow opafm_t domain to execute lib_t files
  Resolves: rhbz#1627861


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-55
changelog:
  - Fix broken config files because of missing level specification in user_t contexts
  Resolves: rhbz#1664448


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-56
changelog:
  - Allow virt_doamin to read/write dev device
  Resolves: rhbz#1672188
  - Update ibacm_t policy after testing lastest version of this component
  Resolves: rhbz#1635674
  - Allow sensord_t domain to mmap own log files
  Resolves:rhbz#1656055
  - Add dac_override capability for ipa_helper_t
  Resolves: rhbz#1668168
  - Allow sensord_t domain to use nsswitch and execute shell
  Resolves: rhbz#1656055
  - Allow opafm_t domain to execute lib_t files
  Resolves: rhbz#1627861
  - Allow opafm_t domain to manage kdump_crash_t files and dirs
  Resolves: rhbz#1627861
  - Label /dev/sev char device as sev_device_t
  Resolves: rhbz#1672188


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-57
changelog:
  - Allow read network state of system for processes labeled as ibacm_t
  Resolves: rhbz#1635674
  - Allow ibacm_t domain to send dgram sockets to kernel processes
  Resolves: rhbz#1635674
  - Allow virt_doamin to read/write dev device
  Resolves: rhbz#1672188
  - Update ibacm_t policy after testing lastest version of this component
  Resolves: rhbz#1635674
  - Allow sensord_t domain to mmap own log files
  Resolves:rhbz#1656055
  - Label /dev/sev char device as sev_device_t
  Resolves: rhbz#1672188


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-58
changelog:
  - Allow ibacm_t domain to read system state and label all ibacm sockets and symlinks as ibacm_var_run_t in /var/run
  Resolves: rhbz#1635674
  - Update mount_read_pid_files macro to allow also list mount_var_run_t dirs
  Resolves: rhbz#1664448
  - Allow userdomain to stop systemd user session during logout.
  Resolves: rhbz#1664448


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-60
changelog:
  - Update kdump_manage_crash() interface to allow also manage dirs by caller domain
  Resolves: rhbz#1627861


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-61
changelog:
  - Add dac_override capability for sbd_t SELinux domain
  Resolves: rhbz#1677325
  - Allow syslogd_t domain to send null signal to all domains on system
  Resolves: rhbz#1676923


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-5
changelog:
  - Add domain transition that systemd labeled as init_t can execute spamd_update_exec_t binary to run newly created process as spamd_update_t
  Resolves :rhbz#1656837
  - Remove allow rule for virt_qemu_ga_t to write/append user_tmp_t files
  Resolves: rhbz#1648854
  - Label /var/run/user/*/dbus-1 as session_dbusd_tmp_t
  Resolves:rhbz#1688671
  - Add dac_override capability to namespace_init_t domain
  Resolves: rhbz#1557420
  - Label /usr/sbin/corosync-qdevice as cluster_exec_t
  Resolves: rhbz#1690925
  - Label /usr/libexec/dnf-utils as debuginfo_exec_t
  Resolves: rhbz#1711183
  - Label /usr/bin/tshark as wireshark_exec_t
  Resolves: rhbz#1710962
  - Allow rhsmcertd_t domain to read rpm cache files
  Resolves: rhbz#1641648
  - Allow associate all filesystem_types with fs_t
  Resolves: rhbz#1614209
  - Allow init_t to manage session_dbusd_tmp_t dirs
  Resolves: rhbz#1688671
  - Allow systemd_gpt_generator_t to read/write to clearance
  Resolves: rhbz#1558573
  - Allow su_domain_type to getattr to /dev/gpmctl
  Resolves: rhbz#1593667
  - Update userdom_login_user_template() template to make working systemd user session for guest and xguest SELinux users
  Resolves: rhbz#1709372


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-6
changelog:
  - Allow kadmind_t domain to read pkcs11 module configs
  Resolves: rhbz#1664983
  - Allow kadmind_t domain to read named_cache_t files
  Resolves: rhbz#1703241
  - Fix bind_read_cache() interface to allow only read perms to caller domains
  - Allow chronyc_t domain to create own tmpfiles and allow communicate send data over unix dgram sockets
  Resolves: rhbz#1711909
  - Allow wireshark_t domain to create fifo temp files
  Resolves: rhbz#1711005
  - Add domain transition that systemd labeled as init_t can execute spamd_update_exec_t binary to run newly created process as spamd_update_t
  Resolves :rhbz#1656837
  - Remove allow rule for virt_qemu_ga_t to write/append user_tmp_t files
  Resolves: rhbz#1648854
  - Label /var/run/user/*/dbus-1 as session_dbusd_tmp_t
  Resolves:rhbz#1688671
  - Add dac_override capability to namespace_init_t domain
  Resolves: rhbz#1557420
  - Label /usr/sbin/corosync-qdevice as cluster_exec_t
  Resolves: rhbz#1690925
  - Label /usr/libexec/dnf-utils as debuginfo_exec_t
  Resolves: rhbz#1711183
  - Allow rtkit_scheduled for sysadm
  Resolves: rhbz#1703241
  - Fix find commands in Makefiles
  - Allow associate all filesystem_types with fs_t
  Resolves: rhbz#1614209
  - Allow init_t to manage session_dbusd_tmp_t dirs
  Resolves: rhbz#1688671
  - Allow systemd_gpt_generator_t to read/write to clearance
  Resolves: rhbz#1558573
  - Allow su_domain_type to getattr to /dev/gpmctl
  Resolves: rhbz#1593667


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-7
changelog:
  - Allow kadmind_t domain to read home config data
  Resolves: rhbz#1664983
  - Allow sbd_t domain to readwrite cgroups
  Resolves: rhbz#1715134
  - Label /var/log/pacemaker/pacemaker as cluster_var_log_t
  Resolves: rhbz#1712058
  - Allow certmonger_t domain to manage named cache files/dirs


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-9
changelog:
  - Allow redis_t domain to read public sssd files
  Resolves: rhbz#1718200
  - Label /usr/sbin/nft as iptables_exec_t
  Resolves: rhbz#1656891


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-10
changelog:
  - Allow qpidd_t domain to getattr all fs_t filesystem and mmap usr_t files
  - Label /var/kerberos/krb5 as krb5_keytab_t
  Resolves: rhbz#1669975
  - Allow sbd_t domain to manage cgroup dirs
  Resolves: rhbz#1715134
  - Allow wireshark_t domain to create netlink netfilter sockets
  Resolves: rhbz#1711005
  - Allow gpg_agent_t domain to use nsswitch
  Resolves: rhbz#1567073
  - Allow httpd script types to mmap httpd rw content
  Resolves: rhbz#1693137
  - Allow confined users to login via cockpit
  Resolves: rhbz#1718814
  - Replace "-" by "_" in speechdispatcher types names
  - Change condor_domain declaration in condor_systemctl
  - Update interface networkmanager_manage_pid_files() to allow manage also dirs
  Resolves: rhbz#1720070
  - Update virt_use_nfs() boolean to allow virt_t to mmap nfs_t files
  Resolves: rhbz#1719083
  - Fix all interfaces which cannot by compiled because of typos
  Resolves: rhbz#1687460
  - Allow auditd_t domain to send signals to audisp_remote_t domain
  Resolves: rhbz#1726659
  - Allow associate efivarfs_t on sysfs_t
  Resolves: rhbz#1709747
  - Allow userdomain attribute to manage cockpit_ws_t stream sockets
  Resolves: rhbz#1718814
  - Allow ssh_agent_type to read/write cockpit_session_t unnamed pipes
  - Add interface ssh_agent_signal()
  - Dontaudit unpriv_userdomain to manage boot_t files
  Resolves: rhbz#1723773
  - Allow crack_t domain read /et/passwd files
  Resolves: rhbz#1721132
  - Allow dhcpc_t domain to manage network manager pid files
  Resolves: rhbz#1720070


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-12
changelog:
  - Make working wireshark execute byt confined users staff_t and sysadm_t
  Resolves: rhbz#1712788
  - Label user cron spool file with user_cron_spool_t
  Resolves: rhbz#1727342
  - Allow ptp4l_t domain to write to pmc socket which is created by pmc command line tool
  Resolves: rhbz#1668667
  - Update svnserve_t policy to make working svnserve hooks
  Resolves: rhbz#1729955
  - Allow varnishlog_t domain to check for presence of varnishd_t domains
  Resolves: rhbz#1730270
  - Allow lsmd_t domain to execute /usr/bin/debuginfo-install
  Resolves: rhbz#1720648
  - Update sandboxX policy to make working firefox inside SELinux sandbox
  Resolves: rhbz#1663874
  - Remove allow rule from svirt_transition_svirt_sandbox interface to don't allow containers to connect to random services
  Resolves: rhbz#1695248
  - Allow httpd_t domain to read /var/lib/softhsm/tokens to allow httpd daemon to use pkcs#11 devices
  Resolves: rhbz#1690484
  - Allow opafm_t domain to modify scheduling information of another process.
  Resolves: rhbz#1725874
  - Allow gssd_t domain to list tmpfs_t dirs
  Resolves: rhbz#1674470
  - Allow mdadm_t domain to read tmpfs_t files
  Resolves: rhbz#1669996
  - Allow sbd_t domain to check presence of processes labeled as cluster_t
  Resolves: rhbz#1669595
  - Dontaudit httpd_sys_script_t to read systemd unit files
  Resolves: rhbz#1670139
  - Allow blkmapd_t domain to read nvme devices
  Resolves: rhbz#1669985
  - Update cpucontrol_t domain to make working microcode service
  Resolves: rhbz#1669485
  - Allow domain transition from logwatch_t do postfix_postqueue_t
  Resolves: rhbz#1669162
  - Allow chronyc_t domain to create and write to non_security files in case when sysadmin is redirecting output to file e.g: 'chronyc -n tracking > /var/lib/test'
  Resolves: rhbz#1696252
  - Allow httpd_sys_script_t domain to mmap httpdcontent
  Resolves: rhbz#1693137
  - Allow sbd_t to manage cgroups_t files
  Resolves: rhbz#1715134
  - Update wireshark policy to make working tshar labeled as wireshark_t
  Resolves: rhbz#1711005
  - Update virt_use_nfs boolean to allow svirt_t domain to mmap nfs_t files
  Resolves: rhbz#1719083
  - Allow sbd_t domain to use nsswitch
  Resolves: rhbz#1723498
  - Allow sysadm_t and staff_t domains to read wireshark shared memory
  Resolves: rhbz#1712788
  - Label /usr/libexec/utempter/utempter  as utemper_exec_t
  Resolves: rhbz#1729571
  - Allow unconfined_domain_type to setattr own process lnk files.
  Resolves: rhbz#1730500
  - Add interface files_write_generic_pid_sockets()
  - Dontaudit writing to user home dirs by gnome-keyring-daemon
  Resolves: rhbz#1689797
  - Allow staff and admin domains to setpcap in user namespace
  Resolves: rhbz#1673922
  - Allow staff and sysadm to use lockdev
  Resolves: rhbz#1673269
  - Allow staff and sysadm users to run iotop.
  Resolves: rhbz#1671241
  - Dontaudit traceroute_t domain require sys_admin capability
  Resolves: rhbz#1671672
  - Dontaudit dbus chat between kernel_t and init_t
  Resolves: rhbz#1669095
  - Allow systemd labeled as init_t to create mountpoints without any specific label as default_t
  Resolves: rhbz#1696144


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-13
changelog:
  - Allow search krb5_keytab_t dirs for interfaces kerberos_read_keytab() and kerberos_rw_keytab
  Resolves: rhbz#1730144
  - Allow virtlockd process read virtlockd.conf file
  Resolves: rhbz#1733185
  - Relabel  /usr/sbin/virtlockd from virt_exec_t to virtlogd_exec_t.
  Resolves: rhbz#1733185
  - Allow brltty to request to load kernel module
  Resolves: rhbz#1689955
  - Add svnserve_tmp_t label forl svnserve temp files to system private tmp
  Resolves: rhbz#1729955
  - Dontaudit svirt_tcg_t domain to read process state of libvirt
  Resolves: rhbz#1732500
  - Allow mysqld_t domain to domtrans to ifconfig_t domain when executing ifconfig tool
  Resolves: rhbz#1732381
  - Allow cyrus work with PrivateTmp
  Resolves: rhbz#1725023
  - Make cgdcbxd_t domain working with SELinux enforcing.
  Resolves: rhbz#1651991
  - Remove system_r role from staff_u user.
  Resolves: rhbz#1677052
  - Add systemd_private_tmp_type attribute
  Resolves: rhbz#1725023
  - Allow systemd to load kernel modules during boot process.
  Resolves: rhbz#1644805


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-15
changelog:
  - Dontaudit abrt_t domain to read root_t files
  Resolves: rhbz#1734403
  - Allow ipa_dnskey_t domain to read kerberos keytab
  Resolves: rhbz#1730144
  - Update ibacm_t policy
  - Allow dlm_controld_t domain setgid capability
  Resolves: rhbz#1738608
  - Allow auditd_t domain to create auditd_tmp_t temporary files and dirs in /tmp or /var/tmp
  Resolves: rhbz#1740146
  - Update systemd_dontaudit_read_unit_files() interface to dontaudit alos listing dirs
  Resolves: rhbz#1670139


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-17
changelog:
  - Label /usr/libexec/microcode_ctl/reload_microcode as cpucontrol_exec_t
  Resolves: rhbz#1669485
  - Fix typo in networkmanager_append_log() interface
  Resolves: rhbz#1687460
  - Update gpg policy to make ti working with confined users
  Resolves: rhbz#1640296


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-20
changelog:
  - Label /var/log/hawkey.log as rpm_log_t and update rpm named filetrans interfaces.
  - Allow sysadm_t to create hawkey log file with rpm_log_t SELinux label
  Resolves: rhbz#1720639


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-21
changelog:
  - Allow user_mail_domain attribute to manage files labeled as etc_aliases_t.
  Resolves: rhbz#1750405
  - Allow dlm_controld_t domain to read random device
  Resolves: rhbz#1752943
  - Allow haproxy_t domain to read network state of system
  Resolves: rhbz#1746974
  - Allow avahi_t to send msg to lpr_t
  Resolves: rhbz#1752843
  - Create new type ipmievd_helper_t domain for loading kernel modules.
  Resolves: rhbz#1673804
  - networkmanager: allow NetworkManager_t to create bluetooth_socket
  Resolves: rhbz#1747768
  - Label /etc/named direcotory as named_conf_t
  Resolves: rhbz#1759505
  - Update aide_t domain to allow this tool to analyze also /dev filesystem
  Resolves: rhbz#1758265
  - Update zebra SELinux policy to make it work also with frr service
  Resolves: rhbz#1714984
  - Allow chronyd_t domain to manage and create chronyd_tmp_t dirs,files,sock_file objects.
  Resolves: rhbz#1711909
  - Allow chronyc_t domain to append to all non_security files
   Resolves: rhbz#1696252
  - Allow httpd_t domain to read/write named_cache_t files
  Resolves: rhbz#1690484
  - Add new interface bind_rw_cache()
  Resolves: rhbz#1690484
  - Label /var/run/mysql as mysqld_var_run_t
  Resolves: rhbz#1687867
  - Allow cupsd_t domain to create directory with name ppd in dirs labeled as cupsd_etc_t with label cupsd_rw_etc_t.
  Resolves: rhbz#1612552
  - Update cron_role, cron_admin_role and cron_unconfined_role to avoid *_t_t types
  Resolves: rhbz#1647971
  - Allow sandbox_web_type domains to sys_ptrace and sys_chroot in user namespaces
  Resolves: rhbz#1663874
  - Update gnome_dontaudit_read_config
  Resolves: rhbz#1663874
  - Update  tomcat_can_network_connect_db boolean to allow tomcat domains also connect to redis ports
  Resolves: rhbz#1687499
  - Update keepalived policy
  Resolves: rhbz#1728332
  - Add sys_admin capability for keepalived_t labeled processes
  Resolves: rhbz#1729174
  - Fix abrt_upload_watch_t in abrt policy
  Resolves: rhbz#1737419
  - Label /dev/shm/dirsrv/ with dirsrv_tmpfs_t label
  Resolves: rhbz#1737550
  - Allow amanda_t to manage its var lib files and read random_device_t
  Resolves: rhbz#1739137
  - Allow zebrat_t domain to read state of NetworkManager_t processes BZ(1739983)
  Resolves: rhbz#1743684
  - Allow pesign_t domain to read/write named cache files.
  Resolves: rhbz#1745429
  - Allow login user type to use systemd user session
  Resolves: rhbz#1727887
  - Allow avahi_t to send msg to xdm_t
  Resolves: rhbz#1755401
  - Allow ldconfig_t domain to manage initrc_tmp_t objects
  Resolves: rhbz#1756006
  - Add new interface init_write_initrc_tmp_pipes()
  - Add new interface init_manage_script_tmp_files()
  - Add new interface udev_getattr_rules_chr_files()
  - Run lvmdbusd service as lvm_t
  Resolves: rhbz#1726166
  - Label 2618/tcp and 2618/udp as priority_e_com_port_t
  - Label 2616/tcp and 2616/udp as appswitch_emp_port_t
  - Label 2615/tcp and 2615/udp as firepower_port_t
  - Label 2610/tcp and 2610/udp as versa_tek_port_t
  - Label 2613/tcp and 2613/udp as smntubootstrap_port_t
  - Label 3784/tcp and 3784/udp as bfd_control_port_t
  - Allow systemd labeled as init_t domain to remount rootfs filesystem
  Resolves: rhbz#1698197
  - Add interface files_remount_rootfs()
  - New interface files_append_non_security_files()
  - Allow domains systemd_networkd_t and systemd_logind_t to chat over dbus
  Resolves: rhbz#1612552
  - Update userdomains to pass correct parametes based on updates from cron_*_role interfaces
   Resolves: rhbz#1647971
  - Dontaudit sys_admin capability for iptables_t SELinux domain
  Resolves: rhbz#1669040
  - Allow systemd labeled as init_t domain to read/write faillog_t. BZ(1723132)
  Resolves: rhbz#1671019
  - Allow userdomains to dbus chat with policykit daemon
  Resolves: rhbz#1727902
  - Allow ipsec_t domain to read/write named cache files
  Resolves: rhbz#1743777
  - Add sys_admin capability for ipsec_t domain
  Resolves: rhbz#1753662


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-22
changelog:
  - Allow ldconfig_t domain to manage initrc_tmp_t link files Allow netutils_t domain to write to initrc_tmp_t fifo files
  Resolves: rhbz#1756006
  - Allow user domains to manage user session services
  Resolves: rhbz#1727887
  - Allow staff and user users to get status of user systemd session
  Resolves: rhbz#1727887


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-23
changelog:
  - Label only regular files inside /usr/lib/frr direcotry as zebra_exec_t
  Resolves: rhbz#1714984
  - Dontaudit and disallow sys_admin capability for keepalived_t domain
  Resolves: rhbz#1729174
  - Allow processes labeled as keepalived_t domain to get process group
  Resolves: rhbz#1746955


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-24
changelog:
  - Allow confined users to run newaliases
  Resolves:rhbz#1750405
  - Add interface mysql_dontaudit_rw_db()
  Resolves: rhbz#1747926
  - Label /var/lib/xfsdump/inventory as amanda_var_lib_t
  Resolves: rhbz#1739137
  - Allow tmpreaper_t domain to read all domains state
  Resolves: rhbz#1765065
  - Allow ipa_ods_exporter_t domain to read krb5_keytab files
  Resolves: rhbz#1759900
  - Allow rhsmcertd_t domain to read rtas_errd lock files
  Resolves: rhbz#1744234
  - Add new interface rtas_errd_read_lock()
  Resolves: rhbz#1744234
  - Donaudit ifconfig_t domain to read/write mysqld_db_t files
  Resolves: rhbz#1747926


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-25
changelog:
  - Allow sssd_t domain to read gnome config and named cache files
  Resolves: rhbz#1743907
  - Allow httpd_t to signull mailman_cgi_t process
  Resolves: rhbz#1686462
  - Update virt_read_content interface to allow caller domain mmap virt_content_t block devices and files
  Resolves: rhbz#1758545
  - Allow cachefilesd_t domain to read/write cachefiles_device_t devices
  Resolves: rhbz#1750096
  - Remove setting label for /dev/cachefilesd char device from cachefilesd policy. This should be added in base policy
  Resolves: rhbz#1750096
  - Allow pcp_pmcd_t domain to bind on udp port labeled as statsd_port_t
  Resolves:rhbz#1746511
  - Label libvirt drivers as virtd_exec_t
  Resolves: rhbz#1745076
  - Update apache and pkcs policies to make active opencryptoki rules
  Resolves: rhbz#1744198
  - Introduce new bolean httpd_use_opencryptoki
  Resolves: rhbz#1744198
  - Allow gssproxy_t domain read state of all processes on system
  Resolves: rhbz#1752031
  - Dontaudit tmpreaper_t getting attributes from sysctl_type files
  Resolves: rhbz#1730204
  - Added macro for timedatex to chat over dbus.
  Resolves: rhbz#1730204
  - Run timedatex service as timedatex_t
  Resolves: rhbz#1730204
  - Run lldpd service as lldpad_t.
  Resolves: rhbz#1726246
  - Allow abrt_upload_watch_t domain to send dgram msgs to kernel processes and stream connect to journald
  - Allow tmpreaper_t domain to getattr files labeled as mtrr_device_t
  Resolves: rhbz#1765065
  - Allow rhsmcertd_t domain to read/write rtas_errd_var_lock_t files
  Resolves: rhbz#1744234
  - Allow tmpwatch process labeled as tmpreaper_t domain to execute fuser command.
  Resolves: rhbz#1765065
  - Update tmpreaper_t policy due to fuser command
  Resolves: rhbz#1765065
  - Allow fail2ban_t domain to create netlink netfilter sockets.
  Resolves: rhbz#1766415
  - Label /dev/cachefilesd as cachefiles_device_t
  Resolves: rhbz#1750096
  - Label udp 8125 port as statsd_port_t
  Resolves: rhbz#1746511
  - Allow systemd(init_t) to load kernel modules
  Resolves: rhbz#1758255
  - Dontaudit sys_admin capability for auditd_t domains
  Resolves: rhbz#1669040
  - Allow x_userdomain to dbus_chat with timedatex.
  Resolves: rhbz#1730204


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-26
changelog:
  - New policy for rrdcached
  Resolves: rhbz#1726255
  - Update timedatex policy
  - Update timedatex SELinux policy to to sychronizate time with GNOME and add new macro chronyd_service_status to chronyd.if
  - Add new macro systemd_timedated_status to systemd.if to get timedated service status
  Resolves: rhbz#1730204
  - Update lldpad_t policy module
  Resolves: rhbz#1726246
  - Dontaudit sandbox web types to setattr lib_t dirs
  Resolves: rhbz#1739858
  - Fix typo in cachefiles device
  Resolves: rhbz#1750096


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-27
changelog:
  - Allow timedatex_t domain dbus chat with both confined and unconfined users
  Resolves: rhbz#1771513
  - Fix typo bugs in rtas_errd_read_lock() interface
  Resolves: rhbz#1750096
  - Allow timedatex_t domain to systemctl chronyd domains
  Resolves: rhbz#1771513
  - Fix typo in dev_filetrans_all_named_dev()
  Resolves: rhbz#1750096


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-30
changelog:
  - Allow userdomain dbus chat with systemd_resolved_t
  Resolves: rhbz#1773463
  - Allow init_t read and setattr on /var/lib/fprintd
  Resolves: rhbz#1781696
  - Allow sysadm_t dbus chat with colord_t
  Resolves: rhbz#1772669
  - Allow confined users run fwupdmgr
  Resolves: rhbz#1772619
  - Allow confined users run machinectl
  Resolves: rhbz#1772625
  - Allow systemd labeled as init_t domain to create dirs labeled as var_t
  Resolves: rhbz#1778126
  - Allow systemd labeled as init_t domain to manage faillog_t objects
  Resolves: rhbz#1671019
  - Add fprintd_read_var_lib_dir and fprintd_setattr_var_lib_dir interfaces
  Resolves: rhbz#1781696
  - Allow pulseaudio create .config and dgram sendto to unpriv_userdomain
  Resolves: rhbz#1703231
  - Allow abrt_dump_oops_t domain to create udp sockets BZ(1778030)
  Resolves: rhbz#1777761
  - Change type in transition for /var/cache/{dnf,yum} directory
  Resolves: rhbz#1686833
  - Revert "Update zebra SELinux policy to make it work also with frr service"
  This reverts commit 73653250a252ad6eefcb3aae00749017e396ab8d.
  - Revert "Label only regular files inside /usr/lib/frr direcotry as zebra_exec_t"
  This reverts commit a19eb1021cbd6c637344954cead54caae081e07c.
  - Allow stratis_t domain to request load modules
  Resolves: rhbz#1726259
  - Allow stratisd to connect to dbus
  Resolves: rhbz#1726259
  - Run stratisd service as stratisd_t
  Resolves: rhbz#1726259
  - Add support for smart card authentication in cockpit BZ(1690444)
  Resolves: rhbz#1771414
  - cockpit: Support split-out TLS proxy
  Resolves: rhbz#1771414
  - cockpit: Allow cockpit-session to read cockpit-tls state
  Resolves: rhbz#1771414
  - Update cockpit policy
  Resolves: rhbz#1771414
  - cockpit: Support https instance factory
  Resolves: rhbz#1771414
  - cockpit: Allow cockpit-session to read cockpit-tls state directory
  Resolves: rhbz#1771414
  - Fix nonexisting types in rtas_errd_rw_lock interface
  Resolves: rhbz#1744234


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-33
changelog:
  - Update files_create_var_lib_dirs() interface to allow caller domain also set attributes of var_lib_t directory
  Resolves: rhbz#1778126


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-34
changelog:
  - Added macro for stratisd to chat over dbus
  - Add dac_override capability to stratisd_t domain
  - Allow userdomain to chat with stratisd over dbus.
  Resolves: rhbz#1787298


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-35
changelog:
  - Allow stratisd_t domain to read/write fixed disk devices and removable devices.
  Resolves: rhbz#1790795


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-37
changelog:
  - Make stratisd_t domain unconfined for RHEL-8.2
  Resolves: rhbz#1791557
  - stratisd_t policy updates
  Resolves: rhbz#1791557


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-39
changelog:
  - Allow vhostmd communication with hosted virtual machines
  - Add and update virt interfaces
  Resolves: rhbz#1782925


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-41
changelog:
  - Allow NetworkManager read its unit files and manage services
  - Mark nm-cloud-setup systemd units as NetworkManager_unit_file_t
  Resolves: rhbz#1806894


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-41.1
changelog:
  - Allow ssh-keygen create file in /var/lib/glusterd
  Resolves: rhbz#1821759
  - Update ctdbd_manage_lib_files() to also allow mmap ctdbd_var_lib_t files
  Resolves: rhbz#1821226
  - Remove container interface calling by named_filetrans_domain.


author: Tomas Orsava <torsava@redhat.com> - 2.18.4-6
changelog:
  - Skip all tests needing httpbin: httpbin has too many dependencies to be
    shipped in RHEL just for build-time package tests


author: Eric Sandeen <sandeen@redhat.com> - 1.0.1-2
changelog:
  - Upstream respun the release tarball to re-include top-level dir
  - drop exclude of bno_plot.py[co], not getting built now?


author: Tomas Orsava <torsava@redhat.com> - 1.2.0-9
changelog:
  - Switch hardcoded python3 shebangs into the %{__python3} macro
  - Add missing BuildRequires on python3-devel so that %{__python3} macro is
    defined


author: - Joseph Chapman <jochapma@redhat.com> - 6.1.0.0-4
changelog:
  - Fix vdostats name in nagios examples
  - Build only on the x86_64 architecture
  - Add systemd files
  - Resolves: rhbz#1480047


author: - Joseph Chapman <jochapma@redhat.com> - 6.1.0.46-9
changelog:
  - update manpage to not allow 0 as an option
  - enforce maximum vdoPhysicalThreads
  - update manpage to describe maximum vdoPhysicalThreads
  - Resolves: rhbz#1510405
  - Resolves: rhbz#1511075
  - Resolves: rhbz#1511085
  - Resolves: rhbz#1511091


author: - Joseph Chapman <jochapma@redhat.com> - 6.1.0.55-10
changelog:
  - manual pages: note logical size limit of 4P
  - manual pages: make cache size/thread count link clearer
  - Resolves: rhbz#1508452
  - Resolves: rhbz#1511042


author: - Joseph Chapman <jochapma@redhat.com> - 6.1.0.89-13
changelog:
  - Build changes for UUID
  - Limit VDO physical size
  - Limit command options to those applicable to the subcommand
  - Fix vdo --modifyBlockMapPeriod
  - Report missing command option appropriately for all subcommands
  - Fix behavior of --indexMem when there's not enough memory
  - Remove obsolete nagios plugin from examples
  - Better error behavior for failing vdo status commands
  - Fix boundary check error for vdoLogicalSize
  - Resolves: rhbz#1507927
  - Resolves: rhbz#1508452
  - Resolves: rhbz#1508544
  - Resolves: rhbz#1508918
  - Resolves: rhbz#1509002
  - Resolves: rhbz#1510567
  - Resolves: rhbz#1512631
  - Resolves: rhbz#1522943


author: - Joseph Chapman <jochapma@redhat.com> - 6.1.0.97-13
changelog:
  - Remove vdo --noRun option
  - Clean up vdo error handling
  - Prevent python stack traces on vdo errors
  - Add more bounds checking to indexMem
  - Resolves: rhbz#1508544
  - Resolves: rhbz#1508918
  - Resolves: rhbz#1520991
  - Resolves: rhbz#1522754


author: - Joseph Chapman <jochapma@redhat.com> - 6.1.0.106-13
changelog:
  - Handle bogus --confFile and --logfile arguments
  - Produce more informative vdo manager high-level help
  - Generate command-specific unrecognized argument messages
  - Resolves: rhbz#1520927
  - Resolves: rhbz#1522750
  - Resolves: rhbz#1525560


author: - Joseph Chapman <jochapma@redhat.com> - 6.1.0.114-14
changelog:
  - VDO automatically chooses the proper write policy by default
  - Package uninstall removes vdo.service symlinks
  - Resolves: rhbz#1525305
  - Resolves: rhbz#1531047


author: - Joseph Chapman <jochapma@redhat.com> - 6.1.0.130-15
changelog:
  - vdo growLogical by less than 4K gives correct error
  - Fix URL to point to GitHub tree
  - Resolves: rhbz#1532653
  - Resolves: rhbz#1539059


author: - Joseph Chapman <jochapma@redhat.com> - 6.1.0.146-16
changelog:
  - VDO start command now does index memory checking
  - Module target is now "vdo" instead of "dedupe"
  - VDO remove with no device no longer puts a spurious file in /dev
  - ANsible module no longer fails on modification operations
  - Resolves: rhbz#1510567
  - Resolves: rhbz#1530358
  - Resolves: rhbz#1535597
  - Resolves: rhbz#1536214


author: - Andy Walsh <awalsh@redhat.com> - 6.2.0.4-1
changelog:
  - Updated to use github for Source0
  - Reformatted tags to be easier to read
  - Initial RHEL8 RPM rhbz#1503786


author: - Andy Walsh <awalsh@redhat.com> - 6.2.0.32-3
changelog:
  Note: This is a pre-release version, future versions of VDO may not support
        VDO devices created with this version.
  - Add a library, libuser.a, to provide easy access to VDO user space code
    for other projects.
  - Fixed a bug in vdo script when /dev/disk/by-id does not exist.
  - Fixed an internationalization bug in the vdo script's --indexMemory
    option.
  - Changed vdo script to not accept --vdoSlabSize=0 as a way of specifying
    the default since it was confusing. The default can be obtained by merely
    omitting the parameter entirely.


author: - Andy Walsh <awalsh@redhat.com> - 6.2.0.35-3
changelog:
  Note: This is a pre-release version, future versions of VDO may not support
        VDO devices created with this version.
  - Added validation that the release version numbers in the geometry and
    super block match on load.
  - Fixed bug where VDO would always be created with a dense index even when
    a sparse index was requested.
  - Fixed compilation problems on newer versions of GCC.


author: - Andy Walsh <awalsh@redhat.com> - 6.2.0.71-4
changelog:
  Note: This is a pre-release version, future versions of VDO may not support
  VDO devices created with this version.
  - Modified vdo script to reqiure --force to remove a VDO volume with no
    device.
  - Improved man pages.
  - Converted python tools to use python 3.


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.9-1
changelog:
  - New upstream bugfix release
  - Adds a new tdbrestore utility
  - Convert to new WAF build-system
  - Add python bindings in new python-tdb subpackage


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.9-7
changelog:
  - Let rpmbuild strip binaries, make build more verbose.
  - Original patch by Ville SkyttÃ¤ <ville.skytta@iki.fi>


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.10-15
changelog:
  - New upstream release 1.2.10
  - Remove upstreamed patches
  - Provides functionality for the upcoming Samba 4 beta


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.3.12-5
changelog:
  - rhbz#1401175 - Missing symbol versioning provided by libtdb.so
  - Fix configure time detection with -Werror=implicit-function-declaration
    -Werror=implicit-int
  - https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.3.13-1
changelog:
  - New upstream release 1.3.13
  - removed Group fields (new packaging policy)
  - %defattr() is no longer needed


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.16-1
changelog:
  - New upstream release 1.3.16
  - Use RHEL_ALLOW_PYTHON2_FOR_BUILD=1 until libtalloc uses waf3
  - Patch the waf script to explicitly call python2 as "env python" doesn't
    yield py2 anymore


author: Trond Eivind Glomsrød <teg@redhat.com> 0.10.38-6
changelog:
  - Fix handling of multiline entries (rest of #50065)
  - don't use the references of the last entry in a po file
  - remove duplicates when inverting
  - Own the en@quot and en@boldquot locale dirs (#52164)
  - Handle entries with a first line of "" as identical to those
    without


author: Trond Eivind Glomsrød <teg@redhat.com> 0.10.40-1
changelog:
  - 0.10.40 - libintl is now LGPLed (it was GPLed). Note that RHL
    uses the glibc version, and don't include libintl from gettext.
  - include new man pages
  - don't include the elisp mode - bundle it into the main emacs package,
    like we do for XEmacs.
  - README-alpha no longer exists, so don't list it as a doc file


author: Leon Ho <llch@redhat.com>
changelog:
  - packaged lib files for devel
  - moved some of the files to different sub-pkg
  - fix problem on x86_64 build


author: Leon Ho <llch@redhat.com>
changelog:
  - use --without-included-gettext to avoid the need of libintl.so (#125497)
  - remove preloadable_libintl.so


author: Leon Ho <llch@redhat.com>
changelog:
  - move java stuff to gettext-devel (#132239)
  - add BuildRequires: gcc-c++ (#132518)
  - add some missing install-info and ldconfig (#131272)
  - fix dir ownership (#133696)
  - run autotools for 1.9


author: Leon Ho <llch@redhat.com>
changelog:
  - updated to 0.14.3
  - fixed compiling problem on gcc4 (#150992)
  - fixed Group for -devel (#138303)
  - moved gettextize and autopoint to -devel (#137542, #145768)
  - moved some of the man pages


author: Jens Petersen <petersen@redhat.com> - 0.14.6-1
changelog:
  - update to 0.14.6
  - include preloadable_libintl.so again (Roozbeh Pournader, #149809)
  - remove .la files (Kjartan Maraas, #172624)
  - cleanup spec file


author: Jens Petersen <petersen@redhat.com> - 0.16.1-4
changelog:
  - protect install-info in devel %post and %preun too (Ville Skyttä, #223689)
  - forward port fix to reset of timestamp of examples ChangeLog for
    brp-java-repack-jars libintl.jar multilib conflict (#205207)


author: Jens Petersen <petersen@redhat.com> - 0.16.1-6
changelog:
  - add buildjar switch for building of libintl.jar
  - lots of spec file cleanup (Mamoru Tasaka, #225791):
  - preserve timestamps of installed files
  - disable building of static library
  - use %find_lang for .mo files
  - remove examples from -devel package
  - do not own en@*quot locale dirs
  - set preloadable_libintl.so executable
  - add ChangeLog to -devel package
  - add %check to run make check
  - add gettext-tools-tests-lang-gawk-fail.patch to work around gawk test failure


author: Jens Petersen <petersen@redhat.com> - 0.16.1-7
changelog:
  - set preloadable_libintl.so executable in %install so it gets stripped
  - force removal of infodir/dir since it is not there when /sbin is not in path


author: Jens Petersen <petersen@redhat.com> - 0.16.1-8
changelog:
  - add gettext-php-prinf-output-237241.patch to workaround php test failure
    (#237241)
  - add gettext-php-headers.patch to correct php test headers
    (Robert Scheck, #232832)


author: Jens Petersen <petersen@redhat.com> - 0.16.1-10
changelog:
  - buildrequire expat-devel
  - add gettext-xglade-include-expat-285701.patch to include expat.h
    to get xgettext to dl the right libexpat (Nils Philippsen, #285701)


author: Nils Philippsen <nphilipp@redhat.com> - 0.16.1-11
changelog:
  - remove gettext-xglade-include-expat-285701.patch, add
    gettext-xglade-define-xml-major-version-285701.patch to determine
    XML_MAJOR_VERSION from expat.h and define it in config.h (#285701)


author: Jens Petersen <petersen@redhat.com> - 0.16.1-12
changelog:
  - add a libs subpackage (suggested by Dwayne Bailey, #294891)
  - move preloadable_libintl.so to the devel subpackage


author: Jens Petersen <petersen@redhat.com> - 0.17-1
changelog:
  - update to 0.17 release
    - update License field to GPLv3
    - add gettext-0.17-open-args.patch to fix build from upstream
    - gettext-tools-tests-lang-gawk-fail.patch, gettext-php-headers.patch,
      gettext-php-prinf-output-237241.patch, and
      gettext-xglade-define-xml-major-version-285701.patch are no longer needed
  - drop superfluous po-mode-init.el source
  - no need to run autoconf and autoheader when building
  - pass -findirect-dispatch to gcj to make java binaries ABI independent
    (jakub,#427796)
  - move autopoint, gettextize, and {_datadir}/{name}/ to main package
  - force removal of emacs/ so install does not fail when no emacs


author: Ding-Yi Chen <dchen at redhat dot com> - 0.17-6
changelog:
  - Fixed Bug 456666 msghack doesn't check for mandatory cmd line params 
    by adding checking statements and display usage (msghack.py modified)
  - rpath patch for binary-or-shlib-defines-rpath in x86_64.


author: Ding-Yi Chen <dchen at redhat dot com> - 0.17-7
changelog:
  - Remove the gettext-libs docs, as they are talking about autoconf, libtool, 
    which are not directly related to the gettext-libs.
  - Remove unused definition and trailing space.
  - Fix the build failure with mock .


author: Jens Petersen <petersen@redhat.com> - 0.17-9
changelog:
  - add buildjava switch to allow turning off the java bits completely
  - add buildcheck to allow turning off make check
  - drop cvs requires for autopoint (Karl Lattimer, #469555)
  - add upstream gettext-xgettext-python-unicode-surrogate-473946.patch by
    Bruno Haible to fix xgettext handling of utf16 surrogates in python (#473946)


author: Jens Petersen <petersen@redhat.com> - 0.17-15
changelog:
  - bring back autopoint requires cvs (#517361)
  - requires info rather than /sbin/install-info
  - drop install_info and remove_install_info macros


author: Jens Petersen <petersen@redhat.com> - 0.17-16
changelog:
  - fix FTBFS by removing openmp.m4 which conflicts with recent autoconf (#539211)
  - cleanup gettext-0.17-rpathFix.patch
    - separate gl_AC_TYPE_LONG_LONG replacement to another patch
    - use trailing ':' for tests LD_LIBRARY_PATH
  - run autogen.sh with --quick and --skip-gnulib


author: Jens Petersen <petersen@redhat.com> - 0.17-17
changelog:
  - create emacs subpackages for po-mode.el (thanks for patch from
    Jonathan Underwood, #579452)
  - provide emacs-po-mode
  - move libgettextlib and libgettextsrc from base to libs subpackage
    (requested by Peter Robinson for blender, #579388)


author: Jens Petersen <petersen@redhat.com> - 0.18.1.1-1
changelog:
  - update to 0.18.1.1 release (#591044)
  - gettext-0.17-autopoint-CVS-441481.patch, gettext-0.17-long-long-int-m4.patch
    gettext-0.17-open-args.patch, and
    gettext-xgettext-python-unicode-surrogate-473946.patch are upstream
  - move libintl.jar to lib subpackage to avoid multilib problems
    (reported by Jim Radford in #595922)
  - disable java for now
  - use chrpath to get us out of rpath hell instead of complicated libtool hacks
  - enable git support


author: Jens Petersen <petersen@redhat.com> - 0.18.1.1-2
changelog:
  - correct license tag from GPLv3 to GPLv3+
  - subpackage autopoint which requires git (#574031)
  - no longer require cvs (#606746)
  - add bcond for git


author: Jens Petersen <petersen@redhat.com> - 0.18.1.1-3
changelog:
  - merge autopoint subpackage into devel to simplify deps (#625325)
  - have ABOUT-NLS only in the base package datadir


author: Jens Petersen <petersen@redhat.com> - 0.18.1.1-8
changelog:
  - add gettext-readlink-einval.patch to fix build on kernel >= 2.6.39 (#739188)
  - add optional buildrequires suggested in the DEPENDENCIES file


author: Jens Petersen <petersen@redhat.com> - 0.18.1.1-13
changelog:
  - base package now provides bundled(gnulib) to make it clear that
    gettext is built with bundled gnulib (#821757)


author: Daiki Ueno <dueno@redhat.com> - 0.19.1-2
changelog:
  - apply patch to msghack.py, for Python 3 compatibility (Closes: #1113425,
    thanks to Bohuslav "Slavek" Kabrda)


author: Daiki Ueno <dueno@redhat.com> - 0.19.2-5
changelog:
  - apply patch to fix infloop in autopoint (Closes: #1151238)
  - apply patch to support newer ncurses in F-22


author: Daiki Ueno <dueno@redhat.com> - 0.19.3-1
changelog:
  - update to 0.19.3 release
  - remove patches included in 0.19.3
  - remove autoconf/automake/libtool/bison from BR, as we don't do bootstrap


author: Daiki Ueno <dueno@redhat.com> - 0.19.7-3
changelog:
  - own .../gettext/its for third-party *.its files
  - add a work around for test-isinf failure on ppc64le (#1297387)


author: Pavel Raiskup <praiskup@redhat.com> - 0.19.8.1-7
changelog:
  - really remove Requires: git from gettext-devel (rhbz#1161284)
  - make the BuildRequires unconditional (rhbz#1416691)


author: Dave Jones <davej@redhat.com>
changelog:
  - Only enable microcode_ctl service if the CPU is capable.
  - Prevent microcode_ctl getting restarted multiple times on initlevel change (#141581)
  - Make restart/reload work properly
  - Do nothing if not started by root.


author: Dave Jones <davej@redhat.com>
changelog:
  - Create/remove the /dev/cpu/microcode dev node as needed.
  - Use correct path again for the microcode.dat.
  - Remove some no longer needed tests in the init script.


author: Dave Jones <davej@redhat.com>
changelog:
  - Drop the node creation/deletion change from previous release.
    It'll cause grief with selinux, and was a hack to get around
    a udev shortcoming that should be fixed properly.


author: Jarod Wilson <jwilson@redhat.com>
changelog:
  - Spec cleanup and macro standardization.
  - Update license
  - Update microcode data file to 20080131 revision.


author: Dave Jones <davej@redhat.com>
changelog:
  - Shorten sleep time during init.
    This really needs to be replaced with proper udev hooks, but this is
    a quick interim fix.


author: Kyle McMartin <kyle@redhat.com> 1.17-1.56
changelog:
  - Add AMD x86/x86-64 microcode. (Dated: 2009-10-09)
    Doesn't need microcode_ctl modifications as it's loaded by
    request_firmware() like any other sensible driver.
  - Eventually, this AMD firmware can probably live inside
    kernel-firmware once it is split out.


author: Anton Arapov <anton@redhat.com> 1.17-18
changelog:
  - Ship splitted microcode for Intel CPUs [#690930]
  - Include tool for splitting microcode for Intl CPUs (Kay Sievers )


author: Peter Jones <pjones@redhat.com> - 3-2
changelog:
  - Always provide macros for efi_arch and efi_alt_arch (and their _upper
    variants), and make efi_has_arch and efi_has_alt_arch 0 when they will be
    wrong.  This ensures everything can always expand when we're on a non-efi
    architecture.


author: Michal Schmidt <mschmidt@redhat.com> - 2.2.8-4
changelog:
  - Return support for crypto hw on s390.
  - Renamed to opencryptoki.
  - Simplified multilib by putting libs in subpackage as suggested by Dan Horák.


author: Dan Horák <dan[at]danny.cz> - 2.4.1-1
changelog:
  - new upstream release 2.4.1
  - convert from initscript to systemd unit
  - import fixes from RHEL-6 about root's group membership (#732756, #730903)


author: Dan Horák <dan[at]danny.cz> - 2.4.2-3
changelog:
  - add virtual opencryptoki(token) Provides to token modules and as Requires
    to main package (#904986)


author: Dan Horák <dan[at]danny.cz> - 3.0-8
changelog:
  - include token specific directories (#1013017, #1045775, #1054442)
  - fix pkcsconf crash for non-root users (#10054661)
  - the libs subpackage must care of creating the pkcs11 group, it's the first to be installed


author: Jakub Jelen <jjelen@redhat.com> 3.2-2
changelog:
  - Fix missing sources and libraries in makefiles causing undefined symbols (#1193560)
  - Make inline function compatible for GCC5


author: Jakub Jelen <jjelen@redhat.com> 3.2-3
changelog:
  - Few more undefined symbols fixed for s390(x) specific targets
  - Do not require --no-undefined, because s390(x) requires some


author: Than Ngo <than@redhat.com> - 3.10.0-3
changelog:
  - Resolves: #1657683, can't establish libica token in FIPS mode
  - Resolves: #1652856, EP11 token fails when using Strict-Session mode or VHSM-Mode


author: Than Ngo <than@redhat.com> - 3.11.0-3
changelog:
  - Resolves: #1667941, 3des tests failures due to FIPS incompatible test scenarios
  - Resolves: #1651731, ep11 token: enhanced IBM z14 functions
  - Resolves: #1651732, ep11 token: support m_*Single functions from ep11 lib
  - Resolves: #1525407, use CPACF hashes in ep11 token
  - Resolves: #1651238, rebase to 3.11.0
  - Resolves: #1682530, gating


author: Tomas Mraz <tmraz@redhat.com> - 1.1-3
changelog:
  - fix setting keycreate context
  - unify logging a bit
  - cleanup some warnings and fix a typo in TZ code
  - 450993 improve and fix inotify support


author: Marcela Mašláňová <mmaslano@redhat.com> - 1.4.1-1
changelog:
  - update to 1.4.1
  - create and own /var/spool/anacron/cron.{daily,weekly,monthly} to
   remove false warning about non existent files
  - Resolves: 517398


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.7-2
changelog:
  - use only systemd units with systemd
  - add trigger for restart on glibc, libselinux or pam upgrades (#699189)


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.8-4
changelog:
  - drop the without systemd build condition
  - add the chkconfig readding trigger to the sysvinit subpackage


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.10-5
changelog:
  - add support for RANDOM_DELAY - delaying job startups
  - pass some environment variables to processes (LANG, etc.) (#969761)
  - do not use putenv() with string literals (#971516)


author: Marcela Mašláňová <mmaslano@redhat.com> - 1.4.11-2
changelog:
  - scriptlets are not created correctly if systemd is not in BR 986698
  - remove sub-package sysvinit, which is not needed anymore
  - update license, anacron is under GPLv2+


author: Marcela Mašláňová <mmaslano@redhat.com> - 1.4.11-4
changelog:
  - some jobs are not executed because not all environment variables are set 995590
  - cronie's systemd script use "KillMode=process" 919290


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.12-3
changelog:
  - call PAM only for non-root user or non-system crontabs (#956157)
  - bypass the PAM check in crontab for root (#1169175)


author: Steve Dickson <steved@redhat.com> 0.1.4-1
changelog:
  - Initial commit
  - Spec reviewed (bz 228894)
  - Added the Provides/Obsoletes which should
    cause rpcbind to replace portmapper


author: Steve Dickson <steved@redhat.com> 0.1.4-2
changelog:
  - Added dependency on glibc-common which allows the
    rpcinfo command to be installed in the correct place.
  - Added dependency on man-pages so the rpcinfo man 
    pages don't conflict.
  - Added the creation of /var/lib/rpcbind which will be
    used to store state files.
  - Make rpcbind run with the 'rpc' uid/gid when it exists.


author: Jeremy Katz <katzj@redhat.com> - 0.1.4-4
changelog:
  - change man-pages requires into a conflicts as we don't have to have 
    man-pages installed, but if we do, we need the newer version


author: Steve Dickson <steved@redhat.com> 0.1.4-5
changelog:
  - Added dependency on setup which contains the correct
    rpcbind /etc/service entry which in turns stops 
    rpcbind from haning when NIS is enabled. (bz 236865)


author: Steve Dickson <steved@redhat.com> 0.1.4-8
changelog:
  - Fixed typo in init script (bz 248285)
  - Added autoconf rules to turn on secure host checking
    via libwrap. Also turned on host check by default (bz 248284)
  - Changed init script to start service in runlevel 2 (bz 251568)
  - Added a couple missing Requires(pre) (bz 247134)


author: Steve Dickson <steved@redhat.com> 0.1.4-11
changelog:
  - Reworked logic in initscript so the correct exit is 
    used when networking does not exist or is set up
    incorrectly.


author: Steve Dickson <steved@redhat.com> 0.1.4-12
changelog:
  - Changed is_loopback() and check_access() see if the calling
    address is an address on a local interface, just not a loopback
    address (bz 358621).


author: Steve Dickson <steved@redhat.com> 0.1.4-13
changelog:
  - Fixed connectivity with Mac OS clients by making sure handle_reply()
    sets the correct fromlen in its recvfrom() call (bz 244492)


author: Steve Dickson <steved@redhat.com> 0.1.4-14
changelog:
  - Fixed a warning in pmap_svc.c
  - Cleaned up warmstarts so uid are longer needed, also
    changed condrestarts to use warmstarts. (bz 428496)


author: Steve Dickson <steved@redhat.com> 0.1.6-2
changelog:
  - Added usptream patches 01 thru 03 that do:
      * Introduce helpers for ipprot/netid mapping
      * Change how we decide on the netids to use for portmap
      * Simplify port live check in pmap_svc.c


author: Steve Dickson <steved@redhat.com> 0.1.6-3
changelog:
  - Fixed a typo in the rpcbind.init script that stop warm starts
    from happening with conrestarts
  - Fixed scriptlet failure (bz 462533)


author: Steve Dickson <steved@redhat.com> - 0.2.0-2
changelog:
  - Fixed pre scriptle failure during upgrades (bz 507364)
  - Corrected the usage info to match what the rpcbind man
      page says. (bz 466332)
  - Correct package issues (bz 503508)


author: Steve Dickson <steved@redhat.com> - 0.2.0-18
changelog:
  - Fixed typo causing rpcbind to run as root (bz 734598)
  - Added /etc/sysconfig/rpcbind config file (bz 861025)


author: Steve Dickson <steved@redhat.com> - 0.2.2-0.0
changelog:
  - Updated to the latest upstream release: 0.2.2 (bz 747363)
  - Added BuildRequires systemd-compat-libs


author: Steve Dickson <steved@redhat.com> - 0.2.2-2.2
changelog:
  - Changed RPCBDIR to be /var/run so bindings are perserved
    during upgrades but not reboots.
  - Make sure rpcbind.socket gets enabled


author: Steve Dickson <steved@redhat.com> - 0.2.3-0.0
changelog:
  - Updated to latest upstream release: 0.2.3
  - Change RPCBDIR to be /tmp since that will exist after a 
    reboot and bindings wil be perserved during upgrades
    but not reboots.


author: Steve Dickson <steved@redhat.com> - 0.2.3-11.rc1
changelog:
  - Removing the braces from the ${RPCBIND_ARGS} in rpcbind.service (bz 1362201)
  - Stop enable rpcbind.socket with every update (bz 1324666)


author: Nils Philippsen <nils@redhat.com> - 0.2.4-8.rc2
changelog:
  - create and formally own the state directory so it is available from the time
    of first installation until reboot


author: Steve Dickson <steved@redhat.com> - 1.2.5-1
changelog:
  - Fixed stack buffer overflow in rpcinfo (bz 1637565)
  - Make sure /var/lib/rpcbind exists (bz 1628901)


author: Ville Skyttä <ville.skytta@iki.fi> - 2.2.5-1
changelog:
  - Update to 2.2.5.
  - Hardlink binaries instead of shipping duplicates (#785834).
  - Build with $RPM_LD_FLAGS.
  - Run test suite during build.


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-71.el8]
changelog:
  - [pci] pci/quirks: Add quirk to reset nvgpu at boot for the Lenovo ThinkPad P50 (Lyude Paul) [1677022]
  - [arm64] arm64, vmcoreinfo : Append 'MAX_USER_VA_BITS' to vmcoreinfo (Bhupesh Sharma) [1672962]
  - [md] dm thin: fix bug where bio that overwrites thin block ignores FUA (Mike Snitzer) [1679211]
  - [pci] PCI: Fix "try" semantics of bus and slot reset (Myron Stowe) [1662901]
  - [acpi] acpi/nfit: Fix bus command validation (Jeff Moyer) [1673958]
  - [pci] PCI/MSI: Return -ENOSPC from pci_alloc_irq_vectors_affinity() (Myron Stowe) [1667773]
  - [fs] NFS: Don't use page_file_mapping after removing the page (Benjamin Coddington) [1664190]
  - [fs] NFS: Fix up return value on fatal errors in nfs_page_async_flush() (Benjamin Coddington) [1664190]
  - [md] md: fix raid10 hang issue caused by barrier (Xiao Ni) [1630921]
  - [md] md/raid1: don't clear bitmap bits on interrupted recovery. (Xiao Ni) [1677360]
  - [virt] kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) (Paolo Bonzini) [1673843] {CVE-2019-6974}
  - [block] blk-mq: fix a hung issue when fsync (Ming Lei) [1674399]
  - [block] Revert "block: cover another queue enter recursion via BIO_QUEUE_ENTERED" (Ming Lei) [1673966]
  - [tools] perf tools: Check for null when copying nsinfo. (Jiri Olsa) [1676451]
  - [iommu] iommu/amd: Fix IOMMU page flush when detach device from a domain (Suravee Suthikulpanit) [1672476]


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 5-4
changelog:
  - Build with hardening flags (#1051344)
  - Fail nicely if no hardware generator is found (#892178)
  - Drop unneeded dependency


author: Neil Horman <nhorman@redhat.com> - 6.8-2
changelog:
  - Fix erroneous message due to bad errno check (bz 1776710)
  - Enable addition of 0 value for fill-watermark (bz 1776710)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Patch to build with neither RSA nor RSAref.
  - Miscellaneous FHS-compliance tweaks.
  - Fix for possibly-compressed man pages.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Move condrestart to server postun.
  - Move key generation to init script.
  - Actually use the right patch for moving the key generation to the init script.
  - Clean up the init script a bit.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to 2.1.1p4, which includes fixes for config file parsing problems.
  - Move the init script back.
  - Add Damien's quick fix for wackiness.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to 20000823 snapshot.
  - Change subpackage requirements from %{version} to %{version}-%{release}
  - Back out the pipe patch.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update x11-askpass to 1.0.2. (#17835)
  - Add BuildPreReqs for /bin/login and /usr/bin/rsh so that configure will
    always find them in the right place. (#17909)
  - Set the default path to be the same as the one supplied by /bin/login, but
    add /usr/X11R6/bin. (#17909)
  - Try to handle obsoletion of ssh-server more cleanly.  Package names
    are different, but init script name isn't. (#17865)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add BuildPreReq on /usr/include/security/pam_appl.h to be sure we always
    build PAM authentication in.
  - Try setting SSH_ASKPASS if gnome-ssh-askpass is installed.
  - Clean out no-longer-used patches.
  - Patch ssh-add to try to add both identity and id_dsa, and to error only
    when neither exists.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to OpenSSH 2.3.0p1.
  - Update to x11-askpass 1.1.0.
  - Enable keyboard-interactive authentication.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Resync with conditional options in Damien Miller's .spec file for an errata.
  - Change libexecdir from %{_libexecdir}/ssh to %{_libexecdir}/openssh.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Add the primes file from the latest snapshot to the main package (#20884).
  - Add the dev package to the prereq list (#19984).
  - Remove the default path and mimic login's behavior in the server itself.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Disable the built-in MD5 password support.  We're using PAM.
  - Take a crack at doing keyboard-interactive authentication with PAM, and
    enable use of it in the default client configuration so that the client
    will try it when the server disallows password authentication.
  - Build with debugging flags.  Build root policies strip all binaries anyway.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Merge multiple PAM text messages into subsequent prompts when possible when
    doing keyboard-interactive authentication.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update to x11-askpass 1.1.1. (#21301)
  - Don't second-guess fixpaths, which causes paths to get fixed twice. (#21290)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Don't treat pam_setcred() failure as fatal unless pam_authenticate() has
    succeeded, to allow public-key authentication after a failure with "none"
    authentication.  (#21268)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - More gettextizing.
  - Close all files after going into daemon mode (needs more testing).
  - Extract patch from CVS to handle auth banners (in the client).
  - Extract patch from CVS to handle compat weirdness.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Don't open a PAM session until we've forked and become the user (#25690).
  - Apply Andrew Bartlett's patch for letting pam_authenticate() know which
    host the user is attempting a login from.
  - Resync with parts of Damien Miller's openssh.spec from CVS.
  - Don't expose KbdInt responses in debug messages (from CVS).
  - Detect and handle errors in rsa_{public,private}_decrypt (from CVS).


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update for 2.5.0p1.
  - Use $RPM_OPT_FLAGS instead of -O when building gnome-ssh-askpass
  - Resync with parts of Damien Miller's openssh.spec from CVS, including
    update of x11 askpass to 1.2.0.
  - Only require openssl (don't prereq) because we generate keys in the init
    script now.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Update for 2.5.1p1.
  - Add init script mods from Pekka Savola.
  - Tweak the init script to match the CVS contrib script more closely.
  - Redo patch to ssh-add to try to adding both identity and id_dsa to also try
    adding id_rsa.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Redo patch to move pam_open_session after the server setuid()s to the user.
  - Rework the nopam patch to use be picked up by autoconf.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Chuck the closing patch.
  - Add a trigger to add host keys for protocol 2 to the config file, now that
    configuration file syntax requires us to specify it with HostKey if we
    specify any other HostKey values, which we do.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - Revert the patch to move pam_open_session.
  - Init script and spec file changes from Pekka Savola. (#28750)
  - Patch sftp to recognize '-o protocol' arguments. (#29540)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.5.2p1 (includes endianness fixes in the rijndael implementation)
  - don't enable challenge-response by default until we find a way to not
    have too many userauth requests (we may make up to six pubkey and up to
    three password attempts as it is)
  - remove build dependency on rsh to match openssh.com's packages more closely


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 2.5.2p2
  - call setcred() again after initgroups, because the "creds" could actually
    be group memberships


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - make do_pam_setcred() smart enough to know when to establish creds and
    when to reinitialize them
  - add in a couple of other fixes from Damien for inclusion in the errata


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - mention that challengereponse supports PAM, so disabling password doesn't
    limit users to pubkey and rsa auth (#34378)
  - bypass the daemon() function in the init script and call initlog directly,
    because daemon() won't start a daemon it detects is already running (like
    open connections)
  - require the version of openssl we had when we were built


author: Preston Brown <pbrown@redhat.com>
changelog:
  - remove explicit openssl requirement, fixes builddistro issue
  - make initscript stop() function wait until sshd really dead to avoid 
    races in condrestart


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - finish marking strings in the init script for translation
  - modify init script to source /etc/sysconfig/sshd and pass $OPTIONS to sshd
    at startup (change merged from openssh.com init script, originally by
    Pekka Savola)
  - refuse to do X11 forwarding if xauth isn't there, handy if you enable
    it by default on a system that doesn't have X installed


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - add in Simon Wilkinson's GSSAPI patch to give it some testing in-house,
    to be removed before the next beta cycle because it's a big departure
    from the upstream version


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix an error parsing the new default sshd_config
  - add a fix from Markus Friedl (via openssh-unix-dev) for ssh-keygen not
    dealing with comments right


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - change Copyright: BSD to License: BSD
  - add Markus Friedl's unverified patch for the cookie file deletion problem
    so that we can verify it
  - drop patch to check if xauth is present (was folded into cookie patch)
  - don't apply gssapi patches for the errata candidate
  - clear supplemental groups list at startup


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - pull cvs patch to add session initialization to no-pty sessions
  - pull cvs patch to not cut off challengeresponse auth needlessly
  - refuse to do X11 forwarding if xauth isn't there, handy if you enable
    it by default on a system that doesn't have X installed (#49263)


author: Nalin Dahyabhai <nalin@redhat.com> 2.9p2-7
changelog:
  - fix scp's server's reporting of file sizes, and build with the proper
    preprocessor define to get large-file capable open(), stat(), etc.
    (sftp has been doing this correctly all along) (#51827)
  - configure without --with-ipv4-default on RHL 7.x and newer (#45987,#52247)
  - pull cvs patch to fix support for /etc/nologin for non-PAM logins (#47298)
  - mark profile.d scriptlets as config files (#42337)
  - refer to Jason Stone's mail for zsh workaround for exit-hanging quasi-bug
  - change a couple of log() statements to debug() statements (#50751)
  - pull cvs patch to add -t flag to sshd (#28611)
  - clear fd_sets correctly (one bit per FD, not one byte per FD) (#43221)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 3.0p1
  - update to x11-ssh-askpass 1.2.4.1
  - change build dependency on a file from pam-devel to the pam-devel package
  - replace primes with moduli


author: Nalin Dahyabhai <nalin@redhat.com> 3.0p1-1
changelog:
  - merge some of Damien Miller <djm@mindrot.org> changes from the upstream
    3.0p1 spec file and init script


author: Nalin Dahyabhai <nalin@redhat.com> 3.0.2p1-3
changelog:
  - add patches from Simon Wilkinson and Nicolas Williams for GSSAPI key
    exchange, authentication, and named key support


author: Nalin Dahyabhai <nalin@redhat.com> SNAP-20020220
changelog:
  - update to SNAP-20020220 for testing purposes (you've been warned, if there's
    anything to be warned about, gss patches won't apply, I don't mind)


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-1
changelog:
  - require sharutils for building (mindrot #137)
  - require db1-devel only when building for 6.x (#55105), which probably won't
    work anyway (3.1 requires OpenSSL 0.9.6 to build), but what the heck
  - require pam-devel by file (not by package name) again
  - add Markus's patch to compile with OpenSSL 0.9.5a (from
    http://bugzilla.mindrot.org/show_bug.cgi?id=141) and apply it if we're
    building for 6.x


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-2gss
changelog:
  - reintroduce Simon's gssapi patches
  - add buildprereq for autoconf253, which is needed to regenerate configure
    after applying the gssapi patches
  - refresh to the latest version of Markus's patch to build properly with
    older versions of OpenSSL


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-3
changelog:
  - pull patch from CVS to avoid printing error messages when some of the
    default keys aren't available when running ssh-add
  - refresh to current revisions of Simon's patches


author: Nalin Dahyabhai <nalin@redhat.com> 3.1p1-4
changelog:
  - drop buildreq on db1-devel
  - require pam-devel by package name
  - require autoconf instead of autoconf253 again


author: Nalin Dahyabhai <nalin@redhat.com> 3.3p1-1
changelog:
  - update to 3.3p1
  - merge in spec file changes from upstream (remove setuid from ssh, ssh-keysign)
  - disable gtk2 askpass
  - require pam-devel by filename rather than by package for erratum
  - include patch from Solar Designer to work around anonymous mmap failures


author: Nalin Dahyabhai <nalin@redhat.com> 3.3p1-2
changelog:
  - rework the close-on-exit docs
  - include configuration file man pages
  - make use of nologin as the privsep shell optional


author: Nalin Dahyabhai <nalin@redhat.com> 3.5p1-2
changelog:
  - patch PAM configuration to use relative path names for the modules, allowing
    us to not worry about which arch the modules are built for on multilib systems


author: Nalin Dahyabhai <nalin@redhat.com> 3.5p1-6
changelog:
  - move scp to the -clients subpackage, because it directly depends on ssh
    which is also in -clients (#84329)


author: Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-6
changelog:
  - modify patch which clears the supplemental group list at startup to only
    complain if setgroups() fails if sshd has euid == 0
  - handle krb5 installed in %{_prefix} or elsewhere by using krb5-config


author: Nalin Dahyabhai <nalin@redhat.com> 3.6.1p2-11
changelog:
  - apply patch to store the correct buffer size in allocated buffers
    (CAN-2003-0693)
  - skip the initial PAM authentication attempt with an empty password if
    empty passwords are not permitted in our configuration (#103998)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - additional fix for apparently-never-happens double-free in buffer_free()
  - extend fix for #103998 to cover SSH1


author: Daniel Walsh <dwalsh@redhat.com> 3.6.1p2-34
changelog:
  * Wed Mar 03 2004 Phil Knirsch <pknirsch@redhat.com> 3.6.1p2-33.30.1
  - Built RHLE3 U2 update package.


author: Nalin Dahyabhai <nalin@redhat.com> 3.8.1p1-1
changelog:
  - request gssapi-with-mic by default but not delegation (flag day for anyone
    who used previous gssapi patches)
  - no longer request x11 forwarding by default


author: Nalin Dahyabhai <nalin@redhat.com> 3.9p1-8
changelog:
  - add a --enable-vendor-patchlevel option which allows a ShowPatchLevel option
    to enable display of a vendor patch level during version exchange (#120285)
  - configure with --disable-strip to build useful debuginfo subpackages


author: Tomas Mraz <tmraz@redhat.com>
changelog:
  - change permissions on pam.d/sshd to 0644 (#64697)
  - patch initscript so it doesn't kill opened sessions if
    the sshd daemon isn't running anymore (#67624)


author: Tomas Mraz <tmraz@redhat.com> 3.9p1-10
changelog:
  - enable trusted forwarding by default if X11 forwarding is 
    required by user (#137685 and duplicates)
  - disable protocol 1 support by default in sshd server config (#88329)
  - keep the gnome-askpass dialog above others (#69131)


author: Tomas Mraz <tmraz@redhat.com> 3.9p1-11
changelog:
  - don't call syslog in signal handler
  - allow password authentication when copying from remote
    to remote machine (#103364)


author: Tomas Mraz <tmraz@redhat.com> 4.0p1-2
changelog:
  - fixed Local/RemoteForward in ssh_config.5 manpage
  - fix fatal when Local/RemoteForward is used and scp run (#153258)
  - don't leak user validity when using krb5 authentication


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-3
changelog:
  - fix small regression caused by the nologin patch (#161956)
  - fix race in getpeername error checking (mindrot #1054)


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-4
changelog:
  - don't deadlock on exit with multiple X forwarded channels (#152432)
  - don't use X11 port which can't be bound on all IP families (#163732)


author: Tomas Mraz <tmraz@redhat.com> 4.1p1-5
changelog:
  - use x11-ssh-askpass if openssh-askpass-gnome is not installed (#165207)
  - install ssh-copy-id from contrib (#88707)


author: Tomas Mraz <tmraz@redhat.com> 4.2p1-2
changelog:
  - use include instead of pam_stack in pam config
  - use fork+exec instead of system in scp - CVE-2006-0225 (#168167)
  - upstream patch for displaying authentication errors


author: Warren Togami <wtogami@redhat.com> - 4.2p1-7
changelog:
  - xorg-x11-devel -> libXt-devel
  - rebuild for new xauth location so X forwarding works
  - buildreq audit-libs-devel
  - buildreq automake for aclocal
  - buildreq imake for xmkmf
  -  -D_GNU_SOURCE in flags in order to get it to build
     Ugly hack to workaround openssh defining __USE_GNU which is
     not allowed and causes problems according to Ulrich Drepper
     fix this the correct way after FC5test1


author: Nalin Dahyabhai <nalin@redhat.com> - 4.2p1-8
changelog:
  - work around missing gccmakedep by wrapping makedepend in a local script
  - remove now-obsolete build dependency on "xauth"


author: Tomas Mraz <tmraz@redhat.com> - 4.2p1-9
changelog:
  - drop x11-ssh-askpass from the package
  - drop old build_6x ifs from spec file
  - improve gnome-ssh-askpass so it doesn't reveal number of passphrase 
    characters to person looking at the display
  - less hackish fix for the __USE_GNU problem


author: Tomas Mraz <tmraz@redhat.com> - 4.3p1-2
changelog:
  - fixed another place where syslog was called in signal handler
  - pass locale environment variables to server, accept them there (#179851)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-3
changelog:
  - enable the subprocess in chroot to send messages to system log
  - sshd should prevent login if audit call fails


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-6
changelog:
  - improve selinux patch (by Jan Kiszka)
  - upstream patch for buffer append space error (#191940)
  - fixed typo in configure.ac (#198986)
  - added pam_keyinit to pam configuration (#198628)
  - improved error message when askpass dialog cannot grab
    keyboard input (#198332)
  - buildrequires xauth instead of xorg-x11-xauth
  - fixed a few rpmlint warnings


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-7
changelog:
  - dropped old ssh obsoletes
  - call the pam_session_open/close from the monitor when privsep is
    enabled so it is always called as root (patch by Darren Tucker)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-8
changelog:
  - drop the pam-session patch from the previous build (#201341)
  - don't set IPV6_V6ONLY sock opt when listening on wildcard addr (#201594)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-9
changelog:
  - don't report duplicate syslog messages, use correct local time (#189158)
  - don't allow spnego as gssapi mechanism (from upstream)
  - fixed memleaks found by Coverity (from upstream)
  - allow ip options except source routing (#202856) (patch by HP)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-10
changelog:
  - improve gssapi-no-spnego patch (#208102)
  - CVE-2006-4924 - prevent DoS on deattack detector (#207957)
  - CVE-2006-5051 - don't call cleanups from signal handler (#208459)


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-11
changelog:
  - merge sshd initscript patches
  - kill all ssh sessions when stop is called in halt or reboot runlevel
  - remove -TERM option from killproc so we don't race on sshd restart


author: Tomas Mraz <tmraz@redhat.com> - 4.3p2-13
changelog:
  - improved pam_session patch so it doesn't regress, the patch is necessary
    for the pam_session_close to be called correctly as uid 0


author: Tomas Mraz <tmraz@redhat.com> - 4.5p1-2
changelog:
  - support mls on labeled networks (#220487)
  - support mls level selection on unlabeled networks
  - allow / in usernames in scp (only beginning /, ./, and ../ is special)


author: Tomas Mraz <tmraz@redhat.com> - 4.5p1-8
changelog:
  - fix sftp client problems on write error (#247802)
  - allow disabling autocreation of server keys (#235466)


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-1
changelog:
  - upgrade to latest upstream
  - use libedit in sftp (#203009)
  - fixed audit log injection problem (CVE-2007-3102)


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-4
changelog:
  - do not copy /etc/localtime into the chroot as it is not
    necessary anymore (#193184)
  - call setkeycreatecon when selinux context is established
  - test for NULL privk when freeing key (#391871) - patch by
    Pierre Ossman


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-9
changelog:
  - set FD_CLOEXEC on client socket
  - apply real fix for window size problem (#286181) from upstream
  - apply fix for the spurious failed bind from upstream
  - apply open handle leak in sftp fix from upstream


author: Tomas Mraz <tmraz@redhat.com> - 4.7p1-10
changelog:
  - fix race on control master and cleanup stale control socket (#436311)
    patches by David Woodhouse


author: Tomas Mraz <tmraz@redhat.com> - 5.0p1-1
changelog:
  - upgrade to new upstream (#441066)
  - prevent initscript from killing itself on halt with upstart (#438449)
  - initscript status should show that the daemon is running
    only when the main daemon is still alive (#430882)


author: Tomas Mraz <tmraz@redhat.com> - 5.0p1-2
changelog:
  - add LANGUAGE to accepted/sent environment variables (#443231)
  - use pam_selinux to obtain the user context instead of doing it itself
  - unbreak server keep alive settings (patch from upstream)
  - small addition to scp manpage


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-1
changelog:
  - upgrade to new upstream release
  - fixed a problem with public key authentication and explicitely
    specified SELinux role


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-4
changelog:
  - set FD_CLOEXEC on channel sockets (#475866)
  - adjust summary
  - adjust nss-keys patch so it is applicable without selinux patches (#470859)


author: Tomas Mraz <tmraz@redhat.com> - 5.1p1-5
changelog:
  - remove obsolete --with-rsh (#478298)
  - add pam_sepermit to allow blocking confined users in permissive mode
    (#471746)
  - move system-auth after pam_selinux in the session stack


author: Jan F. Chadima <jchadima@redhat.com> - 5.2p1-20
changelog:
  - merged xmodifiers to redhat patch
  - merged gssapi-role to selinux patch
  - merged cve-2007_3102 to audit patch
  - sesftp patch only with WITH_SELINUX flag
  - rearange sesftp patch according to upstream request


author: Jan F. Chadima <jchadima@redhat.com> - 5.2p1-28
changelog:
  - Repair initscript to be acord to guidelines (#521860)
  - Add bugzilla# to application of edns and xmodifiers patch


author: Jan F. Chadima <jchadima@redhat.com> - 5.5p1-10 + 0.9.2-26
changelog:
  - Repair the reference in man ssh-ldap-helper(8)
  - Repair the PubkeyAgent section in sshd_config(5)
  - Provide example ldap.conf


author: Jan F. Chadima <jchadima@redhat.com> - 5.6p1-20 + 0.9.2-29
changelog:
  - reapair clientloop crash (#627332)
  - properly restore euid in case connect to the ssh-agent socket fails


author: Jan F. Chadima <jchadima@redhat.com> - 5.8p1-18 + 0.9.2-30
changelog:
  - add periodical reseeding of random generator 
  - change selinux contex for internal sftp in do_usercontext
  - exit(0) after sigterm


author: Jan F. Chadima <jchadima@redhat.com> - 5.8p1-20 + 0.9.2-30
changelog:
  - use /dev/random or /dev/urandom for seeding prng
  - improve periodical reseeding of random generator


author: Jan F. Chadima <jchadima@redhat.com> - 5.8p2-12 + 0.9.2-31
changelog:
  - Systemd compatibility according to Mathieu Bridon <bochecha@fedoraproject.org>
  - Split out the host keygen into their own command, to ease future migration
    to systemd. Compatitbility with the init script was kept.
  - Migrate the package to full native systemd unit files, according to the Fedora
    packaging guidelines.
  - Prepate the unit files for running an ondemand server. (do not add it actually)


author: Tomas Mraz <tmraz@redhat.com> - 5.9p1-11 + 0.9.2-32
changelog:
  - remove unnecessary requires on initscripts
  - set VerifyHostKeyDNS to ask in the default configuration (#739856)


author: Tomas Mraz <tmraz@redhat.com> - 5.9p1-12 + 0.9.2-32
changelog:
  - still support /etc/sysconfig/sshd loading in sshd service (#754732)
  - fix incorrect key permissions generated by sshd-keygen script (#754779)


author: Tomas Mraz <tmraz@redhat.com> - 5.9p1-13 + 0.9.2-32
changelog:
  - add back the restorecon call to ssh-copy-id - it might be needed on older
    distributions (#739989)


author: Petr Lautrbach <plautrba@redhat.com> 5.9p1-18 + 0.9.2-32
changelog:
  - replace TwoFactorAuth with RequiredAuthentications[12]
    https://bugzilla.mindrot.org/show_bug.cgi?id=983


author: Tomas Mraz <tmraz@redhat.com> 5.9p1-23 + 0.9.3-1
changelog:
  - fix segfault in su when pam_ssh_agent_auth is used and the ssh-agent
    is not running, most probably not exploitable
  - update pam_ssh_agent_auth to 0.9.3 upstream version


author: Petr Lautrbach <plautrba@redhat.com> 6.1p1-1 + 0.9.3-3
changelog:
  - new upstream release (#852651)
  - use DIR: kerberos type cache (#848228)
  - don't use chroot_user_t for chrooted users (#830237)
  - replace scriptlets with systemd macros (#850249)
  - don't use /bin and /sbin paths (#856590)


author: Petr Lautrbach <plautrba@redhat.com> 6.1p1-2
changelog:
  - add SELinux comment to /etc/ssh/sshd_config about SELinux command to modify port (#861400)
  - drop required chkconfig (#865498)
  - drop openssh-5.9p1-sftp-chroot.patch (#830237)


author: Petr Lautrbach <plautrba@redhat.com> 6.1p1-3 + 0.9.3-3
changelog:
  - replace RequiredAuthentications2 with AuthenticationMethods based on upstream
  - obsolete RequiredAuthentications[12] options
  - fix openssh-6.1p1-privsep-selinux.patch


author: Petr Lautrbach <plautrba@redhat.com> 6.2p1-2 + 0.9.3-4
changelog:
  - keep track of which IndentityFile options were manually supplied and
    which were default options, and don't warn if the latter are missing.
    (mindrot#2084)


author: Petr Lautrbach <plautrba@redhat.com> 6.2p1-3 + 0.9.3-4
changelog:
  - sshd.service: use KillMode=process (#890376)
  - add latest config.{sub,guess} to support aarch64 (#926284)


author: Petr Lautrbach <plautrba@redhat.com> 6.2p2-4 + 0.9.3-5
changelog:
  - don't show Success for EAI_SYSTEM (#985964)
  - make sftp's libedit interface marginally multibyte aware (#841771)


author: Petr Lautrbach <plautrba@redhat.com> 6.2p2-7 + 0.9.3-5
changelog:
  - use hmac_suffix for ssh{,d} hmac checksums
  - bump the minimum value of SSH_USE_STRONG_RNG to 14 according to SP800-131A
  - automatically restart sshd.service on-failure after 42s interval


author: Petr Lautrbach <plautrba@redhat.com> 6.2p2-8 + 0.9.3-5
changelog:
  - sshd-keygen: generate only RSA keys by default (#1010092)
  - use dist tag in suffixes for hmac checksum files


author: Petr Lautrbach <plautrba@redhat.com> 6.2p2-9 + 0.9.3-5
changelog:
  - use dracut-fips package to determine if a FIPS module is installed
  - revert -fips subpackages and hmac files suffixes


author: Petr Lautrbach <plautrba@redhat.com> 6.3p1-2 + 0.9.3-6
changelog:
  - use default_ccache_name from /etc/krb5.conf for a kerberos cache (#991186)
  - increase the size of the Diffie-Hellman groups (#1010607)
  - sshd-keygen to generate ECDSA keys <i.grok@comcast.net> (#1019222)


author: Petr Lautrbach <plautrba@redhat.com> 6.3p1-5 + 0.9.3-7
changelog:
  - adjust gss kex mechanism to the upstream changes (#1024004)
  - don't use xfree in pam_ssh_agent_auth sources <geertj@gmail.com> (#1024965)


author: Petr Lautrbach <plautrba@redhat.com> 6.4p1-2 + 0.9.3-1
changelog:
  - fix fatal() cleanup in the audit patch (#1029074)
  - fix parsing logic of ldap.conf file (#1033662)


author: Petr Lautrbach <plautrba@redhat.com> 6.4p1-3 + 0.9.3-1
changelog:
  - sshd-keygen - use correct permissions on ecdsa host key (#1023945)
  - use only rsa and ecdsa host keys by default


author: Petr Lautrbach <plautrba@redhat.com> 6.4p1-4 + 0.9.3-1
changelog:
  - use SSH_COPY_ID_LEGACY variable to run ssh-copy-id in the legacy mode
  - make /etc/ssh/moduli file public (#1043661)
  - test existence of /etc/ssh/ssh_host_ecdsa_key in sshd-keygen.service
  - don't clean up gssapi credentials by default (#1055016)
  - ssh-agent - try CLOCK_BOOTTIME with fallback (#1091992)
  - prevent a server from skipping SSHFP lookup - CVE-2014-2653 (#1081338)
  - ignore environment variables with embedded '=' or '\0' characters - CVE-2014-2532
    (#1077843)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-1 + 0.9.3-2
changelog:
  - disable the curve25519 KEX when speaking to OpenSSH 6.5 or 6.6
  - add support for ED25519 keys to sshd-keygen and sshd.sysconfig
  - drop openssh-server-sysvinit subpackage
  - slightly change systemd units logic - use sshd-keygen.service (#1066615)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-5 + 0.9.3-3
changelog:
  - set a client's address right after a connection is set (mindrot#2257)
  - apply RFC3454 stringprep to banners when possible (mindrot#2058)
  - don't consider a partial success as a failure (mindrot#2270)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-6 + 0.9.3-3
changelog:
  - privsep_preauth: use SELinux context from selinux-policy (#1008580)
  - change audit trail for unknown users (mindrot#2245)
  - fix kuserok patch which checked for the existence of .k5login
    unconditionally and hence prevented other mechanisms to be used properly
  - revert the default of KerberosUseKuserok back to yes (#1153076)
  - ignore SIGXFSZ in postauth monitor (mindrot#2263)
  - sshd-keygen - don't generate DSA and ED25519 host keys in FIPS mode


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-9 + 0.9.3-3
changelog:
  - the .local domain example should be in ssh_config, not in sshd_config
  - use different values for DH for Cisco servers (#1026430)


author: Jakub Jelen <jjelen@redhat.com> 6.6.1p1-11.1 + 0.9.3-3
changelog:
  - error message if scp when directory doesn't exist (#1142223)
  - parsing configuration file values (#1130733)
  - documentation in service and socket files for systemd (#1181593)
  - updated ldap patch (#981058)
  - fixed vendor-patchlevel
  - add new option GSSAPIEnablek5users and disable using ~/.k5users by default CVE-2014-9278 (#1170745)


author: Jakub Jelen <jjelen@redhat.com> 6.7p1-3 + 0.9.3-4
changelog:
  - update coverity patch
  - make output of sshd -T more consistent (#1187521)
  - enable seccomp for sandboxing instead of rlimit (#1062953)
  - update hardening to compile on gcc5
  - Add SSH KDF CAVS test driver (#1193045)
  - Fix ssh-copy-id on non-sh remote shells (#1045191)


author: Jakub Jelen <jjelen@redhat.com> 6.7p1-6 + 0.9.3-4
changelog:
  - Update seccomp filter to work on i686 architectures (#1194401)
  - Fix previous failing build (#1195065)


author: Jakub Jelen <jjelen@redhat.com> 6.7p1-9 + 0.9.3-4
changelog:
  - Adjust seccomp filter for primary architectures and solve aarch64 issue (#1197051)
  - Solve issue with ssh-copy-id and keys without trailing newline (#1093168)


author: Jakub Jelen <jjelen@redhat.com> 6.7p1-11 + 0.9.3-4
changelog:
  - Ability to specify LDAP filter in ldap.conf for ssh-ldap-helper
  - Fix auditing when using combination of ForceCommand and PTY
  - Add sftp option to force mode of created files (from rhel)
  - Fix tmpfiles.d entries to be more consistent (#1196807)


author: Jakub Jelen <jjelen@redhat.com> 6.8p1-1 + 0.9.3-5
changelog:
  - new upstream release openssh-6.8p1 (#1203245)
  - Resolve segfault with auditing commands (#1203900)
  - Workaround krb5-config bug (#1204646)


author: Jakub Jelen <jjelen@redhat.com> 6.8p1-3 + 0.9.3-5
changelog:
  - Fixed issue with GSSAPI key exchange (#1207719)
  - Add pam_namespace to sshd pam stack (based on #1125110)
  - Remove krb5-config workaround for #1203900
  - Fix handling SELinux context in MLS systems
  - Regression: solve sshd segfaults if other instance already running


author: Jakub Jelen <jjelen@redhat.com> 6.8p1-6 + 0.9.3-5
changelog:
  - Resolve problem with pam_ssh_agent_auth after rebase (#1225106)
  - ssh-copy-id: tcsh doesnt work with multiline strings
  - Fix upstream memory problems
  - Add missing options in testmode output and manual pages
  - Provide LDIF version of LPK schema
  - Document required selinux boolean for working ssh-ldap-helper


author: Jakub Jelen <jjelen@redhat.com> 6.9p1-1 + 0.9.3-6
changelog:
  - New upstream release (#1238253)
  - Increase limitation number of files which can be listed using glob in sftp
  - Correctly revert "PermitRootLogin no" option from upstream sources (#89216)


author: Jakub Jelen <jjelen@redhat.com> 6.9p1-2 + 0.9.3-6
changelog:
  - Enable SECCOMP filter for s390* architecture (#1195065)
  - Fix race condition when multiplexing connection (#1242682)


author: Jakub Jelen <jjelen@redhat.com> 7.0p1-1 + 0.9.3-7
changelog:
  - New upstream release (#1252639)
  - Fix pam_ssh_agent_auth package (#1251777)
  - Security: Use-after-free bug related to PAM support (#1252853)
  - Security: Privilege separation weakness related to PAM support (#1252854)
  - Security: Incorrectly set TTYs to be world-writable (#1252862)


author: Jakub Jelen <jjelen@redhat.com> 7.0p1-2 + 0.9.3-7
changelog:
  - Fix problem with DSA keys using pam_ssh_agent_auth (#1251777)
  - Add GSSAPIKexAlgorithms option for server and client application
  - Possibility to validate legacy systems by more fingerprints (#1249626)


author: Jakub Jelen <jjelen@redhat.com> 7.1p1-3 + 0.9.2-8
changelog:
  - Fix FIPS mode for DH kex (#1260253)
  - Provide full RELRO and PIE form askpass helper (#1264036)
  - Fix gssapi key exchange on server and client (#1261414)
  - Allow gss-keyex root login when without-password is set (upstream #2456)
  - Fix obsolete usage of SELinux constants (#1261496)


author: Jakub Jelen <jjelen@redhat.com> 7.1p1-4 + 0.9.2-8
changelog:
  - Review SELinux user context handling after authentication (#1269072)
  - Handle root logins the same way as other users (#1269072)
  - Audit implicit mac, if mac is covered in cipher (#1271694)
  - Increase size limit for remote glob over sftp


author: Jakub Jelen <jjelen@redhat.com> 7.1p1-6 + 0.9.2-8
changelog:
  - Preserve IUTF8 tty mode flag over ssh connections (#1270248)
  - Do not require sysconfig file to start service (#1279521)
  - Update ssh-copy-id to upstream version
  - GSSAPI Key Exchange documentation improvements
  - Remove unused patches


author: Jakub Jelen <jjelen@redhat.com> 7.1p1-7 + 0.9.2-8
changelog:
  - Change RPM define macros to global according to packaging guidelines
  - Fix wrong handling of SSH_COPY_ID_LEGACY environment variable
  - Update ssh-agent and ssh-keysign permissions (#1296724)
  - Fix few problems with alternative builds without GSSAPI or openSSL
  - Fix condition to run sshd-keygen


author: Jakub Jelen <jjelen@redhat.com> 7.1p2-2 + 0.10.2-1
changelog:
  - Rebased to recent version of pam_ssh_agent_auth
  - Upstream fix for CVE-2016-1908
  - Remove useless defattr


author: Jakub Jelen <jjelen@redhat.com> 7.1p2-3 + 0.10.2-1
changelog:
  - Fix segfaults with pam_ssh_agent_auth (#1303036)
  - Silently disable X11 forwarding on problems
  - Systemd service should be forking to detect immediate failures


author: Jakub Jelen <jjelen@redhat.com> 7.1p2-4.1 + 0.10.2-1
changelog:
  - Fix race condition in auditing events when using multiplexing (#1308295)
  - Fix X11 forwarding CVE according to upstream
  - Fix problem when running without privsep (#1303910)
  - Remove hard glob limit in SFTP


author: Jakub Jelen <jjelen@redhat.com> 7.2p2-2 + 0.10.2-3
changelog:
  - Fix GSSAPI Key Exchange according to RFC (#1323622)
  - Remove init.d/functions dependency from sshd-keygen (#1317722)
  - Do not use MD5 in pam_ssh_agent_auth in FIPS mode


author: Jakub Jelen <jjelen@redhat.com> 7.2p2-3 + 0.10.2-3
changelog:
  - Make sshd-keygen comply with packaging guidelines (#1325535)
  - Soft-deny socket() syscall in seccomp sandbox (#1324493)
  - Remove *sha1 Kex in FIPS mode (#1324493)
  - Remove *gcm ciphers in FIPS mode (#1324493)


author: Jakub Jelen <jjelen@redhat.com> - 7.2p2-5 + 0.10.2-3
changelog:
  - CVE-2015-8325: ignore PAM environment vars when UseLogin=yes (#1328013)
  - Fix typo in sysconfig/sshd (#1325535)


author: Jakub Jelen <jjelen@redhat.com> - 7.2p2-7
changelog:
  - Fix regression in certificate-based authentication (#1333498)
  - Check for real location of .k5login file (#1328243)
  - Fix unchecked dereference in pam_ssh_agent_auth
  - Clean up old patches
  - Build with seccomp filter on ppc64(le) (#1195065)


author: Jakub Jelen <jjelen@redhat.com> - 7.2p2-8 + 0.10.2-3
changelog:
  - Enable seccomp filter for MIPS architectures
  - UseLogin=yes is not supported in Fedora
  - SFTP server forced permissions should restore umask
  - pam_ssh_agent_auth: Fix conflict bewteen two getpwuid() calls (#1349551)


author: Jakub Jelen <jjelen@redhat.com> - 7.2p2-10 + 0.10.2-3
changelog:
  - CVE-2016-6210: User enumeration via covert timing channel (#1357443)
  - Expose more information about authentication to PAM
  - Make closefrom() ignore softlinks to the /dev/ devices on s390


author: Jakub Jelen <jjelen@redhat.com> - 7.3p1-5 + 0.10.2-4
changelog:
  - Build against OpenSSL 1.1.0 with compat changes
  - Recommend crypto-policies
  - Fix chroot dropping capabilities (#1386755)


author: Jakub Jelen <jjelen@redhat.com> - 7.3p1-7 + 0.10.2-4
changelog:
  - Properly deserialize received RSA certificates in ssh-agent (#1402029)
  - Move MAX_DISPLAYS to a configuration option


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-1 + 0.10.2-5
changelog:
  - New upstream release (#1406204)
  - Cache supported OIDs for GSSAPI key exchange (#1395288)
  - Fix typo causing heap corruption (use-after-free) (#1409433)
  - Prevent hangs with long MOTD


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-2 + 0.10.2-5
changelog:
  - Fix ssh-agent cert signing error (#1416584)
  - Fix wrong path to crypto policies
  - Attempt to resolve issue with systemd


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-3 + 0.10.3-1
changelog:
  - Properly report errors from included files (#1408558)
  - New pam_ssh_agent_auth 0.10.3 release
  - Switch to SD_NOTIFY to make systemd happy


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-4 + 0.10.3-1
changelog:
  - Avoid sending the SD_NOTIFY messages from wrong processes (#1427526)
  - Address reports by coverity


author: Jakub Jelen <jjelen@redhat.com> - 7.5p1-2 + 0.10.3-2
changelog:
  - Fix various after-release typos including failed build in s390x (#1434341)
  - Revert chroot magic with SELinux


author: Jakub Jelen <jjelen@redhat.com> - 7.5p1-4 + 0.10.3-2
changelog:
  - Remove SSH-1 subpackage for Fedora 27 (#1474942)
  - Follow system-wide crypto policy in server (#1479271)


author: Jakub Jelen <jjelen@redhat.com> - 7.5p1-6 + 0.10.3-2
changelog:
  - Do not export KRB5CCNAME if the default path is used (#1199363)
  - Add enablement for openssl-ibmca and openssl-ibmpkcs11 (#1477636)
  - Add new GSSAPI kex algorithms with SHA-2, but leave them disabled for now
  - Enforce pam_sepermit for all logins in SSH (#1492313)
  - Remove pam_reauthorize, since it is not needed by cockpit anymore (#1492313)


author: Jakub Jelen <jjelen@redhat.com> - 7.6p1-1 + 0.10.3-3
changelog:
  - New upstream release OpenSSH 7.6
  - Addressing review remarks for OpenSSL 1.1.0 patch
  - Fix PermitOpen bug in OpenSSH 7.6
  - Drop support for ExposeAuthenticationMethods option


author: Jakub Jelen <jjelen@redhat.com> - 7.6p1-3 + 0.10.3-3
changelog:
  - Do not segfault during audit cleanup (#1524233)
  - Avoid gcc warnings about uninitialized variables


author: Jakub Jelen <jjelen@redhat.com> - 7.6p1-5 + 0.10.3-3
changelog:
  - Drop support for TCP wrappers (#1530163)
  - Do not pass hostnames to audit -- UseDNS is usually disabled (#1534577)


author: Jakub Jelen <jjelen@redhat.com> - 7.7p1-1 + 0.10.3-4
changelog:
  - New upstream release (#1563223)
  - Add support for ECDSA keys in PKCS#11 (#1354510)
  - Add support for PKCS#11 URIs


author: Jakub Jelen <jjelen@redhat.com> - 7.7p1-6 + 0.10.3-4
changelog:
  - Fix listing of kex algoritms in FIPS mode
  - Allow aes-gcm cipher modes in FIPS mode
  - Coverity fixes


author: Jakub Jelen <jjelen@redhat.com> - 7.8p1-2 + 0.10.3-5
changelog:
  - New upstream release fixing CVE 2018-15473
  - Remove unused patches
  - Remove reference to unused enviornment variable SSH_USE_STRONG_RNG
  - Address coverity issues
  - Unbreak scp between two IPv6 hosts (#1620333)
  - Unbreak GSSAPI key exchange (#1624323)
  - Unbreak rekeying with GSSAPI key exchange (#1624344)


author: Jakub Jelen <jjelen@redhat.com> - 7.8p1-3 + 0.10.3-5
changelog:
  - Disable OpenSSH hardening flags and use the ones provided by system (#1630615)
  - Ignore unknown parts of PKCS#11 URI (#1631478)
  - Do not fail with GSSAPI enabled in match blocks (#1580017)
  - Fix the segfaulting cavs test (#1629692)


author: Jakub Jelen <jjelen@redhat.com> - 7.8p1-4 + 0.10.3-5
changelog:
  - Unbreak PKCS#11 URI tests (#1648262)
  - Allow to disable RSA signatures with SHA1 (#1648898)
  - Dump missing GSS options from client configuration (#1649505)
  - Minor fixes from Fedora related to GSSAPI and keberos
  - Follow the system-wide PATH settings


author: Jakub Jelen <jjelen@redhat.com> - 8.0p1-1 + 0.10.3-7
changelog:
  - New upstream release (#1691045)
  - Remove support for unused VendorPatchLevel configuration option
  - Fix kerberos cleanup procedures (#1683295)
  - Do not negotiate arbitrary primes with DH GEX in FIPS (#1685096)
  - Several GSSAPI key exchange improvements and sync with Debian
  - Allow to use labels in PKCS#11 URIs even if they do not match on private key (#1671262)
  - Do not fall back to sshd_net_t SELinux context (#1678695)
  - Use FIPS compliant high-level signature OpenSSL API and KDF
  - Mention crypto-policies in manual pages
  - Do not fail if non-FIPS approved algorithm is enabled in FIPS
  - Generate the PEM files in new PKCS#8 format without the need of MD5 (#1712436)


author: Jakub Jelen <jjelen@redhat.com> - 8.0p1-2 + 0.10.3-7
changelog:
  - Allow specifying a pin-value in PKCS #11 URI in ssh-add (#1639698)
  - Whitelist another syscall variant for s390x cryptographic module (ibmca engine) (#1714915)


author: Jakub Jelen <jjelen@redhat.com> - 8.0p1-3 + 0.10.3-7
changelog:
  - Fix typos in manual pages (#1668325)
  - Use the upstream support for PKCS#8 PEM files alongside with the legacy PEM files (#1712436)
  - Unbreak ssh-keygen -A in FIPS mode (#1732424)
  - Add missing RSA certificate types to offered hostkey types in FIPS mode (#1732449)


author: Aleš Kozumplík <ales@redhat.com> - 0.0.3-1
changelog:
  - tests: import mock through support so its simpler for the test cases. (Ales Kozumplik)
  - packaging: fix typos in the spec. (Ales Kozumplik)
  - [completion_cache] Cache installed packages, update the cache less frequently (Elad Alfassa)
  - Add bash completion to dnf (Elad Alfassa)
  - packaging: missing buildrequire (Ales Kozumplik)


author: Radek Holý <rholy@redhat.com> - 0.0.4-1
changelog:
  - refactor: use Base.install instead of installPkgs in kickstart plugin. (Radek Holy)
  - refactor: move kickstart arguments parsing to standalone method. (Radek Holy)
  - tests: test effects instead of mock calls. (Radek Holy)
  - Add debuginfo-install plugin. (RhBug:1045770) (Igor Gnatenko)
  - builddep: needs to be run under root. (RhBug:1065851) (Ales Kozumplik)


author: Aleš Kozumplík <ales@redhat.com> - 0.0.6-1
changelog:
  - clenaup: remove commented out code (Miroslav Suchý)
  - copr: list: print description (Igor Gnatenko)
  - builddep: rpm error messages sink. (Ales Kozumplik)
  - builddep: improve error handling on an command argument (RhBug:1074436) (Ales Kozumplik)
  - copr: handling case when no argument is passed on cli (Miroslav Suchý)
  - copr: delete excess argument (Igor Gnatenko)
  - add copr plugin (Miroslav Suchý)
  - debuginfo-install: check for root with dnf api (Igor Gnatenko)
  - packaging: fix bogus dates. (Ales Kozumplik)


author: Aleš Kozumplík <ales@redhat.com> - 0.0.7-1
changelog:
  - build: gettext is also needed as a buildreq (Tim Lauridsen)
  - copr: use usage & summary class attributes, to work with dnf 0.5.0 use shared lib dnfpluginscore for translation wrapp
  - build: add cmake as buildreq (Tim Lauridsen)
  - generate-completion-cache: fix shared lib name (Tim Lauridsen)
  - make .spec use gitrev in the source file add helper script for building source archive (Tim Lauridsen)
  - Added transifex config (Tim Lauridsen)
  - tests: use cli logger in kickstart test (Tim Lauridsen)
  - Added translation .pot file Added da translation files so we have something to build & install (Tim Lauridsen)
  - Added CMake files Added CMake build to .spec & and added translation files handling (Tim Lauridsen)
  - make plugins use shared lib added translation wrappers added missing usage & summary PEP8 fixes (Tim Lauridsen)
  - added shared dnfpluginscore lib (Tim Lauridsen)
  - copr: C:139, 0: Unnecessary parens after 'print' keyword (superfluous-parens) (Miroslav Suchý)
  - copr: W: 23, 0: Unused import gettext (unused-import) (Miroslav Suchý)
  - copr: C: 33, 0: No space allowed before : (Miroslav Suchý)
  - copr: some python3 migration (Miroslav Suchý)
  - copr: get rid of dnf i18n imports (Miroslav Suchý)
  - remove dnf.yum.i18n imports. (Ales Kozumplik)
  - copr: Fix the playground upgrade command. (Tadej Janež)
  - copr: implement search function (Igor Gnatenko)
  - better format output (Miroslav Suchý)
  - implement playground plugin (Miroslav Suchý)
  - move removing of repo into method (Miroslav Suchý)
  - check root only for actions which really need root (Miroslav Suchý)
  - move repo downloading into separate method (Miroslav Suchý)
  - define copr url as class attribute (Miroslav Suchý)
  - better wording of warning (Miroslav Suchý)
  - move question to function argument (Miroslav Suchý)
  - move guessing chroot into function (Miroslav Suchý)
  - copr: use common lib use Command.usage & summary cleanup imports & PEP8 fixes (Tim Lauridsen)
  - builddep: added usage & summary & fix some PEP8 issues (Tim Lauridsen)
  - kickstart: use new public Command.usage & Command.summary api (Tim Lauridsen)
  - fix resource leak in builddep.py. (Ales Kozumplik)
  - refactor: command plugins use demands mechanism. (Ales Kozumplik)
  - noroot: move to the new 'demands' mechanism to check the need of root. (Ales Kozumplik)
  - tests: fix locale independence. (Radek Holy)
  - [copr] correctly specify chroot when it should be guessed (Miroslav Suchý)


author: Aleš Kozumplík <ales@redhat.com> - 0.0.8-1
changelog:
  - build: add sphinx to build requires. (Ales Kozumplik)
  - doc: packaging: add license block to each .rst. (Ales Kozumplik)
  - tests: stray print() in test_download.py. (Ales Kozumplik)
  - doc: put each synopsis on new line (Miroslav Suchý)
  - doc: cosmetic: project name in the documentation. (Ales Kozumplik)
  - doc: cleanups, form, style. (Ales Kozumplik)
  - doc: add documentation and man pages (Tim Lauridsen)
  - copr: remove repofile if failed to enable repo (Igor Gnatenko)
  - copr: honor -y and --assumeno (Miroslav Suchý)
  - py3: absolute imports and unicode literals everywhere. (Ales Kozumplik)
  - debuginfo-install: doesn't install latest pkgs (RhBug: 1096507) (Igor Gnatenko)
  - debuginfo-install: fix description (Igor Gnatenko)
  - debuginfo-install: fix logger debug messages (Igor Gnatenko)
  - build: install the download plugin (Tim Lauridsen)
  - download: update the download plugin with --source, --destdir & --resolve options (Tim Lauridsen)
  - Add a special ArgumentParser to parsing plugin cmd arguments and options (Tim Lauridsen)
  - tests: add __init__.py to make tests a module and use abs imports (Tim Lauridsen)
  - build: simplify plugins/CMakeLists.txt. (Ales Kozumplik)
  - dnf.cli.commands.err_mini_usage() changed name. (Ales Kozumplik)
  - kickstart: do not include kickstart errors into own messages. (Radek Holy)


author: Aleš Kozumplík <ales@redhat.com> - 0.1.0-1
changelog:
  - pylint: fix all pylint builddep problems. (Ales Kozumplik)
  - builddep: better error reporting on deps that actually don't exist. (Ales Kozumplik)
  - builddep: load available repos. (RhBug:1103906) (Ales Kozumplik)
  - tests: stop argparse from printing to stdout when tests run. (Ales Kozumplik)
  - packaging: all the manual pages with a glob. (Ales Kozumplik)
  - fix: packaging problem with query.py. (Ales Kozumplik)
  - doc: add reference documentation for repoquery. (Ales Kozumplik)
  - repoquery: support --provides, --requires etc. (Ales Kozumplik)
  - repoquery: make the CLI more compatible with Yum's repoquery. (Ales Kozumplik)
  - repoquery: some cleanups in the plugin and the tests. (Ales Kozumplik)
  - rename: query->repoquery. (RhBug:1045078) (Ales Kozumplik)
  - add pylint script for dnf-core-plugins. (Ales Kozumplik)
  - tests: repoquery: fix unit tests. (Ales Kozumplik)
  - add query tool (Tim Lauridsen)


author: Aleš Kozumplík <ales@redhat.com> - 0.1.1-1
changelog:
  - protected_packages: prevent removal of the running kernel. (RhBug:1049310) (Ales Kozumplik)
  - packaging: create and own /etc/dnf/protected.d. (Ales Kozumplik)
  - doc: add documentation for protected_packages. (Ales Kozumplik)
  - doc: rename: generate-completion-cache -> generate_completion_cache. (Ales Kozumplik)
  - add protected_packages (RhBug:1111855) (Ales Kozumplik)
  - build: add python-requests to requires (RHBZ: 1104088) (Miroslav Suchý)
  - doc: typo: fix double 'plugin' in release notes. (Ales Kozumplik)


author: Aleš Kozumplík <ales@redhat.com> - 0.1.2-1
changelog:
  - BashCompletionCache: error strings are unicoded (RhBug:1118809) (Jan Silhan)
  - transifex update (Jan Silhan)
  - debuginfo-install: remove some pylint warnings (Igor Gnatenko)
  - debuginfo-install: fix installing when installed version not found in repos, optimize performance (RhBug: 1108321) (Ig
  - fix: copr plugin message for repo without builds (RhBug:1116389) (Adam Samalik)
  - logging: remove messages about initialization. (Ales Kozumplik)


author: Jan Silhan <jsilhan@redhat.com> - 0.1.3-1
changelog:
  - repoquery: output times in UTC. (Ales Kozumplik)
  - repoquery: missing help messages. (Ales Kozumplik)
  - repoquery: add --info. (RhBug:1135984) (Ales Kozumplik)
  - add Jan to AUTHORS. (Ales Kozumplik)
  - spec: extended package description with plugin names and commands (Related:RhBug:1132335) (Jan Silhan)
  - copr: check for 'ok' in 'output' for json data (RhBug:1134378) (Igor Gnatenko)
  - README: changed references to new repo location (Jan Silhan)
  - transifex update (Jan Silhan)
  - copr: convert key to unicode before guessing lenght (Miroslav Suchý)
  - Add pnemade to AUTHORS (Ales Kozumplik)
  - debuginfo-install: Use logger as module level variable and not instance attribute since dnf-0.6.0 release (RhBug:1130559) (Parag Nemade)
  - copr: Use logger as module level variable and not instance attribute since dnf-0.6.0 release (RhBug:1130559) (Parag Nemade)
  - copr: implement help command (Igor Gnatenko)
  - debuginfo-install: fix indenting (Igor Gnatenko)
  - debuginfo-install: use srpm basename for debuginfo (Igor Gnatenko)


author: Jan Silhan <jsilhan@redhat.com> - 0.1.4-1
changelog:
  - revert of commit 80ae3f4 (Jan Silhan)
  - transifex update (Jan Silhan)
  - spec: binded to current dnf version (Jan Silhan)
  - generate_completion_cache: use sqlite instead of text files (Igor Gnatenko)
  - logging: renamed log file (Related:RhBug:1074715) (Jan Silhan)
  - Add reposync. (RhBug:1139738) (Ales Kozumplik)
  - download: fix traceback if rpm package has no defined sourcerpm (RhBug: 1144003) (Tim Lauridsen)
  - lint: ignore warnings of a test accessing protected attribute. (Ales Kozumplik)
  - repoquery lint: logger is not used. (Ales Kozumplik)
  - repoquery: support querying of weak deps. (Ales Kozumplik)
  - needs_restarting: fix typo (Miroslav Suchý)
  - copr: migrate copr plugin form urlgrabber to python-request (Miroslav Suchý)
  - Add needs-restarting command. (Ales Kozumplik)


author: Jan Silhan <jsilhan@redhat.com> - 0.1.5-1
changelog:
  - updated package url (Michael Mraka)
  - also dnf_version could be specified on rpmbuild commandline (Michael Mraka)
  - simple script to build test package (Michael Mraka)
  - let gitrev be specified on rpmbuild commandline (Michael Mraka)
  - assign default GITREV value (Michael Mraka)
  - standard way to find out latest commit (Michael Mraka)
  - debuginfo-install: fix handling of subpackages with non-zero epoch (Petr Spacek)
  - debuginfo-install: Make laywers happier by assigning copyright to Red Hat (Petr Spacek)
  - debuginfo-install: remove dead code uncovered by variable renaming (Petr Spacek)
  - debuginfo-install: clearly separate source and debug package names (Petr Spacek)
  - debuginfo-install: use descriptive parameter name in _is_available() (Petr Spacek)
  - repoquery: add -l option to list files contained in the package (Petr Spacek)
  - 1187773 - replace undefined variable (Miroslav Suchý)
  - download: fixed unicode location error (RhBug:1178239) (Jan Silhan)
  - builddep recognizes nosrc.rpm pkgs (RhBug:1166126) (Jan Silhan)
  - builddep: added nosignatures flag to rpm transaction set (Jan Silhan)
  - builddep: more verbose output of non-matching packages (RhBug:1155211) (Jan Silhan)
  - package: archive script is the same as in dnf (Jan Silhan)
  - spec: exclude __pycache__ dir (Igor Gnatenko)


author: Michal Luscon <mluscon@redhat.com> 0.1.6-3
changelog:
  - doc: release notes 0.1.6 (Michal Luscon)
  - initialize to use tito (Michal Luscon)
  - prepare repo for tito build system (Michal Luscon)
  - migrate raw_input() to Python3 (RhBug:1208399) (Miroslav Suchý)
  - require dnf 0.6.5+ which contains duplicated/installonly queries (Michael Mraka)
  - implemented --duplicated and --installonly (Michael Mraka)
  - create --destdir if not exist (Michael Mraka)
  - repoquery: Added -s/--source switch, test case and documentation for querying source rpm name (Parag Nemade)
  - repoquery: Added documentation and test case for file switch (Parag Nemade)
  - spec: ship man pages in dnf-plugins-core metapackage (Jan Silhan)
  - debuginfo-install: support cases where src.rpm name != binary package name (Petr Spacek)
  - spec: added empty %files directive to generate rpm (Jan Silhan)
  - spec: adapt to pykickstart f23 package split (Jan Silhan)
  - spec: requires >= dnf version not = (Jan Silhan)
  - spec: python3 source code by default in f23+ (RhBug:1194725,1198442) (Jan Silhan)
  - use dnfpluginscore.lib.urlopen() (RhBug:1193047) (Miroslav Suchý)
  - implemented functionality of yum-config-manager (Michael Mraka)
  - repoquery: Added --file switch to show who owns the given file (RhBug:1196952) (Parag Nemade)
  - debuginfo-install: accept packages names specified as NEVRA (RhBug:1171046) (Petr Spacek)
  - repoquery: accept package names specified as NEVRA (RhBug:1179366) (Petr Spacek)
  - download: fix typo in 'No source rpm definded' (Petr Spacek)
  - download: accept package names ending with .src too (Petr Spacek)
  - download: Do not disable user-enabled repos (thanks Spacekpe) (Jan Silhan)
  - Add README to tests/ directory (Petr Spacek)
  - AUTHORS: updated (Jan Silhan)
  - download: fix package download on Python 3 (Petr Spacek)


author: Michal Luscon <mluscon@redhat.com> 0.1.7-1
changelog:
  - doc: release notes dnf-plugins-core-0.1.7 (Michal Luscon)
  - spec: fix Conflicts of the new plugins (Radek Holy)
  - spec: allow DNF 1.x.x (Radek Holy)
  - AUTHORS: filled in missing email address (Jan Silhan)
  - download: enabling source repos when desired only (Jan Silhan)
  - download: using enable_source_repos from lib (Jan Silhan)
  - lib: inform user when enabling disabled repo (Jan Silhan)
  - AUTHORS: made 2 categories (Jan Silhan)
  - fixed typos and missing demand (Michael Mraka)
  - changed warning paragraph (Michael Mraka)
  - AUTHORS: updated (Jan Silhan)
  - debuginfo-install: don't consider src packages as candidates for installation
    (RhBug:1215154) (Lubomir Rintel)
  - documentation warning about build deps in srpm (Michael Mraka)
  - fixed builddep tests (Michael Mraka)
  - builddep: enable source repos only when needed (Michael Mraka)
  - fixed builldep documentation (Michael Mraka)
  - mark appropriate dnfpluginscore.lib as API (Michael Mraka)
  - fixed builddep configure test (Michael Mraka)
  - moved enable_{source|debug}_repos() to dnfpluginscore.lib (Michael Mraka)
  - builddep: add feature to get builddeps from remote packages (RhBug:1074585)
    (Igor Gnatenko)
  - doc: repoquery: doesn't print 'No match for argument:...' garbage (Jan
    Silhan)
  - updated repoquery documentation (Michael Mraka)
  - implemented repoquery --latest-limit (Michael Mraka)
  - implemented repoquery --unsatisfied (Michael Mraka)
  - builddep: Support defining macros for parsing spec files (David Michael)
  - removed redundant argument (Michael Mraka)
  - doc: update repoquery docs with --resolve (Tim Lauridsen)
  - repoquery: add --resolve option (RhBug:1156487) (Tim Lauridsen)
  - spec: dnf version upper boundaries (Jan Silhan)
  - spec: added plugin command provides (Related:RhBug:1208773) (Jan Silhan)
  - make --repo cumulative (Michael Mraka)
  - rename --repoid to --repo (Michael Mraka)
  - don't delete local repo packages after download (RhBug:1186948) (Michael
    Mraka)
  - doc: replaced last references pointing to akozumpl (Jan Silhan)


author: Michal Luscon <mluscon@redhat.com> 0.1.9-1
changelog:
  - repoquery: add srpm option (RhBug:1186382) (Vladan Kudlac)
  - create repo files readable by users (RhBug:1228693) (Michael Mraka)
  - copr: use librepo instead of python-request (Miroslav Suchý)
  - --tree now works with --conflicts --obsoletes --requires and --whatrequires
    (RhBug:1128424) (RhBug:1186689) (Adam Salih)
  - url for copr repos changed (RhBug:1227190) (Miroslav Suchý)
  - repoquery: fixed conflicts package format (Adam Salih)
  - document that globs can be used in dnf config-manager (Michael Mraka)


author: Jan Silhan <jsilhan@redhat.com> 0.1.10-1
changelog:
  - generate_completion_cache: use list for each insert (fixes regression
    introduced in e020c96) (Igor Gnatenko)
  - generate_completion_cache: store NEVRA insted of NA (RhBug:1226663) (Igor
    Gnatenko)
  - repoquery: weak deps queries (RhBug:1184930) (Michal Luscon)
  - builddep requires an argument (Michael Mraka)
  - disable c++ checks in rpmbuild (Michael Mraka)
  - path may contain unicode (RhBug:1234099) (Michael Mraka)
  - fail if no package match (RhBug:1241126) (Michael Mraka)
  - make --spec and --srpm mutually exclusive (Michael Mraka)
  - handle error message in python3 (RhBug:1218299) (Michael Mraka)
  - options to recognize spec/srpm files (RhBug:1241135) (Michael Mraka)
  - copr: set chmod to rw-r--r-- on repo files (Miroslav Suchý)
  - [copr] refactor duplicated lines (Jakub Kadlčík)
  - [copr] allow utf-8 user input (RhBug:1244125) (Jakub Kadlčík)
  - [copr] fix regression with handling `search` and `list` subcommands (Valentin
    Gologuzov)
  - [copr] terminate execution when failed to parse project name (Valentin
    Gologuzov)
  - [copr] unused import (Valentin Gologuzov)
  - [copr] subcommand `disable` now only set `enabled=0`, repo file could be
    deleted by new subcommand `remove` (Valentin Gologuzov)


author: Michal Luscon <mluscon@redhat.com> 0.1.11-1
changelog:
  - dnf donwload checks for duplicate packages (rhBug:1250114) (Adam Salih)
  - Extend repoquery --arch option. You can now pass multiple archs separated by
    commas (RhBug:1186381) (Adam Salih)
  - download plugin now prints not valid packages (RhBug:1225784) (Adam Salih)
  - correct typo (Adam Salih)
  - dnf now accepts more than one key (RhBug:1233728) (Adam Salih)
  - description should be print unwrapped (Adam Salih)
  - alternative to pkgnarrow (RhBug:1199601) (Adam Salih)
  - sort output alphabetically, tree accepts switches --enhances --suggests
    --provides --suplements --recommends (RhBug:1156778) (Adam Salih)


author: Michal Luscon <mluscon@redhat.com> 0.1.12-1
changelog:
  - repoquery: add globbing support to whatrequires/whatprovides.
    (RhBug:1249073) (Valentina Mukhamedzhanova)
  - needs_restarting: Rewrite a warning message (Wieland Hoffmann)
  - Remove extra quotation mark in comment (Alexander Todorov)


author: Jan Silhan <jsilhan@redhat.com> 0.1.13-1
changelog:
  - updated: release notes for 0.1.13 (Jan Silhan)
  - Remove kickstart plugin from core plugins (Neal Gompa
    (ニール・ゴンパ))
  - read file as utf-8 in Py3 (RhBug:1267808) (Miroslav Suchý)
  - playground: check if repo actually exists for our version of OS (Miroslav
    Suchý)
  - add Catalan (Robert Antoni Buj Gelonch)
  - repoquery: Fix UnicodeEncodeError with --info (RhBug:1264125) (Jaroslav
    Mracek)
  - lookup builddeps in source package for given package name (RhBug:1265622)
    (Michael Mraka)
  - functions moved to library (Michael Mraka)
  - functions to return name of source and debuginfo package (Michael Mraka)
  - try <name>-debuginfo first then <srcname>-debuginfo (RhBug:1159614) (Michael
    Mraka)
  - Automatic commit of package [dnf-plugins-core] release [0.1.12-2]. (Michal
    Luscon)
  - doc: release notes 0.1.12 (Michal Luscon)


author: Michal Luscon <mluscon@redhat.com> 0.1.14-1
changelog:
  - zanata update (Jan Silhan)
  - repoquery: do not require loading metadata when we want to query system only
    (Jan Silhan)
  - repoquery: fix unicode tracebacks (Michal Luscon)
  - repoquery: use new methods recent, extras, unneeded (Michal Luscon)
  - repoquery: use new api methods duplicated and latest (RhBug:1231572) (Michal
    Luscon)
  - Exit with non-zero status if strict and package not found (alde)
  - Fix cmdline conversion to unicode (RhBug:1265210) (Michal Domonkos)
  - Remove extra 'l' in test class name (Alexander Todorov)
  - copr: PEP formating (Miroslav Suchý)
  - copr: allow to use staging instance of Copr for testing (Miroslav Suchý)
  - do not use @ in repoid (RhBug:1280416) (Miroslav Suchý)
  - reverts unintentional releaser from e035152 (Jan Silhan)
  - don't look for builddeps on source packages (RhBug:1272936) (Michael Mraka)
  - Fix hawkey version constraint (Neal Gompa (ニール・ゴンパ))


author: Michal Luscon <mluscon@redhat.com> 0.1.15-1
changelog:
  - Make it possible to specify the source package name as parameter in stub
    constructor. (Alexander Todorov)
  - Add --debuginfo to download (Alexander Todorov)
  - resolve local RPMs when downloading. useful with --source (Alexander Todorov)
  - spec: ensure python*-dnf-plugins-core versions are the same (RhBug:1283448)
    (Jan Silhan)
  - reimplemented config file writing (RhBug:1253237) (Michael Mraka)


author: Jan Silhan <jsilhan@redhat.com> 0.1.16-1
changelog:
  - zanata update (Jan Silhan)
  - AUTHORS: updated (Jan Silhan)
  - run noroot in non cli mode (RhBug:1297511) (Jan Silhan)
  - Sanitize repos containing a tilde in the URL (François RIGAULT)
  - contributor added (clime)
  - latest-limit option moved to base set of options making it compatible with
    --queryformat and other output formatters (RhBug: 1292475) (clime)
  - builddep: do not download source package (Jeff Smith)
  - repoquery: keep --autoremove as secret option (Jan Silhan)
  - cosmetic: repoquery: remove unused imports (Jan Silhan)
  - doc: repoquery: --recent (Jan Silhan)
  - doc: renamed autoremove to unneeded and extended docs (Jan Silhan)


author: Michal Luscon <mluscon@redhat.com> 0.1.17-1
changelog:
  - enable debuginfo repos if autoupdate is on (RhBug:1024701) (Michael Mraka)
  - fixed string suffix removal (Michael Mraka)
  - install latest debuginfo by default (Michael Mraka)
  - Enable strings for translation (RhBug:1302214) (Parag Nemade)


author: Miroslav Suchý <msuchy@redhat.com> 0.1.18-1
changelog:
  - Add myself as contributor in AUTHORS (Neal Gompa (ニール・ゴンパ))
  - copr: copr.fedoraproject.org -> copr.fedorainfracloud.org (Neal Gompa
    (ニール・ゴンパ))
  - copr: fix traceback when trying to enable non-existing project (RhBug:
    1304615) (Jakub Kadlčík)
  - README: mention translation fixes should be made on Zanata (Jan Šilhan)


author: Michal Luscon <mluscon@redhat.com> 0.1.20-1
changelog:
  - doc: release notes 0.1.20 (Igor Gnatenko)
  - copr: Properly detect reposdir and add chroot override capability (Neal Gompa
    (ニール・ゴンパ))
  - config_manager: Use new API in dnfpluginscore.lib for determining reposdir
    (Neal Gompa (ニール・ゴンパ))
  - dnfpluginscore.lib: Add get_reposdir() API function (Neal Gompa (ニール・ゴンパ))
  - Fix typo (Eduardo Mayorga Téllez)


author: Igor Gnatenko <ignatenko@redhat.com> 0.1.21-1
changelog:
  - doc: release notes 0.1.21 (Igor Gnatenko)
  - spec: correctly set up requirements for python subpkg (Igor Gnatenko)
  - spec: improve python packaging according to new guidelines & compat with EL7
    (Igor Gnatenko)
  - tests/support: set priority and cost in RepoStub (Igor Gnatenko)
  - repoquery: sourcerpm does not contain epoch (RhBug:1335959) (Michael Mraka)
  - enforce-api: use api method transaction (Michal Luscon)
  - enforce-api: apply changes from Base class (Michal Luscon)
  - copr: Read the %distro_arch macro to determine Mageia chroot arch (Neal
    Gompa (ニール・ゴンパ))
  - copr: Remove unnecessary function calls/options and simplify conditional
    (Neal Gompa (ニール・ゴンパ))
  - copr: Add Mageia chroot selection support (Neal Gompa (ニール・ゴンパ))
  - copr: Simplify and fix up reading copr chroot config override (Neal Gompa
    (ニール・ゴンパ))
  - zanata update (Jan Silhan)
  - Add link for other project documentation pages (Jaroslav Mracek)
  - autoglob feature has been moved to filter() (RhBug:1279538) (Michael Mraka)
  - support globs in --what<weak_dep> (RhBug:1303311) (Michael Mraka)
  - repoquery: fix typo (there -> that, and plural form) (Luigi Toscano)
  - copr: fix string - singular is required (Luigi Toscano)
  - doc: release notes updated to vallid plugins version (Jan Šilhan)


author: Michal Luscon <mluscon@redhat.com> 1.0.0-0.rc1.1
changelog:
  - doc: open rpmspec in utf-8 mode (Igor Gnatenko)
  - cls.chroot_config inside _guess_chroot returns None (RhBug: 1361003) (Michael
    Goodwin)
  - builddep: adjust to new config (dnf-2.0) (Michal Luscon)
  - Change minimal required version (Jaroslav Mracek)
  - introduced config-manager --dump-variables (RhBug:1360752) (Michael Mraka)
  - Fix string puzzle in translatable message (Luigi Toscano)
  - Added alias to 'builddep'->'build-dep' (RhBug:1350604) (stepasm)
  - reposync should keep packages (RhBug:1325350) (Michael Mraka)
  - Change usage of add_remote_rpm according to new API (Jaroslav Mracek)
  - Remove lib.py from plugins-core (Jaroslav Mracek)
  - Delete repoquery from dnf-plugins-core (Jaroslav Mracek)
  - removed protected_packages plugin (Jan Silhan)
  - repoquery: add --requires-pre switch (RhBug:1303117) (Michal Luscon)
  - spec: bump version to 1.0.0 (Igor Gnatenko)
  - Automatic commit of package [dnf-plugins-core] release [0.1.21-2]. (Igor
    Gnatenko)
  - Automatic commit of package [dnf-plugins-core] release [0.1.21-1]. (Igor
    Gnatenko)
  - spec: explicitly conflict with python-%{name} with different version (Igor
    Gnatenko)
  - updated plugin to read_config() change (RhBug:1193823) (Michael Mraka)
  - repoquery: sourcerpm does not contain epoch (RhBug:1335959) (Michael Mraka)
  - enforce-api: use api method transaction (Michal Luscon)
  - enforce-api: apply changes from Base class (Michal Luscon)
  - copr: Read the %distro_arch macro to determine Mageia chroot arch (Neal
    Gompa (ニール・ゴンパ))
  - copr: Remove unnecessary function calls/options and simplify conditional
    (Neal Gompa (ニール・ゴンパ))
  - copr: Add Mageia chroot selection support (Neal Gompa (ニール・ゴンパ))
  - copr: Simplify and fix up reading copr chroot config override (Neal Gompa
    (ニール・ゴンパ))
  - autoglob feature has been moved to filter() (RhBug:1279538) (Michael Mraka)


author: Jaroslav Mracek <jmracek@redhat.com> 1.0.1-1
changelog:
  - bump version to 1.0.1 + update release notes (Jaroslav Mracek)
  - setup SideCI to ignore some PEP8 violations (Jaroslav Mracek)
  - spec: define all configs as (noreplace) (Igor Gnatenko)
  - spec: include __pycache__ files (Igor Gnatenko)
  - builddep: print errors from RPM SPEC parser (Petr Spacek)


author: Jaroslav Mracek <jmracek@redhat.com> 1.0.2-1
changelog:
  - bump version to 1.0.2 + update release notes (Jaroslav Mracek)
  - download: add --urlprotocols option (Dusty Mabe)
  - download: add --url cli option (RhBug:1250115) (Dusty Mabe)
  - download: refactor download code (Dusty Mabe)
  - copr: Tweak wording to be more generic (Neal Gompa)
  - Automatic commit of package [dnf-plugins-core] release [1.0.1-1]. (Jaroslav
    Mracek)
  - bump version to 1.0.1 + update release notes (Jaroslav Mracek)


author: Igor Gnatenko <ignatenko@redhat.com> 1.1.0-1
changelog:
  - dnf dowload --resolve should download everytime requested packages
    (RhBug:1276611) (stepasm)
  - builddep: install requirements by provides (RhBug:1332830) (Igor Gnatenko)
  - builddep: do not check GPG key of SRPM (RhBug:1431486) (Igor Gnatenko)
  - builddep: properly check for nosrc.rpm (Igor Gnatenko)
  - po: Update translations (RhBug:1429087) (Igor Gnatenko)
  - Remove noroot plugin that was move into dnf itself (Jaroslav Mracek)


author: Jaroslav Mracek <jmracek@redhat.com> 2.0.0-1
changelog:
  - update release notes (Jaroslav Mracek)
  - po: Update translations (Igor Gnatenko)
  - Fix incorrect exclude of locked version in versionlock (Jaroslav Mracek)
  - po: Update translations (Igor Gnatenko)
  - Setup selectively provides for python2 packages (Jaroslav Mracek)
  - Build python3 packages only if with_python3 (Jaroslav Mracek)
  - Search only according nevra in versionlock (Jaroslav Mracek)
  - Solve a problem in performance of versionlock (RhBug:1431493) (Jaroslav
    Mracek)
  - Repoclosure exit with 1 if unsatisfied dependencies (RhBug:1416782) (Jaroslav
    Rohel)
  - Not raise an Error if strict=False and --url for download command (Jaroslav
    Mracek)
  - Check argument if it is a file ending with .rpm (RhBug:1436570) (Jaroslav
    Mracek)
  - update link to "What I can build in Copr? documentation page (clime)
  - po: Update translations (Igor Gnatenko)
  - Create dir for local plugin if path not exist (Jaroslav Mracek)
  - Correct some PEP8 violations after plugin import (Jaroslav Mracek)
  - Add debug into dnf-plugins-core (Jaroslav Mracek)
  - Added latest doc changes from plugins-extras upstream (Jaroslav Mracek)
  - bump version to 2.0.0 (Jaroslav Mracek)
  - Add migrate plugin into dnf-plugins-core (Jaroslav Mracek)
  - Add man pages for transfered plugins (Jaroslav Mracek)
  - Add provide dnf-plugin-* for each plugin (Jaroslav Mracek)
  - Correct some PEP8 violations (Jaroslav Mracek)
  - Add local into dnf-plugins-core (Jaroslav Mracek)
  - Add leaves and show-leaves into dnf-plugins-core (Jaroslav Mracek)
  - Add versionlock into dnf-plugins-core (Jaroslav Mracek)
  - Add repograph into dnf-plugins-core (Jaroslav Mracek)
  - Add repoclosure into dnf-plugins-core (Jaroslav Mracek)
  - Add repomanage into dnf-plugins-core (Jaroslav Mracek)
  - Add --archlist option for dnf download command (Jaroslav Mracek)
  - Change code that provides package location for download command (Jaroslav
    Mracek)
  - po: update translations (Igor Gnatenko)
  - po: add sv translations (Igor Gnatenko)


author: Jaroslav Mracek <jmracek@redhat.com> 2.1.0-1
changelog:
  - bump version to 2.1.0 + update release notes (Jaroslav Mracek)
  - Adjust the dnf-utils subpackage to be more accurate (Neal Gompa)
  - Add new sub-package dnf-utils (RhBug:1381917) (Jaroslav Mracek)
  - Fix two renamed functions by dnf privatization (Jaroslav Mracek)


author: Jaroslav Mracek <jmracek@redhat.com> 2.1.1-1
changelog:
  - bump version to 2.1.1 + update release notes (Jaroslav Mracek)
  - Enhance versionlock documentation (Jaroslav Mracek)
  - Fix typos in args.ingex to args.index (RhBug:1458446) (Jaroslav Mracek)
  - dont run versionlock on non-transactional operations (Jan Silhan)


author: Igor Gnatenko <ignatenko@redhat.com> - 2.1.2-1
changelog:
  - debuginfo-install: install only requested packages
  - Unify user confirmation in copr with dnf itself


author: Jaroslav Mracek <jmracek@redhat.com> 2.1.3-1
changelog:
  - Solve conflict with migrate plugin (RhBug:1470843) (Jaroslav Mracek)
  - Move copying to dnf (RhBug:1279001) (Ondřej Sojka)
  - Return 1 if dnf config-manager --add-repo fails (RhBug:1439514) (Jaroslav
    Mracek)
  - bump minimal dnf version to 2.6.0 (Igor Gnatenko)
  - trivial: remove whitespace at end of line (Igor Gnatenko)


author: Jaroslav Mracek <jmracek@redhat.com> 2.1.4-1
changelog:
  - Added four new options for ``list`` subcommand of ``copr`` plugin
  - Resolves: rhbz#1476834 - [abrt] dnf: arch(): config.py:908:arch:TypeError: unhashable type: 'list'


author: Jaroslav Mracek <jmracek@redhat.com> 3.0.1-1
changelog:
  - Enhanced documentation
  - Resolves: rhbz#1576594
  - Resolves: rhbz#1530081
  - Resolves: rhbz#1547897
  - Resolves: rhbz#1550006
  - Resolves: rhbz#1431491
  - Resolves: rhbz#1516857
  - Resolves: rhbz#1499623
  - Resolves: rhbz#1489724


author: Jaroslav Mracek <jmracek@redhat.com> - 3.0.4-1
changelog:
  - [copr] Huge upgrade of copr plugin
  - [spec] Disable building python2 modules on Fedora 30+
  - Add characters into repo URL sanitization (RhBug:1615416)
  - copr: add support for multiple copr instances (RhBug:1478208)
  - Redirect repo progress to std error (RhBug:1626011)
  - Resolves: rhbz#1578787 - repodiff command not available in dnf-utils


author: Jaroslav Mracek <jmracek@redhat.com> - 4.0.0-1
changelog:
  - Update to 4.0.0
  - Enhance documentation
  - [repoclosure] check every --pkg attribute separately
  - [repoclosure] Now accepts nevra as a argument of --pkg option
  - [reposync] enhancements (RhBug:1550063,1582152,1550064,1405789,1598068)
  - package-cleanup: remove --oldkernels
  - Download only packages with unique NEVRAs (RhBug:1612874)


author: Jaroslav Mracek <jmracek@redhat.com> - 4.0.2-1
changelog:
  - Added repodif command
  - copr: fix enabling Rawhide repository
  - Add needs-restarting CLI shim
  - [reposync] Fix traceback with --quiet option
  - [versionlock] Accept more pkgspec forms


author: Daniel Mach <dmach@redhat.com> - 4.0.2.1-1
changelog:
  - zanata update
  - Attribute repo.metadata._comps_fn does not exist anymore
  - [download] Fix traceback when local rpm / url is passed
  - Run transaction hook only if transaction
  - [versionlock] Accept more NEVRA forms in the deletion code (RhBug:1654529)
  - [spec] Obsolete yum-utils < 1.1.31-513 (RhBug: 1579322)


author: Pavla Kratochvilova <pkratoch@redhat.com> - 4.0.7-1
changelog:
  - Update to 4.0.7
  - Use improved config parser that preserves order of data
  - Fix: copr disable command traceback (RhBug:1693551)
  - [doc] state repoid as repo identifier of config-manager (RhBug:1686779)
  - [leaves] Show multiply satisfied dependencies as leaves
  - [download] Fix downloading an rpm from a URL (RhBug:1678582)
  - [download] Do not download src without ``--source`` (RhBug:1666648)
  - [download] Fix problem with downloading src pkgs (RhBug:1649627)
  - [download] Fix download of src when not the latest requested (RhBug:1649627)


author: Pavla Kratochvilova <pkratoch@redhat.com> - 4.0.8-1
changelog:
  - Update to 4.0.8
  - [reposync] Enable timestamp preserving for downloaded data (RhBug:1688537)
  - [reposync] Download packages from all streams (RhBug:1714788)
  - Make yum-copr manpage available (RhBug:1673902)
  - [needs-restarting] Add --reboothint option (RhBug:1192946) (RhBug:1639468)
  - Set the cost of ``_dnf_local`` repo to 500, to make it preferred to normal
    repos


author: Pavla Kratochvilova <pkratoch@redhat.com> - 4.0.8-2
changelog:
  - Update localizations from zanata (RhBug:1689984)
  - Rename dnf-utils to yum-utils (RhBug:1722093)
  - [builddep] Report all rpm errors (RhBug:1724668)
  - [config-manager] Behaviour of --setopt (RhBug:1702678)


author: Ondrej Vasik <ovasik@redhat.com> 0.1-13
changelog:
  - copy content of /etc/skel directory for root as posstrans,
    don't overwrite  existing files (#999114)


author: Jakub Jelinek <jakub@redhat.com> 2005g-2
changelog:
  - 2005g
    - fixes for Uruguay
  - include README and Theory from tzcode tarball in %{_docdir};
    Theory includes a good summary of how the timezone data files
    are supposed to be named


author: Jakub Jelinek <jakub@redhat.com> 2005m-2
changelog:
  - 2005m
    - changes for USA (extending DST by 4 weeks since 2007), Tunisia,
      Australia, Kazakhstan
    - historical timezone data changes for Japan, Poland, Northern Ireland and
      Mali
    - timezone name change for East Timor


author: Jakub Jelinek <jakub@redhat.com> 2005n-2
changelog:
  - 2005n
    - changes for Kyrgyzstan and Uruguay
  - fix a typo in the Makefile (used TZDATA env var instead of TZDIR during
    make check), update tst-timezone.c from glibc CVS (#172102)


author: Jakub Jelinek <jakub@redhat.com> 2005q-2
changelog:
  - 2005q
    - changes for Georgia, Azerbaijan, Jordan, Palestine, Cuba, Nicaragua
    - SystemV timezone changes


author: Petr Machata <pmachata@redhat.com> 2005r-2
changelog:
  - 2005r
    - Zones EST, MST, HST, EST5EDT, CST6CDT, MST7MDT, PST8PDT moved to
      northamerica to guard against old files with obsolete information
      being left in the time zone binary directory.
    - Changes for countries that are supposed to join 2007 US DST
      change.  This includes most of Canada, however entries already in
      the database (Alberta, British Columbia, Newfoundland, Northwest
      Territories, and Yukon) were left alone for the time being.
    - Fixes in zdump.c (abbrok): conditions are chained, and the string
      is checked for emptiness.


author: Petr Machata <pmachata@redhat.com> 2005r-3
changelog:
  - 2005r-3
    - Meta changes.  Renaming tzdata.tar.bz2 file to tzdata$ver-base,
      so that it won't clash across updates.


author: Petr Machata <pmachata@redhat.com> 2006a-1
changelog:
  - Upstream 2006a:
    - private.h(scheck): changing char* to char const*
    - Rule changes for Palestine, zone changes for Indiana/US, both
      changes for Canada.
    - Many related doc changes.
  - Naming scheme in spec file doesn't use %{name}, but tzdata.


author: Petr Machata <pmachata@redhat.com> 2006b-1
changelog:
  - Upstream 2006b:
    - using tz64code version, as 32 is legacy according to tzdata ML
    - new manual pages for ctime, strftime, tzset
    - some source code reorganizations
    - no timezone/dst rule updates


author: Petr Machata <pmachata@redhat.com> - 2006c-1
changelog:
  - Upstream 2006c
    - Time-related changes:
      - dozens of historical and commentary changes
      - Iran stopped observing DST
      - Sri Lanka switches from UTC+6 to UTC+5:30
      - America/Thule and America/Edmonton will adopt new US rules,
        starting 2007
      - Tunisia is adopting regular DST
    - Code:
      - asctime.c: Chages in format strings to silent gcc warnings
      - removing K&R notation from function signatures
      - few fixes across the code


author: Petr Machata <pmachata@redhat.com> - 2006d-1
changelog:
  - Upstream 2006d
    - Haiti observes DST
    - Sri Lanka change actually took effect Apr/15
    - All Canada is now scheduled for 2007 US DST rules
    - Some historical fixes


author: Petr Machata <pmachata@redhat.com> - 2006f-1
changelog:
  - Upstream 2006f
    - America/Guatemala observes DST between Apr/30 and Oct/1
    - Historical changes for Nicaragua
    - Update of America/Indiana/Vincennes in zone table


author: Petr Machata <pmachata@redhat.com> - 2006j-1
changelog:
  - Upstream 2006j
    - Honduras stopped observing DST on Monday at 00:00
    - America/Bermuda will follow the US's lead next year
    - America/Moncton will use US-style rules next year
    - New Zone America/Blanc-Sablon, for Canadians who observe AST all
      year
    - New zone: America/Atikokan instead of America/Coral_Harbour
    - New zones: Europe/Jersey, Europe/Guernsey, Europe/Isle_of_Man
    - Historical changes
    - Commentary updates
  - Upstream 2006i
    - localtime.c fixes
  - Upstream 2006h
    - zic leapsecond fix


author: Petr Machata <pmachata@redhat.com> - 2006l-1
changelog:
  - Upstream 2006k, 2006l:
    - Adjustments for Egypt, Palestine, Cuba, Honduras
    - Documentation changes


author: Petr Machata <pmachata@redhat.com> - 2006m-1
changelog:
  - Upstream 2006m:
    - Adjustments for Egypt, Palestine, Uruguay
    - Better description of `until' field in zic (8) manpage


author: Petr Machata <pmachata@redhat.com> - 2006m-2
changelog:
  - Proposed upstream patch (#210058)
    - Jordan will switch to winter time on October 27, not September 29
    - Brazil's DST this year is the first Sunday in November to the last
      Sunday in February.  (Thanks to Frederico A. C. Neves.)
    - ISO 3166 codes for Serbia and Montenegro, zone Europe/Podgorica
    - Commentary and past timestamps changes


author: Petr Machata <pmachata@redhat.com> - 2006p-1
changelog:
  - Upstream 2006p
    - Official version of Western Australia DST trial changes
    - Latitude/longitude changes for Europe/Jersey and Europe/Podgorica


author: Petr Machata <pmachata@redhat.com> - 2007a-1
changelog:
  - Upstream 2007a
    - Updates to Bahamas, they will be in sync with 2007 US DST change
    - New zone Australia/Eucla
    - Africa/Asmera renamed to Africa/Asmara, link created
    - Atlantic/Faeroe renamed to Atlantic/Faroe, link created
  - Packaging
    - Adding BuildRequires: glibc-common >= 2.5.90-7 to build tzdata
      with extended 64-bit format necessary for dates beyond 2037


author: Petr Machata <pmachata@redhat.com> - 2007c-1
changelog:
  - Upstream 2007c
    - Pulaski County, Indiana, switched back to eastern time.
    - Turkey switches at 01:00 standard time, not at 01:00 UTC.
  - Upstream 2007b
    - Changes to the commentary in "leapseconds".


author: Petr Machata <pmachata@redhat.com> - 2007d-1
changelog:
  - Upstream 2007d
    - Mongolia has abolished DST.
    - Turkey will use EU rules this year, changing at 01:00 UTC rather
      than 01:00 standard time.
    - Cuba observed DST starting Sunday.
    - Resolute, Nunavut switched from Central to Eastern time last
      November.


author: Petr Machata <pmachata@redhat.com> - 2007e-1
changelog:
  - Upstream 2007e
    - Syria switched to summer time at Mar/29.
    - Honduras will not enter DST this year.


author: Petr Machata <pmachata@redhat.com> - 2007f-1
changelog:
  - Upstream 2007f
    - New Zealand is extending DST, starting later this year.
    - Haiti no longer observes DST.
    - The Turks and Caicos switch at 02:00, not at 00:00, and have
      adopted US DST rules.


author: Petr Machata <pmachata@redhat.com> - 2007g-1
changelog:
  - Fix licensing tag.
  - Upstream 2007g
    - Egypt switches the September 7, not September 28
    - Daviess, Dubous, Knox, Martin, and Pike Counties, Indiana, switch
      from central to eastern time in November
    - South Australia, Tasmania, Victoria, New South Wales and Lord Howe
      Island are changing their DST rules effective next year
    - Sync several Antarctic station's rules with the New Zealand
    - leapseconds contain changes from the most recent IERS bulletin


author: Petr Machata <pmachata@redhat.com> - 2007h-1
changelog:
  - Upstream 2007h
    - Brazil will observe DST from 2007-10-14 to 2008-02-17
    - Egypt and Gaza switched earlier than we expected
    - Iran will resume DST next year
    - Venezuela is scheduled to change TZ to -4:30 on January 1


author: Petr Machata <pmachata@redhat.com> - 2007i-1
changelog:
  - Upstream 2007i
    - Syria DST will take place at Midnight between Thursday and Friday.
    - Cuba will end DST on the last Sunday of October.
  - Update tst-timezone.c from glibc CVS


author: Petr Machata <pmachata@redhat.com> - 2007j-1
changelog:
  - Upstream 2007j
    - New links America/St_Barthelemy and America/Marigot
    - Venezuela is changing their clocks on December 9 at 03:00


author: Petr Machata <pmachata@redhat.com> - 2008b-1
changelog:
  - Upstream 2008b
    - DST changes for Syria, Cuba; Iraq abandons DST
    - Saigon zone renamed Ho_Chi_Minh; backward link provided
    - Add America/Argentina/San_Luis information


author: Petr Machata <pmachata@redhat.com> - 2008c-1
changelog:
  - Upstream 2008c
    - Mongolia changes zone
    - Pakistan DST is scheduled until Sep/1, instead of Aug/31
  - Drop Morocco and Pakistan patches that are superseded by upstream
  - Fix a typo in Java subpackage name


author: Petr Machata <pmachata@redhat.com> - 2008e-1
changelog:
  - Upstream 2008e
    - Changes for Mauritius
    - Leap second coverage for 31/Dec 2008
    - Corrections of historical dates


author: Petr Machata <pmachata@redhat.com> - 2008f-1
changelog:
  - Upstream 2008f
    - Changes for Mauritius (extends DST to years to come)
    - Palestine changes clocks for the duration of Ramadan
    - Argentina will start DST on Sunday October 19, 2008
    - Brazil will start DST on 2008-10-19
  - Drop Pakistan and Morocco patches


author: Petr Machata <pmachata@redhat.com> - 2008h-1
changelog:
  - Upstream 2008h
    - Fix exact DST transition hour for Mauritius
    - Syria will leave the period of DST on Nov 1
    - Fix coordinates of Pacific/Niue


author: Petr Machata <pmachata@redhat.com> - 2008i-1
changelog:
  - Upstream 2008i
    - Updates for Argentina: Drop DST in zones America/Argentina/Jujuy,
      La_Rioja, San_Juan, Catamarca, Mendoza, Rio_Gallegos, Ushuaia; new
      zone America/Argentina/Salta (for provinces SA, LP, NQ, RN).


author: Petr Machata <pmachata@redhat.com> - 2009a-1
changelog:
  - Upstream 2009a
    - Fix Asia/Kathmandu spelling
    - Historical timestamps for Switzerland and Cuba
    - DST update for America/Resolute


author: Petr Machata <pmachata@redhat.com> - 2009d-1
changelog:
  - Upstream 2009d
    - Morocco will observe DST from 2009-06-01 00:00 to 2009-08-21 00:00
    - Tunisia will not observe DST this year.
    - Syria will start DST on 2009-03-27 00:00 this year
    - Cuba will start DST on midnight between 2009-03-07 and 2009-03-08
    - Province of San Luis, Argentina, went to UTC-04:00 on 2009-03-15


author: Petr Machata <pmachata@redhat.com> - 2009e-1
changelog:
  - Upstream 2009e
    - Historical changes for Jordan
    - Palestine will start DST on 2009-03-26 and end 2009-09-27
  - Egypt ends DST on 2009-09-24


author: Petr Machata <pmachata@redhat.com> - 2009f-1
changelog:
  - Upstream 2009f
    - Pakistan will observe DST between 2009-04-15 and (probably) 2009-11-01
  - Drop Pakistan patch


author: Petr Machata <pmachata@redhat.com> - 2009h-2
changelog:
  - Upstream 2009h
    - Convert use of 00:00 stamps to 24:00 of the previous day
    - Clarify that the data is Public Domain
  - Drop Cairo patch


author: Petr Machata <pmachata@redhat.com> - 2009k-1
changelog:
  - Upstream 2009k
    - Mauritius will not continue to observe DST the coming summer
    - Arbitrarily end DST at the end of 2009 so that a POSIX-style time
      zone string can appear in the Dhaka binary file


author: Petr Machata <pmachata@redhat.com> - 2009m-1
changelog:
  - Upstream 2009m
    - Palestine will will revert back to winter time on Friday, 2009-09-04
    - Samoa passed the DST Bill that fixes DST dates for 2009 and 2010
  - Drop Egypt patch


author: Petr Machata <pmachata@redhat.com> - 2009m-2
changelog:
  - Add markers for autoupdate of spec file
  - Pakistan leaves the period of DST on October 1 (tzdata-2009m-karachi.patch)


author: Petr Machata <pmachata@redhat.com> - 2009o-1
changelog:
  - Upstream 2009o
    - Bangladesh won't go back to Standard Time from October 1, 2009
    - Pakistan leaves DST on October 1, 2009
  - Dropped tzdata-2009m-karachi.patch
  - Argentina does not enter DST on October 18 (tzdata-2009o-argentinas.patch)


author: Petr Machata <pmachata@redhat.com> - 2009u-1
changelog:
  - Upstream 2009p
    - Argentina does not enter DST on October 18
    - San Luis switched from UTC-4 to UTC-3 on October 11th
  - Upstream 2009q
    - Change DST end in Syria from November 1 to last Friday in October
    - Changes to past Hong Kong transitions
    - Kemerovo oblast' in Russia will change current time zone on March 28, 2010.
      Asia/Novokuznetsk is the new time zone name
  - Upstream 2009r
    - Changes to local times of three Australian research stations in Antarctica
  - Upstream 2009s
    - Fiji plans to re-introduce DST from November 29th 2009 to April 25th 2010
  - Upstream 2009u
    - Bangladesh changed their clock back to Standard Time on December 31, 2009
  - Dropped tzdata-2009o-argentinas.patch


author: Petr Machata <pmachata@redhat.com> - 2010c-1
changelog:
  - Upstream 2010a
    - Source code cleanups
    - Historical timestamps for Bangladesh
  - Upstream 2010b
    - Northern Mexico's border cities share the DST schedule with the
      United States
  - Upstream 2010c
    - Paraguay DST now in effect from 2nd Sunday of April to 1st Sunday
      of October


author: Petr Machata <pmachata@redhat.com> - 2010e-1
changelog:
  - Upstream 2010d
    - The DST change in Bangladesh takes place a minute earlier
    - Fiji to end DST on 2010-03-28 at 03:00, about a month earlier
    - Samoa to observe DST this year; they didn't observe DST last year
    - DST in Chile extended to 3 April
  - Upstream 2010e:
    - Fix a typo in Bangladesh DST rule


author: Petr Machata <pmachata@redhat.com> - 2010f-1
changelog:
  - Upstream 2010f:
    - Changes to Australian stations in Antarctica
    - Correct 2010 Samoa DST start date
    - New zone Antarctica/Macquarie
    - Change Syria DST start from last Friday in March to first Friday
      in April in 2010 and forward
  - Upstream 2010g proposal (tzdata-2010f-g.patch):
    - No Bangladesh DST in 2010 and forward.
    - Gaza DST starts last Saturday in March at 12:01 a.m. in 2010 and forward
    - Kamchatka and Anadyr change to Moscow+8 on 2010-03-28
    - Samara changes to Moscow+0 on 2010-03-28
    - Related zone.tab updates


author: Petr Machata <pmachata@redhat.com> - 2010f-3
changelog:
  - Tunisia not to observe DST in 2010 (tzdata-2010g-tunis.patch)
  - Pakistan not to observe DST in 2010 (tzdata-2010g-karachi.patch)


author: Petr Machata <pmachata@redhat.com> - 2010h-2
changelog:
  - Upstream 2010g:
    - No Bangladesh DST in 2010 and forward.
    - Gaza DST starts last Saturday in March at 12:01 a.m. in 2010 and forward
    - Kamchatka and Anadyr change to Moscow+8 on 2010-03-28
    - Samara changes to Moscow+0 on 2010-03-28
    - Related zone.tab updates
  - Upstream 2010h:
    - No DST in Tunisia in 2010 and forward
    - No DST in Pakistan in 2010 and forward
  - Dropped tzdata-2010g-tunis.patch
  - Dropped tzdata-2010f-g.patch
  - Dropped tzdata-2010g-karachi.patch


author: Petr Machata <pmachata@redhat.com> - 2010i-1
changelog:
  - Upstream 2010i:
    - Morocco will have DST from 2010-05-02 to 2010-08-08
    - San Luis, Argentina will keep permanent DST after April 11, 2010
    - Updates of historical stamps for Taiwan


author: Petr Machata <pmachata@redhat.com> - 2010j-1
changelog:
  - Upstream 2010j:
    - Bahia de Banderas (Mexican state of Nayarit) changed time zone
      UTC-7 to new time zone UTC-6 on April 4, 2010


author: Tom "spot" Callaway <tcallawa@redhat.com> - 2010k-1
changelog:
  - Upstream 2010k:
   - Egypt has announced that DST will be off during Ramadan, but
     DST will resume afterwards (August 10, 2010 - September 9, 2010)


author: Petr Machata <pmachata@redhat.com> - 2010l-2
changelog:
  - Upstream 2010l:
    - Change Cairo's 2010 reversion to DST from the midnight between
      September 8 and 9 to the midnight between September 9 and 10.
    - Change Gaza's 2010 return to standard time to the midnight between
      August 10 and 11.
    - Bahia de Banderas (Mexican state of Nayarit) changed time zone
      UTC-7 to new time zone UTC-6 on April 4, 2010


author: Petr Machata <pmachata@redhat.com> - 2010n-1
changelog:
  - Upstream 2010m:
    - Hong Kong didn't observe DST in 1977
    - In zone.tab, remove obsolete association of Vostok Station with
      South Magnetic Pole; add association with Lake Vostok
  - Upstream 2010n:
    - Change end of DST in Samoa in 2011 from 2011-04-03 0:00 to
      2011-04-03 1:00


author: Petr Machata <pmachata@redhat.com> - 2011b-1
changelog:
  - Upstream 2011b:
    - America/North_Dakota/Beulah: Mercer County, North Dakota, changed
      from the mountain time zone to the central time zone


author: Petr Machata <pmachata@redhat.com> - 2011b-2
changelog:
  - Update of historical stamps for Juneau, Sitka, and histcurrent stamps
    for Metlakatla.  Sitka and Metlakatla are new zones.
  - Delay end of DST in Chile in 2011 until first Sunday in April. (tzdata-2011b-c.patch)


author: Petr Machata <pmachata@redhat.com> - 2011d-1
changelog:
  - Upstream 2011d:
    - Change end of DST in Samoa in 2011.
    - Change start of DST in Cuba in 2011.
    - Move start of DST in Turkey by one day in 2011.
  - Dropped tzdata-2011b-c.patch


author: Petr Machata <pmachata@redhat.com> - 2011g-1
changelog:
  - Upstream 2011e:
    - Morocco introduced DST for 2011 from April 2 to July 31.
    - Delay end of DST in Chile in 2011 until May 7.
  - Upstream 2011f:
    - The Falkland Islands will not turn back clocks this winter, but
      stay on daylight saving time.
  - Upstream 2011g:
    - Egypt abandons DST in 2011 (and forward)
  - Dropped tzdata-2011d-chile.patch
  - Dropped tzdata-2011d-morocco.patch


author: Petr Machata <pmachata@redhat.com> - 2011h-1
changelog:
  - Upstream 2011h:
    - Russia abandons DST in 2011.
    - *.tab: change AN (Netherlands Antilles) to CW (Curacao)


author: Petr Machata <pmachata@redhat.com> - 2011h-2
changelog:
  - Patch for upcoming change in Newfoundland.  The transition time
    changes from 12:01 AM to 2:00 AM.


author: Petr Machata <pmachata@redhat.com> - 2011h-1
changelog:
  - Upstream 2011i:
    - Add Africa/Juba (South Sudan) zone
    - Samoa skips over the date line on 2011-12-30
    - Use KALT as abbreviation for Europe/Kalinigrad
    - Canonical version of the Newfoundland patch
    - Change America/Resolute use of EST to 2006-2007 only
    - Assume Metlakatla abandoned use of daylight saving in 1983
    - Sync iso3166.tab and zone.tab with above
  - Resolved: #734063


author: Petr Machata <pmachata@redhat.com> - 2011k-0.1.20110921
changelog:
  - Upstream 2011j:
    - Fix the Samoa date line skip
    - Changes in past timestamp typos several Africa zones
  - Proposed upstream 2011k:
    - Belarus and Ukraine adopt permanent DST in 2011
    - Palestine suspends DST during Ramadan in 2011
    - Gaza and West Bank split in 2011.  West Bank is tracked in the
      timezone Asia/Hebron.  zone.tab update accordingly.
  - Resolves: #737896


author: Petr Machata <pmachata@redhat.com> - 2011l-1
changelog:
  - Upstream 2011l:
    - Fix ancient stamps for America/Sitka
    - Asia/Hebron transitioned to standard time already on Sep 30, not Oct 3
    - Fiji will introduce DST on Oct 22


author: Petr Machata <pmachata@redhat.com> - 2011l-2
changelog:
  - State of Bahia, Brazil, to resume Summer Time on Oct 16
  - The project moved, reflect this in URL
  - Resolves: #746183


author: Petr Machata <pmachata@redhat.com> - 2011l-1
changelog:
  - Rebase to 2011n
    - Drop all patches, including the Kemerovo patch, which is not in
      upstream
    - Cuba postponed DST by two weeks to Nov 13
    - Fiji will enter DST on Jan 21
  - Resolved: #748778


author: Petr Machata <pmachata@redhat.com> - 2012b-1
changelog:
  - Rebase to 2012b; changes vs. 2011n-5:
    - Changes to zones for Antarctica stations
    - Armenia abolished DST in 2012 and forward
    - Cuba enters DST on 31st March
    - Falkland Islands will stay on permanent Summer Time
    - New zone for Creston Valley, Canada, which differs from Dawson
      Creek in past stamps.  Changes to historical stamps in Canada.
    - Last year, Tokelau skipped over the date line together with Samoa


author: Petr Machata <pmachata@redhat.com> - 2012b-2
changelog:
  - Morocco DST starts on the last Sunday of March (March 25, 2012) and
    ends on last Sunday of September, except the month of Ramadan.  It
    is currently unclear what that Ramadan bit means, so this is not
    covered by the patch as of now.


author: Petr Machata <pmachata@redhat.com> - 2012c-1
changelog:
  - Upstream 2012c
    - Haiti observes DST from 2012 on
    - Gaza Strip and Hebron observe DST in 2012
    - Change start of DST in Syria to last Friday in March


author: Petr Machata <pmachata@redhat.com> - 2012d-1
changelog:
  - Upstream 2012d
    - Morocco will not observe DST during the month of Ramadan.
      DST cessation end date was corrected.


author: Petr Machata <pmachata@redhat.com> - 2012f-1
changelog:
  - Fiji will start daylight savings at 2 am on Sunday 21st October 2012
    and end at 3 am on Sunday 20th January 2013.  Guess it will be like
    that in following years as well.
  - Resolves: #857231


author: Petr Machata <pmachata@redhat.com> - 2012g-1
changelog:
  - Upstream 2012g
    - Adjust the packaging for new Makefile
    - Palestine: Fall transition was Sep 21, not Sep 28
    - Samoa: Daylight Saving Time commences on Sunday 30th September
      2012 and ends on Sunday 7th of April 2013.
  - Resolves: #868173


author: Petr Machata <pmachata@redhat.com> - 2012h-1
changelog:
  - Upstream 2012h
    - Brazilian state Bahia no longer has DST.
    - Brazilian state Tocantins now has DST.
    - Israel has new DST rules next year.
    - Jordan stays on DST this winter.


author: Petr Machata <pmachata@redhat.com> - 2012h-2
changelog:
  - Switch back to using system zic, ignore upstream Makefile at all.
    We do so for java anyway.
  - Drop Factory from distribution


author: Petr Machata <pmachata@redhat.com> - 2013b-1
changelog:
  - Upstream 2013b
    - Paraguay will end DST on March 24 this year
    - Haiti uses US daylight-saving rules this year
    - Morocco does not observe DST during Ramadan
  - Upstream 2013a
    - Retire Chile patch, 2013a has the data
    - New Zones Asia/Khandyga, Asia/Ust-Nera, Europe/Busingen
    - Many changes in historical timestamps


author: Petr Machata <pmachata@redhat.com> - 2013c-1
changelog:
  - Upstream 2013c
    - Sync past stamps for Palestine and West Bank with timeanddate.com
    - Assume that the recent change to Paraguay's DST rules is permanent
    - Macquarie was uninhabited between 1919 and 1948.  It's also part
      of Australia (update in zone.tab).


author: Petr Machata <pmachata@redhat.com> - 2013c-2
changelog:
  - Update descriptions in iso3166.tab; make Jerusalem coordinates in
    zone.tab more precise
    (0001-Adjust-commentary-to-try-to-defuse-recent-issues-som.patch)
  - Update local mean time for Jerusalem to match more-precise longitude
    (0002-asia-Asia-Jerusalem-Fix-LMT-to-match-more-precise-lo.patch)
  - Move Morocco's midsummer 2013 transitions
    (0003-Move-Morocco-s-midsummer-2013-transitions.patch)
  - Israel now falls back on the last Sunday of October
    (0004-Israel-now-falls-back-on-the-last-Sunday-of-October.patch)


author: Patsy Franklin <pfrankli@redhat.com> 2013h-1
changelog:
  - Rebase to 2013h 
    - Lybia switched to using UTC+2 without DST
    - Western Sahara (Africa/ElAaiun) uses Morocco's DST rules
    - Acres and Amazon swithc to UTC-4 and UTC-5 on 2013-11-10
    - Add entries for DST transition in Morocco in the year 2038


author: Patsy Franklin <pfrankli@redhat.com> 2013i-1
changelog:
  - Rebase with early release of 2013i from Paul Eggert github.
    - Jordan switches back to standard time at 00:00 on December 20,2013.
    - The 2006-2011 transition schedule is planned to resume in 2014.
    - The compile-time flag NOSOLAR has been removed.
    - The files solar87, solar88, and solar89 are no longer distributed.
    - tz-link.htm now mentions Noda Time.


author: Patsy Franklin <pfrankli@redhat.com> 2014c-1
changelog:
  - Rebase to 2014c
    -Egypt will re-apply DST on May 15 at 24:00, except that DST
     will not be observed during Ramadan.


author: Patsy Franklin <pfrankli@redhat.com> - 2014e-3
changelog:
  - Rebase to 2014e
    - Morrocco suspends DTS for Ramadan
         June 28 at 03:00 and August 2 at 02:00
    - Egypt suspends DTS for Ramadan
         June 26 and July 31 at 24:00
  - Additional edit to support OpenJDK8. (#1091029)


author: Patsy Franklin <pfrankli@redhat.com> - 2014f-1
changelog:
  - Rebase to 2014f
    - Russian time zone changes effective 2014-10-26
    - Several other time zone abbreviation changes as described in
      the NEWS file.


author: Patsy Franklin <pfrankli@redhat.com> - 2014g-1
changelog:
  - Rebase to 2014g
    - Turks & Caicos is switching from US eastern time to UTC-4 year-round,
      modeled as a switch from EST/EDT to AST on 2014-11-02 at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2014i-1
changelog:
  - Rebase to 2014i
    - Pacific/Fiji will observe DST from 2014-11-02 02:00 to 2015-01-18 03:00.
    - A new Zone Pacific/Bougainville, for the part of Papua New Guinea
      that plans to switch from UTC+10 to UTC+11 on 2014-12-28 at 02:00


author: Patsy Franklin <pfrankli@redhat.com> - 2014j-1
changelog:
  - Rebase to 2014j
    - Turks & Caicos' switch from US eastern time to UTC-4 year-round
      did not occur on 2014-11-02 at 02:00.  It's currently scheduled
      for 2015-11-01 at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2015a-1
changelog:
  - Rebase to 2015a
    - New leap second 2015-06-30 23:59:60 UTC as per IERS Bulletin C 49.
    - The Mexican state of Quintana Roo, represented by America/Cancun,
      will shift from Central Time with DST to Eastern Time without DST
      on 2015-02-01 at 02:00.
    - Chile will not change clocks in April or thereafter; its new standard time
      will be its old daylight saving time.  This affects America/Santiago,
      Pacific/Easter, and Antarctica/Palmer.


author: Patsy Franklin <pfrankli@redhat.com> - 2015b-1
changelog:
  - Rebase to 2015b
    - Mongolia will start observing DST again this year, from the last
      Saturday in March at 02:00 to the last Saturday in September at 00:00.
    - Palestine will start DST on March 28, not March 27.  Also,
      correct the fall 2014 transition from September 26 to October 24.
      Adjust future predictions accordingly.


author: Patsy Franklin <pfrankli@redhat.com> - 2015c-1
changelog:
  - Rebase to 2015c
    - Egypt's spring-forward transition is at 24:00 on April's last Thursday,
      not 00:00 on April's last Friday.  2015's transition will therefore be on
      Thursday, April 30 at 24:00, not Friday, April 24 at 00:00.  Similar fixes
      apply to 2026, 2037, 2043, etc.  (Thanks to Steffen Thorsen.)
  - Rebase javazic tool to match latest upstream OpenJDK version


author: Patsy Franklin <pfrankli@redhat.com> - 2015d-1
changelog:
  - Rebase to 2015d
    - Egypt will not observe DST in 2015 and will consider canceling it
      permanently.  For now, assume no DST indefinitely.
    - The abbreviations for Hawaii-Aleutian standard and daylight times
      have been changed from HAST/HADT to HST/HDT, as per US Government
      Printing Office style.  This affects only America/Adak since 1983,
      as America/Honolulu was already using the new style.


author: Patsy Franklin <pfrankli@redhat.com> - 2015d-3
changelog:
  - Morocco will suspend DST from 2015-06-14 03:00 through 2015-07-19 02:00,
    not 06-13 and 07-18 as we had guessed.


author: Patsy Franklin <pfrankli@redhat.com> - 2015e-1
changelog:
  - Morocco will suspend DST from 2015-06-14 03:00 through 2015-07-19 02:00,
    not 06-13 and 07-18 as we had guessed.
  - Assume Cayman Islands will observe DST starting next year, using US rules.
    Although it isn't guaranteed, it is the most likely.


author: Patsy Franklin <pfrankli@redhat.com> - 2015f-1
changelog:
  - Rebase to 2015f
    - North Korea switches to +0830 on 2015-08-15.
      The abbreviation remains "KST".
    - Uruguay no longer observes DST.


author: Patsy Franklin <pfrankli@redhat.com> - 2015g-1
changelog:
  - Rebase to 2015g
    - Turkey's 2015 fall-back transition is scheduled for Nov. 8, not Oct. 25.
    - Norfolk moves from +1130 to +1100 on 2015-10-04 at 02:00 local time.
    - Fiji's 2016 fall-back transition is scheduled for January 17, not 24.
    - Fort Nelson, British Columbia will not fall back on 2015-11-01.  It has
      effectively been on MST (-0700) since it advanced its clocks on 2015-03-08.
      New zone America/Fort_Nelson.


author: Patsy Franklin <pfrankli@redhat.com> - 2016a-1
changelog:
  - Rebase to 2016a
    - America/Cayman will not observe daylight saving this year after all.
      Revert our guess that it would.
    - Asia/Chita switches from +0800 to +0900 on 2016-03-27 at 02:00.
    - Asia/Tehran now has DST predictions for the year 2038 and later,
      to be March 21 00:00 to September 21 00:00.  This is likely better
      than predicting no DST, albeit off by a day every now and then.


author: Patsy Franklin <pfrankli@redhat.com> - 2016b-1
changelog:
  - Rebase to 2016b
    - New zones Europe/Astrakhan and Europe/Ulyanovsk for Astrakhan and
      Ulyanovsk Oblasts, Russia, both of which will switch from +03 to +04 on
      2016-03-27 at 02:00 local time.  They need distinct zones since their
      post-1970 histories disagree.  New zone Asia/Barnaul for Altai Krai and
      Altai Republic, Russia, which will switch from +06 to +07 on the same date
      and local time.  The Astrakhan change is already official; the others have
      passed the first reading in the State Duma and are extremely likely.
      Also, Asia/Sakhalin moves from +10 to +11 on 2016-03-27 at 02:00.
    - As a trial of a new system that needs less information to be made up,
      the new zones use numeric time zone abbreviations like "+04"
      instead of invented abbreviations like "ASTT".
    - Haiti will not observe DST in 2016.
    - Palestine's spring-forward transition on 2016-03-26 is at 01:00, not 00:00.
      Guess future transitions will be March's last Saturday at 01:00, not March's
      last Friday at 24:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2016c-1
changelog:
  - Rebase to 2016c
    - Azerbaijan no longer observes DST.
    - Chile changes from permanent DST to seasonal DST.


author: Patsy Franklin <pfrankli@redhat.com> - 2016d-1
changelog:
  - Rebase to 2016d
    - America/Caracas switches from -0430 to -04 on 2016-05-01 at 02:30.
    - Asia/Magadan switchefrom +10 to +11 on 2016-04-24 at 02:00.
    - New zone Asia/Tomsk, split off from Asia/Novosibirsk.  It covers
      Tomsk Oblast, Russia, which switches from +06 to +07 on 2016-05-29
      at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2016f-1
changelog:
  - Rebase to 2016f
    - Egypt cancelled DST.
    - Asia/Novosibirsk transitions from +06 to +07 on 2016-07-24 at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2016g-1
changelog:
  - Rebase to 2016g
    - Turkey permanently switches from +02 to +03 as of 2016-09-07,
    - Per IERS Bulletin C 52, leap second to be added on 2016-09-31 at 23:59:60.


author: Patsy Franklin <pfrankli@redhat.com> - 2016h-1
changelog:
  - Rebase to 2016h
    - DST ends in Asia/Gaza and Asia/Hebron on 2016-10-29 at 01:00,
      not the predicted date of 2016-10-21 at 00:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2016i-1
changelog:
  - Rebase to 2016i
    - Pacific/Tongatapu now begins DST on 2016-11-06 at 02:00 and ends
      on 2017-01-15 at 03:00.
    - Northern Cyprus is changed to +03 year round. This results in a
      split in Cyprus time zones starting 2016-10-30 at 04:00 and
      creates a new zone - Asia/Famagusta.
    - Antarctica/Casey changed from +08 to +11 on 2016-10-22.


author: Patsy Franklin <pfrankli@redhat.com> - 2016j-1
changelog:
  - Rebase to 2016j
    - The Saratov Region of Russia is changing from +03 to +04 on
      2016-12-04, resulting in a new timezone Europe/Saratov.


author: Patsy Franklin <pfrankli@redhat.com> - 2017a-1
changelog:
  - Rebase to tzdata-2017a
    - Mongolia no longer observes DST
    - Magallanes region of Chile moves from -04/-03 to -03 year round.
      This results in a new zone, America/Punta_Arenas.


author: Patsy Griffin Franklin <patsy@redhat.com> - 2019a-1
changelog:
  - Rebase to tzdata-2019a
    - Palestine will start DST on 2019-03-30, rather than 2019-03-23 as
      previously predicted.
    - Metlakatla rejoined Alaska time on 2019-01-20, ending its observances
      of Pacific standard time.


author: Patsy Griffin <patsy@redhat.com> - 2019b-1
changelog:
  - Rebase to tzdata-2019b
    - Brazil will no longer observe DST going forward.
    - The 2019 spring transition for Palestine occurred 03-29, not 03-30.


author: Patsy Griffin <patsy@redhat.com> - 2019c-1
changelog:
  - Rebase to tzdata-2019c
    - Fiji will observe DST from 2019-11-10 to 2020-01-12.
    - Norfolk Island will begin observing Australian-style DST on 2019-10-06.


author: Patsy Griffin <patsy@redhat.com> - 2020a-1
changelog:
  - Rebase to tzdata-2020a
    - Morocco will spring forward on 2020-05-31 rather than
      previously predicted 2020-05-24.
    - Canada's Yukon region changed to year round UTC -07
      effective 2020-03-08.
    - America/Godthab was renamed to America/Nuuk.


author: Michal Schmidt <mschmidt@redhat.com> - 10.0.0.0-438
changelog:
  - Initial packaging for RHEL, based on upstream spec file.
  - Cleaned up spec.
  - Moved /opt/opafm -> /usr/lib/opa-fm.
  - Fix scriptlets.


author: Michal Schmidt <mschmidt@redhat.com> - 10.0.0.0-440
changelog:
  - Respect optflags.
  - Avoid overflowing prog path due to /opt -> /usr/lib substitution.
  - Resolves: bz1257087
  - Resolves: bz1257093


author: Honggang Li <honli@redhat.com> - 10.0.0.0-443
changelog:
  - Apply one missed patch to fix various /tmp races
  - Revert the script for building (S)RPMs
  - Resolves: bz1262327


author: Honggang Li <honli@redhat.com> - 10.3.1.0-8
changelog:
  - Rebase to upstream branch v10_3_1 as required.
  - Clean up change log.
  - Apply Epoch tag.
  - Resolves: bz1257452, bz1382792


author: Zdenek Dohnal <zdohnal@redhat.com> - 8.0.1763-2
changelog:
  - 1576470 - Suggest correct packages to get embedded interpreters working
  - add libappstream-glib for appstream-util
  - 1576483 - Vim needs Python2 to build


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-8
changelog:
  - 1640919 - augroup fedora, test case failure: /CoreOS/vim/Regression/bz241308-use-augroup-for-rh-autocmds


author: David King <amigadave@amigadave.com> - 0.16-1
changelog:
  - Update to 0.16 (#1144863)
  - Remove clean section and BuildRoot tag
  - Update URL and Sourc0
  - Use license macro for COPYING
  - Use parallel make flags
  - Preserve timestamps during install


author: Chris Leech <cleech@redhat.com> - 1.0.1-3.git986eb2e
changelog:
  - 1303439 package should not attempt to own /etc/bash_completion.d
  - fix more build warning in rawhide


author: Richard Hughes <richard@hughsie.com> 0.2.10-1
changelog:
  - New upstream version
  - Correctly detect removed devices when rescanning
  - Fix a memory leak when using control tranfers
  - Fix symbol version table up to version 0.2.9


author: Donnie Barnes <djb@redhat.com>
changelog:
  - added signal handling patch from Dean Gaudet <dgaudet@arctic.org> that
    is based on a change made in bash 2.0.  Should fix some early exit
    problems with suspends and fg.


author: Ian Macdonald <ianmacd@xs4all.nl>
changelog:
  - upgraded to version 2.02
  - Alpha, MIPS & Sparc patches removed due to lack of test platforms
  - glibc & signal patches no longer required
  - added documentation subpackage (doc)


author: Florian La Roche <Florian.LaRoche@redhat.com>
changelog:
  - add some collected patches for bash2
  - change it over to be the main bash package
  - install man-pages root:root
  - obsolete bash2, bash2-doc


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - 2.04beta5
  - adapt patches
  - Fix up bashrc
  - Don't put in bashrc1, this should be done by the bash1 package
  - use install -c instead of plain install to work on *BSD
  - remove the collected patches - they're now in the base version.
  - make compressed man pages optional


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - 2.04 final
  - remove the echo, pwd, test and kill man pages from the package,
    we're getting them from sh-utils


author: Bernhard Rosenkraenzer <bero@redhat.com> 2.05-1
changelog:
  - Update to 2.05
  - Change PROMPT_COMMAND in bashrc for xterms
    to something less space consuming (#24159)
  - Provide plugs for alternate prompt commands (#30634), but don't
    default to them


author: Bernhard Rosenkraenzer <bero@redhat.com> 2.05-2
changelog:
  - bash comes with its own copy of readline... Add the patches we're
    applying in the readline package.


author: Bernhard Rosenkraenzer <bero@redhat.com> 2.05-5
changelog:
  - Don't set BASH_ENV in .bash_profile, it causes .bashrc to be sourced
    twice in interactive non-login shells.
  - s/Copyright/License/


author: Bernhard Rosenkraenzer <bero@redhat.com> 2.05a-9
changelog:
  - Add patch from Ulrich Drepper to get better error messages when trying
    to launch an application with a bad ELF interpreter (e.g. libc5 ld.so)
    (#60870)


author: Tim Waugh <twaugh@redhat.com> 2.05b-4
changelog:
  - Fix history substitution modifiers in UTF-8 (bug #70294, bug #71186).
  - Fix ADVANCE_CHAR at end of string (bug #70819).
  - docs: CWRU/POSIX.NOTES no longer exists, but ship POSIX.


author: Tim Waugh <twaugh@redhat.com> 2.05b-6
changelog:
  - Add the (4) patches from ftp.gnu.org (bug #75888, bug #72512).
  - Ship '.' man page, which doesn't get picked up by glob.
  - Don't install files not shipped when building.
  - Locale shell variables fix (bug #74701).


author: Tim Waugh <twaugh@redhat.com> 2.05b-23
changelog:
  - Fix a warning message (bug #79629).
  - Don't remove generated source during build, for debuginfo package.
  - Don't build with AFS support (bug #86514).


author: Tim Waugh <twaugh@redhat.com> 3.0-2
changelog:
  - Fixed brace expansion (bug #129128).
  - Build with AFS support again, since bug #86514 seems fixed upstream
    (bug #129094).


author: Tim Waugh <twaugh@redhat.com> 3.0-5
changelog:
  - Make trap usage string show POSIX usage (bug #128938).
  - Updated ${x[@]:1} expansion fix from bug-bash list.
  - Updated patch to fix unset array crash (from bug-bash list).


author: Tim Waugh <twaugh@redhat.com> 3.0-13
changelog:
  - Check for EINVAL from waitpid() and avoid WCONTINUED in that case.
  - Fixed jobs4 test.
  - Applied experimental upstream patch for trap compatibility.
  - Re-make documentation to reflect source changes.


author: Tim Waugh <twaugh@redhat.com> 3.0-21
changelog:
  - Added code to /etc/skel/.bash_logout to support the gpm selection buffer
    invalidation on virtual terminals (bug #115493).


author: Tim Waugh <twaugh@redhat.com>
changelog:
  - Reverted this change:
    - Added code to /etc/skel/.bash_logout to support the gpm selection buffer
      invalidation on virtual terminals (bug #115493).


author: Tim Waugh <twaugh@redhat.com>
changelog:
  - Fixed AFS support for output redirection, so that the correct errors
    are reported for other filesystems (bug #155373).


author: Tim Waugh <twaugh@redhat.com> 3.0-36
changelog:
  - Added Url: tag (bug #172770).
  - Do not explicitly gzip info pages (bug #172770).
  - Fix permissions on bashbug (bug #172770).


author: Tim Waugh <twaugh@redhat.com> 3.0-40
changelog:
  - Fix read memleak when reading from non-blocking fd (bug #173283).
  - Missed another loop for improved sighandler patch (bug #169231).


author: Tim Waugh <twaugh@redhat.com> 3.1-1
changelog:
  - 3.1.
  - No longer need ia64, utf8, multibyteifs, jobs, sigpipe,
    read-e-segfault, manpage, crash, pwd, afs, subshell patches.
  - Remove wrap patch for now.
  - Use upstream patch to fix arrays.


author: Tim Waugh <twaugh@redhat.com> 3.1-2
changelog:
  - No longer need loadables, mbinc or shellfunc patches.
  - Use literal single-quote in bash man page where appropriate (bug #177051).


author: Tim Waugh <twaugh@redhat.com> 3.2-1
changelog:
  - Build requires autoconf and gettext.
  - 3.2.  No longer need aq, login, ulimit, sighandler or read-memleak
    patches.


author: Tim Waugh <twaugh@redhat.com> 3.2-5
changelog:
  - Added triggers for install-info (bug #225609).
  - Use full path to utilities in scriptlets (bug #225609).
  - Fix missing sh-bangs in example scripts (bug #225609).
  - Post requires ncurses (bug #224567).
  - Removed Prefix tag (bug #225609).
  - Fixed BuildRoot tag (bug #225609).
  - Removed trailing full-stop from summary (bug #225609).
  - Spec file is now UTF-8 (bug #225609).
  - Removed obsolete Obsoletes (bug #225609).
  - Moved 'make check' to new 'check' section (bug #225609).
  - Removed uses of RPM_SOURCE_DIR (bug #225609).
  - Fixed macros in changelog (bug #225609).
  - Changed tabs to spaces (bug #225609).


author: Tim Waugh <twaugh@redhat.com> 3.2-7
changelog:
  - Reinstated this change:
    - Post requires ncurses (bug #224567).
  - Reverted this change:
    - Added triggers for install-info (bug #225609).


author: Pete Graner <pgraner@redhat.com> - 3.2-15
changelog:
  - Update to the Improve bash $RANDOM pseudo RNG (bug #234906) 
    now works with subshells and make $RANDOM on demand thus reducing the 
    amount of AVCs thrown.


author: Pete Graner <pgraner@redhat.com> - 3.2-17
changelog:
  - Added bash32-018 upstream official patch
  - Added bash32-020 upstream official patch
  - Added bash32-019 upstream official patch


author: Pete Graner <pgraner@redhat.com> - 3.2-18
changelog:
  - Added bash32-021 upstream official patch
  - Added bash32-025 upstream official patch
  - Added bash32-024 upstream official patch
  - Added bash32-023 upstream official patch
  - Added bash32-022 upstream official patch


author: Tomas Janousek <tjanouse@redhat.com> - 3.2-19
changelog:
  - fix cursor position when prompt has one invisible character (#358231)
  - dropped examples/loadables/ from docs, since it wasn't possible to build them
    anyway (#174380)
  - fix #286861: Wrong input confuses bash's arithmetic unit permanently
  - fix #344411: $RANDOM stays the same when job executed in the background


author: Tomas Janousek <tjanouse@redhat.com> - 3.2-20
changelog:
  - Added bash32-026 upstream official patch
  - Added bash32-027 upstream official patch (#249987)
  - Added bash32-028 upstream official patch
  - Added bash32-029 upstream official patch (#286861)
  - Added bash32-030 upstream official patch
  - Added bash32-031 upstream official patch (#358231)
  - Added bash32-032 upstream official patch
  - Added bash32-033 upstream official patch
  - Fix insert command repeating in vi mode (#190350)


author: Roman Rakus <rrakus@redhat.com> - 3.2-28
changelog:
  - Removing Requires for mktemp and ncurses, which cause
    dependencing loop
  - Enabling #define SSH_SOURCE_BASHRC, because ssh changed.
    Resolves: #458839
  - Catch signals right after calling execve()
    Resolves: #455548


author: Jesse Keating <jkeating@redhat.com> - 3.2-29
changelog:
  - Add the Requires(post) back for ncurses-libs, so that rpm knows
    where to break the loop.  The post actually does require the curses
    libs for the sh calls.  Could consider doing this in LUA and not have
    any external deps.


author: Ville Skyttä <ville.skytta@iki.fi> - 4.1.9-2
changelog:
  - Move doc dir ownership to main package.
  - Preserve doc timestamps.
  - Add --without tests option for building without running the test suite.


author: Roman Rakus <rrakus@redhat.com> - 4.1.9-3
changelog:
  - don't segfault when trying to bind int variable to array
    with bad array subsrcipt
    Resolves: #618289


author: Roman Rakus <rrakus@redhat.com> - 4.2.37-7
changelog:
  - Update info about trap in man page
    Resolves: #799958
  - instead of setting the signal handler to SIG_IGN while installing
    the new trap handler, block the signal and unblock it after the new handler
    is installed
    Resolves: #695656


author: Roman Rakus <rrakus@redhat.com> - 4.2.45-2
changelog:
  - Fixed a bug that caused trap handlers to be executed recursively,
    corrupting internal data structures.


author: Ondrej Oprala - 4.3.39-5
changelog:
  - #1182278 - bash crashes on `select' if REPLY is readonly
  - #1241533,1224855 - bash memleak when LC_ALL set


author: Siteshwar Vashisht <svashisht@redhat.com> - 4.3.42-5
changelog:
  - Do not set terminate_immediately and interrupt_immediately while expanding tilda
    Resolves: #1336800


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 4.3.43-2
changelog:
  - Inverted the condition for UsrMove safeguard check, so we comply with:
    https://fedoraproject.org/wiki/Packaging:Conflicts


author: Preston Brown <pbrown@redhat.com>
changelog:
  - move iptables to /sbin.
  - excludearch alpha for now, not building there because of compiler bug(?)


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - 1.2
  - fix up ipv6 split
  - add init script
  - Move the plugins from /usr/lib/iptables to /lib/iptables.
    This needs to work before /usr is mounted...
  - Use -O1 on alpha (compiler bug)


author: Karsten Hopp <karsten@redhat.de>
changelog:
  - fix bugzilla #25986 (initscript not marked as config file)
  - fix bugzilla #25962 (iptables-restore)
  - mv chkconfig --del from postun to preun


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - Yet another initscript fix (#30173)
  - Fix the fixes; they fixed some issues but broke more important
    stuff :/ (#30176)


author: Bernhard Rosenkraenzer <bero@redhat.com> 1.2.4-1
changelog:
  - Update to 1.2.4 (various fixes, including security fixes; among others:
    - Fix init script (#31133)


author: Bernhard Rosenkraenzer <bero@redhat.com> 1.2.5-2
changelog:
  - Merge ip6tables improvements from Ian Prowell <iprowell@prowell.org>
    - Update URL (#59354)
  - Use /sbin/chkconfig rather than chkconfig in %postun script


author: Karsten Hopp <karsten@redhat.de>
changelog:
  - fixed iptables and ip6tables initscript output, based on #70511
  - check return status of all iptables calls, not just the last one
    in a 'for' loop.


author: Florian La Roche <Florian.LaRoche@redhat.de>
changelog:
  - remove check for very old kernel versions in init scripts
  - sync up both init scripts and remove some further ugly things
  - add some docu into rpm


author: Thomas Woerner <twoerner@redhat.com> 1.2.8-5
changelog:
  - new config option IPTABLES_SAVE_ON_RESTART
  - init script: new status, save and restart
  - fixes #44905, #65389, #80785, #82860, #91040, #91560 and #91374


author: Thomas Woerner <twoerner@redhat.com> 1.2.8-6
changelog:
  - IPTABLES_SAVE_COUNTER defaults to no, now
  - install config file in /etc/sysconfig
  - exchange unload of ip_tables and ip_conntrack
  - fixed start function


author: Thomas Woerner <twoerner@redhat.com> 1.2.8-12.1
changelog:
  - fixed lost udp port range in ip6tables-save (#104484)
  - fixed non numeric multiport port output in ipXtables-savs


author: Thomas Woerner <twoerner@redhat.com> 1.2.8-13
changelog:
  - marked all messages in iptables init script for translation (#107462)
  - enabled devel package (#105884, #106101)
  - bumped build for fedora for libipt_recent.so (#106002)


author: Thomas Woerner <twoerner@redhat.com> 1.2.9-1
changelog:
  - vew version 1.2.9
  - new config options in ipXtables-config:
    IPTABLES_MODULES_UNLOAD
  - more documentation in ipXtables-config
  - fix for netlink security issue in libipq (devel package)
  - print fix for libipt_icmp (#109546)


author: Thomas Woerner <twoerner@redhat.com> 1.2.11-3.1
changelog:
  - changed default behaviour for IPTABLES_STATUS_NUMERIC to "yes" (#129731)
  - modified config file to match this change and un-commented variables with
    default values


author: Thomas Woerner <twoerner@redhat.com> 1.3.0-2
changelog:
  - Remove unnecessary explicit kernel dep (#146142)
  - Fixed out of bounds accesses (#131848): Thanks to Steve Grubb
    for the patch
  - Adapted iptables-config to reference to modprobe.conf (#150143)
  - Remove misleading message (#140154): Thanks to Ulrich Drepper
    for the patch


author: Thomas Woerner <twoerner@redhat.com> 1.3.4-1
changelog:
  - new version 1.3.4
  - dropped free_opts patch (upstream fixed)
  - made libipq PIC (#158623)
  - additional configuration options for iptables startup script (#172929)
    Thanks to Jan Gruenwald for the patch
  - spec file cleanup (dropped linux_header define and usage)


author: Thomas Woerner <twoerner@redhat.com> 1.3.4-2
changelog:
  - fix for plugin problem: link with "gcc -shared" instead of "ld -shared" and 
    replace "_init" with "__attribute((constructor)) my_init"


author: Thomas Woerner <twoerner@redhat.com> 1.3.7-1
changelog:
  - new verison 1.3.7
  - iptc is not a public interface and therefore not installed anymore
  - dropped upstream secmark patch


author: Thomas Woerner <twoerner@redhat.com> 1.3.8-2
changelog:
  - fixed initscript for LSB conformance (rhbz#246953, rhbz#242459)
  - provide iptc interface again, but unsupported (rhbz#216733)
  - compile all extension, which are supported by the kernel-headers package
  - review fixes (rhbz#225906)


author: Thomas Woerner <twoerner@redhat.com> 1.3.8-3
changelog:
  - do not depend on local_fs in lsb header - this delayes start after network
  - fixed exit code for initscript usage


author: Thomas Woerner <twoerner@redhat.com> 1.3.8-4
changelog:
  - fixed IPv6 reject type (rhbz#295181)
  - fixed init script: start, stop and status
  - support netfilter compiled into kernel in init script (rhbz#295611)
  - dropped inversion for limit modules from man pages (rhbz#220780)
  - fixed typo in ip6tables man page (rhbz#236185)


author: Thomas Woerner <twoerner@redhat.com> 1.3.8-4.1
changelog:
  - do not start ip6tables if ipv6 is blacklisted (rhbz#236888)
  - use simpler fix for (rhbz#295611)
    Thanks to Linus Torvalds for the patch.


author: Thomas Woerner <twoerner@redhat.com> 1.3.8-5
changelog:
  - fixed error code for stopping a already stopped firewall (rhbz#321751)
  - moved blacklist test into start


author: Thomas Woerner <twoerner@redhat.com> 1.3.8-6
changelog:
  - fixed leaked file descriptor before fork/exec (rhbz#312191)
  - blacklisting is not working, use "install X /bin/(true|false)" test instead
  - return private exit code 150 for disabled ipv6 support
  - use script name for output messages


author: Thomas Woerner <twoerner@redhat.com> 1.4.0-1
changelog:
  - new version 1.4.0
  - fixed condrestart (rhbz#428148)
  - report the module in rmmod_r if there is an error
  - use nf_ext_init instead of my_init for extension constructors


author: Thomas Woerner <twoerner@redhat.com> 1.4.0-3
changelog:
  - use the kernel headers from the build tree for iptables for now to be able to 
    compile this package, but this makes the package more kernel dependant
  - use s6_addr32 instead of in6_u.u6_addr32


author: Tom "spot" Callaway <tcallawa@redhat.com> 1.4.0-5
changelog:
  - use normal kernel headers, not linux/compiler.h
  - change BuildRequires: kernel-devel to kernel-headers
  - We need to do this to be able to build for both sparcv9 and sparc64 
    (there is no kernel-devel.sparcv9)


author: Thomas Woerner <twoerner@redhat.com> 1.4.1-1
changelog:
  - new version 1.4.1 with new build environment
  - additional ipv6 network mask patch from Jan Engelhardt
  - spec file cleanup
  - removed old patches


author: Thomas Woerner <twoerner@redhat.com> 1.4.2-1
changelog:
  - new version 1.4.2
  - removed TOS value mask patch (upstream)
  - more review fixes (rhbz#225906)
  - install all header files (rhbz#462207)
  - dropped nf_ext_init (rhbz#472548)


author: Thomas Woerner <twoerner@redhat.com> 1.4.2-3
changelog:
  - still more review fixes (rhbz#225906)
    - consistent macro usage
    - use sed instead of perl for rpath removal
    - use standard RPM CFLAGS, but also -fno-strict-aliasing (needed for libiptc*)


author: Thomas Woerner <twoerner@redhat.com> 1.4.3.1-1
changelog:
  - new version 1.4.3.1
    - libiptc is now shared
    - supports all new features of the 2.6.29 kernel
  - dropped typo_latter patch


author: Thomas Woerner <twoerner@redhat.com> 1.4.4-1
changelog:
  - new version 1.4.4 with support for all new features of 2.6.30
    - several man page fixes
    - iptables: replace open-coded sizeof by ARRAY_SIZE
    - libip6t_policy: remove redundant functions
    - policy: use direct xt_policy_info instead of ipt/ip6t
    - policy: merge ipv6 and ipv4 variant
    - extensions: add `cluster' match support
    - extensions: add const qualifiers in print/save functions
    - extensions: use NFPROTO_UNSPEC for .family field
    - extensions: remove redundant casts
    - iptables: close open file descriptors
    - fix segfault if incorrect protocol name is used
    - replace open-coded sizeof by ARRAY_SIZE
    - do not include v4-only modules in ip6tables manpage
    - use direct xt_policy_info instead of ipt/ip6t
    - xtables: fix segfault if incorrect protocol name is used
    - libxt_connlimit: initialize v6_mask
    - SNAT/DNAT: add support for persistent multi-range NAT mappings


author: Thomas Woerner <twoerner@redhat.com> 1.4.5-1
changelog:
  - new version 1.4.5 with support for all new features of 2.6.31
    - libxt_NFQUEUE: add new v1 version with queue-balance option
    - xt_conntrack: revision 2 for enlarged state_mask member
    - libxt_helper: fix invalid passed option to check_inverse
    - libiptc: split v4 and v6
    - extensions: collapse registration structures
    - iptables: allow for parse-less extensions
    - iptables: allow for help-less extensions
    - extensions: remove empty help and parse functions
    - xtables: add multi-registration functions
    - extensions: collapse data variables to use multi-reg calls
    - xtables: warn of missing version identifier in extensions
    - multi binary: allow subcommand via argv[1]
    - iptables: accept multiple IP address specifications for -s, -d
    - several build fixes
    - several man page fixes
  - fixed two leaked file descriptors on sockets (rhbz#521397)


author: Thomas Woerner <twoerner@redhat.com> 1.4.6-1
changelog:
  - new version 1.4.6 with support for all new features of 2.6.32
    - several man page fixes
    - Support for nommu arches
    - realm: remove static initializations
    - libiptc: remove unused functions
    - libiptc: avoid strict-aliasing warnings
    - iprange: do accept non-ranges for xt_iprange v1
    - iprange: warn on reverse range
    - iprange: roll address parsing into a loop
    - iprange: do accept non-ranges for xt_iprange v1 (log)
    - iprange: warn on reverse range (log)
    - libiptc: fix wrong maptype of base chain counters on restore
    - iptables: fix undersized deletion mask creation
    - style: reduce indent in xtables_check_inverse
    - libxtables: hand argv to xtables_check_inverse
    - iptables/extensions: make bundled options work again
    - CONNMARK: print mark rules with mask 0xffffffff as set instead of xset
    - iptables: take masks into consideration for replace command
    - doc: explain experienced --hitcount limit
    - doc: name resolution clarification
    - iptables: expose option to zero packet/byte counters for a specific rule
    - build: restore --disable-ipv6 functionality on system w/o v6 headers
    - MARK: print mark rules with mask 0xffffffff as --set-mark instead of --set-xmark
    - DNAT: fix incorrect check during parsing
    - extensions: add osf extension
    - conntrack: fix --expires parsing


author: Thomas Woerner <twoerner@redhat.com> 1.4.6-2
changelog:
  - moved libip*tc and libxtables libs to /lib[64], added symlinks for .so libs
    to /usr/lib[64] for compatibility (rhbz#558796)


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-1
changelog:
  - new version 1.4.7 with support for all new features of 2.6.33 (rhbz#570767)
    - libip4tc: Add static qualifier to dump_entry()
    - libipq: build as shared library
    - recent: reorder cases in code (cosmetic cleanup)
    - several man page and documentation fixes
    - policy: fix error message showing wrong option
    - includes: header updates
    - Lift restrictions on interface names
  - fixed license and moved iptables-xml into base package according to review


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-2
changelog:
  - added default values for IPTABLES_STATUS_VERBOSE and
    IPTABLES_STATUS_LINENUMBERS in init script
  - added missing lsb keywords Required-Start and Required-Stop to init script


author: Thomas Woerner <twoerner@redhat.com> 1.4.8-1
changelog:
  - new version 1.4.8 all new features of 2.6.34 (rhbz#)
    - extensions: REDIRECT: fix --to-ports parser
    - iptables: add noreturn attribute to exit_tryhelp()
    - extensions: MASQUERADE: fix --to-ports parser
    - libxt_comment: avoid use of IPv4-specific examples
    - libxt_CT: add a manpage
    - iptables: correctly check for too-long chain/target/match names
    - doc: libxt_MARK: no longer restricted to mangle table
    - doc: remove claim that TCPMSS is limited to mangle
    - libxt_recent: add a missing space in output
    - doc: add manpage for libxt_osf
    - libxt_osf: import nfnl_osf program
    - extensions: add support for xt_TEE
    - CT: fix --ctevents parsing
    - extensions: add CT extension
    - libxt_CT: print conntrack zone in ->print/->save
    - xtables: fix compilation when debugging is enabled
    - libxt_conntrack: document --ctstate UNTRACKED
    - iprange: fix xt_iprange v0 parsing


author: Thomas Woerner <twoerner@redhat.com> 1.4.9-1
changelog:
  - new version 1.4.9 with all new features of 2.6.35
    - doc: xt_hashlimit: fix a typo
    - doc: xt_LED: nroff formatting requirements
    - doc: xt_string: correct copy-and-pasting in manpage
    - extensions: add the LED target
    - extensions: libxt_quota.c: Support option negation
    - extensions: libxt_rateest: fix bps options for iptables-save
    - extensions: libxt_rateest: fix typo in the man page
    - extensions: REDIRECT: add random help
    - includes: sync header files from Linux 2.6.35-rc1
    - libxt_conntrack: do print netmask
    - libxt_hashlimit: always print burst value
    - libxt_set: new revision added
    - utils: add missing include flags to Makefile
    - xtables: another try at chain name length checking
    - xtables: remove xtables_set_revision function
    - xt_quota: also document negation
    - xt_sctp: Trace DATA chunk that supports SACK-IMMEDIATELY extension
    - xt_sctp: support FORWARD_TSN chunk type


author: Thomas Woerner <twoerner@redhat.com> 1.4.10-1
changelog:
  - new version 1.4.10 with all new features of 2.6.36
    - all: consistent syntax use in struct option
    - build: fix static linking
    - doc: let man(1) autoalign the text in xt_cpu
    - doc: remove extra empty line from xt_cpu
    - doc: minimal spelling updates to xt_cpu
    - doc: consistent use of markup
    - extensions: libxt_quota: don't ignore the quota value on deletion
    - extensions: REDIRECT: add random help
    - extensions: add xt_cpu match
    - extensions: add idletimer xt target extension
    - extensions: libxt_IDLETIMER: use xtables_param_act when checking options
    - extensions: libxt_CHECKSUM extension
    - extensions: libipt_LOG/libip6t_LOG: support macdecode option
    - extensions: fix compilation of the new CHECKSUM target
    - extensions: libxt_ipvs: user-space lib for netfilter matcher xt_ipvs
    - iptables-xml: resolve compiler warnings
    - iptables: limit chain name length to be consistent with targets
    - libiptc: add Libs.private to pkgconfig files
    - libiptc: build with -Wl,--no-as-needed
    - xtables: remove unnecessary cast
  - dropped xt_CHECKSUM, added upstream


author: Thomas Woerner <twoerner@redhat.com> 1.4.11-1
changelog:
  - new version 1.4.11 with all new features of 2.6.37-39 (not usable)
    - lots of changes and bugfixes for base and extensions
    - complete changelog:
      http://www.netfilter.org/projects/iptables/files/changes-iptables-1.4.11.txt


author: Thomas Woerner <twoerner@redhat.com> 1.4.11.1-1.1
changelog:
  -  added temporary provides for libxtables.so.5 to be able to rebuild iproute,
     which is part of the standard build environment


author: Thomas Woerner <twoerner@redhat.com> 1.4.11.1-3
changelog:
  - added support for native systemd file (rhbz#694738)
    - new iptables.service file
    - additional requires
    - moved sysv init scripts to /usr/libexec
    - added new post, preun and postun scripts and triggers


author: Thomas Woerner <twoerner@redhat.com> 1.4.12-1
changelog:
  - new version 1.4.12 with support of all new features of kernel 3.0
    - build: attempt to fix building under Linux 2.4
    - build: bump soversion for recent data structure change
    - build: install modules in arch-dependent location
    - doc: fix group range in libxt_NFLOG's man
    - doc: fix version string in ip6tables.8
    - doc: include matches/targets in manpage again
    - doc: mention multiple verbosity flags
    - doc: the -m option cannot be inverted
    - extensions: support for per-extension instance global variable space
    - iptables-apply: select default rule file depending on call name
    - iptables: consolidate target/match init call
    - iptables: Coverity: DEADCODE
    - iptables: Coverity: NEGATIVE_RETURNS
    - iptables: Coverity: RESOURCE_LEAK
    - iptables: Coverity: REVERSE_INULL
    - iptables: Coverity: VARARGS
    - iptables: restore negation for -f
    - libip6t_HL: fix option names from ttl -> hl
    - libipt_LOG: fix ignoring all but last flags
    - libxtables: ignore whitespace in the multiaddress argument parser
    - libxtables: properly reject empty hostnames
    - libxtables: set clone's initial data to NULL
    - libxt_conntrack: move more data into the xt_option_entry
    - libxt_conntrack: restore network-byte order for v1,v2
    - libxt_hashlimit: use a more obvious expiry value by default
    - libxt_rateest: abolish global variables
    - libxt_RATEEST: abolish global variables
    - libxt_RATEEST: fix userspacesize field
    - libxt_RATEEST: use guided option parser
    - libxt_state: fix regression about inversion of main option
    - option: remove last traces of intrapositional negation
  - complete changelog:
    http://www.netfilter.org/projects/iptables/files/changes-iptables-1.4.12.txt


author: Thomas Woerner <twoerner@redhat.com> 1.4.12-1.1
changelog:
  - added temporary provides for libxtables.so.6 to be able to rebuild iproute,
    which is part of the standard build environment


author: Thomas Woerner <twoerner@redhat.com> 1.4.12.1-1
changelog:
  - new version 1.4.12.1 with new pkgconfig/libipq.pc
    - build: abort autogen on subcommand failure
    - build: strengthen check for overlong lladdr components
    - build: workaround broken linux-headers on RHEL-5
    - doc: clarify libxt_connlimit defaults
    - doc: fix typo in libxt_TRACE
    - extensions: use multi-target registration
    - libip6t_dst: restore setting IP6T_OPTS_LEN flag
    - libip6t_frag: restore inversion support
    - libip6t_hbh: restore setting IP6T_OPTS_LEN flag
    - libipq: add pkgconfig file
    - libipt_ttl: document that negation is available
    - libxt_conntrack: fix --ctproto 0 output
    - libxt_conntrack: remove one misleading comment
    - libxt_dccp: fix deprecated intrapositional ordering of !
    - libxt_dccp: fix random output of ! on --dccp-option
    - libxt_dccp: provide man pages options in short help too
    - libxt_dccp: restore missing XTOPT_INVERT tags for options
    - libxt_dccp: spell out option name on save
    - libxt_dscp: restore inversion support
    - libxt_hashlimit: default htable-expire must be in milliseconds
    - libxt_hashlimit: observe new default gc-expire time when saving
    - libxt_hashlimit: remove inversion from hashlimit rev 0
    - libxt_owner: restore inversion support
    - libxt_physdev: restore inversion support
    - libxt_policy: remove superfluous inversion
    - libxt_set: put differing variable names in directly
    - libxt_set: update man page about kernel support on the feature
    - libxt_string: define _GNU_SOURCE for strnlen
    - libxt_string: escape the escaping char too
    - libxt_string: fix space around arguments
    - libxt_string: replace hex codes by char equivalents
    - libxt_string: simplify hex output routine
    - libxt_tcp: always print the mask parts
    - libxt_TCPMSS: restore build with IPv6-less libcs
    - libxt_TOS: update linux kernel version list for backported fix
    - libxt_u32: fix missing allowance for inversion
    - src: remove unused IPTABLES_MULTI define
    - tests: add negation tests for libxt_statistic
    - xtoptions: flag use of XTOPT_POINTER without XTOPT_PUT
  - removed include/linux/types.h before build to be able to compile


author: Thomas Woerner <twoerner@redhat.com> 1.4.12.2-1
changelog:
  - new version 1.4.12.2 with new pkgconfig/libip4tc.pc and pkgconfig/libip6tc.pc
    - build: make check stage not fail when building statically
    - build: restore build order of modules
    - build: scan for unreferenced symbols
    - build: sort file list before build
    - doc: clarification on the meaning of -p 0
    - doc: document iptables-restore's -T option
    - doc: fix undesired newline in ip6tables-restore(8)
    - ip6tables-restore: implement missing -T option
    - iptables: move kernel version find routing into libxtables
    - libiptc: provide separate pkgconfig files
    - libipt_SAME: set PROTO_RANDOM on all ranges
    - libxtables: Fix file descriptor leak in xtables_lmap_init on error
    - libxt_connbytes: fix handling of --connbytes FROM
    - libxt_CONNSECMARK: fix spacing in output
    - libxt_conntrack: improve error message on parsing violation
    - libxt_NFQUEUE: fix --queue-bypass ipt-save output
    - libxt_RATEEST: link with -lm
    - libxt_statistic: link with -lm
    - Merge branch 'stable'
    - Merge branch 'stable' of git://dev.medozas.de/iptables
    - nfnl_osf: add missing libnfnetlink_CFLAGS to compile process
    - xtoptions: fill in fallback value for nvals
    - xtoptions: simplify xtables_parse_interface


author: Thomas Woerner <twoerner@redhat.com> 1.4.14-1
changelog:
  - new version 1.4.14
    - extensions: add IPv6 capable ECN match extension
    - extensions: add nfacct match
    - extensions: add rpfilter module
    - extensions: libxt_rateest: output all options in save hook
    - iptables: missing free() in function cache_add_entry()
    - iptables: missing free() in function delete_entry()
    - libiptc: fix retry path in TC_INIT
    - libiptc: Returns the position the entry was inserted
    - libipt_ULOG: fix --ulog-cprange
    - libxt_CT: add --timeout option
    - ip(6)tables-restore: make sure argv is NULL terminated
    - Revert "libiptc: Returns the position the entry was inserted"
    - src: mark newly opened fds as FD_CLOEXEC (close on exec)
    - tests: add rateest match rules
  - dropped patch5 (cloexec), merged upstream


author: Thomas Woerner <twoerner@redhat.com> 1.4.15-1
changelog:
  - new version 1.4.15
    - extensions: add HMARK target
    - iptables-restore: fix parameter parsing (shows up with gcc-4.7)
    - iptables-restore: move code to add_param_to_argv, cleanup (fix gcc-4.7)
    - libxtables: add xtables_ip[6]mask_to_cidr
    - libxt_devgroup: add man page snippet
    - libxt_hashlimit: add support for byte-based operation
    - libxt_recent: add --mask netmask
    - libxt_recent: remove unused variable
    - libxt_HMARK: correct a number of errors introduced by Pablo's rework
    - libxt_HMARK: fix ct case example
    - libxt_HMARK: fix output of iptables -L
    - Revert "iptables-restore: move code to add_param_to_argv, cleanup (fix gcc-4.7)"


author: Thomas Woerner <twoerner@redhat.com> 1.4.16.2-1
changelog:
  - new version 1.4.16.2
    - build: support for automake-1.12
    - build: separate AC variable replacements from xtables.h
    - build: have `make clean` remove dep files too
    - doc: grammatical updates to libxt_SET
    - doc: clean up interpunction in state list for xt_conntrack
    - doc: deduplicate extension descriptions into a new manpage
    - doc: trim "state" manpage and reference conntrack instead
    - doc: have NOTRACK manpage point to CT instead
    - doc: mention iptables-apply in the SEE ALSO sections
    - extensions: libxt_addrtype: fix type in help message
    - include: add missing linux/netfilter_ipv4/ip_queue.h
    - iptables: fix wrong error messages
    - iptables: support for match aliases
    - iptables: support for target aliases
    - iptables-restore: warn about -t in rule lines
    - ip[6]tables-restore: cleanup to reduce one level of indentation
    - libip6t_frag: match any frag id by default
    - libxtables: consolidate preference logic
    - libxt_devgroup: consolidate devgroup specification parsing
    - libxt_devgroup: guard against negative numbers
    - libxt_LED: guard against negative numbers
    - libxt_NOTRACK: replace as an alias to CT --notrack
    - libxt_state: replace as an alias to xt_conntrack
    - libxt_tcp: print space before, not after "flags:"
    - libxt_u32: do bounds checking for @'s operands
    - libxt_*limit: avoid division by zero
    - Merge branch 'master' of git://git.inai.de/iptables
    - Merge remote-tracking branch 'nf/stable'
    - New set match revision with --return-nomatch flag support
  - dropped fixrestore patch, upstream


author: Thomas Woerner <twoerner@redhat.com> 1.4.16.2-2
changelog:
  - new sub package services providing the systemd services (RHBZ#862922)
  - new sub package utils: provides nfnl_osf and the pf.os database
  - using %{_libexecdir}/iptables as script path for the original init scripts
  - added service iptables save funcitonality using the new way provided by 
    initscripts 9.37.1 (RHBZ#748134)
  - added virtual provide for libxtables.so.7


author: Thomas Woerner <twoerner@redhat.com> 1.4.16.2-4
changelog:
  - fixed missing services for update of pre F-18 installations (rhbz#867960)
    - provide and obsolete old main package in services sub package
    - provide and obsolete old ipv6 sub package (pre F-17) in services sub package


author: Ville Skyttä <ville.skytta@iki.fi> - 1.4.16.2-6
changelog:
  - Own unowned -services libexec dirs (#894464, Michael Scherer).
  - Fix -services unit file permissions (#732936, Michal Schmidt).


author: Thomas Woerner <twoerner@redhat.com> 1.4.18-1
changelog:
  - new version 1.4.18 
    - lots of documentation changes
    - Introduce match/target aliases
    - Add the "state" alias to the "conntrack" match
    - iptables: remove unused leftover definitions
    - libxtables: add xtables_rule_matches_free
    - libxtables: add xtables_print_num
    - extensions: libip6t_DNPT: fix wording in DNPT target
    - extension: libip6t_DNAT: allow port DNAT without address
    - extensions: libip6t_DNAT: set IPv6 DNAT --to-destination
    - extensions: S/DNPT: add missing save function
  - changes of 1.4.17:
    - libxt_time: add support to ignore day transition
    - Convert the NAT targets to use the kernel supplied nf_nat.h header
    - extensions: add IPv6 MASQUERADE extension
    - extensions: add IPv6 SNAT extension
    - extensions: add IPv6 DNAT target
    - extensions: add IPv6 REDIRECT extension
    - extensions: add IPv6 NETMAP extension
    - extensions: add NPT extension
    - extensions: libxt_statistic: Fix save output


author: Thomas Woerner <twoerner@redhat.com> 1.4.19.1-1
changelog:
  - new version 1.4.19.1
    - libxt_NFQUEUE: fix bypass option documentation
    - extensions: add connlabel match
    - extensions: add connlabel match
    - ip[6]tables: show --protocol instead of --proto in usage
    - libxt_recent: Fix missing space in manpage for --mask option
    - extensions: libxt_multiport: Update manpage to list valid protocols
    - utils: nfnl_osf: use the right nfnetlink lib
    - libip6t_NETMAP: Use xtables_ip6mask_to_cidr and get rid of libip6tc dependency
    - Revert "build: resolve link failure for ip6t_NETMAP"
    - libxt_osf: fix missing --ttl and --log in save output
    - libxt_osf: fix bad location for location in --genre
    - libip6t_SNPT: add manpage
    - libip6t_DNPT: add manpage
    - utils: updates .gitignore to include nfbpf_compile
    - extensions: libxt_bpf: clarify --bytecode argument
    - libxtables: fix parsing of dotted network mask format
    - build: bump version to 1.4.19
    - libxt_conntrack: fix state match alias state parsing
    - extensions: add libxt_bpf extension
    - utils: nfbpf_compile
    - doc: mention SNAT in INPUT chain since kernel 2.6.36
  - fixed changelog date weekdays where needed


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-1
changelog:
  - no connlabel.conf upstream anymore
  - new version 1.4.21
    - doc: clarify DEBUG usage macro
    - iptables: use autoconf to process .in man pages
    - extensions: libipt_ULOG: man page should mention NFLOG as replacement
    - extensions: libxt_connlabel: use libnetfilter_conntrack
    - Introduce a new revision for the set match with the counters support
    - libxt_CT: Add the "NOTRACK" alias
    - libip6t_mh: Correct command to list named mh types in manpage
    - extensions: libxt_DNAT, libxt_REDIRECT, libxt_NETMAP, libxt_SNAT, libxt_MASQUERADE, libxt_LOG: rename IPv4 manpage and tell about IPv6 support
    - extensions: libxt_LED: fix parsing of delay
    - ip{6}tables-restore: fix breakage due to new locking approach
    - libxt_recent: restore minimum value for --seconds
    - iptables-xml: fix parameter parsing (similar to 2165f38)
    - extensions: add copyright statements
    - xtables: improve get_modprobe handling
    - ip[6]tables: Add locking to prevent concurrent instances
    - iptables: Fix connlabel.conf install location
    - ip6tables: don't print out /128
    - libip6t_LOG: target output is different to libipt_LOG
    - build: additional include path required after UAPI changes
    - iptables: iptables-xml: Fix various parsing bugs
    - libxt_recent: restore reap functionality to recent module
    - build: fail in configure on missing dependency with --enable-bpf-compiler
    - extensions: libxt_NFQUEUE: add --queue-cpu-fanout parameter
    - extensions: libxt_set, libxt_SET: check the set family too
    - ip6tables: Use consistent exit code for EAGAIN
    - iptables: libxt_hashlimit.man: correct address
    - iptables: libxt_conntrack.man extraneous commas
    - iptables: libip(6)t_REJECT.man default icmp types
    - iptables: iptables-xm1.1 correct man section
    - iptables: libxt_recent.{c,man} dead URL
    - iptables: libxt_string.man add examples
    - extensions: libxt_LOG: use generic syslog reference in manpage
    - iptables: extensions/GNUMakefile.in use CPPFLAGS
    - iptables: correctly reference generated file
    - ip[6]tables: fix incorrect alignment in commands_v_options
    - build: add software version to manpage first line at configure stage
    - extensions: libxt_cluster: add note on arptables-jf
    - utils: nfsynproxy: fix error while compiling the BPF filter
    - extensions: add SYNPROXY extension
    - utils: add nfsynproxy tool
    - iptables: state match incompatibilty across versions
    - libxtables: xtables_ipmask_to_numeric incorrect with non-CIDR masks
    - iptables: improve chain name validation
    - iptables: spurious error in load_extension
    - xtables: trivial spelling fix


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-2
changelog:
  - fixed system hang at shutdown if root device is network based (RHBZ#1007934)
    Thanks to Rodrigo A B Freire for the patch


author: Jiri Popelka <jpopelka@redhat.com> - 1.4.21-3
changelog:
  - no need to support the pre-systemd things
  - use systemd macros (#850166)
  - remove scriptlets for migrating to a systemd unit from a SysV initscripts
  - ./configure -> %configure
  - spec clean up
  - fix self-obsoletion


author: Jiri Popelka <jpopelka@redhat.com> - 1.4.21-8
changelog:
  - add missing reload and panic actions
  - BuildRequires: pkgconfig(x) instead of x-devel
  - no need to specify file mode bits twice (in %install and %files)


author: Thomas Woerner <twoerner@redhat.com> - 1.6.0-1
changelog:
  - New upstream version 1.6.0 with nft-compat support and lots of fixes (RHBZ#1292990)
    Upstream changelog:
    http://netfilter.org/projects/iptables/files/changes-iptables-1.6.0.txt
  - New libs sub package containing libxtables and unstable libip*tc libraries (RHBZ#1323161)
  - Using scripts form RHEL-7 (RHBZ#1240366)
  - New compat sub package for nftables compatibility
  - Install iptables-apply (RHBZ#912047)
  - Fixed module uninstall (RHBZ#1324101)
  - Incorporated changes by Petr Pisar
  - Enabled bpf compiler (RHBZ#1170227) Thanks to Yanko Kaneti for the patch


author: Petr Šabata <contyk@redhat.com> - 1.6.0-4
changelog:
  - Disabling parallel build to avoid build issues with xtables
  - See http://patchwork.alpinelinux.org/patch/1787/ for reference
  - This should be fixed in 1.6.1; parallel build can be restored after the
    update


author: Thomas Woerner <twoerner@redhat.com> - 1.6.1-1
changelog:
  - New upstream version 1.6.1 with enhanced translation to nft support and
    several fixes (RHBZ#1417323)
    http://netfilter.org/projects/iptables/files/changes-iptables-1.6.1.txt
  - Enable parallel build again


author: Michael Cronenworth <mike@cchtml.com> - 1.6.2-1
changelog:
  - New upstream version 1.6.2
    http://www.netfilter.org/projects/iptables/files/changes-iptables-1.6.2.txt


author: Phil Sutter <psutter@redhat.com> - 1.6.2-2
changelog:
  - Kill module unloading support
  - Support /etc/sysctl.d
  - Don't restart services after package update
  - Add support for --wait options to restore commands


author: Phil Sutter - 1.8.0-4
changelog:
  - xtables: Fix for segfault in iptables-nft
  - ebtables: Fix entries count in chain listing
  - Use %autosetup macro in %prep


author: Phil Sutter - 1.8.0-5
changelog:
  - xtables: Use meta l4proto for -p match
  - ebtables: Fix for listing of non-existent chains
  - xtables: Fix for no output in iptables-nft -S


author: Phil Sutter - 1.8.0-8
changelog:
  - Fix issues identified by covscan
  - xtables-restore: Fix flushing referenced custom chains
  - xtables: Accept --wait in iptables-nft-restore


author: Phil Sutter - 1.8.0-9
changelog:
  - Add further fixes for issues identified by covscan
  - Fix for bogus "is incompatible" warnings
  - Fix layout in License tag
  - Replace "Fedora" with "RHEL" in description
  - Make devel sub-package depend on libs sub-package


author: Phil Sutter - 1.8.2-2
changelog:
  - Point out that nftables-variants are installed in package description
  - Fix for deleting arptables rules by referencing them


author: Phil Sutter - 1.8.2-4
changelog:
  - Fix iptables init script for nftables-backend
  - Drop references to unsupported broute table from ebtables man page
  - xtables: Don't use native nftables comments


author: Phil Sutter - 1.8.2-6
changelog:
  - Improve performance with large rulesets
  - Fix for changes in arptables output
  - Fix for inserting rules at wrong position
  - Fix segfault when comparing rules with standard target
  - Fix ebtables output for negated values
  - Document missing arptables FORWARD chain


author: Phil Sutter <psutter@redhat.com> - 1.8.2-10
changelog:
  - arptables-nft: fix decoding of hlen on bigendian platforms
  - xtables-save: Fix table not found error message
  - xtables: Catch errors when zeroing rule rounters
  - extensions: TRACE: Point at xtables-monitor in documentation
  - extensions: libipt_realm: Document allowed realm values


author: Phil Sutter <psutter@redhat.com> - 1.8.2-12
changelog:
  - Add iptables-test.py testsuite to sources
  - extensions: libip6t_mh: fix bogus translation error
  - extensions: AUDIT: Document ineffective --type option
  - xtables-restore: Fix program names in help texts
  - xtables-save: Point at existing man page in help text
  - utils: Add a manpage for nfbpf_compile
  - Mark man pages in base package as documentation files


author: Phil Sutter <psutter@redhat.com> - 1.8.2-14
changelog:
  - arptables: Print space before comma and counters
  - extensions: Fix ipvs vproto parsing
  - extensions: Fix ipvs vproto option printing
  - extensions: Add testcase for libxt_ipvs


author: Phil Sutter <psutter@redhat.com> - 1.8.4-3
changelog:
  - Reduce globbing in library file names to expose future SONAME changes
  - Add bootstrapping for libip*tc SONAME bump


author: Phil Sutter <psutter@redhat.com> - 1.8.4-8
changelog:
  - xtables-translate: Fix for iface++
  - tests: shell: Fix skip checks with --host mode
  - xtables-restore: fix for --noflush and empty lines


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - Fix build for some odd situations, such as
    - previously installed make != GNU make
    - /bin/sh != bash


author: Jakub Jelinek <jakub@redhat.com>
changelog:
  - assume we don't have clock_gettime in configure, so that
    make is not linked against -lpthread (and thus does not
    limit stack to 2MB).


author: Jakub Jelinek <jakub@redhat.com> 3.80-8
changelog:
  - make sure errno for error reporting is not lost accross _() calls
  - report EOF on read pipe differently from read returning < 0 reporting


author: Petr Machata <pmachata@redhat.com> 1:3.80-11
changelog:
  - Applied (five years old) patch from Jonathan Kamens to allow make to
    handle several pattern-specific variables (#52962).

    The patch was changed so that it forces make to process pattern
    specific variables in the same order as they appear in file.
    (Upstream make behaves this way, too.)  This is change from old make
    behavior, which processed the variables in reverse order.  In case
    you used only x=a assignments, this had the effect of using the
    first pattern specific variable that matched.  For x+=a this just
    doesn't work, and it produces absolutely nonintuitive results.

  - (It would be great if make's target-specific variables were handled
    the same way as pattern-specific ones, just without the pattern
    component.  However current handling is documented and considered a
    feature.)


author: Petr Machata <pmachata@redhat.com> - 1:3.81-1
changelog:
  - Upstream 3.81:
    - Contains several backwards incompatible changes.  See NEWS inside
      the source package to find out more.
  - memory patch and error reporting patch were ported to this version.


author: Petr Machata <pmachata@redhat.com> - 1:3.81-4
changelog:
  - Tidy up the specfile per rpmlint comments
  - Use utf-8 and fix national characters in contributor's names


author: Petr Machata <pmachata@redhat.com> - 1:3.81-12
changelog:
  - Fix the rlimit patch.  The success flag is kept in memory shared
    with parent process after vfork, and so cannot be reset.
  - Related: #214033


author: Petr Machata <pmachata@redhat.com> - 1:3.82-1
changelog:
  - Upstream 3.82:
    - Drop rlimit, fdleak, strcpy-overlap, recursion-test, double-free
      patches, make supports this functionality now
    - Disable the memory patch for the time being
    - Port remaining patches
    - Add weird-shell patch, upstream bug 30748
  - Resolves: #618998


author: Petr Machata <pmachata@redhat.com> - 1:3.82-4
changelog:
  - Fix a discrepancy between behavior of find_next_token and
    pre-allocation of token memory in func_sort.
  - Resolves: #643359


author: Petr Machata <pmachata@redhat.com> - 1:3.82-10
changelog:
  - Apply the following patches, proposed upstream by Norbert Thiebaud:
    - A patch for warning on call of undefined function
    - A patch for tracing calls to "eval" and "call"


author: Petr Machata <pmachata@redhat.com> - 1:3.82-18
changelog:
  - Backport upstream patch that adds wildcard expansion to pattern
    rules. (make-3.82-stem_glob.patch)


author: Petr Machata <pmachata@redhat.com> - 1:3.82-19
changelog:
  - make now restores rlimit to its original values before launching
    subprocess via $(shell) (make-3.82-func_shell-rlimit.patch)
  - Determinize one test (make-3.82-tests-SECONDARY.patch)


author: Kyle McMartin <kyle@fedoraproject.org> - 1:4.0-3.1
changelog:
  - Pass the test-suite unconditionally until I fix the tests to cope with
    deterministic ar archives (which result in expected rebuilds not occuring)


author: Patsy Franklin <pfrankli@redhat.com> 1:4.1-2
changelog:
  - Include patches dropped in last update as they fix reported bugs and
    update the spec file to include more info on the patches.


author: Patsy Griffin Franklin <pfrankli@redhat.com> 1:4.2.1-7
changelog:
  - Fix build failure caused by automake versioning differences related
    to the glob changes. (#1589769)
  - Fix testing failure due to Perl changes related to expanding paths.


author: Ondrej Vasik <ovasik@redhat.com> - 3.6-1
changelog:
  - own /usr/share/bash-completion{,/completions,/helpers} (#1504616)
  - create and own /usr/lib/debug/.dwz dir to prevent
    dangling symlink (#1508610)


author: Ondrej Vasik <ovasik@redhat.com> - 3.7-1
changelog:
  - own /usr/share/locale and /usr/lib/modules
  - own /usr/lib/sysimage
  - improve filesystem content file to include symlinks and rootdir


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.11-1
changelog:
  - update to 1.8.11
  - major changes & fixes:
    - when running a command in the background, sudo will now forward
      SIGINFO to the command
    - the passwords in ldap.conf and ldap.secret may now be encoded in base64.
    - SELinux role changes are now audited. For sudoedit, we now audit
      the actual editor being run, instead of just the sudoedit command.
    - it is now possible to match an environment variable's value as well as
      its name using env_keep and env_check
    - new files created via sudoedit as a non-root user now have the proper group id
    - sudoedit now works correctly in conjunction with sudo's SELinux RBAC support
    - it is now possible to disable network interface probing in sudo.conf by
      changing the value of the probe_interfaces setting
    - when listing a user's privileges (sudo -l), the sudoers plugin will now prompt
      for the user's password even if the targetpw, rootpw or runaspw options are set.
    - the new use_netgroups sudoers option can be used to explicitly enable or disable
      netgroups support
    - visudo can now export a sudoers file in JSON format using the new -x flag
  - added patch to read ldap.conf more closely to nss_ldap
  - require /usr/bin/vi instead of vim-minimal
  - include pam.d/system-auth in PAM session phase from pam.d/sudo
  - include pam.d/sudo in PAM session phase from pam.d/sudo-i


author: Radovan Sroka <rsroka@redhat.com> 1.8.14p3-2
changelog:
  - add patch that resolves initialization problem before sudo_strsplit call
  - add patch that resolves deadcode in visudo.c
  - add patch that removes extra while in visudo.c and sudoers.c


author: Radovan Sroka <rsroka@redhat.com> - 1.8.25-5
changelog:
  - RHEL 8.1 ERRATUM
  - Fixed problem with sudo-1.8.23 and 'who am i'
  Resolves: rhbz#1673886
  - Backporting sudo bug with expired passwords
  Resolves: rhbz#1676819


author: Radovan Sroka <rsroka@redhat.com> - 1.8.25-6
changelog:
  - RHEL 8.1 ERRATUM
  - Fixed The LDAP backend which is not properly parsing sudoOptions,
    resulting in selinux roles not being applied
  Resolves: rhbz#1738326


author: Joe Orton <jorton@redhat.com> 2008-2
changelog:
  - add (but don't use) mkcabundle.pl
  - tweak description
  - use /usr/bin/keytool directly; BR java-openjdk


author: Joe Orton <jorton@redhat.com> - 2010-2
changelog:
  - fix Java cacert database generation: use Subject rather than Issuer
    for alias name; add diagnostics; fix some alias names.


author: Joe Orton <jorton@redhat.com> - 2010-3
changelog:
  - update to certdata.txt r1.58
  - add /etc/pki/tls/certs/ca-bundle.trust.crt using 'TRUSTED CERTICATE' format
  - exclude ECC certs from the Java cacerts database
  - catch keytool failures
  - fail parsing certdata.txt on finding untrusted but not blacklisted cert


author: Paul Wouters <pwouters@redhat.com> - 2012.86-2
changelog:
  - Updated blacklist with 20 entries (Diginotar, Trustwave, Comodo(?)
  - Fix to certdata2pem.py to also check for CKT_NSS_NOT_TRUSTED


author: Kai Engert <kaie@redhat.com> - 2012.87-2.fc19.1
changelog:
  - Ship trust bundle file in /usr/share/pki/ca-trust-source/, temporarily in addition.
    This location will soon become the only place containing this file.


author: Kai Engert <kaie@redhat.com> - 2012.87-9
changelog:
  - Major rework for the Fedora SharedSystemCertificates feature.
  - Only ship a PEM bundle file using the BEGIN TRUSTED CERTIFICATE file format.
  - Require the p11-kit package that contains tools to automatically create
    other file format bundles.
  - Convert old file locations to symbolic links that point to dynamically
    generated files.
  - Old files, which might have been locally modified, will be saved in backup 
    files with .rpmsave extension.
  - Added a update-ca-certificates script which can be used to regenerate
    the merged trusted output.
  - Refer to the various README files that have been added for more detailed
    explanation of the new system.
  - No longer require rsc for building.
  - Add explanation for the future version numbering scheme,
    because the old numbering scheme was based on upstream using cvs,
    which is no longer true, and therefore can no longer be used.
  - Includes changes from rhbz#873369.


author: Kai Engert <kaie@redhat.com> - 2012.87-11
changelog:
  - adjust to changed and new functionality provided by p11-kit 0.17.3
  - updated READMEs to describe the new directory-specific treatment of files
  - ship a new file that contains certificates with neutral trust
  - ship a new file that contains distrust objects, and also staple a 
    basic constraint extension to one legacy root contained in the
    Mozilla CA list
  - adjust the build script to dynamically produce most of above files
  - add and own the anchors and blacklist subdirectories
  - file generate-cacerts.pl is no longer required


author: Kai Engert <kaie@redhat.com> - 2012.87-12
changelog:
  - Use both label and serial to identify cert during conversion, rhbz#927601
  - Add myself as contributor to certdata2.pem.py and remove use of rcs/ident.
    (thanks to Michael Shuler for suggesting to do so)
  - Update source URLs and comments, add source file for version information.


author: Kai Engert <kaie@redhat.com> - 2013.1.94-14
changelog:
  - added a manual page and related build requirements
  - simplify the README files now that we have a manual page
  - set a certificate alias in trusted bundle (thanks to Ludwig Nussel)


author: Kai Engert <kaie@redhat.com> - 2013.1.94-18
changelog:
  - Update the Entrust root stapled extension for compatibility with 
    p11-kit version 0.19.2, patch by Stef Walter, rhbz#988745


author: Kai Engert <kaie@redhat.com> - 2014.2.1-3
changelog:
  - Temporarily re-enable several legacy root CA certificates because of
    compatibility issues with software based on OpenSSL/GnuTLS,
    see rhbz#1144808


author: Kai Engert <kaie@redhat.com> - 2014.2.1-4
changelog:
  - Introduce the ca-legacy utility and a ca-legacy.conf configuration file.
    By default, legacy roots required for OpenSSL/GnuTLS compatibility
    are kept enabled. Using the ca-legacy utility, the legacy roots can be
    disabled. If disabled, the system will use the trust set as provided
    by the upstream Mozilla CA list. (See also: rhbz#1158197)


author: Kai Engert <kaie@redhat.com> - 2015.2.3-2
changelog:
  - Update to CKBI 2.3 from NSS 3.18 with legacy modifications
  - Fixed a mistake in the legacy handling of the upstream 2.2 release:
    Removed two AOL certificates from the legacy group, because
    upstream didn't remove them as part of phasing out 1024-bit
    certificates, which means it isn't necessary to keep them.
  - Fixed a mistake in the legacy handling of the upstream 2.1 release:
    Moved two NetLock certificates into the legacy group.


author: Kai Engert <kaie@redhat.com> - 2015.2.3-3
changelog:
  - Don't use "enable" as a value for the legacy configuration, instead
    of the value "default", to make it clear that this preference isn't
    a promise to keep certificates enabled, but rather that we only
    keep them enabled as long as it's considered necessary.
  - Changed the configuration file, the ca-legacy utility and filenames
    to use the term "default" (instead of the term "enable").
  - Added a manual page for the ca-legacy utility.
  - Fixed the ca-legacy utility to handle absence of the configuration
    setting and treat absence as the default setting.


author: Kai Engert <kaie@redhat.com> - 2016.2.9-3
changelog:
  - Revert to the unmodified upstream CA list, changing the legacy trust
    to an empty list. Keeping the ca-legacy tool and existing config,
    however, the configuration has no effect after this change.


author: Kai Engert <kaie@redhat.com> - 2017.2.11-4
changelog:
  - Changed the packaged bundle to use the flexible p11-kit-object-v1 file format,
    as a preparation to fix bugs in the interaction between p11-kit-trust and
    Mozilla applications, such as Firefox, Thunderbird etc.
  - Changed update-ca-trust to add comments to extracted PEM format files.
  - Added an utility to help with comparing output of the trust dump command.


author: Kai Engert <kaie@redhat.com> - 2017.2.11-5
changelog:
  - For CAs trusted by Mozilla, set attribute nss-mozilla-ca-policy: true
  - Set attribute modifiable: false
  - Require p11-kit 0.23.4


author: Kai Engert <kaie@redhat.com> - 2017.2.16-2
changelog:
  - Update to (yet unreleased) CKBI 2.16 which is planned for NSS 3.32.
    Mozilla removed all trust bits for code signing.


author: Kai Engert <kaie@redhat.com> - 2017.2.16-4
changelog:
  - Set P11_KIT_NO_USER_CONFIG=1 to prevent p11-kit from reading user
    configuration files (rhbz#1478172).


author: Kai Engert <kaie@redhat.com> - 2017.2.20-6
changelog:
  - Depend on bash, grep, sed. Required for ca-legacy script execution.
  - p11-kit is already required at %post execution time. (rhbz#1537127)


author: Bob Relyea <rrelyea@redhat.com> - 2019.2.32-80.0
changelog:
  - Update to CKBI 2.32 from NSS 3.44
  -  Removing:
  -   # Certificate "Visa eCommerce Root"
  -   # Certificate "AC Raiz Certicamara S.A."
  -   # Certificate "ComSign CA"
  -   # Certificate "Certplus Root CA G1"
  -   # Certificate "Certplus Root CA G2"
  -   # Certificate "OpenTrust Root CA G1"
  -   # Certificate "OpenTrust Root CA G2"
  -   # Certificate "OpenTrust Root CA G3"
  -  Adding:
  -   # Certificate "GlobalSign Root CA - R6"
  -   # Certificate "OISTE WISeKey Global Root GC CA"
  -   # Certificate "GTS Root R1"
  -   # Certificate "GTS Root R2"
  -   # Certificate "GTS Root R3"
  -   # Certificate "GTS Root R4"
  -   # Certificate "UCA Global G2 Root"
  -   # Certificate "UCA Extended Validation Root"
  -   # Certificate "Certigna Root CA"
  -   # Certificate "emSign Root CA - G1"
  -   # Certificate "emSign ECC Root CA - G3"
  -   # Certificate "emSign Root CA - C1"
  -   # Certificate "emSign ECC Root CA - C3"
  -   # Certificate "Hongkong Post Root CA 3"


author: Andy Grover <agrover@redhat.com> - 1.99.1.git987b63b-3
changelog:
  - Address comments from spec review
    - drop examples/myshell from doc, it hasn't been updated for API change
    - Fully document procedure to generate source .tar.gz
    - Remove "." from summary
    - Remove commented-out spec todos and other cruft


author: Andy Grover <agrover@redhat.com> - 1:1.1-2
changelog:
  - Properly update changelog
  - Sync version with upstream, Epoch used
  - Change Source URL to intermediate github repo


author: Andy Grover <agrover@redhat.com> - 1:1.1.fb1-1
changelog:
  - New upstream source and release
  - Remove patches:
    * python-configshell-remove-epydoc-dep.patch
    * python-configshell-git-version.patch


author: Andy Grover <agrover@redhat.com> - 1:1.1.fb9-1
changelog:
  - New upstream release
  - Remove dependency on python-simpleparse in favor of pyparsing
  - Remove BuildRequires


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1:1.1.fb23-4
changelog:
  - Python 2 binary package renamed to python2-configshell
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Dan Walsh <dwalsh@redhat.com> 1.1.3-1
changelog:
  - Update from NSA
    * Merged errno fix from Joshua Brindle (Tresys).
    * Merged fix for semod_build_modules_list leak on error path
      from Serge Hallyn (IBM).  Bug found by Coverity.
    * Merged several fixes from Serge Hallyn (IBM).  Bugs found by
      Coverity.
    * Fixed several other bugs and warnings.
    * Merged patch to move module read/write code from libsemanage
      to libsepol from Jason Tang (Tresys).  
    * Merged relay records patch from Ivan Gyurdiev.
    * Merged key extract patch from Ivan Gyurdiev.

  - Initial version
  - Created by Stephen Smalley <sds@epoch.ncsc.mil>


author: Dan Walsh <dwalsh@redhat.com> 1.1.6-1
changelog:
  - Update from NSA
    * Merged semod.conf template patch from Dan Walsh (Red Hat),
    but restored location to /usr/share/semod/semod.conf.
    * Fixed several bugs found by valgrind.
    * Fixed bug in prior patch for the semod_build_module_list leak.
    * Merged errno fix from Joshua Brindle (Tresys).
    * Merged fix for semod_build_modules_list leak on error path
      from Serge Hallyn (IBM).  Bug found by Coverity.


author: Dan Walsh <dwalsh@redhat.com> 1.3.1-1
changelog:
  - Update from NSA
    * Merged stub functionality for managing user and port records,
    and record table code from Ivan Gyurdiev.
    * Updated version for release.


author: Dan Walsh <dwalsh@redhat.com> 1.3.2-1
changelog:
  - Update from NSA
    * Merged stub iterator functionality from Ivan Gyurdiev.
    * Merged interface record patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.3.3-1
changelog:
  - Update from NSA
    * Merged boolean record, stub record handler, and status codes 
      patches from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.3.5-1
changelog:
  - Update from NSA
    * Split interfaces from semanage.[hc] into handle.[hc], modules.[hc].
    * Separated handle create from connect interface.
    * Added a constructor for initialization.
    * Moved up src/include/*.h to src.
    * Created a symbol map file; dropped dso.h and hidden markings.


author: Dan Walsh <dwalsh@redhat.com> 1.3.7-1
changelog:
  - Update from NSA
    * Merged patch series from Ivan Gyurdiev.
      (pointer typedef elimination, file renames, dbase work, backend
       separation)
    * Split interfaces from semanage.[hc] into handle.[hc], modules.[hc].
    * Separated handle create from connect interface.
    * Added a constructor for initialization.
    * Moved up src/include/*.h to src.
    * Created a symbol map file; dropped dso.h and hidden markings.


author: Dan Walsh <dwalsh@redhat.com> 1.3.10-1
changelog:
  - Update from NSA
    * Updated for changes to libsepol, and to only use types and interfaces
    provided by the shared libsepol.


author: Dan Walsh <dwalsh@redhat.com> 1.3.11-1
changelog:
  - Update from NSA
    * Fixed semanage_install_active() to use the same logic for
    selecting a policy version as semanage_expand_sandbox().  Dropped
    dead code from semanage_install_sandbox().


author: Dan Walsh <dwalsh@redhat.com> 1.3.14-1
changelog:
  - Update from NSA
    * Updated to use get interfaces for hidden sepol_module_package type.
    * Changed semanage_expand_sandbox and semanage_install_active
    to generate/install the latest policy version supported  by libsepol
    by default (unless overridden by semanage.conf), since libselinux
    will now downgrade automatically for load_policy.
    * Merged new callback-based error reporting system and ongoing
    database work from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.3.18-1
changelog:
  - Update from NSA
    * Merged bugfix patch from Ivan Gyurdiev.
    * Merged seuser database patch from Ivan Gyurdiev.
    Merged direct user/port databases to the handle from Ivan Gyurdiev.
    * Removed obsolete include/semanage/commit_api.h (leftover).
    Merged seuser record patch from Ivan Gyurdiev.
    * Merged boolean and interface databases from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.3.20-1
changelog:
  - Update from NSA
    * Merged user and port APIs - policy database patch from Ivan
    Gyurdiev.
    * Converted calls to sepol link_packages and expand_module interfaces
    from using buffers to using sepol handles for error reporting, and 
    changed direct_connect/disconnect to create/destroy sepol handles.


author: Dan Walsh <dwalsh@redhat.com> 1.3.20-1
changelog:
  - Update from NSA
    * Changed default args for load_policy to be null, as it no longer
      takes a pathname argument and we want to preserve booleans.
    * Merged move local dbase initialization patch from Ivan Gyurdiev.
    * Merged acquire/release read lock in databases patch from Ivan Gyurdiev.
    * Merged rename direct -> policydb as appropriate patch from Ivan Gyurdiev.
    * Added calls to sepol_policy_file_set_handle interface prior
      to invoking sepol operations on policy files.
    * Updated call to sepol_policydb_from_image to pass the handle.


author: Dan Walsh <dwalsh@redhat.com> 1.3.24-1
changelog:
  - Update from NSA
    * Merged default database from Ivan Gyurdiev.
    * Merged removal of connect requirement in policydb backend from
      Ivan Gyurdiev.
    * Merged commit locking fix and lock rename from Joshua Brindle.
    * Merged transaction rollback in lock patch from Joshua Brindle.
    * Changed default args for load_policy to be null, as it no longer
      takes a pathname argument and we want to preserve booleans.
    * Merged move local dbase initialization patch from Ivan Gyurdiev.
    * Merged acquire/release read lock in databases patch from Ivan Gyurdiev.
    * Merged rename direct -> policydb as appropriate patch from Ivan Gyurdiev.
    * Added calls to sepol_policy_file_set_handle interface prior
      to invoking sepol operations on policy files.
    * Updated call to sepol_policydb_from_image to pass the handle.


author: Dan Walsh <dwalsh@redhat.com> 1.3.28-1
changelog:
  - Update from NSA
    * Merged interface renaming patch from Ivan Gyurdiev.
    * Merged policy component patch from Ivan Gyurdiev.
    * Renamed 'check=' configuration value to 'expand-check=' for 
      clarity.
    * Changed semanage_commit_sandbox to check for and report errors 
      on rename(2) calls performed during rollback.
    * Added optional check= configuration value to semanage.conf 
      and updated call to sepol_expand_module to pass its value
      to control assertion and hierarchy checking on module expansion.
    * Merged fixes for make DESTDIR= builds from Joshua Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.3.30-1
changelog:
  - Update from NSA
    * Fixed policy file leaks in semanage_load_module and
      semanage_write_module.
    * Merged further database work from Ivan Gyurdiev.
    * Fixed bug in semanage_direct_disconnect.


author: Dan Walsh <dwalsh@redhat.com> 1.3.32-1
changelog:
  - Update from NSA
    * Merged resync to sepol changes and transaction fix patches from
      Ivan Gyurdiev.
    * Merged reorganize users patch from Ivan Gyurdiev.
    * Merged remove unused relay functions patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.3.34-1
changelog:
  - Update from NSA
    * Merged resync to sepol changes and booleans fixes/improvements 
      patches from Ivan Gyurdiev.
    * Merged support for genhomedircon/homedir template, store selection,
      explicit policy reload, and semanage.conf relocation from Joshua
      Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.3.35-1
changelog:
  - Update from NSA
    * Merged sepol handle passing, seusers support, and policydb cache
      patches from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.3.38-1
changelog:
  - Upgrade to latest from NSA
    * Merged dbase policydb list and count change from Ivan Gyurdiev.
    * Merged enable dbase and set relay patches from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.3.39-1
changelog:
  - Upgrade to latest from NSA
    * Merged record interface, dbase flush, common database code,
      and record bugfix patches from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.3.41-1
changelog:
  - Upgrade to latest from NSA
    * Merged interface parse/print, context_to_string interface change,
      move assert_noeof, and order preserving patches from Ivan Gyurdiev.
          * Added src/dso.h in preparation for other changes.
    * Merged install seusers, handle/error messages, MLS parsing,
      and seusers validation patches from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.3.43-1
changelog:
  - Upgrade to latest from NSA
    * Merged seuser parser resync, dbase tracking and cleanup, strtol
      bug, copyright, and assert space patches from Ivan Gyurdiev.
    * Added src/*_internal.h in preparation for other changes.
     * Added hidden/hidden_proto/hidden_def to src/debug.[hc] and
            src/seusers.[hc].


author: Dan Walsh <dwalsh@redhat.com> 1.3.48-1
changelog:
  - Upgrade to latest from NSA
    * Disabled calls to port dbase for merge and commit and stubbed
      out calls to sepol_port interfaces since they are not exported.
    * Merged rename instead of copy patch from Joshua Brindle (Tresys).
    * Added hidden_def/hidden_proto for exported symbols used within 
      libsemanage to eliminate relocations.  Wrapped type definitions
      in exported headers as needed to avoid conflicts.  Added
      src/context_internal.h and src/iface_internal.h.
    * Added semanage_is_managed() interface to allow detection of whether
      the policy is managed via libsemanage.  This enables proper handling
      in setsebool for non-managed systems.
    * Merged semanage_set_reload_bools() interface from Ivan Gyurdiev,
      to enable runtime control over preserving active boolean values
      versus reloading their saved settings upon commit.


author: Dan Walsh <dwalsh@redhat.com> 1.3.51-1
changelog:
  - Upgrade to latest from NSA
    * Clear modules modified flag upon disconnect and commit.
          * Added tracking of module modifications and use it to
      determine whether expand-time checks should be applied
      on commit.
    * Reverted semanage_set_reload_bools() interface.


author: Dan Walsh <dwalsh@redhat.com> 1.3.52-1
changelog:
  - Upgrade to latest from NSA
    * Merged cleanup patch from Ivan Gyurdiev.
      This renames semanage_module_conn to semanage_direct_handle,
      and moves sepol handle create/destroy into semanage handle
      create/destroy to allow use even when disconnected (for the
      record interfaces).


author: Dan Walsh <dwalsh@redhat.com> 1.3.53-1
changelog:
  - Upgrade to latest from NSA
    * Merged move seuser validation patch from Ivan Gyurdiev.
    * Merged hidden declaration fixes from Ivan Gyurdiev,
      with minor corrections.


author: Dan Walsh <dwalsh@redhat.com> 1.3.56-1
changelog:
  - Upgrade to latest from NSA
    * Fixed free->key_free bug.
    * Merged clear obsolete patch from Ivan Gyurdiev.
    * Merged modified swigify patch from Dan Walsh 
      (original patch from Joshua Brindle).
    * Merged move genhomedircon call patch from Chad Sellers.


author: Dan Walsh <dwalsh@redhat.com> 1.3.59-1
changelog:
  - Add additional swig objects
    * Merged wrap char*** for user_get_roles patch from Joshua Brindle.
    * Merged remove defrole from sepol patch from Ivan Gyurdiev.
    * Merged swig wrappers for modifying users and seusers from Joshua Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.3.61-1
changelog:
  - Upgrade to latest from NSA
    * Merged Makefile python definitions patch from Dan Walsh.
    * Removed is_selinux_mls_enabled() conditionals in seusers and users
      file parsers.


author: Dan Walsh <dwalsh@redhat.com> 1.3.63-1
changelog:
  - Upgrade to latest from NSA
    * Dropped handle from user_del_role interface.
    * Removed defrole interfaces.


author: Dan Walsh <dwalsh@redhat.com> 1.3.64-1
changelog:
  - Upgrade to latest from NSA
    * Changed semanage_handle_create() to set do_reload based on
      is_selinux_enabled().  This prevents improper attempts to
      load policy on a non-SELinux system.


author: Dan Walsh <dwalsh@redhat.com> 1.5.1-1
changelog:
  - Upgrade to latest from NSA
    * Added file-mode= setting to semanage.conf, default to 0644.
      Changed semanage_copy_file and callers to use this mode when
      installing policy files to runtime locations.


author: Dan Walsh <dwalsh@redhat.com> 1.5.1-2
changelog:
  - Upgrade to latest from NSA
    * Merged toggle modified flag in policydb_modify, fix memory leak
      in clear_obsolete, polymorphism vs headers fix, and include guards
      for internal headers patches from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.5.3-1
changelog:
  - Upgrade to latest from NSA
    * Merged further header cleanups from Ivan Gyurdiev.
    * Merged toggle modified flag in policydb_modify, fix memory leak
      in clear_obsolete, polymorphism vs headers fix, and include guards
      for internal headers patches from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.5.4-1
changelog:
  - Upgrade to latest from NSA
    * Merged patch series from Ivan Gyurdiev.
      This includes patches to:
      - separate file rw code from linked list
      - annotate objects
      - fold together internal headers
      - support ordering of records in compare function
      - add active dbase backend, active booleans
      - return commit numbers for ro database calls
      - use modified flags to skip rebuild whenever possible
      - enable port interfaces
      - update swig interfaces and typemaps
      - add an API for file_contexts.local and file_contexts
      - flip the traversal order in iterate/list
      - reorganize sandbox_expand
      - add seusers MLS validation
      - improve dbase spec/documentation
      - clone record on set/add/modify


author: Dan Walsh <dwalsh@redhat.com> 1.5.6-1
changelog:
  - Upgrade to latest from NSA
    * Clarified error messages from parse_module_headers and 
      parse_base_headers for base/module mismatches.
    * Merged string and file optimization patch from Russell Coker.
    * Merged swig header reordering patch from Ivan Gyurdiev.
    * Merged toggle modify on add patch from Ivan Gyurdiev.
    * Merged ports parser bugfix patch from Ivan Gyurdiev.
    * Merged fcontext swig patch from Ivan Gyurdiev.
    * Merged remove add/modify/delete for active booleans patch from Ivan Gyurdiev.
    * Merged man pages for dbase functions patch from Ivan Gyurdiev.
    * Merged pywrap tests patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.5.8-1
changelog:
  - Upgrade to latest from NSA
    * Re-applied string and file optimization patch from Russell Coker,
      with bug fix.
    * Reverted string and file optimization patch from Russell Coker.
    * Clarified error messages from parse_module_headers and 
      parse_base_headers for base/module mismatches.


author: Dan Walsh <dwalsh@redhat.com> 1.5.9-1
changelog:
  - Upgrade to latest from NSA
    * Merged const in APIs patch from Ivan Gyurdiev.
    * Merged validation of local file contexts patch from Ivan Gyurdiev.
    * Merged compare2 function patch from Ivan Gyurdiev.
    * Merged hidden def/proto update patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.5.14-1
changelog:
  - Upgrade to latest from NSA
    * Merged disallow port overlap patch from Ivan Gyurdiev.
    * Merged join prereq and implementation patches from Ivan Gyurdiev.
    * Merged join user extra data part 2 patch from Ivan Gyurdiev.
    * Merged bugfix patch from Ivan Gyurdiev.
    * Merged remove add_local/set_local patch from Ivan Gyurdiev.
    * Merged user extra data part 1 patch from Ivan Gyurdiev.
    * Merged size_t -> unsigned int patch from Ivan Gyurdiev.
    * Merged calloc check in semanage_store patch from Ivan Gyurdiev,
      bug noticed by Steve Grubb.
    * Merged cleanups after add/set removal patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.5.15-1
changelog:
  - Upgrade to latest from NSA
    * Merged pywrap Makefile diff from Dan Walsh.
    * Merged cache management patch from Ivan Gyurdiev.
    * Merged bugfix for dbase_llist_clear from Ivan Gyurdiev.
    * Merged remove apply_local function patch from Ivan Gyurdiev.
    * Merged only do read locking in direct case patch from Ivan Gyurdiev.
    * Merged cache error path memory leak fix from Ivan Gyurdiev.
    * Merged auto-generated file header patch from Ivan Gyurdiev.
    * Merged pywrap test update from Ivan Gyurdiev.
    * Merged hidden defs update from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> 1.5.18-1
changelog:
  - Upgrade to latest from NSA
    * Merged seuser -> seuser_local rename patch from Ivan Gyurdiev.
    * Merged set_create_store, access_check, and is_connected interfaces
      from Joshua Brindle.


author: Dan Walsh <dwalsh@redhat.com> 1.5.19-1
changelog:
  - Upgrade to latest from NSA
    * Merged fname parameter patch from Ivan Gyurdiev.
    * Merged more size_t -> unsigned int fixes from Ivan Gyurdiev.
    * Merged seusers.system patch from Ivan Gyurdiev.
    * Merged improve port/fcontext API patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> - 1.5.21-1
changelog:
  - Upgrade to latest from NSA
    * Merged seuser/user_extra support patch from Joshua Brindle.
    * Merged remote system dbase patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> - 1.5.23-1
changelog:
  - Upgrade to latest from NSA
    * Merged optionals in base patch from Joshua Brindle.
    * Merged treat seusers/users_extra as optional sections patch from
      Ivan Gyurdiev.
    * Merged parse_optional fixes from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> - 1.5.26-1
changelog:
  - Upgrade to latest from NSA
    * Merged paths array patch from Ivan Gyurdiev.
    * Merged bug fix patch from Ivan Gyurdiev.
    * Merged improve bindings patch from Ivan Gyurdiev.
    * Merged use PyList patch from Ivan Gyurdiev.  
    * Merged memory leak fix patch from Ivan Gyurdiev.
    * Merged nodecon support patch from Ivan Gyurdiev.
    * Merged cleanups patch from Ivan Gyurdiev.
    * Merged split swig patch from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> - 1.5.28-1
changelog:
  - Upgrade to latest from NSA
    * Merged bug fix for fcontext validate handler from Ivan Gyurdiev.
    * Merged base_merge_components changes from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> - 1.6-1
changelog:
  - Make work on RHEL4
  - Upgrade to latest from NSA
    * Merged abort early on merge errors patch from Ivan Gyurdiev.
    * Cleaned up error handling in semanage_split_fc based on a patch
      by Serge Hallyn (IBM) and suggestions by Ivan Gyurdiev.
    * Merged MLS handling fixes from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> - 1.6.2-1
changelog:
  - Upgrade to latest from NSA
    * Merged Makefile PYLIBVER definition patch from Dan Walsh.
    * Merged man page reorganization from Ivan Gyurdiev.


author: Dan Walsh <dwalsh@redhat.com> - 1.6.3-1
changelog:
  - Fix to work with new version of swig
  - Upgrade to latest from NSA
    * Merged corrected fix for descriptor leak from Dan Walsh.


