# changelog

author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-123
changelog:
  - Fix zarafa labeling
  - Allow guest_t to fix labeling
  - corenet_tcp_bind_all_unreserved_ports(ssh_t) should be called with the user_tcp_server boolean
  - add lxc_contexts
  - Allow accountsd to read /proc
  - Allow restorecond to getattr on all file sytems
  - tmpwatch now calls getpw
  - Allow apache daemon to transition to pwauth domain
  - Label content under /var/run/user/NAME/keyring* as gkeyringd_tmp_t
  - The obex socket seems to be a stream socket
  - dd label for /var/run/nologin


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-125
changelog:
  - Fix pulseaudio port definition
  - Add labeling for condor_starter
  - Allow chfn_t to creat user_tmp_files
  - Allow chfn_t to execute bin_t
  - Allow prelink_cron_system_t to getpw calls
  - Allow sudo domains to manage kerberos rcache files
  - Allow user_mail_domains to work with courie
  - Port definitions necessary for running jboss apps within openshift
  -  Add support for openstack-nova-metadata-api
  - Add support for nova-console*
  - Add support for openstack-nova-xvpvncproxy
  - Fixes to make privsep+SELinux working if we try to use chage to change passwd
  - Fix auth_role() interface
  - Allow numad to read sysfs
  - Allow matahari-rpcd to execute shell
  - Add label for ~/.spicec
  - xdm is executing lspci as root which is requesting a sys_admin priv but seems to succeed without it
  - Devicekit_disk wants to read the logind sessions file when writing a cd
  - Add fixes for condor to make condor jobs working correctly
  - Change label of /var/log/rpmpkgs to cron_log_t
  - Access requires to allow systemd-tmpfiles --create to work.
  - Fix obex to be a user application started by the session bus.
  - Add additional filename trans rules for kerberos
  - Fix /var/run/heartbeat labeling
  - Allow apps that are managing rcache to file trans correctly
  - Allow openvpn to authenticate against ldap server
  - Containers need to listen to network starting and stopping events


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-126
changelog:
  - Dontaudit lpr_t to read/write leaked mozilla tmp files
  - Add file name transition for .grl-podcasts directory
  - Allow corosync to read user tmp files
  - Allow fenced to create snmp lib dirs/files
  - More fixes for sge policy
  - Allow mozilla_plugin_t to execute any application
  - Allow dbus to read/write any open file descriptors to any non security file on the system that it inherits to that it can pass them to another domain
  - Allow mongod to read system state information
  -  Fix wrong type, we should dontaudit sys_admin for xdm_t not xserver_t
  - Allow polipo to manage polipo_cache dirs
  - Add jabbar_client port to mozilla_plugin_t
  - Cleanup procmail policy
  - system bus will pass around open file descriptors on files that do not have labels on them
  - Allow l2tpd_t to read system state
  - Allow tuned to run ls /dev
  - Allow sudo domains to read usr_t files
  - Add label to machine-id 
  - Fix corecmd_read_bin_symlinks cut and paste error


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-127
changelog:
  - Add policy for subversion daemon
  - Allow boinc to read passwd
  - Allow pads to read kernel network state
  - Fix man2html interface for sepolgen-ifgen
  - Remove extra /usr/lib/systemd/system/smb
  - Remove all /lib/systemd and replace with /usr/lib/systemd
  - Add policy for man2html
  - Fix the label of kerberos_home_t to krb5_home_t
  - Allow mozilla plugins to use Citrix
  - Allow tuned to read /proc/sys/kernel/nmi_watchdog
  - Allow tune /sys options via systemd's tmpfiles.d "w" type


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-128
changelog:
  - Fix description of authlogin_nsswitch_use_ldap
  - Fix transition rule for rhsmcertd_t needed for RHEL7
  - Allow useradd to list nfs state data
  - Allow openvpn to manage its log file and directory
  - We want vdsm to transition to mount_t when executing mount command to make sure /etc/mtab remains labeled correctly
  - Allow thumb to use nvidia devices
  -  Allow local_login to create user_tmp_t files for kerberos
  - Pulseaudio needs to read systemd_login /var/run content
  - virt should only transition named system_conf_t config files
  - Allow  munin to execute its plugins
  - Allow nagios system plugin to read /etc/passwd
  - Allow plugin to connect to soundd port
  - Fix httpd_passwd to be able to ask passwords
  - Radius servers can use ldap for backing store
  - Seems to need to mount on /var/lib for xguest polyinstatiation to work.
  - Allow systemd_logind to list the contents of gnome keyring
  - VirtualGL need xdm to be able to manage content in /etc/opt/VirtualGL
  - Add policy for isns-utils


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-1
changelog:
  - Mass merge with upstream
    * new policy topology to include contrib policy modules
    * we have now two base policy patches


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-3
changelog:
  - PolicyKit path has changed
  - Allow httpd connect to dirsrv socket
  - Allow tuned to write generic kernel sysctls
  - Dontaudit logwatch to gettr on /dev/dm-2
  - Allow policykit-auth to manage kerberos files
  - Make condor_startd and rgmanager as initrc domain
  - Allow virsh to read /etc/passwd
  - Allow mount to mount on user_tmp_t for /run/user/dwalsh/gvfs
  - xdm now needs to execute xsession_exec_t
  - Need labels for /var/lib/gdm
  - Fix files_filetrans_named_content() interface
  - Add new attribute - initrc_domain
  - Allow systemd_logind_t to signal, signull, sigkill all processes
  - Add filetrans rules for etc_runtime files


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-4
changelog:
  - Add support for ecryptfs
    * ecryptfs does not support xattr
    * we need labeling for HOMEDIR
  - Add policy for (u)mount.ecryptfs*
  - Fix labeling of kerbero host cache files, allow rpc.svcgssd to manage host cache
  - Allow dovecot to manage Maildir content, fix transitions to Maildir
  - Allow postfix_local to transition to dovecot_deliver
  - Dontaudit attempts to setattr on xdm_tmp_t, looks like bogus code
  - Cleanup interface definitions
  - Allow apmd to change with the logind daemon
  - Changes required for sanlock in rhel6
  - Label /run/user/apache as httpd_tmp_t
  - Allow thumb to use lib_t as execmod if boolean turned on
  - Allow squid to create the squid directory in /var with the correct labe
  - Add a new policy for glusterd from Bryan Bickford (bbickfor@redhat.com)
  - Allow virtd to exec xend_exec_t without transition
  - Allow virtd_lxc_t to unmount all file systems


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-5
changelog:
  - apcupsd needs to read /etc/passwd
  - Sanlock allso sends sigkill
  - Allow glance_registry to connect to the mysqld port
  - Dontaudit mozilla_plugin trying to getattr on /dev/gpmctl
  - Allow firefox plugins/flash to connect to port 1234
  - Allow mozilla plugins to delete user_tmp_t files
  - Add transition name rule for printers.conf.O
  - Allow virt_lxc_t to read urand
  - Allow systemd_loigind to list gstreamer_home_dirs
  - Fix labeling for /usr/bin
  - Fixes for cloudform services
    * support FIPS
  - Allow polipo to work as web caching
  - Allow chfn to execute tmux


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-6
changelog:
  - Add tomcat policy
  - Remove pyzor/razor policy
  - rhsmcertd reads the rpm database
  - Dontaudit  thumb to setattr on xdm_tmp dir
  - Allow wicd to execute ldconfig in the networkmanager_t domain
  - Add /var/run/cherokee\.pid labeling
  - Allow mozilla_plugin to create mozilla_plugin_tmp_t lnk files too
  - Allow postfix-master to r/w pipes other postfix domains
  - Allow snort to create netlink_socket
  - Add kdumpctl policy
  - Allow firstboot to create tmp_t files/directories
  - /usr/bin/paster should not be labeled as piranha_exec_t
  - remove initrc_domain from tomcat
  - Allow ddclient to read /etc/passwd
  - Allow useradd to delete all file types stored in the users homedir
  - Allow ldconfig and insmod to manage kdumpctl tmp files
  - Firstboot should be just creating tmp_t dirs and xauth should be allowed to write to those
  - Transition xauth files within firstboot_tmp_t
  - Fix labeling of /run/media to match /media
  - Label all lxdm.log as xserver_log_t
  - Add port definition for mxi port
  - Allow local_login_t to execute tmux


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-7
changelog:
  - add ptrace_child access to process
  - remove files_read_etc_files() calling from all policies which have auth_use_nsswith()
  - Allow boinc domains to manage boinc_lib_t lnk_files
  - Add support for boinc-client.service unit file
  - Add support for boinc.log
  - Allow mozilla_plugin execmod on mozilla home files if allow_ex
  - Allow dovecot_deliver_t to read dovecot_var_run_t
  - Allow ldconfig and insmod to manage kdumpctl tmp files
  - Move thin policy out from cloudform.pp and add a new thin poli
  - pacemaker needs to communicate with corosync streams
  - abrt is now started on demand by dbus
  - Allow certmonger to talk directly to Dogtag servers
  - Change labeling for /var/lib/cobbler/webui_sessions to httpd_c
  - Allow mozila_plugin to execute gstreamer home files
  - Allow useradd to delete all file types stored in the users hom
  - rhsmcertd reads the rpm database
  - Add support for lightdm


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-8
changelog:
  - initrc is calling exportfs which is not confined so it attempts to read nfsd_files
  - Fixes for passenger running within openshift.
  - Add labeling for all tomcat6 dirs
  - Add support for tomcat6
  - Allow cobblerd to read /etc/passwd
  - Allow jockey to read sysfs and and execute binaries with bin_t
  - Allow thum to use user terminals
  - Allow cgclear to read cgconfig config files
  - Fix bcf2g.fc
  - Remove sysnet_dns_name_resolve() from policies where auth_use_nsswitch() is used for other domains
  - Allow dbomatic to execute ruby
  - abrt_watch_log should be abrt_domain
  - Allow mozilla_plugin to connect to gatekeeper port


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-9
changelog:
  - Until we figure out how to fix systemd issues, allow all apps that send syslog messages to send them to kernel_t
  - Add init_access_check() interface
  - Fix label on /usr/bin/pingus to not be labeled as ping_exec_t
  - Allow tcpdump to create a netlink_socket
  - Label newusers like useradd
  - Change xdm log files to be labeled xdm_log_t
  - Allow sshd_t with privsep to work in MLS
  - Allow freshclam to update databases thru HTTP proxy
  - Allow s-m-config to access check on systemd
  - Allow abrt to read public files by default
  - Fix amavis_create_pid_files() interface
  - Add labeling and filename transition for dbomatic.log
  - Allow system_dbusd_t to stream connect to bluetooth, and use its socket
  - Allow amavisd to execute fsav
  - Allow tuned to use sys_admin and sys_nice capabilities
  - Add php-fpm policy from Bryan
  - Add labeling for aeolus-configserver-thinwrapper
  - Allow thin domains to execute shell
  - Fix gnome_role_gkeyringd() interface description
  - Lot of interface fixes
  - Allow OpenMPI job running as condor_startd_ssh_t to manage condor lib files
  - Allow OpenMPI job to use kerberos
  - Make deltacloudd_t as nsswitch_domain
  - Allow xend_t to run lsscsi
  - Allow qemu-dm running as xend_t to create tun_socket
  - Add labeling for /opt/brother/Printers(.*/)?inf
  - Allow jockey-backend to read pyconfig-64.h labeled as usr_t
  - Fix clamscan_can_scan_system boolean
  - Allow lpr to connectto to /run/user/$USER/keyring-22uREb/pkcs11


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-10
changelog:
  - Add realmd and stapserver policies
  - Allow useradd to manage stap-server lib files
  - Tighten up capabilities for confined users
  - Label /etc/security/opasswd as shadow_t
  - Add label for /dev/ecryptfs
  - Allow condor_startd_t to start sshd with the ranged
  - Allow lpstat.cups to read fips_enabled file
  - Allow pyzor running as spamc_t to create /root/.pyzor directory
  - Add labelinf for amavisd-snmp init script
  - Add support for amavisd-snmp
  - Allow fprintd sigkill self
  - Allow xend (w/o libvirt) to start virtual machines
  - Allow aiccu to read /etc/passwd
  - Allow condor_startd to Make specified domain MCS trusted for setting any category set for the processes it executes
  - Add condor_startd_ranged_domtrans_to() interface
  - Add ssd_conf_t for /etc/sssd
  - accountsd needs to fchown some files/directories
  - Add ICACLient and zibrauserdata as mozilla_filetrans_home_content
  - SELinux reports afs_t needs dac_override to read /etc/mtab, even though everything works, adding dontaudit
  - Allow xend_t to read the /etc/passwd file


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-12
changelog:
  - Add interface to dontaudit getattr access on sysctls
  - Allow sshd to execute /bin/login
  - Looks like xdm is recreating the xdm directory in ~/.cache/ on login
  - Allow syslog to use the leaked kernel_t unix_dgram_socket from system-jounald
  -  Fix semanage to work with unconfined domain disabled on F18
  - Dontaudit attempts by mozilla plugins to getattr on all kernel sysctls
  - Virt seems to be using lock files
  - Dovecot seems to be searching directories of every mountpoint
  - Allow jockey to read random/urandom, execute shell and install third-party drivers
  - Add aditional params to allow cachedfiles to manage its content
  - gpg agent needs to read /dev/random
  - The kernel hands an svirt domains /SYSxxxxx which is a tmpfs that httpd wants to read and write
  - Add a bunch of dontaudit rules to quiet svirt_lxc domains
  - Additional perms needed to run svirt_lxc domains
  - Allow cgclear to read cgconfig
  - Allow sys_ptrace capability for snmp
  - Allow freshclam to read /proc
  - Allow procmail to manage /home/user/Maildir content
  - Allow NM to execute wpa_cli
  - Allow amavis to read clamd system state
  - Regenerate man pages


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-13
changelog:
  - Add systemd_logind_inhibit_var_run_t attribute
  - Remove corenet_all_recvfrom_unlabeled() for non-contrib policies because we moved it to domain.if for all domain_type
  - Add interface for mysqld to dontaudit signull to all processes
  - Label new /var/run/journal directory correctly
  - Allow users to inhibit suspend via systemd
  - Add new type for the /var/run/inhibit directory
  - Add interface to send signull to systemd_login so avahi can send them
  - Allow systemd_passwd to send syslog messages
  - Remove corenet_all_recvfrom_unlabeled() calling fro policy files
  - Allow       editparams.cgi running as httpd_bugzilla_script_t to read /etc/group
  - Allow smbd to read cluster config
  - Add additional labeling for passenger
  - Allow dbus to inhibit suspend via systemd
  - Allow avahi to send signull to systemd_login


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-1
changelog:
  - Fix saslauthd when it tries to read /etc/shadow
  - Label gnome-boxes as a virt homedir
  - Need to allow svirt_t ability to getattr on nfs_t file systems
  - Update sanlock policy to solve all AVC's
  - Change confined users can optionally manage virt content
  - Handle new directories under ~/.cache
  - Add block suspend to appropriate domains
  - More rules required for containers
  - Allow login programs to read /run/ data created by systemd_logind
  - Allow staff users to run svirt_t processes


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-2
changelog:
  - Add new type selinux_login_config_t for /etc/selinux/<type>/logins/
  - Additional fixes for seutil_manage_module_store()
  - dbus_system_domain() should be used with optional_policy
  - Fix svirt to be allowed to use fusefs file system
  - Allow login programs to read /run/ data created by systemd_login
  - sssd wants to write /etc/selinux/<policy>/logins/ for SELinux PAM module
  - Fix svirt to be allowed to use fusefs file system
  - Allow piranha domain to use nsswitch
  - Sanlock needs to send Kill Signals to non root processes
  - Pulseaudio wants to execute /run/user/PID/.orc


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-4
changelog:
  - Fix ecryptfs interfaces
  - Bootloader seems to be trolling around /dev/shm and /dev
  - init wants to create /etc/systemd/system-update.target.wants
  - Fix systemd_filetrans call to move it out of tunable
  - Fix up policy to work with systemd userspace manager
  - Add secure_firmware capability and remove bogus epolwakeup
  - Call seutil_*_login_config interfaces where should be needed
  - Allow rhsmcertd to send signal to itself
  - Allow thin domains to send signal to itself
  - Allow Chrome_ChildIO to read dosfs_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-5
changelog:
  - Put placeholder back in place for proper numbering of capabilities
  - Systemd also configures init scripts


author: Dan Walsh <dwalsh@redhat.com> 3.11.1-6
changelog:
  - Fix Boolean settings
  - Add new libjavascriptcoregtk as textrel_shlib_t
  - Allow xdm_t to create xdm_home_t directories
  - Additional access required for systemd
  - Dontaudit mozilla_plugin attempts to ipc_lock
  - Allow tmpreaper to delete unlabeled files
  - Eliminate screen_tmp_t and allow it to manage user_tmp_t
  - Dontaudit mozilla_plugin_config_t to append to leaked file descriptors
  - Allow web plugins to connect to the asterisk ports
  - Condor will recreate the lock directory if it does not exist
  - Oddjob mkhomedir needs to connectto user processes
  - Make oddjob_mkhomedir_t a userdom home manager


author: Dan Walsh <dwalsh@redhat.com> 3.11.1-7
changelog:
  - Fix bogus regex found by eparis
  - Fix manage run interface since lvm needs more access
  - syslogd is searching cgroups directory
  - Fixes to allow virt-sandbox-service to manage lxc var run content


author: Dan Walsh <dwalsh@redhat.com> 3.11.1-8
changelog:
  - Fix labeling of content in /run created by virsh_t
  - Allow condor domains to read kernel sysctls
  - Allow condor_master to connect to amqp
  - Allow thumb drives to create shared memory and semaphores
  - Allow abrt to read mozilla_plugin config files
  - Add labels for lightsquid
  - Default files in /opt and /usr that end in .cgi as httpd_sys_script_t, allow
  - dovecot_auth_t uses ldap for user auth
  - Allow domains that can read dhcp_etc_t to read lnk_files
  - Add more then one watchdog device
  - Allow useradd_t to manage etc_t files so it can rename it and edit them
  - Fix invalid class dir should be fifo_file
  - Move /run/blkid to fsadm and make sure labeling is correct


author: Dan Walsh <dwalsh@redhat.com> 3.11.1-9
changelog:
  - Allow postfix, sssd, rpcd to block_suspend
  - udev seems to need secure_firmware capability
  - Allow virtd to send dbus messages to firewalld so it can configure the firewall


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-10
changelog:
  - Make "snmpwalk -mREDHAT-CLUSTER-MIB ...." working
  - Allow dlm_controld to execute dlm_stonith labeled as bin_t
  - Allow GFS2 working on F17
  - Abrt needs to execute dmesg
  - Allow jockey to list the contents of modeprobe.d
  - Add policy for lightsquid as squid_cron_t
  - Mailscanner is creating files and directories in /tmp
  - dmesg is now reading /dev/kmsg
  - Allow xserver to communicate with secure_firmware
  - Allow fsadm tools (fsck) to read /run/mount contnet
  - Allow sysadm types to read /dev/kmsg
  -


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-11
changelog:
  - Allow svirt domains to manage the network since this is containerized
  - Allow svirt_lxc_net_t to send audit messages


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-12
changelog:
  - Add file name transitions for ttyACM0
  - spice-vdagent(d)'s are going to log over to syslog
  - Add sensord policy
  - Add more fixes for passenger policy related to puppet
  - Allow wdmd to create wdmd_tmpfs_t
  - Fix labeling for /var/run/cachefilesd\.pid
  - Add thumb_tmpfs_t files type


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-14
changelog:
  - Allow realmd to read resolv.conf
  - Add pegasus_cache_t type
  - Label /usr/sbin/fence_virtd as virsh_exec_t
  - Add policy for pkcsslotd
  - Add support for cpglockd
  - Allow polkit-agent-helper to read system-auth-ac
  - telepathy-idle wants to read gschemas.compiled
  - Allow plymouthd to getattr on fs_t
  - Add slpd policy
  - Allow ksysguardproces to read/write config_usr_t


author: Dan Walsh <dwalsh@redhat.com> 3.11.1-15
changelog:
  - Separate sandbox policy into sandbox and sandboxX, and disable sandbox by default on fresh installs
  - Allow domains that can read etc_t to read etc_runtime_t 
  - Allow all domains to use inherited tmpfiles


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-16
changelog:
  - nmbd wants to create /var/nmbd
  -  Stop transitioning out of anaconda and firstboot, just causes AVC messages
  - Allow clamscan to read /etc files
  - Allow bcfg2 to bind cyphesis port
  - heartbeat should be run as rgmanager_t instead of corosync_t
  - Add labeling for /etc/openldap/certs
  - Add labeling for /opt/sartest directory
  - Make crontab_t as userdom home reader
  - Allow tmpreaper to list admin_home dir
  - Add defition for imap_0 replay cache file
  - Add support for gitolite3
  - Allow virsh_t to send syslog messages
  - allow domains that can read samba content to be able to list the directories also
  - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd
  - Separate out sandbox from sandboxX policy so we can disable it by default
  - Run dmeventd as lvm_t
  - Mounting on any directory requires setattr and write permissions
  - Fix use_nfs_home_dirs() boolean
  - New labels for pam_krb5
  - Allow init and initrc domains to sys_ptrace since this is needed to look at processes not owned by uid 0
  - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-17
changelog:
  - Merge openshift policy
  - Allow xauth to read /dev/urandom
  - systemd needs to relabel content in /run/systemd directories
  - Files unconfined should be able to perform all services on all files
  - Puppet tmp file can be leaked to all domains
  - Dontaudit rhsmcertd-worker to search /root/.local
  - Allow chown capability for zarafa domains
  -  Allow system cronjobs to runcon into openshift domains
  - Allow virt_bridgehelper_t to manage content in the svirt_home_t labeled directories


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-18
changelog:
  - Allow postalias to read postfix config files
  - Allow man2html to read man pages
  - Allow rhev-agentd to search all mountpoints
  - Allow rhsmcertd to read /dev/random
  - Add tgtd_stream_connect() interface
  - Add cyrus_write_data() interface
  - Dontaudit attempts by sandboxX clients connectiing to the xserver_port_t
  - Add port definition for tcp/81 as http_port_t
  - Fix /dev/twa labeling
  - Allow systemd to read modules config


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-20
changelog:
  -  Fix auth_login_pgm_domain() interface to allow domains also managed user tmp dirs because of #856880 related to pam_systemd
  - Remove pam_selinux.8 which conflicts with man page owned by the pam package
  - Allow glance-api to talk to mysql
  - ABRT wants to read Xorg.0.log if if it detects problem with Xorg
  - Fix gstreamer filename trans. interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-21
changelog:
  - Add interfaces to ignore setattr until kernel fixes this to be checked after the DAC check
  - Change pam_t to pam_timestamp_t
  - Add dovecot_domain attribute and allow this attribute block_suspend capability2
  - Add sanlock_use_fusefs boolean
  - numad wants send/recieve msg
  - Allow rhnsd to send syslog msgs
  - Make piranha-pulse as initrc domain
  - Update openshift instances to dontaudit setattr until the kernel is fixed.


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-22
changelog:
  - Stop using attributes form netlabel_peer and syslog, auth_use_nsswitch setsup netlabel_peer
  - Move netlable_peer check out of booleans
  - Remove call to recvfrom_netlabel for kerberos call
  - Remove use of attributes when calling syslog call 
  - Move -miscfiles_read_localization to domain.te to save hundreds of allow rules
  - Allow all domains to read locale files.  This eliminates around 1500 allow rules- Cleanup nis_use_ypbind_uncond interface
  - Allow rndc to block suspend
  - tuned needs to modify the schedule of the kernel
  - Allow svirt_t domains to read alsa configuration files
  - ighten security on irc domains and make sure they label content in homedir correctly
  - Add filetrans_home_content for irc files
  - Dontaudit all getattr access for devices and filesystems for sandbox domains
  - Allow stapserver to search cgroups directories
  - Allow all postfix domains to talk to spamd


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-23
changelog:
  - Fixes to safe more rules
  - Re-write tomcat_domain_template()
  - Fix passenger labeling
  - Allow all domains to read man pages
  - Add ephemeral_port_t to the 'generic' port interfaces
  - Fix the names of postgresql booleans


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-24
changelog:
  - dbus needs to start getty unit files
  - Add interface to allow system_dbusd_t to start the poweroff service
  - xdm wants to exec telepathy apps
  - Allow users to send messages to systemdlogind
  - Additional rules needed for systemd and other boot apps
  - systemd wants to list /home and /boot
  - Allow gkeyringd to write dbus/conf file
  - realmd needs to read /dev/urand
  - Allow readahead to delete /.readahead if labeled root_t, might get created before policy is loaded


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-27
changelog:
  - Remove init_systemd and init_upstart boolean, Move init_daemon_domain and init_system_domain to use attributes
  - Add attribute to all base os types.  Allow all domains to read all ro base OS types


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-29
changelog:
  -  Add mei_device_t
  - Make sure gpg content in homedir created with correct label
  - Allow dmesg to write to abrt cache files
  - automount wants to search  virtual memory sysctls
  - Add support for hplip logs stored in /var/log/hp/tmp
  - Add labeling for /etc/owncloud/config.php
  - Allow setroubleshoot to send analysys to syslogd-journal
  - Allow virsh_t to interact with new fenced daemon
  - Allow gpg to write to /etc/mail/spamassassiin directories
  - Make dovecot_deliver_t a mail server delivery type
  - Add label for /var/tmp/DNS25


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-30
changelog:
  - Add fixes for ctbd
  - Allow nmbd to stream connect to ctbd
  - Make cglear_t as nsswitch_domain
  - Fix bogus in interfaces
  - Allow openshift to read/write postfix public pipe
  - Add postfix_manage_spool_maildrop_files() interface
  - stickshift paths have been renamed to openshift
  - gnome-settings-daemon wants to write to /run/systemd/inhibit/ pipes
  - Update man pages, adding ENTRYPOINTS


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-31
changelog:
  - Add new mandb policy
  - ALlow systemd-tmpfiles_t to relabel mandb_cache_t
  - Allow logrotate to start all unit files


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-33
changelog:
  - Add kernel_read_system_state to sandbox_client_t
  - Add some of the missing access to kdumpgui
  - Allow systemd_dbusd_t to status the init system
  - Allow vmnet-natd to request the kernel to load a module
  - Allow gsf-office-thum to append .cache/gdm/session.log
  - realmd wants to read .config/dconf/user
  - Firewalld wants sys_nice/setsched
  - Allow tmpreaper to delete mandb cache files
  - Firewalld wants sys_nice/setsched
  - Allow firewalld to perform  a DNS name resolution
  - Allown winbind to read /usr/share/samba/codepages/lowcase.dat
  - Add support for HTTPProxy* in /etc/freshclam.conf
  - Fix authlogin_yubike boolean
  - Extend smbd_selinux man page to include samba booleans
  - Allow dhcpc to execute consoletype
  - Allow ping to use inherited tmp files created in init scripts
  - On full relabel with unconfined domain disabled, initrc was running some chcon's
  - Allow people who delete man pages to delete mandb cache files


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-34
changelog:
  - Add policy for qemu-qa
  - Allow razor to write own config files
  -  Add an initial antivirus policy to collect all antivirus program
  - Allow qdisk to read usr_t
  - Add additional caps for vmware_host
  - Allow tmpfiles_t to setattr on mandb_cache_t
  - Dontaudit leaked files into mozilla_plugin_config_t
  - Allow wdmd to getattr on tmpfs
  - Allow realmd to use /dev/random
  - allow containers to send audit messages
  - Allow root mount any file via loop device with enforcing mls policy
  - Allow tmpfiles_t to setattr on mandb_cache_t
  - Allow tmpfiles_t to setattr on mandb_cache_t
  - Make userdom_dontaudit_write_all_ not allow open
  - Allow init scripts to read all unit files
  - Add support for saphostctrl ports


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-35
changelog:
  - tuned wants to getattr on all filesystems
  - tuned needs also setsched. The build is needed for test day


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-36
changelog:
  - Allow semanage to verify types
  - Allow sudo domain to execute user home files
  - Allow session_bus_type to transition to user_tmpfs_t
  - Add dontaudit caused by yum updates
  - Implement pki policy but not activated


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-37
changelog:
  - Allow xdm to search all file systems
  - Add interface to allow the config of all files
  - Add rngd policy
  - Remove kgpg as a gpg_exec_t type
  - Allow plymouthd to block suspend
  - Allow systemd_dbus to config any file
  - Allow system_dbus_t to configure all services
  - Allow freshclam_t to read usr_files
  - varnishd requires execmem to load modules


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-39
changelog:
  - Add interfaces to read kernel_t proc info
  - Missed this version of exec_all
  - Allow anyone who can load a kernel module to compromise kernel
  - Add oddjob_dbus_chat to openshift apache policy
  - Allow chrome_sandbox_nacl_t to send signals to itself
  - Add unit file support to usbmuxd_t
  - Allow all openshift domains to read sysfs info
  - Allow openshift domains to getattr on all domains


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-40
changelog:
  - Additional requirements for disable unconfined module when booting
  - Fix label of systemd script files
  - semanage can use -F /dev/stdin to get input
  - syslog now uses kerberos keytabs
  - Allow xserver to compromise_kernel access
  -  Allow nfsd to write to mount_var_run_t when running the mount command
  - Add filename transition rule for bin_t directories
  - Allow files to read usr_t lnk_files
  - dhcpc wants chown
  - Add support for new openshift labeling
  - Clean up for tunable+optional statements
  - Add labeling for /usr/sbin/mkhomedir_helper
  - Allow antivirus domain to managa amavis spool files
  - Allow rpcbind_t to read passwd 
  - Allow pyzor running as spamc to manage amavis spool


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-41
changelog:
  - Allow mount to relabelfrom unlabeled file systems
  - systemd_logind wants to send and receive messages from devicekit disk over dbus to make connected mouse working
  - Add label to get bin files under libreoffice labeled correctly
  - Fix interface to allow executing of base_ro_file_type
  - Add fixes for realmd
  - Update pki policy
  - Add tftp_homedir boolean
  - Allow blueman sched_setscheduler
  - openshift user domains wants to r/w ssh tcp sockets


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-42
changelog:
  - pki is leaking which we dontaudit until a pki code fix
  - Allow setcap for arping
  - Update man pages
  - Add labeling for /usr/sbin/mcollectived
  - pki fixes
  - Allow smokeping to execute fping in the netutils_t domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-44
changelog:
  - Change default label of all files in /var/run/rpcbind
  - Allow sandbox domains (java) to read hugetlbfs_t
  - Allow awstats cgi content to create tmp files and read apache log files
  - Allow setuid/setgid for cupsd-config
  - Allow setsched/sys_nice pro cupsd-config
  -  Fix /etc/localtime sym link to be labeled locale_t
  - Allow sshd to search postgresql db t since this is a homedir
  - Allow xwindows users to chat with realmd
  - Allow unconfined domains to configure all files and null_device_t service


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-45
changelog:
  - Add new selinuxuser_use_ssh_chroot boolean
  - dbus needs to be able to read/write inherited fixed disk device_t passed through it
  - Cleanup netutils process allow rule
  - Dontaudit leaked fifo files from openshift to ping
  - sanlock needs to read mnt_t lnk files
  - Fail2ban needs to setsched and sys_nice


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-46
changelog:
  - Allow loging programs to dbus chat with realmd
  - Make apache_content_template calling as optional
  - realmd is using policy kit


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-47
changelog:
  - Allow getty to setattr on usb ttys
  - Allow sshd to search all directories for sshd_home_t content
  - Allow staff domains to send dbus messages to kdumpgui
  - Fix labels on /etc/.pwd.lock and friends to be passwd_file_t
  - Dontaudit setfiles reading urand
  - Add files_dontaudit_list_tmp() for domains to which we added sys_nice/setsched
  - Allow staff_gkeyringd_t to read /home/$USER/.local/share/keyrings dir
  - Allow systemd-timedated to read /dev/urandom
  - Allow entropyd_t to read proc_t (meminfo)
  - Add unconfined munin plugin
  - Fix networkmanager_read_conf() interface
  - Allow blueman to list /tmp which is needed by sys_nic/setsched
  - Fix label of /etc/mail/aliasesdb-stamp
  - numad is searching cgroups
  - realmd is communicating with networkmanager using dbus
  - Lots of fixes to try to get kdump to work


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-48
changelog:
  - Fix label on /etc/group.lock
  - Allow gnomeclock to create lnk_file in /etc
  - label /root/.pki as a home_cert_t
  - Add interface to make sure rpcbind.sock is created with the correct label
  - Add definition for new directory /var/lib/os-probe and bootloader wants to read udev rules
  - opendkim should be a part of milter
  - Allow libvirt to set the kernel sched algorythm
  - Allow mongod to read sysfs_t
  - Add authconfig policy
  - Remove calls to miscfiles_read_localization all domains get this
  - Allow virsh_t to read /root/.pki/ content
  - Add label for log directory under /var/www/stickshift


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-49
changelog:
  - Add smsd policy
  - Add support for OpenShift sbin labelin
  - Add boolean to allow virt to use rawip
  - Allow mozilla_plugin to read all file systems with noxattrs support
  - Allow kerberos to write on anon_inodefs fs
  - Additional access required by fenced
  - Add filename transitions for passwd.lock/group.lock
  - UPdate man pages
  - Create coolkey directory in /var/cache with the correct label


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-50
changelog:
  - Allow all domains to read /proc/sys/vm/overcommit_memory
  - Make proc_numa_t an MLS Trusted Object
  - Add /proc/numactl support for confined users
  - Allow ssh_t to connect to any port > 1023
  - Add openvswitch domain
  - Pulseaudio tries to create directories in gnome_home_t directories
  - New ypbind pkg wants to search /var/run which is caused by sd_notify
  - Allow NM to read certs on NFS/CIFS using use_nfs_*, use_samba_* booleans
  - Allow sanlock to read /dev/random
  - Treat php-fpm with httpd_t
  - Allow domains that can read named_conf_t to be able to list the directories
  - Allow winbind to create sock files in /var/run/samba


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-51
changelog:
  - Add port defintion for tcp/9000
  - Fix labeling for /usr/share/cluster/checkquorum to label also checkquorum.wdmd
  - Add rules and labeling for $HOME/cache/\.gstreamer-.* directory
  - Add support for CIM provider openlmi-networking which uses NetworkManager dbus API
  - Allow shorewall_t to create netlink_socket
  - Allow krb5admind to block suspend
  - Fix labels on /var/run/dlm_controld /var/log/dlm_controld
  - Allow krb5kdc to block suspend
  - gnomessytemmm_t needs to read /etc/passwd
  - Allow cgred to read all sysctls


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-52
changelog:
  - Define usbtty_device_t as a term_tty
  - Allow svnserve to accept a connection
  - Allow xend manage default virt_image_t type
  - Allow prelink_cron_system_t to overide user componant when executing cp
  - Add labeling for z-push
  - Gnomeclock sets the realtime clock
  - Openshift seems to be storing apache logs in /var/lib/openshift/.log/httpd
  - Allow lxc domains to use /dev/random and /dev/urandom


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-53
changelog:
  - Fix storage_rw_inherited_fixed_disk_dev() to cover also blk_file
  - Dontaudit setfiles reading /dev/random
  - On initial boot gnomeclock is going to need to be set buy gdm
  - Fix tftp_read_content() interface
  - Random apps looking at kernel file systems
  - Testing virt with lxc requiers additional access for virsh_t
  - New allow rules requied for latest libvirt, libvirt talks directly to journald,lxc setup tool needs compromize_kernel,and we need ipc_lock in the container
  - Allow MPD to read /dev/radnom
  - Allow sandbox_web_type to read logind files which needs to read pulseaudio
  - Allow mozilla plugins to read /dev/hpet
  - Add labeling for /var/lib/zarafa-webap
  - Allow BOINC client to use an HTTP proxy for all connections
  - Allow rhsmertd to domain transition to dmidecod
  -  Allow setroubleshootd to send D-Bus msg to ABRT


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-54
changelog:
  - Fix filetrans interface definitions
  - Dontaudit xdm_t to getattr on BOINC lib files
  - Add systemd_reload_all_services() interface
  - Dontaudit write access on /var/lib/net-snmp/mib_indexes 
  - Only stop mcsuntrustedproc from relableing files
  - Allow accountsd to dbus chat with gdm
  - Allow realmd to getattr on all fs
  - Allow logrotate to reload all services
  - Add systemd unit file for radiusd
  - Allow winbind to create samba pid dir
  - Add labeling for /var/nmbd/unexpected
  - Allow chrome and mozilla plugin to connect to msnp ports


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-55
changelog:
  - Fix userhelper_console_role_template()
  - Allow enabling Network Access Point service using blueman
  - Make vmware_host_t as unconfined domain
  - Allow authenticate users in webaccess via squid, using mysql as backend
  - Allow gathers to get various metrics on mounted file systems
  - Allow firewalld to read /etc/hosts
  - Fix cron_admin_role() to make sysadm cronjobs running in the sysadm_t instead of cronjob_t
  - Allow kdumpgui to read/write to zipl.conf
  - Commands needed to get mock to build from staff_t in enforcing mode
  - Allow mdadm_t to manage cgroup files
  - Allow all daemons and systemprocesses to use inherited initrc_tmp_t files
  - dontaudit ifconfig_t looking at fifo_files that are leaked to it
  - Add lableing for Quest Authentication System


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-56
changelog:
  - Allow syslogd to request the kernel to load a module
  - Allow syslogd_t to read the network state information
  - Allow xdm_dbusd_t connect to the system DBUS
  - Add support for 7389/tcp port
  - Allow domains to read/write all inherited sockets
  - Allow staff_t to read kmsg
  - Add awstats_purge_apache_log boolean
  - Allow ksysguardproces to read /.config/Trolltech.conf
  - Allow passenger to create and append puppet log files
  - Add puppet_append_log and puppet_create_log interfaces
  - Add puppet_manage_log() interface
  - Allow tomcat domain to search tomcat_var_lib_t
  - Allow pki_tomcat_t to connect to pki_ca ports
  - Allow pegasus_t to have net_admin capability
  - Allow pegasus_t to write /sys/class/net/<interface>/flags
  - Allow mailserver_delivery to manage mail_home_rw_t lnk_files
  - Allow fetchmail to create log files
  - Allow gnomeclock to manage home config in .kde
  - Allow bittlebee to read kernel sysctls
  - Allow logrotate to list /root


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-57
changelog:
  - Add support for 4567/tcp port
  - Random fixes from Tuomo Soini
  - xdm wants to get init status
  - Allow programs to run in fips_mode
  - Add interface to allow the reading of all blk device nodes
  - Allow init to relabel rpcbind sock_file
  - Fix labeling for lastlog and faillog related to logrotate
  - ALlow aeolus_configserver to use TRAM port
  - Add fixes for aeolus_configserver
  - Allow snmpd to connect to snmp port
  - Allow spamd_update to create spamd_var_lib_t directories
  - Allow domains that can read sssd_public_t files to also list the directory
  - Remove miscfiles_read_localization, this is defined for all domains


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-58
changelog:
  - Add back consolekit policy
  - Silence bootloader trying to use inherited tty
  - Silence xdm_dbusd_t trying to execute telepathy apps
  - Fix shutdown avcs when machine has unconfined.pp disabled
  - The host and a virtual machine can share the same printer on a usb device
  - Change oddjob to transition to a ranged openshift_initr_exec_t when run from oddjob
  - Allow abrt_watch_log_t to execute bin_t
  - Allow chrome sandbox to write content in ~/.config/chromium
  - Dontaudit setattr on fontconfig dir for thumb_t
  - Allow lircd to request the kernel to load module
  - Make rsync as userdom_home_manager
  - Allow rsync to search automount filesystem
  - Add fixes for pacemaker


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-60
changelog:
  - Add openshift_initrc_signal() interface
  - Fix typos
  - dspam port is treat as spamd_port_t
  - Allow setroubleshoot to getattr on all executables
  - Allow tuned to execute profiles scripts in /etc/tuned
  - Allow apache to create directories to store its log files
  - Allow all directories/files in /var/log starting with passenger to be labeled passenger_log_t
  - Looks like apache is sending sinal to openshift_initrc_t now,needs back port to RHEL6
  - Allow Postfix to be configured to listen on TCP port 10026 for email from DSPAM
  - Add filename transition for /etc/tuned/active_profile
  - Allow condor_master to send mails
  - Allow condor_master to read submit.cf
  - Allow condor_master to create /tmp files/dirs
  - Allow condor_mater to send sigkill to other condor domains
  - Allow condor_procd sigkill capability
  - tuned-adm wants to talk with tuned daemon
  - Allow kadmind and krb5kdc to also list sssd_public_t
  - Allow accountsd to dbus chat with init
  - Fix git_read_generic_system_content_files() interface
  - pppd wants sys_nice by nmcli because of "syscall=sched_setscheduler"
  - Fix mozilla_plugin_can_network_connect to allow to connect to all ports
  - Label all munin plugins which are not covered by munin plugins policy  as unconfined_munin_plugin_exec_t
  - dspam wants to search /var/spool for opendkim data
  - Revert "Add support for tcp/10026 port as dspam_port_t"
  - Turning on labeled networking requires additional access for netlabel_peer_t; these allow rules need to be back ported to RHEL6
  - Allow all application domains to use fifo_files passed in from userdomains, also allow them to write to tmp_files inherited from userdomain
  - Allow systemd_tmpfiles_t to setattr on mandb_cache_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-61
changelog:
  - Label /var/lib/pgsql/.ssh as ssh_home_t
  - Add labeling for /usr/bin/pg_ctl
  - Allow systemd-logind to manage keyring user tmp dirs
  - Add support for 7389/tcp port
  - gems seems to be placed in lots of places
  - Since xdm is running a full session, it seems to be trying to execute lots of executables via dbus
  - Add back tcp/8123 port as http_cache port
  - Add ovirt-guest-agent\.pid labeling
  - Allow xend to run scsi_id
  - Allow rhsmcertd-worker to read "physical_package_id"
  - Allow pki_tomcat to connect to ldap port
  - Allow lpr to read /usr/share/fonts
  - Allow open file from CD/DVD drive on domU
  - Allow munin services plugins to talk to SSSD
  - Allow all samba domains to create samba directory in var_t directories
  - Take away svirt_t ability to use nsswitch
  - Dontaudit attempts by openshift to read apache logs
  - Allow apache to create as well as append _ra_content_t
  - Dontaudit sendmail_t reading a leaked file descriptor
  - Add interface to have admin transition /etc/prelink.cache to the proper label
  - Add sntp support to ntp policy
  - Allow firewalld to dbus chat with devicekit_power
  - Allow tuned to call lsblk
  - Allow tor to read /proc/sys/kernel/random/uuid
  - Add tor_can_network_relay boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-62
changelog:
  - Fix MCS Constraints to control ingres and egres controls on the network.
  - Change name of svirt_nokvm_t to svirt_tcg_t
  - Allow tuned to request the kernel to load kernel modules


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-63
changelog:
  - Add label for efivarfs
  - Allow certmonger to send signal to itself
  - Allow plugin-config to read own process status
  - Add more fixes for pacemaker
  - apache/drupal can run clamscan on uploaded content
  - Allow chrome_sandbox_nacl_t to read pid 1 content


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-65
changelog:
  - Allow svirt to use netlink_route_socket which was a part of auth_use_nsswitch
  - Add additional labeling for /var/www/openshift/broker
  - Fix rhev policy
  - Allow openshift_initrc domain to dbus chat with systemd_logind
  - Allow httpd to getattr passenger log file if run_stickshift
  - Allow consolehelper-gtk to connect to xserver
  - Add labeling for the tmp-inst directory defined in pam_namespace.conf
  - Add lvm_metadata_t labeling for /etc/multipath


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-66
changelog:
  - Allow munin disk plugins to get attributes of all directories
  - Allow munin disk plugins to get attributes of all directorie
  - Allow logwatch to get attributes of all directories
  - Fix networkmanager_manage_lib() interface
  - Fix gnome_manage_config() to allow to manage sock_file
  - Fix virtual_domain_context
  - Add support for dynamic DNS for DHCPv6


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-67
changelog:
  - systemd_logind_t is looking at all files under /run/user/apache
  - Allow systemd to manage all user tmp files
  - Add labeling for /var/named/chroot/etc/localtime
  - Allow netlabel_peer_t type to flow over netif_t and node_t, and only be hindered by MLS, need back port to RHEL6
  - Keystone is now using a differnt port
  - Allow xdm_t to use usbmuxd daemon to control sound
  - Allow passwd daemon to execute gnome_exec_keyringd
  - Fix chrome_sandbox policy
  - Add labeling for /var/run/checkquorum-timer
  - More fixes for the dspam domain, needs back port to RHEL6
  - More fixes for the dspam domain, needs back port to RHEL6
  - sssd needs to connect to kerberos password port if a user changes his password
  - Lots of fixes from RHEL testing of dspam web
  - Allow chrome and mozilla_plugin to create msgq and semaphores
  - Fixes for dspam cgi scripts
  - Fixes for dspam cgi scripts
  - Allow confine users to ptrace screen
  - Backport virt_qemu_ga_t changes from RHEL
  - Fix labeling for dspam.cgi needed for RHEL6
  - We need to back port this policy to RHEL6, for lxc domains
  - Dontaudit attempts to set sys_resource of logrotate
  - Allow corosync to read/write wdmd's tmpfs files
  - I see a ptrace of mozilla_plugin_t by staff_t, will allow without deny_ptrace being set
  - Allow cron jobs to read bind config for unbound
  - libvirt needs to inhibit systemd
  - kdumpctl needs to delete boot_t files
  - Fix duplicate gnome_config_filetrans
  - virtd_lxc_t is using /dev/fuse
  - Passenger needs to create a directory in /var/log, needs a backport to RHEL6 for openshift
  - apcupsd can be setup to listen to snmp trafic
  - Allow transition from kdumpgui to kdumpctl
  - Add fixes for munin CGI scripts
  - Allow deltacloud to connect to openstack at the keystone port
  - Allow domains that transition to svirt domains to be able to signal them
  - Fix file context of gstreamer in .cache directory
  - libvirt is communicating with logind
  - NetworkManager writes to the systemd inhibit pipe


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-68
changelog:
  - Allow setroubleshoot_fixit to execute rpm
  - zoneminder needs to connect to httpd ports where remote cameras are listening
  - Allow firewalld to execute content created in /run directory
  - Allow svirt_t to read generic certs
  - Dontaudit leaked ps content to mozilla plugin
  - Allow sshd_t sys_admin for use with afs logins
  - Allow systemd to read/write all sysctls
  - init scripts are creating systemd_unit_file_t directories


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-69
changelog:
  - Add systemd_status_all_unit_files() interface
  - Add support for nshadow
  - Allow sysadm_t to administrate the postfix domains
  - Add interface to setattr on isid directories for use by tmpreaper
  - Allow sshd_t sys_admin for use with afs logins
  - Allow systemd to read/write all sysctls
  - Allow sshd_t sys_admin for use with afs logins
  - Allow systemd to read/write all sysctls
  - Add systemd_status_all_unit_files() interface
  - Add support for nshadow
  - Allow sysadm_t to administrate the postfix domains
  - Add interface to setattr on isid directories for use by tmpreaper
  - Allow sshd_t sys_admin for use with afs logins
  - Allow systemd to read/write all sysctls
  - Allow sshd_t sys_admin for use with afs logins
  - Add labeling for /var/named/chroot/etc/localtim


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-2
changelog:
  - Remove all mcs overrides and replace with t1 != mcs_constrained_types
  - Add attribute_role for iptables
  - mcs_process_set_categories needs to be called for type
  - Implement additional role_attribute statements
  - Sodo domain is attempting to get the additributes of proc_kcore_t
  - Unbound uses port 8953
  - Allow svirt_t images to compromise_kernel when using pci-passthrough
  - Add label for dns lib files
  - Bluetooth aquires a dbus name
  - Remove redundant files_read_usr_file calling
  - Remove redundant files_read_etc_file calling
  - Fix mozilla_run_plugin()
  - Add role_attribute support for more domains


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-3
changelog:
  - Allow gnomeclock to talk to puppet over dbus
  - Allow numad access discovered by Dominic
  - Add support for HOME_DIR/.maildir
  - Fix attribute_role for mozilla_plugin_t domain to allow staff_r to access this domain
  - Allow udev to relabel udev_var_run_t lnk_files
  - New bin_t file in mcelog


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-4
changelog:
  - Allow systemd-tmpfiles to relabel lpd spool files
  - Ad labeling for texlive bash scripts
  - Add xserver_filetrans_fonts_cache_home_content() interface
  - Remove duplicate rules from *.te
  - Add support for /var/lock/man-db.lock
  - Add support for /var/tmp/abrt(/.*)?
  - Add additional labeling for munin cgi scripts
  - Allow httpd_t to read munin conf files
  - Allow certwatch to read meminfo
  - Fix nscd_dontaudit_write_sock_file() interfac
  - Fix gnome_filetrans_home_content() to include also "fontconfig" dir as cache_home_t
  - llow mozilla_plugin_t to create HOMEDIR/.fontconfig with the proper labeling


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-5
changelog:
  - Fix systemd_manage_unit_symlinks() interface
  - Call systemd_manage_unit_symlinks(() which is correct interface
  - Add filename transition for opasswd
  - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock
  - Allow sytstemd-timedated to get status of init_t
  - Add new systemd policies for hostnamed and rename gnomeclock_t to systemd_timedate_t
  - colord needs to communicate with systemd and systemd_logind, also remove duplicate rules
  - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock
  - Allow gpg_t to manage all gnome files
  - Stop using pcscd_read_pub_files
  - New rules for xguest, dontaudit attempts to dbus chat
  - Allow firewalld to create its mmap files in tmpfs and tmp directories
  - Allow firewalld to create its mmap files in tmpfs and tmp directories
  - run unbound-chkconf as named_t, so it can read dnssec
  - Colord is reading xdm process state, probably reads state of any apps that sends dbus message
  - Allow mdadm_t to change the kernel scheduler
  - mythtv policy
  - Update mandb_admin() interface
  - Allow dsspam to listen on own tpc_socket
  - seutil_filetrans_named_content needs to be optional
  - Allow sysadm_t to execute content in his homedir
  - Add attach_queue to tun_socket, new patch from Paul Moore
  - Change most of selinux configuration types to security_file_type.
  - Add filename transition rules for selinux configuration
  - ssh into a box with -X -Y requires ssh_use_ptys
  - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on
  - Allow all unpriv userdomains to send dbus messages to hostnamed and timedated
  - New allow rules found by Tom London for systemd_hostnamed


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-6
changelog:
  - kde gnomeclock wants to write content to /tmp
  - /usr/libexec/kde4/kcmdatetimehelper attempts to create /root/.kde
  - Allow blueman_t to rwx zero_device_t, for some kind of jre
  - Allow mozilla_plugin_t to rwx zero_device_t, for some kind of jre
  - Ftp full access should be allowed to create directories as well as files
  - Add boolean to allow rsync_full_acces, so that an rsync server can write all
  - over the local machine
  - logrotate needs to rotate logs in openshift directories, needs back port to RHEL6
  - Add missing vpnc_roles type line
  - Allow stapserver to write content in /tmp
  - Allow gnome keyring to create keyrings dir in ~/.local/share
  - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on
  - Add interface to colord_t dbus_chat to allow it to read remote process state
  - Allow colord_t to read cupsd_t state
  - Add mate-thumbnail-font as thumnailer
  - Allow sectoolm to sys_ptrace since it is looking at other proceses /proc data.
  - Allow qpidd to list /tmp. Needed by ssl
  - Only allow init_t to transition to rsync_t domain, not initrc_t.  This should be back ported to F17, F18
  - - Added systemd support for ksmtuned
  - Added booleans
   	ksmtuned_use_nfs
   	ksmtuned_use_cifs
  - firewalld seems to be creating mmap files which it needs to execute in /run /tmp and /dev/shm.  Would like to clean this up but for now we will allow
  - Looks like qpidd_t needs to read /dev/random
  - Lots of probing avc's caused by execugting gpg from staff_t
  - Dontaudit senmail triggering a net_admin avc
  - Change thumb_role to use thumb_run, not sure why we have a thumb_role, needs back port
  - Logwatch does access check on mdadm binary
  - Add raid_access_check_mdadm() iterface


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-7
changelog:
  - mount.glusterfs executes glusterfsd binary
  - Allow systemd_hostnamed_t to stream connect to systemd
  - Dontaudit any user doing a access check
  - Allow obex-data-server to request the kernel to load a module
  - Allow gpg-agent to manage gnome content (~/.cache/gpg-agent-info)
  - Allow gpg-agent to read /proc/sys/crypto/fips_enabled
  - Add new types for antivirus.pp policy module
  - Allow gnomesystemmm_t caps because of ioprio_set
  - Make sure if mozilla_plugin creates files while in permissive mode, they get created with the correct label, user_home_t
  - Allow gnomesystemmm_t caps because of ioprio_set
  - Allow NM rawip socket
  - files_relabel_non_security_files can not be used with boolean
  - Add interface to thumb_t dbus_chat to allow it to read remote process state
  - ALlow logrotate to domtrans to mdadm_t
  - kde gnomeclock wants to write content to /tmp


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-8
changelog:
  - Change ssh_use_pts to use macro and only inherited sshd_devpts_t
  - Allow confined users to read systemd_logind seat information
  - libmpg ships badly created libraries
  - Add support for strongswan.service
  - Add labeling for strongswan
  - Allow l2tpd_t to read network manager content in /run directory
  - Allow rsync to getattr any file in rsync_data_t
  - Add labeling and filename transition for .grl-podcasts


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-9
changelog:
  - boinc_cliean wants also execmem as boinc projecs have
  - Allow sa-update to search admin home for /root/.spamassassin
  - Allow sa-update to search admin home for /root/.spamassassin
  - Allow antivirus domain to read net sysctl
  - Dontaudit attempts from thumb_t to connect to ssd
  - Dontaudit attempts by readahead to read sock_files
  - Dontaudit attempts by readahead to read sock_files
  - Create tmpfs file while running as wine as user_tmpfs_t
  - Dontaudit attempts by readahead to read sock_files
  - libmpg ships badly created librarie


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-10
changelog:
  - Fix smartmontools
  - Fix userdom_restricted_xwindows_user_template() interface
  - Add xserver_xdm_ioctl_log() interface
  - Allow Xusers to ioctl lxdm.log to make lxdm working
  - Add MLS fixes to make MLS boot/log-in working
  - Add mls_socket_write_all_levels() also for syslogd
  - fsck.xfs needs to read passwd
  - Fix ntp_filetrans_named_content calling in init.te
  - Allow postgresql to create pg_log dir
  - Allow sshd to read rsync_data_t to make rsync <backuphost> working
  - Change ntp.conf to be labeled net_conf_t
  - Allow useradd to create homedirs in /run.  ircd-ratbox does this and we should just allow it
  - Allow xdm_t to execute gstreamer home content
  - Allod initrc_t and unconfined domains, and sysadm_t to manage ntp
  - New policy for openstack swift domains
  - More access required for openshift_cron_t
  - Use cupsd_log_t instead of cupsd_var_log_t
  - rpm_script_roles should be used in rpm_run
  - Fix rpm_run() interface
  - Fix openshift_initrc_run()
  - Fix sssd_dontaudit_stream_connect() interface
  - Fix sssd_dontaudit_stream_connect() interface
  - Allow LDA's job to deliver mail to the mailbox
  - dontaudit block_suspend for mozilla_plugin_t
  - Allow l2tpd_t to all signal perms
  - Allow uuidgen to read /dev/random
  - Allow mozilla-plugin-config to read power_supply info
  - Implement cups_domain attribute for cups domains
  - We now need access to user terminals since we start by executing a command outside the tty
  - We now need access to user terminals since we start by executing a command outside the tty
  - svirt lxc containers want to execute userhelper apps, need these changes to allow this to happen
  - Add containment of openshift cron jobs
  - Allow system cron jobs to create tmp directories
  - Make userhelp_conf_t a config file
  - Change rpm to use rpm_script_roles
  - More fixes for rsync to make rsync <backuphost> wokring
  - Allow logwatch to domtrans to mdadm
  - Allow pacemaker to domtrans to ifconfig
  - Allow pacemaker to setattr on corosync.log
  - Add pacemaker_use_execmem for memcheck-amd64 command
  - Allow block_suspend capability
  - Allow create fifo_file in /tmp with pacemaker_tmp_t
  - Allow systat to getattr on fixed disk
  - Relabel /etc/ntp.conf to be net_conf_t
  - ntp_admin should create files in /etc with the correct label
  - Add interface to create ntp_conf_t files in /etc
  - Add additional labeling for quantum
  - Allow quantum to execute dnsmasq with transition


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-11
changelog:
  - Allow gpg to read fips_enabled
  - Add support for /var/cache/realmd
  - Add support for /usr/sbin/blazer_usb and systemd support for nut
  - Add labeling for fenced_sanlock and allow sanclok transition to fenced_t
  - bitlbee wants to read own log file
  - Allow glance domain to send a signal itself
  - Allow xend_t to request that the kernel load a kernel module
  - Allow pacemaker to execute heartbeat lib files
  - cleanup new swift policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-12
changelog:
  - Rename files_rw_inherited_tmp_files to files_rw_inherited_tmp_file
  - Add missing files_rw_inherited_tmp_files interface
  - Add additional interface for ecryptfs
  - ALlow nova-cert to connect to postgresql
  - Allow keystone to connect to postgresql
  - Allow all cups domains to getattr on filesystems
  - Allow pppd to send signull
  - Allow tuned to execute ldconfig
  - Allow gpg to read fips_enabled
  - Add additional fixes for ecryptfs
  - Allow httpd to work with posgresql
  - Allow keystone getsched and setsched


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-13
changelog:
  - virsh now does a setexeccon call
  - Additional rules required by openshift domains
  - Allow svirt_lxc_domains to use inherited terminals, needed to make virt-sandbox-service execute work
  - Allow spamd_update_t to search spamc_home_t
  - Avcs discovered by mounting an isci device under /mnt
  - Allow lspci running as logrotate to read pci.ids
  - Additional fix for networkmanager_read_pid_files()
  - Fix networkmanager_read_pid_files() interface
  - Allow all svirt domains to connect to svirt_socket_t
  - Allow virsh to set SELinux context for a process.
  - Allow tuned to create netlink_kobject_uevent_socket
  - Allow systemd-timestamp to set SELinux context
  - Add support for /var/lib/systemd/linger
  - Fix ssh_sysadm_login to be working on MLS as expected


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-14
changelog:
  - Allow gluster to get attrs on all fs
  - New access required for virt-sandbox
  - Allow dnsmasq to execute bin_t
  - Allow dnsmasq to create content in /var/run/NetworkManager
  - Fix openshift_initrc_signal() interface
  - Dontaudit openshift domains doing getattr on other domains
  - Allow consolehelper domain to communicate with session bus
  - Mock should not be transitioning to any other domains,  we should keep mock_t as mock_t
  - Update virt_qemu_ga_t policy
  - Allow authconfig running from realmd to restart oddjob service
  - Add systemd support for oddjob
  - Add initial policy for realmd_consolehelper_t which if for authconfig executed by realmd
  - Add labeling for gnashpluginrc
  - Allow chrome_nacl to execute /dev/zero
  - Allow condor domains to read /proc
  - mozilla_plugin_t will getattr on /core if firefox crashes
  - Allow condor domains to read /etc/passwd
  - Allow dnsmasq to execute shell scripts, openstack requires this access
  - Fix glusterd labeling
  - Allow virtd_t to interact with the socket type
  - Allow nmbd_t to override dac if you turned on sharing all files
  - Allow tuned to created kobject_uevent socket
  - Allow guest user to run fusermount
  - Allow openshift to read /proc and locale
  - Allow realmd to dbus chat with rpm
  - Add new interface for virt
  - Remove depracated interfaces
  - Allow systemd_domains read access on etc, etc_runtime and usr files, also allow them to connect stream to syslog socket
  - /usr/share/munin/plugins/plugin.sh should be labeled as bin_t
  - Remove some more unconfined_t process transitions, that I don't believe are necessary
  - Stop transitioning uncofnined_t to checkpc
  - dmraid creates /var/lock/dmraid
  - Allow systemd_localed to creatre unix_dgram_sockets
  - Allow systemd_localed to write kernel messages.
  - Also cleanup systemd definition a little.
  - Fix userdom_restricted_xwindows_user_template() interface
  - Label any block devices or char devices under /dev/infiniband as fixed_disk_device_t
  - User accounts need to dbus chat with accountsd daemon
  - Gnome requires all users to be able to read /proc/1/


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-16
changelog:
  - Fix authconfig.py labeling
  - Make any domains that write homedir content do it correctly
  - Allow glusterd to read/write anyhwere on the file system by default
  - Be a little more liberal with the rsync log files
  - Fix iscsi_admin interface
  - Allow iscsid_t to read /dev/urand
  - Fix up iscsi domain for use with unit files
  - Add filename transition support for spamassassin policy
  - Allow web plugins to use badly formated libraries
  - Allow nmbd_t to create samba_var_t directories
  - Add filename transition support for spamassassin policy
  - Add filename transition support for tvtime
  - Fix alsa_home_filetrans_alsa_home() interface
  - Move all userdom_filetrans_home_content() calling out of booleans
  - Allow logrotote to getattr on all file sytems
  - Remove duplicate userdom_filetrans_home_content() calling
  - Allow kadmind to read /etc/passwd
  - Dontaudit append .xsession-errors file on ecryptfs for  policykit-auth
  - Allow antivirus domain to manage antivirus db links
  - Allow logrotate to read /sys
  - Allow mandb to setattr on man dirs
  - Remove mozilla_plugin_enable_homedirs boolean
  - Fix ftp_home_dir boolean
  - homedir mozilla filetrans has been moved to userdom_home_manager
  - homedir telepathy filetrans has been moved to userdom_home_manager
  - Remove gnome_home_dir_filetrans() from gnome_role_gkeyringd()
  - Might want to eventually write a daemon on fusefsd.
  - Add policy fixes for sshd [net] child from plautrba@redhat.com
  - Tor uses a new port
  - Remove bin_t for authconfig.py
  - Fix so only one call to userdom_home_file_trans
  - Allow home_manager_types to create content with the correctl label
  - Fix all domains that write data into the homedir to do it with the correct label
  - Change the postgresql to use proper boolean names, which is causing httpd_t to
  - not get access to postgresql_var_run_t
  - Hostname needs to send syslog messages
  - Localectl needs to be able to send dbus signals to users
  - Make sure userdom_filetrans_type will create files/dirs with user_home_t labeling by default
  - Allow user_home_manger domains to create spam* homedir content with correct labeling
  - Allow user_home_manger domains to create HOMEDIR/.tvtime with correct labeling
  - Add missing miscfiles_setattr_man_pages() interface and for now comment some rules for userdom_filetrans_type to make build process working
  - Declare userdom_filetrans_type attribute
  - userdom_manage_home_role() needs to be called withoout usertype attribute because of userdom_filetrans_type attribute
  - fusefsd is mounding a fuse file system on /run/user/UID/gvfs


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-19
changelog:
  - Allow postgresql to manage rgmanager pid files
  - Allow postgresql to read ccs data
  - Allow systemd_domain to send dbus messages to policykit
  - Add labels for /etc/hostname and /etc/machine-info and allow systemd-hostnamed to create them
  - All systemd domains that create content are reading the file_context file and setfscreate
  - Systemd domains need to search through init_var_run_t
  - Allow sshd to communicate with libvirt to set containers labels
  - Add interface to manage pid files
  - Allow NetworkManger_t to read /etc/hostname
  - Dontaudit leaked locked files into openshift_domains
  - Add fixes for oo-cgroup-read - it nows creates tmp files
  - Allow gluster to manage all directories as well as files
  - Dontaudit chrome_sandbox_nacl_t using user terminals
  - Allow sysstat to manage its own log files
  - Allow virtual machines to setrlimit and send itself signals.
  - Add labeling for /var/run/hplip


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-20
changelog:
  - Adopt swift changes from lhh@redhat.com
  - Add rhcs_manage_cluster_pid_files() interface
  - Allow screen domains to configure tty and setup sock_file in ~/.screen directory
  - ALlow setroubleshoot to read default_context_t, needed to backport to F18
  - Label /etc/owncloud as being an apache writable directory
  - Allow sshd to stream connect to an lxc domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-21
changelog:
  - Fix log transition rule for cluster domains
  - Start to group all cluster log together
  - Dont use filename transition for POkemon Advanced Adventure until a new checkpolicy update
  - cups uses usbtty_device_t devices
  - These fixes were all required to build a MLS virtual Machine with single level desktops
  - Allow domains to transiton using httpd_exec_t
  - Allow svirt domains to manage kernel key rings
  - Allow setroubleshoot to execute ldconfig
  - Allow firewalld to read generate gnome data
  - Allow bluetooth to read machine-info
  - Allow boinc domain to send signal to itself
  - Fix gnome_filetrans_home_content() interface
  - Allow mozilla_plugins to list apache modules, for use with gxine
  - Fix labels for POkemon in the users homedir
  - Allow xguest to read mdstat
  - Dontaudit virt_domains getattr on /dev/*
  - These fixes were all required to build a MLS virtual Machine with single level desktops
  - Need to back port this to RHEL6 for openshift
  - Add tcp/8891 as milter port
  - Allow nsswitch domains to read sssd_var_lib_t files
  - Allow ping to read network state.
  - Fix typo
  - Add labels to /etc/X11/xorg.d and allow systemd-timestampd_t to manage them


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-22
changelog:
  - Allow nagios to manage nagios spool files
  - /var/spool/snmptt is a directory which snmdp needs to write to, needs back port to RHEL6
  - Add swift_alias.* policy files which contain typealiases for swift types
  - Add support for /run/lock/opencryptoki
  - Allow pkcsslotd chown capability
  - Allow pkcsslotd to read passwd
  - Add rsync_stub() interface
  - Allow systemd_timedate also manage gnome config homedirs
  - Label /usr/lib64/security/pam_krb5/pam_krb5_cchelper as bin_t
  - Fix filetrans rules for kdm creates .xsession-errors
  - Allow sytemd_tmpfiles to create wtmp file
  - Really should not label content  under /var/lock, since it could have labels on it different from var_lock_t
  - Allow systemd to list all file system directories
  - Add some basic stub interfaces which will be used in PRODUCT policies


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-23
changelog:
  - Allow localectl to read /etc/X11/xorg.conf.d directory
  - Revert "Revert "Fix filetrans rules for kdm creates .xsession-errors""
  - Allow mount to transition to systemd_passwd_agent
  - Make sure abrt directories are labeled correctly
  - Allow commands that are going to read mount pid files to search mount_var_run_t
  - label /usr/bin/repoquery as rpm_exec_t
  - Allow automount to block suspend
  - Add abrt_filetrans_named_content so that abrt directories get labeled correctly
  - Allow virt domains to setrlimit and read file_context


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-24
changelog:
  - Add labeling for /usr/share/pki
  - Allow programs that read var_run_t symlinks also read var_t symlinks
  - Add additional ports as mongod_port_t for  27018, 27019, 28017, 28018 and 28019 ports
  - Fix labeling for /etc/dhcp directory
  - add missing systemd_stub_unit_file() interface
  - Add files_stub_var() interface
  - Add lables for cert_t directories
  - Make localectl set-x11-keymap working at all
  - Allow abrt to manage mock build environments to catch build problems.
  - Allow virt_domains to setsched for running gdb on itself
  - Allow thumb_t to execute user home content
  - Allow pulseaudio running as mozilla_plugin_t to read /run/systemd/users/1000
  - Allow certwatch to execut /usr/bin/httpd
  - Allow cgred to send signal perms to itself, needs back port to RHEL6
  - Allow openshift_cron_t to look at quota
  - Allow cups_t to read inhered tmpfs_t from the kernel
  - Allow yppasswdd to use NIS
  - Tuned wants sys_rawio capability
  - Add ftpd_use_fusefs boolean
  - Allow dirsrvadmin_t to signal itself


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-25
changelog:
  - Allow realmd to create tmp files
  - FIx ircssi_home_t type to irssi_home_t
  - Allow adcli running as realmd_t to connect to ldap port
  - Allow NetworkManager to transition to ipsec_t, for running strongswan
  - Make openshift_initrc_t an lxc_domain
  - Allow gssd to manage user_tmp_t files
  - Fix handling of irclogs in users homedir
  - Fix labeling for drupal an wp-content in subdirs of /var/www/html
  - Allow abrt to read utmp_t file
  - Fix openshift policy to transition lnk_file, sock-file an fifo_file when created in a tmpfs_t, needs back port to RHEL6
  - fix labeling for (oo|rhc)-restorer-wrapper.sh
  - firewalld needs to be able to write to network sysctls
  - Fix mozilla_plugin_dontaudit_rw_sem() interface
  - Dontaudit generic ipc read/write to a mozilla_plugin for sandbox_x domains
  - Add mozilla_plugin_dontaudit_rw_sem() interface
  - Allow svirt_lxc_t to transition to openshift domains
  - Allow condor domains block_suspend and dac_override caps
  - Allow condor_master to read passd
  - Allow condor_master to read system state
  - Allow NetworkManager to transition to ipsec_t, for running strongswan
  - Lots of access required by lvm_t to created encrypted usb device
  - Allow xdm_t to dbus communicate with systemd_localed_t
  - Label strongswan content as ipsec_exec_mgmt_t for now
  - Allow users to dbus chat with systemd_localed
  - Fix handling of .xsession-errors in xserver.if, so kde will work
  - Might be a bug but we are seeing avc's about people status on init_t:service
  - Make sure we label content under /var/run/lock as <<none>>
  - Allow daemon and systemprocesses to search init_var_run_t directory
  - Add boolean to allow xdm to write xauth data to the home directory
  - Allow mount to write keys for the unconfined domain
  - Add unconfined_write_keys() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-26
changelog:
  - Try to label on controlC devices up to 30 correctly
  - Add mount_rw_pid_files() interface
  - Add additional mount/umount interfaces needed by mock
  - fsadm_t sends audit messages in reads kernel_ipc_info when doing livecd-iso-to-disk
  - Fix tabs
  - Allow initrc_domain to search rgmanager lib files
  - Add more fixes which make mock working together with confined users
    * Allow mock_t to manage rpm files
    * Allow mock_t to read rpm log files
    * Allow mock to setattr on tmpfs, devpts
    * Allow mount/umount filesystems
  - Add rpm_read_log() interface
  - yum-cron runs rpm from within it.
  - Allow tuned to transition to dmidecode
  - Allow firewalld to do net_admin
  - Allow mock to unmont tmpfs_t
  - Fix virt_sigkill() interface
  - Add additional fixes for mock. Mainly caused by mount running in mock_t
  - Allow mock to write sysfs_t and mount pid files
  - Add mailman_domain to mailman_template()
  - Allow openvswitch to execute shell
  - Allow qpidd to use kerberos
  - Allow mailman to use fusefs, needs back port to RHEL6
  - Allow apache and its scripts to use anon_inodefs
  - Add alias for git_user_content_t and git_sys_content_t so that RHEL6 will update to RHEL7
  - Realmd needs to connect to samba ports, needs back port to F18 also
  - Allow colord to read /run/initial-setup-
  - Allow sanlock-helper to send sigkill to virtd which is registred to sanlock
  - Add virt_kill() interface
  - Add rgmanager_search_lib() interface
  - Allow wdmd to getattr on all filesystems. Back ported from RHEL6


author: Dan Walsh <dwalsh@redhat.com> 3.12.1-28
changelog:
  - Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean
  - Fixes for dlm_controld
  - Fix apache_read_sys_content_rw_dirs() interface
  - Allow logrotate to read /var/log/z-push dir
  - Allow postfix_postdrop to acces postfix_public socket
  - Allow sched_setscheduler for cupsd_t
  - Add missing context for /usr/sbin/snmpd
  - Allow consolehelper more access discovered by Tom London
  - Allow fsdaemon to send signull to all domain
  - Add port definition for osapi_compute port
  - Allow unconfined to create /etc/hostname with correct labeling
  - Add systemd_filetrans_named_hostname() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-29
changelog:
  - Add mising nslcd_dontaudit_write_sock_file() interface
  - one more fix
  - Fix pki_read_tomcat_lib_files() interface
  - Allow certmonger to read pki-tomcat lib files
  - Allow certwatch to execute bin_t
  - Allow snmp to manage /var/lib/net-snmp files
  - Don't audit attempts to write to stream socket of nscld by thumbnailers
  - Allow git_system_t to read network state
  - Allow pegasas to execute mount command
  - Fix desc for drdb_admin
  - Fix condor_amin()
  - Interface fixes for uptime, vdagent, vnstatd
  - Fix labeling for moodle in /var/www/moodle/data
  - Add interface fixes
  - Allow bugzilla to read certs
  - /var/www/moodle needs to be writable by apache
  - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest
  - Fix namespace_init_t to create content with proper labels, and allow it to manage all user content
  - Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean
  - Fixes for dlm_controld
  - Fix apache_read_sys_content_rw_dirs() interface
  - Allow logrotate to read /var/log/z-push dir
  - Fix sys_nice for cups_domain
  - Allow postfix_postdrop to acces postfix_public socket
  - Allow sched_setscheduler for cupsd_t
  - Add missing context for /usr/sbin/snmpd
  - Kernel_t needs mac_admin in order to support labeled NFS
  - Fix systemd_dontaudit_dbus_chat() interface
  - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest
  - Allow consolehelper domain to write Xauth files in /root
  - Add port definition for osapi_compute port
  - Allow unconfined to create /etc/hostname with correct labeling
  - Add systemd_filetrans_named_hostname() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-30
changelog:
  - Allow alsa_t signal_perms, we probaly should search for any app that can execute something without transition and give it signal_perms...
  - Add dontaudit for mozilla_plugin_t looking at the xdm_t sockets
  - Fix deny_ptrace boolean, certain ptrace leaked into the system
  - Allow winbind to manage kerberos_rcache_host
  - Allow spamd to create spamd_var_lib_t directories
  - Remove transition to mozilla_tmp_t by mozilla_t, to allow it to manage the users tmp dirs
  - Add mising nslcd_dontaudit_write_sock_file() interface
  - one more fix
  - Fix pki_read_tomcat_lib_files() interface
  - Allow certmonger to read pki-tomcat lib files
  - Allow certwatch to execute bin_t
  - Allow snmp to manage /var/lib/net-snmp files
  - Call snmp_manage_var_lib_files(fogorn_t) instead of snmp_manage_var_dirs
  - Fix vmware_role() interface
  - Fix cobbler_manage_lib_files() interface
  - Allow nagios check disk plugins to execute bin_t
  - Allow quantum to transition to openvswitch_t
  - Allow postdrop to stream connect to postfix-master
  - Allow quantum to stream connect to openvswitch
  - Add xserver_dontaudit_xdm_rw_stream_sockets() interface
  - Allow daemon to send dgrams to initrc_t
  - Allow kdm to start the power service to initiate a reboot or poweroff


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-31
changelog:
  - Fix description of deny_ptrace boolean
  - Remove allow for execmod lib_t for now
  - Allow quantum to connect to keystone port
  - Allow nova-console to talk with mysql over unix stream socket
  - Allow dirsrv to stream connect to uuidd
  - thumb_t needs to be able to create ~/.cache if it does not exist
  - virtd needs to be able to sys_ptrace when starting and stoping containers


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-32
changelog:
  - Allow realmd to run ipa, really needs to be an unconfined_domain
  - Allow sandbox domains to use inherted terminals
  - Allow pscd to use devices labeled svirt_image_t in order to use cat cards.
  - Add label for new alsa pid
  - Alsa now uses a pid file and needs to setsched 
  - Fix oracleasmfs_t definition
  - Add support for sshd_unit_file_t
  - Add oracleasmfs_t
  - Allow unlabeled_t files to be stored on unlabeled_t filesystems


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-33
changelog:
  - Fix mozilla specification of homedir content
  - Allow certmonger to read network state
  - Allow tmpwatch to read tmp in /var/spool/{cups,lpd}
  - Label all nagios plugin as unconfined by default
  - Add httpd_serve_cobbler_files()
  - Allow mdadm to read /dev/sr0 and create tmp files
  - Allow certwatch to send mails
  - Fix labeling for nagios plugins
  - label shared libraries in /opt/google/chrome as testrel_shlib_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-35
changelog:
  - Fix lockdev_manage_files()
  - Allow setroubleshootd to read var_lib_t to make email_alert working
  - Add lockdev_manage_files()
  - Call proper interface in virt.te
  - Allow gkeyring_domain to create /var/run/UID/config/dbus file
  - system dbus seems to be blocking suspend
  - Dontaudit attemps to sys_ptrace, which I believe gpsd does not need
  - When you enter a container from root, you generate avcs with a leaked file descriptor
  - Allow mpd getattr on file system directories
  - Make sure realmd creates content with the correct label
  - Allow systemd-tty-ask to write kmsg
  - Allow mgetty to use lockdev library for device locking
  - Fix selinuxuser_user_share_music boolean name to selinuxuser_share_music
  - When you enter a container from root, you generate avcs with a leaked file descriptor
  - Make sure init.fc files are labeled correctly at creation
  - File name trans vconsole.conf
  - Fix labeling for nagios plugins
  - label shared libraries in /opt/google/chrome as testrel_shlib_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-37
changelog:
  - Allow lvm to create its own unit files
  - Label /var/lib/sepolgen as selinux_config_t
  - Add filetrans rules for tw devices
  - Add transition from cupsd_config_t to cupsd_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-38
changelog:
  - Allow thumbnails to share memory with apps which run thumbnails
  - Allow postfix-postqueue block_suspend
  - Add lib interfaces for smsd
  - Add support for nginx
  - Allow s2s running as jabberd_t to connect to jabber_interserver_port_t
  - Allow pki apache domain to create own tmp files and execute httpd_suexec
  - Allow procmail to manger user tmp files/dirs/lnk_files
  - Add virt_stream_connect_svirt() interface
  - Allow dovecot-auth to execute bin_t
  - Allow iscsid to request that kernel load a kernel module
  - Add labeling support for /var/lib/mod_security
  - Allow iw running as tuned_t to create netlink socket
  - Dontaudit sys_tty_config for thumb_t
  - Add labeling for nm-l2tp-service
  - Allow httpd running as certwatch_t to open tcp socket
  - Allow useradd to manager smsd lib files
  - Allow useradd_t to add homedirs in /var/lib
  - Fix typo in userdomain.te
  - Cleanup userdom_read_home_certs
  - Implement userdom_home_reader_certs_type to allow read certs also on encrypt /home with ecryptfs_t
  - Allow staff to stream connect to svirt_t to make gnome-boxes working


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-39
changelog:
  - Allow tcpd to execute leafnode
  - Allow samba-net to read realmd cache files
  - Dontaudit sys_tty_config for alsactl
  - Fix allow rules for postfix_var_run
  - Allow cobblerd to read /etc/passwd
  - Allow pegasus to read exports
  - Allow systemd-timedate to read xdm state
  - Allow mout to stream connect to rpcbind
  - Add labeling just for /usr/share/pki/ca-trust-source instead of /usr/share/pki


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-41
changelog:
  - Remove userdom_home_manager for xdm_t and move all rules to xserver.te directly
  - Add new xdm_write_home boolean to allow xdm_t to create files in HOME dirs with xdm_home_t
  - Allow postfix-showq to read/write unix.showq in /var/spool/postfix/pid
  - Allow virsh to read xen lock file
  - Allow qemu-ga to create files in /run with proper labeling
  - Allow glusterd to connect to own socket in /tmp
  - Allow glance-api to connect to http port to make glance image-create working
  - Allow keystonte_t to execute rpm


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-42
changelog:
  - Allow samba-net to also read realmd tmp files
  - Allow NUT to use serial ports
  - realmd can be started by systemctl now


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-43
changelog:
  - Transition directories and files when in a user_tmp_t directory
  - Change certwatch to domtrans to apache instead of just execute
  - Allow virsh_t to read xen lib files
  - update policy rules for pegasus_openlmi_account_t
  - Add support for svnserve_tmp_t
  - Activate account openlmi policy
  - pegasus_openlmi_domain_template needs also require pegasus_t
  - One more fix for policykit.te
  - Call fs_list_cgroups_dirs() in policykit.te
  - Allow nagios service plugin to read mysql config files
  - Add labeling for /var/svn
  - Fix chrome.te
  - Fix pegasus_openlmi_domain_template() interfaces
  - Fix dev_rw_vfio_dev definiton, allow virtd_t to read tmpfs_t symlinks
  - Fix location of google-chrome data
  - Add support for chome_sandbox to store content in the homedir
  - Allow policykit to watch for changes in cgroups file system
  - Add boolean to allow  mozilla_plugin_t to use spice
  - Allow collectd to bind to udp port
  - Allow collected_t to read all of /proc
  - Should use netlink socket_perms
  - Should use netlink socket_perms
  - Allow glance domains to connect to apache ports
  - Allow apcupsd_t to manage its log files
  - Allow chrome objects to rw_inherited unix_stream_socket from callers
  - Allow staff_t to execute virtd_exec_t for running vms
  - nfsd_t needs to bind mountd port to make nfs-mountd.service working
  - Allow unbound net_admin capability because of setsockopt syscall
  - Fix fs_list_cgroup_dirs()
  - Label /usr/lib/nagios/plugins/utils.pm as bin_t
  - Remove uplicate definition of fs_read_cgroup_files()
  - Remove duplicate definition of fs_read_cgroup_files()
  - Add files_mountpoint_filetrans interface to be used by quotadb_t and snapperd
  - Additional interfaces needed to list and read cgroups config
  - Add port definition for collectd port
  - Add labels for /dev/ptp*
  - Allow staff_t to execute virtd_exec_t for running vms


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-44
changelog:
  - Make sure users and unconfined domains create .hushlogin with the correct label
  - Allow pegaus to chat with realmd over DBus
  - Allow cobblerd to read network state
  - Allow boicn-client to stat on /dev/input/mice
  - Allow certwatch to read net_config_t when it executes apache
  - Allow readahead to create /run/systemd and then create its own directory with the correct label


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-45
changelog:
  - Add additional fixes for #948073 bug
  - Allow sge_execd_t to also connect to sge ports
  - Allow openshift_cron_t to manage openshift_var_lib_t sym links
  - Allow openshift_cron_t to manage openshift_var_lib_t sym links
  - Allow sge_execd to bind sge ports. Allow kill capability and reads cgroup files
  - Remove pulseaudio filetrans pulseaudio_manage_home_dirs which is a part of pulseaudio_manage_home_files
  - Add networkmanager_stream_connect()
  - Make gnome-abrt wokring with staff_t
  - Fix openshift_manage_lib_files() interface
  - mdadm runs ps command which seems to getattr on random log files
  - Allow mozilla_plugin_t to create pulseaudit_home_t directories
  - Allow qemu-ga to shutdown virtual hosts
  - Add labelling for cupsd-browsed
  - Add web browser plugins to connect to aol ports
  - Allow nm-dhcp-helper to stream connect to NM
  - Add port definition for sge ports


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-46
changelog:
  - Dontaudit to getattr on dirs for dovecot-deliver
  - Allow raiudusd server connect to postgresql socket
  - Add kerberos support for radiusd
  - Allow saslauthd to connect to ldap port
  - Allow postfix to manage postfix_private_t files
  - Add chronyd support for #965457
  - Fix labeling for HOME_DIR/\.icedtea
  - CHange squid and snmpd to be allowed also write own logs
  - Fix labeling for /usr/libexec/qemu-ga
  - Allow virtd_t to use virt_lock_t
  - Allow also sealert to read the policy from the kernel
  - qemu-ga needs to execute scripts in /usr/libexec/qemu-ga and to use /tmp content
  - Dontaudit listing of users homedir by sendmail Seems like a leak
  - Allow passenger to transition to puppet master
  - Allow apache to connect to mythtv
  - Add definition for mythtv ports


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-47
changelog:
  - Add transition rules to unconfined domains and to sysadm_t to create /etc/adjtime
  - with the proper label.
  - Update files_filetrans_named_content() interface to get right labeling for pam.d conf files
  - Allow systemd-timedated to create adjtime
  - Add clock_create_adjtime()
  - Additional fix ifconfing for #966106
  - Allow kernel_t to create boot.log with correct labeling
  - Remove unconfined_mplayer for which we don't have rules
  - Rename interfaces
  - Add userdom_manage_user_home_files/dirs interfaces
  - Fix files_dontaudit_read_all_non_security_files
  - Fix ipsec_manage_key_file()
  - Fix ipsec_filetrans_key_file()
  - Label /usr/bin/razor-lightdm-greeter as xdm_exec_t instead of spamc_exec_t
  - Fix labeling for ipse.secrets
  - Add interfaces for ipsec and labeling for ipsec.info and ipsec_setup.pid
  - Add files_dontaudit_read_all_non_security_files() interface
  - /var/log/syslog-ng should be labeled var_log_t
  - Make ifconfig_var_run_t a mountpoint
  - Add transition from ifconfig to dnsmasq
  - Allow ifconfig to execute bin_t/shell_exec_t
  - We want to have hwdb.bin labeled as etc_t
  - update logging_filetrans_named_content() interface
  - Allow systemd_timedate_t to manage /etc/adjtime
  - Allow NM to send signals to l2tpd
  - Update antivirus_can_scan_system boolean
  - Allow devicekit_disk_t to sys_config_tty
  - Run abrt-harvest programs as abrt_t, and allow abrt_t to list all filesystem directories
  - Make printing from vmware working
  - Allow php-cgi from php54 collection to access /var/lib/net-snmp/mib_indexes
  - Add virt_qemu_ga_data_t for qemu-ga
  - Make chrome and mozilla able to connect to same ports, add jboss_management_port_t to both
  - Fix typo in virt.te
  - Add virt_qemu_ga_unconfined_t for hook scripts
  - Make sure NetworkManager files get created with the correct label
  - Add mozilla_plugin_use_gps boolean
  - Fix cyrus to have support for net-snmp
  - Additional fixes for dnsmasq and quantum for #966106
  - Add plymouthd_create_log()
  - remove httpd_use_oddjob for which we don't have rules
  - Add missing rules for httpd_can_network_connect_cobbler
  - Add missing cluster_use_execmem boolean
  - Call userdom_manage_all_user_home_type_files/dirs
  - Additional fix for ftp_home_dir
  - Fix ftp_home_dir boolean
  - Allow squit to recv/send client squid packet
  - Fix nut.te to have nut_domain attribute
  - Add support for ejabberd; TODO: revisit jabberd and rabbit policy
  - Fix amanda policy
  - Add more fixes for domains which use libusb
  - Make domains which use libusb working correctly
  - Allow l2tpd to create ipsec key files with correct labeling and manage them
  - Fix cobbler_manage_lib_files/cobbler_read_lib_files to cover also lnk files
  - Allow rabbitmq-beam to bind generic node
  - Allow l2tpd to read ipse-mgmt pid files
  - more fixes for l2tpd, NM and pppd from #967072


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-48
changelog:
  - Fix openshift_search_lib
  - Add support for abrt-uefioops-oops
  - Allow colord to getattr any file system
  - Allow chrome processes to look at each other
  - Allow sys_ptrace for abrt_t
  - Add new policy for gssproxy
  - Dontaudit leaked file descriptor writes from firewalld
  - openshift_net_type is interface not template
  - Dontaudit pppd to search gnome config
  - Update openshift_search_lib() interface
  - Add fs_list_pstorefs()
  - Fix label on libbcm_host.so since it is built incorrectly on raspberry pi, needs back port to F18
  - Better labels for raspberry pi devices
  - Allow init to create devpts_t directory
  - Temporarily label rasbery pi devices as memory_device_t, needs back port to f18
  - Allow sysadm_t to build kernels
  - Make sure mount creates /var/run/blkid with the correct label, needs back port to F18
  - Allow userdomains to stream connect to gssproxy
  - Dontaudit leaked file descriptor writes from firewalld
  - Allow xserver to read /dev/urandom
  - Add additional fixes for ipsec-mgmt
  - Make SSHing into an Openshift Enterprise Node working


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-49
changelog:
  - Fix courier_domain_template() interface
  - Allow blueman to write ip_forward
  - Allow mongodb to connect to mongodb port
  - Allow mongodb to connect to mongodb port
  - Allow java to bind jobss_debug port
  - Fixes for *_admin interfaces
  - Allow iscsid auto-load kernel modules needed for proper iSCSI functionality
  - Need to assign attribute for courier_domain to all courier_domains
  - Fail2ban reads /etc/passwd
  - postfix_virtual will create new files in postfix_spool_t
  - abrt triggers sys_ptrace by running pidof
  - Label ~/abc as mozilla_home_t, since java apps as plugin want to create it
  - Add passenger fixes needed by foreman
  - Remove dup interfaces
  - Add additional interfaces for quantum
  - Add new interfaces for dnsmasq
  - Allow  passenger to read localization and send signull to itself
  - Allow dnsmasq to stream connect to quantum
  - Add quantum_stream_connect()
  - Make sure that mcollective starts the service with the correct labeling
  - Add labels for ~/.manpath
  - Dontaudit attempts by svirt_t to getpw* calls
  - sandbox domains are trying to look at parent process data
  - Allow courior auth to create its pid file in /var/spool/courier subdir
  - Add fixes for beam to have it working with couchdb
  - Add labeling for /run/nm-xl2tpd.con
  - Allow apache to stream connect to thin
  - Add systemd support for amand
  - Make public types usable for fs mount points
  - Call correct mandb interface in domain.te
  - Allow iptables to r/w quantum inherited pipes and send sigchld
  - Allow ifconfig domtrans to iptables and execute ldconfig
  - Add labels for ~/.manpath
  - Allow systemd to read iscsi lib files
  - seunshare is trying to look at parent process data


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-50
changelog:
  - Allow wine to manage wine home content
  - Make amanda working with socket actiovation
  - Add labeling for /usr/sbin/iscsiadm
  - Add support for /var/run/gssproxy.sock
  - dnsmasq_t needs to read sysctl_net_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-51
changelog:
  - accountservice watches when accounts come and go in wtmp
  - /usr/java/jre1.7.0_21/bin/java needs to create netlink socket
  - Add httpd_use_sasl boolean
  - Allow net_admin for tuned_t
  - iscsid needs sys_module to auto-load kernel modules
  - Allow blueman to read bluetooth conf
  - Add nova_manage_lib_files() interface
  - Fix mplayer_filetrans_home_content()
  - Add mplayer_filetrans_home_content()
  - mozilla_plugin_config_roles need to be able to access mozilla_plugin_config_t
  - Revert "Allow thumb_t to append inherited xdm stream socket"
  - Add iscsi_filetrans_named_content() interface
  - Allow to create .mplayer with the correct labeling for unconfined
  - Allow iscsiadmin to create lock file with the correct labeling


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-52
changelog:
  - Add labeling for /dev/tgt
  - Dontaudit leak fd from firewalld for modprobe
  - Allow runuser running as rpm_script_t to create netlink_audit socket
  - Allow mdadm to read BIOS non-volatile RAM


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-53
changelog:
  - Make vdagent able to request loading kernel module
  - Add support for cloud-init make it as unconfined domain
  - Allow snmpd to run smartctl in fsadm_t domain
  - remove duplicate openshift_search_lib() interface
  - Allow mysqld to search openshift lib files
  - Allow openshift cgroup to interact with passedin file descriptors
  - Allow colord to list directories inthe users homedir
  - aide executes prelink to check files
  - Make sure cupsd_t creates content in /etc/cups with the correct label
  - Lest dontaudit apache read all domains, so passenger will not cause this avc
  - Allow gssd to connect to gssproxy
  - systemd-tmpfiles needs to be able to raise the level to fix labeling on /run/setrans in MLS
  - Allow systemd-tmpfiles to relabel also lock files
  - Allow useradd to add homdir in /var/lib/openshift
  - Allow setfiles and semanage to write output to /run/files


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-54
changelog:
  - Don't audit access checks by sandbox xserver on xdb var_lib
  - Allow ntop to read usbmon devices
  - Add labeling for new polcykit authorizor
  - Dontaudit access checks from fail2ban_client
  - Don't audit access checks by sandbox xserver on xdb var_lib
  - Allow apps that connect to xdm stream to conenct to xdm_dbusd_t stream
  - Fix labeling for all /usr/bim/razor-lightdm-* binaries
  - Add filename trans for /dev/md126p1


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-55
changelog:
  - condor_collector uses tcp/9000
  - Label /usr/sbin/virtlockd as virtd_exec_t for now
  - Allow cobbler to execute ldconfig
  - Allow NM to execute ssh
  - Allow mdadm to read /dev/crash
  - Allow antivirus domains to connect to snmp port
  - Make amavisd-snmp working correctly
  - Allow nfsd_t to mounton nfsd_fs_t
  - Add initial snapper policy
  - We still need to have consolekit policy
  - Dontaudit firefox attempting to connect to the xserver_port_t if run within sandbox_web_t
  - Dontaudit sandbox apps attempting to open user_devpts_t
  - Allow dirsrv to read network state
  - Fix pki_read_tomcat_lib_files
  - Add labeling for /usr/libexec/nm-ssh-service
  - Add label cert_t for /var/lib/ipa/pki-ca/publish
  - Lets label /sys/fs/cgroup as cgroup_t for now, to keep labels consistant
  - Allow nfsd_t to mounton nfsd_fs_t
  - Dontaudit sandbox apps attempting to open user_devpts_t
  - Allow passwd_t to change role to system_r from unconfined_r


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-56
changelog:
  - Allow lvm_t to create default targets for filesystem handling
  - Fix labeling for razor-lightdm binaries
  - Allow insmod_t to read any file labeled var_lib_t
  - Add policy for pesign
  - Activate policy for cmpiLMI_Account-cimprovagt
  - Allow isnsd syscall=listen
  - /usr/libexec/pegasus/cimprovagt needs setsched caused by sched_setscheduler
  - Allow ctdbd to use udp/4379
  - gatherd wants sys_nice and setsched
  - Add support for texlive2012
  - Allow NM to read file_t (usb stick with no labels used to transfer keys for example)
  - Allow cobbler to execute apache with domain transition


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-57
changelog:
  - Make DSPAM to act as a LDA working
  - Allow ntop to create netlink socket
  - Allow policykit to send a signal to policykit-auth
  - Allow stapserver to dbus chat with avahi/systemd-logind
  - Fix labeling on haproxy unit file
  - Clean up haproxy policy
  - A new policy for haproxy and placed it to rhcs.te
  - Add support for ldirectord and treat it with cluster_t
  - Make sure anaconda log dir is created with var_log_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-58
changelog:
  - Shrink the size of policy by moving to attributes, also add dridomain so that mozilla_plugin can follow selinuxuse_dri boolean. 
  - Allow bootloader to manage generic log files 
  - Allow ftp to bind to port 989 
  - Fix label of new gear directory 
  - Add support for new directory /var/lib/openshift/gears/ 
  - Add openshift_manage_lib_dirs() 
  - allow virtd domains to manage setrans_var_run_t 
  - Allow useradd to manage all openshift content 
  - Add support so that mozilla_plugin_t can use dri devices 
  - Allow chronyd to change the scheduler 
  - Allow apmd to shut downthe system 
  - Devicekit_disk_t needs to manage /etc/fstab


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-59
changelog:
  - Add prosody policy written by Michael Scherer
  - Allow nagios plugins to read /sys info
  - ntpd needs to manage own log files
  - Add support for HOME_DIR/.IBMERS
  - Allow iptables commands to read firewalld config
  - Allow consolekit_t to read utmp
  - Fix filename transitions on .razor directory
  - Add additional fixes to make DSPAM with LDA working
  - Allow snort to read /etc/passwd
  - Allow fail2ban to communicate with firewalld over dbus
  - Dontaudit openshift_cgreoup_file_t read/write leaked dev
  - Allow nfsd to use mountd port
  - Call th proper interface
  - Allow openvswitch to read sys and execute plymouth
  - Allow tmpwatch to read /var/spool/cups/tmp
  - Add support for /usr/libexec/telepathy-rakia
  - Add systemd support for zoneminder
  - Allow mysql to create files/directories under /var/log/mysql
  - Allow zoneminder apache scripts to rw zoneminder tmpfs
  - Allow httpd to manage zoneminder lib files
  - Add zoneminder_run_sudo boolean to allow to start zoneminder
  - Allow zoneminder to send mails
  - gssproxy_t sock_file can be under /var/lib
  - Allow web domains to connect to whois port.
  - Allow sandbox_web_type to connect to the same ports as mozilla_plugin_t.
  - We really need to add an interface to corenet to define what a web_client_domain is and
  - then define chrome_sandbox_t, mozilla_plugin_t and sandbox_web_type to that domain.
  - Add labeling for cmpiLMI_LogicalFile-cimprovagt
  - Also make pegasus_openlmi_logicalfile_t as unconfined to have unconfined_domain attribute for filename trans rules
  - Update policy rules for pegasus_openlmi_logicalfile_t
  - Add initial types for logicalfile/unconfined OpenLMI providers
  - mailmanctl needs to read own log
  - Allow logwatch manage own lock files
  - Allow nrpe to read meminfo
  - Allow httpd to read certs located in pki-ca
  - Add pki_read_tomcat_cert() interface
  - Add support for nagios openshift plugins
  - Add port definition for redis port
  - fix selinuxuser_use_ssh_chroot boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-60
changelog:
  - Allow nsd_t to read /dev/urand
  - Allow mdadm_t to read framebuffer
  - Allow rabbitmq_beam_t to read process info on rabbitmq_epmd_t
  - Allow mozilla_plugin_config_t to create tmp files
  - Cleanup openvswitch policy
  - Allow mozilla plugin to getattr on all executables
  - Allow l2tpd_t to create fifo_files in /var/run
  - Allow samba to touch/manage fifo_files or sock_files in a samba_share_t directory
  - Allow mdadm to connecto its own unix_stream_socket
  - FIXME: nagios changed locations to /log/nagios which is wrong. But we need to have this workaround for now.
  - Allow apache to access smokeping pid files
  - Allow rabbitmq_beam_t to getattr on all filesystems
  - Add systemd support for iodined
  - Allow nup_upsdrvctl_t to execute its entrypoint
  - Allow fail2ban_client to write to fail2ban_var_run_t, Also allow it to use nsswitch
  - add labeling for ~/.cache/libvirt-sandbox
  - Add interface to allow domains transitioned to by confined users to send sigchld to screen program
  - Allow sysadm_t to check the system status of files labeled etc_t, /etc/fstab
  - Allow systemd_localed to start /usr/lib/systemd/system/systemd-vconsole-setup.service
  - Allow an domain that has an entrypoint from a type to be allowed to execute the entrypoint without a transition,  I can see no case where this is  a bad thing, and elminiates a whole class of AVCs.
  - Allow staff to getsched all domains, required to run htop
  - Add port definition for redis port
  - fix selinuxuser_use_ssh_chroot boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-61
changelog:
  - Allow mdamd to execute systemctl
  - Allow mdadm to read /dev/kvm
  - Allow ipsec_mgmt_t to read l2tpd pid content


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-64
changelog:
  - Add support for gluster ports
  - Make sure that all keys located in /etc/ssh/ are labeled correctly
  - Make sure apcuspd lock files get created with the correct label
  - Use getcap in gluster.te
  - Fix gluster policy
  - add additional fixes to allow beam.smp to interact with couchdb files
  - Additional fix for #974149
  - Allow gluster to user gluster ports
  - Allow glusterd to transition to rpcd_t and add additional fixes for #980683
  - Allow tgtd working when accessing to the passthrough device
  - Fix labeling for mdadm unit files


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-65
changelog:
  - Label /var/lib/ipa/pki-ca/publish as pki_tomcat_cert_t
  - Add labeling for /usr/libexec/kde4/polkit-kde-authentication-agent-1
  - Allow all domains that can domtrans to shutdown, to start the power services script to shutdown
  - consolekit needs to be able to shut down system
  - Move around interfaces
  - Remove nfsd_rw_t and nfsd_ro_t, they don't do anything
  - Add additional fixes for rabbitmq_beam to allow getattr on mountpoints
  - Allow gconf-defaults-m to read /etc/passwd
  - Fix pki_rw_tomcat_cert() interface to support lnk_files


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-66
changelog:
  - Allow systemd-tmpfile to handle tmp content in print spool dir
  - Allow systemd-sysctl to send system log messages
  - Add support for RTP media ports and fmpro-internal
  - Make auditd working if audit is configured to perform SINGLE action on disk error
  - Add interfaces to handle systemd units
  - Make systemd-notify working if pcsd is used
  - Add support for netlabel and label /usr/sbin/netlabelctl as iptables_exec_t
  - Instead of having all unconfined domains get all of the named transition rules,
  - Only allow unconfined_t, init_t, initrc_t and rpm_script_t by default.
  - Add definition for the salt ports
  - Allow xdm_t to create link files in xdm_var_run_t
  - Dontaudit reads of blk files or chr files leaked into ldconfig_t
  - Allow sys_chroot for useradd_t
  - Allow net_raw cap for ipsec_t
  - Allow sysadm_t to reload services
  - Add additional fixes to make strongswan working with a simple conf
  - Allow sysadm_t to enable/disable init_t services
  - Add additional glusterd perms
  - Allow apache to read lnk files in the /mnt directory
  - Allow glusterd to ask the kernel to load a module
  - Fix description of ftpd_use_fusefs boolean
  - Allow svirt_lxc_net_t to sys_chroot, modify policy to tighten up svirt_lxc_domain capabilties and process controls, but add them to svirt_lxc_net_t
  - Allow glusterds to request load a kernel module
  - Allow boinc to stream connect to xserver_t
  - Allow sblim domains to read /etc/passwd
  - Allow mdadm to read usb devices
  - Allow collectd to use ping plugin
  - Make foghorn working with SNMP
  - Allow sssd to read ldap certs
  - Allow haproxy to connect to RTP media ports
  - Add additional trans rules for aide_db
  - Add labeling for /usr/lib/pcsd/pcsd
  - Add labeling for /var/log/pcsd
  - Add support for pcs which is a corosync and pacemaker configuration tool


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-67
changelog:
  - Add support for cmpiLMI_Service-cimprovagt
  - Allow pegasus domtrans to rpm_t to make pycmpiLMI_Software-cimprovagt running as rpm_t
  - Label pycmpiLMI_Software-cimprovagt as rpm_exec_t
  - Add support for pycmpiLMI_Storage-cimprovagt
  - Add support for cmpiLMI_Networking-cimprovagt
  - Allow system_cronjob_t to create user_tmpfs_t to make pulseaudio working
  - Allow virtual machines and containers to run as user doains, needed for virt-sandbox
  - Allow buglist.cgi to read cpu info


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-68
changelog:
  - Allow xdm_t to act as a dbus client to itsel
  - Allow fetchmail to resolve host names
  - Allow gnupg apps to write to pcscd socket
  - Add labeling for cmpiLMI_Fan-cimprovagt
  - Allow net_admin for glusterd
  - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/
  - Add pegasus_openlmi_system_t
  - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te
  -httpd_t does access_check on certs


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-69
changelog:
  - Add more aliases in pegasus.te
  - Add more fixes for *_admin interfaces
  - Add interface fixes
  - Allow nscd to stream connect to nmbd
  - Allow gnupg apps to write to pcscd socket
  - Add more fixes for openlmi provides. Fix naming and support for additionals
  - Allow fetchmail to resolve host names
  - Allow firewalld to interact also with lnk files labeled as firewalld_etc_rw_t
  - Add labeling for cmpiLMI_Fan-cimprovagt
  - Allow net_admin for glusterd
  - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/
  - Add pegasus_openlmi_system_t
  - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te
  - Fix corecmd_exec_chroot()
  - Fix logging_relabel_syslog_pid_socket interface
  - Fix typo in unconfineduser.te
  - Allow system_r to access unconfined_dbusd_t to run hp_chec


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-70
changelog:
  - selinux_set_enforce_mode needs to be used with type
  - Add append to the dontaudit for unix_stream_socket of xdm_t leak
  - Allow xdm_t to create symlinks in log direcotries
  - Allow login programs to read afs config
  - Label 10933 as a pop port, for dovecot
  - New policy to allow selinux_server.py to run as semanage_t as a dbus service
  - Add fixes to make netlabelctl working on MLS
  - AVCs required for running sepolicy gui as staff_t
  - Dontaudit attempts to read symlinks, sepolicy gui is likely to cause this type of AVC
  - New dbus server to be used with new gui
  - After modifying some files in /etc/mail, I saw this needed on the next boot
  - Loading a vm from /usr/tmp with virt-manager
  - Clean up oracleasm policy for Fedora
  - Add oracleasm policy written by rlopez@redhat.com
  - Make postfix_postdrop_t as mta_agent to allow domtrans to system mail if it is executed by apache
  - Add label for /var/crash
  - Allow fenced to domtrans to sanclok_t
  - Allow nagios to manage nagios spool files
  - Make tfptd as home_manager
  - Allow kdump to read kcore on MLS system
  - Allow mysqld-safe sys_nice/sys_resource caps
  - Allow apache to search automount tmp dirs if http_use_nfs is enabled
  - Allow crond to transition to named_t, for use with unbound
  - Allow crond to look at named_conf_t, for unbound
  - Allow mozilla_plugin_t to transition its home content
  - Allow dovecot_domain to read all system and network state
  - Allow httpd_user_script_t to call getpw
  - Allow semanage to read pid files
  - Dontaudit leaked file descriptors from user domain into thumb
  - Make PAM authentication working if it is enabled in ejabberd
  - Add fixes for rabbit to fix ##992920,#992931
  - Allow glusterd to mount filesystems
  - Loading a vm from /usr/tmp with virt-manager
  - Trying to load a VM I got an AVC from devicekit_disk for loopcontrol device
  - Add fix for pand service
  - shorewall touches own log
  - Allow nrpe to list /var
  - Mozilla_plugin_roles can not be passed into lpd_run_lpr
  - Allow afs domains to read afs_config files
  - Allow login programs to read afs config
  - Allow virt_domain to read virt_var_run_t symlinks
  - Allow smokeping to send its process signals
  - Allow fetchmail to setuid
  - Add kdump_manage_crash() interface
  - Allow abrt domain to write abrt.socket


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-71
changelog:
  - Allow boinc to connect to  @/tmp/.X11-unix/X0
  - Allow beam.smp to connect to tcp/5984
  - Allow named to manage own log files
  - Add label for /usr/libexec/dcc/start-dccifd  and domtrans to dccifd_t
  - Add virt_transition_userdomain boolean decl
  - Allow httpd_t to sendto unix_dgram sockets on its children
  - Allow nova domains to execute ifconfig
  - bluetooth wants to create fifo_files in /tmp
  - exim needs to be able to manage mailman data
  - Allow sysstat to getattr on all file systems
  - Looks like bluetoothd has moved
  - Allow collectd to send ping packets
  - Allow svirt_lxc domains to getpgid
  - Remove virt-sandbox-service labeling as virsh_exec_t, since it no longer does virsh_t stuff
  - Allow frpintd_t to read /dev/urandom
  - Allow asterisk_t to create sock_file in /var/run
  - Allow usbmuxd to use netlink_kobject
  - sosreport needs to getattr on lots of devices, and needs access to netlink_kobject_uevent_socket
  - More cleanup of svirt_lxc policy
  - virtd_lxc_t now talks to dbus
  - Dontaudit leaked ptmx_t
  - Allow processes to use inherited fifo files
  - Allow openvpn_t to connect to squid ports
  - Allow prelink_cron_system_t to ask systemd to reloaddd miscfiles_dontaudit_access_check_cert()
  - Allow ssh_t to use /dev/ptmx
  - Make sure /run/pluto dir is created with correct labeling
  - Allow syslog to run shell and bin_t commands
  - Allow ip to relabel tun_sockets
  - Allow mount to create directories in files under /run
  - Allow processes to use inherited fifo files
  - Allow user roles to connect to the journal socket


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-72
changelog:
  - Add policy for lsmd
  - Add support for /var/log/mariadb dir and allow mysqld_safe to list this directory
  - Update condor_master rules to allow read system state info and allow logging
  - Add labeling for /etc/condor and allow condor domain to write it (bug)
  - Allow condor domains to manage own logs
  - Allow glusterd to read domains state
  - Fix initial hypervkvp policy
  - Add policy for hypervkvpd
  - Fix redis.if summary


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-73
changelog:
  0 
  - Allow rhsmcertd to read init state
  - Allow fsetid for pkcsslotd
  - Fix labeling for /usr/lib/systemd/system/pkcsslotd.service
  - Allow fetchmail to create own pid with correct labeling
  - Fix rhcs_domain_template()
  - Allow roles which can run mock to read mock lib files to view results
  - Allow rpcbind to use nsswitch
  - Fix lsm.if summary
  - Fix collectd_t can read /etc/passwd file
  - Label systemd unit files under dracut correctly
  - Add support for pam_mount to mount user's encrypted home When a user logs in and logs out using ssh
  - Add support for .Xauthority-n
  - Label umount.crypt as lvm_exec_t
  - Allow syslogd to search psad lib files
  - Allow ssh_t to use /dev/ptmx
  - Make sure /run/pluto dir is created with correct labeling
  - Allow syslog to run shell and bin_t commands
  - Allow ip to relabel tun_sockets
  - Allow mount to create directories in files under /run
  - Allow processes to use inherited fifo files


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-75
changelog:
  - Also sock_file trans rule is needed in lsm
  - Fix labeling for fetchmail pid files/dirs
  - Add additional fixes for abrt-upload-watch
  - Fix polipo.te
  - Fix transition rules in asterisk policy
  - Add fowner capability to networkmanager policy
  - Allow polipo to connect to tor ports
  - Cleanup lsmd.if
  - Cleanup openhpid policy
  - Fix kdump_read_crash() interface
  - Make more domains as init domain
  - Fix cupsd.te
  - Fix requires in rpm_rw_script_inherited_pipes
  - Fix interfaces in lsm.if
  - Allow munin service plugins to manage own tmpfs files/dirs
  - Allow virtd_t also relabel unix stream sockets for virt_image_type
  - Make ktalk as init domain
  - Fix to define ktalkd_unit_file_t correctly
  - Fix ktalk.fc
  - Add systemd support for talk-server
  - Allow glusterd to create sock_file in /run
  - Allow xdm_t to delete gkeyringd_tmp_t files on logout
  - Add fixes for hypervkvp policy
  - Add logwatch_can_sendmail boolean
  - Allow mysqld_safe_t to handle also symlinks in /var/log/mariadb
  - Allow xdm_t to delete gkeyringd_tmp_t files on logout


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-76
changelog:
  - Cleanup related to init_domain()+inetd_domain fixes
  - Use just init_domain instead of init_daemon_domain in inetd_core_service_domain
  - svirt domains neeed to create kobject_uevint_sockets
  - Lots of new access required for sosreport
  - Allow tgtd_t to connect to isns ports
  - Allow init_t to transition to all inetd domains:
  - openct needs to be able to create netlink_object_uevent_sockets
  - Dontaudit leaks into ldconfig_t
  - Dontaudit su domains getattr on /dev devices, move su domains to attribute based calls
  - Move kernel_stream_connect into all Xwindow using users
  - Dontaudit inherited lock files in ifconfig o dhcpc_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-77
changelog:
  - Split out rlogin ports from inetd
  - Treat files labeld as usr_t like bin_t when it comes to transitions
  - Allow staff_t to read login config
  - Allow ipsec_t to read .google authenticator data
  - Allow systemd running as git_systemd to bind git port
  - Fix mozilla_plugin_rw_tmpfs_files()
  - Call the correct interface - corenet_udp_bind_ktalkd_port()
  - Allow all domains that can read gnome_config to read kde config
  - Allow sandbox domain to read/write mozilla_plugin_tmpfs_t so pulseaudio will work
  - Allow mdadm to getattr any file system
  - Allow a confined domain to executes mozilla_exec_t via dbus
  - Allow cupsd_lpd_t to bind to the printer port
  - Dontaudit attempts to bind to ports < 1024 when nis is turned on
  - Allow apache domain to connect to gssproxy socket
  - Allow rlogind to bind to the rlogin_port
  - Allow telnetd to bind to the telnetd_port
  - Allow ktalkd to bind to the ktalkd_port
  - Allow cvs to bind to the cvs_port


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-78
changelog:
  - Allow xdm_t to transition to itself
  - Call neutron interfaces instead of quantum
  - Allow init to change targed role to make uncofined services (xrdp which now has own systemd unit file) working. We want them to have in unconfined_t
  - Make sure directories in /run get created with the correct label
  - Make sure /root/.pki gets created with the right label
  - try to remove labeling for motion from zoneminder_exec_t to bin_t
  - Allow inetd_t to execute shell scripts
  - Allow cloud-init to read all domainstate
  - Fix to use quantum port
  - Add interface netowrkmanager_initrc_domtrans
  - Fix boinc_execmem
  - Allow t-mission-control to read gabble cache home
  - Add labeling for ~/.cache/telepathy/avatars/gabble
  - Allow memcache to read sysfs data
  - Cleanup antivirus policy and add additional fixes
  - Add boolean boinc_enable_execstack
  - Add support for couchdb in rabbitmq policy
  - Add interface couchdb_search_pid_dirs
  - Allow firewalld to read NM state
  - Allow systemd running as git_systemd to bind git port
  - Fix mozilla_plugin_rw_tmpfs_files()


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-79
changelog:
  - Allow block_suspend cap for samba-net
  - Allow t-mission-control to manage gabble cache files
  - Allow nslcd to read /sys/devices/system/cpu
  - Allow selinux_store to use symlinks


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-80
changelog:
  - Allow ldconfig to write to kdumpctl fifo files
  - allow neutron to connect to amqp ports
  - Allow kdump_manage_crash to list the kdump_crash_t directory
  - Allow glance-api to connect to amqp port
  - Allow virt_qemu_ga_t to read meminfo
  - Add antivirus_home_t type for antivirus date in HOMEDIRS
  - Allow mpd setcap which is needed by pulseaudio
  - Allow smbcontrol to create content in /var/lib/samba
  - Allow mozilla_exec_t to be used as a entrypoint to mozilla_domtrans_spec
  - Add additional labeling for qemu-ga/fsfreeze-hook.d scripts
  - amanda_exec_t needs to be executable file
  - Allow block_suspend cap for samba-net
  - Allow apps that read ipsec_mgmt_var_run_t to search ipsec_var_run_t
  - Allow init_t to run crash utility
  - Treat usr_t just like bin_t for transitions and executions
  - Add port definition of pka_ca to port 829 for openshift
  - Allow selinux_store to use symlinks


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-81
changelog:
  - Dontaudit attempts by sosreport to read shadow_t
  - Allow browser sandbox plugins to connect to cups to print
  - Add new label mpd_home_t
  - Label /srv/www/logs as httpd_log_t
  - Add support for /var/lib/php/wsdlcache
  - Add zarafa_setrlimit boolean
  - Allow fetchmail to send mails
  - Add labels for apache logs under miq package
  - Allow irc_t to use tcp sockets
  - fix labels in puppet.if
  - Allow tcsd to read utmp file
  - Allow openshift_cron_t to run ssh-keygen in ssh_keygen_t to access host keys
  - Define svirt_socket_t as a domain_type
  - Take away transition from init_t to initrc_t when executing bin_t, allow init_t to run chk_passwd_t
  - Fix label on pam_krb5 helper apps


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-82
changelog:
  - wine_tmp is no longer needed
  - Allow setroubleshoot to look at /proc
  - Allow telepathy domains to dbus with systemd logind
  - Fix handling of fifo files of rpm
  - Allow mozilla_plugin to transition to itself
  - Allow certwatch to write to cert_t directories
  - New abrt application
  - Allow NetworkManager to set the kernel scheduler
  - Make wine_domain shared by all wine domains
  - Allow mdadm_t to read images labeled svirt_image_t
  - Allow amanda to read /dev/urand
  - ALlow my_print_default to read /dev/urand
  - Allow mdadm to write to kdumpctl fifo files
  - Allow nslcd to send signull to itself
  - Allow yppasswd to read /dev/urandom
  - Fix zarafa_setrlimit
  - Add support for /var/lib/php/wsdlcache
  - Add zarafa_setrlimit boolean
  - Allow fetchmail to send mails
  - Add additional alias for user_tmp_t because wine_tmp_t is no longer used
  - More handling of ther kernel keyring required by kerberos
  - New privs needed for init_t when running without transition to initrc_t over bin_t, and without unconfined domain installed


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-84
changelog:
  - Fix labeling for /usr/libexec/kde4/kcmdatetimehelper
  - Allow tuned to search all file system directories
  - Allow alsa_t to sys_nice, to get top performance for sound management
  - Add support for MySQL/PostgreSQL for amavis
  - Allow openvpn_t to manage openvpn_var_log_t files.
  - Allow dirsrv_t to create tmpfs_t directories
  - Allow dirsrv to create dirs in /dev/shm with dirsrv_tmpfs label
  - Dontaudit leaked unix_stream_sockets into gnome keyring
  - Allow telepathy domains to inhibit pipes on telepathy domains
  - Allow cloud-init to domtrans to rpm
  - Allow abrt daemon to manage abrt-watch tmp files
  - Allow abrt-upload-watcher to search /var/spool directory
  - Allow nsswitch domains to manage own process key
  - Fix labeling for mgetty.* logs
  - Allow systemd to dbus chat with upower
  - Allow ipsec to send signull to itself
  - Allow setgid cap for ipsec_t
  - Match upstream labeling


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-86
changelog:
  - Fix nscd_shm_use()
  - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services.
  - Add hypervkvp_unit_file_t type
  - Add additional fixes forpegasus_openlmi_account_t
  - Allow mdadm to read /dev/urand
  - Allow pegasus_openlmi_storage_t to create mdadm.conf and write it
  - Add label/rules for /etc/mdadm.conf
  - Allow pegasus_openlmi_storage_t to transition to fsadm_t
  - Fixes for interface definition problems
  - Dontaudit dovecot-deliver to gettatr on all fs dirs
  - Allow domains to search data_home_t directories
  - Allow cobblerd to connect to mysql
  - Allow mdadm to r/w kdump lock files
  - Add support for kdump lock files
  - Label zarafa-search as zarafa-indexer
  - Openshift cgroup wants to read /etc/passwd
  - Add new sandbox domains for kvm
  - Allow mpd to interact with pulseaudio if mpd_enable_homedirs is turned on
  - Fix labeling for /usr/lib/systemd/system/lvm2.*
  - Add labeling for /usr/lib/systemd/system/lvm2.*
  - Fix typos to get a new build. We should not cover filename trans rules to prevent duplicate rules
  - Add sshd_keygen_t policy for sshd-keygen
  - Fix alsa_home_filetrans interface name and definition
  - Allow chown for ssh_keygen_t
  - Add fs_dontaudit_getattr_all_dirs()
  - Allow init_t to manage etc_aliases_t and read xserver_var_lib_t and chrony keys
  - Fix up patch to allow systemd to manage home content
  - Allow domains to send/recv unlabeled traffic if unlabelednet.pp is enabled
  - Allow getty to exec hostname to get info
  - Add systemd_home_t for ~/.local/share/systemd directory


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-87
changelog:
  - init reload  from systemd_localed_t
  - Allow domains that communicate with systemd_logind_sessions to use systemd_logind_t fd
  - Allow systemd_localed_t to ask systemd to reload the locale.
  - Add systemd_runtime_unit_file_t type for unit files that systemd creates in memory
  - Allow readahead to read /dev/urand
  - Fix lots of avcs about tuned
  - Any file names xenstored in /var/log should be treated as xenstored_var_log_t
  - Allow tuned to inderact with hugepages
  - Allow condor domains to list etc rw dirs


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-88
changelog:
  - Add auth_exec_chkpwd interface
  - Fix port definition for ctdb ports
  - Allow systemd domains to read /dev/urand
  - Dontaudit attempts for mozilla_plugin to append to /dev/random
  - Add label for /var/run/charon.*
  - Add labeling for /usr/lib/systemd/system/lvm2.*dd policy for motion service
  - Fix for nagios_services plugins
  - Fix some bugs in zoneminder policy
  - add type defintion for ctdbd_var_t
  - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file
  - Allow net_admin/netlink_socket all hyperv_domain domains
  - Add labeling for zarafa-search.log and zarafa-search.pid
  - glusterd binds to random unreserved ports
  - Additional allow rules found by testing glusterfs
  - apcupsd needs to send a message to all users on the system so needs to look them up
  - Fix the label on ~/.juniper_networks
  - Dontaudit attempts for mozilla_plugin to append to /dev/random
  - Allow polipo_daemon to connect to flash ports
  - Allow gssproxy_t to create replay caches
  - Fix nscd_shm_use()
  - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services.
  - Add hypervkvp_unit_file_t type


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-89
changelog:
  - Fix gnome_read_generic_data_home_files()
  - allow openshift_cgroup_t to read/write inherited openshift file types
  - Remove httpd_cobbler_content * from cobbler_admin interface
  - Allow svirt sandbox domains to setattr on chr_file and blk_file svirt_sandbox_file_t, so sshd will work within a container
  - Allow httpd_t to read also git sys content symlinks
  - Allow init_t to read gnome home data
  - Dontaudit setroubleshoot_fixit_t execmem, since it does not seem to really need it.
  - Allow virsh to execute systemctl
  - Fix for nagios_services plugins
  - add type defintion for ctdbd_var_t
  - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file
  - Allow net_admin/netlink_socket all hyperv_domain domains
  - Add labeling for zarafa-search.log and zarafa-search.pid
  - Fix hypervkvp.te
  - Fix nscd_shm_use()
  - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services.
  - Add hypervkvp_unit_file_t type
  - Fix logging policy
  - Allow syslog to bind to tls ports
  - Update labeling for /dev/cdc-wdm
  - Allow to su_domain to read init states
  - Allow init_t to read gnome home data
  - Make sure if systemd_logind creates nologin file with the correct label
  - Clean up ipsec.te


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-91
changelog:
  - Allow mailserver_domains to manage and transition to mailman data
  - Dontaudit attempts by mozilla plugin to relabel content, caused by using mv and cp commands
  - Allow mailserver_domains to manage and transition to mailman data
  - Allow svirt_domains to read sysctl_net_t
  - Allow thumb_t to use tmpfs inherited from the user
  - Allow mozilla_plugin to bind to the vnc port if running with spice
  - Add new attribute to discover confined_admins and assign confined admin to it
  - Fix zabbix to handle attributes in interfaces
  - Fix zabbix to read system states for all zabbix domains
  - Fix piranha_domain_template()
  - Allow ctdbd to create udp_socket. Allow ndmbd to access ctdbd var files.
  - Allow lldpad sys_rouserce cap due to #986870
  - Allow dovecot-auth to read nologin
  - Allow openlmi-networking to read /proc/net/dev
  - Allow smsd_t to execute scripts created on the fly labeled as smsd_spool_t
  - Add zabbix_domain attribute for zabbix domains to treat them together
  - Add labels for zabbix-poxy-* (#1018221)
  - Update openlmi-storage policy to reflect #1015067
  - Back port piranha tmpfs fixes from RHEL6
  - Update httpd_can_sendmail boolean to allow read/write postfix spool maildrop
  - Add postfix_rw_spool_maildrop_files interface
  - Call new userdom_admin_user_templat() also for sysadm_secadm.pp
  - Fix typo in userdom_admin_user_template()
  - Allow SELinux users to create coolkeypk11sE-Gate in /var/cache/coolkey
  - Add new attribute to discover confined_admins
  - Fix labeling for /etc/strongswan/ipsec.d
  - systemd_logind seems to pass fd to anyone who dbus communicates with it
  - Dontaudit leaked write descriptor to dmesg


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-93
changelog:
  - Allow sshd_t to read openshift content, needs backport to RHEL6.5
  - Label /usr/lib64/sasl2/libsasldb.so.3.0.0 as textrel_shlib_t
  - Make sur kdump lock is created with correct label if kdumpctl is executed
  - gnome interface calls should always be made within an optional_block
  - Allow syslogd_t to connect to the syslog_tls port
  - Add labeling for /var/run/charon.ctl socket
  - Add kdump_filetrans_named_content()
  - Allo setpgid for fenced_t
  - Allow setpgid and r/w cluster tmpfs for fenced_t
  - gnome calls should always be within optional blocks
  - wicd.pid should be labeled as networkmanager_var_run_t
  - Allow sys_resource for lldpad


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-94
changelog:
  - Allow sysadm_t to read login information
  - Allow systemd_tmpfiles to setattr on var_log_t directories
  - Udpdate Makefile to include systemd_contexts
  - Add systemd_contexts
  - Add fs_exec_hugetlbfs_files() interface
  - Add daemons_enable_cluster_mode boolean
  - Fix rsync_filetrans_named_content()
  - Add rhcs_read_cluster_pid_files() interface
  - Update rhcs.if with additional interfaces from RHEL6
  - Fix rhcs_domain_template() to not create run dirs with cluster_var_run_t
  - Allow glusterd_t to mounton glusterd_tmp_t
  - Allow glusterd to unmout al filesystems
  - Allow xenstored to read virt config
  - Add label for swift_server.lock and make add filetrans_named_content to make sure content gets created with the correct label
  - Allow mozilla_plugin_t to mmap hugepages as an executable


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-95
changelog:
  - Fix alias decl in corenetwork.te.in
  - Add support for fuse.glusterfs
  - Add file transition rules for content created by f5link
  - Rename quantum_port information to neutron
  - Allow all antivirus domains to manage also own log dirs
  - Rename quantum_port information to neutron
  - Allow pegasus_openlmi_services_t to stream connect to sssd_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-97
changelog:
  - Add label only for redhat.repo instead of /etc/yum.repos.d. But probably we will need to switch for the directory.
  - Label /etc/yum.repos.d as system_conf_t
  - Use sysnet_filetrans_named_content in udev.te instead of generic transition for net_conf_t
  - Allow dac_override for sysadm_screen_t
  - Allow init_t to read ipsec_conf_t as we had it for initrc_t. Needed by ipsec unit file.
  - Allow netlabel-config to read meminfo
  - Add interface to allow docker to mounton file_t
  - Add new interface to exec unlabeled files
  - Allow lvm to use docker semaphores
  - Setup transitons for .xsessions-errors.old
  - Change labels of files in /var/lib/*/.ssh to transition properly
  - Allow staff_t and user_t to look at logs using journalctl
  - pluto wants to manage own log file
  - Allow pluto running as ipsec_t to create pluto.log
  - Fix alias decl in corenetwork.te.in
  - Add support for fuse.glusterfs
  - Allow dmidecode to read/write /run/lock/subsys/rhsmcertd
  - Allow rhsmcertd to manage redhat.repo which is now labeled as system.conf. Allow rhsmcertd to manage all log files.
  - Additional access for docker
  - Added more rules to sblim policy
  - Fix kdumpgui_run_bootloader boolean
  - Allow dspam to connect to lmtp port
  - Included sfcbd service into sblim policy
  - rhsmcertd wants to manaage /etc/pki/consumer dir
  - Add kdumpgui_run_bootloader boolean
  - Add support for /var/cache/watchdog
  - Remove virt_domain attribute for virt_qemu_ga_unconfined_t
  - Fixes for handling libvirt containes
  - Dontaudit attempts by mysql_safe to write content into /
  - Dontaudit attempts by system_mail to modify network config
  - Allow dspam to bind to lmtp ports
  - Add new policy to allow staff_t and user_t to look at logs using journalctl
  - Allow apache cgi scripts to list sysfs
  - Dontaudit attempts to write/delete user_tmp_t files
  - Allow all antivirus domains to manage also own log dirs
  - Allow pegasus_openlmi_services_t to stream connect to sssd_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-98
changelog:
  - Add files_relabel_base_file_types() interface
  - Allow netlabel-config to read passwd
  - update gluster_export_all_rw boolean to allow relabel all base file types caused by lsetxattr()
  - Allow x86_energy_perf  tool to modify the MSR
  - Fix /var/lib/dspam/data labeling
  - Allow pegasus to domtrans to mount_t
  - Add labeling for unconfined scripts in /usr/libexec/watchdog/scripts
  - Add support for unconfined watchdog scripts
  - Allow watchdog to manage own log files


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-99
changelog:
  - Add support for yubikey in homedir
  - Add support for upd/3052 port
  - Allow apcupsd to use PowerChute Network Shutdown
  - Allow lsmd to execute various lsmplugins
  - Add labeling also for /etc/watchdog\.d where are watchdog scripts located too
  - Update gluster_export_all_rw boolean to allow relabel all base file types
  - Allow x86_energy_perf  tool to modify the MSR
  - Fix /var/lib/dspam/data labeling


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-100
changelog:
  - Fix passenger_stream_connect interface
  - setroubleshoot_fixit wants to read network state
  - Allow procmail_t to connect to dovecot stream sockets
  - Allow cimprovagt service providers to read network states
  - Add labeling for /var/run/mariadb
  - pwauth uses lastlog() to update system's lastlog
  - Allow account provider to read login records
  - Add support for texlive2013
  - More fixes for user config files to make crond_t running in userdomain
  - Add back disable/reload/enable permissions for system class
  - Fix manage_service_perms macro
  - Allow passwd_t to connect to gnome keyring to change password
  - Update mls config files to have cronjobs in the user domains
  - Remove access checks that systemd does not actually do


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-102
changelog:
  - Fix files_dontaudit_unmount_all_mountpoints()
  - Add support for 2608-2609 tcp/udp ports
  - Should allow domains to lock the terminal device
  - More fixes for user config files to make crond_t running in userdomain
  - Add back disable/reload/enable permissions for system class
  - Fix manage_service_perms macro
  - We need to require passwd rootok
  - Fix zebra.fc
  - Fix dnsmasq_filetrans_named_content() interface
  - Allow all sandbox domains create content in svirt_home_t
  - Allow zebra domains also create zebra_tmp_t files in /tmp
  - Add support for new zebra services:isisd,babeld. Add systemd support for zebra services.
  - Fix labeling on neutron and remove transition to iconfig_t
  - abrt needs to read mcelog log file
  - Fix labeling on dnsmasq content
  - Fix labeling on /etc/dnsmasq.d
  - Allow glusterd to relabel own lib files
  - Allow sandbox domains to use pam_rootok, and dontaudit attempts to unmount file systems, this is caused by a bug in systemd
  - Allow ipc_lock for abrt to run journalctl


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-104
changelog:
  - Allow watchdog to read /etc/passwd
  - Allow browser plugins to connect to bumblebee
  - New policy for bumblebee and freqset
  - Add new policy for mip6d daemon
  - Add new policy for opensm daemon
  - Allow condor domains to read/write condor_master udp_socket
  - Allow openshift_cron_t to append to openshift log files, label /var/log/openshift
  - Add back file_pid_filetrans for /var/run/dlm_controld
  - Allow smbd_t to use inherited tmpfs content
  - Allow mcelog to use the /dev/cpu device
  - sosreport runs rpcinfo
  - sosreport runs subscription-manager
  - Allow staff_t to run frequency command
  - Allow systemd_tmpfiles to relabel log directories
  - Allow staff_t to read xserver_log file
  - Label hsperfdata_root as tmp_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-105
changelog:
  - Dontaudit openshift domains trying to use rawip_sockets, this is caused by a bad check in the kernel.
  - Allow git_system_t to read git_user_content if the git_system_enable_homedirs boolean is turned on
  - Add lsmd_plugin_t for lsm plugins
  - Allow dovecot-deliver to search mountpoints
  - Add labeling for /etc/mdadm.conf
  - Allow opelmi admin providers to dbus chat with init_t
  - Allow sblim domain to read /dev/urandom and /dev/random
  - Allow apmd to request the kernel load modules
  - Add glusterd_brick_t type
  - label mate-keyring-daemon with gkeyringd_exec_t
  - Add plymouthd_create_log()
  - Dontaudit leaks from openshift domains into mail domains, needs back port to RHEL6
  - Allow sssd to request the kernel loads modules
  - Allow gpg_agent to use ssh-add
  - Allow gpg_agent to use ssh-add
  - Dontaudit access check on /root for myslqd_safe_t
  - Allow ctdb to getattr on al filesystems
  - Allow abrt to stream connect to syslog
  - Allow dnsmasq to list dnsmasq.d directory
  - Watchdog opens the raw socket
  - Allow watchdog to read network state info
  - Dontaudit access check on lvm lock dir
  - Allow sosreport to send signull to setroubleshootd
  - Add setroubleshoot_signull() interface
  - Fix ldap_read_certs() interface
  - Allow sosreport all signal perms
  - Allow sosreport to run systemctl
  - Allow sosreport to dbus chat with rpm
  - Add glusterd_brick_t files type
  - Allow zabbix_agentd to read all domain state
  - Clean up rtas.if
  - Allow smoltclient to execute ldconfig
  - Allow sosreport to request the kernel to load a module
  - Fix userdom_confined_admin_template()
  - Add back exec_content boolean for secadm, logadm, auditadm
  - Fix files_filetrans_system_db_named_files() interface
  - Allow sulogin to getattr on /proc/kcore
  - Add filename transition also for servicelog.db-journal
  - Add files_dontaudit_access_check_root()
  - Add lvm_dontaudit_access_check_lock() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-108
changelog:
  - Allow sosreport to send a signal to ABRT
  - Add proper aliases for pegasus_openlmi_service_exec_t and pegasus_openlmi_service_t
  - Label /usr/sbin/htcacheclean as httpd_exec_t
  Resolves:#1037529
  - Added support for rdisc unit file
  - Add antivirus_db_t labeling for /var/lib/clamav-unofficial-sigs
  - Allow runuser running as logrotate connections to system DBUS
  - Label bcache devices as fixed_disk_device_t
  - Allow systemctl running in ipsec_mgmt_t to access /usr/lib/systemd/system/ipsec.service
  - Label /usr/lib/systemd/system/ipsec.service as ipsec_mgmt_unit_file_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-109
changelog:
  - Change labeling for /usr/libexec/nm-dispatcher.action to NetworkManager_exec_t
  Resolves:#1039879
  - Add labeling for /usr/lib/systemd/system/mariadb.service
  - Allow hyperv_domain to read sysfs
  - Fix ldap_read_certs() interface to allow acess also link files
  - Add support for /usr/libexec/pegasus/cmpiLMI_Journald-cimprovagt
  - Allow tuned to run modprobe
  - Allow portreserve to search /var/lib/sss dir
  - Add SELinux support for the teamd package contains team network device control daemon.
  - Dontaudit access check on /proc for bumblebee
  - Bumblebee wants to load nvidia modules
  - Fix rpm_named_filetrans_log_files and wine.te
  - Add conman policy for rawhide
  - DRM master and input event devices are used by  the TakeDevice API
  - Clean up bumblebee policy
  - Update pegasus_openlmi_storage_t policy
  - Add freeipmi_stream_connect() interface
  - Allow logwatch read madm.conf to support RAID setup
  - Add raid_read_conf_files() interface
  - Allow up2date running as rpm_t create up2date log file with rpm_log_t labeling
  - add rpm_named_filetrans_log_files() interface
  - Allow dkim-milter to create files/dirs in /tmp
  - update freeipmi policy
  - Add policy for freeipmi services
  - Added rdisc_admin and rdisc_systemctl interfaces
  - opensm policy clean up
  - openwsman policy clean up
  - ninfod policy clean up
  - Added new policy for ninfod
  - Added new policy for openwsman
  - Added rdisc_admin and rdisc_systemctl interfaces
  - Fix kernel_dontaudit_access_check_proc()
  - Add support for /dev/uhid
  - Allow sulogin to get the attributes of initctl and sys_admin cap
  - Add kernel_dontaudit_access_check_proc()
  - Fix dev_rw_ipmi_dev()
  - Fix new interface in devices.if
  - DRM master and input event devices are used by  the TakeDevice API
  - add dev_rw_inherited_dri() and dev_rw_inherited_input_dev()
  - Added support for default conman port
  - Add interfaces for ipmi devices


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-110
changelog:
  - Allow freeipmi_ipmidetectd_t to use freeipmi port
  - Update freeipmi_domain_template()
  - Allow journalctl running as ABRT to read /run/log/journal
  - Allow NM to read dispatcher.d directory
  - Update freeipmi policy
  - Type transitions with a filename not allowed inside conditionals
  - Allow tor to bind to hplip port
  - Make new type to texlive files in homedir
  - Allow zabbix_agent to transition to dmidecode
  - Add rules for docker
  - Allow sosreport to send signull to unconfined_t
  - Add virt_noatsecure and virt_rlimitinh interfaces
  - Fix labeling in thumb.fc to add support for /usr/lib64/tumbler-1/tumblerddd support for freeipmi port
  - Add sysadm_u_default_contexts
  - Add logging_read_syslog_pid()
  - Fix userdom_manage_home_texlive() interface
  - Make new type to texlive files in homedir
  - Add filename transitions for /run and /lock links
  - Allow virtd to inherit rlimit information
  Resolves:#975358


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-111
changelog:
  - Add labeling for /var/lib/servicelog/servicelog.db-journal
  - Add support for freeipmi port
  - Add sysadm_u_default_contexts
  - Make new type to texlive files in homedir
  - Allow subscription-manager running as sosreport_t to manage rhsmcertd
  - Additional fixes for docker.te
  - Remove ability to do mount/sys_admin by default in virt_sandbox domains
  - New rules required to run docker images within libivrt
  - Add label for ~/.cvsignore
  - Change mirrormanager to be run by cron
  - Add mirrormanager policy
  - Fixed bumblebee_admin() and mip6d_admin()
  - Add log support for sensord
  - Fix typo in docker.te
  - Allow amanda to do backups over UDP
  - Allow bumblebee to read /etc/group and clean up bumblebee.te
  - type transitions with a filename not allowed inside conditionals
  - Don't allow virt-sandbox tools to use netlink out of the box, needs back port to RHEL7
  - Make new type to texlive files in homedir


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-112
changelog:
  - Allow sshd to write to all process levels in order to change passwd when running at a level
  - Allow updpwd_t to downgrade /etc/passwd file to s0, if it is not running with this range
  - Allow apcuspd_t to status and start the power unit file
  - Allow udev to manage kdump unit file
  - Added new interface modutils_dontaudit_exec_insmod
  - Allow cobbler to search dhcp_etc_t directory
  - systemd_systemctl needs sys_admin capability
  - Allow sytemd_tmpfiles_t to delete all directories
  - passwd to create gnome-keyring passwd socket
  - Add missing zabbix_var_lib_t type
  - Fix filename trans for zabbixsrv in zabbix.te
  - Allow fprintd_t to send syslog messages
  - Add  zabbix_var_lib_t for /var/lib/zabbixsrv, also allow zabix to connect to smtp port
  - Allow mozilla plugin to chat with policykit, needed for spice
  - Allow gssprozy to change user and gid, as well as read user keyrings
  - Label upgrades directory under /var/www as httpd_sys_rw_content_t, add other filetrans rules to label content correctly
  - Allow polipo to connect to http_cache_ports
  - Allow cron jobs to manage apache var lib content
  - Allow yppassword to manage the passwd_file_t
  - Allow showall_t to send itself signals
  - Allow cobbler to restart dhcpc, dnsmasq and bind services
  - Allow certmonger to manage home cert files
  - Add userdom filename trans for user mail domains
  - Allow apcuspd_t to status and start the power unit file
  - Allow cgroupdrulesengd to create content in cgoups directories
  - Allow smbd_t to signull cluster
  - Allow gluster daemon to create fifo files in glusterd_brick_t and sock_file in glusterd_var_lib_t
  - Add label for /var/spool/cron.aquota.user
  - Allow sandbox_x domains to use work with the mozilla plugin semaphore
  - Added new policy for speech-dispatcher
  - Added dontaudit rule for insmod_exec_t  in rasdaemon policy
  - Updated rasdaemon policy
  - Allow system_mail_t to transition to postfix_postdrop_t
  - Clean up mirrormanager policy
  - Allow virt_domains to read cert files, needs backport to RHEL7
  - Allow sssd to read systemd_login_var_run_t
  - Allow irc_t to execute shell and bin-t files:
  - Add new access for mythtv
  - Allow rsync_t to manage all non auth files
  - allow modemmanger to read /dev/urand
  - Allow sandbox apps to attempt to set and get capabilties


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-114
changelog:
  - Add default lvm_var_run_t label for /var/run/multipathd
  Resolves:#1051430
  - Fix log labeling to have correct default label for them after logrotate
  - Add files_write_root_dirs
  - Add new openflow port label for 6653/tcp and 6633/tcp
  - Add xserver_manage_xkb_libs()
  - Label tcp/8891 as milter por
  - Allow gnome_manage_generic_cache_files also create cache_home_t files
  - Fix aide.log labeling
  - Fix log labeling to have correct default label for them after logrotate
  - Allow mysqld-safe write access on /root to make mysqld working
  - Allow sosreport domtrans to prelikn
  - Allow OpenvSwitch to connec to openflow ports
  - Allow NM send dgram to lldpad
  - Allow hyperv domains to execute shell
  - Allow lsmd plugins stream connect to lsmd/init
  - Allow sblim domains to create /run/gather with correct labeling
  - Allow httpd to read ldap certs
  - Allow cupsd to send dbus msgs to process with different MLS level
  - Allow bumblebee to stream connect to apmd
  - Allow bumblebee to run xkbcomp
  - Additional allow rules to get libvirt-lxc containers working with docker
  - Additional allow rules to get libvirt-lxc containers working with docker
  - Allow docker to getattr on itself
  - Additional rules needed for sandbox apps
  - Allow mozilla_plugin to set attributes on usb device if use_spice boolean enabled
  - httpd should be able to send signal/signull to httpd_suexec_t
  - Add more fixes for neturon. Domtrans to dnsmasq, iptables. Make neutron as filenamtrans domain.


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-116
changelog:
  - Add missing files_create_var_lib_dirs()
  - Fix typo in ipsec.te
  - Allow passwd to create directory in /var/lib
  - Add filename trans also for event21
  - Allow iptables command to read /dev/rand
  - Add sigkill capabilityfor ipsec_t
  - Add filename transitions for bcache devices
  - Add additional rules to create /var/log/cron by syslogd_t with correct labeling
  - Add give everyone full access to all key rings
  - Add default lvm_var_run_t label for /var/run/multipathd
  - Fix log labeling to have correct default label for them after logrotate
  - Labeled ~/.nv/GLCache as being gstreamer output
  - Allow nagios_system_plugin to read mrtg lib files
  - Add mrtg_read_lib_files()
  - Call rhcs_rw_cluster_tmpfs for dlm_controld
  - Make authconfing as named_filetrans domain
  - Allow virsh to connect to user process using stream socket
  - Allow rtas_errd to read rand/urand devices and add chown capability
  - Fix labeling from /var/run/net-snmpd to correct /var/run/net-snmp
  Resolves:#1051497
  - Add also chown cap for abrt_upload_watch_t. It already has dac_override
  - Allow sosreport to manage rhsmcertd pid files
  - Add rhsmcertd_manage_pid_files()
  - Allow also setgid cap for rpc.gssd
  - Dontaudit access check for abrt on cert_t
  - Allow pegasus_openlmi_system providers to dbus chat with systemd-logind


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-118
changelog:
  - Allow init_t to work on transitient and snapshot unit files
  - Add logging_manage_syslog_config()
  - Update sysnet_dns_name_resolve() to allow connect to dnssec por
  - Allow pegasus_openlmi_storage_t to read hwdata
  Resolves:#1031721
  - Fix rhcs_rw_cluster_tmpfs()
  - Allow fenced_t to bind on zented udp port
  - Added policy for vmtools
  - Fix mirrormanager_read_lib_files()
  - Allow mirromanager scripts running as httpd_t to manage mirrormanager pid files
  - Allow ctdb to create sock files in /var/run/ctdb
  - Add sblim_filetrans_named_content() interface
  - Allow rpm scritplets to create /run/gather with correct labeling
  - Allow gnome keyring domains to create gnome config dirs
  - Dontaudit read/write to init stream socket for lsmd_plugin_t
  - Allow automount to read nfs link files
  - Allow lsm plugins to read/write lsmd stream socket
  - Allow certmonger to connect ldap port to make IPA CA certificate renewal working.
  - Add also labeling for /var/run/ctdb
  - Add missing labeling for /var/lib/ctdb
  - ALlow tuned to manage syslog.conf. Should be fixed in tuned. #1030446
  - Dontaudit hypervkvp to search homedirs
  - Dontaudit hypervkvp to search admin homedirs
  - Allow hypervkvp to execute bin_t and ifconfig in the caller domain
  - Dontaudit xguest_t to read ABRT conf files
  - Add abrt_dontaudit_read_config()
  - Allow namespace-init to getattr on fs
  - Add thumb_role() also for xguest
  - Add filename transitions to create .spamassassin with correct labeling
  - Allow apache domain to read mirrormanager pid files
  - Allow domains to read/write shm and sem owned by mozilla_plugin_t
  - Allow alsactl to send a generic signal to kernel_t


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-119
changelog:
  - Add cron unconfined role support for uncofined SELinux user
  - Call corenet_udp_bind_all_ports() in milter.te
  - Allow fence_virtd to connect to zented port
  - Fix header for mirrormanager_admin()
  - Allow dkim-milter to bind udp ports
  - Allow milter domains to send signull itself
  - Allow block_suspend for yum running as mock_t
  - Allow beam.smp to manage couchdb files
  - Add couchdb_manage_files()
  - Add labeling for /var/log/php_errors.log
  - Allow bumblebee to stream connect to xserver
  - Allow bumblebee to send a signal to xserver
  - gnome-thumbnail to stream connect to bumblebee
  - Allow xkbcomp running as bumblebee_t to execute  bin_t
  - Allow logrotate to read squid.conf
  - Additional rules to get docker and lxc to play well with SELinux
  - Allow bumbleed to connect to xserver port
  - Allow pegasus_openlmi_storage_t to read hwdata


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-120
changelog:
  - Allow apache to write to the owncloud data directory in /var/www/html...
  - Allow consolekit to create log dir
  - Add support for icinga CGI scripts
  - Add support for icinga
  - Allow kdumpctl_t to create kdump lock file
  Resolves:#1055634
  - Allow kdump to create lnk lock file
  - Allow nscd_t block_suspen capability
  - Allow unconfined domain types to manage own transient unit file
  - Allow systemd domains to handle transient init unit files
  - Add interfaces to handle transient


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-121
changelog:
  - Allow gdm to create /var/gdm with correct labeling
  - Allow domains to append rkhunterl lib files. #1057982
  - Allow systemd_tmpfiles_t net_admin to communicate with journald
  - Add interface to getattr on an isid_type for any type of file
  - Update libs_filetrans_named_content() to have support for /usr/lib/debug directory
  - Allow initrc_t domtrans to authconfig if unconfined is enabled
  - Allow docker and mount on devpts chr_file
  - Allow docker to transition to unconfined_t if boolean set
  - init calling needs to be optional in domain.te
  - Allow uncofined domain types to handle transient unit files
  - Fix labeling for vfio devices
  - Allow net_admin capability and send system log msgs
  - Allow lldpad send dgram to NM
  - Add networkmanager_dgram_send()
  - rkhunter_var_lib_t is correct type
  - Back port pcp policy from rawhide
  - Allow openlmi-storage to read removable devices
  - Allow system cron jobs to manage rkhunter lib files
  - Add rkhunter_manage_lib_files()
  - Fix ftpd_use_fusefs boolean to allow manage also symlinks
  - Allow smbcontrob block_suspend cap2
  - Allow slpd to read network and system state info
  - Allow NM domtrans to iscsid_t if iscsiadm is executed
  - Allow slapd to send a signal itself
  - Allow sslget running as pki_ra_t to contact port 8443, the secure port of the CA.
  - Fix plymouthd_create_log() interface
  - Add rkhunter policy with files type definition for /var/lib/rkhunter until it is fixed in rkhunter package
  - Add mozilla_plugin_exec_t for /usr/lib/firefox/plugin-container
  - Allow postfix and cyrus-imapd to work out of box
  - Allow fcoemon to talk with unpriv user domain using unix_stream_socket
  - Dontaudit domains that are calling into journald to net_admin
  - Add rules to allow vmtools to do what it does
  - snapperd is D-Bus service
  - Allow OpenLMI PowerManagement to call 'systemctl --force reboot'
  - Add haproxy_connect_any boolean
  - Allow haproxy also to use http cache port by default
  Resolves:#1058248


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-122
changelog:
  - Update snapper policy
  - Allow domains to append rkhunter lib files
  - Allow snapperd to getattr on all fs
  - Allow xdm to create /var/gdm with correct labeling
  - Add label for snapper.log
  - Allow fail2ban-client to read apache log files
  - Allow thumb_t to execute dbus-daemon in thumb_t


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-123
changelog:
  - Turn on bacula, rhnsd policy
  - Add support for rhnsd unit file
  - Add dbus_chat_session_bus() interface
  - Add dbus_stream_connect_session_bus() interface
  - Fix logrotate_use_nfs boolean
  - Add lot of pcp fixes found in RHEL7
  - fix labeling for pmie for pcp pkg
  - Change thumb_t to be allowed to chat/connect with session bus type
  - Allow call renice in mlocate
  - Add logrotate_use_nfs boolean
  - Allow setroubleshootd to read rpc sysctl
  - Fixes for *_admin interfaces
  - Add pegasus_openlmi_storage_var_run_t type def
  - Add support for /var/run/openlmi-storage
  - Allow tuned to create syslog.conf with correct labeling
  - Add httpd_dontaudit_search_dirs boolean
  - Add support for winbind.service
  - ALlow also fail2ban-client to read apache logs
  - Allow vmtools to getattr on all fs
  - Add support for dey_sapi port
  - Add logging_filetrans_named_conf()
  - Allow passwd_t to use ipc_lock, so that it can change the password in gnome-keyring


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-124
changelog:
  - Added osad policy
  - Allow postfix to deliver to procmail
  - Allow bumblebee to seng kill signal to xserver
  - Allow vmtools to execute /usr/bin/lsb_release
  - Allow docker to write system net ctrls
  - Add support for rhnsd unit file
  - Add dbus_chat_session_bus() interface
  - Add dbus_stream_connect_session_bus() interface
  - Fix pcp.te
  - Fix logrotate_use_nfs boolean
  - Add lot of pcp fixes found in RHEL7
  - fix labeling for pmie for pcp pkg
  - Change thumb_t to be allowed to chat/connect with session bus type
  - Allow call renice in mlocate
  - Add logrotate_use_nfs boolean
  - Allow setroubleshootd to read rpc sysctl


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-125
changelog:
  - Addopt corenet rules for unbound-anchor to rpm_script_t
  - Allow runuser to send send audit messages.
  - Allow postfix-local to search .forward in munin lib dirs
  - Allow udisks to connect to D-Bus
  - Allow spamd to connect to spamd port
  - Fix syntax error in snapper.te
  - Dontaudit osad to search gconf home files
  - Allow rhsmcertd to manage /etc/sysconf/rhn director
  - Fix pcp labeling to accept /usr/bin for all daemon binaries
  - Fix mcelog_read_log() interface
  - Allow iscsid to manage iscsi lib files
  - Allow snapper domtrans to lvm_t. Add support for /etc/snapper and allow snapperd to manage it.
  - Make tuned_t as unconfined domain for RHEL7.0
  - Allow ABRT to read puppet certs
  - Add sys_time capability for virt-ga
  - Allow gemu-ga to domtrans to hwclock_t
  - Allow additional access for virt_qemu_ga_t processes to read system clock and send audit messages
  - Fix some AVCs in pcp policy
  - Add to bacula capability setgid and setuid and allow to bind to bacula ports
  - Changed label from rhnsd_rw_conf_t to rhnsd_conf_t
  - Add access rhnsd and osad to /etc/sysconfig/rhn
  - drbdadm executes drbdmeta
  - Fixes needed for docker
  - Allow epmd to manage /var/log/rabbitmq/startup_err file
  - Allow beam.smp connect to amqp port
  - Modify xdm_write_home to allow create also links as xdm_home_t if the boolean is on true
  - Allow init_t to manage pluto.ctl because of init_t instead of initrc_t
  - Allow systemd_tmpfiles_t to manage all non security files on the system
  - Added labels for bacula ports
  - Fix label on /dev/vfio/vfio
  - Add kernel_mounton_messages() interface
  - init wants to manage lock files for iscsi


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-126
changelog:
  - Add lvm_read_metadata()
  - Allow auditadm to search /var/log/audit dir
  - Add lvm_read_metadata() interface
  - Allow confined users to run vmtools helpers
  - Fix userdom_common_user_template()
  - Generic systemd unit scripts do write check on /
  - Allow init_t to create init_tmp_t in /tmp.This is for temporary content created by generic unit files
  - Add additional fixes needed for init_t and setup script running in generic unit files
  - Allow general users to create packet_sockets
  - added connlcli port
  - Add init_manage_transient_unit() interface
  - Allow init_t (generic unit files) to manage rpc state date as we had it for initrc_t
  - Fix userdomain.te to require passwd class
  - devicekit_power sends out a signal to all processes on the message bus when power is going down
  - Dontaudit rendom domains listing /proc and hittping system_map_t
  - Dontauit leaks of var_t into ifconfig_t
  - Allow domains that transition to ssh_t to manipulate its keyring
  - Define oracleasm_t as a device node
  - Change to handle /root as a symbolic link for os-tree
  - Allow sysadm_t to create packet_socket, also move some rules to attributes
  - Add label for openvswitch port
  - Remove general transition for files/dirs created in /etc/mail which got etc_aliases_t label.
  - Allow postfix_local to read .forward in pcp lib files
  - Allow pegasus_openlmi_storage_t to read lvm metadata
  - Add additional fixes for pegasus_openlmi_storage_t
  - Allow bumblebee to manage debugfs
  - Make bumblebee as unconfined domain
  - Allow snmp to read etc_aliases_t
  - Allow lscpu running in pegasus_openlmi_storage_t to read /dev/mem
  - Allow pegasus_openlmi_storage_t to read /proc/1/environ
  - Dontaudit read gconf files for cupsd_config_t
  - make vmtools as unconfined domain
  - Add vmtools_helper_t for helper scripts. Allow vmtools shutdonw a host and run ifconfig.
  - Allow collectd_t to use a mysql database
  - Allow ipa-otpd to perform DNS name resolution
  - Added new policy for keepalived
  - Allow openlmi-service provider to manage transitient units and allow stream connect to sssd
  - Add additional fixes new pscs-lite+polkit support
  - Add labeling for /run/krb5kdc
  - Change w3c_validator_tmp_t to httpd_w3c_validator_tmp_t in F20
  - Allow pcscd to read users proc info
  - Dontaudit smbd_t sending out random signuls
  - Add boolean to allow openshift domains to use nfs
  - Allow w3c_validator to create content in /tmp
  - zabbix_agent uses nsswitch
  - Allow procmail and dovecot to work together to deliver mail
  - Allow spamd to execute files in homedir if boolean turned on
  - Allow openvswitch to listen on port 6634
  - Add net_admin capability in collectd policy
  - Fixed snapperd policy
  - Fixed bugsfor pcp policy
  - Allow dbus_system_domains to be started by init
  - Fixed some interfaces
  - Add kerberos_keytab_domain attribute
  - Fix snapperd_conf_t def


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-127
changelog:
  - Add snapperd_home_t for HOME_DIR/.snapshots directory
  - Make sosreport as unconfined domain
  - Allow sosreport to execute grub2-probe
  - Allow NM to manage hostname config file
  - Allow systemd_timedated_t to dbus chat with rpm_script_t
  - Allow lsmd plugins to connect to http/ssh/http_cache ports by default
  - Add lsmd_plugin_connect_any boolean
  - Allow mozilla_plugin to attempt to set capabilities
  - Allow lsdm_plugins to use tcp_socket
  - Dontaudit mozilla plugin from getattr on /proc or /sys
  - Dontaudit use of the keyring by the services in a sandbox
  - Dontaudit attempts to sys_ptrace caused by running ps for mysqld_safe_t
  - Allow rabbitmq_beam to connect to jabber_interserver_port
  - Allow logwatch_mail_t to transition to qmail_inject and queueu
  - Added new rules to pcp policy
  - Allow vmtools_helper_t to change role to system_r
  - Allow NM to dbus chat with vmtools
  - Fix couchdb_manage_files() to allow manage couchdb conf files
  - Add support for /var/run/redis.sock
  - dontaudit gpg trying to use audit
  - Allow consolekit to create log directories and files
  - Fix vmtools policy to allow user roles to access vmtools_helper_t
  - Allow block_suspend cap2 for ipa-otpd
  - Allow pkcsslotd to read users state
  - Add ioctl to init_dontaudit_rw_stream_socket
  - Add systemd_hostnamed_manage_config() interface
  - Remove transition for temp dirs created by init_t
  - gdm-simple-slave uses use setsockopt
  - sddm-greater is a xdm type program


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-128
changelog:
  - Make snapperd as unconfined domain and add additional fixes for it
  - Remove nsplugin.pp module on upgrade


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-129
changelog:
  - Allow block_suspend cap2 for systemd-logind and rw dri device
  - Add labeling for /usr/libexec/nm-libreswan-service
  - Allow locallogin to rw xdm key to make Virtual Terminal login providing smartcard pin working
  - Add xserver_rw_xdm_keys()
  - Allow rpm_script_t to dbus chat also with systemd-located
  - Fix ipa_stream_connect_otpd()
  - update lpd_manage_spool() interface
  - Allow krb5kdc to stream connect to ipa-otpd
  - Add ipa_stream_connect_otpd() interface
  - Allow vpnc to unlink NM pids
  - Add networkmanager_delete_pid_files()
  - Allow munin plugins to access unconfined plugins
  - update abrt_filetrans_named_content to cover /var/spool/debug
  - Label /var/spool/debug as abrt_var_cache_t
  - Allow rhsmcertd to connect to squid port
  - Make docker_transition_unconfined as optional boolean
  - Allow certmonger to list home dirs


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-130
changelog:
  - Change userdom_use_user_inherited_ttys to userdom_use_user_ttys for systemd-tty-ask
  - Add sysnet_filetrans_named_content_ifconfig() interface
  - Allow ctdbd to connect own ports
  - Fix samba_export_all_rw booleanto cover also non security dirs
  - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs
  - Allow neutron to create /run/netns with correct labeling
  - Allow kerberos keytab domains to manage sssd/userdomain keys"
  - Allow to run ip cmd in neutron_t domain


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-131
changelog:
  - Added pcp rules
  - dontaudit openshift_cron_t searching random directories, should be back ported to RHEL6
  - clean up ctdb.te
  - Allow ctdbd to connect own ports
  - Fix samba_export_all_rw booleanto cover also non security dirs
  - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs
  - Allow neutron to create /run/netns with correct labeling
  - Allow certmonger to list home dirs


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-132
changelog:
  - Modify xdm_write_home to allow create files/links in /root with xdm_home_
  - Allow virt domains to read network state
  Resolves:#1072019


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-133
changelog:
  - Allow numad to write scan_sleep_millisecs
  - Turn on entropyd_use_audio boolean by default
  - Allow cgred to read /etc/cgconfig.conf because it contains templates used together with rules from /etc/cgrules.conf.
  - Allow lscpu running as rhsmcertd_t to read /proc/sysinfo
  - Fix label on irclogs in the homedir
  - Allow kerberos_keytab_domain domains to manage keys until we get sssd fix
  - Allow postgresql to use ldap
  - Add missing syslog-conn port
  - Add support for /dev/vmcp and /dev/sclp
  Resolves:#1069310


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-134
changelog:
  - Allow unpriv SELinux users to dbus chat with firewalld
  - Add lvm_write_metadata()
  - Label /etc/yum.reposd dir as system_conf_t. Should be safe because system_conf_t is base_ro_file_type
  - Allow pegasus_openlmi_storage_t to write lvm metadata
  - Add hide_broken_symptoms for kdumpgui because of systemd bug
  - Make kdumpgui_t as unconfined domain
  Resolves:#1044299
  - Allow docker to connect to tcp/5000


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-137
changelog:
  - Allow vmtools_helper_t to execute bin_t
  - Add support for /usr/share/joomla
  - /var/lib/containers should be labeled as openshift content for now
  - Allow docker domains to talk to the login programs, to allow a process to login into the container
  - Allow install_t do dbus chat with NM
  - Fix interface names in anaconda.if
  - Add install_t for anaconda. A new type is a part of anaconda policy
  - sshd to read network sysctls


author: Lukas Vrabec <lvrabec@redhat.com> 3.12.1-138
changelog:
  - Make rtas_errd_t as unconfined domain for F20.It needs additional fixes. It runs rpm at least.
  - Allow net_admin cap for fence_virtd running as fenced_t
  - Make  abrt-java-connector working
  - Make cimtest script 03_defineVS.py of ComputerSystem group working
  - Fix git_system_enable_homedirs boolean
  - Allow munin mail plugins to read network systcl


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-139
changelog:
  - Allow collectd to talk to libvirt
  - Allow chrome_sandbox to use leaked unix_stream_sockets
  - Dontaudit leaks of sockets into chrome_sandbox_t
  - If you create a cups directory in /var/cache then it should be labeled cups_rw_etc_t
  - Run vmtools as unconfined domains
  - Allow snort to manage its log files
  - Allow systemd_cronjob_t to be entered via bin_t
  - Allow procman to list doveconf_etc_t
  - allow keyring daemon to create content in tmpfs directories
  - Add proper labelling for icedtea-web
  - vpnc is creating content in networkmanager var run directory
  - Label sddm as xdm_exec_t to make KDE working again
  - Allow postgresql to read network state
  - Allow java running as pki_tomcat to read network sysctls
  - Fix cgroup.te to allow cgred to read cgconfig_etc_t
  - Allow beam.smp to use ephemeral ports
  - Allow winbind to use the nis to authenticate passwords


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-140
changelog:
  - Allow docker to read tmpfs_t symlinks
  - Allow sandbox svirt_lxc_net_t to talk to syslog and to sssd over stream sockets


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-142
changelog:
  - Add support for /var/spool/rhsm/debug
  - Make virt_sandbox_use_audit as True by default
  - Allow svirt_sandbox_domains to ptrace themselves


author: Lukas Vrabec <lvrabec@redhat.com> 3.12.1-143
changelog:
  - Add additional fixes for rtas_errd
  - Fix transitions for tmp/tmpfs in rtas.te
  - Allow rtas_errd to readl all sysctls


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-144
changelog:
  - allow anaconda to dbus chat with systemd-localed
  - Add fixes for haproxy based on bperkins@redhat.com
  - Allow cmirrord to make dmsetup working
  - Allow NM to execute arping
  - Allow users to send messages through talk
  - Add userdom_tmp_role for secadm_t


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-145
changelog:
  - Allow also unpriv user to run vmtools
  - Allow secadm to read /dev/urandom and meminfo
  Resolves:#1079250
  - Add booleans to allow docker processes to use nfs and samba
  - Add mdadm_tmpfs support
  - Dontaudit net_amdin for /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.51-2.4.5.1.el7.x86_64/jre-abrt/bin/java running as pki_tomcat_t
  - Allow vmware-user-sui to use user ttys
  - Allow talk 2 users logged via console too
  - Allow ftp services to manage xferlog_t
  - Make all pcp domanis as unconfined for RHEL7.0 beucause of new policies
  - allow anaconda to dbus chat with systemd-localed


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-146
changelog:
  - add gnome_append_home_config()
  - Allow thumb to append GNOME config home files
  - Allow rasdaemon to rw /dev/cpu//msr
  - fix /var/log/pki file spec
  - make bacula_t as auth_nsswitch domain
  - Identify pki_tomcat_cert_t as a cert_type
  - Define speech-dispater_exec_t as an application executable
  - Add a new file context for /var/named/chroot/run directory
  - update storage_filetrans_all_named_dev for sg* devices
  - Allow auditctl_t  to getattr on all removeable devices
  - Allow nsswitch_domains to stream connect to nmbd
  - Allow unprivusers to connect to memcached
  - label /var/lib/dirsrv/scripts-INSTANCE as bin_t


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-147
changelog:
  - Back port fixes for pegasus_openlmi_admin_t from rawhide
  Resolves:#1080973
  - Add labels for ostree
  - Add SELinux awareness for NM
  - Label /usr/sbin/pwhistory_helper as updpwd_exec_t


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-148
changelog:
  - Allow kdm to send signull to remote_login_t process
  - Add gear policy
  - Turn on gear_port_t
  - Allow cgit to read gitosis lib files by default
  - Allow vdagent to read xdm state
  - Allow NM and fcoeadm to talk together over unix_dgram_socket


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-149
changelog:
  - Allow xauth_t to read user_home_dir_t lnk_file
  - Add labeling for lightdm-data
  - Allow certmonger to manage ipa lib files
  - Add support for /var/lib/ipa
  - Allow pegasus to getattr virt_content
  - Added some new rules to pcp policy
  - Allow chrome_sandbox to execute config_home_t
  - Add support for ABRT FAF


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-151
changelog:
  - varnishd wants chown capability
  - update ntp_filetrans_named_content() interface
  - Add additional fixes for neutron_t. #1083335
  - Dontaudit getattr on proc_kcore_t
  - Allow pki_tomcat_t to read ipa lib files
  - Allow named_filetrans_domain to create /var/cache/ibus with correct labelign
  - Allow init_t run /sbin/augenrules
  - Add dev_unmount_sysfs_fs and sysnet_manage_ifconfig_run interfaces
  - Allow unpriv SELinux user to use sandbox
  - Add default label for /tmp/hsperfdata_root


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-152
changelog:
  - Fix Multiple same specifications for /var/named/chroot/dev/zero
  - Add labels for /var/named/chroot_sdb/dev devices
  - Add support for strongimcv
  - Use kerberos_keytab_domains in auth_use_nsswitch
  - Update auth_use_nsswitch to make all these types as kerberos_keytab_domain to
  - Allow net_raw cap for neutron_t and send sigkill to dnsmasq
  - Fix ntp_filetrans_named_content for sntp-kod file
  - Add httpd_dbus_sssd boolean
  - Dontaudit exec insmod in boinc policy
  - Rename kerberos_keytab_domain to kerberos_keytab_domains
  - Add kerberos_keytab_domain()
  - Fix kerberos_keytab_template()
  - Make all domains which use kerberos as kerberos_keytab_domain
  Resolves:#1083670
  - Allow kill capability to winbind_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-154
changelog:
  - Add support for us_cli ports
  - Fix labeling for /var/run/user/<UID>/gvfs
  - add support for tcp/9697
  - Additional rules required by openstack,  needs backport to F20 and RHEL7
  - Additional access required by docker
  - ALlow motion to use tcp/8082 port
  - Allow init_t to setattr/relabelfrom dhcp state files
  - Dontaudit antivirus domains read access on all security files by default
  - Add missing alias for old amavis_etc_t type
  - Allow block_suspend cap for haproxy
  - Additional fixes for  instack overcloud
  - Allow OpenStack to read mysqld_db links and connect to MySQL
  - Remove dup filename rules in gnome.te
  - Allow sys_chroot cap for httpd_t and setattr on httpd_log_t
  - Allow iscsid to handle own unit files
  - Add iscsi_systemctl()
  - Allow mongod to create also sock_files in /run with correct labeling
  - Allow httpd to send signull to apache script domains and don't audit leaks
  - Allow rabbitmq_beam to connect to httpd port
  - Allow aiccu stream connect to pcscd
  - Allow dmesg to read hwdata and memory dev
  - Allow all freeipmi domains to read/write ipmi devices
  - Allow sblim_sfcbd to use also pegasus-https port
  - Allow rabbitmq_epmd to manage rabbit_var_log_t files
  - Allow chronyd to read /sys/class/hwmon/hwmon1/device/temp2_input
  - Allow docker to status any unit file and allow it to start generic unit files


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-2
changelog:
  - Allow locate to look at files/directories without labels, and chr_file and blk_file on non dev file systems
  - Label /usr/lib/erlang/erts.*/bin files as bin_t
  - Add files_dontaudit_access_check_home_dir() inteface.
  - Allow udev_t mounton udev_var_run_t dirs #(1128618)
  - Add systemd_networkd_var_run_t labeling for /var/run/systemd/netif and allow systemd-networkd to manage it.
  - Add init_dontaudit_read_state() interface.
  - Add label for ~/.local/share/fonts
  - Allow unconfined_r to access unconfined_service_t.
  - Allow init to read all config files
  - Add new interface to allow creation of file with lib_t type
  - Assign rabbitmq port.
  - Allow unconfined_service_t to dbus chat with all dbus domains
  - Add new interfaces to access users keys.
  - Allow domains to are allowed to mounton proc to mount on files as well as dirs
  - Fix labeling for HOME_DIR/tmp and HOME_DIR/.tmp directories.
  - Add a port definition for shellinaboxd
  - Label ~/tmp and ~/.tmp directories in user tmp dirs as user_tmp_t
  - Allow userdomains to stream connect to pcscd for smart cards
  - Allow programs to use pam to search through user_tmp_t dires (/tmp/.X11-unix)
  - Update to rawhide-contrib changes
  Resolves:#1123844


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-3
changelog:
  - Add back kill permisiion for system class
  - Allow iptables read fail2ban logs.
  - Fix radius labeled ports
  - Add userdom_manage_user_tmpfs_files interface
  - Allow libreswan to connect to VPN via NM-libreswan.
  - Label 4101 tcp port as brlp port
  - fix dev_getattr_generic_usb_dev interface
  - Allow all domains to read fonts
  - Make sure /run/systemd/generator and system is labeled correctly on creation.
  - Dontaudit aicuu to search home config dir. 
  - Make keystone_cgi_script_t domain. 
  Resolves:#1138424
  - Fix bug in drbd policy, 
  - Added support for cpuplug. 
  - ALlow sanlock_t to read sysfs_t.
  - Added sendmail_domtrans_unconfined interface
  - Fix broken interfaces
  - radiusd wants to write own log files.
  - Label /usr/libexec/rhsmd as rhsmcertd_exec_t
  - Allow rhsmcertd send signull to setroubleshoot. 
  - Allow rhsmcertd manage rpm db. 
  - Added policy for blrtty. 
  - Fix keepalived policy
  - Allow rhev-agentd dbus chat with systemd-logind.
  - Allow keepalived manage snmp var lib sock files.
  - Add support for /var/lib/graphite-web
  - Allow NetworkManager to create Bluetooth SDP sockets
  - It's going to do the the discovery for DUN service for modems with Bluez 5.
  - Allow swift to connect to all ephemeral ports by default.
  - Allow sssd to read selinux config to add SELinux user mapping.
  - Allow lsmd to search own plguins.
  - Allow abrt to read /dev/memto generate an unique machine_id and uses  sosuploader's algorithm based off dmidecode[1] fields.
  - ALlow zebra for user/group look-ups.
  - Allow nova domains to getattr on all filesystems.
  - Allow collectd sys_ptrace and dac_override caps because of reading of /proc/%i/io for several processes.
  - Allow pppd to connect to /run/sstpc/sstpc-nm-sstp-service-28025 over unix stream socket.
  - Allow rhnsd_t to manage also rhnsd config symlinks.
  - ALlow user mail domains to create dead.letter.
  - Allow rabbitmq_t read rabbitmq_var_lib_t lnk files. 
  - Allow pki-tomcat to change SELinux object identity.
  - Allow radious to connect to apache ports to do OCSP check
  - Allow git cgi scripts to create content in /tmp
  - Allow cockpit-session to do GSSAPI logins.
  - Allow sensord read in /proc 
  - Additional access required by usbmuxd


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-5
changelog:
  - Add back kill permisiion for service class
  Resolves:#1150011
  - Make rhsmcertd_t also as dbus domain.
  - Allow named to create DNS_25 with correct labeling.
  - Add cloudform_dontaudit_write_cloud_log()
  - Call auth_use_nsswitch to apache to read/write cloud-init keys.
  - Allow cloud-init to dbus chat with certmonger.
  - Fix path to mon_statd_initrc_t script.
  - Allow all RHCS services to read system state.
  - Allow dnssec_trigger_t to execute unbound-control in own domain.
  - kernel_read_system_state needs to be called with type. Moved it to antivirus.if.
  - Added policy for mon_statd and mon_procd services. BZ (1077821)
  - Allow opensm_t to read/write /dev/infiniband/umad1.
  - Allow mongodb to manage own log files.
  - Allow neutron connections to system dbus.
  - Add support for /var/lib/swiftdirectory.
  - Allow nova-scheduler to read certs.
  - Allow openvpn to access /sys/fs/cgroup dir.
  - Allow openvpn to execute  systemd-passwd-agent in  systemd_passwd_agent_t to make openvpn working with systemd.
  - Fix samba_export_all_ro/samba_export_all_rw booleans to dontaudit search/read security files.
  - Add auth_use_nsswitch for portreserve to make it working with sssd.
  - automount policy is non-base module so it needs to be called in optional block.
  - ALlow sensord to getattr on sysfs.
  - Label /usr/share/corosync/corosync as cluster_exec_t.
  - Allow lmsd_plugin to read passwd file. BZ(1093733)
  - Allow read antivirus domain all kernel sysctls.
  - Allow mandb to getattr on file systems
  - Allow nova-console to connect to mem_cache port.
  - Make sosreport as unconfined domain.
  - Allow mondogdb to  'accept' accesses on the tcp_socket port.
  - ALlow sanlock to send a signal to virtd_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-7
changelog:
  - Allow modemmanger to connectto itself
  Resolves:#1120152 
  - Allow pki_tomcat to create link files in /var/lib/pki-ca.
  Resolves:#1121744 
  - varnishd needs to have fsetid capability
  Resolves:#1125165
  - Allow snapperd to dbus chat with system cron jobs.
  Resolves:#1152447
  - Allow dovecot to create user's home directory when they log into IMAP 
  Resolves:#1152773   
  - Add labeling for /usr/sbin/haproxy-systemd-wrapper wrapper to make haproxy running haproxy_t.
  - ALlow listen and accept on tcp socket for init_t in MLS. Previously it was for xinetd_t. 
  - Allow nslcd to execute netstat.
  - Add suppor for keepalived unconfined scripts and allow keepalived to read all domain state and kill capability.
  - Allow nslcd to read /dev/urandom.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-8
changelog:
  - Allow guest to connect to libvirt using unix_stream_socket.
  - Allow all bus client domains to dbus chat with unconfined_service_t.
  - Allow inetd service without own policy to run in inetd_child_t which is unconfined domain.
  - Make opensm as nsswitch domain to make it working with sssd.
  - Allow brctl to read meminfo.
  - Allow winbind-helper to execute ntlm_auth in the caller domain.
  Resolves:#1160339
  - Make plymouthd as nsswitch domain to make it working with sssd.
  Resolves:#1160196
  - Make drbd as nsswitch domain to make it working with sssd.
  - Make conman as nsswitch domain to make ipmitool.exp runing as conman_t working.
  - Add support for /var/lib/sntp directory.
  - Add fixes to allow docker to create more content in tmpfs ,and donaudit reading /proc
  - Allow winbind to read usermodehelper
  - Allow telepathy domains to execute shells and bin_t
  - Allow gpgdomains to create netlink_kobject_uevent_sockets
  - Allow mongodb to bind to the mongo port and mongos to run as mongod_t
  - Allow abrt to read software raid state.
  - Allow nslcd to execute netstat.
  - Allow dovecot to create user's home directory when they log into IMAP.
  - Allow login domains to create kernel keyring with different level.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-9
changelog:
  - Dontaudit access check on setfiles/load_policy for sssd_t.
  Resolves:#1140106
  - Add kdump_rw_inherited_kdumpctl_tmp_pipes()
  Resolves:#1156442
  - Make linuxptp services as unconfined.
  - Added new policy linuxptp.
  Resolves:#1149693
  - Label keystone cgi files as keystone_cgi_script_exec_t.
  Resolves:#1138424
  - Make tuned as unconfined domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-10
changelog:
  - Label /etc/strongimcv as ipsec_conf_file_t.
  - Add support for /usr/bin/start-puppet-ca helper script
  Resolves:#1160727
  - Allow rpm scripts to enable/disable transient systemd units.
  Resolves:#1154613 
  - Make kpropdas nsswitch domain
  Resolves:#1153561
  - Make all glance domain as nsswitch domains
  Resolves:#1113281
  - Allow selinux_child running as sssd access check on /etc/selinux/targeted/modules/active
  - Allow access checks on setfiles/load_policy/semanage_lock for selinux_child running as sssd_t
  Resolves:#1140106


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-11
changelog:
  - Allow radius to bind tcp/1812 radius port.
  - Dontaudit list user_tmp files for system_mail_t.
  - Label virt-who as virtd_exec_t.
  - Allow rhsmcertd to send a null signal to virt-who running as virtd_t.
  - Add missing alias for _content_rw_t.
  Resolves:#1089177
  - Allow spamd to access razor-agent.log.
  - Add fixes for sfcb from libvirt-cim TestOnly bug.
  - Allow NetworkManager stream connect on openvpn.
  - Make /usr/bin/vncserver running as unconfined_service_t.
  - getty_t should be ranged in MLS. Then also local_login_t runs as ranged domain.
  - Label /etc/docker/certs.d as cert_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-12
changelog:
  - Add seutil_dontaudit_access_check_semanage_module_store() interface
  Resolves:#1140106
  - Update to have all _systemctl() interface also init_reload_services().
  - Dontaudit access check on SELinux module store for sssd.
  - Add labeling for /sbin/iw.
  - Allow named_filetrans_domain to create ibus directory with correct labeling.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-13
changelog:
  - Remove old pkcsslotd.pp from minimum package
  - Allow rlogind to use also rlogin ports.
  - Add support for /usr/libexec/ntpdate-wrapper. Label it as ntpdate_exec_t.
  - Allow bacula to connect also to postgresql.
  - Label /usr/libexec/tomcat/server as tomcat_exec_t
  - Add support for /usr/sbin/ctdbd_wrapper
  - Add support for /usr/libexec/ppc64-diag/rtas_errd
  - Allow rpm_script_roles to access system_mail_t
  - Allow brltty to create /var/run/brltty
  - Allow lsmd plugin to access netlink_route_socket
  - Allow smbcontrol to read passwd
  - Add support for /usr/libexec/sssd/selinux_child and create sssd_selinux_manager_t domain for it
  Resolves:#1140106
  - Allow osad to execute rhn_check
  - Allow load_policy to rw inherited sssd pipes because of selinux_child
  - Allow admin SELinux users mounting / as private within a new mount namespace as root in MLS
  - Add additional fixes for su_restricted_domain_template to make moving to sysadm_r and trying to su working correctly
  - Add additional booleans substitions


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-14
changelog:
  - Allow virt_qemu_ga_t to execute kmod.
  - Add missing files_dontaudit_list_security_dirs() for smbd_t in samba_export_all_ro boolean.
  - Add additionnal MLS attribute for oddjob_mkhomedir to create homedirs.
  Resolves:#1113725
  - Enable OpenStack cinder policy
  - Add support for /usr/share/vdsm/daemonAdapter
  - Add support for /var/run/gluster


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-15
changelog:
  - Fix bugs in interfaces discovered by sepolicy.
  - Allow slapd to read /usr/share/cracklib/pw_dict.hwm.
  - Allow lsm plugins to connect to tcp/18700 by default.
  - Allow brltty mknod capability to allow create /var/run/brltty/vcsa.
  - Fix pcp_domain_template() interface.
  - Fix conman.te.
  - Allow mon_fsstatd to read /proc/sys/fs/binfmt_misc
  - Allow glance-scrubber to connect tcp/9191.
  - Add missing setuid capability for sblim-sfcbd.
  - Allow pegasus ioctl() on providers.
  - Add conman_can_network.
  - Allow chronyd to read chrony conf files located in /run/timemaster/.
  - Allow radius to bind on tcp/1813 port.
  - dontaudit block suspend access for openvpn_t 
  - Allow conman to create files/dirs in /tmp.
  - Update xserver_rw_xdm_keys() interface to have 'setattr'.
  Resolves:#1172291 
  - Allow sulogin to read /dev/urandom and /dev/random.
  - Update radius port definition to have also tcp/18121
  - Label prandom as random_device_t.
  - Allow charon to manage files in /etc/strongimcv labeled as ipsec_conf_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-16
changelog:
  - Allow sssd to send dbus all user domains.
  Resolves:#1172291
  - Allow lsm plugin to read certificates.
  - Fix labeling for keystone CGI scripts.
  - Make snapperd back as unconfined domain.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-17
changelog:
  - Allow ipsec to execute _updown.netkey script to run unbound-control.
  - Allow neutron to read rpm DB.
  - Add additional fixes for hyperkvp
   * creates new ifcfg-{name} file
   * Runs hv_set_ifconfig.sh, which does the following
   * Copies ifcfg-{name} to /etc/sysconfig/network-scripts
  - Allow svirt to read symbolic links in /sys/fs/cgroups labeled as tmpfs_t
  - Add labeling for pacemaker.log.
  - Allow radius to connect/bind radsec ports.
  - Allow pm-suspend running as virt_qemu_ga to read /var/log/pm-suspend.log
  - Allow  virt_qemu_ga to dbus chat with rpm.
  - Update virt_read_content() interface to allow read also char devices.
  - Allow glance-registry to connect to keystone port.
  Resolves:#1181818


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-18
changelog:
  - Add auditing support for ipsec.
  Resolves:#1182524
  - Label /ostree/deploy/rhel-atomic-host/deploy directory as system_conf_t
  - Allow netutils chown capability to make tcpdump working with -w


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-21
changelog:
  - pkcsslotd_lock_t should be an alias for pkcs_slotd_lock_t.
  - Allow fowner capability for sssd because of selinux_child handling.
  - ALlow bind to read/write inherited ipsec pipes
  - Allow hypervkvp to read /dev/urandom and read  addition states/config files.
  - Allow gluster rpm scripletto create glusterd socket with correct labeling. This is a workaround until we get fix in glusterd.
  - Add glusterd_filetrans_named_pid() interface
  - Allow radiusd to connect to radsec ports.
  - Allow setuid/setgid for selinux_child
  - Allow lsmd plugin to connect to tcp/5988 by default.
  - Allow lsmd plugin to connect to tcp/5989 by default.
  - Update ipsec_manage_pid() interface.
  Resolves:#1184978


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-23
changelog:
  - Update seutil_manage_config() interface.
  Resolves:#1185962
  - Allow pki-tomcat relabel pki_tomcat_etc_rw_t.
  - Turn on docker_transition_unconfined by default


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-24
changelog:
  - ALlow mongod execmem by default.
  - Update policy/mls for sockets. Rules were contradictory.
  Resolves:#1207133
  - Allow a user to login with different security level via ssh.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-25
changelog:
  - Label /usr/libexec/postgresql-ctl as postgresql_exec_t. 
  - Add more restriction on entrypoint for unconfined domains.
  - Only allow semanage_t to be able to setenforce 0, no all domains that use selinux_semanage interface
  - Allow all domains to read /dev/urandom. It is needed by all apps/services linked to libgcrypt. There is no harm to allow it by default.
  - Update policy/mls for sockets related to access perm. Rules were contradictory.
  - Add nagios_run_pnp4nagios and nagios_run_sudo booleans to allow r
  un sudo from NRPE utils scripts and allow run nagios in conjunction w
  ith PNP4Nagios.
  Resolves:#1201054
  - Don't use deprecated userdom_manage_tmpfs_role() interface calliing and use userdom_manage_tmp_role() instead.
  - Update virt_read_pid_files() interface to allow read also symlinks with virt_var_run_t type
  - Label /var/lib/tftpboot/aarch64(/.*)? and /var/lib/tftpboot/images2(/.*)?
  - Add support for iprdbg logging files in /var/log.
  - Add fixes to rhsmcertd_t
  - Allow puppetagent_t to transfer firewalld messages over dbus
  - Add support for /usr/libexec/mongodb-scl-helper RHSCL helper script.
  - Added label mysqld_etc_t for /etc/my.cnf.d/ dir.
  - Add support for mongod/mongos systemd unit files.
  - cloudinit and rhsmcertd need to communicate with dbus
  - Allow dovecot_t sys_resource capability


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-26
changelog:
  - Back port the latest F22 changes to RHEL7. It should fix most of RHEL7.2 bugs
  - Add cgdcbxd policy 
  Resolves:#1072493
  - Fix ftp_homedir boolean
  Resolve:#1097775
  - Dontaudit ifconfig writing inhertited /var/log/pluto.log.
  - Allow cluster domain to dbus chat with systemd-logind.
  Resolves:#1145215
  - Dontaudit write access to inherited kdumpctl tmp files
  Resolves:#1156442
  - Allow isnsd_t to communicate with sssd
  Resolves:#1167702
  - Allow rwho_t to communicate with sssd
  Resolves:#1167718
  - Allow sblim_gatherd_t to communicate with sssd
  Resolves:#1167732
  - Allow pkcs_slotd_t to communicate with sssd
  Resolves:#1167737
  - Allow openvswitch_t to communicate with sssd
  Resolves:#1167816
  - Allow mysqld_safe_t to communicate with sssd
  Resolves:#1167832
  - Allow sshd_keygen_t to communicate with sssd
  Resolves:#1167840
  - Add support for iprdbg logging files in /var/log.
  Resolves:#1174363
  - Allow tmpreaper_t to manage ntp log content
  Resolves:#1176965
  - Allow gssd_t to manage ssh keyring
  Resolves:#1184791
  - Allow httpd_sys_script_t to send system log messages
  Resolves:#1185231
  - Allow apcupsd_t to read /sys/devices
  Resolves:#1189185
  - Allow dovecot_t sys_resource capability
  Resolves:#1191143
  - Add support for mongod/mongos systemd unit files.
  Resolves:#1197038
  - Add bacula fixes
  - Added label mysqld_etc_t for /etc/my.cnf.d/ dir.
  Resolves:#1203991


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-27
changelog:
  - Calling cron_system_entry() in pcp_domain_template needs to be a part of optional_policy block.
  - Allow samba-net to access /var/lib/ctdbd dirs/files.
  - Allow glusterd to send a signal to smbd.
  - Make ctdbd as home manager to access also FUSE.
  - Allow glusterd to use geo-replication gluster tool.
  - Allow glusterd to execute ssh-keygen.
  - Allow glusterd to interact with cluster services.
  - Allow glusterd to connect to the system DBUS for service (acquire_svc).
  - Label /dev/log correctly.
  Resolves:#1230932


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-28
changelog:
  - Allow glusterd to send generic signals to systemd_passwd_agent processes.
  - Allow glusterd to access init scripts/units without defined policy
  - Allow glusterd to run init scripts.
  - Allow glusterd to execute /usr/sbin/xfs_dbin glusterd_t domain.
  Resolves:#1224879


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-29
changelog:
  - We allow can_exec() on ssh_keygen on gluster. But there is a transition defined by init_initrc_domain() because we need to allow execute unconfined services by glusterd. So ssh-keygen ends up with ssh_keygen_t and we need to allow to manage /var/lib/glusterd/geo-replication/secret.pem.
  - Allow sshd to execute gnome-keyring if there is configured pam_gnome_keyring.so.
  - Allow gnome-keyring executed by passwd to access /run/user/UID/keyring to change a password. 
  - Label gluster python hooks also as bin_t.
  - Allow glusterd to interact with gluster tools running in a user domain
  - Add glusterd_manage_lib_files() interface.
  - ntop reads /var/lib/ntop/macPrefix.db and it needs dac_override. It has setuid/setgid. 
  - Allow samba_t net_admin capability to make CIFS mount working.
  - S30samba-start gluster hooks wants to search audit logs. Dontaudit it.
  Resolves:#1224879


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-30
changelog:
  - Allow iptables to read ctdbd lib files.
  Resolves:#1224879
  - Add systemd_networkd_t to nsswitch domains.
  - Allow drbd_t write to fixed_disk_device. Reason: drbdmeta needs write to fixed_disk_device during initialization. 
  Resolves:#1130675
  - Allow NetworkManager write to sysfs. 
  - Fix cron_system_cronjob_use_shares boolean to call fs interfaces which contain only entrypoint permission.
  - Add cron_system_cronjob_use_shares boolean to allow system cronjob to be executed from shares - NFS, CIFS, FUSE. It requires "entrypoint" permissios on nfs_t, cifs_t and fusefs_t SELinux types.
  - Allow NetworkManager write to sysfs. 
  - Allow ctdb_t sending signull to smbd_t, for checking if smbd process exists. 
  - Dontaudit apache to manage snmpd_var_lib_t files/dirs. 
  - Add interface snmp_dontaudit_manage_snmp_var_lib_files().
  - Dontaudit mozilla_plugin_t cap. sys_ptrace. 
  - Rename xodbc-connect port to xodbc_connect
  - Allow ovsdb-server to connect on xodbc-connect and ovsdb tcp ports. 
  - Allow iscsid write to fifo file kdumpctl_tmp_t. Appears when kdump generates the initramfs during the kernel boot. 
  - Dontaudit chrome to read passwd file. 
  - nrpe needs kill capability to make gluster moniterd nodes working. 
  Resolves:#1235587


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-31
changelog:
  - Add logging_syslogd_run_nagios_plugins boolean for rsyslog to allow transition to nagios unconfined plugins
  Resolves:#1233550
  - Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/
  - Add support for oddjob based helper in FreeIPA.
  - Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob.
  - Add nagios_domtrans_unconfined_plugins() interface.
  - Update mta_filetrans_named_content() interface to cover more db files. 
  Resolves:#1167468
  - Add back ftpd_use_passive_mode boolean with fixed description.
  - Allow pmcd daemon stream connect to mysqld.
  - Allow pcp domains to connect to own process using unix_stream_socket. 
  Resolves:#1213709
  - Allow  abrt-upload-watch service to dbus chat with ABRT daemon and fsetid capability to allow run reporter-upload correctly.
  - Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob.
  - Add support for oddjob based helper in FreeIPA.
  - Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-32
changelog:
  - Allow gluster to connect to all ports. It is required by random services executed by gluster.
  - Add interfaces winbind_signull(), samba_unconfined_net_signull().
  - Dontaudit smbd_t block_suspend capability. This is kernel bug.
  - Allow ctdbd sending signull to process winbind, samba_unconfined_net, to
      checking if processes exists.
  - Add tmpreaper booleans to use nfs_t and samba_share_t.
  - Fix path from /usr/sbin/redis-server to /usr/bin/redis-server
  - Allow connect ypserv to portmap_port_t
  - Fix paths in inn policy, Allow innd read innd_log_t dirs, Allow innd execute innd_etc_t files
  - Add support for openstack-nova-* packages
  - Allow NetworkManager_t send signull to dnssec_trigger_t.
  - Allow glusterd to execute showmount in the showmount domain.
  - Label swift-container-reconciler binary as swift_t.
  - Allow dnssec_trigger_t relabelfrom dnssec_trigger_var_run_t files.
  - Add cobbler_var_lib_t to "/var/lib/tftpboot/boot(/.*)?"
  Resolves:#1213540
  - Merge all nova_* labels under one nova_t.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-33
changelog:
  - Allow networkmanager read rfcomm port.
  Resolves:#1212498
  - Remove non exists label.
  - Fix *_admin intefaces where body is not consistent with header.
  - Label /usr/afs/ as afs_files_t, Allow afs_bosserver_t create afs_config_t and afs_dbdir_t dirs under afs_files_t, Allow afs_bosserver_t read kerberos config
  - Remove non exits nfsd_ro_t label.
  - Make all interfaces related to openshift_cache_t as deprecated.
  - Add rpm_var_run_t label to rpm_admin header
  - Add jabberd_lock_t label to jabberd_admin header.
  - Add samba_unconfined_script_exec_t to samba_admin header.
  - inn daemon should create innd_log_t objects in var_log_t instead of innd_var_run_t
  - Fix ctdb policy
  - Add samba_signull_winbind()
  - Add samba_signull_unconfined_net()
  - Allow ctdbd_t send signull to samba_unconfined_net_t.
  - Allow openshift_initrc_t to communicate with firewalld over dbus 
  Resolves:#1221326


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-34
changelog:
  - Allow glusterd to manage nfsd and rpcd services.
  - Allow networkmanager to  communicate via dbus with systemd_hostanmed. 
  Resolves: #1234954
  - Allow stream connect logrotate to prosody.
  - Add prosody_stream_connect() interface.
  -  httpd should be able to send signal/signull to httpd_suexec_t, instead of httpd_suexec_exec_t.
  - Allow prosody to create own tmp files/dirs.
  Resolves:#1212498


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-35
changelog:
  - gnome_dontaudit_search_config() needs to be a part of optinal_policy in pegasus.te
  - Allow pcp_pmcd daemon to read postfix config files.
  - Allow pcp_pmcd daemon to search postfix spool dirs.
  Resolves: #1213740
  - Added Booleans: pcp_read_generic_logs.
  Resolves: #1213740
  - Allow drbd to read configuration options used when loading modules.
  Resolves: #1134883
  - Allow glusterd to manage nfsd and rpcd services.
  - Allow glusterd to communicate with cluster domains over stream socket.
  - glusterd call pcs utility which calls find for cib.* files and runs pstree under glusterd. Dontaudit access to security files and update gluster boolean to reflect these changes.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-36
changelog:
  - Allow drbd to get attributes from filesystems.
  - Allow redis to read kernel parameters.
  Resolves: #1209518
  - Allow virt_qemu_ga_t domtrans to passwd_t
  - Allow audisp_remote_t to start power unit files domain to allow halt system.
  Resolves: #1186780
  - Allow audisp_remote_t to read/write user domain pty.
  Resolves: #1186780
  - Label /usr/sbin/chpasswd as passwd_exec_t.
  - Allow sysadm to administrate ldap environment and allow to bind ldap port to allow to setup an LDAP server (389ds).
  Resolves:#1221121


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-37
changelog:
  - Allow httpd_suexec_t to read and write Apache stream sockets 
  Resolves: #1243569
  - Allow qpid to create lnk_files in qpid_var_lib_t
  Resolves: #1247279


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-38
changelog:
  - Allow openhpid to use libsnmp_bc plugin (allow read snmp lib files).
    Resolves: #1243902
  - Allow lsm_plugin_t to read sysfs, read hwdata, rw to scsi_generic_device
    Resolves: #1238079
  - Allow lsm_plugin_t to rw raw_fixed_disk.
    Resolves:#1238079
  - Allow rhsmcertd to send signull to unconfined_service.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-39
changelog:
  - Allow mdadm to access /dev/random and add support to create own files/dirs as mdadm_tmpfs_t.
  Resolves:#1073314
  - Allow udev, lvm and fsadm to access systemd-cat in /var/tmp/dracut if 'dracut -fv' is executed in MLS.
  - Allow admin SELinu users to communicate with kernel_t. It is needed to access /run/systemd/journal/stdout if 'dracut -vf' is executed. We allow it for other SELinux users.
  - Allow sysadm to execute systemd-sysctl in the sysadm_t domain. It is needed for ifup command in MLS mode.
  - Add fstools_filetrans_named_content_fsadm() and call it for named_filetrans_domain domains. We need to be sure that /run/blkid is created with correct labeling.
  Resolves:#1183503
  - Add support for /etc/sanlock which is writable by sanlock daemon.
  Resolves:#1231377
  - Allow useradd add homedir located in /var/lib/kdcproxy in ipa-server RPM scriplet.
  Resolves:#1243775 
  - Allow snapperd to pass data (one way only) via pipe negotiated over dbus
  Resolves:#1250550
  - Allow lsmd also setuid capability. Some commands need to executed under root privs. Other commands are executed under unprivileged user.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-40
changelog:
  - Add interface to read/write watchdog device
  - Add labels for /dev/memory_bandwith and /dev/vhci. Thanks ssekidde
  Resolves:#1210237
  - Allow apcupsd_t to read /sys/devices 
  Resolves:#1189185
  - Allow logrotate to reload services.
  Resolves: #1242453
  - Allow openhpid use libwatchdog plugin. (Allow openhpid_t rw watchdog device)
  Resolves: #1244260
  - Allow openhpid liboa_soap plugin to read generic certs.
  Resolves: #1244248
  - Allow openhpid liboa_soap plugin to read resolv.conf file.
  Resolves: #1244248
  - Label /usr/libexec/chrony-helper as chronyd_exec_t
  - Allow chronyd_t to read dhcpc state.
  - Allow chronyd to execute mkdir command.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-41
changelog:
  - Allow pcp_domain to manage pcp_var_lib_t lnk_files.
  Resolves: #1252341
  - Label /var/run/xtables.* as iptables_var_run_t
  Resolves: #1243403


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-42
changelog:
  - Fix label on /var/tmp/kiprop_0
  Resolves:#1220763
  - Allow lldpad_t to getattr tmpfs_t.
  Resolves: #1246220
  - Label /dev/shm/lldpad.* as lldapd_tmpfs_t
  Resolves: #1246220
  - Allow audisp client to read system state.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-43
changelog:
  - Allow openhpid_t to read system state.
  Resolves: #1244248
  - Added labels for files provided by rh-nginx18 collection
  Resolves: #1249945
  - Dontaudit block_suspend capability for ipa_helper_t, this is kernel bug. Allow ipa_helper_t capability net_admin. Allow ipa_helper_t to list /tmp. Allow ipa_helper_t to read rpm db.
  Resolves: #1252968
  - Allow rhsmcertd exec rhsmcertd_var_run_t files and rhsmcerd_tmp_t files. This rules are in hide_broken_sympthons until we find better solution.
  Resolves: #1243431
  - Allow abrt_dump_oops_t to read proc_security_t files.
  - Allow abrt_dump_oops to signull all domains Allow abrt_dump_oops to read all domains state Allow abrt_dump_oops to ptrace all domains
  - Add interface abrt_dump_oops_domtrans()
  - Add mountpoint dontaudit access check in rhsmcertd policy.
  Resolves: #1243431
  - Allow samba_net_t to manage samba_var_t sock files.
  Resolves: #1252937
  - Allow chrome setcap to itself.
  Resolves: #1251996
  - Allow httpd daemon to manage httpd_var_lib_t lnk_files.
  Resolves: #1253706
  - Allow chronyd exec systemctl
  Resolves: #1243764
  - Add inteface chronyd_signal Allow timemaster_t send generic signals to chronyd_t.
  Resolves: #1243764
  - Added interface fs_dontaudit_write_configfs_dirs
  - Add label for kernel module dep files in /usr/lib/modules
  Resolves:#916635
  - Allow kernel_t domtrans to abrt_dump_oops_t
  - Added to files_dontaudit_write_all_mountpoints intefface new dontaudit rule, that domain included this interface dontaudit capability dac_override.
  - Allow systemd-networkd to send logs to systemd-journald.
  Resolves: #1236616


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-44
changelog:
  - Allow exec pidof under hypervkvp domain.
  Resolves: #1254870
  - Allow hypervkvp daemon create connection to the system DBUS
  Resolves: #1254870


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-45
changelog:
  - Fix postfix_spool_maildrop_t,postfix_spool_flush_t contexts in postfix.fc file.
  Resolves: #1252442


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-46
changelog:
  - Allow watchdog execute fenced python script. Resolves: #1255020
  - Added inferface watchdog_unconfined_exec_read_lnk_files()
  - Label /var/run/chrony-helper dir as chronyd_var_run_t. Resolves: #1243764
  - Allow dhcpc_t domain transition to chronyd_t Resolves: #1243764


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-47
changelog:
  - Fix regexp in chronyd.fc file
  Resolves: #1243764
  - Allow passenger to getattr filesystem xattr
  Resolves: #1196555
  - Label mdadm.conf.anackbak as mdadm_conf_t file.
  Resolves: #1088904
  - Revert "Allow pegasus_openlmi_storage_t create mdadm.conf.anacbak file in /etc."
  - Allow watchdog execute fenced python script.
  Resolves: #1255020
  - Added inferface watchdog_unconfined_exec_read_lnk_files()
  - Remove labeling for /var/db/.*\.db as etc_t to label db files as system_db_t.
  Resolves: #1230877


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-48
changelog:
  - Fix labeling for fence_scsi_check script
  Resolves: #1255020
  - Allow openhpid to read system state Allow openhpid to connect to tcp http port.
   Resolves: #1244248
  - Allow openhpid to read snmp var lib files.
   Resolves: #1243902
  - Allow openvswitch_t domains read kernel dependencies due to openvswitch run modprobe
  - Allow unconfined_t domains to create /var/run/xtables.lock with iptables_var_run_t
  Resolves: #1243403
  - Remove bin_t label for /usr/share/cluster/fence_scsi_check\.pl 
  Resolves: #1255020


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-49
changelog:
  - Allow systemd-udevd to access netlink_route_socket to change names for network interfaces without unconfined.pp module. It affects also MLS. 
  Resolves:#1250456


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-50
changelog:
  - Add labels for afs binaries: dafileserver, davolserver, salvageserver, dasalvager 
  Resolves: #1192338
  - Add lsmd_plugin_t sys_admin capability, Allow lsmd_plugin_t getattr from sysfs filesystem.
   Resolves: #1238079
  - Allow rhsmcertd_t send signull to unconfined_service_t domains. 
  Resolves: #1176078
  - Remove file transition from snmp_manage_var_lib_dirs() interface which created snmp_var_lib_t dirs in var_lib_t.
  - Allow openhpid_t daemon to manage snmp files and dirs. 
  Resolves: #1243902
  - Allow mdadm_t domain read/write to general ptys and unallocated ttys. 
  Resolves: #1073314
  - Add interface unconfined_server_signull() to allow domains send signull to unconfined_service_t
   Resolves: #1176078


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-51
changelog:
  - Label /etc/ipa/nssdb dir as cert_t
  Resolves:#1262718
  - Do not provide docker policy files which is shipped by docker-selinux.rpm
  Resolves:#1262812


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-52
changelog:
  - Allow dirsrv-admin script to read passwd file. Allow dirsrv-admin script to read httpd pid files. Label dirsrv-admin unit file and allow dirsrv-admin domains to use it.
  Resolves: #1230300
  - Allow qpid daemon to connect on amqp tcp port.
  Resolves: #1261805


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-53
changelog:
  - Allow smbcontrol to create a socket in /var/samba which uses for a communication with smbd, nmbd and winbind. 
  Resolves: #1256459


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-54
changelog:
  - Add temporary fixes for sandbox related to #1103622. It allows to run everything under one sandbox type.
  Resolves:#1261938
  - Allow abrt_t domain to write to kernel msg device.
  Resolves: #1257828
  - Allow rpcbind_t domain to change file owner and group
  Resolves: #1265266


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-55
changelog:
  - We need to require sandbox_web_type attribute in sandbox_x_domain_template(). 
  Resolves: #1261938
  - ipsec: The NM helper needs to read the SAs
  Resolves: #1259786
  - ipsec: Allow ipsec management to create ptys
  Resolves: #1259786


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-56
changelog:
  - Remove labeling for modules_dep_t file contexts to have labeled them as modules_object_t.
  - Update files_read_kernel_modules() to contain modutils_read_module_deps_files() calling because module deps labeling could remain and it allows to avoid regressions.
  Resolves:#1266928


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-57
changelog:
  - Add missing labeling for /usr/libexec/abrt-hook-ccpp as a part of #1245477 and #1242467 bugs
  Resolves: #1254188
  - We need allow connect to xserver for all sandbox_x domain because we have one type for all sandbox processes.
  Resolves:#1261938


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-58
changelog:
  - Allow search dirs in sysfs types in kernel_read_security_state.
  Resolves: #1254188
  - Fix kernel_read_security_state interface that source domain of this interface can search sysctl_fs_t dirs.
  Resolves: #1254188


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-60
changelog:
  Allow hypervvssd to list all mountpoints to have VSS live backup working correctly.
  Resolves:#1247880


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-61
changelog:
  - Allow smbcontrol domain to send sigchld to ctdbd domain.
  Resolves: #1293784
  - Allow openvswitch read/write hugetlb filesystem.
  Resolves: #1278495


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-62
changelog:
  - Allow openvswitch to manage hugetlfs files and dirs.
  Resolves: rhbz#1278495
  - Add fs_manage_hugetlbfs_files() interface.
  Resolves: rhbz#1278495


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-64
changelog:
  - Add new SELinux policy fo targetd daemon.
  Resolves: rhbz#1063714
  - Add new SELinux policy fo ipmievd daemon.
  Resolves: rhbz#1083031
  - Add new SELinux policy fo hsqldb daemon.
  Resolves: rhbz#1083171
  - Add new SELinux policy for blkmapd daemon.
  Resolves: rhbz#1072997
  - Allow p11-child to connect to apache ports.
  - Label /usr/sbin/lvmlockd binary file as lvm_exec_t.
  Resolves: rhbz#1278028
  - Add interface "lvm_manage_lock" to lvm policy.
  Resolves: rhbz#1063714


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-65
changelog:
  - Allow sending dbus msgs between firewalld and system_cronjob domains. Resolves: rhbz#1284902
  - Allow zabbix-agentd to connect to following tcp sockets. One of zabbix-agentd functions is get service status of ftp,http,innd,pop,smtp protocols.
  Resolves:  rhbz#1242506
  - Add new boolean tmpreaper_use_cifs() to allow tmpreaper to run on local directories being shared with Samba.
  Resolves: rhbz#1284972
  - Add support for systemd-hwdb daemon.
   Resolves: rhbz#1257940
  - Add interface fs_setattr_cifs_dirs().
   Resolves: rhbz#1284972


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-67
changelog:
  - Allow rsync_export_all_ro boolean to read also non_auth_dirs/files/symlinks.
  Resolves: rhbz#1263770
  - Fix context of "/usr/share/nginx/html".
  Resolves: rhbz#1261857
  - Allow pmdaapache labeled as pcp_pmcd_t access to port 80 for apache diagnostics
  Resolves: rhbz#1270344
  - Allow pmlogger to create pmlogger.primary.socket link file.
   Resolves: rhbz#1270344
  - Label nagios scripts as httpd_sys_script_exec_t.
  Resolves: rhbz#1260306
  - Add dontaudit interface for kdumpctl_tmp_t
  Resolves: rhbz#1156442
  - Allow mdadm read files in EFI partition.
  Resolves: rhbz#1291801
  - Allow nsd_t to bind on nsf_control tcp port. Allow nsd_crond_t to read nsd pid.
  Resolves: rhbz#1293140
  - Label some new nsd binaries as nsd_exec_t Allow nsd domain net_admin cap. Create label nsd_tmp_t for nsd tmp files/dirs
  Resolves: rhbz#1293140
  - Add filename transition that /etc/princap will be created with cupsd_rw_etc_t label in cups_filetrans_named_content() interface.
  Resolves: rhbz#1265102
  - Add missing labeling for /usr/libexec/abrt-hook-ccpp.
  Resolves: rhbz#1213409
  - Allow pcp_pmie and pcp_pmlogger to read all domains state.
  Resolves: rhbz#1206525
  - Label /etc/redis-sentinel.conf as redis_conf_t. Allow redis_t write to redis_conf_t. Allow redis_t to connect on redis tcp port.
  Resolves: rhbz#1275246
  - cockpit has grown content in /var/run directory
  Resolves: rhbz#1279429
  - Allow collectd setgid capability
  Resolves:#1310898
  - Remove declaration of empty booleans in virt policy.
  Resolves: rhbz#1103153
  - Fix typo in drbd policy
  - Add new drbd file type: drbd_var_run_t. Allow drbd_t to manage drbd_var_run_t files/dirs. Allow drbd_t create drbd_tmp_t files in /tmp.
  Resolves: rhbz#1134883
  - Label /etc/ctdb/events.d/* as ctdb_exec_t. Allow ctdbd_t to setattr on ctdbd_exec_t files.
  Resolves: rhbz#1293788
  - Allow abrt-hook-ccpp to get attributes of all processes because of core_pattern.
  Resolves: rhbz#1254188
  - Allow abrt_t to read sysctl_net_t files.
  Resolves: rhbz#1254188
  - The ABRT coredump handler has code to emulate default core file creation The handler runs in a separate process with abrt_dump_oops_t SELinux process type. abrt-hook-ccpp also saves the core dump file in the very same way as kernel does and a user can specify CWD location for a coredump. abrt-hook-ccpp has been made as a SELinux aware apps to create this coredumps with correct labeling and with this commit the policy rules have been updated to allow access all non security files on a system.
  - Allow abrt-hook-ccpp to getattr on all executables.
  - Allow setuid/setgid capabilities for abrt-hook-ccpp.
   Resolves: rhbz#1254188
  - abrt-hook-ccpp needs to have setfscreate access because it is SELinux aware and compute a target labeling.
   Resolves: rhbz#1254188
  - Allow abrt-hook-ccpp to change SELinux user identity for created objects.
   Resolves: rhbz#1254188
  - Dontaudit write access to inherited kdumpctl tmp files.
   Resolves: rbhz#1156442
  - Add interface to allow reading files in efivarfs - contains Linux Kernel configuration options for UEFI systems (UEFI Runtime Variables)
   Resolves: rhbz#1291801
  - Label 8952 tcp port as nsd_control.
   Resolves: rhbz#1293140
  - Allow ipsec to use pam.
   Resolves: rhbz#1315700
  - Allow to log out to gdm after screen was resized in session via vdagent.
  Resolves: rhbz#1249020
  - Allow setrans daemon to read /proc/meminfo.
   Resolves: rhbz#1316804
  - Allow systemd_networkd_t to write kmsg, when kernel was started with following params: systemd.debug systemd.log_level=debug systemd.log_target=kmsg
  Resolves: rhbz#1298151
  - Label tcp port 5355 as llmnr-> Link-Local Multicast Name Resolution
  Resolves: rhbz#1236579
  - Add new selinux policy for systemd-resolved dawmon.
  Resolves: rhbz#1236579
  - Add interface ssh_getattr_server_keys() interface.
  Resolves: rhbz#1306197
  - Allow run sshd-keygen on second boot if first boot fails after some reason and content is not syncedon the disk. These changes are reflecting this commit in sshd. http://pkgs.fedoraproject.org/cgit/rpms/openssh.git/commit/?id=af94f46861844cbd6ba4162115039bebcc8f78ba rhbz#1299106
  Resolves: rhbz#1306197
  - Allow systemd_notify_t to write to kmsg_device_t when 'systemd.log_target=kmsg' option is used.
  Resolves: rhbz#1309417
  - Remove bin_t label for /etc/ctdb/events.d/. We need to label this scripts as ctdb_exec_t.
  Resolves: rhbz#1293788


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-68
changelog:
  - Create new permissivedomains CIL module and make it active.
  Resolves: rhbz#1320451
  - Add support for new mock location - /usr/libexec/mock/mock.
  Resolves: rhbz#1271209
  - Allow bitlee to create bitlee_var_t dirs.
  Resolves: rhbz#1268651
  - Allow CIM provider to read sssd public files.
  Resolves: rhbz#1263339
  - Fix some broken interfaces in distro policy.
  Resolves: rhbz#1121171
  - Allow power button to shutdown the laptop.
  Resolves: rhbz#995898
  - Allow lsm plugins to create named fixed disks.
  Resolves: rhbz#1238066
  - Add default labeling for /etc/Pegasus/cimserver_current.conf. It is a correct patch instead of the current /etc/Pegasus/pegasus_current.confResolves: rhbz#1278777
  - Allow hyperv domains to rw hyperv devices.
  Resolves: rhbz#1309361
  - Label /var/www/html(/.*)?/wp_backups(/.*)? as httpd_sys_rw_content_t.Resolves: rhbz#1246780
  - Create conman_unconfined_script_t type for conman script stored in /use/share/conman/exec/
  Resolves: rhbz#1297323
  - Fix rule definitions for httpd_can_sendmail boolean. We need to distinguish between base and contrib.
  - Add support for /dev/mptctl device used to check RAID status.
   Resolves: rhbz#1258029
  - Create hyperv* devices and create rw interfaces for this devices.
  Resolves: rhbz#1309361
  - Add fixes for selinux userspace moving the policy store to /var/lib/selinux.
  - Remove optional else block for dhcp ping


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-69
changelog:
  - Allow runnig php7 in fpm mode. From selinux-policy side, we need to allow httpd to read/write hugetlbfs.
  Resolves: rhbz#1319442
  - Allow openvswitch daemons to run under openvswitch Linux user instead of root. This change needs allow set capabilities: chwon, setgid, setuid, setpcap.
  Resolves: rhbz#1296640
  - Remove ftpd_home_dir() boolean from distro policy. Reason is that we cannot make this working due to m4 macro language limits.
  Resolves: rhbz#1097775
  - /bin/mailx is labeled sendmail_exec_t, and enters the sendmail_t domain on execution.  If /usr/sbin/sendmail does not have its own domain to transition to, and is not one of several products whose behavior is allowed by the sendmail_t policy, execution will fail. In this case we need to label /bin/mailx as bin_t.
  Resolves: rhbz#1262483
  - Allow nsd daemon to create log file in /var/log as nsd_log_t
  Resolves: rhbz#1293140
  - Sanlock policy update.   - New sub-domain for sanlk-reset daemon
  Resolves: rhbz#1212324
  - Label all run tgtd files, not just socket files
  Resolves: rhbz#1280280
  - Label all run tgtd files, not just socket files.
  Resolves: rhbz#1280280
  - Allow prosody to stream connect to sasl. This will allow using cyrus authentication in prosody.
  Resolves: rhbz#1321049
  - unbound wants to use ephemeral ports as a default configuration. Allow to use also udp sockets.
  Resolves: rhbz#1318224
  - Allow prosody to listen on port 5000 for mod_proxy65.
  Resolves: rhbz#1316918
  - Allow targetd to read/write to /dev/mapper/control device.
  Resolves: rhbz#1063714
  - Allow KDM to get status about power services. This change allow kdm to be able do shutdown.
  Resolves: rhbz#1316724
  - Allow systemd-resolved daemon creating netlink_route sockets.
  Resolves:rhbz#1236579
  - Allow systemd_resolved_t to read /etc/passwd file. Allow systemd_resolved_t to write to kmsg_device_t when 'systemd.log_target=kmsg' option is used
  Resolves: rhbz#1065362
  - Label /etc/selinux/(minimum|mls|targeted)/active/ as semanage_store_t
  Resolves: rhbz#1321943
  - Label all nvidia binaries as xserver_exec_t
  Resolves: rhbz#1322283


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-70
changelog:
  - Label /usr/bin/ganesha.nfsd as glusterd_exec_t to run ganesha as glusterd_t. Allow glusterd_t stream connect to rpbind_t. Allow cluster_t to create symlink /var/lib/nfs labeled as var_lib_nfs_t. Add interface rpc_filetrans_var_lib_nfs_content() Add new boolean: rpcd_use_fusefs to allow rpcd daemon use fusefs.
   Resolves: rhbz#1312809
   Resolves: rhbz#1323947
  - Allow dbus chat between httpd_t and oddjob_t. Resolves: rhbz#1324144
  - Label /usr/libexec/ipa/oddjob/org.freeipa.server.conncheck as ipa_helper_exec_t.
  Resolves: rhbz#1324144
  - Label /var/log/ipareplica-conncheck.log file as ipa_log_t Allow ipa_helper_t domain to manage logs labeledas ipa_log_t Allow ipa_helper_t to connect on http and kerberos_passwd ports.
  Resolves: rhbz#1324144
  - Allow prosody to listen on port 5000 for mod_proxy65.
  Resolves: rhbz#1316918
  - Allow pcp_pmcd_t domain to manage docker lib files. This rule is needed to allow pcp to collect container information when SELinux is enabled.
  Resolves: rhbz#1309454


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-71
changelog:
  - Add interface glusterd_dontaudit_read_lib_dirs()
  Resolves: rhbz#1295680
  - Dontaudit Occasionally observing AVC's while running geo-rep automation
  Resolves: rhbz#1295680
  - Allow glusterd to manage socket files labeled as glusterd_brick_t.
  Resolves: rhbz#1331561
  - Create new apache content template for files stored in user homedir. This change is needed to make working booleans: - httpd_enable_homedirs - httpd_read_user_content 
  Resolves: rhbz#1246522
  - Allow stunnel create log files. 
  Resolves: rhbz#1296851
  - Label tcp port 8181 as intermapper_port_t.
  Resolves: rhbz#1334783
  - Label tcp/udp port 2024 as xinuexpansion4_port_t
  Resolves: rhbz#1334783
  - Label tcp port 7002 as afs_pt_port_t Label tcp/udp port 2023 as xinuexpansion3_port_t
  Resolves: rhbz#1334783
  - Dontaudit ldconfig read gluster lib files.
  Resolves: rhbz#1295680
  - Add interface auth_use_nsswitch() to systemd_domain_template.
  Resolves: rhbz#1236579


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-72
changelog:
  - We need to restore contexts on /etc/passwd*,/etc/group*,/etc/*shadow* during install phase to get proper labeling for these files until selinux-policy pkgs are installed.
  Resolves: rhbz#1333952


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-73
changelog:
  - Allow logwatch to domtrans to postqueue
  Resolves: rhbz#1331542
  - Label /var/log/ganesha.log as gluster_log_t
  - Allow glusterd_t domain to create glusterd_log_t files.
  - Label /var/run/ganesha.pid as gluster_var_run_t.
  Resolves: rhbz#1335828
  - Allow zabbix to connect to postgresql port
  Resolves: rhbz#1330479
  - Add userdom_destroy_unpriv_user_shared_mem() interface.
  Related: rhbz#1306403
  - systemd-logind remove all IPC objects owned by a user on a logout. This covers also SysV memory. This change allows to destroy unpriviledged user SysV shared memory segments.
  Resolves: rhbz#1306403


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-74
changelog:
  - Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus.
  Resolves: rhbz#1336760
  - Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t.
  Resolves: rhbz#1336737


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-75
changelog:
  - dnsmasq: allow NetworkManager to control dnsmasq via D-Bus
  Resolves: rhbz#1336722
  - Directory Server (389-ds-base) has been updated to use systemd-ask-password. In order to function correctly we need the following added to dirsrv.te
  Resolves: rhbz#1333198
  - sftpd_* booleans are functionless these days.
  Resolves: rhbz#1335656
  - Label /var/log/ganesha.log as gluster_log_t Allow glusterd_t domain to create glusterd_log_t files. Label /var/run/ganesha.pid as gluster_var_run_t.
  Resolves: rhbz#1335828
  - Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus.
  Resolves: rhbz#1336760
  - Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t.
  Resolves: rhbz#1336737
  - Label /usr/libexec/storaged/storaged as lvm_exec_t to run storaged daemon in lvm_t SELinux domain.
  Resolves: rhbz#1264390
  - Allow systemd_hostanmed_t to read /proc/sysinfo labeled as sysctl_t.
  Resolves: rhbz#1337061
  - Revert "Allow all domains some process flags."
  Resolves: rhbz#1303644
  - Revert "Remove setrlimit to all domains."
  Resolves: rhbz#1303644
  - Label /usr/sbin/xrdp* files as bin_t
  Resolves: rhbz#1276777
  - Add mls support for some db classes
  Resolves: rhbz#1303651
  - Allow systemd_resolved_t to check if ipv6 is disabled.
  Resolves: rhbz#1236579
  - Allow systemd_resolved to read systemd_networkd run files.
  Resolves: rhbz#1236579


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-76
changelog:
  - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
  - Added missing docker interfaces:  - docker_typebounds  - docker_entrypoint
  Resolves: rhbz#1236580
  - New interfaces needed for systemd-machinectl
  Resolves: rhbz#1236580
  - New interfaces needed by systemd-machine
  Resolves: rhbz#1236580
  - Add interface allowing sending and receiving messages from virt over dbus.
  Resolves: rhbz#1236580
  - Backport docker policy from Fedora.
  Related: #1303123
  Resolves: #1341257
  - Allow NetworkManager_t and policykit_t read access to systemd-machined pid files.
  Resolves: rhbz#1236580
  - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
  - Added interfaces needed by new docker policy.
  Related: rhbz#1303123
  - Add support for systemd-machined daemon
  Resolves: rhbz#1236580
  - Allow rpm-ostree domain transition to install_t domain from init_t.
  Resolves: rhbz#1340542


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-77
changelog:
  - Allow tmpreaper_t to read/setattr all non_security_file_type dirs
  Resolves: rhbz#1115987
  - Allow firewalld to create firewalld_var_run_t directory.
  Resolves: rhbz#1304723
  - Add interface firewalld_read_pid_files()
  Resolves: rhbz#1304723
  - Label /usr/libexec/rpm-ostreed as rpm_exec_t.
  Resolves: rhbz#1340542
  - Allow sanlock service to read/write cephfs_t files.
  Resolves: rhbz#1315332
  - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
  - Added missing docker interfaces:  - docker_typebounds  - docker_entrypoint
  Resolves: rhbz#1236580
  - Add interface files_setattr_non_security_dirs()
  Resolves: rhbz#1115987
  - Add support for onloadfs
  - Allow iptables to read firewalld pid files.
  Resolves: rhbz#1304723
  - Add SELinux support for ceph filesystem.
  Resolves: rhbz#1315332
  - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
  Resolves: rhbz#1236580


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-78
changelog:
  - Allow glusterd domain read krb5_keytab_t files.
  Resolves: rhbz#1343929
  - Fix typo in files_setattr_non_security_dirs.
  Resolves: rhbz#1115987


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-80
changelog:
  - Allow conman to kill conman_unconfined_script.
  Resolves: rhbz#1297323
  - Make conman_unconfined_script_t as init_system_domain.
  Resolves:rhbz#1297323
  - Allow init dbus chat with apmd.
  Resolves:rhbz#995898
  - Patch /var/lib/rpm is symlink to /usr/share/rpm on Atomic, due to this change we need to label also /usr/share/rpm as rpm_var_lib_t.
  Resolves: rhbz#1233252
  - Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_t
  Resolves: rhbz#1052880
  - Add mediawiki rules to proper scope
  Resolves: rhbz#1301186
  - Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_t
  Resolves: rhbz#1052880
  - Allow mysqld_safe to inherit rlimit information from mysqld
  Resolves: rhbz#1323673
  - Allow collectd_t to stream connect to postgresql.
  Resolves: rhbz#1344056
  - Allow mediawiki-script to read /etc/passwd file.
  Resolves: rhbz#1301186
  - Add filetrans rule that NetworkManager_t can create net_conf_t files in /etc.
  Resolves: rhbz#1344505
  - Add labels for mediawiki123
  Resolves: rhbz#1293872
  - Fix label for all fence_scsi_check scripts
  - Allow ip netns to mounton root fs and unmount proc_t fs.
  Resolves: rhbz#1343776
  Resolves: rhbz#1286851
  - Allow sysadm_t to run newaliases command.
  Resolves: rhbz#1344828
  - Add interface sysnet_filetrans_named_net_conf()
  Resolves: rhbz#1344505


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-81
changelog:
  - Allow firewalld_t to create entries in net_conf_t dirs.
  Resolves: rhbz#1304723
  - Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals
  Resolves: rhbz#1288255
  - Allow mongod log to syslog.
  Resolves: rhbz#1306995
  - Allow rhsmcertd connect to port tcp 9090
  Resolves: rhbz#1337319
  - Label for /bin/mail(x) was removed but /usr/bin/mail(x) not. This path is also needed to remove. 
  Resolves: rhbz#1262483
  Resolves: rhbz#1277506
  - Label /usr/libexec/mimedefang-wrapper as spamd_exec_t.
  Resolves: rhbz#1301516
  - Add new boolean spamd_update_can_network.
  Resolves: rhbz#1305469
  - Allow rhsmcertd connect to tcp netport_port_t
  Resolves: rhbz#1329475
  - Fix SELinux context for /usr/share/mirrormanager/server/mirrormanager to Label all binaries under dir as mirrormanager_exec_t.
  Resolves: rhbz#1328234
  - Allow prosody to bind to fac_restore tcp port.
  Resolves: rhbz#1321787
  - Allow ninfod to read raw packets
  Resolves: rhbz#1317964
  - Allow pegasus get attributes from qemu binary files.
  Resolves: rhbz#1260835
  - Allow pegasus get attributes from qemu binary files.
  Resolves: rhbz#1271159
  - Allow tuned to use policykit. This change is required by cockpit.
  Resolves: rhbz#1346464
  - Allow conman_t to read dir with conman_unconfined_script_t binary files.
  Resolves: rhbz#1297323
  - Allow pegasus to read /proc/sysinfo.
  Resolves: rhbz#1265883
  - Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals.
  Resolves: rhbz#1288255
  - Label tcp ports:16379, 26379 as redis_port_t
  Resolves: rhbz#1348471
  - Allow systemd to relabel /var and /var/lib directories during boot.
  - Add files_relabel_var_dirs() and files_relabel_var_dirs() interfaces.
  - Add files_relabelto_var_lib_dirs() interface.
  - Label tcp port 2004 as mailbox_port_t.
  Resolves: rhbz#1332843
  - Label tcp and udp port 5582 as fac_restore_port_t
  Resolves: rhbz#1321787
  - Allow sysadm_t user to run postgresql-setup.
  Resolves: rhbz#1282543
  - Allow sysadm_t user to dbus chat with oddjob_t. This allows confined admin run oddjob mkhomedirfor script.
  Resolves: rhbz#1297480
  - Update netlink socket classes.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-82
changelog:
  - Label /var/lib/softhsm as named_cache_t. Allow named_t to manage named_cache_t dirs.
  Resolves:rhbz#1331315
  - Label named-pkcs11 binary as named_exec_t.
  Resolves: rhbz#1331315
  - Allow glusterd daemon to get systemd status
  Resolves: rhbz#1321785
  - Allow logrotate dbus-chat with system_logind daemon
  Resolves: rhbz#1283134
  - Allow pcp_pmlogger to read kernel network state Allow pcp_pmcd to read cron pid files
  Resolves: rhbz#1336211
  - Add interface cron_read_pid_files()
  Resolves: rhbz#1336211
  - Allow pcp_pmlogger to create unix dgram sockets
  Resolves: rhbz#1336211
  - Add hwloc-dump-hwdata SELinux policy
  Resolves: rhbz#1344054
  - Remove non-existing jabberd_spool_t() interface and add new jabbertd_var_spool_t.
  Resolves: rhbz#1121171
  - Remove non-existing interface salk_resetd_systemctl() and replace it with sanlock_systemctl_sanlk_resetd()
  Resolves: rhbz#1259764
  - Create label for openhpid log files. 
  esolves: rhbz#1259764
  - Label /var/lib/ganglia as httpd_var_lib_t
  Resolves: rhbz#1260536
  - Allow firewalld_t to create entries in net_conf_t dirs.
  Resolves: rhbz#1304723
  - Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals
  Resolves: rhbz#1288255
  - Include patch from distgit repo: policy-RHEL-7.1-flask.patch.
  Resolves: rhbz#1329560
  - Update refpolicy to handle hwloc
  Resolves: rhbz#1344054
  - Label /etc/dhcp/scripts dir as bin_t
  - Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals.
  Resolves: rhbz#1288255


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-83
changelog:
  - Allow krb5kdc_t to communicate with sssd
  Resolves: rhbz#1319933
  - Allow prosody to bind on prosody ports
  Resolves: rhbz#1304664
  - Add dac_override caps for fail2ban-client
  Resolves: rhbz#1316678
  - dontaudit read access for svirt_t on the file /var/db/nscd/group
  Resolves: rhbz#1301637
  - Allow inetd child process to communicate via dbus with systemd-logind
  Resolves: rhbz#1333726
  - Add label for brltty log file
  Resolves: rhbz#1328818
  - Allow dspam to read the passwd file
  Resolves: rhbz#1286020
  - Allow snort_t to communicate with sssd
  Resolves: rhbz#1284908
  - svirt_sandbox_domains need to be able to execmod for badly built libraries.
  Resolves: rhbz#1206339
  - Add policy for lttng-tools package.
  Resolves: rhbz#1256374
  - Make mirrormanager as application domain.
  Resolves: rhbz#1328234
  - Add support for the default lttng-sessiond port - tcp/5345.  This port is used by LTTng 2.x central tracing registry session daemon.
  - Add prosody ports
  Resolves: rhbz#1304664
  - Allow sssd read also sssd_conf_t dirs
  Resolves: rhbz#1350535


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-84
changelog:
  - Fix typo in brltty SELinux module
  - Add new SELinux module sbd
  Resolves: rhbz#1322725
  - Allow pcp dmcache metrics collection
  Resolves: rhbz#1309883
  - Allow pkcs_slotd_t to create dir in /var/lock Add label pkcs_slotd_log_t
  Resolves: rhbz#1350782
  - Allow openvpn to create sock files labeled as openvpn_var_run_t
  Resolves: rhbz#1328246
  - Allow hypervkvp daemon to getattr on  all filesystem types.
  Resolves: rhbz#1349356
  - Allow firewalld to create net_conf_t files
  Resolves: rhbz#1304723
  - Allow mock to use lvm
  Resolves: rhbz#1271209
  - Allow keepalived to create netlink generic sockets.
  Resolves: rhbz#1349809
  - Allow mirromanager creating log files in /tmp
  Resolves:rhbz#1328818
  - Rename few modules to make it consistent with source files
  Resolves: rhbz#1351445
  - Allow vmtools_t to transition to rpm_script domain
  Resolves: rhbz#1342119
  - Allow nsd daemon to manage nsd_conf_t dirs and files
  Resolves: rhbz#1349791
  - Allow cluster to create dirs in /var/run labeled as cluster_var_run_t
  Resolves: rhbz#1346900
  - Allow sssd read also sssd_conf_t dirs
  Resolves: rhbz#1350535
  - Dontaudit su_role_template interface to getattr /proc/kcore Dontaudit su_role_template interface to getattr /dev/initctl
  Resolves: rhbz#1086240
  - Add interface lvm_getattr_exec_files()
  Resolves: rhbz#1271209
  - Fix typo Compliling vs. Compiling
  Resolves: rhbz#1351445


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-85
changelog:
  - Allow virtual machines to rw infiniband devices.
  Resolves: rhbz#1210263
  - Allow opensm daemon to rw infiniband_mgmt_device_t
  Resolves: rhbz#1210263
  - Allow systemd_hwdb_t to relabel /etc/udev/hwdb.bin file.
  Resolves: rhbz#1350756
  - Make label for new infiniband_mgmt deivices
  Resolves: rhbz#1210263


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-86
changelog:
  - Allow udev to manage systemd-hwdb files
  - Add interface systemd_hwdb_manage_config()
  Resolves: rhbz#1350756
  - Fix paths to infiniband devices. This allows use more then two infiniband interfaces.
  Resolves: rhbz#1210263


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-87
changelog:
  - Allow lttng tools to block suspending
  Resolves: rhbz#1256374
  - Allow creation of vpnaas in openstack
  Resolves: rhbz#1352710
  - virt: add strict policy for virtlogd daemon
  Resolves:rhbz#1311606
  - Update makefile to support snapperd_contexts file
  Resolves: rhbz#1352681


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-88
changelog:
  - Allow rhsmcertd to copy certs into /etc/docker/cert.d
  - Add interface docker_rw_config()
  Resolves: rhbz#1344500
  - Fix logrotate fc file to label also /var/lib/logrotate/ dir as logrotate_var_lib_t
  Resolves: rhbz#1355632
  - Allow rhsmcertd to read network sysctls
  Resolves: rhbz#1329475
  - Label /var/log/graphite-web dir as httpd_log_t
  Resolves: rhbz#1310898
  - Allow mock to use generic ptys
  Resolves: rhbz#1271209
  - Allow adcli running as sssd_t to write krb5.keytab file.
  Resolves: rhbz#1356082
  - Allow openvswitch connect to openvswitch_port_t type.
  Resolves: rhbz#1335024
  - Add SELinux policy for opendnssec service.
  Resolves: rhbz#1350957
  - Create new SELinux type for /usr/libexec/ipa/ipa-dnskeysyncd
  Resolves: rhbz#1350957
  - label /dev/ndctl0 device as nvram_device_t
  Resolves: rhbz#1355809


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-89
changelog:
  - Allow firewalld to manage net_conf_t files.
  Resolves:rhbz#1304723
  - Allow logrotate read logs inside containers.
  Resolves: rhbz#1303514
  - Allow sssd to getattr on fs_t
  Resolves: rhbz#1356082
  - Allow opendnssec domain to manage bind chace files
  Resolves: rhbz#1350957
  - Fix typo in rhsmcertd  policy module
  Resolves: rhbz#1329475
  - Allow systemd to get status of systemd-logind daemon
  Resolves: rhbz#1356141
  - Label more ndctl devices not just ndctl0
  Resolves: rhbz#1355809


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-90
changelog:
  - Allow ipa-dnskey read system state.
  Reasolves: rhbz#1350957
  - Allow dogtag-ipa-ca-renew-agent-submit labeled as certmonger_t to create /var/log/ipa/renew.log file
  Resolves: rhbz#1350957


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-92
changelog:
  - Dontaudit mock_build_t can list all ptys.
  Resolves: rhbz#1271209
  - Allow ftpd_t to mamange userhome data without any boolean.
  Resolves: rhbz#1097775
  - Add logrotate permissions for creating netlink selinux sockets.
  Resolves: rhbz#1283134
  - Allow lsmd_plugin_t to exec ldconfig.
  Resolves: rhbz#1238066
  - Allow vnstatd domain to read /sys/class/net/ files
  Resolves: rhbz#1358243
  - Remove duplicate allow rules in spamassassin SELinux module
  Resolves:rhbz#1358175
  - Allow spamc_t and spamd_t domains create .spamassassin file in user homedirs
  Resolves:rhbz#1358175
  - Allow sshd setcap capability. This is needed due to latest changes in sshd
  Resolves: rhbz#1357857
  - Add new MLS attribute to allow relabeling objects higher than system low. This exception is needed for package managers when processing sensitive data.
  Resolves: rhbz#1330464
  - Allow gnome-keyring also manage user_tmp_t sockets.
  Resolves: rhbz#1257057
  - corecmd: Remove fcontext for /etc/sysconfig/libvirtd
  Resolves:rhbz#1351382


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-93
changelog:
  - Dontaudit mock to write to generic certs.
  Resolves: rhbz#1271209
  - Add labeling for corosync-qdevice and corosync-qnetd daemons, to run as cluster_t
  Resolves: rhbz#1347514
  - Revert "Label corosync-qnetd and corosync-qdevice as corosync_t domain"
  - Allow modemmanager to write to systemd inhibit pipes
  Resolves: rhbz#1365214
  - Label corosync-qnetd and corosync-qdevice as corosync_t domain
  Resolves: rhbz#1347514
  - Allow ipa_helper to read network state
  Resolves: rhbz#1361636
  - Label oddjob_reqiest as oddjob_exec_t
  Resolves: rhbz#1361636
  - Add interface oddjob_run()
  Resolves: rhbz#1361636
  - Allow modemmanager chat with systemd_logind via dbus
  Resolves: rhbz#1362273
  - Allow NetworkManager chat with puppetagent via dbus
  Resolves: rhbz#1363989
  - Allow NetworkManager chat with kdumpctl via dbus
  Resolves: rhbz#1363977
  - Allow sbd send msgs to syslog Allow sbd create dgram sockets. Allow sbd to communicate with kernel via dgram socket Allow sbd r/w kernel sysctls.
  Resolves: rhbz#1322725
  - Allow ipmievd_t domain to re-create ipmi devices Label /usr/libexec/openipmi-helper as ipmievd_exec_t
  Resolves: rhbz#1349058
  - Allow rasdaemon to use tracefs filesystem.
  Resolves: rhbz#1364380
  - Fix typo bug in dirsrv policy
  - Some logrotate scripts run su and then su runs unix_chkpwd. Allow logrotate_t domain to check passwd.
  Resolves: rhbz#1283134
  - Add ipc_lock capability to sssd domain. Allow sssd connect to http_cache_t
  Resolves: rhbz#1362688
  - Allow dirsrv to read dirsrv_share_t content
  Resolves: rhbz#1363662
  - Allow virtlogd_t to append svirt_image_t files.
  Resolves: rhbz#1358140
  - Allow hypervkvp domain to read hugetlbfs dir/files.
  Resolves: rhbz#1349356
  - Allow mdadm daemon to read nvme_device_t blk files
  Resolves: rhbz#1362564
  - Allow selinuxusers and unconfineduser to run oddjob_request
  Resolves: rhbz#1361636
  - Allow sshd server to acces to Crypto Express 4 (CEX4) devices.
  Resolves: rhbz#1362539
  - Fix labeling issue in init.fc file. Path /usr/lib/systemd/fedora-* changed to /usr/lib/systemd/rhel-*.
  Resolves: rhbz#1363769
  - Fix typo in device interfaces
  Resolves: rhbz#1349058
  - Add interfaces for managing ipmi devices
  Resolves: rhbz#1349058
  - Add interfaces to allow mounting/umounting tracefs filesystem
  Resolves: rhbz#1364380
  - Add interfaces to allow rw tracefs filesystem
  Resolves: rhbz#1364380
  - Add interface dev_read_nvme() to allow reading Non-Volatile Memory Host Controller devices.
  Resolves: rhbz#1362564
  - Label /sys/kernel/debug/tracing filesystem
  Resolves: rhbz#1364380
  - Allow sshd setcap capability. This is needed due to latest changes in sshd
  Resolves: rhbz#1357857


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-94
changelog:
  - Allow ipmievd domain to create lock files in /var/lock/subsys/
  Resolves:rhbz#1349058
  - Update policy for ipmievd daemon.
  Resolves:rhbz#1349058
  - Dontaudit hyperkvp to getattr on non security files.
  Resolves: rhbz#1349356
  - Label /run/corosync-qdevice and /run/corosync-qnetd as corosync_var_run_t
  Resolves: rhbz#1347514
  - Fixed lsm SELinux module
  - Add sys_admin capability to sbd domain
  Resolves: rhbz#1322725
  - Allow vdagent to comunnicate with systemd-logind via dbus
  Resolves: rhbz#1366731
  - Allow lsmd_plugin_t domain to create fixed_disk device.
  Resolves: rhbz#1238066
  - Allow opendnssec domain to create and manage own tmp dirs/files
  Resolves: rhbz#1366649
  - Allow opendnssec domain to read system state
  Resolves: rhbz#1366649
  - Update opendnssec_manage_config() interface to allow caller domain also manage opendnssec_conf_t dirs
  Resolves: rhbz#1366649
  - Allow rasdaemon to mount/unmount tracefs filesystem.
  Resolves: rhbz#1364380
  - Label /usr/libexec/iptables/iptables.init as iptables_exec_t Allow iptables creating lock file in /var/lock/subsys/
  Resolves: rhbz#1367520
  - Modify interface den_read_nvme() to allow also read nvme_device_t block files.
  Resolves: rhbz#1362564
  - Label /var/run/storaged as lvm_var_run_t.
  Resolves: rhbz#1264390
  - Allow unconfineduser to run ipa_helper_t.
  Resolves: rhbz#1361636


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-95
changelog:
  - Label /etc/pki/pki-tomcat/ca/ as pki_tomcat_cert_t
  Resolves:rhbz#1366915
  - Allow certmonger to manage all systemd unit files
  Resolves:rhbz#1366915
  - Grant certmonger "chown" capability
  Resolves:rhbz#1366915
  - Allow ipa_helper_t stream connect to dirsrv_t domain
  Resolves: rhbz#1368418
  - Update oracleasm SELinux module
  Resolves: rhbz#1331383
  - label /var/lib/kubelet as svirt_sandbox_file_t
  Resolves: rhbz#1369159
  - Add few interfaces to cloudform.if file
  Resolves: rhbz#1367834
  - Label /var/run/corosync-qnetd and /var/run/corosync-qdevice as cluster_var_run_t. Note: corosync policy is now par of rhcs module
  Resolves: rhbz#1347514
  - Allow krb5kdc_t to read krb4kdc_conf_t dirs.
  Resolves: rhbz#1368492
  - Update networkmanager_filetrans_named_content() interface to allow source domain to create also temad dir in /var/run.
  Resolves: rhbz#1365653
  - Allow teamd running as NetworkManager_t to access netlink_generic_socket to allow multiple network interfaces to be teamed together.
  Resolves: rhbz#1365653
  - Label /dev/oracleasmfs as oracleasmfs_t. Add few interfaces related to oracleasmfs_t type
  Resolves: rhbz#1331383
  - A new version of cloud-init that supports the effort to provision RHEL Atomic on Microsoft Azure requires some a new rules that allows dhclient/dhclient hooks to call cloud-init.
  Resolves: rhbz#1367834
  - Allow iptables to creating netlink generic sockets.
  Resolves: rhbz#1364359


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-96
changelog:
  - Allow arpwatch to create netlink netfilter sockets. Resolves: rhbz#1358261
  - Fix file context for /etc/pki/pki-tomcat/ca/
  - new interface oddjob_mkhomedir_entrypoint()
  - Move label for /var/lib/docker/vfs/ to proper SELinux module
  - Allow mdadm to get attributes from all devices.
  - Label /etc/puppetlabs as puppet_etc_t.
  - Allow systemd-machined to communicate to lxc container using dbus
  - Allow systemd_resolved to send dbus msgs to userdomains Resolves: rhbz#1236579
  - Allow systemd-resolved to read network sysctls Resolves: rhbz#1236579
  - Allow systemd_resolved to connect on system bus. Resolves: rhbz#1236579
  - Make entrypoint oddjob_mkhomedir_exec_t for unconfined_t
  - Label all files in /dev/oracleasmfs/ as oracleasmfs_t Resolves: rhbz#1331383


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-97
changelog:
  - Add oracleasm_conf_t type and allow oracleasm_t to create /dev/oracleasm
  Resolves: rhbz#1331383
  - Label /usr/share/pcp/lib/pmie as pmie_exec_t and /usr/share/pcp/lib/pmlogger as pmlogger_exec_t
  Resolves: rhbz#1206525
  - Allow mdadm_t to getattr all device nodes
  Resolves: rhbz#1365171
  - Add interface dbus_dontaudit_stream_connect_system_dbusd()
  Resolves:rhbz#1052880
  - Add virt_stub_* interfaces for docker policy which is no longer a part of our base policy.
  Resolves: rhbz#1372705
  - Allow guest-set-user-passwd to set users password.
  Resolves: rhbz#1369693
  - Allow samdbox domains to use msg class
  Resolves: rhbz#1372677
  - Allow domains using kerberos to read also kerberos config dirs
  Resolves: rhbz#1368492
  - Allow svirt_sandbox_domains to r/w onload sockets
  Resolves: rhbz#1342930
  - Add interface fs_manage_oracleasm()
  Resolves: rhbz#1331383
  - Label /dev/kfd as hsa_device_t
  Resolves: rhbz#1373488
  - Update seutil_manage_file_contexts() interface that caller domain can also manage file_context_t dirs
  Resolves: rhbz#1368097
  - Add interface to write to nsfs inodes
  Resolves: rhbz#1372705
  - Allow systemd services to use PrivateNetwork feature
  Resolves: rhbz#1372705
  - Add a type and genfscon for nsfs.
  Resolves: rhbz#1372705
  - Allow run sulogin_t in range mls_systemlow-mls_systemhigh.
  Resolves: rhbz#1290400


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-98
changelog:
  - Update oracleasm SELinux module that can manage oracleasmfs_t blk files. Add dac_override cap to oracleasm_t domain.
  Resolves: rhbz#1331383
  - Add few rules to pcp SELinux module to make ti able to start pcp_pmlogger service
  Resolves: rhbz#1206525


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-99
changelog:
  - Allow iscsid create netlink iscsid sockets.
  Resolves: rhbz#1358266
  - Improve regexp for power_unit_file_t files. To catch just systemd power unit files.
  Resolves: rhbz#1375462


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-100
changelog:
  - Allow ftp daemon to manage apache_user_content
  Resolves: rhbz#1097775
  - Label /etc/sysconfig/oracleasm as oracleasm_conf_t
  Resolves: rhbz#1331383
  - Allow oracleasm to rw inherited fixed disk device
  Resolves: rhbz#1331383
  - Allow collectd to connect on unix_stream_socket
  Resolves: rhbz#1377259


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-101
changelog:
  - Allow pcp_pmcd_t domain transition to lvm_t Add capability kill and sys_ptrace to pcp_pmlogger_t
  Resolves: rhbz#1309883


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-102.1
changelog:
  - Allow sssd_selinux_manager_t to manage also dir class.
  Resolves: rhbz#1380687
  - Add interface seutil_manage_default_contexts_dirs()
  Resolves: rhbz#1380687


author: Petr Lautrbach <plautrba@redhat.com> - 3.13.1-102.3
changelog:
  - Use selinux-policy-migrate-local-changes.sh instead of migrateStore* macros
  Resolves: rhbz#1383450
  - Add selinux-policy-migrate-local-changes service
  Resolves: rhbz#1383450


author: Miroslav Grepl <mgrepl@redhat.com> - 3.13.1-102.4
changelog:
  - Allow GlusterFS with RDMA transport to be started correctly. It requires ipc_lock capability together with rw permission on rdma_cm device.
  Resolves:#1386620
  - Allow glusterd to get attributes on /sys/kernel/config directory.
  Resolves:#1386621


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-102.5
changelog:
  - Fix error message during update from RHEL-7.2 to RHEL-7.3, when /usr/sbin/semanage command is not installed and selinux-policy-migrate-local-changes.sh script is executed in %post install phase of selinux-policy package
  Resolves: rhbz#1393045


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-102.7
changelog:
  - Update systemd on RHEL-7.2 box to version from RHEL-7.3 and then as a separate yum command update the selinux policy systemd will start generating USER_AVC denials and will start returning "Access Denied" errors to DBus clients.
  Resolves: rhbz#1394715


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-102.8
changelog:
  - Allow puppetagent_t to access timedated dbus. Use the systemd_dbus_chat_timedated interface to allow puppetagent_t the access.
  Resolves: rhbz#1400505


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-102.12
changelog:
  - Allow glusterd_t to bind on glusterd_port_t udp ports.
  Resolves: rhbz#1408128
  - Allow glusterd_t send signals to userdomain. Label new glusterd binaries as glusterd_exec_t
  Resolves: rhbz#1408128
  - Fixes for containers
  - Allow containers to attempt to write to unix_sysctls.
  - Allow cotainers to use the FD's leaked to them from parent processes.
  Resolves: rhbz#1408126
  - Allow systemd to stop glusterd_t domains.
  Resolves: rhbz#1408125


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-102.13
changelog:
  - Allow systemd container to read/write usermodehelperstate
  Resolves: rhbz#1408126
  - Allow glusterd_t to bind on glusterd_port_t udp ports.
  Resolves: rhbz#1408128


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-102.16
changelog:
  - Allow openvswitch read script state.
  - Allow openvswitch exec hostname and readinitrc_t files
  Resolves: rhbz#1430751


author: Adam Stokes <ajs at redhat dot com> = 1.8-21
changelog:
  - more sanitizing options for log files
  - rhbz fixes from RHEL version merged into trunk
  - progressbar update


author: Adam Stokes <ajs at redhat dot com> = 1.9-1
changelog:
  - version bump 1.9
  - replaced compression utility with xz
  - strip threading/multiprocessing
  - simplified progress indicator
  - pylint update
  - put global vars in class container
  - unittests
  - simple profiling
  - make use of xgettext as pygettext is deprecated


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-3
changelog:
  - Fix cluster plugin dlm lockdump for el6
  - Add sssd plugin to collect configuration and logs
  - Collect /etc/anacrontab in system plugin
  - Correct handling of redhat-release for el6


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-4
changelog:
  - Fix collection of logs and config files in sssd.py
  - Add support for collecting entitlement certificates in rhn.py


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-6
changelog:
  - Fix collection of chkconfig output in startup.py
  - Collect /etc/dhcp in dhcp.py plugin
  - Collect dmsetup ls --tree output in devicemapper.py
  - Collect lsblk output in filesys.py


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-9
changelog:
  - Collect yum repository list by default
  - Add basic Infiniband plugin
  - Add plugin for scsi-target-utils iSCSI target
  - Fix autofs plugin LC_ALL usage
  - Fix collection of lsusb and add collection of -t and -v outputs
  - Extend data collection by qpidd plugin
  - Add ethtool pause, coalesce and ring (-a, -c, -g) options to network plugin


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-10
changelog:
  - Fix collection of data from LVM2 reporting tools in devicemapper plugin
  - Add /proc/vmmemctl collection to vmware plugin


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-11
changelog:
  - Truncate files that exceed specified size limit
  - Add support for collecting Red Hat Subscrition Manager configuration
  - Collect /etc/init on systems using upstart
  - Don't strip whitespace from output of external programs
  - Collect ipv6 neighbour table in network module
  - Collect basic cgroups configuration data


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-15
changelog:
  - Fix brctl collection when a bridge contains no interfaces
  - Fix up2dateclient path in hardware plugin


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-16
changelog:
  - Fix execution of RHN hardware.py from hardware plugin
  - Fix hardware plugin to support new lsusb path


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-18
changelog:
  - Collect fence_virt.conf in cluster module
  - Fix collection of /proc/net directory tree
  - Gather output of cpufreq-info when present
  - Fix brctl showstp output when bridges contain multiple interfaces
  - Add /etc/modprobe.d to kernel module
  - Ensure relative symlink targets are correctly handled when copying
  - Fix satellite and proxy package detection in rhn plugin
  - Collect stderr output from external commands
  - Collect /proc/cgroups in the cgroups module
    Resolve: bz784874
  - Collect /proc/irq in the kernel module
  - Fix installed-rpms formatting for long package names
  - Add symbolic links for truncated log files
  - Collect non-standard syslog and rsyslog log files
  - Use correct paths for tomcat6 in RHN module
  - Obscure root password if present in anacond-ks.cfg
  - Do not accept embedded forward slashes in RHN usernames
  - Add new sunrpc module to collect rpcinfo for gluster systems


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-19
changelog:
  - Collect additional diagnostic information for realtime systems
  - Improve sanitization of RHN user and case number in report name
  - Fix verbose output and debug logging
  - Add basic support for CloudForms data collection
  - Add support for Subscription Asset Manager diagnostics


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-22
changelog:
  - Correct aeolus debug invocation in CloudForms module
  - Update gluster module for gluster-3.3
  - Add additional command output to gluster module
  - Add support for collecting gluster configuration and logs


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-29
changelog:
  - Collect the swift configuration directory in gluster module
  - Update IPA module and related plug-ins


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-31
changelog:
  - Avoid calling volume status when collecting gluster statedumps
  - Use a default report name if --name is empty
  - Quote tilde characters passed to shell in RPM module
  - Collect KDC and named configuration in ipa module
  - Sanitize hostname characters before using as report path
  - Collect /etc/multipath in device-mapper module
  - New plug-in for PostgreSQL
  - Add OpenStack module
  - Avoid deprecated sysctls in /proc/sys/net
  - Fix error logging when calling external programs
  - Use ip instead of ifconfig to generate network interface lists


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-32
changelog:
  - Collect /proc/pagetypeinfo in memory module
  - Strip trailing newline from command output
  - Add sanlock module
  - Do not collect archived accounting files in psacct module
  - Call spacewalk-debug from rhn module to collect satellite data


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-33
changelog:
  - Add Red Hat Update Infrastructure module
  - Collect /proc/iomem in hardware module
  - Collect subscription-manager output in general module
  - Collect rhsm log files in general module
  - Fix exception in gluster module on non-gluster systems
  - Fix exception in psql module when dbname is not given


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-35
changelog:
  - Report --name and --ticket values as defaults
  - Fix device-mapper command execution logging
  - Fix data collection and rename PostreSQL module to pgsql


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-3
changelog:
  - Add crm_report support to cluster plug-in
    Resolves: bz839342
  - Fix rhel_version() usage in cluster and s390 plug-ins
    Resolves: bz916705
  - Strip trailing newline from command output
    Resolves: bz971420


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-4
changelog:
  - Do not attempt to read RPC pseudo files in networking plug-in
    Resolves: bz996992, bz996994
  - Restrict wbinfo collection to the current domain
    Resolves: bz997101
  - Add obfuscation of luci secrets to cluster plug-in
    Resolves: bz997090
  - Add XFS plug-in
    Resolves: bz997094
  - Fix policy class handling of --tmp-dir
    Resolves: bz997083
  - Do not set batch mode if stdin is not a TTY
    Resolves: bz1002943
  - Attempt to continue when reading bad input in interactive mode
    Resolves: bz1002943


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-5
changelog:
  - Include /etc/yaboot.conf in boot plug-in
    Resolves: bz1001966
  - Fix collection of brctl output in networking plug-in
    Resolves: bz1019235
  - Verify limited set of RPM packages by default
    Resolves: bz1019863
  - Do not strip newlines from command output
    Resolves: bz1019338
  - Limit default sar data collection
    Resolves: bz1001599


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-6
changelog:
  - Remove version checks in gluster plug-in
    Resolves: bz1015606
  - Check for usable temporary directory
    Resolves: bz1019517
  - Fix --alloptions command line option
    Resolves: bz1019356
  - Fix configuration fail regression
    Resolves: bz1019516


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-7
changelog:
  - Add domainname output to NIS plug-in
    Resolves: bz1026906
  - Collect /var/log/squid in squid plug-in
    Resolves: bz1026829
  - Collect mountstats and mountinfo in filesys plug-in
    Resolves: bz1026869
  - Add PowerPC plug-in from upstream
    Resolves: bz1025236


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-9
changelog:
  - Restore --build command line option
    Resolves: bz1015599
  - Collect saved vmcore-dmesg.txt files
    Resolves: bz1026959
  - Normalize temporary directory paths
    Resolves: bz829069


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-10
changelog:
  - Add nfs client plug-in
    Resolves: bz1028072
  - Fix traceback when sar module force-enabled
    Resolves: bz1028125


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-12
changelog:
  - Fix typo in yum plug-in add_forbidden_paths
    Resolves: bz829297
  - Add krb5 plug-in and drop collection of krb5.keytab
    Resolves: bz1028150


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-15
changelog:
  - Remove debug statements from logs plugin
    Resolves: bz1030042
  - Make ethernet interface detection more robust
    Resolves: bz1030824
  - Fix specifying multiple plugin options on the command line
    Resolves: bz1031124
  - Make log and message levels match previous versions
    Resolves: bz1031126
  - Log a warning message when external commands time out
    Resolves: bz1034956
  - Remove --upload command line option
    Resolves: bz1028484
  - Update sos UI text to match upstream
    Resolves: bz1034970


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-16
changelog:
  - Add new plugin to collect OpenHPI configuration
    Resolves: bz1028121
  - Fix cluster plugin crm_report support
    Resolves: bz1030553
  - Fix file postprocessing in ldap plugin
    Resolves: bz1030602
  - Remove collection of anaconda-ks.cfg from general plugin
    Resolves: bz1034865


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-17
changelog:
  - Fix get_option use in cluster plugin
    Resolves: bz1030553
  - Fix debug logging to file when given '-v'
    Resolves: bz1031126
  - Always treat rhevm plugin's vdsmlogs option as a string
    Resolves: bz1030617
  - Run the rhsm-debug script from yum plugin
    Resolves: bz1039036


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-18
changelog:
  - Prevent file descriptor leaks when using Popen
    Resolves: bz1051009
  - Disable zip archive creation when running rhsm-debug
    Resolves: bz1039036
  - Include volume geo-replication status in gluster plugin
    Resolves: bz1036752


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-19
changelog:
  - Fix generation of volume names in gluster plugin
    Resolves: bz1036752
  - Add distupgrade plugin
    Resolves: bz1059760


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-3
changelog:
  - [pam] add pam_tally2 and faillock support
    Resolves: bz1127631
  - [postgresql] obtain db password from the environment
    Resolves: bz1126001
  - [pcp] add Performance Co-Pilot plugin
    Resolves: bz1119833
  - [nfsserver] collect /etc/exports.d
    Resolves: bz1118921
  - [sosreport] handle --compression-type correctly
    Resolves: bz1118152
  - [anaconda] redact passwords in kickstart configurations
    Resolves: bz1112175
  - [haproxy] add new plugin
    Resolves: bz1107865
  - [keepalived] add new plugin
    Resolves: bz1105247
  - [lvm2] set locking_type=0 when calling lvm commands
    Resolves: bz1102285
  - [tuned] add new plugin
    Resolves: bz1095447
  - [cgroups] collect /etc/sysconfig/cgred
    Resolves: bz1083677
  - [plugins] ensure doc text is always displayed for plugins
    Resolves: bz1065473
  - [sosreport] fix the distribution version API call
    Resolves: bz1028111
  - [docker] add new plugin
    Resolves: bz1084990
  - [openstack_*] include broken-out openstack plugins
    Resolves: bz1140756
  - [mysql] support MariaDB
    Resolves: bz1106600
  - [openstack] do not collect /var/lib/nova
    Resolves: bz1106423
  - [grub2] collect grub.cfg on UEFI systems
    Resolves: bz1086648
  - [sosreport] handle out-of-space errors gracefully
    Resolves: bz1087977
  - [firewalld] new plugin
    Resolves: bz1100505
  - [networking] collect NetworkManager status
    Resolves: bz1100505
  - [kpatch] new plugin
    Resolves: bz1110918
  - [global] update to upstream 3.2 release
    Resolves: bz1026962


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-4
changelog:
  - [yum] call rhsm-debug with --no-subscriptions
    Resolves: bz1116349
  - [powerpc] allow PowerPC plugin to run on ppc64le
    Resolves: bz1140427
  - [package] add Obsoletes for sos-plugins-openstack
    Resolves: bz1140756


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-5
changelog:
  - [corosync] add postprocessing for corosync-objctl output
    Resolves: bz1087515
  - [ovirt_hosted_engine] fix exception when force-enabled
    Resolves: bz1148551


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-6
changelog:
  - [tomcat] add support for tomcat7 and default log size limits
    Resolves: bz1148375
  - [mysql] obtain database password from the environment
    Resolves: bz1126001


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-8
changelog:
  - [kpatch] do not attempt to collect data if kpatch is not installed
    Resolves: bz1110918
  - [archive] drop support for Zip archives
    Resolves: bz1118152


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-9
changelog:
  - [navicli] catch exceptions if stdin is unreadable
    Resolves: bz1166039
  - [docs] update man page for new options
    Resolves: bz1171658
  - [sosreport] make all utf-8 handling user errors=ignore
    Resolves: bz1164267


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-11
changelog:
  - [sosreport] do not make logging calls after OSError
    Resolves: bz1087977
  - [sosreport] catch OSError exceptions in SoSReport.execute()
    Resolves: bz1087977
  - [anaconda] make useradd password regex tolerant of whitespace
    Resolves: bz1112175


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-12
changelog:
  - [plugin] limit path names to PC_NAME_MAX
    Resolves: bz1026962
  - [squid] collect files from /var/log/squid
    Resolves: bz1026962
  - [sosreport] log plugin exceptions to a file
    Resolves: bz1026962
  - [ctdb] fix collection of /etc/sysconfig/ctdb
    Resolves: bz1026962
  - [sosreport] fix silent exception handling
    Resolves: bz1026962


author: Pavel Moravec <pmoravec@redhat.com> = 3.2-17
changelog:
  - [openstack_neutron] neutron configuration and logs files not captured
    Resolves: bz1213315
  - [ovirt] remove ovirt-engine setup answer file password leak
    Resolves: bz1162788
  - [networking] network plugin fails if NetworkManager is disabled
    Resolves: bz1206633


author: Pavel Moravec <pmoravec@redhat.com> = 3.2-20
changelog:
  - [cluster] crm_report fails to run because dir already exists
    Resolves: bz1200526
  - [foreman] Skip collection of generic resources
    Resolves: bz1135317
  - [apache] Added collection of conf.modules.d dir for httpd 2.4
    Resolves: bz1183265
  - [pcp] collect /etc/pcp.conf
    Resolves: bz1183297
  - [puppet] adding new plugin for puppet
    Resolves: bz1183768
  - [block] Don't use parted human readable output
    Resolves: bz1183770
  - [general] Better handling --name and --ticket-number in
    Resolves: bz1185093
  - [networking] additional ip, firewall and traffic shaping
    Resolves: bz1194554
  - [infiniband] add opensm and infiniband-diags support
    Resolves: bz1194556
  - [plugins/rabbitmq] Added cluster_status command output
    Resolves: bz1197006
  - [networking] re-add 'ip addr' with a root symlink
    Resolves: bz1209454
  - [kimchi] add new plugin
    Resolves: bz1209840
  - [iprconfig] add plugin for IBM Power RAID adapters
    Resolves: bz1221932
  - [ovirt] Collect engine tunables and domain information.
    Resolves: bz1236101
  - [activemq] Honour all_logs and get config on RHEL
    Resolves: bz1236111
  - [cluster] Add luci to packages for standalone luci servers
    Resolves: bz1236124
  - [hpasm] hpasmcli commands hang under timeout
    Resolves: bz1214209
  - [mysql] Collect log file
    Resolves: bz1210906
  - [chrony] add chrony plugin
    Resolves: bz1165418


author: Pavel Moravec <pmoravec@redhat.com> = 3.2-21
changelog:
  - [cluster] enable crm_report password scrubbing
    Resolves: bz1164864
  - [sosreport] fix command-line report defaults
    Resolves: bz1219720
  - [virsh] add new plugin, add listing of qemu
    Resolves: bz1195086
  - [sap*,vhostmd] new plugins for SAP
    Resolves: bz1195608


author: Pavel Moravec <pmoravec@redhat.com> = 3.2-22
changelog:
  - [general] verify --profile contains valid plugins only
    Resolves: bz1184602
  - [kernel,mpt,memory] additional kernel-related diagnostics
    Resolves: bz1194159


author: Pavel Moravec <pmoravec@redhat.com> = 3.2-23
changelog:
  - [ceph] add calamari and ragos logs and configs
    Resolves: bz1210527
  - [iprconfig] enable plugin for ppc64* architectures
    Resolves: bz1238726


author: Pavel Moravec <pmoravec@redhat.com> = 3.2-25
changelog:
  - [openstack] New Openstack Trove (DBaaS) plugin
    Resolves: bz1238349
  - [services] Add more diagnostics to applications
    Resolves: bz1195087
  - [openstack_neutron] Obscure passwords and secrets
    Resolves: bz1240666


author: Pavel Moravec <pmoravec@redhat.com> = 3.2-27
changelog:
  - [plugin] pass stderr through _collect_cmd_output
  - split dependencies of bz1185990 fix from bz1185990 patch
    Resolves: bz1185990


author: Pavel Moravec <pmoravec@redhat.com> = 3.2-29
changelog:
  - [openvswitch] capture the logs, db and OVS bridges details
    Resolves: bz1242507
  - [logs] fix reference to missing 'rsyslog_conf' variable
    Resolves: bz1249705
  - [sapnw] Add check if saphostctrl is not present, dont use Set
    Resolves: bz1195608
  - [Plugin] fix handling of symlinks in non-sysroot environments
    Resolves: bz1248672


author: Pavel Moravec <pmoravec@redhat.com> = 3.2-36
changelog:
  - [ceph] collect /var/lib/ceph and /var/run/ceph
    Resolves: bz1260607
  - [sosreport] prepare report in a private subdirectory
    Resolves: bz1290955


author: Pavel Moravec <pmoravec@redhat.com> = 3.3-2
changelog:
  - [grub2] grub2-mkconfig loads ext4 and brctl kernel
    Resolves: bz1116670
  - [ceph] skip collecting of all keyring and bindpass files
    Resolves: bz1260607
  - [omsa] add omreport storage controller
    Resolves: bz1299603
  - [atomichost] fix collection of 'docker info' output
    Resolves: bz1302146
  - [monit] fix add_copy_spec() arguments
    Resolves: bz1356945
  - [virtwho] add new plugin for virt-who agent
    Resolves: bz1353552


author: Pavel Moravec <pmoravec@redhat.com> = 3.3-3
changelog:
  - [nodejs][nms]: new plugins
    Resolves: bz1368393
  - [docker]: Gather more data and expand plugin options
    Resolves: bz1351647


author: Adam Jackson <ajax@redhat.com> 0.7.39-2
changelog:
  - Rebuild to break bogus libpng dependency
  - Fix summaries for gtk3 subpackages to not talk about gtk2


author: Hans de Goede <hdegoede@redhat.com> - 0.11-4
changelog:
  - Add missing BuildRequires: usbutils, so that we get proper USB device
    descriptions in the USB device selection menu


author: Christophe Fergeau <cfergeau@redhat.com> - 0.11-5
changelog:
  - Fix build on PPC
  - Remove ExclusiveArch. While spice-gtk will build on ARM and PPC, it
    hasn't been tested on these arch, so there may be some bugs.


author: Marc-Andre Lureau <marcandre.lureau@redhat.com> - 0.22-1
changelog:
  - Rebase to 0.22
    Resolves: rhbz#1109397
  - Fix screenshot of secondary displays
    Resolves: rhbz#1029761
  - Fix potential crash when freeing primary surface.
    Resolves: rhbz#1082555
  - Add RHEL-only SPICE_NOSCALE to disable display scaling.
    Resolves: rhbz#1067346
  - Fix connection to RHEL5 Spice server
    Resolves: rhbz#1017862
  - Fix coroutine leak
    Resolves: rhbz#1007841
  - Fix clipboard hang on clipboard loop
    Resolves: rhbz#1073364


author: Jonathon Jongsma <jjongsma@redhat.com> - 0.22-2
changelog:
  - Additional display pop out when restarting service spice-vdagentd in guest
    Resolves: rhbz#1043782
  - Coverity scan fixes
    Resolves: rhbz#885719
  - Send data message for file copy of 0 size
    Resolves: rhbz#1135104
  - add spice_channel_get_error()
    Resolves: rhbz#1116048
  - Prefix proxy lookup errors
    Resolves: rhbz#1116048


author: Marc-Andre Lureau <marcandre.lureau@redhat.com> - 0.26-1
changelog:
  - Rebase to 0.26
    Resolves: rhbz#1214101
  - Allow to transfer multiple files at once
    Resolves: rhbz#1167829
  - Fix smartcard cannot work after restart guest
    Resolves: rhbz#1205548


author: Fabiano Fidêncio <fidencio@redhat.com> - 0.26-5
changelog:
  - Connecting to VM changes its resolution
    Resolves: rhbz#1242602
  - Cannot enable display 1 when it was disabled in previous session
    Resolves: rhbz#1247907
  - Windows needs to send complete monitors_config message to client
    Resolves: rhbz#1244878
  - High Resolution Multi-Monitor Windows Guest freeze
    Resolves: rhbz#1235442
  - Print file transfer summary to the log
    Resolves: rhbz#1140512
  - Enable proxy when requested
    Related: rhbz#1182252


author: Victor Toso <victortoso@redhat.com> - 0.26-6
changelog:
  - Implements volume-sync from guest to client
    Resolves: rhbz#1264105
  - Avoid crash in virt-manager
    Resolves: rhbz#1301863
  - Fix focus in fullscreen mode
    Resolves: rhbz#1275231
  - Add Client capability for Windows monitor_config message
    Resolves: rhbz#1248189
  - Fix error message for file transfer
    Resolves: rhbz#1265562


author: Pavel Grunt <pgrunt@redhat.com> - 0.26-7
changelog:
  - Improve message for number of usb channels in usb device widget
    Resolves: rhbz#1299931
  - Fix usbredir leak when redirecting a webcam
    Resolves: rhbz#1270363


author: Pavel Grunt <pgrunt@redhat.com> - 0.26-8
changelog:
  - Check runtime usbredir version
    Resolves: rhbz#1320827
  - Allow connection to password protected guests
    Resolves: rhbz#1320806
  - Fix runtime warnings related to shared folders and usb redirection
    Resolves: rhbz#1319405
  - Change runtime warning for empty monitor config to debug message
    Resolves: rhbz#1319405
  - Fix 16 bpp LZ image decompression
    Resolves: rhbz#1285469


author: Victor Toso <victortoso@redhat.com> - 0.31-3
changelog:
  - Fix client's crash when agent is killed
    Resolves: rhbz#1336321
  - Parse ipv6 address
    Resolves: rhbz#1335239
  - Improving parsing of Smartcard messages
    Resolves: rhbz#1338727
  - Fix hangs with "Connected to graphic server"
    Resolves: rhbz#1323092


author: Pavel Grunt <pgrunt@redhat.com> - 0.31-4
changelog:
  - Fix SASL GSSAPI (kerberos authentication)
    Resolves: rhbz#1343361
  - Allow to connect to ipv6 behind proxy
    Resolves: rhbz#1331777


author: Pavel Grunt <pgrunt@redhat.com> - 0.31-5
changelog:
  - Allow to connect to ipv6 without proxy
    Resolves: rhbz#1361478
  - Silence a critical when migrating
    Resolves: rhbz#1356162
  - Disable EPOXY / EGL usage
    Resolves: rhbz#1362460


author: Gerd Hoffmann <kraxel@redhat.com> - 0.5.2-2
changelog:
  - Fix license: LGPL.
  - Cleanup specfile, drop bits not needed any more with
    recent rpm versions (F13+).
  - Use optflags as-is.
  -


author: Hans de Goede <hdegoede@redhat.com> - 0.6.3-2
changelog:
  - Various bugfixes from upstream git:
    - Make spicec work together with the Firefox XPI for RHEV-M
    - Make sure the spicec window gets properly raised when first shown


author: Hans de Goede <hdegoede@redhat.com> - 0.6.3-3
changelog:
  - Log to ~/.spicec/cegui.log rather then to CEGUI.log in the cwd, this
    fixes spicec from aborting when run in a non writable dir (#650253)


author: Hans de Goede <hdegoede@redhat.com> - 0.6.3-4
changelog:
  - Fix the info layer not showing when used through the XPI
  - Do not let the connection gui flash by when a hostname has been specified
    on the cmdline
  - Fix spice client locking up when dealing with XIM input (#654265)
  - Fix modifier keys getting stuck (#655048)
  - Fix spice client crashing when dealing with XIM ibus input (#655836)
  - Fix spice client only showing a white screen in full screen mode


author: Hans de Goede <hdegoede@redhat.com> - 0.8.0-2
changelog:
  - Fix being unable to send ctrl+alt+key when release mouse is bound to
    ctrl+alt (which can happen when used from RHEV-M)


author: Alon Levy <alevy@redhat.com>
changelog:
  - Fix mjpeg memory leak and bad behavior.
  - Add usbredir to list of channels for security purposes. (#819484)


author: Soren Sandmann <ssp@redhat.com> - 0.11.3-1
changelog:
  - Add capability patches
  - Add capability patches to the included copy of spice-protocol

      Please see the comment above Patch6 and Patch7
      regarding this situation.


author: Yonit Halperin <yhalperi@redhat.com> 0.12.4-1
changelog:
  - New upstream release 0.12.4
  - Require libjpeg-turbo-devel instead of libjpeg-devel
  - Remove "BuildRequires: spice-protocol" from spice-server
  - Add "Requires: spice-protocol" to spice-server-devel.


author: Hans de Goede <hdegoede@redhat.com> - 0.12.4-1
changelog:
  - Add patches from upstream git to fix sound-channel-free crash (rhbz#986407)
  - Add Obsoletes for dropped spice-client sub-package


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.4-5
changelog:
  - Fix qemu crash during migration with reboot
    Resolves: rhbz#1016795
  - Monitor whether the client is alive
    Resolves: rhbz#1016790


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.4-7
changelog:
  - Fix assert in mjpeg_encoder_adjust_params_to_bit_rate()
    Resolves: rhbz#1086823
  - Fix "Spice-ERROR **: reds.c:1464:reds_send_link_ack: assertion
    `link->link_mess->channel_type == SPICE_CHANNEL_MAIN' failed" assertion
    Resolves: rhbz#1058625
  - Lower a monitor-config warning to debug level
    Resolves: rhbz#1119220
  - mjpeg: Don't warn on unsupported image formats
    Resolves: rhbz#1070028


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.4-8
changelog:
  - Fix defects reported by Coverity
    Resolves: rhbz#885717
  - Validate surface bounding box sent from QXL driver
    Resolves: rhbz#1052856
  - Fix assertion sometimes happening during migration while a client is
    connected
    Resolves: rhbz#1035184
  - Fix crash when restarting VM with old client
    Resolves: rhbz#1145919


author: Fabiano Fidêncio <fidencio@redhat.com> 0.12.4-10
changelog:
  - Fix qemu segmentation fault (core dumped) when boot KVM guest with
    spice in FIPS enabled mode.
    Resolves: rhbz#1071176


author: Fabiano Fidêncio <fidencio@redhat.com> 0.12.4-11
changelog:
  - Don't assert on invalid client message
    Resolves: rhbz#1227410
  - Don't truncate large 'now' values in _spice_timer_set
    Resolves: rhbz#1227408
  - Avoid race conditions reading monitor configs from guest
    Resolves: rhbz#1239128
  - Lock the pixmap image cache for the entire fill_bits call
    Resolves: rhbz#1235443


author: Christophe Fergeau <cfergeau@redhat.com> - 0.12.4-16
changelog:
  - Use autosetup
    Related: CVE-2016-0749
  - Fix heap-based memory corruption within smartcard handling
    Resolves: CVE-2016-0749
  - Fix host memory access from guest with invalid primary surface parameters
    Resolves: CVE-2016-2150


author: Christophe Fergeau <cfergeau@redhat.com> - 0.12.4-17
changelog:
  - Fix crash when the client sends a wrong header (for example when using spice-html5)
    Resolves: rhbz#1281442
  - Fix crash when guest provides wrong address
    Resolves: rhbz#1264356
  - Fix thread-safety issue causing a crash when playing a Youtube video spanning
    multiple monitors
    Resolves: rhbz#1253375
  - Add patches reducing QEMU wake-ups
    Related: rhbz#912763, rhbz#1186146
  - Fix use-after-free after resetting a VM
    Resolves: rhbz#1281455
  - Send KeepAlive probes every 10 minutes
    Resolves: rhbz#1298590
  - Add client to guest volume synchronization
    Resolves: rhbz#1264107


author: Christophe Fergeau <cfergeau@redhat.com> - 0.12.4-18
changelog:
  - Fix crash when connecting to VM using smartcard passthrough
    Resolves: rhbz#1340899
  - Fix hang after unredirecting a USB device
    Resolves: rhbz#1338752
  - Backport spice_qxl_set_max_monitors()
    Resolves: rhbz#1283202


author: Frediano Ziglio <fziglio@redhat.com> - 0.12.4-20
changelog:
  - Fix buffer overflow in main_channel_alloc_msg_rcv_buf when reading large
    messages.
    Resolves: CVE-2016-9577
  - Fix remote DoS via crafted message.
    Resolves: CVE-2016-9578


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - first build against glibc
  - patched out the use of setresuid(), which is available only on kernels
    2.1.44 and later


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - updated the init script to use reconfigure option to restart squid instead
    of shutdown/restart (both safer and quicker)


author: Bill Nottingham <notting@redhat.com>
changelog:
  - cache & log dirs shouldn't be world readable
  - remove preun script (leave logs & cache @ uninstall)


author: Bill Nottingham <notting@redhat.com>
changelog:
  - switch to using group squid
  - turn off icmp (insecure)
  - update to 2.2.DEVEL3
  - build FAQ docs from source


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - Fix compliance with ftp RFCs
    (http://www.wu-ftpd.org/broken-clients.html)
  - Work around a bug in some versions of autoconf
  - BuildPrereq sgml-tools - we're using sgml2html


author: Bill Nottingham <notting@redhat.com>
changelog:
  - fix init script again (#11699)
  - add --enable-delay-pools (#11695)
  - update to STABLE3
  - update FAQ


author: Bill Nottingham <notting@redhat.com>
changelog:
  - fix path references in QUICKSTART (#15114)
  - fix initscript translations (#24086)
  - fix shutdown logic (#24234), patch from <jos@xos.nl>
  - add /etc/sysconfig/squid for daemon options & shutdown timeouts
  - three more bugfixes from the Squid people
  - update FAQ.sgml
  - build and ship auth modules (#23611)


author: Bill Nottingham <notting@redhat.com>
changelog:
  - update to 2.4.STABLE1 + patches
  - enable some more configure options (#24981)
  - oops, ship /etc/sysconfig/squid


author: Bill Nottingham <notting@redhat.com>
changelog:
  - 2.4.STABLE3 + patches
  - turn off HTCP at request of maintainers
  - leave SNMP enabled in the build, but disabled in the default config


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE3-0
changelog:
  - Spec file change to enable the nul storage module. bugzilla #74654
  - Upgrade to 2.5STABLE3 with current official patches.
  - Added --enable-auth="basic,ntlm": closes bugzilla #90145
  - Added --with-winbind-auth-challenge: closes bugzilla #78691
  - Added --enable-useragent-log and --enable-referer-log, closes
  - bugzilla #91884


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE4-1
changelog:
  - New upstream version.
  - Fix the Source: line in this spec file to point to the correct URL.
  - redo the -location patch to work with the new upstream version.


author: Jay Fenlason <fenlason@redhat.com>
changelog:
  - Incorporate many upstream patches
  - Include many spec file changes from D.Johnson <dj@www.uk.linux.org>


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE4-3
changelog:
  - Clean up the spec file to work on 64-bit platforms (use %{_libdir}
    instead of /usr/lib, etc)
  - Make the release number in the changelog section agree with reality.
  - use -fPIE rather than -fpie.  s390 fails with just -fpie


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE5-1
changelog:
  - New upstream version, obsoletes many patches.
  - Fix --datadir passed to configure.  Configure automatically adds /squid
    so we shouldn't.
  - Remove the problematic triggerpostun trigger, since is's broken, and FC2
    never shipped with that old version.
  - add %{?_smp_mflags} to make line.


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE5-2
changelog:
  - Include the first 10 upstream patches
  - Add a patch for the correct location of the winbindd pipe.  This closes
    bugzilla #107561
  - Remove the change to ssl_support.c from squid-2.5.STABLE3-build patch
    This closes #117851
  - Include /etc/pam.d/squid .  This closes #113404
  - Include a patch to close #111254 (assignment in assert)
  - Change squid.init to put output messages in /var/log/squid/squid.out
    This closes #104697
  - Only useradd the squid user if it doesn't already exist, and error out
    if the useradd fails.  This closes #118718.


author: Jay Fenlason <fenlason@redhat.com> 7:2.5STABLE5-5
changelog:
  - Merge current upstream patches.
  - Fix the -pipe patch to have the correct name of the winbind pipe.


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE6-1
changelog:
  - New upstream version, with 32 upstream patches.
    This closes #133970, #133931, #131728, #128143, #126726

  - Change the permissions on /etc/squid/squid.conf to 640.  This closes
    bugzilla #125007


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE6-3
changelog:
  - include patch from Ulrich Drepper <drepper@redhat.com> to stop
    problems with O_NONBLOCK.  This closes #136049


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE7-1
changelog:
  - new upstream version, with 3 upstream patches.
    Updated the -build and -config patches
  - Include patch from Ulrich Drepper <frepper@redhat.com> to more
    intelligently close all file descriptors.


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE7-2
changelog:
  - Add a triggerin on samba-common to make /var/cache/samba/winbindd_privileged
    accessable so that ntlm_auth will work.  It needs to be in this rpm,
    because the Samba RPM can't assume the squid user exists.
    Note that this will only work if the Samba RPM is recent enough to create
    that directory at install time instead of at winbindd startup time.
    That should be samba-common-3.0.0-15 or later.
    This fixes bugzilla #103726
  - Clean up extra whitespace in this spec file.
  - Add additional upstream patches. (Now 18 upstream patches).
  - patch #112 closes CAN-2005-0096 and CAN-2005-0097, remote DOS security holes.
  - patch #113 closes CAN-2005-0094, a remote buffer-overflow DOS security hole.
  - patch #114 closes CAN-2005-0095, a remote DOS security hole.
  - Remove the -nonbl (replaced by #104) and -close (replaced by #111) patches, since
    they're now fixed by upstream patches.


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE7-4
changelog:
  - Include two more upstream patches for security vulns:
    bz#146783 Correct handling of oversized reply headers
    bz#146778 CAN-2005-0211 Buffer overflow in WCCP recvfrom() call


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE8-2
changelog:
  - new upstream version with 4 upstream patches.
  - Reorganize spec file to apply upstream patches first


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE9-4
changelog:
  - More upstream patches, including the fixed 2GB patch.
  - include the -libbind patch, which prevents squid from using the optional
    -lbind library, even if it's installed.


author: Jay Fenlason <fenlason@redhat.com> 7:2.5.STABLE9-6
changelog:
  - More upstream patches, including a fix for
    bz#157456 CAN-2005-1519 DNS lookups unreliable on untrusted networks


author: Martin Stransky <stransky@redhat.com> 7:2.5.STABLE10-1
changelog:
  - new upstream version
  - enabled fakeauth utility (#154020)
  - enabled digest authentication scheme (#155882)
  - all error pages marked as config (#127836)
  - patch for 64bit statvfs interface (#153274)
  - added httpd config file for cachemgr.cgi (#112725)


author: Martin Stransky <stransky@redhat.com> 7:2.5.STABLE10-3
changelog:
  - removed "--enable-truncate" option (#165948)
  - added "--enable-cache-digests" option (#102134)
  - added "--enable-ident-lookups" option (#161640)
  - some clean up (#165949)


author: Martin Stransky <stransky@redhat.com> 7:2.5.STABLE11-5
changelog:
  - fix for #171213 - CVE-2005-3258 Squid crash due to malformed FTP response
  - more fixes from upstream


author: Martin Stransky <stransky@redhat.com> 7:2.5.STABLE12-2
changelog:
  - rewriten patch squid-2.5.STABLE10-64bit.patch, it works with
    "--with-large-files" option now
  - fix for #72896 - squid does not support > 1024 file descriptors,
    new "--enable-fd-config" option for it.


author: Martin Stransky <stransky@redhat.com> - 7:2.6.STABLE1-1
changelog:
  - new upstream + the latest CVS snapshot from 2006/07/18
  - updated fd config patch
  - enabled epoll
  - fixed release format (#197405)
  - enabled WCCPv2 support (#198642)


author: Martin Stransky <stransky@redhat.com> - 7:2.6.STABLE4-2
changelog:
  - upstream fixes:
    * Accept 00:00-24:00 as a valid time specification (upstream BZ #1794)
    * aioDone() could be called twice
    * Squid reconfiguration (upstream BZ #1800)


author: Martin Stransky <stransky@redhat.com> - 7:2.6.STABLE4-3
changelog:
  - added fix for #183869 - squid can abort when getting status
  - added upstream fixes:
      * Bug #1796: Assertion error HttpHeader.c:914: "str"
      * Bug #1779: Delay pools fairness, correction to first patch
      * Bug #1802: Crash on exit in certain conditions where cache.log is not writeable
      * Bug #1779: Delay pools fairness when multiple connections compete for bandwidth
      * Clarify the select/poll/kqueue/epoll configure --enable/disable options
  - reworked fd patch for STABLE4


author: Martin Bacovsky <mbacovsk@redhat.com> - 7:2.6.STABLE16-2
changelog:
  - our fd_config patch was replaced by upstream's version 
  - Source1 (FAQ.sgml) points to local source (upstream's moved to wiki)


author: Martin Nagy <mnagy@redhat.com> - 7:3.0.STABLE2-1
changelog:
  - upgrade to latest upstream 3.0.STABLE2
  - check config file before starting (#428998)
  - whitespace unification of init script
  - some minor path changes in the QUICKSTART file
  - configure with the --with-filedescriptors=16384 option


author: Martin Nagy <mnagy@redhat.com> - 7:3.0.STABLE5-2
changelog:
  - fix configure detection of netfilter kernel headers (#435499),
    patch by aoliva@redhat.com
  - add support for negotiate authentication (#445337)


author: Jiri Skala <jskala@redhat.com> - 7:3.0.STABLE7-2
changelog:
  - used ncsa_auth.8 from man-pages. there will be this file removed due to conflict
  - fix #458593 noisy initscript
  - fix #463129 init script tests wrong conf file
  - fix #450352 - build.patch patches only generated files


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.0.STABLE13-2
changelog:
  - backported logfile.cc syslog parameters patch from 3.1 (b9443.patch)
  - GCC-4.4 workaround in src/wccp2.cc


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.0.STABLE17-2
changelog:
  - Bug #514014, update to 3.0.STABLE17 fixing the denial of service issues
    mentioned in Squid security advisory SQUID-2009_2.


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.0.13-1
changelog:
  - Upgrade to next upstream release 3.1.0.13 with many new features
    * IPv6 support
    * NTLM-passthru
    * Kerberos/Negotiate authentication scheme support
    * Localized error pages based on browser language preferences
    * Follow X-Forwarded-For capability
    * and more..


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.0.13-7
changelog:
  - Include upstream patches fixing important operational issues
  - Enable ESI support now that it does not conflict with normal operation


author: Jiri Skala <jskala@redhat.com> 7:3.1.0.14-2
changelog:
  - fixed #532930 Syntactic error in /etc/init.d/squid
  - fixed #528453 cannot initialize cache_dir with user specified config file


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.0.15-3
changelog:
  - fixed #551302 PROXY needs libcap. Also increases security a little.
  - merged relevant upstream bugfixes waiting for next 3.1 release


author: Jiri Skala <jskala@redhat.com> - 7:3.1.0.16-4
changelog:
  - spec file modified to be fedora packaging guidline compliant
  - little shifting lines in init script header due to rpmlint complaint
  - fixes assertion during start up


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.0.16-6
changelog:
  - Patch for Squid security advisory SQUID-2010:2, denial of service
    issue in HTCP processing (CVE-2010-0639)


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.1-2
changelog:
  - Update to 3.1.1 Squid bug #2827 crash with assertion failed:
    FilledChecklist.cc:90: "conn() != NULL" under high load.


author: Jiri Skala <jskala@redhat.com>
changelog:
  - fixes #548903 - "comm_open: socket failure: (97) Address family not supported by protocol" if IPv6 disabled


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.3-2
changelog:
  - Fully fix #548903 - "comm_open: socket failure: (97) Address family not supported by protocol" if IPv6 disabled
  - Various IPv6 related issues fixed, making tcp_outgoing_address behave
    as expected and no commResetFD warnings when using tproxy setups.


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.4-1
changelog:
  - Upstream 3.1.4 bugfix release, issues relating to IPv6, TPROXY, Memory
    management, follow_x_forwarded_for, and stability fixes


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.1.5-2
changelog:
  - Upstream 3.1.5 bugfix release
  - Upstream patch for Bug #614665: Squid crashes with  ident auth
  - Upstream patches for various memory leaks


author: Jiri Skala <jskala@redhat.com> - 7:3.2.0.9-1
changelog:
  - upgrade to squid-3.2
  - fixes #720445 - Provide native systemd unit file
  - SysV initscript moved to subpackage
  - temproary disabled eCap


author: Jiri Skala <jskala@redhat.com> - 7:3.2.0.13-2
changelog:
  - fixes #747103 - squid does not start if /var/spool/squid is empty
  - fixes #747110 - squid does not start adding "memory_pools off"


author: Henrik Nordstrom <henrik@henriknordstrom.net> - 7:3.2.0.14-6
changelog:
  - upstream gcc-4.7 patch
  - fix for bug #772483 running out of memory, mem_node growing out of bounds


author: Michal Luscon <mluscon@redhat.com> - 7:3.2.3-2
changelog:
  - Resolved: #854356 - squid.service use PIDFile
  - Resolved: #859393 - Improve cache_swap script
  - Resolved: #791129 - disk space warning
  - Resolved: #862252 - reload on VPN or network up/down
  - Resolved: #867531 - run test suite during build
  - Resolved: #832684 - missing after dependency nss-lookup.target
  - Removed obsolete configure options


author: Michal Luscon <mluscon@redhat.com> - 7:3.2.9-1
changelog:
  - Update to latest upstream version 3.2.9
  - Fixed: CVE-2013-1839
  - Removed: makefile-patch (+make check)


author: Michal Luscon <mluscon@redhat.com> - 7:3.3.8-1
changelog:
  - Update to latest upstream version 3.3.8
  - Fixed: active ftp crashing
  - Fix basic auth and log daemon DB helper builds.
  - Use xz compressed tarball, fix source URLs.
  - Fix bogus dates in %changelog.


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-22
changelog:
  - Related: #1102842 - squid rpm package misses /var/run/squid needed for
    smp mode. Creation of this directory was moved to service file.


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-23
changelog:
  - Related: #1102842 - squid rpm package misses /var/run/squid needed for
    smp mode. Creation of this directory was moved to tmpfiles.d conf file.


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-24
changelog:
  - Related: #1102842 - squid rpm package misses /var/run/squid needed for
    smp mode. Creation of /var/run/squid was also needed to be in SPEC file.


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-25
changelog:
  - Related: #1102842 - squid rpm package misses /var/run/squid needed for
    smp mode. Squid needs write access to /var/run/squid.


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-28
changelog:
  - Related: #1330577 - CVE-2016-4052 CVE-2016-4053 CVE-2016-4054 squid: multiple
    issues in ESI processing


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.3.8-30
changelog:
  - Related: #1334509 - CVE-2016-4553 squid: Cache poisoning issue in
    HTTP Request handling
  - Related: #1334492 - CVE-2016-4554 CVE-2016-4555 CVE-2016-4556 
    squid: various flaws


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.10-1
changelog:
  - Resolves: #1273942 - Rebase squid to latest mature 3.5 version (3.5.10)
  - Resolves: #1322770 - CVE-2016-2569 CVE-2016-2570 CVE-2016-2571 CVE-2016-2572
    CVE-2016-3948 squid: various flaws
  - Resolves: #1254016 - IPv4 fallback is not working when connecting
    to a dualstack host with non-functional IPv6
  - Resolves: #1254018 - should BuildRequire: g++
  - Resolves: #1262456 - Squid delays on FQDNs that don't contains AAAA record
  - Resolves: #1336940 - Disable squid systemd unit start/stop timeouts
  - Resolves: #1344197 - /usr/lib/firewalld/services/squid.xml conflicts between
    attempted installs of squid-7:3.3.8-31.el7.x86_64 and
    firewalld-0.4.2-1.el7.noarch
  - Resolves: #1299972 - squid file descriptor limit hardcoded to 16384 via 
    compile option in spec file


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.10-4
changelog:
  - Resolves: #1349775 - Provide migration tools needed due to rebase
    to squid 3.5 as a separate sub-package


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.10-5
changelog:
  - Related: #1349775 - Provide migration tools needed due to rebase
    to squid 3.5 as a separate sub-package


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.5.20-2.3
changelog:
  - Resolves: #1428378 - SIGSEV in TunnelStateData::handleConnectResponse()
    during squid reconfigure and restart


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.6-2
changelog:
  - remove absolute path names from the PAM configuration, ensuring that the
    right modules get used for whichever arch we're built for
  - don't try to install the FAQ, which isn't there any more


author: Colin Walters <walters@redhat.com> 1.6.7p5-24
changelog:
  - Enhance sesh.c to fork/exec children itself, to avoid
    having sudo reap all domains.
  - Only reinstall default signal handlers immediately before
    exec of child with SELinux patch


author: Karel Zak <kzak@redhat.com> 1.6.8p9-1
changelog:
  - new version 1.6.8p9 (resolve #161116 - CAN-2005-1993 sudo trusted user arbitrary command execution)


author: Dan Walsh <dwalsh@redhat.com> 1.6.8p12-3
changelog:
  - Remove selinux patch.  It has been decided that the SELinux patch for sudo is
  - no longer necessary.  In tageted policy it had no effect.  In strict/MLS policy
  - We require the person using sudo to execute newrole before using sudo.


author: Karel Zak <kzak@redhat.com> 1.6.8p12-7
changelog:
  - fix #198755 - make login processes (sudo -i) initialise session keyring
    (thanks for PAM config files to David Howells)
  - add IPv6 support (patch by Milan Zazrivec)


author: Peter Vrabec <pvrabec@redhat.com> 1.6.9p17-2
changelog:
  - adjust audit patch, do not scream when kernel is
    compiled without audit netlink support (#401201)


author: Daniel Kopecek <dkopecek@redhat.com> 1.6.9p17-6
changelog:
  - fixed building with new libtool
  - fix for incorrect handling of groups in Runas_User
  - added /usr/local/sbin to secure-path


author: Daniel Kopecek <dkopecek@redhat.com> 1.7.1-4
changelog:
  - moved the closefrom() call before audit_help_open() (sudo-1.7.1-auditfix.patch)
  - epoch number sync


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-1
changelog:
  - new upstream version 1.7.2p2-1
  - commented out unused aliases in sudoers to make visudo happy (#550239)


author: Ville Skyttä <ville.skytta@iki.fi> - 1.7.2p2-2
changelog:
  - Add /etc/sudoers.d dir and use it in default config (#551470).
  - Drop *.pod man page duplicates from docs.


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-4
changelog:
  - audit related Makefile.in and configure.in corrections
  - added --with-audit configure option
  - removed call to libtoolize


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p6-1
changelog:
  - update to new upstream version
  - merged .audit and .libaudit patch
  - added sudoers.ldap.5* to files


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-1
changelog:
  - update to new upstream version
  - new command available: sudoreplay
  - use native audit support
  - corrected license field value: BSD -> ISC


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-5
changelog:
  - anybody in the wheel group has now root access (using password) (rhbz#656873)
  - sync configuration paths with the nss_ldap package (rhbz#652687)


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.1p2-1
changelog:
  - rebase to 1.8.1p2
  - removed .sudoi patch
  - fixed typo: RELPRO -> RELRO
  - added -devel subpackage for the sudo_plugin.h header file
  - use default ldap configuration files again


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.5-4
changelog:
  - added patches that fix & improve SSSD support (thanks to pbrezina@redhat.com)
  - re-enabled SSSD support
  - removed libsss_sudo dependency


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-2
changelog:
  - added upstream patch for a regression
  - don't include arch specific files in the -devel subpackage
  - ship only one sample plugin in the -devel subpackage


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-1
changelog:
  - update to 1.8.6p7
  - fixes CVE-2013-1775 and CVE-2013-1776
  - fixed several packaging issues (thanks to ville.skytta@iki.fi)
    - build with system zlib.
    - let rpmbuild strip libexecdir/*.so.
    - own the %{_docdir}/sudo-* dir.
    - fix some rpmlint warnings (spaces vs tabs, unescaped macros).
    - fix bogus %changelog dates.


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-3
changelog:
  - synced sudoers, configure options & configuration files with
    expected RHEL configuration
    Resolves: rhbz#969373
    Resolves: rhbz#971009
    Resolves: rhbz#965124
    Resolves: rhbz#971013
    Resolves: rhbz#839705


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-5
changelog:
  - added standalone manpage for sudo.conf and sudo-ldap.conf
  - spec file cleanup
    Resolves: rhbz#881258


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-6
changelog:
  - fixed alias cycle detection code
  - added debug messages for tracing of netgroup matching
  - fixed aborting on realloc when displaying allowed commands
  - sssd: filter netgroups in the sudoUser attribute
  - parse uids/gids more strictly
  - added debug messages to trace netgroup matching
    Resolves: rhbz#1026904
    Resolves: rhbz#1026890
    Resolves: rhbz#1007014
    Resolves: rhbz#1026894
    Resolves: rhbz#1000389
    Resolves: rhbz#994566


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-11
changelog:
  - Fixed incorrect login shell path construction in sesh
    (thanks fkrska@redhat.com for the patch)
    Resolves: rhbz#1065418


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-12
changelog:
  - RHEL 7.1 erratum
    - don't retry authentication when ctrl-c pressed
    - fix double-quote processing in Defaults options
    - handle the "(none)" hostname correctly
    - SSSD: fix sudoUser netgroup specification filtering
    - SSSD: list correct user when -U <user> -l specified
    - SSSD: show rule names on long listing (-ll)
    - fix infinite loop when duplicate entries are specified on the
      sudoers nsswitch.conf line
    Resolves: rhbz#1084488
    Resolves: rhbz#1088464
    Resolves: rhbz#1088825
    Resolves: rhbz#1092499
    Resolves: rhbz#1093099
    Resolves: rhbz#1096813
    Resolves: rhbz#1147497
    Resolves: rhbz#1147557


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-14
changelog:
  - RHEL 7.2 erratum
    - backported command digest specification
    - fixed CVE-2014-9680 sudo: unsafe handling of TZ environment variable
    - fixed typos in sudoers.ldap man page
    - fixed handling of double-quoted sudoOption values in ldap, sssd sources
    - fixed numeric uid specification support in ldap source
    - fixed authentication flag logic in ldap source
    - added the systemctl command to the SERVICES alias in the default sudoers file
    Resolves: rhbz#1144446
    Resolves: rhbz#1235570
    Resolves: rhbz#1138259
    Resolves: rhbz#1183818
    Resolves: rhbz#1233607
    Resolves: rhbz#1144419
    Resolves: rhbz#1135539
    Resolves: rhbz#1215400


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-15
changelog:
  - RHEL 7.2 erratum
    - fixed compilation of testing binaries during make check
    - added legacy group processing patch
    - replaced buggy base64 decoder with a public domain implementation
    Resolves: rhbz#1254621
    Resolves: rhbz#1183818
    Resolves: rhbz#1247591


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-18
changelog:
  - RHEL 7.3 erratum
    - removed requiretty flag from the default sudoers policy
    - backported pam_service and pam_login_service defaults options
    - implemented netgroup_tuple defaults option for changing netgroup
      processing semantics
    - fixed user matching logic in the LDAP nss backend
    - don't allow visudo to accept an invalid sudoers file
    - fixed a bug causing that non-root users can list privileges of
      other users
    - modified digest check documentation to mention the raciness of
      the checking mechanism
    Resolves: rhbz#1196451
    Resolves: rhbz#1247230
    Resolves: rhbz#1334331
    Resolves: rhbz#1334360
    Resolves: rhbz#1261998
    Resolves: rhbz#1313364
    Resolves: rhbz#1312486
    Resolves: rhbz#1268958
    Resolves: rhbz#1335039
    Resolves: rhbz#1335042
    Resolves: rhbz#1335045
    Resolves: rhbz#1273243
    Resolves: rhbz#1299883


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-19
changelog:
  - RHEL 7.3 erratum
    - removed INPUTRC from env_keep to prevent a potential info leak
    Resolves: rhbz#1340700


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - patch for using PATH_MAX instead of some silly internal #defines for
    variables that handle filenames.


author: Adrian Havill <havill@redhat.com>
changelog:
  - use <time.h> instead of <sys/time.h> for pickier lib (#25935)
  - allow arguments for login shells (#19926)


author: Miloslav Trmac <mitr@redhat.com> - 6.13-1
changelog:
  - Update to tcsh-6.13.00
  - Fix charset headers in some of the translations
  - Convert translated messages to LC_CTYPE locale
  - Fix automatic dspmbyte setting


author: Miloslav Trmac <mitr@redhat.com> - 6.13-2
changelog:
  - Make comparisons for ranges in bracket expressions symmetric (#59493)
  - Run perl2html with LC_ALL=C to workaround what seems to be a perl bug
    (#60664)
  - Define $HOSTTYPE and $MACHTYPE on x86_64 (#115531)
  - Fix setting of O_LARGEFILE (#122558)


author: Miloslav Trmac <mitr@redhat.com> - 6.13-5
changelog:
  - Fix HTML documentation generation, second attempt (#60664)
  - Set dspmbyte using nl_langinfo(CODESET) if possible, should cover all
    cases where lang.csh was correctly setting dspmbyte (#89549)


author: Miloslav Trmac <mitr@redhat.com> - 6.13-6
changelog:
  - Define $HOSTTYPE and $MACHTYPE also on IA-64 and s390x (#115531)
  - Don't close sockets to avoid file descriptor conflits with nss_ldap (#112453)


author: Miloslav Trmac <mitr@redhat.com> - 6.13-7
changelog:
  - Define $HOSTTYPE and $MACHTYPE for ppc64 and s390 (#115531),
    I hope that finally covers all architectures.


author: Miloslav Trmac <mitr@redhat.com> - 6.13-12
changelog:
  - Don't ship the HTML documentation (generated from the man page, contains
    also a copy of the man page)


author: Miloslav Trmac <mitr@redhat.com> - 6.14-7
changelog:
  - Fix a crash when reading scripts with multibyte characters (#183267)
  - Block SIGINT while waiting for children (#177366)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 6.15-4
changelog:
  - Fix '\' can not be used to quote all delimiters
    Related: #435421
  - Fix $name[selector] should fail when any number of 'selector' is out of range
    Related: #435398


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 6.15-5
changelog:
  - Rediffed all patches to work with patch --fuzz=0
  - Let tcsh know 'ca' colorls variable
    Resolves: #458716


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 6.15-6
changelog:
  - Fix UTF-8 Japanese character is garbled in tcsh script in
    a certain situation
    Related: #453785
  - Fix calculation order of operators description in tcsh manpage
    Related: #442536
  - Fix strings which begin with '0' are not recognized as octal numbers
    Related: #438109
  - Fix memoryuse description in tcsh manpage
    Related: #437095
  - Fix tcsh scripts with multiple case statement with end keywords
    break with error
    Related: #436956
  - Fix description of builtin command 'set' in tcsh manpage
    Related: #430459


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 6.16-1
changelog:
  - Update to tcsh-6.16.00
  - Merge Review (fix License, add BUGS and WishList to documentation, convert Fixes and
    WishList to UTF-8, remove root checking from buildroot cleaning, preserve timestamps,
    use smp_flags, remove unused patches, improve postun script and minor fix to %files)
    Resolves: #226483


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 6.17-10
changelog:
  - Make wait builtin command interruptible
    Resolves: #440465
  - Fix incorrect $status value of pipelined commands
    Resolves: #638955 (Patch by Tomas Smetana <tsmetana@redhat.com>)


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 6.17-11
changelog:
  - Don't set $REMOTEHOST on the local machine
    Resolves: #669176
  - Don't print history in verbose mode
    Resolves: #583075, #658171
  - Don't allow illegal variable names to be set
    Resolves: #436901
  - Revert "Fix incorrect $status value of pipelined commands"


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 6.17-16
changelog:
  - Fix status of pipelined/backquoted/list of commands (RHEL-6 #658190)
  - Do not dereference null pointer in cwd (RHEL-6 #700309)
  - Fix negative number of jobs with %j formatting parameter in prompt
  - Clean-up patches numbers & order (prepare space for missing RHEL-6 patches)
  - Disable obsolete glob-automount.patch; The issue should have been
    (and is now) fixed in glibc (posix/glob.c)


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 6.17-19
changelog:
  - Handle pending signals before flush so that the the .history file
    does not get truncated (#653054)
  - Implement file locking using shared readers, exclusive writer
    to prevent any .history file data corruption (#653054)


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 6.18.00-1
changelog:
  - Update to tcsh-6.18.00
  - Remove obsolete patches: tcsh-6.15.00-ca-color.patch,
    tcsh-6.17.00-tc-color.patch, tcsh-6.17.00-mh-color.patch,
    tcsh-6.17.00-history.patch, tcsh-6.17.00-printexitvalue.patch,
    tcsh-6.17.00-testsuite.patch, tcsh-6.17.00-negative_jobs.patch,
    tcsh-6.17.00-wait-intr.patch, tcsh-6.17.00-dont-set-empty-remotehost.patch,
    tcsh-6.17.00-dont-print-history-on-verbose.patch, tcsh-6.14.00-set.patch,
    tcsh-6.17.00-extrafork.patch, tcsh-6.17.00-avoid-null-cwd.patch,
    tcsh-6.17.00-avoid-infinite-loop-pendjob-xprintf.patch,
    tcsh-6.17.00-variable-names.patch,
    tcsh-6.17.00-handle-signals-before-flush.patch
    tcsh-6.17.00-status-pipeline-backquote-list-of-cmds.patch (reverted!)
  - Modify and adapt the existing patches to the new source code:
    tcsh-6.13.00-memoryuse.patch, tcsh-6.14.00-tinfo.patch,
    tcsh-6.18.00-history-file-locking.patch


author: Roman Kollar <rkollar@redhat.com> - 6.18.00-4
changelog:
  - Add Copyright file in %doc
  - Readd tcsh-6.18.00-history-file-locking.patch
  - Fix casting in lseek calls in the history file locking patch (#821796)
  - Fix dosource calls in the history file locking patch (#847102)
    Resolves: #842851
  - Fix upstream source tarball location


author: Fridolin Pokorny <fpokorny@redhat.com> 6.18.00-7
changelog:
  - File locking patch modified to reflect HIST_MERGE flag (#879371)
  - Drop tcsh-6.18.00-sigint-while-waiting-for-child.patch, accepted by upstream
  - Add tcsh-6.18.00-history-merge.patch to merge histlist properly (#919452)
  - Add tcsh-6.18.00-history-savehist.patch to store history with length
    $savehist, not only $history.


author: Fridolin Pokorny <fpokorny@redhat.com> 6.18.01-1
changelog:
  - Update to tcsh-6.18.01
  - Removed tcsh-6.18.00-history-savehist.patch, not accepted by upstream
    http://mx.gw.com/pipermail/tcsh-bugs/2013-March/000824.html


author: Jaromír Končický <jkoncick@redhat.com> - 6.18.01-4
changelog:
  - Fix regression in default $status value in case of lists/pipelines
    (Changed 'anyerror' variable to 'tcsh_posix_status' with opposite meaning)
    Resolves: #1025703


author: Jaromír Končický <jkoncick@redhat.com> - 6.18.01-5
changelog:
  - Readded reverse-history-handling-in-loops patch which was created for
    tcsh version 6.17.00 in RHEL 6.4 to fix bug #814069
    Resolves: #1035235


author: David Kaspar <dkaspar@redhat.com> - 6.18.01-8
changelog:
  - Upstream's $anyerror variable re-introduced. (#1123854)
  - Fix for hang inside the 'wait' built-in of tcsh added. (#1181682)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 6.18.01-9
changelog:
  - 'if statement' parsing fixed when the space is missing after ')'. (#1273892)
  - Quote backslashes properly to preserve them in `...` expressions. (#1319816)
  - Fix for tcsh being interruptible while waiting for child process. (#1269370)
  - Fix of memory leak when using the 'source' built-in command.      (#1273513)
  - Print error message on stderr (instead of stdout).                (#1273498)
  - Use GLIBC's malloc instead of builtin malloc.                     (#1315713)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 6.18.01-12
changelog:
  - Fix another regression in tcsh-6.18.01-quote-backslashes-properly.patch
    Related: #1334751

  - Fix regression in tcsh-6.18.01-use-stderr-upon-error.patch
    Related: #1273498


author: David Hill <djh[at]ii.net>
changelog:
  - update to latest CVS (0.4a)
  - update Enigmail to 0.82.2
  - alter mozconfig for new build requirements
  - add missing BuildReq (#987)


author: Warren Togami <warren@togami.com> 0:0.4-0.fdr.3
changelog:
  - open-browser.sh release 3
  - patch broken /usr/bin/mozilla script during install
  - dir ownership
  - XXX: Source fails build on x86_64... fix later


author: David Hill <djh[at]ii.net> 0:0.5-0.fdr.1
changelog:
  - update Enigmail to 0.83.3
  - use official source tarball (after removing the CRLFs)
  - package renamed to thunderbird


author: David Hill <djh[at]ii.net> 0:0.5-0.fdr.4
changelog:
  - add Mozilla x86_64 patch (Oliver Sontag)
  - Enigmail source filenames now include the version
  - modify BuildRoot


author: David Hill <djh[at]ii.net> 0:0.5-0.fdr.6
changelog:
  - update open-browser script, modify BuildRequires (Warren)
  - add Blizzard's x-remote patch
  - initial attempt at x-remote-enabled startup script


author: David Hill <djh[at]ii.net> 0:0.5-0.fdr.8
changelog:
  - minor improvements to open-browser.sh and startup script
  - update to latest version of Blizzard's x-remote patch


author: David Hill <djh[at]ii.net> 0.6-0.fdr.0.20040415
changelog:
  - update to latest CVS, update mozconfig and %build accordingly
  - update to Enigmail 0.83.6
  - remove x-remote and x86_64 patches
  - build with -Os


author: David Hill <djh[at]ii.net> 0.6-0.fdr.3
changelog:
  - installation directory now versioned
  - allow root to run the program (for installing extensions)
  - remove unnecessary %pre and %post
  - remove separators, update mozconfig and launch script (M. Schwendt, #1460)


author: David Hill <djh[at]ii.net> 0.7-0.fdr.0
changelog:
  - update to 0.7
  - temporarily disable Enigmail 0.84.1, make ftp links work (#1634)
  - specify libdir, change BR for apt (V. Skyttä, #1617)


author: David Hill <djh[at]ii.net> 0.7-0.fdr.1
changelog:
  - re-enable Enigmail 0.84.1
  - add gcc-3.4 patch (Kaj Niemi)
  - use official branding (with permission)


author: David Hill <djh[at]ii.net> 0.7.2-0.fdr.0
changelog:
  - update to 0.7.2, just because it's there
  - update gcc-3.4 patch (Kaj Niemi)
  - add EM registration patch and remove instdir hack


author: David Hill <djh[at]ii.net> 0.7.3-0.fdr.1
changelog:
  - update to Thunderbird 0.7.3 and Enigmail 0.85.0
  - remove XUL.mfasl on startup, add Debian enigmail patches
  - add Xvfb hack for -install-global-extension


author: Warren Togami <wtogami@redhat.com> 0.7.3-3
changelog:
  - rawhide import
  - apply NetBSD's freetype 2.1.8 patch
  - apply psfonts patch
  - remove BR on /usr/bin/ex, breaks beehive


author: Christopher Aillon <caillon@redhat.com> 0.8.0-1
changelog:
  - Update to 0.8.0
  - Remove enigmail
  - Update BuildRequires
  - Remove gcc34 and extension manager patches -- they are upstreamed.
  - Fix for gnome-vfs2 error at component registration


author: Christopher Blizzard <blizzard@redhat.com> 0.8.0-8
changelog:
  - Pull over patches from firefox build:
    - disable default application dialog
    - don't include software update since it doesn't work
    - make external app support work


author: Christopher Aillon <caillon@redhat.com> 1.0.2-3
changelog:
  - Don't have downloads "disappear" when downloading to desktop (#139015)
  - Fix for some more cursor issues in textareas (149991, 150002, 152089)
  - Add upstream patch to fix bidi justification of pango
  - Add patch to fix launching of helper applications
  - Add patch to properly link against libgfxshared_s.a
  - Fix multilib conflicts


author: Kristian Høgsberg <krh@redhat.com> 1.0.2-7
changelog:
  - Add firefox-1.0-pango-cairo.patch to get rid of the last few Xft
    references, fixing the "no fonts" problem.


author: Christopher Aillon <caillon@redhat.com> - 1.5-0.5.3.rc1
changelog:
  - Once again, disable ppc64 because of a new issue.
    See https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=175944

  - Use the system NSS libraries
  - Build on ppc64


author: Christopher Aillon <caillon@redhat.com> - 1.5-0.5.6.rc1
changelog:
  - Fix crash when deleting highlighted text while composing mail within
    plaintext editor with spellcheck enabled.


author: Christopher Aillon <caillon@redhat.com> - 1.5.0.5-5
changelog:
  - Update nopangoxft.patch
  - Fix rendering of MathML thanks to Behdad Esfahbod.
  - Update start page text to reflect the MathML fixes.
  - Enable pango by default on all locales
  - Build using -rpath
  - Re-enable GCC visibility


author: Christopher Aillon <caillon@redhat.com> - 1.5.0.7-2
changelog:
  - Fix crash when changing gtk key theme
  - Prevent UI freezes while changing GNOME theme
  - Remove verbiage about pango; no longer required by upstream.


author: Christopher Aillon <caillon@redhat.com> 1.5.0.8-1
changelog:
  - Update to 1.5.0.8
  - Allow choosing of download directory
  - Take the user to the correct directory from the Download Manager.
  - Patch to add support for printing via pango from Behdad.


author: Christopher Aillon <caillon@redhat.com> 1.5.0.9-7
changelog:
  - Updated cursor position patch from tagoh to fix issue with "jumping"
    cursor when in a textfield with tabs.


author: Christopher Aillon <caillon@redhat.com> 2.0.0.0-0.5.rc1
changelog:
  - Fix the desktop file
  - Clean up the files list
  - Remove the default client stuff from the pref window


author: Christopher Aillon <caillon@redhat.com> 2.0.0.6-4
changelog:
  - Fix crashes when using GTK+ themes containing a gtkrc which specify 
    GtkOptionMenu::indicator_size and GtkOptionMenu::indicator_spacing


author: Jan Horak <jhorak@redhat.com> - 3.0-2.beta2
changelog:
  - Fixed clicked link does not open in browser (#489120)
  - Fixed missing help in thunderbird (#488885)


author: Remi Collet <fedora@famillecollet.com> - 3.1.6-8
changelog:
  - fix cairo + nspr required version
  - lightning: fix thunderbird version required
  - lightning: fix release (b3pre)
  - lightning: clean install


author: Christopher Aillon <caillon@redhat.com> - 3.1.9-7
changelog:
  - Make gvfs-open launch a compose window (salimma)
  - Spec file cleanups (salimma, caillon)
  - Split out mozilla crashreporter symbols to its own debuginfo package (caillon)


author: Jan Horak <jhorak@redhat.com> - 8.0-2
changelog:
  - Enable Mozilla's crash reporter again for all archs
  - Temporary workaround for langpacks
  - Disabled addon check UI (#753551)


author: Martin Stransky <stransky@redhat.com> - 14.0-4
changelog:
  - Removed StartupWMClass (rhbz#844863)
  - Fixed -g parameter
  - Removed thunderbird-devel before packing to avoid debugsymbols duplicities (rhbz#823940)


author: Martin Stransky <stransky@redhat.com> - 24.2.0-4
changelog:
  - Fixed rhbz#1024232 - thunderbird: squiggly lines used 
    for spelling correction disappear randomly


author: Ivan Afonichev <ivan.afonichev@gmail.com> 0:7.0.12-2
changelog:
  - Package now named just tomcat instead of tomcat7
  - Removed Provides:  tomcat-log4j
  - Switched to apache-commons-* names instead of jakarta-commons-* .
  - Remove the old changelog
  - BR/R java >= 1:1.6.0 , same for java-devel
  - Removed old tomcat6 crap


author: Ivan Afonichev <ivan.afonichev@gmail.com> 0:7.0.14-2
changelog:
  - Fixed http source link
  - Securify some permissions
  - Added licenses for el-api and servlet-api
  - Added dependency on jpackage-utils for the javadoc subpackage


author: Ivan Afonichev <ivan.afonichev@gmail.com> 0:7.0.22-2
changelog:
  - Move tomcat-juli.jar to lib package
  - Drop %update_maven_depmap as in tomcat6
  - Provide native systemd unit file ported from tomcat6


author: Joseph D. Wagner <joe@josephdwagner.info> 0:7.0.23-3
changelog:
  - Added support to /usr/sbin/tomcat-sysd and /usr/sbin/tomcat for
    starting tomcat with jsvc, which allows tomcat to perform some
    privileged operations (e.g. bind to a port < 1024) and then switch
    identity to a non-privileged user. Must add USE_JSVC="true" to
    /etc/tomcat/tomcat.conf or /etc/sysconfig/tomcat.


author: Krzysztof Daniel <kdaniel@redhat.com> 0:7.0.23-5
changelog:
  - Exported javax.servlet.* packages in version 3.0 as 2.6 to make
    servlet-api compatible with Eclipse.


author: Ivan Afonichev <ivan.afonichev@gmail.com> 0:7.0.25-1
changelog:
  - Updated to 7.0.25
  - Removed EntityResolver patch (changes already in upstream sources)
  - Place poms and depmaps in the same package as jars
  - Added javax.servlet.descriptor to export-package of servlet-api
  - Move several chkconfig actions and reqs to systemv subpackage
  - New maven depmaps generation method
  - Add patch to support java7. (patch sent upstream).
  - Require java >= 1:1.6.0


author: Ivan Afonichev <ivan.afonichev@gmail.com> 0:7.0.28-1
changelog:
  - Updated to 7.0.28
  - Resolves: rhbz 820119 Remove bundled apache-commons-dbcp
  - Resolves: rhbz 814900 Added tomcat-coyote POM
  - Resolves: rhbz 810775 Remove systemv stuff from %post scriptlet
  - Remove redhat-lsb R


author: Ivan Afonichev <ivan.afonichev@gmail.com> 0:7.0.29-1
changelog:
  - Updated to 7.0.29
  - Add pidfile as tmpfile
  - Use systemd for running as unprivileged user
  - Resolves: rhbz 847751 upgrade path was broken
  - Resolves: rhbz 850343 use new systemd-rpm macros


author: Ivan Afonichev <ivan.afonichev@gmail.com> 0:7.0.34-1
changelog:
  - Updated to 7.0.34
  - ecj >= 4.2.1 now required
  - Resolves: rhbz 889395 concat classpath correctly; chdir to $CATALINA_HOME


author: David Knox <dknox@redhat.com> - 0:7.0.42-2
changelog:
  - Resolves: rhbz#1056673 Invocation of useradd with shell
  - other than sbin nologin
  - Resolves: rhbz#1056677 preun systemv scriptlet unconditionally
  - stops service
  - Resolves: rhbz#1056696 init.d tomcat does not conform to RHEL7
  - systemd rules. systemv subpackage is removed.
  - Resolves: CVE-2013-4286
  - Resolves: CVE-2013-4322
  - Resolves: CVE-2014-0050
  - Built for rhel-7 RC


author: David Knox <dknox@redhat.com> - 0:7.0.42-3
changelog:
  - Related: CVE-2013-4286. increment build number. missed doing
  - it. 
  - Resolves: rhbz#1038183 remove BR for ant-nodeps. it's
  - no long used.


author: David Knox <dknox@redhat.com> - 0:7.0.42-5
changelog:
  - Related: CVE-2013-4286
  - Related: CVE-2013-4322
  - Related: CVE-2014-0050
  - revisit patches for above.


author: David Knox <dknox@redhat.com> - 0:7.0.54-1
changelog:
  - Resolves: rhbz#1141372 - Remove systemv artifacts. Add new systemd 
  - artifacts. Rebase on 7.0.54.


author: Coty Sutherland <csutherl@redhat.com> - 0:7.0.69-1
changelog:
  - Resolves: rhbz#1287928 Rebase to tomcat 7.0.69
  - Resolves: rhbz#1327326 rpm -V tomcat fails on /var/log/tomcat/catalina.out
  - Resolves: rhbz#1277197 tomcat user has non-existing default shell set
  - Resolves: rhbz#1240279 The command tomcat-digest doesn't work with RHEL 7
  - Resolves: rhbz#1229476 Tomcat startup ONLY options
  - Resolves: rhbz#1133070 Need to include full implementation of tomcat-juli.jar and tomcat-juli-adapters.jar
  - Resolves: rhbz#1201409 Fix the broken tomcat-jsvc service unit
  - Resolves: rhbz#1221896 tomcat.service loads /etc/sysconfig/tomcat without shell expansion
  - Resolves: rhbz#1208402 Mark web.xml in tomcat-admin-webapps as config file


author: Coty Sutherland <csutherl@redhat.com> - 0:7.0.69-2
changelog:
  - Rebase Resolves: rhbz#1311622 Getting NoSuchElementException while handling attributes with empty string value in tomcat
  - Rebase Resolves: rhbz#1320853 Add HSTS support
  - Rebase Resolves: rhbz#1293292 CVE-2014-7810 tomcat: Tomcat/JBossWeb: security manager bypass via EL expressions
  - Rebase Resolves: rhbz#1347144 CVE-2016-0706 tomcat: security manager bypass via StatusManagerServlet
  - Rebase Resolves: rhbz#1347139 CVE-2015-5346 tomcat: Session fixation
  - Rebase Resolves: rhbz#1347136 CVE-2015-5345 tomcat: directory disclosure
  - Rebase Resolves: rhbz#1347129 CVE-2015-5174 tomcat: URL Normalization issue
  - Rebase Resolves: rhbz#1347146 CVE-2016-0763 tomcat: security manager bypass via setGlobalContext()
  - Rebase Resolves: rhbz#1347142 CVE-2016-0714 tomcat: Security Manager bypass via persistence mechanisms
  - Rebase Resolves: rhbz#1347133 CVE-2015-5351 tomcat: CSRF token leak


author: Coty Sutherland <csutherl@redhat.com> - 0:7.0.69-4
changelog:
  - Resolves: rhbz#1350438 CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service


author: Coty Sutherland <csutherl@redhat.com> - 0:7.0.69-9
changelog:
  - Resolves: rhbz#1362213 Tomcat: CGI sets environmental variable based on user supplied Proxy request header
  - Resolves: rhbz#1368122


author: Coty Sutherland <csutherl@redhat.com> - 0:7.0.69-11
changelog:
  - Resolves: rhbz#1413591 CVE-2016-8745 tomcat: information disclosure due to incorrect Processor sharing
  - Resolves: rhbz#1402662 CVE-2016-6816 tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests


author: Jan Vcelak <jvcelak@redhat.com> 2.1.0-1
changelog:
  - new release:
    - daemon: allow running without selected profile
    - daemon: fix profile merging, allow only safe characters in profile names
    - daemon: implement missing methods in DBus interface
    - daemon: implement profile recommendation
    - daemon: improve daemonization, PID file handling
    - daemon: improved device matching in profiles, negation possible
    - daemon: various internal improvements
    - executables: check for EUID instead of UID
    - executables: run python with -Es to increase security
    - plugins: cpu - fix cpupower execution
    - plugins: disk - fix option setting
    - plugins: mounts - new, currently supports only barriers control
    - plugins: sysctl - fix a bug preventing settings application
    - powertop2tuned: speedup, fix crashes with non-C locales
    - powertop2tuned: support for powertop 2.2 output
    - profiles: progress on replacing scripts with plugins
    - tuned-adm: bash completion - suggest profiles from all supported locations
    - tuned-adm: complete switch to D-bus
    - tuned-adm: full control to users with physical access


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.1.2-1
changelog:
  - new release:
    - systemtap {disk,net}devstat: fix typo in usage
    - switched to configobj parser
    - latency-performance: disabled THP
    - fixed fd leaks on subprocesses


author: Jan Vcelak <jvcelak@redhat.com> 2.2.0-1
changelog:
  - new release:
    - remove nobarrier from virtual-guest (data loss prevention)
    - devices enumeration via udev, instead of manual retrieval
    - support for dynamically inserted devices (currently disk plugin)
    - dropped rfkill plugins (bluetooth and wifi), the code didn't work


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.2.1-1
changelog:
  - new release:
    - audio plugin: fixed error handling in _get_timeout
    - removed cpupower dependency, added sysfs fallback
    - powertop2tuned: fixed parser crash on binary garbage
      resolves: rhbz#914933
    - cpu plugin: dropped multicore_powersave as kernel upstream already did
    - plugins: options manipulated by dynamic tuning are now correctly saved and restored
    - powertop2tuned: added alias -e for --enable option
    - powertop2tuned: new option -m, --merge-profile to select profile to merge
    - prefer transparent_hugepage over redhat_transparent_hugepage
    - recommend: use recommend.conf not autodetect.conf
    - tuned.service: switched to dbus type service
      resolves: rhbz#911445
    - tuned: new option --pid, -P to write PID file
    - tuned, tuned-adm: added new option --version, -v to show version
    - disk plugin: use APM value 254 for cleanup / APM disable instead of 255
      resolves: rhbz#905195
    - tuned: new option --log, -l to select log file
    - powertop2tuned: avoid circular deps in include (one level check only)
    - powertop2tuned: do not crash if powertop is not installed
    - net plugin: added support for wake_on_lan static tuning
      resolves: rhbz#885504
    - loader: fixed error handling
    - spec: used systemd-rpm macros
      resolves: rhbz#850347


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.2.2-1
changelog:
  - new-release:
    - cpu plugin: fixed cpupower workaround
    - cpu plugin: fixed crash if cpupower is installed


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.2.2-4
changelog:
  - lock CPU to C1 instead of C0 in latency-performance profile
    resolves: rhbz#1013085
  - readahed multiply set to 4 in throughput-performance profile
    resolves: rhbz#987570
  - packaged pmqos-static script for debugging purposes
    resolves: rhbz#1015676
  - added global configuration file with the possibility to globally
    disable the dynamic tuning and it is by default disabled on RHEL
    resolves: rhbz#1006427


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.3.0-1
changelog:
  - new-release
    resolves: rhbz#1020743
    - audio plugin: fixed audio settings in standard profiles
    - video plugin: fixed tunings
    - daemon: fixed crash if preset profile is not available
    - man: various updates and corrections
    - functions: fixed usb and bluetooth handling
    - tuned: switched to lightweighted pygobject3-base
    - daemon: added global config for dynamic_tuning
    - utils: added pmqos-static script for debug purposes
    - throughput-performance: various fixes
    - tuned: added global option update_interval
    - plugin_cpu: added support for x86_energy_perf_policy
      resolves: rhbz#1015675
    - dbus: fixed KeyboardInterrupt handling
    - plugin_cpu: added support for intel_pstate
      resolves: rhbz#996722
    - profiles: various fixes
    - profiles: added desktop profile
      resolves: rhbz#996723
    - tuned-adm: implemented non DBus fallback control
    - profiles: added sap profile
    - tuned: lowered CPU usage due to python bug


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.3.0-2
changelog:
  - fixed race condition in the start/stop code
    resolves: rhbz#1028119
  - improved tuned responsiveness
    resolves: rhbz#1028122


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.3.0-7
changelog:
  - throughput-performance is default for the server
    resolves: rhbz#1063481
  - THP not disabled in the latency-performance profile
    resolves: rhbz#1064510
  - added network-latency profile
    resolves: rhbz#1052418
  - added network-throughput profile
    resolves: rhbz#1052421


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.3.0-10
changelog:
  - added requirement to kernel-tools
    resolves: rhbz#1073008
  - made cpupower.service conflicting
    resolves: rhbz#1073392


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.3.0-15
changelog:
  - updated man page to include atomic-host and atomic-guest profiles
    related: rhbz#1091977, rhbz#1091979


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.4.0-1
changelog:
  - new-release
    resolves: rhbz#1093883
    - fixed traceback if profile cannot be loaded
      related: rhbz#953128
    - powertop2tuned: fixed traceback if rewriting file instead of dir
    - daemon: fixed race condition in start/stop
    - balanced: used medium_power ALPM policy
    - balanced: used conservative CPU governor
      resolves: rhbz#1124125
    - plugins: added selinux plugin
    - plugin_net: added nf_conntrack_hashsize parameter
    - profiles: included sap-hana and sap-hana-vmware profiles
    - profiles: sap-profiles in individual subpackages
      resolves: rhbz#1058483
    - man: structured profiles manual pages according to sub-packages
    - improved error handling of switch_profile
    - tuned-adm: active: detect whether tuned deamon is running
    - removed active_profile from RPM verification
      resolves: rhbz#1104126
    - plugin_disk: readahead value can be now specified in sectors
      resolves: rhbz#1127127
    - plugins: added bootloader plugin
      resolves: rhbz#1044111
    - plugin_disk: added error counter to hdparm calls
    - plugins: added scheduler plugin
      resolves: rhbz#1100826
    - added tuned-gui


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.5.0-1
changelog:
  - new-release
    resolves: rhbz#1155052
    - add support for ethtool -C to tuned network plugin
      resolves: rhbz#1152539
    - add support for ethtool -K to tuned network plugin
      resolves: rhbz#1152541
    - add support for calculation of values for the kernel command line
      resolves: rhbz#1191595
    - no error output if there is no hdparm installed
      resolves: rhbz#1191775
    - do not run hdparm on hotplug events if there is no hdparm tuning
      resolves: rhbz#1193682
    - add oracle tuned profile
      resolves: rhbz#1196298
    - fix bash completions for tuned-adm
      resolves: rhbz#1207668
    - add glob support to tuned sysfs plugin
      resolves: rhbz#1212831
    - add tuned-adm verify subcommand
      resolves: rhbz#1212836
    - do not install tuned kernel command line to rescue kernels
      resolves: rhbz#1223864
    - add variables support
      resolves: rhbz#1225124
    - add built-in support for unit conversion into tuned
      resolves: rhbz#1225135
    - fixed vm.max_map_count setting in sap-netweaver profile
      resolves: rhbz#1228562
    - create tuned profile for RHEL-RT
      resolves: rhbz#1228801
    - plugin_scheduler: added support for runtime tuning of processes
      resolves: rhbz#1148546
    - add support for changing elevators on xvd* devices (Amazon EC2)
      resolves: rhbz#1170152
    - add workaround to be run after systemd-sysctl
      resolves: rhbz#1189263
    - do not change settings of transparent hugepages if set in kernel cmdline
      resolves: rhbz#1189868
    - add tuned profiles for RHEL-NFV
      resolves: rhbz#1228803
    - plugin_bootloader: apply $tuned_params to existing kernels
      resolves: rhbz#1233004
    - add support for no daemon mode
      resolves: rhbz#1068663


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.5.1-1
changelog:
  - new-release
    related: rhbz#1155052
    - plugin_scheduler: work with nohz_full
      resolves: rhbz#1247184
    - fixed realtime-virtual-guest/host profiles packaged twice
      resolves: rhbz#1249028
    - fixed requirements of realtime and nfv profiles
    - fixed tuned-gui not starting
    - various other minor fixes
    - defuzzified gtk-3.8 patch


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.5.1-5
changelog:
  - fixed various verification issues (by verification-fixes patch)
    resolves: rhbz#1252153
  - realtime profile now sets cpumask of unbound workqueues
    (by realtime-set-unbound-workqueues patch)
    resolves: rhbz#1259043
  - fixed lapic_timer_adv_ns cache in realtime-virtual-host profile
    (by lapic-timer-adv-ns-cache-fix patch)
    resolves: rhbz#1259452
  - fixed find-lapictscdeadline-optimal-fix in realtime-virtual-host profile
    (by find-lapictscdeadline-optimal-fix patch)
    resolves: rhbz#1267284
  - removed nohz_full from the realtime profile (by realtime-remove-nohz-full
    patch)
    resolves: rhbz#1274486


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.5.1-6
changelog:
  - fixed race in modprobe in realtime-virtual-host profile and extended
    stop action to have hint why it is called
    resolves: rhbz#1292117


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.7.0-1
changelog:
  - new-release
    - rebase tuned to latest upstream
      resolves: rhbz#1289048
    - gui: fixed save profile
      resolves: rhbz#1242491
    - tuned-adm: added --ignore-missing parameter
      resolves: rhbz#1243807
    - plugin_vm: added transparent_hugepage alias
      resolves: rhbz#1249610
    - plugins: added modules plugin
      resolves: rhbz#1249618
    - plugin_cpu: do not show error if cpupower or x86_energy_perf_policy are
      missing
      resolves: rhbz#1254417
    - tuned-adm: fixed restart attempt if tuned is not running
      resolves: rhbz#1258755
    - nfv: avoided race condition by using synchronous mode
      resolves: rhbz#1259039
    - realtime: added check for isolcpus sanity
      resolves: rhbz#1264128
    - pm_qos: fixed exception if PM_QoS is not available
      resolves: rhbz#1296137
    - plugin_sysctl: reapply system sysctl after Tuned sysctl are applied
      resolves: rhbz#1302953
    - atomic: increase number of inotify watches
      resolves: rhbz#1322001
    - realtime-virtual-host/guest: added rcu_nocbs kernel boot parameter
      resolves: rhbz#1334479
    - realtime: fixed kernel.sched_rt_runtime_us to be -1
      resolves: rhbz#1346715
    - tuned-adm: fixed detection of no_daemon mode
      resolves: rhbz#1351536
    - plugin_base: correctly strip assignment modifiers even if not used
      resolves: rhbz#1353142
    - plugin_disk: try to workaround embedded '/' in device names
      related: rhbz#1353142
    - sap-hana: explicitly setting kernel.numa_balancing = 0 for better performance
      resolves: rhbz#1355768
    - libexec: fixed listdir and isdir in defirqaffinity.py
      resolves: rhbz#1252160
    - plugin_cpu: save and restore only intel pstate attributes that were changed
      resolves: rhbz#1252156
    - functions: fixed sysfs save to work with options
      resolves: rhbz#1251507
    - functions: fixed restore_logs_syncing to preserve SELinux context on rsyslog.conf
      resolves: rhbz#1268901
    - spec: correctly remove tuned footprint from /etc/default/grub
      resolves: rhbz#1268845
    - gui: fixed creation of new profile
      resolves: rhbz#1274609


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.7.1-1
changelog:
  - - new-release
    - rebase tuned to latest upstream
      resolves: rhbz#1289048
    - gui: fixed traceback caused by DBus paths copy&paste error
      related: rhbz#1356369
    - tuned-adm: fixed traceback of 'tuned-adm list' if daemon is not running
      resolves: rhbz#1358857


author: Jakub Jelinek <jakub@redhat.com> 2005g-2
changelog:
  - 2005g
    - fixes for Uruguay
  - include README and Theory from tzcode tarball in %{_docdir};
    Theory includes a good summary of how the timezone data files
    are supposed to be named


author: Jakub Jelinek <jakub@redhat.com> 2005m-2
changelog:
  - 2005m
    - changes for USA (extending DST by 4 weeks since 2007), Tunisia,
      Australia, Kazakhstan
    - historical timezone data changes for Japan, Poland, Northern Ireland and
      Mali
    - timezone name change for East Timor


author: Jakub Jelinek <jakub@redhat.com> 2005n-2
changelog:
  - 2005n
    - changes for Kyrgyzstan and Uruguay
  - fix a typo in the Makefile (used TZDATA env var instead of TZDIR during
    make check), update tst-timezone.c from glibc CVS (#172102)


author: Jakub Jelinek <jakub@redhat.com> 2005q-2
changelog:
  - 2005q
    - changes for Georgia, Azerbaijan, Jordan, Palestine, Cuba, Nicaragua
    - SystemV timezone changes


author: Petr Machata <pmachata@redhat.com> 2005r-2
changelog:
  - 2005r
    - Zones EST, MST, HST, EST5EDT, CST6CDT, MST7MDT, PST8PDT moved to
      northamerica to guard against old files with obsolete information
      being left in the time zone binary directory.
    - Changes for countries that are supposed to join 2007 US DST
      change.  This includes most of Canada, however entries already in
      the database (Alberta, British Columbia, Newfoundland, Northwest
      Territories, and Yukon) were left alone for the time being.
    - Fixes in zdump.c (abbrok): conditions are chained, and the string
      is checked for emptiness.


author: Petr Machata <pmachata@redhat.com> 2005r-3
changelog:
  - 2005r-3
    - Meta changes.  Renaming tzdata.tar.bz2 file to tzdata$ver-base,
      so that it won't clash across updates.


author: Petr Machata <pmachata@redhat.com> 2006a-1
changelog:
  - Upstream 2006a:
    - private.h(scheck): changing char* to char const*
    - Rule changes for Palestine, zone changes for Indiana/US, both
      changes for Canada.
    - Many related doc changes.
  - Naming scheme in spec file doesn't use %{name}, but tzdata.


author: Petr Machata <pmachata@redhat.com> 2006b-1
changelog:
  - Upstream 2006b:
    - using tz64code version, as 32 is legacy according to tzdata ML
    - new manual pages for ctime, strftime, tzset
    - some source code reorganizations
    - no timezone/dst rule updates


author: Petr Machata <pmachata@redhat.com> - 2006c-1
changelog:
  - Upstream 2006c
    - Time-related changes:
      - dozens of historical and commentary changes
      - Iran stopped observing DST
      - Sri Lanka switches from UTC+6 to UTC+5:30
      - America/Thule and America/Edmonton will adopt new US rules,
        starting 2007
      - Tunisia is adopting regular DST
    - Code:
      - asctime.c: Chages in format strings to silent gcc warnings
      - removing K&R notation from function signatures
      - few fixes across the code


author: Petr Machata <pmachata@redhat.com> - 2006d-1
changelog:
  - Upstream 2006d
    - Haiti observes DST
    - Sri Lanka change actually took effect Apr/15
    - All Canada is now scheduled for 2007 US DST rules
    - Some historical fixes


author: Petr Machata <pmachata@redhat.com> - 2006f-1
changelog:
  - Upstream 2006f
    - America/Guatemala observes DST between Apr/30 and Oct/1
    - Historical changes for Nicaragua
    - Update of America/Indiana/Vincennes in zone table


author: Petr Machata <pmachata@redhat.com> - 2006j-1
changelog:
  - Upstream 2006j
    - Honduras stopped observing DST on Monday at 00:00
    - America/Bermuda will follow the US's lead next year
    - America/Moncton will use US-style rules next year
    - New Zone America/Blanc-Sablon, for Canadians who observe AST all
      year
    - New zone: America/Atikokan instead of America/Coral_Harbour
    - New zones: Europe/Jersey, Europe/Guernsey, Europe/Isle_of_Man
    - Historical changes
    - Commentary updates
  - Upstream 2006i
    - localtime.c fixes
  - Upstream 2006h
    - zic leapsecond fix


author: Petr Machata <pmachata@redhat.com> - 2006l-1
changelog:
  - Upstream 2006k, 2006l:
    - Adjustments for Egypt, Palestine, Cuba, Honduras
    - Documentation changes


author: Petr Machata <pmachata@redhat.com> - 2006m-1
changelog:
  - Upstream 2006m:
    - Adjustments for Egypt, Palestine, Uruguay
    - Better description of `until' field in zic (8) manpage


author: Petr Machata <pmachata@redhat.com> - 2006m-2
changelog:
  - Proposed upstream patch (#210058)
    - Jordan will switch to winter time on October 27, not September 29
    - Brazil's DST this year is the first Sunday in November to the last
      Sunday in February.  (Thanks to Frederico A. C. Neves.)
    - ISO 3166 codes for Serbia and Montenegro, zone Europe/Podgorica
    - Commentary and past timestamps changes


author: Petr Machata <pmachata@redhat.com> - 2006p-1
changelog:
  - Upstream 2006p
    - Official version of Western Australia DST trial changes
    - Latitude/longitude changes for Europe/Jersey and Europe/Podgorica


author: Petr Machata <pmachata@redhat.com> - 2007a-1
changelog:
  - Upstream 2007a
    - Updates to Bahamas, they will be in sync with 2007 US DST change
    - New zone Australia/Eucla
    - Africa/Asmera renamed to Africa/Asmara, link created
    - Atlantic/Faeroe renamed to Atlantic/Faroe, link created
  - Packaging
    - Adding BuildRequires: glibc-common >= 2.5.90-7 to build tzdata
      with extended 64-bit format necessary for dates beyond 2037


author: Petr Machata <pmachata@redhat.com> - 2007c-1
changelog:
  - Upstream 2007c
    - Pulaski County, Indiana, switched back to eastern time.
    - Turkey switches at 01:00 standard time, not at 01:00 UTC.
  - Upstream 2007b
    - Changes to the commentary in "leapseconds".


author: Petr Machata <pmachata@redhat.com> - 2007d-1
changelog:
  - Upstream 2007d
    - Mongolia has abolished DST.
    - Turkey will use EU rules this year, changing at 01:00 UTC rather
      than 01:00 standard time.
    - Cuba observed DST starting Sunday.
    - Resolute, Nunavut switched from Central to Eastern time last
      November.


author: Petr Machata <pmachata@redhat.com> - 2007e-1
changelog:
  - Upstream 2007e
    - Syria switched to summer time at Mar/29.
    - Honduras will not enter DST this year.


author: Petr Machata <pmachata@redhat.com> - 2007f-1
changelog:
  - Upstream 2007f
    - New Zealand is extending DST, starting later this year.
    - Haiti no longer observes DST.
    - The Turks and Caicos switch at 02:00, not at 00:00, and have
      adopted US DST rules.


author: Petr Machata <pmachata@redhat.com> - 2007g-1
changelog:
  - Fix licensing tag.
  - Upstream 2007g
    - Egypt switches the September 7, not September 28
    - Daviess, Dubous, Knox, Martin, and Pike Counties, Indiana, switch
      from central to eastern time in November
    - South Australia, Tasmania, Victoria, New South Wales and Lord Howe
      Island are changing their DST rules effective next year
    - Sync several Antarctic station's rules with the New Zealand
    - leapseconds contain changes from the most recent IERS bulletin


author: Petr Machata <pmachata@redhat.com> - 2007h-1
changelog:
  - Upstream 2007h
    - Brazil will observe DST from 2007-10-14 to 2008-02-17
    - Egypt and Gaza switched earlier than we expected
    - Iran will resume DST next year
    - Venezuela is scheduled to change TZ to -4:30 on January 1


author: Petr Machata <pmachata@redhat.com> - 2007i-1
changelog:
  - Upstream 2007i
    - Syria DST will take place at Midnight between Thursday and Friday.
    - Cuba will end DST on the last Sunday of October.
  - Update tst-timezone.c from glibc CVS


author: Petr Machata <pmachata@redhat.com> - 2007j-1
changelog:
  - Upstream 2007j
    - New links America/St_Barthelemy and America/Marigot
    - Venezuela is changing their clocks on December 9 at 03:00


author: Petr Machata <pmachata@redhat.com> - 2008b-1
changelog:
  - Upstream 2008b
    - DST changes for Syria, Cuba; Iraq abandons DST
    - Saigon zone renamed Ho_Chi_Minh; backward link provided
    - Add America/Argentina/San_Luis information


author: Petr Machata <pmachata@redhat.com> - 2008c-1
changelog:
  - Upstream 2008c
    - Mongolia changes zone
    - Pakistan DST is scheduled until Sep/1, instead of Aug/31
  - Drop Morocco and Pakistan patches that are superseded by upstream
  - Fix a typo in Java subpackage name


author: Petr Machata <pmachata@redhat.com> - 2008e-1
changelog:
  - Upstream 2008e
    - Changes for Mauritius
    - Leap second coverage for 31/Dec 2008
    - Corrections of historical dates


author: Petr Machata <pmachata@redhat.com> - 2008f-1
changelog:
  - Upstream 2008f
    - Changes for Mauritius (extends DST to years to come)
    - Palestine changes clocks for the duration of Ramadan
    - Argentina will start DST on Sunday October 19, 2008
    - Brazil will start DST on 2008-10-19
  - Drop Pakistan and Morocco patches


author: Petr Machata <pmachata@redhat.com> - 2008h-1
changelog:
  - Upstream 2008h
    - Fix exact DST transition hour for Mauritius
    - Syria will leave the period of DST on Nov 1
    - Fix coordinates of Pacific/Niue


author: Petr Machata <pmachata@redhat.com> - 2008i-1
changelog:
  - Upstream 2008i
    - Updates for Argentina: Drop DST in zones America/Argentina/Jujuy,
      La_Rioja, San_Juan, Catamarca, Mendoza, Rio_Gallegos, Ushuaia; new
      zone America/Argentina/Salta (for provinces SA, LP, NQ, RN).


author: Petr Machata <pmachata@redhat.com> - 2009a-1
changelog:
  - Upstream 2009a
    - Fix Asia/Kathmandu spelling
    - Historical timestamps for Switzerland and Cuba
    - DST update for America/Resolute


author: Petr Machata <pmachata@redhat.com> - 2009d-1
changelog:
  - Upstream 2009d
    - Morocco will observe DST from 2009-06-01 00:00 to 2009-08-21 00:00
    - Tunisia will not observe DST this year.
    - Syria will start DST on 2009-03-27 00:00 this year
    - Cuba will start DST on midnight between 2009-03-07 and 2009-03-08
    - Province of San Luis, Argentina, went to UTC-04:00 on 2009-03-15


author: Petr Machata <pmachata@redhat.com> - 2009e-1
changelog:
  - Upstream 2009e
    - Historical changes for Jordan
    - Palestine will start DST on 2009-03-26 and end 2009-09-27
  - Egypt ends DST on 2009-09-24


author: Petr Machata <pmachata@redhat.com> - 2009f-1
changelog:
  - Upstream 2009f
    - Pakistan will observe DST between 2009-04-15 and (probably) 2009-11-01
  - Drop Pakistan patch


author: Petr Machata <pmachata@redhat.com> - 2009h-2
changelog:
  - Upstream 2009h
    - Convert use of 00:00 stamps to 24:00 of the previous day
    - Clarify that the data is Public Domain
  - Drop Cairo patch


author: Petr Machata <pmachata@redhat.com> - 2009k-1
changelog:
  - Upstream 2009k
    - Mauritius will not continue to observe DST the coming summer
    - Arbitrarily end DST at the end of 2009 so that a POSIX-style time
      zone string can appear in the Dhaka binary file


author: Petr Machata <pmachata@redhat.com> - 2009m-1
changelog:
  - Upstream 2009m
    - Palestine will will revert back to winter time on Friday, 2009-09-04
    - Samoa passed the DST Bill that fixes DST dates for 2009 and 2010
  - Drop Egypt patch


author: Petr Machata <pmachata@redhat.com> - 2009m-2
changelog:
  - Add markers for autoupdate of spec file
  - Pakistan leaves the period of DST on October 1 (tzdata-2009m-karachi.patch)


author: Petr Machata <pmachata@redhat.com> - 2009o-1
changelog:
  - Upstream 2009o
    - Bangladesh won't go back to Standard Time from October 1, 2009
    - Pakistan leaves DST on October 1, 2009
  - Dropped tzdata-2009m-karachi.patch
  - Argentina does not enter DST on October 18 (tzdata-2009o-argentinas.patch)


author: Petr Machata <pmachata@redhat.com> - 2009u-1
changelog:
  - Upstream 2009p
    - Argentina does not enter DST on October 18
    - San Luis switched from UTC-4 to UTC-3 on October 11th
  - Upstream 2009q
    - Change DST end in Syria from November 1 to last Friday in October
    - Changes to past Hong Kong transitions
    - Kemerovo oblast' in Russia will change current time zone on March 28, 2010.
      Asia/Novokuznetsk is the new time zone name
  - Upstream 2009r
    - Changes to local times of three Australian research stations in Antarctica
  - Upstream 2009s
    - Fiji plans to re-introduce DST from November 29th 2009 to April 25th 2010
  - Upstream 2009u
    - Bangladesh changed their clock back to Standard Time on December 31, 2009
  - Dropped tzdata-2009o-argentinas.patch


author: Petr Machata <pmachata@redhat.com> - 2010c-1
changelog:
  - Upstream 2010a
    - Source code cleanups
    - Historical timestamps for Bangladesh
  - Upstream 2010b
    - Northern Mexico's border cities share the DST schedule with the
      United States
  - Upstream 2010c
    - Paraguay DST now in effect from 2nd Sunday of April to 1st Sunday
      of October


author: Petr Machata <pmachata@redhat.com> - 2010e-1
changelog:
  - Upstream 2010d
    - The DST change in Bangladesh takes place a minute earlier
    - Fiji to end DST on 2010-03-28 at 03:00, about a month earlier
    - Samoa to observe DST this year; they didn't observe DST last year
    - DST in Chile extended to 3 April
  - Upstream 2010e:
    - Fix a typo in Bangladesh DST rule


author: Petr Machata <pmachata@redhat.com> - 2010f-1
changelog:
  - Upstream 2010f:
    - Changes to Australian stations in Antarctica
    - Correct 2010 Samoa DST start date
    - New zone Antarctica/Macquarie
    - Change Syria DST start from last Friday in March to first Friday
      in April in 2010 and forward
  - Upstream 2010g proposal (tzdata-2010f-g.patch):
    - No Bangladesh DST in 2010 and forward.
    - Gaza DST starts last Saturday in March at 12:01 a.m. in 2010 and forward
    - Kamchatka and Anadyr change to Moscow+8 on 2010-03-28
    - Samara changes to Moscow+0 on 2010-03-28
    - Related zone.tab updates


author: Petr Machata <pmachata@redhat.com> - 2010f-3
changelog:
  - Tunisia not to observe DST in 2010 (tzdata-2010g-tunis.patch)
  - Pakistan not to observe DST in 2010 (tzdata-2010g-karachi.patch)


author: Petr Machata <pmachata@redhat.com> - 2010h-2
changelog:
  - Upstream 2010g:
    - No Bangladesh DST in 2010 and forward.
    - Gaza DST starts last Saturday in March at 12:01 a.m. in 2010 and forward
    - Kamchatka and Anadyr change to Moscow+8 on 2010-03-28
    - Samara changes to Moscow+0 on 2010-03-28
    - Related zone.tab updates
  - Upstream 2010h:
    - No DST in Tunisia in 2010 and forward
    - No DST in Pakistan in 2010 and forward
  - Dropped tzdata-2010g-tunis.patch
  - Dropped tzdata-2010f-g.patch
  - Dropped tzdata-2010g-karachi.patch


author: Petr Machata <pmachata@redhat.com> - 2010i-1
changelog:
  - Upstream 2010i:
    - Morocco will have DST from 2010-05-02 to 2010-08-08
    - San Luis, Argentina will keep permanent DST after April 11, 2010
    - Updates of historical stamps for Taiwan


author: Petr Machata <pmachata@redhat.com> - 2010j-1
changelog:
  - Upstream 2010j:
    - Bahia de Banderas (Mexican state of Nayarit) changed time zone
      UTC-7 to new time zone UTC-6 on April 4, 2010


author: Tom "spot" Callaway <tcallawa@redhat.com> - 2010k-1
changelog:
  - Upstream 2010k:
   - Egypt has announced that DST will be off during Ramadan, but
     DST will resume afterwards (August 10, 2010 - September 9, 2010)


author: Petr Machata <pmachata@redhat.com> - 2010l-2
changelog:
  - Upstream 2010l:
    - Change Cairo's 2010 reversion to DST from the midnight between
      September 8 and 9 to the midnight between September 9 and 10.
    - Change Gaza's 2010 return to standard time to the midnight between
      August 10 and 11.
    - Bahia de Banderas (Mexican state of Nayarit) changed time zone
      UTC-7 to new time zone UTC-6 on April 4, 2010


author: Petr Machata <pmachata@redhat.com> - 2010n-1
changelog:
  - Upstream 2010m:
    - Hong Kong didn't observe DST in 1977
    - In zone.tab, remove obsolete association of Vostok Station with
      South Magnetic Pole; add association with Lake Vostok
  - Upstream 2010n:
    - Change end of DST in Samoa in 2011 from 2011-04-03 0:00 to
      2011-04-03 1:00


author: Petr Machata <pmachata@redhat.com> - 2011b-1
changelog:
  - Upstream 2011b:
    - America/North_Dakota/Beulah: Mercer County, North Dakota, changed
      from the mountain time zone to the central time zone


author: Petr Machata <pmachata@redhat.com> - 2011b-2
changelog:
  - Update of historical stamps for Juneau, Sitka, and histcurrent stamps
    for Metlakatla.  Sitka and Metlakatla are new zones.
  - Delay end of DST in Chile in 2011 until first Sunday in April. (tzdata-2011b-c.patch)


author: Petr Machata <pmachata@redhat.com> - 2011d-1
changelog:
  - Upstream 2011d:
    - Change end of DST in Samoa in 2011.
    - Change start of DST in Cuba in 2011.
    - Move start of DST in Turkey by one day in 2011.
  - Dropped tzdata-2011b-c.patch


author: Petr Machata <pmachata@redhat.com> - 2011g-1
changelog:
  - Upstream 2011e:
    - Morocco introduced DST for 2011 from April 2 to July 31.
    - Delay end of DST in Chile in 2011 until May 7.
  - Upstream 2011f:
    - The Falkland Islands will not turn back clocks this winter, but
      stay on daylight saving time.
  - Upstream 2011g:
    - Egypt abandons DST in 2011 (and forward)
  - Dropped tzdata-2011d-chile.patch
  - Dropped tzdata-2011d-morocco.patch


author: Petr Machata <pmachata@redhat.com> - 2011h-1
changelog:
  - Upstream 2011h:
    - Russia abandons DST in 2011.
    - *.tab: change AN (Netherlands Antilles) to CW (Curacao)


author: Petr Machata <pmachata@redhat.com> - 2011h-2
changelog:
  - Patch for upcoming change in Newfoundland.  The transition time
    changes from 12:01 AM to 2:00 AM.


author: Petr Machata <pmachata@redhat.com> - 2011h-1
changelog:
  - Upstream 2011i:
    - Add Africa/Juba (South Sudan) zone
    - Samoa skips over the date line on 2011-12-30
    - Use KALT as abbreviation for Europe/Kalinigrad
    - Canonical version of the Newfoundland patch
    - Change America/Resolute use of EST to 2006-2007 only
    - Assume Metlakatla abandoned use of daylight saving in 1983
    - Sync iso3166.tab and zone.tab with above
  - Resolved: #734063


author: Petr Machata <pmachata@redhat.com> - 2011k-0.1.20110921
changelog:
  - Upstream 2011j:
    - Fix the Samoa date line skip
    - Changes in past timestamp typos several Africa zones
  - Proposed upstream 2011k:
    - Belarus and Ukraine adopt permanent DST in 2011
    - Palestine suspends DST during Ramadan in 2011
    - Gaza and West Bank split in 2011.  West Bank is tracked in the
      timezone Asia/Hebron.  zone.tab update accordingly.
  - Resolves: #737896


author: Petr Machata <pmachata@redhat.com> - 2011l-1
changelog:
  - Upstream 2011l:
    - Fix ancient stamps for America/Sitka
    - Asia/Hebron transitioned to standard time already on Sep 30, not Oct 3
    - Fiji will introduce DST on Oct 22


author: Petr Machata <pmachata@redhat.com> - 2011l-2
changelog:
  - State of Bahia, Brazil, to resume Summer Time on Oct 16
  - The project moved, reflect this in URL
  - Resolves: #746183


author: Petr Machata <pmachata@redhat.com> - 2011l-1
changelog:
  - Rebase to 2011n
    - Drop all patches, including the Kemerovo patch, which is not in
      upstream
    - Cuba postponed DST by two weeks to Nov 13
    - Fiji will enter DST on Jan 21
  - Resolved: #748778


author: Petr Machata <pmachata@redhat.com> - 2012b-1
changelog:
  - Rebase to 2012b; changes vs. 2011n-5:
    - Changes to zones for Antarctica stations
    - Armenia abolished DST in 2012 and forward
    - Cuba enters DST on 31st March
    - Falkland Islands will stay on permanent Summer Time
    - New zone for Creston Valley, Canada, which differs from Dawson
      Creek in past stamps.  Changes to historical stamps in Canada.
    - Last year, Tokelau skipped over the date line together with Samoa


author: Petr Machata <pmachata@redhat.com> - 2012b-2
changelog:
  - Morocco DST starts on the last Sunday of March (March 25, 2012) and
    ends on last Sunday of September, except the month of Ramadan.  It
    is currently unclear what that Ramadan bit means, so this is not
    covered by the patch as of now.


author: Petr Machata <pmachata@redhat.com> - 2012c-1
changelog:
  - Upstream 2012c
    - Haiti observes DST from 2012 on
    - Gaza Strip and Hebron observe DST in 2012
    - Change start of DST in Syria to last Friday in March


author: Petr Machata <pmachata@redhat.com> - 2012d-1
changelog:
  - Upstream 2012d
    - Morocco will not observe DST during the month of Ramadan.
      DST cessation end date was corrected.


author: Petr Machata <pmachata@redhat.com> - 2012f-1
changelog:
  - Fiji will start daylight savings at 2 am on Sunday 21st October 2012
    and end at 3 am on Sunday 20th January 2013.  Guess it will be like
    that in following years as well.
  - Resolves: #857231


author: Petr Machata <pmachata@redhat.com> - 2012g-1
changelog:
  - Upstream 2012g
    - Adjust the packaging for new Makefile
    - Palestine: Fall transition was Sep 21, not Sep 28
    - Samoa: Daylight Saving Time commences on Sunday 30th September
      2012 and ends on Sunday 7th of April 2013.
  - Resolves: #868173


author: Petr Machata <pmachata@redhat.com> - 2012h-1
changelog:
  - Upstream 2012h
    - Brazilian state Bahia no longer has DST.
    - Brazilian state Tocantins now has DST.
    - Israel has new DST rules next year.
    - Jordan stays on DST this winter.


author: Petr Machata <pmachata@redhat.com> - 2012h-2
changelog:
  - Switch back to using system zic, ignore upstream Makefile at all.
    We do so for java anyway.
  - Drop Factory from distribution


author: Petr Machata <pmachata@redhat.com> - 2013b-1
changelog:
  - Upstream 2013b
    - Paraguay will end DST on March 24 this year
    - Haiti uses US daylight-saving rules this year
    - Morocco does not observe DST during Ramadan
  - Upstream 2013a
    - Retire Chile patch, 2013a has the data
    - New Zones Asia/Khandyga, Asia/Ust-Nera, Europe/Busingen
    - Many changes in historical timestamps


author: Petr Machata <pmachata@redhat.com> - 2013c-1
changelog:
  - Upstream 2013c
    - Sync past stamps for Palestine and West Bank with timeanddate.com
    - Assume that the recent change to Paraguay's DST rules is permanent
    - Macquarie was uninhabited between 1919 and 1948.  It's also part
      of Australia (update in zone.tab).


author: Patsy Franklin <pfrankli@redhat.com> 2013h-1
changelog:
  - Rebase to 2013h
    - Libya switched to using UTC+2 without DST
    - Western Sahara (Africa/ElAaiun) uses Morocco's DST rules
    - Acres and Amazon swithc to UTC-4 and UTC-5 on 2013-11-10
    - Add entries for DST transition in Morocco in the year 2038


author: Patsy Franklin <pfrankli@redhat.com> 2013i-1
changelog:
  - Rebase with early release of 2013i from Paul Eggert github.
    - Jordan switches back to standard time at 00:00 on December 20,2013.
    - The 2006-2011 transition schedule is planned to resume in 2014.
    - The compile-time flag NOSOLAR has been removed.
    - The files solar87, solar88, and solar89 are no longer distributed.
    - tz-link.htm now mentions Noda Time.


author: Patsy Franklin <pfrankli@redhat.com> - 2014b-1
changelog:
  - Rebase to 2014b
    - Crimea switches to Moscow time on 2014-03-30 at 02:00 local time.
    - New entry for Troll station, Antarctica.


author: Patsy Franklin <pfrankli@redhat.com> - 2014d-1
changelog:
  - Rebase to 2014d
    - zic no longer generates files containing time stamps before
      the Big Bang.  This works around GNOME bug 730332


author: Patsy Franklin <pfrankli@redhat.com> - 2014e-1
changelog:
  - Rebase to 2014e
    - Morrocco suspends DTS for Ramadan 
         June 28 at 03:00 and August 2 at 02:00
    - Egypt suspends DTS for Ramadan
         June 26 and July 31 at 24:00


author: Patsy Franklin <pfrankli@redhat.com> - 2014f-1
changelog:
  - Rebase to 2014f
    - Several Russian time zones changes effective on 2014-10-26 
      at 02:00 local time.  See NEWS file for additional details.


author: Patsy Franklin <pfrankli@redhat.com> - 2014g-1
changelog:
  - Rebase to 2014g
    - Turks & Caicos is switching from US eastern time to UTC-4
      year-round, modeled as a switch from EST/EDT to AST
      on 2014-11-02 at 02:00.


author: Petr Machata <pmachata@redhat.com> - 2014h-1
changelog:
  - Rebase to 2014h
    - Changes to historical transitions in America/Jamaica and
      Asia/Novokuznetsk.
    - Africa/{Blantyre, Bujumbura, Gaborone, Harare, Kigali, Lubumbashi,
      Lusaka} now alias Africa/Maputo, because they don't differ in
      post-1970 stamps.
    - Africa/Maseru and Africa/Mbabane now alias Africa/Johannesburg for
      the same reason.


author: Patsy Franklin <pfrankli@redhat.com> - 2014i-1
changelog:
  - Rebase to 2014i
    - Pacific/Fiji will observe DST from 2014-11-02 02:00 to 2015-01-18 03:00.
    - A new Zone Pacific/Bougainville, for the part of Papua New Guinea
      that plans to switch from UTC+10 to UTC+11 on 2014-12-28 at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2014j-1
changelog:
  - Rebase to 2014j
    - Turks & Caicos' switch from US eastern time to UTC-4 year-round
      did not occur on 2014-11-02 at 02:00.  It's currently scheduled
      for 2015-11-01 at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2015a-1
changelog:
  - Rebase to 2015a
    - New leap second 2015-06-30 23:59:60 UTC as per IERS Bulletin C 49.
    - The Mexican state of Quintana Roo, represented by America/Cancun,
      will shift from Central Time with DST to Eastern Time without DST
      on 2015-02-01 at 02:00.
    - Chile will not change clocks in April or thereafter; its new
      standard time will be its old daylight saving time.  This affects
      America/Santiago, Pacific/Easter, and Antarctica/Palmer.


author: Patsy Franklin <pfrankli@redhat.com> - 2015b-1
changelog:
  - Rebase to 2015b
    - Mongolia will start observing DST again this year, from the last
      Saturday in March at 02:00 to the last Saturday in September at 00:00.
    - Palestine will start DST on March 28, not March 27.  Also,
      correct the fall 2014 transition from September 26 to October 24.
      Adjust future predictions accordingly.


author: Patsy Franklin <pfrankli@redhat.com> - 2015c-1
changelog:
  - Rebase to 2015c
    - Egypt's spring-forward transition is at 24:00 on April's last Thursday,
      not 00:00 on April's last Friday.  2015's transition will therefore be on
      Thursday, April 30 at 24:00, not Friday, April 24 at 00:00.  Similar fixes
      apply to 2026, 2037, 2043, etc.


author: Patsy Franklin <pfrankli@redhat.com> - 2015d-1
changelog:
  - Rebase to 2015d:
    - The Egyptian Cabinet announced that DST will be cancelled for 2015.
    - The abbreviations for Hawaii-Aleutian standard and daylight times
      have been changed from HAST/HADT to HST/HDT, as per US Government
      Printing Office style. This affects only America/Adak since 1983,
      as America/Honolulu was already using the new style.


author: Patsy Franklin <pfrankli@redhat.com> - 2015d-3
changelog:
  -  Morocco will suspend DST from 2015-06-14 03:00 through 2015-07-19 02:00,
     not 06-13 and 07-18 as we had guessed.


author: Patsy Franklin <pfrankli@redhat.com> - 2015e-1
changelog:
  - Rebase to 2015e:
    - Morocco will suspend DST from 2015-06-14 03:00 through 2015-07-19 02:00,
      not 06-13 and 07-18 as we had guessed.  (Thanks to Milamber.)
    - Assume Cayman Islands will observe DST starting next year, using US rules.
      Although it isn't guaranteed, it is the most likely.


author: Patsy Franklin <pfrankli@redhat.com> - 2015f-1
changelog:
  - Rebase to 2015f
    - North Korea switches to +0830 on 2015-08-15. 
      The abbreviation remains "KST". 
    - Uruguay no longer observes DST.


author: Patsy Franklin <pfrankli@redhat.com> - 2015g-1
changelog:
  - Rebase to 2015g
    - Turkey's 2015 fall-back transition is scheduled for Nov. 8, not Oct. 25.
    - Norfolk moves from +1130 to +1100 on 2015-10-04 at 02:00 local time.
    - Fiji's 2016 fall-back transition is scheduled for January 17, not 24.
    - Fort Nelson, British Columbia will not fall back on 2015-11-01.  It has
      effectively been on MST (-0700) since it advanced its clocks on 2015-03-08.
      New zone America/Fort_Nelson.


author: Patsy Franklin <pfrankli@redhat.com> - 2016a-1
changelog:
  - Rebase to 2016a
    - America/Cayman will not observe daylight saving this year after all.
      Revert our guess that it would.
    - Asia/Chita switches from +0800 to +0900 on 2016-03-27 at 02:00.
    - Asia/Tehran now has DST predictions for the year 2038 and later,
      to be March 21 00:00 to September 21 00:00.  This is likely better
      than predicting no DST, albeit off by a day every now and then.


author: Patsy Franklin <pfrankli@redhat.com> - 2016b-1
changelog:
  - Rebase to 2016b
    - New zones Europe/Astrakhan and Europe/Ulyanovsk for Astrakhan and
      Ulyanovsk Oblasts, Russia, both of which will switch from +03 to +04 on
      2016-03-27 at 02:00 local time.  They need distinct zones since their
      post-1970 histories disagree.  New zone Asia/Barnaul for Altai Krai and
      Altai Republic, Russia, which will switch from +06 to +07 on the same date
      and local time.  The Astrakhan change is already official; the others have
      passed the first reading in the State Duma and are extremely likely.
      Also, Asia/Sakhalin moves from +10 to +11 on 2016-03-27 at 02:00.
    - As a trial of a new system that needs less information to be made up,
      the new zones use numeric time zone abbreviations like "+04"
      instead of invented abbreviations like "ASTT".
    - Haiti will not observe DST in 2016.
    - Palestine's spring-forward transition on 2016-03-26 is at 01:00, not 00:00.
      Guess future transitions will be March's last
      Saturday at 01:00, not March's last Friday at 24:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2016c-1
changelog:
  - Rebase to 2016c
    - Azerbaijan no longer observes DST.
    - Chile reverts from permanent to seasonal DST.


author: Patsy Franklin <pfrankli@redhat.com> - 2016d-1
changelog:
  - Rebase to 2016d 
    - America/Caracas switches from -0430 to -04 on 2016-05-01 at 02:30.
    - Asia/Magadan switches from +10 to +11 on 2016-04-24 at 02:00.
    - New zone Asia/Tomsk, split off from Asia/Novosibirsk.  It covers
      Tomsk Oblast, Russia, which switches from +06 to +07 on 2016-05-29
      at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2016d-2
changelog:
  - Fix java conditionals to always build all the java tzdata. OpenJDK 7 is the
    default/base Java. It is sufficient for building everything. (#1230903)


author: Patsy Franklin <pfrankli@redhat.com> - 2016f-1
changelog:
  - Rebase to 2016f
    - Egypt cancelled DST.
    - Asia/Novosibirsk transitions from +06 to +07 on 2016-07-24 at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2016g-1.prerelease
changelog:
  - Rebase to prerelease version of tzdata-2016g.
    - Turkey changed from EET/EEST (+02/+03) to permanent +03,
      on 2016-09-07. 
    - A new leap second will be added on 2016-12-31 23:59:60 UTC.


author: Patsy Franklin <pfrankli@redhat.com> - 2016g-2
changelog:
  - Rebase to tzdata-2016g.
    - Turkey changed from EET/EEST (+02/+03) to permanent +03,
      on 2016-09-07.
    - A new leap second will be added on 2016-12-31 23:59:60 UTC.


author: Patsy Franklin <pfrankli@redhat.com> - 2016i-1
changelog:
  - Rebase to tzdata-2016i:
    - Cyprus is now split into two time zones as of 2016-10-30
    - Tonga will reintroduce DST on 2016-11-06


author: Patsy Franklin <pfrankli@redhat.com> - 2016j-1
changelog:
  - Rebase to tzdata-2016ij
    - Saratov region of Russia is moving from +03 offset to +04 offset
      on 2016-12-04.


author: Patsy Franklin <pfrankli@redhat.com> - 2017a-1
changelog:
  - Rebase to tzdata-2017a.
    - Mongolia no longer observes DST. (BZ #1425214)
    - Add upstream patch to fix over-runing of POSIX limit on zone abbreviations.
  - Add zone1970.tab file to the install list. (BZ #1414829)


author: Karsten Hopp <karsten@redhat.com> 7.3.638-2
changelog:
  - fix some man page typos (#668894, #675480)
  - own usr/share/vim/vimfiles/doc/tags (#845564)
  - add path to csope database (#844843)


author: Karsten Hopp <karsten@redhat.com> 7.4.5-1
changelog:
  - patchlevel 5
  - when closing a window fails ":bwipe" may hang
  - "vaB" while 'virtualedit' is set selects the wrong area


author: Karsten Hopp <karsten@redhat.com> 7.4.009-1
changelog:
  - patchlevel 009
    mkdir("foo/bar/", "p") gives an error message
    creating a preview window on startup messes up the screen
    new regexp engine can't be interrupted
    too easy to write a file was not decrypted (yet)


author: Radek Novacek <rnovacek@redhat.com> 0.3-3
changelog:
  - Use updateConsumer API instead of updateConsumerFact (fixes limit 255 chars of uuid list)
  - Requires python-rhsm >= 0.96.13


author: Radek Novacek <rnovacek@redhat.com> 0.8-1
changelog:
  - Upstream version 0.8
  - RFE: command line improvements
  - Add support for accessing RHEV-M
  - Fix printing tracebacks on terminal


author: Radek Novacek <rnovacek@redhat.com> 0.8-9
changelog:
  - Add satellite support
  - Handle more than 100 objects in esx traversal
  - Use instanceUuid when uuid of virtual machine is empty
  - Resolves: rhbz#1032596


author: Radek Novacek <rnovacek@redhat.com> 0.8-10
changelog:
  - Force using background mode when starting from systemd
  - Check if process defined by PID file exists
  - vsphere: reconnect before each scan
  - Resolves: rhbz#1036561, rhbz#1035604, rhbz#1035957


author: Radek Novacek <rnovacek@redhat.com> 0.8-12
changelog:
  - Support sending additional information together with guest uuid on libvirt
  - Reconnect to vsphere before each scan
  - Requires python-rhsm >= 1.10.10
  - Resolves: rhbz#1048954, rhbz#1047245


author: Radek Novacek <rnovacek@redhat.com> 0.11-3
changelog:
  - Treat remove libvirt as hypervisor
  - Set /etc/sysconfig/virt-who permissions to 600
  - Create /etc/virt-who.d directory
  - Fix wrong options used when connecting to satellite
  - Display found configurations and their modes in the log file
  - Resolves: rhbz#1127965, rhbz#1158759, rhbz#1159187, rhbz#1158859, rhbz#1158803


author: Radek Novacek <rnovacek@redhat.com> 0.11-4
changelog:
  - Fix ecrypted passwords
  - Remove syslog.target from systemd unit After definition
  - Fix missing config attribute of the Esx object
  - Resolves: rhbz#1161607, rhbz#1162049, rhbz#1163021


author: Radek Novacek <rnovacek@redhat.com> 0.11-5
changelog:
  - Limit systemd service shutdown to 5 seconds
  - Fix error in domain sorting
  - Satellite: use proper hypervisor type in VM name
  - Resolves: rhbz#1161434, rhbz#1168111, rhbz#1168122


author: Radek Novacek <rnovacek@redhat.com> 0.14-2
changelog:
  - Support asynchronous API in candlepin
  - Nicely order keys in debug report
  - Retry sending data multiple times
  - Resolves: rhbz#1240728, rhbz#1243697


author: Radek Novacek <rnovacek@redhat.com> 0.14-3
changelog:
  - Put uuid before guests in print mode for better readibility
  - Fix decoding saved association in fake mode
  - Stop the main loop when fatal error occurs
  - Deprecate -b option and VIRTWHO_BACKGROUND env var
  - Support hypervisor_id=hostname in remote libvirt
  - Fix host uuid filtering
  - Resolves: rhbz#1243683, rhbz#1167238, rhbz#1247066, rhbz#1247031, rhbz#1246409, rhbz#1246951, rhbz#1247922, rhbz#1247922, rhbz#1248425


author: Radek Novacek <rnovacek@redhat.com> 0.14-4
changelog:
  - Readd support for hypervisorType guest attribute
  - hyperv: add proxy support
  - Set active attribute to 1 when guest is suspended
  - hyperv: consider Quiesce EnabledState as paused state
  - Remove -b option completely
  - Fake: fix non-hypervisor reporting
  - Resolves: rhbz#1248360


author: Radek Novacek <rnovacek@redhat.com> 0.14-5
changelog:
  - Use systemd notify for service status updates
  - Add template configuration file
  - Allow single quotes and spaces in config lists
  - Fail if no owner or env is set in SAM mode
  - Clear obsolete reports before sending them
  - Resolves: rhbz#1243341, rhbz#1250159, rhbz#1254840


author: Radek Novacek <rnovacek@redhat.com> 0.14-6
changelog:
  - virt: don't enqueue error reports when no error occurs
  - Config: show warning when unapplicable option is used
  - fake: check if fake data are correct
  - Resolves: rhbz#1257073


author: Radek Novacek <rnovacek@redhat.com> 0.14-8
changelog:
  - Fix logging of fatal errors
  - Change systemd unit type to notify
  - Warn about usage of env and owner in non-remote libvirt mode
  - Fix proxy support in ESX and Hyper-V modes
  - Resolves: rhbz#1254843, rhbz#1243341, rhbz#1250782


author: Radek Novacek <rnovacek@redhat.com> 0.14-9
changelog:
  - Check config option
  - Another attempt on hyperv proxy support
  - Resolves: rhbz#1254843, rhbz#1250782


author: Radek Novacek <rnovacek@redhat.com> 0.17-2
changelog:
  - Support prefix in the rhevm url
  - Raise exception when status code is not 200 in rhevm
  - Support new api for socket count in rhevm-4.0
  - SAM: handle connection interruption in ping method
  - ESX: skip cert verification when downloading vim file
  - Add python-setuptools requirement
  - Resolves: rhbz#1337407, rhbz#1337757, rhbz#1337758, rhbz#1338596, rhbz#1339419


author: Radek Novacek <rnovacek@redhat.com> 0.17-3
changelog:
  - Don't show error when requests are too old
  - esx: fix using of connection timeout
  - rhevm: fix urls not ending with slash
  - xen: fix support for multiple hosts
  - Add placeholders for xen config to /etc/sysconfig/virt-who template
  - Handle errors when checking job status
  - Allow quoted config values
  - Resolves: rhbz#1263512, rhbz#1311632, rhbz#1342364, rhbz#1346548, rhbz#1346577


author: Radek Novacek <rnovacek@redhat.com> 0.17-4
changelog:
  - Use sha256 instead of md5 for internal object hashing
  - sat5: create and use hypervisor-base channel for new system registration
  - Resolves: rhbz#1245035


author: Radek Novacek <rnovacek@redhat.com> - 0.17-7
changelog:
  - esx: don't add dot to hostname when there is no domain
  - config: fix unquoting list of options
  - print: show hypervisor facts in print mode
  - virt: don't show failures when backend is being terminated
  - sat5: don't send unchanged reports
  - Resolves: rhbz#1339863, rhbz#1359640, rhbz#1359653, rhbz#1359571


author: Radek Novacek <rnovacek@redhat.com> - 0.17-8
changelog:
  - esx: filter out guests with empty uuid property
  - xen: use active waiting to prevent thread lockups
  - xen: don't allow starting without owner/env
  - subscriptionmanager: handle waiting job state
  - Resolves: rhbz#1362351


author: Radek Novacek <rnovacek@redhat.com> - 0.17-10
changelog:
  - Better connection failure handling
  - xen: support hostname and hwuuid hypervisor_id options
  - xen: remove duplicated entries from the log
  - setup.py fixes
  - Make the spec compatible with RHEL-6
  - Resolves: rhbz#1339863


author: Chris Snyder <csnyder@redhat.com> - 0.17-11
changelog:
  - esx: don't report guests with empty uuids
  - Make sure to obey the interval setting
  - Resolves: rhbz#1405620
  - Resolves: rhbz#1405618


author: Douglas E. Warner <silfreed@silfreed.net> 0.4.2-1
changelog:
  - upgrade to 0.4.2
  - new sample conf file that will use any unrestricted AP
  - make sysconfig config entry
  - new BuildRoot for Fedora Extras
  - adding dist tag to Release


author: Douglas E. Warner <silfreed@silfreed.net> 0.4.5-1
changelog:
  - upgrade to 0.4.5
  - updated config file wpa_supplicant is built with
    especially, the ipw2100 driver changed to just ipw
    and enabled a bunch more EAP
  - disabled dist tag


author: Douglas E. Warner <silfreed@silfreed.net> 0.4.6-1
changelog:
  - upgrade to 0.4.6
  - adding ctrl interface changes recommended 
    by Hugo Paredes <hugo.paredes@e-know.org>


author: Dan Williams <dcbw@redhat.com> - 0.4.8-4
changelog:
  - Add additional BuildRequires #rh181914#
  - Add prereq on chkconfig #rh182905# #rh182906#
  - Own /var/run/wpa_supplicant and /etc/wpa_supplicant #rh183696#


author: Dan Williams <dcbw@redhat.com> - 0.4.8-6
changelog:
  - Add patch to make orinoco happy with WEP keys
  - Enable Prism54-specific driver
  - Disable ipw-specific driver; ipw2x00 should be using WEXT instead


author: Dan Williams <dcbw@redhat.com> - 0.4.8-10
changelog:
  - Add fix for madwifi and WEP (wpa_supplicant/hostap bud #140) (#rh190075#)
  - Fix up madwifi-ng private ioctl()s for r1331 and later
  - Update madwifi headers to r1475


author: Dan Williams <dcbw@redhat.com> - 0.4.9-1
changelog:
  - Update to 0.4.9 for WE-21 fixes, remove upstreamed patches
  - Don't package doc/ because they aren't actually wpa_supplicant user documentation,
      and becuase it pulls in perl


author: Dan Williams <dcbw@redhat.com> - 0.5.7-7
changelog:
  - Make SIGUSR1 change debug level on-the-fly; useful in combination with
      the -f switch to log output to /var/log/wpa_supplicant.log
  - Stop stripping binaries on install so we get debuginfo packages
  - Remove service start requirement for interfaces & devices from sysconfig file,
      since wpa_supplicant's D-Bus interface is now turned on


author: Dan Williams <dcbw@redhat.com> - 0.5.7-8
changelog:
  - Change system bus activation file name to work around D-Bus bug that fails
      to launch services unless their .service file is named the same as the
      service itself


author: Dan Williams <dcbw@redhat.com> - 0.5.7-11
changelog:
  - Add BLOB support to the D-Bus interface
  - Fix D-Bus interface permissions so that only root can use the wpa_supplicant
      D-Bus interface


author: Dan Williams <dcbw@redhat.com> - 0.5.7-12
changelog:
  - Fix conversion of byte arrays to strings by ensuring the buffer is NULL
      terminated after conversion


author: Dan Williams <dcbw@redhat.com> - 0.5.7-16
changelog:
  - Add IW_ENCODE_TEMP patch for airo driver and Dynamic WEP
  - Fix error in wpa_supplicant-0.5.7-ignore-dup-ca-cert-addition.patch that
      caused the last error to not be printed
  - Fix wpa_supplicant-0.5.7-ignore-dup-ca-cert-addition.patch to ignore
      duplicate cert additions for all certs and keys
  - Change license to BSD due to linkage against OpenSSL since there is no
      OpenSSL exception in the GPLv2 license text that upstream ships


author: Dan Williams <dcbw@redhat.com> - 1:0.5.7-19
changelog:
  - Fix two leaks when signalling state and scan results (rh #408141)
  - Add logrotate config file (rh #404181)
  - Add new LSB initscript header to initscript with correct deps (rh #244029)
  - Move other runtime arguments to /etc/sysconfig/wpa_supplicant
  - Start after messagebus service (rh #385191)
  - Fix initscript 'condrestart' command (rh #217281)


author: Dan Williams <dcbw@redhat.com> - 1:0.6.3-6
changelog:
  - Fix 802.11a frequency bug
  - Always schedule specific SSID scans to help find hidden APs
  - Properly switch between modes on mac80211 drivers
  - Give adhoc connections more time to assocate


author: Dan Williams <dcbw@redhat.com> - 1:0.6.4-1
changelog:
  - Update to 0.6.4
  - Remove 'hostap', 'madwifi', and 'prism54' drivers; use standard 'wext' instead
  - Drop upstreamed patches


author: Dan Williams <dcbw@redhat.com> - 1:0.6.4-2
changelog:
  - Handle encryption keys correctly when switching 802.11 modes (rh #459399)
  - Better scanning behavior on resume from suspend/hibernate
  - Better interaction with newer kernels and drivers


author: Dan Williams <dcbw@redhat.com> - 1:0.6.7-1
changelog:
  - Fix PEAP connections to Windows Server 2008 authenticators (rh #465022)
  - Stop supplicant on uninstall (rh #447843)
  - Suppress scan results message in logs (rh #466601)


author: Dan Williams <dcbw@redhat.com> - 1:0.6.8-3
changelog:
  - Ensure the supplicant starts and ends with clean driver state
  - Handle driver disconnect spammage by forcibly clearing SSID
  - Don't switch access points unless the current association is dire (rh #493745)


author: Dan Williams <dcbw@redhat.com> - 1:0.6.8-7
changelog:
  - Fix supplicant initscript return value (rh #521807)
  - Fix race when connecting to WPA-Enterprise/802.1x-enabled access points (rh #508509)
  - Don't double-scan when attempting to associate


author: Dan Williams <dcbw@redhat.com> - 1:1.0-1
changelog:
  - Enable lightweight AP mode support
  - Enable P2P (WiFi Direct) support
  - Enable RSN IBSS/AdHoc support


author: <danw@redhat.com> - 1:2.0-15
changelog:
  - Add domain_match config option from upstream (rh #1178263)
  - Include peer certificate in EAP events for use by clients


author: Jeremy Katz <katzj@redhat.com> - 2.6.13-1
changelog:
  - update to 2.6.13 per request of upstream
  - fixes mount by label of xfs on former raid partition (#122043)


author: Robert Scheck <redhat@linuxnetz.de> 2.8.3-1
changelog:
  - Upgrade to 2.8.3 (#196599)
  - Applied Russell Coker's suggested patch to improve the
    performance for SELinux machines significantly (#120622)


author: Eric Sandeen <sandeen@redhat.com> 2.9.5-1
changelog:
  - Update to xfsprogs 2.9.5
  - Contains more optimal mkfs defaults
  - specfile cleanup, & don't restate config defaults


author: Eric Sandeen <sandeen@redhat.com> 2.9.6-1
changelog:
  - Update to xfsprogs 2.9.6 - fixes mkfs sizing problem.
  - Trim down BuildRequires to what's actually required now


author: Eric Sandeen <sandeen@redhat.com> 2.9.8-1
changelog:
  - Update to xfsprogs 2.9.8
  - Add support for sb_features2 in wrong location
  - Add -c option to xfs_admin to turn lazy-counters on/off
  - Added support for mdp in libdisk/mkfs.xfs


author: Eric Sandeen <sandeen@redhat.com> 2.10.1-4
changelog:
  - Add protection from borken sys_ustat
  - Add final upstream versions of gfs2 & parallel build patches


author: Eric Sandeen <sandeen@redhat.com> 3.1.0-1
changelog:
  - New upstream release
  - Minor fixups for new glibc headers
  - Fixes default mkfs.xfs on 4k sector device (#539553)


author: Eric Sandeen <sandeen@redhat.com> 3.2.0-0.1.alpha1
changelog:
  - New upstream alpha release with preliminary CRC support (#1015632)
  - Additional patches beyon 3.2.0-alpha1:
  - Fix big endian build
  - Handle symlinks in xfs_quota arguments (#1013668)
  - Don't report non-regular files as xfsctl-capable (#1012412)
  - Fix log recovery on 4k filesystems


author: Eric Sandeen <sandeen@redhat.com> 3.2.0-0.2.alpha1
changelog:
  - Move xfs_types.h from xfsprogs-qa-devel to xfsprogs-devel (#1024048)
  - Remove deprecated xfs_check from package (#1029458)


author: Eric Sandeen <sandeen@redhat.com> 3.2.0-0.3.alpha2
changelog:
  - New upstream alpha release (#1034445)
  - Remove xfs_check reference from fsck.xfs output (#1029455)
  - Fix xfs_fsr on some files with selinux attributes (#1034013)


author: Eric Sandeen <sandeen@redhat.com> 3.2.0-0.6.alpha2
changelog:
  - xfs_metadump: Require -F if proper SB magic is not found (#1040921)
  - xfs_repair: fix bad block pointer found in large directories (#1034157)
  - libxfs: Don't mark single-map blockmaps as discontiguous (#1033480)
  - libxfs: Clear stale buffer errors on write (1033480)


author: Eric Sandeen <sandeen@redhat.com> 3.2.0-0.7.alpha2
changelog:
  - xfs_metadump: Really add xfs_metadump -F option (#1040921)
  - xfs_check: Remove xfs_check manpage, xfs_check is deprecated (#1029458)


author: Eric Sandeen <sandeen@redhat.com> 3.2.0-0.8.alpha2
changelog:
  - mkfs.xfs fix default log size for small filesystems (#1034003)
  - xfs_copy: partial fixups for CRC filesystems (#1043570)
  - xfs_logprint: Don't error out after split items lose context (#1043591)


author: Eric Sandeen <sandeen@redhat.com> 3.2.1-1
changelog:
  - New upstream release (#1119940)
  - xfs_copy: fix data corruption of target (#1105170)
  - mkfs.xfs: handle mkfs of file on 4k block device (#1101236)
  - xfs_copy: don't exit with error code on success (#1100376)


author: Eric Sandeen <sandeen@redhat.com> 3.2.1-2
changelog:
  - xfs_quota: fix segfault when reporting on nonexistant path (#1077826)
  - xfs_quota: fix reporting on symlinked paths (#1077841)


author: Eric Sandeen <sandeen@redhat.com> 3.2.1-6
changelog:
  - xfs_repair: fix maximum block offset test (#1173146)
  - xfs_copy: fix assert failure on 4k sector devices (#1162414)
  - xfs_quota: man page updates (#175133, #1175627)


author: Eric Sandeen <sandeen@redhat.com> 3.2.2-1
changelog:
  - Update to upstream v3.2.2, plus fixes from v3.2.3 (#1223991)
  - repair: fix unnecessary secondary scan if only last sb is corrupt (#1201238)
  - repair: check ino alignment value to avoid mod by zero (#1223444)


author: Eric Sandeen <sandeen@redhat.com> 4.5.0-1
changelog:
  - Rebase to upstream v4.5.0 (#1309498)
  - mkfs: default to CRC enabled filesystems
  - mkfs: default to ftype enabled filesystems
  - mkfs.xfs.8: Clarify mkfs vs. mount block size limits. (#1263535)
  - xfs_copy: fix copy of hard 4k devices (#1231841)
  - xfs_quota: use Q_XGETNEXTQUOTA for faster repquota (#1164652)
  - xfs_fsr: more fixes for extent swaps with selinux (#1083833)
  - xfs_copy: Allow UUID changes on V5 filesystems (#1072283)


author: Eric Sandeen <sandeen@redhat.com> 4.5.0-3
changelog:
  - mkfs.xfs: disable finobt by default, disable sparse inodes entirely (#1345961)
  - Fix header files for compatibility (#1340553)


author: Eric Sandeen <sandeen@redhat.com> 4.5.0-4
changelog:
  - xfs_db: Fix multi-inode-record chunks in 4.5.0 (#1346927)
  - xfs_repair: Fix special inode handling in 4.5.0 (#1347698)
  - xfs_repair: Fix quota inode handling in 4.5.0 (#1347719)


author: Eric Sandeen <sandeen@redhat.com> 4.5.0-8
changelog:
  - revert loff_t to off64_t change to preserve xfs.h behavior (#1366291)
  - accomodate lack of ustat() on some arches (#1373605)


author: Erik Troan <ewt@redhat.com>
changelog:
  - supports chkconfig
  - updated initscript for status and restart
  - turned off in all runlevels, by default
  - removed postinstall script which didn't do anything


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - upgraded to 1.3.4
  - fixed the fubared Makefile
  - link against gdbm instead of ndbm (it seems to work better)


author: Florian La Roche <Florian.LaRoche@redhat.de>
changelog:
  - add gdbm-devel BuildReq #49767
  - add ypxfrd init script #44845
  - fix #44805
  - fix #20042, adding option to yppasswdd startup
  - own /var/yp


author: Florian La Roche <Florian.LaRoche@redhat.de>
changelog:
  - fix restart initscript option #57129
  - add a "gawk" requires #57002
  - fix printcap bug #56993
  - fix ypxfrd init script #55234


author: Alex Larsson <alexl@redhat.com> 2.2-5
changelog:
  - Add patch that fixes generation of services.byname. (#41851)
  - Actually apply patch #5, seems like it got left out by misstake


author: Alex Larsson <alexl@redhat.com> 2.2-9
changelog:
  - Removed my ypserv-2.2-services patch. According to thorsten
    (yp maintainer) the key in services.byname actually
    SHOULD be port/protocol.


author: Phil Knirsch <pknirsch@redhat.com> 2.11-1
changelog:
  - Updated to latest upstream version.
  - Dropped ypserv-2.8-echild.patch (not needed anymore).
  - Fixed several other patches for new version.


author: Steve Dickson <steved@redhat.com> - 2.19-4
changelog:
  - Made ypserver less verbose on common errors (bz #199236)
  - Don't allow a make for empty domainname's or domainname's set to (none)
    (bz #197646)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.19-9
changelog:
  - Mark /var/yp/Makefile as %config(noreplace)
    Resolves: #432582
  - Comment "slp" part of ypserv.conf to avoid ypserv warnings
    Resolves: #154806
  - Spec file cleanup - remove period from end of Summary,
    fix license, remove macros from Changelog


author: Karel Klic <kklic@redhat.com> - 2.21-1
changelog:
  - Updated to new upstream version
  - Removed ypserv-2.11-nomap.patch, it has been applied by upstream
  - Removed ypserv-2.19-quieter.patch, it has been applied by upstream
  - Removed ypserv-2.13-yplib-memleak.patch, upstream version fixes the problem
  - Removed ypserv-2.19-debuginfo.patch, upstream version no longer needs it
  - Ported -path, -iface patches to the new version


author: Karel Klic <kklic@redhat.com> - 2.21-2
changelog:
  - Added patch for rpc.ypxfrd to create a pid file
  - Rewrote initscripts to become closer to Packaging:SysVInitScript
    Fedora guildeline
  - Fixed initscript for ypserv (rhbz#523438)
  - Fixed initscript for yppasswdd (rhbz#523394)
  - Fixed initscript for ypxfrd (rhbz#523397)


author: Karel Klic <kklic@redhat.com> - 2.21-4
changelog:
  - Removed ypserv-2.21-iface.patch, because upstream refused to 
    merge it three times over 7 years. "Since this is 
    not supported by RPC (means portmapper still shows ypserv 
    for the other subnets and portmapper can forward requests 
    from other subnets via loopback), this will give quite some 
    unexpected behaviors and makes it pretty difficult to debug 
    such scenarios."


author: Karel Klic <kklic@redhat.com> - 2.23-1
changelog:
  - Updated to new upstream version
  - Removed pidfile and nodbclose patches, as those were
    merged by the upstream


author: Karel Klic <kklic@redhat.com> - 2.24-2
changelog:
  - Removed Buildroot tag
  - Removed %clean section
  - Replace custom %initdir macro with systemwide %_initrddir


author: Honza Horak <hhorak@redhat.com> - 2.24-4
changelog:
  - Change default aliases file location to /etc/aliases to correspond 
    with default MTAs' config (#699826)


author: Honza Horak <hhorak@redhat.com> - 2.26-4
changelog:
  - Added passwd.adjunct support in yppasswdd to recognize 
    password format correctly when changing password using yppasswd
    Resolves: #699667


author: Honza Horak <hhorak@redhat.com> - 2.26-7
changelog:
  - Fixed empty domain handling in ypinit script
    Resolves: #751427
  - Added a wrapper script to use all variables correctly in the unit file
    Resolves: #755775


author: Honza Horak <hhorak@redhat.com> - 2.26-9
changelog:
  - Rebuild against compat_gdbm, because gdbm has changed license 
    to GPLv3+ and it is not compatible with ypserv GPLv2


author: Honza Horak <hhorak@redhat.com> - 2.26-10
changelog:
  - Added ypserv-pre-setdomain to respect NISDOMAIN environment variable 
    and set domainname if empty
  - Added autoreconf call (thus .path patch modified to keep impact)
  - Patch .aliases fixed
    Resolves: #699826


author: Honza Horak <hhorak@redhat.com> - 2.27-1
changelog:
  - Update to new upstream version, which fixes several bugs 
    (removing patches that aren't needed any more)


author: Honza Horak <hhorak@redhat.com> - 2.28-1
changelog:
  - Update to new upstream version, which fixes several bugs
  - Use Tokyo Cabinet as DBM and rebuild maps after updating
  - Consider NISDOMAIN variable from /etc/sysconfig/network


author: Honza Horak <hhorak@redhat.com> - 2.29-1
changelog:
  - Update to new upstream version that fix memory leaks (Related: #845283)
  - Use sdnotify to inform systemd that daemons are ready
  - Some minor spec file clean up
  - Added systemd-devel as a build requirement


author: Honza Horak <hhorak@redhat.com> - 2.31-4
changelog:
  - Remove systemd-units and systemd-sysv requirements
  - Clean-up SysV init conversion code
  - Clean-up systemd preset macros compatibility code
  - Remove fedora-releated stuff for maps upgrading


author: Matej Mužila <mmuzila@redhat.com> - 2.31-9
changelog:
  - Do not update NIS map when master's version is older
  - Open correct _temporary_ db with tokyocabinet
  - Resolves #1305137, #1331882


author: Miroslav Suchý <msuchy@redhat.com> 1.1.3-1
changelog:
  - 598323 - yumex do not set version (msuchy@redhat.com)
  - l10n: Updates to Chinese (China) (zh_CN) translation
    (leahliu@fedoraproject.org)
  - l10n: Updates to Spanish (Castilian) (es) translation
    (gguerrer@fedoraproject.org)
  - l10n: Updates to Russian (ru) translation (ypoyarko@fedoraproject.org)
  - cleanup - removing translation file, which does not match any language code
    (msuchy@redhat.com)
  - update po files for yum-rhn-plugin (msuchy@redhat.com)
  - l10n: Updates to German (de) translation (ttrinks@fedoraproject.org)
  - l10n: Updates to Polish (pl) translation (raven@fedoraproject.org)


author: Miroslav Suchý <msuchy@redhat.com> 1.1.4-1
changelog:
  - download scheduled package installation in advance (msuchy@redhat.com)
  - add parameter cache_only to all client actions (msuchy@redhat.com)


author: Michael Mraka <michael.mraka@redhat.com> 1.3.3-1
changelog:
  - switch off network communication in cache only mode
  - cache list of rhn channels so we can correctly clean our stuff
  - 627525 - moved communication with satellite server from init_hook to
  - 656380 - do not disable SSL server name check for XMLRPC communication
  - 652424 - code optimalization: use up2date_cfg as class atribute
  - 652424 - do not enable Akamai if you set useNoSSLForPackages option
  - 627525 - do not parse command line, leave it to yum itself


author: Tomas Lestach <tlestach@redhat.com> 1.3.4-1
changelog:
  - updating Copyright years for year 2011 (tlestach@redhat.com)
  - update .po and .pot files for yum-rhn-plugin (tlestach@redhat.com)
  - 666545 - don't report empty transactions as a successful action
    (mzazrivec@redhat.com)
  - fix expression semantics (mzazrivec@redhat.com)


author: Tomas Lestach <tlestach@redhat.com> 1.3.5-1
changelog:
  - 672471 - do not send info to rhnParent about removing packages if plugin is
    enabled, but machine is not registred - i.e. getSystemId() returns None
    (msuchy@redhat.com)


author: Tomas Lestach <tlestach@redhat.com> 1.3.6-1
changelog:
  - this was accidentaly commited in previous commit - reverting
    (msuchy@redhat.com)
  - 648403 - do not require up2date on rhel5 (msuchy@redhat.com)


author: Jan Pazdziora 1.4.1-1
changelog:
  - 675780 - remove installed packages from transaction (mzazrivec@redhat.com)
  - 671032 - specify RHN as "RHN Satellite or RHN Classic" (msuchy@redhat.com)
  - 671032 - disable rhnplugin by default and enable it only after successful
    registration (msuchy@redhat.com)
  - Bumping package versions for 1.4 (tlestach@redhat.com)


author: Miroslav Suchý <msuchy@redhat.com> 1.4.2-1
changelog:
  - l10n: Updates to Russian (ru) translation (ypoyarko@fedoraproject.org)
  - repopulate package sack after initial setup (mzazrivec@redhat.com)


author: Miroslav Suchý <msuchy@redhat.com> 1.4.4-1
changelog:
  - 683546 - optparse isn't friendly to translations in unicode
  - 682820 - re-enable yum-rhn-plugin after package upgrade if the system is
    already registered
  - forward port translations from RHEL6 to yum-rhn-plugin


author: Jan Pazdziora 1.4.5-1
changelog:
  - remove every reference to "up2date --register" - even in comments
    (msuchy@redhat.com)
  - 684342 - beside repo.id, cache even repo.name (msuchy@redhat.com)


author: Miroslav Suchý 1.4.8-1
changelog:
  - 683200 - ssl cert can not be unicode string
  - fix variable typo
  - older yum do not have _repos_persistdir


author: Simon Lukasik <slukasik@redhat.com> 1.4.13-1
changelog:
  - Removing packages.verifyAll capability; it was never used.
    (slukasik@redhat.com)
  - Moving unit test for touchTimeStamp() which was moved to yum-rhn-plugin
    (slukasik@redhat.com)


author: Miroslav Suchý 1.4.14-1
changelog:
  - update copyright years (msuchy@redhat.com)
  - download spacewalk.yum-rhn-plugin from Transifex (msuchy@redhat.com)


