# changelog

author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-49
changelog:
  - Additional support for keepalived running in a namespace
  Resolves: rhbz#1815281
  - Allow keepalived manage its private type runtime directories
  Resolves: rhbz#1815281
  - Run ipa_helper_noatsecure(oddjob_t) only if the interface exists
  Resolves: rhbz#1853432
  - Allow oddjob_t process noatsecure permission for ipa_helper_t
  Resolves: rhbz#1853432
  - Allow domain dbus chat with systemd-resolved
  Resolves: rhbz#1852378
  - Define file context for /var/run/netns directory only
  Related: rhbz#1815281


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-50
changelog:
  - Revert "Allow qemu-kvm read and write /dev/mapper/control"
  This reverts commit f948eaf3d010215fc912e42013e4f88870279093.
  - Allow smbd get attributes of device files labeled samba_share_t
  Resolves: rhbz#1851816
  - Allow tomcat read user temporary files
  Resolves: rhbz#1857675
  - Revert "Dontaudit and disallow sys_admin capability for keepalived_t domain"
  Resolves: rhbz#1815281
  - Label /tmp/krb5_0.rcache2 with krb5_host_rcache_t
  Resolves: rhbz#1848953
  - Allow auditd manage kerberos host rcache files
  Resolves: rhbz#1855770


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-51
changelog:
  - Allow kadmind manage kerberos host rcache
  Resolves: rhbz#1863043
  - Allow virtlockd only getattr and lock block devices
  Resolves: rhbz#1832756
  - Allow qemu-ga read all non security file types conditionally
  Resolves: rhbz#1747960
  - Allow virtlockd manage VMs posix file locks
  Resolves: rhbz#1832756
  - Add dev_lock_all_blk_files() interface
  Resolves: rhbz#1832756
  - Allow systemd-logind dbus chat with fwupd
  Resolves: rhbz#1851932
  - Update xserver_rw_session macro
  Resolves: rhbz#1851448


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-52
changelog:
  - Add ipa_helper_noatsecure() interface unconditionally
  Resolves: rhbz#1853432
  - Conditionally allow nagios_plugin_domain dbus chat with init
  Resolves: rhbz#1750821
  - Revert "Update allow rules set for nrpe_t domain"
  Resolves: rhbz#1750821
  - Add ipa_helper_noatsecure() interface to ipa.if
  Resolves: rhbz#1853432
  - Allow tomcat map user temporary files
  Resolves: rhbz#1857675
  - Allow tomcat manage user temporary files
  Resolves: rhbz#1857675
  - Add file context for /sys/kernel/tracing
  Resolves: rhbz#1847331
  - Define named file transition for sshd on /tmp/krb5_0.rcache2
  Resolves: rhbz#1848953


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-53
changelog:
  - Allow certmonger fowner capability
  Resolves: rhbz#1870596
  - Define named file transition for saslauthd on /tmp/krb5_0.rcache2
  Resolves: rhbz#1870300
  - Label /usr/libexec/qemu-pr-helper with virtd_exec_t
  Resolves: rhbz#1867115


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-55
changelog:
  - Allow init dbus chat with kernel
  Resolves: rhbz#1694681
  - Confine systemd-sleep service
  Resolves: rhbz#1850177
  - Add default file context for /usr/libexec/pcp/lib/*
  Resolves: rhbz#1886369
  - Allow rtkit_daemon_t to uise sys_ptrace usernamespace capability
  Resolves: rhbz#1873658
  - Add fstools_rw_swap_files() interface
  Resolves: rhbz#1850177


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-56
changelog:
  - Let keepalived bind a raw socket
  Resolves: rhbz#1895130
  - Add fetchmail_uidl_cache_t type for /var/mail/.fetchmail.pid
  Resolves: rhbz#1853389
  - Allow arpwatch create and use rdma socket
  Resolves: rhbz#1843409
  - Set correct default file context for /usr/libexec/pcp/lib/*
  Resolves: rhbz#1886369
  - Allow systemd-logind manage efivarfs files
  Resolves: rhbz#1869979
  - Allow systemd_resolved_t to read efivarfs
  Resolves: rhbz#1869979
  - Allow systemd_modules_load_t to read efivarfs
  Resolves: rhbz#1869979
  - Allow read efivarfs_t files by domains executing systemctl file
  Resolves: rhbz#1869979
  - Introduce systemd_read_efivarfs_type attribute
  Resolves: rhbz#1869979


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-57
changelog:
  - Allow dovecot bind to smtp ports
  Resolves: rhbz#1881884
  - Change fetchmail temporary files path to /var/spool/mail
  Resolves: rhbz#1853389
  - Set file context for symlinks in /etc/httpd to etc_t
  Resolves: rhbz#1900650
  - Allow dnsmasq read public files
  Resolves: rhbz#1782539
  - Fix range for unreserved ports
  Resolves: rhbz#1794531
  - Introduce logging_syslogd_append_public_content tunable
  Resolves: rhbz#1823672
  - Add files_search_non_security_dirs() interface
  Resolves: rhbz#1823672
  - Add miscfiles_append_public_files() interface
  Resolves: rhbz#1823672


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-58
changelog:
  - Allow kexec manage generic tmp files
  Resolves: rhbz#1896424
  - Update systemd-sleep policy
  Resolves: rhbz#1850177
  - Add groupadd_t fowner capability
  Resolves: rhbz#1884179


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-59
changelog:
  - Add cron_dbus_chat_system_job() interface
  Resolves: rhbz#1883906
  - Dontaudit firewalld dac_override capability
  Resolves: rhbz#1759010
  - Allow tcsd the setgid capability
  Resolves: rhbz#1898694
  - Allow timedatex dbus chat with cron system domain
  Resolves: rhbz#1883906
  - Allow systemd_hostnamed_t domain to dbus chat with sosreport_t domain
  Resolves: rhbz#1854299
  - Allow pcp-pmcd manage perf_events
  Resolves: rhbz#1901958
  - Label /dev/isst_interface as cpu_device_t
  Resolves: rhbz#1902227
  - Allow ipsec set the context of a SPD entry to the default context
  Resolves: rhbz#1880474
  - Allow sysadm_u user and unconfined_domain_type manage perf_events
  Resolves: rhbz#1901958
  - Add manage_perf_event_perms object permissions set
  Resolves: rhbz#1901958
  - Add perf_event access vectors.
  Resolves: rhbz#1901958
  - Remove "ipa = module" from modules-targeted-contrib.conf
  Resolves: rhbz#1461914


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-60
changelog:
  - Allow wireshark create and use rdma socket
  Resolves: rhbz#1844370
  - Allow to use nnp_transition in pulseaudio_role
  Resolves: rhbz#1854471
  - Allow certmonger fsetid capability
  Resolves: rhbz#1873211
  - Add rsync_sys_admin tunable to allow rsync sys_admin capability
  Resolves: rhbz#1889673
  - Allow sysadm read and write /dev/rfkill
  Resolves: rhbz#1831630
  - Allow staff_u run pam_console_apply
  Resolves: rhbz#1817690
  - Label /dev/vhost-vdpa-[0-9]+ as vhost_device_t
  Resolves: rhbz#1907485


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-61
changelog:
  - Add kpatch_exec() interface
  Resolves: rhbz#1895322
  - Allow rhsmcertd execute kpatch
  Resolves: rhbz#1895322
  - Allow openvswitch_t perf_event open permission
  Resolves: rhbz#1916046
  - Allow openvswitch fowner capability and create netlink sockets
  Resolves: rhbz#1883980
  - Add net_broadcast capability to openvswitch_t domain
  Resolves: rhbz#1883980
  - Update interface modutils_read_module_deps to allow caller domain also mmap modules_dep_t files
  Resolves: rhbz#1883980
  - Allow machinectl to run pull-tar
  Resolves: rhbz#1788055


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-62
changelog:
  - Allow rhsmcertd_t domain transition to kpatch_t
  Resolves: rhbz#1895322
  - Revert "Add kpatch_exec() interface"
  Resolves: rhbz#1895322
  - Revert "Allow rhsmcertd execute kpatch"
  Resolves: rhbz#1895322
  - Dontaudit NetworkManager_t domain to write to kdump temp pipies
  Resolves: rhbz#1842897
  - Allow NetworkManager_t domain to get status of samba services
  Resolves: rhbz#1781806
  - Allow openvswitch create and use xfrm netlink sockets
  Resolves: rhbz#1916046
  - Allow openvswitch_t perf_event write permission
  Resolves: rhbz#1916046
  - Add write_perf_event_perms object permission set
  Related: rhbz#1916046


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-63
changelog:
  - Allow rtkit_daemon_t domain set process nice value in user namespaces
  Resolves: rhbz#1910507
  - Allow gpsd read and write ptp4l_t shared memory.
  Resolves: rhbz#1803845
  - Label /var/run/pcsd-ruby.socket socket with cluster_var_run_t type
  Resolves: rhbz#1804626
  - Allow Certmonger to use opencryptoki services
  Resolves: rhbz#1894132
  - Dontaudit vhostmd to write in /var/lib/rpm/ dir and allow signull rpm
  Resolves: rhbz#1815603
  - Allow rhsmcertd_t read kpatch lib files
  Resolves: rhbz#1895322
  - Allow ipsec_t connectto ipsec_mgmt_t
  Resolves: rhbz#1848355
  - Allow IPsec to use opencryptoki services
  Resolves: rhbz#1894132
  - Allow systemd-importd create /run/systemd/machines.lock file
  Resolves: rhbz#1788055


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-64
changelog:
  - Allow unconfined_t and kprop_t to create krb5_0.rcache2 with the right context
  Resolves: rhbz#1874527
  Resolves: rhbz#1877044
  - Allow rhsmcertd bind tcp sockets to a generic node
  Resolves: rhbz#1923985
  - Allow ipsec_mgmt_t mmap ipsec_conf_file_t files
  Resolves: rhbz#1889542
  - Allow strongswan start using swanctl method
  Resolves: rhbz#1889542
  - Allow systemd-importd manage machines.lock file
  Resolves: rhbz#1788055


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-68
changelog:
  - Allow pluto IKEv2 / ESP over TCP
  Resolves: rhbz#1931848
  - Label SDC(scini) Dell Driver
  Resolves: rhbz#1936882
  - Add file context specification for /var/tmp/tmp-inst
  Resolves: rhbz#1919253
  - Allow virtlogd_t to create virt_var_lockd_t dir
  Resolves: rhbz#1941464
  - Allow cups-lpd read its private runtime socket files
  Resolves: rhbz#1919399


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-69
changelog:
  - Add /var/usrlocal equivalency rule
  Resolves: rhbz#1943381
  - Label '/var/usrlocal/(.*/)?sbin(/.*)?' as bin_t
  Resolves: rhbz#1943381
  - Label /dev/trng with random_device_t
  Resolves: rhbz#1934483
  - Allow systemd-sleep transition to sysstat_t
  Resolves: rhbz#1927551
  - Allow systemd-sleep transition to tlp_t
  Resolves: rhbz#1927551
  - Allow systemd-sleep transition to unconfined_service_t on bin_t executables
  Resolves: rhbz#1927551
  - Allow systemd-sleep execute generic programs
  Resolves: rhbz#1948070
  - Allow systemd-sleep execute shell
  Resolves: rhbz#1954358
  - Allow nsswitch_domain read init pid lnk_files
  Resolves: rhbz#1860924
  - Introduce logging_syslogd_list_non_security_dirs tunable
  Resolves: rhbz#1823669
  - Add sysstat_domtrans() to allow systemd-sleep transition to sysstat_t
  Resolves: rhbz#1927551
  - Change param description in cron interfaces to userdomain_prefix
  Resolves: rhbz#1801249
  - Add missing declaration in rpm_named_filetrans()
  Resolves: rhbz#1801249


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-70
changelog:
  - Allow using opencryptoki for ipsec
  Resolves: rhbz#1894132
  - Remove all kernel_getattr_proc() interface calls
  Resolves: rhbz#1967125
  - Allow domain stat /proc filesystem
  Resolves: rhbz#1967125
  - Allow pkcs-slotd create and use netlink_kobject_uevent_socket
  Resolves: rhbz#1969725
  - Label var.lib.opencryptoki.* files and create pkcs_tmpfs_filetrans()
  Resolves: rhbz#1894132
  - Allow using opencryptoki for certmonger
  Resolves: rhbz#1894132
  - install_t: Allow NoNewPriv transition from systemd
  Resolves: rhbz#1955547
  - Remove all kernel_getattr_proc() interface calls
  Resolves: rhbz#1967125
  - Allow httpd_sys_script_t read, write, and map hugetlbfs files
  Resolves: rhbz#1966133


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-71
changelog:
  - Allow nmap create and use rdma socket
  Resolves: rhbz#1844530
  - Label /.k5identity file allow read of this file to rpc.gssd
  Resolves: rhbz#1951093
  - Label /var/lib/kdump with kdump_var_lib_t
  Resolves: rhbz#1965985
  - Label /run/libvirt/common with virt_common_var_run_t
  Resolves: rhbz#1966842


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-72
changelog:
  - Allow systemd-sleep get attributes of fixed disk device nodes
  Resolves: rhbz#1931460
  - Allow systemd-sleep create hardware state information files
  Resolves: rhbz#1968610
  - virtiofs supports Xattrs and SELinux
  Resolves: rhbz#1899703
  - Label 4460/tcp port as ntske_port_t
  Resolves: rhbz#1961207
  - Add the miscfiles_map_generic_certs macro to the sysnet_dns_name_resolve macro.
  Resolves: rhbz#1961207
  - Allow chronyd_t to accept and make NTS-KE connections
  Resolves: rhbz#1961207
  - Dontaudit NetworkManager write to initrc_tmp_t pipes
  Resolves: rhbz#1963162
  - Allow logrotate rotate container log files
  Resolves: rhbz#1892170
  - Allow rhsmd read process state of all domains and kernel threads
  Resolves: rhbz#1878020


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-73
changelog:
  - Removed adding to attribute unpriv_userdomain from userdom_unpriv_type template
  Resolves: rhbz#1947841
  - Allow transition from xdm domain to unconfined_t domain.
  Resolves: rhbz#1947841
  - Allow nftables read NetworkManager unnamed pipes
  Resolves: rhbz#1967857
  - Create a policy for systemd-journal-upload
  Resolves: rhbz#1913414
  - Add dev_getattr_infiniband_dev() interface.
  Resolves: rhbz#1972522
  - Allow tcpdump and nmap get attributes of infiniband_device_t
  Resolves: rhbz#1972522
  - Allow fcoemon create sysfs files
  Resolves: rhbz#1978562
  - Allow nftables read NetworkManager unnamed pipes
  Resolves: rhbz#1967857
  - Allow radius map its library files
  Resolves: rhbz#1854650
  - Allow arpwatch get attributes of infiniband_device_t devices
  Resolves: rhbz#1936522


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-75
changelog:
  - Add the unconfined_dgram_send() interface
  Resolves: rhbz#1978562
  - Change dev_getattr_infiniband_dev() to use getattr_chr_files_pattern()
  Resolves: rhbz#1936522
  - Add checkpoint_restore cap2 capability
  Resolves: rhbz#1973325
  - Allow fcoemon talk with unconfined user over unix domain datagram socket
  Resolves: rhbz#1978562
  - Allow hostapd bind UDP sockets to the dhcpd port
  Resolves: rhbz#1977676
  - Allow NetworkManager read and write z90crypt device
  Resolves: rhbz#1938203
  - Allow abrt_domain read and write z90crypt device
  Resolves: rhbz#1938203
  - Label /usr/lib/pcs/pcs_snmp_agent with cluster_exec_t
  Resolves: rhbz#1937111
  - Allow mdadm read iscsi pid files
  Resolves: rhbz#1924716


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-76
changelog:
  - Allow login_userdomain read and map /var/lib/systemd files
  Resolves: rhbz#1965251
  - Allow sysadm acces to kernel module resources
  Resolves: rhbz#1965251
  - Allow sysadm to read/write scsi files and manage shadow
  Resolves: rhbz#1965251
  - Allow sysadm access to files_unconfined and bind rpc ports
  Resolves: rhbz#1965251
  - Allow sysadm read and view kernel keyrings
  Resolves: rhbz#1965251
  - Allow bootloader to read tuned etc files
  Resolves: rhbz#1965251
  - Update the policy for systemd-journal-upload
  Resolves: rhbz#1913414
  - Allow journal mmap and read var lib files
  Resolves: rhbz#1965251
  - Allow tuned to read rhsmcertd config files
  Resolves: rhbz#1965251
  - Allow bootloader to read tuned etc files
  Resolves: rhbz#1965251
  - Confine rhsm service and rhsm-facts service as rhsmcertd_t
  Resolves: rhbz#1846081
  - Allow virtlogd_t read process state of user domains
  Resolves: rhbz#1797899
  - Allow cockpit_ws_t get attributes of fs_t filesystems
  Resolves: rhbz#1979182


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-77
changelog:
  - Revert "update libs_filetrans_named_content() to have support for /usr/lib/debug directory"
  Resolves: rhbz#1887739
  - Allow sysadm to read/write scsi files and manage shadow
  Resolves: rhbz#1956302
  - Allow rhsmcertd execute gpg
  Resolves: rhbz#1887572
  - Allow lldpad send to kdump over a unix dgram socket
  Resolves: rhbz#1979121
  - Remove glusterd SELinux module from distribution policy
  Resolves: rhbz#1816718


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-78
changelog:
  - Label /usr/bin/Xwayland with xserver_exec_t
  Resolves: rhbz#1984584
  - Label /usr/libexec/gdm-runtime-config with xdm_exec_t
  Resolves: rhbz#1984584
  - Allow D-bus communication between avahi and sosreport
  Resolves: rhbz#1916397
  - Allow lldpad send to kdumpctl over a unix dgram socket
  Resolves: rhbz#1979121
  - Revert "Allow lldpad send to kdump over a unix dgram socket"
  Resolves: rhbz#1979121
  - Allow chronyc respond to a user chronyd instance
  Resolves: rhbz#1993104
  - Allow ptp4l respond to pmc
  Resolves: rhbz#1993104
  - Allow lldpad send to unconfined_t over a unix dgram socket
  Resolves: rhbz#1993270


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-79
changelog:
  - Introduce xdm_manage_bootloader booelan
  Resolves: rhbz#1994096
  - Rename samba_exec() to samba_exec_net()
  Resolves: rhbz#1855215
  - Allow sssd to set samba setting
  Resolves: rhbz#1855215
  - Allow dirsrv read slapd tmpfs files
  Resolves: rhbz#1843238
  - Allow rhsmcertd to create cache file in /var/cache/cloud-what
  Resolves: rhbz#1994718


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-81
changelog:
  - Allow unconfined domains to bpf all other domains
  Resolves: rhbz#1991443
  - Allow vmtools_unconfined_t domain transition to rpm_script_t
  Resolves: rhbz#1872245
  - Allow unbound connectto unix_stream_socket
  Resolves: rhbz#1905441
  - Label /usr/sbin/virtproxyd as virtd_exec_t
  Resolves: rhbz#1854332
  - Allow postfix_domain to sendto unix dgram sockets.
  Resolves: rhbz#1920521


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-82
changelog:
  - Support sanlock VG automated recovery on storage access loss
  Resolves: rhbz#1985000
  - Allow proper function sosreport in sysadmin role
  Resolves: rhbz#1965251
  - Allow systemd execute user bin files
  Resolves: rhbz#1860443
  - Label /dev/crypto/nx-gzip with accelerator_device_t
  Resolves: rhbz#2011166
  - Allow ipsec_t and login_userdomain named file transition in tmpfs
  Resolves: rhbz#2001599
  - Support sanlock VG automated recovery on storage access loss
  Resolves: rhbz#1985000
  - Allow proper function sosreport via iotop
  Resolves: rhbz#1965251
  - Call pkcs_tmpfs_named_filetrans for certmonger
  Resolves: rhbz#2001599
  - Allow ibacm the net_raw and sys_rawio capabilities
  Resolves: rhbz#2010644
  - Support new PING_CHECK health checker in keepalived
  Resolves: rhbz#2010873
  - Update spamassasin policy to make working /usr/share/spamassassin/sa-update.cron script
  Resolves: rhbz#2011239


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-83
changelog:
  - VQP: Include IANA-assigned TCP/1589
  Resolves: rhbz#1924038
  - Label port 3785/udp with bfd_echo
  Resolves: rhbz#1924038
  - Allow sysadm_t dbus chat with realmd_t
  Resolves: rhbz#2000488
  - Support sanlock VG automated recovery on storage access loss 1/2
  Resolves: rhbz#1985000
  - Revert "Support sanlock VG automated recovery on storage access loss"
  Resolves: rhbz#1985000
  - Support sanlock VG automated recovery on storage access loss
  Resolves: rhbz#1985000
  - radius: Lexical sort of service-specific corenet rules by service name
  Resolves: rhbz#1924038
  - radius: Allow binding to the BDF Control and Echo ports
  Resolves: rhbz#1924038
  - radius: Allow binding to the DHCP client port
  Resolves: rhbz#1924038
  - radius: Allow net_raw; allow binding to the DHCP server ports
  Resolves: rhbz#1924038
  - Support hitless reloads feature in haproxy
  Resolves: rhbz#2015423
  - Allow redis get attributes of filesystems with extended attributes
  Resolves: rhbz#2015435
  - Support sanlock VG automated recovery on storage access loss 2/2
  Resolves: rhbz#1985000
  - Revert "Support sanlock VG automated recovery on storage access loss"
  Resolves: rhbz#1985000


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-84
changelog:
  - Allow sysadm_t read/write pkcs shared memory segments
  Resolves: rhbz#1965251
  - Allow sysadm_t connect to sanlock over a unix stream socket
  Resolves: rhbz#1965251
  - Allow sysadm_t dbus chat with sssd
  Resolves: rhbz#1965251
  - Allow sysadm_t set attributes on character device nodes
  Resolves: rhbz#1965251
  - Allow sysadm_t read and write watchdog devices
  Resolves: rhbz#1965251
  - Allow sysadm_t connect to cluster domains over a unix stream socket
  Resolves: rhbz#1965251
  - Allow sysadm_t dbus chat with tuned 2/2
  Resolves: rhbz#1965251
  - Update userdom_exec_user_tmp_files() with an entrypoint rule
  Resolves: rhbz#1920883
  - Allow sudodomain send a null signal to sshd processes
  Resolves: rhbz#1966945
  - Allow sysadm_t dbus chat with tuned 1/2
  Resolves: rhbz#1965251
  - Allow cloud-init dbus chat with systemd-logind
  Resolves: rhbz#2009769
  - Allow svnserve send mail from the system
  Resolves: rhbz#2004843
  - Allow svnserve_t domain to read system state
  Resolves: rhbz#2004843


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-85
changelog:
  - Allow unconfined_t to node_bind icmp_sockets in node_t domain
  Resolves: rhbz#2025445
  - Allow rhsmcertd get attributes of tmpfs_t filesystems
  Resolves: rhbz#2015820
  - The nfsdcld service is now confined by SELinux
  Resolves: rhbz#2026588
  - Allow smbcontrol use additional socket types
  Resolves: rhbz#2027740
  - Allow lldpd use an snmp subagent over a tcp socket
  Resolves: rhbz#2028379


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-86
changelog:
  - Allow sysadm execute sysadmctl in sysadm_t domain using sudo
  Resolves: rhbz#2013749
  - Allow local_login_t get attributes of tmpfs filesystems
  Resolves: rhbz#2015539
  - Allow local_login_t get attributes of filesystems with ext attributes
  Resolves: rhbz#2015539
  - Allow local_login_t domain to getattr cgroup filesystem
  Resolves: rhbz#2015539
  - Allow systemd read unlabeled symbolic links
  Resolves: rhbz#2021835
  - Allow userdomains use pam_ssh_agent_auth for passwordless sudo
  Resolves: rhbz#1917879
  - Allow sudodomains execute passwd in the passwd domain
  Resolves: rhbz#1943572
  - Label authcompat.py with authconfig_exec_t
  Resolves: rhbz#1919122
  - Dontaudit pkcsslotd sys_admin capability
  Resolves: rhbz#2021887
  - Allow lldpd connect to snmpd with a unix domain stream socket
  Resolves: rhbz#1991029


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-87
changelog:
  - Set default file context for /sys/firmware/efi/efivars
  Resolves: rhbz#2039458
  - Allow sysadm_t start and stop transient services
  Resolves: rhbz#2031065
  - Label /etc/cockpit/ws-certs.d with cert_t
  Resolves: rhbz#1907473
  - Allow smbcontrol read the network state information
  Resolves: rhbz#2033873
  - Allow rhsm-service read/write its private memfd: objects
  Resolves: rhbz#2029873
  - Allow fcoemon request the kernel to load a module
  Resolves: rhbz#1940317
  - Allow radiusd connect to the radacct port
  Resolves: rhbz#2038955
  - Label /var/lib/shorewall6-lite with shorewall_var_lib_t
  Resolves: rhbz#2041447
  - Exclude container.if from selinux-policy-devel
  Resolves: rhbz#1861968


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-89
changelog:
  - Allow NetworkManager talk with unconfined user over unix domain dgram socket
  Resolves: rhbz#2044048
  - Allow system_mail_t read inherited apache system content rw files
  Resolves: rhbz#1988339
  - Add apache_read_inherited_sys_content_rw_files() interface
  Related: rhbz#1988339
  - Allow rhsm-service execute its private memfd: objects
  Resolves: rhbz#2029873
  - Allow dirsrv read configfs files and directories
  Resolves: rhbz#2042568
  - Label /run/stratisd with stratisd_var_run_t
  Resolves: rhbz#1879585
  - Fix path for excluding container.if from selinux-policy-devel
  Resolves: rhbz#1861968


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-90
changelog:
  - Fix badly indented used interfaces
  Resolves: rhbz#2030156
  - Allow domain transition to sssd_t 1/2
  Resolves: rhbz#2022690
  - Allow confined users to use kinit,klist and etc.
  Resolves: rhbz#2026598
  - Allow login_userdomain open/read/map system journal
  Resolves: rhbz#2046481
  - Allow init read stratis data symlinks 2/2
  Resolves: rhbz#2048514
  - Label new utility of NetworkManager nm-priv-helper
  Resolves: rhbz#1986076
  - Label NetworkManager-dispatcher service with separate context
  Resolves: rhbz#1989070
  - Allow domtrans to sssd_t and role access to sssd
  Resolves: rhbz#2030156
  - Creating interface sssd_run_sssd()
  Resolves: rhbz#2030156
  - Allow domain transition to sssd_t 2/2
  Resolves: rhbz#2022690
  - Allow timedatex dbus chat with xdm
  Resolves: rhbz#2040214
  - Associate stratisd_data_t with device filesystem
  Resolves: rhbz#2048514
  - Allow init read stratis data symlinks 1/2
  Resolves: rhbz#2048514
  - Allow rhsmcertd create rpm hawkey logs with correct label
  Resolves: rhbz#1949871


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-92
changelog:
  - Allow postfix_domain read dovecot certificates 1/2
  Resolves: rhbz#2043599
  - Dontaudit dirsrv search filesystem sysctl directories 1/2
  Resolves: rhbz#2042568
  - Allow chage domtrans to sssd
  Resolves: rhbz#2054718
  - Allow postfix_domain read dovecot certificates 2/2
  Resolves: rhbz#2043599
  - Allow ctdb create cluster logs
  Resolves: rhbz#2049481
  - Allow alsa bind mixer controls to led triggers
  Resolves: rhbz#2049730
  - Allow alsactl set group Process ID of a process
  Resolves: rhbz#2049730
  - Dontaudit mdadm list dirsrv tmpfs dirs
  Resolves: rhbz#2011174
  - Dontaudit dirsrv search filesystem sysctl directories 2/2
  Resolves: rhbz#2042568
  - Revert "Label NetworkManager-dispatcher service with separate context"
  Related: rhbz#1989070
  - Revert "Allow NetworkManager-dispatcher dbus chat with NetworkManager"
  Related: rhbz#1989070


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-93
changelog:
  - Allow systemd-networkd dbus chat with sosreport
  Resolves: rhbz#1949493
  - Allow sysadm_passwd_t to relabel passwd and group files
  Resolves: rhbz#2053457
  - Allow confined sysadmin to use tool vipw
  Resolves: rhbz#2053457
  - Allow sosreport dbus chat with abrt and timedatex
  Resolves: rhbz#1949493
  - Remove unnecessary /etc file transitions for insights-client
  Resolves: rhbz#2031853
  - Label all content in /var/lib/insights with insights_client_var_lib_t
  Resolves: rhbz#2031853
  - Update insights-client policy
  Resolves: rhbz#2031853
  - Update insights-client: fc pattern, motd, writing to etc
  Resolves: rhbz#2031853
  - Remove permissive domain for insights_client_t
  Resolves: rhbz#2031853
  - New policy for insight-client
  Resolves: rhbz#2031853
  - Add the insights_client module
  Resolves: rhbz#2031853
  - Update specfile to buildrequire policycoreutils-devel >= 2.9-19
  - Add modules_checksum to %files


author: Nikola Knazekova nknazeko@redhat.com - 3.14.3-94
changelog:
  - Allow chronyd send a message to sosreport over datagram socket
  - Allow systemd-logind dbus chat with sosreport
  Resolves: rhbz#2062607


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-96
changelog:
  - Add interface rpc_manage_exports
  Resolves: rhbz#2062183
  - Allow sshd read filesystem sysctl files
  Resolves: rhbz#2061403
  - Update targetd nfs & lvm
  Resolves: rhbz#2062183
  - Allow dhcpd_t domain to read network sysctls.
  Resolves: rhbz#2059509
  - Allow chronyd talk with unconfined user over unix domain dgram socket
  Resolves: rhbz#2065313
  - Allow fenced read kerberos key tables
  Resolves: rhbz#1964839


author: Nikola Knazekova <nknazeko@redhat.com> - 3.14.3-97
changelog:
  - Create macro corenet_icmp_bind_generic_node()
  Resolves: rhbz#2070870
  - Allow traceroute_t and ping_t to bind generic nodes.
  Resolves: rhbz#2070870
  - Allow administrative users the bpf capability
  Resolves: rhbz#2070983
  - Allow insights-client search rhnsd configuration directory
  Resolves: rhbz#2073395
  - Allow ntlm_auth read the network state information
  Resolves: rhbz#2073349
  - Allow keepalived setsched and sys_nice
  Resolves: rhbz#2008033
  - Revert "Allow administrative users the bpf capability"
  Resolves: rhbz#2070983


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-98
changelog:
  - Allow sysadm user execute init scripts with a transition
  Resolves: rhbz#2039662
  - Change invalid type redisd_t to redis_t in redis_stream_connect()
  Resolves: rhbz#1897517
  - Allow php-fpm write access to /var/run/redis/redis.sock
  Resolves: rhbz#1897517
  - Allow sssd read systemd-resolved runtime directory
  Resolves: rhbz#2060721
  - Allow postfix stream connect to cyrus through runtime socket
  Resolves: rhbz#2066005
  - Allow insights-client create_socket_perms for tcp/udp sockets
  Resolves: rhbz#2073395
  - Allow insights-client read rhnsd config files
  Resolves: rhbz#2073395
  - Allow sblim-sfcbd connect to sblim-reposd stream
  Resolves: rhbz#2075810
  - Allow rngd drop privileges via setuid/setgid/setcap
  Resolves: rhbz#2076641
  - Allow rngd_t domain to use nsswitch
  Resolves: rhbz#2076641


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-99
changelog:
  - Allow ifconfig_t domain to manage vmware logs
  Resolves: rhbz#1721943
  - Allow insights-client manage gpg admin home content
  Resolves: rhbz#2060834
  - Add the gpg_manage_admin_home_content() interface
  Resolves: rhbz#2060834
  - Label /var/cache/insights with insights_client_cache_t
  Resolves: rhbz#2063195
  - Allow insights-client search gconf homedir
  Resolves: rhbz#2087069
  - Allow insights-client create and use unix_dgram_socket
  Resolves: rhbz#2087069
  - Label more vdsm utils with virtd_exec_t
  Resolves: rhbz#2063871
  - Label /usr/libexec/vdsm/supervdsmd and vdsmd with virtd_exec_t
  Resolves: rhbz#2063871
  - Allow sblim-gatherd the kill capability
  Resolves: rhbz#2082677
  - Allow privoxy execmem
  Resolves: rhbz#2083940


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-100
changelog:
  - Update logging_create_generic_logs() to use create_files_pattern()
  Resolves: rhbz#2081907
  - Add the auth_read_passwd_file() interface
  Resolves: rhbz#2083504
  - Allow auditd_t noatsecure for a transition to audisp_remote_t
  Resolves: rhbz#2081907
  - Add support for samba-dcerpcd
  Resolves: rhbz#2083504
  - Allow rhsmcertd create generic log files
  Resolves: rhbz#1852086
  - Allow ctdbd nlmsg_read on netlink_tcpdiag_socket
  Resolves: rhbz#2090800


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-101
changelog:
  - Add the init_status_config_transient_files() interface
  Resolves: rhbz#2091117
  - Allow init_t to rw insights_client unnamed pipe
  Resolves: rhbz#2091117
  - Update kernel_read_unix_sysctls() for sysctl_net_unix_t handling
  Resolves: rhbz#2091117
  - Allow insights-client get status of the systemd transient scripts
  Resolves: rhbz#2091117
  - Allow insights-client execute its private memfd: objects
  Resolves: rhbz#2091117
  - Update policy for insights-client to run additional commands 2
  Resolves: rhbz#2091117
  - Do not call systemd_userdbd_stream_connect() for insights-client
  Resolves: rhbz#2091117
  - Use insights_client_tmp_t instead of insights_client_var_tmp_t
  Resolves: rhbz#2091117
  - Change space indentation to tab in insights-client
  Resolves: rhbz#2091117
  - Use socket permissions sets in insights-client
  Resolves: rhbz#2091117
  - Update policy for insights-client to run additional commands
  Resolves: rhbz#2091117
  - Change rpm_setattr_db_files() to use a pattern
  Resolves: rhbz#2091117
  - Add rpm setattr db files macro
  Resolves: rhbz#2091117
  - Fix insights client
  Resolves: rhbz#2091117
  - Do not let system_cronjob_t create redhat-access-insights.log with var_log_t
  Resolves: rhbz#2091117


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-102
changelog:
  - Allow transition to insights_client named content
  Resolves: rhbz#2091117
  - Add the insights_client_filetrans_named_content() interface
  Resolves: rhbz#2091117
  - Update policy for insights-client to run additional commands 3
  Resolves: rhbz#2091117


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-103
changelog:
  - Allow domain read usermodehelper state information
  Resolves: rhbz#2083504
  - Remove all kernel_read_usermodehelper_state() interface calls
  Resolves: rhbz#2083504
  - Allow samba-dcerpcd work with sssd
  Resolves: rhbz#2096825
  - Allow winbind_rpcd_t connect to self over a unix_stream_socket
  Resolves: rhbz#2096825
  - Update samba-dcerpcd policy for kerberos usage
  Resolves: rhbz#2096825
  - Allow keepalived read the contents of the sysfs filesystem
  Resolves: rhbz#2098189
  - Update policy for samba-dcerpcd
  Resolves: rhbz#2083504
  - Remove all kernel_read_usermodehelper_state() interface calls 2/2
  Resolves: rhbz#2083504
  - Update insights_client_filetrans_named_content()
  Resolves: rhbz#2091117


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-105
changelog:
  - Do not call systemd_userdbd_stream_connect() for winbind-rpcd
  Resolves: rhbz#2108383
  - Update winbind_rpcd_t
  Resolves: rhbz#2108383
  - Allow irqbalance file transition for pid sock_files and directories
  Resolves: rhbz#2111916
  - Update irqbalance runtime directory file context
  Resolves: rhbz#2111916


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-106
changelog:
  - Allow networkmanager to signal unconfined process
  Resolves: rhbz#1918148
  - Allow sa-update to get init status and start systemd files
  Resolves: rhbz#2011239
  - Allow samba-bgqd get a printer list
  Resolves: rhbz#2114737
  - Allow insights-client rpm named file transitions
  Resolves: rhbz#2104913
  - Add /var/tmp/insights-archive to insights_client_filetrans_named_content
  Resolves: rhbz#2104913
  - Use insights_client_filetrans_named_content
  Resolves: rhbz#2104913
  - Make default file context match with named transitions
  Resolves: rhbz#2104913
  - Allow rhsmcertd to read insights config files
  Resolves: rhbz#2104913
  - Label /etc/insights-client/machine-id
  Resolves: rhbz#2104913


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-107
changelog:
  - Label 319/udp port with ptp_event_port_t
  Resolves: rhbz#2118628
  - Allow unconfined and sysadm users transition for /root/.gnupg
  Resolves: rhbz#2119507
  - Add the kernel_read_proc_files() interface
  Resolves: rhbz#2119507
  - Add userdom_view_all_users_keys() interface
  Resolves: rhbz#2119507
  - Allow system_cronjob_t domtrans to rpm_script_t
  Resolves: rhbz#2118362
  - Allow smbd_t process noatsecure permission for winbind_rpcd_t
  Resolves: rhbz#2117199
  - Allow chronyd bind UDP sockets to ptp_event ports
  Resolves: rhbz#2118628
  - Allow samba-bgqd to read a printer list
  Resolves: rhbz#2118958
  - Add gpg_filetrans_admin_home_content() interface
  Resolves: rhbz#2119507
  - Update insights-client policy for additional commands execution
  Resolves: rhbz#2119507
  - Allow gpg read and write generic pty type
  Resolves: rhbz#2119507
  - Allow chronyc read and write generic pty type
  Resolves: rhbz#2119507
  - Disable rpm verification on interface_info
  Resolves: rhbz#2119472


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-108
changelog:
  - Allow unconfined_service_t insights client content filetrans
  Resolves: rhbz#2119507
  - Allow nsswitch_domain to connect to systemd-machined using a unix socket
  Resolves: rhbz#2119507
  - Add init_status_all_script_files() interface
  Resolves: rhbz#2119507
  - Add dev_dontaudit_write_raw_memory() and dev_read_vsock() interfaces
  Resolves: rhbz#2119507
  - Update insights-client policy for additional commands execution 5
  Resolves: rhbz#2119507
  - Confine insights-client systemd unit
  Resolves: rhbz#2119507
  - Update insights-client policy for additional commands execution 4
  Resolves: rhbz#2119507
  - Change rhsmcertd_t to insights_client_t in insights-client policy
  Resolves: rhbz#2119507
  - Allow insights-client send signull to unconfined_service_t
  Resolves: rhbz#2119507
  - Update insights-client policy for additional commands execution 3
  Resolves: rhbz#2119507
  - Allow journalctl read init state
  Resolves: rhbz#2119507
  - Update insights-client policy for additional commands execution 2
  Resolves: rhbz#2119507


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-109
changelog:
  - Add the files_map_read_etc_files() interface
  Resolves: rhbz#2132230
  - Allow insights-client manage samba var dirs
  Resolves: rhbz#2132230
  - Allow insights-client send null signal to rpm and system cronjob
  Resolves: rhbz#2132230
  - Update rhcd policy for executing additional commands 4
  Resolves: rhbz#2132230
  - Allow insights-client connect to postgresql with a unix socket
  Resolves: rhbz#2132230
  - Allow insights-client domtrans on unix_chkpwd execution
  Resolves: rhbz#2132230
  - Add file context entries for insights-client and rhc
  Resolves: rhbz#2132230
  - Allow snmpd_t domain to trace processes in user namespace
  Resolves: rhbz#2121084
  - Allow sbd the sys_ptrace capability
  Resolves: rhbz#2124552
  - Allow pulseaudio create gnome content (~/.config)
  Resolves: rhbz#2124387


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-110
changelog:
  - Add the systemd_connectto_socket_proxyd_unix_sockets() interface
  Resolves: rhbz#208441
  - Add the dev_map_vhost() interface
  Resolves: rhbz#2122920
  - Allow init remount all file_type filesystems
  Resolves: rhbz#2122239
  - added policy for systemd-socket-proxyd
  Resolves: rhbz#2088441
  - Allow virt_domain map vhost devices
  Resolves: rhbz#2122920
  - Allow virt domains to access xserver devices
  Resolves: rhbz#2122920
  - Allow rotatelogs read httpd_log_t symlinks
  Resolves: rhbz#2030633
  - Allow vlock search the contents of the /dev/pts directory
  Resolves: rhbz#2122838
  - Allow system cronjobs dbus chat with setroubleshoot
  Resolves: rhbz#2125008
  - Allow ptp4l_t name_bind ptp_event_port_t
  Resolves: rhbz#2130168
  - Allow pcp_domain execute its private memfd: objects
  Resolves: rhbz#2090711
  - Allow samba-dcerpcd use NSCD services over a unix stream socket
  Resolves: rhbz#2121709
  - Allow insights-client manage samba var dirs
  Resolves: rhbz#2132230


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-111
changelog:
  - Add domain_unix_read_all_semaphores() interface
  Resolves: rhbz#2141311
  - Allow iptables list cgroup directories
  Resolves: rhbz#2134820
  - Allow systemd-hostnamed dbus chat with init scripts
  Resolves: rhbz#2111632
  - Allow systemd to read symlinks in /var/lib
  Resolves: rhbz#2118784
  - Allow insights-client domain transition on semanage execution
  Resolves: rhbz#2141311
  - Allow insights-client create gluster log dir with a transition
  Resolves: rhbz#2141311
  - Allow insights-client manage generic locks
  Resolves: rhbz#2141311
  - Allow insights-client unix_read all domain semaphores
  Resolves: rhbz#2141311
  - Allow winbind-rpcd use the terminal multiplexor
  Resolves: rhbz#2107106
  - Allow mrtg send mails
  Resolves: rhbz#2103675
  - Allow sssd dbus chat with system cronjobs
  Resolves: rhbz#2132922
  - Allow postfix/smtp and postfix/virtual read kerberos key table
  Resolves: rhbz#1983308


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-112
changelog:
  - Allow ipsec_t only read tpm devices
  Resolves: rhbz#2147380
  - Allow ipsec_t read/write tpm devices
  Resolves: rhbz#2147380
  - Label udf tools with fsadm_exec_t
  Resolves: rhbz#1972230
  - Allow the spamd_update_t domain get generic filesystem attributes
  Resolves: rhbz#2144501
  - Allow cdcc mmap dcc-client-map files
  Resolves: rhbz#2144505
  - Allow insights client communicate with cupsd, mysqld, openvswitch, redis
  Resolves: rhbz#2143878
  - Allow insights client read raw memory devices
  Resolves: rhbz#2143878
  - Allow winbind-rpcd get attributes of device and pty filesystems
  Resolves: rhbz#2107106
  - Allow postfix/smtpd read kerberos key table
  Resolves: rhbz#1983308


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-113
changelog:
  - Allow systemd-socket-proxyd get attributes of cgroup filesystems
  Resolves: rhbz#2088441
  - Allow systemd-socket-proxyd get filesystems attributes
  Resolves: rhbz#2088441
  - Allow sysadm read ipmi devices
  Resolves: rhbz#2148561
  - Allow system mail service read inherited certmonger runtime files
  Resolves: rhbz#2143337
  - Add lpr_roles  to system_r roles
  Resolves: rhbz#2151111
  - Allow insights-client tcp connect to various ports
  Resolves: rhbz#2151111
  - Allow insights-client work with pcp and manage user config files
  Resolves: rhbz#2151111
  - Allow insights-client dbus chat with various services
  Resolves: rhbz#2152867
  - Allow insights-client dbus chat with abrt
  Resolves: rhbz#2152867
  - Allow redis get user names
  Resolves: rhbz#2112228
  - Add winbind-rpcd to samba_enable_home_dirs boolean
  Resolves: rhbz#2143696


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-114
changelog:
  - Add interfaces in domain, files, and unconfined modules
  Resolves: rhbz#2141311
  - Allow sysadm_t read/write ipmi devices
  Resolves: rhbz#2148561
  - Allow sudodomain use sudo.log as a logfile
  Resolves: rhbz#2143762
  - Add insights additional capabilities
  Resolves: rhbz#2158779
  - Allow insights client work with gluster and pcp
  Resolves: rhbz#2141311
  - Allow prosody manage its runtime socket files
  Resolves: rhbz#2157902
  - Allow system mail service read inherited certmonger runtime files
  Resolves: rhbz#2143337
  - Add lpr_roles  to system_r roles
  Resolves: rhbz#2151111


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-115
changelog:
  - Fix syntax problem in redis.te
  Resolves: rhbz#2112228
  - Allow unconfined user filetransition for sudo log files
  Resolves: rhbz#2164047
  - Allow winbind-rpcd make a TCP connection to the ldap port
  Resolves: rhbz#2152642
  - Allow winbind-rpcd manage samba_share_t files and dirs
  Resolves: rhbz#2152642
  - Allow insights-client work with su and lpstat
  Resolves: rhbz#2134125
  - Allow insights-client read nvme devices
  Resolves: rhbz#2143878
  - Allow insights-client tcp connect to all ports
  Resolves: rhbz#2143878
  - Allow redis-sentinel execute a notification script
  Resolves: rhbz#2112228


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-116
changelog:
  - Allow sysadm_t run initrc_t script and sysadm_r role access
  Resolves: rhbz#2039662
  - Allow insights-client manage fsadm pid files
  Resolves: rhbz#2166802
  - Add journalctl the sys_resource capability
  Resolves: rhbz#2136189


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-117
changelog:
  - Fix opencryptoki file names in /dev/shm
  Resolves: rhbz#2028637
  - Allow system_cronjob_t transition to rpm_script_t
  Resolves: rhbz#2154242
  - Revert "Allow system_cronjob_t domtrans to rpm_script_t"
  Resolves: rhbz#2154242
  - Allow httpd work with tokens in /dev/shm
  Resolves: rhbz#2028637
  - Allow keepalived to set resource limits
  Resolves: rhbz#2168638
  - Allow insights-client manage fsadm pid files


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-118
changelog:
  - Allow login_pgm setcap permission
  Resolves: rhbz#2172541
  - Label /run/fsck with fsadm_var_run_t
  Resolves: rhbz#2184348
  - Add boolean qemu-ga to run unconfined script
  Resolves: rhbz#2028762
  - Allow dovecot-deliver write to the main process runtime fifo files
  Resolves: rhbz#2170495
  - Allow certmonger dbus chat with the cron system domain
  Resolves: rhbz#2173289
  - Allow insights-client read all sysctls
  Resolves: rhbz#2177607


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-119
changelog:
  - Add unconfined_server_read_semaphores() interface
  Resolves: rhbz#2183351
  - Allow systemd-pstore read kernel persistent storage files
  Resolves: rhbz#2181558
  - Add fs_read_pstore_files() interface
  Resolves: rhbz#2181558
  - Allow insights-client work with teamdctl
  Resolves: rhbz#2185158
  - Allow insights-client read unconfined service semaphores
  Resolves: rhbz#2183351
  - Allow insights-client get quotas of all filesystems
  Resolves: rhbz#2183351


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-120
changelog:
  - Allow unconfined service inherit signal state from init
  Resolves: rhbz#2177254
  - Allow systemd-pstore delete kernel persistent storage files
  Resolves: rhbz#2181558
  - Add fs_delete_pstore_files() interface
  Resolves: rhbz#2181558
  - Allow certmonger manage cluster library files
  Resolves: rhbz#2177836
  - Allow samba-rpcd work with passwords
  Resolves: rhbz#2107106
  - Allow snmpd read raw disk data
  Resolves: rhbz#2160000
  - Allow cluster_t dbus chat with various services
  Resolves: rhbz#2196524


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-121
changelog:
  - Update pkcsslotd policy for sandboxing 2/2
  Resolves: rhbz#2208162
  - Update pkcsslotd policy for sandboxing 1/2
  Resolves: rhbz#2208162
  - Allow abrt_t read kernel persistent storage files
  Resolves: rhbz#2207914
  - Add allow rules for lttng-sessiond domain
  Resolves: rhbz#2203509
  - Allow rpcd_lsad setcap and use generic ptys
  Resolves: rhbz#2107106
  - Allow samba-dcerpcd connect to systemd_machined over a unix socket
  Resolves: rhbz#2107106
  - Dontaudit targetd search httpd config dirs
  Resolves: rhbz#2203720


author: Nikola Knazekova <nknazeko@redhat.com> - 3.14.3-122
changelog:
  - Update cyrus_stream_connect() to use sockets in /run
  Resolves: rhbz#2165752
  - Allow insights-client map generic log files
  Resolves: rhbz#2214572
  - Allow insights-client work with pipe and socket tmp files
  Resolves: rhbz#2207819
  - Allow insights-client getsession process permission
  Resolves: rhbz#2207819
  - Allow keepalived to manage its tmp files
  Resolves: rhbz#2179335


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-123
changelog:
  - Label only /usr/sbin/ripd and ripngd with zebra_exec_t
  Resolves: rhbz#2213606
  - Allow httpd tcp connect to redis port conditionally
  Resolves: rhbz#2213965
  - Exclude container-selinux manpage from selinux-policy-doc
  Resolves: rhbz#2218362


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-124
changelog:
  - Add the files_getattr_non_auth_dirs() interface
  Resolves: rhbz#2076937
  - Update policy for the sblim-sfcb service
  Resolves: rhbz#2076937
  - Dontaudit sfcbd sys_ptrace cap_userns
  Resolves: rhbz#2076937
  - Label /usr/sbin/sos with sosreport_exec_t
  Resolves: rhbz#2167731
  - Allow sa-update manage spamc home files
  Resolves: rhbz#2222200
  - Allow sa-update connect to systemlog services
  Resolves: rhbz#2222200
  - Label /usr/lib/systemd/system/mimedefang.service with antivirus_unit_file_t
  Resolves: rhbz#2222200


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-125
changelog:
  - Allow user_u and staff_u get attributes of non-security dirs
  Resolves: rhbz#2216151
  - Allow unconfined user filetrans chrome_sandbox_home_t 1/2
  Resolves: rhbz#2221573
  - Allow unconfined user filetrans chrome_sandbox_home_t 2/2
  Resolves: rhbz#2221573
  - Allow insights-client execmem
  Resolves: rhbz#2225233
  - Allow svnserve execute postdrop with a transition
  Resolves: rhbz#2004843
  - Do not make postfix_postdrop_t type an MTA executable file
  Resolves: rhbz#2004843
  - Allow samba-dcerpc service manage samba tmp files
  Resolves: rhbz#2210771
  - Update samba-dcerpc policy for printing
  Resolves: rhbz#2210771


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-126
changelog:
  - Allow cloud_init create dhclient var files and init_t manage net_conf_t 1/2
  Resolves: rhbz#2229726
  - Label /usr/libexec/openssh/ssh-pkcs11-helper with ssh_agent_exec_t
  Resolves: rhbz#2177704
  - Allow cloud_init create dhclient var files and init_t manage net_conf_t 2/2
  Resolves: rhbz#2229726
  - Make insights_client_t an unconfined domain
  Resolves: rhbz#2225527
  - Allow insights-client create all rpm logs with a correct label
  Resolves: rhbz#2229559
  - Allow insights-client manage generic logs
  Resolves: rhbz#2229559


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-128
changelog:
  - Allow ssh_agent_type manage generic cache home files
  Resolves: rhbz#2177704
  - Add chromium_sandbox_t setcap capability
  Resolves: rhbz#2221573


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-129
changelog:
  - Set default file context of /var/lib/authselect/backups to <<none>>
  Resolves: RHEL-3539
  - Add file context specification for /usr/libexec/realmd
  Resolves: RHEL-2147
  - Add numad the ipc_owner capability
  Resolves: RHEL-2415


author: Lukas Vrabec <lvrabec@redhat.com> - 3.14.3-130
changelog:
  - Label msmtp and msmtpd with sendmail_exec_t
  Resolves: RHEL-1678
  - Set default file context of HOME_DIR/tmp/.* to <<none>>
  Resolves: RHEL-1099
  - Improve default file context(None) of /var/lib/authselect/backups
  Resolves: RHEL-3539


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-131
changelog:
  - Additional permissions for ip-vrf
  Resolves: RHEL-9981
  - Allow ip an explicit domain transition to other domains
  Resolves: RHEL-9981
  - Allow  winbind_rpcd_t processes access when samba_export_all_* is on
  Resolves: RHEL-5845
  - Allow system_mail_t manage exim spool files and dirs
  Resolves: RHEL-14186


author: Nikita Sanjay Patwa <npatwa@redhat.com> - 3.14.3-139.2
changelog:
  - Label /etc/redis.conf with redis_conf_t
  Resolves: RHEL-95750
  - Allow nfsd_t domain setuid and setgid capability for rpc.mountd
  Resolves: RHEL-148243


author: Vit Mojzis <vmojzis@redhat.com> - 4.2.1-3
changelog:
  - Use 
    CFLAGS="${CFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CFLAGS ; 
    CXXFLAGS="${CXXFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CXXFLAGS ; 
    FFLAGS="${FFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib64/gfortran/modules}" ; export FFLAGS ; 
    FCFLAGS="${FCFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib64/gfortran/modules}" ; export FCFLAGS ; 
    LDFLAGS="${LDFLAGS:--Wl,-z,relro  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld}" ; export LDFLAGS instead of -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection


author: Vit Mojzis <vmojzis@redhat.com> - 4.3.0-1
changelog:
  - SETools 4.3.0 release (#1820079)
  - Revised sediff method for TE rules. This drastically reduced memory and run time.
  - Added infiniband context support to seinfo, sediff, and apol.
  - Added apol configuration for location of Qt assistant.
  - Fixed sediff issue where properties header would display when not requested.
  - Fixed sediff issue with type_transition file name comparison.
  - Fixed permission map socket sendto information flow direction.
  - Added methods to TypeAttribute class to make it a complete Python collection.
  - Genfscon now will look up classes rather than using fixed values which
    were dropped from libsepol.
  - setools requires -console, -console-analyses and -gui packages (#1820078)


author: Vit Mojzis <vmojzis@redhat.com> - 4.3.0-4
changelog:
  - Disable/remove neverallow options in frontends (#2184141)
  - AVRuleXperm: Fix permission set creation for AVTAB_XPERMS_IOCTLDRIVER (#2174376)


author: Ondrej Vasik <ovasik@redhat.com> - 2.12.2-2
changelog:
  - do not ship /etc/hosts.allow and /etc/hosts.deny (no need for them
    as we don't allow tcp_wrappers in RHEL8, #1663556)


author: Martin Osvald <mosvald@redhat.com> - 2.12.2-3
changelog:
  - add pcp user to /etc/aliases (#1744089)
  - set PATH if it is empty in csh.login (#1744104)
  - lang.csh: prevent grep from failing so scripts do not end
    prematurely when tcsh -e option in use (#1678706)
  - use full path for non-builtins (#1688302)
  - add nrpe tcp port 5666 to /etc/services (#1730396)


author: Martin Osvald <mosvald@redhat.com> - 2.12.2-7
changelog:
  - Move /var/log/lastlog ownership to systemd (#2044589)
  - tcsh sets variable p to /usr/sbin from /etc/csh.login (#1945400)
  - bashrc: Don't set up VTE-specific PROMPT_COMMAND (#1917934)


author: Tomas Bzatek <tbzatek@redhat.com> - 1.44-3
changelog:
  - Fix sg_turs help invocation in an old mode (#1683343)
  - Fix sg_raw printing error about device not specified on version request (#1627657)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-15
changelog:
  - Creation of subid and subid-devel subpackages (#2013009)
  - libsubid: creation and nsswitch support
  - libsubid: don't print error messages on stderr by default
  - libsubid: libsubid_init return false if out of memory
  - libsubid: don't return owner in list_owner_ranges API call
  - libsubid: libsubid_init don't print messages on error
  - libsubid: fix newusers when nss provides subids
  - libsubid: make shadow_logfd not extern
  - useradd: fix SUB_UID_COUNT=0
  - man: mention NSS in new[ug]idmap manpages
  - man: clarify subid delegation


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-16
changelog:
  - getsubids: provide system binary and man page. Resolves: #2013016
  - groupdel: fix SIGSEGV when passwd does not exist. Resolves: #1986782


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-17
changelog:
  - subordinateio: also compare the owner ID. Resolves: #2093311
  - Fix release sources
  - Add subid requirement for subid-devel


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-18
changelog:
  - Update patch to close label to reset libselinux state. Resolves: #1984740
  - useradd: check if subid range exists for user. Resolves: #2012929
  - find_new_[gu]id: Skip over IDs that are reserved for legacy reasons. Resolves: #1994269


author: Erik Troan <ewt@redhat.com>
changelog:
  - added patch for XOPEN oddities in glibc headers
  - check for ut_user before checking for ut_name -- this works around some
    confusion on glibc 2.1 due to the utmpx header not defining the ut_name
    compatibility stuff. I used a gross sed hack here because I couldn't make
    automake work properly on the sparc (this could be a glibc 2.0.99 problem
    though). The utuser patch works fine, but I don't apply it.
  - sleep after running autoconf


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - updated the spec file
  - updated the patch so that new accounts created on shadowed system won't
    confuse pam_pwdb anymore ('!!' default password instead on '!')
  - fixed a bug that made useradd -G segfault
  - the check for the ut_user is now patched into configure


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - Note that /usr/sbin/mkpasswd conflicts with /usr/bin/mkpasswd;
    one of these (I think /usr/sbin/mkpasswd but other opinions are valid)
    should probably be renamed.  In any case, mkpasswd.8 from this package
    needs to be installed. (problem #823)


author: Michael K. Johnson <johnsonm@redhat.com>
changelog:
  - have userdel remove user private groups when it is safe to do so
  - allow -f to force user removal even when user appears busy in utmp


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - Serial: 1 because now we are using 19990827 (why the heck can't they have
    a normal version just like everybody else?!)
  - ported all patches to the new code base


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix usermod patch to check for shadow before doing any shadow-specific stuff
    and merge it into the pwlock patch


author: Matt Wilson <msw@redhat.com>
changelog:
  - use mandir for FHS
  - added patches in src/ and po/ to honor DESTDIR
  - use make install DESTDIR=$RPM_BUILD_ROOT


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - change symlinked man pages to includers
  - require /usr/bin/newgrp (util-linux) so that /usr/bin/sg isn't left dangling


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - Remove a fixed-size buffer that caused problems when adding a huge number
    of users to a group (>8192 bytes) (Bugs #3809, #11930)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - take LOG_CONS out of the openlog() call so that we don't litter the
    screen during text-mode upgrades


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - don't overwrite user dot files in useradd (#19982)
  - truncate new files when moving overwriting files with the contents of other
    files while moving directories (keeps files from looking weird later on)
  - configure using %{_prefix} as the prefix


author: Bernhard Rosenkraenzer <bero@redhat.com> 20000902-1
changelog:
  - Create an empty mailspool when creating a user so non-setuid/non-setgid
    MDAs (postfix+procmail) can deliver mail (#41811)
  - 20000902
  - adapt patches


author: Nalin Dahyabhai <nalin@redhat.com> 20000902-4
changelog:
  - use -O0 instead of -O on ia64
  - build in source directory
  - don't leave lock files on the filesystem when useradd creates a group for
    the user (#50269)
  - fix the -o option to check for duplicate UIDs instead of login names (#52187)


author: Nalin Dahyabhai <nalin@redhat.com> 20000902-12
changelog:
  - force .mo files to be regenerated with current gettext to flush out possible
    problems
  - fixup non-portable encodings in translations
  - make sv translation header non-fuzzy so that it will be included (#71281)


author: Nalin Dahyabhai <nalin@redhat.com> 20000902-13
changelog:
  - prevent libshadow from being built more than once, to keep automake happy
  - change how md5 and md5crypt are enabled, to keep autoconf happy
  - remove unpackaged files after %install


author: Nalin Dahyabhai <nalin@redhat.com> 4.0.3-6
changelog:
  - adjust mailspool patch to complain if no group named "mail" exists, even
    though that should never happen


author: Nalin Dahyabhai <nalin@redhat.com> 4.0.3-14
changelog:
  - lastlog: don't pass a possibly-smaller field to localtime (#109648)
  - configure: call AC_SYS_LARGEFILE to get large file support


author: Nalin Dahyabhai <nalin@redhat.com> 4.0.3-15
changelog:
  - don't convert man pages to UTF-8 for RHEL 3, conditionalized using macro
  - fixup dangling man page references


author: Dan Walsh <dwalsh@redhat.com> 4.0.3-23
changelog:
  - Add get_enforce checks
  - Clean up patch for potential upstream submission
  - Add removemalloc patch to get it to build on 3.4


author: Adrian Havill <havill@redhat.com> 2:4.0.3-31
changelog:
  - check for non-standard legacy place for ncsd HUP (/var/run/nscd.pid) and
    then the std FHS place (/var/run/nscd.pid) (#125421)


author: Adrian Havill <havill@redhat.com> 2:4.0.3-33
changelog:
  - allow for mixed case and dots in usernames (#135401)
  - all man pages to UTF-8, not just Japanese (#133883)
  - add Polish blurb for useradd -n man page option (#82177)


author: Adrian Havill <havill@redhat.com> 2:4.0.3-35
changelog:
  - make the limit for the group name the same as the username (determined
    by the header files, rather than a constant) (#56850)


author: Peter Vrabec <pvrabec@redhat.com> 2:4.0.7-4
changelog:
  - use newgrp binary
  - newgrp don't ask for password if user's default GID = group ID,
    ask for password if there is some in /etc/gshadow
    and in /etc/group is 'x' (#149997)


author: Peter Vrabec <pvrabec@redhat.com> 2:4.0.7-5
changelog:
  - fix memory leak, and CPU spinning when grp_update() and
    duplicate group entries in /etc/group (#151484)


author: Peter Vrabec <pvrabec@redhat.com> 2:4.0.17-6
changelog:
  - fix regression. Permissions on user* group* binaries
    should be 0750, because of CAPP/LSPP certification
  - fix groupdel man page


author: Peter Vrabec <pvrabec@redhat.com> 2:4.0.18.1-2
changelog:
  - improve audit logging (#211659)
  - improve "-l" option. Do not reset faillog if it's used (#213450).


author: Peter Vrabec <pvrabec@redhat.com> 2:4.1.2-8
changelog:
  - groupmems: check username for valid character (#455603)
  - groupmems: don't segfault on nonexistent group (#456088)


author: Peter Vrabec <pvrabec@redhat.com> 2:4.1.2-11
changelog:
  - fix license tag (#226416)
  - get rid of tabs in spec file (#226416)
  - convert HOWTO to UTF8 (#226416)


author: Peter Vrabec <pvrabec@redhat.com> - 2:4.1.4.2-5
changelog:
  - newusers man page more informative
  - userdel should not need to run semanage
    Resolves: #586330 #586408


author: Peter Vrabec <pvrabec@redhat.com> - 2:4.1.4.2-9
changelog:
  - fix gshadow functions from shadow utils
  - make shadow utils use gshadow functions from glibc
    Resolves: #665780


author: Peter Vrabec <pvrabec@redhat.com> - 2:4.1.4.2-10
changelog:
  - do not use  gshadow functions from glibc, there is a bug
    in glibc sgetsgent(#674361)
    Resolves: #674234


author: Peter Vrabec <pvrabec@redhat.com> - 2:4.1.4.2-11
changelog:
  - useradd man page (-m option)
  - create home directory on fs with noacl
  - remove faillog app (pam_tally.so is no longer shipped)
    Resolves: #523265, #622320


author: Peter Vrabec <pvrabec@redhat.com> - 2:4.1.4.3-5
changelog:
  - userdel option to remove Linux login <-> SELinux login mapping (#639900)
  - useradd special exit value if SELinux user mapping is invalid (#639975)
  - usermod special exit value if SELinux user mapping is invalid (#639976)


author: Tomas Mraz <tmraz@redhat.com> - 2:4.1.5.1-6
changelog:
  - report error to stdout when SELinux context for home directory
    cannot be determined (#973647)
  - audit the changing home directory owner (#885797)
  - do not set the default SELinux MLS range (#852676)


author: Tomas Mraz <tmraz@redhat.com> - 2:4.1.5.1-8
changelog:
  - slightly more meaningful error messages if crypt() returns NULL (#988184)
  - explicit suid permissions


author: Tomas Mraz <tmraz@redhat.com> - 2:4.1.5.1-14
changelog:
  - put system users and groups into /usr/lib/{passwd,group} if
    the files exist and SHADOW_USE_USRLIB environment variable is set
    Patch by Colin Walters


author: Tomas Mraz <tmraz@redhat.com> - 2:4.1.5.1-18
changelog:
  - label the newly created home dir correctly (#1077809)
  - mention that chage -d 0 forces password change (#1135010)
  - improve date parsing and error detecting in chage
  - avoid full group database scanning in newgrp in most common case
  - report error if usermod asked for moving homedir and it does not exist


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.1.5.1-21
changelog:
  - update auditing to cover more events and fix some incorrect audit
    records - patch by Steve Grubb (#1151580)
  - apply the same new allocation algorithm to uids as for gids


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.2.1-3
changelog:
  - unlock also passwords locked with passwd -l
  - prevent breaking user entry by entering a password containing colon
  - fix possible DoS when locking the database files for update
  - properly use login.defs from the chroot in useradd


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.2.1-4
changelog:
  - document that groupmems is not setuid root
  - document that expiration of the password after inactivity period
    locks the user account completely


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.2.1-5
changelog:
  - do not use obscure permissions for binaries
  - remove unused commands from login.defs(5) cross-reference


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.5-4
changelog:
  - allow switching to secondary group without checking the membership
    explicitly (patch from upstream)


author: Björn Esser <besser82@fedoraproject.org> - 2:4.5-9
changelog:
  - Add patch to include crypt.h, if present
  - Use %make_{build,install} macros
  - Refresh other patches for proper alignment


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.6-1
changelog:
  - Update to current upstream release 4.6
  - Raise limit for passwd and shadow entry length but also prevent
    writing longer entries (#1422497)


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.6-5
changelog:
  - use cap_setxid file capabilities for newxidmap instead of making them setuid
  - limit the SYS_U/GID_MIN value to 1 as the algorithm does not work with 0
    and the 0 is always used by root anyway
  - manual page improvements
  - flush sssd caches - patch by Jakub Hrozek


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.6-8
changelog:
  - properly audit group password change
  - do not add uid of a new (not yet added) user to the audit message
  - use lckpwdf() again to disable concurrent edits of databases by
    other applications
  - clarify chage manual page in regards to shadow and passwd
    inconsistency
  - fix minor issues in groupadd and login.defs manual pages
  - Ignore LOGIN_PLAIN_PROMPT variable in login.defs
  - force regeneration of getdate.c otherwise the date parsing fix
    is not applied


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-9
changelog:
  - do not mistake a regular user process for a namespaced one (#1788696)
  - add HOME_MODE support in login.defs (#1777718)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-12
changelog:
  - lib/sssd: redirect warning message to file (#1749001)
  - useradd: clarify valid usernames/groupnames (#1869432)
  - login.defs: link login specific information to its own package (#1804766)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-23
changelog:
  - nss.c: shadow_logfd to stderr. Resolves: RHEL-83432
  - pwck/grpck: only force nscd/sssd caches flush if anything was changed
    Resolves: RHEL-123912


author: Javier Martinez Canillas <javierm@redhat.com> - 15-12
changelog:
  - Fix firmware update bug in aarch64 caused by shim ignoring arguments
    Resolves: rhbz#1830871
  - Fix a shim crash when attempting to netboot
    Resolves: rhbz#1795654


author: Peter Jones <pjones@redhat.com> - 15-13
changelog:
  - New signing keys
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 15.5-1
changelog:
  - Update to shim-15.5
    Resolves: rhbz#1970632
    Resolves: rhbz#1982071
    Resolves: rhbz#2000946
    Resolves: rhbz#2002265


author: Peter Jones <pjones@redhat.com> - 15.5-2.el8
changelog:
  - Include the actual signed shim binaries.
    Resolves: rhbz#1970632
    Resolves: rhbz#1982071
    Resolves: rhbz#2000946
    Resolves: rhbz#2002265


author: Čestmír Kalina <ckalina@redhat.com> - 1.6.0-3
changelog:
  - Patch stats.c to fix overruns
  - Patch stats.c to fix leaks
  - Patch stats.c to fix fallback counter values
  - Resolves: #1993469


author: Čestmír Kalina <ckalina@redhat.com> - 1.8.1-1
changelog:
  - Upgrade smc-tools to latest version
  - Add User-defined EID (Enterprise ID) Support
  - Resolves: #1919228
  - Resolves: #2043841


author: Čestmír Kalina <ckalina@redhat.com> - 1.8.3-1
changelog:
  - Resolves: RHEL-11417 Upgrade smc-tools to latest version
  - smc_stats: Fix man page name
  - Bump version.


author: Xiaoping Liu <liuxiaoping@alibaba-inc.com> - 1.8.3-1.0.1
changelog:
  - Add doc sub package
  - Support smc-ebpf (alibuda@linux.alibaba.com)
  - fix spec on smc-ebpf, fix issues where smc-ebpf can not works (alibuda@linux.alibaba.com)


author: Wen Gu <guwen.gu@alibaba-inc.com> - 1.8.3-1.0.4
changelog:
  - Fix segmentation fault in concurrent socket creation
  - Add statistics for ringbuf usage of conns and LGRs
  - Remove stats cache file if it is corrupted
  - Add smc_monitor_ex tool
  - Add tools for smc traffic capture


author: Bhupesh Sharma <bhsharma@redhat.com> - 1.1.8-1
changelog:
  - Rebase to latest github version Snappy-1.1.8
  - Also change the URL to reflect to the updated github location.


author: Pavel Moravec <pmoravec@redhat.com> = 4.0-2
changelog:
  - [cleaner] more streamlined sanitize_item method
    Resolves: bz1827801
  - [openstack_ironic] Missing ironic-inspector configs
    Resolves: bz1874295
  - Add support to collect hardware component logs
    Resolves: bz1880372
  - [crio] collect /etc/crio/crio.conf.d/
    Resolves: bz1881118
  - [policy] Handle additional failure conditions for FTP uploads
    Resolves: bz1882368
  - [filesys] never collect content of /proc/fs/panfs
    Resolves: bz1886782
  - [kdump] Collect new kdump logfiles
    Resolves: bz1887390
  - [stratis] Collect key list and report engine
    Resolves: bz1888012
  - return tmp-dir with absolute path
    Resolves: bz1891562


author: Pavel Moravec <pmoravec@redhat.com> = 4.0-3
changelog:
  - [ovirt] collect /etc/pki/ovirt-engine/.truststore
    Resolves: bz1848095
  - [collector] allow overriding plain --cluster-type
    Resolves: bz1895316
  - [component] Add log verbosity from presets
    Resolves: bz1904045
  - [options] Fix --log-size=0 being ignored and unreported
    Resolves: bz1905657
  - [report] collect broken symlinks
    Resolves: bz1906598


author: Pavel Moravec <pmoravec@redhat.com> = 4.0-5
changelog:
  - [component] honour plugopts from config file
    Resolves: bz1912889
  - [collector] declare sysroot for each component
    Resolves: bz1912821
  - [plugins] Dont stop collecting by empty specfile when sizelimit=0
    Resolves: bz1912910


author: Pavel Moravec <pmoravec@redhat.com> = 4.0-7
changelog:
  - [kdump] Gather the file kexec-dmesg.log
    Resolves: bz1887402
  - [Policy] Handle additional FTP authentication issues
    Resolves: bz1916729


author: Pavel Moravec <pmoravec@redhat.com> = 4.1-2
changelog:
  - Load maps from all archives before obfuscation
    Resolves: bz1930181
  - Multiple fixes in man pages
    Resolves: bz1935603
  - [ds] Mask password and encryption keys in ldif files
    Resolves: bz1937298
  - [report] add --cmd-timeout option
    Resolves: bz1937418
  - [cups] Add gathering cups-browsed logs
    Resolves: bz1939963
  - [sssd] Collect memory cache / individual logfiles
    Resolves: bz1940502
  - Collect ibmvNIC dynamic_debugs
    Resolves: bz1942276
  - [pulpcore] add plugin for pulp-3
    Resolves: bz1956673
  - [saphana] remove redundant unused argument of get_inst_info
    Resolves: bz1959413
  - [networking] Add nstat command support
    Resolves: bz1961458
  - [snapper] add a new plugin
    Resolves: bz1961229


author: Pavel Moravec <pmoravec@redhat.com> = 4.1-3
changelog:
  - [gluster] collect public keys from the right dir
    Resolves: bz1925419
  - [cleaner] Only skip packaging-based files for the IP parse
    Resolves: bz1964499
  - [networking] collect also tc filter show ingress
    Resolves: bz1886711
  - [archive] skip copying SELinux context for /proc and /sys
    Resolves: bz1965001
  - [sssd] sssd plugin when sssd-common
    Resolves: bz1967613
  - Various OCP/cluster/cleanup enhancements
    Resolves: bz1973675


author: Pavel Moravec <pmoravec@redhat.com> = 4.1-4
changelog:
  - [options] allow variant option names in config file
    Resolves: bz1923938
  - [plugins] Set default predicate instead of None
    Resolves: bz1985986
  - [MigrationResults] collect info about conversions
    Resolves: bz1959598


author: Pavel Moravec <pmoravec@redhat.com> = 4.1-5
changelog:
  - [report,collect] unify --map-file arguments
    Resolves: bz1923938
  - [rhui] add new plugin for RHUI 4
    Resolves: bz1665947
  - [username parser] Load usernames from `last` for LDAP users
    Resolves: bz1985037


author: Pavel Moravec <pmoravec@redhat.com> = 4.2-1
changelog:
  - Rebase on upstream 4.2
    Resolves: bz1998133
  - [report] Implement --estimate-only
    Resolves: bz1873185
  - [omnipath_client] Opacapture to run only with allow changes
    Resolves: bz1998433
  - [unpackaged] deal with recursive loop of symlinks properly
    Resolves: bz1998521
  - [networking] prevent iptables-save commands to load nf_tables
    Resolves: bz2001096
  - [kernel] Capture Pressure Stall Information
    Resolves: bz2002145
  - [processor] Apply sizelimit to /sys/devices/system/cpu/cpuX
    Resolves: bz2011413


author: Pavel Moravec <pmoravec@redhat.com> = 4.2-2
changelog:
  - [firewall_tables] call iptables -t <table> based on nft
    Resolves: bz2005195
  - [report] Count with sos_logs and sos_reports in
    Resolves: bz1873185
  - [foreman] Collect puma status and stats
    Resolves: bz2011506
  - [report] Overwrite pred=None before refering predicate
    Resolves: bz2012856
  - [openvswitch] add commands for offline analysis
    Resolves: bz2004929


author: Pavel Moravec <pmoravec@redhat.com> = 4.2-4
changelog:
  - [report] Calculate sizes of dirs, symlinks and manifest in
    Resolves: bz1873185
  - [report] shutdown threads for timeouted plugins
    Resolves: bz2012857
  - [report] fix filter_namespace per pattern
    Resolves: bz2020777
  - Ensure specific plugin timeouts are only set
    Resolves: bz2018033


author: Pavel Moravec <pmoravec@redhat.com> = 4.2-5
changelog:
  - [clean,hostname_parser] Source /etc/hosts for obfuscation
    Resolves: bz2023867
  - [clean, hostname] Fix unintentionally case sensitive
    Resolves: bz2023863
  - [redhat] update SFTP API version to v2
    Resolves: bz2025610


author: Pavel Moravec <pmoravec@redhat.com> = 4.2-8
changelog:
  - [rhui] New log folder
    Resolves: bz2030741
  - nvidia]:Patch to update nvidia plugin for GPU info
    Resolves: bz2025403
  - [hostname] Fix edge case for new hosts in a known subdomain
    Resolves: bz2023867


author: Pavel Moravec <pmoravec@redhat.com> = 4.2-9
changelog:
  - add oc transport, backport various PRs for OCP
    Resolves: bz2036697
  - [report] Provide better warning about estimate-mode
    Resolves: bz1873185
  - [hostname] Fix loading and detection of long base domains
    Resolves: bz2023867


author: Pavel Moravec <pmoravec@redhat.com> = 4.2-12
changelog:
  - [foreman] Use psql-msgpack-decode wrapper for dynflow >= 1.6
    Resolves: bz2043102
  - [virsh] Call virsh commands in the foreground / with a TTY
    Resolves: bz2041488
  - [ovn_central] Account for Red Hat ovn package naming
    Resolves: bz2042966
  - [clean,parsers] Build regex lists for static items only once
    Resolves: bz2036697


author: Pavel Moravec <pmoravec@redhat.com> = 4.2-15
changelog:
  - [sosnode] Handle downstream versioning for runtime option
    Resolves: bz2036697
  - [options] Fix logging on plugopts in effective sos command
    Resolves: bz2054882
  - [report] Honor plugins' hardcoded plugin_timeout
    Resolves: bz2055547
  - [policies] Set fallback to None sysroot, don't chroot to '/'
    Resolves: bz1873185
  - [ovn_central] Rename container responsable of Red Hat
    Resolves: bz2042966


author: Pavel Moravec <pmoravec@redhat.com> = 4.3-1
changelog:
  - Rebase on upstream 4.3
    Resolves: bz2055002
  - [sapnw] Fix IndexError exception
    Resolves: bz1992938
  - [Plugin, utilities] Allow writing command output directly to disk
    Resolves: bz1726023
  - [Ceph] Add support for containerized Ceph setup
    Resolves: bz1882544
  - [unbound] Add new plugin for Unbound DNS resolver
    Resolves: bz2018228
  - [discovery] Add new discovery plugin
    Resolves: bz2018549
  - [vdsm] Exclude /var/lib/vdsm/storage/transient_disks
    Resolves: bz2029154


author: Pavel Moravec <pmoravec@redhat.com> = 4.3-2
changelog:
  - [ovirt] answer files: Filter out all password keys
    Resolves: bz2095263
  - [plugins] Allow 'str' PlugOpt type to accept any value
    Resolves: bz2079485
  - [tigervnc] Update collections for newer versions of TigerVNC
    Resolves: bz2062908
  - [pacemaker] Redesign node enumeration logic
    Resolves: bz2065805
  - crio: switch from parsing output in table format to json
    Resolves: bz2092969
  - [report] Honor plugins' hardcoded plugin_timeout
    Resolves: bz2079187
  - [report] --list-plugins should report used, not default,
    Resolves: bz2079484
  - [utilities] Close file only when storing to file
    Resolves: bz2079486
  - [presets] Adjust OCP preset options, more OCP backports
    Resolves: bz2058279


author: Pavel Moravec <pmoravec@redhat.com> = 4.3-3
changelog:
  - [vdsm] Set LVM option use_devicesfile=0
    Resolves: bz2093993
  - [Plugin] Make forbidden path checks more efficient
    Resolves: bz2099598


author: Pavel Moravec <pmoravec@redhat.com> = 4.4-1
changelog:
  - Rebase on upstream 4.4
    Resolves: bz2082614
  - [redhat] Honour credential-less --upload-url on RedHat distro properly
    Resolves: bz2059572
  - [sos] Fix unhandled exception when concurrently removing temp dir
    Resolves: bz2088439
  - [specfile] drop python3-libxml2 dependency
    Resolves: bz2125486
  - [md] Restrict data capture to raid members
    Resolves: bz2125485
  - [cleaner] Use compiled regex lists for parsers by default
    Resolves: bz2043233
  - [cgroups] not collect memory.kmem.slabinfo
    Resolves: bz1995120
  - [report] Fix loop devices data gathering
    Resolves: bz2010735
  - [insights] Collect /var/lib/insights
    Resolves: bz2103233
  - [candlepin] collect information about SCA
    Resolves: bz2060925
  - [manpages] Clarify --upload-directory applicable to FTP protocol only
    Resolves: bz2063259
  - [cleaner] Dont obfuscate tmpdir path of local private_map
    Resolves: bz2064815
  - [fibrechannel] collect Cisco fnic statistics
    Resolves: bz2074715
  - [pulpcore] Collect db_tables_sizes
    Resolves: bz2081433
  - [fibrechannel]: Update fibrechannel plugin to collect HBA logs
    Resolves: bz2089591
  - [arcconf]: Update arcconf plugin to collect UART logs
    Resolves: bz2090283
  - [pulpcore] Stop collecting commands relevant to old taskig system
    Resolves: bz2093191
  - [dnf,yum] Merge plugins into dnf, remove yum plugin
    Resolves: bz2100154
  - [policies] Simplify flow in _container_init()
    Resolves: bz2100480
  - [pacemaker] Update collect cluster profile for pacemaker
    Resolves: bz2065821


author: Pavel Moravec <pmoravec@redhat.com> = 4.4-2
changelog:
  - [utilities] Relax from hard dependency of python3-magic
    Resolves: bz2129038
  - [dnf] Collect legacy yum config symlinks, properly obfuscate pwds
    Resolves: bz2100154


author: Pavel Moravec <pmoravec@redhat.com> = 4.5.1-3
changelog:
  - Rebase on upstream 4.5.1
    Resolves: bz2175806
  - [composer] Capure /etc/osbuild-composer file
    Resolves: bz2169776
  - [ostree] Collect "ostree fsck" under plugin specific opt
    Resolves: bz2161533
  - [iprconfig] guard whole plugin by sg kmod predicate
    Resolves: bz2176086
  - [cleaner] dont clean sys_tmp from final_path
    Resolves: bz2176218


author: Jan Jansky <jjansky@redhat.com> = 4.5.3-1
changelog:
  - [report] Ignore case when scrubbing via do_file_sub
    Resolves: bz2143272
  - [subscription_manager] Scrub proxy passwords from repo_server_val
    Resolves: bz2177282
  - [virsh] Scrub passwords in virt-manager logs
    Resolves: bz2184062


author: Pavel Moravec <pmoravec@redhat.com> = 4.5.4-1
changelog:
  - [plugins] collect strings before commands
    Resolves: bz2203141
  - [collector] collect report from primary node if in node_list
    Resolves: bz2186460
  - [powerpc] collect invscout logs
    Resolves: bz2210543
  - [rhc] New plugin for RHC
    Resolves: bz2196649


author: Jan Jansky <jjansky@redhat.com> = 4.5.5-1
changelog:
  - [clean] Respect permissions of sanitised files
    Resolves: bz2218279
  - [plugin] Fix exception when calling os.makedirs
    Resolves: bz2216608
  - [cleaner] Enhance trailing characters list after AMC address
    Resolves: bz2207562


author: Jan Jansky <jjansky@redhat.com> = 4.5.5-2
changelog:
  - Adding patch for mac obfuscation
    Resolves: bz2218279
    Resolves: bz2216608
    Resolves: bz2207562


author: Pavel Moravec <pmoravec@redhat.com> = 4.6.1-1
changelog:
  - rebase to upstream 4.6.1
    Resolves: RHEL-21173
  - [redhat] Change authentication method for RHEL
    Resolves: RHEL-21177


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-10
changelog:
  - Fixed CVE-2020-13632 (#1845572)
  - Fixed CVE-2020-13631 (#1845474)
  - Fixed CVE-2020-13630 (#1845153)


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-14
changelog:
  - Fixed CVE-2019-5827 (#1710184)
  - Fixed CVE-2019-13750 (#1786510)
  - Fixed CVE-2019-13751 (#1786522)
  - Fixed CVE-2019-19603 (#1792013)
  - Fixed CVE-2020-13435 (#1841233)


author: Paul Nasrat <pnasrat@redhat.com> - 3.3.6-1
changelog:
  - Update to 3.3.6
  - Fix typo  (#189647)
  - Enable threading fixes (#181298)
  - Conditionalize static library


author: Panu Matilainen <pmatilai@redhat.com> - 3.5.9-2
changelog:
  - Remove references to temporary registers from cache on release (#463061)
  - Enable loading of external extensions (#457433)


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.6.2-2
changelog:
  - require tcl(abi) in sqlite-tcl subpackage (#474034)
  - move tcl extensions to arch-specific location
  - enable dependency extraction on the tcl dso
  - require pkgconfig in sqlite-devel


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.12-2
changelog:
  - disable strict aliasing to work around brokenness on 3.6.12 (#494266)
  - run test-suite on build but let it fail for now


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.14-1
changelog:
  - update to 3.6.14 (http://www.sqlite.org/releaselog/3_6_14.html)
  - merge-review cosmetics (#226429)
    - drop ancient sqlite3 obsoletes
    - fix tab vs space whitespace issues
    - remove commas from summaries
  - fixup io-test fsync expectations wrt SQLITE_DISABLE_DIRSYNC


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.17-1
changelog:
  - update to 3.6.17 (http://www.sqlite.org/releaselog/3_6_17.html)
  - disable to failing tests until upstream fixes


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.18-1
changelog:
  - update to 3.6.18 (http://www.sqlite.org/releaselog/3_6_18.html)
  - drop no longer needed test-disabler patches


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.23-1
changelog:
  - update to 3.6.23 (http://www.sqlite.org/releaselog/3_6_23.html)
  - drop the lemon sprintf patch, upstream doesn't want it
  - make test-suite errors fail build finally


author: Panu Matilainen <pmatilai@redhat.com> - 3.7.4-1
changelog:
  - update to 3.7.4 (http://www.sqlite.org/releaselog/3_7_4.html)
  - deal with upstream source naming, versioning and format changing
  - fixup wal2-test expections wrt SQLITE_DISABLE_DIRSYNC use


author: Panu Matilainen <pmatilai@redhat.com> - 3.7.7.1-1
changelog:
  - update to 3.7.7.1 (http://www.sqlite.org/releaselog/3_7_7_1.html)
  - autoconf no longer needed for build, libdl check finally upstreamed


author: Panu Matilainen <pmatilai@redhat.com> - 3.7.13-1
changelog:
  - update to 3.7.13 (http://www.sqlite.org/releaselog/3_7_13.html)
  - drop no longer needed savepoint relase patch


author: Panu Matilainen <pmatilai@redhat.com> - 3.7.15-1
changelog:
  - update to 3.7.15 (http://www.sqlite.org/releaselog/3_7_15.html)
  - fix an old incorrect date in spec changelog


author: Jan Stanek <jstanek@redhat.com> - 3.7.16.2-1
changelog:
  - update to 3.7.16.2 (http://www.sqlite.org/releaselog/3_7_16_2.html)
  - add support for aarch64 (rerunning autoconf) (#926568)


author: Jan Stanek <jstanek@redhat.com> 3.8.3-1
changelog:
  - Update to 3.8.3 (http://www.sqlite.org/releaselog/3_8_3.html)
  - Dropped man-page patch - included upstream


author: Honza Horak <hhorak@redhat.com> - 3.8.4.2-3
changelog:
  - Revert part of the upstream commit dca1945aeb3fb005, since it causes
    nautilus to crash
    Related: #1075889


author: Jan Stanek <jstanek@redhat.com> - 3.8.4.3-1
changelog:
  - Update to version 3.8.4.3 (http://www.sqlite.org/releaselog/3_8_4_3.html)
  - Changed patch for rhbz#1075889 to upstream version
    Related: #1075889


author: Jan Stanek <jstanek@redhat.com> - 3.8.5-1
changelog:
  - Update to version 3.8.5 (http://www.sqlite.org/releaselog/3_8_5.html)
  - Dropped patch already included upstream


author: Jan Stanek <jstanek@redhat.com> - 3.8.7-1
changelog:
  - Updated to version 3.8.7 (http://sqlite.org/releaselog/3_8_7.html)
  - Dropped patch for problem fixed upstream


author: Jan Stanek <jstanek@redhat.com> - 3.8.8-1
changelog:
  - Updated to version 3.8.8 (https://sqlite.org/releaselog/3_8_8.html)
  - Recreated patches to work on current version.


author: Jan Stanek <jstanek@redhat.com> - 3.10.2-1
changelog:
  - Updated to version 3.10.2 (http://sqlite.org/releaselog/3_10_2.html)
  - Enabled JSON1 Extension (rhbz#1277387)
  - Made test failure nonfatal on MIPS (rhbz#1294888)


author: Nils Philippsen <nils@redhat.com> - 3.11.0-2
changelog:
  - add obsoletes/conflicts to make updates on multi-lib systems work (#1310441)
  - make -devel package depend on arch-specific -libs (not main) package


author: Petr Kubat <pkubat@redhat.com> - 3.18.0-1
changelog:
  - Updated to version 3.18.0 (https://sqlite.org/releaselog/3_18_0.html)
  - Modify sync2.test to pass with DIRSYNC turned off


author: Petr Kubat <pkubat@redhat.com> - 3.19.3-1
changelog:
  - Updated to version 3.19.3 (https://sqlite.org/releaselog/3_19_3.html)
  - Better detection of CVE-2017-10989 (#1469673)


author: Petr Kubat <pkubat@redhat.com> - 3.22.0-1
changelog:
  - Fixed issue with some e_expr tests failing i686
  - Fixed issue with a fts3rank test failing on big-endian systems


author: Petr Kubat <pkubat@redhat.com> - 3.26.0-1
changelog:
  - Updated to version 3.26.0 (https://sqlite.org/releaselog/3_26_0.html)
    Fixes fts3/4 corrupt database exploit (#1659684)


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-5
changelog:
  - Fixed CVE-2019-13752 (#1786529) 
  - Fixed CVE-2019-13753 (#1786535) 
  - Fixed CVE-2019-13734 (#1786509) 
  - Fixed CVE-2019-19924 (#1789776)
  - Fixed CVE-2019-19923 (#1789812)
  - Fixed CVE-2019-19925 (#1789808)
  - Fixed CVE-2019-19959 (#1789823)


author: Abhi Das <adas@redhat.com> - 4.3-19
changelog:
  - rhbz#1602698 - Fix coverity issues
    rhbz#1624173 - Fix annocheck failures
    rhbz#1716278 - limit max cpus in mksquashfs
    Resolves: rhbz#1602698, rhbz#1624173, rhbz#1716278


author: Abhi Das <adas@redhat.com> - 4.3-20
changelog:
  - rhbz#1895017 - unsquashfs does not preserve file capabilities
    rhbz#1754815 - Kdump: Building kdump initramfs img may fail with 'dracut: Failed making squash image' occasionally
    Resolves: rhbz#1895017, rhbz#1754815


author: wuxiat <nijie@wwxiat.com> -4.3-20.0.2
changelog:
  * Mon Dec 13 2021 Weitao Zhou <zhouwt@linux.alibaba.com> - 4.3-20.0.1
  - use extern in header files when declaring global variables for compatible gcc10 build


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.2-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: rhbz#2226021 - dbus and crond getting terminated with SIGBUS in sss_client code
  - Resolves: rhbz#2237253 - SSSD runs multiples lookup search for each NFS request (SBUS req chaining stopped working in sssd-2.7)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.3-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: RHEL-14070 - sssd-2.9.2-1.el8 breaks smart card authentication
  - Resolves: RHEL-3665 - Unexplainable error "Unable to find primary gid [2]: No such file or directory" when SSSD performs lookup for an AD user


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: RHEL-1680 - auto_private_groups does not create cache in IPA server SSSD cache
  - Resolves: RHEL-10092 - logfile rotation for sssd_kcm not working properly, sssd_kcm never receives a 'kill -HUP'
  - Resolves: RHEL-17495 - New sssd.conf seems not to be backwards compatible (wrt SmartCard auth of local users using 'files provider')
  - Resolves: RHEL-18431 - Excessive logging to sssd_nss and sssd_be in multi-domain AD forest
  - Resolves: RHEL-5033 - Incorrect IdM product name in man sssd.conf
  - Resolves: RHEL-15368 - SSSD GPO lacks group resolution on hosts [rhel-8]
  - Resolves: RHEL-10721 - very bad performance when requesting service tickets
  - Resolves: RHEL-19011 - Invalid handling groups from child domain
  - Resolves: RHEL-19949 - latest sssd breaks logging in via XDMCP for LDAP/Kerberos users [rhel-8]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-2
changelog:
  - Resolves: RHEL-25064 - AD users are unable to log in due to case sensitivity of user because the domain is found as an alias to the email address. [rhel-8]
  - Resolves: RHEL-25066 - gdm smartcard login fails with sssd-2.9.3 in case of multiple identities [rhel-8]
  - Resolves: RHEL-25065 - ssh pubkey stored in ldap/AD no longer works to authenticate via sssd [rhel-8]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-3
changelog:
  - Resolves: RHEL-27205 - Race condition during authorization leads to GPO policies functioning inconsistently


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-5.1
changelog:
  - Resolves: RHEL-67671 - Label DP_OPT_DYNDNS_REFRESH_OFFSET has no corresponding option [rhel-8.10.z]
  - Resolves: RHEL-68507 - sssd backend process segfaults when krb5.conf is invalid [rhel-8.10.z]
  - Resolves: RHEL-66267 - SSSD needs an option to indicate if the LDAP server can run the exop with an anonymous bind or not [rhel-8.10.z]
  - Resolves: RHEL-67128 - Excessive "Domain not found' messages logged to sssd_nss & sssd_be in multidomain AD forest [rhel-8.10.z]
  - Resolves: RHEL-66272 - sssd is skipping GPO evaluation with auto_private_groups [rhel-8.10.z]
  - Resolves: RHEL-66277 - possible regression of rhbz#2196521 [rhel-8.10.z]


author: Simo Sorce <ssorce@redhat.com> - 0.3.0-2
changelog:
  - Try to fix build adding automake as an explicit BuildRequire
  - Add also a couple of last minute patches from upstream


author: Jakub Hrozek <jhrozek@redhat.com> - 0.3.2-1
changelog:
  - bugfix release 0.3.2
  - includes previous release patches
  - change permissions of the /etc/sssd/sssd.conf to 0600


author: Simo Sorce <ssorce@redhat.com> - 0.4.1-1
changelog:
  - add missing configure check that broke stopping the daemon
  - also fix default config to add a missing required option


author: Jakub Hrozek <jhrozek@redhat.com> - 0.4.1-4
changelog:
  - Fix for CVE-2009-2410 - Native SSSD users with no password set could log in
    without a password. (Patch by Stephen Gallagher)


author: Stephen Gallagher <sgallagh@redhat.com> - 0.6.0-1
changelog:
  - Ensure that the configuration upgrade script always writes the config
    file with 0600 permissions
  - Eliminate an infinite loop in group enumerations


author: Stephen Gallagher <sgallagh@redhat.com> - 0.6.1-1
changelog:
  - Add SSSDConfig API
  - Update polish translation for 0.6.0
  - Fix long timeout on ldap operation
  - Make dp requests more robust


author: Stephen Gallagher <sgallagh@redhat.com> - 0.7.1-1
changelog:
  - Fix segfault in sssd_pam when cache_credentials was enabled
  - Update the sample configuration
  - Fix upgrade issues caused by data provider service removal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.0.2-1
changelog:
  - Fixes a bug in the failover code that prevented the SSSD from detecting when it went back online
  - Fixes a bug causing long (sometimes multiple-minute) waits for NSS requests
  - Several segfault bugfixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.0.3-1
changelog:
  - Fixes link error on platforms that do not do implicit linking
  - Fixes double-free segfault in PAM
  - Fixes double-free error in async resolver
  - Fixes support for TCP-based DNS lookups in async resolver
  - Fixes memory alignment issues on ARM processors
  - Manpage fixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-1.pre20100317git0ea7f19
changelog:
  - Release candidate for SSSD 1.1
  - Add simple access provider
  - Create subpackages for libcollection, libini_config, libdhash and librefarray
  - Support IPv6
  - Support LDAP referrals
  - Fix cache issues
  - Better feedback from PAM when offline


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-2
changelog:
  - Release SSSD 1.1.0 final
  - Fix two potential segfaults
  - Fix memory leak in monitor
  - Better error message for unusable confdb


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.1-1
changelog:
  - New upstream release 1.1.1
  - Fixed the IPA provider (which was segfaulting at start)
  - Fixed a bug in the SSSDConfig API causing some options to revert to
  - their defaults
  - This impacted the Authconfig UI
  - Ensure that SASL binds to LDAP auto-retry when interrupted by a signal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.91-10
changelog:
  - Release new upstream version 1.1.91
  - Enhancements when using SSSD with FreeIPA v2
  - Support for deferred kinit
  - Support for DNS SRV records for failover


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.92-11
changelog:
  - New LDAP access provider allows for filtering user access by LDAP attribute
  - Reduced default timeout for detecting offline status with LDAP
  - GSSAPI ticket lifetime made configurable
  - Better offline->online transition support in Kerberos


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.0-12
changelog:
  - New stable upstream version 1.2.0
  - Support ServiceGroups for FreeIPA v2 HBAC rules
  - Fix long-standing issue with auth_provider = proxy
  - Better logging for TLS issues in LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-15
changelog:
  - New stable upstream version 1.2.1
  - Resolves: rhbz#595529 - spec file should eschew %define in favor of
  -                         %global
  - Resolves: rhbz#593644 - Empty list of simple_allow_users causes sssd service
  -                         to fail while restart.
  - Resolves: rhbz#599026 - Makefile typo causes SSSD not to use the kernel
  -                         keyring
  - Resolves: rhbz#599724 - sssd is broken on Rawhide


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.91-20
changelog:
  - New upstream version 1.2.91 (1.3.0rc1)
  - Improved LDAP failover
  - Synchronous sysdb API (provides performance enhancements)
  - Better online reconnection detection


author: Stephen Gallagher <sgallagh@redhat.com> - 1.3.0-30
changelog:
  - Resolves: CVE-2010-2940 - sssd allows null password entry to authenticate
  -                           against LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.3.0-32
changelog:
  - Resolves: rhbz#637955 - libini_config-devel needs libcollection-devel but
  -                         doesn't require it


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.0-1
changelog:
  - New upstream release 1.4.0
  - Added support for netgroups to the LDAP provider
  - Performance improvements made to group processing of RFC2307 LDAP servers
  - Fixed nested group issues with RFC2307bis LDAP servers without a memberOf plugin
  - Build-system improvements to support Gentoo
  - Split out several libraries into the ding-libs tarball
  - Manpage reviewed and updated


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.1-1
changelog:
  - New upstream release 1.4.1
  - Add support for netgroups to the proxy provider
  - Fixes a minor bug with UIDs/GIDs >= 2^31
  - Fixes a segfault in the kerberos provider
  - Fixes a segfault in the NSS responder if a data provider crashes
  - Correctly use sdap_netgroup_search_base


author: Stephen Gallagher <sgallagh@redhat.com> - 1.4.1-3
changelog:
  - Solve a shutdown race-condition that sometimes left processes running
  - Resolves: rhbz#606887 - SSSD stops on upgrade


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.0-1
changelog:
  - New upstream release 1.5.0
  - Fixed issues with LDAP search filters that needed to be escaped
  - Add Kerberos FAST support on platforms that support it
  - Reduced verbosity of PAM_TEXT_INFO messages for cached credentials
  - Added a Kerberos access provider to honor .k5login
  - Addressed several thread-safety issues in the sss_client code
  - Improved support for delayed online Kerberos auth
  - Significantly reduced time between connecting to the network/VPN and
  - acquiring a TGT
  - Added feature for automatic Kerberos ticket renewal
  - Provides the kerberos ticket for long-lived processes or cron jobs
  - even when the user logs out
  - Added several new features to the LDAP access provider
  - Support for 'shadow' access control
  - Support for authorizedService access control
  - Ability to mix-and-match LDAP access control features
  - Added an option for a separate password-change LDAP server for those
  - platforms where LDAP referrals are not supported
  - Added support for manpage translations


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-1
changelog:
  - New upstream release 1.5.1
  - Addresses CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
  - Vast performance improvements when enumerate = true
  - All PAM actions will now perform a forced initgroups lookup instead of just
  - a user information lookup
  -   This guarantees that all group information is available to other
  -   providers, such as the simple provider.
  - For backwards-compatibility, DNS lookups will also fall back to trying the
  - SSSD domain name as a DNS discovery domain.
  - Support for more password expiration policies in LDAP
  -    389 Directory Server
  -    FreeIPA
  -    ActiveDirectory
  - Support for ldap_tls_{cert,key,cipher_suite} config options
  -Assorted bugfixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-3
changelog:
  - Fix nested group member filter sanitization for RFC2307bis
  - Put translated tool manpages into the sssd-tools subpackage


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-8
changelog:
  - Resolves: rhbz#677768 - name service caches names, so id command shows
  -                         recently deleted users


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.2-1
changelog:
  - New upstream release 1.5.2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.2
  - Fixes for support of FreeIPA v2
  - Fixes for failover if DNS entries change
  - Improved sss_obfuscate tool with better interactive mode
  - Fix several crash bugs
  - Don't attempt to use START_TLS over SSL. Some LDAP servers can't handle this
  - Delete users from the local cache if initgroups calls return 'no such user'
  - (previously only worked for getpwnam/getpwuid)
  - Use new Transifex.net translations
  - Better support for automatic TGT renewal (now survives restart)
  - Netgroup fixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.4-1
changelog:
  - New upstream release 1.5.4
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.4
  - Fixes for Active Directory when not all users and groups have POSIX attributes
  - Fixes for handling users and groups that have name aliases (aliases are ignored)
  - Fix group memberships after initgroups in the IPA provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-1
changelog:
  - New upstream release 1.5.5
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.5
  - Fixes for several crash bugs
  - LDAP group lookups will no longer abort if there is a zero-length member
  - attribute
  - Add automatic fallback to 'cn' if the 'gecos' attribute does not exist


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-3
changelog:
  - Fix systemd conversion. Upgrades from SysV to systemd weren't properly
  - enabling the systemd service.
  - Fix a serious memory leak in the memberOf plugin
  - Fix an issue where the user's full name would sometimes be removed
  - from the cache


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.5-5
changelog:
  - Resolves: rhbz#697057 - kpasswd fails when using sssd and
  -                         kadmin server != kdc server
  - Upgrades from SysV should now maintain enabled/disabled status


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.6-1
changelog:
  - New upstream release 1.5.6
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.6
  - Fixed a serious memory leak in the memberOf plugin
  - Fixed a regression with the negative cache that caused it to be essentially
  - nonfunctional
  - Fixed an issue where the user's full name would sometimes be removed from
  - the cache
  - Fixed an issue with password changes in the kerberos provider not working
  - with kpasswd


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.7-1
changelog:
  - Resolves: rhbz#700891 - CVE-2011-1758 sssd: automatic TGT renewal overwrites
  -                         cached password with predicatable filename


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.7-3
changelog:
  - Resolves: rhbz#706740 - Orphaned links on rc0.d-rc6.d
  - Make sure to properly convert to systemd if upgrading from newer
  - updates for Fedora 14


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.8-1
changelog:
  - New upstream release 1.5.8
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.8
  - Support for the LDAP paging control
  - Support for multiple DNS servers for name resolution
  - Fixes for several group membership bugs
  - Fixes for rare crash bugs


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.9-1
changelog:
  - New upstream release 1.5.9
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.9
  - Support for overriding home directory, shell and primary GID locally
  - Properly honor TTL values from SRV record lookups
  - Support non-POSIX groups in nested group chains (for RFC2307bis LDAP
  - servers)
  - Properly escape IPv6 addresses in the failover code
  - Do not crash if inotify fails (e.g. resource exhaustion)
  - Don't add multiple TGT renewal callbacks (too many log messages)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.10-1
changelog:
  - New upstream release 1.5.10
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.10
  - Fixed a regression introduced in 1.5.9 that could result in blocking calls
  - to LDAP


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.11-2
changelog:
  - New upstream release 1.5.11
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.5.11
  - Fix a serious regression that prevented SSSD from working with ldaps:// URIs
  - IPA Provider: Fix a bug with dynamic DNS that resulted in the wrong IPv6
  - address being saved to the AAAA record


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.0-1
changelog:
  - New upstream release 1.6.0
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.0
  - Add host access control support for LDAP (similar to pam_host_attr)
  - Finer-grained control on principals used with Kerberos (such as for FAST or
  - validation)
  - Added a new tool sss_cache to allow selective expiring of cached entries
  - Added support for LDAP DEREF and ASQ controls
  - Added access control features for Novell Directory Server
  - FreeIPA dynamic DNS update now checks first to see if an update is needed
  - Complete rewrite of the HBAC library
  - New libraries: libipa_hbac and libipa_hbac-python


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.1-1
changelog:
  - New upstream release 1.6.1
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.1
  - Fixes a serious issue with LDAP connections when the communication is
    dropped (e.g. VPN disconnection, waking from sleep)
  - SSSD is now less strict when dealing with users/groups with multiple names
    when a definitive primary name cannot be determined
  - The LDAP provider will no longer attempt to canonicalize by default when
    using SASL. An option to re-enable this has been provided.
  - Fixes for non-standard LDAP attribute names (e.g. those used by Active
    Directory)
  - Three HBAC regressions have been fixed.
  - Fix for an infinite loop in the deref code


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.2-1
changelog:
  - Improved handling of users and groups with multi-valued name attributes
    (aliases)
  - Performance enhancements
      Initgroups on RFC2307bis/FreeIPA
      HBAC rule processing
  - Improved process-hang detection and restarting
  - Enabled the midpoint cache refresh by default (fewer cache misses on
    commonly-used entries)
  - Cleaned up the example configuration
  - New tool to change debug level on the fly


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.2-4
changelog:
  - Change selinux policy requirement to Conflicts: with the old version,
    rather than Requires: the supported version.


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.3-1
changelog:
  - New upstream release 1.6.3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.6.3
  - Fixes a major cache performance issue introduced in 1.6.2
  - Fixes a potential infinite-loop with certain LDAP layouts


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.3-4
changelog:
  - Resolves: rhbz#753639 - sssd_nss crashes when passed invalid UTF-8 for the
                            username in getpwnam()
  - Resolves: rhbz#758425 - LDAP failover not working if server refuses
                            connections


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.4-1
changelog:
  - New upstream release 1.6.4
  - Rolls up previous patches applied to the 1.6.3 tarball
  - Fixes a rare issue causing crashes in the failover logic
  - Fixes an issue where SSSD would return the wrong PAM error code for users
    that it does not recognize.


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-1
changelog:
  - New upstream release 1.7.0
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.7.0
  - Support for case-insensitive domains
  - Support for multiple search bases in the LDAP provider
  - Support for the native FreeIPA netgroup implementation
  - Reliability improvements to the process monitor
  - New DEBUG facility with more consistent log levels
  - New tool to change debug log levels without restarting SSSD
  - SSSD will now disconnect from LDAP server when idle
  - FreeIPA HBAC rules can choose to ignore srchost options for significant
    performance gains
  - Assorted performance improvements in the LDAP provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-3
changelog:
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features


author: Stephen Gallagher <sgallagh@redhat.com> - 1.7.0-5
changelog:
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features - fix netgroups and sudo as well


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-1.beta1
changelog:
  - New upstream release
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta1
  - Support for the service map in NSS
  - Support for setting default SELinux user context from FreeIPA
  - Support for retrieving SSH user and host keys from LDAP (Experimental)
  - Support for caching autofs LDAP requests (Experimental)
  - Support for caching SUDO rules (Experimental)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-1.beta2
changelog:
  - New upstream release
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta2
  - Fix two minor manpage bugs
  - Include the IPA AutoFS provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-4.beta3
changelog:
  - New upstream release 1.8.0 beta 3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.0beta3
  - Fixed a regression in group enumeration since 1.7.0
  - Fixed several memory-corruption bugs
  - Finalized the ABI for the autofs support
  - Fixed a regression in the proxy provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-6
changelog:
  - New upstream release 1.8.0
  - Support for the service map in NSS
  - Support for setting default SELinux user context from FreeIPA
  - Support for retrieving SSH user and host keys from LDAP (Experimental)
  - Support for caching autofs LDAP requests (Experimental)
  - Support for caching SUDO rules (Experimental)
  - Include the IPA AutoFS provider
  - Fixed several memory-corruption bugs
  - Fixed a regression in group enumeration since 1.7.0
  - Fixed a regression in the proxy provider
  - Resolves: rhbz#741981 - Separate Cache Timeouts for SSSD
  - Resolves: rhbz#797968 - sssd_be: The requested tar get is not configured is
                            logged at each login
  - Resolves: rhbz#754114 - [abrt] sssd-1.6.3-1.fc16: ping_check: Process
                            /usr/sbin/sssd was killed by signal 11 (SIGSEGV)
  - Resolves: rhbz#743133 - Performance regression with Kerberos authentication
                            against AD
  - Resolves: rhbz#773706 - SSSD fails during autodetection of search bases for
                            new LDAP features
  - Resolves: rhbz#786957 - sssd and kerberos should change the default location for create the Credential Cashes to /run/usr/USERNAME/krb5cc


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-7
changelog:
  - New upstream release 1.8.1
  - Resolve issue where we could enter an infinite loop trying to connect to an
    auth server
  - Fix serious issue with complex (3+ levels) nested groups
  - Fix netgroup support for case-insensitivity and aliases
  - Fix serious issue with lookup bundling resulting in requests never
    completing
  - IPA provider will now check the value of nsAccountLock during pam_acct_mgmt
    in addition to pam_authenticate
  - Fix several regressions in the proxy provider
  - Resolves: rhbz#743133 - Performance regression with Kerberos authentication
                            against AD
  - Resolves: rhbz#799031 - --debug option for sss_debuglevel doesn't work


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-8
changelog:
  - Fix uninitialized value bug causing crashes throughout the code
  - Resolves: rhbz#804783 - [abrt] Segfault during LDAP 'services' lookup


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.1-9
changelog:
  - Don't duplicate libsss_autofs.so in two packages
  - Set explicit package contents instead of globbing


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.2-10
changelog:
  - New upstream release 1.8.2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.2
  - Several fixes to case-insensitive domain functions
  - Fix for GSSAPI binds when the keytab contains unrelated principals
  - Fixed several segfaults
  - Workarounds added for LDAP servers with unreadable RootDSE
  - SSH knownhostproxy will no longer enter an infinite loop preventing login
  - The provided SYSV init script now starts SSSD earlier at startup and stops
    it later during shutdown
  - Assorted minor fixes for issues discovered by static analysis tools


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.3-11
changelog:
  - New upstream release 1.8.3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.8.3
  - Numerous manpage and translation updates
  - LDAP: Handle situations where the RootDSE isn't available anonymously
  - LDAP: Fix regression for users using non-standard LDAP attributes for user
    information


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-1.beta1
changelog:
  - New upstream release 1.9.0 beta 1
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta1
  - Add native support for autofs to the IPA provider
  - Support for ID-mapping when connecting to Active Directory
  - Support for handling very large (> 1500 users) groups in Active Directory
  - Support for sub-domains (will be used for dealing with trust relationships)
  - Add a new fast in-memory cache to speed up lookups of cached data on
    repeated requests


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-2.beta1
changelog:
  - Fix several regressions since 1.5.x
  - Ensure that the RPM creates the /var/lib/sss/mc directory
  - Add support for Netscape password warning expiration control
  - Rebuild against libldb 1.1.6


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-5.beta2
changelog:
  - New upstream release 1.9.0 beta 2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta2
  - Add support for the Kerberos DIR cache for storing multiple TGTs
    automatically
  - Major performance enhancement when storing large groups in the cache
  - Major performance enhancement when performing initgroups() against Active
    Directory
  - SSSDConfig data file default locations can now be set during configure for
    easier packaging


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-7.beta2
changelog:
  - Switch unicode library from libunistring to Glib
  - Drop unnecessary explicit Requires on keyutils
  - Guarantee that versioned Requires include the correct architecture


author: Stephen Gallagher <sgallagh@redhat.com> - 1.9.0-8.beta3
changelog:
  - New upstream release 1.9.0 beta 3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta3
  - Add a new PAC responder for dealing with cross-realm Kerberos trusts
  - Terminate idle connections to the NSS and PAM responders


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-9.beta4
changelog:
  - New upstream release 1.9.0 beta 4
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta4
  - Add a new AD provider to improve integration with Active Directory 2008 R2
    or later servers
  - SUDO integration was completely rewritten. The new implementation works
    with multiple domains and uses an improved refresh mechanism to download
    only the necessary rules
  - The IPA authentication provider now supports subdomains
  - Fixed regression for setups that were setting default_tkt_enctypes
    manually by reverting a previous workaround.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-12.beta5
changelog:
  - New upstream release 1.9.0 beta 5
  - Obsoletes the patch for missing DP_OPTION_TERMINATOR in AD provider options
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta5
  - Many fixes for the support for setting default SELinux user context from
    FreeIPA, most notably fixed the specificity evaluation
  - Fixed an incorrect default in the krb5_canonicalize option of the AD
    provider which was preventing password change operation
  - The shadowLastChange attribute value is now correctly updated with the
    number of days since the Epoch, not seconds


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-13.beta6
changelog:
  - New upstream release 1.9.0 beta 6
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.0beta6
  - A new option, override_shell was added. If this option is set, all users
    managed by SSSD will have their shell set to its value.
  - Fixes for the support for setting default SELinux user context from FreeIPA.
  - Fixed a regression introduced in beta 5 that broke LDAP SASL binds
  - The SSSD supports the concept of a Primary Server and a Back Up Server in
    failover
  - A new command-line tool sss_seed is available to help prime the cache with
    a user record when deploying a new machine
  - SSSD is now able to discover and save the domain-realm mappings
    between an IPA server and a trusted Active Directory server.
  - Packaging changes to fix ldconfig usage in subpackages (#843995)
  - Rebuild against libldb 1.1.9


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-14.beta6
changelog:
  - Don't discard HBAC rule processing result if SELinux is on
    Resolves: rhbz#846792 (CVE-2012-3462)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-18.beta6
changelog:
  - Change the default ccache location to DIR:/run/user/${UID}/krb5cc
    and patch man page accordingly
  - Resolves: rhbz#851304


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.4-3
changelog:
  - Recreate Kerberos ccache directory if it's missing
  - Resolves: rhbz#853558 - [sssd[krb5_child[PID]]]: Credential cache
                            directory /run/user/UID/ccdir does not exist


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-4.beta1
changelog:
  - Explicitly Require libini_config >= 1.0.0.1 to work around a SONAME bug
    in ding-libs
  - Fix SSH integration with fully-qualified domains
  - Add the ability to dynamically discover the NetBIOS name


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-6.beta1
changelog:
  - Resolves: rhbz#961357 - Missing dyndns_update entry in sssd.conf during
                            realm join
  - Resolves: rhbz#961278 - Login failure: Enterprise Principal enabled by
                            default for AD Provider
  - Resolves: rhbz#961251 - sssd does not create user's krb5 ccache dir/file
                            parent directory when logging in


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-7.beta1
changelog:
  - Apply a couple of patches from upstream git that resolve crashes when
    ID mapping object was not initialized properly but needed later


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-8.beta2
changelog:
  - New upstream release 1.10 beta2
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.10.0beta2
  - BuildRequire libcmocka-devel in order to run all upstream tests during build
  - BuildRequire libnl3 instead of libnl1
  - No longer BuildRequire initscripts, we no longer use /sbin/service
  - Remove explicit krb5-libs >= 1.10 requires; this platform doensn't carry any
    older krb5-libs version


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-9.beta2
changelog:
  - Fix typo in Requires that prevented an upgrade (#973916)
  - Use a hardcoded version in Conflicts, not less-than-current


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.0-11.beta2
changelog:
  - Apply a number of patches from upstream to fix issues found post-beta,
    in particular:
    -- segfault with a high DEBUG level
    -- Fix IPA password migration (upstream #1873)
    -- Fix fail over when retrying SRV resolution (upstream #1886)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.10.0-14
changelog:
  - Fix Obsoletes: to account for dist tag
  - Convert post and pre scripts to run on the sssd-common subpackage
  - Remove old conversion from SYSV


author: Stephen Gallagher <sgallagh@redhat.com> - 1.10.0-16
changelog:
  - Move sssd_pac to the sssd-ipa and sssd-ad subpackages
  - Trim out RHEL5-specific macros since we don't build on RHEL 5
  - Trim out macros for Fedora older than F18
  - Update libldb requirement to 1.1.16
  - Trim RPM changelog down to the last year


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0.2beta2
changelog:
  - Resolves: #906427 - Do not use %{_lib} in specfile for the nss and
                        pam libraries


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0-0.4.beta2
changelog:
  - Resolves: #967012 - [abrt] sssd-1.9.5-1.fc18: sss_mmap_cache_gr_invalidate_gid:
                        Process /usr/libexec/sssd/sssd_nss was killed by
                        signal 11 (SIGSEGV)
  - Resolves: #996214 - sssd proxy_child segfault


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0-2
changelog:
  - Backport simplification of ccache management from 1.11.1
  - Resolves: rhbz#1010553 - sssd setting KRB5CCNAME=(null) on login


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.0-3
changelog:
  - Fix multicast checks in the SSSD
  - Resolves: rhbz#1007475 - The multicast check is wrong in the sudo source
                             code getting the host info


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.2-1
changelog:
  - New upstream release 1.11.2
  - Remove upstreamed patches
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.2


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.3-1
changelog:
  - New upstream release 1.11.3
  - Remove upstreamed patches
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.3


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.4-1
changelog:
  - New upstream release 1.11.4
  - Remove upstreamed patch
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.4


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.5-1
changelog:
  - New upstream release 1.11.5
  - Remove upstreamed patch
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.11.5


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.1-2
changelog:
  - Resolves: rhbz#1139962 - Fedora 21, FreeIPA 4.0.2: sssd does not find user
                             private group from server


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.2-6
changelog:
  - Fix regressions and bugs in sssd upstream 1.12.2
  - https://fedorahosted.org/sssd/ticket/{id}
  - Regressions: #2471, #2475, #2483, #2487, #2529, #2535
  - Bugs: #2287, #2445


author: Sumit Bose <sbose@redhat.com> - 1.12.2-7
changelog:
  - Resolves: rhbz#1175511 - sssd-libwbclient conflicts with Samba's and causes
                             crash in wbinfo
                             - in addition to the patch libwbclient.so is
                               filtered out of the Provides list of the package


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-1
changelog:
  - New upstream release 1.12.3
  - https://fedorahosted.org/sssd/wiki/Releases/Notes-1.12.3
  - Fix spelling errors in description (fedpkg lint)


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-2
changelog:
  - Resolves: rhbz#1164156 - libsss_simpleifp should pull sssd-dbus
  - Resolves: rhbz#1179379 - gzip: stdin: file size changed while
                             zipping when rotating logfile


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-3
changelog:
  - Apply a number of patches from upstream to fix issues found 1.12.3
  - Resolves: rhbz#1176373 - dyndns_iface does not accept multiple
                             interfaces, or isn't documented to be able to
  - Resolves: rhbz#988068 - getpwnam_r fails for non-existing users when sssd is
                            not running
  - Resolves: upstream #2557  authentication failure with user from AD


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-4
changelog:
  - Decrease priority of sssd-libwbclient 20 -> 5
  - It should be lower than priority of samba veriosn of libwbclient.
  - https://bugzilla.redhat.com/show_bug.cgi?id=1175511#c18


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.3-6
changelog:
  - Fix double free in monitor
  - Resolves: rhbz#1186887 [abrt] sssd-common: talloc_abort():
                          sssd killed by SIGABRT


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-2
changelog:
  - Add support for python3 bindings
  - Add requirement to python3 or python3 bindings
  - Resolves: rhbz#1014594 - sssd: Support Python 3


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-5
changelog:
  - Fix regressions with ipa and SELinux
  - Resolves: upstream #2587 - With empty ipaselinuxusermapdefault security
                               context on client is staff_u


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-6
changelog:
  - Fix slow login with ipa and SELinux
  - Resolves: upstream #2624 - Only set the selinux context if the context
                               differs from the local one


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.12.4-8
changelog:
  - Backport important patches from upstream 1.13 prerelease
  - Resolves: rhbz#1060325 - Does sssd-ad use the most suitable
                             attribute for group name
  - Resolves: upstream #2335 - Investigate using the krb5 responder
                               for driving the PAM conversation with OTPs
  - Enable cmocka tests for secondary architectures


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.0-4
changelog:
  - Fix ipa-migration bug
  - Resolves: upstream #2719 - IPA: returned unknown dp error code with disabled
                               migration mode


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.0-6
changelog:
  - Fix OTP bug
  - Resolves: upstream #2729 - Do not send SSS_OTP if both factors were
                               entered separately


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.1-2
changelog:
  - Fix few segfaults
  - Resolves: upstream #2811 - PAM responder crashed if user was not set
  - Resolves: upstream #2810 - sssd_be crashed in ipa_srv_ad_acct_lookup_step


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.1-3
changelog:
  - python-sssdconfig: Fix parssing sssd.conf without config_file_version
  - Resolves: upstream #2837 - REGRESSION: ipa-client-automout failed


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.3-5
changelog:
  - Resolves: rhbz#1310664 - [RFE] IPA: resolve external group memberships of IPA
                             groups during getgrnam and getgrgid
  - Resolves: rhbz#1301303 - sss_obfuscate: SyntaxError: Missing parentheses
                             in call to 'print'


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.3-6
changelog:
  - Resolves: rhbz#1276868 - Sudo PAM Login should support multiple password
                             prompts (e.g. Password + Token)
  - Resolves: rhbz#1313041 - ssh with sssd proxy fails with "Connection closed
                             by remote host" if locale not available


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.4-3
changelog:
  - Resolves: rhbz#1335639 - [abrt] sssd-dbus: ldb_msg_find_element():
                             sssd_ifp killed by SIGSEGV


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.14.1-2
changelog:
  - Backport important patches from upstream 1.14.2 prerelease
  - Resolves: upstream #3154 - sssd exits if clock is adjusted backwards after
                               boot
  - Resolves: upstream #3163 - resolving IPA nested user group is broken in 1.14


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.14.1-3
changelog:
  - Fix regression with krb5_map_user
  - Resolves: rhbz#1375552 - krb5_map_user doesn't seem effective anymore
  - Resolves: rhbz#1349286 - authconfig fails with SSSDConfig.NoDomainError:
                             default if nonexistent domain is mentioned


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.14.2-2
changelog:
  - Resolves: rhbz#1369130 - nss_sss should not link against libpthread
  - Resolves: rhbz#1392916 - sssd failes to start after update
  - Resolves: rhbz#1398789 - SELinux is preventing sssd from 'write' accesses
                             on the directory /etc/sssd


author: Jakub Hrozek <jhrozek@redhat.com> - 1.15.0-4
changelog:
  - Cherry-pick patches from upstream that enable the files provider
  - Enable the files domain
  - Retire patch 0501-Partially-revert-CONFIG-Use-default-config-when-none.patch
    which is superseded by the files domain autoconfiguration
  - Related: rhbz#1357418 - SSSD fast cache for local users


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-0.beta.2
changelog:
  - Fix issue with IPA + SELinux in containers
  - Resolves: upstream https://fedorahosted.org/sssd/ticket/3297


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-0.beta.3
changelog:
  - Resolves: rhbz#1445680 - Properly fall back to local Smartcard authentication
  - Resolves: rhbz#1437199 - sssd-nfs-idmap-1.15.2-1.fc25.x86_64 conflicts with
                             file from package sssd-common-1.15.1-1.fc25.x86_64
  - Resolves: rhbz#1063278 - sss_ssh_knownhostsproxy doesn't fall back to ipv4


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-4
changelog:
  - Resolves: rhbz#1488327 - SELinux is preventing selinux_child from write
                             access on the sock_file system_bus_socket
  - Resolves: rhbz#1490402 - SSSD does not create /var/lib/sss/deskprofile and
                             fails to download desktop profile data
  - Resolves: upstream#3485 - getsidbyid does not work with 1.15.3
  - Resolves: upstream#3488 - SUDO doesn't work for IPA users on IPA clients
                              after applying ID Views for them in IPA server
  - Resolves: upstream#3501 - Accessing IdM kerberos ticket fails while id
                              mapping is applied


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.15.3-5
changelog:
  - Resolves: rhbz#1499354 - CVE-2017-12173 sssd: unsanitized input when
                             searching in local cache database access on
                             the sock_file system_bus_socket


author: Lukas Slebodnik <lslebodn@fedoraproject.org> - 1.16.0-5
changelog:
  - Resolves: upstream#3523 - ABRT crash - /usr/libexec/sssd/sssd_nss in
                              setnetgrent_result_timeout
  - Resolves: upstream#3588 - sssd_nss consumes more memory until restarted
                              or machine swaps
  - Resolves: failure in glibc tests
              https://sourceware.org/bugzilla/show_bug.cgi?id=22530
  - Resolves: upstream#3451 - When sssd is configured with id_provider proxy and
                              auth_provider ldap, login fails if the LDAP server
                              is not allowing anonymous binds
  - Resolves: upstream#3285 - SSSD needs restart after incorrect clock is
                              corrected with AD
  - Resolves: upstream#3586 - Give a more detailed debug and system-log message
                              if krb5_init_context() failed
  - Resolves: rhbz#1431153 - SSSD ships a drop-in configuration snippet
                             in /etc/systemd/system
  - Backport few upstream features from 1.16.1


author: Fabiano Fidêncio <fidencio@fedoraproject.org> - 1.16.0-12
changelog:
  - Resolves: rhbz#1538643 - SSSD crashes when retrieving a Desktop Profile
                             with no specific host/hostgroup set
  - Resolves: upstream#3621 - FleetCommander integration must not require
                              capability DAC_OVERRIDE


author: Fabiano Fidêncio <fidencio@fedoraproject.org> - 1.16.1-2
changelog:
  - Resolves: upstream#3573 - sssd won't show netgroups with blank domain
  - Resolves: upstream#3660 - confdb_expand_app_domains() always fails
  - Resolves: upstream#3658 - Application domain is not interpreted correctly
  - Resolves: upstream#3687 - KCM: Don't pass a non null terminated string to
                              json_loads()
  - Resolves: upstream#3386 - KCM: Payload buffer is too small
  - Resolves: upstream#3666 - Fix usage of str.decode() in our tests
  - A few KCM misc fixes


author: Fabiano Fidêncio <fidencio@fedoraproject.org> - 1.16.1-3
changelog:
  - Resolves: upstream#3684 - A group is not updated if its member is removed
                              with the cleanup task, but the group does not
                              change
  - Resolves: upstream#3558 - sudo: report error when two rules share cn
  - Tone down shutdown messages for socket activated responders
  - IPA: Qualify the externalUser sudo attribute
  - Resolves: upstream#3550 - refresh_expired_interval does not work with
                              netgrous in 1.15
  - Resolves: upstream#3402 - Support alternative sources for the files provider
  - Resolves: upstream#3646 - SSSD's GPO code ignores ad_site option
  - Resolves: upstream#3679 - Make nss netgroup requests more robust
  - Resolves: upstream#3634 - sssctl COMMAND --help fails if sssd is not
                              configured
  - Resolves: upstream#3469 - extend sss-certmap man page regarding priority
                              processing
  - Improve docs/debug message about GC detection
  - Resolves: upstream#3715 - ipa 389-ds-base crash in krb5-libs - k5_copy_etypes
                              list out of bound?
  - Resolves: upstream#2653 - Group renaming issue when "id_provider = ldap" is
                              set.
  - Document which principal does the AD provider use
  - Resolves: upstream#3680 - GPO: SSSD fails to process GPOs If a rule is
                              defined, but contains no SIDs
  - Resolves: upstream#3520 - Files provider supports only BE_FILTER_ENUM
  - Resolves: rhbz#1540703 - FreeIPA/SSSD implicit_file sssd_nss error: The Data
                             Provider returned an error
                             [org.freedesktop.sssd.Error.DataProvider.Fatal]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.2-1
changelog:
  - Update to 1.16.2 release
  - Cleanup unused global definitions
  - Remove python2 references from the spec file
  - Resolves: rhbz#1585313 - Kerberos with sssd-kcm is not working on s390x


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-2
changelog:
  - Resolves: rhbz#1622026 - sssd 2.0 regression: Kerberos authentication
                             fails with the KCM ccache


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-4
changelog:
  - Resolves: rhbz#1615417 - [RFE] Add Smart Card authentication for local
                             users


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-7
changelog:
  - Resolves: rhbz#1628503 - sssd only sets the SELinux login context if it
                             differs from the default


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-8
changelog:
  - Resolves: rhbz#1628126 - [abrt] [faf] sssd: unknown function():
                              /usr/libexec/sssd/sssd_be killed by 11 crash
                              func _dbus_list_unlink


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-9
changelog:
  - Resolves: rhbz#1624785 - Remove references of sss_user/group/add/del
                             commands in man pages since local provider
                             is deprecated


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-10
changelog:
  - Resolves: rhbz#1626001 - SSSD should log to syslog if a domain is not
                             started due to a misconfiguration


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-11
changelog:
  - Resolves: rhbz#1628122 - Printing incorrect information about domain
                             with sssctl utility


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-16
changelog:
  - Related: rhbz#1620123 - [RFE] Add option to specify a Smartcard with a
                            PKCS#11 URI


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-17
changelog:
  - Related: rhbz#1637131 - pam_unix unable to match fully qualified username
                            provided by sssd during smartcard auth using gdm


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-18
changelog:
  - Related: rhbz#1638006 - Files: The files provider always enumerates
                            which causes duplicate when running getent passwd


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-19
changelog:
  - Add OSCP checks for p11_child
  - Related: rhbz#1615417 - [RFE] Add Smart Card authentication for local
                            users


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-21
changelog:
  - Related: rhbz#1638150 - session not recording for local user when groups defined
  - Also add silence a Coverity warning, which is related to rhbz#1637131


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-23
changelog:
  - Resolves: rhbz#1642508 - sssd ifp crash when trying to access ipa webui
                             with smart card


author: Michal Židek <mzidek@redhat.com> - 2.0.0-24
changelog:
  - Resolves: rhbz#1646168 - sssctl access-report always prints an error message
  - Resolves: rhbz#1643053 - Restarting the sssd-kcm service should reload the
                             configuration without having to restart the whole
                             sssd
  - Resolves: rhbz#1640576 - sssctl reports incorrect information about local
                             user's cache entry expiration time
  - Resolves: rhbz#1645238 - Unable to su to root when logged in as a local user
  - Resolves: rhbz#1639411 - sssd support for for smartcards using ECC keys


author: Michal Židek <mzidek@redhat.com> - 2.0.0-25
changelog:
  - Resolves: rhbz#1645566 - SSSD 2.x does not sanitize domain name properly
                             for D-bus, resulting in a crash


author: Michal Židek <mzidek@redhat.com> - 2.0.0-27
changelog:
  - Resolves: rhbz#1657979 - SSSD's LDAP authentication provider does not work
                             if ID provider is authenticated with GSSAPI


author: Michal Židek <mzidek@redhat.com> - 2.0.0-29
changelog:
  - Resolves: rhbz#1655459 - [abrt] [faf] sssd: raise():
                             /usr/libexec/sssd/proxy_child killed by 6


author: Michal Židek <mzidek@redhat.com> - 2.0.0-30
changelog:
  - Resolves: 1657898 - SSSD must be cleared/restarted periodically in order to
                        retrieve AD users through IPA Trust


author: Michal Židek <mzidek@redhat.com> - 2.0.0-32
changelog:
  - Resolves: rhbz#1625670 - sssd needs to require a newer version of libtalloc
              and libtevent to avoid an issue in GPO processing


author: Michal Židek <mzidek@redhat.com> - 2.0.0-33
changelog:
  - Resolves: rhbz#1646113 - Missing concise documentation about valid options
                             for sssd-files-provider


author: Michal Židek <mzidek@redhat.com> - 2.0.0-34
changelog:
  - Resolves: rhbz#1622008 - Error message when IPA server uninstall calls
                             kdestroy caused by KCM returning a wrong error
                             code during the delete operation


author: Michal Židek <mzidek@redhat.com> - 2.0.0-36
changelog:
  - Resolves: rhbz#1652563 - incorrect example in the man page of idmap_sss
                             suggests using * for backend sss


author: Michal Židek <mzidek@redhat.com> - 2.0.0-38
changelog:
  - Resolves: rhbz#1578014 - sssd does not work under non-root user
  - Note: Actually the patches were in the 2.0.0-37, this one just adds this
          changelog because it was missing.


author: Michal Židek <mzidek@redhat.com> - 2.0.0-39
changelog:
  - Resolves: rhbz#1661183 - SSSD 2.0 has drastically lower sbus timeout than
                             1.x, this can result in time outs


author: Michal Židek <mzidek@redhat.com> - 2.0.0-40
changelog:
  -Resolves: rhbz#1660083 - extraAttributes is org.freedesktop.DBus.Error.
                            UnknownProperty: Unknown property


author: Michal Židek <mzidek@redhat.com> - 2.0.0-41
changelog:
  -Resolves: rhbz#1659498 - Re-setting the trusted AD domain fails due to wrong
                            subdomain service name being used


author: Michal Židek <mzidek@redhat.com> - 2.0.0-42
changelog:
  - Resolves: rhbz#1645291 - Perform some basic ccache initialization as part
                             of gen_new to avoid a subsequent switch call
                             failure


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-43
changelog:
  - Resolves: rhbz#1672780 - gdm login not prompting for username when smart
                             card maps to multiple users


author: Michal Židek <mzidek@redhat.com> - 2.0.0-45
changelog:
  - Replace ARRAY_SIZE with N_ELEMENTS to reflect samba changes. This is
    done here in order to unblock gating changes before rebase.
  - Related: rhbz#1682305


author: Jakub Hrozek <jhrozek@redhat.com> - 2.2.0-2
changelog:
  - Resolves: rhbz#1673443 - sssd man pages: The default value of
                             "ldap_user_home_directory" is not mentioned
                             with AD server configuration


author: Jakub Hrozek <jhrozek@redhat.com> - 2.2.0-3
changelog:
  - Resolves: rhbz#1725168 - sssd-proxy crashes resolving groups with
                             no members


author: Jakub Hrozek <jhrozek@redhat.com> - 2.2.0-4
changelog:
  - Resolves: rhbz#1283798 - sssd failover does not work on connecting to
                             non-responsive ldaps:// server


author: Michal Židek <mzidek@redhat.com> - 2.2.0-6
changelog:
  - Resolves: rhbz#1726945 - negative cache does not use values from
                             'filter_users' config option for known domains


author: Michal Židek <mzidek@redhat.com> - 2.2.0-7
changelog:
  - Resolves: rhbz#1711318 - p11_child::sign_data() function implementation is
                             not FIPS140 compliant


author: Michal Židek <mzidek@redhat.com> - 2.2.0-8
changelog:
  - Resolves: rhbz#1699480 - Include libsss_nss_idmap-devel in the Builder
                             repository
                           - This just required a raise in release number
                             and changelog for the record.


author: Michal Židek <mzidek@redhat.com> - 2.2.0-10
changelog:
  - Resolves: rhbz#1736483 - Sudo prompt for smart card authentication is missing
                             the trailing colon


author: Michal Židek <mzidek@redhat.com> - 2.2.0-11
changelog:
  - Resolves: rhbz#1733372 - permission denied on logs when running sssd as
                             non-root user


author: Michal Židek <mzidek@redhat.com> - 2.2.0-13
changelog:
  - Resolves: rhbz#1669407 - MAN: Document that PAM stack contains the
              systemd-user service in the account phase in RHEL-8


author: Michal Židek <mzidek@redhat.com> - 2.2.0-14
changelog:
  - Resolves: rhbz#1736796 - sssd config option "default_domain_suffix"
                             should not cause files domain entries to be
                             qualified, this can break sudo access


author: Michal Židek <mzidek@redhat.com> - 2.2.0-15
changelog:
  - Resolves: rhbz#1736265 - Smart Card auth of local user: endless
                             loop if wrong PIN was provided


author: Michal Židek <mzidek@redhat.com> - 2.2.0-16
changelog:
  - Resolves: rhbz#1736861 - dyndns_update = True is no longer enough to get
                             the IP address of the machine updated in IPA upon
                             sssd.service startup


author: Michal Židek <mzidek@redhat.com> - 2.2.0-17
changelog:
  - Resolves: rhbz#1676385 - pam_sss with smartcard auth does not create gnome
                             keyring
  - Also apply a patch to fix gating tests issue


author: Michal Židek <mzidek@redhat.com> - 2.2.0-18
changelog:
  - Resolves: rhbz#1744134 - New defect found in sssd-2.2.0-16.el8
  - Also sync. kcm multihost tests with master


author: Michal Židek <mzidek@redhat.com> - 2.2.0-19
changelog:
  - Resolves: rhbz#1712875 - Old kerberos credentials active instead of valid
                             new ones (kcm)


author: Michal Židek <mzidek@redhat.com> - 2.2.3-2
changelog:
  * Resolves: rhbz#1753694 - Rebase sssd to the latest upstream release
              PART2: Fix gating issue.


author: Michal Židek <mzidek@redhat.com> - 2.2.3-3
changelog:
  * Resolves: rhbz#1753694 - Rebase sssd to the latest upstream release
              Increasing version number to pick latest libldb


author: Michal Židek <mzidek@redhat.com> - 2.2.3-4
changelog:
  * Resolves: rhbz#1781728 - sssctl config-check command does not give proper
                             error messages with line numbers


author: Michal Židek <mzidek@redhat.com> - 2.2.3-5
changelog:
  * Resolves: rhbz#1744500 - [Doc]Provide explanation on escape character
                             for match rules sss-certmap


author: Michal Židek <mzidek@redhat.com> - 2.2.3-9
changelog:
  * Resolves: rhbz#1783190 - [abrt] [faf] sssd:
                             raise(): /usr/libexec/sssd/sssd_autofs killed by 6


author: Michal Židek <mzidek@redhat.com> - 2.2.3-10
changelog:
  * Resolves: rhbz#1583592 - [RFE] Add configurable randomness to SSSD ldap
                             connection timeout


author: Michal Židek <mzidek@redhat.com> - 2.2.3-14
changelog:
  - Resolves: rhbz#1767514 - sssd requires timed sudoers ldap entries to be
                             specified up to the seconds


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-16
changelog:
  - Resolves: rhbz#1792331 - sssd_be crashes when krb5_realm and krb5_server is
                             omitted and auth_provider is krb5


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-17
changelog:
  - Resolves: rhbz#1718193 - p11_child should have an option to skip
                             C_WaitForSlotEvent if the PKCS#11 module
                             does not implement it properly


author: Michal Židek <mzidek@redhat.com> - 2.2.3-18
changelog:
  - Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
                             certificate EKU and perform an action based
                             on value when generating SSH key from a certificate


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-19
changelog:
  - Resolves: rhbz#1810634 - id command taking 1+ minute for returning user
                             information


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-19
changelog:
  - Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
                             certificate EKU and perform an action based
                             on value when generating SSH key from a certificate
                             (additional patch)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-1
changelog:
  - Resolves: rhbz#1839037 - Rebase SSSD for RHEL 8.3
  - Resolves: rhbz#1843872 - sssd 2.3.0 breaks AD auth due to GPO parsing failure
  - Resolves: rhbz#1834156 - sssd or sssd-ad not updating their dependencies on "yum update" which breaks working


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-2
changelog:
  - Resolves: rhbz#Bug 1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-3
changelog:
  - Resolves: rhbz#1829470 - `sssd.api.conf` and `sssd.api.d` should belong to `python-sssdconfig` package
  - Resolves: rhbz#1544457 - sssd fails to release file descriptor on child logs after receiving HUP
  - Resolves: rhbz#1824323 - SSSD user filtering is failing on RHEL 8 after "files" provider rebuilds cache
  - Resolves: rhbz#1827432 - When the passwd or group files are replaced, sssd stops monitoring the file for
                             inotify events, and no updates are triggered
  - Resolves: rhbz#1835710 - Change the message "Please enter smart card" to "Please insert smart card"
                             on GDM login with smart-card
  - Resolves: rhbz#1838037 - Oddjob-mkhomedir fails when using NSS compat
  - Resolves: rhbz#1845904 - gdm smart card authentication does not work shortly after disconnecting from network.
  - Resolves: rhbz#1845975 - sssd doesn't follow the link order of AD Group Policy Management
  - Resolves: rhbz#1845980 - sssd is failing to discover other subdomains in the forest
                             if LDAP entries do not contain AD forest root information
  - Resolves: rhbz#1845987 - Document how to prevent invalid selinux context for default home directories
                             in SSSD-AD direct integration.
  - Resolves: rhbz#1845994 - GDM failure loop when no user mapped for smart card
  - Resolves: rhbz#1846003 - GDM password prompt when cert mapped to multiple users and promptusername is False
  - Resolves: rhbz#1850961 - /usr/share/systemtap/tapset/sssd_functions.stp missing a comma


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-4
changelog:
  - Resolves: rhbz#1815584 - id_provider = proxy proxy_lib_name = files returns * in password field, breaking PAM authentication
  - Resolves: rhbz#1794607 - SSSD must be able to resolve membership involving root with files provider
  - Resolves: rhbz#1803134 - Improve "unlock" time when user session already active


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-5
changelog:
  - Resolves: rhbz#1821719 - sssd (sssd_be) is consuming 100% CPU, partially due to failing mem-cache
  - Fixed "requires/provides" rpmdiff warning


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-7
changelog:
  - Resolves: rhbz#1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.
  - Resolves: rhbz#1780404 - smartcards: special characters must be escaped when building search filter


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-8
changelog:
  - Resolves: rhbz#1868387 - system not enforcing GPO rule restriction. ad_gpo_implicit_deny = True is not working
  - Resolves: rhbz#1854951 - sss-certmap man page change to add clarification for userPrincipalName attribute from AD schema
  - Resolves: rhbz#1856861 - False errors/warnings are logged in sssd.log file after enabling 2FA prompting settings in sssd.conf
  - Resolves: rhbz#1869683 - p11_child: default value of ocsp_dgst == sha256 doesn't conform RFC5019 and has to be changed to sha1


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-9
changelog:
  - Resolves: rhbz#1855323 - When ad_gpo_implicit_deny is True, it is permitting users to login when no gpo is applied


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-1
changelog:
  - Resolves: rhbz#1881992 - Rebase SSSD for RHEL 8.4
  - Resolves: rhbz#1722842 - sssd-kcm does not store TGT with ssh login using GSSAPI
  - Resolves: rhbz#1734040 - sssd crash in ad_get_account_domain_search()
  - Resolves: rhbz#1784459 - [RFE] tlog does not allow to exclude some users from session recording
  - Resolves: rhbz#1791300 - sporadic sssd_be crash on s390x
  - Resolves: rhbz#1817122 - 'getent group ldapgroupname' doesn't show any LDAP users or some LDAP users when 'rfc2307bis' schema is used with SSSD.
  - Resolves: rhbz#1819012 - [RFE] Improve AD site discovery process
  - Resolves: rhbz#1846778 - [RfE] `/usr/libexec/sssd/p11_child` cmdline argument '--nssdb' might be confusing when SSSD was built against OpenSSL
  - Resolves: rhbz#1873715 - automount sssd issue when 2 automount maps have the same key (one un uppercase, one in lowercase)
  - Resolves: rhbz#1879860 - correction in sssd.conf:pam_response_filter man page
  - Resolves: rhbz#1881336 - [RFE] sssd-ldap man page modification for parameter "ldap_referrals"
  - Resolves: rhbz#1883488 - [RfE] Implement a new sssd.conf option to disable the filter for AD domain local groups from trusted domains
  - Resolves: rhbz#1884196 - [RFE] Add "enabled" option to domain section in config file
  - Resolves: rhbz#1884205 - KCM: Increase client idle timeout to 5 minutes
  - Resolves: rhbz#1884207 - [RFE] ldap: add new option ldap_library_debug_level
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff
  - Resolves: rhbz#1884281 - Secondary LDAP group go missing from 'id' command
  - Resolves: rhbz#1884301 - [RFE] dyndns: suport asymmetric auth for nsupdate


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-3
changelog:
  - Resolves: rhbz#1900733 - sssd_be segfaults at be_refresh_get_values_ex() due to NULL ptrs in results of sysdb_search_with_ts_attr()
  - Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
  - Resolves: rhbz#1894540 - sssd component logging is now too generic in syslog/journal
  - Resolves: rhbz#1828483 - filtered ID is appearing due to strange negative cache behavior


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-4
changelog:
  - Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
  - Resolves: rhbz#1876658 - filter_groups option partially filters the group from 'id' output of the user because gidNumber still appears in 'id' output [RHEL 8]
  - Resolves: rhbz#1895001 - User lookups over the InfoPipe responder fail intermittently


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-5
changelog:
  - Resolves: rhbz#1631410 - Can't login with smartcard with multiple certs having same ID value
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff (additional patches)
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-6
changelog:
  - Resolves: rhbz#1113639 - autofs: return a connection failure until maps have been fetched
  - Resolves: rhbz#1915395 - Memory leak in the simple access provider
  - Resolves: rhbz#1915319 - SSSD: SBUS: failures during servers startup
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication (additional patches)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-7
changelog:
  - Resolves: rhbz#1920001 - Do not add '%' to group names already prefixed with '%' in IPA sudo rules
  - Resolves: rhbz#1918433 - sssd unable to lookup certmap rules
  - Resolves: rhbz#1917382 - [abrt] [faf] sssd: dp_client_handshake_timeout(): /usr/libexec/sssd/sssd_be killed by 11


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-8
changelog:
  - Resolves: rhbz#1926622 - Add support to verify authentication indicators in pam_sss_gss
  - Resolves: rhbz#1926454 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0.
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures (additional patch)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.0-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1930535 - [abrt] [faf] sssd: monitor_service_shutdown(): /usr/sbin/sssd killed by 11
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1945888 - Inconsistant debug level for connection logging
  - Resolves: rhbz#1948657 - pam_sss_gss.so doesn't work with large kerberos tickets
  - Resolves: rhbz#1949149 - [RFE] Poor man's backtrace
  - Resolves: rhbz#1920500 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR
  - Resolves: rhbz#1923964 - [RFE] SSSD Error Msg Improvement: write_krb5info_file failed, authentication might fail.
  - Resolves: rhbz#1928648 - SSSD logs improvements: clarify which config option applies to each timeout in the logs
  - Resolves: rhbz#1632159 - sssd-kcm starts successfully for non existent socket_path
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm
  - Resolves: rhbz#1925505 - [RFE] improve the sssd refresh timers for SUDO queries
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1925561 - sssd-ldap(5) does not report how to disable the SUDO smart queries
  - Resolves: rhbz#1925621 - document impact of indices and of scope on performance of LDAP queries
  - Resolves: rhbz#1855320 - [RFE] RHEL8 sssd: inheritance of the case_sensitive parameter for subdomains.
  - Resolves: rhbz#1925608 - [RFE] make 'random_offset' addon to 'offline_timeout' option configurable
  - Resolves: rhbz#1447945 - man page / docs update required: if two certificate matching rules with the same priority match only one is used
  - Resolves: rhbz#1703436 - sssd not thread-safe in innetgr()
  - Resolves: rhbz#1713143 - SSSD does not translate the 2FA text labels("first factor" / "second factor") on GDM login and screensaver unlock screen
  - Resolves: rhbz#1888977 - sss_override: Usage limitations clarification in man page
  - Resolves: rhbz#1890177 - Clarify "single_prompt" option in "PROMPTING CONFIGURATION SECTION" section of sssd.conf man page
  - Resolves: rhbz#1902280 - fix sss_cache to also reset cached timestamp
  - Resolves: rhbz#1935683 - SSSD not detecting subdomain from AD forest (RHEL 8.3)
  - Resolves: rhbz#1937919 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7
  - Resolves: rhbz#1944665 - No gpo found and ad_gpo_implicit_deny set to True still permits user login
  - Resolves: rhbz#1919942 - sss_override does not take precedence over override_homedir directive


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1917444 - SSSD Error Msg Improvement: Server resolution failed: [2]: No such file or directory
  - Resolves: rhbz#1917511 - SSSD Error Msg Improvement: Failed to resolve server 'server.example.com': Error reading file
  - Resolves: rhbz#1917535 - sssd.conf man page: parameter dns_resolver_server_timeout and dns_resolver_op_timeout
  - Resolves: rhbz#1940509 - [RFE] Health and Support Analyzer: Link frontend to backend requests
  - Resolves: rhbz#1649464 - auto_private_groups not working as expected with posix ipa/ad trust
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1961215 - Invalid sssd-kcm return code if requested operation is not found
  - Resolves: rhbz#1837090 - SSSD fails nss_getby_name for IPA user with SID if the user has user private group
  - Resolves: rhbz#1879869 - sudo commands incorrectly exports the KRB5CCNAME environment variable
  - Resolves: rhbz#1962550 - sss_pac_make_request fails on systems joined to Active Directory.
  - Resolves: rhbz#1737489 - [RFE] SSSD should honor default Kerberos settings (keytab name) in /etc/krb5.conf


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-2
changelog:
  - Resolves: rhbz#1974257 - 'debug_microseconds' config option is broken
  - Resolves: rhbz#1936902 - SSSD Error Msg Improvement: Invalid argument
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm (additional patches and rebuild)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1693379 - sssd_be and sss_cache too heavy on CPU
  - Resolves: rhbz#1909373 - Missing search index for `originalADgidNumber`
  - Resolves: rhbz#1954630 - [RFE] Improve debug messages by adding a unique tag for each request the backend is handling
  - Resolves: rhbz#1936891 - SSSD Error Msg Improvement: Bad address
  - Resolves: rhbz#1364596 - sssd still showing ipa user after removed from last group
  - Resolves: rhbz#1979404 - Changes made to /etc/pam.d/sssd-shadowutils are overwritten back to default on sssd-common package upgrade


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2
changelog:
  - Resolves: rhbz#1975169 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8]
  - Resolves: rhbz#1962042 - [sssd] RHEL 8.5 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.1-1
changelog:
  - Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
  - Resolves: rhbz#1968340 - 'exclude_groups' option provided in SSSD for session recording (tlog) doesn't work as expected
  - Resolves: rhbz#1952569 - SSSD should use "hidden" temporary file in its krb locator
  - Resolves: rhbz#1917970 - proxy provider: secondary group is showing in sssd cache after group is removed
  - Resolves: rhbz#1636002 - socket-activated services start as the sssd user and then are unable to read the confdb
  - Resolves: rhbz#2021196 - Make backtrace less "chatty" (avoid duplicate backtraces)
  - Resolves: rhbz#2018432 - 2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest)
  - Resolves: rhbz#2015070 - Consistency in defaults between OpenSSH and SSSD
  - Resolves: rhbz#2013297 - disabled root ad domain causes subdomains to be marked offline
  - Resolves: rhbz#2013294 - Lookup with fully-qualified name does not work with 'cache_first = True'
  - Resolves: rhbz#2013218 - autofs lookups for unknown mounts are delayed for 50s
  - Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
  - Resolves: rhbz#2013024 - Add support for CKM_RSA_PKCS in smart card authentication.
  - Resolves: rhbz#2013006 - [RFE] support subid ranges managed by FreeIPA
  - Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
  - Resolves: rhbz#2012122 - tps tests fail with cross dependency on sssd debuginfo package: removal of 'sssd-libwbclient-debuginfo' is missing


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-1
changelog:
  - Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
  - Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#1961182 - Passwordless (GSSAPI) SSH not working due to missing "includedir /var/lib/sss/pubconf/krb5.include.d" directive in /etc/krb5.conf
  - Resolves: rhbz#2008829 - sssd_be segfault due to empty forest root name
  - Resolves: rhbz#2012263 - pam responder does not call initgroups to refresh the user entry
  - Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
  - Resolves: rhbz#2012327 - Groups are missing while performing id lookup as SSSD switching to offline mode due to the wrong domain name in the ldap-pings(netlogon).
  - Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
  - Resolves: rhbz#2013259 - [RHEL8] Add tevent chain ID logic into responders
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-3
changelog:
  - Resolves: rhbz#2039892 - 2.6.2 regression: Daemon crashes when resolving AD user names
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#2035245 - AD Domain in the AD Forest Missing after sssd latest update
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.0-2
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2026799 - SSSD authenticating to LDAP with obfuscated password produces Invalid authtoken type message causing sssd_be to go offline (cross inter_ference of different provider plugins options)
  - Resolves: rhbz#2033347 - sssd error triggers backtrace : [write_krb5info_file_from_fo_server] (0x0020): [RID#73501] There is no server that can be written into kdc info file.
  - Resolves: rhbz#2056483 - [RFE] Add sssd internal krb5 plugin for authentication against external IdP via OAuth2
  - Resolves: rhbz#2062689 - [Improvement] Add user and group version of sss_nss_getorigbyname()
  - Resolves: rhbz#2065692 - [RHEL8] Ship new sub-package called sssd-idp into sssd
  - Resolves: rhbz#2072050 - sssd_nss exiting (due to missing 'sssd' local user) making SSSD service to restart in a loop
  - Resolves: rhbz#2072931 - Use right sdap_domain in ad_domain_info_send
  - Resolves: rhbz#2087088 - sssd does not enforce smartcard auth for kde screen locker
  - Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
  - Resolves: rhbz#2087745 - 2FA prompting setting ineffective
  - Resolves: rhbz#2087746 - sssd fails GPO-based access if AD have setup with Japanese language


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.2-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2098620 - sdap_nested_group_deref_direct_process() triggers internal watchdog for large data sets
  - Resolves: rhbz#2098619 - [Improvement] add SSSD support for more than one CRL PEM file name with parameters certificate_verification and crl_file
  - Resolves: rhbz#2088817 - pam_sss_gss ceased to work after upgrade to 8.6
  - Resolves: rhbz#2098616 - Add idp authentication indicator in man page of sssd.conf
  - Resolves: rhbz#2056035 - 'getent hosts' not return hosts if they have more than one CN in LDAP
  - Resolves: rhbz#2098615 - Regression "Missing internal domain data." when setting ad_domain to incorrect
  - Resolves: rhbz#2098617 - Harden kerberos ticket validation
  - Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2063016 - [sssd] RHEL 8.7 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-2
changelog:
  - Resolves: rhbz#2116488 - virsh command will hang after the host run several auto test cases
  - Resolves: rhbz#2116486 - [regression] sssctl analyze fails to parse PAM related sssd logs
  - Resolves: rhbz#2116487 - cache_req_data_set_hybrid_lookup: cache_req_data should never be NULL


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-3
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
  - Resolves: rhbz#2119726 - sssctl analyze --logdir option requires sssd to be configured
  - Resolves: rhbz#2120669 - Incorrect request ID tracking from responder to backend


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-4
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-5
changelog:
  - Related: rhbz#2132051 - Rebase Samba to the the latest 4.17.x release
    Rebuild against Samba rebase.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.1-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2144581 - [RFE] provide dbus method to find users by attr
  - Resolves: rhbz#2144579 - sssd timezone issues sudonotafter
  - Resolves: rhbz#2144519 - [RFE] SSSD does not support to change the user’s password when option ldap_pwd_policy equals to shadow in sssd.conf file
  - Resolves: rhbz#2127822 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict)
  - Resolves: rhbz#2111393 - authenticating against external IdP services okta (native app) with OAuth client secret failed


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2136701 - Lower the severity of the log message for SSSD so that it is not shown at the default debug level.
  - Resolves: rhbz#2139760 - [sssd] RHEL 8.8 Tier 0 Localization
  - Resolves: rhbz#2139865 - Analyzer: Optimize and remove duplicate messages in verbose list
  - Resolves: rhbz#2142795 - SSSD: `sssctl analyze` command shouldn't require 'root' privileged
  - Resolves: rhbz#2144491 - UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around
  - Resolves: rhbz#2150357 - Smart Card auth does not work with p11_uri (with-smartcard-required)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-2
changelog:
  - Resolves: rhbz#2149091 - Update to sssd-2.7.3-4.el8_7.1.x86_64 resulted in "Request to sssd failed. Device or resource busy"


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.0-1
changelog:
  - Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
  - Resolves: rhbz#2101489 - [sssd] Auth fails if client cannot speak to forest root domain (ldap_sasl_interactive_bind_s failed)
  - Resolves: rhbz#2143925 - kinit switches KCM away from the newly issued ticket
  - Resolves: rhbz#2151403 - AD user is not found on IPA client after upgrading to RHEL8.7
  - Resolves: rhbz#2164805 - man page entry should make clear that a nested group needs a name
  - Resolves: rhbz#2170484 - Unable to lookup AD user from child domain (or "make filtering of the domains more configurable")
  - Resolves: rhbz#2180981 - sss allows extraneous @ characters prefixed to username #


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.0-4
changelog:
  - Related: rhbz#2190417 - Rebase Samba to the latest 4.18.x release
    Rebuild against rebased Samba libs


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.1-1
changelog:
  - Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
  - Resolves: rhbz#2196521 - [RHEL8] sssd : AD user login problem when modify ldap_user_name= name and restricted by GPO Policy
  - Resolves: rhbz#2195919 - sssd-be tends to run out of system resources, hitting the maximum number of open files
  - Resolves: rhbz#2192708 - [RHEL8] [sssd] User lookup on IPA client fails with 's2n get_fqlist request failed'
  - Resolves: rhbz#2139467 - [RHEL8] sssd attempts LDAP password modify extended op after BIND failure
  - Resolves: rhbz#2054825 - sssd_be segfault at 0 ip 00007f16b5fcab7e sp 00007fffc1cc0988 error 4 in libc-2.28.so[7f16b5e72000+1bc000]
  - Resolves: rhbz#2189583 - [sssd] RHEL 8.9 Tier 0 Localization
  - Resolves: rhbz#2170720 - [RHEL8] When adding attributes in sssd.conf that we have already, the cross-forest query just stop working
  - Resolves: rhbz#2096183 - BE_REQ_USER_AND_GROUP LDAP search filter can inadvertently catch multiple overrides
  - Resolves: rhbz#2151450 - [RHEL8] SSSD missing group membership when evaluating GPO policy with 'auto_private_groups = true'


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-5.2
changelog:
  - Resolves: RHEL-78300 - 'sssd_kcm' leaks memory [rhel-8.10.z]
  - Resolves: RHEL-82420 - Disk cache failure with large db sizes [rhel-8.10.z]
  - Resolves: RHEL-76022 - Use the DN from existing entry when updating a cached group [rhel-8.10.z]


author: Alejandro López <allopez@redhat.com> - 2.9.4-5.3
changelog:
  - Resolves: RHEL-112455 - p11_child currently has an infinite timeout [rhel-8.10.z]
  - Resolves: RHEL-120292 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems [rhel-8.10.z]


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.13-1
changelog:
  - Rebase to v5.13; drop upstream patches on top of 5.7 (#2015917).
  - Address some issues reported by covscan.


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.18-2
changelog:
  - Fix the issues reported by covscan (#2103068).
  - Fix SELinux context matching for the deleted paths (#2087693).
  - Fix sloppy FD usage in the bpf test (#2103137).


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.18-2.1
changelog:
  - Fix incorrect syscall name reporting in restart_syscall() on attach when
    PTRACE_GET_SYSCALL_INFO is in use (RHEL-8570).
  - Update net-yy-inet*, linkat--secontext_mismatch, and prctl-sve tests.


author: Hangbo Fan <fanhangbo.fhb@alibaba-inc.com> - 5.18-2.1.0.1
changelog:
  - Add doc sub package
  - Improve support for loongarch64 (lihui@loongson.cn)
  - cherry-pick `add sw patch #757f9ac5303eba4f95fb2221cae6eb2688b4bc3e`. (nijie@wuxiat.com)
  - Handle failed testsuite strace-k for loongarch64 (lihui@loongson.cn)


author: Sahana Prasad <sahana@redhat.com> - 5.56-5
changelog:
  - Fixes CVE-2021-20230 stunnel: client certificate not
    correctly verified when redirect and verifyChain options are used.


author: Clemens Lang <cllang@redhat.com> - 5.71-1
changelog:
  - New upstream release 5.71
    Resolves: RHEL-2340
  - Enable socket activation support
  - verify upstream source in %prep
  - clean up stale conditionals


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.6-2
changelog:
  - remove absolute path names from the PAM configuration, ensuring that the
    right modules get used for whichever arch we're built for
  - don't try to install the FAQ, which isn't there any more


author: Colin Walters <walters@redhat.com> 1.6.7p5-24
changelog:
  - Enhance sesh.c to fork/exec children itself, to avoid
    having sudo reap all domains.
  - Only reinstall default signal handlers immediately before
    exec of child with SELinux patch


author: Karel Zak <kzak@redhat.com> 1.6.8p9-1
changelog:
  - new version 1.6.8p9 (resolve #161116 - CAN-2005-1993 sudo trusted user arbitrary command execution)


author: Dan Walsh <dwalsh@redhat.com> 1.6.8p12-3
changelog:
  - Remove selinux patch.  It has been decided that the SELinux patch for sudo is
  - no longer necessary.  In tageted policy it had no effect.  In strict/MLS policy
  - We require the person using sudo to execute newrole before using sudo.


author: Karel Zak <kzak@redhat.com> 1.6.8p12-7
changelog:
  - fix #198755 - make login processes (sudo -i) initialise session keyring
    (thanks for PAM config files to David Howells)
  - add IPv6 support (patch by Milan Zazrivec)


author: Peter Vrabec <pvrabec@redhat.com> 1.6.9p17-2
changelog:
  - adjust audit patch, do not scream when kernel is
    compiled without audit netlink support (#401201)


author: Daniel Kopecek <dkopecek@redhat.com> 1.6.9p17-6
changelog:
  - fixed building with new libtool
  - fix for incorrect handling of groups in Runas_User
  - added /usr/local/sbin to secure-path


author: Daniel Kopecek <dkopecek@redhat.com> 1.7.1-4
changelog:
  - moved the closefrom() call before audit_help_open() (sudo-1.7.1-auditfix.patch)
  - epoch number sync


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-1
changelog:
  - new upstream version 1.7.2p2-1
  - commented out unused aliases in sudoers to make visudo happy (#550239)


author: Ville Skyttä <ville.skytta@iki.fi> - 1.7.2p2-2
changelog:
  - Add /etc/sudoers.d dir and use it in default config (#551470).
  - Drop *.pod man page duplicates from docs.


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-4
changelog:
  - audit related Makefile.in and configure.in corrections
  - added --with-audit configure option
  - removed call to libtoolize


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p6-1
changelog:
  - update to new upstream version
  - merged .audit and .libaudit patch
  - added sudoers.ldap.5* to files


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-1
changelog:
  - update to new upstream version
  - new command available: sudoreplay
  - use native audit support
  - corrected license field value: BSD -> ISC


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-5
changelog:
  - anybody in the wheel group has now root access (using password) (rhbz#656873)
  - sync configuration paths with the nss_ldap package (rhbz#652687)


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.1p2-1
changelog:
  - rebase to 1.8.1p2
  - removed .sudoi patch
  - fixed typo: RELPRO -> RELRO
  - added -devel subpackage for the sudo_plugin.h header file
  - use default ldap configuration files again


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.5-4
changelog:
  - added patches that fix & improve SSSD support (thanks to pbrezina@redhat.com)
  - re-enabled SSSD support
  - removed libsss_sudo dependency


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-2
changelog:
  - added upstream patch for a regression
  - don't include arch specific files in the -devel subpackage
  - ship only one sample plugin in the -devel subpackage


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-1
changelog:
  - update to 1.8.6p7
  - fixes CVE-2013-1775 and CVE-2013-1776
  - fixed several packaging issues (thanks to ville.skytta@iki.fi)
    - build with system zlib.
    - let rpmbuild strip libexecdir/*.so.
    - own the %{_docdir}/sudo-* dir.
    - fix some rpmlint warnings (spaces vs tabs, unescaped macros).
    - fix bogus %changelog dates.


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.8-1
changelog:
  - update to 1.8.8
  - major changes & fixes:
    - LDAP SASL support now works properly with Kerberos
    - root may no longer change its SELinux role without entering a password
    - user messages are now always displayed in the user's locale, even when
      the same message is being logged or mailed in a different locale.
    - log files created by sudo now explicitly have the group set to group
      ID 0 rather than relying on BSD group semantics
    - sudo now stores its libexec files in a sudo subdirectory instead of in
      libexec itself
    - system_group and group_file sudoers group provider plugins are now
      installed by default
    - the paths to ldap.conf and ldap.secret may now be specified as arguments
      to the sudoers plugin in the sudo.conf file
    - ...and many new features and settings. See the upstream ChangeLog for the
      full list.
  - several sssd support fixes
  - added patch to make uid/gid specification parsing more strict (don't accept
    an invalid number as uid/gid)
  - use the _pkgdocdir macro
    (see https://fedoraproject.org/wiki/Changes/UnversionedDocdirs)
  - fixed several bugs found by the clang static analyzer
  - added %post dependency on chmod


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.8-3
changelog:
  - remove bundled copy of zlib before compilation
  - drop the requiretty Defaults setting from sudoers


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.11-1
changelog:
  - update to 1.8.11
  - major changes & fixes:
    - when running a command in the background, sudo will now forward
      SIGINFO to the command
    - the passwords in ldap.conf and ldap.secret may now be encoded in base64.
    - SELinux role changes are now audited. For sudoedit, we now audit
      the actual editor being run, instead of just the sudoedit command.
    - it is now possible to match an environment variable's value as well as
      its name using env_keep and env_check
    - new files created via sudoedit as a non-root user now have the proper group id
    - sudoedit now works correctly in conjunction with sudo's SELinux RBAC support
    - it is now possible to disable network interface probing in sudo.conf by
      changing the value of the probe_interfaces setting
    - when listing a user's privileges (sudo -l), the sudoers plugin will now prompt
      for the user's password even if the targetpw, rootpw or runaspw options are set.
    - the new use_netgroups sudoers option can be used to explicitly enable or disable
      netgroups support
    - visudo can now export a sudoers file in JSON format using the new -x flag
  - added patch to read ldap.conf more closely to nss_ldap
  - require /usr/bin/vi instead of vim-minimal
  - include pam.d/system-auth in PAM session phase from pam.d/sudo
  - include pam.d/sudo in PAM session phase from pam.d/sudo-i


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.11p2-1
changelog:
  - update to 1.8.11p2
  - added patch to fix upstream bug #671 -- exiting immediately
    when audit is disabled


author: Radovan Sroka <rsroka@redhat.com> 1.8.12-2
changelog:
  - add patch3 sudo.1.8.14b4-passexpire.patch that makes change in documentation about timestamp_time
  - Resolves: rhbz#1162070


author: Radovan Sroka <rsroka@redhat.com> 1.8.14p1-1
changelog:
  - update to 1.8.14p1-1
  - rebase sudo-1.8.14b3-ldapconfpatch.patch -> sudo-1.8.14p1-ldapconfpatch.patch
  - rebase sudo-1.8.14b4-docpassexpire.patch -> sudo-1.8.14p1-docpassexpire.patch


author: Radovan Sroka <rsroka@redhat.com> 1.8.14p3-2
changelog:
  - add patch that resolves initialization problem before sudo_strsplit call
  - add patch that resolves deadcode in visudo.c
  - add patch that removes extra while in visudo.c and sudoers.c


author: Radovan Sroka <rsroka@redhat.com> 1.8.18rc2-1
changelog:
  - update to 1.8.18rc2
  - dropped sudo-1.8.14p1-ldapconfpatch.patch
    upstreamed --> https://www.sudo.ws/pipermail/sudo-workers/2016-September/001006.html


author: Radovan Sroka <rsroka@redhat.com> 1.8.19-0.1.20160923git90e4538
changelog:
  - we were not able to update from rc and beta versions to stable one
  - so this is a new snapshot package which resolves it


author: Jiri Vymazal <jvymazal@redhat.com> - 1.8.20-0.1.b1
changelog:
  - update to latest development version 1.8.20b1
  - added sudo to dnf/yum protected packages
    Resolves: rhbz#1418756


author: Matthew Miller <mattdm@fedoraproject.org> - 1.8.20p2-4
changelog:
  - replace file-based requirements with package-level ones:
  - /etc/pam.d/system-auth to 'pam'
  - /bin/chmod to 'coreutils' (bug #1488934)
  - /usr/bin/vi to vim-minimal
  - ... and make vim-minimal "recommends" instead of "requires", because
    other editors can be configured.


author: Radovan Sroka <rsroka@redhat.com> - 1.8.25-1
changelog:
  - rebase to the new upstream version 1.8.25p1
  - sync patches with rhel-7.6
  - sync sudoers with rhel-7.6
    resolves: rhbz#1633144


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.25-2
changelog:
  - Depend explicitly on /usr/sbin/sendmail instead of sendmail (rhel-7 sync)
  - Simplified pam configuration file by removing duplicate pam stack entries
  Resolves: rhbz#1633144


author: Radovan Sroka <rsroka@redhat.com> - 1.8.25-5
changelog:
  - RHEL 8.1 ERRATUM
  - Fixed problem with sudo-1.8.23 and 'who am i'
  Resolves: rhbz#1673886
  - Backporting sudo bug with expired passwords
  Resolves: rhbz#1676819


author: Radovan Sroka <rsroka@redhat.com> - 1.8.25-6
changelog:
  - RHEL 8.1 ERRATUM
  - Fixed The LDAP backend which is not properly parsing sudoOptions,
    resulting in selinux roles not being applied
  Resolves: rhbz#1738326


author: Radovan Sroka <rsroka@redhat.com> - 1.8.28p1-1
changelog:
  - RHEL 8.2 ERRATUM
  - rebase to 1.8.28p1
  Resolves: rhbz#1733961
  - fixed man page for always_set_home
  Resolves: rhbz#1576880
  - sudo does not work with notbefore/after
  Resolves: rhbz#1679508
  - NOTBEFORE showing value of sudoNotAfter Ldap attribute
  Resolves: rhbz#1715516
  - CVE-2019-14287 sudo
  - Privilege escalation via 'Runas' specification with 'ALL' keyword
  Resolves: rhbz#1760697


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29-7
changelog:
  - RHEL 8.4 ERRATUM
  - CVE-2021-3156
  Resolves: rhbz#1917734
  - CVE-2021-23239 sudo: possible directory existence test due to race condition in sudoedit
  Resolves: rhzb#1916434
  - CVE-2021-23240 sudo: symbolic link attack in SELinux-enabled sudoedit
  Resolves: rhbz#1917038
  - updated upstream url
  Resolves: rhbz#1923825


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29-8
changelog:
  RHEL 8.6.0 ERRATUM
  - sudoedit does not work with selinux args
  Resolves: rhbz#2029551
  - Make sure SIGCHLD is not ignored when sudo is executed
  Resolves: rhbz#1999751
  - [RFE] pass KRB5CCNAME to pam_authenticate environment if available
  Resolves: rhbz#1917379
  - utmp resource leak in sudo
  Resolves: rhbz#1986572


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29.9
changelog:
  RHEL 8.8.0 ERRATUM
  - CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user
  Resolves: rhbz#2161221
  - sudo digest check fails incorrectly for certain file sizes (SHA512/SHA384)
  Resolves: rhbz#2114576


author: Radovan Sroka <rsroka@redhat.com> - 1.9.5p2-1
changelog:
  RHEL 8.9.0.Z ERRATUM
  - Rebase to 1.9.5p2
  - CVE-2023-28486 sudo: Sudo does not escape control characters in log messages
  Resolves: RHEL-21825
  - CVE-2023-28487 sudo: Sudo does not escape control characters in sudoreplay output
  Resolves: RHEL-21831
  - CVE-2023-42465 sudo: Targeted Corruption of Register and Stack Variables
  Resolves: RHEL-21820


author: guo chuang <guo.chuang@zte.com.cn> - 1.9.5p2-1.0.1.1
changelog:
  - add patch for CVE-2022-43955
  - cherry-pick `add sw arch #67f107f94b2ae4b6376e750103f8f5fd1f3e6b31`.


author: Alejandro López <allopez@redhat.com> - 1.9.5p2-1.2
changelog:
  RHEL 8.10.0.Z ERRATUM
  - Reintroduce cmnd_no_wait
  Resolves: RHEL-51956
  - Missing separator in the log
  Resolves: RHEL-71913


author: Alejandro López <allopez@redhat.com> - 1.9.5p2-1.3
changelog:
  RHEL 8.10.0.Z ERRATUM
  - sudo passes SHELL environment variable twice to the shell being executed [rhel-8]
  Resolves: RHEL-127360


author: Alejandro López <allopez@redhat.com> - 1.9.5p2-1.5
changelog:
  RHEL 8.10.0.Z ERRATUM
  - CVE-2026-35535 - Privilege escalation due to failure in privilege drop calls
  Resolves: RHEL-166060


author: Liwei Ge <geliwei@openanolis.org> - 6.04-6.0.1
changelog:
  - Enable nonlinux for x86 build
  - Fix gcc10 -fno-common compile issue for compatible with gcc10 build


author: Kalev Lember <klember@redhat.com> - 3.39.92-2
changelog:
  - Split sysprof-capture library and header files out to sysprof-capture-devel
  - Update minimum required glib2 version


author: Jan Tulak <jtulak@redhat.com> - 1.2-1
changelog:
  - Upstream release 1.2 which fixes:
  - use pwquality to test password strength for cryptsetup (#1141871)
  - add multipath detection support (#1309729)
  - add migrate command (#1014708)


author: Jan Tulak <jtulak@redhat.com> - 1.2-3:
changelog:
  - Gating tests implementation, which meant adding few more changes
    to the existing patches (#1681969)
  - sphinx patch was merged to python3 change
  - add seq numbers to patch files


author: Jan Tulak <jtulak@redhat.com> - 1.4-1:
changelog:
  - Bring changes from upstream 1.4 (mostly bugfixes)
  - Remove multipath from the list of default backends (rhbz#1685019)
  - Fix locale issue (rhbz#1679587)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-77
changelog:
  - ci: update permissions for source-git automation workflows (#2179309)
  - sulogin: fix control lost of the current terminal when default.target is rescue.target (#2169932)
  - parse-util: in parse_permille() check negative earlier (#2178179)
  - tree-wide: increase granularity of percent specifications all over the place to permille (#2178179)
  - errno-util: introduce ERRNO_IS_TRANSIENT() (#2172846)
  - tree-wide: use ERRNO_IS_TRANSIENT() (#2172846)
  - libsystemd: ignore both EINTR and EAGAIN (#2172846)
  - sd-bus: handle -EINTR return from bus_poll() (#2172846)
  - stdio-bridge: don't be bothered with EINTR (#2172846)
  - sd-netlink: handle EINTR from poll() gracefully, as success (#2172846)
  - resolved: handle -EINTR returned from fd_wait_for_event() better (#2172846)
  - utmp-wtmp: fix error in case isatty() fails (#2172846)
  - utmp-wtmp: handle EINTR gracefully when waiting to write to tty (#2172846)
  - journal-vacuum: count size of all journal files (#2180380)
  - resolved: instead of closing DNS UDP transaction fds right-away, add them to a socket "graveyard" (#2156751)
  - resolved: close UDP socket when we received a network error on it (#2156751)
  - ci: allow RHEL-only labels to mark downstream-only commits (#2179309)
  - man: tweak markup in systemd-pstore.service(8) (#2217786)
  - man: add .service suffix to systemd-pstore(8) (#2217786)
  - presets: enable systemd-pstore.service by default (#2217786)
  - logind: simplify code (#2209328)
  - format-table: add TABLE_TIMESTAMP_UTC and _RELATIVE (#2156786)
  - loginctl: shorten variable name (#2156786)
  - loginctl: use bus_map_all_properties (#2156786)
  - loginctl: show session idle status in list-sessions (#2156786)
  - loginctl: list-sessions: fix timestamp for idle hint (#2156786)
  - loginctl: also show idle hint in session-status (#2156786)
  - core/timer: Always use inactive_exit_timestamp if it is set (#1719364)
  - timer: Use dual_timestamp_is_set() in one more place (#1719364)
  - ci: drop systemd-stable from advanced-commit-linter config (#2179309)
  - core/mount: escape invalid UTF8 char in dbus reply (#2158724)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-78
changelog:
  - login: add a missing error check for session_set_leader() (#2158167)
  - logind: reset session leader if we know for a fact that it is gone (#2158167)
  - test-login: skip consistency checks when logind is not active (#2223582)
  - sd-event: remove dead code and use _cleanup_ (#2211358)
  - sd-event: don't destroy inotify data structures from inotify event handler (#2211358)
  - sd-event: add sd_event_add_inotify_fd() call (#2211358)
  - test: add test case for self-destroy inotify handler (#2211358)
  - doc: add downstream CONTRIBUTING document (#2179309)
  - doc: use link with prefilled Jira issue (#2179309)
  - docs: link downstream CONTRIBUTING in README (#2179309)
  - unit drop-in: Fix ordering of special type.d drop-ins (#2156620)
  - Add failing test to show service.d global drop-in does not get overridden by more specific dropins (#2156620)
  - test: set indentation to 4 spaces (#2156620)
  - test/TEST-15: remove all created unit files (#2156620)
  - test: use quotes where necessary (#2156620)
  - tree-wide: drop manually-crafted message for missing variables (#2156620)
  - manager: reformat boolean expression in unit_is_pristine() (#2156620)
  - manager: allow transient units to have drop-ins (#2156620)
  - TEST-15: allow helper functions to accept other unit types (#2156620)
  - TEST-15: also test hierarchical drop-ins for slices (#2156620)
  - TEST-15: add test for transient units with drop-ins (#2156620)
  - TEST-15: add one more test for drop-in precedence (#2156620)
  - udev/net_id: introduce naming scheme for RHEL-8.9 (#2231846)
  - meson: remove libdw dependency from pstore (#2211416)
  - pstore: introduce tmpfiles.d/systemd-pstore.conf (#2211416)
  - tmpfiles: don't complain if we can't enable pstore in containers (#2211416)
  - pstore: don't enable crash_kexec_post_notifiers by default (#2211416)
  - core: when Delegate=yes is set for a unit, run ExecStartPre= and friends in a subcgroup of the unit (#2215925)
  - man: link Delegate= documentation up with the markdown docs (#2215925)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-79
changelog:
  - ci: Extend source-git-automation (RHEL-1087)
  - ci: add missing configuration for commit linter (RHEL-1087)
  - ci: add `Red Hat Enterprise Linux 8` to the list of supported products (RHEL-1087)
  - ci: enable source-git automation to validate reviews and ci results (RHEL-1087)
  - ci: remove Mergify config - replaced by Pull Request Validator (RHEL-1087)
  - ci: enable auto-merge GH Action (RHEL-1087)
  - fstab-generator: allow overriding /etc/fstab with $SYSTEMD_FSTAB (RHEL-1087)
  - fstab-generator: allow overriding path to /sysroot/etc/fstab too (RHEL-1087)
  - test: backport TEST-81-GENERATORS (fstab-generator only) (RHEL-1087)
  - resolved: actually check authenticated flag of SOA transaction (RHEL-6213)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-80
changelog:
  - fd-util: rework how we determine highest possible fd (RHEL-18302)
  - basic/fd-util: refuse "infinite" loop in close_all_fds() (RHEL-18302)
  - fd-util: split out inner fallback loop of close_all_fds() as close_all_fds_without_malloc() (RHEL-18302)
  - exec-util: use close_all_fds_without_malloc() from freeze() (RHEL-18302)
  - ci: use source-git-automation composite Action (RHEL-1087)
  - ci: increase the cron interval to 45 minutes (RHEL-1087)
  - ci: add all Z-Stream versions to array of allowed versions (RHEL-1087)
  - tree-wide: always declare bitflag enums the same way (RHEL-2857)
  - login: Add KEY_RESTART handling (RHEL-2857)
  - analyze security: fix recursive call of syscall_names_in_filter() (RHEL-5991)
  - analyze-security: do not assign badness to filtered-out syscalls (RHEL-5991)
  - analyze-security: include an actual syscall name in the message (RHEL-5991)
  - udev/net_id: introduce naming scheme for RHEL-8.10 (RHEL-22426)
  - doc: add missing `<listitem>` to `systemd.net-naming-scheme.xml` (RHEL-22426)
  - service: schedule cleanup of PID hashmaps when we now longer have main_pid and we are in container (RHEL-5863)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-82
changelog:
  - ci: add configuration for regression sniffer GA (RHEL-1087)
  - coredump: actually store parsed unit in the context (RHEL-18302)
  - resolved: limit the number of signature validations in a transaction (RHEL-26644)
  - resolved: reduce the maximum nsec3 iterations to 100 (RHEL-26644)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-82.1
changelog:
  - pid1: by default make user units inherit their umask from the user manager (RHEL-28048)
  - pam: add call to pam_umask (RHEL-28048)
  - ci: deploy systemd man to GitHub Pages (RHEL-32494)
  - ci(src-git): update list of supported products (RHEL-32494)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-82.3
changelog:
  - ci: update actions/upload-artifact to `v4` (RHEL-32494)
  - ci: drop unused variable (RHEL-32494)
  - core: add possibility to not track certain unit types (RHEL-5877)
  - logind: don't setup idle session watch for lock-screen and greeter (RHEL-19215)
  - logind: tighten for which classes of sessions we do stop-on-idle (RHEL-19215)
  - ci: point C8S containers to the Vault (RHEL-1087)


author: Yuanhong Peng <yummypeng@linux.alibaba.com> - 239-82.0.3.3
changelog:
  - core: fix a null reference case in load_from_path()
  - sysctl: Don't pass null directive argument to '%s'
  - exit-status: introduce EXIT_EXCEPTION mapping to 255
  - main: don't freeze PID 1 in containers, exit with non-zero instead
  - Do not go into freeze when systemd crashd
  - mount-setup: change the system mount propagation to shared by default only at bootup
  - cgroup-util: make definition of CGROUP_CONTROLLER_TO_MASK() unsigned
  - cgroup: update only siblings that got realized once
  - core: add a config item to support setting the value of cpuset.clone_children when systemd is starting
  - support loongarch for systemd
  - test-catalog: Fix coredump when compiled under GCC10
  - add Iluvatar CoreX pci id (Liwei Ge)
  - seccomp: add loongarch64 support (Liwei Ge)
  - seccomp: remove loongarch64 switch(Liwei Ge)
  - umount: check LO_FLAGS_AUTOCLEAR after LOOP_CLR_FD claimed success(yuanhui)
  - fileio: when reading a full file into memory, refuse inner NUL bytes (Guorui Yu)
  - util: introduce explicit_bzero_safe for explicit memset (Guorui Yu)
  - util: introduce erase_and_free() helper (Guorui Yu)
  - util: introduce READ_FULL_FILE_SECURE flag for reading secure data (Guorui Yu)
  - fileio: introduce warn_file_is_world_accessible() (Guorui Yu)
  - fileio: read_full_file_full() also warns when file is world readable and secure flag is set (Guorui Yu)
  - basic/fileio: Fix memory leak if READ_FULL_FILE_SECURE flag is used (Guorui Yu)
  - fileio: add explicit flag for generating world executable warning when reading file (Guorui Yu)
  - fileio: add 'dir_fd' parameter to read_full_file_full() (Guorui Yu)
  - fileio: add support for read_full_file() on AF_UNIX stream sockets (Guorui Yu)
  - fileio: beef up READ_FULL_FILE_CONNECT_SOCKET to allow setting sender socket name (Guorui Yu)
  - fileio: teach read_full_file_full() to read from offset/with maximum size (Guorui Yu)
  - cryptsetup: port cryptsetup's main key file logic over to read_full_file_full() (Guorui Yu)
  - Update upstream parse_hwdb.py to fix parse-hwdb error (Zhongling He)
  - cgroup: do not refresh cgroup devices config when daemon-reload (Zhongling He)
  - core: introduce cgroup full delegation for compability (Zhongling He)
  - Update vendor ids for ieisystem 0750 (wangkaiyuan@inspur.com)
  - LifseaOS: Add back hostnamectl (yuanhui@linux.alibaba.com)
  - LifseaOS: Add back timedatectl (yuanhui@linux.alibaba.com)
  - LifseaOS: shared: Remove dependency of libcryptsetup if HAVE_LIBCRYPTSETUP is not defined (yuanhui@linux.alibaba.com)
  - LifseaOS: analyze: show information from hostnamed in plot even when user mode (yuanhui@linux.alibaba.com)
  - LifseaOS: configure: Disable smack (yuanhui@linux.alibaba.com)
  - LifseaOS: Remove nss module provided by systemd (yuanhui@linux.alibaba.com)
  - LifseaOS: configure: Remove multiple non-essential features (yuanhui@linux.alibaba.com)
  - LifseaOS: configure: Disable firstboot (yuanhui@linux.alibaba.com)
  - LifseaOS: Remove user-runtime-dir binary and service file (yuanhui@linux.alibaba.com)
  - LifseaOS: Remove the dependency of acl package (yuanhui@linux.alibaba.com)
  - LifseaOS: Remove locale and hostname related tools (yuanhui@linux.alibaba.com)
  - LifseaOS: Remove multiple unnecessary modules (yuanhui@linux.alibaba.com)
  - LifseaOS: Remove compression algorithm (yuanhui@linux.alibaba.com)
  - LifseaOS: Remove many tools of little use (yuanhui@linux.alibaba.com)
  - LifseaOS: Remove coredump tools (yuanhui@linux.alibaba.com)
  - LifseaOS: configure: Disable cryptsetup (yuanhui@linux.alibaba.com)
  - LifseaOS: configure: Disable polkit (yuanhui@linux.alibaba.com)
  - LifseaOS: configure: Disable logind (yuanhui@linux.alibaba.com)
  - LifseaOS: Remove systemd-pam module (yuanhui@linux.alibaba.com)
  - LifseaOS: configure: Remove manpage and bash/zsh completion (yuanhui@linux.alibaba.com)
  - LifseaOS: cgroup: Do not remove cgroup path which not created by systemd (yuanhui@linux.alibaba.com)
  - Remove patch 20002 as it inhibits systemd device cgroup slice creation (zhonglingh@linux.alibaba.com)
  - Add patch 20005 to enable device cgroup full delegation by default (zhonglingh@linux.alibaba.com)
  - cherry-pick `add sw patch #20ead624ed837d467ff4c9607d46c027bbc84ac3`. (nijie@wxiat.com)
  - add seccomp support for sw_64. (Weisson@alinux.alibaba.com)
  - add test-seccomp support for sw_64. (Weisson@alinux.alibaba.com)
  - core: Fix subcgroup deletion caused by full delegation (zhonglingh@linux.alibaba.com)
  - core: Fix cgroups members mask cache propagation problem (zhonglingh@linux.alibaba.com)
  - core, udev: remove old device on move event (zhonglingh@linux.alibaba.com)
  - bugfix: sw8a machine seems not to support getxpid syscall any more, replace it with getpid. (Weisson@linux.alibaba.com)


author: Lennart Poettering <lpoetter@redhat.com> - 0-0.7.20100629git4176e5
changelog:
  - New snapshot
  - Split off -units package where other packages can depend on without pulling in the whole of systemd


author: Lennart Poettering <lpoetter@redhat.com> - 8-3
changelog:
  - Reexecute after installation, take ownership of /var/run/user
  - https://bugzilla.redhat.com/show_bug.cgi?id=627457
  - https://bugzilla.redhat.com/show_bug.cgi?id=627634


author: Lennart Poettering <lpoetter@redhat.com> - 10-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=630401
  - https://bugzilla.redhat.com/show_bug.cgi?id=630225
  - https://bugzilla.redhat.com/show_bug.cgi?id=626966
  - https://bugzilla.redhat.com/show_bug.cgi?id=623456


author: Lennart Poettering <lpoetter@redhat.com> - 14-1
changelog:
  - Upstream update
  - Enable hwclock-load by default
  - Obsolete readahead
  - Enable /var/run and /var/lock on tmpfs


author: Lennart Poettering <lpoetter@redhat.com> - 24-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=694079
  - https://bugzilla.redhat.com/show_bug.cgi?id=693289
  - https://bugzilla.redhat.com/show_bug.cgi?id=693274
  - https://bugzilla.redhat.com/show_bug.cgi?id=693161


author: Lennart Poettering <lpoetter@redhat.com> - 25-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=694788
  - https://bugzilla.redhat.com/show_bug.cgi?id=694321
  - https://bugzilla.redhat.com/show_bug.cgi?id=690253
  - https://bugzilla.redhat.com/show_bug.cgi?id=688661
  - https://bugzilla.redhat.com/show_bug.cgi?id=682662
  - https://bugzilla.redhat.com/show_bug.cgi?id=678555
  - https://bugzilla.redhat.com/show_bug.cgi?id=628004


author: Lennart Poettering <lpoetter@redhat.com> - 26-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=699394
  - https://bugzilla.redhat.com/show_bug.cgi?id=698198
  - https://bugzilla.redhat.com/show_bug.cgi?id=698674
  - https://bugzilla.redhat.com/show_bug.cgi?id=699114
  - https://bugzilla.redhat.com/show_bug.cgi?id=699128


author: Lennart Poettering <lpoetter@redhat.com> - 26-2
changelog:
  - Bugfix release
  - https://bugzilla.redhat.com/show_bug.cgi?id=707507
  - https://bugzilla.redhat.com/show_bug.cgi?id=707483
  - https://bugzilla.redhat.com/show_bug.cgi?id=705427
  - https://bugzilla.redhat.com/show_bug.cgi?id=707577


author: Michal Schmidt <mschmidt@redhat.com> - 28-3
changelog:
  - Apply patches from current upstream
  - https://bugzilla.redhat.com/show_bug.cgi?id=709909
  - https://bugzilla.redhat.com/show_bug.cgi?id=710839
  - https://bugzilla.redhat.com/show_bug.cgi?id=711015


author: Michal Schmidt <mschmidt@redhat.com> - 28-4
changelog:
  - Apply patches from current upstream.
  - Fixes memory size detection on 32-bit with >4GB RAM (BZ712341)


author: Lennart Poettering <lpoetter@redhat.com> - 35-1
changelog:
  - New upstream release
  - Update post scripts
  - Resolves: #726683, #713384, #698198, #722803, #727315, #729997, #733706, #734611


author: Michal Schmidt <mschmidt@redhat.com> - 37-2
changelog:
  - A couple of fixes from upstream:
  - Fix a regression in bash-completion reported in Bodhi.
  - Fix a crash in isolating.
  - Resolves: #717325


author: Michal Schmidt <mschmidt@redhat.com> - 38-5
changelog:
  - Build against libgee06. Reenable gtk tools.
  - Delete unused patches.
  - Add easy building of git snapshots.
  - Remove legacy spec file elements.
  - Don't mention implicit BuildRequires.
  - Configure with --disable-static.
  - Merge -units into the main package.
  - Move section 3 manpages to -devel.
  - Fix unowned directory.
  - Run ldconfig in scriptlets.
  - Split systemd-analyze to a subpackage.


author: Lennart Poettering <lpoetter@redhat.com> - 42-1
changelog:
  - New upstream release
  - Save a bit of entropy during system installation (#789407)
  - Don't own /etc/os-release anymore, leave that to fedora-release


author: Dennis Gilmore <dennis@ausil.us> - 43-2
changelog:
  - don't conflict with fedora-release systemd never actually provided
  - /etc/os-release so there is no actual conflict


author: Dennis Gilmore <dennis@ausil.us> - 44-3
changelog:
  - apply patch from upstream so we can build systemd on arm and ppc
  - and likely the rest of the secondary arches


author: Michal Schmidt <mschmidt@redhat.com> - 44-4
changelog:
  - Add triggers from Bill Nottingham to correct the damage done by
    the obsoleted systemd-units's preun scriptlet (#807457).


author: Kay Sievers - 185-1
changelog:
  - New upstream release
    - udev selinux labeling fixes
    - new man pages
    - systemctl help <unit name>


author: Michal Schmidt <mschmidt@redhat.com> - 185-4.gita2368a3
changelog:
  - Update to current git snapshot
    - Add systemd-readahead-analyze
    - Drop upstream patch
  - Split systemd-libs
  - Drop duplicate doc files
  - Fixed License headers of subpackages


author: Lennart Poettering <lpoetter@redhat.com> - 188-1
changelog:
  - New upstream release
  - Enable gdm and avahi by default via the preset file
  - Convert /etc/sysconfig/desktop to display-manager.service symlink
  - Enable hardened build


author: Lennart Poettering <lpoetter@redhat.com> - 188-3
changelog:
  - Remount file systems MS_PRIVATE before switching roots
  - https://bugzilla.redhat.com/show_bug.cgi?id=847418


author: Ray Strode <rstrode@redhat.com> 188-4
changelog:
  - more scriptlet fixes
    (move dm migration logic to %posttrans so the service
     files it's looking for are available at the time
     the logic is run)


author: Lennart Poettering <lpoetter@redhat.com> - 189-3
changelog:
  - Update preset policy
  - Rename preset policy file from 99-default.preset to 90-default.preset so that people can order their own stuff after the Fedora default policy if they wish


author: Lennart Poettering <lpoetter@redhat.com> - 190-1
changelog:
  - New upstream release
  - Take possession of /etc/localtime, and remove /etc/sysconfig/clock
  - https://bugzilla.redhat.com/show_bug.cgi?id=858780
  - https://bugzilla.redhat.com/show_bug.cgi?id=858787
  - https://bugzilla.redhat.com/show_bug.cgi?id=858771
  - https://bugzilla.redhat.com/show_bug.cgi?id=858754
  - https://bugzilla.redhat.com/show_bug.cgi?id=858746
  - https://bugzilla.redhat.com/show_bug.cgi?id=858266
  - https://bugzilla.redhat.com/show_bug.cgi?id=858224
  - https://bugzilla.redhat.com/show_bug.cgi?id=857670
  - https://bugzilla.redhat.com/show_bug.cgi?id=856975
  - https://bugzilla.redhat.com/show_bug.cgi?id=855863
  - https://bugzilla.redhat.com/show_bug.cgi?id=851970
  - https://bugzilla.redhat.com/show_bug.cgi?id=851275
  - https://bugzilla.redhat.com/show_bug.cgi?id=851131
  - https://bugzilla.redhat.com/show_bug.cgi?id=847472
  - https://bugzilla.redhat.com/show_bug.cgi?id=847207
  - https://bugzilla.redhat.com/show_bug.cgi?id=846483
  - https://bugzilla.redhat.com/show_bug.cgi?id=846085
  - https://bugzilla.redhat.com/show_bug.cgi?id=845973
  - https://bugzilla.redhat.com/show_bug.cgi?id=845194
  - https://bugzilla.redhat.com/show_bug.cgi?id=845028
  - https://bugzilla.redhat.com/show_bug.cgi?id=844630
  - https://bugzilla.redhat.com/show_bug.cgi?id=839736
  - https://bugzilla.redhat.com/show_bug.cgi?id=835848
  - https://bugzilla.redhat.com/show_bug.cgi?id=831740
  - https://bugzilla.redhat.com/show_bug.cgi?id=823485
  - https://bugzilla.redhat.com/show_bug.cgi?id=821813
  - https://bugzilla.redhat.com/show_bug.cgi?id=807886
  - https://bugzilla.redhat.com/show_bug.cgi?id=802198
  - https://bugzilla.redhat.com/show_bug.cgi?id=767795
  - https://bugzilla.redhat.com/show_bug.cgi?id=767561
  - https://bugzilla.redhat.com/show_bug.cgi?id=752774
  - https://bugzilla.redhat.com/show_bug.cgi?id=732874
  - https://bugzilla.redhat.com/show_bug.cgi?id=858735


author: Lennart Poettering <lpoetter@redhat.com> - 194-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=859614
  - https://bugzilla.redhat.com/show_bug.cgi?id=859655


author: Lennart Poettering <lpoetter@redhat.com> - 195-1
changelog:
  - New upstream release
  - https://bugzilla.redhat.com/show_bug.cgi?id=831665
  - https://bugzilla.redhat.com/show_bug.cgi?id=847720
  - https://bugzilla.redhat.com/show_bug.cgi?id=858693
  - https://bugzilla.redhat.com/show_bug.cgi?id=863481
  - https://bugzilla.redhat.com/show_bug.cgi?id=864629
  - https://bugzilla.redhat.com/show_bug.cgi?id=864672
  - https://bugzilla.redhat.com/show_bug.cgi?id=864674
  - https://bugzilla.redhat.com/show_bug.cgi?id=865128
  - https://bugzilla.redhat.com/show_bug.cgi?id=866346
  - https://bugzilla.redhat.com/show_bug.cgi?id=867407
  - https://bugzilla.redhat.com/show_bug.cgi?id=868603


author: Michal Schmidt <mschmidt@redhat.com> - 195-4
changelog:
  - add dmraid-activation.service to the default preset
  - add yum protected.d fragment
  - https://bugzilla.redhat.com/show_bug.cgi?id=869619
  - https://bugzilla.redhat.com/show_bug.cgi?id=869717


author: Michal Schmidt <mschmidt@redhat.com> - 195-6
changelog:
  - Fix cyclical dep between systemd and systemd-libs.
  - Avoid broken build of test-journal-syslog.
  - https://bugzilla.redhat.com/show_bug.cgi?id=873387
  - https://bugzilla.redhat.com/show_bug.cgi?id=872638


author: Michal Schmidt <mschmidt@redhat.com> - 195-7
changelog:
  - Revert udev killing cgroup patch for F18 Beta.
  - https://bugzilla.redhat.com/show_bug.cgi?id=873576


author: Lennart Poettering <lpoetter@redhat.com> - 195-8
changelog:
  - https://bugzilla.redhat.com/show_bug.cgi?id=873459
  - https://bugzilla.redhat.com/show_bug.cgi?id=878093


author: Michal Schmidt <mschmidt@redhat.com> - 196-2
changelog:
  - added spice-vdagentd.service to presets (Lennart, #876237)
  - BR cryptsetup-devel instead of the legacy cryptsetup-luks-devel provide name
    (requested by Milan Brož).
  - verbose make to see the actual build flags


author: Michal Schmidt <mschmidt@redhat.com> - 196-3
changelog:
  - Disable hardening on s390(x) because PIE is broken there and produces
    text relocations with __thread (#868839).


author: Michal Schmidt <mschmidt@redhat.com> - 197-2
changelog:
  - Added qemu-guest-agent.service to presets (Lennart, #885406).
  - Add missing pygobject3-base to systemd-analyze deps (Lennart).
  - Do not require hwdata, it is all in the hwdb now (Kay).
  - Drop dependency on dbus-python.


author: Michal Schmidt <mschmidt@redhat.com> - 201-2
changelog:
  - Automatically discover whether to run autoreconf and add autotools and git
    BuildRequires based on the presence of patches to be applied.
  - Use find -delete.


author: Harald Hoyer <harald@redhat.com> 202-2
changelog:
  - nspawn create empty /etc/resolv.conf if necessary
  - python wrapper: add sd_journal_add_conjunction()
  - fix s390 booting
  - Resolves: rhbz#953217


author: Harald Hoyer <harald@redhat.com> 202-3
changelog:
  - fix ENOENT for getaddrinfo
  - Resolves: rhbz#954012 rhbz#956035
  - crypt-setup-generator: correctly check return of strdup
  - logind-dbus: initialize result variable
  - prevent library underlinking


author: Lennart Poettering <lpoetter@redhat.com> - 204-5
changelog:
  - Rename 90-display-manager.preset to 85-display-manager.preset so that it actually takes precedence over 90-default.preset's "disable *" line (#903690)


author: Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> - 206-3
changelog:
  - New systemd-python3 package (#976427).
  - Add ownership of a few directories that we create (#894202).


author: Dennis Gilmore <dennis@ausil.us> - 206-9
changelog:
  - Require grubby, Fedora installs require grubby,
  - kernel-install took over from new-kernel-pkg
  - without the Requires we are unable to compose Fedora
  - everyone else says that since kernel-install took over
  - it is responsible for ensuring that grubby is in place
  - this is really what we want for Fedora


author: Harald Hoyer <harald@redhat.com> 206-10
changelog:
  - Do not require grubby, lorax now takes care of grubby
  - cherry-picked a lot of patches from upstream


author: Harald Hoyer <harald@redhat.com> 206-11
changelog:
  - support "debug" kernel command line parameter
  - journald: fix fd leak in journal_file_empty
  - journald: fix vacuuming of archived journals
  - libudev: enumerate - do not try to match against an empty subsystem
  - cgtop: fixup the online help
  - libudev: fix memleak when enumerating childs


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 208-5
changelog:
  - Use unit name in PrivateTmp= directories (#957439)
  - Update manual pages, completion scripts, and hardware database
  - Configurable Timeouts/Restarts default values
  - Support printing of timestamps on the console
  - Fix some corner cases in detecting when writing to the console is safe
  - Python API: convert keyword values to string, fix sd_is_booted() wrapper
  - Do not tread missing /sbin/fsck.btrfs as an error (#1015467)
  - Allow masking of fsck units
  - Advertise hibernation to swap files
  - Fix SO_REUSEPORT settings
  - Prefer converted xkb keymaps to legacy keymaps (#981805, #1026872)
  - Make use of newer kmod
  - Assorted bugfixes: #1017161, #967521, #988883, #1027478, #821723, #1014303


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 208-7
changelog:
  - Backport patches (#1023041, #1036845, #1006386?)
  - HWDB update
  - Some small new features: nspawn --drop-capability=, running PID 1 under
    valgrind, "yearly" and "annually" in calendar specifications
  - Some small documentation and logging updates


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 208-11
changelog:
  - Backport a few fixes, relevant documentation updates, and HWDB changes
    (#1051797, #1051768, #1047335, #1047304, #1047186, #1045849, #1043304,
     - Flip journalctl to --full by default (#984758)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 208-13
changelog:
  - A different fix for #1023820 taken from Mageia
  - Backported fix for #997031
  - Hardward database updates, man pages improvements, a few small memory
    leaks, utf-8 correctness and completion fixes
  - Support for key-slot option in crypttab


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 208-14
changelog:
  - Back out patch which causes user manager to be destroyed when unneeded
    and spams logs (#1053315)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 210-5
changelog:
  - Bugfixes: #1047568, #1047039, #1071128, #1073402
  - Bash completions for more systemd tools
  - Bluetooth database update
  - Manpage fixes


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 210-8
changelog:
  - Fix logind unpriviledged reboot issue and a few other minor fixes
  - Limit generator execution time
  - Recognize buttonless joystick types


author: Michal Sekletar <msekleta@redhat.com> - 213-2
changelog:
  - Create temporary files after installation (#1101983)
  - Add sysstat-collect.timer, sysstat-summary.timer to preset policy (#1101621)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 214-2
changelog:
  - Do not restart systemd-logind on upgrades (#1110697)
  - Add some patches (#1081429, #1054549, #1108568, #928962)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 215-2
changelog:
  - Move systemd-journal-remote to systemd-journal-gateway package (#1114688)
  - Disable /etc/mtab handling temporarily (#1116158)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 215-4
changelog:
  - Various man page updates
  - Static device node logic is conditionalized on CAP_SYS_MODULES instead of CAP_MKNOD
    for better behaviour in containers
  - Some small networkd link handling fixes
  - vconsole-setup runs setfont before loadkeys (https://bugs.freedesktop.org/show_bug.cgi?id=80685)
  - New systemd-escape tool
  - XZ compression settings are tweaked to greatly improve journald performance
  - "watch" is accepted as chassis type
  - Various sysusers fixes, most importantly correct selinux labels
  - systemd-timesyncd bug fix (https://bugs.freedesktop.org/show_bug.cgi?id=80932)
  - Shell completion improvements
  - New udev tag ID_SOFTWARE_RADIO can be used to instruct logind to allow user access
  - XEN and s390 virtualization is properly detected


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 215-5
changelog:
  - Fix SELinux context of /etc/passwd-, /etc/group-, /etc/.updated (#1121806)
  - Add missing BR so gnutls and elfutils are used


author: Michal Schmidt <mschmidt@redhat.com> - 216-5
changelog:
  - Use common CONFIGURE_OPTS for build2 and build3.
  - Configure timesyncd with NTP servers from Fedora/RHEL vendor zone.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 217-4
changelog:
  - Change libgudev1 to only require systemd-libs (#727499), there's
    no need to require full systemd stack.
  - Fixes for bugs #1159448, #1152220, #1158035.
  - Bash completions updates to allow propose more units for start/restart,
    and completions for set-default,get-default.
  - Again allow systemctl enable of instances.
  - Hardware database update and fixes.
  - Udev crash on invalid options and kernel commandline timeout parsing are fixed.
  - Add "embedded" chassis type.
  - Sync before 'reboot -f'.
  - Fix restarting of timer units.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 218-4
changelog:
  - Enable xkbcommon dependency to allow checking of keymaps
  - Fix permissions of /var/log/journal (#1048424)
  - Enable timedatex in presets (#1187072)
  - Disable rpcbind in presets (#1099595)


author: Lennart Poettering <lpoetter@redhat.com> - 219-1
changelog:
  - New upstream release
  - This removes the sysctl/bridge hack, a different solution needs to be found for this (see #634736)
  - This removes the /etc/resolv.conf hack, anaconda needs to fix their handling of /etc/resolv.conf as symlink
  - This enables "%check"
  - disable gold on arm, as that is broken (see #1193212)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 219-8
changelog:
  - Reworked device handling (#1195761)
  - ACL handling fixes (with a script in %post)
  - Various log messages downgraded (#1184712)
  - Allow PIE on s390 again (#1197721)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 219-10
changelog:
  - Fixes for bugs 1186018, 1195294, 1185604, 1196452.
  - Hardware database update.
  - Documentation fixes.
  - A fix for journalctl performance regression.
  - Fix detection of inability to open files in journalctl.
  - Detect SuperH architecture properly.
  - The first of duplicate lines in tmpfiles wins again.
  - Do vconsole setup after loading vconsole driver, not fbcon.
  - Fix problem where some units were restarted during systemd reexec.
  - Fix race in udevadm settle tripping up NetworkManager.
  - Downgrade various log messages.
  - Fix issue where journal-remote would process some messages with a delay.
  - GPT /srv partition autodiscovery is fixed.
  - Reconfigure old Finnish keymaps in post (#1151958)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 219-11
changelog:
  - Move all parts systemd-journal-{remote,upload} to
    systemd-journal-gatewayd subpackage (#1193143).
  - Create /var/lib/systemd/journal-upload directory (#1193145).
  - Cut out lots of stupid messages at debug level which were obscuring more
    important stuff.
  - Apply "tentative" state for devices only when they are added, not removed.
  - Ignore invalid swap pri= settings (#1204336)
  - Fix SELinux check for timedated operations to enable/disable ntp (#1014315)
  - Fix comparing of filesystem paths (#1184016)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 219-14
changelog:
  - Remove presets (#1221340)
  - Fix (potential) crash and memory leak in timedated, locking failure
    in systemd-nspawn, crash in resolved.
  - journalctl --list-boots should be faster
  - zsh completions are improved
  - various ommissions in docs are corrected (#1147651)
  - VARIANT and VARIANT_ID fields in os-release are documented
  - systemd-fsck-root.service is generated in the initramfs (#1201979, #1107818)
  - systemd-tmpfiles should behave better on read-only file systems (#1207083)


author: Lennart Poettering <lpoetter@redhat.com> - 220-1
changelog:
  - New upstream release
  - Drop /etc/mtab hack, as that's apparently fixed in mock now (#1116158)
  - Remove ghosting for %{_sysconfdir}/systemd/system/runlevel*.target, these targets are not configurable anymore in systemd upstream
  - Drop work-around for #1002806, since this is solved upstream now


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 220-4
changelog:
  - systemd-devel should require systemd-libs, not the main package (#1226301)
  - Check for botched translations (#1226566)
  - Make /etc/udev/hwdb.d part of the rpm (#1226379)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 220-8
changelog:
  - Remove gudev which is now provided as separate package (libgudev)
  - Fix for spurious selinux denials (#1224211)
  - Udev change events (#1225905)
  - Patches for some potential crashes
  - ProtectSystem=yes does not touch /home
  - Man page fixes, hwdb updates, shell completion updates
  - Restored persistent device symlinks for bcache, xen block devices
  - Tag all DRM cards as master-of-seat


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 227-7
changelog:
  - Rename journal-gateway subpackage to journal-remote
  - Ignore the access mode on /var/log/journal (#1048424)
  - Do not assume fstab is present (#1281606)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 228-4.gite35a787
changelog:
  - Update to latest upstream git: there is a bunch of fixes
    (nss-mymachines overflow bug, networkd fixes, more completions are
    properly installed), mixed with some new resolved features.
  - Rework file triggers so that they always run before daemons are restarted


author: Dennis Gilmore <dennis@ausil.us> - 229-2
changelog:
  - revert: fixed kernel-install for copying files for grubby
  Resolves: rhbz#1299019
  - this causes the dtb files to not get installed at all and the fdtdir
  - line in extlinux.conf to not get updated correctly


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 229-5
changelog:
  - Split out systemd-container subpackage (#1163412)
  - Split out system-udev subpackage
  - Add various bugfix patches, incl. a tentative fix for #1308771


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 229-7
changelog:
  - Moar patches (#1316964, #1317928)
  - Move vconsole-setup and tmpfiles-setup-dev bits to systemd-udev
  - Protect systemd-udev from deinstallation


author: Zbigniew Jędrzejewski-Szmek <zbyszek@bupkis> - 230-1
changelog:
  - New version
  - Drop compat-libs
  - Require libxkbcommon explictly, since the automatic dependency will
    not be generated anymore


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 230-3
changelog:
  - Update to latest git snapshot (fixes for systemctl set-default,
    polkit lingering policy, reversal of the framebuffer rules,
    unaligned access fixes, fix for StartupBlockIOWeight-over-dbus).
    Those changes are interspersed with other changes and new features
    (mostly in lldp, networkd, and nspawn). Some of those new features
    might not work, but I think that existing functionality should not
    be broken, so it seems worthwile to update to the snapshot.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 231-4
changelog:
  - Fix preset-all (#1363858)
  - Fix issue with daemon-reload messing up graphics (#1367766)
  - A few other bugfixes


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 231-9
changelog:
  - Fix systemctl set-default (#1374371)
  - Prevent systemd-udev-trigger.service from restarting (follow-up for #1378974)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 231-10
changelog:
  - Do not recreate /var/log/journal on upgrades (#1383066)
  - Move nss-myhostname provides to systemd-libs (#1383271)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 232-1
changelog:
  - Update to latest version (#998615, #1181922, #1374371, #1390704, #1384150, #1287161)
  - Add %{_isa} to Provides on arch-full packages (#1387912)
  - Create systemd-coredump user in %pre (#1309574)
  - Replace grubby patch with a short-circuiting install.d "plugin"
  - Enable nss-systemd in the passwd, group lines in nsswith.conf
  - Add [!UNAVAIL=return] fallback after nss-resolve in hosts line in nsswith.conf
  - Move systemd-nspawn man pages to the right subpackage (#1391703)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 232-2
changelog:
  - Fix kernel-install (#1391829)
  - Restore previous systemd-user PAM config (#1391836)
  - Move journal-upload.conf.5 from systemd main to journal-remote subpackage (#1391833)
  - Fix permissions on /var/lib/systemd/journal-upload (#1262665)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 232-9
changelog:
  - Add fake dependency on systemd-pam to systemd-devel to ensure systemd-pam
    is available as multilib (#1414153)


author: zbyszek <zbyszek@in.waw.pl> - 232-11
changelog:
  - Backport a number of patches (#1411299, #1413075, #1415745,
                                  - Fix various memleaks and unitialized variable access
  - Shell completion enhancements
  - Enable TPM logging by default (#1411156)
  - Update hwdb (#1270124)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 232-12
changelog:
  - Backport patch for initrd-switch-root.service getting killed (#1414904)
  - Fix sd-journal-gatewayd -D, --trust, and COREDUMP_CONTAINER_CMDLINE
    extraction by sd-coredump.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 233-1
changelog:
  - New upstream release (#1416201, #1405439, #1420753, many others)
  - New systemd-tests subpackage with "installed tests"


author: Michal Sekletar <msekleta@redhat.com> - 233-3
changelog:
  - Backport bugfixes from upstream
  - Don't return error when machinectl couldn't figure out container IP addresses (#1419501)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 233-4
changelog:
  - Backport a bunch of small fixes (memleaks, wrong format strings,
    man page clarifications, shell completion)
  - Fix systemd-resolved crash on crafted DNS packet (CVE-2017-9217, #1455493)
  - Fix systemd-vconsole-setup.service error on systems with no VGA console (#1272686)
  - Drop soft-static uid for systemd-journal-gateway
  - Use ID from /etc/os-release as ntpvendor


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 234-3
changelog:
  - Fix x-systemd.timeout=0 in /etc/fstab (#1462378)
  - Minor patches (memleaks, --help fixes, seccomp on arm64)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 236-2.git23e14c4
changelog:
  - Backport a bunch of bugfixes from upstream (#1531502, #1531381, #1526621
    various memory corruptions in systemd-networkd)
  - /dev/kvm is marked as a static node which fixes permissions on s390x
    and ppc64 (#1532382)


author: Zbigniew Jędrzejeweski-Szmek <zbyszek@in.waw.pl> - 237-1.git78bd769
changelog:
  - Update to first stable snapshot (various minor memory leaks and misaccesses,
    some documentation bugs, build fixes).


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 237-2.gitdff4849
changelog:
  - Backport a bunch of patches, most notably for the journal and various
    memory issues. Some minor build fixes.
  - Switch to new ldconfig macros that do nothing in F28+
  - /etc/systemd/dont-synthesize-nobody is created in %post if nfsnobody
    or nobody users are defined (#1537262)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 237-3.git84c8da5
changelog:
  - Update some patches for test skipping that were updated upstream
    before merging
  - Add /usr/lib/systemd/purge-nobody-user — a script to check if nobody is defined
    correctly and possibly replace existing mappings


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 238-1
changelog:
  - Update to latest version
  - This fixes a hard-to-trigger potential vulnerability (CVE-2018-6954)
  - New transfiletriggers are installed for udev hwdb and rules, the journal
    catalog, sysctl.d, binfmt.d, sysusers.d, tmpfiles.d.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 238-3
changelog:
  - Revert the patches for GRUB BootLoaderSpec support
  - Add patch for /etc/machine-id creation (#1552843)


author: Michal Sekletar <msekleta@redhat.com> - 238-4
changelog:
  - disable support for qrencode (#1566158)
  - bump default journal rate limit to 10000 messages per 30s (#1563729)
  - fix unit reloads (#1560549)
  - don't create /var/log/journal during package installation (#1523188)


author: Michal Sekletar <msekleta@redhat.com> - 238-6
changelog:
  - forwardport downstream-only udev rules from RHEL-7 (#1523227)
  - set RemoveIPC=no by default (#1523233)


author: Michal Sekletár <msekleta@redhat.com> - 239-1
changelog:
  - rebase to systemd-239
  - Override systemd-user PAM config in install and not prep (patch by Filipe Brandenburger <filbranden@google.com>)
  - use %autosetup -S git_am to apply patches
  - revert upstream default for RemoveIPC (#1523233)
  - bump DefaultTasksMax to 80% of kernel default (#1523236)
  - avoid /tmp being mounted as tmpfs without the user's will (#1578772)
  - bump maximum number of processes in user slice to 80% of pid.max (#1523236)
  - forwardport downstream-only udev rules from RHEL-7 (#1523227)
  - don't ship systemd-networkd
  - don't ship systemd-timesyncd
  - add back support for WAIT_FOR to udev rules (#1523213)


author: Michal Sekletár <msekleta@redhat.com> - 239-2
changelog:
  - 20-grubby.install: populate symvers.gz file (#1609698)
  - net_setup_link: allow renaming interfaces that were renamed already
  - units: drop DynamicUser=yes from systemd-resolved.service
  - journal: remove journal audit socket


author: Michal Sekletár <msekleta@redhat.com> - 239-4
changelog:
  - drop the patch for delayed loading of config in net_setup_link and set NAME in prefixdevname udev rules (#1614681)
  - bus: move BUS_DONT_DESTROY calls after asserts (#1610397)


author: Michal Sekletár <msekleta@redhat.com> - 239-7
changelog:
  - change default cgroup hierarchy to "legacy" (#1638650)
  - we never added mymachines module to passwd: or group: in RHEL8, hence don't try to remove it (#1638450)
  - bump minimal size of random pool to 1024 bytes (#1619268)
  - install RHEL-7 compatible rc.local (#1625209)
  - backport support for sector-size crypttab option (#1572563)
  - units: don't enable per-service IP firewall by default (#1630219)
  - sd-bus: unify three code-paths which free struct bus_container (#1635435)
  - bus-message: do not crash on message with a string of zero length (#1635439)
  - bus-message: stack based buffer overflow in free_and_strdup (#1635428)
  - journal: change support URL shown in the catalog entries (#1550548)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-9
changelog:
  - dissect-image: use right comparison function (#1602706)
  - login: avoid leak of name returned by uid_to_name() (#1602706)
  - firewall-util: add an assert that we're not overwriting a buffer (#1602706)
  - journal-file: avoid calling ftruncate with invalid fd (#1602706)
  - dhcp6: make sure we have enough space for the DHCP6 option header (#1643363)
  - core: rename queued_message → pending_reload_message (#1647359)
  - core: when we can't send the pending reload message, say we ignore it in the warning we log (#1647359)
  - core: make sure we don't throttle change signal generator when a reload is pending (#1647359)
  - proc-cmdline: introduce PROC_CMDLINE_RD_STRICT (#1643429)
  - debug-generator: introduce rd.* version of all options (#1643429)
  - chown-recursive: let's rework the recursive logic to use O_PATH (#1643368)
  - chown-recursive: also drop ACLs when recursively chown()ing (#1643368)
  - chown-recursive: TAKE_FD() is your friend (#1643368)
  - test: add test case for recursive chown()ing (#1643368)
  - Revert "sysctl.d: request ECN on both in and outgoing connections" (#1619790)
  - detect-virt: do not try to read all of /proc/cpuinfo (#1631532)
  - sd-bus: unify three code-paths which free struct bus_container (#1635435)
  - sd-bus: properly initialize containers (#1635435)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-10
changelog:
  - cryptsetup-generator: introduce basic keydev support (#1656869)
  - cryptsetup: don't use %m if there's no error to show (#1656869)
  - cryptsetup-generator: don't return error if target directory already exists (#1656869)
  - cryptsetup-generator: allow whitespace characters in keydev specification (#1656869)
  - rules: watch metadata changes on DASD devices (#1638676)
  - sysctl.d: switch net.ipv4.conf.all.rp_filter from 1 to 2 (#1653824)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-12
changelog:
  - core: when deserializing state always use read_line(…, LONG_LINE_MAX, …) (CVE-2018-15686)
  - coredump: remove duplicate MESSAGE= prefix from message (#1664976)
  - journald: remove unnecessary {} (#1664976)
  - journald: do not store the iovec entry for process commandline on stack (#1664976)
  - basic/process-util: limit command line lengths to _SC_ARG_MAX (#1664976)
  - coredump: fix message when we fail to save a journald coredump (#1664976)
  - procfs-util: expose functionality to query total memory (#1664976)
  - basic/prioq: add prioq_peek_item() (#1664976)
  - journal: limit the number of entries in the cache based on available memory (#1664976)
  - journald: periodically drop cache for all dead PIDs (#1664976)
  - process-util: don't use overly large buffer to store process command line (#1664976)
  - Revert "sysctl.d: switch net.ipv4.conf.all.rp_filter from 1 to 2" (#1653824)
  - journal: fix syslog_parse_identifier() (#1664978)
  - journald: set a limit on the number of fields (1k) (#1664977)
  - journald: when processing a native message, bail more quickly on overbig messages (#1664977)
  - journald: lower the maximum entry size limit to ½ for non-sealed fds (#1664977)
  - µhttpd: use a cleanup function to call MHD_destroy_response (#1664977)
  - journal-remote: verify entry length from header (#1664977)
  - journal-remote: set a limit on the number of fields in a message (#1664977)
  - journald: correctly attribute log messages also with cgroupsv1 (#1658115)
  - rules: add elevator= kernel command line parameter (#1670126)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-14
changelog:
  - rules: implement new memory hotplug policy (#1670728)
  - rules: add the rule that adds elevator= kernel command line parameter (#1670126)
  - bus-socket: Fix line_begins() to accept word matching full string (#1692991)
  - Refuse dbus message paths longer than BUS_PATH_SIZE_MAX limit. (#1678641)
  - Allocate temporary strings to hold dbus paths on the heap (#1678641)
  - sd-bus: if we receive an invalid dbus message, ignore and proceeed (#1678641)
  - Revert "core: one step back again, for nspawn we actually can't wait for cgroups running empty since systemd will get exactly zero notifications about it" (#1703485)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-15
changelog:
  - tree-wide: shorten error logging a bit (#1697893)
  - nspawn: simplify machine terminate bus call (#1697893)
  - nspawn: merge two variable declaration lines (#1697893)
  - nspawn: rework how we allocate/kill scopes (#1697893)
  - unit: enqueue cgroup empty check event if the last ref on a unit is dropped (#1697893)
  - Revert "journal: remove journal audit socket" (#1699287)
  - journal: don't enable systemd-journald-audit.socket by default (#1699287)
  - logs-show: use grey color for de-emphasizing journal log output (#1695601)
  - units: add [Install] section to tmp.mount (#1667065)
  - nss: do not modify errno when NSS_STATUS_NOTFOUND or NSS_STATUS_SUCCESS (#1691691)
  - util.h: add new UNPROTECT_ERRNO macro (#1691691)
  - nss: unportect errno before writing to NSS' *errnop (#1691691)
  - seccomp: reduce logging about failure to add syscall to seccomp (#1658691)
  - format-table: when duplicating a cell, also copy the color (#1689832)
  - format-table: optionally make specific cells clickable links (#1689832)
  - format-table: before outputting a color, check if colors are available (#1689832)
  - format-table: add option to store/format percent and uint64_t values in cells (#1689832)
  - format-table: optionally allow reversing the sort order for a column (#1689832)
  - format-table: add table_update() to update existing entries (#1689832)
  - format-table: add an API for getting the cell at a specific row/column (#1689832)
  - format-table: always underline header line (#1689832)
  - format-table: add calls to query the data in a specific cell (#1689832)
  - format-table: make sure we never call memcmp() with NULL parameters (#1689832)
  - format-table: use right field for display (#1689832)
  - format-table: add option to uppercase cells on display (#1689832)
  - format-table: never try to reuse cells that have color/url/uppercase set (#1689832)
  - locale-util: add logic to output smiley emojis at various happiness levels (#1689832)
  - analyze: add new security verb (#1689832)
  - tests: add a rudimentary fuzzer for server_process_syslog_message (#9979) (#1696224)
  - journald: make it clear that dev_kmsg_record modifies the string passed to it (#1696224)
  - journald: free the allocated memory before returning from dev_kmsg_record (#1696224)
  - tests: rework the code fuzzing journald (#1696224)
  - journald: make server_process_native_message compatible with fuzz_journald_processing_function (#1696224)
  - tests: add a fuzzer for server_process_native_message (#1696224)
  - tests: add a fuzzer for sd-ndisc (#1696224)
  - ndisc: fix two infinite loops (#1696224)
  - tests: add reproducers for several issues uncovered with fuzz-journald-syslog (#1696224)
  - tests: add a reproducer for an infinite loop in ndisc_handle_datagram (#1696224)
  - tests: add a reproducer for another infinite loop in ndisc_handle_datagram (#1696224)
  - fuzz: rename "fuzz-corpus" directory to just "fuzz" (#1696224)
  - test: add testcase for issue 10007 by oss-fuzz (#1696224)
  - fuzz: unify the "fuzz-regressions" directory with the main corpus (#1696224)
  - test-bus-marshal: use cescaping instead of hexmem (#1696224)
  - meson: add -Dlog-trace to set LOG_TRACE (#1696224)
  - meson: allow building resolved and machined without nss modules (#1696224)
  - meson: drop duplicated condition (#1696224)
  - meson: use .source_root() in more places (#1696224)
  - meson: treat all fuzz cases as unit tests (#1696224)
  - fuzz-bus-message: add fuzzer for message parsing (#1696224)
  - bus-message: use structured initialization to avoid use of unitialized memory (#1696224)
  - bus-message: avoid an infinite loop on empty structures (#1696224)
  - bus-message: let's always use -EBADMSG when the message is bad (#1696224)
  - bus-message: rename function for clarity (#1696224)
  - bus-message: use define (#1696224)
  - bus: do not print (null) if the message has unknown type (#1696224)
  - bus-message: fix calculation of offsets table (#1696224)
  - bus-message: remove duplicate assignment (#1696224)
  - bus-message: fix calculation of offsets table for arrays (#1696224)
  - bus-message: drop asserts in functions which are wrappers for varargs version (#1696224)
  - bus-message: output debug information about offset troubles (#1696224)
  - bus-message: fix skipping of array fields in !gvariant messages (#1696224)
  - bus-message: also properly copy struct signature when skipping (#1696224)
  - fuzz-bus-message: add two test cases that pass now (#1696224)
  - bus-message: return -EBADMSG not -EINVAL on invalid !gvariant messages (#1696224)
  - bus-message: avoid wrap-around when using length read from message (#1696224)
  - util: do not use stack frame for parsing arbitrary inputs (#1696224)
  - travis: enable ASan and UBSan on RHEL8 (#1683319)
  - tests: keep SYS_PTRACE when running under ASan (#1683319)
  - tree-wide: various ubsan zero size memory fixes (#1683319)
  - util: introduce memcmp_safe() (#1683319)
  - test-socket-util: avoid "memleak" reported by valgrind (#1683319)
  - sd-journal: escape binary data in match_make_string() (#1683319)
  - capability: introduce CAP_TO_MASK_CORRECTED() macro replacing CAP_TO_MASK() (#1683319)
  - sd-bus: use size_t when dealing with memory offsets (#1683319)
  - sd-bus: call cap_last_cap() only once in has_cap() (#1683319)
  - mount-point: honour AT_SYMLINK_FOLLOW correctly (#1683319)
  - travis: switch from trusty to xenial (#1683319)
  - test-socket-util: Add tests for receive_fd_iov() and friends. (#1683319)
  - socket-util: Introduce send_one_fd_iov() and receive_one_fd_iov() (#1683319)
  - core: swap order of "n_storage_fds" and "n_socket_fds" parameters (#1683334)
  - execute: use our usual syntax for defining bit masks (#1683334)
  - core: introduce new Type=exec service type (#1683334)
  - man: document the new Type=exec type (#1683334)
  - sd-bus: allow connecting to the pseudo-container ".host" (#1683334)
  - sd-login: let's also make sd-login understand ".host" (#1683334)
  - test: add test for Type=exec (#1683334)
  - journal-gateway: explicitly declare local variables (#1705971)
  - tools: drop unused variable (#1705971)
  - journal-gateway: use localStorage["cursor"] only when it has valid value (#1705971)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-16
changelog:
  - sd-bus: deal with cookie overruns (#1694999)
  - journal-remote: do not request Content-Length if Transfer-Encoding is chunked (#1708849)
  - journal: do not remove multiple spaces after identifier in syslog message (#1691817)
  - cryptsetup: Do not fallback to PLAIN mapping if LUKS data device set fails. (#1719153)
  - cryptsetup: call crypt_load() for LUKS only once (#1719153)
  - cryptsetup: Add LUKS2 token support. (#1719153)
  - udev/scsi_id: fix incorrect page length when get device identification VPD page (#1713227)
  - Change job mode of manager triggered restarts to JOB_REPLACE (#11456
  - bash-completion: analyze: support 'security' (#1733395)
  - man: note that journal does not validate syslog fields (#1707175)
  - rules: skip memory hotplug on ppc64 (#1713159)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-17
changelog:
  - mount: simplify /proc/self/mountinfo handler (#1696178)
  - mount: rescan /proc/self/mountinfo before processing waitid() results (#1696178)
  - swap: scan /proc/swaps before processing waitid() results (#1696178)
  - analyze-security: fix potential division by zero (#1734400)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-18
changelog:
  - shared/but-util: drop trusted annotation from bus_open_system_watch_bind_with_description() (#1746857)
  - sd-bus: adjust indentation of comments (#1746857)
  - resolved: do not run loop twice (#1746857)
  - resolved: allow access to Set*Link and Revert methods through polkit (#1746857)
  - resolved: query polkit only after parsing the data (#1746857)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-19
changelog:
  - core: never propagate reload failure to service result (#1735787)
  - man: document systemd-analyze security (#1750343)
  - man: reorder and add examples to systemd-analyze(1) (#1750343)
  - travis: move to CentOS 8 docker images (#1761519)
  - travis: drop SCL remains (#1761519)
  - syslog: fix segfault in syslog_parse_priority() (#1761519)
  - sd-bus: make strict asan shut up (#1761519)
  - travis: don't run slow tests under ASan/UBSan (#1761519)
  - kernel-install: do not require non-empty kernel cmdline (#1701454)
  - ask-password: prevent buffer overrow when reading from keyring (#1752050)
  - core: try to reopen /dev/kmsg again right after mounting /dev (#1749212)
  - buildsys: don't garbage collect sections while linking (#1748258)
  - udev: introduce CONST key name (#1762679)
  - Call getgroups() to know size of supplementary groups array to allocate (#1743230256 KB
  - Consider smb3 as remote filesystem (#1757257)
  - process-util: introduce pid_is_my_child() helper (#1744972)
  - core: reduce the number of stalled PIDs from the watched processes list when possible (#1744972)
  - core: only watch processes when it's really necessary (#1744972)
  - core: implement per unit journal rate limiting (#1719577)
  - path: stop watching path specs once we triggered the target unit (#1763161)
  - journald: fixed assertion failure when system journal rotation fails (#9893) (#1763619)
  - test: use PBKDF2 instead of Argon2 in cryptsetup... (#1761519)
  - test: mask several unnecessary services (#1761519)
  - test: bump the second partition's size to 50M (#1761519)
  - shared/sleep-config: exclude zram devices from hibernation candidates (#1763617)
  - selinux: don't log SELINUX_INFO and SELINUX_WARNING messages to audit (#1763612)
  - sd-device: introduce log_device_*() macros (#1753369)
  - udev: Add id program and rule for FIDO security tokens (#1753369)
  - shared/but-util: drop trusted annotation from bus_open_system_watch_bind_with_description() (#1746857)
  - sd-bus: adjust indentation of comments (#1746857)
  - resolved: do not run loop twice (#1746857)
  - resolved: allow access to Set*Link and Revert methods through polkit (#1746857)
  - resolved: query polkit only after parsing the data (#1746857)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-20
changelog:
  - journal: rely on _cleanup_free_ to free a temporary string used in client_context_read_cgroup (#1764560)
  - basic/user-util: allow dots in user names (#1717603)
  - sd-bus: bump message queue size again (#1770189)
  - tests: put fuzz_journald_processing_function in a .c file (#1764560)
  - tests: add a fuzzer for dev_kmsg_record (#1764560)
  - basic: remove an assertion from cunescape_one (#1764560)
  - journal: fix an off-by-one error in dev_kmsg_record (#1764560)
  - tests: add a reproducer for a memory leak fixed in 30eddcd51b8a472e05d3b8d1 in August (#1764560)
  - tests: add a reproducer for a heap-buffer-overflow fixed in 937b1171378bc1000a (#1764560)
  - test: initialize syslog_fd in fuzz-journald-kmsg too (#1764560)
  - tests: add a fuzzer for process_audit_string (#1764560)
  - journald: check whether sscanf has changed the value corresponding to %n (#1764560)
  - tests: introduce dummy_server_init and use it in all journald fuzzers (#1764560)
  - tests: add a fuzzer for journald streams (#1764560)
  - tests: add a fuzzer for server_process_native_file (#1764560)
  - fuzz-journal-stream: avoid assertion failure on samples which don't fit in pipe (#1764560)
  - journald: take leading spaces into account in syslog_parse_identifier (#1764560)
  - Add a warning about the difference in permissions between existing directories and unit settings. (#1778384)
  - execute: remove one redundant comparison check (#1778384)
  - core: change ownership/mode of the execution directories also for static users (#1778384)
  - core/dbus-execute: remove unnecessary initialization (#1734787)
  - shared/cpu-set-util: move the part to print cpu-set into a separate function (#1734787)
  - shared/cpu-set-util: remove now-unused CPU_SIZE_TO_NUM() (#1734787)
  - Rework cpu affinity parsing (#1734787)
  - Move cpus_in_affinity_mask() to cpu-set-util.[ch] (#1734787)
  - test-cpu-set-util: add simple test for cpus_in_affinity_mask() (#1734787)
  - test-cpu-set-util: add a smoke test for test_parse_cpu_set_extend() (#1734787)
  - pid1: parse CPUAffinity= in incremental fashion (#1734787)
  - pid1: don't reset setting from /proc/cmdline upon restart (#1734787)
  - pid1: when reloading configuration, forget old settings (#1734787)
  - test-execute: use CPUSet too (#1734787)
  - shared/cpu-set-util: drop now-unused cleanup function (#1734787)
  - shared/cpu-set-util: make transfer of cpu_set_t over bus endian safe (#1734787)
  - test-cpu-set-util: add test for dbus conversions (#1734787)
  - shared/cpu-set-util: introduce cpu_set_to_range() (#1734787)
  - systemctl: present CPUAffinity mask as a list of CPU index ranges (#1734787)
  - shared/cpu-set-util: only force range printing one time (#1734787)
  - execute: dump CPUAffinity as a range string instead of a list of CPUs (#1734787)
  - cpu-set-util: use %d-%d format in  cpu_set_to_range_string() only for actual ranges (#1734787)
  - core: introduce NUMAPolicy and NUMAMask options (#1734787)
  - core: disable CPUAccounting by default (#1734787)
  - set kptr_restrict=1 (#1689346)
  - cryptsetup: reduce the chance that we will be OOM killed (#1696602)
  - core, job: fix breakage of ordering dependencies by systemctl reload command (#1766417)
  - debug-generator: enable custom systemd.debug_shell tty (#1723722)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-21
changelog:
  - test-cpu-set-util: fix comparison for allocation size (#1734787)
  - test-cpu-set-util: fix allocation size check on i386 (#1734787)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-23
changelog:
  - catalog: fix name of variable (#1677768)
  - cryptsetup: add keyfile-timeout to allow a keydev timeout and allow to fallback to a password if it fails. (#1763155)
  - cryptsetup: add documentation for keyfile-timeout (#1763155)
  - cryptsetup: use unabbrieviated variable names (#1763155)
  - cryptsetup: don't assert on variable which is optional (#1763155)
  - cryptsetup-generator: guess whether the keyfile argument is two items or one (#1763155)
  - crypt-util: Translate libcryptsetup log level instead of using log_debug() (#1776408)
  - cryptsetup: add some commenting about EAGAIN generation (#1776408)
  - cryptsetup: downgrade a log message we ignore (#1776408)
  - cryptsetup: rework how we log about activation failures (#1776408)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-24
changelog:
  - rules: reintroduce 60-alias-kmsg.rules (#1739353)
  - sd-bus: make rqueue/wqueue sizes of type size_t (CVE-2020-1712)
  - sd-bus: reorder bus ref and bus message ref handling (CVE-2020-1712)
  - sd-bus: make sure dispatch_rqueue() initializes return parameter on all types of success (CVE-2020-1712)
  - sd-bus: drop two inappropriate empty lines (CVE-2020-1712)
  - sd-bus: initialize mutex after we allocated the wqueue (CVE-2020-1712)
  - sd-bus: always go through sd_bus_unref() to free messages (CVE-2020-1712)
  - bus-message: introduce two kinds of references to bus messages (CVE-2020-1712)
  - sd-bus: introduce API for re-enqueuing incoming messages (CVE-2020-1712)
  - sd-event: add sd_event_source_disable_unref() helper (CVE-2020-1712)
  - polkit: when authorizing via PK let's re-resolve callback/userdata instead of caching it (CVE-2020-1712)
  - sysctl: let's by default increase the numeric PID range from 2^16 to 2^22 (#1744214)
  - journal: do not trigger assertion when journal_file_close() get NULL (#1788085)
  - journal: use cleanup attribute at one more place (#1788085)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-25
changelog:
  - sd-bus: use "queue" message references for managing r/w message queues in connection objects (CVE-2020-1712)
  - pid1: make sure to restore correct default values for some rlimits (#1789930)
  - main: introduce a define HIGH_RLIMIT_MEMLOCK similar to HIGH_RLIMIT_NOFILE (#1789930)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-26
changelog:
  - seccomp: introduce seccomp_restrict_suid_sgid() for blocking chmod() for suid/sgid files (#1687512)
  - test: add test case for restrict_suid_sgid() (#1687512)
  - core: expose SUID/SGID restriction as new unit setting RestrictSUIDSGID= (#1687512)
  - analyze: check for RestrictSUIDSGID= in "systemd-analyze security" (#1687512)
  - man: document the new RestrictSUIDSGID= setting (#1687512)
  - units: turn on RestrictSUIDSGID= in most of our long-running daemons (#1687512)
  - core: imply NNP and SUID/SGID restriction for DynamicUser=yes service (#1687512)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-32
changelog:
  - pid1: fix DefaultTasksMax initialization (#1809037)
  - cgroup: make sure that cpuset is supported on cgroup v2 and disabled with v1 (#1808940)
  - test: introduce TEST-36-NUMAPOLICY (#1808940)
  - test: replace `tail -f` with journal cursor which should be... (#1808940)
  - test: support MPOL_LOCAL matching in unpatched strace versions (#1808940)
  - test: make sure the strace process is indeed dead (#1808940)
  - test: skip the test on systems without NUMA support (#1808940)
  - test: give strace some time to initialize (#1808940)
  - test: add a simple sanity check for systems without NUMA support (#1808940)
  - test: drop the missed || exit 1 expression (#1808940)
  - test: replace cursor file with a plain cursor (#1808940)
  - cryptsetup: Treat key file errors as a failed password attempt (#1763155)
  - swap: finish the secondary swap units' jobs if deactivation of the primary swap unit fails (#1749622)
  - resolved: Recover missing PrivateTmp=yes and ProtectSystem=strict (#1810869)
  - bus_open leak sd_event_source when udevadm trigger。 (#1798504)
  - core: rework StopWhenUnneeded= logic (#1798046)
  - pid1: fix the names of AllowedCPUs= and AllowedMemoryNodes= (#1818054)
  - core: fix re-realization of cgroup siblings (#1818054)
  - basic: use comma as separator in cpuset cgroup cpu ranges (#1818054)
  - core: transition to FINAL_SIGTERM state after ExecStopPost= (#1766479)
  - sd-journal: close journal files that were deleted by journald before we've setup inotify watch (#1796128)
  - sd-journal: remove the dead code and actually fix #14695 (#1796128)
  - udev: downgrade message when we fail to set inotify watch up (#1808051)
  - logind: check PolicyKit before allowing VT switch (#1797679)
  - test: do not use global variable to pass error (#1823767)
  - test: install libraries required by tests (#1823767)
  - test: introduce install_zoneinfo() (#1823767)
  - test: replace duplicated Makefile by symbolic link (#1823767)
  - test: add paths of keymaps in install_keymaps() (#1823767)
  - test: make install_keymaps() optionally install more keymaps (#1823767)
  - test-fs-util: skip some tests when running in unprivileged container (#1823767)
  - test-process-util: skip several verifications when running in unprivileged container (#1823767)
  - test-execute: also check python3 is installed or not (#1823767)
  - test-execute: skip several tests when running in container (#1823767)
  - test: introduce test_is_running_from_builddir() (#1823767)
  - test: make test-catalog relocatable (#1823767)
  - test: parallelize tasks in TEST-24-UNIT-TESTS (#1823767)
  - test: try to determine QEMU_SMP dynamically (#1823767)
  - test: store coredumps in journal (#1823767)
  - pid1: add new kernel cmdline arg systemd.cpu_affinity= (#1812894)
  - udev-rules: make tape-changers also apprear in /dev/tape/by-path/ (#1820112)
  - man: be clearer that .timer time expressions need to be reset to override them (#1816908)
  - Add support for opening files for appending (#1809175)
  - nspawn: move payload to sub-cgroup first, then sync cgroup trees (#1837094)
  - core: move unit_status_emit_starting_stopping_reloading() and related calls to job.c (#1737283)
  - job: when a job was skipped due to a failed condition, log about it (#1737283)
  - core: split out all logic that updates a Job on a unit's unit_notify() invocation (#1737283)
  - core: make log messages about units entering a 'failed' state recognizable (#1737283)
  - core: log a recognizable message when a unit succeeds, too (#1737283)
  - tests: always use the right vtable wrapper calls (#1737283)
  - test-execute: allow filtering test cases by pattern (#1737283)
  - test-execute: provide custom failure message (#1737283)
  - core: ExecCondition= for services (#1737283)
  - Drop support for lz4 < 1.3.0 (#1843871)
  - test-compress: add test for short decompress_startswith calls (#1843871)
  - journal: adapt for new improved LZ4_decompress_safe_partial() (#1843871)
  - fuzz-compress: add fuzzer for compression and decompression (#1843871)
  - seccomp: fix __NR__sysctl usage (#1843871)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-33
changelog:
  - tmpfiles: fix crash with NULL in arg_root and other fixes and tests (#1836024)
  - sulogin-shell: Use force if SYSTEMD_SULOGIN_FORCE set (#1625929)
  - resolvconf: fixes for the compatibility interface (#1835594)
  - mount: don't add Requires for tmp.mount (#1748840)
  - core: coldplug possible nop_job (#1829798)
  - core: add IODeviceLatencyTargetSec (#1831519)
  - time-util: Introduce parse_sec_def_infinity (#1770379)
  - cgroup: use structured initialization (#1770379)
  - core: add CPUQuotaPeriodSec= (#1770379)
  - core: downgrade CPUQuotaPeriodSec= clamping logs to debug (#1770379)
  - sd-bus: avoid magic number in SASL length calculation (#1838081)
  - sd-bus: fix SASL reply to empty AUTH (#1838081)
  - sd-bus: skip sending formatted UIDs via SASL (#1838081)
  - core: add MemoryMin (#1763435)
  - core: introduce cgroup_add_device_allow() (#1763435)
  - test: remove support for suffix in get_testdata_dir() (#1763435)
  - cgroup: Implement default propagation of MemoryLow with DefaultMemoryLow (#1763435)
  - cgroup: Create UNIT_DEFINE_ANCESTOR_MEMORY_LOOKUP (#1763435)
  - unit: Add DefaultMemoryMin (#1763435)
  - cgroup: Polish hierarchically aware protection docs a bit (#1763435)
  - cgroup: Readd some plumbing for DefaultMemoryMin (#1763435)
  - cgroup: Support 0-value for memory protection directives (#1763435)
  - cgroup: Test that it's possible to set memory protection to 0 again (#1763435)
  - cgroup: Check ancestor memory min for unified memory config (#1763435)
  - cgroup: Respect DefaultMemoryMin when setting memory.min (#1763435)
  - cgroup: Mark memory protections as explicitly set in transient units (#1763435)
  - meson: allow setting the version string during configuration (#1804252)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-36
changelog:
  - core: don't consider SERVICE_SKIP_CONDITION for abnormal or failure restarts (#1737283)
  - selinux: do preprocessor check only in selinux-access.c (#1830861)
  - basic/cgroup-util: introduce cg_get_keyed_attribute_full() (#1830861)
  - shared: add generic logic for waiting for a unit to enter some state (#1830861)
  - shared: fix assert call (#1830861)
  - shared: Don't try calling NULL callback in bus_wait_for_units_clear (#1830861)
  - shared: add NULL callback check in one more place (#1830861)
  - core: introduce support for cgroup freezer (#1830861)
  - core/cgroup: fix return value of unit_cgorup_freezer_action() (#1830861)
  - core: fix the return value in order to make sure we don't dipatch method return too early (#1830861)
  - test: add test for cgroup v2 freezer support (#1830861)
  - fix mis-merge (#1848421)
  - tests: sleep a bit and give kernel time to perform the action after manual freeze/thaw (#1848421)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-39
changelog:
  - device: make sure we emit PropertiesChanged signal once we set sysfs (#1793533)
  - device: don't emit PropetiesChanged needlessly (#1793533)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-40
changelog:
  - units: add generic boot-complete.target (#1872243)
  - man: document new "boot-complete.target" unit (#1872243)
  - core: make sure to restore the control command id, too (#1829867)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-42
changelog:
  - logind: don't print warning when user@.service template is masked (#1880270)
  - build: use simple project version in pkgconfig files (#1862714)
  - basic/virt: try the /proc/1/sched hack also for PID1 (#1868877)
  - seccomp: rework how the S[UG]ID filter is installed (#1860374)
  - vconsole-setup: downgrade log message when setting font fails on dummy console (#1889996)
  - units: fix systemd.special man page reference in system-update-cleanup.service (#1871827)
  - units: drop reference to sushell man page (#1871827)
  - sd-bus: break the loop in bus_ensure_running() if the bus is not connecting (#1885553)
  - core: add new API for enqueing a job with returning the transaction data (#846319)
  - systemctl: replace switch statement by table of structures (#846319)
  - systemctl: reindent table (#846319)
  - systemctl: Only wait when there's something to wait for. (#846319)
  - systemctl: clean up start_unit_one() error handling (#846319)
  - systemctl: split out extra args generation into helper function of its own (#846319)
  - systemctl: add new --show-transaction switch (#846319)
  - test: add some basic testing that "systemctl start -T" does something (#846319)
  - man: document the new systemctl --show-transaction option (#846319)
  - socket: New option 'FlushPending' (boolean) to flush socket before entering listening state (#1870638)
  - core: remove support for API bus "started outside our own logic" (#1764282)
  - mount-setup: fix segfault in mount_cgroup_controllers when using gcc9 compiler (#1868877)
  - dbus-execute: make transfer of CPUAffinity endian safe (#12711) (#1740657)
  - core: add support for setting CPUAffinity= to special "numa" value (#1740657)
  - basic/user-util: always use base 10 for user/group numbers (#1848373)
  - parse-util: sometimes it is useful to check if a string is a valid integer, but not actually parse it (#1848373)
  - basic/parse-util: add safe_atoux64() (#1848373)
  - parse-util: allow tweaking how to parse integers (#1848373)
  - parse-util: allow '-0' as alternative to '0' and '+0' (#1848373)
  - parse-util: make return parameter optional in safe_atou16_full() (#1848373)
  - parse-util: rewrite parse_mode() on top of safe_atou_full() (#1848373)
  - user-util: be stricter in parse_uid() (#1848373)
  - strv: add new macro STARTSWITH_SET() (#1848373)
  - parse-util: also parse integers prefixed with 0b and 0o (#1848373)
  - tests: beef up integer parsing tests (#1848373)
  - shared/user-util: add compat forms of user name checking functions (#1848373)
  - shared/user-util: emit a warning on names with dots (#1848373)
  - user-util: Allow names starting with a digit (#1848373)
  - shared/user-util: allow usernames with dots in specific fields (#1848373)
  - user-util: switch order of checks in valid_user_group_name_or_id_full() (#1848373)
  - user-util: rework how we validate user names (#1848373)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-43
changelog:
  - man: mention System Administrator's Guide in systemctl manpage (#1623116)
  - udev: introduce udev net_id "naming schemes" (#1827462)
  - meson: make net.naming-scheme= default configurable (#1827462)
  - man: describe naming schemes in a new man page (#1827462)
  - udev/net_id: parse _SUN ACPI index as a signed integer (#1827462)
  - udev/net_id: don't generate slot based names if multiple devices might claim the same slot (#1827462)
  - fix typo in ProtectSystem= option (#1871139)
  - remove references of non-existent man pages (#1876807)
  - log: Prefer logging to CLI unless JOURNAL_STREAM is set (#1865840)
  - locale-util: add new helper locale_is_installed() (#1755287)
  - test: add test case for locale_is_installed() (#1755287)
  - tree-wide: port various bits over to locale_is_installed() (#1755287)
  - install: allow instantiated units to be enabled via presets (#1812972)
  - install: small refactor to combine two function calls into one function (#1812972)
  - test: fix a memleak (#1812972)
  - docs: Add syntax for templated units to systemd.preset man page (#1812972)
  - shared/install: fix preset operations for non-service instantiated units (#1812972)
  - introduce setsockopt_int() helper (#1887181)
  - socket-util: add generic socket_pass_pktinfo() helper (#1887181)
  - core: add new PassPacketInfo= socket unit property (#1887181)
  - resolved: tweak cmsg calculation (#1887181)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-44
changelog:
  - ci: PowerTools repo was renamed to powertools in RHEL 8.3 (#1871827)
  - ci: use quay.io instead of Docker Hub to avoid rate limits (#1871827)
  - ci: move jobs from Travis CI to GH Actions (#1871827)
  - unit: make UNIT() cast function deal with NULL pointers (#1871827)
  - use link to RHEL-8 docs (#1623116)
  - cgroup: Also set blkio.bfq.weight (#1657810)
  - units: make sure initrd-cleanup.service terminates before switching to rootfs (#1657810)
  - core: reload SELinux label cache on daemon-reload (#1888912)
  - selinux: introduce mac_selinux_create_file_prepare_at() (#1888912)
  - selinux: add trigger for policy reload to refresh internal selabel cache (#1888912)
  - udev/net_id: give RHEL-8.4 naming scheme a name (#1827462)
  - basic/stat-util: make mtime check stricter and use entire timestamp (#1642728)
  - udev: make algorithm that selects highest priority devlink less susceptible to race conditions (#1642728)
  - test: create /dev/null in test-udev.pl (#1642728)
  - test: missing "die" (#1642728)
  - udev-test: remove a check for whether the test is run in a container (#1642728)
  - udev-test: skip the test only if it can't setup its environment (#1642728)
  - udev-test: fix test skip condition (#1642728)
  - udev-test: fix missing directory test/run (#1642728)
  - udev-test: check if permitted to create block device nodes (#1642728)
  - test-udev: add a testcase of too long line (#1642728)
  - test-udev: use proper semantics for too long line with continuation (#1642728)
  - test-udev: add more tests for line continuations and comments (#1642728)
  - test-udev: add more tests for line continuation (#1642728)
  - test-udev: fix alignment and drop unnecessary white spaces (#1642728)
  - test/udev-test.pl: cleanup if skipping test (#1642728)
  - test: add test cases for empty string match (#1642728)
  - test: add test case for multi matches when use "||" (#1642728)
  - udev-test: do not rely on "mail" group being defined (#1642728)
  - test/udev-test.pl: allow multiple devices per test (#1642728)
  - test/udev-test.pl: create rules only once (#1642728)
  - test/udev-test.pl: allow concurrent additions and removals (#1642728)
  - test/udev-test.pl: use computed devnode name (#1642728)
  - test/udev-test.pl: test correctness of symlink targets (#1642728)
  - test/udev-test.pl: allow checking multiple symlinks (#1642728)
  - test/udev-test.pl: fix wrong test descriptions (#1642728)
  - test/udev-test.pl: last_rule is unsupported (#1642728)
  - test/udev-test.pl: Make some tests a little harder (#1642728)
  - test/udev-test.pl: remove bogus rules from magic subsys test (#1642728)
  - test/udev-test.pl: merge "space and var with space" tests (#1642728)
  - test/udev-test.pl: merge import parent tests into one (#1642728)
  - test/udev-test.pl: count "good" results (#1642728)
  - tests/udev-test.pl: add multiple device test (#1642728)
  - test/udev-test.pl: add repeat count (#1642728)
  - test/udev-test.pl: generator for large list of block devices (#1642728)
  - test/udev-test.pl: suppress umount error message at startup (#1642728)
  - test/udev_test.pl: add "expected good" count (#1642728)
  - test/udev-test: gracefully exit when imports fail (#1642728)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-45
changelog:
  - Revert "test: add test cases for empty string match" and "test: add test case for multi matches when use ||" (#1935124)
  - test/sys-script.py: add missing DEVNAME entries to uevents (#1935124)
  - sd-event: split out helper functions for reshuffling prioqs (#1937315)
  - sd-event: split out enable and disable codepaths from sd_event_source_set_enabled() (#1937315)
  - sd-event: mention that two debug logged events are ignored (#1937315)
  - sd-event: split clock data allocation out of sd_event_add_time() (#1937315)
  - sd-event: split out code to add/remove timer event sources to earliest/latest prioq (#1937315)
  - sd-event: fix delays assert brain-o (#17790) (#1937315)
  - sd-event: let's suffix last_run/last_log with "_usec" (#1937315)
  - sd-event: refuse running default event loops in any other thread than the one they are default for (#1937315)
  - sd-event: ref event loop while in sd_event_prepare() ot sd_event_run() (#1937315)
  - sd-event: follow coding style with naming return parameter (#1937315)
  - sd-event: remove earliest_index/latest_index into common part of event source objects (#1937315)
  - sd-event: update state at the end in event_source_enable (#1937315)
  - sd-event: increase n_enabled_child_sources just once (#1937315)
  - sd-event: add ability to ratelimit event sources (#1937315)
  - test: add ratelimiting test (#1937315)
  - core: prevent excessive /proc/self/mountinfo parsing (#1937315)
  - udev: run link_update() with increased retry count in second invocation (#1935124)
  - pam-systemd: use secure_getenv() rather than getenv() (#1936866)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-46
changelog:
  - Revert "udev: run link_update() with increased retry count in second invocation" (#1942299)
  - Revert "udev: make algorithm that selects highest priority devlink less susceptible to race conditions" (#1942299)
  - test/udev-test.pl: drop test cases that add mutliple devices (#1942299)


author: Jan Macku <jamacku@redhat.com> - 239-47
changelog:
  - systemd-binfmt: Add safeguard in triggers (#1787144)
  - spec: Requires(post) openssl-libs to fix missing /etc/machine-id (#1947438)
  - spec: Go back to using systemctl preset-all in post (#1783263, #1647172, #1118740)
  - spec: Disable libiptc support (#1817265)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-48
changelog:
  - cgroup: Also set io.bfq.weight (#1927290)
  - seccomp: allow turning off of seccomp filtering via env var (#1916835)
  - meson: remove strange dep that causes meson to enter infinite loop (#1970860)
  - copy: handle copy_file_range() weirdness on procfs/sysfs (#1970860)
  - core: Hide "Deactivated successfully" message (#1954802)
  - util: rework in_initrd() to make use of path_is_temporary_fs() (#1959339)
  - initrd: extend SYSTEMD_IN_INITRD to accept non-ramfs rootfs (#1959339)
  - initrd: do a debug log if failed to detect rootfs type (#1959339)
  - initrd: do a debug log if /etc/initrd-release doesn't take effect (#1959339)
  - units: assign user-runtime-dir@.service to user-%i.slice (#1946453)
  - units: order user-runtime-dir@.service after systemd-user-sessions.service (#1946453)
  - units: make sure user-runtime-dir@.service is Type=oneshot (#1946453)
  - user-runtime-dir: downgrade a few log messages to LOG_DEBUG that we ignore (#1946453)
  - shared/install: Preserve escape characters for escaped unit names (#1952686)
  - basic/virt: Detect PowerVM hypervisor (#1937989)
  - man: document differences in clean exit status for Type=oneshot (#1940078)
  - busctl: add a timestamp to the output of the busctl monitor command (#1909214)
  - basic/cap-list: parse/print numerical capabilities (#1946943)
  - shared/mount-util: convert to libmount (#1885143)
  - mount-util: bind_remount: avoid calling statvfs (#1885143)
  - mount-util: use UMOUNT_NOFOLLOW in recursive umounter (#1885143)
  - test-install-root: create referenced targets (#1835351)
  - install: warn if WantedBy targets don't exist (#1835351)
  - test-install-root: add test for unknown WantedBy= target (#1835351)
  - ceph is a network filesystem (#1952013)
  - sysctl: set kernel.core_pipe_limit=16 (#1949729)
  - core: don't drop timer expired but not yet processed when system date is changed (#1899402)
  - core: Detect initial timer state from serialized data (#1899402)
  - rc-local: order after network-online.target (#1934028)
  - set core ulimit to 0 like on RHEL-7 (#1905582)
  - test-mountpointutil-util: do not assert in test_mnt_id() (#1910425)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-49
changelog:
  - remove a left-over break (#1970860)
  - basic/unit-name: do not use strdupa() on a path (#1974700)
  - sd-event: change ordering of pending/ratelimited events (#1968528)
  - sd-event: drop unnecessary "else" (#1968528)
  - sd-event: use CMP() macro (#1968528)
  - sd-event: use usec_add() (#1968528)
  - sd-event: make event_source_time_prioq_reshuffle() accept all event source type (#1968528)
  - sd-event: always reshuffle time prioq on changing online/offline state (#1968528)
  - ci: run unit tests on z-stream branches as well (#1970860)
  - ci: drop forgotten Travis references (#1934504)
  - ci: run unit tests on CentOS 8 Stream as well (#1934504)
  - ci: add missing test dependencies (#1934504)
  - meson: bump timeout for test-udev to 180s (#1934504)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-50
changelog:
  - Added option --check-inhibitors for non-tty usage (#1269726)
  - logind: Introduce RebootWithFlags and others (#1269726)
  - logind: add …WithFlags methods to policy (#1269726)
  - logind: simplify flags handling a bit (#1269726)
  - Update link to RHEL documentation (#1982584)
  - Set default core ulimit to 0, but keep the hard limit ulimited (#1905582)
  - shared/seccomp-util: address family filtering is broken on ppc (#1982650)
  - logind: rework Seat/Session/User object allocation and freeing a bit (#1642460)
  - logind: fix serialization/deserialization of user's "display session" (#1642460)
  - logind: turn of stdio locking when writing session files too (#1642460)
  - units: set StopWhenUnneeded= for the user slice units too (#1642460)
  - units: improve Description= string a bit (#1642460)
  - logind: improve logging in manager_connect_console() (#1642460)
  - logind: save/restore User object's "stopping" field during restarts (#1642460)
  - logind: correct bad clean-up path (#1642460)
  - logind: fix bad error propagation (#1642460)
  - logind: never elect a session that is stopping as display (#1642460)
  - logind: introduce little helper that checks whether a session is ready (#1642460)
  - logind: propagate session stop errors (#1642460)
  - logind: rework how we manage the slice and user-runtime-dir@.service unit for each user (#1642460)
  - logind: optionally, keep the user@.service instance for eached logged in user around for a while (#1642460)
  - logind: add a RequiresMountsFor= dependency from the session scope unit to the home directory of the user (#1642460)
  - logind: improve error propagation of user_check_linger_file() (#1642460)
  - logind: automatically GC lingering users for who now user@.service (nor slice, not runtime dir service) is running anymore (#1642460)
  - pam_systemd: simplify code which with we set environment variables (#1642460)
  - logind: validate /run/user/1000 before we set it (#1642460)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-53
changelog:
  - sd-hwdb: allow empty properties (#2005009)
  - Update hwdb (#2005009)
  - Disable libpitc to fix CentOS Stream CI (#2017033)
  - rpm: Fix typo in %_environmentdir (#2018024)
  - rpm: Add misspelled %_environmentdir macro for temporary compatibility (#2018024)
  - rpm: emit warning when macro with typo is used (#2018024)
  - Remove unintended additions to systemd-analyze man page (#2004765)
  - core: fix SIGABRT on empty exec command argv (#2020239)
  - core/service: also check path in exec commands (#2020239)
  - mount-util: fix fd_is_mount_point() when both the parent and directory are network fs (#2015057)
  - basic: add vmware hypervisor detection from device-tree (#1959150)
  - pam: do not require a non-expired password for user@.service (#1961746)
  - udev rules: add rule to create /dev/ptp_hyperv (#1991834)
  - process-util: explicitly handle processes lacking parents in get_process_ppid() (#1977569)
  - errno-util: add ERRNO_IS_PRIVILEGE() helper (#1977569)
  - procfs-util: fix confusion wrt. quantity limit and maximum value (#1977569)
  - test-process-util: also add EROFS to the list of "good" errors (#1977569)
  - journal: refresh cached credentials of stdout streams (#1931806)
  - util-lib: introduce HAS_FEATURE_ADDRESS_SANITIZER (#2017033)
  - ci: skip test-execute on GH Actions under ASan (#2017033)
  - test-seccomp: accept ENOSYS from sysctl(2) too (#2017033)
  - test: accept that char device 0/0 can now be created witout privileges (#2017033)
  - meson: do not fail if rsync is not installed with meson 0.57.2 (#2017033)
  - pid1: fix free of uninitialized pointer in unit_fail_if_noncanonical() (#1970945)
  - sd-event: take ref on event loop object before dispatching event sources (#1970945)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-54
changelog:
  - core: consider service with no start command immediately started (#1860899)
  - man: move description of *Action= modes to FailureAction=/SuccessAction= (#1860899)
  - core: define "exit" and "exit-force" actions for user units and only accept that (#1860899)
  - core: accept system mode emergency action specifiers with a warning (#1860899)
  - core: allow services with no commands but SuccessAction set (#1860899)
  - core: limit service-watchdogs=no to actual "watchdog" commands (#1860899)
  - units: use SuccessAction=exit-force in systemd-exit.service (#1860899)
  - units: use SuccessAction=reboot-force in systemd-reboot.service (#1860899)
  - units: use SuccessAction=poweroff-force in systemd-poweroff.service (#1860899)
  - units: allow and use SuccessAction=exit-force in system systemd-exit.service (#1860899)
  - core: do not "warn" about mundane emergency actions (#1860899)
  - core: return true from cg_is_empty* on ENOENT (#1860899)
  - macro: define HAS_FEATURE_ADDRESS_SANITIZER also on gcc (#2017033)
  - tests: add helper function to autodetect CI environments (#2017033)
  - strv: rework FOREACH_STRING() macro (#2017033)
  - test,systemctl: use "const char*" instead of "char*" (#2017033)
  - ci: pass the $GITHUB_ACTIONS variable to the CentOS container (#2017033)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-55
changelog:
  - lgtm: detect uninitialized variables using the __cleanup__ attribute (#2017033)
  - lgtm: replace the query used for looking for fgets with a more general query (#2017033)
  - lgtm: beef up list of dangerous/questionnable API calls not to make (#2017033)
  - lgtm: warn about strerror() use (#2017033)
  - lgtm: complain about accept() [people should use accept4() instead, due to O_CLOEXEC] (#2017033)
  - lgtm: don't treat the custom note as a list of tags (#2017033)
  - lgtm: ignore certain cleanup functions (#2017033)
  - lgtm: detect more possible problematic scenarios (#2017033)
  - lgtm: enable more (and potentially useful) queries (#2017033)
  - test: make TEST-47 less racy (#2017033)
  - core: rename unit_{start_limit|condition|assert}_test() to unit_test_xyz() (#2036608)
  - core: Check unit start rate limiting earlier (#2036608)
  - sd-event: introduce callback invoked when event source ratelimit expires (#2036608)
  - core: rename/generalize UNIT(u)->test_start_limit() hook (#2036608)
  - mount: make mount units start jobs not runnable if /p/s/mountinfo ratelimit is in effect (#2036608)
  - mount: retrigger run queue after ratelimit expired to run delayed mount start jobs (#2036608)
  - pid1: add a manager_trigger_run_queue() helper (#2036608)
  - unit: add jobs that were skipped because of ratelimit back to run_queue (#2036608)
  - Revert "Revert "sysctl: Enable ping(8) inside rootless Podman containers"" (#2037807)
  - sysctl: prefix ping port range setting with a dash (#2037807)
  - mount: don't propagate errors from mount_setup_unit() further up (#2036853)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-57
changelog:
  - udev/net_id: introduce naming scheme for RHEL-8.5 (#2039797)
  - udev/net_id: remove extraneous bracket (#2039797)
  - udev/net_id: introduce naming scheme for RHEL-8.6 (#2039797)
  - define newly needed constants (#2005008)
  - sd-netlink: support IFLA_PROP_LIST and IFLA_ALT_IFNAME attributes (#2005008)
  - sd-netlink: introduce sd_netlink_message_read_strv() (#2005008)
  - sd-netlink: introduce sd_netlink_message_append_strv() (#2005008)
  - test: add a test for sd_netlink_message_{append,read}_strv() (#2005008)
  - util: introduce ifname_valid_full() (#2005008)
  - rename function (#2005008)
  - udev: support AlternativeName= setting in .link file (#2005008)
  - network: make Name= in [Match] support alternative names of interfaces (#2005008)
  - udev: extend the length of ID_NET_NAME_XXX= to ALTIFNAMSIZ (#2005008)
  - udev: do not fail if kernel does not support alternative names (#2005008)
  - udev: introduce AlternativeNamesPolicy= setting (#2005008)
  - network: set AlternativeNamesPolicy= in 99-default.link (#2005008)
  - random-util: call initialize_srand() after fork() (#2005008)
  - sd-netlink: introduce rtnl_resolve_link_alternative_names() (#2005008)
  - udev: sort alternative names (#2005008)
  - netlink: introduce rtnl_get/delete_link_alternative_names() (#2005008)
  - netlink: do not fail when new interface name is already used as an alternative name (#2005008)
  - udev: do not try to reassign alternative names (#2005008)
  - Do not fail if the same alt. name is set again (#2005008)
  - mount: do not update exec deps on mountinfo changes (#2008825)
  - core/mount: add implicit unit dependencies even if when mount unit is generated from /proc/self/mountinfo (#2008825)
  - core: fix unfortunate typo in unit_is_unneeded() (#2040147)
  - core: make destructive transaction error a bit more useful (#2040147)
  - tmpfiles: use a entry in hashmap as ItemArray in read_config_file() (#1944468)
  - tmpfiles: rework condition check (#1944468)
  - TEST-22-TMPFILES: add reproducer for bug with X (#1944468)
  - core: make sure we don't get confused when setting TERM for a tty fd (#2045307)
  - hash-funcs: introduce macro to create typesafe hash_ops (#2037807)
  - hash-func: add destructors for key and value (#2037807)
  - util: define free_func_t (#2037807)
  - hash-funcs: make basic hash_ops typesafe (#2037807)
  - test: add tests for destructors of hashmap or set (#2037807)
  - man: document the new sysctl.d/ - prefix (#2037807)
  - sysctl: if options are prefixed with "-" ignore write errors (#2037807)
  - sysctl: fix segfault (#2037807)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-58
changelog:
  - ci: drop CentOS 8 CI (#2017033)
  - test: adapt to the new capsh format (#2017033)
  - test: ignore IAB capabilities in `test-execute` (#2017033)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-59
changelog:
  - core: disallow using '-.service' as a service name (#2051520)
  - shared/dropin: support -.service.d/ top level drop-in for service units (#2051520)
  - core: change top-level drop-in from -.service.d to service.d (#2051520)
  - shared/dropin: fix assert for invalid drop-in (#2051520)
  - udev: fix slot based network names on s390 (#1939914)
  - udev: it is not necessary that the path is readable (#1939914)
  - udev: allow onboard index up to 65535 (#1939914)
  - Revert "basic: use comma as separator in cpuset cgroup cpu ranges" (#1858220)
  - acpi-fpdt: mark structures as packed (#2047373)
  - core/slice: make slice_freezer_action() return 0 if freezing state is unchanged (#2047373)
  - core/unit: fix use-after-free (#2047373)
  - sd-bus: fix reference counter to be incremented (#2047373)
  - sd-bus: do not read unused value (#2047373)
  - sd-bus: do not return negative errno when unknown name is specified (#2047373)
  - sd-bus: switch to a manual overflow check in sd_bus_track_add_name() (#2047373)
  - spec: Add dependency on timedatex (#2066946)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-60
changelog:
  - unit: don't emit PropertiesChanged signal if adding a dependency to a unit is a no-op (#1948480)
  - tests: make inverted tests actually count (#2087152)
  - TEST-*: make failure tests actually fail on failure (#2087152)
  - ci(Mergify): configuration update (#2087152)
  - core: propagate triggered unit in more load states (#2065322)
  - core: propagate unit start limit hit state to triggering path unit (#2065322)
  - core: Move 'r' variable declaration to start of unit_start() (#2065322)
  - core: Delay start rate limit check when starting a unit (#2065322)
  - core: Propagate condition failed state to triggering units. (#2065322)
  - unit: check for mount rate limiting before checking active state (#2095744)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-61
changelog:
  - mkosi: Add gnutls package (#2101227)
  - unit-name: tighten checks for building valid unit names (#1940973)
  - core: shorten long unit names that are based on paths and append path hash at the end (#1940973)
  - test: add extended test for triggering mount rate limit (#1940973)
  - tests: add test case for long unit names (#1940973)
  - core: unset HOME=/ that the kernel gives us (#2056527)
  - journal-remote: check return value from MHD_add_response_header (#2051981)
  - journalctl: in --follow mode watch stdout for POLLHUP/POLLERR and exit (#2003236)
  - sd-bus: make BUS_DEFAULT_TIMEOUT configurable (#2039461)
  - fstab-generator: fix debug log (#2101433)
  - logind-session-dbus: allow to set display name via dbus (#1857969)
  - Allow restart for oneshot units (#2042896)
  - test: correct TEST-41 StartLimitBurst test (#2042896)
  - core: fix assert() about number of built environment variables (#2049788)
  - core: add one more assert() (#2049788)
  - strv: introduce strv_join_prefix() (#2049788)
  - test: add tests for strv_join_prefix() (#2049788)
  - test: replace swear words by 'hoge' (#2049788)
  - core: add new environment variable $RUNTIME_DIRECTORY= or friends (#2049788)
  - test-execute: add tests for $RUNTIME_DIRECTORY= or friends (#2049788)
  - man: document RUNTIME_DIRECTORY= or friends (#2049788)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-64
changelog:
  - ci: bump the worker Ubuntu version to Jammy (#2087152)
  - test: make test-execute pass on Linux 5.15 (#2087152)
  - ci: install iputils (#2087152)
  - ci(Mergify): Add `ci-waived` logic (#2087152)
  - sd-event: don't invalidate source type on disconnect (#2115396)
  - tests: make sure we delay running mount start jobs when /p/s/mountinfo is rate limited (#2095744)
  - core: drop references to 'StandardOutputFileToCreate' (#2093479)
  - dbus-execute: fix indentation (#2093479)
  - dbus-execute: generate the correct transient unit setting (#2093479)
  - bus-unit-util: properly accept StandardOutput=append:… settings (#2093479)
  - core: be more careful when inheriting stdout fds to stderr (#2093479)
  - test: add a test for StandardError=file:… (#2093479)
  - tree-wide: allow ASCII fallback for → in logs (#2093479)
  - tree-wide: allow ASCII fallback for … in logs (#2093479)
  - core: allow to set default timeout for devices (#1967245)
  - man: document DefaultDeviceTimeoutSec= (#1967245)
  - Revert "core: Propagate condition failed state to triggering units." (#2114005)
  - core: Check unit start rate limiting earlier (#2114005)
  - core: Add trigger limit for path units (#2114005)
  - meson: add syscall-names-update target (#2040247)
  - syscall-names: add process_madvise which is planned for 5.10 (#2040247)
  - shared: add @known syscall list (#2040247)
  - generate-syscall-list: require python3 (#2040247)
  - shared/seccomp: reduce scope of indexing variables (#2040247)
  - shared/syscall-list: filter out some obviously platform-specific syscalls (#2040247)
  - seccomp: tighten checking of seccomp filter creation (#2040247)
  - shared/seccomp-util: added functionality to make list of filtred syscalls (#2040247)
  - nspawn: return ENOSYS by default, EPERM for "known" calls (#2040247)
  - revert: resolved: pin stream while calling callbacks for it (#2110549)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-66
changelog:
  - Try stopping MD RAID devices in shutdown too (#1817706)
  - shutdown: get only active md arrays. (#1817706)
  - scope: allow unprivileged delegation on scopes (#2068575)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-67
changelog:
  - resolved: pin stream while calling callbacks for it (#2110549)
  - ci(functions): Add `useradd` and `userdel` (#2110549)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-69
changelog:
  - logind: optionally watch utmp for login data (#2122288)
  - logind: add hashtable for finding session by leader PID (#2122288)
  - core/load-fragment: move config_parse_sec_fix_0 to src/shared (#2122288)
  - sd-event: add relative timer calls (#2122288)
  - logind: add option to stop idle sessions after specified timeout (#2122288)
  - logind: schedule idle check full interval from now if we couldn't figure out atime timestamp (#2122288)
  - ci(lint): add shell linter - Differential ShellCheck (#2122499)
  - meson: do not compare objects of different types (#2122499)
  - journal-remote: use MHD_HTTP_CONTENT_TOO_LARGE as MHD_HTTP_PAYLOAD_TOO_LARGE is deprecated since 0.9.74 (#2122499)
  - Fix build with µhttpd 0.9.71 (#2122499)
  - ci: replace LGTM with CodeQL (#2122499)
  - ci(mergify): Update policy - Drop LGTM checks (#2122499)
  - time-util: fix buffer-over-run (#2139391)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-70
changelog:
  - basic: recognize pdfs filesystem as a network filesystem (#2094661)
  - core: move reset_arguments() to the end of main's finish (#2127131)
  - manager: move inc. of n_reloading into a function (#2136869)
  - core: Add new DBUS properties UnitsReloadStartTimestamp and UnitsLoadTimestampMontonic (#2136869)
  - core: Indicate the time when the manager started loading units the last time (#2136869)
  - core: do not touch /run/systemd/systemd-units-load from user session instances (#2136869)
  - sysctl: downgrade message when we have no permission (#2158160)
  - core: respect SELinuxContext= for socket creation (#2136738)
  - manager: use target process context to set socket context (#2136738)
  - virt: detect Amazon EC2 Nitro instance (#2117948)
  - machine-id-setup: generate machine-id from DMI product ID on Amazon EC2 (#2117948)
  - virt: use string table to detect VM or container (#2117948)
  - fileio: introduce read_full_virtual_file() for reading virtual files in sysfs, procfs (#2117948)
  - Use BIOS characteristics to distinguish EC2 bare-metal from VMs (#2117948)
  - device: drop refuse_after (#2043524)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-71
changelog:
  - manager: limit access to private dbus socket (#2119405)
  - journalctl: do not treat EINTR as an error when waiting for events (#2161683)
  - core: bring manager_startup() and manager_reload() more inline (#2059633)
  - pam: add a call to pam_namespace (#1861836)
  - virt: Support detection for ARM64 Hyper-V guests (#2158307)
  - virt: Fix the detection for Hyper-V VMs (#2158307)
  - basic: add STRERROR() wrapper for strerror_r() (#2155520)
  - coredump: put context array into a struct (#2155520)
  - coredump: do not allow user to access coredumps with changed uid/gid/capabilities (#2155520)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-72
changelog:
  - test: import logind test from debian/ubuntu test suite (#1866955)
  - test: introduce inst_recursive() helper function (#1866955)
  - tests: verify that Lock D-Bus signal is sent when IdleAction=lock (#1866955)
  - systemctl: simplify halt_main() (#2053273)
  - systemctl: shutdown don't fallback on auth fail (#2053273)
  - systemctl: reintroduce the original halt_main() (#2053273)
  - systemctl: preserve old behavior unless requested (#2053273)
  - pam_systemd: suppress LOG_DEBUG log messages if debugging is off (#2170084)
  - udev/net_id: introduce naming scheme for RHEL-8.8 (#2170499)
  - pam: add a call to pam_namespace (#1861836)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-73
changelog:
  - journald: add API to move logging from /var to /run again (#1873540)
  - journalctl: add new --relinquish and --smart-relinquish options (#1873540)
  - units: automatically revert to /run logging on shutdown if necessary (#1873540)
  - pstore: Tool to archive contents of pstore (#2158832)
  - meson: drop redundant line (#2158832)
  - pstore: drop unnecessary initializations (#2158832)
  - pstopre: fix return value of list_files() (#2158832)
  - pstore: remove temporary file on failure (#2158832)
  - pstore: do not add FILE= journal entry if content_size == 0 (#2158832)
  - pstore: run only when /sys/fs/pstore is not empty (#2158832)
  - pstore: fix use after free (#2158832)
  - pstore: refuse to run if arguments are specified (#2158832)
  - pstore: allow specifying src and dst dirs are arguments (#2158832)
  - pstore: rework memory handling for dmesg (#2158832)
  - pstore: fixes for dmesg.txt reconstruction (#2158832)
  - pstore: Don't start systemd-pstore.service in containers (#2158832)
  - units: pull in systemd-pstore.service from sysinit.target (#2158832)
  - units: drop dependency on systemd-remount-fs.service from systemd-pstore.service (#2158832)
  - units: make sure systemd-pstore stops at shutdown (#2158832)
  - pstore: Run after modules are loaded (#2158832)
  - pstore: do not try to load all known pstore modules (#2158832)
  - logind-session: make stopping of idle session visible to admins (#2156780)
  - journald: Increase stdout buffer size sooner, when almost full (#2029426)
  - journald: rework end of line marker handling to use a field table (#2029426)
  - journald: use the fact that client_context_release() returns NULL (#2029426)
  - journald: rework pid change handling (#2029426)
  - test: Add a test case for #15654 (#2029426)
  - test: Stricter test case for #15654 (Add more checks) (#2029426)
  - man: document the new _LINE_BREAK= type (#2029426)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-74
changelog:
  - journald-server: always create state file in signal handler (#2174645)
  - journald-server: move relinquish code into function (#2174645)
  - journald-server: always touch state file in signal handler (#2174645)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-75
changelog:
  - journald-server: always create state file in signal handler (#2176892)
  - journald-server: move relinquish code into function (#2176892)
  - journald-server: always touch state file in signal handler (#2176892)
  - test: make TEST-35-LOGIN stable again (#2179309)
  - pager: set $LESSSECURE whenver we invoke a pager (#2175624)
  - test-login: always test sd_pid_get_owner_uid(), modernize (#2175624)
  - pager: make pager secure when under euid is changed or explicitly requested (#2175624)
  - ci: trigger differential-shellcheck workflow on push (#2179309)
  - ci: codeql `master` -> `main` (#2179309)
  - test: ignore ENOMEDIUM error from sd_pid_get_cgroup() (#2175622)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-76
changelog:
  - ci(Mergify): drop requirements on linting workflows (#2179309)
  - ci: workflow for gathering metadata for source-git automation (#2179309)
  - ci: first part of the source-git automation - commit linter (#2179309)
  - pstore: fix crash and forward dummy arguments instead of NULL (#2190151)
  - test: Disable LUKS devices from initramfs in QEMU tests (#2190151)
  - pstore: explicitly set the base when converting record ID (#2190151)
  - pstore: avoid opening the dmesg.txt file if not requested (#2190151)
  - test: add a couple of tests for systemd-pstore (#2190151)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-82.5
changelog:
  - man: be even clearer that tmpfiles user/group/mode are applied on existing inodes (RHEL-77145)
  - Revert "man: fix description of --force in halt(8) (#7392)" (RHEL-81056)
  - man: explicitly document that "reboot -f" is different from "systemctl reboot -f" (RHEL-81056)


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - Fiddle bindir/libexecdir to get RH install correct.
  - Don't include /sbin/rmt -- use the rmt from dump.
  - Turn on nls.


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - update to tar-1.12.64013.
  - subtract (and reopen #2415) bzip2 support using -y.
  - move gtar to /bin.


author: Bernhard Rosenkränzer <bero@redhat.com>
changelog:
  - 1.13.14
  - Update man page to know about -I / --bzip
  - Remove dependancy on rmt - tar can be used for anything local
    without it.


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - fix hang on tar tvzf - <something.tar.gz, introduced by
    exit code fix (Bug #15448), Patch from Tim Waugh <twaugh@redhat.com>


author: Bernhard Rosenkraenzer <bero@redhat.com> 1.13.19-5
changelog:
  - Fix build with current autoconf (stricter checking on AC_DEFINE)
  - Fix segfault when tarring directories without having read permissions
    (#40802)


author: Peter Vrabec <pvrabec@redhat.com> 1.15.1-5
changelog:
  - extract sparse files even if the output fd is not seekable.(#154882)
  - (sparse_scan_file): Bugfix. offset had incorrect type.


author: Peter Vrabec <pvrabec@redhat.com> 1.15.1-12
changelog:
  - fix extracting sparse files to a filesystem like vfat,
    when ftruncate may fail to grow the size of a file.(#179507)


author: Peter Vrabec <pvrabec@redhat.com> 1.15.90-4
changelog:
  - fix problem with unpacking archives in a directory for which
    one has write permission but does not own (such as /tmp) (#149686)


author: Radek Brich <rbrich@redhat.com> 2:1.17-1
changelog:
  - new upstream version
  - patch for wildcards (#206841), restoring old behavior
  - patch for testsuite
  - update -xattrs patch
  - drop 13 obsolete patches


author: Radek Brich <rbrich@redhat.com> 2:1.17-5
changelog:
  - fix (non)detection of xattrs
  - move configure stuff from -xattrs patch to -xattrs-conf,
    so the original patch could be easily read
  - fix -xattrs patch to work with zero length files and show
    warnings when xattrs not available (fixes by James Antill)
  - possible corruption (#408621) - add warning to man page
    for now, may be actually fixed later, depending on upstream


author: Radek Brich <rbrich@redhat.com> 2:1.19-2
changelog:
  - fix errors in man page
    * fix definition of --occurrence (bz#416661, patch by Jonathan Wakely)
    * update meaning of -l: it has changed from --one-filesystem
      to --check-links (bz#426717)
  - update license tag, tar 1.19 is GPLv3+


author: Radek Brich <rbrich@redhat.com> 2:1.19-3
changelog:
  - do not print getfilecon/setfilecon warnings when SELinux is disabled
    or SELinux data are not available (bz#431879)
  - fix for GCC 4.3


author: Ondrej Vasik <ovasik@redhat.com> 2:1.20-1
changelog:
  - new upstream release 1.20 (lzma support, few new options
    and bugfixes)
  - heavily modified xattrs patches(as tar-1.20 now uses automake
    1.10.1)


author: Ondrej Vasik <ovasik@redhat.com> 2:1.20-3
changelog:
  - Fixed wrong documentation for xattrs options (#466517)
  - fixed bug with null file terminator and change dirs
    (upstream)


author: Ondrej Vasik <ovasik@redhat.com> 2:1.21-1
changelog:
  - New upstream release 1.21, removed applied patches
  - add support for -I option, fix testsuite failure


author: Ondrej Vasik <ovasik@redhat.com> 2:1.22-4
changelog:
  - Report record size only if the archive refers to a device
    (#487760)
  - Do not sigabrt with new gcc/glibc because of writing to
    struct members of gnutar header at once via strcpy


author: Ondrej Vasik <ovasik@redhat.com> 2:1.22-10
changelog:
  - store xattrs for symlinks (#525992) - by Kamil Dudka
  - update tar(1) manpage (#539787)
  - fix memory leak in xheader (#518079)


author: Ondrej Vasik <ovasik@redhat.com> 2:1.22-11
changelog:
  - fix segfault with corrupted metadata in code_ns_fraction
    (#531441)
  - commented patches and sources


author: Ondrej Vasik <ovasik@redhat.com> 2:1.22-12
changelog:
  - do not fail with POSIX 2008 glibc futimens() (#552320)
  - temporarily disable fix for #531441, causing stack smashing
    with newer glibc(#551206)


author: Ondrej Vasik <ovasik@redhat.com> 2:1.22-17
changelog:
  - CVE-2010-0624 tar, cpio: Heap-based buffer overflow
    by expanding a specially-crafted archive (#572149)
  - realloc within check_exclusion_tags() caused invalid write
    (#570591)
  - not closing file descriptors for excluded files/dirs with
    exlude-tag... options could cause descriptor exhaustion
    (#570591)


author: Kamil Dudka <kdudka@redhat.com> 2:1.23-6
changelog:
  - fix exclusion of long file names with --xattrs (#634866)
  - do not crash with --listed-incremental (#635318)


author: Ondrej Vasik <ovasik@redhat.com> 2:1.25-4
changelog:
  - mention that some compression options might not work if
    the external program is not available(#666755)


author: Pavel Raiskup <praiskup@redhat.com> 2:1.26-5
changelog:
  - fix for bad cooperation of the '-C' (change directory) and '-u' (update
    package) options (#688567)


author: Ondrej Vasik <ovasik@redhat.com> 2:1.26-7
changelog:
  - store&restore security.capability extended attributes category
    (#771927)
  - fix build failure with undefined gets


author: Pavel Raiskup <praiskup@redhat.com> 2:1.26-10
changelog:
  - prepare Gnulib for new xattrs (#850291)
  - new version of RH xattrs patch (#850291)
  - enable verbose mode in testsuite to allow better debugging on error


author: Pavel Raiskup <praiskup@redhat.com> 2:1.26-12
changelog:
  - repair the xattr-gnulib-prepare patch to allow build tar without SELinux
    support
  - fedora-review compliance -> remove trailing white-spaces, remove macro from
    comment, remove BR of gawk;coreutils;gzip that should be covered automatically
    by minimum build environment, do not `rm -rf' buildroot at the beginning of
    install phase (needed only in EPEL), remove BuildRoot definition, remove
    defattr macro, s/define/global/
  - do not use ${VAR} syntax for bash variables, use just $VAR


author: Pavel Raiskup <praiskup@redhat.com> 2:1.26-13
changelog:
  - fix badly written macro for building --without-selinux
  - allow to build tar in difference CoverityScan by forcing the '.gets' patch to
    be applied even in the run without patches


author: Pavel Raiskup <praiskup@redhat.com> - 2:1.26-16
changelog:
  - make the info documentation more visible in manpage (#903666)
  - sync tar.1 manpage with actual --help output (e.g. added --skip-old-files)
  - add the last_help2man_run file to git repo to allow more easily find changes
    in --help in future
  - make the DEFAULTS section to be more visible in man page
  - verbose 'make check' only when some fail happened (append to koji build.log)


author: Pavel Raiskup <praiskup@redhat.com> - 2:1.26-17
changelog:
  - add possibility to 'rpmbuild' without %check phase
  - make the autoreconf phase verbose
  - re-create older patches (avoid offset warnings during patching)
  - remove patches which we don't need now (xattrs - will be updated, sigpipe -
    test should work now, partial revert of *at() conversion was done because of
    incompatible xattr patch)
  - add upstream up2date xattr patch


author: Pavel Raiskup <praiskup@redhat.com> - 2:1.26-19
changelog:
  - fix creating sparse pax archives containing files of effective
    size >8GB (#516309)
  - silence rpmlint (fix bad dates in changelog based on git log dates)


author: Pavel Raiskup <praiskup@redhat.com> - 2:1.26-21
changelog:
  - allow extracting single volume from multi-volume archive (#919897)
  - usrmove: /bin/tar ~> /usr/bin/tar, selinux handling edit
  - add possibility to pass arguments to commands called from tar (#819187)


author: Pavel Raiskup <praiskup@redhat.com> - 2:1.26-22
changelog:
  - enable build for arm64 (#926610)
  - fix the NAME part in manual page (copied from texinfo)
  - silence gcc warnings (lint fixes without risk from upstream) for RPMDiff


author: Pavel Raiskup <praiskup@redhat.com> - 2:1.26-24
changelog:
  - use /usr/bin/ssh as the default remote shell binary (#969015)
  - do not verbose-print xattrs when --no-xattrs option is used
  - do not override the config.{guess,sub} twice, this is already done by the
    redhat-rpm-config package (#951442)


author: Pavel Raiskup <praiskup@redhat.com> - 1.26-26
changelog:
  - the /etc/rmt seems to be the best place where to look for rmt binary (see the
    commit message in Fedora's cpio.git for more info)


author: Pavel Raiskup <praiskup@redhat.com> - 1.26-28
changelog:
  - add documenation for xattrs-like options (#996753)
  - the --xattrs-include implies --xattrs now (#965969)


author: Pavel Raiskup <praiskup@redhat.com> - 1.27.1-3
changelog:
  - document --exclude mistakes (#903666)
  - fix default ACLs propagation (#1082603)
  - infinite loop(s) in sparse-file handling (#1082608)
  - fix listing (and --verify) for big sparse files (#916995)
  - fix eternal loop in -T option (#1083066)
  - don't read/write archive from/to terminal (#1083075)


author: Pavel Raiskup <praiskup@redhat.com> - 1.28-1
changelog:
  - rebase to new upstream tarball, per release notes:
    https://savannah.gnu.org/forum/forum.php?forum_id=8037


author: Pavel Raiskup <praiskup@redhat.com> - 1.28-6
changelog:
  - fix --files-from and -T cooperation (rhbz#1230762)
  - avoid two testsuite false alarms related to --files-from option


author: Pavel Raiskup <praiskup@redhat.com> - 1.29-3
changelog:
  - revert back some docs
  - fix --create to use --xattrs-include/exclude (rhbz#1341787)
  - don't hang with '-x --skip-old-files --xattrs' (rhbz#1399036)


author: Pavel Raiskup <praiskup@redhat.com> - 1.30-1
changelog:
  - rebase to latest upstream release, per release notes
    http://lists.gnu.org/archive/html/info-gnu/2017-12/msg00011.html


author: Ondrej Dubaj <odubaj@redhat.com> - 1.30-6
changelog:
  - added "padding with zeros" info message (#1913566)
  - do not report disk error as file shrank (#1913569)


author: Pavel Cahyna <pcahyna@redhat.com> - 2:1.30-10
changelog:
  - Warn “file changed as we read it” less often
  - Add downstream patch to fix related failure in filerem01 test


author: Pavel Cahyna <pcahyna@redhat.com> - 2:1.30-11
changelog:
  - Backport fix for regression in the --no-overwrite-dir option fix (1.30-7)
    Upstream commit 4e742fc8674064a9fa00d4483d06aca48d5b0463, discussed
    in https://www.mail-archive.com/bug-tar@gnu.org/msg06445.html


author: Tony Camuso <tcamuso@redhat.com> - 1:1.9.12-1
changelog:
  - Add patch to revert "Disable GCC9 address-of-packed-member warning"
    While it was able to build locally with 'rhpkg local', the brew
    build failed, because the compiler on the brew systems did not
    recognized the new GCC9 command line flag:
    -Wno-address-of-packed-member


author: Tony Camuso <tcamuso@redhat.com> - 1:1.9.12-2
changelog:
  - Fix build issues with one upstream patch.
    This patch also reverts the previous patch concerning the
    -Wno-address-of-packed-member cflag.
    Resolves: rhbz#1847938


author: Tony Camuso <tcamuso@redhat.com> - 1:1.10.0-0
changelog:
  Upgrade to latest upstream version
    Added upstream patch to remove deprecated man pages
    Resolves: rhbz#1857068


author: Tony Camuso <tcamuso@redhat.com> - 1:1.10.0-1
changelog:
  Build problem creating directory for grub modules. We can't
    know if the modules are there, so it's up to the end user to
    find the modules and copy them to the correct location.
    Specifically, for systems booting from EFI, the
    /boot/efi/EFI/redhat/x86_64-efi/multiboot2.mod file, if it
    exists, must be copied to the /boot/efi/EFI/redhat/x86_64-efi/
    directory. If that file does not exist, then the system has
    the wrong version of grub for using tboot in an EFI system.
    Resolves: rhbz#1857068


author: Tony Camuso <tcamuso@redhat.com> - 1:1.10.0-1
changelog:
  Need to add BuildRequires: perl, since it has beem moved
    from BuildRoot.
    See: https://fedoraproject.org/wiki/Packaging:Perl#Build_Dependencies
    Resolves: rhbz#1857068


author: Tony Camuso <tcamuso@redhat.com> - 1:1.10.1-1
changelog:
  Upgrade to tboot-1.10.2-1 provides some bug fixes and updates.
    Remove 0001-Do-not-install-man-pages-for-deprecated-tools.patch
    from the git repo, since it is no longer needed.
    Resolves: rhbz#1857068
    Resolves: rhbz#1873296
    Resolves: rhbz#1920386


author: Tony Camuso <tcamuso@redhat.com> - 1:1.10.5-1
changelog:
  Upgrade to tboot-1.10.5-1 for fixes and updates.
    Added a scriptlet to the tboot.spec file to automatically install
    grub2-efi-x64-modules and move them to the correct directory.
    Resolves: rhbz#2040082
    Resolves: rhbz#2041759


author: Tony Camuso <tcamuso@redhat.com> - 1:1.10.5-2
changelog:
  - The install scriptlet in %post was not choosing the correct
    grubenv directory. In RHEL8, the efi and legacy bios grubenv
    directories are different. This change assures that the
    correct directory is used for grub.cfg and related modules.
    Added a %postun section to cleanup when removing tboot with
    dnf erase.
    Resolves: rhbz#2121836


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1:8.6.6-2
changelog:
  - Splitted documentation to the doc subpackage
    Resolves: rhbz#1380291
  - Fixed whitespace
  - Dropped obsoleted defattr


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1:8.6.8-2
changelog:
  - Reverted _module_build macro check which fixes systemtap probes on RHEL-8
    Resolves: rhbz#1579386


author: Petr Pisar <ppisar@redhat.com> - 1.8-1
changelog:
  - 1.8 bump
  - License changed from GPLv2+ to (GPLv3+ and GFDL)
  - Disable printing command failure in POSIX mode


author: Filipe Rosset <rosset.filipe@gmail.com> - 2.5-4
changelog:
  - Fixes rhbz #1476851 tmux bell-action other not working
  - Fixes rhbz #1476892 tmux update in F26 broke tmuxinator


author: Michal Schmidt <mschmidt@redhat.com> - 1.3.9-1
changelog:
  - Upstream release 1.3.9.
  - Add fixes for build errors with OpenSSL 1.1.
  - Add fixes for NULL cipher context use in seal/unseal.
  - spec file modernization.


author: Jerry Snitselaar <jsnitsel@redhat.com> - 4.1.1-2
changelog:
  - Fix ESYS_TR hierarchy transition.
  - Refactor fix_esys_hierarchies to return actual TSS2_RC return code.
  - tpm2_alg_util.c: fix a bug where the string rsa3072 wasn't being parsed.
  - tpm2_create.c: Fix an issue where userwithauth attr cleared if policy specified.
  - tpm2_hierarchycontrol: Fix bug where hierarchycontrol operation failed silently.
  - tpm2_nvdefine.c: Fix error reporting message.
  - tpm2_policyor: Fix silent failure for invalid/unspecified policy digest alg.
  resolves: rhbz#1854774


author: Jerry Snitselaar <jsnitsel@redhat.com> - 4.1.1-3
changelog:
  - Fix resource leak.
  - Fix to restrict policy digest size.
  - Fix incompatible pointer cast.
  - Fix error message in files_load_##name
  - Fix issue where execution couldn't reach function return.
  resolves: rhbz#1920821


author: chench <chench@hygon.cn> -4.1.1-5.0.2
changelog:
  - Add gm support for all commands.
  - Add the gm API for tools library.
  - Add commands line arguments to support gm in some commands


author: chench <chench@hygon.cn> -4.1.1-5.0.3
changelog:
  - Add gm test case for all commands.
  - This patch tests all commands for gm support. Every script test a class of commands


author: Jerry Snitselaar <jsnitsel@redhat.com> - 2.3.2-3
changelog:
  - Add tss user if doesn't exist.
  - Update exported symbols map for libtss2-mu
  - esys: Check object handle node before calling compute_session_value
  - esys: fix resource name calculation
  - esys: fix Esys_StartAuthSession called with optional params
  - esys: fix keysize of ECC curve TPM2_ECC_NISTP224
  - esys: fixup compute_encrypted_salt error handling
  - esys: use memcmp in byte array comparison
  - esys: zero out ctx->salt after startAuthSession_finish
  - mu: Remove use of VLAs for Marshalling TPML types
  - return proper error code on memory allocation failure
  - sys: match counter variable type for cmdAuthsArray->count
  - tcti-device: getPollHandles should allow num_handles query
  - tctildr: fix segmentation fault if name_conf is too big
  resolves: rhbz#1879071 rhbz#1855180


author: Jerry Snitselaar <jsnitsel@redhat.com> - 2.3.2-4
changelog:
  - Fix hmac calculation for tpm2_clear command.
  - Remove private implementation of strndup.
  resolves: rhbz#1920825 rhbz#1940861


author: Hangbo Fan <fanhangbo.fhb@alibaba-inc.com> - 2.3.2-6.0.1
changelog:
  - Add doc sub package
  - Add gm support. (chench@hygon.cn)
  - adds SM2,SM3,SM4 support for esapi. (chench@hygon.cn)


author: Sun Yunying <yunying.sun@intel.com> - 1.0-2
changelog:
  - Remove global macro pkg_version to avoid duplicate of version
  - Use ExclusiveArch instead of ExcludeArch
  - Use less wildcard in %files section to be more specific
  - Add trailing slash at end of added directory in %file section
  - Remove autoconf/automake/pkgconfig(cmocka) from BuildRequires
  - Increase release version to 2


author: Javier Martinez Canillas <javierm@redhat.com> - 1.2.0-1
changelog:
  - Update to 1.2.0 release
  - Use tpm2-tss instead of TPM2.0-TSS as prefix since project name changed
  - Fix SPEC file access mode
  - Include new man pages in %files directive


author: Javier Martinez Canillas <javierm@redhat.com> - 1.3.0-0.1.rc2
changelog:
  - Update to 1.3.0 release candidate 2 (RHBZ#1508870)
  - Remove global pkg_prefix since now the upstream repo and package names match
  - Update URLs to point to the new project location
  - Remove -Wno-int-in-bool-context compiler flag since now upstream takes care
  - Remove %doc directive since README.md and CHANGELOG.md are not in the tarball
  - Add patch to include a LICENSE since the generated tarball does not have it


author: Javier Martinez Canillas <javierm@redhat.com> - 1.4.0-1
changelog:
  - Update URLs to point to the new project location
  - Add README.md CHANGELOG.md to %files directive
  - Update to 1.4.0 release (RHBZ#1508870)


author: Yunying Sun <yunying.sun@intel.com> - 2.0.0-1
changelog:
  - Update to 2.0.0 release (RHBZ#1508870)
  - Remove patch file 60-tpm-udev.rules, use upstream tpm-udev.rules instead
  - Disable ESAPI to fix build errors caused by dependency to libgcrypt 1.6.0
  - Add scriptlet to fix Rpath errors
  - Update file installation paths and names accordingly


author: Yunying Sun <yunying.sun@intel.com> - 2.0.0-2
changelog:
  - Re-enable ESAPI since gcrypt dependency is not an issue for Fedora
  - Bump release version to 2.0.0-2


author: John Kacur <jkacur@redhat.com> - 2.7-8
changelog:
  - Install kernelshark manpage with kernelshark subpackage, not with trace-cmd
  Resolves: rhbz#1678252


author: Preston Brown <pbrown@redhat.com>
changelog:
  - bugfix for segfault with source routing (#13466)
  - fix bug tracerouting thru aliased ethernet addresses (#9351)


author: Phil Knirsch <pknirsch@redhat.com> 1.4a12-20
changelog:
  - Added patch from Jesper Skriver supplied by Kaj J. Niemi to support
    draft-ietf-mpls-icmp-02.txt.


author: Xose Vazquez Perez <xose.vazquez@gmail.com> 1.0.3-2
changelog:
  - license is GPL
  - remove S_ISUID from /bin/traceroute
  - description of this implementation
  - s/$RPM_BUILD_ROOT/%{buildroot}
  - man page needs 0644
  - link it agains relative paths, it works over NFS


author: Robert Scheck <redhat@linuxnetz.de> 1.0.3-3
changelog:
  - enable working IPv6 support in traceroute
  - removed old compatibility links, nothing has SUID/SGID
  - added some documentation files
  - don't expand rpm macros in %changelog


author: Martin Bacovsky <mbacovsk@redhat.com> - 2.0.3-1.fc7
changelog:
  - Resolves: #222577 - man page with execute bit
  - Resolves: #223784 - new traceroute breaks scripts
  - Resolves: #223795 - /bin/tcptraceroute symlink occludes alternate tcptraceroute package


author: Martin Bacovsky <mbacovsk@redhat.com> - 3:2.0.7-1
changelog:
  - upgrade to new upstream traceroute-2.0.7
  - resolves: #249958: traceroute: useless debuginfo package


author: Martin Bacovsky <mbacovsk@redhat.com> - 3:2.0.8-1
changelog:
  - upgrade to new upstream traceroute-2.0.8
  - fixed traceroute.8 install source path and traceroute6.8 link source
  - fixed typo in Source0 URL


author: Dmitry Butskoy <Dmitry@Butskoy.name> - 3:2.0.12-1
changelog:
  - update to 2.0.12 (fixes #461278 and #461626)
  - this release adds support for icmp extensions (including MPLS),
    which was expected for a long time (#176588)
  - drop "tracert" symlink (#461109)


author: Kamil Dudka <kdudka@redhat.com> - 1.7.0-11
changelog:
  - do not escape UTF-8 chars in file names by default in UTF-8 locale (#1480778)
  - modernize spec file (Group, BuildRoot, autosetup, clean, defattr)


author: Jerry Snitselaar <jsnitsel@redhat.com> - 0.3.15-1
changelog:
  - Rebase to 0.3.15
  - Fix CVE-2020-24330 CVE-2020-24331 CVE-2020-24332
  resolves: rhbz#1725782 rhbz#1877517 rhbz#1882402 rhbz#1882414


author: Merlin Mathesius <mmathesi@redhat.com> - 1027-1
changelog:
  - Version bump. Now supported for all architectures.
  - Generate man pages since they are no longer included in source archive.


author: Jerry Snitselaar <jsnitsel@redhat.com> - 1234-5
changelog:
  - Move header files to ibmtss directory.
  - Check return value of TSS_Hash_Generate.
  resolves: rhbz#1636245


author: John Kacur <jkacur@redhat.com> - 0.18-8
changelog:
  - Remove deprecated distutils from setup
  - Adjust SPDX patch to accomdate the removed distutils
  Resolves: RHEL-19037


author: John Kacur <jkacur@redhat.com> - 0.18-9
changelog:
  - Don't start the gui if a display is not available
  - Revert removing distutils for rhel8
  - Update the License tag in the specfile to the spdx version
  Resolves: RHEL-19179


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.22.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-17119
    - print all arguments of failing commands in error messages
    - plugin_sysctl: added support for sysctl names with slash
    - tuned-adm: added support for moving devices between plugin instances
    - api: added methods for retrieval of plugin instances and devices
    - plugin_cpu: amd-pstate mentioned instead of just intel_pstate
    - hotplug: do not report ENOENT errors on device remove
    - plugin_sysctl: expand variables when reporting overrides
    - plugin_acpi: new plugin which handles ACPI platform_profile
    - plugin_bootloader: skip calling rpm-ostree kargs in no-op case
    - plugin_cpu: support cstate settings of pm_qos_resume_latency_us
    - scheduler: add option for ignoring IRQs affinity
    - plugin_intel_uncore: new plugin for uncore setting


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.22.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-17119
    - lower CPU usage by using runtime=0 in profiles using scheduler plugin
      resolves: RHEL-6869


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.22.1-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-17119
    - renamed intel_uncore plugin to uncore
    - network-throughput: increased net.ipv4.tcp_rmem default value


author: zhangbinchen <zhangbinchen@openanolis.org> - 2.22.1-5.0.1
changelog:
  - Don't require syspurpose for Anolis OS
  - Turn on balance mode for Anolis OS
  - Remove python3-syspurpose requirement (gc-taifu@linux.alibaba.com)


author: Jan Vcelak <jvcelak@redhat.com> 2.1.0-1
changelog:
  - new release:
    - daemon: allow running without selected profile
    - daemon: fix profile merging, allow only safe characters in profile names
    - daemon: implement missing methods in DBus interface
    - daemon: implement profile recommendation
    - daemon: improve daemonization, PID file handling
    - daemon: improved device matching in profiles, negation possible
    - daemon: various internal improvements
    - executables: check for EUID instead of UID
    - executables: run python with -Es to increase security
    - plugins: cpu - fix cpupower execution
    - plugins: disk - fix option setting
    - plugins: mounts - new, currently supports only barriers control
    - plugins: sysctl - fix a bug preventing settings application
    - powertop2tuned: speedup, fix crashes with non-C locales
    - powertop2tuned: support for powertop 2.2 output
    - profiles: progress on replacing scripts with plugins
    - tuned-adm: bash completion - suggest profiles from all supported locations
    - tuned-adm: complete switch to D-bus
    - tuned-adm: full control to users with physical access


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.1.2-1
changelog:
  - new release:
    - systemtap {disk,net}devstat: fix typo in usage
    - switched to configobj parser
    - latency-performance: disabled THP
    - fixed fd leaks on subprocesses


author: Jan Vcelak <jvcelak@redhat.com> 2.2.0-1
changelog:
  - new release:
    - remove nobarrier from virtual-guest (data loss prevention)
    - devices enumeration via udev, instead of manual retrieval
    - support for dynamically inserted devices (currently disk plugin)
    - dropped rfkill plugins (bluetooth and wifi), the code didn't work


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.2.1-1
changelog:
  - new release:
    - audio plugin: fixed error handling in _get_timeout
    - removed cpupower dependency, added sysfs fallback
    - powertop2tuned: fixed parser crash on binary garbage
      resolves: rhbz#914933
    - cpu plugin: dropped multicore_powersave as kernel upstream already did
    - plugins: options manipulated by dynamic tuning are now correctly saved and restored
    - powertop2tuned: added alias -e for --enable option
    - powertop2tuned: new option -m, --merge-profile to select profile to merge
    - prefer transparent_hugepage over redhat_transparent_hugepage
    - recommend: use recommend.conf not autodetect.conf
    - tuned.service: switched to dbus type service
      resolves: rhbz#911445
    - tuned: new option --pid, -P to write PID file
    - tuned, tuned-adm: added new option --version, -v to show version
    - disk plugin: use APM value 254 for cleanup / APM disable instead of 255
      resolves: rhbz#905195
    - tuned: new option --log, -l to select log file
    - powertop2tuned: avoid circular deps in include (one level check only)
    - powertop2tuned: do not crash if powertop is not installed
    - net plugin: added support for wake_on_lan static tuning
      resolves: rhbz#885504
    - loader: fixed error handling
    - spec: used systemd-rpm macros
      resolves: rhbz#850347


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.2.2-1
changelog:
  - new-release:
    - cpu plugin: fixed cpupower workaround
    - cpu plugin: fixed crash if cpupower is installed


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.3.0-1
changelog:
  - new-release
    resolves: rhbz#1020743
    - audio plugin: fixed audio settings in standard profiles
      resolves: rhbz#1019805
    - video plugin: fixed tunings
    - daemon: fixed crash if preset profile is not available
      resolves: rhbz#953128
    - man: various updates and corrections
    - functions: fixed usb and bluetooth handling
    - tuned: switched to lightweighted pygobject3-base
    - daemon: added global config for dynamic_tuning
      resolves: rhbz#1006427
    - utils: added pmqos-static script for debug purposes
      resolves: rhbz#1015676
    - throughput-performance: various fixes
      resolves: rhbz#987570
    - tuned: added global option update_interval
    - plugin_cpu: added support for x86_energy_perf_policy
      resolves: rhbz#1015675
    - dbus: fixed KeyboardInterrupt handling
    - plugin_cpu: added support for intel_pstate
      resolves: rhbz#996722
    - profiles: various fixes
      resolves: rhbz#922068
    - profiles: added desktop profile
      resolves: rhbz#996723
    - tuned-adm: implemented non DBus fallback control
    - profiles: added sap profile
    - tuned: lowered CPU usage due to python bug
      resolves: rhbz#917587


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.3.0-2
changelog:
  - fixed race condition in the start/stop code
    resolves: rhbz#1028119
  - improved tuned responsiveness
    resolves: rhbz#1028122


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.4.0-1
changelog:
  - new-release
    resolves: rhbz#1093883
    - fixed traceback if profile cannot be loaded
      related: rhbz#953128
    - powertop2tuned: fixed traceback if rewriting file instead of dir
      resolves: rhbz#963441
    - throughput-performance: altered dirty ratios for better performance
      resolves: rhbz#1043533
    - latency-performance: leaving THP on its default
      resolves: rhbz#1064510
    - used throughput-performance profile on server by default
      resolves: rhbz#1063481
    - network-latency: added new profile
      resolves: rhbz#1052418
    - network-throughput: added new profile
      resolves: rhbz#1052421
    - recommend.conf: fixed config file
      resolves: rhbz#1069123
    - systemd: added cpupower.service conflict
      resolves: rhbz#1073392
    - balanced: used medium_power ALPM policy
    - added support for >, < assignment modifiers in tuned.conf
    - handled root block devices
    - balanced: used conservative CPU governor
      resolves: rhbz#1124125
    - plugins: added selinux plugin
    - plugin_net: added nf_conntrack_hashsize parameter
    - profiles: added atomic-host profile
      resolves: rhbz#1091977
    - profiles: added atomic-guest profile
      resolves: rhbz#1091979
    - moved profile autodetection from post install script to tuned daemon
      resolves: rhbz#1144067
    - profiles: included sap-hana and sap-hana-vmware profiles
    - man: structured profiles manual pages according to sub-packages
    - added missing hdparm dependency
      resolves: rhbz#1144858
    - improved error handling of switch_profile
      resolves: rhbz#1068699
    - tuned-adm: active: detect whether tuned deamon is running
      related: rhbz#1068699
    - removed active_profile from RPM verification
      resolves: rhbz#1104126
    - plugin_disk: readahead value can be now specified in sectors
      resolves: rhbz#1127127
    - plugins: added bootloader plugin
      resolves: rhbz#1044111
    - plugin_disk: added error counter to hdparm calls
    - plugins: added scheduler plugin
      resolves: rhbz#1100826
    - added tuned-gui


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.4.1-1
changelog:
  - new-release
    - fixed return code of tuned grub template
      resolves: rhbz#1151768
    - plugin_bootloader: fix for multiple parameters on command line
      related: rhbz#1148711
    - tuned-adm: fixed traceback on "tuned-adm list"
      resolves: rhbz#1149162
    - plugin_bootloader is automatically disabled if grub2 is not found
      resolves: rhbz#1150047
    - plugin_disk: set_spindown and set_APM made independent
      resolves: rhbz#976725


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.5.0-1
changelog:
  - new-release
    resolves: rhbz#1155052
    - add support for ethtool -C to tuned network plugin
      resolves: rhbz#1152539
    - add support for ethtool -K to tuned network plugin
      resolves: rhbz#1152541
    - add support for calculation of values for the kernel command line
      resolves: rhbz#1191595
    - no error output if there is no hdparm installed
      resolves: rhbz#1191775
    - do not run hdparm on hotplug events if there is no hdparm tuning
      resolves: rhbz#1193682
    - add oracle tuned profile
      resolves: rhbz#1196298
    - fix bash completions for tuned-adm
      resolves: rhbz#1207668
    - add glob support to tuned sysfs plugin
      resolves: rhbz#1212831
    - add tuned-adm verify subcommand
      resolves: rhbz#1212836
    - do not install tuned kernel command line to rescue kernels
      resolves: rhbz#1223864
    - add variables support
      resolves: rhbz#1225124
    - add built-in support for unit conversion into tuned
      resolves: rhbz#1225135
    - fix vm.max_map_count setting in sap-netweaver profile
      resolves: rhbz#1228562
    - add tuned profile for RHEL-RT
      resolves: rhbz#1228801
    - plugin_scheduler: added support for runtime tuning of processes
      resolves: rhbz#1148546
    - add support for changing elevators on xvd* devices (Amazon EC2)
      resolves: rhbz#1170152
    - add workaround to be run after systemd-sysctl
      resolves: rhbz#1189263
    - do not change settings of transparent hugepages if set in kernel cmdline
      resolves: rhbz#1189868
    - add tuned profiles for RHEL-NFV
      resolves: rhbz#1228803
    - plugin_bootloader: apply $tuned_params to existing kernels
      resolves: rhbz#1233004


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.5.1-1
changelog:
  - new-release
    related: rhbz#1155052
    - plugin_scheduler: work with nohz_full
      resolves: rhbz#1247184
    - fixed realtime-virtual-guest/host profiles packaged twice
      resolves: rhbz#1249028
    - fixed requirements of realtime and nfv profiles
    - fixed tuned-gui not starting
    - various other minor fixes


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.6.0-1
changelog:
  - new-release
    - plugin_cpu: do not show error if cpupower or x86_energy_perf_policy are missing
    - plugin_sysctl: fixed quoting of sysctl values
      resolves: rhbz#1254538
    - tuned-adm: added log file location hint to verify command output
    - libexec: fixed listdir and isdir in defirqaffinity.py
      resolves: rhbz#1252160
    - plugin_cpu: save and restore only intel pstate attributes that were changed
      resolves: rhbz#1252156
    - functions: fixed sysfs save to work with options
      resolves: rhbz#1251507
    - plugins: added scsi_host plugin
    - tuned-adm: fixed restart attempt if tuned is not running
    - spec: fixed post scriptlet to work without grub
      resolves: rhbz#1265654
    - tuned-profiles-nfv: fix find-lapictscdeadline-optimal.sh for CPUS where ns > 6500
      resolves: rhbz#1267284
    - functions: fixed restore_logs_syncing to preserve SELinux context on rsyslog.conf
      resolves: rhbz#1268901
    - realtime: set unboud workqueues cpumask
      resolves: rhbz#1259043
    - spec: correctly remove tuned footprint from /etc/default/grub
      resolves: rhbz#1268845
    - gui: fixed creation of new profile
      resolves: rhbz#1274609
    - profiles: removed nohz_full from the realtime profile
      resolves: rhbz#1274486
    - profiles: Added nohz_full and nohz=on to realtime guest/host profiles
      resolves: rhbz#1274445
    - profiles: fixed lapic_timer_adv_ns cache
      resolves: rhbz#1259452
    - plugin_sysctl: pass verification even if the option doesn't exist
      related: rhbz#1252153
    - added support for 'summary' and 'description' of profiles,
      extended D-Bus API for Cockpit
      related: rhbz#1228356


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.7.0-1
changelog:
  - new-release
    - gui: fixed save profile
      resolves: rhbz#1242491
    - tuned-adm: added --ignore-missing parameter
      resolves: rhbz#1243807
    - plugin_vm: added transparent_hugepage alias
      resolves: rhbz#1249610
    - plugins: added modules plugin
      resolves: rhbz#1249618
    - plugin_cpu: do not show error if cpupower or x86_energy_perf_policy are
      missing
      resolves: rhbz#1254417
    - tuned-adm: fixed restart attempt if tuned is not running
      resolves: rhbz#1258755
    - nfv: avoided race condition by using synchronous mode
      resolves: rhbz#1259039
    - realtime: added check for isolcpus sanity
      resolves: rhbz#1264128
    - pm_qos: fixed exception if PM_QoS is not available
      resolves: rhbz#1296137
    - plugin_sysctl: reapply system sysctl after Tuned sysctl are applied
      resolves: rhbz#1302953
    - atomic: increase number of inotify watches
      resolves: rhbz#1322001
    - realtime-virtual-host/guest: added rcu_nocbs kernel boot parameter
      resolves: rhbz#1334479
    - realtime: fixed kernel.sched_rt_runtime_us to be -1
      resolves: rhbz#1346715
    - tuned-adm: fixed detection of no_daemon mode
      resolves: rhbz#1351536
    - plugin_base: correctly strip assignment modifiers even if not used
      resolves: rhbz#1353142
    - plugin_disk: try to workaround embedded '/' in device names
      related: rhbz#1353142
    - sap-hana: explicitly setting kernel.numa_balancing = 0 for better performance
      resolves: rhbz#1355768
    - switched to polkit authorization
      resolves: rhbz#1095142
    - plugins: added scsi_host plugin
      resolves: rhbz#1246992
    - spec: fixed conditional support for grub2 to work with selinux
      resolves: rhbz#1351937
    - gui: added tuned icon and desktop file
      resolves: rhbz#1356369


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.7.0-2
changelog:
  - Fixed tuned-gui traceback (by tuned-gui-traceback-fix patch)
    Resolves: rhbz#1358846
  - Fixed 'tuned-adm list' traceback if daemon is not running
    (by tuned-adm-list-no-dbus-traceback-fix patch)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.7.1-1
changelog:
  - New release
    Resolves: rhbz#1362481
  - Dropped tuned-gui-traceback-fix and tuned-adm-list-no-dbus-traceback-fix
    patches (both upstreamed)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.7.1-3
changelog:
  - Fixed traceback when non-existent profile is queried through
    tuned-adm profile_info
    Resolves: rhbz#1385145


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.8.0-1
changelog:
  - new release
    - rebase tuned to latest upstream
      resolves: rhbz#1388454
    - cpu-partitioning: enabled timer migration
      resolves: rhbz#1408308
    - cpu-partitioning: disabled kvmclock sync and ple
      resolves: rhbz#1395855
    - spec: muted error if there is no selinux support
      resolves: rhbz#1404214
    - units: implemented instance priority
      resolves: rhbz#1246172
    - bootloader: added support for initrd overlays
      resolves: rhbz#1414098
    - cpu-partitioning: set CPUAffinity early in initrd image
      resolves: rhbz#1394965
    - cpu-partitioning: set workqueue affinity early
      resolves: rhbz#1395899
    - scsi_host: fixed probing of ALPM, missing ALPM logged as info
      resolves: rhbz#1416712
    - added new profile cpu-partitioning
      resolves: rhbz#1359956
    - bootloader: improved inheritance
      resolves: rhbz#1274464
    - units: mplemented udev-based regexp device matching
      resolves: rhbz#1251240
    - units: introduced pre_script, post_script
      resolves: rhbz#1246176
    - realtime-virtual-host: accommodate new ktimersoftd thread
      resolves: rhbz#1332563
    - defirqaffinity: fixed traceback due to syntax error
      resolves: rhbz#1369791
    - variables: support inheritance of variables
      resolves: rhbz#1433496
    - scheduler: added support for cores isolation
      resolves: rhbz#1403309
    - tuned-profiles-nfv splitted to host/guest and dropped unneeded dependency
      resolves: rhbz#1413111
    - desktop: fixed typo in profile summary
      resolves: rhbz#1421238
    - with systemd don't do full rollback on shutdown / reboot
      resolves: rhbz#1421286
    - builtin functions: added virt_check function and support to include
      resolves: rhbz#1426654
    - cpulist_present: explicitly sorted present CPUs
      resolves: rhbz#1432240
    - plugin_scheduler: fixed initialization
      resolves: rhbz#1433496
    - log errors when applying a profile fails
      resolves: rhbz#1434360
    - systemd: added support for older systemd CPUAffinity syntax
      resolves: rhbz#1441791
    - scheduler: added workarounds for low level exceptions from
      python-linux-procfs
      resolves: rhbz#1441792
    - bootloader: workaround for adding tuned_initrd to new kernels on restart
      resolves: rhbz#1441797


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.8.0-6
changelog:
  - Dropped qemu-kvm-tools-rhev requirement, now satisfied by
    tuned-profiles-nfv-host-bin
    Related: rhbz#1504681


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.10.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1546598
    - script: show stderr output in the log
    - realtime-virtual-host: script.sh: add error checking
    - man: improved tuned-profiles-cpu-partitioning.7
    - bootloader: check if grub2_cfg_file_name is None in _remove_grub2_tuning()
    - plugin_scheduler: whitelist/blacklist processed also for thread names
    - bootloader: patch all GRUB2 config files
    - profiles: added mssql profile
    - tuned-adm: print log excerpt when changing profile
    - cpu-partitioning: use no_balance_cores instead of no_rebalance_cores
    - sysctl: support assignment modifiers as other plugins do
    - oracle: fixed ip_local_port_range parity warning
      resolves: rhbz#1527219
    - Fix verifying cpumask on systems with more than 32 cores
      resolves: rhbz#1528368
    - oracle: updated the profile to be in sync with KCS 39188
      resolves: rhbz#1447323


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.10.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: rhbz#1546598
    - IRQ affinity handled by scheduler plugin
      resolves: rhbz#1590937


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.10.0-9
changelog:
  - realtime-virtual-guest/host: start/stop rt-entsk daemon on
    initialization/shutdown
    resolves: rhbz#1619822


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.12.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1685585
    - sap-netweaver: changed values of kernel.shmall and kernel.shmmax to RHEL-8 defaults
      resolves: rhbz#1708418
    - sap-netweaver: changed value of kernel.sem to RHEL-8 default
      resolves: rhbz#1701394
    - sap-hana-vmware: dropped profile
      resolves: rhbz#1715541
    - s2kb function: fixed to be compatible with python3
      resolves: rhbz#1684122
    - do fallback to the powersave governor (balanced and powersave profiles)
      resolves: rhbz#1679205
    - added support for negation of CPU list
      resolves: rhbz#1676588
    - switched from sysctl tool to own implementation
      resolves: rhbz#1666678
    - realtime-virtual-host: added tsc-deadline=on to qemu cmdline
      resolves: rhbz#1554458
    - fixed handling of devices that have been removed and re-attached
      resolves: rhbz#1677730


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.13.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1738250
    - cpu: fixed checking if EPB is supported
      resolves: rhbz#1690929
    - scheduler: fixed IRQ SMP affinity verification to respect ignore_missing
      resolves: rhbz#1729936
    - realtime: enabled ktimer_lockless_check
      resolves: rhbz#1734096
    - plugins: support cpuinfo_regex and uname_regex matching
      resolves: rhbz#1748965
    - sysctl: made reapply_sysctl ignore configs from /usr
      resolves: rhbz#1759597
    - added support for multiple include directives
      resolves: rhbz#1760390
    - realtime: added nowatchdog kernel command line option
      resolves: rhbz#1767614


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.13.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: rhbz#1738250
    - sap-hana: updated tuning
      resolves: rhbz#1779821
    - latency-performance: updated tuning
      resolves: rhbz#1779759


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.14.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1792264
    - oracle: turned off NUMA balancing
      resolves: rhbz#1782233
    - man: documented the possibility to apply multiple profiles
      resolves: rhbz#1794337
    - cpu-partitioning: disabled kernel.timer_migration
      resolves: rhbz#1797629
    - profiles: new profile optimize-serial-console
      resolves: rhbz#1840689
    - added support for a post-loaded profile
      resolves: rhbz#1798183
    - plugins: new irqbalance plugin
      resolves: rhbz#1784645
    - throughput-performance: added architecture specific tuning for Marvell ThunderX
      resolves: rhbz#1746961
    - throughput-performance: added architecture specific tuning for AMD
      resolves: rhbz#1746957
    - scheduler: added support for cgroups
      resolves: rhbz#1784648


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.14.0-4
changelog:
  - realtime-virtual-host: remove lapic advancement calculation and
    related qemu-kvm-tools-rhev requirement
    Resolves: rhbz#1845717


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.15.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1874052
    - added plugin service for linux services control
      resolves: rhbz#1869991
    - scheduler: added default_irq_smp_affinity option
      resolves: rhbz#1896348
    - bootloader: skip boom managed BLS snippets
      resolves: rhbz#1901532
    - scheduler: added perf_process_fork option to enable processing of fork
      resolves: rhbz#1894610
    - scheduler: added perf_mmap_pages option to set perf buffer size
      resolves: rhbz#1890219
    - bootloader: fixed cmdline duplication with BLS and grub2-mkconfig
      resolves: rhbz#1777874


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.16.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1936426
    - realtime: "isolate_managed_irq=Y" should be mentioned in
      "/etc/tuned/realtime-virtual-*-variables.conf"
      resolves: rhbz#1817827
    - realtime: changed tuned default to "isolcpus=domain,managed_irq,X-Y"
      resolves: rhbz#1820626
    - applying a profile with multiple inheritance where parents include a common
      ancestor fails
      resolves: rhbz#1825882
    - failure in moving i40e IRQ threads to housekeeping CPUs from isolated CPUs
      resolves: rhbz#1933069
    - sort network devices before matching by regex
      resolves: rhbz#1939970
    - net: fixed traceback while adjusting the netdev queue count
      resolves: rhbz#1943291
    - net: fixed traceback if the first listed device returns netlink error
      resolves: rhbz#1944686
    - realtime: improve verification
      resolves: rhbz#1947858
    - bootloader: add support for the rpm-ostree
      resolves: rhbz#1950164
    - net: fixed traceback if a device channel contains n/a
      resolves: rhbz#1974071
    - mssql: updated the profile
      resolves: rhbz#1942733


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.18.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2003833
    - profiles: fix improper parsing of include directive
      resolves: rhbz#2017924
    - disk: added support for the nvme
      resolves: rhbz#1854816
    - cpu: extended cstate force_latency syntax to allow skipping zero latency
      resolves: rhbz#2002744
    - net: added support for the txqueuelen
      resolves: rhbz#2015044
    - bootloader: on s390(x) remove TuneD variables from the BLS
      resolves: rhbz#1978786
    - daemon: don't do full rollback on systemd failure
      resolves: rhbz#2011459


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.18.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: rhbz#2003833
    - tuned-gui: fixed creation of new profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.19.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2057602
    - fixed parsing of inline comments
      resolves: rhbz#2060138
    - added support for quotes in isolated_cores specification
      resolves: rhbz#1891036
    - recommend: preset balanced profile for notebook, laptop or portable if
      syspurpose is not defined
      resolves: rhbz#1896717


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2133814
    - systemd: relax polkit requirement
      resolves: rhbz#2065591
    - sysvinit: fixed path
    - plugin_cpu: added support for pm_qos_resume_latency_us
    - do not exit on duplicate config lines
      resolves: rhbz#2071418
    - profiles: new cpu-partitioning-powersave profile
    - profiles: new profile for AWS EC2
    - API: add support for moving devices between instances
    - D-Bus: send tracebacks through D-Bus only in debug mode
    - Makefile: added fix for python-3.12
    - throughput-performance: set net.core.somaxconn to at least 2048
      resolves: rhbz#1998310
    - plugin_scheduler: do not leak FDs from the perf
      resolves: rhbz#2080227
    - plugin_cpu: added support for intel_pstate scaling driver
    - added support for the API access through the Unix Domain Socket


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.21.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2182119
    - sap-hana: new profile sap-hana-kvm-guest
      resolves: rhbz#2173740
    - serialized SIGHUP handler to prevent possible bootcmdline corruption
      resolves: rhbz#2215298


author: Pavol Žáčik <pzacik@redhat.com> - 2.22.1-6
changelog:
  - Make hdparm device checks lazy
    Resolves: RHEL-71457
  - Disable the amd.scheduler plug-in instance in the postgresql profile
    Resolves: RHEL-70470


author: Patsy Griffin <patsy@redhat.com> - 2023d-1
changelog:
  - Rebase to tzdata-2023d
    - Include time zone changes for Ittoqqortoormiit, Greenland
      and Vostok, Antarctica.
    - Update the expiration date for the leap-seconds.list file.
      No new leap seconds were added.


author: Patsy Griffin <patsy@redhat.com> - 2024a-1
changelog:
  - Rebase to tzdata-2024a
    - Kazakhstan will transition from UTC+6 to UTC+5 on 2024-03-01.
    - Palestine will spring forward a week later than previously
      predicted.


author: Patsy Griffin <patsy@redhat.com> - 2024b-1
changelog:
  - Update to tzdata-2024b
    - Improve historical data for Mexico, Mongolia, and Portugal.
    - System V names are now obsolescent.
    - The main data form now uses %z.
    - The code now conforms to RFC 8536 for early timestamps.
    - Support POSIX.1-2024, which removes asctime_r and ctime_r.
    - Assume POSIX.2-1992 or later for shell scripts.
    - SUPPORT_C89 now defaults to 1.
    - Include two upstream patches for month names as in April vs Apr.


author: Patsy Griffin <pats@redhat.com> - 2025a-1
changelog:
  Update to tzdata-2025a (RHEL-74309)
    - Paraguay is now permanently at -03. This impacts timestamps
      starting on 2025-03-22.
    - Includes improvements to pre-1991 data for the Philippines.
    - Etc/Unknown is now reserved.


author: Jakub Jelinek <jakub@redhat.com> 2005g-2
changelog:
  - 2005g
    - fixes for Uruguay
  - include README and Theory from tzcode tarball in %{_docdir};
    Theory includes a good summary of how the timezone data files
    are supposed to be named


author: Jakub Jelinek <jakub@redhat.com> 2005m-2
changelog:
  - 2005m
    - changes for USA (extending DST by 4 weeks since 2007), Tunisia,
      Australia, Kazakhstan
    - historical timezone data changes for Japan, Poland, Northern Ireland and
      Mali
    - timezone name change for East Timor


author: Jakub Jelinek <jakub@redhat.com> 2005n-2
changelog:
  - 2005n
    - changes for Kyrgyzstan and Uruguay
  - fix a typo in the Makefile (used TZDATA env var instead of TZDIR during
    make check), update tst-timezone.c from glibc CVS (#172102)


author: Jakub Jelinek <jakub@redhat.com> 2005q-2
changelog:
  - 2005q
    - changes for Georgia, Azerbaijan, Jordan, Palestine, Cuba, Nicaragua
    - SystemV timezone changes


author: Petr Machata <pmachata@redhat.com> 2005r-2
changelog:
  - 2005r
    - Zones EST, MST, HST, EST5EDT, CST6CDT, MST7MDT, PST8PDT moved to
      northamerica to guard against old files with obsolete information
      being left in the time zone binary directory.
    - Changes for countries that are supposed to join 2007 US DST
      change.  This includes most of Canada, however entries already in
      the database (Alberta, British Columbia, Newfoundland, Northwest
      Territories, and Yukon) were left alone for the time being.
    - Fixes in zdump.c (abbrok): conditions are chained, and the string
      is checked for emptiness.


author: Petr Machata <pmachata@redhat.com> 2005r-3
changelog:
  - 2005r-3
    - Meta changes.  Renaming tzdata.tar.bz2 file to tzdata$ver-base,
      so that it won't clash across updates.


author: Petr Machata <pmachata@redhat.com> 2006a-1
changelog:
  - Upstream 2006a:
    - private.h(scheck): changing char* to char const*
    - Rule changes for Palestine, zone changes for Indiana/US, both
      changes for Canada.
    - Many related doc changes.
  - Naming scheme in spec file doesn't use %{name}, but tzdata.


author: Petr Machata <pmachata@redhat.com> 2006b-1
changelog:
  - Upstream 2006b:
    - using tz64code version, as 32 is legacy according to tzdata ML
    - new manual pages for ctime, strftime, tzset
    - some source code reorganizations
    - no timezone/dst rule updates


author: Petr Machata <pmachata@redhat.com> - 2006c-1
changelog:
  - Upstream 2006c
    - Time-related changes:
      - dozens of historical and commentary changes
      - Iran stopped observing DST
      - Sri Lanka switches from UTC+6 to UTC+5:30
      - America/Thule and America/Edmonton will adopt new US rules,
        starting 2007
      - Tunisia is adopting regular DST
    - Code:
      - asctime.c: Chages in format strings to silent gcc warnings
      - removing K&R notation from function signatures
      - few fixes across the code


author: Petr Machata <pmachata@redhat.com> - 2006d-1
changelog:
  - Upstream 2006d
    - Haiti observes DST
    - Sri Lanka change actually took effect Apr/15
    - All Canada is now scheduled for 2007 US DST rules
    - Some historical fixes


author: Petr Machata <pmachata@redhat.com> - 2006f-1
changelog:
  - Upstream 2006f
    - America/Guatemala observes DST between Apr/30 and Oct/1
    - Historical changes for Nicaragua
    - Update of America/Indiana/Vincennes in zone table


author: Petr Machata <pmachata@redhat.com> - 2006j-1
changelog:
  - Upstream 2006j
    - Honduras stopped observing DST on Monday at 00:00
    - America/Bermuda will follow the US's lead next year
    - America/Moncton will use US-style rules next year
    - New Zone America/Blanc-Sablon, for Canadians who observe AST all
      year
    - New zone: America/Atikokan instead of America/Coral_Harbour
    - New zones: Europe/Jersey, Europe/Guernsey, Europe/Isle_of_Man
    - Historical changes
    - Commentary updates
  - Upstream 2006i
    - localtime.c fixes
  - Upstream 2006h
    - zic leapsecond fix


author: Petr Machata <pmachata@redhat.com> - 2006l-1
changelog:
  - Upstream 2006k, 2006l:
    - Adjustments for Egypt, Palestine, Cuba, Honduras
    - Documentation changes


author: Petr Machata <pmachata@redhat.com> - 2006m-1
changelog:
  - Upstream 2006m:
    - Adjustments for Egypt, Palestine, Uruguay
    - Better description of `until' field in zic (8) manpage


author: Petr Machata <pmachata@redhat.com> - 2006m-2
changelog:
  - Proposed upstream patch (#210058)
    - Jordan will switch to winter time on October 27, not September 29
    - Brazil's DST this year is the first Sunday in November to the last
      Sunday in February.  (Thanks to Frederico A. C. Neves.)
    - ISO 3166 codes for Serbia and Montenegro, zone Europe/Podgorica
    - Commentary and past timestamps changes


author: Petr Machata <pmachata@redhat.com> - 2006p-1
changelog:
  - Upstream 2006p
    - Official version of Western Australia DST trial changes
    - Latitude/longitude changes for Europe/Jersey and Europe/Podgorica


author: Petr Machata <pmachata@redhat.com> - 2007a-1
changelog:
  - Upstream 2007a
    - Updates to Bahamas, they will be in sync with 2007 US DST change
    - New zone Australia/Eucla
    - Africa/Asmera renamed to Africa/Asmara, link created
    - Atlantic/Faeroe renamed to Atlantic/Faroe, link created
  - Packaging
    - Adding BuildRequires: glibc-common >= 2.5.90-7 to build tzdata
      with extended 64-bit format necessary for dates beyond 2037


author: Petr Machata <pmachata@redhat.com> - 2007c-1
changelog:
  - Upstream 2007c
    - Pulaski County, Indiana, switched back to eastern time.
    - Turkey switches at 01:00 standard time, not at 01:00 UTC.
  - Upstream 2007b
    - Changes to the commentary in "leapseconds".


author: Petr Machata <pmachata@redhat.com> - 2007d-1
changelog:
  - Upstream 2007d
    - Mongolia has abolished DST.
    - Turkey will use EU rules this year, changing at 01:00 UTC rather
      than 01:00 standard time.
    - Cuba observed DST starting Sunday.
    - Resolute, Nunavut switched from Central to Eastern time last
      November.


author: Petr Machata <pmachata@redhat.com> - 2007e-1
changelog:
  - Upstream 2007e
    - Syria switched to summer time at Mar/29.
    - Honduras will not enter DST this year.


author: Petr Machata <pmachata@redhat.com> - 2007f-1
changelog:
  - Upstream 2007f
    - New Zealand is extending DST, starting later this year.
    - Haiti no longer observes DST.
    - The Turks and Caicos switch at 02:00, not at 00:00, and have
      adopted US DST rules.


author: Petr Machata <pmachata@redhat.com> - 2007g-1
changelog:
  - Fix licensing tag.
  - Upstream 2007g
    - Egypt switches the September 7, not September 28
    - Daviess, Dubous, Knox, Martin, and Pike Counties, Indiana, switch
      from central to eastern time in November
    - South Australia, Tasmania, Victoria, New South Wales and Lord Howe
      Island are changing their DST rules effective next year
    - Sync several Antarctic station's rules with the New Zealand
    - leapseconds contain changes from the most recent IERS bulletin


author: Petr Machata <pmachata@redhat.com> - 2007h-1
changelog:
  - Upstream 2007h
    - Brazil will observe DST from 2007-10-14 to 2008-02-17
    - Egypt and Gaza switched earlier than we expected
    - Iran will resume DST next year
    - Venezuela is scheduled to change TZ to -4:30 on January 1


author: Petr Machata <pmachata@redhat.com> - 2007i-1
changelog:
  - Upstream 2007i
    - Syria DST will take place at Midnight between Thursday and Friday.
    - Cuba will end DST on the last Sunday of October.
  - Update tst-timezone.c from glibc CVS


author: Petr Machata <pmachata@redhat.com> - 2007j-1
changelog:
  - Upstream 2007j
    - New links America/St_Barthelemy and America/Marigot
    - Venezuela is changing their clocks on December 9 at 03:00


author: Petr Machata <pmachata@redhat.com> - 2008b-1
changelog:
  - Upstream 2008b
    - DST changes for Syria, Cuba; Iraq abandons DST
    - Saigon zone renamed Ho_Chi_Minh; backward link provided
    - Add America/Argentina/San_Luis information


author: Petr Machata <pmachata@redhat.com> - 2008c-1
changelog:
  - Upstream 2008c
    - Mongolia changes zone
    - Pakistan DST is scheduled until Sep/1, instead of Aug/31
  - Drop Morocco and Pakistan patches that are superseded by upstream
  - Fix a typo in Java subpackage name


author: Petr Machata <pmachata@redhat.com> - 2008e-1
changelog:
  - Upstream 2008e
    - Changes for Mauritius
    - Leap second coverage for 31/Dec 2008
    - Corrections of historical dates


author: Petr Machata <pmachata@redhat.com> - 2008f-1
changelog:
  - Upstream 2008f
    - Changes for Mauritius (extends DST to years to come)
    - Palestine changes clocks for the duration of Ramadan
    - Argentina will start DST on Sunday October 19, 2008
    - Brazil will start DST on 2008-10-19
  - Drop Pakistan and Morocco patches


author: Petr Machata <pmachata@redhat.com> - 2008h-1
changelog:
  - Upstream 2008h
    - Fix exact DST transition hour for Mauritius
    - Syria will leave the period of DST on Nov 1
    - Fix coordinates of Pacific/Niue


author: Petr Machata <pmachata@redhat.com> - 2008i-1
changelog:
  - Upstream 2008i
    - Updates for Argentina: Drop DST in zones America/Argentina/Jujuy,
      La_Rioja, San_Juan, Catamarca, Mendoza, Rio_Gallegos, Ushuaia; new
      zone America/Argentina/Salta (for provinces SA, LP, NQ, RN).


author: Petr Machata <pmachata@redhat.com> - 2009a-1
changelog:
  - Upstream 2009a
    - Fix Asia/Kathmandu spelling
    - Historical timestamps for Switzerland and Cuba
    - DST update for America/Resolute


author: Petr Machata <pmachata@redhat.com> - 2009d-1
changelog:
  - Upstream 2009d
    - Morocco will observe DST from 2009-06-01 00:00 to 2009-08-21 00:00
    - Tunisia will not observe DST this year.
    - Syria will start DST on 2009-03-27 00:00 this year
    - Cuba will start DST on midnight between 2009-03-07 and 2009-03-08
    - Province of San Luis, Argentina, went to UTC-04:00 on 2009-03-15


author: Petr Machata <pmachata@redhat.com> - 2009e-1
changelog:
  - Upstream 2009e
    - Historical changes for Jordan
    - Palestine will start DST on 2009-03-26 and end 2009-09-27
  - Egypt ends DST on 2009-09-24


author: Petr Machata <pmachata@redhat.com> - 2009f-1
changelog:
  - Upstream 2009f
    - Pakistan will observe DST between 2009-04-15 and (probably) 2009-11-01
  - Drop Pakistan patch


author: Petr Machata <pmachata@redhat.com> - 2009h-2
changelog:
  - Upstream 2009h
    - Convert use of 00:00 stamps to 24:00 of the previous day
    - Clarify that the data is Public Domain
  - Drop Cairo patch


author: Petr Machata <pmachata@redhat.com> - 2009k-1
changelog:
  - Upstream 2009k
    - Mauritius will not continue to observe DST the coming summer
    - Arbitrarily end DST at the end of 2009 so that a POSIX-style time
      zone string can appear in the Dhaka binary file


author: Petr Machata <pmachata@redhat.com> - 2009m-1
changelog:
  - Upstream 2009m
    - Palestine will will revert back to winter time on Friday, 2009-09-04
    - Samoa passed the DST Bill that fixes DST dates for 2009 and 2010
  - Drop Egypt patch


author: Petr Machata <pmachata@redhat.com> - 2009m-2
changelog:
  - Add markers for autoupdate of spec file
  - Pakistan leaves the period of DST on October 1 (tzdata-2009m-karachi.patch)


author: Petr Machata <pmachata@redhat.com> - 2009o-1
changelog:
  - Upstream 2009o
    - Bangladesh won't go back to Standard Time from October 1, 2009
    - Pakistan leaves DST on October 1, 2009
  - Dropped tzdata-2009m-karachi.patch
  - Argentina does not enter DST on October 18 (tzdata-2009o-argentinas.patch)


author: Petr Machata <pmachata@redhat.com> - 2009u-1
changelog:
  - Upstream 2009p
    - Argentina does not enter DST on October 18
    - San Luis switched from UTC-4 to UTC-3 on October 11th
  - Upstream 2009q
    - Change DST end in Syria from November 1 to last Friday in October
    - Changes to past Hong Kong transitions
    - Kemerovo oblast' in Russia will change current time zone on March 28, 2010.
      Asia/Novokuznetsk is the new time zone name
  - Upstream 2009r
    - Changes to local times of three Australian research stations in Antarctica
  - Upstream 2009s
    - Fiji plans to re-introduce DST from November 29th 2009 to April 25th 2010
  - Upstream 2009u
    - Bangladesh changed their clock back to Standard Time on December 31, 2009
  - Dropped tzdata-2009o-argentinas.patch


author: Petr Machata <pmachata@redhat.com> - 2010c-1
changelog:
  - Upstream 2010a
    - Source code cleanups
    - Historical timestamps for Bangladesh
  - Upstream 2010b
    - Northern Mexico's border cities share the DST schedule with the
      United States
  - Upstream 2010c
    - Paraguay DST now in effect from 2nd Sunday of April to 1st Sunday
      of October


author: Petr Machata <pmachata@redhat.com> - 2010e-1
changelog:
  - Upstream 2010d
    - The DST change in Bangladesh takes place a minute earlier
    - Fiji to end DST on 2010-03-28 at 03:00, about a month earlier
    - Samoa to observe DST this year; they didn't observe DST last year
    - DST in Chile extended to 3 April
  - Upstream 2010e:
    - Fix a typo in Bangladesh DST rule


author: Petr Machata <pmachata@redhat.com> - 2010f-1
changelog:
  - Upstream 2010f:
    - Changes to Australian stations in Antarctica
    - Correct 2010 Samoa DST start date
    - New zone Antarctica/Macquarie
    - Change Syria DST start from last Friday in March to first Friday
      in April in 2010 and forward
  - Upstream 2010g proposal (tzdata-2010f-g.patch):
    - No Bangladesh DST in 2010 and forward.
    - Gaza DST starts last Saturday in March at 12:01 a.m. in 2010 and forward
    - Kamchatka and Anadyr change to Moscow+8 on 2010-03-28
    - Samara changes to Moscow+0 on 2010-03-28
    - Related zone.tab updates


author: Petr Machata <pmachata@redhat.com> - 2010f-3
changelog:
  - Tunisia not to observe DST in 2010 (tzdata-2010g-tunis.patch)
  - Pakistan not to observe DST in 2010 (tzdata-2010g-karachi.patch)


author: Petr Machata <pmachata@redhat.com> - 2010h-2
changelog:
  - Upstream 2010g:
    - No Bangladesh DST in 2010 and forward.
    - Gaza DST starts last Saturday in March at 12:01 a.m. in 2010 and forward
    - Kamchatka and Anadyr change to Moscow+8 on 2010-03-28
    - Samara changes to Moscow+0 on 2010-03-28
    - Related zone.tab updates
  - Upstream 2010h:
    - No DST in Tunisia in 2010 and forward
    - No DST in Pakistan in 2010 and forward
  - Dropped tzdata-2010g-tunis.patch
  - Dropped tzdata-2010f-g.patch
  - Dropped tzdata-2010g-karachi.patch


author: Petr Machata <pmachata@redhat.com> - 2010i-1
changelog:
  - Upstream 2010i:
    - Morocco will have DST from 2010-05-02 to 2010-08-08
    - San Luis, Argentina will keep permanent DST after April 11, 2010
    - Updates of historical stamps for Taiwan


author: Petr Machata <pmachata@redhat.com> - 2010j-1
changelog:
  - Upstream 2010j:
    - Bahia de Banderas (Mexican state of Nayarit) changed time zone
      UTC-7 to new time zone UTC-6 on April 4, 2010


author: Tom "spot" Callaway <tcallawa@redhat.com> - 2010k-1
changelog:
  - Upstream 2010k:
   - Egypt has announced that DST will be off during Ramadan, but
     DST will resume afterwards (August 10, 2010 - September 9, 2010)


author: Petr Machata <pmachata@redhat.com> - 2010l-2
changelog:
  - Upstream 2010l:
    - Change Cairo's 2010 reversion to DST from the midnight between
      September 8 and 9 to the midnight between September 9 and 10.
    - Change Gaza's 2010 return to standard time to the midnight between
      August 10 and 11.
    - Bahia de Banderas (Mexican state of Nayarit) changed time zone
      UTC-7 to new time zone UTC-6 on April 4, 2010


author: Petr Machata <pmachata@redhat.com> - 2010n-1
changelog:
  - Upstream 2010m:
    - Hong Kong didn't observe DST in 1977
    - In zone.tab, remove obsolete association of Vostok Station with
      South Magnetic Pole; add association with Lake Vostok
  - Upstream 2010n:
    - Change end of DST in Samoa in 2011 from 2011-04-03 0:00 to
      2011-04-03 1:00


author: Petr Machata <pmachata@redhat.com> - 2011b-1
changelog:
  - Upstream 2011b:
    - America/North_Dakota/Beulah: Mercer County, North Dakota, changed
      from the mountain time zone to the central time zone


author: Petr Machata <pmachata@redhat.com> - 2011b-2
changelog:
  - Update of historical stamps for Juneau, Sitka, and histcurrent stamps
    for Metlakatla.  Sitka and Metlakatla are new zones.
  - Delay end of DST in Chile in 2011 until first Sunday in April. (tzdata-2011b-c.patch)


author: Petr Machata <pmachata@redhat.com> - 2011d-1
changelog:
  - Upstream 2011d:
    - Change end of DST in Samoa in 2011.
    - Change start of DST in Cuba in 2011.
    - Move start of DST in Turkey by one day in 2011.
  - Dropped tzdata-2011b-c.patch


author: Petr Machata <pmachata@redhat.com> - 2011g-1
changelog:
  - Upstream 2011e:
    - Morocco introduced DST for 2011 from April 2 to July 31.
    - Delay end of DST in Chile in 2011 until May 7.
  - Upstream 2011f:
    - The Falkland Islands will not turn back clocks this winter, but
      stay on daylight saving time.
  - Upstream 2011g:
    - Egypt abandons DST in 2011 (and forward)
  - Dropped tzdata-2011d-chile.patch
  - Dropped tzdata-2011d-morocco.patch


author: Petr Machata <pmachata@redhat.com> - 2011h-1
changelog:
  - Upstream 2011h:
    - Russia abandons DST in 2011.
    - *.tab: change AN (Netherlands Antilles) to CW (Curacao)


author: Petr Machata <pmachata@redhat.com> - 2011h-2
changelog:
  - Patch for upcoming change in Newfoundland.  The transition time
    changes from 12:01 AM to 2:00 AM.


author: Petr Machata <pmachata@redhat.com> - 2011h-1
changelog:
  - Upstream 2011i:
    - Add Africa/Juba (South Sudan) zone
    - Samoa skips over the date line on 2011-12-30
    - Use KALT as abbreviation for Europe/Kalinigrad
    - Canonical version of the Newfoundland patch
    - Change America/Resolute use of EST to 2006-2007 only
    - Assume Metlakatla abandoned use of daylight saving in 1983
    - Sync iso3166.tab and zone.tab with above
  - Resolved: #734063


author: Petr Machata <pmachata@redhat.com> - 2011k-0.1.20110921
changelog:
  - Upstream 2011j:
    - Fix the Samoa date line skip
    - Changes in past timestamp typos several Africa zones
  - Proposed upstream 2011k:
    - Belarus and Ukraine adopt permanent DST in 2011
    - Palestine suspends DST during Ramadan in 2011
    - Gaza and West Bank split in 2011.  West Bank is tracked in the
      timezone Asia/Hebron.  zone.tab update accordingly.
  - Resolves: #737896


author: Petr Machata <pmachata@redhat.com> - 2011l-1
changelog:
  - Upstream 2011l:
    - Fix ancient stamps for America/Sitka
    - Asia/Hebron transitioned to standard time already on Sep 30, not Oct 3
    - Fiji will introduce DST on Oct 22


author: Petr Machata <pmachata@redhat.com> - 2011l-2
changelog:
  - State of Bahia, Brazil, to resume Summer Time on Oct 16
  - The project moved, reflect this in URL
  - Resolves: #746183


author: Petr Machata <pmachata@redhat.com> - 2011l-1
changelog:
  - Rebase to 2011n
    - Drop all patches, including the Kemerovo patch, which is not in
      upstream
    - Cuba postponed DST by two weeks to Nov 13
    - Fiji will enter DST on Jan 21
  - Resolved: #748778


author: Petr Machata <pmachata@redhat.com> - 2012b-1
changelog:
  - Rebase to 2012b; changes vs. 2011n-5:
    - Changes to zones for Antarctica stations
    - Armenia abolished DST in 2012 and forward
    - Cuba enters DST on 31st March
    - Falkland Islands will stay on permanent Summer Time
    - New zone for Creston Valley, Canada, which differs from Dawson
      Creek in past stamps.  Changes to historical stamps in Canada.
    - Last year, Tokelau skipped over the date line together with Samoa


author: Petr Machata <pmachata@redhat.com> - 2012b-2
changelog:
  - Morocco DST starts on the last Sunday of March (March 25, 2012) and
    ends on last Sunday of September, except the month of Ramadan.  It
    is currently unclear what that Ramadan bit means, so this is not
    covered by the patch as of now.


author: Petr Machata <pmachata@redhat.com> - 2012c-1
changelog:
  - Upstream 2012c
    - Haiti observes DST from 2012 on
    - Gaza Strip and Hebron observe DST in 2012
    - Change start of DST in Syria to last Friday in March


author: Petr Machata <pmachata@redhat.com> - 2012d-1
changelog:
  - Upstream 2012d
    - Morocco will not observe DST during the month of Ramadan.
      DST cessation end date was corrected.


author: Petr Machata <pmachata@redhat.com> - 2012f-1
changelog:
  - Fiji will start daylight savings at 2 am on Sunday 21st October 2012
    and end at 3 am on Sunday 20th January 2013.  Guess it will be like
    that in following years as well.
  - Resolves: #857231


author: Petr Machata <pmachata@redhat.com> - 2012g-1
changelog:
  - Upstream 2012g
    - Adjust the packaging for new Makefile
    - Palestine: Fall transition was Sep 21, not Sep 28
    - Samoa: Daylight Saving Time commences on Sunday 30th September
      2012 and ends on Sunday 7th of April 2013.
  - Resolves: #868173


author: Petr Machata <pmachata@redhat.com> - 2012h-1
changelog:
  - Upstream 2012h
    - Brazilian state Bahia no longer has DST.
    - Brazilian state Tocantins now has DST.
    - Israel has new DST rules next year.
    - Jordan stays on DST this winter.


author: Petr Machata <pmachata@redhat.com> - 2012h-2
changelog:
  - Switch back to using system zic, ignore upstream Makefile at all.
    We do so for java anyway.
  - Drop Factory from distribution


author: Petr Machata <pmachata@redhat.com> - 2013b-1
changelog:
  - Upstream 2013b
    - Paraguay will end DST on March 24 this year
    - Haiti uses US daylight-saving rules this year
    - Morocco does not observe DST during Ramadan
  - Upstream 2013a
    - Retire Chile patch, 2013a has the data
    - New Zones Asia/Khandyga, Asia/Ust-Nera, Europe/Busingen
    - Many changes in historical timestamps


author: Petr Machata <pmachata@redhat.com> - 2013c-1
changelog:
  - Upstream 2013c
    - Sync past stamps for Palestine and West Bank with timeanddate.com
    - Assume that the recent change to Paraguay's DST rules is permanent
    - Macquarie was uninhabited between 1919 and 1948.  It's also part
      of Australia (update in zone.tab).


author: Petr Machata <pmachata@redhat.com> - 2013c-2
changelog:
  - Update descriptions in iso3166.tab; make Jerusalem coordinates in
    zone.tab more precise
    (0001-Adjust-commentary-to-try-to-defuse-recent-issues-som.patch)
  - Update local mean time for Jerusalem to match more-precise longitude
    (0002-asia-Asia-Jerusalem-Fix-LMT-to-match-more-precise-lo.patch)
  - Move Morocco's midsummer 2013 transitions
    (0003-Move-Morocco-s-midsummer-2013-transitions.patch)
  - Israel now falls back on the last Sunday of October
    (0004-Israel-now-falls-back-on-the-last-Sunday-of-October.patch)


author: Patsy Franklin <pfrankli@redhat.com> 2013h-1
changelog:
  - Rebase to 2013h 
    - Lybia switched to using UTC+2 without DST
    - Western Sahara (Africa/ElAaiun) uses Morocco's DST rules
    - Acres and Amazon swithc to UTC-4 and UTC-5 on 2013-11-10
    - Add entries for DST transition in Morocco in the year 2038


author: Patsy Franklin <pfrankli@redhat.com> 2013i-1
changelog:
  - Rebase with early release of 2013i from Paul Eggert github.
    - Jordan switches back to standard time at 00:00 on December 20,2013.
    - The 2006-2011 transition schedule is planned to resume in 2014.
    - The compile-time flag NOSOLAR has been removed.
    - The files solar87, solar88, and solar89 are no longer distributed.
    - tz-link.htm now mentions Noda Time.


author: Patsy Franklin <pfrankli@redhat.com> 2014c-1
changelog:
  - Rebase to 2014c
    -Egypt will re-apply DST on May 15 at 24:00, except that DST
     will not be observed during Ramadan.


author: Patsy Franklin <pfrankli@redhat.com> - 2014e-3
changelog:
  - Rebase to 2014e
    - Morrocco suspends DTS for Ramadan
         June 28 at 03:00 and August 2 at 02:00
    - Egypt suspends DTS for Ramadan
         June 26 and July 31 at 24:00
  - Additional edit to support OpenJDK8. (#1091029)


author: Patsy Franklin <pfrankli@redhat.com> - 2014f-1
changelog:
  - Rebase to 2014f
    - Russian time zone changes effective 2014-10-26
    - Several other time zone abbreviation changes as described in
      the NEWS file.


author: Patsy Franklin <pfrankli@redhat.com> - 2014g-1
changelog:
  - Rebase to 2014g
    - Turks & Caicos is switching from US eastern time to UTC-4 year-round,
      modeled as a switch from EST/EDT to AST on 2014-11-02 at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2014i-1
changelog:
  - Rebase to 2014i
    - Pacific/Fiji will observe DST from 2014-11-02 02:00 to 2015-01-18 03:00.
    - A new Zone Pacific/Bougainville, for the part of Papua New Guinea
      that plans to switch from UTC+10 to UTC+11 on 2014-12-28 at 02:00


author: Patsy Franklin <pfrankli@redhat.com> - 2014j-1
changelog:
  - Rebase to 2014j
    - Turks & Caicos' switch from US eastern time to UTC-4 year-round
      did not occur on 2014-11-02 at 02:00.  It's currently scheduled
      for 2015-11-01 at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2015a-1
changelog:
  - Rebase to 2015a
    - New leap second 2015-06-30 23:59:60 UTC as per IERS Bulletin C 49.
    - The Mexican state of Quintana Roo, represented by America/Cancun,
      will shift from Central Time with DST to Eastern Time without DST
      on 2015-02-01 at 02:00.
    - Chile will not change clocks in April or thereafter; its new standard time
      will be its old daylight saving time.  This affects America/Santiago,
      Pacific/Easter, and Antarctica/Palmer.


author: Patsy Franklin <pfrankli@redhat.com> - 2015b-1
changelog:
  - Rebase to 2015b
    - Mongolia will start observing DST again this year, from the last
      Saturday in March at 02:00 to the last Saturday in September at 00:00.
    - Palestine will start DST on March 28, not March 27.  Also,
      correct the fall 2014 transition from September 26 to October 24.
      Adjust future predictions accordingly.


author: Patsy Franklin <pfrankli@redhat.com> - 2015c-1
changelog:
  - Rebase to 2015c
    - Egypt's spring-forward transition is at 24:00 on April's last Thursday,
      not 00:00 on April's last Friday.  2015's transition will therefore be on
      Thursday, April 30 at 24:00, not Friday, April 24 at 00:00.  Similar fixes
      apply to 2026, 2037, 2043, etc.  (Thanks to Steffen Thorsen.)
  - Rebase javazic tool to match latest upstream OpenJDK version


author: Patsy Franklin <pfrankli@redhat.com> - 2015d-1
changelog:
  - Rebase to 2015d
    - Egypt will not observe DST in 2015 and will consider canceling it
      permanently.  For now, assume no DST indefinitely.
    - The abbreviations for Hawaii-Aleutian standard and daylight times
      have been changed from HAST/HADT to HST/HDT, as per US Government
      Printing Office style.  This affects only America/Adak since 1983,
      as America/Honolulu was already using the new style.


author: Patsy Franklin <pfrankli@redhat.com> - 2015d-3
changelog:
  - Morocco will suspend DST from 2015-06-14 03:00 through 2015-07-19 02:00,
    not 06-13 and 07-18 as we had guessed.


author: Patsy Franklin <pfrankli@redhat.com> - 2015e-1
changelog:
  - Morocco will suspend DST from 2015-06-14 03:00 through 2015-07-19 02:00,
    not 06-13 and 07-18 as we had guessed.
  - Assume Cayman Islands will observe DST starting next year, using US rules.
    Although it isn't guaranteed, it is the most likely.


author: Patsy Franklin <pfrankli@redhat.com> - 2015f-1
changelog:
  - Rebase to 2015f
    - North Korea switches to +0830 on 2015-08-15.
      The abbreviation remains "KST".
    - Uruguay no longer observes DST.


author: Patsy Franklin <pfrankli@redhat.com> - 2015g-1
changelog:
  - Rebase to 2015g
    - Turkey's 2015 fall-back transition is scheduled for Nov. 8, not Oct. 25.
    - Norfolk moves from +1130 to +1100 on 2015-10-04 at 02:00 local time.
    - Fiji's 2016 fall-back transition is scheduled for January 17, not 24.
    - Fort Nelson, British Columbia will not fall back on 2015-11-01.  It has
      effectively been on MST (-0700) since it advanced its clocks on 2015-03-08.
      New zone America/Fort_Nelson.


author: Patsy Franklin <pfrankli@redhat.com> - 2016a-1
changelog:
  - Rebase to 2016a
    - America/Cayman will not observe daylight saving this year after all.
      Revert our guess that it would.
    - Asia/Chita switches from +0800 to +0900 on 2016-03-27 at 02:00.
    - Asia/Tehran now has DST predictions for the year 2038 and later,
      to be March 21 00:00 to September 21 00:00.  This is likely better
      than predicting no DST, albeit off by a day every now and then.


author: Patsy Franklin <pfrankli@redhat.com> - 2016b-1
changelog:
  - Rebase to 2016b
    - New zones Europe/Astrakhan and Europe/Ulyanovsk for Astrakhan and
      Ulyanovsk Oblasts, Russia, both of which will switch from +03 to +04 on
      2016-03-27 at 02:00 local time.  They need distinct zones since their
      post-1970 histories disagree.  New zone Asia/Barnaul for Altai Krai and
      Altai Republic, Russia, which will switch from +06 to +07 on the same date
      and local time.  The Astrakhan change is already official; the others have
      passed the first reading in the State Duma and are extremely likely.
      Also, Asia/Sakhalin moves from +10 to +11 on 2016-03-27 at 02:00.
    - As a trial of a new system that needs less information to be made up,
      the new zones use numeric time zone abbreviations like "+04"
      instead of invented abbreviations like "ASTT".
    - Haiti will not observe DST in 2016.
    - Palestine's spring-forward transition on 2016-03-26 is at 01:00, not 00:00.
      Guess future transitions will be March's last Saturday at 01:00, not March's
      last Friday at 24:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2016c-1
changelog:
  - Rebase to 2016c
    - Azerbaijan no longer observes DST.
    - Chile changes from permanent DST to seasonal DST.


author: Patsy Franklin <pfrankli@redhat.com> - 2016d-1
changelog:
  - Rebase to 2016d
    - America/Caracas switches from -0430 to -04 on 2016-05-01 at 02:30.
    - Asia/Magadan switchefrom +10 to +11 on 2016-04-24 at 02:00.
    - New zone Asia/Tomsk, split off from Asia/Novosibirsk.  It covers
      Tomsk Oblast, Russia, which switches from +06 to +07 on 2016-05-29
      at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2016f-1
changelog:
  - Rebase to 2016f
    - Egypt cancelled DST.
    - Asia/Novosibirsk transitions from +06 to +07 on 2016-07-24 at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2016g-1
changelog:
  - Rebase to 2016g
    - Turkey permanently switches from +02 to +03 as of 2016-09-07,
    - Per IERS Bulletin C 52, leap second to be added on 2016-09-31 at 23:59:60.


author: Patsy Franklin <pfrankli@redhat.com> - 2016h-1
changelog:
  - Rebase to 2016h
    - DST ends in Asia/Gaza and Asia/Hebron on 2016-10-29 at 01:00,
      not the predicted date of 2016-10-21 at 00:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2016i-1
changelog:
  - Rebase to 2016i
    - Pacific/Tongatapu now begins DST on 2016-11-06 at 02:00 and ends
      on 2017-01-15 at 03:00.
    - Northern Cyprus is changed to +03 year round. This results in a
      split in Cyprus time zones starting 2016-10-30 at 04:00 and
      creates a new zone - Asia/Famagusta.
    - Antarctica/Casey changed from +08 to +11 on 2016-10-22.


author: Patsy Franklin <pfrankli@redhat.com> - 2016j-1
changelog:
  - Rebase to 2016j
    - The Saratov Region of Russia is changing from +03 to +04 on
      2016-12-04, resulting in a new timezone Europe/Saratov.


author: Patsy Franklin <pfrankli@redhat.com> - 2017a-1
changelog:
  - Rebase to tzdata-2017a
    - Mongolia no longer observes DST
    - Magallanes region of Chile moves from -04/-03 to -03 year round.
      This results in a new zone, America/Punta_Arenas.


author: Patsy Franklin <pfrankli@redhat.com> - 2017c-1
changelog:
  - Rebase to tzdata-2017c.
    - Northern Cyprus will revert to using EQ rules on October 29, 2017.
    - Sudan will switch from +03 to +02 on November 1, 2017.
    - Tonga will not change it's clocks on Novemeber 5, 2017 ending it's
      experiment with DST.
    - Fiji DST will end on January 14, 2018 rather than January 21, 2018.
    - Namibia - starting September 3, 2017 switches from +)1 with DST to
      +02 all year.  This change takes effect April 1, 2018.
    - Turks & Caicos changes from -04 all year to -05 with US DST starting
      on March 11, 2018.  Effective change date is November 4, 2018.
    - tzdata now includes two text versions of the time zone data - tzdata.zi
      and leapseconds.
    - Includes two patches to deal with build issues.


author: Patsy Franklin <pfrankli@redhat.com> - 2018c-1
changelog:
  - Rebase to tzdata-2018c:
    - São Tomé and Príncipe changed from +00 to +01 on January 1, 2018
    - Brazil's DST will start on the first Sunday in November
    - Support for the new zic -t option.
    - Add back pacificnew file omitted in tzdata-2018a


author: Patsy Franklin <pfrankli@redhat.com> - 2018d-1
changelog:
  - Rebase to tzdata-2018d:
    - DST for Asia/Gaza and Asia/Hebron has changed 
      from March 31 to March 24.
    - Antarctica/Casey station changed to UTC+8 on March 11.


author: Patsy Franklin <pfrankli@redhat.com> - 2018e-1
changelog:
  - Rebase to tzdata-2018e
    - North Korea changed from UTC+8:30 to UTC+9 on May 5, 2018.
    - In this update, the upstream project now defaults to using
      the "vanguard" data implementation which includes negative DST offsets.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018g-1
changelog:
  - Rebase to tzdata-2018g
    - Morocco will remain at UTC+1 rather than switching back to UTC+0 as
      planned.  This change is effective Octobober 28, 2018.
  - Include changes introduced in tzdata-2018f
    - Volgograd will change from UTC+03 to UTC+04 on 2018-10-28 at 02:00.
    - Fiji will end DST on 2019-01-13 instead of the 2019-01-20 as
      previously predicted.
    - Most of Chile will end DST on the first Saturday in April at 24:00
      and restart DST on the first Saturday in September at 24:00.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018i-1
changelog:
  - Rebase to tzdata-2018i (includes changes from tzdata-2018h)
    - São Tomé and Príncipe changed from UTC+01 to UTC+00 on 2019-01-01.
    - Qyzylorda, Kazakhstan changed from UTC+06 to UTC+05 on 2018-12-21.
    - Created a new zone Asia/Qostanay since Qostanay, Kazakhstan didn't 
      transition with the Qyzylorda change.
    - Metlakatla, Alaska will observe PST for this winter only.
    - Predict that Morocco will continue to adjust clocks around Ramadan.
    - Also include predictions for Iran from 2038 through 2090.


author: Patsy Griffin Franklin <patsy@redhat.com> - 2019a-1
changelog:
  - Rebase to tzdata-2019a
    - Palestine will start DST on 2019-03-30, rather than 2019-03-23 as
      previously predicted.
    - Metlakatla rejoined Alaska time on 2019-01-20, ending its observances
      of Pacific standard time.


author: Patsy Griffin <patsy@redhat.com> - 2019b-1
changelog:
  - Rebase to tzdata-2019b
    - Brazil will no longer observe DST going forward.
    - The 2019 spring transition for Palestine occurred 03-29, not 03-30.


author: Patsy Griffin <patsy@redhat.com> - 2019c-1
changelog:
  - Rebase to tzdata-2019c
    - Fiji will observe DST from 2019-11-10 to 2020-01-12.
    - Norfolk Island will begin observing Australian-style DST on 2019-10-06.


author: Patsy Griffin <patsy@redhat.com> - 2020a-1
changelog:
  - Rebase to tzdata-2020a
    - Morocco will spring forward on 2020-05-31 rather than
      previously predicted 2020-05-24.
    - Canada's Yukon region changed to year round UTC -07
      effective 2020-03-08.
    - America/Godthab was renamed to America/Nuuk.


author: Patsy Griffin <patsy@redhat.com> - 2020b-1
changelog:
  - Rebase to tzdata-2020b
    - Yukon timezones represented by America/Whitehorse and
      America/Dawson will change time zone rules from -08/-07 to
      permanent -07 on 2020-11-01, not on 2020-03-08 as 2020a had it.
    - The most recent winter(+08)/summer(+11) transition for Casey Station,
      Antarctica was 2020-10-04 00:01.
    - Remove obsolete files pacificnew, systemv, and yearistype.sh
      from the distribution.


author: Patsy Griffin <patsy@redhat.com> - 2020b-2
changelog:
  - Include the upstream patch to support pacificnew for java tzupdater.
  - Set POSIXRULES macro to continue installing posixrules file.


author: Patsy Griffin <patsy@redhat.com> - 2020c-1
changelog:
  - Rebase to tzdata-2020c
    - Fiji starts DST later than usual, on 2020-12-20.
    - Rearguard now provides an empty file pacificnew to support
      downstream software that expects it.


author: Patsy Griffin <patsy@redhat.com> - 2020d-1
changelog:
  - Rebase to tzdata-2020d
   - Palestine will end summer time on 2020-10-24 rather than the
     predicted 2020-10-31.


author: Patsy Griffin <patsy@redhat.com> - 2020f-1
changelog:
  - Rebase to tzdata-2020f including changes for tzdata-2020e
    - tzdata-2020f fixes a bug in tzdata-2020e that caused an
      invalid zi file in rearguard format
    - Volgograd changes time zone from UTC+04 to UTC+03 on 2020-12-27.
    - Australia/Currie is identical to Australia/Hobart for all
      timestamps since 1970 and was therefore created by mistake,
      now moved to the "backward" file.


author: Patsy Griffin <patsy@redhat.com> - 2021c-1
changelog:
  - Rebase to tzdata-2021c - supersedes tzdata-2021b
    - Revert most of 2021b changes to 'backward'.
    - Fix 'zic -b fat' bug in pre-1970 32-bit data.
    - Fix two Link line typos.
    - Distribute SECURITY file.
  - Includes changes in tzdata-2021b
    - Innclude patch for Mayen
    - Jordan now starts DST on February's last Thursday.
    - Samoa no longer observes DST.
    - Merge more location-based Zones whose timestamps agree since 1970.
    - Move some backward-compatibility links to 'backward'.
    - Rename Pacific/Enderbury to Pacific/Kanton.
    - Correct many pre-1993 transitions in Malawi, Portugal, etc.
    - zic now creates each output file or link atomically.
    - zic -L no longer omits the POSIX TZ string in its output.
    - zic fixes for truncation and leap second table expiration.
    - zic now follows POSIX for TZ strings using all-year DST.
    - Fix some localtime crashes and bugs in obscure cases.
    - zdump -v now outputs more-useful boundary cases.
    - tzfile.5 better matches a draft successor to RFC 8536.


author: Patsy Griffin <patsy@redhat.com> - 2021e-1
changelog:
  - Rebase to tzdata-2021e - supersedes tzdata-2021d
    - Pacific/Fiji suspended DST for the 2021/2022 season.
    - 'zic -r' now marks unspecified timestamps with "-00".
    - Palestine will fall back 2021-10-29 at 01:00, rather
      than the predicted 2021-10-30.


author: Patsy Griffin <patsy@redhat.com> - 2022a-1
changelog:
  - Rebase to tzdata-2022a
    - Palestine springs forward on 2022-03-27, not -03-26.
    - zdump -v now outputs better failure information
    - fixes for code that reads corrupted TZif data


author: Patsy Griffin <patsy@redhat.com> - 2022b-1
changelog:
  - Rebase to tzdata-2022b
    - Chile transitions to DST on 2022-09-11, not 2022-09-04
    - 'make install' now defaults LOCALTIME to Factory rather than GMT
    - More zones that are the same since 1970 have been moved to backzone.
    - Include patch for awk workaround.


author: Patsy Griffin <patsy@redhat.com> - 2022c-1
changelog:
  - Rebase to tzdata-2022c - supersedes tzdata-2022b
    - Add a work-around for an awk bug in FreeBSD, macOS, etc.
    - Improve tzselect with respect to intercontinental Zones.


author: Patsy Griffin <patsy@redhat.com> - 2022f-1
changelog:
  - Rebase to tzdata-2022f
    - Mexico will stop observing DST except near the US border.
    - Chihuahua moved to -06 year round starting on 2022-10-30.
    - Fiji no longer observes DST.


author: Patsy Griffin <patsy@redhat.com> - 2022g-1
changelog:
  - Rebase to tzdata-2022g
    - The northern edge of the Mexican state of Chihuahua will
      change time zone to agree with nearby US locations on
      2022-11-30.
    - Added a new Zone America/Ciudad_Juarez that splits from
      America/Ojinaga.


author: Patsy Griffin <patsy@redhat.com> - 2023a-1
changelog:
  - Rebase to tzdata-2023a
    - Egypt reintroduced DST, from April through October.
    - Morocco springs forward April 23, not April 30.
    - Palestine delayed the start of DST this year.


author: Patsy Griffin <patsy@redhat.com> - 2025b-1
changelog:
  - Update to tzdata-2025b (RHEL-84748)
    - Chile's Aysén Region moves from -04/-03
      to -03 year-round, diverging from America/Santiago and
      creating a new zone America/Coyhaique.


author: Patsy Griffin <patsy@redhat.com> - 2026a-1
changelog:
  - Update to tzdata-2026a (RHEL-154033)
    - Correct the transition times for Moldova.
    - The POSIXRULES option is now obsolete.


author: Patsy Griffin <patsy@redhat.com> - 2026b-1
changelog:
  - Update to tzdata-2026b (RHEL-170797)
    - British Columbia’s 2026-03-08 spring forward is expected
      to be its last transition as it moves to permanent -07.


author: Kamil Dudka <kdudka@redhat.com> - 2.17-5
changelog:
  - do not update currency.units from network during build
  - units_cur: validate rate data from server (#1598913)


author: Jakub Martisko <jamartis@redhat.com> - 6.0-40
changelog:
  - fix several possibly unterminated strings
    When copying to OEM_CP and ISO_CP strings, the string could end unterminated
    (stncpy does not append '\0').
  - Related: #1602721


author: Jakub Martisko <jamartis@redhat.com> - 6.0-47
changelog:
  - Fix: Unzip Fails on Large Zip Files
  - Use the patch from Debian dealing with this
  Resolves: RHEL-45997


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - 5.42
  - Don't strip binaries explicitly
  - build without assembly, it doesn't seem to increase performance
  - make it respect RPM_OPT_FLAGS, define _GNU_SOURCE
  - use %{_tmppath}
  - "License:" replaces "Copyright:"
  - Update URL
  - include zipgrep
  - COPYING doesn't exist anymore, include LICENSE instead


author: Lon Hohberger <lhh@redhat.com> 5.50-18
changelog:
  - SECURITY: Incorporate far cleaner patch from Ben Laurie
  <ben@algroup.co.uk> which also fixes ^V/ (quote-slash).
  Patch checks post-decode as opposed to inline as previous
  patch does.


author: Lon Hohberger <lhh@redhat.com> 5.50-30
changelog:
  - SECURITY Round 3: Fix up original patch (from 5.50-9) to fix
  ^V/ exploit, but still allow '-:', which the other patch (5.50-18)
  does not allow.  Never allow explicit writing to the root
  directory; force users to change there and extract it manually.


author: Ivana Varekova <varekova@redhat.com> 5.52-2
changelog:
  - fix bug 180078 - unzip -l causing error
  - fix CVE-2005-4667 - unzip long file name buffer overflow


author: Karel Klic <kklic@redhat.com> - 6.0-1
changelog:
  - New upstream version
  - Compiled using `make generic_gcc` (includes asm)
  - Removed unzip542-rpmoptflags.patch, because RPM_OPT_FLAGS
    are provided using command line
  - Removed unzip-5.51-link-segv.patch, because the link file
    is not reopened in the current version
  - Removed unzip-5.51-link-segv2.patch, the bug was already fixed
    in open_outfile in 5.52
  - Removed unzip-5.52-toctou.patch (CAN-2005-2475), the vulnerability
    is fixed in the current version
  - Removed unzip-5.52-near-4GB.patch, unzip-5.52-near-4GB2.patch,
    unzip-5.52-4GB3.patch, and unzip-5.52-4GB_types.patch, because
    the current version supports large files
  - Removed unzip-5.52-long-filename.patch, the current version
    fixes the vulnerability by checking the length of command line
    arguments in unzip.c
  - Removed unzip-5.52-makefile.patch, because we no longer create
    the link manually
  - Removed unzip-5.52-open.patch, the current version uses umask.
  - Removed unzip-5.52-cve-2008-0888.patch, the current version
    fixes this vulnerability
  - Ported unzip-5.52-249057.patch to current version (unzip-6.0-close)


author: Karel Klic <kklic@redhat.com> - 6.0-2
changelog:
  - Fixed a buffer overflow (rhbz#532380, unzip-6.0-attribs-overflow.patch)
  - Generate debuginfos (rhbz#540220, unzip-6.0-nostrip.patch)


author: Fedora Release Engineering <rel-eng@lists.fedoraproject.org>
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild

  - Fix minor manpage spelling mistake
    Resolves: #675454


author: Tom Callaway <spot@fedoraproject.org> - 6.0-9
changelog:
  - Apply changes to match.c to sync with recmatch from util.c (from zip 3.0)
    This also resolves the license issue in that file.


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-13
changelog:
  - Solve problem with non-functional case-insensitive matching
    (#1104018)
  - Added patch for build option "-Werror=format-security"
    However solve only false positives - here is not really
    vulnerable print.


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-16
changelog:
  - Fix producing of incorrect output due to memcpy overlapping
    by added option -D NOMEMCPY to compile section.
    (#1153388)


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-17
changelog:
  - Fix unitialized reads (#558738)
  - Fix fix broken -X option - never worked before. Added -DIZ_HAVE_UXUIDGID
    option for compilation.
    (#935202)


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-19
changelog:
  - Fix CVE-2014-8139 - CRC32 verification heap-based buffer overread 
    (#1174844)
  - Fix CVE-2014-8140 - out-of-bounds write issue in test_compr_eb()
    (#1174851)
  - Fix CVE-2014-8141 - getZip64Data() out-of-bounds read issues
    (#1174856)
  - Fix buffer overflow on long file sizes
    (#1191136)


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-29
changelog:
  - added build parameter "-DNO_LCHMOD" because lchmod isn't provided on Linux
    system
    Resolves: #1350627


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-30
changelog:
  - rename patch unzip-6.0-nostrip.patch to unzip-6.0-configure.patch
    so linking is now configurable from the spec file
  - define __global_ldflags on EL <= 7
  - set LFLAGS2 with __global_ldflags for hardened build
    Resolves: #1330519


author: Jakub Martisko <jamartis@redhat.com> - 6.0-38
changelog:
  - Fix CVE-2018-1000035 - heap based buffer overflow when opening
    password protected files.
    Resolves: 1537043


author: Miloslav Trmač <mitr@redhat.com> - 1.111-10
changelog:
  - Fix a FBFS with  -Werror=format-security
    Resolves #1444750
  - Fix inconsistent dates in %changelog


author: Jiri Kucera <jkucera@redhat.com> - 1.112-2
changelog:
  - Dropped need to run autotools
  - <sys/sysmacros.h> must be now included manually
    Resolves #1611752
  - Fixed bad FSF address


author: Jiri Kucera <jkucera@redhat.com> - 1.113-2
changelog:
  - Fix typo in pam-panel-icon manpage
    Do not use deprecated selinux API
    Do not use fexecve
    Resolves: #1775931


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.10.1-3
changelog:
  - Replace arch-dependent /usr/include/urcu/config.h with arch-independent
    stub when needed. (bz #1853168)
  - Added CI gating tests (bz #1682555)
  - Resolves: bz #1682555, #1853168


author: Karel Zak <kzak@redhat.com> 2.32.1-43
changelog:
  - fix #2117355 - Add additional documentation for fstab
  - fix #2184728 - libuuid - downport cache related patch
  - fix #2188894 - The swapon man page of -p(priority) option shows incorrect.
  - fix #2227097 - wall(1) fail when trying to use seat0


author: Karel Zak <kzak@redhat.com> 2.32.1-46
changelog:
  - fix RHEL-13741 - lscpu: avoid EBUSY on cpuinfo_max_freq
  - fix RHEL-18451 - logger: initialize socket credentials control union
  - fix RHEL-16070 - util-linux: issues in libblkid
  - fix RHEL-6274 - lslogins incorrect account expiration field


author: Weitao Zhou <zhouwt@linux.alibaba.com> 2.32.1-46.0.1
changelog:
  - [Patch] hwclock: better compatibility for both glibc2.28 and glibc2.31
  - [Patch] lscpu: add Neoverse-N2 to ARM identifiers tables (flin@linux.alibaba.com)
  - [Patch] lscpu: fix lscpu to get cpu frequency from cpuinfo on arm64 (flin@linux.alibaba.com)
  - cherry-pick `add sw patch #a16dca4d0754a5ae036dc6833523ff37429b3e60`. (nijie@wxiat.com)
  - [Bugfix]:prlimit fix optional arguments parsing (songkai01@inpsur.com)


author: Michael K. Johnson <johnsonm@redhat.com>
changelog:
  - pam.patch differentiated between different kinds of bad logins.
    In particular, "user does not exist" and "bad password" were treated
    differently.  This was a minor security hole.


author: Erik Troan <ewt@redhat.com>
changelog:
  - Merged Red Hat changes into main util-linux source, updated package to
    development util-linux (nearly 2.7).


author: Erik Troan <ewt@redhat.com>
changelog:
  - updated MCONFIG to automatically determine the architecture
  - added glibc header hacks to fdisk code
  - rdev is only available on the intel


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - patch top build on the arm without PAM and related utilities, for now.
  - build hwclock only on intel


author: Michael K. Johnson <johnsonm@redhat.com>
changelog:
  - .perms patch to login to make it retain root in parent process
    for pam_close_session to work correctly


author: Jakub Jelinek <jj@ultra.linux.cz>
changelog:
  - if hwclock is to be compiled on sparc,
    it must actually work. Also, it should obsolete
    clock, otherwise it clashes.
  - limit the swap size in mkswap for 2.2.1+ kernels
    by the actual maximum size kernel can handle.
  - fix kbdrate on sparc, patch by J. S. Connell
    <ankh@canuck.gen.nz>


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - include sfdisk (#1164)
  - fix write (#1784)
  - use positive logic in spec file (ifarch rather than ifnarch).
  - (re)-use 1st matching utmp slot if search by mypid not found.
  - update to 2.9o
  - lastb wants bad logins in wtmp clone /var/run/btmp (#884)


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - update to 2.9t:
  - national language support for hwclock
  - Japanese messages (both by Daisuke Yamashita)
  - German messages and some misc i18n fixes (Elrond)
  - Czech messages (Jiri Pavlovsky)
  - wall fixed for /dev/pts/xx ttys
  - make last and wall use getutent() (Sascha Schumann)
  	[Maybe this is bad: last reading all of wtmp may be too slow.
  	Revert in case people complain.]
  - documented UUID= and LABEL= in fstab.5
  - added some partition types
  - swapon: warn only if verbose


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - update to 2.9u:
  - Czech more.help and messages (Jiri Pavlovsky)
  - Japanese messages (Daisuke Yamashita)
  - fdisk fix (Klaus G. Wagner)
  - mount fix (Hirokazu Takahashi)
  - agetty: enable hardware flow control (Thorsten Kranzkowski)
  - minor cfdisk improvements
  - fdisk no longer accepts a default device
  - Makefile fix


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - update to 2.9v:
  - cfdisk no longer believes the kernel's HDGETGEO
  	(and may be able to partition a 2 TB disk)


author: Christian 'Dr. Disk' Hechelmann <drdisk@tc-gruppe.de>
changelog:
  - added locale message catalogs to %file
  - added patch for non-root build
  - vigr.8 and /usr/lib/getopt  man-page was missing from file list
  - /etc/fdprm really is a config file


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - hostid is now in sh-utils. On sparc, install hostid as sunhostid (#4581).
  - update to 2.9w:
  -  Updated mount.8 (Yann Droneaud)
  -  Improved makefiles
  -  Fixed flaw in fdisk


author: Matt Wilson <msw@redhat.com>
changelog:
  - updated to util-linux 2.10c
  - deprecated IMAP login mail notification patch17
  - deprecated raw patch22
  - depricated readprofile patch24


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - raw control file was /dev/raw, now /dev/rawctl.
  - raw access files were /dev/raw*, now /dev/raw/raw*.


author: Matt Wilson <msw@redhat.com>
changelog:
  - use snprintf - not sprintf - when doing
    sprintf ("%s\n", _("Some string")) to avoid overflows and
    segfaults.


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - update to 2.10o
  -  fdformat: fixed to work with kernel 2.4.0test6 (Marek Wojtowicz)
  -  login: not installed suid
  -  getopt: by default install aux files in /usr/share/misc
  - update to 2.10n:
  -  added blockdev.8
  -  change to elvtune (andrea)
  -  fixed overrun in agetty (vii@penguinpowered.com)
  -  shutdown: prefer umounting by mount point (rgooch)
  -  fdisk: added plan9
  -  fdisk: remove empty links in chain of extended partitions
  -  hwclock: handle both /dev/rtc and /dev/efirtc (Bill Nottingham)
  -  script: added -f (flush) option (Ivan Schreter)
  -  script: added -q (quiet) option (Per Andreas Buer)
  -  getopt: updated to version 1.1.0 (Frodo Looijaard)
  -  Czech messages (Jiri Pavlovsky)
  - login.1 man page had not /var/spool/mail path (#16998).
  - sln.8 man page (but not executable) included (#10601).
  - teach fdisk 0xde(Dell), 0xee(EFI GPT), 0xef(EFI FAT) partitions (#17610).


author: Erik Troan <ewt@redhat.com>
changelog:
  - fixed problem w/ empty extended partitions
  - added patch to fix the date in the more man page
  - set OPT to pass optimization flags to make rather then RPM_OPT_FLAG
  - fixed fdisk -l /Proc/partitions parsing
  - updated to 2.10s


author: Erik Troan <ewt@redhat.com>
changelog:
  - updated kill man page
  - added patch to fix vipw race
  - updated vipw to edit /etc/shadow and /etc/gshadow, if appropriate
  - added patch to disassociate login from tty, session, and pgrp


author: Tim Powers <timp@redhat.com>
changelog:
  - fixed bug #29131, where ipc.info didn't have an info dir entry,
    added the dir entry to ipc.texi (Patch58)


author: Matt Wilson <msw@redhat.com>
changelog:
  - patched mkcramfs to use the PAGE_SIZE from asm/page.h instead of hard
    coding 4096 (fixes mkcramfs on alpha...)


author: Matt Wilson <msw@redhat.com>
changelog:
  - changed Requires: kernel >= 2.2.12-7 to Conflicts: kernel < 2.2.12-7
    (fixes a initscripts -> util-linux -> kernel -> initscripts prereq loop)


author: Erik Troan <ewt@redhat.com>
changelog:
  - upgraded to 2.11a (kbdrate moved to kbd, among other things)
  - turned off ALLOW_VCS_USE
  - modified mkcramfs to not use a large number of file descriptors
  - include mkfs.bfs


author: Bernhard Rosenkraenzer <bero@redhat.com> 2.11a-3
changelog:
  - Fix up login - exiting immediately even if the password is correct
    is not exactly a nice feature.
  - Make definite plans to kill people who update login without checking
    if the new version works ;)


author: Bernhard Rosenkraenzer <bero@redhat.com> 2.11b-1
changelog:
  - Fix up login for real (a console session should be the controlling tty)
    by reverting to 2.10s code (#36839, #36840, #39237)
  - Add man page for agetty (#39287)
  - 2.11b, while at it


