# changelog

author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-33
changelog:
  - Allow sblim_sfcbd_t domain to mmap own tmpfs files
  - Allow nfsd_t domain to read krb5 keytab files
  - Allow nfsd_t domain to manage fadm pid files
  - Allow virt_domain to create icmp sockets BZ(1609142)
  - Dontaudit oracleasm_t domain to request sys_admin capability
  - Update logging_manage_all_logs() interface to allow caller domain map all logfiles


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-34
changelog:
  - Fix issue with aliases in apache interface file
  Resolves: rhbz#1596618
  - Add same context for symlink as binary
  - Allow boltd_t to send logs to journal
  - Allow colord_use_nfs to allow colord also mmap nfs_t files
  - Allow mysqld_safe_t do execute itself
  - Allow smbd_t domain to chat via dbus with avahi daemon
  - cupsd_t domain will create /etc/cupsd/ppd as cupsd_etc_rw_t
  - Update screen_role_template to allow caller domain to have screen_exec_t as entrypoint do new domain
  - Add alias httpd__script_t to _script_t to make sepolicy generate working
  - Allow gpg_t domain to mmap gpg_agent_tmp_t files
  - Allow kprop_t domain to read network state
  - Add support boltd policy
  - Allow kpropd domain to exec itself
  - Allow pdns_t to bind on tcp transproxy port
  - Add support for opafm service
  - Allow hsqldb_t domain to read cgroup files
  - Allow rngd_t domain to read generic certs
  - Allow innd_t domain to mmap own var_lib_t files
  - Update screen_role_temaplate interface
  - Allow chronyd_t domain to mmap own tmpfs files
  - Allow chronyd_t domain to mmap own tmpfs files
  - label /var/lib/pgsql/data/log as postgresql_log_t
  - Allow sysadm_t domain to accept socket
  - Allow systemd to manage passwd_file_t
  - Allow sshd_t domain to mmap user_tmp_t files
  - Allow systemd to mounont boltd lib dirs
  - Allow sysadm_t domain to create rawip sockets
  - Allow sysadm_t domain to listen on socket
  - Update sudo_role_template() to allow caller domain also setattr generic ptys


author: Daniel Kopeček <dkopecek@redhat.com> - 3.14.1-35
changelog:
  - Use explicit path BuildRequires to get /usr/bin/python3 inside the buildroot
  Resolves: rhbz#1615312


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-37
changelog:
  - Dontaudit abrt_t domain to write to usr_t dirs
  - Revert "Allow rpcbind to bind on all unreserved udp ports"
  - Allow rpcbind to bind on all unreserved udp ports
  - Allow virtlogd to execute itself
  - Allow stapserver several actions: - execute own tmp files - mmap stapserver_var_lib_t files - create stapserver_tmpfs_t files
  - Allow ypxfr_t domain to stream connect to rpcbind and allos search sssd libs
  - Allos systemd to socket activate ibacm service
  - Allow dirsrv_t domain to mmap user_t files
  - Allow kdumpctl_t domain to manage kdumpctl_tmp_t fifo files
  - Allow kdumpctl to write to files on all levels
  - Allow httpd_t domain to mmap httpd_config_t files
  - Allow sanlock_t domain to connectto to unix_stream_socket
  - Revert "Add same context for symlink as binary"
  - Allow mysql execute rsync
  - Update nfsd_t policy because of ganesha features
  - Allow conman to getattr devpts_t
  - Allow tomcat_domain to connect to smtp ports
  - Allow tomcat_t domain to mmap tomcat_var_lib_t files
  - Allow nagios_t domain to mmap nagios_log_t files
  - Allow kpropd_t domain to mmap krb5kdc_principal_t files
  - Allow kdumpctl_t domain to read fixed disk storage
  - Allow xserver_t domain to start using systemd socket activation
  - Tweak SELinux policy for systemd to allow DynamicUsers systemd feature
  - Associate several proc labels to fs_t
  - Update init_named_socket_activation() interface to allow systemd also create link files in /var/run
  - Fix typo in syslogd policy
  - Update syslogd policy to make working elasticsearch
  - Label tcp and udp ports 9200 as wap_wsp_port
  - Allow few domains to rw inherited kdumpctl tmp pipes


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-38
changelog:
  - Allow ovs-vswitchd labeled as openvswitch_t domain communicate with qemu-kvm via UNIX stream socket
  Resolves: rhbz#1621142
  - Add interface devicekit_mounton_var_lib()
  - Allow httpd_t domain to mmap tmp files
  - Allow tcsd_t domain to have dac_override capability
  - Allow cupsd_t to rename cupsd_etc_t files
  - Allow iptables_t domain to create rawip sockets
  - Allow amanda_t domain to mmap own tmpfs files
  - Allow fcoemon_t domain to write to sysfs_t dirs
  - Allow dovecot_auth_t domain to have dac_override capability
  - Allow geoclue_t domain to mmap own tmp files
  - Allow chronyc_t domain to read network state
  - Allow apcupsd_t domain to execute itself
  - Allow modemmanager_t domain to stream connect to sssd
  - Allow chonyc_t domain to rw userdomain pipes
  - Update dirsrv_read_share() interface to allow caller domain to mmap dirsrv_share_t files
  - Update dirsrvadmin_script_t policy to allow read httpd_tmp_t symlinks
  - Allow nagios_script_t domain to mmap nagios_spool_t files
  - Allow geoclue_t domain to mmap geoclue_var_lib_t files
  - Allow geoclue_t domain to map generic certs
  - Update munin_manage_var_lib_files to allow manage also dirs
  - Allow nsd_t domain to create new socket file in /var/run/nsd.ctl
  - Fix typo in virt SELinux policy module
  - Allow virtd_t domain to create netlink_socket
  - Allow rpm_t domain to write to audit
  - Allow nagios_script_t domain to mmap nagios_etc_t files
  - Update nscd_socket_use() to allow caller domain to stream connect to nscd_t
  - Allow kdumpctl_t domain to getattr fixed disk device in mls
  - Fix typo in stapserver policy
  - Dontaudit abrt_t domain to write to usr_t dirs
  - Revert "Allow rpcbind to bind on all unreserved udp ports"
  - Allow rpcbind to bind on all unreserved udp ports
  - Allow virtlogd to execute itself
  - Allow stapserver several actions: - execute own tmp files - mmap stapserver_var_lib_t files - create stapserver_tmpfs_t files
  - Allow ypxfr_t domain to stream connect to rpcbind and allos search sssd libs
  - Allos systemd to socket activate ibacm service
  - Allow dirsrv_t domain to mmap user_t files
  - Allow dhcpc_t domain to read /dev/random
  - Allow systemd to mounton device_var_lib_t dirs
  - Allow systemd to mounton kernel system table
  - Label also chr_file /dev/mtd.* devices as fixed_disk_device_t
  - Allow syslogd_t domain to create netlink generic sockets
  - Label /dev/tpmrm[0-9]* as tpm_device_t
  - Update dev_filetrans_all_named_dev() to allow create event22-30 character files with label event_device_t
  - Update userdom_security_admin() and userdom_security_admin_template() to allow use auditctl
  - Allow insmod_t domain to read iptables pid files
  - Allow systemd to mounton /etc
  - Allow initrc_domain to mmap all binaries labeled as systemprocess_entry
  - Allow xserver_t domain to start using systemd socket activation
  - Tweak SELinux policy for systemd to allow DynamicUsers systemd feature
  - Associate several proc labels to fs_t
  - Update init_named_socket_activation() interface to allow systemd also create link files in /var/run


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-39
changelog:
  - Merge remote-tracking branch 'fedora-contrib/f28' into rhel8.0-contrib
  - Tomcat should not be unconfined domain
  - Update ibacm_read_pid_files interface to allow also reading link files
  - Allow zebra_t domain to create packet_sockets
  - Allow opafm_t domain to list sysfs
  - Label /usr/libexec/cyrus-imapd/cyrus-master as cyris_exec_t
  - Allow tomcat Tomcat to delete a temporary file used when compiling class files for JSPs.
  - Allow chronyd_t domain to read virt_var_lib_t files
  - Allow tomcat services create link file in /tmp
  - Label /etc/shorewall6 as shorewall_etc_t
  - Allow winbind_t domain kill in user namespaces
  - Allow firewalld_t domain to read random device
  - Allow abrt_t domain to do execmem
  - Allow geoclue_t domain to execute own var_lib_t files
  - Allow openfortivpn_t domain to read system network state
  - Allow dnsmasq_t domain to read networkmanager lib files
  - sssd: Allow to limit capabilities using libcap
  - sssd: Remove unnecessary capability
  - sssd: Do not audit usage of lib nss_systemd.so
  - Fix bug in nsd.fc, /var/run/nsd.ctl is socket file not file
  - Add correct namespace_init_exec_t context to /etc/security/namespace.d/*
  - Update nscd_socket_use to allow caller domain to mmap nscd_var_run_t files
  - Allow exim_t domain to mmap bin files
  - Allow mysqld_t domain to executed with nnp transition
  - Allow svirt_t domain to mmap svirt_image_t block files
  - Add caps dac_read_search and dav_override to pesign_t domain
  - Allow iscsid_t domain to mmap userio chr files
  - Merge remote-tracking branch 'fedora-base/f28' into rhel8.0-base
  - Revert "Add new interface dev_map_userio()"
  - Add new interface dev_map_userio()
  - Allow systemd to read ibacm pid files
  - Allow systemd to create symlinks in for /var/lib
  - Add comment to show that template call also allows changing shells
  - Document userdom_change_password_template() behaviour
  - Merge remote-tracking branch 'fedora-base/f28' into rhel8.0-base
  - update files_mounton_kernel_symbol_table() interface to allow caller domain also mounton system_map_t file
  - Fix typo in logging SELinux module
  - Allow usertype to mmap user_tmp_type files
  - In domain_transition_pattern there is no permission allowing caller domain to execu_no_trans on entrypoint, this patch fixing this issue
  - Revert "Add execute_no_trans permission to mmap_exec_file_perms pattern"
  - Add boolean: domain_can_mmap_files.
  - Allow ipsec_t domian to mmap own tmp files
  - Add .gitignore file
  - Add execute_no_trans permission to mmap_exec_file_perms pattern
  - Allow sudodomain to search caller domain proc info
  - Allow audisp_remote_t domain to read auditd_etc_t
  - netlabel: Remove unnecessary sssd nsswitch related macros
  - Allow to use sss module in auth_use_nsswitch
  - Limit communication with init_t over dbus
  - Add actual modules.conf to the git repo
  - Add few interfaces to optional block
  - Allow sysadm_t and staff_t domain to manage systemd unit files
  - Add interface dev_map_userio_dev()
  Resolves: rhbz#1623411
  Resolves: rhbz#1624648
  Resolves: rhbz#1596618
  Resolves: rhbz#1574878
  Resolves: rhbz#1577324
  Resolves: rhbz#1625202
  Resolves: rhbz#1581715
  Resolves: rhbz#1625127


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-40
changelog:
  - Tomcat should not be unconfined domain
  - Allow cockpit_t domain to read systemd state
  - Allow abrt_t domain to write to usr_t files
  - Allow cockpit to create motd file in /var/run/cockpit
  - Label /usr/sbin/pcsd as cluster_exec_t
  - Allow pesign_t domain to getattr all fs
  - Allow tomcat servers to manage usr_t files
  - Dontaudit tomcat serves to append to /dev/random device
  - Allow dirsrvadmin_script_t domain to read httpd tmp files
  - Allow sbd_t domain to getattr of all char files in /dev and read sysfs_t files and dirs
  - Revert "Allow firewalld_t domain to read random device"
  - Allow postfix domains to mmap system db files
  - Allow geoclue_t domain to execute own tmp files
  - Allow virt_qemu_ga_t domain to read network state BZ(1592145)
  - Update ibacm_read_pid_files interface to allow also reading link files
  - Allow zebra_t domain to create packet_sockets
  - Allow opafm_t domain to list sysfs
  - Label /usr/libexec/cyrus-imapd/cyrus-master as cyris_exec_t
  - Add boolean: domain_can_mmap_files.
  - Allow sshd_t domain to read cockpit pid files
  - Allow syslogd_t domain to manage cert_t files
  - Allow getattr as part of files_mounton_kernel_symbol_table.
  - Fix typo "aduit" -> "audit"
  - Revert "Add new interface dev_map_userio()"
  - Add new interface dev_map_userio()
  - Allow systemd to read ibacm pid files
  Resolves: rhbz#1615318
  Resolves: rhbz#1619001
  Resolves: rhbz#1627646


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-41
changelog:
  - Tomcat should not be unconfined domain
  - Fix typo in cockpit interfaces we have cockpit_var_run_t files not cockpit_var_pid_t
  - Add interface apcupsd_read_power_files()
  - Allow systemd labeled as init_t to execute logrotate in logrotate_t domain
  - Allow dac_override capability to amanda_t domain
  - Allow geoclue_t domain to get attributes of fs_t filesystems
  - Update selinux policy for rhnsd_t domain based on changes in spacewalk-2.8-client
  Resolves: rhbz#1629678
  Resolves: rhbz#1629685
  Resolves: rhbz#1626100
  Resolves: rhbz#1629588
  Resolves: rhbz#1630317


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-42
changelog:
  - Allow cockpit to create motd file in /var/run/cockpit
  Resolves: rhbz#1629678
  - Allow cockpit_t domain to read systemd state
  Resolves: rhbz#1629588


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-43
changelog:
  - Allow ibacm_t domain to read/write to infiniband devices Allow ibacm_t domain to getattr tmpfs_t filesystem.
  Resolves: rhbz#1635674
  - Update SELinux policy for libreswan based on the latest rebase 3.26
  Resolves: rhbz#1637089


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-44
changelog:
  - Update rpm macros for selinux policy from sources repository: https://github.com/fedora-selinux/selinux-policy-macros
  Resolves: rhbz#1633198
  - Allow boltd_t to read fwupd_t processes state
  - Turn named_write_master_zones boolean on by default.
  Resolves: rhbz#1633158
  - Label /etc/rhsm as rhsmcertd_config_t
  Resolves: rhbz#1636212
  - Allow httpd_t domain to write to httpd_config_t dirs if httpd_run_ipa boolean is turned on
  Resolves: rhbz#1624930
  - Allow dhcpd_t domain to mmap dhcpd_state_t files
  Resolves: rhbz#1635643
  - Allow abrt_t domain to manage usr_t dirs
  Resolves: rhbz#1619001
  - Allow certmonger_t domain to manage cockpit pid files
  Resolves: rhbz#1629685
  - Update opafm_t domain after basic testing this service
  Resolves: rhbz#1627861
  - Allow systemd-tty-ask to ask for password of encrypted partions during boot
  Resolves: rhbz#1638666
  - Update sysnet_read_dhcp_config interface to allow caller domain also mmap dhcp_etc_t files
  - Add interface files_manage_usr_dirs()


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-45
changelog:
  - Allow gpg_t to create own tmpfs dirs and sockets
  - Allow rhsmcertd_t domain to relabel cert_t files
  - Add SELinux policy for kpatch
  Resolves: rhbz#1630198
  - Allow nova_t domain to use pam
  - sysstat: grant sysstat_t the search_dir_perms set
  - Allow boltd_t domain to dbus chat with fwupd_t domain BZ(1633786)
  - Allow caller domains using cron_*_role to have entrypoint permission on system_cron_spool_t files BZ(1625645)
  - Add interface cron_system_spool_entrypoint()
  - Bolt added d-bus API for force-powering the thunderbolt controller, so system-dbusd needs acces to boltd pipes BZ(1637676)
  - Add interfaces for boltd SELinux module
  - Add dac_override capability to modemmanager_t domain BZ(1636608)
  - Add interface miscfiles_relabel_generic_cert()
  - Make kpatch policy active
  - Fix userdom_write_user_tmp_dirs() to allow caller domain also read/write user_tmp_t dirs
  - Dontaudit sys_admin capability for netutils_t domain
  - Label tcp and udp ports 2611 as qpasa_agent_port_t
  - Allow systemd to mount boltd_var_run_t dirs BZ(1636823)
  - Label correctly /var/named/chroot*/dev/unrandom in bind chroot.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-46
changelog:
  - Add dac_override capability to ftpd_t domain
  Resolves: rhbz#1641049
  - Allow X display manager to check status and reload services which are part of x_domain attribute
  Resolves: rhbz#1641082


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-47
changelog:
  - Update pesign policy to allow pesign_t domain to read bind cache files/dirs
  Resolves: rhbz#1644796
  - Add dac_override capability to mdadm_t domain
  Resolves: rhbz#1599646
  - Create ibacm_tmpfs_t type for the ibacm policy
  Resolves: rhbz#1581715
  - Dontaudit capability sys_admin for dhcpd_t domain
  Resolves: rhbz#1635643
  - Makes rhsmcertd_t domain an exception to the constraint preventing changing the user identity in object contexts.
  Resolves: rhbz#1639181
  - Allow abrt_t domain to mmap generic tmp_t files
  Resolves:rhbz#1644727
  - Label /usr/sbin/wpa_cli as wpa_cli_exec_t
  Resolves: rhbz#1644899
  - Allow sandbox_xserver_t domain write to user_tmp_t files
  Resolves:rhbz#1644315
  - Dontaudit thumb_t domain to setattr on lib_t dirs BZ(1643672)
  - Dontaudit cupsd_t domain to setattr lib_t dirs BZ(1636766)
  - Add dac_override capability to postgrey_t domain BZ(1638954)
  - Allow thumb_t domain to execute own tmpfs files BZ(1643698)
  - Add nnp transition rule for vnstatd_t domain using NoNewPrivileges systemd feature BZ(1643063)
  - Allow l2tpd_t domain to mmap /etc/passwd file BZ(1638948)
  - Allow certutil running as ipsec_mgmt_t domain to mmap ipsec_mgmt pid files Dontaudit ipsec_mgmt_t domain to write to the all mountpoints
  Resolves: rhbz#1644727
  - Add interface files_map_generic_tmp_files()
  - Add dac_override capability to the syslogd_t domain
  Resolves: rhbz#1644373
  - Create systemd_timedated_var_run_t label
  - Update systemd_timedated_t domain to allow create own pid files/access init_var_lib_t files and read dbus files BZ(1646202)
  - Improve fs_manage_ecryptfs_files to allow caller domain also mmap ecryptfs_t files BZ(1630675)
  - kernel/files.fc: Label /run/motd.d(/.*)? as etc_t
  - Allow ipsec_mgmt_t process to send signals other than SIGKILL, SIGSTOP, or SIGCHLD to the ipsec_t domains BZ(1638949)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-48
changelog:
  - Allow sanlock_t domain to read/write sysfs_t files
  Resolves: rhbz#1647594
  - Add dac_override capability to postfix_local_t domain
  - Allow ypbind_t to search sssd_var_lib_t dirs
  - Allow virt_qemu_ga_t domain to write to user_tmp_t files
  - Allow systemd_logind_t to dbus chat with virt_qemu_ga_t
  - Update sssd_manage_lib_files() interface to allow also mmap sssd_var_lib_t files
  - Label /var/lib/private/systemd/ as init_var_lib_t
  Resolves: rhbz#1649312
  - Allow initrc_t domain to create new socket labeled as init_t
  - Allow audisp_remote_t domain remote logging client to read local audit events from relevant socket.
  Resolves: rhbz#1639675
  - Add tracefs_t type to mountpoint attribute
  Resolves: rhbz#1647819
  - Allow useradd_t and groupadd_t domains to send signals to sssd_t
  Resolves: rhbz#1651531
  - Allow systemd_logind_t domain to remove directories labeled as tmpfs_t BZ(1648636)
  - Allow useradd_t and groupadd_t domains to access sssd files because of the new feature in shadow-utils
  Resolves: rhbz#1651531


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-49
changelog:
  - Update nslcd_t domain to allow view kernel and systemd keyrings
  Resolves: rhbz#1657916
  - Allow arpwatch_t domains to execute shell BZ(1644568)
  - Allow processes labeled as ipa_otpd_t stream connect to sssd.
  - Add new SELinux domain pcp_plugin_t.
  Resolves: rhbz#1648386
  - Remove all ganesha bits from gluster and rpc policy
  Resolves: rhbz#1639227
  - Label /usr/share/spamassassin/sa-update.cron as spamd_update_exec_t
  Resolves: rhbz#1656837
  - Add dac_override capability to ssad_t domains
  Resolves: rhbz#1655551
  - Allow pesign_t domain to read gnome home configs
  Resolves: rhbz#1644796
  - Label /usr/libexec/lm_sensors/sensord-service-wrapper as lsmd_exec_t
  Resolves: rhbz#1656055
  - Allow rngd_t domains read kernel state
  Resolves: rhbz#1656054
  - Allow certmonger_t domains to read bind cache
  Resolves: rhbz#1655077
  - Allow ypbind_t domain to stream connect to sssd
  Resolves: rhbz#1583953
  - Allow rngd_t domain to setsched
  Resolves: rhbz#1653872
  - Add interface init_view_key()
  - Allow systemd to mmap all pidfiles
  Resolves: rhbz#1622548
  - Add files_map_all_pids() interface
  - Allow passwd_t domain mamange sssd public nad lib files, read pid files and send signals to sssd_t domains
  Resolves: rhbz#1657291
  - Update xserver_filetrans_home_content() and xserver_filetrans_admin_home_content() unterfaces to allow caller domain to create .vnc dir in users homedir labeled as xdm_home_t
  Resolves: rhbz#1639846
  - Update logging_filetrans_named_content() to allow caller domains of this interface to create /var/log/journal/remote directory labeled as var_log_t
  - Add sys_resource capability to the systemd_passwd_agent_t domain
  Resolves: rhbz#1590981
  - Allow ipsec_t domains to read bind cache
  Resolves: rhbz#1654692
  - kernel/files.fc: Label /run/motd as etc_t
  - Allow systemd to stream connect to userdomain processes
  Resolves: rhbz#1644733


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-50
changelog:
  - Change label of /usr/libexec/lm_sensors/sensord-service-wrapper from lsmd_exec_t to sensord_exec_t
  Resolves: rhbz#1656055
  - Make kpatch_t domain application domain to allow users to execute kpatch in kpatch_t domain.
  Resolves: rhbz#1630198
  - Allow confined users to use new socket classes for bluetooth, alg and tcpdiag sockets
  Resolves: rhbz#1557301
  - Allow sysadm_t,staff_t and unconfined_t domain to execute kpatch as kpatch_t domain
  Resolves: rhbz#1630198


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-51
changelog:
  - Allow tangd_t domain to bind on tcp ports labeled as tangd_port_t
  Resolves: rhbz#1664345
  - Create tangd_port_t with default label tcp/7406
  Resolves: rhbz#1664345
  - Remove tangd_t domain from permissive domains.
  Resolves: rhbz#1664345


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-52
changelog:
  - Fix userdom_admin_user_template() interface by adding bluetooth,alg,dccp create_stream_socket permissions.
  Resolves: rhbz#1557301


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-53
changelog:
  - Update dbus_role_template interface to allow userdomains to accept data from userdomain dbus domains
  Resolves: rhbz#1664448
  - Allow systemd to read selinux logind config
  Resolves: rhbz#1664448
  - Fix userdom_admin_user_template() interface by adding bluetooth,alg,dccp create_stream_socket permissions.
  - Allow transition from init_t domain to user_t domain during ssh login with confined user user_u
  Resolves: rhbz#1664448


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-54
changelog:
  - Allow sensord_t domain to use nsswitch and execute shell
  Resolves: rhbz#1656055
  - Allow opafm_t domain to execute lib_t files
  Resolves: rhbz#1627861


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-55
changelog:
  - Fix broken config files because of missing level specification in user_t contexts
  Resolves: rhbz#1664448


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-56
changelog:
  - Allow virt_doamin to read/write dev device
  Resolves: rhbz#1672188
  - Update ibacm_t policy after testing lastest version of this component
  Resolves: rhbz#1635674
  - Allow sensord_t domain to mmap own log files
  Resolves:rhbz#1656055
  - Add dac_override capability for ipa_helper_t
  Resolves: rhbz#1668168
  - Allow sensord_t domain to use nsswitch and execute shell
  Resolves: rhbz#1656055
  - Allow opafm_t domain to execute lib_t files
  Resolves: rhbz#1627861
  - Allow opafm_t domain to manage kdump_crash_t files and dirs
  Resolves: rhbz#1627861
  - Label /dev/sev char device as sev_device_t
  Resolves: rhbz#1672188


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-57
changelog:
  - Allow read network state of system for processes labeled as ibacm_t
  Resolves: rhbz#1635674
  - Allow ibacm_t domain to send dgram sockets to kernel processes
  Resolves: rhbz#1635674
  - Allow virt_doamin to read/write dev device
  Resolves: rhbz#1672188
  - Update ibacm_t policy after testing lastest version of this component
  Resolves: rhbz#1635674
  - Allow sensord_t domain to mmap own log files
  Resolves:rhbz#1656055
  - Label /dev/sev char device as sev_device_t
  Resolves: rhbz#1672188


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-58
changelog:
  - Allow ibacm_t domain to read system state and label all ibacm sockets and symlinks as ibacm_var_run_t in /var/run
  Resolves: rhbz#1635674
  - Update mount_read_pid_files macro to allow also list mount_var_run_t dirs
  Resolves: rhbz#1664448
  - Allow userdomain to stop systemd user session during logout.
  Resolves: rhbz#1664448


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-60
changelog:
  - Update kdump_manage_crash() interface to allow also manage dirs by caller domain
  Resolves: rhbz#1627861


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.1-61
changelog:
  - Add dac_override capability for sbd_t SELinux domain
  Resolves: rhbz#1677325
  - Allow syslogd_t domain to send null signal to all domains on system
  Resolves: rhbz#1676923


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-5
changelog:
  - Add domain transition that systemd labeled as init_t can execute spamd_update_exec_t binary to run newly created process as spamd_update_t
  Resolves :rhbz#1656837
  - Remove allow rule for virt_qemu_ga_t to write/append user_tmp_t files
  Resolves: rhbz#1648854
  - Label /var/run/user/*/dbus-1 as session_dbusd_tmp_t
  Resolves:rhbz#1688671
  - Add dac_override capability to namespace_init_t domain
  Resolves: rhbz#1557420
  - Label /usr/sbin/corosync-qdevice as cluster_exec_t
  Resolves: rhbz#1690925
  - Label /usr/libexec/dnf-utils as debuginfo_exec_t
  Resolves: rhbz#1711183
  - Label /usr/bin/tshark as wireshark_exec_t
  Resolves: rhbz#1710962
  - Allow rhsmcertd_t domain to read rpm cache files
  Resolves: rhbz#1641648
  - Allow associate all filesystem_types with fs_t
  Resolves: rhbz#1614209
  - Allow init_t to manage session_dbusd_tmp_t dirs
  Resolves: rhbz#1688671
  - Allow systemd_gpt_generator_t to read/write to clearance
  Resolves: rhbz#1558573
  - Allow su_domain_type to getattr to /dev/gpmctl
  Resolves: rhbz#1593667
  - Update userdom_login_user_template() template to make working systemd user session for guest and xguest SELinux users
  Resolves: rhbz#1709372


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-6
changelog:
  - Allow kadmind_t domain to read pkcs11 module configs
  Resolves: rhbz#1664983
  - Allow kadmind_t domain to read named_cache_t files
  Resolves: rhbz#1703241
  - Fix bind_read_cache() interface to allow only read perms to caller domains
  - Allow chronyc_t domain to create own tmpfiles and allow communicate send data over unix dgram sockets
  Resolves: rhbz#1711909
  - Allow wireshark_t domain to create fifo temp files
  Resolves: rhbz#1711005
  - Add domain transition that systemd labeled as init_t can execute spamd_update_exec_t binary to run newly created process as spamd_update_t
  Resolves :rhbz#1656837
  - Remove allow rule for virt_qemu_ga_t to write/append user_tmp_t files
  Resolves: rhbz#1648854
  - Label /var/run/user/*/dbus-1 as session_dbusd_tmp_t
  Resolves:rhbz#1688671
  - Add dac_override capability to namespace_init_t domain
  Resolves: rhbz#1557420
  - Label /usr/sbin/corosync-qdevice as cluster_exec_t
  Resolves: rhbz#1690925
  - Label /usr/libexec/dnf-utils as debuginfo_exec_t
  Resolves: rhbz#1711183
  - Allow rtkit_scheduled for sysadm
  Resolves: rhbz#1703241
  - Fix find commands in Makefiles
  - Allow associate all filesystem_types with fs_t
  Resolves: rhbz#1614209
  - Allow init_t to manage session_dbusd_tmp_t dirs
  Resolves: rhbz#1688671
  - Allow systemd_gpt_generator_t to read/write to clearance
  Resolves: rhbz#1558573
  - Allow su_domain_type to getattr to /dev/gpmctl
  Resolves: rhbz#1593667


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-7
changelog:
  - Allow kadmind_t domain to read home config data
  Resolves: rhbz#1664983
  - Allow sbd_t domain to readwrite cgroups
  Resolves: rhbz#1715134
  - Label /var/log/pacemaker/pacemaker as cluster_var_log_t
  Resolves: rhbz#1712058
  - Allow certmonger_t domain to manage named cache files/dirs


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-9
changelog:
  - Allow redis_t domain to read public sssd files
  Resolves: rhbz#1718200
  - Label /usr/sbin/nft as iptables_exec_t
  Resolves: rhbz#1656891


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-10
changelog:
  - Allow qpidd_t domain to getattr all fs_t filesystem and mmap usr_t files
  - Label /var/kerberos/krb5 as krb5_keytab_t
  Resolves: rhbz#1669975
  - Allow sbd_t domain to manage cgroup dirs
  Resolves: rhbz#1715134
  - Allow wireshark_t domain to create netlink netfilter sockets
  Resolves: rhbz#1711005
  - Allow gpg_agent_t domain to use nsswitch
  Resolves: rhbz#1567073
  - Allow httpd script types to mmap httpd rw content
  Resolves: rhbz#1693137
  - Allow confined users to login via cockpit
  Resolves: rhbz#1718814
  - Replace "-" by "_" in speechdispatcher types names
  - Change condor_domain declaration in condor_systemctl
  - Update interface networkmanager_manage_pid_files() to allow manage also dirs
  Resolves: rhbz#1720070
  - Update virt_use_nfs() boolean to allow virt_t to mmap nfs_t files
  Resolves: rhbz#1719083
  - Fix all interfaces which cannot by compiled because of typos
  Resolves: rhbz#1687460
  - Allow auditd_t domain to send signals to audisp_remote_t domain
  Resolves: rhbz#1726659
  - Allow associate efivarfs_t on sysfs_t
  Resolves: rhbz#1709747
  - Allow userdomain attribute to manage cockpit_ws_t stream sockets
  Resolves: rhbz#1718814
  - Allow ssh_agent_type to read/write cockpit_session_t unnamed pipes
  - Add interface ssh_agent_signal()
  - Dontaudit unpriv_userdomain to manage boot_t files
  Resolves: rhbz#1723773
  - Allow crack_t domain read /et/passwd files
  Resolves: rhbz#1721132
  - Allow dhcpc_t domain to manage network manager pid files
  Resolves: rhbz#1720070


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-12
changelog:
  - Make working wireshark execute byt confined users staff_t and sysadm_t
  Resolves: rhbz#1712788
  - Label user cron spool file with user_cron_spool_t
  Resolves: rhbz#1727342
  - Allow ptp4l_t domain to write to pmc socket which is created by pmc command line tool
  Resolves: rhbz#1668667
  - Update svnserve_t policy to make working svnserve hooks
  Resolves: rhbz#1729955
  - Allow varnishlog_t domain to check for presence of varnishd_t domains
  Resolves: rhbz#1730270
  - Allow lsmd_t domain to execute /usr/bin/debuginfo-install
  Resolves: rhbz#1720648
  - Update sandboxX policy to make working firefox inside SELinux sandbox
  Resolves: rhbz#1663874
  - Remove allow rule from svirt_transition_svirt_sandbox interface to don't allow containers to connect to random services
  Resolves: rhbz#1695248
  - Allow httpd_t domain to read /var/lib/softhsm/tokens to allow httpd daemon to use pkcs#11 devices
  Resolves: rhbz#1690484
  - Allow opafm_t domain to modify scheduling information of another process.
  Resolves: rhbz#1725874
  - Allow gssd_t domain to list tmpfs_t dirs
  Resolves: rhbz#1674470
  - Allow mdadm_t domain to read tmpfs_t files
  Resolves: rhbz#1669996
  - Allow sbd_t domain to check presence of processes labeled as cluster_t
  Resolves: rhbz#1669595
  - Dontaudit httpd_sys_script_t to read systemd unit files
  Resolves: rhbz#1670139
  - Allow blkmapd_t domain to read nvme devices
  Resolves: rhbz#1669985
  - Update cpucontrol_t domain to make working microcode service
  Resolves: rhbz#1669485
  - Allow domain transition from logwatch_t do postfix_postqueue_t
  Resolves: rhbz#1669162
  - Allow chronyc_t domain to create and write to non_security files in case when sysadmin is redirecting output to file e.g: 'chronyc -n tracking > /var/lib/test'
  Resolves: rhbz#1696252
  - Allow httpd_sys_script_t domain to mmap httpdcontent
  Resolves: rhbz#1693137
  - Allow sbd_t to manage cgroups_t files
  Resolves: rhbz#1715134
  - Update wireshark policy to make working tshar labeled as wireshark_t
  Resolves: rhbz#1711005
  - Update virt_use_nfs boolean to allow svirt_t domain to mmap nfs_t files
  Resolves: rhbz#1719083
  - Allow sbd_t domain to use nsswitch
  Resolves: rhbz#1723498
  - Allow sysadm_t and staff_t domains to read wireshark shared memory
  Resolves: rhbz#1712788
  - Label /usr/libexec/utempter/utempter  as utemper_exec_t
  Resolves: rhbz#1729571
  - Allow unconfined_domain_type to setattr own process lnk files.
  Resolves: rhbz#1730500
  - Add interface files_write_generic_pid_sockets()
  - Dontaudit writing to user home dirs by gnome-keyring-daemon
  Resolves: rhbz#1689797
  - Allow staff and admin domains to setpcap in user namespace
  Resolves: rhbz#1673922
  - Allow staff and sysadm to use lockdev
  Resolves: rhbz#1673269
  - Allow staff and sysadm users to run iotop.
  Resolves: rhbz#1671241
  - Dontaudit traceroute_t domain require sys_admin capability
  Resolves: rhbz#1671672
  - Dontaudit dbus chat between kernel_t and init_t
  Resolves: rhbz#1669095
  - Allow systemd labeled as init_t to create mountpoints without any specific label as default_t
  Resolves: rhbz#1696144


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-13
changelog:
  - Allow search krb5_keytab_t dirs for interfaces kerberos_read_keytab() and kerberos_rw_keytab
  Resolves: rhbz#1730144
  - Allow virtlockd process read virtlockd.conf file
  Resolves: rhbz#1733185
  - Relabel  /usr/sbin/virtlockd from virt_exec_t to virtlogd_exec_t.
  Resolves: rhbz#1733185
  - Allow brltty to request to load kernel module
  Resolves: rhbz#1689955
  - Add svnserve_tmp_t label forl svnserve temp files to system private tmp
  Resolves: rhbz#1729955
  - Dontaudit svirt_tcg_t domain to read process state of libvirt
  Resolves: rhbz#1732500
  - Allow mysqld_t domain to domtrans to ifconfig_t domain when executing ifconfig tool
  Resolves: rhbz#1732381
  - Allow cyrus work with PrivateTmp
  Resolves: rhbz#1725023
  - Make cgdcbxd_t domain working with SELinux enforcing.
  Resolves: rhbz#1651991
  - Remove system_r role from staff_u user.
  Resolves: rhbz#1677052
  - Add systemd_private_tmp_type attribute
  Resolves: rhbz#1725023
  - Allow systemd to load kernel modules during boot process.
  Resolves: rhbz#1644805


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-15
changelog:
  - Dontaudit abrt_t domain to read root_t files
  Resolves: rhbz#1734403
  - Allow ipa_dnskey_t domain to read kerberos keytab
  Resolves: rhbz#1730144
  - Update ibacm_t policy
  - Allow dlm_controld_t domain setgid capability
  Resolves: rhbz#1738608
  - Allow auditd_t domain to create auditd_tmp_t temporary files and dirs in /tmp or /var/tmp
  Resolves: rhbz#1740146
  - Update systemd_dontaudit_read_unit_files() interface to dontaudit alos listing dirs
  Resolves: rhbz#1670139


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-17
changelog:
  - Label /usr/libexec/microcode_ctl/reload_microcode as cpucontrol_exec_t
  Resolves: rhbz#1669485
  - Fix typo in networkmanager_append_log() interface
  Resolves: rhbz#1687460
  - Update gpg policy to make ti working with confined users
  Resolves: rhbz#1640296


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-20
changelog:
  - Label /var/log/hawkey.log as rpm_log_t and update rpm named filetrans interfaces.
  - Allow sysadm_t to create hawkey log file with rpm_log_t SELinux label
  Resolves: rhbz#1720639


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-21
changelog:
  - Allow user_mail_domain attribute to manage files labeled as etc_aliases_t.
  Resolves: rhbz#1750405
  - Allow dlm_controld_t domain to read random device
  Resolves: rhbz#1752943
  - Allow haproxy_t domain to read network state of system
  Resolves: rhbz#1746974
  - Allow avahi_t to send msg to lpr_t
  Resolves: rhbz#1752843
  - Create new type ipmievd_helper_t domain for loading kernel modules.
  Resolves: rhbz#1673804
  - networkmanager: allow NetworkManager_t to create bluetooth_socket
  Resolves: rhbz#1747768
  - Label /etc/named direcotory as named_conf_t
  Resolves: rhbz#1759505
  - Update aide_t domain to allow this tool to analyze also /dev filesystem
  Resolves: rhbz#1758265
  - Update zebra SELinux policy to make it work also with frr service
  Resolves: rhbz#1714984
  - Allow chronyd_t domain to manage and create chronyd_tmp_t dirs,files,sock_file objects.
  Resolves: rhbz#1711909
  - Allow chronyc_t domain to append to all non_security files
   Resolves: rhbz#1696252
  - Allow httpd_t domain to read/write named_cache_t files
  Resolves: rhbz#1690484
  - Add new interface bind_rw_cache()
  Resolves: rhbz#1690484
  - Label /var/run/mysql as mysqld_var_run_t
  Resolves: rhbz#1687867
  - Allow cupsd_t domain to create directory with name ppd in dirs labeled as cupsd_etc_t with label cupsd_rw_etc_t.
  Resolves: rhbz#1612552
  - Update cron_role, cron_admin_role and cron_unconfined_role to avoid *_t_t types
  Resolves: rhbz#1647971
  - Allow sandbox_web_type domains to sys_ptrace and sys_chroot in user namespaces
  Resolves: rhbz#1663874
  - Update gnome_dontaudit_read_config
  Resolves: rhbz#1663874
  - Update  tomcat_can_network_connect_db boolean to allow tomcat domains also connect to redis ports
  Resolves: rhbz#1687499
  - Update keepalived policy
  Resolves: rhbz#1728332
  - Add sys_admin capability for keepalived_t labeled processes
  Resolves: rhbz#1729174
  - Fix abrt_upload_watch_t in abrt policy
  Resolves: rhbz#1737419
  - Label /dev/shm/dirsrv/ with dirsrv_tmpfs_t label
  Resolves: rhbz#1737550
  - Allow amanda_t to manage its var lib files and read random_device_t
  Resolves: rhbz#1739137
  - Allow zebrat_t domain to read state of NetworkManager_t processes BZ(1739983)
  Resolves: rhbz#1743684
  - Allow pesign_t domain to read/write named cache files.
  Resolves: rhbz#1745429
  - Allow login user type to use systemd user session
  Resolves: rhbz#1727887
  - Allow avahi_t to send msg to xdm_t
  Resolves: rhbz#1755401
  - Allow ldconfig_t domain to manage initrc_tmp_t objects
  Resolves: rhbz#1756006
  - Add new interface init_write_initrc_tmp_pipes()
  - Add new interface init_manage_script_tmp_files()
  - Add new interface udev_getattr_rules_chr_files()
  - Run lvmdbusd service as lvm_t
  Resolves: rhbz#1726166
  - Label 2618/tcp and 2618/udp as priority_e_com_port_t
  - Label 2616/tcp and 2616/udp as appswitch_emp_port_t
  - Label 2615/tcp and 2615/udp as firepower_port_t
  - Label 2610/tcp and 2610/udp as versa_tek_port_t
  - Label 2613/tcp and 2613/udp as smntubootstrap_port_t
  - Label 3784/tcp and 3784/udp as bfd_control_port_t
  - Allow systemd labeled as init_t domain to remount rootfs filesystem
  Resolves: rhbz#1698197
  - Add interface files_remount_rootfs()
  - New interface files_append_non_security_files()
  - Allow domains systemd_networkd_t and systemd_logind_t to chat over dbus
  Resolves: rhbz#1612552
  - Update userdomains to pass correct parametes based on updates from cron_*_role interfaces
   Resolves: rhbz#1647971
  - Dontaudit sys_admin capability for iptables_t SELinux domain
  Resolves: rhbz#1669040
  - Allow systemd labeled as init_t domain to read/write faillog_t. BZ(1723132)
  Resolves: rhbz#1671019
  - Allow userdomains to dbus chat with policykit daemon
  Resolves: rhbz#1727902
  - Allow ipsec_t domain to read/write named cache files
  Resolves: rhbz#1743777
  - Add sys_admin capability for ipsec_t domain
  Resolves: rhbz#1753662


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-22
changelog:
  - Allow ldconfig_t domain to manage initrc_tmp_t link files Allow netutils_t domain to write to initrc_tmp_t fifo files
  Resolves: rhbz#1756006
  - Allow user domains to manage user session services
  Resolves: rhbz#1727887
  - Allow staff and user users to get status of user systemd session
  Resolves: rhbz#1727887


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-23
changelog:
  - Label only regular files inside /usr/lib/frr direcotry as zebra_exec_t
  Resolves: rhbz#1714984
  - Dontaudit and disallow sys_admin capability for keepalived_t domain
  Resolves: rhbz#1729174
  - Allow processes labeled as keepalived_t domain to get process group
  Resolves: rhbz#1746955


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-24
changelog:
  - Allow confined users to run newaliases
  Resolves:rhbz#1750405
  - Add interface mysql_dontaudit_rw_db()
  Resolves: rhbz#1747926
  - Label /var/lib/xfsdump/inventory as amanda_var_lib_t
  Resolves: rhbz#1739137
  - Allow tmpreaper_t domain to read all domains state
  Resolves: rhbz#1765065
  - Allow ipa_ods_exporter_t domain to read krb5_keytab files
  Resolves: rhbz#1759900
  - Allow rhsmcertd_t domain to read rtas_errd lock files
  Resolves: rhbz#1744234
  - Add new interface rtas_errd_read_lock()
  Resolves: rhbz#1744234
  - Donaudit ifconfig_t domain to read/write mysqld_db_t files
  Resolves: rhbz#1747926


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-25
changelog:
  - Allow sssd_t domain to read gnome config and named cache files
  Resolves: rhbz#1743907
  - Allow httpd_t to signull mailman_cgi_t process
  Resolves: rhbz#1686462
  - Update virt_read_content interface to allow caller domain mmap virt_content_t block devices and files
  Resolves: rhbz#1758545
  - Allow cachefilesd_t domain to read/write cachefiles_device_t devices
  Resolves: rhbz#1750096
  - Remove setting label for /dev/cachefilesd char device from cachefilesd policy. This should be added in base policy
  Resolves: rhbz#1750096
  - Allow pcp_pmcd_t domain to bind on udp port labeled as statsd_port_t
  Resolves:rhbz#1746511
  - Label libvirt drivers as virtd_exec_t
  Resolves: rhbz#1745076
  - Update apache and pkcs policies to make active opencryptoki rules
  Resolves: rhbz#1744198
  - Introduce new bolean httpd_use_opencryptoki
  Resolves: rhbz#1744198
  - Allow gssproxy_t domain read state of all processes on system
  Resolves: rhbz#1752031
  - Dontaudit tmpreaper_t getting attributes from sysctl_type files
  Resolves: rhbz#1730204
  - Added macro for timedatex to chat over dbus.
  Resolves: rhbz#1730204
  - Run timedatex service as timedatex_t
  Resolves: rhbz#1730204
  - Run lldpd service as lldpad_t.
  Resolves: rhbz#1726246
  - Allow abrt_upload_watch_t domain to send dgram msgs to kernel processes and stream connect to journald
  - Allow tmpreaper_t domain to getattr files labeled as mtrr_device_t
  Resolves: rhbz#1765065
  - Allow rhsmcertd_t domain to read/write rtas_errd_var_lock_t files
  Resolves: rhbz#1744234
  - Allow tmpwatch process labeled as tmpreaper_t domain to execute fuser command.
  Resolves: rhbz#1765065
  - Update tmpreaper_t policy due to fuser command
  Resolves: rhbz#1765065
  - Allow fail2ban_t domain to create netlink netfilter sockets.
  Resolves: rhbz#1766415
  - Label /dev/cachefilesd as cachefiles_device_t
  Resolves: rhbz#1750096
  - Label udp 8125 port as statsd_port_t
  Resolves: rhbz#1746511
  - Allow systemd(init_t) to load kernel modules
  Resolves: rhbz#1758255
  - Dontaudit sys_admin capability for auditd_t domains
  Resolves: rhbz#1669040
  - Allow x_userdomain to dbus_chat with timedatex.
  Resolves: rhbz#1730204


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-26
changelog:
  - New policy for rrdcached
  Resolves: rhbz#1726255
  - Update timedatex policy
  - Update timedatex SELinux policy to to sychronizate time with GNOME and add new macro chronyd_service_status to chronyd.if
  - Add new macro systemd_timedated_status to systemd.if to get timedated service status
  Resolves: rhbz#1730204
  - Update lldpad_t policy module
  Resolves: rhbz#1726246
  - Dontaudit sandbox web types to setattr lib_t dirs
  Resolves: rhbz#1739858
  - Fix typo in cachefiles device
  Resolves: rhbz#1750096


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-27
changelog:
  - Allow timedatex_t domain dbus chat with both confined and unconfined users
  Resolves: rhbz#1771513
  - Fix typo bugs in rtas_errd_read_lock() interface
  Resolves: rhbz#1750096
  - Allow timedatex_t domain to systemctl chronyd domains
  Resolves: rhbz#1771513
  - Fix typo in dev_filetrans_all_named_dev()
  Resolves: rhbz#1750096


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-30
changelog:
  - Allow userdomain dbus chat with systemd_resolved_t
  Resolves: rhbz#1773463
  - Allow init_t read and setattr on /var/lib/fprintd
  Resolves: rhbz#1781696
  - Allow sysadm_t dbus chat with colord_t
  Resolves: rhbz#1772669
  - Allow confined users run fwupdmgr
  Resolves: rhbz#1772619
  - Allow confined users run machinectl
  Resolves: rhbz#1772625
  - Allow systemd labeled as init_t domain to create dirs labeled as var_t
  Resolves: rhbz#1778126
  - Allow systemd labeled as init_t domain to manage faillog_t objects
  Resolves: rhbz#1671019
  - Add fprintd_read_var_lib_dir and fprintd_setattr_var_lib_dir interfaces
  Resolves: rhbz#1781696
  - Allow pulseaudio create .config and dgram sendto to unpriv_userdomain
  Resolves: rhbz#1703231
  - Allow abrt_dump_oops_t domain to create udp sockets BZ(1778030)
  Resolves: rhbz#1777761
  - Change type in transition for /var/cache/{dnf,yum} directory
  Resolves: rhbz#1686833
  - Revert "Update zebra SELinux policy to make it work also with frr service"
  This reverts commit 73653250a252ad6eefcb3aae00749017e396ab8d.
  - Revert "Label only regular files inside /usr/lib/frr direcotry as zebra_exec_t"
  This reverts commit a19eb1021cbd6c637344954cead54caae081e07c.
  - Allow stratis_t domain to request load modules
  Resolves: rhbz#1726259
  - Allow stratisd to connect to dbus
  Resolves: rhbz#1726259
  - Run stratisd service as stratisd_t
  Resolves: rhbz#1726259
  - Add support for smart card authentication in cockpit BZ(1690444)
  Resolves: rhbz#1771414
  - cockpit: Support split-out TLS proxy
  Resolves: rhbz#1771414
  - cockpit: Allow cockpit-session to read cockpit-tls state
  Resolves: rhbz#1771414
  - Update cockpit policy
  Resolves: rhbz#1771414
  - cockpit: Support https instance factory
  Resolves: rhbz#1771414
  - cockpit: Allow cockpit-session to read cockpit-tls state directory
  Resolves: rhbz#1771414
  - Fix nonexisting types in rtas_errd_rw_lock interface
  Resolves: rhbz#1744234


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-33
changelog:
  - Update files_create_var_lib_dirs() interface to allow caller domain also set attributes of var_lib_t directory
  Resolves: rhbz#1778126


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-34
changelog:
  - Added macro for stratisd to chat over dbus
  - Add dac_override capability to stratisd_t domain
  - Allow userdomain to chat with stratisd over dbus.
  Resolves: rhbz#1787298


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-35
changelog:
  - Allow stratisd_t domain to read/write fixed disk devices and removable devices.
  Resolves: rhbz#1790795


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-37
changelog:
  - Make stratisd_t domain unconfined for RHEL-8.2
  Resolves: rhbz#1791557
  - stratisd_t policy updates
  Resolves: rhbz#1791557


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-39
changelog:
  - Allow vhostmd communication with hosted virtual machines
  - Add and update virt interfaces
  Resolves: rhbz#1782925


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-41
changelog:
  - Allow NetworkManager read its unit files and manage services
  - Mark nm-cloud-setup systemd units as NetworkManager_unit_file_t
  Resolves: rhbz#1806894


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-42
changelog:
  - Allow ssh-keygen create file in /var/lib/glusterd
  Resolves: rhbz#1816663
  - Update ctdbd_manage_lib_files() to also allow mmap ctdbd_var_lib_t files
  Resolves: rhbz#1819243
  - Remove container interface calling by named_filetrans_domain.
  - Makefile: fix tmp/%.mod.fc target
  Resolves: rhbz#1821191


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-43
changelog:
  - Update radiusd policy
  Resolves: rhbz#1803407
  - Allow sssd read NetworkManager's runtime directory
  Resolves: rhbz#1781818
  - Label /usr/lib/NetworkManager/dispatcher as NetworkManager_initrc_exec_t
  Resolves: rhbz#1777506
  - Allow ipa_helper_t to read kr5_keytab_t files
  Resolves: rhbz#1769423
  - Add ibacm_t ipc_lock capability
  Resolves: rhbz#1754719
  - Allow opafm_t to create and use netlink rdma sockets.
  Resolves: rhbz#1786670
  - Allow ptp4l_t create and use packet_socket sockets
  Resolves: rhbz#1759214
  - Update ctdbd_t policy
  Resolves: rhbz#1735748
  - Allow glusterd synchronize between master and slave
  Resolves: rhbz#1824662
  - Allow auditd poweroff or switch to single mode
  Resolves: rhbz#1826788
  - Allow init_t set the nice level of all domains
  Resolves: rhbz#1819121
  - Label /etc/sysconfig/ip6?tables\.save as system_conf_t
  Resolves: rhbz#1776873
  - Add file context entry and file transition for /var/run/pam_timestamp
  Resolves: rhbz#1791957


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-44
changelog:
  - Make boinc_var_lib_t label system mountdir attribute
  Resolves: rhbz#1779070
  - Allow aide to be executed by systemd with correct (aide_t) domain
  Resolves: rhbz#1814809
  - Allow chronyc_t domain to use nsswitch
  Resolves: rhbz#1772852
  - Allow nscd_socket_use() for domains in nscd_use() unconditionally
  Resolves: rhbz#1772852
  - Allow gluster geo-replication in rsync mode
  Resolves: rhbz#1831109
  - Update networkmanager_read_pid_files() to allow also list_dir_perms
  Resolves: rhbz#1781818
  - Allow associating all labels with CephFS
  Resolves: bz#1814689
  - Allow tcpdump sniffing offloaded (RDMA) traffic
  Resolves: rhbz#1834773


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-45
changelog:
  - Remove files_mmap_usr_files() call for particular domains
  Related: rhbz#1801214
  - Allow dirsrv_t list cgroup directories
  Resolves: rhbz#1836795
  - Create the kerberos_write_kadmind_tmp_files() interface
  Related: rhbz#1841488
  - Allow realmd_t dbus chat with accountsd_t
  Resolves: rhbz#1792895
  - Allow nagios_plugin_domain execute programs in bin directories
  Resolves: rhbz#1815621
  - Update allow rules set for nrpe_t domain
  Resolves: rhbz#1750821
  - Allow Gluster mount client to mount files_type
  Resolves: rhbz#1753626
  - Allow qemu-kvm read and write /dev/mapper/control
  Resolves: rhbz#1835909
  - Introduce logrotate_use_cifs boolean
  Resolves: rhbz#1795923
  - Allow ptp4l_t sys_admin capability to run bpf programs
  Resolves: rhbz#1759214
  - Allow rhsmd mmap /etc/passwd
  Resolves: rhbz#1814644
  - Remove files_mmap_usr_files() call for systemd_localed_t
  Related: rhbz#1801214
  - Allow domain mmap usr_t files
  Resolves: rhbz#1801214
  - Allow libkrb5 lib read client keytabs
  Resolves: rhbz#1831769
  - Add files_dontaudit_manage_boot_dirs() interface
  Related: rhbz#1803868
  - Create files_create_non_security_dirs() interface
  Related: rhbz#1840265
  - Add new interface dev_mounton_all_device_nodes()
  Related: rhbz#1840265
  - Add new interface dev_create_all_files()
  Related: rhbz#1840265
  - Allow sshd write to kadmind temporary files
  Resolves: rhbz#1841488
  - Create init_create_dirs boolean to allow init create directories
  Resolves: rhbz#1832231
  - Do not audit staff_t and user_t attempts to manage boot_t entries
  Resolves: rhbz#1803868
  - Allow systemd to relabel all files on system.
  Resolves: rhbz#1818981
  - Make dbus-broker service working on s390x arch
  Resolves: rhbz#1840265


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-46
changelog:
  - Fix description tag for the sssd_connect_all_unreserved_ports tunable
  Related: rhbz#1826748
  - Allow journalctl process set its resource limits
  Resolves: rhbz#1825894
  - Add sssd_access_kernel_keys tunable to conditionally access kernel keys
  Resolves: rhbz#1802062
  - Make keepalived work with network namespaces
  Resolves: rhbz#1815281
  - Create sssd_connect_all_unreserved_ports boolean
  Resolves: rhbz#1826748
  - Allow hypervkvpd to request kernel to load a module
  Resolves: rhbz#1842414
  - Allow systemd_private_tmp(dirsrv_tmp_t)
  Resolves: rhbz#1836820
  - Allow radiusd connect to gssproxy over unix domain stream socket
  Resolves: rhbz#1813572
  - Add fwupd_cache_t file context for '/var/cache/fwupd(/.*)?'
  Resolves: rhbz#1832231
  - Modify kernel_rw_key() not to include append permission
  Related: rhbz#1802062
  - Add kernel_rw_key() interface to access to kernel keyrings
  Related: rhbz#1802062
  - Modify systemd_delete_private_tmp() to use delete_*_pattern macros
  Resolves: rhbz#1836820
  - Allow systemd-modules to load kernel modules
  Resolves: rhbz#1823246
  - Add cachefiles_dev_t as a typealias to cachefiles_device_t
  Resolves: rhbz#1814796


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-47
changelog:
  - Allow virtlogd_t manage virt lib files
  Resolves: rhbz#1832756
  - Allow pdns server to read system state
  Resolves: rhbz#1801214
  - Support systemctl --user in machinectl
  Resolves: rhbz#1788616
  - Allow chkpwd_t read and write systemd-machined devpts character nodes
  Resolves: rhbz#1788616
  - Allow init_t write to inherited systemd-logind sessions pipes
  Resolves: rhbz#1788616
  - Label systemd-growfs and systemd-makefs as fsadm_exec_t
  Resolves: rhbz#1820798
  - Allow staff_u and user_u setattr generic usb devices
  Resolves: rhbz#1783325
  - Allow sysadm_t dbus chat with accountsd
  Resolves: rhbz#1828809


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-49
changelog:
  - Additional support for keepalived running in a namespace
  Resolves: rhbz#1815281
  - Allow keepalived manage its private type runtime directories
  Resolves: rhbz#1815281
  - Run ipa_helper_noatsecure(oddjob_t) only if the interface exists
  Resolves: rhbz#1853432
  - Allow oddjob_t process noatsecure permission for ipa_helper_t
  Resolves: rhbz#1853432
  - Allow domain dbus chat with systemd-resolved
  Resolves: rhbz#1852378
  - Define file context for /var/run/netns directory only
  Related: rhbz#1815281


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-50
changelog:
  - Revert "Allow qemu-kvm read and write /dev/mapper/control"
  This reverts commit f948eaf3d010215fc912e42013e4f88870279093.
  - Allow smbd get attributes of device files labeled samba_share_t
  Resolves: rhbz#1851816
  - Allow tomcat read user temporary files
  Resolves: rhbz#1857675
  - Revert "Dontaudit and disallow sys_admin capability for keepalived_t domain"
  Resolves: rhbz#1815281
  - Label /tmp/krb5_0.rcache2 with krb5_host_rcache_t
  Resolves: rhbz#1848953
  - Allow auditd manage kerberos host rcache files
  Resolves: rhbz#1855770


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-51
changelog:
  - Allow kadmind manage kerberos host rcache
  Resolves: rhbz#1863043
  - Allow virtlockd only getattr and lock block devices
  Resolves: rhbz#1832756
  - Allow qemu-ga read all non security file types conditionally
  Resolves: rhbz#1747960
  - Allow virtlockd manage VMs posix file locks
  Resolves: rhbz#1832756
  - Add dev_lock_all_blk_files() interface
  Resolves: rhbz#1832756
  - Allow systemd-logind dbus chat with fwupd
  Resolves: rhbz#1851932
  - Update xserver_rw_session macro
  Resolves: rhbz#1851448


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-52
changelog:
  - Add ipa_helper_noatsecure() interface unconditionally
  Resolves: rhbz#1853432
  - Conditionally allow nagios_plugin_domain dbus chat with init
  Resolves: rhbz#1750821
  - Revert "Update allow rules set for nrpe_t domain"
  Resolves: rhbz#1750821
  - Add ipa_helper_noatsecure() interface to ipa.if
  Resolves: rhbz#1853432
  - Allow tomcat map user temporary files
  Resolves: rhbz#1857675
  - Allow tomcat manage user temporary files
  Resolves: rhbz#1857675
  - Add file context for /sys/kernel/tracing
  Resolves: rhbz#1847331
  - Define named file transition for sshd on /tmp/krb5_0.rcache2
  Resolves: rhbz#1848953


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-53
changelog:
  - Allow certmonger fowner capability
  Resolves: rhbz#1870596
  - Define named file transition for saslauthd on /tmp/krb5_0.rcache2
  Resolves: rhbz#1870300
  - Label /usr/libexec/qemu-pr-helper with virtd_exec_t
  Resolves: rhbz#1867115


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-55
changelog:
  - Allow init dbus chat with kernel
  Resolves: rhbz#1694681
  - Confine systemd-sleep service
  Resolves: rhbz#1850177
  - Add default file context for /usr/libexec/pcp/lib/*
  Resolves: rhbz#1886369
  - Allow rtkit_daemon_t to uise sys_ptrace usernamespace capability
  Resolves: rhbz#1873658
  - Add fstools_rw_swap_files() interface
  Resolves: rhbz#1850177


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-56
changelog:
  - Let keepalived bind a raw socket
  Resolves: rhbz#1895130
  - Add fetchmail_uidl_cache_t type for /var/mail/.fetchmail.pid
  Resolves: rhbz#1853389
  - Allow arpwatch create and use rdma socket
  Resolves: rhbz#1843409
  - Set correct default file context for /usr/libexec/pcp/lib/*
  Resolves: rhbz#1886369
  - Allow systemd-logind manage efivarfs files
  Resolves: rhbz#1869979
  - Allow systemd_resolved_t to read efivarfs
  Resolves: rhbz#1869979
  - Allow systemd_modules_load_t to read efivarfs
  Resolves: rhbz#1869979
  - Allow read efivarfs_t files by domains executing systemctl file
  Resolves: rhbz#1869979
  - Introduce systemd_read_efivarfs_type attribute
  Resolves: rhbz#1869979


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-57
changelog:
  - Allow dovecot bind to smtp ports
  Resolves: rhbz#1881884
  - Change fetchmail temporary files path to /var/spool/mail
  Resolves: rhbz#1853389
  - Set file context for symlinks in /etc/httpd to etc_t
  Resolves: rhbz#1900650
  - Allow dnsmasq read public files
  Resolves: rhbz#1782539
  - Fix range for unreserved ports
  Resolves: rhbz#1794531
  - Introduce logging_syslogd_append_public_content tunable
  Resolves: rhbz#1823672
  - Add files_search_non_security_dirs() interface
  Resolves: rhbz#1823672
  - Add miscfiles_append_public_files() interface
  Resolves: rhbz#1823672


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-58
changelog:
  - Allow kexec manage generic tmp files
  Resolves: rhbz#1896424
  - Update systemd-sleep policy
  Resolves: rhbz#1850177
  - Add groupadd_t fowner capability
  Resolves: rhbz#1884179


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-59
changelog:
  - Add cron_dbus_chat_system_job() interface
  Resolves: rhbz#1883906
  - Dontaudit firewalld dac_override capability
  Resolves: rhbz#1759010
  - Allow tcsd the setgid capability
  Resolves: rhbz#1898694
  - Allow timedatex dbus chat with cron system domain
  Resolves: rhbz#1883906
  - Allow systemd_hostnamed_t domain to dbus chat with sosreport_t domain
  Resolves: rhbz#1854299
  - Allow pcp-pmcd manage perf_events
  Resolves: rhbz#1901958
  - Label /dev/isst_interface as cpu_device_t
  Resolves: rhbz#1902227
  - Allow ipsec set the context of a SPD entry to the default context
  Resolves: rhbz#1880474
  - Allow sysadm_u user and unconfined_domain_type manage perf_events
  Resolves: rhbz#1901958
  - Add manage_perf_event_perms object permissions set
  Resolves: rhbz#1901958
  - Add perf_event access vectors.
  Resolves: rhbz#1901958
  - Remove "ipa = module" from modules-targeted-contrib.conf
  Resolves: rhbz#1461914


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-60
changelog:
  - Allow wireshark create and use rdma socket
  Resolves: rhbz#1844370
  - Allow to use nnp_transition in pulseaudio_role
  Resolves: rhbz#1854471
  - Allow certmonger fsetid capability
  Resolves: rhbz#1873211
  - Add rsync_sys_admin tunable to allow rsync sys_admin capability
  Resolves: rhbz#1889673
  - Allow sysadm read and write /dev/rfkill
  Resolves: rhbz#1831630
  - Allow staff_u run pam_console_apply
  Resolves: rhbz#1817690
  - Label /dev/vhost-vdpa-[0-9]+ as vhost_device_t
  Resolves: rhbz#1907485


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-61
changelog:
  - Add kpatch_exec() interface
  Resolves: rhbz#1895322
  - Allow rhsmcertd execute kpatch
  Resolves: rhbz#1895322
  - Allow openvswitch_t perf_event open permission
  Resolves: rhbz#1916046
  - Allow openvswitch fowner capability and create netlink sockets
  Resolves: rhbz#1883980
  - Add net_broadcast capability to openvswitch_t domain
  Resolves: rhbz#1883980
  - Update interface modutils_read_module_deps to allow caller domain also mmap modules_dep_t files
  Resolves: rhbz#1883980
  - Allow machinectl to run pull-tar
  Resolves: rhbz#1788055


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-62
changelog:
  - Allow rhsmcertd_t domain transition to kpatch_t
  Resolves: rhbz#1895322
  - Revert "Add kpatch_exec() interface"
  Resolves: rhbz#1895322
  - Revert "Allow rhsmcertd execute kpatch"
  Resolves: rhbz#1895322
  - Dontaudit NetworkManager_t domain to write to kdump temp pipies
  Resolves: rhbz#1842897
  - Allow NetworkManager_t domain to get status of samba services
  Resolves: rhbz#1781806
  - Allow openvswitch create and use xfrm netlink sockets
  Resolves: rhbz#1916046
  - Allow openvswitch_t perf_event write permission
  Resolves: rhbz#1916046
  - Add write_perf_event_perms object permission set
  Related: rhbz#1916046


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-63
changelog:
  - Allow rtkit_daemon_t domain set process nice value in user namespaces
  Resolves: rhbz#1910507
  - Allow gpsd read and write ptp4l_t shared memory.
  Resolves: rhbz#1803845
  - Label /var/run/pcsd-ruby.socket socket with cluster_var_run_t type
  Resolves: rhbz#1804626
  - Allow Certmonger to use opencryptoki services
  Resolves: rhbz#1894132
  - Dontaudit vhostmd to write in /var/lib/rpm/ dir and allow signull rpm
  Resolves: rhbz#1815603
  - Allow rhsmcertd_t read kpatch lib files
  Resolves: rhbz#1895322
  - Allow ipsec_t connectto ipsec_mgmt_t
  Resolves: rhbz#1848355
  - Allow IPsec to use opencryptoki services
  Resolves: rhbz#1894132
  - Allow systemd-importd create /run/systemd/machines.lock file
  Resolves: rhbz#1788055


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-64
changelog:
  - Allow unconfined_t and kprop_t to create krb5_0.rcache2 with the right context
  Resolves: rhbz#1874527
  Resolves: rhbz#1877044
  - Allow rhsmcertd bind tcp sockets to a generic node
  Resolves: rhbz#1923985
  - Allow ipsec_mgmt_t mmap ipsec_conf_file_t files
  Resolves: rhbz#1889542
  - Allow strongswan start using swanctl method
  Resolves: rhbz#1889542
  - Allow systemd-importd manage machines.lock file
  Resolves: rhbz#1788055


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-68
changelog:
  - Allow pluto IKEv2 / ESP over TCP
  Resolves: rhbz#1931848
  - Label SDC(scini) Dell Driver
  Resolves: rhbz#1936882
  - Add file context specification for /var/tmp/tmp-inst
  Resolves: rhbz#1919253
  - Allow virtlogd_t to create virt_var_lockd_t dir
  Resolves: rhbz#1941464
  - Allow cups-lpd read its private runtime socket files
  Resolves: rhbz#1919399


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-69
changelog:
  - Add /var/usrlocal equivalency rule
  Resolves: rhbz#1943381
  - Label '/var/usrlocal/(.*/)?sbin(/.*)?' as bin_t
  Resolves: rhbz#1943381
  - Label /dev/trng with random_device_t
  Resolves: rhbz#1934483
  - Allow systemd-sleep transition to sysstat_t
  Resolves: rhbz#1927551
  - Allow systemd-sleep transition to tlp_t
  Resolves: rhbz#1927551
  - Allow systemd-sleep transition to unconfined_service_t on bin_t executables
  Resolves: rhbz#1927551
  - Allow systemd-sleep execute generic programs
  Resolves: rhbz#1948070
  - Allow systemd-sleep execute shell
  Resolves: rhbz#1954358
  - Allow nsswitch_domain read init pid lnk_files
  Resolves: rhbz#1860924
  - Introduce logging_syslogd_list_non_security_dirs tunable
  Resolves: rhbz#1823669
  - Add sysstat_domtrans() to allow systemd-sleep transition to sysstat_t
  Resolves: rhbz#1927551
  - Change param description in cron interfaces to userdomain_prefix
  Resolves: rhbz#1801249
  - Add missing declaration in rpm_named_filetrans()
  Resolves: rhbz#1801249


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-70
changelog:
  - Allow using opencryptoki for ipsec
  Resolves: rhbz#1894132
  - Remove all kernel_getattr_proc() interface calls
  Resolves: rhbz#1967125
  - Allow domain stat /proc filesystem
  Resolves: rhbz#1967125
  - Allow pkcs-slotd create and use netlink_kobject_uevent_socket
  Resolves: rhbz#1969725
  - Label var.lib.opencryptoki.* files and create pkcs_tmpfs_filetrans()
  Resolves: rhbz#1894132
  - Allow using opencryptoki for certmonger
  Resolves: rhbz#1894132
  - install_t: Allow NoNewPriv transition from systemd
  Resolves: rhbz#1955547
  - Remove all kernel_getattr_proc() interface calls
  Resolves: rhbz#1967125
  - Allow httpd_sys_script_t read, write, and map hugetlbfs files
  Resolves: rhbz#1966133


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-71
changelog:
  - Allow nmap create and use rdma socket
  Resolves: rhbz#1844530
  - Label /.k5identity file allow read of this file to rpc.gssd
  Resolves: rhbz#1951093
  - Label /var/lib/kdump with kdump_var_lib_t
  Resolves: rhbz#1965985
  - Label /run/libvirt/common with virt_common_var_run_t
  Resolves: rhbz#1966842


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-72
changelog:
  - Allow systemd-sleep get attributes of fixed disk device nodes
  Resolves: rhbz#1931460
  - Allow systemd-sleep create hardware state information files
  Resolves: rhbz#1968610
  - virtiofs supports Xattrs and SELinux
  Resolves: rhbz#1899703
  - Label 4460/tcp port as ntske_port_t
  Resolves: rhbz#1961207
  - Add the miscfiles_map_generic_certs macro to the sysnet_dns_name_resolve macro.
  Resolves: rhbz#1961207
  - Allow chronyd_t to accept and make NTS-KE connections
  Resolves: rhbz#1961207
  - Dontaudit NetworkManager write to initrc_tmp_t pipes
  Resolves: rhbz#1963162
  - Allow logrotate rotate container log files
  Resolves: rhbz#1892170
  - Allow rhsmd read process state of all domains and kernel threads
  Resolves: rhbz#1878020


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-73
changelog:
  - Removed adding to attribute unpriv_userdomain from userdom_unpriv_type template
  Resolves: rhbz#1947841
  - Allow transition from xdm domain to unconfined_t domain.
  Resolves: rhbz#1947841
  - Allow nftables read NetworkManager unnamed pipes
  Resolves: rhbz#1967857
  - Create a policy for systemd-journal-upload
  Resolves: rhbz#1913414
  - Add dev_getattr_infiniband_dev() interface.
  Resolves: rhbz#1972522
  - Allow tcpdump and nmap get attributes of infiniband_device_t
  Resolves: rhbz#1972522
  - Allow fcoemon create sysfs files
  Resolves: rhbz#1978562
  - Allow nftables read NetworkManager unnamed pipes
  Resolves: rhbz#1967857
  - Allow radius map its library files
  Resolves: rhbz#1854650
  - Allow arpwatch get attributes of infiniband_device_t devices
  Resolves: rhbz#1936522


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-75
changelog:
  - Add the unconfined_dgram_send() interface
  Resolves: rhbz#1978562
  - Change dev_getattr_infiniband_dev() to use getattr_chr_files_pattern()
  Resolves: rhbz#1936522
  - Add checkpoint_restore cap2 capability
  Resolves: rhbz#1973325
  - Allow fcoemon talk with unconfined user over unix domain datagram socket
  Resolves: rhbz#1978562
  - Allow hostapd bind UDP sockets to the dhcpd port
  Resolves: rhbz#1977676
  - Allow NetworkManager read and write z90crypt device
  Resolves: rhbz#1938203
  - Allow abrt_domain read and write z90crypt device
  Resolves: rhbz#1938203
  - Label /usr/lib/pcs/pcs_snmp_agent with cluster_exec_t
  Resolves: rhbz#1937111
  - Allow mdadm read iscsi pid files
  Resolves: rhbz#1924716


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-76
changelog:
  - Allow login_userdomain read and map /var/lib/systemd files
  Resolves: rhbz#1965251
  - Allow sysadm acces to kernel module resources
  Resolves: rhbz#1965251
  - Allow sysadm to read/write scsi files and manage shadow
  Resolves: rhbz#1965251
  - Allow sysadm access to files_unconfined and bind rpc ports
  Resolves: rhbz#1965251
  - Allow sysadm read and view kernel keyrings
  Resolves: rhbz#1965251
  - Allow bootloader to read tuned etc files
  Resolves: rhbz#1965251
  - Update the policy for systemd-journal-upload
  Resolves: rhbz#1913414
  - Allow journal mmap and read var lib files
  Resolves: rhbz#1965251
  - Allow tuned to read rhsmcertd config files
  Resolves: rhbz#1965251
  - Allow bootloader to read tuned etc files
  Resolves: rhbz#1965251
  - Confine rhsm service and rhsm-facts service as rhsmcertd_t
  Resolves: rhbz#1846081
  - Allow virtlogd_t read process state of user domains
  Resolves: rhbz#1797899
  - Allow cockpit_ws_t get attributes of fs_t filesystems
  Resolves: rhbz#1979182


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-77
changelog:
  - Revert "update libs_filetrans_named_content() to have support for /usr/lib/debug directory"
  Resolves: rhbz#1887739
  - Allow sysadm to read/write scsi files and manage shadow
  Resolves: rhbz#1956302
  - Allow rhsmcertd execute gpg
  Resolves: rhbz#1887572
  - Allow lldpad send to kdump over a unix dgram socket
  Resolves: rhbz#1979121
  - Remove glusterd SELinux module from distribution policy
  Resolves: rhbz#1816718


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-78
changelog:
  - Label /usr/bin/Xwayland with xserver_exec_t
  Resolves: rhbz#1984584
  - Label /usr/libexec/gdm-runtime-config with xdm_exec_t
  Resolves: rhbz#1984584
  - Allow D-bus communication between avahi and sosreport
  Resolves: rhbz#1916397
  - Allow lldpad send to kdumpctl over a unix dgram socket
  Resolves: rhbz#1979121
  - Revert "Allow lldpad send to kdump over a unix dgram socket"
  Resolves: rhbz#1979121
  - Allow chronyc respond to a user chronyd instance
  Resolves: rhbz#1993104
  - Allow ptp4l respond to pmc
  Resolves: rhbz#1993104
  - Allow lldpad send to unconfined_t over a unix dgram socket
  Resolves: rhbz#1993270


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-79
changelog:
  - Introduce xdm_manage_bootloader booelan
  Resolves: rhbz#1994096
  - Rename samba_exec() to samba_exec_net()
  Resolves: rhbz#1855215
  - Allow sssd to set samba setting
  Resolves: rhbz#1855215
  - Allow dirsrv read slapd tmpfs files
  Resolves: rhbz#1843238
  - Allow rhsmcertd to create cache file in /var/cache/cloud-what
  Resolves: rhbz#1994718


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-81
changelog:
  - Allow unconfined domains to bpf all other domains
  Resolves: rhbz#1991443
  - Allow vmtools_unconfined_t domain transition to rpm_script_t
  Resolves: rhbz#1872245
  - Allow unbound connectto unix_stream_socket
  Resolves: rhbz#1905441
  - Label /usr/sbin/virtproxyd as virtd_exec_t
  Resolves: rhbz#1854332
  - Allow postfix_domain to sendto unix dgram sockets.
  Resolves: rhbz#1920521


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-82
changelog:
  - Support sanlock VG automated recovery on storage access loss
  Resolves: rhbz#1985000
  - Allow proper function sosreport in sysadmin role
  Resolves: rhbz#1965251
  - Allow systemd execute user bin files
  Resolves: rhbz#1860443
  - Label /dev/crypto/nx-gzip with accelerator_device_t
  Resolves: rhbz#2011166
  - Allow ipsec_t and login_userdomain named file transition in tmpfs
  Resolves: rhbz#2001599
  - Support sanlock VG automated recovery on storage access loss
  Resolves: rhbz#1985000
  - Allow proper function sosreport via iotop
  Resolves: rhbz#1965251
  - Call pkcs_tmpfs_named_filetrans for certmonger
  Resolves: rhbz#2001599
  - Allow ibacm the net_raw and sys_rawio capabilities
  Resolves: rhbz#2010644
  - Support new PING_CHECK health checker in keepalived
  Resolves: rhbz#2010873
  - Update spamassasin policy to make working /usr/share/spamassassin/sa-update.cron script
  Resolves: rhbz#2011239


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-83
changelog:
  - VQP: Include IANA-assigned TCP/1589
  Resolves: rhbz#1924038
  - Label port 3785/udp with bfd_echo
  Resolves: rhbz#1924038
  - Allow sysadm_t dbus chat with realmd_t
  Resolves: rhbz#2000488
  - Support sanlock VG automated recovery on storage access loss 1/2
  Resolves: rhbz#1985000
  - Revert "Support sanlock VG automated recovery on storage access loss"
  Resolves: rhbz#1985000
  - Support sanlock VG automated recovery on storage access loss
  Resolves: rhbz#1985000
  - radius: Lexical sort of service-specific corenet rules by service name
  Resolves: rhbz#1924038
  - radius: Allow binding to the BDF Control and Echo ports
  Resolves: rhbz#1924038
  - radius: Allow binding to the DHCP client port
  Resolves: rhbz#1924038
  - radius: Allow net_raw; allow binding to the DHCP server ports
  Resolves: rhbz#1924038
  - Support hitless reloads feature in haproxy
  Resolves: rhbz#2015423
  - Allow redis get attributes of filesystems with extended attributes
  Resolves: rhbz#2015435
  - Support sanlock VG automated recovery on storage access loss 2/2
  Resolves: rhbz#1985000
  - Revert "Support sanlock VG automated recovery on storage access loss"
  Resolves: rhbz#1985000


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-84
changelog:
  - Allow sysadm_t read/write pkcs shared memory segments
  Resolves: rhbz#1965251
  - Allow sysadm_t connect to sanlock over a unix stream socket
  Resolves: rhbz#1965251
  - Allow sysadm_t dbus chat with sssd
  Resolves: rhbz#1965251
  - Allow sysadm_t set attributes on character device nodes
  Resolves: rhbz#1965251
  - Allow sysadm_t read and write watchdog devices
  Resolves: rhbz#1965251
  - Allow sysadm_t connect to cluster domains over a unix stream socket
  Resolves: rhbz#1965251
  - Allow sysadm_t dbus chat with tuned 2/2
  Resolves: rhbz#1965251
  - Update userdom_exec_user_tmp_files() with an entrypoint rule
  Resolves: rhbz#1920883
  - Allow sudodomain send a null signal to sshd processes
  Resolves: rhbz#1966945
  - Allow sysadm_t dbus chat with tuned 1/2
  Resolves: rhbz#1965251
  - Allow cloud-init dbus chat with systemd-logind
  Resolves: rhbz#2009769
  - Allow svnserve send mail from the system
  Resolves: rhbz#2004843
  - Allow svnserve_t domain to read system state
  Resolves: rhbz#2004843


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-85
changelog:
  - Allow unconfined_t to node_bind icmp_sockets in node_t domain
  Resolves: rhbz#2025445
  - Allow rhsmcertd get attributes of tmpfs_t filesystems
  Resolves: rhbz#2015820
  - The nfsdcld service is now confined by SELinux
  Resolves: rhbz#2026588
  - Allow smbcontrol use additional socket types
  Resolves: rhbz#2027740
  - Allow lldpd use an snmp subagent over a tcp socket
  Resolves: rhbz#2028379


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-86
changelog:
  - Allow sysadm execute sysadmctl in sysadm_t domain using sudo
  Resolves: rhbz#2013749
  - Allow local_login_t get attributes of tmpfs filesystems
  Resolves: rhbz#2015539
  - Allow local_login_t get attributes of filesystems with ext attributes
  Resolves: rhbz#2015539
  - Allow local_login_t domain to getattr cgroup filesystem
  Resolves: rhbz#2015539
  - Allow systemd read unlabeled symbolic links
  Resolves: rhbz#2021835
  - Allow userdomains use pam_ssh_agent_auth for passwordless sudo
  Resolves: rhbz#1917879
  - Allow sudodomains execute passwd in the passwd domain
  Resolves: rhbz#1943572
  - Label authcompat.py with authconfig_exec_t
  Resolves: rhbz#1919122
  - Dontaudit pkcsslotd sys_admin capability
  Resolves: rhbz#2021887
  - Allow lldpd connect to snmpd with a unix domain stream socket
  Resolves: rhbz#1991029


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-87
changelog:
  - Set default file context for /sys/firmware/efi/efivars
  Resolves: rhbz#2039458
  - Allow sysadm_t start and stop transient services
  Resolves: rhbz#2031065
  - Label /etc/cockpit/ws-certs.d with cert_t
  Resolves: rhbz#1907473
  - Allow smbcontrol read the network state information
  Resolves: rhbz#2033873
  - Allow rhsm-service read/write its private memfd: objects
  Resolves: rhbz#2029873
  - Allow fcoemon request the kernel to load a module
  Resolves: rhbz#1940317
  - Allow radiusd connect to the radacct port
  Resolves: rhbz#2038955
  - Label /var/lib/shorewall6-lite with shorewall_var_lib_t
  Resolves: rhbz#2041447
  - Exclude container.if from selinux-policy-devel
  Resolves: rhbz#1861968


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-89
changelog:
  - Allow NetworkManager talk with unconfined user over unix domain dgram socket
  Resolves: rhbz#2044048
  - Allow system_mail_t read inherited apache system content rw files
  Resolves: rhbz#1988339
  - Add apache_read_inherited_sys_content_rw_files() interface
  Related: rhbz#1988339
  - Allow rhsm-service execute its private memfd: objects
  Resolves: rhbz#2029873
  - Allow dirsrv read configfs files and directories
  Resolves: rhbz#2042568
  - Label /run/stratisd with stratisd_var_run_t
  Resolves: rhbz#1879585
  - Fix path for excluding container.if from selinux-policy-devel
  Resolves: rhbz#1861968


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-90
changelog:
  - Fix badly indented used interfaces
  Resolves: rhbz#2030156
  - Allow domain transition to sssd_t 1/2
  Resolves: rhbz#2022690
  - Allow confined users to use kinit,klist and etc.
  Resolves: rhbz#2026598
  - Allow login_userdomain open/read/map system journal
  Resolves: rhbz#2046481
  - Allow init read stratis data symlinks 2/2
  Resolves: rhbz#2048514
  - Label new utility of NetworkManager nm-priv-helper
  Resolves: rhbz#1986076
  - Label NetworkManager-dispatcher service with separate context
  Resolves: rhbz#1989070
  - Allow domtrans to sssd_t and role access to sssd
  Resolves: rhbz#2030156
  - Creating interface sssd_run_sssd()
  Resolves: rhbz#2030156
  - Allow domain transition to sssd_t 2/2
  Resolves: rhbz#2022690
  - Allow timedatex dbus chat with xdm
  Resolves: rhbz#2040214
  - Associate stratisd_data_t with device filesystem
  Resolves: rhbz#2048514
  - Allow init read stratis data symlinks 1/2
  Resolves: rhbz#2048514
  - Allow rhsmcertd create rpm hawkey logs with correct label
  Resolves: rhbz#1949871


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-92
changelog:
  - Allow postfix_domain read dovecot certificates 1/2
  Resolves: rhbz#2043599
  - Dontaudit dirsrv search filesystem sysctl directories 1/2
  Resolves: rhbz#2042568
  - Allow chage domtrans to sssd
  Resolves: rhbz#2054718
  - Allow postfix_domain read dovecot certificates 2/2
  Resolves: rhbz#2043599
  - Allow ctdb create cluster logs
  Resolves: rhbz#2049481
  - Allow alsa bind mixer controls to led triggers
  Resolves: rhbz#2049730
  - Allow alsactl set group Process ID of a process
  Resolves: rhbz#2049730
  - Dontaudit mdadm list dirsrv tmpfs dirs
  Resolves: rhbz#2011174
  - Dontaudit dirsrv search filesystem sysctl directories 2/2
  Resolves: rhbz#2042568
  - Revert "Label NetworkManager-dispatcher service with separate context"
  Related: rhbz#1989070
  - Revert "Allow NetworkManager-dispatcher dbus chat with NetworkManager"
  Related: rhbz#1989070


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-93
changelog:
  - Allow systemd-networkd dbus chat with sosreport
  Resolves: rhbz#1949493
  - Allow sysadm_passwd_t to relabel passwd and group files
  Resolves: rhbz#2053457
  - Allow confined sysadmin to use tool vipw
  Resolves: rhbz#2053457
  - Allow sosreport dbus chat with abrt and timedatex
  Resolves: rhbz#1949493
  - Remove unnecessary /etc file transitions for insights-client
  Resolves: rhbz#2031853
  - Label all content in /var/lib/insights with insights_client_var_lib_t
  Resolves: rhbz#2031853
  - Update insights-client policy
  Resolves: rhbz#2031853
  - Update insights-client: fc pattern, motd, writing to etc
  Resolves: rhbz#2031853
  - Remove permissive domain for insights_client_t
  Resolves: rhbz#2031853
  - New policy for insight-client
  Resolves: rhbz#2031853
  - Add the insights_client module
  Resolves: rhbz#2031853
  - Update specfile to buildrequire policycoreutils-devel >= 2.9-19
  - Add modules_checksum to %files


author: Nikola Knazekova nknazeko@redhat.com - 3.14.3-94
changelog:
  - Allow chronyd send a message to sosreport over datagram socket
  - Allow systemd-logind dbus chat with sosreport
  Resolves: rhbz#2062607


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-96
changelog:
  - Add interface rpc_manage_exports
  Resolves: rhbz#2062183
  - Allow sshd read filesystem sysctl files
  Resolves: rhbz#2061403
  - Update targetd nfs & lvm
  Resolves: rhbz#2062183
  - Allow dhcpd_t domain to read network sysctls.
  Resolves: rhbz#2059509
  - Allow chronyd talk with unconfined user over unix domain dgram socket
  Resolves: rhbz#2065313
  - Allow fenced read kerberos key tables
  Resolves: rhbz#1964839


author: Nikola Knazekova <nknazeko@redhat.com> - 3.14.3-97
changelog:
  - Create macro corenet_icmp_bind_generic_node()
  Resolves: rhbz#2070870
  - Allow traceroute_t and ping_t to bind generic nodes.
  Resolves: rhbz#2070870
  - Allow administrative users the bpf capability
  Resolves: rhbz#2070983
  - Allow insights-client search rhnsd configuration directory
  Resolves: rhbz#2073395
  - Allow ntlm_auth read the network state information
  Resolves: rhbz#2073349
  - Allow keepalived setsched and sys_nice
  Resolves: rhbz#2008033
  - Revert "Allow administrative users the bpf capability"
  Resolves: rhbz#2070983


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-98
changelog:
  - Allow sysadm user execute init scripts with a transition
  Resolves: rhbz#2039662
  - Change invalid type redisd_t to redis_t in redis_stream_connect()
  Resolves: rhbz#1897517
  - Allow php-fpm write access to /var/run/redis/redis.sock
  Resolves: rhbz#1897517
  - Allow sssd read systemd-resolved runtime directory
  Resolves: rhbz#2060721
  - Allow postfix stream connect to cyrus through runtime socket
  Resolves: rhbz#2066005
  - Allow insights-client create_socket_perms for tcp/udp sockets
  Resolves: rhbz#2073395
  - Allow insights-client read rhnsd config files
  Resolves: rhbz#2073395
  - Allow sblim-sfcbd connect to sblim-reposd stream
  Resolves: rhbz#2075810
  - Allow rngd drop privileges via setuid/setgid/setcap
  Resolves: rhbz#2076641
  - Allow rngd_t domain to use nsswitch
  Resolves: rhbz#2076641


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-99
changelog:
  - Allow ifconfig_t domain to manage vmware logs
  Resolves: rhbz#1721943
  - Allow insights-client manage gpg admin home content
  Resolves: rhbz#2060834
  - Add the gpg_manage_admin_home_content() interface
  Resolves: rhbz#2060834
  - Label /var/cache/insights with insights_client_cache_t
  Resolves: rhbz#2063195
  - Allow insights-client search gconf homedir
  Resolves: rhbz#2087069
  - Allow insights-client create and use unix_dgram_socket
  Resolves: rhbz#2087069
  - Label more vdsm utils with virtd_exec_t
  Resolves: rhbz#2063871
  - Label /usr/libexec/vdsm/supervdsmd and vdsmd with virtd_exec_t
  Resolves: rhbz#2063871
  - Allow sblim-gatherd the kill capability
  Resolves: rhbz#2082677
  - Allow privoxy execmem
  Resolves: rhbz#2083940


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-100
changelog:
  - Update logging_create_generic_logs() to use create_files_pattern()
  Resolves: rhbz#2081907
  - Add the auth_read_passwd_file() interface
  Resolves: rhbz#2083504
  - Allow auditd_t noatsecure for a transition to audisp_remote_t
  Resolves: rhbz#2081907
  - Add support for samba-dcerpcd
  Resolves: rhbz#2083504
  - Allow rhsmcertd create generic log files
  Resolves: rhbz#1852086
  - Allow ctdbd nlmsg_read on netlink_tcpdiag_socket
  Resolves: rhbz#2090800


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-101
changelog:
  - Add the init_status_config_transient_files() interface
  Resolves: rhbz#2091117
  - Allow init_t to rw insights_client unnamed pipe
  Resolves: rhbz#2091117
  - Update kernel_read_unix_sysctls() for sysctl_net_unix_t handling
  Resolves: rhbz#2091117
  - Allow insights-client get status of the systemd transient scripts
  Resolves: rhbz#2091117
  - Allow insights-client execute its private memfd: objects
  Resolves: rhbz#2091117
  - Update policy for insights-client to run additional commands 2
  Resolves: rhbz#2091117
  - Do not call systemd_userdbd_stream_connect() for insights-client
  Resolves: rhbz#2091117
  - Use insights_client_tmp_t instead of insights_client_var_tmp_t
  Resolves: rhbz#2091117
  - Change space indentation to tab in insights-client
  Resolves: rhbz#2091117
  - Use socket permissions sets in insights-client
  Resolves: rhbz#2091117
  - Update policy for insights-client to run additional commands
  Resolves: rhbz#2091117
  - Change rpm_setattr_db_files() to use a pattern
  Resolves: rhbz#2091117
  - Add rpm setattr db files macro
  Resolves: rhbz#2091117
  - Fix insights client
  Resolves: rhbz#2091117
  - Do not let system_cronjob_t create redhat-access-insights.log with var_log_t
  Resolves: rhbz#2091117


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-102
changelog:
  - Allow transition to insights_client named content
  Resolves: rhbz#2091117
  - Add the insights_client_filetrans_named_content() interface
  Resolves: rhbz#2091117
  - Update policy for insights-client to run additional commands 3
  Resolves: rhbz#2091117


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-103
changelog:
  - Allow domain read usermodehelper state information
  Resolves: rhbz#2083504
  - Remove all kernel_read_usermodehelper_state() interface calls
  Resolves: rhbz#2083504
  - Allow samba-dcerpcd work with sssd
  Resolves: rhbz#2096825
  - Allow winbind_rpcd_t connect to self over a unix_stream_socket
  Resolves: rhbz#2096825
  - Update samba-dcerpcd policy for kerberos usage
  Resolves: rhbz#2096825
  - Allow keepalived read the contents of the sysfs filesystem
  Resolves: rhbz#2098189
  - Update policy for samba-dcerpcd
  Resolves: rhbz#2083504
  - Remove all kernel_read_usermodehelper_state() interface calls 2/2
  Resolves: rhbz#2083504
  - Update insights_client_filetrans_named_content()
  Resolves: rhbz#2091117


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-105
changelog:
  - Do not call systemd_userdbd_stream_connect() for winbind-rpcd
  Resolves: rhbz#2108383
  - Update winbind_rpcd_t
  Resolves: rhbz#2108383
  - Allow irqbalance file transition for pid sock_files and directories
  Resolves: rhbz#2111916
  - Update irqbalance runtime directory file context
  Resolves: rhbz#2111916


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-106
changelog:
  - Allow networkmanager to signal unconfined process
  Resolves: rhbz#1918148
  - Allow sa-update to get init status and start systemd files
  Resolves: rhbz#2011239
  - Allow samba-bgqd get a printer list
  Resolves: rhbz#2114737
  - Allow insights-client rpm named file transitions
  Resolves: rhbz#2104913
  - Add /var/tmp/insights-archive to insights_client_filetrans_named_content
  Resolves: rhbz#2104913
  - Use insights_client_filetrans_named_content
  Resolves: rhbz#2104913
  - Make default file context match with named transitions
  Resolves: rhbz#2104913
  - Allow rhsmcertd to read insights config files
  Resolves: rhbz#2104913
  - Label /etc/insights-client/machine-id
  Resolves: rhbz#2104913


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-107
changelog:
  - Label 319/udp port with ptp_event_port_t
  Resolves: rhbz#2118628
  - Allow unconfined and sysadm users transition for /root/.gnupg
  Resolves: rhbz#2119507
  - Add the kernel_read_proc_files() interface
  Resolves: rhbz#2119507
  - Add userdom_view_all_users_keys() interface
  Resolves: rhbz#2119507
  - Allow system_cronjob_t domtrans to rpm_script_t
  Resolves: rhbz#2118362
  - Allow smbd_t process noatsecure permission for winbind_rpcd_t
  Resolves: rhbz#2117199
  - Allow chronyd bind UDP sockets to ptp_event ports
  Resolves: rhbz#2118628
  - Allow samba-bgqd to read a printer list
  Resolves: rhbz#2118958
  - Add gpg_filetrans_admin_home_content() interface
  Resolves: rhbz#2119507
  - Update insights-client policy for additional commands execution
  Resolves: rhbz#2119507
  - Allow gpg read and write generic pty type
  Resolves: rhbz#2119507
  - Allow chronyc read and write generic pty type
  Resolves: rhbz#2119507
  - Disable rpm verification on interface_info
  Resolves: rhbz#2119472


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-108
changelog:
  - Allow unconfined_service_t insights client content filetrans
  Resolves: rhbz#2119507
  - Allow nsswitch_domain to connect to systemd-machined using a unix socket
  Resolves: rhbz#2119507
  - Add init_status_all_script_files() interface
  Resolves: rhbz#2119507
  - Add dev_dontaudit_write_raw_memory() and dev_read_vsock() interfaces
  Resolves: rhbz#2119507
  - Update insights-client policy for additional commands execution 5
  Resolves: rhbz#2119507
  - Confine insights-client systemd unit
  Resolves: rhbz#2119507
  - Update insights-client policy for additional commands execution 4
  Resolves: rhbz#2119507
  - Change rhsmcertd_t to insights_client_t in insights-client policy
  Resolves: rhbz#2119507
  - Allow insights-client send signull to unconfined_service_t
  Resolves: rhbz#2119507
  - Update insights-client policy for additional commands execution 3
  Resolves: rhbz#2119507
  - Allow journalctl read init state
  Resolves: rhbz#2119507
  - Update insights-client policy for additional commands execution 2
  Resolves: rhbz#2119507


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-109
changelog:
  - Add the files_map_read_etc_files() interface
  Resolves: rhbz#2132230
  - Allow insights-client manage samba var dirs
  Resolves: rhbz#2132230
  - Allow insights-client send null signal to rpm and system cronjob
  Resolves: rhbz#2132230
  - Update rhcd policy for executing additional commands 4
  Resolves: rhbz#2132230
  - Allow insights-client connect to postgresql with a unix socket
  Resolves: rhbz#2132230
  - Allow insights-client domtrans on unix_chkpwd execution
  Resolves: rhbz#2132230
  - Add file context entries for insights-client and rhc
  Resolves: rhbz#2132230
  - Allow snmpd_t domain to trace processes in user namespace
  Resolves: rhbz#2121084
  - Allow sbd the sys_ptrace capability
  Resolves: rhbz#2124552
  - Allow pulseaudio create gnome content (~/.config)
  Resolves: rhbz#2124387


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-110
changelog:
  - Add the systemd_connectto_socket_proxyd_unix_sockets() interface
  Resolves: rhbz#208441
  - Add the dev_map_vhost() interface
  Resolves: rhbz#2122920
  - Allow init remount all file_type filesystems
  Resolves: rhbz#2122239
  - added policy for systemd-socket-proxyd
  Resolves: rhbz#2088441
  - Allow virt_domain map vhost devices
  Resolves: rhbz#2122920
  - Allow virt domains to access xserver devices
  Resolves: rhbz#2122920
  - Allow rotatelogs read httpd_log_t symlinks
  Resolves: rhbz#2030633
  - Allow vlock search the contents of the /dev/pts directory
  Resolves: rhbz#2122838
  - Allow system cronjobs dbus chat with setroubleshoot
  Resolves: rhbz#2125008
  - Allow ptp4l_t name_bind ptp_event_port_t
  Resolves: rhbz#2130168
  - Allow pcp_domain execute its private memfd: objects
  Resolves: rhbz#2090711
  - Allow samba-dcerpcd use NSCD services over a unix stream socket
  Resolves: rhbz#2121709
  - Allow insights-client manage samba var dirs
  Resolves: rhbz#2132230


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-111
changelog:
  - Add domain_unix_read_all_semaphores() interface
  Resolves: rhbz#2141311
  - Allow iptables list cgroup directories
  Resolves: rhbz#2134820
  - Allow systemd-hostnamed dbus chat with init scripts
  Resolves: rhbz#2111632
  - Allow systemd to read symlinks in /var/lib
  Resolves: rhbz#2118784
  - Allow insights-client domain transition on semanage execution
  Resolves: rhbz#2141311
  - Allow insights-client create gluster log dir with a transition
  Resolves: rhbz#2141311
  - Allow insights-client manage generic locks
  Resolves: rhbz#2141311
  - Allow insights-client unix_read all domain semaphores
  Resolves: rhbz#2141311
  - Allow winbind-rpcd use the terminal multiplexor
  Resolves: rhbz#2107106
  - Allow mrtg send mails
  Resolves: rhbz#2103675
  - Allow sssd dbus chat with system cronjobs
  Resolves: rhbz#2132922
  - Allow postfix/smtp and postfix/virtual read kerberos key table
  Resolves: rhbz#1983308


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-112
changelog:
  - Allow ipsec_t only read tpm devices
  Resolves: rhbz#2147380
  - Allow ipsec_t read/write tpm devices
  Resolves: rhbz#2147380
  - Label udf tools with fsadm_exec_t
  Resolves: rhbz#1972230
  - Allow the spamd_update_t domain get generic filesystem attributes
  Resolves: rhbz#2144501
  - Allow cdcc mmap dcc-client-map files
  Resolves: rhbz#2144505
  - Allow insights client communicate with cupsd, mysqld, openvswitch, redis
  Resolves: rhbz#2143878
  - Allow insights client read raw memory devices
  Resolves: rhbz#2143878
  - Allow winbind-rpcd get attributes of device and pty filesystems
  Resolves: rhbz#2107106
  - Allow postfix/smtpd read kerberos key table
  Resolves: rhbz#1983308


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-113
changelog:
  - Allow systemd-socket-proxyd get attributes of cgroup filesystems
  Resolves: rhbz#2088441
  - Allow systemd-socket-proxyd get filesystems attributes
  Resolves: rhbz#2088441
  - Allow sysadm read ipmi devices
  Resolves: rhbz#2148561
  - Allow system mail service read inherited certmonger runtime files
  Resolves: rhbz#2143337
  - Add lpr_roles  to system_r roles
  Resolves: rhbz#2151111
  - Allow insights-client tcp connect to various ports
  Resolves: rhbz#2151111
  - Allow insights-client work with pcp and manage user config files
  Resolves: rhbz#2151111
  - Allow insights-client dbus chat with various services
  Resolves: rhbz#2152867
  - Allow insights-client dbus chat with abrt
  Resolves: rhbz#2152867
  - Allow redis get user names
  Resolves: rhbz#2112228
  - Add winbind-rpcd to samba_enable_home_dirs boolean
  Resolves: rhbz#2143696


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-114
changelog:
  - Add interfaces in domain, files, and unconfined modules
  Resolves: rhbz#2141311
  - Allow sysadm_t read/write ipmi devices
  Resolves: rhbz#2148561
  - Allow sudodomain use sudo.log as a logfile
  Resolves: rhbz#2143762
  - Add insights additional capabilities
  Resolves: rhbz#2158779
  - Allow insights client work with gluster and pcp
  Resolves: rhbz#2141311
  - Allow prosody manage its runtime socket files
  Resolves: rhbz#2157902
  - Allow system mail service read inherited certmonger runtime files
  Resolves: rhbz#2143337
  - Add lpr_roles  to system_r roles
  Resolves: rhbz#2151111


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-115
changelog:
  - Fix syntax problem in redis.te
  Resolves: rhbz#2112228
  - Allow unconfined user filetransition for sudo log files
  Resolves: rhbz#2164047
  - Allow winbind-rpcd make a TCP connection to the ldap port
  Resolves: rhbz#2152642
  - Allow winbind-rpcd manage samba_share_t files and dirs
  Resolves: rhbz#2152642
  - Allow insights-client work with su and lpstat
  Resolves: rhbz#2134125
  - Allow insights-client read nvme devices
  Resolves: rhbz#2143878
  - Allow insights-client tcp connect to all ports
  Resolves: rhbz#2143878
  - Allow redis-sentinel execute a notification script
  Resolves: rhbz#2112228


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-116
changelog:
  - Allow sysadm_t run initrc_t script and sysadm_r role access
  Resolves: rhbz#2039662
  - Allow insights-client manage fsadm pid files
  Resolves: rhbz#2166802
  - Add journalctl the sys_resource capability
  Resolves: rhbz#2136189


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-117
changelog:
  - Fix opencryptoki file names in /dev/shm
  Resolves: rhbz#2028637
  - Allow system_cronjob_t transition to rpm_script_t
  Resolves: rhbz#2154242
  - Revert "Allow system_cronjob_t domtrans to rpm_script_t"
  Resolves: rhbz#2154242
  - Allow httpd work with tokens in /dev/shm
  Resolves: rhbz#2028637
  - Allow keepalived to set resource limits
  Resolves: rhbz#2168638
  - Allow insights-client manage fsadm pid files


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-118
changelog:
  - Allow login_pgm setcap permission
  Resolves: rhbz#2172541
  - Label /run/fsck with fsadm_var_run_t
  Resolves: rhbz#2184348
  - Add boolean qemu-ga to run unconfined script
  Resolves: rhbz#2028762
  - Allow dovecot-deliver write to the main process runtime fifo files
  Resolves: rhbz#2170495
  - Allow certmonger dbus chat with the cron system domain
  Resolves: rhbz#2173289
  - Allow insights-client read all sysctls
  Resolves: rhbz#2177607


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-119
changelog:
  - Add unconfined_server_read_semaphores() interface
  Resolves: rhbz#2183351
  - Allow systemd-pstore read kernel persistent storage files
  Resolves: rhbz#2181558
  - Add fs_read_pstore_files() interface
  Resolves: rhbz#2181558
  - Allow insights-client work with teamdctl
  Resolves: rhbz#2185158
  - Allow insights-client read unconfined service semaphores
  Resolves: rhbz#2183351
  - Allow insights-client get quotas of all filesystems
  Resolves: rhbz#2183351


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-120
changelog:
  - Allow unconfined service inherit signal state from init
  Resolves: rhbz#2177254
  - Allow systemd-pstore delete kernel persistent storage files
  Resolves: rhbz#2181558
  - Add fs_delete_pstore_files() interface
  Resolves: rhbz#2181558
  - Allow certmonger manage cluster library files
  Resolves: rhbz#2177836
  - Allow samba-rpcd work with passwords
  Resolves: rhbz#2107106
  - Allow snmpd read raw disk data
  Resolves: rhbz#2160000
  - Allow cluster_t dbus chat with various services
  Resolves: rhbz#2196524


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-121
changelog:
  - Update pkcsslotd policy for sandboxing 2/2
  Resolves: rhbz#2208162
  - Update pkcsslotd policy for sandboxing 1/2
  Resolves: rhbz#2208162
  - Allow abrt_t read kernel persistent storage files
  Resolves: rhbz#2207914
  - Add allow rules for lttng-sessiond domain
  Resolves: rhbz#2203509
  - Allow rpcd_lsad setcap and use generic ptys
  Resolves: rhbz#2107106
  - Allow samba-dcerpcd connect to systemd_machined over a unix socket
  Resolves: rhbz#2107106
  - Dontaudit targetd search httpd config dirs
  Resolves: rhbz#2203720


author: Nikola Knazekova <nknazeko@redhat.com> - 3.14.3-122
changelog:
  - Update cyrus_stream_connect() to use sockets in /run
  Resolves: rhbz#2165752
  - Allow insights-client map generic log files
  Resolves: rhbz#2214572
  - Allow insights-client work with pipe and socket tmp files
  Resolves: rhbz#2207819
  - Allow insights-client getsession process permission
  Resolves: rhbz#2207819
  - Allow keepalived to manage its tmp files
  Resolves: rhbz#2179335


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-123
changelog:
  - Label only /usr/sbin/ripd and ripngd with zebra_exec_t
  Resolves: rhbz#2213606
  - Allow httpd tcp connect to redis port conditionally
  Resolves: rhbz#2213965
  - Exclude container-selinux manpage from selinux-policy-doc
  Resolves: rhbz#2218362


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-124
changelog:
  - Add the files_getattr_non_auth_dirs() interface
  Resolves: rhbz#2076937
  - Update policy for the sblim-sfcb service
  Resolves: rhbz#2076937
  - Dontaudit sfcbd sys_ptrace cap_userns
  Resolves: rhbz#2076937
  - Label /usr/sbin/sos with sosreport_exec_t
  Resolves: rhbz#2167731
  - Allow sa-update manage spamc home files
  Resolves: rhbz#2222200
  - Allow sa-update connect to systemlog services
  Resolves: rhbz#2222200
  - Label /usr/lib/systemd/system/mimedefang.service with antivirus_unit_file_t
  Resolves: rhbz#2222200


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-125
changelog:
  - Allow user_u and staff_u get attributes of non-security dirs
  Resolves: rhbz#2216151
  - Allow unconfined user filetrans chrome_sandbox_home_t 1/2
  Resolves: rhbz#2221573
  - Allow unconfined user filetrans chrome_sandbox_home_t 2/2
  Resolves: rhbz#2221573
  - Allow insights-client execmem
  Resolves: rhbz#2225233
  - Allow svnserve execute postdrop with a transition
  Resolves: rhbz#2004843
  - Do not make postfix_postdrop_t type an MTA executable file
  Resolves: rhbz#2004843
  - Allow samba-dcerpc service manage samba tmp files
  Resolves: rhbz#2210771
  - Update samba-dcerpc policy for printing
  Resolves: rhbz#2210771


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-126
changelog:
  - Allow cloud_init create dhclient var files and init_t manage net_conf_t 1/2
  Resolves: rhbz#2229726
  - Label /usr/libexec/openssh/ssh-pkcs11-helper with ssh_agent_exec_t
  Resolves: rhbz#2177704
  - Allow cloud_init create dhclient var files and init_t manage net_conf_t 2/2
  Resolves: rhbz#2229726
  - Make insights_client_t an unconfined domain
  Resolves: rhbz#2225527
  - Allow insights-client create all rpm logs with a correct label
  Resolves: rhbz#2229559
  - Allow insights-client manage generic logs
  Resolves: rhbz#2229559


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-128
changelog:
  - Allow ssh_agent_type manage generic cache home files
  Resolves: rhbz#2177704
  - Add chromium_sandbox_t setcap capability
  Resolves: rhbz#2221573


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-128.1
changelog:
  - Additional permissions for ip-vrf
  Resolves: RHEL-15427
  - Allow ip an explicit domain transition to other domains
  Resolves: RHEL-15427
  - Allow  winbind_rpcd_t processes access when samba_export_all_* is on
  Resolves: RHEL-16274


author: Ondrej Vasik <ovasik@redhat.com> - 2.12.2-2
changelog:
  - do not ship /etc/hosts.allow and /etc/hosts.deny (no need for them
    as we don't allow tcp_wrappers in RHEL8, #1663556)


author: Martin Osvald <mosvald@redhat.com> - 2.12.2-3
changelog:
  - add pcp user to /etc/aliases (#1744089)
  - set PATH if it is empty in csh.login (#1744104)
  - lang.csh: prevent grep from failing so scripts do not end
    prematurely when tcsh -e option in use (#1678706)
  - use full path for non-builtins (#1688302)
  - add nrpe tcp port 5666 to /etc/services (#1730396)


author: Martin Osvald <mosvald@redhat.com> - 2.12.2-7
changelog:
  - Move /var/log/lastlog ownership to systemd (#2044589)
  - tcsh sets variable p to /usr/sbin from /etc/csh.login (#1945400)
  - bashrc: Don't set up VTE-specific PROMPT_COMMAND (#1917934)


author: Tomas Bzatek <tbzatek@redhat.com> - 1.44-3
changelog:
  - Fix sg_turs help invocation in an old mode (#1683343)
  - Fix sg_raw printing error about device not specified on version request (#1627657)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-12
changelog:
  - lib/sssd: redirect warning message to file (#1749001)
  - useradd: clarify valid usernames/groupnames (#1869432)
  - login.defs: link login specific information to its own package (#1804766)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-15
changelog:
  - Creation of subid and subid-devel subpackages (#2013009)
  - libsubid: creation and nsswitch support
  - libsubid: don't print error messages on stderr by default
  - libsubid: libsubid_init return false if out of memory
  - libsubid: don't return owner in list_owner_ranges API call
  - libsubid: libsubid_init don't print messages on error
  - libsubid: fix newusers when nss provides subids
  - libsubid: make shadow_logfd not extern
  - useradd: fix SUB_UID_COUNT=0
  - man: mention NSS in new[ug]idmap manpages
  - man: clarify subid delegation


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-16
changelog:
  - getsubids: provide system binary and man page. Resolves: #2013016
  - groupdel: fix SIGSEGV when passwd does not exist. Resolves: #1986782


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-17
changelog:
  - subordinateio: also compare the owner ID. Resolves: #2093311
  - Fix release sources
  - Add subid requirement for subid-devel


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-18
changelog:
  - Update patch to close label to reset libselinux state. Resolves: #1984740
  - useradd: check if subid range exists for user. Resolves: #2012929
  - find_new_[gu]id: Skip over IDs that are reserved for legacy reasons. Resolves: #1994269


author: Javier Martinez Canillas <javierm@redhat.com> - 15-12
changelog:
  - Fix firmware update bug in aarch64 caused by shim ignoring arguments
    Resolves: rhbz#1830871
  - Fix a shim crash when attempting to netboot
    Resolves: rhbz#1795654


author: Peter Jones <pjones@redhat.com> - 15-13
changelog:
  - New signing keys
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Čestmír Kalina <ckalina@redhat.com> - 1.6.0-1
changelog:
  - Resolves: #1869292 Statistics Support - smc-tools part
  - Resolves: #1919225 Add SMC-D Setup Check (smc-tools)
  - Resolves: #1919240 Upgrade smc-tools to latest version


author: Čestmír Kalina <ckalina@redhat.com> - 1.6.0-3
changelog:
  - Patch stats.c to fix overruns
  - Patch stats.c to fix leaks
  - Patch stats.c to fix fallback counter values
  - Resolves: #1993469


author: Čestmír Kalina <ckalina@redhat.com> - 1.8.1-1
changelog:
  - Upgrade smc-tools to latest version
  - Add User-defined EID (Enterprise ID) Support
  - Resolves: #1919228
  - Resolves: #2043841


author: Bhupesh Sharma <bhsharma@redhat.com> - 1.1.8-1
changelog:
  - Rebase to latest github version Snappy-1.1.8
  - Also change the URL to reflect to the updated github location.


author: Jan Jansky <jjansky@redhat.com> = 4.6.0-1
changelog:
  - [ultrapath] Add new plugin for Huawei UltraPath
    Resolves: bz2187407
  - [cleaner] Use data filter for extraction
    Resolves: bz2217906
  - [discovery] Enable the plugin by containers
    Resolves: bz2222134


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-10
changelog:
  - Fixed CVE-2020-13632 (#1845572)
  - Fixed CVE-2020-13631 (#1845474)
  - Fixed CVE-2020-13630 (#1845153)


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-14
changelog:
  - Fixed CVE-2019-5827 (#1710184)
  - Fixed CVE-2019-13750 (#1786510)
  - Fixed CVE-2019-13751 (#1786522)
  - Fixed CVE-2019-19603 (#1792013)
  - Fixed CVE-2020-13435 (#1841233)


author: Abhi Das <adas@redhat.com> - 4.3-19
changelog:
  - rhbz#1602698 - Fix coverity issues
    rhbz#1624173 - Fix annocheck failures
    rhbz#1716278 - limit max cpus in mksquashfs
    Resolves: rhbz#1602698, rhbz#1624173, rhbz#1716278


author: Abhi Das <adas@redhat.com> - 4.3-20
changelog:
  - rhbz#1895017 - unsquashfs does not preserve file capabilities
    rhbz#1754815 - Kdump: Building kdump initramfs img may fail with 'dracut: Failed making squash image' occasionally
    Resolves: rhbz#1895017, rhbz#1754815


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.13-1
changelog:
  - Rebase to v5.13; drop upstream patches on top of 5.7 (#2015917).
  - Address some issues reported by covscan.


author: Sahana Prasad <sahana@redhat.com> - 5.56-5
changelog:
  - Fix CVE-2021-20230 stunnel: client certificate not
    correctly verified when redirect and verifyChain options are used.


author: Radovan Sroka <rsroka@redhat.com> - 1.8.28p1-1
changelog:
  - RHEL 8.2 ERRATUM
  - rebase to 1.8.28p1
  Resolves: rhbz#1733961
  - fixed man page for always_set_home
  Resolves: rhbz#1576880
  - sudo does not work with notbefore/after
  Resolves: rhbz#1679508
  - NOTBEFORE showing value of sudoNotAfter Ldap attribute
  Resolves: rhbz#1715516
  - CVE-2019-14287 sudo
  - Privilege escalation via 'Runas' specification with 'ALL' keyword
  Resolves: rhbz#1760697


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29-7
changelog:
  - RHEL 8.4 ERRATUM
  - CVE-2021-3156
  Resolves: rhbz#1917734
  - CVE-2021-23239 sudo: possible directory existence test due to race condition in sudoedit
  Resolves: rhzb#1916434
  - CVE-2021-23240 sudo: symbolic link attack in SELinux-enabled sudoedit
  Resolves: rhbz#1917038
  - updated upstream url
  Resolves: rhbz#1923825


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29-8
changelog:
  RHEL 8.6.0 ERRATUM
  - sudoedit does not work with selinux args
  Resolves: rhbz#2029551
  - Make sure SIGCHLD is not ignored when sudo is executed
  Resolves: rhbz#1999751
  - [RFE] pass KRB5CCNAME to pam_authenticate environment if available
  Resolves: rhbz#1917379
  - utmp resource leak in sudo
  Resolves: rhbz#1986572


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29.9
changelog:
  RHEL 8.8.0 ERRATUM
  - CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user
  Resolves: rhbz#2161221
  - sudo digest check fails incorrectly for certain file sizes (SHA512/SHA384)
  Resolves: rhbz#2114576


author: Radovan Sroka <rsroka@redhat.com> - 1.9.5p2-1
changelog:
  RHEL 8.9.0.Z ERRATUM
  - Rebase to 1.9.5p2
  - CVE-2023-28486 sudo: Sudo does not escape control characters in log messages
  Resolves: RHEL-21825
  - CVE-2023-28487 sudo: Sudo does not escape control characters in sudoreplay output
  Resolves: RHEL-21831
  - CVE-2023-42465 sudo: Targeted Corruption of Register and Stack Variables
  Resolves: RHEL-21820


author: Kalev Lember <klember@redhat.com> - 3.39.92-2
changelog:
  - Split sysprof-capture library and header files out to sysprof-capture-devel
  - Update minimum required glib2 version


author: Jan Tulak <jtulak@redhat.com> - 1.2-1
changelog:
  - Upstream release 1.2 which fixes:
  - use pwquality to test password strength for cryptsetup (#1141871)
  - add multipath detection support (#1309729)
  - add migrate command (#1014708)


author: Jan Tulak <jtulak@redhat.com> - 1.2-3:
changelog:
  - Gating tests implementation, which meant adding few more changes
    to the existing patches (#1681969)
  - sphinx patch was merged to python3 change
  - add seq numbers to patch files


author: Jan Tulak <jtulak@redhat.com> - 1.4-1:
changelog:
  - Bring changes from upstream 1.4 (mostly bugfixes)
  - Remove multipath from the list of default backends (rhbz#1685019)
  - Fix locale issue (rhbz#1679587)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-70
changelog:
  - basic: recognize pdfs filesystem as a network filesystem (#2094661)
  - core: move reset_arguments() to the end of main's finish (#2127131)
  - manager: move inc. of n_reloading into a function (#2136869)
  - core: Add new DBUS properties UnitsReloadStartTimestamp and UnitsLoadTimestampMontonic (#2136869)
  - core: Indicate the time when the manager started loading units the last time (#2136869)
  - core: do not touch /run/systemd/systemd-units-load from user session instances (#2136869)
  - sysctl: downgrade message when we have no permission (#2158160)
  - core: respect SELinuxContext= for socket creation (#2136738)
  - manager: use target process context to set socket context (#2136738)
  - virt: detect Amazon EC2 Nitro instance (#2117948)
  - machine-id-setup: generate machine-id from DMI product ID on Amazon EC2 (#2117948)
  - virt: use string table to detect VM or container (#2117948)
  - fileio: introduce read_full_virtual_file() for reading virtual files in sysfs, procfs (#2117948)
  - Use BIOS characteristics to distinguish EC2 bare-metal from VMs (#2117948)
  - device: drop refuse_after (#2043524)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-71
changelog:
  - manager: limit access to private dbus socket (#2119405)
  - journalctl: do not treat EINTR as an error when waiting for events (#2161683)
  - core: bring manager_startup() and manager_reload() more inline (#2059633)
  - pam: add a call to pam_namespace (#1861836)
  - virt: Support detection for ARM64 Hyper-V guests (#2158307)
  - virt: Fix the detection for Hyper-V VMs (#2158307)
  - basic: add STRERROR() wrapper for strerror_r() (#2155520)
  - coredump: put context array into a struct (#2155520)
  - coredump: do not allow user to access coredumps with changed uid/gid/capabilities (#2155520)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-72
changelog:
  - test: import logind test from debian/ubuntu test suite (#1866955)
  - test: introduce inst_recursive() helper function (#1866955)
  - tests: verify that Lock D-Bus signal is sent when IdleAction=lock (#1866955)
  - systemctl: simplify halt_main() (#2053273)
  - systemctl: shutdown don't fallback on auth fail (#2053273)
  - systemctl: reintroduce the original halt_main() (#2053273)
  - systemctl: preserve old behavior unless requested (#2053273)
  - pam_systemd: suppress LOG_DEBUG log messages if debugging is off (#2170084)
  - udev/net_id: introduce naming scheme for RHEL-8.8 (#2170499)
  - pam: add a call to pam_namespace (#1861836)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-73
changelog:
  - journald: add API to move logging from /var to /run again (#1873540)
  - journalctl: add new --relinquish and --smart-relinquish options (#1873540)
  - units: automatically revert to /run logging on shutdown if necessary (#1873540)
  - pstore: Tool to archive contents of pstore (#2158832)
  - meson: drop redundant line (#2158832)
  - pstore: drop unnecessary initializations (#2158832)
  - pstopre: fix return value of list_files() (#2158832)
  - pstore: remove temporary file on failure (#2158832)
  - pstore: do not add FILE= journal entry if content_size == 0 (#2158832)
  - pstore: run only when /sys/fs/pstore is not empty (#2158832)
  - pstore: fix use after free (#2158832)
  - pstore: refuse to run if arguments are specified (#2158832)
  - pstore: allow specifying src and dst dirs are arguments (#2158832)
  - pstore: rework memory handling for dmesg (#2158832)
  - pstore: fixes for dmesg.txt reconstruction (#2158832)
  - pstore: Don't start systemd-pstore.service in containers (#2158832)
  - units: pull in systemd-pstore.service from sysinit.target (#2158832)
  - units: drop dependency on systemd-remount-fs.service from systemd-pstore.service (#2158832)
  - units: make sure systemd-pstore stops at shutdown (#2158832)
  - pstore: Run after modules are loaded (#2158832)
  - pstore: do not try to load all known pstore modules (#2158832)
  - logind-session: make stopping of idle session visible to admins (#2156780)
  - journald: Increase stdout buffer size sooner, when almost full (#2029426)
  - journald: rework end of line marker handling to use a field table (#2029426)
  - journald: use the fact that client_context_release() returns NULL (#2029426)
  - journald: rework pid change handling (#2029426)
  - test: Add a test case for #15654 (#2029426)
  - test: Stricter test case for #15654 (Add more checks) (#2029426)
  - man: document the new _LINE_BREAK= type (#2029426)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-74
changelog:
  - journald-server: always create state file in signal handler (#2174645)
  - journald-server: move relinquish code into function (#2174645)
  - journald-server: always touch state file in signal handler (#2174645)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-75
changelog:
  - journald-server: always create state file in signal handler (#2176892)
  - journald-server: move relinquish code into function (#2176892)
  - journald-server: always touch state file in signal handler (#2176892)
  - test: make TEST-35-LOGIN stable again (#2179309)
  - pager: set $LESSSECURE whenver we invoke a pager (#2175624)
  - test-login: always test sd_pid_get_owner_uid(), modernize (#2175624)
  - pager: make pager secure when under euid is changed or explicitly requested (#2175624)
  - ci: trigger differential-shellcheck workflow on push (#2179309)
  - ci: codeql `master` -> `main` (#2179309)
  - test: ignore ENOMEDIUM error from sd_pid_get_cgroup() (#2175622)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-76
changelog:
  - ci(Mergify): drop requirements on linting workflows (#2179309)
  - ci: workflow for gathering metadata for source-git automation (#2179309)
  - ci: first part of the source-git automation - commit linter (#2179309)
  - pstore: fix crash and forward dummy arguments instead of NULL (#2190151)
  - test: Disable LUKS devices from initramfs in QEMU tests (#2190151)
  - pstore: explicitly set the base when converting record ID (#2190151)
  - pstore: avoid opening the dmesg.txt file if not requested (#2190151)
  - test: add a couple of tests for systemd-pstore (#2190151)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-77
changelog:
  - ci: update permissions for source-git automation workflows (#2179309)
  - sulogin: fix control lost of the current terminal when default.target is rescue.target (#2169932)
  - parse-util: in parse_permille() check negative earlier (#2178179)
  - tree-wide: increase granularity of percent specifications all over the place to permille (#2178179)
  - errno-util: introduce ERRNO_IS_TRANSIENT() (#2172846)
  - tree-wide: use ERRNO_IS_TRANSIENT() (#2172846)
  - libsystemd: ignore both EINTR and EAGAIN (#2172846)
  - sd-bus: handle -EINTR return from bus_poll() (#2172846)
  - stdio-bridge: don't be bothered with EINTR (#2172846)
  - sd-netlink: handle EINTR from poll() gracefully, as success (#2172846)
  - resolved: handle -EINTR returned from fd_wait_for_event() better (#2172846)
  - utmp-wtmp: fix error in case isatty() fails (#2172846)
  - utmp-wtmp: handle EINTR gracefully when waiting to write to tty (#2172846)
  - journal-vacuum: count size of all journal files (#2180380)
  - resolved: instead of closing DNS UDP transaction fds right-away, add them to a socket "graveyard" (#2156751)
  - resolved: close UDP socket when we received a network error on it (#2156751)
  - ci: allow RHEL-only labels to mark downstream-only commits (#2179309)
  - man: tweak markup in systemd-pstore.service(8) (#2217786)
  - man: add .service suffix to systemd-pstore(8) (#2217786)
  - presets: enable systemd-pstore.service by default (#2217786)
  - logind: simplify code (#2209328)
  - format-table: add TABLE_TIMESTAMP_UTC and _RELATIVE (#2156786)
  - loginctl: shorten variable name (#2156786)
  - loginctl: use bus_map_all_properties (#2156786)
  - loginctl: show session idle status in list-sessions (#2156786)
  - loginctl: list-sessions: fix timestamp for idle hint (#2156786)
  - loginctl: also show idle hint in session-status (#2156786)
  - core/timer: Always use inactive_exit_timestamp if it is set (#1719364)
  - timer: Use dual_timestamp_is_set() in one more place (#1719364)
  - ci: drop systemd-stable from advanced-commit-linter config (#2179309)
  - core/mount: escape invalid UTF8 char in dbus reply (#2158724)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-78
changelog:
  - login: add a missing error check for session_set_leader() (#2158167)
  - logind: reset session leader if we know for a fact that it is gone (#2158167)
  - test-login: skip consistency checks when logind is not active (#2223582)
  - sd-event: remove dead code and use _cleanup_ (#2211358)
  - sd-event: don't destroy inotify data structures from inotify event handler (#2211358)
  - sd-event: add sd_event_add_inotify_fd() call (#2211358)
  - test: add test case for self-destroy inotify handler (#2211358)
  - doc: add downstream CONTRIBUTING document (#2179309)
  - doc: use link with prefilled Jira issue (#2179309)
  - docs: link downstream CONTRIBUTING in README (#2179309)
  - unit drop-in: Fix ordering of special type.d drop-ins (#2156620)
  - Add failing test to show service.d global drop-in does not get overridden by more specific dropins (#2156620)
  - test: set indentation to 4 spaces (#2156620)
  - test/TEST-15: remove all created unit files (#2156620)
  - test: use quotes where necessary (#2156620)
  - tree-wide: drop manually-crafted message for missing variables (#2156620)
  - manager: reformat boolean expression in unit_is_pristine() (#2156620)
  - manager: allow transient units to have drop-ins (#2156620)
  - TEST-15: allow helper functions to accept other unit types (#2156620)
  - TEST-15: also test hierarchical drop-ins for slices (#2156620)
  - TEST-15: add test for transient units with drop-ins (#2156620)
  - TEST-15: add one more test for drop-in precedence (#2156620)
  - udev/net_id: introduce naming scheme for RHEL-8.9 (#2231846)
  - meson: remove libdw dependency from pstore (#2211416)
  - pstore: introduce tmpfiles.d/systemd-pstore.conf (#2211416)
  - tmpfiles: don't complain if we can't enable pstore in containers (#2211416)
  - pstore: don't enable crash_kexec_post_notifiers by default (#2211416)
  - core: when Delegate=yes is set for a unit, run ExecStartPre= and friends in a subcgroup of the unit (#2215925)
  - man: link Delegate= documentation up with the markdown docs (#2215925)


author: Yuanhong Peng <yummypeng@linux.alibaba.com> - 239-78.0.1
changelog:
  - core: fix a null reference case in load_from_path()
  - sysctl: Don't pass null directive argument to '%s'
  - exit-status: introduce EXIT_EXCEPTION mapping to 255
  - main: don't freeze PID 1 in containers, exit with non-zero instead
  - Do not go into freeze when systemd crashd
  - mount-setup: change the system mount propagation to shared by default only at bootup
  - cgroup-util: make definition of CGROUP_CONTROLLER_TO_MASK() unsigned
  - cgroup: update only siblings that got realized once
  - core: add a config item to support setting the value of cpuset.clone_children when systemd is starting
  - support loongarch for systemd
  - test-catalog: Fix coredump when compiled under GCC10
  - add Iluvatar CoreX pci id (Liwei Ge)
  - seccomp: add loongarch64 support (Liwei Ge)
  - seccomp: remove loongarch64 switch(Liwei Ge)
  - umount: check LO_FLAGS_AUTOCLEAR after LOOP_CLR_FD claimed success(yuanhui)
  - fileio: when reading a full file into memory, refuse inner NUL bytes (Guorui Yu)
  - util: introduce explicit_bzero_safe for explicit memset (Guorui Yu)
  - util: introduce erase_and_free() helper (Guorui Yu)
  - util: introduce READ_FULL_FILE_SECURE flag for reading secure data (Guorui Yu)
  - fileio: introduce warn_file_is_world_accessible() (Guorui Yu)
  - fileio: read_full_file_full() also warns when file is world readable and secure flag is set (Guorui Yu)
  - basic/fileio: Fix memory leak if READ_FULL_FILE_SECURE flag is used (Guorui Yu)
  - fileio: add explicit flag for generating world executable warning when reading file (Guorui Yu)
  - fileio: add 'dir_fd' parameter to read_full_file_full() (Guorui Yu)
  - fileio: add support for read_full_file() on AF_UNIX stream sockets (Guorui Yu)
  - fileio: beef up READ_FULL_FILE_CONNECT_SOCKET to allow setting sender socket name (Guorui Yu)
  - fileio: teach read_full_file_full() to read from offset/with maximum size (Guorui Yu)
  - cryptsetup: port cryptsetup's main key file logic over to read_full_file_full() (Guorui Yu)
  - Update upstream parse_hwdb.py to fix parse-hwdb error (Zhongling He)
  - cgroup: do not refresh cgroup devices config when daemon-reload (Zhongling He)
  - core: introduce cgroup full delegation for compability (Zhongling He)


author: Lennart Poettering <lpoetter@redhat.com> - 0-0.7.20100629git4176e5
changelog:
  - New snapshot
  - Split off -units package where other packages can depend on without pulling in the whole of systemd


author: Lennart Poettering <lpoetter@redhat.com> - 8-3
changelog:
  - Reexecute after installation, take ownership of /var/run/user
  - https://bugzilla.redhat.com/show_bug.cgi?id=627457
  - https://bugzilla.redhat.com/show_bug.cgi?id=627634


author: Lennart Poettering <lpoetter@redhat.com> - 10-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=630401
  - https://bugzilla.redhat.com/show_bug.cgi?id=630225
  - https://bugzilla.redhat.com/show_bug.cgi?id=626966
  - https://bugzilla.redhat.com/show_bug.cgi?id=623456


author: Lennart Poettering <lpoetter@redhat.com> - 14-1
changelog:
  - Upstream update
  - Enable hwclock-load by default
  - Obsolete readahead
  - Enable /var/run and /var/lock on tmpfs


author: Lennart Poettering <lpoetter@redhat.com> - 24-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=694079
  - https://bugzilla.redhat.com/show_bug.cgi?id=693289
  - https://bugzilla.redhat.com/show_bug.cgi?id=693274
  - https://bugzilla.redhat.com/show_bug.cgi?id=693161


author: Lennart Poettering <lpoetter@redhat.com> - 25-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=694788
  - https://bugzilla.redhat.com/show_bug.cgi?id=694321
  - https://bugzilla.redhat.com/show_bug.cgi?id=690253
  - https://bugzilla.redhat.com/show_bug.cgi?id=688661
  - https://bugzilla.redhat.com/show_bug.cgi?id=682662
  - https://bugzilla.redhat.com/show_bug.cgi?id=678555
  - https://bugzilla.redhat.com/show_bug.cgi?id=628004


author: Lennart Poettering <lpoetter@redhat.com> - 26-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=699394
  - https://bugzilla.redhat.com/show_bug.cgi?id=698198
  - https://bugzilla.redhat.com/show_bug.cgi?id=698674
  - https://bugzilla.redhat.com/show_bug.cgi?id=699114
  - https://bugzilla.redhat.com/show_bug.cgi?id=699128


author: Lennart Poettering <lpoetter@redhat.com> - 26-2
changelog:
  - Bugfix release
  - https://bugzilla.redhat.com/show_bug.cgi?id=707507
  - https://bugzilla.redhat.com/show_bug.cgi?id=707483
  - https://bugzilla.redhat.com/show_bug.cgi?id=705427
  - https://bugzilla.redhat.com/show_bug.cgi?id=707577


author: Michal Schmidt <mschmidt@redhat.com> - 28-3
changelog:
  - Apply patches from current upstream
  - https://bugzilla.redhat.com/show_bug.cgi?id=709909
  - https://bugzilla.redhat.com/show_bug.cgi?id=710839
  - https://bugzilla.redhat.com/show_bug.cgi?id=711015


author: Michal Schmidt <mschmidt@redhat.com> - 28-4
changelog:
  - Apply patches from current upstream.
  - Fixes memory size detection on 32-bit with >4GB RAM (BZ712341)


author: Lennart Poettering <lpoetter@redhat.com> - 35-1
changelog:
  - New upstream release
  - Update post scripts
  - Resolves: #726683, #713384, #698198, #722803, #727315, #729997, #733706, #734611


author: Michal Schmidt <mschmidt@redhat.com> - 37-2
changelog:
  - A couple of fixes from upstream:
  - Fix a regression in bash-completion reported in Bodhi.
  - Fix a crash in isolating.
  - Resolves: #717325


author: Michal Schmidt <mschmidt@redhat.com> - 38-5
changelog:
  - Build against libgee06. Reenable gtk tools.
  - Delete unused patches.
  - Add easy building of git snapshots.
  - Remove legacy spec file elements.
  - Don't mention implicit BuildRequires.
  - Configure with --disable-static.
  - Merge -units into the main package.
  - Move section 3 manpages to -devel.
  - Fix unowned directory.
  - Run ldconfig in scriptlets.
  - Split systemd-analyze to a subpackage.


author: Lennart Poettering <lpoetter@redhat.com> - 42-1
changelog:
  - New upstream release
  - Save a bit of entropy during system installation (#789407)
  - Don't own /etc/os-release anymore, leave that to fedora-release


author: Dennis Gilmore <dennis@ausil.us> - 43-2
changelog:
  - don't conflict with fedora-release systemd never actually provided
  - /etc/os-release so there is no actual conflict


author: Dennis Gilmore <dennis@ausil.us> - 44-3
changelog:
  - apply patch from upstream so we can build systemd on arm and ppc
  - and likely the rest of the secondary arches


author: Michal Schmidt <mschmidt@redhat.com> - 44-4
changelog:
  - Add triggers from Bill Nottingham to correct the damage done by
    the obsoleted systemd-units's preun scriptlet (#807457).


author: Kay Sievers - 185-1
changelog:
  - New upstream release
    - udev selinux labeling fixes
    - new man pages
    - systemctl help <unit name>


author: Michal Schmidt <mschmidt@redhat.com> - 185-4.gita2368a3
changelog:
  - Update to current git snapshot
    - Add systemd-readahead-analyze
    - Drop upstream patch
  - Split systemd-libs
  - Drop duplicate doc files
  - Fixed License headers of subpackages


author: Lennart Poettering <lpoetter@redhat.com> - 188-1
changelog:
  - New upstream release
  - Enable gdm and avahi by default via the preset file
  - Convert /etc/sysconfig/desktop to display-manager.service symlink
  - Enable hardened build


author: Lennart Poettering <lpoetter@redhat.com> - 188-3
changelog:
  - Remount file systems MS_PRIVATE before switching roots
  - https://bugzilla.redhat.com/show_bug.cgi?id=847418


author: Ray Strode <rstrode@redhat.com> 188-4
changelog:
  - more scriptlet fixes
    (move dm migration logic to %posttrans so the service
     files it's looking for are available at the time
     the logic is run)


author: Lennart Poettering <lpoetter@redhat.com> - 189-3
changelog:
  - Update preset policy
  - Rename preset policy file from 99-default.preset to 90-default.preset so that people can order their own stuff after the Fedora default policy if they wish


author: Lennart Poettering <lpoetter@redhat.com> - 190-1
changelog:
  - New upstream release
  - Take possession of /etc/localtime, and remove /etc/sysconfig/clock
  - https://bugzilla.redhat.com/show_bug.cgi?id=858780
  - https://bugzilla.redhat.com/show_bug.cgi?id=858787
  - https://bugzilla.redhat.com/show_bug.cgi?id=858771
  - https://bugzilla.redhat.com/show_bug.cgi?id=858754
  - https://bugzilla.redhat.com/show_bug.cgi?id=858746
  - https://bugzilla.redhat.com/show_bug.cgi?id=858266
  - https://bugzilla.redhat.com/show_bug.cgi?id=858224
  - https://bugzilla.redhat.com/show_bug.cgi?id=857670
  - https://bugzilla.redhat.com/show_bug.cgi?id=856975
  - https://bugzilla.redhat.com/show_bug.cgi?id=855863
  - https://bugzilla.redhat.com/show_bug.cgi?id=851970
  - https://bugzilla.redhat.com/show_bug.cgi?id=851275
  - https://bugzilla.redhat.com/show_bug.cgi?id=851131
  - https://bugzilla.redhat.com/show_bug.cgi?id=847472
  - https://bugzilla.redhat.com/show_bug.cgi?id=847207
  - https://bugzilla.redhat.com/show_bug.cgi?id=846483
  - https://bugzilla.redhat.com/show_bug.cgi?id=846085
  - https://bugzilla.redhat.com/show_bug.cgi?id=845973
  - https://bugzilla.redhat.com/show_bug.cgi?id=845194
  - https://bugzilla.redhat.com/show_bug.cgi?id=845028
  - https://bugzilla.redhat.com/show_bug.cgi?id=844630
  - https://bugzilla.redhat.com/show_bug.cgi?id=839736
  - https://bugzilla.redhat.com/show_bug.cgi?id=835848
  - https://bugzilla.redhat.com/show_bug.cgi?id=831740
  - https://bugzilla.redhat.com/show_bug.cgi?id=823485
  - https://bugzilla.redhat.com/show_bug.cgi?id=821813
  - https://bugzilla.redhat.com/show_bug.cgi?id=807886
  - https://bugzilla.redhat.com/show_bug.cgi?id=802198
  - https://bugzilla.redhat.com/show_bug.cgi?id=767795
  - https://bugzilla.redhat.com/show_bug.cgi?id=767561
  - https://bugzilla.redhat.com/show_bug.cgi?id=752774
  - https://bugzilla.redhat.com/show_bug.cgi?id=732874
  - https://bugzilla.redhat.com/show_bug.cgi?id=858735


author: Lennart Poettering <lpoetter@redhat.com> - 194-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=859614
  - https://bugzilla.redhat.com/show_bug.cgi?id=859655


author: Lennart Poettering <lpoetter@redhat.com> - 195-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=831665
  - https://bugzilla.redhat.com/show_bug.cgi?id=847720
  - https://bugzilla.redhat.com/show_bug.cgi?id=858693
  - https://bugzilla.redhat.com/show_bug.cgi?id=863481
  - https://bugzilla.redhat.com/show_bug.cgi?id=864629
  - https://bugzilla.redhat.com/show_bug.cgi?id=864672
  - https://bugzilla.redhat.com/show_bug.cgi?id=864674
  - https://bugzilla.redhat.com/show_bug.cgi?id=865128
  - https://bugzilla.redhat.com/show_bug.cgi?id=866346
  - https://bugzilla.redhat.com/show_bug.cgi?id=867407
  - https://bugzilla.redhat.com/show_bug.cgi?id=868603


author: Michal Schmidt <mschmidt@redhat.com> - 195-4
changelog:
  - add dmraid-activation.service to the default preset
  - add yum protected.d fragment
  - https://bugzilla.redhat.com/show_bug.cgi?id=869619
  - https://bugzilla.redhat.com/show_bug.cgi?id=869717


author: Michal Schmidt <mschmidt@redhat.com> - 195-6
changelog:
  - Fix cyclical dep between systemd and systemd-libs.
  - Avoid broken build of test-journal-syslog.
  - https://bugzilla.redhat.com/show_bug.cgi?id=873387
  - https://bugzilla.redhat.com/show_bug.cgi?id=872638


author: Michal Schmidt <mschmidt@redhat.com> - 195-7
changelog:
  - Revert udev killing cgroup patch for F18 Beta.
  - https://bugzilla.redhat.com/show_bug.cgi?id=873576


author: Lennart Poettering <lpoetter@redhat.com> - 195-8
changelog:
  - https://bugzilla.redhat.com/show_bug.cgi?id=873459
  - https://bugzilla.redhat.com/show_bug.cgi?id=878093


author: Michal Schmidt <mschmidt@redhat.com> - 196-2
changelog:
  - added spice-vdagentd.service to presets (Lennart, #876237)
  - BR cryptsetup-devel instead of the legacy cryptsetup-luks-devel provide name
    (requested by Milan Brož).
  - verbose make to see the actual build flags


author: Michal Schmidt <mschmidt@redhat.com> - 196-3
changelog:
  - Disable hardening on s390(x) because PIE is broken there and produces
    text relocations with __thread (#868839).


author: Michal Schmidt <mschmidt@redhat.com> - 197-2
changelog:
  - Added qemu-guest-agent.service to presets (Lennart, #885406).
  - Add missing pygobject3-base to systemd-analyze deps (Lennart).
  - Do not require hwdata, it is all in the hwdb now (Kay).
  - Drop dependency on dbus-python.


author: Michal Schmidt <mschmidt@redhat.com> - 201-2
changelog:
  - Automatically discover whether to run autoreconf and add autotools and git
    BuildRequires based on the presence of patches to be applied.
  - Use find -delete.


author: Harald Hoyer <harald@redhat.com> 202-2
changelog:
  - nspawn create empty /etc/resolv.conf if necessary
  - python wrapper: add sd_journal_add_conjunction()
  - fix s390 booting
  - Resolves: rhbz#953217


author: Harald Hoyer <harald@redhat.com> 202-3
changelog:
  - fix ENOENT for getaddrinfo
  - Resolves: rhbz#954012 rhbz#956035
  - crypt-setup-generator: correctly check return of strdup
  - logind-dbus: initialize result variable
  - prevent library underlinking


author: Lennart Poettering <lpoetter@redhat.com> - 204-5
changelog:
  - Rename 90-display-manager.preset to 85-display-manager.preset so that it actually takes precedence over 90-default.preset's "disable *" line (#903690)


author: Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> - 206-3
changelog:
  - New systemd-python3 package (#976427).
  - Add ownership of a few directories that we create (#894202).


author: Dennis Gilmore <dennis@ausil.us> - 206-9
changelog:
  - Require grubby, Fedora installs require grubby,
  - kernel-install took over from new-kernel-pkg
  - without the Requires we are unable to compose Fedora
  - everyone else says that since kernel-install took over
  - it is responsible for ensuring that grubby is in place
  - this is really what we want for Fedora


author: Harald Hoyer <harald@redhat.com> 206-10
changelog:
  - Do not require grubby, lorax now takes care of grubby
  - cherry-picked a lot of patches from upstream


author: Harald Hoyer <harald@redhat.com> 206-11
changelog:
  - support "debug" kernel command line parameter
  - journald: fix fd leak in journal_file_empty
  - journald: fix vacuuming of archived journals
  - libudev: enumerate - do not try to match against an empty subsystem
  - cgtop: fixup the online help
  - libudev: fix memleak when enumerating childs


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 208-5
changelog:
  - Use unit name in PrivateTmp= directories (#957439)
  - Update manual pages, completion scripts, and hardware database
  - Configurable Timeouts/Restarts default values
  - Support printing of timestamps on the console
  - Fix some corner cases in detecting when writing to the console is safe
  - Python API: convert keyword values to string, fix sd_is_booted() wrapper
  - Do not tread missing /sbin/fsck.btrfs as an error (#1015467)
  - Allow masking of fsck units
  - Advertise hibernation to swap files
  - Fix SO_REUSEPORT settings
  - Prefer converted xkb keymaps to legacy keymaps (#981805, #1026872)
  - Make use of newer kmod
  - Assorted bugfixes: #1017161, #967521, #988883, #1027478, #821723, #1014303


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 208-7
changelog:
  - Backport patches (#1023041, #1036845, #1006386?)
  - HWDB update
  - Some small new features: nspawn --drop-capability=, running PID 1 under
    valgrind, "yearly" and "annually" in calendar specifications
  - Some small documentation and logging updates


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 208-11
changelog:
  - Backport a few fixes, relevant documentation updates, and HWDB changes
    (#1051797, #1051768, #1047335, #1047304, #1047186, #1045849, #1043304,
     - Flip journalctl to --full by default (#984758)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 208-13
changelog:
  - A different fix for #1023820 taken from Mageia
  - Backported fix for #997031
  - Hardward database updates, man pages improvements, a few small memory
    leaks, utf-8 correctness and completion fixes
  - Support for key-slot option in crypttab


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 208-14
changelog:
  - Back out patch which causes user manager to be destroyed when unneeded
    and spams logs (#1053315)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 210-5
changelog:
  - Bugfixes: #1047568, #1047039, #1071128, #1073402
  - Bash completions for more systemd tools
  - Bluetooth database update
  - Manpage fixes


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 210-8
changelog:
  - Fix logind unpriviledged reboot issue and a few other minor fixes
  - Limit generator execution time
  - Recognize buttonless joystick types


author: Michal Sekletar <msekleta@redhat.com> - 213-2
changelog:
  - Create temporary files after installation (#1101983)
  - Add sysstat-collect.timer, sysstat-summary.timer to preset policy (#1101621)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 214-2
changelog:
  - Do not restart systemd-logind on upgrades (#1110697)
  - Add some patches (#1081429, #1054549, #1108568, #928962)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 215-2
changelog:
  - Move systemd-journal-remote to systemd-journal-gateway package (#1114688)
  - Disable /etc/mtab handling temporarily (#1116158)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 215-4
changelog:
  - Various man page updates
  - Static device node logic is conditionalized on CAP_SYS_MODULES instead of CAP_MKNOD
    for better behaviour in containers
  - Some small networkd link handling fixes
  - vconsole-setup runs setfont before loadkeys (https://bugs.freedesktop.org/show_bug.cgi?id=80685)
  - New systemd-escape tool
  - XZ compression settings are tweaked to greatly improve journald performance
  - "watch" is accepted as chassis type
  - Various sysusers fixes, most importantly correct selinux labels
  - systemd-timesyncd bug fix (https://bugs.freedesktop.org/show_bug.cgi?id=80932)
  - Shell completion improvements
  - New udev tag ID_SOFTWARE_RADIO can be used to instruct logind to allow user access
  - XEN and s390 virtualization is properly detected


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 215-5
changelog:
  - Fix SELinux context of /etc/passwd-, /etc/group-, /etc/.updated (#1121806)
  - Add missing BR so gnutls and elfutils are used


author: Michal Schmidt <mschmidt@redhat.com> - 216-5
changelog:
  - Use common CONFIGURE_OPTS for build2 and build3.
  - Configure timesyncd with NTP servers from Fedora/RHEL vendor zone.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 217-4
changelog:
  - Change libgudev1 to only require systemd-libs (#727499), there's
    no need to require full systemd stack.
  - Fixes for bugs #1159448, #1152220, #1158035.
  - Bash completions updates to allow propose more units for start/restart,
    and completions for set-default,get-default.
  - Again allow systemctl enable of instances.
  - Hardware database update and fixes.
  - Udev crash on invalid options and kernel commandline timeout parsing are fixed.
  - Add "embedded" chassis type.
  - Sync before 'reboot -f'.
  - Fix restarting of timer units.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 218-4
changelog:
  - Enable xkbcommon dependency to allow checking of keymaps
  - Fix permissions of /var/log/journal (#1048424)
  - Enable timedatex in presets (#1187072)
  - Disable rpcbind in presets (#1099595)


author: Lennart Poettering <lpoetter@redhat.com> - 219-1
changelog:
  - New upstream release
  - This removes the sysctl/bridge hack, a different solution needs to be found for this (see #634736)
  - This removes the /etc/resolv.conf hack, anaconda needs to fix their handling of /etc/resolv.conf as symlink
  - This enables "%check"
  - disable gold on arm, as that is broken (see #1193212)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 219-8
changelog:
  - Reworked device handling (#1195761)
  - ACL handling fixes (with a script in %post)
  - Various log messages downgraded (#1184712)
  - Allow PIE on s390 again (#1197721)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 219-10
changelog:
  - Fixes for bugs 1186018, 1195294, 1185604, 1196452.
  - Hardware database update.
  - Documentation fixes.
  - A fix for journalctl performance regression.
  - Fix detection of inability to open files in journalctl.
  - Detect SuperH architecture properly.
  - The first of duplicate lines in tmpfiles wins again.
  - Do vconsole setup after loading vconsole driver, not fbcon.
  - Fix problem where some units were restarted during systemd reexec.
  - Fix race in udevadm settle tripping up NetworkManager.
  - Downgrade various log messages.
  - Fix issue where journal-remote would process some messages with a delay.
  - GPT /srv partition autodiscovery is fixed.
  - Reconfigure old Finnish keymaps in post (#1151958)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 219-11
changelog:
  - Move all parts systemd-journal-{remote,upload} to
    systemd-journal-gatewayd subpackage (#1193143).
  - Create /var/lib/systemd/journal-upload directory (#1193145).
  - Cut out lots of stupid messages at debug level which were obscuring more
    important stuff.
  - Apply "tentative" state for devices only when they are added, not removed.
  - Ignore invalid swap pri= settings (#1204336)
  - Fix SELinux check for timedated operations to enable/disable ntp (#1014315)
  - Fix comparing of filesystem paths (#1184016)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 219-14
changelog:
  - Remove presets (#1221340)
  - Fix (potential) crash and memory leak in timedated, locking failure
    in systemd-nspawn, crash in resolved.
  - journalctl --list-boots should be faster
  - zsh completions are improved
  - various ommissions in docs are corrected (#1147651)
  - VARIANT and VARIANT_ID fields in os-release are documented
  - systemd-fsck-root.service is generated in the initramfs (#1201979, #1107818)
  - systemd-tmpfiles should behave better on read-only file systems (#1207083)


author: Lennart Poettering <lpoetter@redhat.com> - 220-1
changelog:
  - New upstream release
  - Drop /etc/mtab hack, as that's apparently fixed in mock now (#1116158)
  - Remove ghosting for %{_sysconfdir}/systemd/system/runlevel*.target, these targets are not configurable anymore in systemd upstream
  - Drop work-around for #1002806, since this is solved upstream now


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 220-4
changelog:
  - systemd-devel should require systemd-libs, not the main package (#1226301)
  - Check for botched translations (#1226566)
  - Make /etc/udev/hwdb.d part of the rpm (#1226379)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 220-8
changelog:
  - Remove gudev which is now provided as separate package (libgudev)
  - Fix for spurious selinux denials (#1224211)
  - Udev change events (#1225905)
  - Patches for some potential crashes
  - ProtectSystem=yes does not touch /home
  - Man page fixes, hwdb updates, shell completion updates
  - Restored persistent device symlinks for bcache, xen block devices
  - Tag all DRM cards as master-of-seat


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 227-7
changelog:
  - Rename journal-gateway subpackage to journal-remote
  - Ignore the access mode on /var/log/journal (#1048424)
  - Do not assume fstab is present (#1281606)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 228-4.gite35a787
changelog:
  - Update to latest upstream git: there is a bunch of fixes
    (nss-mymachines overflow bug, networkd fixes, more completions are
    properly installed), mixed with some new resolved features.
  - Rework file triggers so that they always run before daemons are restarted


author: Dennis Gilmore <dennis@ausil.us> - 229-2
changelog:
  - revert: fixed kernel-install for copying files for grubby
  Resolves: rhbz#1299019
  - this causes the dtb files to not get installed at all and the fdtdir
  - line in extlinux.conf to not get updated correctly


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 229-5
changelog:
  - Split out systemd-container subpackage (#1163412)
  - Split out system-udev subpackage
  - Add various bugfix patches, incl. a tentative fix for #1308771


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 229-7
changelog:
  - Moar patches (#1316964, #1317928)
  - Move vconsole-setup and tmpfiles-setup-dev bits to systemd-udev
  - Protect systemd-udev from deinstallation


author: Zbigniew Jędrzejewski-Szmek <zbyszek@bupkis> - 230-1
changelog:
  - New version
  - Drop compat-libs
  - Require libxkbcommon explictly, since the automatic dependency will
    not be generated anymore


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 230-3
changelog:
  - Update to latest git snapshot (fixes for systemctl set-default,
    polkit lingering policy, reversal of the framebuffer rules,
    unaligned access fixes, fix for StartupBlockIOWeight-over-dbus).
    Those changes are interspersed with other changes and new features
    (mostly in lldp, networkd, and nspawn). Some of those new features
    might not work, but I think that existing functionality should not
    be broken, so it seems worthwile to update to the snapshot.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 231-4
changelog:
  - Fix preset-all (#1363858)
  - Fix issue with daemon-reload messing up graphics (#1367766)
  - A few other bugfixes


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 231-9
changelog:
  - Fix systemctl set-default (#1374371)
  - Prevent systemd-udev-trigger.service from restarting (follow-up for #1378974)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 231-10
changelog:
  - Do not recreate /var/log/journal on upgrades (#1383066)
  - Move nss-myhostname provides to systemd-libs (#1383271)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 232-1
changelog:
  - Update to latest version (#998615, #1181922, #1374371, #1390704, #1384150, #1287161)
  - Add %{_isa} to Provides on arch-full packages (#1387912)
  - Create systemd-coredump user in %pre (#1309574)
  - Replace grubby patch with a short-circuiting install.d "plugin"
  - Enable nss-systemd in the passwd, group lines in nsswith.conf
  - Add [!UNAVAIL=return] fallback after nss-resolve in hosts line in nsswith.conf
  - Move systemd-nspawn man pages to the right subpackage (#1391703)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 232-2
changelog:
  - Fix kernel-install (#1391829)
  - Restore previous systemd-user PAM config (#1391836)
  - Move journal-upload.conf.5 from systemd main to journal-remote subpackage (#1391833)
  - Fix permissions on /var/lib/systemd/journal-upload (#1262665)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 232-9
changelog:
  - Add fake dependency on systemd-pam to systemd-devel to ensure systemd-pam
    is available as multilib (#1414153)


author: zbyszek <zbyszek@in.waw.pl> - 232-11
changelog:
  - Backport a number of patches (#1411299, #1413075, #1415745,
                                  - Fix various memleaks and unitialized variable access
  - Shell completion enhancements
  - Enable TPM logging by default (#1411156)
  - Update hwdb (#1270124)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 232-12
changelog:
  - Backport patch for initrd-switch-root.service getting killed (#1414904)
  - Fix sd-journal-gatewayd -D, --trust, and COREDUMP_CONTAINER_CMDLINE
    extraction by sd-coredump.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 233-1
changelog:
  - New upstream release (#1416201, #1405439, #1420753, many others)
  - New systemd-tests subpackage with "installed tests"


author: Michal Sekletar <msekleta@redhat.com> - 233-3
changelog:
  - Backport bugfixes from upstream
  - Don't return error when machinectl couldn't figure out container IP addresses (#1419501)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 233-4
changelog:
  - Backport a bunch of small fixes (memleaks, wrong format strings,
    man page clarifications, shell completion)
  - Fix systemd-resolved crash on crafted DNS packet (CVE-2017-9217, #1455493)
  - Fix systemd-vconsole-setup.service error on systems with no VGA console (#1272686)
  - Drop soft-static uid for systemd-journal-gateway
  - Use ID from /etc/os-release as ntpvendor


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 234-3
changelog:
  - Fix x-systemd.timeout=0 in /etc/fstab (#1462378)
  - Minor patches (memleaks, --help fixes, seccomp on arm64)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 236-2.git23e14c4
changelog:
  - Backport a bunch of bugfixes from upstream (#1531502, #1531381, #1526621
    various memory corruptions in systemd-networkd)
  - /dev/kvm is marked as a static node which fixes permissions on s390x
    and ppc64 (#1532382)


author: Zbigniew Jędrzejeweski-Szmek <zbyszek@in.waw.pl> - 237-1.git78bd769
changelog:
  - Update to first stable snapshot (various minor memory leaks and misaccesses,
    some documentation bugs, build fixes).


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 237-2.gitdff4849
changelog:
  - Backport a bunch of patches, most notably for the journal and various
    memory issues. Some minor build fixes.
  - Switch to new ldconfig macros that do nothing in F28+
  - /etc/systemd/dont-synthesize-nobody is created in %post if nfsnobody
    or nobody users are defined (#1537262)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 237-3.git84c8da5
changelog:
  - Update some patches for test skipping that were updated upstream
    before merging
  - Add /usr/lib/systemd/purge-nobody-user — a script to check if nobody is defined
    correctly and possibly replace existing mappings


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 238-1
changelog:
  - Update to latest version
  - This fixes a hard-to-trigger potential vulnerability (CVE-2018-6954)
  - New transfiletriggers are installed for udev hwdb and rules, the journal
    catalog, sysctl.d, binfmt.d, sysusers.d, tmpfiles.d.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 238-3
changelog:
  - Revert the patches for GRUB BootLoaderSpec support
  - Add patch for /etc/machine-id creation (#1552843)


author: Michal Sekletar <msekleta@redhat.com> - 238-4
changelog:
  - disable support for qrencode (#1566158)
  - bump default journal rate limit to 10000 messages per 30s (#1563729)
  - fix unit reloads (#1560549)
  - don't create /var/log/journal during package installation (#1523188)


author: Michal Sekletar <msekleta@redhat.com> - 238-6
changelog:
  - forwardport downstream-only udev rules from RHEL-7 (#1523227)
  - set RemoveIPC=no by default (#1523233)


author: Michal Sekletár <msekleta@redhat.com> - 239-1
changelog:
  - rebase to systemd-239
  - Override systemd-user PAM config in install and not prep (patch by Filipe Brandenburger <filbranden@google.com>)
  - use %autosetup -S git_am to apply patches
  - revert upstream default for RemoveIPC (#1523233)
  - bump DefaultTasksMax to 80% of kernel default (#1523236)
  - avoid /tmp being mounted as tmpfs without the user's will (#1578772)
  - bump maximum number of processes in user slice to 80% of pid.max (#1523236)
  - forwardport downstream-only udev rules from RHEL-7 (#1523227)
  - don't ship systemd-networkd
  - don't ship systemd-timesyncd
  - add back support for WAIT_FOR to udev rules (#1523213)


author: Michal Sekletár <msekleta@redhat.com> - 239-2
changelog:
  - 20-grubby.install: populate symvers.gz file (#1609698)
  - net_setup_link: allow renaming interfaces that were renamed already
  - units: drop DynamicUser=yes from systemd-resolved.service
  - journal: remove journal audit socket


author: Michal Sekletár <msekleta@redhat.com> - 239-4
changelog:
  - drop the patch for delayed loading of config in net_setup_link and set NAME in prefixdevname udev rules (#1614681)
  - bus: move BUS_DONT_DESTROY calls after asserts (#1610397)


author: Michal Sekletár <msekleta@redhat.com> - 239-7
changelog:
  - change default cgroup hierarchy to "legacy" (#1638650)
  - we never added mymachines module to passwd: or group: in RHEL8, hence don't try to remove it (#1638450)
  - bump minimal size of random pool to 1024 bytes (#1619268)
  - install RHEL-7 compatible rc.local (#1625209)
  - backport support for sector-size crypttab option (#1572563)
  - units: don't enable per-service IP firewall by default (#1630219)
  - sd-bus: unify three code-paths which free struct bus_container (#1635435)
  - bus-message: do not crash on message with a string of zero length (#1635439)
  - bus-message: stack based buffer overflow in free_and_strdup (#1635428)
  - journal: change support URL shown in the catalog entries (#1550548)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-9
changelog:
  - dissect-image: use right comparison function (#1602706)
  - login: avoid leak of name returned by uid_to_name() (#1602706)
  - firewall-util: add an assert that we're not overwriting a buffer (#1602706)
  - journal-file: avoid calling ftruncate with invalid fd (#1602706)
  - dhcp6: make sure we have enough space for the DHCP6 option header (#1643363)
  - core: rename queued_message → pending_reload_message (#1647359)
  - core: when we can't send the pending reload message, say we ignore it in the warning we log (#1647359)
  - core: make sure we don't throttle change signal generator when a reload is pending (#1647359)
  - proc-cmdline: introduce PROC_CMDLINE_RD_STRICT (#1643429)
  - debug-generator: introduce rd.* version of all options (#1643429)
  - chown-recursive: let's rework the recursive logic to use O_PATH (#1643368)
  - chown-recursive: also drop ACLs when recursively chown()ing (#1643368)
  - chown-recursive: TAKE_FD() is your friend (#1643368)
  - test: add test case for recursive chown()ing (#1643368)
  - Revert "sysctl.d: request ECN on both in and outgoing connections" (#1619790)
  - detect-virt: do not try to read all of /proc/cpuinfo (#1631532)
  - sd-bus: unify three code-paths which free struct bus_container (#1635435)
  - sd-bus: properly initialize containers (#1635435)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-10
changelog:
  - cryptsetup-generator: introduce basic keydev support (#1656869)
  - cryptsetup: don't use %m if there's no error to show (#1656869)
  - cryptsetup-generator: don't return error if target directory already exists (#1656869)
  - cryptsetup-generator: allow whitespace characters in keydev specification (#1656869)
  - rules: watch metadata changes on DASD devices (#1638676)
  - sysctl.d: switch net.ipv4.conf.all.rp_filter from 1 to 2 (#1653824)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-12
changelog:
  - core: when deserializing state always use read_line(…, LONG_LINE_MAX, …) (CVE-2018-15686)
  - coredump: remove duplicate MESSAGE= prefix from message (#1664976)
  - journald: remove unnecessary {} (#1664976)
  - journald: do not store the iovec entry for process commandline on stack (#1664976)
  - basic/process-util: limit command line lengths to _SC_ARG_MAX (#1664976)
  - coredump: fix message when we fail to save a journald coredump (#1664976)
  - procfs-util: expose functionality to query total memory (#1664976)
  - basic/prioq: add prioq_peek_item() (#1664976)
  - journal: limit the number of entries in the cache based on available memory (#1664976)
  - journald: periodically drop cache for all dead PIDs (#1664976)
  - process-util: don't use overly large buffer to store process command line (#1664976)
  - Revert "sysctl.d: switch net.ipv4.conf.all.rp_filter from 1 to 2" (#1653824)
  - journal: fix syslog_parse_identifier() (#1664978)
  - journald: set a limit on the number of fields (1k) (#1664977)
  - journald: when processing a native message, bail more quickly on overbig messages (#1664977)
  - journald: lower the maximum entry size limit to ½ for non-sealed fds (#1664977)
  - µhttpd: use a cleanup function to call MHD_destroy_response (#1664977)
  - journal-remote: verify entry length from header (#1664977)
  - journal-remote: set a limit on the number of fields in a message (#1664977)
  - journald: correctly attribute log messages also with cgroupsv1 (#1658115)
  - rules: add elevator= kernel command line parameter (#1670126)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-14
changelog:
  - rules: implement new memory hotplug policy (#1670728)
  - rules: add the rule that adds elevator= kernel command line parameter (#1670126)
  - bus-socket: Fix line_begins() to accept word matching full string (#1692991)
  - Refuse dbus message paths longer than BUS_PATH_SIZE_MAX limit. (#1678641)
  - Allocate temporary strings to hold dbus paths on the heap (#1678641)
  - sd-bus: if we receive an invalid dbus message, ignore and proceeed (#1678641)
  - Revert "core: one step back again, for nspawn we actually can't wait for cgroups running empty since systemd will get exactly zero notifications about it" (#1703485)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-15
changelog:
  - tree-wide: shorten error logging a bit (#1697893)
  - nspawn: simplify machine terminate bus call (#1697893)
  - nspawn: merge two variable declaration lines (#1697893)
  - nspawn: rework how we allocate/kill scopes (#1697893)
  - unit: enqueue cgroup empty check event if the last ref on a unit is dropped (#1697893)
  - Revert "journal: remove journal audit socket" (#1699287)
  - journal: don't enable systemd-journald-audit.socket by default (#1699287)
  - logs-show: use grey color for de-emphasizing journal log output (#1695601)
  - units: add [Install] section to tmp.mount (#1667065)
  - nss: do not modify errno when NSS_STATUS_NOTFOUND or NSS_STATUS_SUCCESS (#1691691)
  - util.h: add new UNPROTECT_ERRNO macro (#1691691)
  - nss: unportect errno before writing to NSS' *errnop (#1691691)
  - seccomp: reduce logging about failure to add syscall to seccomp (#1658691)
  - format-table: when duplicating a cell, also copy the color (#1689832)
  - format-table: optionally make specific cells clickable links (#1689832)
  - format-table: before outputting a color, check if colors are available (#1689832)
  - format-table: add option to store/format percent and uint64_t values in cells (#1689832)
  - format-table: optionally allow reversing the sort order for a column (#1689832)
  - format-table: add table_update() to update existing entries (#1689832)
  - format-table: add an API for getting the cell at a specific row/column (#1689832)
  - format-table: always underline header line (#1689832)
  - format-table: add calls to query the data in a specific cell (#1689832)
  - format-table: make sure we never call memcmp() with NULL parameters (#1689832)
  - format-table: use right field for display (#1689832)
  - format-table: add option to uppercase cells on display (#1689832)
  - format-table: never try to reuse cells that have color/url/uppercase set (#1689832)
  - locale-util: add logic to output smiley emojis at various happiness levels (#1689832)
  - analyze: add new security verb (#1689832)
  - tests: add a rudimentary fuzzer for server_process_syslog_message (#9979) (#1696224)
  - journald: make it clear that dev_kmsg_record modifies the string passed to it (#1696224)
  - journald: free the allocated memory before returning from dev_kmsg_record (#1696224)
  - tests: rework the code fuzzing journald (#1696224)
  - journald: make server_process_native_message compatible with fuzz_journald_processing_function (#1696224)
  - tests: add a fuzzer for server_process_native_message (#1696224)
  - tests: add a fuzzer for sd-ndisc (#1696224)
  - ndisc: fix two infinite loops (#1696224)
  - tests: add reproducers for several issues uncovered with fuzz-journald-syslog (#1696224)
  - tests: add a reproducer for an infinite loop in ndisc_handle_datagram (#1696224)
  - tests: add a reproducer for another infinite loop in ndisc_handle_datagram (#1696224)
  - fuzz: rename "fuzz-corpus" directory to just "fuzz" (#1696224)
  - test: add testcase for issue 10007 by oss-fuzz (#1696224)
  - fuzz: unify the "fuzz-regressions" directory with the main corpus (#1696224)
  - test-bus-marshal: use cescaping instead of hexmem (#1696224)
  - meson: add -Dlog-trace to set LOG_TRACE (#1696224)
  - meson: allow building resolved and machined without nss modules (#1696224)
  - meson: drop duplicated condition (#1696224)
  - meson: use .source_root() in more places (#1696224)
  - meson: treat all fuzz cases as unit tests (#1696224)
  - fuzz-bus-message: add fuzzer for message parsing (#1696224)
  - bus-message: use structured initialization to avoid use of unitialized memory (#1696224)
  - bus-message: avoid an infinite loop on empty structures (#1696224)
  - bus-message: let's always use -EBADMSG when the message is bad (#1696224)
  - bus-message: rename function for clarity (#1696224)
  - bus-message: use define (#1696224)
  - bus: do not print (null) if the message has unknown type (#1696224)
  - bus-message: fix calculation of offsets table (#1696224)
  - bus-message: remove duplicate assignment (#1696224)
  - bus-message: fix calculation of offsets table for arrays (#1696224)
  - bus-message: drop asserts in functions which are wrappers for varargs version (#1696224)
  - bus-message: output debug information about offset troubles (#1696224)
  - bus-message: fix skipping of array fields in !gvariant messages (#1696224)
  - bus-message: also properly copy struct signature when skipping (#1696224)
  - fuzz-bus-message: add two test cases that pass now (#1696224)
  - bus-message: return -EBADMSG not -EINVAL on invalid !gvariant messages (#1696224)
  - bus-message: avoid wrap-around when using length read from message (#1696224)
  - util: do not use stack frame for parsing arbitrary inputs (#1696224)
  - travis: enable ASan and UBSan on RHEL8 (#1683319)
  - tests: keep SYS_PTRACE when running under ASan (#1683319)
  - tree-wide: various ubsan zero size memory fixes (#1683319)
  - util: introduce memcmp_safe() (#1683319)
  - test-socket-util: avoid "memleak" reported by valgrind (#1683319)
  - sd-journal: escape binary data in match_make_string() (#1683319)
  - capability: introduce CAP_TO_MASK_CORRECTED() macro replacing CAP_TO_MASK() (#1683319)
  - sd-bus: use size_t when dealing with memory offsets (#1683319)
  - sd-bus: call cap_last_cap() only once in has_cap() (#1683319)
  - mount-point: honour AT_SYMLINK_FOLLOW correctly (#1683319)
  - travis: switch from trusty to xenial (#1683319)
  - test-socket-util: Add tests for receive_fd_iov() and friends. (#1683319)
  - socket-util: Introduce send_one_fd_iov() and receive_one_fd_iov() (#1683319)
  - core: swap order of "n_storage_fds" and "n_socket_fds" parameters (#1683334)
  - execute: use our usual syntax for defining bit masks (#1683334)
  - core: introduce new Type=exec service type (#1683334)
  - man: document the new Type=exec type (#1683334)
  - sd-bus: allow connecting to the pseudo-container ".host" (#1683334)
  - sd-login: let's also make sd-login understand ".host" (#1683334)
  - test: add test for Type=exec (#1683334)
  - journal-gateway: explicitly declare local variables (#1705971)
  - tools: drop unused variable (#1705971)
  - journal-gateway: use localStorage["cursor"] only when it has valid value (#1705971)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-16
changelog:
  - sd-bus: deal with cookie overruns (#1694999)
  - journal-remote: do not request Content-Length if Transfer-Encoding is chunked (#1708849)
  - journal: do not remove multiple spaces after identifier in syslog message (#1691817)
  - cryptsetup: Do not fallback to PLAIN mapping if LUKS data device set fails. (#1719153)
  - cryptsetup: call crypt_load() for LUKS only once (#1719153)
  - cryptsetup: Add LUKS2 token support. (#1719153)
  - udev/scsi_id: fix incorrect page length when get device identification VPD page (#1713227)
  - Change job mode of manager triggered restarts to JOB_REPLACE (#11456
  - bash-completion: analyze: support 'security' (#1733395)
  - man: note that journal does not validate syslog fields (#1707175)
  - rules: skip memory hotplug on ppc64 (#1713159)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-17
changelog:
  - mount: simplify /proc/self/mountinfo handler (#1696178)
  - mount: rescan /proc/self/mountinfo before processing waitid() results (#1696178)
  - swap: scan /proc/swaps before processing waitid() results (#1696178)
  - analyze-security: fix potential division by zero (#1734400)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-18
changelog:
  - shared/but-util: drop trusted annotation from bus_open_system_watch_bind_with_description() (#1746857)
  - sd-bus: adjust indentation of comments (#1746857)
  - resolved: do not run loop twice (#1746857)
  - resolved: allow access to Set*Link and Revert methods through polkit (#1746857)
  - resolved: query polkit only after parsing the data (#1746857)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-19
changelog:
  - core: never propagate reload failure to service result (#1735787)
  - man: document systemd-analyze security (#1750343)
  - man: reorder and add examples to systemd-analyze(1) (#1750343)
  - travis: move to CentOS 8 docker images (#1761519)
  - travis: drop SCL remains (#1761519)
  - syslog: fix segfault in syslog_parse_priority() (#1761519)
  - sd-bus: make strict asan shut up (#1761519)
  - travis: don't run slow tests under ASan/UBSan (#1761519)
  - kernel-install: do not require non-empty kernel cmdline (#1701454)
  - ask-password: prevent buffer overrow when reading from keyring (#1752050)
  - core: try to reopen /dev/kmsg again right after mounting /dev (#1749212)
  - buildsys: don't garbage collect sections while linking (#1748258)
  - udev: introduce CONST key name (#1762679)
  - Call getgroups() to know size of supplementary groups array to allocate (#1743230256 KB
  - Consider smb3 as remote filesystem (#1757257)
  - process-util: introduce pid_is_my_child() helper (#1744972)
  - core: reduce the number of stalled PIDs from the watched processes list when possible (#1744972)
  - core: only watch processes when it's really necessary (#1744972)
  - core: implement per unit journal rate limiting (#1719577)
  - path: stop watching path specs once we triggered the target unit (#1763161)
  - journald: fixed assertion failure when system journal rotation fails (#9893) (#1763619)
  - test: use PBKDF2 instead of Argon2 in cryptsetup... (#1761519)
  - test: mask several unnecessary services (#1761519)
  - test: bump the second partition's size to 50M (#1761519)
  - shared/sleep-config: exclude zram devices from hibernation candidates (#1763617)
  - selinux: don't log SELINUX_INFO and SELINUX_WARNING messages to audit (#1763612)
  - sd-device: introduce log_device_*() macros (#1753369)
  - udev: Add id program and rule for FIDO security tokens (#1753369)
  - shared/but-util: drop trusted annotation from bus_open_system_watch_bind_with_description() (#1746857)
  - sd-bus: adjust indentation of comments (#1746857)
  - resolved: do not run loop twice (#1746857)
  - resolved: allow access to Set*Link and Revert methods through polkit (#1746857)
  - resolved: query polkit only after parsing the data (#1746857)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-20
changelog:
  - journal: rely on _cleanup_free_ to free a temporary string used in client_context_read_cgroup (#1764560)
  - basic/user-util: allow dots in user names (#1717603)
  - sd-bus: bump message queue size again (#1770189)
  - tests: put fuzz_journald_processing_function in a .c file (#1764560)
  - tests: add a fuzzer for dev_kmsg_record (#1764560)
  - basic: remove an assertion from cunescape_one (#1764560)
  - journal: fix an off-by-one error in dev_kmsg_record (#1764560)
  - tests: add a reproducer for a memory leak fixed in 30eddcd51b8a472e05d3b8d1 in August (#1764560)
  - tests: add a reproducer for a heap-buffer-overflow fixed in 937b1171378bc1000a (#1764560)
  - test: initialize syslog_fd in fuzz-journald-kmsg too (#1764560)
  - tests: add a fuzzer for process_audit_string (#1764560)
  - journald: check whether sscanf has changed the value corresponding to %n (#1764560)
  - tests: introduce dummy_server_init and use it in all journald fuzzers (#1764560)
  - tests: add a fuzzer for journald streams (#1764560)
  - tests: add a fuzzer for server_process_native_file (#1764560)
  - fuzz-journal-stream: avoid assertion failure on samples which don't fit in pipe (#1764560)
  - journald: take leading spaces into account in syslog_parse_identifier (#1764560)
  - Add a warning about the difference in permissions between existing directories and unit settings. (#1778384)
  - execute: remove one redundant comparison check (#1778384)
  - core: change ownership/mode of the execution directories also for static users (#1778384)
  - core/dbus-execute: remove unnecessary initialization (#1734787)
  - shared/cpu-set-util: move the part to print cpu-set into a separate function (#1734787)
  - shared/cpu-set-util: remove now-unused CPU_SIZE_TO_NUM() (#1734787)
  - Rework cpu affinity parsing (#1734787)
  - Move cpus_in_affinity_mask() to cpu-set-util.[ch] (#1734787)
  - test-cpu-set-util: add simple test for cpus_in_affinity_mask() (#1734787)
  - test-cpu-set-util: add a smoke test for test_parse_cpu_set_extend() (#1734787)
  - pid1: parse CPUAffinity= in incremental fashion (#1734787)
  - pid1: don't reset setting from /proc/cmdline upon restart (#1734787)
  - pid1: when reloading configuration, forget old settings (#1734787)
  - test-execute: use CPUSet too (#1734787)
  - shared/cpu-set-util: drop now-unused cleanup function (#1734787)
  - shared/cpu-set-util: make transfer of cpu_set_t over bus endian safe (#1734787)
  - test-cpu-set-util: add test for dbus conversions (#1734787)
  - shared/cpu-set-util: introduce cpu_set_to_range() (#1734787)
  - systemctl: present CPUAffinity mask as a list of CPU index ranges (#1734787)
  - shared/cpu-set-util: only force range printing one time (#1734787)
  - execute: dump CPUAffinity as a range string instead of a list of CPUs (#1734787)
  - cpu-set-util: use %d-%d format in  cpu_set_to_range_string() only for actual ranges (#1734787)
  - core: introduce NUMAPolicy and NUMAMask options (#1734787)
  - core: disable CPUAccounting by default (#1734787)
  - set kptr_restrict=1 (#1689346)
  - cryptsetup: reduce the chance that we will be OOM killed (#1696602)
  - core, job: fix breakage of ordering dependencies by systemctl reload command (#1766417)
  - debug-generator: enable custom systemd.debug_shell tty (#1723722)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-21
changelog:
  - test-cpu-set-util: fix comparison for allocation size (#1734787)
  - test-cpu-set-util: fix allocation size check on i386 (#1734787)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-23
changelog:
  - catalog: fix name of variable (#1677768)
  - cryptsetup: add keyfile-timeout to allow a keydev timeout and allow to fallback to a password if it fails. (#1763155)
  - cryptsetup: add documentation for keyfile-timeout (#1763155)
  - cryptsetup: use unabbrieviated variable names (#1763155)
  - cryptsetup: don't assert on variable which is optional (#1763155)
  - cryptsetup-generator: guess whether the keyfile argument is two items or one (#1763155)
  - crypt-util: Translate libcryptsetup log level instead of using log_debug() (#1776408)
  - cryptsetup: add some commenting about EAGAIN generation (#1776408)
  - cryptsetup: downgrade a log message we ignore (#1776408)
  - cryptsetup: rework how we log about activation failures (#1776408)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-24
changelog:
  - rules: reintroduce 60-alias-kmsg.rules (#1739353)
  - sd-bus: make rqueue/wqueue sizes of type size_t (CVE-2020-1712)
  - sd-bus: reorder bus ref and bus message ref handling (CVE-2020-1712)
  - sd-bus: make sure dispatch_rqueue() initializes return parameter on all types of success (CVE-2020-1712)
  - sd-bus: drop two inappropriate empty lines (CVE-2020-1712)
  - sd-bus: initialize mutex after we allocated the wqueue (CVE-2020-1712)
  - sd-bus: always go through sd_bus_unref() to free messages (CVE-2020-1712)
  - bus-message: introduce two kinds of references to bus messages (CVE-2020-1712)
  - sd-bus: introduce API for re-enqueuing incoming messages (CVE-2020-1712)
  - sd-event: add sd_event_source_disable_unref() helper (CVE-2020-1712)
  - polkit: when authorizing via PK let's re-resolve callback/userdata instead of caching it (CVE-2020-1712)
  - sysctl: let's by default increase the numeric PID range from 2^16 to 2^22 (#1744214)
  - journal: do not trigger assertion when journal_file_close() get NULL (#1788085)
  - journal: use cleanup attribute at one more place (#1788085)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-25
changelog:
  - sd-bus: use "queue" message references for managing r/w message queues in connection objects (CVE-2020-1712)
  - pid1: make sure to restore correct default values for some rlimits (#1789930)
  - main: introduce a define HIGH_RLIMIT_MEMLOCK similar to HIGH_RLIMIT_NOFILE (#1789930)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-26
changelog:
  - seccomp: introduce seccomp_restrict_suid_sgid() for blocking chmod() for suid/sgid files (#1687512)
  - test: add test case for restrict_suid_sgid() (#1687512)
  - core: expose SUID/SGID restriction as new unit setting RestrictSUIDSGID= (#1687512)
  - analyze: check for RestrictSUIDSGID= in "systemd-analyze security" (#1687512)
  - man: document the new RestrictSUIDSGID= setting (#1687512)
  - units: turn on RestrictSUIDSGID= in most of our long-running daemons (#1687512)
  - core: imply NNP and SUID/SGID restriction for DynamicUser=yes service (#1687512)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-32
changelog:
  - pid1: fix DefaultTasksMax initialization (#1809037)
  - cgroup: make sure that cpuset is supported on cgroup v2 and disabled with v1 (#1808940)
  - test: introduce TEST-36-NUMAPOLICY (#1808940)
  - test: replace `tail -f` with journal cursor which should be... (#1808940)
  - test: support MPOL_LOCAL matching in unpatched strace versions (#1808940)
  - test: make sure the strace process is indeed dead (#1808940)
  - test: skip the test on systems without NUMA support (#1808940)
  - test: give strace some time to initialize (#1808940)
  - test: add a simple sanity check for systems without NUMA support (#1808940)
  - test: drop the missed || exit 1 expression (#1808940)
  - test: replace cursor file with a plain cursor (#1808940)
  - cryptsetup: Treat key file errors as a failed password attempt (#1763155)
  - swap: finish the secondary swap units' jobs if deactivation of the primary swap unit fails (#1749622)
  - resolved: Recover missing PrivateTmp=yes and ProtectSystem=strict (#1810869)
  - bus_open leak sd_event_source when udevadm trigger。 (#1798504)
  - core: rework StopWhenUnneeded= logic (#1798046)
  - pid1: fix the names of AllowedCPUs= and AllowedMemoryNodes= (#1818054)
  - core: fix re-realization of cgroup siblings (#1818054)
  - basic: use comma as separator in cpuset cgroup cpu ranges (#1818054)
  - core: transition to FINAL_SIGTERM state after ExecStopPost= (#1766479)
  - sd-journal: close journal files that were deleted by journald before we've setup inotify watch (#1796128)
  - sd-journal: remove the dead code and actually fix #14695 (#1796128)
  - udev: downgrade message when we fail to set inotify watch up (#1808051)
  - logind: check PolicyKit before allowing VT switch (#1797679)
  - test: do not use global variable to pass error (#1823767)
  - test: install libraries required by tests (#1823767)
  - test: introduce install_zoneinfo() (#1823767)
  - test: replace duplicated Makefile by symbolic link (#1823767)
  - test: add paths of keymaps in install_keymaps() (#1823767)
  - test: make install_keymaps() optionally install more keymaps (#1823767)
  - test-fs-util: skip some tests when running in unprivileged container (#1823767)
  - test-process-util: skip several verifications when running in unprivileged container (#1823767)
  - test-execute: also check python3 is installed or not (#1823767)
  - test-execute: skip several tests when running in container (#1823767)
  - test: introduce test_is_running_from_builddir() (#1823767)
  - test: make test-catalog relocatable (#1823767)
  - test: parallelize tasks in TEST-24-UNIT-TESTS (#1823767)
  - test: try to determine QEMU_SMP dynamically (#1823767)
  - test: store coredumps in journal (#1823767)
  - pid1: add new kernel cmdline arg systemd.cpu_affinity= (#1812894)
  - udev-rules: make tape-changers also apprear in /dev/tape/by-path/ (#1820112)
  - man: be clearer that .timer time expressions need to be reset to override them (#1816908)
  - Add support for opening files for appending (#1809175)
  - nspawn: move payload to sub-cgroup first, then sync cgroup trees (#1837094)
  - core: move unit_status_emit_starting_stopping_reloading() and related calls to job.c (#1737283)
  - job: when a job was skipped due to a failed condition, log about it (#1737283)
  - core: split out all logic that updates a Job on a unit's unit_notify() invocation (#1737283)
  - core: make log messages about units entering a 'failed' state recognizable (#1737283)
  - core: log a recognizable message when a unit succeeds, too (#1737283)
  - tests: always use the right vtable wrapper calls (#1737283)
  - test-execute: allow filtering test cases by pattern (#1737283)
  - test-execute: provide custom failure message (#1737283)
  - core: ExecCondition= for services (#1737283)
  - Drop support for lz4 < 1.3.0 (#1843871)
  - test-compress: add test for short decompress_startswith calls (#1843871)
  - journal: adapt for new improved LZ4_decompress_safe_partial() (#1843871)
  - fuzz-compress: add fuzzer for compression and decompression (#1843871)
  - seccomp: fix __NR__sysctl usage (#1843871)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-33
changelog:
  - tmpfiles: fix crash with NULL in arg_root and other fixes and tests (#1836024)
  - sulogin-shell: Use force if SYSTEMD_SULOGIN_FORCE set (#1625929)
  - resolvconf: fixes for the compatibility interface (#1835594)
  - mount: don't add Requires for tmp.mount (#1748840)
  - core: coldplug possible nop_job (#1829798)
  - core: add IODeviceLatencyTargetSec (#1831519)
  - time-util: Introduce parse_sec_def_infinity (#1770379)
  - cgroup: use structured initialization (#1770379)
  - core: add CPUQuotaPeriodSec= (#1770379)
  - core: downgrade CPUQuotaPeriodSec= clamping logs to debug (#1770379)
  - sd-bus: avoid magic number in SASL length calculation (#1838081)
  - sd-bus: fix SASL reply to empty AUTH (#1838081)
  - sd-bus: skip sending formatted UIDs via SASL (#1838081)
  - core: add MemoryMin (#1763435)
  - core: introduce cgroup_add_device_allow() (#1763435)
  - test: remove support for suffix in get_testdata_dir() (#1763435)
  - cgroup: Implement default propagation of MemoryLow with DefaultMemoryLow (#1763435)
  - cgroup: Create UNIT_DEFINE_ANCESTOR_MEMORY_LOOKUP (#1763435)
  - unit: Add DefaultMemoryMin (#1763435)
  - cgroup: Polish hierarchically aware protection docs a bit (#1763435)
  - cgroup: Readd some plumbing for DefaultMemoryMin (#1763435)
  - cgroup: Support 0-value for memory protection directives (#1763435)
  - cgroup: Test that it's possible to set memory protection to 0 again (#1763435)
  - cgroup: Check ancestor memory min for unified memory config (#1763435)
  - cgroup: Respect DefaultMemoryMin when setting memory.min (#1763435)
  - cgroup: Mark memory protections as explicitly set in transient units (#1763435)
  - meson: allow setting the version string during configuration (#1804252)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-36
changelog:
  - core: don't consider SERVICE_SKIP_CONDITION for abnormal or failure restarts (#1737283)
  - selinux: do preprocessor check only in selinux-access.c (#1830861)
  - basic/cgroup-util: introduce cg_get_keyed_attribute_full() (#1830861)
  - shared: add generic logic for waiting for a unit to enter some state (#1830861)
  - shared: fix assert call (#1830861)
  - shared: Don't try calling NULL callback in bus_wait_for_units_clear (#1830861)
  - shared: add NULL callback check in one more place (#1830861)
  - core: introduce support for cgroup freezer (#1830861)
  - core/cgroup: fix return value of unit_cgorup_freezer_action() (#1830861)
  - core: fix the return value in order to make sure we don't dipatch method return too early (#1830861)
  - test: add test for cgroup v2 freezer support (#1830861)
  - fix mis-merge (#1848421)
  - tests: sleep a bit and give kernel time to perform the action after manual freeze/thaw (#1848421)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-39
changelog:
  - device: make sure we emit PropertiesChanged signal once we set sysfs (#1793533)
  - device: don't emit PropetiesChanged needlessly (#1793533)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-40
changelog:
  - units: add generic boot-complete.target (#1872243)
  - man: document new "boot-complete.target" unit (#1872243)
  - core: make sure to restore the control command id, too (#1829867)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-42
changelog:
  - logind: don't print warning when user@.service template is masked (#1880270)
  - build: use simple project version in pkgconfig files (#1862714)
  - basic/virt: try the /proc/1/sched hack also for PID1 (#1868877)
  - seccomp: rework how the S[UG]ID filter is installed (#1860374)
  - vconsole-setup: downgrade log message when setting font fails on dummy console (#1889996)
  - units: fix systemd.special man page reference in system-update-cleanup.service (#1871827)
  - units: drop reference to sushell man page (#1871827)
  - sd-bus: break the loop in bus_ensure_running() if the bus is not connecting (#1885553)
  - core: add new API for enqueing a job with returning the transaction data (#846319)
  - systemctl: replace switch statement by table of structures (#846319)
  - systemctl: reindent table (#846319)
  - systemctl: Only wait when there's something to wait for. (#846319)
  - systemctl: clean up start_unit_one() error handling (#846319)
  - systemctl: split out extra args generation into helper function of its own (#846319)
  - systemctl: add new --show-transaction switch (#846319)
  - test: add some basic testing that "systemctl start -T" does something (#846319)
  - man: document the new systemctl --show-transaction option (#846319)
  - socket: New option 'FlushPending' (boolean) to flush socket before entering listening state (#1870638)
  - core: remove support for API bus "started outside our own logic" (#1764282)
  - mount-setup: fix segfault in mount_cgroup_controllers when using gcc9 compiler (#1868877)
  - dbus-execute: make transfer of CPUAffinity endian safe (#12711) (#1740657)
  - core: add support for setting CPUAffinity= to special "numa" value (#1740657)
  - basic/user-util: always use base 10 for user/group numbers (#1848373)
  - parse-util: sometimes it is useful to check if a string is a valid integer, but not actually parse it (#1848373)
  - basic/parse-util: add safe_atoux64() (#1848373)
  - parse-util: allow tweaking how to parse integers (#1848373)
  - parse-util: allow '-0' as alternative to '0' and '+0' (#1848373)
  - parse-util: make return parameter optional in safe_atou16_full() (#1848373)
  - parse-util: rewrite parse_mode() on top of safe_atou_full() (#1848373)
  - user-util: be stricter in parse_uid() (#1848373)
  - strv: add new macro STARTSWITH_SET() (#1848373)
  - parse-util: also parse integers prefixed with 0b and 0o (#1848373)
  - tests: beef up integer parsing tests (#1848373)
  - shared/user-util: add compat forms of user name checking functions (#1848373)
  - shared/user-util: emit a warning on names with dots (#1848373)
  - user-util: Allow names starting with a digit (#1848373)
  - shared/user-util: allow usernames with dots in specific fields (#1848373)
  - user-util: switch order of checks in valid_user_group_name_or_id_full() (#1848373)
  - user-util: rework how we validate user names (#1848373)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-43
changelog:
  - man: mention System Administrator's Guide in systemctl manpage (#1623116)
  - udev: introduce udev net_id "naming schemes" (#1827462)
  - meson: make net.naming-scheme= default configurable (#1827462)
  - man: describe naming schemes in a new man page (#1827462)
  - udev/net_id: parse _SUN ACPI index as a signed integer (#1827462)
  - udev/net_id: don't generate slot based names if multiple devices might claim the same slot (#1827462)
  - fix typo in ProtectSystem= option (#1871139)
  - remove references of non-existent man pages (#1876807)
  - log: Prefer logging to CLI unless JOURNAL_STREAM is set (#1865840)
  - locale-util: add new helper locale_is_installed() (#1755287)
  - test: add test case for locale_is_installed() (#1755287)
  - tree-wide: port various bits over to locale_is_installed() (#1755287)
  - install: allow instantiated units to be enabled via presets (#1812972)
  - install: small refactor to combine two function calls into one function (#1812972)
  - test: fix a memleak (#1812972)
  - docs: Add syntax for templated units to systemd.preset man page (#1812972)
  - shared/install: fix preset operations for non-service instantiated units (#1812972)
  - introduce setsockopt_int() helper (#1887181)
  - socket-util: add generic socket_pass_pktinfo() helper (#1887181)
  - core: add new PassPacketInfo= socket unit property (#1887181)
  - resolved: tweak cmsg calculation (#1887181)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-44
changelog:
  - ci: PowerTools repo was renamed to powertools in RHEL 8.3 (#1871827)
  - ci: use quay.io instead of Docker Hub to avoid rate limits (#1871827)
  - ci: move jobs from Travis CI to GH Actions (#1871827)
  - unit: make UNIT() cast function deal with NULL pointers (#1871827)
  - use link to RHEL-8 docs (#1623116)
  - cgroup: Also set blkio.bfq.weight (#1657810)
  - units: make sure initrd-cleanup.service terminates before switching to rootfs (#1657810)
  - core: reload SELinux label cache on daemon-reload (#1888912)
  - selinux: introduce mac_selinux_create_file_prepare_at() (#1888912)
  - selinux: add trigger for policy reload to refresh internal selabel cache (#1888912)
  - udev/net_id: give RHEL-8.4 naming scheme a name (#1827462)
  - basic/stat-util: make mtime check stricter and use entire timestamp (#1642728)
  - udev: make algorithm that selects highest priority devlink less susceptible to race conditions (#1642728)
  - test: create /dev/null in test-udev.pl (#1642728)
  - test: missing "die" (#1642728)
  - udev-test: remove a check for whether the test is run in a container (#1642728)
  - udev-test: skip the test only if it can't setup its environment (#1642728)
  - udev-test: fix test skip condition (#1642728)
  - udev-test: fix missing directory test/run (#1642728)
  - udev-test: check if permitted to create block device nodes (#1642728)
  - test-udev: add a testcase of too long line (#1642728)
  - test-udev: use proper semantics for too long line with continuation (#1642728)
  - test-udev: add more tests for line continuations and comments (#1642728)
  - test-udev: add more tests for line continuation (#1642728)
  - test-udev: fix alignment and drop unnecessary white spaces (#1642728)
  - test/udev-test.pl: cleanup if skipping test (#1642728)
  - test: add test cases for empty string match (#1642728)
  - test: add test case for multi matches when use "||" (#1642728)
  - udev-test: do not rely on "mail" group being defined (#1642728)
  - test/udev-test.pl: allow multiple devices per test (#1642728)
  - test/udev-test.pl: create rules only once (#1642728)
  - test/udev-test.pl: allow concurrent additions and removals (#1642728)
  - test/udev-test.pl: use computed devnode name (#1642728)
  - test/udev-test.pl: test correctness of symlink targets (#1642728)
  - test/udev-test.pl: allow checking multiple symlinks (#1642728)
  - test/udev-test.pl: fix wrong test descriptions (#1642728)
  - test/udev-test.pl: last_rule is unsupported (#1642728)
  - test/udev-test.pl: Make some tests a little harder (#1642728)
  - test/udev-test.pl: remove bogus rules from magic subsys test (#1642728)
  - test/udev-test.pl: merge "space and var with space" tests (#1642728)
  - test/udev-test.pl: merge import parent tests into one (#1642728)
  - test/udev-test.pl: count "good" results (#1642728)
  - tests/udev-test.pl: add multiple device test (#1642728)
  - test/udev-test.pl: add repeat count (#1642728)
  - test/udev-test.pl: generator for large list of block devices (#1642728)
  - test/udev-test.pl: suppress umount error message at startup (#1642728)
  - test/udev_test.pl: add "expected good" count (#1642728)
  - test/udev-test: gracefully exit when imports fail (#1642728)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-45
changelog:
  - Revert "test: add test cases for empty string match" and "test: add test case for multi matches when use ||" (#1935124)
  - test/sys-script.py: add missing DEVNAME entries to uevents (#1935124)
  - sd-event: split out helper functions for reshuffling prioqs (#1937315)
  - sd-event: split out enable and disable codepaths from sd_event_source_set_enabled() (#1937315)
  - sd-event: mention that two debug logged events are ignored (#1937315)
  - sd-event: split clock data allocation out of sd_event_add_time() (#1937315)
  - sd-event: split out code to add/remove timer event sources to earliest/latest prioq (#1937315)
  - sd-event: fix delays assert brain-o (#17790) (#1937315)
  - sd-event: let's suffix last_run/last_log with "_usec" (#1937315)
  - sd-event: refuse running default event loops in any other thread than the one they are default for (#1937315)
  - sd-event: ref event loop while in sd_event_prepare() ot sd_event_run() (#1937315)
  - sd-event: follow coding style with naming return parameter (#1937315)
  - sd-event: remove earliest_index/latest_index into common part of event source objects (#1937315)
  - sd-event: update state at the end in event_source_enable (#1937315)
  - sd-event: increase n_enabled_child_sources just once (#1937315)
  - sd-event: add ability to ratelimit event sources (#1937315)
  - test: add ratelimiting test (#1937315)
  - core: prevent excessive /proc/self/mountinfo parsing (#1937315)
  - udev: run link_update() with increased retry count in second invocation (#1935124)
  - pam-systemd: use secure_getenv() rather than getenv() (#1936866)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-46
changelog:
  - Revert "udev: run link_update() with increased retry count in second invocation" (#1942299)
  - Revert "udev: make algorithm that selects highest priority devlink less susceptible to race conditions" (#1942299)
  - test/udev-test.pl: drop test cases that add mutliple devices (#1942299)


author: Jan Macku <jamacku@redhat.com> - 239-47
changelog:
  - systemd-binfmt: Add safeguard in triggers (#1787144)
  - spec: Requires(post) openssl-libs to fix missing /etc/machine-id (#1947438)
  - spec: Go back to using systemctl preset-all in post (#1783263, #1647172, #1118740)
  - spec: Disable libiptc support (#1817265)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-48
changelog:
  - cgroup: Also set io.bfq.weight (#1927290)
  - seccomp: allow turning off of seccomp filtering via env var (#1916835)
  - meson: remove strange dep that causes meson to enter infinite loop (#1970860)
  - copy: handle copy_file_range() weirdness on procfs/sysfs (#1970860)
  - core: Hide "Deactivated successfully" message (#1954802)
  - util: rework in_initrd() to make use of path_is_temporary_fs() (#1959339)
  - initrd: extend SYSTEMD_IN_INITRD to accept non-ramfs rootfs (#1959339)
  - initrd: do a debug log if failed to detect rootfs type (#1959339)
  - initrd: do a debug log if /etc/initrd-release doesn't take effect (#1959339)
  - units: assign user-runtime-dir@.service to user-%i.slice (#1946453)
  - units: order user-runtime-dir@.service after systemd-user-sessions.service (#1946453)
  - units: make sure user-runtime-dir@.service is Type=oneshot (#1946453)
  - user-runtime-dir: downgrade a few log messages to LOG_DEBUG that we ignore (#1946453)
  - shared/install: Preserve escape characters for escaped unit names (#1952686)
  - basic/virt: Detect PowerVM hypervisor (#1937989)
  - man: document differences in clean exit status for Type=oneshot (#1940078)
  - busctl: add a timestamp to the output of the busctl monitor command (#1909214)
  - basic/cap-list: parse/print numerical capabilities (#1946943)
  - shared/mount-util: convert to libmount (#1885143)
  - mount-util: bind_remount: avoid calling statvfs (#1885143)
  - mount-util: use UMOUNT_NOFOLLOW in recursive umounter (#1885143)
  - test-install-root: create referenced targets (#1835351)
  - install: warn if WantedBy targets don't exist (#1835351)
  - test-install-root: add test for unknown WantedBy= target (#1835351)
  - ceph is a network filesystem (#1952013)
  - sysctl: set kernel.core_pipe_limit=16 (#1949729)
  - core: don't drop timer expired but not yet processed when system date is changed (#1899402)
  - core: Detect initial timer state from serialized data (#1899402)
  - rc-local: order after network-online.target (#1934028)
  - set core ulimit to 0 like on RHEL-7 (#1905582)
  - test-mountpointutil-util: do not assert in test_mnt_id() (#1910425)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-49
changelog:
  - remove a left-over break (#1970860)
  - basic/unit-name: do not use strdupa() on a path (#1974700)
  - sd-event: change ordering of pending/ratelimited events (#1968528)
  - sd-event: drop unnecessary "else" (#1968528)
  - sd-event: use CMP() macro (#1968528)
  - sd-event: use usec_add() (#1968528)
  - sd-event: make event_source_time_prioq_reshuffle() accept all event source type (#1968528)
  - sd-event: always reshuffle time prioq on changing online/offline state (#1968528)
  - ci: run unit tests on z-stream branches as well (#1970860)
  - ci: drop forgotten Travis references (#1934504)
  - ci: run unit tests on CentOS 8 Stream as well (#1934504)
  - ci: add missing test dependencies (#1934504)
  - meson: bump timeout for test-udev to 180s (#1934504)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-50
changelog:
  - Added option --check-inhibitors for non-tty usage (#1269726)
  - logind: Introduce RebootWithFlags and others (#1269726)
  - logind: add …WithFlags methods to policy (#1269726)
  - logind: simplify flags handling a bit (#1269726)
  - Update link to RHEL documentation (#1982584)
  - Set default core ulimit to 0, but keep the hard limit ulimited (#1905582)
  - shared/seccomp-util: address family filtering is broken on ppc (#1982650)
  - logind: rework Seat/Session/User object allocation and freeing a bit (#1642460)
  - logind: fix serialization/deserialization of user's "display session" (#1642460)
  - logind: turn of stdio locking when writing session files too (#1642460)
  - units: set StopWhenUnneeded= for the user slice units too (#1642460)
  - units: improve Description= string a bit (#1642460)
  - logind: improve logging in manager_connect_console() (#1642460)
  - logind: save/restore User object's "stopping" field during restarts (#1642460)
  - logind: correct bad clean-up path (#1642460)
  - logind: fix bad error propagation (#1642460)
  - logind: never elect a session that is stopping as display (#1642460)
  - logind: introduce little helper that checks whether a session is ready (#1642460)
  - logind: propagate session stop errors (#1642460)
  - logind: rework how we manage the slice and user-runtime-dir@.service unit for each user (#1642460)
  - logind: optionally, keep the user@.service instance for eached logged in user around for a while (#1642460)
  - logind: add a RequiresMountsFor= dependency from the session scope unit to the home directory of the user (#1642460)
  - logind: improve error propagation of user_check_linger_file() (#1642460)
  - logind: automatically GC lingering users for who now user@.service (nor slice, not runtime dir service) is running anymore (#1642460)
  - pam_systemd: simplify code which with we set environment variables (#1642460)
  - logind: validate /run/user/1000 before we set it (#1642460)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-53
changelog:
  - sd-hwdb: allow empty properties (#2005009)
  - Update hwdb (#2005009)
  - Disable libpitc to fix CentOS Stream CI (#2017033)
  - rpm: Fix typo in /usr/lib/environment.d (#2018024)
  - rpm: Add misspelled /usr/lib/environment.d macro for temporary compatibility (#2018024)
  - rpm: emit warning when macro with typo is used (#2018024)
  - Remove unintended additions to systemd-analyze man page (#2004765)
  - core: fix SIGABRT on empty exec command argv (#2020239)
  - core/service: also check path in exec commands (#2020239)
  - mount-util: fix fd_is_mount_point() when both the parent and directory are network fs (#2015057)
  - basic: add vmware hypervisor detection from device-tree (#1959150)
  - pam: do not require a non-expired password for user@.service (#1961746)
  - udev rules: add rule to create /dev/ptp_hyperv (#1991834)
  - process-util: explicitly handle processes lacking parents in get_process_ppid() (#1977569)
  - errno-util: add ERRNO_IS_PRIVILEGE() helper (#1977569)
  - procfs-util: fix confusion wrt. quantity limit and maximum value (#1977569)
  - test-process-util: also add EROFS to the list of "good" errors (#1977569)
  - journal: refresh cached credentials of stdout streams (#1931806)
  - util-lib: introduce HAS_FEATURE_ADDRESS_SANITIZER (#2017033)
  - ci: skip test-execute on GH Actions under ASan (#2017033)
  - test-seccomp: accept ENOSYS from sysctl(2) too (#2017033)
  - test: accept that char device 0/0 can now be created witout privileges (#2017033)
  - meson: do not fail if rsync is not installed with meson 0.57.2 (#2017033)
  - pid1: fix free of uninitialized pointer in unit_fail_if_noncanonical() (#1970945)
  - sd-event: take ref on event loop object before dispatching event sources (#1970945)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-54
changelog:
  - core: consider service with no start command immediately started (#1860899)
  - man: move description of *Action= modes to FailureAction=/SuccessAction= (#1860899)
  - core: define "exit" and "exit-force" actions for user units and only accept that (#1860899)
  - core: accept system mode emergency action specifiers with a warning (#1860899)
  - core: allow services with no commands but SuccessAction set (#1860899)
  - core: limit service-watchdogs=no to actual "watchdog" commands (#1860899)
  - units: use SuccessAction=exit-force in systemd-exit.service (#1860899)
  - units: use SuccessAction=reboot-force in systemd-reboot.service (#1860899)
  - units: use SuccessAction=poweroff-force in systemd-poweroff.service (#1860899)
  - units: allow and use SuccessAction=exit-force in system systemd-exit.service (#1860899)
  - core: do not "warn" about mundane emergency actions (#1860899)
  - core: return true from cg_is_empty* on ENOENT (#1860899)
  - macro: define HAS_FEATURE_ADDRESS_SANITIZER also on gcc (#2017033)
  - tests: add helper function to autodetect CI environments (#2017033)
  - strv: rework FOREACH_STRING() macro (#2017033)
  - test,systemctl: use "const char*" instead of "char*" (#2017033)
  - ci: pass the $GITHUB_ACTIONS variable to the CentOS container (#2017033)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-55
changelog:
  - lgtm: detect uninitialized variables using the __cleanup__ attribute (#2017033)
  - lgtm: replace the query used for looking for fgets with a more general query (#2017033)
  - lgtm: beef up list of dangerous/questionnable API calls not to make (#2017033)
  - lgtm: warn about strerror() use (#2017033)
  - lgtm: complain about accept() [people should use accept4() instead, due to O_CLOEXEC] (#2017033)
  - lgtm: don't treat the custom note as a list of tags (#2017033)
  - lgtm: ignore certain cleanup functions (#2017033)
  - lgtm: detect more possible problematic scenarios (#2017033)
  - lgtm: enable more (and potentially useful) queries (#2017033)
  - test: make TEST-47 less racy (#2017033)
  - core: rename unit_{start_limit|condition|assert}_test() to unit_test_xyz() (#2036608)
  - core: Check unit start rate limiting earlier (#2036608)
  - sd-event: introduce callback invoked when event source ratelimit expires (#2036608)
  - core: rename/generalize UNIT(u)->test_start_limit() hook (#2036608)
  - mount: make mount units start jobs not runnable if /p/s/mountinfo ratelimit is in effect (#2036608)
  - mount: retrigger run queue after ratelimit expired to run delayed mount start jobs (#2036608)
  - pid1: add a manager_trigger_run_queue() helper (#2036608)
  - unit: add jobs that were skipped because of ratelimit back to run_queue (#2036608)
  - Revert "Revert "sysctl: Enable ping(8) inside rootless Podman containers"" (#2037807)
  - sysctl: prefix ping port range setting with a dash (#2037807)
  - mount: don't propagate errors from mount_setup_unit() further up (#2036853)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-57
changelog:
  - udev/net_id: introduce naming scheme for RHEL-8.5 (#2039797)
  - udev/net_id: remove extraneous bracket (#2039797)
  - udev/net_id: introduce naming scheme for RHEL-8.6 (#2039797)
  - define newly needed constants (#2005008)
  - sd-netlink: support IFLA_PROP_LIST and IFLA_ALT_IFNAME attributes (#2005008)
  - sd-netlink: introduce sd_netlink_message_read_strv() (#2005008)
  - sd-netlink: introduce sd_netlink_message_append_strv() (#2005008)
  - test: add a test for sd_netlink_message_{append,read}_strv() (#2005008)
  - util: introduce ifname_valid_full() (#2005008)
  - rename function (#2005008)
  - udev: support AlternativeName= setting in .link file (#2005008)
  - network: make Name= in [Match] support alternative names of interfaces (#2005008)
  - udev: extend the length of ID_NET_NAME_XXX= to ALTIFNAMSIZ (#2005008)
  - udev: do not fail if kernel does not support alternative names (#2005008)
  - udev: introduce AlternativeNamesPolicy= setting (#2005008)
  - network: set AlternativeNamesPolicy= in 99-default.link (#2005008)
  - random-util: call initialize_srand() after fork() (#2005008)
  - sd-netlink: introduce rtnl_resolve_link_alternative_names() (#2005008)
  - udev: sort alternative names (#2005008)
  - netlink: introduce rtnl_get/delete_link_alternative_names() (#2005008)
  - netlink: do not fail when new interface name is already used as an alternative name (#2005008)
  - udev: do not try to reassign alternative names (#2005008)
  - Do not fail if the same alt. name is set again (#2005008)
  - mount: do not update exec deps on mountinfo changes (#2008825)
  - core/mount: add implicit unit dependencies even if when mount unit is generated from /proc/self/mountinfo (#2008825)
  - core: fix unfortunate typo in unit_is_unneeded() (#2040147)
  - core: make destructive transaction error a bit more useful (#2040147)
  - tmpfiles: use a entry in hashmap as ItemArray in read_config_file() (#1944468)
  - tmpfiles: rework condition check (#1944468)
  - TEST-22-TMPFILES: add reproducer for bug with X (#1944468)
  - core: make sure we don't get confused when setting TERM for a tty fd (#2045307)
  - hash-funcs: introduce macro to create typesafe hash_ops (#2037807)
  - hash-func: add destructors for key and value (#2037807)
  - util: define free_func_t (#2037807)
  - hash-funcs: make basic hash_ops typesafe (#2037807)
  - test: add tests for destructors of hashmap or set (#2037807)
  - man: document the new sysctl.d/ - prefix (#2037807)
  - sysctl: if options are prefixed with "-" ignore write errors (#2037807)
  - sysctl: fix segfault (#2037807)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-58
changelog:
  - ci: drop CentOS 8 CI (#2017033)
  - test: adapt to the new capsh format (#2017033)
  - test: ignore IAB capabilities in `test-execute` (#2017033)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-59
changelog:
  - core: disallow using '-.service' as a service name (#2051520)
  - shared/dropin: support -.service.d/ top level drop-in for service units (#2051520)
  - core: change top-level drop-in from -.service.d to service.d (#2051520)
  - shared/dropin: fix assert for invalid drop-in (#2051520)
  - udev: fix slot based network names on s390 (#1939914)
  - udev: it is not necessary that the path is readable (#1939914)
  - udev: allow onboard index up to 65535 (#1939914)
  - Revert "basic: use comma as separator in cpuset cgroup cpu ranges" (#1858220)
  - acpi-fpdt: mark structures as packed (#2047373)
  - core/slice: make slice_freezer_action() return 0 if freezing state is unchanged (#2047373)
  - core/unit: fix use-after-free (#2047373)
  - sd-bus: fix reference counter to be incremented (#2047373)
  - sd-bus: do not read unused value (#2047373)
  - sd-bus: do not return negative errno when unknown name is specified (#2047373)
  - sd-bus: switch to a manual overflow check in sd_bus_track_add_name() (#2047373)
  - spec: Add dependency on timedatex (#2066946)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-60
changelog:
  - unit: don't emit PropertiesChanged signal if adding a dependency to a unit is a no-op (#1948480)
  - tests: make inverted tests actually count (#2087152)
  - TEST-*: make failure tests actually fail on failure (#2087152)
  - ci(Mergify): configuration update (#2087152)
  - core: propagate triggered unit in more load states (#2065322)
  - core: propagate unit start limit hit state to triggering path unit (#2065322)
  - core: Move 'r' variable declaration to start of unit_start() (#2065322)
  - core: Delay start rate limit check when starting a unit (#2065322)
  - core: Propagate condition failed state to triggering units. (#2065322)
  - unit: check for mount rate limiting before checking active state (#2095744)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-61
changelog:
  - mkosi: Add gnutls package (#2101227)
  - unit-name: tighten checks for building valid unit names (#1940973)
  - core: shorten long unit names that are based on paths and append path hash at the end (#1940973)
  - test: add extended test for triggering mount rate limit (#1940973)
  - tests: add test case for long unit names (#1940973)
  - core: unset HOME=/ that the kernel gives us (#2056527)
  - journal-remote: check return value from MHD_add_response_header (#2051981)
  - journalctl: in --follow mode watch stdout for POLLHUP/POLLERR and exit (#2003236)
  - sd-bus: make BUS_DEFAULT_TIMEOUT configurable (#2039461)
  - fstab-generator: fix debug log (#2101433)
  - logind-session-dbus: allow to set display name via dbus (#1857969)
  - Allow restart for oneshot units (#2042896)
  - test: correct TEST-41 StartLimitBurst test (#2042896)
  - core: fix assert() about number of built environment variables (#2049788)
  - core: add one more assert() (#2049788)
  - strv: introduce strv_join_prefix() (#2049788)
  - test: add tests for strv_join_prefix() (#2049788)
  - test: replace swear words by 'hoge' (#2049788)
  - core: add new environment variable $RUNTIME_DIRECTORY= or friends (#2049788)
  - test-execute: add tests for $RUNTIME_DIRECTORY= or friends (#2049788)
  - man: document RUNTIME_DIRECTORY= or friends (#2049788)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-64
changelog:
  - ci: bump the worker Ubuntu version to Jammy (#2087152)
  - test: make test-execute pass on Linux 5.15 (#2087152)
  - ci: install iputils (#2087152)
  - ci(Mergify): Add `ci-waived` logic (#2087152)
  - sd-event: don't invalidate source type on disconnect (#2115396)
  - tests: make sure we delay running mount start jobs when /p/s/mountinfo is rate limited (#2095744)
  - core: drop references to 'StandardOutputFileToCreate' (#2093479)
  - dbus-execute: fix indentation (#2093479)
  - dbus-execute: generate the correct transient unit setting (#2093479)
  - bus-unit-util: properly accept StandardOutput=append:… settings (#2093479)
  - core: be more careful when inheriting stdout fds to stderr (#2093479)
  - test: add a test for StandardError=file:… (#2093479)
  - tree-wide: allow ASCII fallback for → in logs (#2093479)
  - tree-wide: allow ASCII fallback for … in logs (#2093479)
  - core: allow to set default timeout for devices (#1967245)
  - man: document DefaultDeviceTimeoutSec= (#1967245)
  - Revert "core: Propagate condition failed state to triggering units." (#2114005)
  - core: Check unit start rate limiting earlier (#2114005)
  - core: Add trigger limit for path units (#2114005)
  - meson: add syscall-names-update target (#2040247)
  - syscall-names: add process_madvise which is planned for 5.10 (#2040247)
  - shared: add @known syscall list (#2040247)
  - generate-syscall-list: require python3 (#2040247)
  - shared/seccomp: reduce scope of indexing variables (#2040247)
  - shared/syscall-list: filter out some obviously platform-specific syscalls (#2040247)
  - seccomp: tighten checking of seccomp filter creation (#2040247)
  - shared/seccomp-util: added functionality to make list of filtred syscalls (#2040247)
  - nspawn: return ENOSYS by default, EPERM for "known" calls (#2040247)
  - revert: resolved: pin stream while calling callbacks for it (#2110549)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-66
changelog:
  - Try stopping MD RAID devices in shutdown too (#1817706)
  - shutdown: get only active md arrays. (#1817706)
  - scope: allow unprivileged delegation on scopes (#2068575)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-67
changelog:
  - resolved: pin stream while calling callbacks for it (#2110549)
  - ci(functions): Add `useradd` and `userdel` (#2110549)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-69
changelog:
  - logind: optionally watch utmp for login data (#2122288)
  - logind: add hashtable for finding session by leader PID (#2122288)
  - core/load-fragment: move config_parse_sec_fix_0 to src/shared (#2122288)
  - sd-event: add relative timer calls (#2122288)
  - logind: add option to stop idle sessions after specified timeout (#2122288)
  - logind: schedule idle check full interval from now if we couldn't figure out atime timestamp (#2122288)
  - ci(lint): add shell linter - Differential ShellCheck (#2122499)
  - meson: do not compare objects of different types (#2122499)
  - journal-remote: use MHD_HTTP_CONTENT_TOO_LARGE as MHD_HTTP_PAYLOAD_TOO_LARGE is deprecated since 0.9.74 (#2122499)
  - Fix build with µhttpd 0.9.71 (#2122499)
  - ci: replace LGTM with CodeQL (#2122499)
  - ci(mergify): Update policy - Drop LGTM checks (#2122499)
  - time-util: fix buffer-over-run (#2139391)


author: yuanhui <yuanhui@linux.alibaba.com> - 239-78.0.3
changelog:
  - LifseaOS: Add back hostnamectl
  - LifseaOS: Add back timedatectl
  - LifseaOS: shared: Remove dependency of libcryptsetup if HAVE_LIBCRYPTSETUP is not defined
  - LifseaOS: analyze: show information from hostnamed in plot even when user mode
  - LifseaOS: configure: Disable smack
  - LifseaOS: Remove nss module provided by systemd
  - LifseaOS: configure: Remove multiple non-essential features
  - LifseaOS: configure: Disable firstboot
  - LifseaOS: Remove user-runtime-dir binary and service file
  - LifseaOS: Remove the dependency of acl package
  - LifseaOS: Remove locale and hostname related tools
  - LifseaOS: Remove multiple unnecessary modules
  - LifseaOS: Remove compression algorithm
  - LifseaOS: Remove many tools of little use
  - LifseaOS: Remove coredump tools
  - LifseaOS: configure: Disable cryptsetup
  - LifseaOS: configure: Disable polkit
  - LifseaOS: configure: Disable logind
  - LifseaOS: Remove systemd-pam module
  - LifseaOS: configure: Remove manpage and bash/zsh completion
  - LifseaOS: cgroup: Do not remove cgroup path which not created by systemd


author: zhongling.h <zhonglingh@linux.alibaba.com> - 239-78.0.4
changelog:
  - Remove patch 20002 as it inhibits systemd device cgroup slice creation
  - Add patch 20005 to enable device cgroup full delegation by default


author: Ondrej Dubaj <odubaj@redhat.com> - 1.30-6
changelog:
  - added "padding with zeros" info message (#1913566)
  - do not report disk error as file shrank (#1913569)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1:8.6.6-2
changelog:
  - Splitted documentation to the doc subpackage
    Resolves: rhbz#1380291
  - Fixed whitespace
  - Dropped obsoleted defattr


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1:8.6.8-2
changelog:
  - Reverted _module_build macro check which fixes systemtap probes on RHEL-8
    Resolves: rhbz#1579386


author: Petr Pisar <ppisar@redhat.com> - 1.8-1
changelog:
  - 1.8 bump
  - License changed from GPLv2+ to (GPLv3+ and GFDL)
  - Disable printing command failure in POSIX mode


author: Filipe Rosset <rosset.filipe@gmail.com> - 2.5-4
changelog:
  - Fixes rhbz #1476851 tmux bell-action other not working
  - Fixes rhbz #1476892 tmux update in F26 broke tmuxinator


author: Michal Schmidt <mschmidt@redhat.com> - 1.3.9-1
changelog:
  - Upstream release 1.3.9.
  - Add fixes for build errors with OpenSSL 1.1.
  - Add fixes for NULL cipher context use in seal/unseal.
  - spec file modernization.


author: Javier Martinez Canillas <javierm@redhat.com> - 2.0.0-1
changelog:
  - Download the distributed tarball instead of the source code tarball
  - Update URLs to point to the new project location
  - Update to 2.0.0 release


author: Jerry Snitselaar <jsnitsel@redhat.com> - 4.1.1-2
changelog:
  - Fix ESYS_TR hierarchy transition.
  - Refactor fix_esys_hierarchies to return actual TSS2_RC return code.
  - tpm2_alg_util.c: fix a bug where the string rsa3072 wasn't being parsed.
  - tpm2_create.c: Fix an issue where userwithauth attr cleared if policy specified.
  - tpm2_hierarchycontrol: Fix bug where hierarchycontrol operation failed silently.
  - tpm2_nvdefine.c: Fix error reporting message.
  - tpm2_policyor: Fix silent failure for invalid/unspecified policy digest alg.
  resolves: rhbz#1854774


author: Jerry Snitselaar <jsnitsel@redhat.com> - 4.1.1-3
changelog:
  - Fix resource leak.
  - Fix to restrict policy digest size.
  - Fix incompatible pointer cast.
  - Fix error message in files_load_##name
  - Fix issue where execution couldn't reach function return.
  resolves: rhbz#1920821


author: chench <chench@hygon.cn> -4.1.1-5.0.2
changelog:
  - Add gm support for all commands.
  - Add the gm API for tools library.
  - Add commands line arguments to support gm in some commands


author: chench <chench@hygon.cn> -4.1.1-5.0.3
changelog:
  - Add gm test case for all commands.
  - This patch tests all commands for gm support. Every script test a class of commands


author: Jerry Snitselaar <jsnitsel@redhat.com> - 2.3.2-3
changelog:
  - Add tss user if doesn't exist.
  - Update exported symbols map for libtss2-mu
  - esys: Check object handle node before calling compute_session_value
  - esys: fix resource name calculation
  - esys: fix Esys_StartAuthSession called with optional params
  - esys: fix keysize of ECC curve TPM2_ECC_NISTP224
  - esys: fixup compute_encrypted_salt error handling
  - esys: use memcmp in byte array comparison
  - esys: zero out ctx->salt after startAuthSession_finish
  - mu: Remove use of VLAs for Marshalling TPML types
  - return proper error code on memory allocation failure
  - sys: match counter variable type for cmdAuthsArray->count
  - tcti-device: getPollHandles should allow num_handles query
  - tctildr: fix segmentation fault if name_conf is too big
  resolves: rhbz#1879071 rhbz#1855180


author: Jerry Snitselaar <jsnitsel@redhat.com> - 2.3.2-4
changelog:
  - Fix hmac calculation for tpm2_clear command.
  - Remove private implementation of strndup.
  resolves: rhbz#1920825 rhbz#1940861


author: John Kacur <jkacur@redhat.com> - 2.7-8
changelog:
  - Install kernelshark manpage with kernelshark subpackage, not with trace-cmd
  Resolves: rhbz#1678252


author: Kamil Dudka <kdudka@redhat.com> - 1.7.0-11
changelog:
  - do not escape UTF-8 chars in file names by default in UTF-8 locale (#1480778)
  - modernize spec file (Group, BuildRoot, autosetup, clean, defattr)


author: Jerry Snitselaar <jsnitsel@redhat.com> - 0.3.15-1
changelog:
  - Rebase to 0.3.15
  - Fix CVE-2020-24330 CVE-2020-24331 CVE-2020-24332
  resolves: rhbz#1725782 rhbz#1877517 rhbz#1882402 rhbz#1882414


author: Leah Leshchinsky <lleshchi@redhat.com> - 0.17-2
changelog:
  - Fix typo for variable parm
  - Handle get_policy_and_rtprio exceptions
  - Remove finally block in get_policy_and_rtprio
  Resolves: rhbz#2049746


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.19.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2057602
    - fixed parsing of inline comments
      resolves: rhbz#2060138
    - added support for quotes in isolated_cores specification
      resolves: rhbz#1891036
    - recommend: preset balanced profile for notebook, laptop or portable if
      syspurpose is not defined
      resolves: rhbz#1896717


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2133814
    - systemd: relax polkit requirement
      resolves: rhbz#2065591
    - sysvinit: fixed path
    - plugin_cpu: added support for pm_qos_resume_latency_us
    - do not exit on duplicate config lines
      resolves: rhbz#2071418
    - profiles: new cpu-partitioning-powersave profile
    - profiles: new profile for AWS EC2
    - API: add support for moving devices between instances
    - D-Bus: send tracebacks through D-Bus only in debug mode
    - Makefile: added fix for python-3.12
    - throughput-performance: set net.core.somaxconn to at least 2048
      resolves: rhbz#1998310
    - plugin_scheduler: do not leak FDs from the perf
      resolves: rhbz#2080227
    - plugin_cpu: added support for intel_pstate scaling driver
    - added support for the API access through the Unix Domain Socket


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.21.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2182119
    - sap-hana: new profile sap-hana-kvm-guest
      resolves: rhbz#2173740
    - serialized SIGHUP handler to prevent possible bootcmdline corruption
      resolves: rhbz#2215298


author: Patsy Griffin <patsy@redhat.com> - 2022f-1
changelog:
  - Rebase to tzdata-2022f
    - Mexico will stop observing DST except near the US border.
    - Chihuahua moved to -06 year round starting on 2022-10-30.
    - Fiji no longer observes DST.


author: Patsy Griffin <patsy@redhat.com> - 2022g-1
changelog:
  - Rebase to tzdata-2022g
    - The northern edge of the Mexican state of Chihuahua will
      change time zone to agree with nearby US locations on
      2022-11-30.
    - Added a new Zone America/Ciudad_Juarez that splits from
      America/Ojinaga.


author: Patsy Griffin <patsy@redhat.com> - 2023a-1
changelog:
  - Rebase to tzdata-2023a
    - Egypt reintroduced DST, from April through October.
    - Morocco springs forward April 23, not April 30.
    - Palestine delayed the start of DST this year.


author: Patsy Griffin <patsy@redhat.com> - 2023d-1
changelog:
  - Rebase to tzdata-2023d
    - Include time zone changes for Ittoqqortoormiit, Greenland
      and Vostok, Antarctica.
    - Update the expiration date for the leap-seconds.list file.
      No new leap seconds were added.


author: Patsy Griffin <patsy@redhat.com> - 2024a-1
changelog:
  - Rebase to tzdata-2024a
    - Kazakhstan will transition from UTC+6 to UTC+5 on 2024-03-01.
    - Palestine will spring forward a week later than previously
      predicted.


author: Kamil Dudka <kdudka@redhat.com> - 2.17-5
changelog:
  - do not update currency.units from network during build
  - units_cur: validate rate data from server (#1598913)


author: Jakub Martisko <jamartis@redhat.com> - 6.0-38
changelog:
  - Fix CVE-2018-1000035 - heap based buffer overflow when opening
    password protected files.
    Resolves: 1537043


author: Jakub Martisko <jamartis@redhat.com> - 6.0-40
changelog:
  - fix several possibly unterminated strings
    When copying to OEM_CP and ISO_CP strings, the string could end unterminated
    (stncpy does not append '\0').
  - Related: #1602721


author: Miloslav Trmač <mitr@redhat.com> - 1.111-10
changelog:
  - Fix a FBFS with  -Werror=format-security
    Resolves #1444750
  - Fix inconsistent dates in %changelog


author: Jiri Kucera <jkucera@redhat.com> - 1.112-2
changelog:
  - Dropped need to run autotools
  - <sys/sysmacros.h> must be now included manually
    Resolves #1611752
  - Fixed bad FSF address


author: Jiri Kucera <jkucera@redhat.com> - 1.113-2
changelog:
  - Fix typo in pam-panel-icon manpage
    Do not use deprecated selinux API
    Do not use fexecve
    Resolves: #1775931


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.10.1-3
changelog:
  - Replace arch-dependent /usr/include/urcu/config.h with arch-independent
    stub when needed. (bz #1853168)
  - Added CI gating tests (bz #1682555)
  - Resolves: bz #1682555, #1853168


author: - Andy Walsh <awalsh@redhat.com> - 6.2.5.74-14
changelog:
  - Renamed vdo2LVM to vdopreparelvm and moved its installation location to
    /usr/libexec so that it is not in common default paths as this utility is
    intended to be called from LVM, not directly by users.
  - Related: rhbz#1986930


author: - Andy Walsh <awalsh@redhat.com> - 6.2.6.3-14
changelog:
  - Added a check to vdopreparelvm to determine whether it has already been
    converted.
  - Resolves: rhbz#2017843


author: - Andy Walsh <awalsh@redhat.com> - 6.2.6.7-14
changelog:
  - Fixed bugs in the vdopreparelvm check to determine whether a device has
    already been converted.
  - Resolves: rhbz#2017843
  - Fixed an issue in the vdo-by-dev tool which could result in a failure to
    start vdo devices when some devices in the vdo config file do not exist.
  - Resolves: rhbz#2022154


author: - Andy Walsh <awalsh@redhat.com> - 6.2.6.14-14
changelog:
  - Added a tool to make LVMVDO pools read/write so that support and
    debugging tools may access them.
  - Resolves: rhbz#1999640


author: - Andy Walsh <awalsh@redhat.com> - 6.2.7.17-14
changelog:
  - Fixed excessive vdo2lvm "Retrying" messages.
  - Resolves: rhbz#1986595
  - Fixed a pylint 2+ complaint in the vdo scripts.
  - Resolves: rhbz#2072131
  - Updated vdo script documentation and help text for the uuid option.
  - Resolves: rhbz#2089957


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - CVE-2021-4193 vim: vulnerable to Out-of-bounds Read
  - CVE-2021-4192 vim: vulnerable to Use After Free


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - CVE-2022-0261 vim: Heap-based Buffer Overflow in block_insert() in src/ops.c
  - CVE-2022-0318 vim: heap-based buffer overflow in utf_head_off() in mbyte.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - fix test suite after fix for CVE-2022-0318
  - CVE-2022-0359 vim: heap-based buffer overflow in init_ccline() in ex_getln.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - CVE-2022-0392 vim: heap-based buffer overflow in getexmodeline() in ex_getln.c
  - CVE-2022-0413 vim: use after free in src/ex_cmds.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-19.3
changelog:
  - CVE-2022-1785 vim: Out-of-bounds Write
  - CVE-2022-1897 vim: out-of-bounds write in vim_regsub_both() in regexp.c
  - CVE-2022-1927 vim: buffer over-read in utf_ptr2char() in mbyte.c


author: Richard W.M. Jones <rjones@redhat.com> - 0.5-17
changelog:
  - Remove ldconfig
    https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/SU3LJVDZ7LUSJGZR5MS72BMRAFP3PQQL/


author: Than Ngo <than@redhat.com> - 2.21-17
changelog:
  - Resolves: #2025709, check shell correctly 
  - Resolves: #2009547, which treats function contents as aliases when parsing ksh


author: Davide Caratti <dcaratti@redhat.com> - 1:2.9-2
changelog:
  - Fix AP mode PMF disconnection protection bypass (CVE-2019-16275)
  - Fix NULL dereference in d-bus handler when P2P control interface is removed (rh #1752780)
  - enable WIFI_DISPLAY (rh #1755941)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.9-3
changelog:
  - fix p2p_listen unexpectedly stopped after 5 seconds (rh #1693684)
  - allow changing 'bridge' via D-Bus (rh #1888050)
  - expose OWE configurability via D-Bus (rh #1888718)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.9-5
changelog:
  - P2P: Fix a corner case in peer addition based on PD Request (CVE-2021-27803)
  - Fix buffer overflow when processing P2P group information (CVE-2021-0326)


author: Pavel Reichl <preichl@redhat.com> - 3.1.8-5
changelog:
  - xfsrestore: Files from the backup go to orphanage dir because of xfsdump issue
  - related: bz#2055289


author: Pavel Reichl <preichl@redhat.com> - 3.1.8-6
changelog:
  - xfsdump: restoring inventory prevents non-directory files being restored from tape
  - related: bz#2166554


author: Russell Cattelan <cattelan@thebarn.com> - 2.2.38-2
changelog:
  - install removes the makefile installed version of the docs
  	package the docs based in the version specfic directory


author: Russell Cattelan <cattelan@thebarn.com> - 2.2.38-3
changelog:
  - Fix the /usr/sbin sym links to relative links
  - Add the Distribution tag
  - Add ncurses-devel to buildrequires


author: Pavel Reichl <preichl@redhat.com> - 3.1.8-7
changelog:
  - xfsdump/xfsrestore: suggest recovery for false roots may be possible using -x
  - Related: RHEL-14494


author: Bill O'Donnell <billodo@redhat.com> 5.0.0-6
changelog:
  - xfs_repair: improve AG btree ptr validation (libxfs_verify_agbno) (#1887288)
  - mkfs.xfs: fix ASSERT on too-small device with stripe geometry (#1887401)
  - xfs_repair: fix rebuilding btree block less than minrecs (#1759452)


author: Bill O'Donnell <billodo@redhat.com> 5.0.0-7
changelog:
  - xfs_quota: document how the default quota is stored (#1850188)
  - xfs_db: skip type change if type_f unchanged (#1867474)


author: Pavel Reichl <preichl@redhat.com> - 5.0.0-11
changelog:
  - Fix xfstest fails with error "missing xfsprogs fix patch"(#2161936,#2160746)
  - Fix ignore autofs mount table entries (#2182361)


author: Pavel Reichl <preichl@redhat.com> - 5.0.0-12
changelog:
  - Fix xfs_repair progress reporting is not working (#2183398)
  - Fix man page default for sparse mkfs option (#2118564)


author: liuzhilin <liuzhilin@uniontech.com> - 5.0.0-12.0.1
changelog:
  - Fix gcc10 -fno-common compile issue for compatible with gcc10 build
  - Add atomic write support (joseph.qi@linux.aliabba.com)
  - mkfs: don't trample the gid set in the protofile (hongnan.li@linux.alibaba.com)
  - Add doc sub package (fanhangbo.fhb@alibaba-inc.com)
  - Add fsck log replay support (joseph.qi@linux.aliabba.com)
  - mkfs.xfs: terminate getsubopt arrays properly (mengferry@linux.alibaba.com)
  - mkfs.xfs: fix internal logs' size (mengferry@linux.alibaba.com)
  - xfs_repair: ignore empty xattr leaf blocks (mengferry@linux.alibaba.com)


author: Rob Crittenden <rcritten@redhat.com> - 1.51.0-7
changelog:
  - lib: Prevent more integer overflows (CVE-2022-22822 to CVE-2022-22827)
    (#2058567, #2058576, #2058582, #2058589, #2058595, #2058602)
  - Prevent integer overflow on m_groupSize in doProlog
    (CVE-2021-46143) (#2058560)


author: Pavel Raiskup <praiskup@redhat.com> - 5.2.4-1
changelog:
  - rebase to 5.2.4 (rhbz#1574039), per release notes:
    https://www.mail-archive.com/xz-devel@tukaani.org/msg00295.html


author: Pavel Raiskup <praiskup@redhat.com> - 5.2.4-2
changelog:
  - drop ppc64p7 hack, per fedora devel list discussion:
    https://lists.fedoraproject.org/archives/list/
    devel@lists.fedoraproject.org/thread/2OWD2QRDFBEC6HTPVQ7FMJENH32BWT54/
  - don't explicitly set _FILE_OFFSET_BITS, package uses AC_SYS_LARGEFILE


author: Jakub Martisko <jamartis@redhat.com> - 3.0-22
changelog:
  - Add missing linker flags
  - Port the configure patch from unzip that allows linker flags configuration
    from the spec file
  - Related: #1624188


author: Jakub Martisko <jamartis@redhat.com> - 3.0-23
changelog:
  - Set the ziperr function as noreturn
  - Fix email in the previous chnagelog entry
  - Related: #1602741


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-17
changelog:
  - Fixed DFLTCC compression level switching issues (#1875492)
  - Enabled HW compression for compression levels 1 through 6 (#1847438)
  - Fixed inflateSyncPoint() bad return value on z15 (#1888930)


author: Lukas Javorsky <ljavorsk@redhat.com> - 1.2.11-19
changelog:
  - Apply IBM patch for compressBound() function
  - Source from https://github.com/madler/zlib/issues/410#issuecomment-947212824
  - Resolves: #2056900


author: Matej Mužila <mmuzila@redhat.com> - 1.2.11-20
changelog:
  - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c
  - Resolves: CVE-2022-37434


author: Lukas Javorsky <ljavorsk@redhat.com> - 1.2.11-23
changelog:
  - Rebased Power 8 optimization patches
  - Fix for Unnecessary IFUNC resolver for crc32_z
  - Fix for python3.11 broken libxml2 and lxml on s390x


