# changelog

author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-5
changelog:
  - Fix systemd_manage_unit_symlinks() interface
  - Call systemd_manage_unit_symlinks(() which is correct interface
  - Add filename transition for opasswd
  - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock
  - Allow sytstemd-timedated to get status of init_t
  - Add new systemd policies for hostnamed and rename gnomeclock_t to systemd_timedate_t
  - colord needs to communicate with systemd and systemd_logind, also remove duplicate rules
  - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock
  - Allow gpg_t to manage all gnome files
  - Stop using pcscd_read_pub_files
  - New rules for xguest, dontaudit attempts to dbus chat
  - Allow firewalld to create its mmap files in tmpfs and tmp directories
  - Allow firewalld to create its mmap files in tmpfs and tmp directories
  - run unbound-chkconf as named_t, so it can read dnssec
  - Colord is reading xdm process state, probably reads state of any apps that sends dbus message
  - Allow mdadm_t to change the kernel scheduler
  - mythtv policy
  - Update mandb_admin() interface
  - Allow dsspam to listen on own tpc_socket
  - seutil_filetrans_named_content needs to be optional
  - Allow sysadm_t to execute content in his homedir
  - Add attach_queue to tun_socket, new patch from Paul Moore
  - Change most of selinux configuration types to security_file_type.
  - Add filename transition rules for selinux configuration
  - ssh into a box with -X -Y requires ssh_use_ptys
  - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on
  - Allow all unpriv userdomains to send dbus messages to hostnamed and timedated
  - New allow rules found by Tom London for systemd_hostnamed


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-4
changelog:
  - Allow systemd-tmpfiles to relabel lpd spool files
  - Ad labeling for texlive bash scripts
  - Add xserver_filetrans_fonts_cache_home_content() interface
  - Remove duplicate rules from *.te
  - Add support for /var/lock/man-db.lock
  - Add support for /var/tmp/abrt(/.*)?
  - Add additional labeling for munin cgi scripts
  - Allow httpd_t to read munin conf files
  - Allow certwatch to read meminfo
  - Fix nscd_dontaudit_write_sock_file() interfac
  - Fix gnome_filetrans_home_content() to include also "fontconfig" dir as cache_home_t
  - llow mozilla_plugin_t to create HOMEDIR/.fontconfig with the proper labeling


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-3
changelog:
  - Allow gnomeclock to talk to puppet over dbus
  - Allow numad access discovered by Dominic
  - Add support for HOME_DIR/.maildir
  - Fix attribute_role for mozilla_plugin_t domain to allow staff_r to access this domain
  - Allow udev to relabel udev_var_run_t lnk_files
  - New bin_t file in mcelog


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-2
changelog:
  - Remove all mcs overrides and replace with t1 != mcs_constrained_types
  - Add attribute_role for iptables
  - mcs_process_set_categories needs to be called for type
  - Implement additional role_attribute statements
  - Sodo domain is attempting to get the additributes of proc_kcore_t
  - Unbound uses port 8953
  - Allow svirt_t images to compromise_kernel when using pci-passthrough
  - Add label for dns lib files
  - Bluetooth aquires a dbus name
  - Remove redundant files_read_usr_file calling
  - Remove redundant files_read_etc_file calling
  - Fix mozilla_run_plugin()
  - Add role_attribute support for more domains


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-69
changelog:
  - Add systemd_status_all_unit_files() interface
  - Add support for nshadow
  - Allow sysadm_t to administrate the postfix domains
  - Add interface to setattr on isid directories for use by tmpreaper
  - Allow sshd_t sys_admin for use with afs logins
  - Allow systemd to read/write all sysctls
  - Allow sshd_t sys_admin for use with afs logins
  - Allow systemd to read/write all sysctls
  - Add systemd_status_all_unit_files() interface
  - Add support for nshadow
  - Allow sysadm_t to administrate the postfix domains
  - Add interface to setattr on isid directories for use by tmpreaper
  - Allow sshd_t sys_admin for use with afs logins
  - Allow systemd to read/write all sysctls
  - Allow sshd_t sys_admin for use with afs logins
  - Add labeling for /var/named/chroot/etc/localtim


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-68
changelog:
  - Allow setroubleshoot_fixit to execute rpm
  - zoneminder needs to connect to httpd ports where remote cameras are listening
  - Allow firewalld to execute content created in /run directory
  - Allow svirt_t to read generic certs
  - Dontaudit leaked ps content to mozilla plugin
  - Allow sshd_t sys_admin for use with afs logins
  - Allow systemd to read/write all sysctls
  - init scripts are creating systemd_unit_file_t directories


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-67
changelog:
  - systemd_logind_t is looking at all files under /run/user/apache
  - Allow systemd to manage all user tmp files
  - Add labeling for /var/named/chroot/etc/localtime
  - Allow netlabel_peer_t type to flow over netif_t and node_t, and only be hindered by MLS, need back port to RHEL6
  - Keystone is now using a differnt port
  - Allow xdm_t to use usbmuxd daemon to control sound
  - Allow passwd daemon to execute gnome_exec_keyringd
  - Fix chrome_sandbox policy
  - Add labeling for /var/run/checkquorum-timer
  - More fixes for the dspam domain, needs back port to RHEL6
  - More fixes for the dspam domain, needs back port to RHEL6
  - sssd needs to connect to kerberos password port if a user changes his password
  - Lots of fixes from RHEL testing of dspam web
  - Allow chrome and mozilla_plugin to create msgq and semaphores
  - Fixes for dspam cgi scripts
  - Fixes for dspam cgi scripts
  - Allow confine users to ptrace screen
  - Backport virt_qemu_ga_t changes from RHEL
  - Fix labeling for dspam.cgi needed for RHEL6
  - We need to back port this policy to RHEL6, for lxc domains
  - Dontaudit attempts to set sys_resource of logrotate
  - Allow corosync to read/write wdmd's tmpfs files
  - I see a ptrace of mozilla_plugin_t by staff_t, will allow without deny_ptrace being set
  - Allow cron jobs to read bind config for unbound
  - libvirt needs to inhibit systemd
  - kdumpctl needs to delete boot_t files
  - Fix duplicate gnome_config_filetrans
  - virtd_lxc_t is using /dev/fuse
  - Passenger needs to create a directory in /var/log, needs a backport to RHEL6 for openshift
  - apcupsd can be setup to listen to snmp trafic
  - Allow transition from kdumpgui to kdumpctl
  - Add fixes for munin CGI scripts
  - Allow deltacloud to connect to openstack at the keystone port
  - Allow domains that transition to svirt domains to be able to signal them
  - Fix file context of gstreamer in .cache directory
  - libvirt is communicating with logind
  - NetworkManager writes to the systemd inhibit pipe


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-66
changelog:
  - Allow munin disk plugins to get attributes of all directories
  - Allow munin disk plugins to get attributes of all directorie
  - Allow logwatch to get attributes of all directories
  - Fix networkmanager_manage_lib() interface
  - Fix gnome_manage_config() to allow to manage sock_file
  - Fix virtual_domain_context
  - Add support for dynamic DNS for DHCPv6


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-65
changelog:
  - Allow svirt to use netlink_route_socket which was a part of auth_use_nsswitch
  - Add additional labeling for /var/www/openshift/broker
  - Fix rhev policy
  - Allow openshift_initrc domain to dbus chat with systemd_logind
  - Allow httpd to getattr passenger log file if run_stickshift
  - Allow consolehelper-gtk to connect to xserver
  - Add labeling for the tmp-inst directory defined in pam_namespace.conf
  - Add lvm_metadata_t labeling for /etc/multipath


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-63
changelog:
  - Add label for efivarfs
  - Allow certmonger to send signal to itself
  - Allow plugin-config to read own process status
  - Add more fixes for pacemaker
  - apache/drupal can run clamscan on uploaded content
  - Allow chrome_sandbox_nacl_t to read pid 1 content


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-62
changelog:
  - Fix MCS Constraints to control ingres and egres controls on the network.
  - Change name of svirt_nokvm_t to svirt_tcg_t
  - Allow tuned to request the kernel to load kernel modules


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-61
changelog:
  - Label /var/lib/pgsql/.ssh as ssh_home_t
  - Add labeling for /usr/bin/pg_ctl
  - Allow systemd-logind to manage keyring user tmp dirs
  - Add support for 7389/tcp port
  - gems seems to be placed in lots of places
  - Since xdm is running a full session, it seems to be trying to execute lots of executables via dbus
  - Add back tcp/8123 port as http_cache port
  - Add ovirt-guest-agent\.pid labeling
  - Allow xend to run scsi_id
  - Allow rhsmcertd-worker to read "physical_package_id"
  - Allow pki_tomcat to connect to ldap port
  - Allow lpr to read /usr/share/fonts
  - Allow open file from CD/DVD drive on domU
  - Allow munin services plugins to talk to SSSD
  - Allow all samba domains to create samba directory in var_t directories
  - Take away svirt_t ability to use nsswitch
  - Dontaudit attempts by openshift to read apache logs
  - Allow apache to create as well as append _ra_content_t
  - Dontaudit sendmail_t reading a leaked file descriptor
  - Add interface to have admin transition /etc/prelink.cache to the proper label
  - Add sntp support to ntp policy
  - Allow firewalld to dbus chat with devicekit_power
  - Allow tuned to call lsblk
  - Allow tor to read /proc/sys/kernel/random/uuid
  - Add tor_can_network_relay boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-60
changelog:
  - Add openshift_initrc_signal() interface
  - Fix typos
  - dspam port is treat as spamd_port_t
  - Allow setroubleshoot to getattr on all executables
  - Allow tuned to execute profiles scripts in /etc/tuned
  - Allow apache to create directories to store its log files
  - Allow all directories/files in /var/log starting with passenger to be labeled passenger_log_t
  - Looks like apache is sending sinal to openshift_initrc_t now,needs back port to RHEL6
  - Allow Postfix to be configured to listen on TCP port 10026 for email from DSPAM
  - Add filename transition for /etc/tuned/active_profile
  - Allow condor_master to send mails
  - Allow condor_master to read submit.cf
  - Allow condor_master to create /tmp files/dirs
  - Allow condor_mater to send sigkill to other condor domains
  - Allow condor_procd sigkill capability
  - tuned-adm wants to talk with tuned daemon
  - Allow kadmind and krb5kdc to also list sssd_public_t
  - Allow accountsd to dbus chat with init
  - Fix git_read_generic_system_content_files() interface
  - pppd wants sys_nice by nmcli because of "syscall=sched_setscheduler"
  - Fix mozilla_plugin_can_network_connect to allow to connect to all ports
  - Label all munin plugins which are not covered by munin plugins policy  as unconfined_munin_plugin_exec_t
  - dspam wants to search /var/spool for opendkim data
  - Revert "Add support for tcp/10026 port as dspam_port_t"
  - Turning on labeled networking requires additional access for netlabel_peer_t; these allow rules need to be back ported to RHEL6
  - Allow all application domains to use fifo_files passed in from userdomains, also allow them to write to tmp_files inherited from userdomain
  - Allow systemd_tmpfiles_t to setattr on mandb_cache_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-58
changelog:
  - Add back consolekit policy
  - Silence bootloader trying to use inherited tty
  - Silence xdm_dbusd_t trying to execute telepathy apps
  - Fix shutdown avcs when machine has unconfined.pp disabled
  - The host and a virtual machine can share the same printer on a usb device
  - Change oddjob to transition to a ranged openshift_initr_exec_t when run from oddjob
  - Allow abrt_watch_log_t to execute bin_t
  - Allow chrome sandbox to write content in ~/.config/chromium
  - Dontaudit setattr on fontconfig dir for thumb_t
  - Allow lircd to request the kernel to load module
  - Make rsync as userdom_home_manager
  - Allow rsync to search automount filesystem
  - Add fixes for pacemaker


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-57
changelog:
  - Add support for 4567/tcp port
  - Random fixes from Tuomo Soini
  - xdm wants to get init status
  - Allow programs to run in fips_mode
  - Add interface to allow the reading of all blk device nodes
  - Allow init to relabel rpcbind sock_file
  - Fix labeling for lastlog and faillog related to logrotate
  - ALlow aeolus_configserver to use TRAM port
  - Add fixes for aeolus_configserver
  - Allow snmpd to connect to snmp port
  - Allow spamd_update to create spamd_var_lib_t directories
  - Allow domains that can read sssd_public_t files to also list the directory
  - Remove miscfiles_read_localization, this is defined for all domains


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-56
changelog:
  - Allow syslogd to request the kernel to load a module
  - Allow syslogd_t to read the network state information
  - Allow xdm_dbusd_t connect to the system DBUS
  - Add support for 7389/tcp port
  - Allow domains to read/write all inherited sockets
  - Allow staff_t to read kmsg
  - Add awstats_purge_apache_log boolean
  - Allow ksysguardproces to read /.config/Trolltech.conf
  - Allow passenger to create and append puppet log files
  - Add puppet_append_log and puppet_create_log interfaces
  - Add puppet_manage_log() interface
  - Allow tomcat domain to search tomcat_var_lib_t
  - Allow pki_tomcat_t to connect to pki_ca ports
  - Allow pegasus_t to have net_admin capability
  - Allow pegasus_t to write /sys/class/net/<interface>/flags
  - Allow mailserver_delivery to manage mail_home_rw_t lnk_files
  - Allow fetchmail to create log files
  - Allow gnomeclock to manage home config in .kde
  - Allow bittlebee to read kernel sysctls
  - Allow logrotate to list /root


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-55
changelog:
  - Fix userhelper_console_role_template()
  - Allow enabling Network Access Point service using blueman
  - Make vmware_host_t as unconfined domain
  - Allow authenticate users in webaccess via squid, using mysql as backend
  - Allow gathers to get various metrics on mounted file systems
  - Allow firewalld to read /etc/hosts
  - Fix cron_admin_role() to make sysadm cronjobs running in the sysadm_t instead of cronjob_t
  - Allow kdumpgui to read/write to zipl.conf
  - Commands needed to get mock to build from staff_t in enforcing mode
  - Allow mdadm_t to manage cgroup files
  - Allow all daemons and systemprocesses to use inherited initrc_tmp_t files
  - dontaudit ifconfig_t looking at fifo_files that are leaked to it
  - Add lableing for Quest Authentication System


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-54
changelog:
  - Fix filetrans interface definitions
  - Dontaudit xdm_t to getattr on BOINC lib files
  - Add systemd_reload_all_services() interface
  - Dontaudit write access on /var/lib/net-snmp/mib_indexes 
  - Only stop mcsuntrustedproc from relableing files
  - Allow accountsd to dbus chat with gdm
  - Allow realmd to getattr on all fs
  - Allow logrotate to reload all services
  - Add systemd unit file for radiusd
  - Allow winbind to create samba pid dir
  - Add labeling for /var/nmbd/unexpected
  - Allow chrome and mozilla plugin to connect to msnp ports


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-53
changelog:
  - Fix storage_rw_inherited_fixed_disk_dev() to cover also blk_file
  - Dontaudit setfiles reading /dev/random
  - On initial boot gnomeclock is going to need to be set buy gdm
  - Fix tftp_read_content() interface
  - Random apps looking at kernel file systems
  - Testing virt with lxc requiers additional access for virsh_t
  - New allow rules requied for latest libvirt, libvirt talks directly to journald,lxc setup tool needs compromize_kernel,and we need ipc_lock in the container
  - Allow MPD to read /dev/radnom
  - Allow sandbox_web_type to read logind files which needs to read pulseaudio
  - Allow mozilla plugins to read /dev/hpet
  - Add labeling for /var/lib/zarafa-webap
  - Allow BOINC client to use an HTTP proxy for all connections
  - Allow rhsmertd to domain transition to dmidecod
  -  Allow setroubleshootd to send D-Bus msg to ABRT


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-52
changelog:
  - Define usbtty_device_t as a term_tty
  - Allow svnserve to accept a connection
  - Allow xend manage default virt_image_t type
  - Allow prelink_cron_system_t to overide user componant when executing cp
  - Add labeling for z-push
  - Gnomeclock sets the realtime clock
  - Openshift seems to be storing apache logs in /var/lib/openshift/.log/httpd
  - Allow lxc domains to use /dev/random and /dev/urandom


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-51
changelog:
  - Add port defintion for tcp/9000
  - Fix labeling for /usr/share/cluster/checkquorum to label also checkquorum.wdmd
  - Add rules and labeling for $HOME/cache/\.gstreamer-.* directory
  - Add support for CIM provider openlmi-networking which uses NetworkManager dbus API
  - Allow shorewall_t to create netlink_socket
  - Allow krb5admind to block suspend
  - Fix labels on /var/run/dlm_controld /var/log/dlm_controld
  - Allow krb5kdc to block suspend
  - gnomessytemmm_t needs to read /etc/passwd
  - Allow cgred to read all sysctls


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-50
changelog:
  - Allow all domains to read /proc/sys/vm/overcommit_memory
  - Make proc_numa_t an MLS Trusted Object
  - Add /proc/numactl support for confined users
  - Allow ssh_t to connect to any port > 1023
  - Add openvswitch domain
  - Pulseaudio tries to create directories in gnome_home_t directories
  - New ypbind pkg wants to search /var/run which is caused by sd_notify
  - Allow NM to read certs on NFS/CIFS using use_nfs_*, use_samba_* booleans
  - Allow sanlock to read /dev/random
  - Treat php-fpm with httpd_t
  - Allow domains that can read named_conf_t to be able to list the directories
  - Allow winbind to create sock files in /var/run/samba


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-49
changelog:
  - Add smsd policy
  - Add support for OpenShift sbin labelin
  - Add boolean to allow virt to use rawip
  - Allow mozilla_plugin to read all file systems with noxattrs support
  - Allow kerberos to write on anon_inodefs fs
  - Additional access required by fenced
  - Add filename transitions for passwd.lock/group.lock
  - UPdate man pages
  - Create coolkey directory in /var/cache with the correct label


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-48
changelog:
  - Fix label on /etc/group.lock
  - Allow gnomeclock to create lnk_file in /etc
  - label /root/.pki as a home_cert_t
  - Add interface to make sure rpcbind.sock is created with the correct label
  - Add definition for new directory /var/lib/os-probe and bootloader wants to read udev rules
  - opendkim should be a part of milter
  - Allow libvirt to set the kernel sched algorythm
  - Allow mongod to read sysfs_t
  - Add authconfig policy
  - Remove calls to miscfiles_read_localization all domains get this
  - Allow virsh_t to read /root/.pki/ content
  - Add label for log directory under /var/www/stickshift


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-47
changelog:
  - Allow getty to setattr on usb ttys
  - Allow sshd to search all directories for sshd_home_t content
  - Allow staff domains to send dbus messages to kdumpgui
  - Fix labels on /etc/.pwd.lock and friends to be passwd_file_t
  - Dontaudit setfiles reading urand
  - Add files_dontaudit_list_tmp() for domains to which we added sys_nice/setsched
  - Allow staff_gkeyringd_t to read /home/$USER/.local/share/keyrings dir
  - Allow systemd-timedated to read /dev/urandom
  - Allow entropyd_t to read proc_t (meminfo)
  - Add unconfined munin plugin
  - Fix networkmanager_read_conf() interface
  - Allow blueman to list /tmp which is needed by sys_nic/setsched
  - Fix label of /etc/mail/aliasesdb-stamp
  - numad is searching cgroups
  - realmd is communicating with networkmanager using dbus
  - Lots of fixes to try to get kdump to work


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-46
changelog:
  - Allow loging programs to dbus chat with realmd
  - Make apache_content_template calling as optional
  - realmd is using policy kit


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-45
changelog:
  - Add new selinuxuser_use_ssh_chroot boolean
  - dbus needs to be able to read/write inherited fixed disk device_t passed through it
  - Cleanup netutils process allow rule
  - Dontaudit leaked fifo files from openshift to ping
  - sanlock needs to read mnt_t lnk files
  - Fail2ban needs to setsched and sys_nice


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-44
changelog:
  - Change default label of all files in /var/run/rpcbind
  - Allow sandbox domains (java) to read hugetlbfs_t
  - Allow awstats cgi content to create tmp files and read apache log files
  - Allow setuid/setgid for cupsd-config
  - Allow setsched/sys_nice pro cupsd-config
  -  Fix /etc/localtime sym link to be labeled locale_t
  - Allow sshd to search postgresql db t since this is a homedir
  - Allow xwindows users to chat with realmd
  - Allow unconfined domains to configure all files and null_device_t service


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-42
changelog:
  - pki is leaking which we dontaudit until a pki code fix
  - Allow setcap for arping
  - Update man pages
  - Add labeling for /usr/sbin/mcollectived
  - pki fixes
  - Allow smokeping to execute fping in the netutils_t domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-41
changelog:
  - Allow mount to relabelfrom unlabeled file systems
  - systemd_logind wants to send and receive messages from devicekit disk over dbus to make connected mouse working
  - Add label to get bin files under libreoffice labeled correctly
  - Fix interface to allow executing of base_ro_file_type
  - Add fixes for realmd
  - Update pki policy
  - Add tftp_homedir boolean
  - Allow blueman sched_setscheduler
  - openshift user domains wants to r/w ssh tcp sockets


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-40
changelog:
  - Additional requirements for disable unconfined module when booting
  - Fix label of systemd script files
  - semanage can use -F /dev/stdin to get input
  - syslog now uses kerberos keytabs
  - Allow xserver to compromise_kernel access
  -  Allow nfsd to write to mount_var_run_t when running the mount command
  - Add filename transition rule for bin_t directories
  - Allow files to read usr_t lnk_files
  - dhcpc wants chown
  - Add support for new openshift labeling
  - Clean up for tunable+optional statements
  - Add labeling for /usr/sbin/mkhomedir_helper
  - Allow antivirus domain to managa amavis spool files
  - Allow rpcbind_t to read passwd 
  - Allow pyzor running as spamc to manage amavis spool


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-39
changelog:
  - Add interfaces to read kernel_t proc info
  - Missed this version of exec_all
  - Allow anyone who can load a kernel module to compromise kernel
  - Add oddjob_dbus_chat to openshift apache policy
  - Allow chrome_sandbox_nacl_t to send signals to itself
  - Add unit file support to usbmuxd_t
  - Allow all openshift domains to read sysfs info
  - Allow openshift domains to getattr on all domains


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-37
changelog:
  - Allow xdm to search all file systems
  - Add interface to allow the config of all files
  - Add rngd policy
  - Remove kgpg as a gpg_exec_t type
  - Allow plymouthd to block suspend
  - Allow systemd_dbus to config any file
  - Allow system_dbus_t to configure all services
  - Allow freshclam_t to read usr_files
  - varnishd requires execmem to load modules


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-36
changelog:
  - Allow semanage to verify types
  - Allow sudo domain to execute user home files
  - Allow session_bus_type to transition to user_tmpfs_t
  - Add dontaudit caused by yum updates
  - Implement pki policy but not activated


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-35
changelog:
  - tuned wants to getattr on all filesystems
  - tuned needs also setsched. The build is needed for test day


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-34
changelog:
  - Add policy for qemu-qa
  - Allow razor to write own config files
  -  Add an initial antivirus policy to collect all antivirus program
  - Allow qdisk to read usr_t
  - Add additional caps for vmware_host
  - Allow tmpfiles_t to setattr on mandb_cache_t
  - Dontaudit leaked files into mozilla_plugin_config_t
  - Allow wdmd to getattr on tmpfs
  - Allow realmd to use /dev/random
  - allow containers to send audit messages
  - Allow root mount any file via loop device with enforcing mls policy
  - Allow tmpfiles_t to setattr on mandb_cache_t
  - Allow tmpfiles_t to setattr on mandb_cache_t
  - Make userdom_dontaudit_write_all_ not allow open
  - Allow init scripts to read all unit files
  - Add support for saphostctrl ports


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-33
changelog:
  - Add kernel_read_system_state to sandbox_client_t
  - Add some of the missing access to kdumpgui
  - Allow systemd_dbusd_t to status the init system
  - Allow vmnet-natd to request the kernel to load a module
  - Allow gsf-office-thum to append .cache/gdm/session.log
  - realmd wants to read .config/dconf/user
  - Firewalld wants sys_nice/setsched
  - Allow tmpreaper to delete mandb cache files
  - Firewalld wants sys_nice/setsched
  - Allow firewalld to perform  a DNS name resolution
  - Allown winbind to read /usr/share/samba/codepages/lowcase.dat
  - Add support for HTTPProxy* in /etc/freshclam.conf
  - Fix authlogin_yubike boolean
  - Extend smbd_selinux man page to include samba booleans
  - Allow dhcpc to execute consoletype
  - Allow ping to use inherited tmp files created in init scripts
  - On full relabel with unconfined domain disabled, initrc was running some chcon's
  - Allow people who delete man pages to delete mandb cache files


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-31
changelog:
  - Add new mandb policy
  - ALlow systemd-tmpfiles_t to relabel mandb_cache_t
  - Allow logrotate to start all unit files


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-30
changelog:
  - Add fixes for ctbd
  - Allow nmbd to stream connect to ctbd
  - Make cglear_t as nsswitch_domain
  - Fix bogus in interfaces
  - Allow openshift to read/write postfix public pipe
  - Add postfix_manage_spool_maildrop_files() interface
  - stickshift paths have been renamed to openshift
  - gnome-settings-daemon wants to write to /run/systemd/inhibit/ pipes
  - Update man pages, adding ENTRYPOINTS


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-29
changelog:
  -  Add mei_device_t
  - Make sure gpg content in homedir created with correct label
  - Allow dmesg to write to abrt cache files
  - automount wants to search  virtual memory sysctls
  - Add support for hplip logs stored in /var/log/hp/tmp
  - Add labeling for /etc/owncloud/config.php
  - Allow setroubleshoot to send analysys to syslogd-journal
  - Allow virsh_t to interact with new fenced daemon
  - Allow gpg to write to /etc/mail/spamassassiin directories
  - Make dovecot_deliver_t a mail server delivery type
  - Add label for /var/tmp/DNS25


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-27
changelog:
  - Remove init_systemd and init_upstart boolean, Move init_daemon_domain and init_system_domain to use attributes
  - Add attribute to all base os types.  Allow all domains to read all ro base OS types


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-24
changelog:
  - dbus needs to start getty unit files
  - Add interface to allow system_dbusd_t to start the poweroff service
  - xdm wants to exec telepathy apps
  - Allow users to send messages to systemdlogind
  - Additional rules needed for systemd and other boot apps
  - systemd wants to list /home and /boot
  - Allow gkeyringd to write dbus/conf file
  - realmd needs to read /dev/urand
  - Allow readahead to delete /.readahead if labeled root_t, might get created before policy is loaded


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-23
changelog:
  - Fixes to safe more rules
  - Re-write tomcat_domain_template()
  - Fix passenger labeling
  - Allow all domains to read man pages
  - Add ephemeral_port_t to the 'generic' port interfaces
  - Fix the names of postgresql booleans


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-22
changelog:
  - Stop using attributes form netlabel_peer and syslog, auth_use_nsswitch setsup netlabel_peer
  - Move netlable_peer check out of booleans
  - Remove call to recvfrom_netlabel for kerberos call
  - Remove use of attributes when calling syslog call 
  - Move -miscfiles_read_localization to domain.te to save hundreds of allow rules
  - Allow all domains to read locale files.  This eliminates around 1500 allow rules- Cleanup nis_use_ypbind_uncond interface
  - Allow rndc to block suspend
  - tuned needs to modify the schedule of the kernel
  - Allow svirt_t domains to read alsa configuration files
  - ighten security on irc domains and make sure they label content in homedir correctly
  - Add filetrans_home_content for irc files
  - Dontaudit all getattr access for devices and filesystems for sandbox domains
  - Allow stapserver to search cgroups directories
  - Allow all postfix domains to talk to spamd


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-21
changelog:
  - Add interfaces to ignore setattr until kernel fixes this to be checked after the DAC check
  - Change pam_t to pam_timestamp_t
  - Add dovecot_domain attribute and allow this attribute block_suspend capability2
  - Add sanlock_use_fusefs boolean
  - numad wants send/recieve msg
  - Allow rhnsd to send syslog msgs
  - Make piranha-pulse as initrc domain
  - Update openshift instances to dontaudit setattr until the kernel is fixed.


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-20
changelog:
  -  Fix auth_login_pgm_domain() interface to allow domains also managed user tmp dirs because of #856880 related to pam_systemd
  - Remove pam_selinux.8 which conflicts with man page owned by the pam package
  - Allow glance-api to talk to mysql
  - ABRT wants to read Xorg.0.log if if it detects problem with Xorg
  - Fix gstreamer filename trans. interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-18
changelog:
  - Allow postalias to read postfix config files
  - Allow man2html to read man pages
  - Allow rhev-agentd to search all mountpoints
  - Allow rhsmcertd to read /dev/random
  - Add tgtd_stream_connect() interface
  - Add cyrus_write_data() interface
  - Dontaudit attempts by sandboxX clients connectiing to the xserver_port_t
  - Add port definition for tcp/81 as http_port_t
  - Fix /dev/twa labeling
  - Allow systemd to read modules config


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-17
changelog:
  - Merge openshift policy
  - Allow xauth to read /dev/urandom
  - systemd needs to relabel content in /run/systemd directories
  - Files unconfined should be able to perform all services on all files
  - Puppet tmp file can be leaked to all domains
  - Dontaudit rhsmcertd-worker to search /root/.local
  - Allow chown capability for zarafa domains
  -  Allow system cronjobs to runcon into openshift domains
  - Allow virt_bridgehelper_t to manage content in the svirt_home_t labeled directories


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-16
changelog:
  - nmbd wants to create /var/nmbd
  -  Stop transitioning out of anaconda and firstboot, just causes AVC messages
  - Allow clamscan to read /etc files
  - Allow bcfg2 to bind cyphesis port
  - heartbeat should be run as rgmanager_t instead of corosync_t
  - Add labeling for /etc/openldap/certs
  - Add labeling for /opt/sartest directory
  - Make crontab_t as userdom home reader
  - Allow tmpreaper to list admin_home dir
  - Add defition for imap_0 replay cache file
  - Add support for gitolite3
  - Allow virsh_t to send syslog messages
  - allow domains that can read samba content to be able to list the directories also
  - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd
  - Separate out sandbox from sandboxX policy so we can disable it by default
  - Run dmeventd as lvm_t
  - Mounting on any directory requires setattr and write permissions
  - Fix use_nfs_home_dirs() boolean
  - New labels for pam_krb5
  - Allow init and initrc domains to sys_ptrace since this is needed to look at processes not owned by uid 0
  - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd


author: Dan Walsh <dwalsh@redhat.com> 3.11.1-15
changelog:
  - Separate sandbox policy into sandbox and sandboxX, and disable sandbox by default on fresh installs
  - Allow domains that can read etc_t to read etc_runtime_t 
  - Allow all domains to use inherited tmpfiles


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-14
changelog:
  - Allow realmd to read resolv.conf
  - Add pegasus_cache_t type
  - Label /usr/sbin/fence_virtd as virsh_exec_t
  - Add policy for pkcsslotd
  - Add support for cpglockd
  - Allow polkit-agent-helper to read system-auth-ac
  - telepathy-idle wants to read gschemas.compiled
  - Allow plymouthd to getattr on fs_t
  - Add slpd policy
  - Allow ksysguardproces to read/write config_usr_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-12
changelog:
  - Add file name transitions for ttyACM0
  - spice-vdagent(d)'s are going to log over to syslog
  - Add sensord policy
  - Add more fixes for passenger policy related to puppet
  - Allow wdmd to create wdmd_tmpfs_t
  - Fix labeling for /var/run/cachefilesd\.pid
  - Add thumb_tmpfs_t files type


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-11
changelog:
  - Allow svirt domains to manage the network since this is containerized
  - Allow svirt_lxc_net_t to send audit messages


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-10
changelog:
  - Make "snmpwalk -mREDHAT-CLUSTER-MIB ...." working
  - Allow dlm_controld to execute dlm_stonith labeled as bin_t
  - Allow GFS2 working on F17
  - Abrt needs to execute dmesg
  - Allow jockey to list the contents of modeprobe.d
  - Add policy for lightsquid as squid_cron_t
  - Mailscanner is creating files and directories in /tmp
  - dmesg is now reading /dev/kmsg
  - Allow xserver to communicate with secure_firmware
  - Allow fsadm tools (fsck) to read /run/mount contnet
  - Allow sysadm types to read /dev/kmsg
  -


author: Dan Walsh <dwalsh@redhat.com> 3.11.1-9
changelog:
  - Allow postfix, sssd, rpcd to block_suspend
  - udev seems to need secure_firmware capability
  - Allow virtd to send dbus messages to firewalld so it can configure the firewall


author: Dan Walsh <dwalsh@redhat.com> 3.11.1-8
changelog:
  - Fix labeling of content in /run created by virsh_t
  - Allow condor domains to read kernel sysctls
  - Allow condor_master to connect to amqp
  - Allow thumb drives to create shared memory and semaphores
  - Allow abrt to read mozilla_plugin config files
  - Add labels for lightsquid
  - Default files in /opt and /usr that end in .cgi as httpd_sys_script_t, allow
  - dovecot_auth_t uses ldap for user auth
  - Allow domains that can read dhcp_etc_t to read lnk_files
  - Add more then one watchdog device
  - Allow useradd_t to manage etc_t files so it can rename it and edit them
  - Fix invalid class dir should be fifo_file
  - Move /run/blkid to fsadm and make sure labeling is correct


author: Dan Walsh <dwalsh@redhat.com> 3.11.1-7
changelog:
  - Fix bogus regex found by eparis
  - Fix manage run interface since lvm needs more access
  - syslogd is searching cgroups directory
  - Fixes to allow virt-sandbox-service to manage lxc var run content


author: Dan Walsh <dwalsh@redhat.com> 3.11.1-6
changelog:
  - Fix Boolean settings
  - Add new libjavascriptcoregtk as textrel_shlib_t
  - Allow xdm_t to create xdm_home_t directories
  - Additional access required for systemd
  - Dontaudit mozilla_plugin attempts to ipc_lock
  - Allow tmpreaper to delete unlabeled files
  - Eliminate screen_tmp_t and allow it to manage user_tmp_t
  - Dontaudit mozilla_plugin_config_t to append to leaked file descriptors
  - Allow web plugins to connect to the asterisk ports
  - Condor will recreate the lock directory if it does not exist
  - Oddjob mkhomedir needs to connectto user processes
  - Make oddjob_mkhomedir_t a userdom home manager


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-5
changelog:
  - Put placeholder back in place for proper numbering of capabilities
  - Systemd also configures init scripts


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-4
changelog:
  - Fix ecryptfs interfaces
  - Bootloader seems to be trolling around /dev/shm and /dev
  - init wants to create /etc/systemd/system-update.target.wants
  - Fix systemd_filetrans call to move it out of tunable
  - Fix up policy to work with systemd userspace manager
  - Add secure_firmware capability and remove bogus epolwakeup
  - Call seutil_*_login_config interfaces where should be needed
  - Allow rhsmcertd to send signal to itself
  - Allow thin domains to send signal to itself
  - Allow Chrome_ChildIO to read dosfs_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-2
changelog:
  - Add new type selinux_login_config_t for /etc/selinux/<type>/logins/
  - Additional fixes for seutil_manage_module_store()
  - dbus_system_domain() should be used with optional_policy
  - Fix svirt to be allowed to use fusefs file system
  - Allow login programs to read /run/ data created by systemd_login
  - sssd wants to write /etc/selinux/<policy>/logins/ for SELinux PAM module
  - Fix svirt to be allowed to use fusefs file system
  - Allow piranha domain to use nsswitch
  - Sanlock needs to send Kill Signals to non root processes
  - Pulseaudio wants to execute /run/user/PID/.orc


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-1
changelog:
  - Fix saslauthd when it tries to read /etc/shadow
  - Label gnome-boxes as a virt homedir
  - Need to allow svirt_t ability to getattr on nfs_t file systems
  - Update sanlock policy to solve all AVC's
  - Change confined users can optionally manage virt content
  - Handle new directories under ~/.cache
  - Add block suspend to appropriate domains
  - More rules required for containers
  - Allow login programs to read /run/ data created by systemd_logind
  - Allow staff users to run svirt_t processes


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-13
changelog:
  - Add systemd_logind_inhibit_var_run_t attribute
  - Remove corenet_all_recvfrom_unlabeled() for non-contrib policies because we moved it to domain.if for all domain_type
  - Add interface for mysqld to dontaudit signull to all processes
  - Label new /var/run/journal directory correctly
  - Allow users to inhibit suspend via systemd
  - Add new type for the /var/run/inhibit directory
  - Add interface to send signull to systemd_login so avahi can send them
  - Allow systemd_passwd to send syslog messages
  - Remove corenet_all_recvfrom_unlabeled() calling fro policy files
  - Allow       editparams.cgi running as httpd_bugzilla_script_t to read /etc/group
  - Allow smbd to read cluster config
  - Add additional labeling for passenger
  - Allow dbus to inhibit suspend via systemd
  - Allow avahi to send signull to systemd_login


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-12
changelog:
  - Add interface to dontaudit getattr access on sysctls
  - Allow sshd to execute /bin/login
  - Looks like xdm is recreating the xdm directory in ~/.cache/ on login
  - Allow syslog to use the leaked kernel_t unix_dgram_socket from system-jounald
  -  Fix semanage to work with unconfined domain disabled on F18
  - Dontaudit attempts by mozilla plugins to getattr on all kernel sysctls
  - Virt seems to be using lock files
  - Dovecot seems to be searching directories of every mountpoint
  - Allow jockey to read random/urandom, execute shell and install third-party drivers
  - Add aditional params to allow cachedfiles to manage its content
  - gpg agent needs to read /dev/random
  - The kernel hands an svirt domains /SYSxxxxx which is a tmpfs that httpd wants to read and write
  - Add a bunch of dontaudit rules to quiet svirt_lxc domains
  - Additional perms needed to run svirt_lxc domains
  - Allow cgclear to read cgconfig
  - Allow sys_ptrace capability for snmp
  - Allow freshclam to read /proc
  - Allow procmail to manage /home/user/Maildir content
  - Allow NM to execute wpa_cli
  - Allow amavis to read clamd system state
  - Regenerate man pages


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-10
changelog:
  - Add realmd and stapserver policies
  - Allow useradd to manage stap-server lib files
  - Tighten up capabilities for confined users
  - Label /etc/security/opasswd as shadow_t
  - Add label for /dev/ecryptfs
  - Allow condor_startd_t to start sshd with the ranged
  - Allow lpstat.cups to read fips_enabled file
  - Allow pyzor running as spamc_t to create /root/.pyzor directory
  - Add labelinf for amavisd-snmp init script
  - Add support for amavisd-snmp
  - Allow fprintd sigkill self
  - Allow xend (w/o libvirt) to start virtual machines
  - Allow aiccu to read /etc/passwd
  - Allow condor_startd to Make specified domain MCS trusted for setting any category set for the processes it executes
  - Add condor_startd_ranged_domtrans_to() interface
  - Add ssd_conf_t for /etc/sssd
  - accountsd needs to fchown some files/directories
  - Add ICACLient and zibrauserdata as mozilla_filetrans_home_content
  - SELinux reports afs_t needs dac_override to read /etc/mtab, even though everything works, adding dontaudit
  - Allow xend_t to read the /etc/passwd file


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-9
changelog:
  - Until we figure out how to fix systemd issues, allow all apps that send syslog messages to send them to kernel_t
  - Add init_access_check() interface
  - Fix label on /usr/bin/pingus to not be labeled as ping_exec_t
  - Allow tcpdump to create a netlink_socket
  - Label newusers like useradd
  - Change xdm log files to be labeled xdm_log_t
  - Allow sshd_t with privsep to work in MLS
  - Allow freshclam to update databases thru HTTP proxy
  - Allow s-m-config to access check on systemd
  - Allow abrt to read public files by default
  - Fix amavis_create_pid_files() interface
  - Add labeling and filename transition for dbomatic.log
  - Allow system_dbusd_t to stream connect to bluetooth, and use its socket
  - Allow amavisd to execute fsav
  - Allow tuned to use sys_admin and sys_nice capabilities
  - Add php-fpm policy from Bryan
  - Add labeling for aeolus-configserver-thinwrapper
  - Allow thin domains to execute shell
  - Fix gnome_role_gkeyringd() interface description
  - Lot of interface fixes
  - Allow OpenMPI job running as condor_startd_ssh_t to manage condor lib files
  - Allow OpenMPI job to use kerberos
  - Make deltacloudd_t as nsswitch_domain
  - Allow xend_t to run lsscsi
  - Allow qemu-dm running as xend_t to create tun_socket
  - Add labeling for /opt/brother/Printers(.*/)?inf
  - Allow jockey-backend to read pyconfig-64.h labeled as usr_t
  - Fix clamscan_can_scan_system boolean
  - Allow lpr to connectto to /run/user/$USER/keyring-22uREb/pkcs11


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-8
changelog:
  - initrc is calling exportfs which is not confined so it attempts to read nfsd_files
  - Fixes for passenger running within openshift.
  - Add labeling for all tomcat6 dirs
  - Add support for tomcat6
  - Allow cobblerd to read /etc/passwd
  - Allow jockey to read sysfs and and execute binaries with bin_t
  - Allow thum to use user terminals
  - Allow cgclear to read cgconfig config files
  - Fix bcf2g.fc
  - Remove sysnet_dns_name_resolve() from policies where auth_use_nsswitch() is used for other domains
  - Allow dbomatic to execute ruby
  - abrt_watch_log should be abrt_domain
  - Allow mozilla_plugin to connect to gatekeeper port


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-7
changelog:
  - add ptrace_child access to process
  - remove files_read_etc_files() calling from all policies which have auth_use_nsswith()
  - Allow boinc domains to manage boinc_lib_t lnk_files
  - Add support for boinc-client.service unit file
  - Add support for boinc.log
  - Allow mozilla_plugin execmod on mozilla home files if allow_ex
  - Allow dovecot_deliver_t to read dovecot_var_run_t
  - Allow ldconfig and insmod to manage kdumpctl tmp files
  - Move thin policy out from cloudform.pp and add a new thin poli
  - pacemaker needs to communicate with corosync streams
  - abrt is now started on demand by dbus
  - Allow certmonger to talk directly to Dogtag servers
  - Change labeling for /var/lib/cobbler/webui_sessions to httpd_c
  - Allow mozila_plugin to execute gstreamer home files
  - Allow useradd to delete all file types stored in the users hom
  - rhsmcertd reads the rpm database
  - Add support for lightdm


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-6
changelog:
  - Add tomcat policy
  - Remove pyzor/razor policy
  - rhsmcertd reads the rpm database
  - Dontaudit  thumb to setattr on xdm_tmp dir
  - Allow wicd to execute ldconfig in the networkmanager_t domain
  - Add /var/run/cherokee\.pid labeling
  - Allow mozilla_plugin to create mozilla_plugin_tmp_t lnk files too
  - Allow postfix-master to r/w pipes other postfix domains
  - Allow snort to create netlink_socket
  - Add kdumpctl policy
  - Allow firstboot to create tmp_t files/directories
  - /usr/bin/paster should not be labeled as piranha_exec_t
  - remove initrc_domain from tomcat
  - Allow ddclient to read /etc/passwd
  - Allow useradd to delete all file types stored in the users homedir
  - Allow ldconfig and insmod to manage kdumpctl tmp files
  - Firstboot should be just creating tmp_t dirs and xauth should be allowed to write to those
  - Transition xauth files within firstboot_tmp_t
  - Fix labeling of /run/media to match /media
  - Label all lxdm.log as xserver_log_t
  - Add port definition for mxi port
  - Allow local_login_t to execute tmux


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-5
changelog:
  - apcupsd needs to read /etc/passwd
  - Sanlock allso sends sigkill
  - Allow glance_registry to connect to the mysqld port
  - Dontaudit mozilla_plugin trying to getattr on /dev/gpmctl
  - Allow firefox plugins/flash to connect to port 1234
  - Allow mozilla plugins to delete user_tmp_t files
  - Add transition name rule for printers.conf.O
  - Allow virt_lxc_t to read urand
  - Allow systemd_loigind to list gstreamer_home_dirs
  - Fix labeling for /usr/bin
  - Fixes for cloudform services
    * support FIPS
  - Allow polipo to work as web caching
  - Allow chfn to execute tmux


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-4
changelog:
  - Add support for ecryptfs
    * ecryptfs does not support xattr
    * we need labeling for HOMEDIR
  - Add policy for (u)mount.ecryptfs*
  - Fix labeling of kerbero host cache files, allow rpc.svcgssd to manage host cache
  - Allow dovecot to manage Maildir content, fix transitions to Maildir
  - Allow postfix_local to transition to dovecot_deliver
  - Dontaudit attempts to setattr on xdm_tmp_t, looks like bogus code
  - Cleanup interface definitions
  - Allow apmd to change with the logind daemon
  - Changes required for sanlock in rhel6
  - Label /run/user/apache as httpd_tmp_t
  - Allow thumb to use lib_t as execmod if boolean turned on
  - Allow squid to create the squid directory in /var with the correct labe
  - Add a new policy for glusterd from Bryan Bickford (bbickfor@redhat.com)
  - Allow virtd to exec xend_exec_t without transition
  - Allow virtd_lxc_t to unmount all file systems


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-3
changelog:
  - PolicyKit path has changed
  - Allow httpd connect to dirsrv socket
  - Allow tuned to write generic kernel sysctls
  - Dontaudit logwatch to gettr on /dev/dm-2
  - Allow policykit-auth to manage kerberos files
  - Make condor_startd and rgmanager as initrc domain
  - Allow virsh to read /etc/passwd
  - Allow mount to mount on user_tmp_t for /run/user/dwalsh/gvfs
  - xdm now needs to execute xsession_exec_t
  - Need labels for /var/lib/gdm
  - Fix files_filetrans_named_content() interface
  - Add new attribute - initrc_domain
  - Allow systemd_logind_t to signal, signull, sigkill all processes
  - Add filetrans rules for etc_runtime files


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-1
changelog:
  - Mass merge with upstream
    * new policy topology to include contrib policy modules
    * we have now two base policy patches


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-128
changelog:
  - Fix description of authlogin_nsswitch_use_ldap
  - Fix transition rule for rhsmcertd_t needed for RHEL7
  - Allow useradd to list nfs state data
  - Allow openvpn to manage its log file and directory
  - We want vdsm to transition to mount_t when executing mount command to make sure /etc/mtab remains labeled correctly
  - Allow thumb to use nvidia devices
  -  Allow local_login to create user_tmp_t files for kerberos
  - Pulseaudio needs to read systemd_login /var/run content
  - virt should only transition named system_conf_t config files
  - Allow  munin to execute its plugins
  - Allow nagios system plugin to read /etc/passwd
  - Allow plugin to connect to soundd port
  - Fix httpd_passwd to be able to ask passwords
  - Radius servers can use ldap for backing store
  - Seems to need to mount on /var/lib for xguest polyinstatiation to work.
  - Allow systemd_logind to list the contents of gnome keyring
  - VirtualGL need xdm to be able to manage content in /etc/opt/VirtualGL
  - Add policy for isns-utils


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-127
changelog:
  - Add policy for subversion daemon
  - Allow boinc to read passwd
  - Allow pads to read kernel network state
  - Fix man2html interface for sepolgen-ifgen
  - Remove extra /usr/lib/systemd/system/smb
  - Remove all /lib/systemd and replace with /usr/lib/systemd
  - Add policy for man2html
  - Fix the label of kerberos_home_t to krb5_home_t
  - Allow mozilla plugins to use Citrix
  - Allow tuned to read /proc/sys/kernel/nmi_watchdog
  - Allow tune /sys options via systemd's tmpfiles.d "w" type


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-126
changelog:
  - Dontaudit lpr_t to read/write leaked mozilla tmp files
  - Add file name transition for .grl-podcasts directory
  - Allow corosync to read user tmp files
  - Allow fenced to create snmp lib dirs/files
  - More fixes for sge policy
  - Allow mozilla_plugin_t to execute any application
  - Allow dbus to read/write any open file descriptors to any non security file on the system that it inherits to that it can pass them to another domain
  - Allow mongod to read system state information
  -  Fix wrong type, we should dontaudit sys_admin for xdm_t not xserver_t
  - Allow polipo to manage polipo_cache dirs
  - Add jabbar_client port to mozilla_plugin_t
  - Cleanup procmail policy
  - system bus will pass around open file descriptors on files that do not have labels on them
  - Allow l2tpd_t to read system state
  - Allow tuned to run ls /dev
  - Allow sudo domains to read usr_t files
  - Add label to machine-id 
  - Fix corecmd_read_bin_symlinks cut and paste error


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-125
changelog:
  - Fix pulseaudio port definition
  - Add labeling for condor_starter
  - Allow chfn_t to creat user_tmp_files
  - Allow chfn_t to execute bin_t
  - Allow prelink_cron_system_t to getpw calls
  - Allow sudo domains to manage kerberos rcache files
  - Allow user_mail_domains to work with courie
  - Port definitions necessary for running jboss apps within openshift
  -  Add support for openstack-nova-metadata-api
  - Add support for nova-console*
  - Add support for openstack-nova-xvpvncproxy
  - Fixes to make privsep+SELinux working if we try to use chage to change passwd
  - Fix auth_role() interface
  - Allow numad to read sysfs
  - Allow matahari-rpcd to execute shell
  - Add label for ~/.spicec
  - xdm is executing lspci as root which is requesting a sys_admin priv but seems to succeed without it
  - Devicekit_disk wants to read the logind sessions file when writing a cd
  - Add fixes for condor to make condor jobs working correctly
  - Change label of /var/log/rpmpkgs to cron_log_t
  - Access requires to allow systemd-tmpfiles --create to work.
  - Fix obex to be a user application started by the session bus.
  - Add additional filename trans rules for kerberos
  - Fix /var/run/heartbeat labeling
  - Allow apps that are managing rcache to file trans correctly
  - Allow openvpn to authenticate against ldap server
  - Containers need to listen to network starting and stopping events


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-123
changelog:
  - Fix zarafa labeling
  - Allow guest_t to fix labeling
  - corenet_tcp_bind_all_unreserved_ports(ssh_t) should be called with the user_tcp_server boolean
  - add lxc_contexts
  - Allow accountsd to read /proc
  - Allow restorecond to getattr on all file sytems
  - tmpwatch now calls getpw
  - Allow apache daemon to transition to pwauth domain
  - Label content under /var/run/user/NAME/keyring* as gkeyringd_tmp_t
  - The obex socket seems to be a stream socket
  - dd label for /var/run/nologin


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-122
changelog:
  - Allow jetty running as httpd_t to read hugetlbfs files
  - Allow sys_nice and setsched for rhsmcertd
  - Dontaudit attempts by mozilla_plugin_t to bind to ssdp ports
  - Allow setfiles to append to xdm_tmp_t
  - Add labeling for /export as a usr_t directory
  - Add labels for .grl files created by gstreamer


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-121
changelog:
  - Add labeling for /usr/share/jetty/bin/jetty.sh
  - Add jetty policy which contains file type definitios
  - Allow jockey to use its own fifo_file and make this the default for all domains
  - Allow mozilla_plugins to use spice (vnc_port/couchdb)
  - asterisk wants to read the network state
  - Blueman now uses /var/lib/blueman- Add label for nodejs_debug
  - Allow mozilla_plugin_t to create ~/.pki directory and content


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-120
changelog:
  - Add clamscan_can_scan_system boolean
  - Allow mysqld to read kernel network state
  - Allow sshd to read/write condor lib files
  - Allow sshd to read/write condor-startd tcp socket
  - Fix description on httpd_graceful_shutdown
  - Allow glance_registry to communicate with mysql
  - dbus_system_domain is using systemd to lauch applications
  - add interfaces to allow domains to send kill signals to user mail agents
  - Remove unnessary access for svirt_lxc domains, add privs for virtd_lxc_t
  - Lots of new access required for secure containers
  - Corosync needs sys_admin capability
  - ALlow colord to create shm
  - .orc should be allowed to be created by any app that can create gstream home content, thumb_t to be specific
  - Add boolean to control whether or not mozilla plugins can create random content in the users homedir
  -  Add new interface to allow domains to list msyql_db directories, needed for libra
  - shutdown has to be allowed to delete etc_runtime_t
  - Fail2ban needs to read /etc/passwd
  -  Allow ldconfig to create /var/cache/ldconfig
  - Allow tgtd to read hardware state information
  - Allow collectd to create packet socket
  - Allow chronyd to send signal to itself
  - Allow collectd to read /dev/random
  - Allow collectd to send signal to itself
  - firewalld needs to execute restorecon
  - Allow restorecon and other login domains to execute restorecon


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-119
changelog:
  - Allow logrotate to getattr on systemd unit files
  - Add support for tor systemd unit file
  - Allow apmd to create /var/run/pm-utils with the correct label
  - Allow l2tpd to send sigkill to pppd
  - Allow pppd to stream connect to l2tpd
  - Add label for scripts in /etc/gdm/
  - Allow systemd_logind_t to ignore mcs constraints on sigkill
  - Fix files_filetrans_system_conf_named_files() interface
  - Add labels for /usr/share/wordpress/wp-includes/*.php
  - Allow cobbler to get SELinux mode and booleans


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-118
changelog:
  - Add unconfined_execmem_exec_t as an alias to bin_t
  - Allow fenced to read snmp var lib files, also allow it to read usr_t
  - ontaudit access checks on all executables from mozilla_plugin
  - Allow all user domains to setexec, so that sshd will work properly if it call setexec(NULL) while running withing a user mode
  - Allow systemd_tmpfiles_t to getattr all pipes and sockets
  - Allow glance-registry to send system log messages
  - semanage needs to manage mock lib files/dirs


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-117
changelog:
  - Add policy for abrt-watch-log
  - Add definitions for jboss_messaging ports
  - Allow systemd_tmpfiles to manage printer devices
  - Allow oddjob to use nsswitch
  - Fix labeling of log files for postgresql
  - Allow mozilla_plugin_t to execmem and execstack by default
  - Allow firewalld to execute shell
  - Fix /etc/wicd content files to get created with the correct label
  - Allow mcelog to exec shell
  - Add ~/.orc as a gstreamer_home_t
  - /var/spool/postfix/lib64 should be labeled lib_t
  - mpreaper should be able to list all file system labeled directories
  - Add support for apache to use openstack
  - Add labeling for /etc/zipl.conf and zipl binary
  - Turn on allow_execstack and turn off telepathy transition for final release


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-116
changelog:
  - More access required for virt_qmf_t
  - Additional assess required for systemd-logind to support multi-seat
  - Allow mozilla_plugin to setrlimit
  - Revert changes to fuse file system to stop deadlock


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-115
changelog:
  - Allow condor domains to connect to ephemeral ports
  - More fixes for condor policy
  - Allow keystone to stream connect to mysqld
  - Allow mozilla_plugin_t to read generic USB device to support GPS devices
  - Allow thum to file name transition gstreamer home content
  - Allow thum to read all non security files
  - Allow glance_api_t to connect to ephemeral ports
  - Allow nagios plugins to read /dev/urandom
  - Allow syslogd to search postfix spool to support postfix chroot env
  - Fix labeling for /var/spool/postfix/dev
  - Allow wdmd chown
  - Label .esd_auth as pulseaudio_home_t
  - Have no idea why keyring tries to write to /run/user/dwalsh/dconf/user, but we can dontaudit for now


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-114
changelog:
  - Add support for clamd+systemd
  - Allow fresclam to execute systemctl to handle clamd
  - Change labeling for /usr/sbin/rpc.ypasswd.env
  	- Allow yppaswd_t to execute yppaswd_exec_t
  	- Allow yppaswd_t to read /etc/passwd
  - Gnomekeyring socket has been moved to /run/user/USER/
  - Allow samba-net to connect to ldap port
  - Allow signal for vhostmd
  - allow mozilla_plugin_t to read user_home_t socket
  - New access required for secure Linux Containers
  - zfs now supports xattrs
  - Allow quantum to execute sudo and list sysfs
  - Allow init to dbus chat with the firewalld
  - Allow zebra to read /etc/passwd


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-113
changelog:
  - Allow svirt_t to create content in the users homedir under ~/.libvirt
  - Fix label on /var/lib/heartbeat
  - Allow systemd_logind_t to send kill signals to all processes started by a user
  - Fuse now supports Xattr Support


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-112
changelog:
  - upowered needs to setsched on the kernel
  - Allow mpd_t to manage log files
  - Allow xdm_t to create /var/run/systemd/multi-session-x
  - Add rules for missedfont.log to be used by thumb.fc
  - Additional access required for virt_qmf_t
  - Allow dhclient to dbus chat with the firewalld
  - Add label for lvmetad
  - Allow systemd_logind_t to remove userdomain sock_files
  - Allow cups to execute usr_t files
  - Fix labeling on nvidia shared libraries
  - wdmd_t needs access to sssd and /etc/passwd
  - Add boolean to allow ftp servers to run in passive mode
  - Allow namepspace_init_t to relabelto/from a different user system_u from the user the namespace_init running with
  - Fix using httpd_use_fusefs
  - Allow chrome_sandbox_nacl to write inherited user tmp files as we allow it for chrome_sandbox


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-111
changelog:
  - Rename rdate port to time port, and allow gnomeclock to connect to it
  - We no longer need to transition to ldconfig from rpm, rpm_script, or anaconda
  - /etc/auto.* should be labeled bin_t
  - Add httpd_use_fusefs boolean
  - Add fixes for heartbeat
  - Allow sshd_t to signal processes that it transitions to
  - Add condor policy
  - Allow svirt to create monitors in ~/.libvirt
  - Allow dovecot to domtrans sendmail to handle sieve scripts
  - Lot of fixes for cfengine


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-110
changelog:
  - /var/run/postmaster.* labeling is no longer needed
  - Alllow drbdadmin to read /dev/urandom
  - l2tpd_t seems to use ptmx
  - group+ and passwd+ should be labeled as /etc/passwd
  - Zarafa-indexer is a socket


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-109
changelog:
  - Ensure lastlog is labeled correctly
  - Allow accountsd to read /proc data about gdm
  - Add fixes for tuned
  - Add bcfg2 fixes which were discovered during RHEL6 testing
  - More fixes for gnome-keyring socket being moved
  - Run semanage as a unconfined domain, and allow initrc_t to create tmpfs_t sym links on shutdown
  - Fix description for files_dontaudit_read_security_files() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-108
changelog:
  - Add new policy and man page for bcfg2
  - cgconfig needs to use getpw calls
  - Allow domains that communicate with the keyring to use cache_home_t instead of gkeyringd_tmpt
  - gnome-keyring wants to create a directory in cache_home_t
  - sanlock calls getpw


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-107
changelog:
  - Add numad policy and numad man page
  - Add fixes for interface bugs discovered by SEWatch
  - Add /tmp support for squid
  - Add fix for #799102
       * change default labeling for /var/run/slapd.* sockets
  - Make thumb_t as userdom_home_reader
  - label /var/lib/sss/mc same as pubconf, so getpw domains can read it
  - Allow smbspool running as cups_t to stream connect to nmbd
  - accounts needs to be able to execute passwd on behalf of users
  - Allow systemd_tmpfiles_t to delete boot flags
  - Allow dnssec_trigger to connect to apache ports
  - Allow gnome keyring to create sock_files in ~/.cache
  - google_authenticator is using .google_authenticator
  - sandbox running from within firefox is exposing more leaks
  - Dontaudit thumb to read/write /dev/card0
  - Dontaudit getattr on init_exec_t for gnomeclock_t
  - Allow certmonger to do a transition to certmonger_unconfined_t
  - Allow dhcpc setsched which is caused by nmcli
  - Add rpm_exec_t for /usr/sbin/bcfg2
  - system cronjobs are sending dbus messages to systemd_logind
  - Thumnailers read /dev/urand


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-106
changelog:
  - Allow auditctl getcap
  - Allow vdagent to use libsystemd-login
  - Allow abrt-dump-oops to search /etc/abrt
  - Got these avc's while trying to print a boarding pass from firefox
  - Devicekit is now putting the media directory under /run/media
  - Allow thumbnailers to create content in ~/.thumbails directory
  - Add support for proL2TPd by Dominick Grift
  - Allow all domains to call getcap
  - wdmd seems to get a random chown capability check that it does not need
  - Allow vhostmd to read kernel sysctls


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-105
changelog:
  - Allow chronyd to read unix
  - Allow hpfax to read /etc/passwd
  - Add support matahari vios-proxy-* apps and add virtd_exec_t label for them
  - Allow rpcd to read quota_db_t
  - Update to man pages to match latest policy
  - Fix bug in jockey interface for sepolgen-ifgen
  - Add initial svirt_prot_exec_t policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-103
changelog:
  - Add a new type for /etc/firewalld and allow firewalld to write to this directory
  - Add definition for ~/Maildir, and allow mail deliver domains to write there
  - Allow polipo to run from a cron job
  - Allow rtkit to schedule wine processes
  - Allow mozilla_plugin_t to acquire a bug, and allow it to transition gnome content in the home dir to the proper label
  - Allow users domains to send signals to consolehelper domains


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-102
changelog:
  - More fixes for boinc policy
  - Allow polipo domain to create its own cache dir and pid file
  - Add systemctl support to httpd domain
  - Add systemctl support to polipo, allow NetworkManager to manage the service
  - Add policy for jockey-backend
  - Add support for motion daemon which is now covered by zoneminder policy
  - Allow colord to read/write motion tmpfs
  - Allow vnstat to search through var_lib_t directories
  - Stop transitioning to quota_t, from init an sysadm_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-100
changelog:
  - Add additional fixes for icmp nagios plugin
  - Allow cron jobs to open fifo_files from cron, since service script opens /dev/stdin
  - Add certmonger_unconfined_exec_t
  - Make sure tap22 device is created with the correct label
  - Allow staff users to read systemd unit files
  - Merge in previously built policy
  - Arpwatch needs to be able to start netlink sockets in order to start
  - Allow cgred_t to sys_ptrace to look at other DAC Processes


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-99
changelog:
  - Back port some of the access that was allowed in nsplugin_t
  - Add definitiona for couchdb ports
  - Allow nagios to use inherited users ttys
  - Add git support for mock
  - Allow inetd to use rdate port
  - Add own type for rdate port
  - Allow samba to act as a portmapper
  - Dontaudit chrome_sandbox attempts to getattr on chr_files in /dev
  - New fixes needed for samba4
  - Allow apps that use lib_t to read lib_t symlinks


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-98
changelog:
  - Add policy for nove-cert
  - Add labeling for nova-openstack  systemd unit files
  - Add policy for keystoke


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-97
changelog:
  - Fix man pages fro domains
  - Add man pages for SELinux users and roles
  - Add storage_dev_filetrans_named_fixed_disk() and use it for smartmon
  - Add policy for matahari-rpcd
  - nfsd executes mount command on restart
  - Matahari domains execute renice and setsched
  - Dontaudit leaked tty in mozilla_plugin_config
  - mailman is changing to a per instance naming
  - Add 7600 and 4447 as jboss_management ports
  - Add fixes for nagios event handlers
  - Label httpd.event as httpd_exec_t, it is an apache daemon


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-96
changelog:
  - Add labeling for /var/spool/postfix/dev/log
  - NM reads sysctl.conf
  - Iscsi log file context specification fix
  -  Allow mozilla plugins to send dbus messages to user domains that transition to it
  - Allow mysql to read the passwd file
  - Allow mozilla_plugin_t to create mozilla home dirs in user homedir
  - Allow deltacloud to read kernel sysctl
  - Allow postgresql_t to connectto itselfAllow postgresql_t to connectto itself
  - Allow postgresql_t to connectto itself
  - Add login_userdomain attribute for users which can log in using terminal


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-95
changelog:
  - Allow sysadm_u to reach system_r by default #784011
  - Allow nagios plugins to use inherited user terminals
  - Razor labeling is not used no longer
  - Add systemd support for matahari
  - Add port_types to man page, move booleans to the top, fix some english
  - Add support for matahari-sysconfig-console
  - Clean up matahari.fc
  - Fix matahari_admin() interfac
  - Add labels for/etc/ssh/ssh_host_*.pub keys


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-94
changelog:
  - Allow ksysguardproces to send system log msgs
  - Allow  boinc setpgid and signull
  - Allow xdm_t to sys_ptrace to run pidof command
  - Allow smtpd_t to manage spool files/directories and symbolic links
  - Add labeling for jetty
  - Needed changes to get unbound/dnssec to work with openswan


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-93
changelog:
  - Add user_fonts_t alias xfs_tmp_t
  - Since depmod now runs as insmod_t we need to write to kernel_object_t
  - Allow firewalld to dbus chat with networkmanager
  - Allow qpidd to connect to matahari ports
  - policykit needs to read /proc for uses not owned by it
  - Allow systemctl apps to connecto the init stream


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-90
changelog:
  - Add proxy class and read access for gssd_proxy
  - Separate out the sharing public content booleans
  - Allow certmonger to execute a script and send signals to  apache and dirsrv to reload the certificate
  -  Add label transition for gstream-0.10 and 12
  - Add booleans to allow rsync to share nfs and cifs file sytems
  - chrome_sandbox wants to read the /proc/PID/exe file of the program that executed it
  - Fix filename transitions for cups files
  - Allow denyhosts to read "unix"
  - Add file name transition for locale.conf.new
  - Allow boinc projects to gconf config files
  - sssd needs to be able to increase the socket limit under certain loads
  - sge_execd needs to read /etc/passwd
  - Allow denyhost to check network state
  - NetworkManager needs to read sessions data
  - Allow denyhost to check network state
  - Allow xen to search virt images directories
  - Add label for /dev/megaraid_sas_ioctl_node
  - Add autogenerated man pages


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-89
changelog:
  - Allow boinc project to getattr on fs
  - Allow init to execute initrc_state_t
  - rhev-agent package was rename to ovirt-guest-agent
  - If initrc_t creates /etc/local.conf then we need to make sure it is labeled correctly
  - sytemd writes content to /run/initramfs and executes it on shutdown
  - kdump_t needs to read /etc/mtab, should be back ported to F16
  - udev needs to load kernel modules in early system boot


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-88
changelog:
  - Need to add sys_ptrace back in since reading any content in /proc can cause these accesses
  - Add additional systemd interfaces which are needed fro *_admin interfaces
  - Fix bind_admin() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-87
changelog:
  - Allow firewalld to read urand
  - Alias java, execmem_mono to bin_t to allow third parties
  - Add label for kmod
  - /etc/redhat-lsb contains binaries
  - Add boolean to allow gitosis to send mail
  - Add filename transition also for "event20"
  - Allow systemd_tmpfiles_t to delete all file types
  - Allow collectd to ipc_lock


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-86
changelog:
  - make consoletype_exec optional, so we can remove consoletype policy
  - remove unconfined_permisive.patch
  - Allow openvpn_t to inherit user home content and tmp content
  - Fix dnssec-trigger labeling
  - Turn on obex policy for staff_t
  - Pem files should not be secret
  - Add lots of rules to fix AVC's when playing with containers
  - Fix policy for dnssec
  - Label ask-passwd directories correctly for systemd


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-85
changelog:
  - sshd fixes seem to be causing unconfined domains to dyntrans to themselves
  - fuse file system is now being mounted in /run/user
  - systemd_logind is sending signals to processes that are dbus messaging with it
  - Add support for winshadow port and allow iscsid to connect to this port
  - httpd should be allowed to bind to the http_port_t udp socket
  - zarafa_var_lib_t can be a lnk_file
  - A couple of new .xsession-errors files
  - Seems like user space and login programs need to read logind_sessions_files
  - Devicekit disk seems to be being launched by systemd
  - Cleanup handling of setfiles so most of rules in te file
  - Correct port number for dnssec
  - logcheck has the home dir set to its cache


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-83
changelog:
  - Add new sysadm_secadm.pp module
  	* contains secadm definition for sysadm_t
  - Move user_mail_domain access out of the interface into the te file
  - Allow httpd_t to create httpd_var_lib_t directories as well as files
  - Allow snmpd to connect to the ricci_modcluster stream
  - Allow firewalld to read /etc/passwd
  - Add auth_use_nsswitch for colord
  - Allow smartd to read network state
  - smartdnotify needs to read /etc/group


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-82
changelog:
  - Allow gpg and gpg_agent to store sock_file in gpg_secret_t directory
  - lxdm startup scripts should be labeled bin_t, so confined users will work
  - mcstransd now creates a pid, needs back port to F16
  - qpidd should be allowed to connect to the amqp port
  - Label devices 010-029 as usb devices
  - ypserv packager says ypserv does not use tmp_t so removing selinux policy types
  - Remove all ptrace commands that I believe are caused by the kernel/ps avcs
  - Add initial Obex policy
  - Add logging_syslogd_use_tty boolean
  - Add polipo_connect_all_unreserved bolean
  - Allow zabbix to connect to ftp port
  - Allow systemd-logind to be able to switch VTs
  - Allow apache to communicate with memcached through a sock_file


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-80
changelog:
  - Add zabbix_can_network boolean
  - Add httpd_can_connect_zabbix boolean
  - Prepare file context labeling for usrmove functions
  - Allow system cronjobs to read kernel network state
  - Add support for selinux_avcstat munin plugin
  - Treat hearbeat with corosync policy
  - Allow corosync to read and write to qpidd shared mem
  -  mozilla_plugin is trying to run pulseaudio 
  - Fixes for new sshd patch for running priv sep domains as the users context
  - Turn off dontaudit rules when turning on allow_ypbind
  - udev now reads /etc/modules.d directory


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-79
changelog:
  - Turn on deny_ptrace boolean for the Rawhide run, so we can test this out
  - Cups exchanges dbus messages with init
  - udisk2 needs to send syslog messages
  - certwatch needs to read /etc/passwd


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-77
changelog:
  - Treat Bip with bitlbee policy
        * Bip is an IRC proxy
  - Add port definition for interwise port
  - Add support for ipa_memcached socket
  - systemd_jounald needs to getattr on all processes
  - mdadmin fixes
       * uses getpw
  - amavisd calls getpwnam()
  - denyhosts calls getpwall()


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-76
changelog:
  - Setup labeling of /var/rsa and /var/lib/rsa to allow login programs to write there
  - bluetooth says they do not use /tmp and want to remove the type
  - Allow init to transition to colord
  - Mongod needs to read /proc/sys/vm/zone_reclaim_mode
  - Allow postfix_smtpd_t to connect to spamd
  - Add boolean to allow ftp to connect to all ports > 1023
  - Allow sendmain to write to inherited dovecot tmp files
  - setroubleshoot needs to be able to execute rpm to see what version of packages


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-75
changelog:
  - Merge systemd patch
  - systemd-tmpfiles wants to relabel /sys/devices/system/cpu/online
  - Allow deltacloudd dac_override, setuid, setgid  caps
  - Allow aisexec to execute shell
  - Add use_nfs_home_dirs boolean for ssh-keygen


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-74
changelog:
  - Add labeling for /var/run/systemd/journal/syslog
  - libvirt sends signals to ifconfig
  - Allow domains that read logind session files to list them


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-73
changelog:
  - Fixed destined form libvirt-sandbox
  - Allow apps that list sysfs to also read sympolicy links in this filesystem
  - Add ubac_constrained rules for chrome_sandbox
  - Need interface to allow domains to use tmpfs_t files created by the kernel, used by libra
  - Allow postgresql to be executed by the caller
  - Standardize interfaces of daemons 
  - Add new labeling for mm-handler
  - Allow all matahari domains to read network state and etc_runtime_t files


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-72
changelog:
  - New fix for seunshare, requires seunshare_domains to be able to mounton /
  - Allow systemctl running as logrotate_t to connect to private systemd socket
  - Allow tmpwatch to read meminfo
  - Allow rpc.svcgssd to read supported_krb5_enctype
  - Allow zarafa domains to read /dev/random and /dev/urandom
  - Allow snmpd to read dev_snmp6
  - Allow procmail to talk with cyrus
  - Add fixes for check_disk and check_nagios plugins


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-71
changelog:
  - default trans rules for Rawhide policy
  -  Make sure sound_devices controlC* are labeled correctly on creation
  - sssd now needs sys_admin
  - Allow snmp to read all proc_type
  - Allow to setup users homedir with quota.group


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-70
changelog:
  - Add httpd_can_connect_ldap() interface
  - apcupsd_t needs to use seriel ports connected to usb devices
  - Kde puts procmail mail directory under ~/.local/share
  - nfsd_t can trigger sys_rawio on tests that involve too many mountpoints, dontaudit for now
  - Add labeling for /sbin/iscsiuio


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-69
changelog:
  - Add label for /var/lib/iscan/interpreter
  - Dont audit writes to leaked file descriptors or redirected output for nacl
  - NetworkManager needs to write to /sys/class/net/ib*/mode


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-68
changelog:
  - Allow abrt  to request the kernel to load a module
  - Make sure mozilla content is labeled correctly
  - Allow tgtd to read system state
  - More fixes for boinc
    * allow to resolve dns name
    * re-write boinc policy to use boinc_domain attribute
  - Allow munin services plugins to use NSCD services


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-67
changelog:
  - Allow mozilla_plugin_t to manage mozilla_home_t
  - Allow ssh derived domain to execute ssh-keygen in the ssh_keygen_t domain
  - Add label for tumblerd


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-65
changelog:
  - Fixes related to  /bin, /sbin
  - Allow abrt to getattr on blk files
  - Add type for rhev-agent log file
  - Fix labeling for /dev/dmfm
  - Dontaudit wicd leaking
  - Allow systemd_logind_t to look at process info of apps that exchange dbus messages with it
  - Label /etc/locale.conf correctly
  - Allow user_mail_t to read /dev/random
  - Allow postfix-smtpd to read MIMEDefang
  - Add label for /var/log/suphp.log
  - Allow swat_t to connect and read/write nmbd_t sock_file
  - Allow systemd-tmpfiles to setattr for /run/user/gdm/dconf
  - Allow systemd-tmpfiles to change user identity in object contexts
  - More fixes for rhev_agentd_t consolehelper policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-64
changelog:
  - Use fs_use_xattr for squashf
  -  Fix procs_type interface
  - Dovecot has a new fifo_file /var/run/dovecot/stats-mail
  - Dovecot has a new fifo_file /var/run/stats-mail
  - Colord does not need to connect to network
  - Allow system_cronjob to dbus chat with NetworkManager
  - Puppet manages content, want to make sure it labels everything correctly


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-63
changelog:
  - Change port 9050 to tor_socks_port_t and then allow openvpn to connect to it
  - Allow all postfix domains to use the fifo_file
  - Allow sshd_t to getattr on all file systems in order to generate avc on nfs_t
  - Allow apmd_t to read grub.cfg
  - Let firewallgui read the selinux config
  - Allow systemd-tmpfiles to delete content in /root that has been moved to /tmp
  - Fix devicekit_manage_pid_files() interface
  - Allow squid to check the network state
  - Dontaudit colord getattr on file systems
  - Allow ping domains to read zabbix_tmp_t files


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-59
changelog:
  - Allow mcelog_t to create dir and file in /var/run and label it correctly
  - Allow dbus to manage fusefs
  - Mount needs to read process state when mounting gluster file systems
  - Allow collectd-web to read collectd lib files
  - Allow daemons and system processes started by init to read/write the unix_stream_socket passed in from as stdin/stdout/stderr
  - Allow colord to get the attributes of tmpfs filesystem
  - Add sanlock_use_nfs and sanlock_use_samba booleans
  - Add bin_t label for /usr/lib/virtualbox/VBoxManage


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-58
changelog:
  - Add ssh_dontaudit_search_home_dir
  - Changes to allow namespace_init_t to work
  - Add interface to allow exec of mongod, add port definition for mongod port, 27017
  - Label .kde/share/apps/networkmanagement/certificates/ as home_cert_t
  - Allow spamd and clamd to steam connect to each other
  - Add policy label for passwd.OLD
  - More fixes for postfix and postfix maildro
  - Add ftp support for mozilla plugins
  - Useradd now needs to manage policy since it calls libsemanage
  - Fix devicekit_manage_log_files() interface
  - Allow colord to execute ifconfig
  - Allow accountsd to read /sys
  - Allow mysqld-safe to execute shell
  - Allow openct to stream connect to pcscd
  - Add label for /var/run/nm-dns-dnsmasq\.conf
  - Allow networkmanager to chat with virtd_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-55
changelog:
  - Add more MCS fixes to make sandbox working
  - Make faillog MLS trusted to make sudo_$1_t working
  - Allow sandbox_web_client_t to read passwd_file_t
  - Add .mailrc file context
  - Remove execheap from openoffice domain
  - Allow chrome_sandbox_nacl_t to read cpu_info
  - Allow virtd to relabel generic usb which is need if USB device
  - Fixes for virt.if interfaces to consider chr_file as image file type


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-53
changelog:
  - Make nvidia* to be labeled correctly
  - Fix abrt_manage_cache() interface
  - Make filetrans rules optional so base policy will build
  - Dontaudit chkpwd_t access to inherited TTYS
  - Make sure postfix content gets created with the correct label
  - Allow gnomeclock to read cgroup
  - Fixes for cloudform policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-51
changelog:
  -  Begin removing qemu_t domain, we really no longer need this domain.  
  - systemd_passwd needs dac_overide to communicate with users TTY's
  - Allow svirt_lxc domains to send kill signals within their container


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-50
changelog:
  - Allow policykit to talk to the systemd via dbus
  - Move chrome_sandbox_nacl_t to permissive domains
  - Additional rules for chrome_sandbox_nacl


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-49
changelog:
  - Change bootstrap name to nacl
  - Chrome still needs execmem
  - Missing role for chrome_sandbox_bootstrap
  - Add boolean to remove execmem and execstack from virtual machines
  - Dontaudit xdm_t doing an access_check on etc_t directories


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-48
changelog:
  - Allow named to connect to dirsrv by default
  - add ldapmap1_0 as a krb5_host_rcache_t file
  - Google chrome developers asked me to add bootstrap policy for nacl stuff
  - Allow rhev_agentd_t to getattr on mountpoints
  - Postfix_smtpd_t needs access to milters and cleanup seems to read/write postfix_smtpd_t unix_stream_sockets


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-47
changelog:
  - Fixes for cloudform policies which need to connect to random ports
  - Make sure if an admin creates modules content it creates them with the correct label
  - Add port 8953 as a dns port used by unbound
  - Fix file name transition for alsa and confined users


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-41
changelog:
  - Allow svirt_lxc_domain to chr_file and blk_file devices if they are in the domain
  - Allow init process to setrlimit on itself
  - Take away transition rules for users executing ssh-keygen
  - Allow setroubleshoot_fixit_t to read /dev/urand
  - Allow sshd to relbale tunnel sockets
  - Allow fail2ban domtrans to shorewall in the same way as with iptables
  - Add support for lnk files in the /var/lib/sssd directory
  - Allow system mail to connect to courier-authdaemon over an unix stream socket


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-40
changelog:
  - Dontaudit access checks for all executables, gnome-shell is doing access(EXEC, X_OK)
  - Make corosync to be able to relabelto cluster lib fies
  - Allow samba domains to search /var/run/nmbd
  - Allow dirsrv to use pam
  - Allow thumb to call getuid
  - chrome less likely to get mmap_zero bug so removing dontaudit
  - gimp help-browser has built in javascript
  - Best guess is that devices named /dev/bsr4096 should be labeled as cpu_device_t
  - Re-write glance policy


author: Dan Walsh <dwalsh@redhat.com> 3.10.0-39.3
changelog:
  - Move dontaudit sys_ptrace line from permissive.te to domain.te
  - Remove policy for hal, it no longer exists


author: Dan Walsh <dwalsh@redhat.com> 3.10.0-39.1
changelog:
  - Remove allow_ptrace and replace it with deny_ptrace, which will remove all 
  ptrace from the system
  - Remove 2000 dontaudit rules between confined domains on transition
  and replace with single
  dontaudit domain domain:process { noatsecure siginh rlimitinh } ;


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-39
changelog:
  - Fixes for bootloader policy
  - $1_gkeyringd_t needs to read $HOME/%USER/.local/share/keystore
  - Allow nsplugin to read /usr/share/config
  - Allow sa-update to update rules
  - Add use_fusefs_home_dirs for chroot ssh option
  - Fixes for grub2
  - Update systemd_exec_systemctl() interface
  - Allow gpg to read the mail spool
  - More fixes for sa-update running out of cron job
  - Allow ipsec_mgmt_t to read hardware state information
  - Allow pptp_t to connect to unreserved_port_t
  - Dontaudit getattr on initctl in /dev from chfn
  - Dontaudit getattr on kernel_core from chfn
  - Add systemd_list_unit_dirs to systemd_exec_systemctl call
  - Fixes for collectd policy
  - CHange sysadm_t to create content as user_tmp_t under /tmp


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-38
changelog:
  - Allow virsh to read xenstored pid file
  - Backport corenetwork fixes from upstream
  - Do not audit attempts by thumb to search config_home_t dirs (~/.config)
  - label ~/.cache/telepathy/logger telepathy_logger_cache_home_t
  - allow thumb to read generic data home files (mime.type)


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-37
changelog:
  - Allow nmbd to manage sock file in /var/run/nmbd
  - ricci_modservice send syslog msgs
  - Stop transitioning from unconfined_t to ldconfig_t, but make sure /etc/ld.so.cache is labeled correctly
  - Allow systemd_logind_t to manage /run/USER/dconf/user


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-36
changelog:
  - Allow logrotate setuid and setgid since logrotate is supposed to do it
  - Fixes for thumb policy by grift
  - Add new nfsd ports
  - Added fix to allow confined apps to execmod on chrome
  - Add labeling for additional vdsm directories
  - Allow Exim and Dovecot SASL
  - Add label for /var/run/nmbd
  - Add fixes to make virsh and xen working together
  - Colord executes ls
  - /var/spool/cron  is now labeled as user_cron_spool_t


author: Dan Walsh <dwalsh@redhat.com> 3.10.0-34.4
changelog:
  - Fixes caused by the labeling of /etc/passwd
  - Add thumb.patch to transition unconfined_t to thumb_t for Rawhide


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-34.3
changelog:
  - Add support for Clustered Samba commands
  - Allow ricci_modrpm_t to send log msgs
  - move permissive virt_qmf_t from virt.te to permissivedomains.te
  - Allow ssh_t to use kernel keyrings
  - Add policy for libvirt-qmf and more fixes for linux containers
  - Initial Polipo
  - Sanlock needs to run ranged in order to kill svirt processes
  - Allow smbcontrol to stream connect to ctdbd


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-34
changelog:
  - Make mta_role() active
  - Allow asterisk to connect to jabber client port
  - Allow procmail to read utmp
  - Add NIS support for systemd_logind_t
  - Allow systemd_logind_t to manage /run/user/$USER/dconf dir which is labeled as config_home_t
  - Fix systemd_manage_unit_dirs() interface
  - Allow ssh_t to manage directories passed into it
  - init needs to be able to create and delete unit file directories
  - Fix typo in apache_exec_sys_script
  - Add ability for logrotate to transition to awstat domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-33
changelog:
  - Change screen to use screen_domain attribute and allow screen_domains to read all process domain state
  - Add SELinux support for ssh pre-auth net process in F17
  - Add logging_syslogd_can_sendmail boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-29
changelog:
  - Allow sanlock to manage virt lib files
  - Add virt_use_sanlock booelan
  - ksmtuned is trying to resolve uids
  - Make sure .gvfs is labeled user_home_t in the users home directory
  - Sanlock sends kill signals and needs the kill capability
  - Allow mockbuild to work on nfs homedirs
  - Fix kerberos_manage_host_rcache() interface
  - Allow exim to read system state


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-28
changelog:
  - Allow systemd-tmpfiles to set the correct labels on /var/run, /tmp and other files
  - We want any file type that is created in /tmp by a process running as initrc_t to be labeled initrc_tmp_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-27
changelog:
  -  Allow collectd to read hardware state information
  - Add loop_control_device_t
  - Allow mdadm to request kernel to load module
  - Allow domains that start other domains via systemctl to search unit dir
  - systemd_tmpfilses, needs to list any file systems mounted on /tmp
  - No one can explain why radius is listing the contents of /tmp, so we will dontaudit
  - If I can manage etc_runtime files, I should be able to read the links
  - Dontaudit hostname writing to mock library chr_files
  - Have gdm_t setup labeling correctly in users home dir
  - Label content unde /var/run/user/NAME/dconf as config_home_t
  - Allow sa-update to execute shell
  - Make ssh-keygen working with fips_enabled
  - Make mock work for staff_t user
  - Tighten security on mock_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-26
changelog:
  - removing unconfined_notrans_t no longer necessary
  - Clean up handling of secure_mode_insmod and secure_mode_policyload
  - Remove unconfined_mount_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-25
changelog:
  - Add exim_exec_t label for /usr/sbin/exim_tidydb
  - Call init_dontaudit_rw_stream_socket() interface in mta policy
  - sssd need to search /var/cache/krb5rcache directory
  - Allow corosync to relabel own tmp files
  - Allow zarafa domains to send system log messages
  - Allow ssh to do tunneling
  - Allow initrc scripts to sendto init_t unix_stream_socket
  - Changes to make sure dmsmasq and virt directories are labeled correctly
  - Changes needed to allow sysadm_t to manage systemd unit files
  - init is passing file descriptors to dbus and on to system daemons
  - Allow sulogin additional access Reported by dgrift and Jeremy Miller
  - Steve Grubb believes that wireshark does not need this access
  - Fix /var/run/initramfs to stop restorecon from looking at
  - pki needs another port
  - Add more labels for cluster scripts
  - Allow apps that manage cgroup_files to manage cgroup link files
  - Fix label on nfs-utils scripts directories
  - Allow gatherd to read /dev/rand and /dev/urand


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-24
changelog:
  - pki needs another port
  - Add more labels for cluster scripts
  - Fix label on nfs-utils scripts directories
  - Fixes for cluster
  - Allow gatherd to read /dev/rand and /dev/urand
  - abrt leaks fifo files


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-23
changelog:
  - Add glance policy
  - Allow mdadm setsched
  - /var/run/initramfs should not be relabeled with a restorecon run
  - memcache can be setup to override sys_resource
  - Allow httpd_t to read tetex data
  - Allow systemd_tmpfiles to delete kernel modules left in /tmp directory.


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-22
changelog:
  - Allow Postfix to deliver to Dovecot LMTP socket
  - Ignore bogus sys_module for lldpad
  - Allow chrony and gpsd to send dgrams, gpsd needs to write to the real time clock
  - systemd_logind_t sets the attributes on usb devices
  - Allow hddtemp_t to read etc_t files
  - Add permissivedomains module
  - Move all permissive domains calls to permissivedomain.te
  - Allow pegasis to send kill signals to other UIDs


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-21
changelog:
  - Allow insmod_t to use fds leaked from devicekit
  - dontaudit getattr between insmod_t and init_t unix_stream_sockets
  - Change sysctl unit file interfaces to use systemctl
  - Add support for chronyd unit file
  - Allow mozilla_plugin to read gnome_usr_config
  - Add policy for new gpsd
  - Allow cups to create kerberos rhost cache files
  - Add authlogin_filetrans_named_content, to unconfined_t to make sure shadow and other log files get labeled correctly


author: Dan Walsh <dwalsh@redhat.com> 3.10.0-20
changelog:
  - Make users_extra and seusers.final into config(noreplace) so semanage users and login does not get overwritten


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-19
changelog:
  - Add policy for sa-update being run out of cron jobs
  - Add create perms to postgresql_manage_db
  - ntpd using a gps has to be able to read/write generic tty_device_t
  - If you disable unconfined and unconfineduser, rpm needs more privs to manage /dev
  - fix spec file
  - Remove qemu_domtrans_unconfined() interface
  - Make passenger working together with puppet
  - Add init_dontaudit_rw_stream_socket interface
  - Fixes for wordpress


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-18
changelog:
  - Turn on allow_domain_fd_use boolean on F16
  - Allow syslog to manage all log files
  - Add use_fusefs_home_dirs boolean for chrome
  - Make vdagent working with confined users
  - Add abrt_handle_event_t domain for ABRT event scripts
  - Labeled /usr/sbin/rhnreg_ks as rpm_exec_t and added changes related to this change
  - Allow httpd_git_script_t to read passwd data
  - Allow openvpn to set its process priority when the nice parameter is used


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-16
changelog:
  - fetchmail can use kerberos
  - ksmtuned reads in shell programs
  - gnome_systemctl_t reads the process state of ntp
  - dnsmasq_t asks the kernel to load multiple kernel modules
  - Add rules for domains executing systemctl
  - Bogus text within fc file


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-13
changelog:
  - Add abrt_domain attribute
  - Allow corosync to manage cluster lib files
  - Allow corosync to connect to the system DBUS


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-10
changelog:
  - Allow rcsmcertd to perform DNS name resolution
  - Add dirsrvadmin_unconfined_script_t domain type for 389-ds admin scripts
  - Allow tmux to run as screen
  - New policy for collectd
  - Allow gkeyring_t to interact with all user apps
  - Add rules to allow firstboot to run on machines with the unconfined.pp module removed


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-9
changelog:
  - Allow systemd_logind to send dbus messages with users
  - allow accountsd to read wtmp file
  - Allow dhcpd to get and set capabilities


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-8
changelog:
  - Fix oracledb_port definition
  - Allow mount to mounton the selinux file system
  - Allow users to list /var directories


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-6
changelog:
  - Add initial policy for abrt_dump_oops_t
  - xtables-multi wants to getattr of the proc fs
  - Smoltclient is connecting to abrt
  - Dontaudit leaked file descriptors to postdrop
  - Allow abrt_dump_oops to look at kernel sysctls
  - Abrt_dump_oops_t reads kernel ring buffer
  - Allow mysqld to request the kernel to load modules
  - systemd-login needs fowner
  - Allow postfix_cleanup_t to searh maildrop


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-5
changelog:
  - Initial systemd_logind policy
  - Add policy for systemd_logger and additional proivs for systemd_logind
  - More fixes for systemd policies


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-4
changelog:
  - Allow setsched for virsh
  - Systemd needs to impersonate cups, which means it needs to create tcp_sockets in cups_t domain, as well as manage spool directories
  - iptables: the various /sbin/ip6?tables.* are now symlinks for
  /sbin/xtables-multi


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-3
changelog:
  - A lot of users are running yum -y update while in /root which is causing ldconfig to list the contents, adding dontaudit
  - Allow colord to interact with the users through the tmpfs file system
  - Since we changed the label on deferred, we need to allow postfix_qmgr_t to be able to create maildrop_t files
  - Add label for /var/log/mcelog
  - Allow asterisk to read /dev/random if it uses TLS
  - Allow colord to read ini files which are labeled as bin_t
  - Allow dirsrvadmin sys_resource and setrlimit to use ulimit
  - Systemd needs to be able to create sock_files for every label in /var/run directory, cupsd being the first.  
  - Also lists /var and /var/spool directories
  - Add openl2tpd to l2tpd policy
  - qpidd is reading the sysfs file


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-2
changelog:
  - Change usbmuxd_t to dontaudit attempts to read chr_file
  - Add mysld_safe_exec_t for libra domains to be able to start private mysql domains
  - Allow pppd to search /var/lock dir
  - Add rhsmcertd policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-29
changelog:
  - Add dspam policy
  - Add lldpad policy
  - dovecot auth wants to search statfs #713555
  - Allow systemd passwd apps to read init fifo_file
  - Allow prelink to use inherited terminals
  - Run cherokee in the httpd_t domain
  - Allow mcs constraints on node connections
  - Implement pyicqt policy
  - Fixes for zarafa policy
  - Allow cobblerd to send syslog messages


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-27
changelog:
  - Fixes for zabbix
  - init script needs to be able to manage sanlock_var_run_...
  - Allow sandlock and wdmd to create /var/run directories... 
  - mixclip.so has been compiled correctly
  - Fix passenger policy module name


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-26
changelog:
  - Add mailscanner policy from dgrift
  - Allow chrome to optionally be transitioned to
  - Zabbix needs these rules when starting the zabbix_server_mysql
  - Implement a type for freedesktop openicc standard (~/.local/share/icc)
  - Allow system_dbusd_t to read inherited icc_data_home_t files.
  - Allow colord_t to read icc_data_home_t content. #706975
  - Label stuff under /usr/lib/debug as if it was labeled under /


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-25
changelog:
  - Fixes for sanlock policy
  - Fixes for colord policy
  - Other fixes
  	* http://git.fedorahosted.org/git/?p=selinux-policy.git;a=log


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-22
changelog:
  - Allow logrotate to execute systemctl
  - Allow nsplugin_t to getattr on gpmctl
  - Fix dev_getattr_all_chr_files() interface
  - Allow shorewall to use inherited terms
  - Allow userhelper to getattr all chr_file devices
  - sandbox domains should be able to getattr and dontaudit search of sysctl_kernel_t
  - Fix labeling for ABRT Retrace Server


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-21
changelog:
  - Dontaudit sys_module for ifconfig
  - Make telepathy and gkeyringd daemon working with confined users
  - colord wants to read files in users homedir
  - Remote login should be creating user_tmp_t not its own tmp files


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-20
changelog:
  - Fix label for /usr/share/munin/plugins/munin_* plugins
  - Add support for zarafa-indexer
  - Fix boolean description
  - Allow colord to getattr on /proc/scsi/scsi
  - Add label for /lib/upstart/init
  - Colord needs to list /mnt


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-19
changelog:
  - Forard port changes from F15 for telepathy
  - NetworkManager should be allowed to use /dev/rfkill
  - Fix dontaudit messages to say Domain to not audit
  - Allow telepathy domains to read/write gnome_cache files
  - Allow telepathy domains to call getpw
  - Fixes for colord and vnstatd policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-18
changelog:
  - Allow init_t getcap and setcap
  - Allow namespace_init_t to use nsswitch
  - aisexec will execute corosync
  - colord tries to read files off noxattr file systems
  - Allow init_t getcap and setcap


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-17
changelog:
  - Add support for ABRT retrace server
  - Allow user_t and staff_t access to generic scsi to handle locally plugged in scanners
  - Allow telepath_msn_t to read /proc/PARENT/cmdline
  - ftpd needs kill capability
  - Allow telepath_msn_t to connect to sip port
  - keyring daemon does not work on nfs homedirs
  - Allow $1_sudo_t to read default SELinux context
  - Add label for tgtd sock file in /var/run/
  - Add apache_exec_rotatelogs interface
  - allow all zaraha domains to signal themselves, server writes to /tmp
  - Allow syslog to read the process state
  - Add label for /usr/lib/chromium-browser/chrome
  - Remove the telepathy transition from unconfined_t
  - Dontaudit sandbox domains trying to mounton sandbox_file_t, this is caused by fuse mounts
  - Allow initrc_t domain to manage abrt pid files
  - Add support for AEOLUS project
  - Virt_admin should be allowed to manage images and processes
  - Allow plymountd to send signals to init
  - Change labeling of fping6


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-16
changelog:
  - Fixes for zarafa policy
  - Add support for AEOLUS project
  - Change labeling of fping6
  - Allow plymountd to send signals to init
  - Allow initrc_t domain to manage abrt pid files
  - Virt_admin should be allowed to manage images and processes


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-15
changelog:
  - xdm_t needs getsession for switch user 
  - Every app that used to exec init is now execing systemdctl 
  - Allow squid to manage krb5_host_rcache_t files 
  - Allow foghorn to connect to agentx port - Fixes for colord policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-14
changelog:
  - Add Dan's patch to remove 64 bit variants
  - Allow colord to use unix_dgram_socket 
  - Allow apps that search pids to read /var/run if it is a lnk_file 
  - iscsid_t creates its own directory 
  - Allow init to list var_lock_t dir 
  - apm needs to verify user accounts auth_use_nsswitch
  - Add labeling for systemd unit files
  - Allow gnomeclok to enable ntpd service using systemctl - systemd_systemctl_t domain was added
  - Add label for matahari-broker.pid file
  - We want to remove untrustedmcsprocess from ability to read /proc/pid
  - Fixes for matahari policy
  - Allow system_tmpfiles_t to delete user_home_t files in the /tmp dir
  - Allow sshd to transition to sysadm_t if ssh_sysadm_login is turned on


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-12
changelog:
  - Add /var/run/lock /var/lock definition to file_contexts.subs
  - nslcd_t is looking for kerberos cc files
  - SSH_USE_STRONG_RNG is 1 which requires /dev/random
  - Fix auth_rw_faillog definition
  - Allow sysadm_t to set attributes on fixed disks
  - allow user domains to execute lsof and look at application sockets
  - prelink_cron job calls telinit -u if init is rewritten
  - Fixes to run qemu_t from staff_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-10
changelog:
  - Add file_contexts.subs to handle /run and /run/lock
  - Add other fixes relating to /run changes from F15 policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-7
changelog:
  - Allow $1_sudo_t and $1_su_t open access to user terminals
  - Allow initrc_t to use generic terminals
  - Make Makefile/Rules.modular run sepolgen-ifgen during build to check if files for bugs
  -systemd is going to be useing /run and /run/lock for early bootup files.
  - Fix some comments in rlogin.if
  - Add policy for KDE backlighthelper
  - sssd needs to read ~/.k5login in nfs, cifs or fusefs file systems
  - sssd wants to read .k5login file in users homedir
  - setroubleshoot reads executables to see if they have TEXTREL
  - Add /var/spool/audit support for new version of audit
  - Remove kerberos_connect_524() interface calling
  - Combine kerberos_master_port_t and kerberos_port_t
  - systemd has setup /dev/kmsg as stderr for apps it executes
  - Need these access so that init can impersonate sockets on unix_dgram_socket


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-5
changelog:
  - Fix multiple specification for boot.log
  - devicekit leaks file descriptors to setfiles_t
  - Change all all_nodes to generic_node and all_if to generic_if
  - Should not use deprecated interface
  - Switch from using all_nodes to generic_node and from all_if to generic_if
  - Add support for xfce4-notifyd
  - Fix file context to show several labels as SystemHigh
  - seunshare needs to be able to mounton nfs/cifs/fusefs homedirs
  - Add etc_runtime_t label for /etc/securetty
  - Fixes to allow xdm_t to start gkeyringd_USERTYPE_t directly
  - login.krb needs to be able to write user_tmp_t
  - dirsrv needs to bind to port 7390 for dogtag
  - Fix a bug in gpg policy
  - gpg sends audit messages
  - Allow qpid to manage matahari files


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-4
changelog:
  - Initial policy for matahari
  - Add dev_read_watchdog
  - Allow clamd to connect clamd port
  - Add support for kcmdatetimehelper
  - Allow shutdown to setrlimit and sys_nice
  - Allow systemd_passwd to talk to /dev/log before udev or syslog is running
  - Purge chr_file and blk files on /tmp
  - Fixes for pads
  - Fixes for piranha-pulse
  - gpg_t needs to be able to encyprt anything owned by the user


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-3
changelog:
  - mozilla_plugin_tmp_t needs to be treated as user tmp files
  - More dontaudits of writes from readahead
  - Dontaudit readahead_t file_type:dir write, to cover up kernel bug
  - systemd_tmpfiles needs to relabel faillog directory as well as the file
  - Allow hostname and consoletype to r/w inherited initrc_tmp_t files handline hostname >> /tmp/myhost


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-2
changelog:
  - Add policykit fixes from Tim Waugh
  - dontaudit sandbox domains sandbox_file_t:dir mounton
  - Add new dontaudit rules for sysadm_dbusd_t
  - Change label for /var/run/faillock
  	* other fixes which relate with this change


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-1
changelog:
  - Update to upstream
  - Fixes for telepathy
  - Add port defition for ssdp port
  - add policy for /bin/systemd-notify from Dan
  - Mount command requires users read mount_var_run_t
  - colord needs to read konject_uevent_socket
  - User domains connect to the gkeyring socket
  - Add colord policy and allow user_t and staff_t to dbus chat with it
  - Add lvm_exec_t label for kpartx
  - Dontaudit reading the mail_spool_t link from sandbox -X
  - systemd is creating sockets in avahi_var_run and system_dbusd_var_run


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.15-5
changelog:
  - gpg_t needs to talk to gnome-keyring
  - nscd wants to read /usr/tmp->/var/tmp to generate randomziation in unixchkpwd
  - enforce MCS labeling on nodes
  - Allow arpwatch to read meminfo
  - Allow gnomeclock to send itself signals
  - init relabels /dev/.udev files on boot
  - gkeyringd has to transition back to staff_t when it runs commands in bin_t or shell_exec_t
  - nautilus checks access on /media directory before mounting usb sticks, dontaudit access_check on mnt_t
  - dnsmasq can run as a dbus service, needs acquire service
  - mysql_admin should  be allowed to connect to mysql service
  - virt creates monitor sockets in the users home dir


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.15-2
changelog:
  - Allow usbhid-ups to read hardware state information
  - systemd-tmpfiles has moved
  - Allo cgroup to sys_tty_config
  - For some reason prelink is attempting to read gconf settings
  - Add allow_daemons_use_tcp_wrapper boolean
  - Add label for ~/.cache/wocky to make telepathy work in enforcing mode
  - Add label for char devices /dev/dasd*
  - Fix for apache_role
  - Allow amavis to talk to nslcd
  - allow all sandbox to read selinux poilcy config files
  - Allow cluster domains to use the system bus and send each other dbus messages


author: Dan Walsh <dwalsh@redhat.com> 3.9.14-1
changelog:
  - Update to ref policy
  - cgred needs chown capability
  - Add /dev/crash crash_dev_t
  - systemd-readahead wants to use fanotify which means readahead_t needs sys_admin capability


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.13-10
changelog:
  - New labeling for postfmulti #675654
  - dontaudit xdm_t listing noxattr file systems
  - dovecot-auth needs to be able to connect to mysqld via the network as well as locally
  - shutdown is passed stdout to a xdm_log_t file
  - smartd creates a fixed disk device
  - dovecot_etc_t contains a lnk_file that domains need to read
  - mount needs to be able to read etc_runtim_t:lnk_file since in rawhide this is a link created at boot


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.13-9
changelog:
  - syslog_t needs syslog capability
  - dirsrv needs to be able to create /var/lib/snmp
  - Fix labeling for dirsrv
  - Fix for dirsrv policy missing manage_dirs_pattern
  - corosync needs to delete clvm_tmpfs_t files
  - qdiskd needs to list hugetlbfs
  - Move setsched to sandbox_x_domain, so firefox can run without network access
  - Allow hddtemp to read removable devices
  - Adding syslog and read_policy permissions to policy
  	* syslog
  		Allow unconfined, sysadm_t, secadm_t, logadm_t
  	* read_policy
  		allow unconfined, sysadm_t, secadm_t, staff_t on Targeted
  		allow sysadm_t (optionally), secadm_t on MLS
  - mdadm application will write into /sys/.../uevent whenever arrays are
  assembled or disassembled.


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.13-7
changelog:
  - ricci_modclusterd_t needs to bind to rpc ports 500-1023
  - Allow dbus to use setrlimit to increase resoueces
  - Mozilla_plugin is leaking to sandbox
  - Allow confined users  to connect to lircd over unix domain stream socket which allow to use remote control
  - Allow awstats to read squid logs
  - seunshare needs to manage tmp_t
  - apcupsd cgi scripts have a new directory


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.13-6
changelog:
  - Fix xserver_dontaudit_read_xdm_pid
  - Change oracle_port_t to oracledb_port_t to prevent conflict with satellite
  - Allow dovecot_deliver_t to read/write postfix_master_t:fifo_file. 
  	* These fifo_file is passed from postfix_master_t to postfix_local_t to dovecot_deliver_t
  - Allow readahead to manage readahead pid dirs
  - Allow readahead to read all mcs levels
  - Allow mozilla_plugin_t to use nfs or samba homedirs


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.13-5
changelog:
  - Allow nagios plugin to read /proc/meminfo
  - Fix for mozilla_plugin
  - Allow samba_net_t to create /etc/keytab
  - pppd_t setting up vpns needs to run unix_chkpwd, setsched its process and write wtmp_t
  - nslcd can read user credentials
  - Allow nsplugin to delete mozilla_plugin_tmpfs_t
  - abrt tries to create dir in rpm_var_lib_t
  - virt relabels fifo_files
  - sshd needs to manage content in fusefs homedir
  - mock manages link files in cache dir


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.13-4
changelog:
  - nslcd needs setsched and to read /usr/tmp
  - Invalid call in likewise policy ends up creating a bogus role
  - Cannon puts content into /var/lib/bjlib that cups needs to be able to write
  - Allow screen to create screen_home_t in /root
  - dirsrv sends syslog messages
  - pinentry reads stuff in .kde directory
  - Add labels for .kde directory in homedir
  - Treat irpinit, iprupdate, iprdump services with raid policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.13-3
changelog:
  - NetworkManager wants to read consolekit_var_run_t
  - Allow readahead to create /dev/.systemd/readahead
  - Remove permissive domains
  - Allow newrole to run namespace_init


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.12-8
changelog:
  - Add oracle ports and allow apache to connect to them if the connect_db boolean is turned on
  - Add puppetmaster_use_db boolean
  - Fixes for zarafa policy
  - Fixes for gnomeclock poliy
  - Fix systemd-tmpfiles to use auth_use_nsswitch


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.12-7
changelog:
  - gnomeclock executes a shell
  - Update for screen policy to handle pipe in homedir
  - Fixes for polyinstatiated homedir
  - Fixes for namespace policy and other fixes related to polyinstantiation
  - Add namespace policy
  - Allow dovecot-deliver transition to sendmail which is needed by sieve scripts
  - Fixes for init, psad policy which relate with confined users
  - Do not audit bootloader attempts to read devicekit pid files
  - Allow nagios service plugins to read /proc


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.12-6
changelog:
  - Add firewalld policy
  - Allow vmware_host to read samba config
  - Kernel wants to read /proc Fix duplicate grub def in cobbler
  - Chrony sends mail, executes shell, uses fifo_file and reads /proc
  - devicekitdisk getattr all file systems
  - sambd daemon writes wtmp file
  - libvirt transitions to dmidecode


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.12-5
changelog:
  - Add initial policy for system-setup-keyboard which is now daemon
  - Label /var/lock/subsys/shorewall as shorewall_lock_t
  - Allow users to communicate with the gpg_agent_t
  - Dontaudit mozilla_plugin_t using the inherited terminal
  - Allow sambagui to read files in /usr
  - webalizer manages squid log files
  - Allow unconfined domains to bind ports to raw_ip_sockets
  - Allow abrt to manage rpm logs when running yum
  - Need labels for /var/run/bittlebee
  - Label .ssh under amanda
  - Remove unused genrequires for virt_domain_template
  - Allow virt_domain to use fd inherited from virtd_t
  - Allow iptables to read shorewall config


author: Dan Walsh <dwalsh@redhat.com> 3.9.12-4
changelog:
  - Gnome apps list config_home_t
  - mpd creates lnk files in homedir
  - apache leaks write to mail apps on tmp files
  - /var/stockmaniac/templates_cache contains log files
  - Abrt list the connects of mount_tmp_t dirs
  - passwd agent reads files under /dev and reads utmp file
  - squid apache script connects to the squid port
  - fix name of plymouth log file
  - teamviewer is a wine app
  - allow dmesg to read system state
  - Stop labeling files under /var/lib/mock so restorecon will not go into this 
  - nsplugin needs to read network state for google talk


author: Dan Walsh <dwalsh@redhat.com> 3.9.12-3
changelog:
  - Allow xdm and syslog to use /var/log/boot.log
  - Allow users to communicate with mozilla_plugin and kill it
  - Add labeling for ipv6 and dhcp


author: Dan Walsh <dwalsh@redhat.com> 3.9.12-2
changelog:
  - New labels for ghc http content
  - nsplugin_config needs to read urand, lvm now calls setfscreate to create dev
  - pm-suspend now creates log file for append access so we remove devicekit_wri
  - Change authlogin_use_sssd to authlogin_nsswitch_use_ldap
  - Fixes for greylist_milter policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.12-1
changelog:
  - Update to upstream
  - Fixes for systemd policy
  - Fixes for passenger policy
  - Allow staff users to run mysqld in the staff_t domain, akonadi needs this
  - Add bin_t label for /usr/share/kde4/apps/kajongg/kajongg.py
  - auth_use_nsswitch does not need avahi to read passwords,needed for resolving data
  - Dontaudit (xdm_t) gok attempting to list contents of /var/account
  - Telepathy domains need to read urand
  - Need interface to getattr all file classes in a mock library for setroubleshoot


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.10-13
changelog:
  - Allow sandbox to run on nfs partitions, fixes for systemd_tmpfs
  - remove per sandbox domains devpts types
  - Allow dkim-milter sending signal to itself


author: Dan Walsh <dwalsh@redhat.com> 3.9.10-12
changelog:
  - Allow domains that transition to ping or traceroute, kill them
  - Allow user_t to conditionally transition to ping_t and traceroute_t
  - Add fixes to systemd- tools, including new labeling for systemd-fsck, systemd-cryptsetup


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.10-11
changelog:
  - Turn on systemd policy
  - mozilla_plugin needs to read certs in the homedir.
  - Dontaudit leaked file descriptors from devicekit
  - Fix ircssi to use auth_use_nsswitch
  - Change to use interface without param in corenet to disable unlabelednet packets
  - Allow init to relabel sockets and fifo files in /dev
  - certmonger needs dac* capabilities to manage cert files not owned by root
  - dovecot needs fsetid to change group membership on mail
  - plymouthd removes /var/log/boot.log
  - systemd is creating symlinks in /dev
  - Change label on /etc/httpd/alias to be all cert_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.10-10
changelog:
  - Fixes for clamscan and boinc policy
  - Add boinc_project_t setpgid
  - Allow alsa to create tmp files in /tmp


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.10-7
changelog:
  - Fix the label for wicd log
  - plymouthd creates force-display-on-active-vt file
  - Allow avahi to request the kernel to load a module
  - Dontaudit hal leaks
  - Fix gnome_manage_data interface
  - Add new interface corenet_packet to define a type as being an packet_type.
  - Removed general access to packet_type from icecast and squid.
  - Allow mpd to read alsa config
  - Fix the label for wicd log
  - Add systemd policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.10-6
changelog:
  - Fix gnome_manage_data interface
  - Dontaudit sys_ptrace capability for iscsid
  - Fixes for nagios plugin policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.10-5
changelog:
  - Fix cron to run ranged when started by init
  - Fix devicekit to use log files
  - Dontaudit use of devicekit_var_run_t for fstools
  - Allow init to setattr on logfile directories
  - Allow hald to manage files in /var/run/pm-utils/ dir which is now labeled as devicekit_var_run_t


author: Dan Walsh <dwalsh@redhat.com> 3.9.10-4
changelog:
  - Fix up handling of dnsmasq_t creating /var/run/libvirt/network
  - Turn on sshd_forward_ports boolean by default
  - Allow sysadmin to dbus chat with rpm
  - Add interface for rw_tpm_dev
  - Allow cron to execute bin
  - fsadm needs to write sysfs
  - Dontaudit consoletype reading /var/run/pm-utils
  - Lots of new privs fro mozilla_plugin_t running java app, make mozilla_plugin
  - certmonger needs to manage dirsrv data
  - /var/run/pm-utils should be labeled as devicekit_var_run_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.10-3
changelog:
  - fixes to allow /var/run and /var/lock as tmpfs
  - Allow chrome sandbox to connect to web ports
  - Allow dovecot to listem on lmtp and sieve ports
  - Allov ddclient to search sysctl_net_t
  - Transition back to original domain if you execute the shell


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.9-4
changelog:
  - Allow ddclient to fix file mode bits of ddclient conf file
  - init leaks file descriptors to daemons
  - Add labels for /etc/lirc/ and
  - Allow amavis_t to exec shell
  - Add label for gssd_tmp_t for /var/tmp/nfs_0


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.9-2
changelog:
  - Turn on allow_postfix_local_write_mail_spool
  - Allow initrc_t to transition to shutdown_t
  - Allow logwatch and cron to mls_read_to_clearance for MLS boxes
  - Allow wm to send signull to all applications and receive them from users
  - lircd patch from field
  - Login programs have to read /etc/samba
  - New programs under /lib/systemd
  - Abrt needs to read config files


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.9-1
changelog:
  - Update to upstream
  - Dontaudit leaked sockets from userdomains to user domains
  - Fixes for mcelog to handle scripts
  - Apply patch from Ruben Kerkhof
  - Allow syslog to search spool dirs


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.8-7
changelog:
  - Allow nagios plugins to read usr files
  - Allow mysqld-safe to send system log messages
  - Fixes fpr ddclient policy
  - Fix sasl_admin interface
  - Allow apache to search zarafa config
  - Allow munin plugins to search /var/lib directory
  - Allow gpsd to read sysfs_t
  - Fix labels on /etc/mcelog/triggers to bin_t


author: Dan Walsh <dwalsh@redhat.com> 3.9.8-6
changelog:
  - Remove saslauthd_tmp_t and transition tmp files to krb5_host_rcache_t
  - Allow saslauthd_t to create krb5_host_rcache_t files in /tmp
  - Fix xserver interface
  - Fix definition of /var/run/lxdm


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.8-5
changelog:
  - Turn on mediawiki policy
  - kdump leaks kdump_etc_t to ifconfig, add dontaudit
  - uux needs to transition to uucpd_t
  - More init fixes relabels man,faillog
  - Remove maxima defs in libraries.fc
  - insmod needs to be able to create tmpfs_t files
  - ping needs setcap


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.8-4
changelog:
  - Allow groupd transition to fenced domain when executes fence_node
  - Fixes for rchs policy
  - Allow mpd to be able to read samba/nfs files


author: Dan Walsh <dwalsh@redhat.com> 3.9.8-3
changelog:
  - Fix up corecommands.fc to match upstream
  - Make sure /lib/systemd/* is labeled init_exec_t
  - mount wants to setattr on all mountpoints
  - dovecot auth wants to read dovecot etc files
  - nscd daemon looks at the exe file of the comunicating daemon
  - openvpn wants to read utmp file
  - postfix apps now set sys_nice and lower limits
  - remote_login (telnetd/login) wants to use telnetd_devpts_t and user_devpts_t to work correctly
  - Also resolves nsswitch
  - Fix labels on /etc/hosts.*
  - Cleanup to make upsteam patch work
  - allow abrt to read etc_runtime_t


author: Dan Walsh <dwalsh@redhat.com> 3.9.7-10
changelog:
  - Fix sandbox to work on nfs homedirs
  - Allow cdrecord to setrlimit
  - Allow mozilla_plugin to read xauth
  - Change label on systemd-logger to syslogd_exec_t
  - Install dirsrv policy from dirsrv package


author: Dan Walsh <dwalsh@redhat.com> 3.9.7-9
changelog:
  - Add virt_home_t, allow init to setattr on xserver_tmp_t and relabel it
  - Udev needs to stream connect to init and kernel
  - Add xdm_exec_bootloader boolean, which allows xdm to execute /sbin/grub and read files in /boot directory


author: Dan Walsh <dwalsh@redhat.com> 3.9.7-8
changelog:
  - Allow NetworkManager to read openvpn_etc_t
  - Dontaudit hplip to write of /usr dirs
  - Allow system_mail_t to create /root/dead.letter as mail_home_t
  - Add vdagent policy for spice agent daemon


author: Dan Walsh <dwalsh@redhat.com> 3.9.7-7
changelog:
  - Dontaudit sandbox sending sigkill to all user domains
  - Add policy for rssh_chroot_helper
  - Add missing flask definitions
  - Allow udev to relabelto removable_t
  - Fix label on /var/log/wicd.log
  - Transition to initrc_t from init when executing bin_t
  - Add audit_access permissions to file
  - Make removable_t a device_node 
  - Fix label on /lib/systemd/*


author: Dan Walsh <dwalsh@redhat.com> 3.9.7-5
changelog:
  - Allow chome to create netlink_route_socket
  - Add additional MATHLAB file context
  - Define nsplugin as an application_domain
  - Dontaudit sending signals from sandboxed domains to other domains
  - systemd requires init to build /tmp /var/auth and /var/lock dirs
  - mount wants to read devicekit_power /proc/ entries
  - mpd wants to connect to soundd port
  - Openoffice causes a setattr on a lib_t file for normal users, add dontaudit
  - Treat lib_t and textrel_shlib_t directories the same
  - Allow mount read access on virtual images


author: Dan Walsh <dwalsh@redhat.com> 3.9.7-4
changelog:
  - Allow sandbox_x_domains to work with nfs/cifs/fusefs home dirs.
  - Allow devicekit_power to domtrans to mount
  - Allow dhcp to bind to udp ports > 1024 to do named stuff
  - Allow ssh_t to exec ssh_exec_t
  - Remove telepathy_butterfly_rw_tmp_files(), dev_read_printk() interfaces which are nolonger used
  - Fix clamav_append_log() intefaces
  - Fix 'psad_rw_fifo_file' interface


author: Dan Walsh <dwalsh@redhat.com> 3.9.6-3
changelog:
  -Mount command from a confined user generates setattr on /etc/mtab file, need to dontaudit this access
  - dovecot-auth_t needs ipc_lock
  - gpm needs to use the user terminal
  - Allow system_mail_t to append ~/dead.letter
  - Allow NetworkManager to edit /etc/NetworkManager/NetworkManager.conf
  - Add pid file to vnstatd
  - Allow mount to communicate with gfs_controld
  - Dontaudit hal leaks in setfiles


author: Dan Walsh <dwalsh@redhat.com> 3.9.6-2
changelog:
  - Lots of fixes for systemd
  - systemd now executes readahead and tmpwatch type scripts
  - Needs to manage random seed


author: Dan Walsh <dwalsh@redhat.com> 3.9.5-11
changelog:
  - Fix fusefs handling
  - Do not allow sandbox to manage nsplugin_rw_t
  - Allow mozilla_plugin_t to connecto its parent
  - Allow init_t to connect to plymouthd running as kernel_t
  - Add mediawiki policy
  - dontaudit sandbox sending signals to itself.  This can happen when they are running at different mcs.
  - Disable transition from dbus_session_domain to telepathy for F14
  - Allow boinc_project to use shm
  - Allow certmonger to search through directories that contain certs
  - Allow fail2ban the DAC Override so it can read log files owned by non root users


author: Dan Walsh <dwalsh@redhat.com> 3.9.5-10
changelog:
  - Start adding support for use_fusefs_home_dirs
  - Add /var/lib/syslog directory file context
  - Add /etc/localtime as locale file context


author: Dan Walsh <dwalsh@redhat.com> 3.9.5-9
changelog:
  - Turn off default transition to mozilla_plugin and telepathy domains from unconfined user 
  - Turn off iptables from unconfined user 
  - Allow sudo to send signals to any domains the user could have transitioned to.
  - Passwd in single user mode needs to talk to console_device_t
  - Mozilla_plugin_t needs to connect to web ports, needs to write to video device, and read alsa_home_t alsa setsup pulseaudio
  - locate tried to read a symbolic link, will dontaudit
  - New labels for telepathy-sunshine content in homedir
  - Google is storing other binaries under /opt/google/talkplugin
  - bluetooth/kernel is creating unlabeled_t socket that I will allow it to use until kernel fixes bug
  - Add boolean for unconfined_t transition to mozilla_plugin_t and telepathy domains, turned off in F14 on in F15
  - modemmanger and bluetooth send dbus messages to devicekit_power
  - Samba needs to getquota on filesystems labeld samba_share_t


author: Dan Walsh <dwalsh@redhat.com> 3.9.5-7
changelog:
  - Fixes to allow mozilla_plugin_t to create nsplugin_home_t directory.
  - Allow mozilla_plugin_t to create tcp/udp/netlink_route sockets
  - Allow confined users to read xdm_etc_t files
  - Allow xdm_t to transition to xauth_t for lxdm program


author: Dan Walsh <dwalsh@redhat.com> 3.9.5-6
changelog:
  - Rearrange firewallgui policy to be more easily updated to upstream, dontaudit search of /home
  - Allow clamd to send signals to itself
  - Allow mozilla_plugin_t to read user home content.  And unlink pulseaudio shm.
  - Allow haze to connect to yahoo chat and messenger port tcp:5050.
  Bz #637339
  - Allow guest to run ps command on its processes by allowing it to read /proc
  - Allow firewallgui to sys_rawio which seems to be required to setup masqerading
  - Allow all domains to search through default_t directories, in order to find differnet labels.  For example people serring up /foo/bar to be share via samba.
  - Add label for /var/log/slim.log


author: Dan Walsh <dwalsh@redhat.com> 3.9.5-5
changelog:
  - Pull in cleanups from dgrift
  - Allow mozilla_plugin_t to execute mozilla_home_t
  - Allow rpc.quota to do quotamod


author: Dan Walsh <dwalsh@redhat.com> 3.9.5-4
changelog:
  - Cleanup policy via dgrift
  - Allow dovecot_deliver to append to inherited log files
  - Lots of fixes for consolehelper


author: Dan Walsh <dwalsh@redhat.com> 3.9.4-3
changelog:
  - Add the ability to send audit messages to confined admin policies
  - Remove permissive domain from cmirrord and dontaudit sys_tty_config
  - Split out unconfined_domain() calls from other unconfined_ calls so we can d
  - virt needs to be able to read processes to clearance for MLS


author: Dan Walsh <dwalsh@redhat.com> 3.9.4-2
changelog:
  - Allow all domains that can use cgroups to search tmpfs_t directory
  - Allow init to send audit messages


author: Dan Walsh <dwalsh@redhat.com> 3.9.3-2
changelog:
  - Handle /var/db/sudo
  - Allow pulseaudio to read alsa config
  - Allow init to send initrc_t dbus messages


author: Dan Walsh <dwalsh@redhat.com> 3.9.3-1
changelog:
  Allow iptables to read shorewall tmp files
  Change chfn and passwd to use auth_use_pam so they can send dbus messages to fpr
  intd
  label vlc as an execmem_exec_t 
  Lots of fixes for mozilla_plugin to run google vidio chat
  Allow telepath_msn to execute ldconfig and its own tmp files
  Fix labels on hugepages
  Allow mdadm to read files on /dev
  Remove permissive domains and change back to unconfined
  Allow freshclam to execute shell and bin_t
  Allow devicekit_power to transition to dhcpc
  Add boolean to allow icecast to connect to any port


author: Dan Walsh <dwalsh@redhat.com> 3.9.2-1
changelog:
  - Merge upstream fix of mmap_zero
  - Allow mount to write files in debugfs_t
  - Allow corosync to communicate with clvmd via tmpfs
  - Allow certmaster to read usr_t files
  - Allow dbus system services to search cgroup_t
  - Define rlogind_t as a login pgm


author: Dan Walsh <dwalsh@redhat.com> 3.9.1-2
changelog:
  - Dominic Grift Cleanup
  - Miroslav Grepl policy for jabberd
  - Various fixes for mount/livecd and prelink


author: Dan Walsh <dwalsh@redhat.com> 3.8.8-20
changelog:
  - Allow cron to look at user_cron_spool links
  - Lots of fixes for mozilla_plugin_t
  - Add sysv file system
  - Turn unconfined domains to permissive to find additional avcs


author: Dan Walsh <dwalsh@redhat.com> 3.8.8-18
changelog:
  - Allow clamscan to read proc_t
  - Allow mount_t to write to debufs_t dir
  - Dontaudit mount_t trying to write to security_t dir


author: Dan Walsh <dwalsh@redhat.com> 3.8.8-7
changelog:
  - Update boinc policy
  - Fix sysstat policy to allow sys_admin
  - Change failsafe_context to unconfined_r:unconfined_t:s0


author: Dan Walsh <dwalsh@redhat.com> 3.8.1-2
changelog:
  - Fix label on /var/lib/dokwiki
  - Change permissive domains to enforcing
  - Fix libvirt policy to allow it to run on mls


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-22
changelog:
  - Allow procmail to execute scripts in the users home dir that are labeled home_bin_t
  - Fix /var/run/abrtd.lock label


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-21
changelog:
  - Allow login programs to read krb5_home_t
  Resolves: 594833
  - Add obsoletes for cachefilesfd-selinux package
  Resolves: #575084


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-20
changelog:
  - Allow mount to r/w abrt fifo file
  - Allow svirt_t to getattr on hugetlbfs
  - Allow abrt to create a directory under /var/spool


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-19
changelog:
  - Add labels for /sys
  - Allow sshd to getattr on shutdown
  - Fixes for munin
  - Allow sssd to use the kernel key ring
  - Allow tor to send syslog messages
  - Allow iptabels to read usr files
  - allow policykit to read all domains state


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-17
changelog:
  - Fix path for /var/spool/abrt
  - Allow nfs_t as an entrypoint for http_sys_script_t
  - Add policy for piranha
  - Lots of fixes for sosreport


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-16
changelog:
  - Allow xm_t to read network state and get and set capabilities
  - Allow policykit to getattr all processes
  - Allow denyhosts to connect to tcp port 9911
  - Allow pyranha to use raw ip sockets and ptrace itself
  - Allow unconfined_execmem_t and gconfsd mechanism to dbus
  - Allow staff to kill ping process
  - Add additional MLS rules


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-15
changelog:
  - Allow gdm to edit ~/.gconf dir
  Resolves: #590677
  - Allow dovecot to create directories in /var/lib/dovecot
  Partially resolves 590224
  - Allow avahi to dbus chat with NetworkManager
  - Fix cobbler labels
  - Dontaudit iceauth_t leaks
  - fix /var/lib/lxdm file context
  - Allow aiccu to use tun tap devices
  - Dontaudit shutdown using xserver.log


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-14
changelog:
  - Fixes for sandbox_x_net_t  to match access for sandbox_web_t ++
  - Add xdm_etc_t for /etc/gdm directory, allow accountsd to manage this directory
  - Add dontaudit interface for bluetooth dbus
  - Add chronyd_read_keys, append_keys for initrc_t
  - Add log support for ksmtuned
  Resolves: #586663


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-12
changelog:
  - Allow initrc_t to remove dhcpc_state_t
  - Fix label on sa-update.cron
  - Allow dhcpc to restart chrony initrc
  - Don't allow sandbox to send signals to its parent processes
  - Fix transition from unconfined_t -> unconfined_mount_t -> rpcd_t
  Resolves: #589136


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-11
changelog:
  - Fix location of oddjob_mkhomedir
  Resolves: #587385
  - fix labeling on /root/.shosts and ~/.shosts
  - Allow ipsec_mgmt_t to manage net_conf_t
  Resolves: #586760


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-6
changelog:
  - Allow initrc_t to read slapd_db_t
  Resolves: #585476
  - Allow ipsec_mgmt to use unallocated devpts and to create /etc/resolv.conf
  Resolves: #585963


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-5
changelog:
  - Allow rlogind_t to search /root for .rhosts
  Resolves: #582760
  - Fix path for cached_var_t
  - Fix prelink paths /var/lib/prelink	
  - Allow confined users to direct_dri
  - Allow mls lvm/cryptosetup to work


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-3
changelog:
  - Fix label on /root/.rhosts
  Resolves: #582760
  - Add labels for Picasa
  - Allow openvpn to read home certs
  - Allow plymouthd_t to use tty_device_t
  - Run ncftool as iptables_t
  - Allow mount to unmount unlabeled_t
  - Dontaudit hal leaks


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-1
changelog:
  - Update to upstream
  - Allow abrt to delete sosreport
  Resolves: #579998
  - Allow snmp to setuid and gid
  Resolves: #582155
  - Allow smartd to use generic scsi devices
  Resolves: #582145


author: Dan Walsh <dwalsh@redhat.com> 3.7.18-3
changelog:
  - Allow ipsec_t to create /etc/resolv.conf with the correct label
  - Fix reserved port destination
  - Allow autofs to transition to showmount
  - Stop crashing tuned


author: Dan Walsh <dwalsh@redhat.com> 3.7.18-1
changelog:
  - Update to upstream
  - Fix label for  /opt/google/chrome/chrome-sandbox
  - Allow modemmanager to dbus with policykit


author: Dan Walsh <dwalsh@redhat.com> 3.7.17-6
changelog:
  - Fix allow_httpd_mod_auth_pam to use 	auth_use_pam(httpd_t)
  - Allow accountsd to read shadow file
  - Allow apache to send audit messages when using pam
  - Allow asterisk to bind and connect to sip tcp ports
  - Fixes for dovecot 2.0
  - Allow initrc_t to setattr on milter directories
  - Add procmail_home_t for .procmailrc file


author: Dan Walsh <dwalsh@redhat.com> 3.7.17-4
changelog:
  - Fix /cgroup file context 
  - Fix broken afs use of unlabled_t
  - Allow getty to use the console for s390


author: Dan Walsh <dwalsh@redhat.com> 3.7.17-3
changelog:
  - Fix cgroup handling adding policy for /cgroup
  - Allow confined users to write to generic usb devices, if user_rw_noexattrfile boolean set


author: Dan Walsh <dwalsh@redhat.com> 3.7.16-2
changelog:
  - Fix ~/.fontconfig label
  - Add /root/.cert label
  - Allow reading of the fixed_file_disk_t:lnk_file if you can read file
  - Allow qemu_exec_t as an entrypoint to svirt_t


author: Dan Walsh <dwalsh@redhat.com> 3.7.16-1
changelog:
  - Update to upstream
  - Allow tmpreaper to delete sandbox sock files
  - Allow chrome-sandbox_t to use /dev/zero, and dontaudit getattr file systems
  - Fixes for gitosis
  - No transition on livecd to passwd or chfn
  - Fixes for denyhosts


author: Dan Walsh <dwalsh@redhat.com> 3.7.15-4
changelog:
  - Add label for /var/lib/upower
  - Allow logrotate to run sssd
  - dontaudit readahead on tmpfs blk files
  - Allow tmpreaper to setattr on sandbox files
  - Allow confined users to execute dos files
  - Allow sysadm_t to kill processes running within its clearance
  - Add accountsd policy
  - Fixes for corosync policy
  - Fixes from crontab policy
  - Allow svirt to manage svirt_image_t chr files
  - Fixes for qdisk policy
  - Fixes for sssd policy
  - Fixes for newrole policy


author: Dan Walsh <dwalsh@redhat.com> 3.7.14-2
changelog:
  - Dontaudit ipsec_mgmt sys_ptrace
  - Allow at to mail its spool files
  - Allow nsplugin to search in .pulse directory


author: Dan Walsh <dwalsh@redhat.com> 3.7.13-4
changelog:
  - Allow users to dbus chat with xdm
  - Allow users to r/w wireless_device_t
  - Dontaudit reading of process states by ipsec_mgmt


author: Dan Walsh <dwalsh@redhat.com> 3.7.11-1
changelog:
  - Update to upstream - These are merges of my patches
  - Remove 389 labeling conflicts
  - Add MLS fixes found in RHEL6 testing
  - Allow pulseaudio to run as a service
  - Add label for mssql and allow apache to connect to this database port if boolean set
  - Dontaudit searches of debugfs mount point
  - Allow policykit_auth to send signals to itself
  - Allow modcluster to call getpwnam
  - Allow swat to signal winbind
  - Allow usbmux to run as a system role
  - Allow svirt to create and use devpts


author: Dan Walsh <dwalsh@redhat.com> 3.7.10-5
changelog:
  - Add MLS fixes found in RHEL6 testing
  - Allow domains to append to rpm_tmp_t
  - Add cachefilesfd policy
  - Dontaudit leaks when transitioning


author: Dan Walsh <dwalsh@redhat.com> 3.7.10-4
changelog:
  - Change allow_execstack and allow_execmem booleans to on
  - dontaudit acct using console
  - Add label for fping
  - Allow tmpreaper to delete sandbox_file_t
  - Fix wine dontaudit mmap_zero
  - Allow abrt to read var_t symlinks


author: Dan Walsh <dwalsh@redhat.com> 3.7.8-3
changelog:
  - Allow abrt_helper to getattr on all filesystems
  - Add label for /opt/real/RealPlayer/plugins/oggfformat\.so


author: Dan Walsh <dwalsh@redhat.com> 3.7.7-1
changelog:
  - Move users file to selection by spec file.
  - Allow vncserver to run as unconfined_u:unconfined_r:unconfined_t


author: Dan Walsh <dwalsh@redhat.com> 3.6.32-13
changelog:
  - Allow cupsd_config to read user tmp
  - Allow snmpd_t to signal itself
  - Allow sysstat_t to makedir in sysstat_log_t


author: Dan Walsh <dwalsh@redhat.com> 3.6.31-5
changelog:
  - Fix label on /usr/bin/notepad, /usr/sbin/vboxadd-service
  - Remove policycoreutils-python requirement except for minimum


author: Dan Walsh <dwalsh@redhat.com> 3.6.31-4
changelog:
  - Fix devicekit_disk_t to getattr on all domains sockets and fifo_files
  - Conflicts seedit (You can not use selinux-policy-targeted and seedit at the same time.)


author: Dan Walsh <dwalsh@redhat.com> 3.6.25-1
changelog:
  - Fix polkit label
  - Remove hidebrokensymptoms for nss_ldap fix
  - Add modemmanager policy
  - Lots of merges from upstream
  - Begin removing textrel_shlib_t labels, from fixed libraries


author: Dan Walsh <dwalsh@redhat.com> 3.6.13-3
changelog:
  - Add fish as a shell
  - Allow fprintd to list usbfs_t
  - Allow consolekit to search mountpoints
  - Add proper labeling for shorewall


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-27
changelog:
  - Fix /sbin/ip6tables-save context
  - Allod udev to transition to mount
  - Fix loading of mls policy file


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-21
changelog:
  - Allow confined users to manage virt_content_t, since this is home dir content
  - Allow all domains to read rpm_script_tmp_t which is what shell creates on redirection


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-20
changelog:
  - Fix labeling on /var/lib/misc/prelink*
  - Allow xserver to rw_shm_perms with all x_clients
  - Allow prelink to execute files in the users home directory


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-19
changelog:
  - Allow initrc_t to delete dev_null
  - Allow readahead to configure auditing
  - Fix milter policy
  - Add /var/lib/readahead


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-6
changelog:
  - Allow cupsd_t to create link files in print_spool_t
  - Fix iscsi_stream_connect typo
  - Fix labeling on /etc/acpi/actions
  - Don't reinstall unconfine and unconfineuser on upgrade if they are not installed


author: Dan Walsh <dwalsh@redhat.com> 3.5.13-14
changelog:
  - Additional fixes for cyphesis
  - Fix certmaster file context
  - Add policy for system-config-samba
  - Allow hal to read /var/run/video.rom


author: Dan Walsh <dwalsh@redhat.com> 3.5.10-1
changelog:
  - Allow NetworkManager to transition to avahi and iptables
  - Allow domains to search other domains keys, coverup kernel bug


author: Dan Walsh <dwalsh@redhat.com> 3.5.1-4
changelog:
  - Consolodate pyzor,spamassassin, razor into one security domain
  - Fix xdm requiring additional perms.


author: Dan Walsh <dwalsh@redhat.com> 3.5.1-1
changelog:
  - Fix xguest -> xguest_mozilla_t -> xguest_openiffice_t
  - Change dhclient to be able to red networkmanager_var_run


author: Dan Walsh <dwalsh@redhat.com> 3.4.2-12
changelog:
  - Allow amanda to read tape
  - Allow prewikka cgi to use syslog, allow audisp_t to signal cgi
  - Add support for netware file systems


author: Dan Walsh <dwalsh@redhat.com> 3.4.2-7
changelog:
  - Allow confined users to use postgres
  - Allow system_mail_t to exec other mail clients
  - Label mogrel_rails as an apache server


author: Dan Walsh <dwalsh@redhat.com> 3.4.1-3
changelog:
  - Dontaudit search of admin_home for init_system_domain
  - Rewrite of xace interfaces
  - Lots of new fs_list_inotify
  - Allow livecd to transition to setfiles_mac


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-44
changelog:
  - Change unconfined_t to transition to unconfined_mono_t when running mono
  - Change XXX_mono_t to transition to XXX_t when executing bin_t files, so gnome-do will work


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-28
changelog:
  - Allow radvd to use fifo_file
  - dontaudit setfiles reading links
  - allow semanage sys_resource
  - add allow_httpd_mod_auth_ntlm_winbind boolean
  - Allow privhome apps including dovecot read on nfs and cifs home 
  dirs if the boolean is set


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-27
changelog:
  - Allow nsplugin to read /etc/mozpluggerrc, user_fonts
  - Allow syslog to manage innd logs.
  - Allow procmail to ioctl spamd_exec_t


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-22
changelog:
  - Allow stunnel to transition to inetd children domains
  - Make unconfined_dbusd_t an unconfined domain


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-20
changelog:
  - Fix bug in mozilla policy to allow xguest transition
  - This will fix the 

  libsemanage.dbase_llist_query: could not find record value
  libsemanage.dbase_llist_query: could not query record value (No such file or
  directory)
   bug in xguest


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-15
changelog:
  - Allow init to transition to initrc_t on shell exec.
  - Fix init to be able to sendto init_t.
  - Allow syslog to connect to mysql
  - Allow lvm to manage its own fifo_files
  - Allow bugzilla to use ldap
  - More mls fixes


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-6
changelog:
  - Prepare policy for beta release
  - Change some of the system domains back to unconfined
  - Turn on some of the booleans


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-5
changelog:
  - Allow nsplugin_config execstack/execmem
  - Allow nsplugin_t to read alsa config
  - Change apache to use user content


author: Dan Walsh <dwalsh@redhat.com> 3.2.5-6
changelog:
  - Fix role transition from unconfined_r to system_r when running rpm
  - Allow unconfined_domains to communicate with user dbus instances


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-30
changelog:
  - Allow XServer to read /proc/self/cmdline
  - Fix unconfined cron jobs
  - Allow fetchmail to transition to procmail
  - Fixes for hald_mac
  - Allow system_mail to transition to exim
  - Allow tftpd to upload files
  - Allow xdm to manage unconfined_tmp
  - Allow udef to read alsa config
  - Fix xguest to be able to connect to sound port


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-28
changelog:
  - Fixes for hald_mac 
  - Treat unconfined_home_dir_t as a home dir
  - dontaudit rhgb writes to fonts and root


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-15
changelog:
  - Allow tmpreadper to read man_t
  - Allow racoon to bind to all nodes
  - Fixes for finger print reader


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-7
changelog:
  - Allow cupsd_config_t to read/write usb_device_t
  - Support for finger print reader,
  - Many fixes for clvmd
  - dbus starting networkmanager


author: Dan Walsh <dwalsh@redhat.com> 3.0.2-7
changelog:
  - Begin adding policy to separate setsebool from semanage
  - Fix xserver.if definition to not break sepolgen.if


author: Dan Walsh <dwalsh@redhat.com> 2.6.4-5
changelog:
  - More fixes for alsactl
  - Transition from hal and modutils
  - Fixes for suspend resume.  
       - insmod domtrans to alsactl
       - insmod writes to hal log


author: Dan Walsh <dwalsh@redhat.com> 2.5.11-6
changelog:
  - Fix hald_acl_t to be able to getattr/setattr on usb devices
  - Dontaudit write to unconfined_pipes for load_policy


author: Dan Walsh <dwalsh@redhat.com> 2.5.4-2
changelog:
  - Revert Nemiver change
  - Set sudo as a corecmd so prelink will work,  remove sudoedit mapping, since this will not work, it does not transition.
  - Allow samba to execute useradd


author: Dan Walsh <dwalsh@redhat.com> 2.5.2-6
changelog:
  - Allow mozilla, evolution and thunderbird to read dev_random.
  Resolves: #227002
  - Allow spamd to connect to smtp port
  Resolves: #227184
  - Fixes to make ypxfr work
  Resolves: #227237


author: Dan Walsh <dwalsh@redhat.com> 2.5.2-4
changelog:
  - Fix spamassisin so crond can update spam files
  - Fixes to allow kpasswd to work
  - Fixes for bluetooth


author: Dan Walsh <dwalsh@redhat.com> 2.5.2-1
changelog:
  - Add ability to generate webadm_t policy
  - Lots of new interfaces for httpd
  - Allow sshd to login as unconfined_t


author: Dan Walsh <dwalsh@redhat.com> 2.5.1-1
changelog:
  - Allow prelink when run from rpm to create tmp files
  Resolves: #221865
  - Remove file_context for exportfs
  Resolves: #221181
  - Allow spamassassin to create ~/.spamassissin
  Resolves: #203290
  - Allow ssh access to the krb tickets
  - Allow sshd to change passwd
  - Stop newrole -l from working on non securetty
  Resolves: #200110
  - Fixes to run prelink in MLS machine
  Resolves: #221233
  - Allow spamassassin to read var_lib_t dir
  Resolves: #219234


author: Dan Walsh <dwalsh@redhat.com> 2.4.6-16
changelog:
  - Allow semanage to exec it self.  Label genhomedircon as semanage_exec_t
  Resolves: #219421
  - Allow sysadm_lpr_t to manage other print spool jobs
  Resolves: #220080


author: Dan Walsh <dwalsh@redhat.com> 2.4.6-3
changelog:
  - Allow login programs to polyinstatiate homedirs
  Resolves: #216184
  - Allow quotacheck to create database files
  Resolves: #212957


author: Dan Walsh <dwalsh@redhat.com> 2.4.6-1
changelog:
  - Dontaudit appending hal_var_lib files 
  Resolves: #217452
  Resolves: #217571
  Resolves: #217611
  Resolves: #217640
  Resolves: #217725


author: James Antill <james.antill@redhat.com> 2.4.2-6
changelog:
  - Fix policygentool specfile problem.
  - Allow apache to send signals to it's logging helpers.
  - Resolves: rhbz#212731


author: Dan Walsh <dwalsh@redhat.com> 2.3.16-9
changelog:
  - Remove bluetooth-helper transition
  - Add selinux_validate for semanage
  - Require new version of libsemanage


author: Dan Walsh <dwalsh@redhat.com> 2.3.9-4
changelog:
  - Set /usr/lib/ia32el/ia32x_loader to unconfined_execmem_exec_t for ia32 platform
  - Fix spec for /dev/adsp


author: Dan Walsh <dwalsh@redhat.com> 2.3.6-4
changelog:
  - Change allow_execstack to default to on, for RHEL5 Beta.  
    This is required because of a Java compiler problem.
    Hope to turn off for next beta


author: Dan Walsh <dwalsh@redhat.com> 2.3.3-11
changelog:
  - Added Paul Howarth patch to only load policy packages shipped 
    with this package
  - Allow pidof from initrc to ptrace higher level domains
  - Allow firstboot to communicate with hal via dbus


author: Dan Walsh <dwalsh@redhat.com> 2.3.3-3
changelog:
  - Allow prelink to read bin_t symlink
  - allow xfs to read random devices
  - Change gfs to support xattr


author: Dan Walsh <dwalsh@redhat.com> 2.2.32-2
changelog:
  - Add unconfined_mount_t
  - Allow privoxy to connect to httpd_cache
  - fix cups labeleing on /var/cache/cups


author: Dan Walsh <dwalsh@redhat.com> 2.2.29-6
changelog:
  - Allow secadm_t ability to relabel all files
  - Allow ftp to search xferlog_t directories
  - Allow mysql to communicate with ldap
  - Allow rsync to bind to rsync_port_t


author: Russell Coker <rcoker@redhat.com> 2.2.29-5
changelog:
  - Fixed mailman with Postfix #183928
  - Allowed semanage to create file_context files.
  - Allowed amanda_t to access inetd_t TCP sockets and allowed amanda_recover_t
    to bind to reserved ports.  #149030
  - Don't allow devpts_t to be associated with tmp_t.
  - Allow hald_t to stat all mountpoints.
  - Added boolean samba_share_nfs to allow smbd_t full access to NFS mounts.
    - Make mount run in mount_t domain from unconfined_t to prevent mislabeling of
    /etc/mtab.
  - Changed the file_contexts to not have a regex before the first ^/[a-z]/
    whenever possible, makes restorecon slightly faster.
  - Correct the label of /etc/named.caching-nameserver.conf
  - Now label /usr/src/kernels/.+/lib(/.*)? as usr_t instead of
    /usr/src(/.*)?/lib(/.*)? - I don't think we need anything else under /usr/src
    hit by this.
  - Granted xen access to /boot, allowed mounting on xend_var_lib_t, and allowed
    xenstored_t rw access to the xen device node.


author: Dan Walsh <dwalsh@redhat.com> 2.2.29-2
changelog:
  - Add mono dbus support
  - Lots of file_context fixes for textrel_shlib_t in FC5
  - Turn off execmem auditallow since they are filling log files


author: Dan Walsh <dwalsh@redhat.com> 2.2.23-17
changelog:
  - MLS Fixes
       dmidecode needs mls_file_read_up
  - add ypxfr_t
  - run init needs access to nscd
  - udev needs setuid
  - another xen log file
  - Dontaudit mount getattr proc_kcore_t


author: Dan Walsh <dwalsh@redhat.com> 2.2.23-8
changelog:
  - Blkid changes
  - Allow udev access to usb_device_t
  - Fix post script to create targeted policy config file


author: Dan Walsh <dwalsh@redhat.com> 2.2.20-1
changelog:
  - Fix load_policy to work on MLS
  - Fix cron_rw_system_pipes for postfix_postdrop_t
  - Allow audotmount to run showmount


author: Dan Walsh <dwalsh@redhat.com> 2.2.19-2
changelog:
  - Fix swapon
  - allow httpd_sys_script_t to be entered via a shell
  - Allow httpd_sys_script_t to read eventpolfs


author: Dan Walsh <dwalsh@redhat.com> 2.2.2-1
changelog:
  - Update to upstream
  - Turn off execheap execstack for unconfined users
  - Add mono/wine policy to allow execheap and execstack for them
  - Add execheap for Xdm policy


author: Dan Walsh <dwalsh@redhat.com> 2.1.12-3
changelog:
  - Fix for procmail/spamassasin
  - Update to upstream
  - Add rules to allow rpcd to work with unlabeled_networks.


author: Dan Walsh <dwalsh@redhat.com> 2.1.6-13
changelog:
  - Add dri libs to textrel_shlib_t
  - Add system_r role for java
  - Add unconfined_exec_t for vncserver
  - Allow slapd to use kerberos


author: Dan Walsh <dwalsh@redhat.com> 2.1.3-1
changelog:
  - Turn back on execmem since we need it for java, firefox, ooffice
  - Allow gpm to stream socket to itself


author: Jeremy Katz <katzj@redhat.com> - 2.1.2-3
changelog:
  - fix requirements to be on the actual packages so that policy can get
    created properly at install time


author: Dan Walsh <dwalsh@redhat.com> 2.1.2-1
changelog:
  - Update to upstream 
  - Turn off allow_execmem and allow_execmod booleans
  - Add tcpd and automount policies


author: Dan Walsh <dwalsh@redhat.com> 2.1.1-3
changelog:
  - Add two new httpd booleans, turned off by default
       * httpd_can_network_relay
       * httpd_can_network_connect_db


author: Mathieu Bridon <bochecha@fedoraproject.org> - 1.2-2
changelog:
  - added comment explaining how the source is obtained (as it is modified from upstream)
  - temporary fix for RHBZ#490830 while not fixed upstream


author: Dan Walsh <dwalsh@redhat.com> - 0.3.3-7
changelog:
  - Add secolor.conf.5 man page
  - Make mcstransd watch for content being written to /run/setrans for files names containing translations.
  -- This will allow apps like libvirt to write content nameing randomly selected MCS labels
  - Fix memory leak in mcstransd


author: Ted X Toth <txtoth@gmail.com> - 0.3.2-0
changelog:
  - Add constraints
  - Add setrans.conf man page
  - Fix mixed raw and translated range bug
  - Moved todo comments to TODO file


author: Joe Nall <joe@nall.com> 0.3.1-1
changelog:
  - Rewrite translations to allow individual word/category mapping
  - Eamon Walsh's color mapping changes


author: Dan Walsh <dwalsh@redhat.com> 0.1.4-1
changelog:
  - Add patch from sgrubb
  - 	Fix 64 bit size problems
  - 	Increase the open file limit
  -	Make sure maximum size is not exceeded


author: Rex Dieter <rdieter@fedoraproject.or> 4.1.80-3
changelog:
  - drop (Build)Requires: kdebase-workspace(-devel)
  - BR: plasma-devel
  - better, versioned Obsoletes: kdeaccessibility-devel ...


author: Adam Jackson <ajax@redhat.com> 7.7-1
changelog:
  - rgb 1.0.5
  - xsessreg 1.0.8
  - xgamma 1.0.5
  - xhost 1.0.5
  - xmodmap 1.0.7
  - xsetroot 1.1.1
  - xstdcmap 1.0.3


author: Matěj Cepl <mcepl@redhat.com> - 7.5-7
changelog:
  - Fix BuildRequires ... xbitmaps-devel does not exist anymore (RHBZ #744751)
  - Upgrade to the latest upstream iceauth, rgb, sessreg, and xrandr


author: Jan Pokorný <jpokorny+rpm-booth@redhat.com> - 1.0-8.ef769ef.git
changelog:
  - build for aarch64
    Resolves: rhbz#1422615
  - fix unconditional "dist" RPM macro reference in Release field
    Resolves: rhbz#1465933
  - ensure booth-arbitrator service will get restarted when it fails


author: Jan Pokorný <jpokorny+rpm-booth@redhat.com> - 1.0-6.ef769ef.git
changelog:
  - fix an issue with identity self-determination based on match
    between the addresses assigned at host and the configured addresses
    when a network-part-of-the-address-only match preceded a possible
    exact address match which would not be even tested if the length
    of the network prefix was the same (no longer for this exact one)
    Resolves: rhbz#1341720
  - fix a crash when running booth without determined identity
    (e.g., existing, yet empty configuration) under some circumstances
    Resolves: rhbz#1366616
  - make patches be applied using "git am" rather than "git apply"


author: Jan Pokorný <jpokorny+rpm-booth@redhat.com> - 1.0-5.77d65dd.git
changelog:
  - update per the the current upstream, most notably the support for
    cluster-glue alternatives has been accepted (separate patches no
    longer needed)
  - make the main (envelope) package properly require the subpackages
    of the same version
  - add patches allowing for live_test.sh using pcs
  - allow building also against s390x architecture
    (per Pacemaker dependency constraint)
    Resolves: rhbz#1302087


author: Jan Pokorný <jpokorny+rpm-booth@redhat.com> - 1.0-3.570876d.git
changelog:
  - update per the changesets recently accepted by the upstream
    (memory/resource leaks fixes, patches previously attached separately
    that make unit test pass, internal cleanups, etc.)
    Resolves: rhbz#1302087


author: Jan Pokorný <jpokorny+rpm-booth@redhat.com> - 1.0-2.eb4256a.git
changelog:
  - update a subset of out-of-tree patches per
    https://github.com/ClusterLabs/booth/pull/22#issuecomment-216936987
  - pre-inclusion cleanups in the spec (apply systemd scriptlet operations
    with booth-arbitrator, avoid overloading file implicitly considered %doc
    as %license)
    Resolves: rhbz#1302087
    Related (Fedora): rhbz#1314865
    Related (Fedora): rhbz#1333509


author: Michal Ruprich <mruprich@redhat.com> - 0.17-78
changelog:
  - Resolves: #1502657 - Copying remote file to local dir fails with "rcp: protocol screwup: expected control record"
  - Resolves: #1338037 - rsh/rlogin sessions ignore SIGPIPE due to systemd
  - Resolves: #1477207 - rlogin killed when changing run level
  - Resolves: #1503112 - rexecd Could not allocate space for cmdbuf
  - Resolves: #1505226 - have a proposed patch for rsh-0.17-76.el7_1.1


author: Michal Sekletar <msekleta@redhat.com> - 0.17-72
changelog:
  - unit files must not be marked as config files
  - fix handling of non-native IPv6 connections via AF_INET6 socket


author: Michal Sekletar <msekleta@redhat.com> - 0.17-71
changelog:
  - resolves: RHBZ #737244 #896583 #947213
  - migrate from xinetd to systemd configuration
  - close pam session correctly when client does not ask for separate error channel
  - fix pty handling which was broken by changes in /bin/login


author: Adam Tkac <atkac redhat com> - 0.17-59
changelog:
  - merge review related fixes (#226379)
  - remove unused patches
    - netkit-rsh-0.16-pamfix.patch
    - netkit-rsh-0.16-jbj2.patch
    - netkit-rsh-0.16-jbj3.patch


author: Adam Tkac <atkac redhat com> 0.17-51
changelog:
  - updated ipv6 patch due rpm 4.6 (#465053)
  - make in.rshd working on kernels without audit support (#448904)


author: Adam Tkac <atkac redhat com> 0.17-50
changelog:
  - fixed typos in arg_max and audit patches (#445606)
  - use pam_rhosts, not pam_rhosts_auth (#445606)


author: Adam Tkac <atkac redhat com> 0.17-43
changelog:
  - removed -D option from rshd and rlogind (we have -a option when
    we need force reverse DNS lookup)
  - patches netkit-rsh-0.17-nodns.patch and netkit-rsh-0.17-nohostcheck.patch
    are substituted by netkit-rsh-0.17-dns.patch


author: Adam Tkac <atkac redhat com> 0.17-40
changelog:
  - improved -D option to rlogind - when name won't be resolved rlogind uses IP address
  - added smp_mflags to make


author: Karel Zak <kzak@redhat.com> 0.17-35
changelog:
  - added support for IPv6 (patch by Jan Pazdziora)
  - fix #198632 - add keyinit instructions to the rsh, rlogin and rexec PAM scripts
    (patch by David Howells)
  - fix #191390 - improve linefeed patch


author: Karel Zak <kzak@redhat.com> 0.17-25
changelog:
  - rexecd uses PAM session now (#68590)
  - fixed errno usage in rcp (#67361)
  - fixed rexec fails with "Invalid Argument" (#118630)


author: Nalin Dahyabhai <nalin@redhat.com> 0.17-11
changelog:
  - remove directory names from PAM configuration files, allowing them to be used
    for all arches on multilib systems


author: Phil Knirsch <pknirsch@redhat.com>
changelog:
  - Fixed really missing BuildPrereq: libtermcap-devel (#49577)
  - Fixed security problem with rexec.pam (#49181)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - securetty is screwy because rsh doesn't allocate one and rlogin does auth
    before it has a tty, so change the hard-coded TTYs used from "tty" for all
    to "rsh" or "rlogin" or "rexec"


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix PAM config files to always honor nologin and securetty, to use rhosts,
    and to fall back to password auth only for rlogin and rexec (#17183)
  - add references to pam_env to the PAM configs as well (#16170)
  - disable rlogin and rsh by default


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - expunge all mentions of kerberos authentication or DES encryption using
    kerberos from the man pages


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - rexec needs pam_set_item() (#60).
  - clarify protocol in rexecd.8.
  - add rexec client from contrib.


author: Pavel Raiskup <praiskup@redhat.com> - 1.5.2-7
changelog:
  - we should provide /etc/rmt symlink for a while (related to #968980)
  - use the ssh as the default remote access method


author: Pavel Raiskup <praiskup@redhat.com> - 1.5.2-2
changelog:
  - package spax and scpio separately (#959917)
  - fedora-review fixes, unapplied patch
  - make the spax to be pax alternative (#960007)


author: Pavel Raiskup <praiskup@redhat.com> - 1.5.2-1
changelog:
  - rebase to most up2date upstream tarball, remove patches already upstream, fix
    code movements in patches (#928758)
  - fix man-page-day objections (private #948866)
  - fix the build for aarch64 (#926571)


author: Pavel Raiskup <praiskup@redhat.com> - 1.5.1-10
changelog:
  - do not crash during extracting if extended attributes are not set on all
    archived files (#861848)
  - note in man page that H=crc format uses Sum32 algorithm (FIPS refuses CRC)


author: Ondrej Vasik <ovasik@redhat.com> 1.5-7
changelog:
  - Merge review (#226434) changes: convert AN-1.5 to utf-8,
    spec file cosmetic/policy changes, ship README.linux in doc


author: Peter Vrabec <pvrabec@redhat.com> 1.5a65-1
changelog:
  - upgrade 1.5a65-1 made by Horst H. von Brand <vonbrand@inf.utfsm.cl>
  - Source URL changed, no homepage now
  - License changed from GPL to CDDL 1.0
  - Define MAKEPROG=gmake like the Gmake.linux script does
  - Disable fat binary as per star/Makefile, update star-1.5-selinux.patch for
    the various *.mk files used in that case
  - Axe /usr/share/man/man1/match.1*, /usr/etc/default/rmt too
  - Explicit listing in %files, allow for compressed or plain manpages


author: Livy Ge <livy.ge@oracle.com> 2.0.15-33.0.1
changelog:
  - change makedumpfile fixed size buffer for VMCOREINFO (isaac.chen@oracle.com) [Orabug: 29612733]
  - rebase kexec-tools-2.0.8-dracut-module-setup-ibft-avoid-dup-config.patch (brian.maly@oracle.com) [Orabug: 28872281]
  - don't patch files in SOURCES directory. That breaks building from the srpm (dave.kleikamp@oracle.com)
  - dracut-module-setup: avoid duplicate config for ibft [Orabug: 22780125]
  - kdumpctl: exclude default_hugepagesz setting from kdump kernel cmdline
    (Sriharsha Yadagudde) [Orabug: 19134999]
  - kdumpctl: verify if kernel support securelevel interface
    (Sriharsha Yadagudde) [Orabug: 18905671]


author: Bhupesh Sharma <bhsharma@redhat.com> 2.0.15-33
changelog:
  - makedumpfile: x86_64: Add support for AMD Secure Memory Encryption
    [Fix the Fix the patch to make sure makedumpfile-1.6.2/ path is used]


author: Bhupesh Sharma <bhsharma@redhat.com> 2.0.15-32
changelog:
  - makedumpfile: exclude pages that are logically offline
  - makedumpfile: x86_64: Add support for AMD Secure Memory Encryption


author: Bhupesh Sharma <bhsharma@redhat.com> 2.0.15-24
changelog:
  - mkdumprd: use --quiet dracut argument to speedup initramfs build
  - mkdumprd: refine regex on dropping mount options


author: Bhupesh Sharma <bhsharma@redhat.com> 2.0.15-23
changelog:
  - kdump: fix an error that can not parse the e820 reserved region
  - Doc: add document to declare atlantic support


author: Pingfan Liu <piliu@redhat.com> 2.0.15-22
changelog:
  - doc/kdump.conf: Local dump path should be <mnt>/<path>/%HOST_IP-%DATE
  - Update help text to indicate --mem-usage is supported on archs other than x86_64
  - Add missing usage info
  - Rewrite kdump's udev rules, use reload instead of restart
  - kdumpctl: Add reload support


author: Pingfan Liu <piliu@redhat.com> 2.0.15-20
changelog:
  - makedumpfile: when refiltering, initialize refiltered bitmap2 from the kdump file's bitmap2
  - dracut-module-setup: Fix DRM module inclusion test for hyper-v
  - kdumpctl: remove some cmdline inheritage from 1st kernel
  - kdump-lib.sh:get_loaded_kernel_modules() Fix missing newline
  - kdumpctl: Rebuild initramfs if loaded kernel modules changed (V2)
  - Revert "kdumpctl: Rebuild initramfs if loaded kernel modules changed"
  - dracut-module-setup: Fix test for inclusion of DRM modules


author: Pingfan Liu <piliu@redhat.com> 2.0.15-18
changelog:
  kdumpctl: Rebuild initramfs if loaded kernel modules changed
  dracut-module-setup.sh: don't include multipath-hostonly
  Add document to declare FCoE support (V2)
  Revert "Add document to declare FCoE support"
  Add document to declare FCoE support
  makedumpfile: fix makedumpfile Not tainted in 2nd kernel


author: Pingfan Liu <piliu@redhat.com> 2.0.15-15
changelog:
  - dracut-module-setup.sh: pass ip=either6 param for ipv6
  - dracut-module-setup.sh: install /etc/hosts when using fence_kdump
  - update kdump-anaconda-addon-003-29-g4c517c5.tar.gz


author: Pingfan Liu <piliu@redhat.com> 2.0.15-14
changelog:
  - kdumpctl: Remove 'netroot' and 'iscsi initiator' entries from kdump cmdline
  - doc: remove btrfs from supported filesystems list
  - Update kdump anaconda addon
  - makedumpfile/arm64: Add '--mem-usage' support
  - Fix warning about persistent device name not found.
  - kdumpctl: Check the modification time of core_collector
  - kdump.sysconfig.x86_64: Remove 'notsc' from KDUMP_COMMANDLINE_REMOVE
  - makedumpfile: fix for hugepages filtering


author: Pingfan Liu <piliu@redhat.com> 2.0.15-13
changelog:
  * Thu Feb 1 2018 Pingfan Liu <piliu@redhat.com> 2.0.15-12
  - makedumpfile/sadump: Fix a problem of PTI enabled kernel
  - makedumpfile: Fix physical-to-virtual conversion in 'exclude_segment()'


author: Pingfan Liu <piliu@redhat.com> 2.0.15-11
changelog:
  - dracut-module-setup.sh: temporary install /bin/grep to work around dracut's bug
  - kdump.sysconfig/x86_64: Add nokaslr to kdump kernel cmdline
  - kdumpctl: skip selinux-relabel for dracut_args --mount dump target


author: Pingfan Liu <piliu@redhat.com> 2.0.15-10
changelog:
  - kexec-tools.spec: require dracut >= 033-522 to make 99kdump module installed correctly
  - kdump.sysconfig.ppc64(le): remove "root=" param from ppc64(le) 2nd kernel's command line
  - Revert "kdumpctl: sanity check of nr_cpus for x86_64 in case running out of vectors"


author: Pingfan Liu <piliu@redhat.com> 2.0.15-9
changelog:
  - makedumpfile: Fix 'kernel_version' variable being uninitialized & introduce minor reorganization
  - makedumpfile: Fix segmentation fault when using --split on a vmcore
  - dracut-module-setup.sh: check whether to include multipath-hostonly or not


author: Pingfan Liu <piliu@redhat.com> 2.0.15-7
changelog:
  - mkdumprd: apply dracut "--hostonly-cmdline" and "--no-hostonly-default-device"
  - Change dump_to_rootfs to use "--mount" instead of "root=X"
  - kdumpctl: move is_fadump_capable() to kdump-lib.sh
  - module-setup: fix 99kdumpbase network dependency
  - mkdumprd: change for_each_block_target() to use get_kdump_targets()
  - kdump-lib.sh: introduce get_kdump_targets()
  - kdump-lib.sh: fix improper get_block_dump_target()
  - kdumpctl: remove "root=X" for kdump boot
  - kdumpctl: fix a bug in remove_cmdline_param()


author: Pingfan Liu <piliu@redhat.com> 2.0.15-5
changelog:
  - Revert "Update kdump anaconda addon"
  - Revert "Update kdump anaconda addon: fix the md5sum in source file"


author: Pingfan Liu <piliu@redhat.com> 2.0.15-3
changelog:
  - makedumpfile: x86_64: Take care of init_level4_pgt rename in kernel
  - makedumpfile: ppc64: get the info of mem reserved for crashkernel
  - makedumpfile: Fix SECTION_MAP_MASK for kernel >= v.13


author: Pingfan Liu <piliu@redhat.com> 2.0.15-2
changelog:
  - mkdumprd: fix patterns to modify mount options
  - kexec-tools/ppc64: avoid adding coherent memory regions to crash memory ranges
  - kexec-tools/ppc64: fix command line overflow error
  - kexec-tools/ppc64: fix how RMA top is deduced


author: Pingfan Liu <piliu@redhat.com> - 2.0.14-18
changelog:
  mkdumprd: remove useless "x-initrd.mount"
  kdumpctl: use "apicid" other than "initial apicid"
  kdumpctl: sanity check of nr_cpus for x86_64 in case running out of vectors
  kdumpctl: change prepare_cmdline() to operate KDUMP_COMMANDLINE directly
  mkdumprd: use 300s as the default systemd unit timeout for kdump mount
  mkdumprd: reduce lvm2 memory under kdump
  module-setup: suppress the early iscsi error messages
  kdumpctl: fix infinite loop caused by running under bash


author: Pingfan Liu <piliu@redhat.com> - 2.0.14-15
changelog:
  - Revert "pc64/ppc64le: drop cpu online rule in 40-redhat.rules in kdump initramfs"
  - udev rules: mask cpu hotplug rules


author: Pingfan Liu <piliu@redhat.com> - 2.0.14-14
changelog:
  - kdump.conf.5: clarify the fence_kdump_nodes option
  - kdumpctl: for fence_kdump, the ipaddr of this node should be excluded from list


author: Pingfan Liu <piliu@redhat.com> - 2.0.14-12
changelog:
  - kdump.sysconfig.x86_64: remove kaslr in kdump kernel cmdline
  - Revert commit b590153 kdump.sysconfig/x86_64: Add nokaslr to kdump kernel cmdline


author: Pingfan Liu <piliu@redhat.com> - 2.0.14-10
changelog:
  - kdumpctl: call strip_comments only when necessary to speedup
  - Revert "kdumpctl: improve "while read" time for /etc/kdump.conf"


author: Pingfan Liu <piliu@redhat.com> - 2.0.14-9
changelog:
  - kdumpctl: bail out earlier in case of no reserved memory
  - kdumpctrl: kdump feasibility should fail if no crash memory
  - kdumpctl: improve "while read" time for /etc/kdump.conf
  - kdumpctl: update check_dump_fs_modified() to use "lsinitrd -f"
  - kdumpctl: improve check_wdt_modified()
  - kdumpctl: remove is_mode_switched()
  - arm64: cmdline: modify to optimize size for memory reservation


author: Pingfan Liu <piliu@redhat.com> - 2.0.14-7
changelog:
  - arm64: Increase the upper limit for RAM segments
  - kdump: Introduce 'force_no_rebuild' option
  - kdump-lib-initramfs.sh: ignore the failure of echo
  - use "systemctl reboot -f" for reboot action


author: Pingfan Liu <piliu@redhat.com> - 2.0.14-5
changelog:
  - ppc64: Reduce number of ELF LOAD segments
  - kexec-kdump-howto: Include notes about using debug kernel as crash kernel
  - Correct two typos in kdumpctl and kdump.conf


author: Pingfan Liu <piliu@redhat.com> - 2.0.14-4
changelog:
  - kdump-emergency: fix "Transaction is destructive" emergency failure
  - x86: Support large number of memory ranges


author: Pingfan Liu <piliu@redhat.com> - 2.0.14-3
changelog:
  - arm64: backport latest kdump patches
  - Fix `makedumpfile --mem-usage /proc/kcore`
  - kdump-lib.sh: fix incorrect usage with pipe as input for grep -q in is_pcs_fence_kdump()


author: Pingfan Liu <piliu@redhat.com> - 2.0.14-2
changelog:
  - kdumpctl: check the existence of /sys/kernel/security/securelevel
  - kdump.sysconfig.x86_64: Remove 'notsc' from kdump kernel cmdline
  - kdump.sysconfig: add KDUMP_COMMANDLINE_REMOVE for aarch64 and ia64
  - kdump.sysconfig: add KDUMP_COMMANDLINE_REMOVE
  - Document: fix incorrect link in fadump-how.txt
  - kexec-tools.spec: add %doc for fadump-howto.txt


author: Pingfan Liu <piliu@redhat.com> - 2.0.7-52
changelog:
  - kdumpctl: check /etc/fstab modification only when it exists
  - kdumpctl: remove duplicate statement
  - kdumpctl: Kill duplicate code related to file modication check
  - fadump: restore default initrd when fadump mode is disabled
  - kdump/fadump: fix network interface name when switching from fadump to kdump


author: Baoquan He <bhe@redhat.com> - 2.0.7-50
changelog:
  - spec: Update to add dependency on dracut-network version >= 033-449
  - mkdumprd: Do not add "nfs" dracut module explicitly
  - kexec-kdump-howto: Add doc about the special mount information via "dracut_args"
  - Support special mount information via "dracut_args"


author: Baoquan He <bhe@redhat.com> - 2.0.7-47
changelog:
  - spec: Update to add dependency on dracut version >= 033-449
  - watchdog: do not add watchdog module in rd.driver.pre now
  - howto: Notes on watchdog module handling
  - kdumpctl: force rebuild in case of watchdog state change
  - mkdumprd: Add dracut watchdog module as default option


author: Baoquan He <bhe@redhat.com> - 2.0.7-45
changelog:
  - kdump.conf man page fixes
  - kdump.conf comments fixes
  - Add persistent memory support
  - module-setup: Don't handle iBFT in kdump


author: Baoquan He <bhe@redhat.com> - 2.0.7-44
changelog:
  - Update kdump anaconda addon
  - kdumpctl: Do not rebuild initramfs when $KDUMP_BOOTDIR is read only
  - get_persistent_dev(): fix name contention with dracut's similar function


author: Baoquan He <bhe@redhat.com> - 2.0.7-43
changelog:
  - kexec/sadump: Back port two patches to fix regression bug of makedumpfile 1.6.0
  - Makedumpfile: Rebase to 1.6.0


author: Baoquan He <bhe@redhat.com> - 2.0.7-42
changelog:
  - module-setup: Use get_ifcfg_filename() to get the proper ifcfg file
  - kdump-lib: Add get_ifcfg_filename() to get the proper ifcfg file
  - doc: add nfs to supported filesystems list


author: Baoquan He <bhe@redhat.com> - 2.0.7-40
changelog:
  - kdumpctl: force rebuild in case of file system is modified
  - mkdumprd: move to_dev_name() & get_persistent_dev() to kdump-lib.sh
  - kdumpctl: Move file modification check logic in check_system_modified()
  - kdumpctl: force rebuild in case of dynamic system modification
  - mkdumprd: do not lookup in by-uuid dirs for raw device's persistent name


author: Baoquan He <bhe@redhat.com> - 2.0.7-39
changelog:
  - Remove duplicate prefix path ${initdir}
  - Document declaration to support iSCSI HBA (ALL OFFLOAD)
  - kdump.init: fix a typo
  - rpm spec: add two patches to fix ppc64 kexec boot issue
  - kexec-tools ppc64: add arch option --dt-no-old-root
  - kexec-tools fs2dt.c: move copy old root param as a new function
  - kdumpctl: Remove slub_debug from cmdline


author: Baoquan He <bhe@redhat.com> - 2.0.7-34
changelog:
  arm64: Overwrite CFLAGS and remove -fno-exceptions from kexec purgatory code
  Fix comment to exclude keyword 
    CFLAGS="${CFLAGS:--O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic}" ; export CFLAGS ; 
    CXXFLAGS="${CXXFLAGS:--O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic}" ; export CXXFLAGS ; 
    FFLAGS="${FFLAGS:--O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic -I/usr/lib64/gfortran/modules}" ; export FFLAGS ; 
    FCFLAGS="${FCFLAGS:--O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic -I/usr/lib64/gfortran/modules}" ; export FCFLAGS ; 
    LDFLAGS="${LDFLAGS:--Wl,-z,relro }"; export LDFLAGS; 
    [ "1" == 1 ] && [ "x86_64" == ppc64le ] && /usr/lib/rpm/redhat/libtool-handle-ppc64le.sh ; 
    for i in $(find . -name config.guess -o -name config.sub) ; do 
        [ -f /usr/lib/rpm/redhat/$(basename $i) ] && /usr/bin/rm -f $i && /usr/bin/cp -fv /usr/lib/rpm/redhat/$(basename $i) $i ; 
    done ; 
    ./configure --build=x86_64-redhat-linux-gnu --host=x86_64-redhat-linux-gnu \
  	--program-prefix= \
  	--disable-dependency-tracking \
  	--prefix=/usr \
  	--exec-prefix=/usr \
  	--bindir=/usr/bin \
  	--sbindir=/usr/sbin \
  	--sysconfdir=/etc \
  	--datadir=/usr/share \
  	--includedir=/usr/include \
  	--libdir=/usr/lib64 \
  	--libexecdir=/usr/libexec \
  	--localstatedir=/var \
  	--sharedstatedir=/var/lib \
  	--mandir=/usr/share/man \
  	--infodir=/usr/share/info
  Revert "arm64: move -fno-exceptions from purgatory code to spec file"


author: Baoquan He <bhe@redhat.com> - 2.0.7-33
changelog:
  mkdumprd: Remove ifcfg from dracut's modules
  arm64: move -fno-exceptions from purgatory code to spec file
  module-setup: Choose the first matched gateway in kdump_static_ip


author: Minfei Huang <mhuang@redhat.com> - 2.0.7-27
changelog:
  - dracut-module-setup: Apply the manual DNS to the 2nd kernel
  - makedumpfile: --split: assign fair I/O workloads in appropriate time
  - makedumpfile: Support producing a consistent dump file even if disk space is insufficient
  - Disable transparent hugepages in second kernel


author: Minfei Huang <mhuang@redhat.com> - 2.0.7-26
changelog:
  - kdumpctl: Add the command "kdumpctl showmem" to show the reserved memory
  - Enhance kdump.conf "default" parameters check.
  - Filtered out "noauto" options in 2nd kernel fstab
  - make kdump work when kernel crash after shutdown


author: Baoquan He <bhe@redhat.com> - 2.0.7-21
changelog:
  - dracut-module-setup: Enhance kdump to support the bind mounted feature in Atomic
  - Fix the warning if the target path is bind mount in Atomic
  - Get the mount point correctly, if the device has several mount point
  - kdump-lib: Add new function to judge the system is Atomic or not
  - kdump-lib: Add the new function to enhance bind mounted judgement
  - Remove duplicate slash in save path
  - dracut-module-setup.sh: change the insecure use of /tmp/*$$* filenames
  - make kdump saving directory name consistent with RHEL6


author: WANG Chao <chaowang@redhat.com> - 2.0.7-15
changelog:
  - mount fail if its mount poing doesn't exist in /sysroot
  - rebuild initrd dependency during kdump restart
  - fix a dump path issue


author: WANG Chao <chaowang@redhat.com> - 2.0.7-14
changelog:
  - fix core_collector issue for ssh/raw dump
  - remove sysctl.conf for kdump kernel
  - exclude aarch64 build
  - fix path directive issue
  - remove panic_on_warn kernel parameter


author: WANG Chao <chaowang@redhat.com> - 2.0.7-10
changelog:
  - Rebase makedumpfile-1.5.7
  - Fix an issue on iscsi boot environment
  - Disable kvm CMA reservation in kdump kernel


author: WANG Chao <chaowang@redhat.com> - 2.0.7-9
changelog:
  - Enable ppc64le arch.
  - add sample eppic scripts to kexec-tools-eppic package
  - Restart kdump service on cpu ADD/REMOVE events


author: WANG Chao <chaowang@redhat.com> - 2.0.7-5
changelog:
  - rework of kdump error handling
  - ppc: add fadump support
  - add static route support
  - systemd will take care of shutdown and unmount filesystems
  - fix an issue that can't bring up correct network device


author: WANG Chao <chaowang@redhat.com> - 2.0.7-4
changelog:
  - ppc64: kexec load fails due to elf symbol relocation failure.
  - display a message while waiting for kdump lock


author: WANG Chao <chaowang@redhat.com> - 2.0.4-33
changelog:
  - support fence_kdump for generic cluster
  - handle static ip fix
  - stop passing "nofail" mount option to 2nd kernel


author: WANG Chao <chaowang@redhat.com> - 2.0.4-28
changelog:
  - Document supported/unsupported/unknown list of dump targets
  - Warn user about save vmcore path mounted by another disk


author: WANG Chao <chaowang@redhat.com> - 2.0.4-27
changelog:
  - mkdumprd: call dracut with --hostonly-cmdline (dracut >= 033-145)
  - warning on secure boot enabled platform


author: WANG Chao <chaowang@redhat.com> - 2.0.4-25
changelog:
  - kdumpctl: Pass disable_cpu_apicid to kexec of capture kernel
  - Relax restriction of dumping on encrypted target
  - ssh dump: create random-seed manually


author: WANG Chao <chaowang@redhat.com> - 2.0.4-24
changelog:
  - remove selinux flipping when propagating ssh key
  - add kdump-in-cluster-environment.txt to rpm pkg
  - Secure Boot status check warning
  - Some watchdog driver support


author: WANG Chao <chaowang@redhat.com> - 2.0.4-21
changelog:
  - makedumpfile: Improve progress information for huge memory system
  - s390: use nr_cpus=1 instead of maxcpus=1


author: WANG Chao <chaowang@redhat.com> - 2.0.4-20
changelog:
  - vmcore-dmesg: fix timestamp error in vmcore-dmesg.txt
  - makedumpfile: re-enable mmap() and introduce --non-mmap
  - kdump.conf uncomment default core_collector line
  - fix an issue when 'ssh' directive appearing in kdump.conf, the rest part of
    lines in this file are ignored


author: WANG Chao <chaowang@redhat.com> - 2.0.4-15
changelog:
  - makedumpfile: default to lzo compression
  - makedumpfile: add makedumpfile.conf.sample and its manpage


author: WANG Chao <chaowang@redhat.com> - 2.0.4-14
changelog:
  - Add rd.memdebug in kdump module
  - kdumpctl: Avoid leaking fd to subshell
  - makedumpfile: Understand >= v3.11-rc4 dmesg
  - makedumpfile, ppc: Support to filter dump for kernels that use CONFIG_SPARSEMEM_VMEMMAP.


author: WANG Chao <chaowang@redhat.com> - 2.0.4-12
changelog:
  - fix sadump format phys_base calculating error
  - kdump, x86: Process multiple Crash kernel in /proc/iomem
  - makedumpfile: wrong cyclic buffer size recalculation causes bitmap data corruption
  - Fix max_mapnr issue on system has over 44-bit addressing.


author: Baoquan He <bhe@redhat.com> - 2.0.4-9
changelog:
  - Strip inline comments from the kdump config file before use
  - kdump-lib.sh: add common function strip_comments
  - Introduce kdump-lib.sh for kdump shared functions
  - kdump.service: Start kdump after network is online and remote fs is mounted
  - dracut-module-setup: _dev to be a local variable
  - kdumpctl: Run multiple kdumpctl instances one by one in serial order


author: Baoquan He <bhe@redhat.com> - 2.0.4-7
changelog:
  - dracut-kdump.sh: add do_dump() and error out if dump vmcore fails
  - dracut-module-setup.sh: setup correct system time and time zone in 2nd kernel.
  - kernel cmdline: Remove hugepage allocations
  - Use /lib/dracut/no-emergency-shell to control action on fail
  - Revert: kdump.sysconfig: Add option action_on_fail and set its default as continue
  - dracut-kdump.sh: Redirect kdump script stdout/stderr to /dev/console
  - add snappy build


author: Baoquan He <bhe@redhat.com> - 2.0.4-6
changelog:
  - add lzo build
  - makedumpfile: Add vmap_area_list definition for ppc/ppc64.
  - pull makedumpfile-1.5.4
  - mkdumprd: check return value of subshell
  - mkdumprd: get_persistent_dev() return original dev if no persistent dev exists.
  - dracut-kdump.sh: Merge dump_to_rootfs() to dump_fs()
  - dracut-kdump.sh: explicitly sync after each dump
  - Correct wrong weekday of changelog
  - kexec-tools.spec: Remove incorrect description in changelog


author: Baoquan He <bhe@redhat.com> - 2.0.4-5
changelog:
  - monitor-dd-progress fix
  - rawdump: only show dd progress bar when core_collector is not makedumpfile
  - kexec-tools.spec: replaces scriptlets with new systemd macros
  - dracut-kdump.sh: umount fs right before kdump exit
  - dracut-kdump.sh: recursively umount fs and its submounts
  - dracut-kdump.sh: cleanup - using local variable names instead of $1/$2 in functions
  - dracut-kdump.sh: name the invalid vmcore to vmcore-incomplete
  - dracut-kdump.sh: Output top level information about the kdump progress.
  - kexec-kdump-howto: Add a section for debugging tips


author: Baoquan He <bhe@redhat.com> - 2.0.4-4
changelog:
  - dracut-module-setup.sh: improve the approach to get a bridged interface list
  - dracut-module-setup.sh: cleanup - use kdump_get_mac_addr() function
  - dracut-module-setup.sh: use kernel exported mac address in kdump_get_mac_addr()
  - dracut-module-setup.sh: use perm addr of slaves to setup bonding network
  - kdump: Do not output debug messages by default
  - dracut-module-setup.sh: kdump module depends on drm module
  - mkdumprd: return error if no write permission on save path of server for ssh


author: Baoquan He <bhe@redhat.com> - 2.0.4-3
changelog:
  - mkdumprd: remove -M option for dracut
  - kdumpctl: add selinux relabel when service startup
  - depends on dracut selinux module
  - dracut-kdump.sh: umount rootfs after dump_to_rootfs
  - kdump.sysconfig: append "panic=10" to kdump cmdline
  - kexec-kdump-howto: grubby is suggested modifing kernel cmdline
  - kexec-tools.spec: removes kexec udev rules for s390
  - kdump.sysconfig: Add option action_on_fail and set its default as continue
  - Add tab key as delimiter for core_collector in kdump.conf
  - redirect stdout to stderr


author: Baoquan He <bhe@redhat.com> - 2.0.4-2
changelog:
  - kdump: Save vmcore-dmesg.txt before saving vmcore
  - Remove "ip=" overwrite to 40ip.conf
  - Add support for bridge over bond/team/vlan.
  - Fix bonding options syntax and get all specified options from ifcfg file.
  - add dracut_args option to kdump.conf
  - kexec-tools.spec: Add ethtool to dependency.
  - error out if dump target is encrypted


author: Baoquan He <bhe@redhat.com> - 2.0.4-1
changelog:
  - Delete several patches which have been merged into kexec-tools-2.0.4
  - Revert: Release 2.0.3-72
  - Release 2.0.3-72
  - Pull kexec-tools-2.0.4
  - Check if block device as dump target is resettable
  - mkdumprd: add function perror_exit
  - Deprecate blacklist option


author: Baoquan He <bhe@redhat.com> - 2.0.3-68
changelog:
  - tune sysconfig to save memory usage
  - Remove useless codes related to LOGGER in kdumpctl
  - kdumpctl:print out the service status
  - Return to start() function when check_ssh_target failed
  - use findmnt instead of blkid in mkdumprd
  - check dump target mounting earlier
  - kdumpctl: rename function name check_config
  - add function to check kdump config file
  - dracut-module-setup.sh: remove UUID/LABEL quotes before using it
  - Change dump_to_rootfs to be a default option and reboot to be default action
  - Remove "-F" in CORE_COLLECTOR when dump_to_rootfs


author: Baoquan He <bhe@redhat.com> - 2.0.3-67
changelog:
  - Remove comma which is redundant
  - Modify codes related to dump dir to make it clearer
  - Rectify the get_host_ip implementation
  - Revert: Merge an upstream patch for fix a ppc64 makedumpfile bug with with CONFIG_SPARSEMEM_EXTREME
  - pull makedumpfile 1.5.3


author: Dave Young <ruyang@redhat.com> - 2.0.3-66
changelog:
  - Spec: remove kdump image when a corresponding kernel is removed
  - Merge an upstream patch for fix a ppc64 makedumpfile bug


author: Dave Young <ruyang@redhat.com> - 2.0.3-65
changelog:
  - Add support for team devices
  - Update translation file po/it.po
  - remove wait for net ok function
  - add bootdev cmdline param
  - kdumpnic cmdline file name cleanup


author: Dave Young <ruyang@redhat.com> - 2.0.3-63
changelog:
  - revert explictly handling of PIPESTATUS
  - enable pipefail bash option
  - wrong ssh key fix
  - build fix: Update 3 po files: po/gu.po po/or.po po/zh_CN.po


author: Dave Young <ruyang@redhat.com> - 2.0.3-62
changelog:
  - Pull translated po files from zanata
  - Optimize redundent code fetching server of network dump
  - change the dump dir format to be more readable


author: Dave Young <ruyang@redhat.com> - 2.0.3-60
changelog:
  - makedumpfile 1.5.1
  - Update po tar.gz
  - Add a notes for zanata process
  - Add two xmls file for po zanata translation
  - Cleanup and recreate po files


author: Dave Young <ruyang@redhat.com> - 2.0.3-59
changelog:
  - Enable kdump service after installation
  - get MEM_RESERVED from sysfs attribute
  - get_ssh_size: use -n to redirect stdin from /dev/null
  - add random feeding code for ssh dump
  - kdump option space checking improvement
  - kdumpctl: multi dump target checking fix


author: Dave Young <ruyang@redhat.com> - 2.0.3-56
changelog:
  - Pull vmcore-dmesg patches from vivek
  - ppc/ppc64: compile purgatory with gcc option msoft-float
  - Update to support f18 grub2 efi config file
  - pass persistent name to dracut --device
  - pass persistent name to dracut --mount
  - use persistent name in kdump.conf of initramfs
  - mkdumprd: add function get_persistent_dev
  - remove useless uuid and label handling


author: Dave Young <ruyang@redhat.com> - 2.0.3-54
changelog:
  - pass raw device as dracut argument
  - iscsi setup fix
  - firstboot: add automatic and manual memory reservation for rhel
  - firstboot: remove unnecessary underline shortkey
  - firstboot: fix gtk warning about non-zero page size
  - firstboot: update all kernels config in grubbyCmd
  - firstboot: add actual reserved memory widget
  - firstboot code cleanup
  - rhcrashkernel-param: echo crashkernel=auto for rhel7
  - Remove the kernel-kdump handling
  - s390x firstboot fix
  - remove elilo support
  - grub2 fix in firstboot
  - Take closing the reboot dialog as no
  - Handle new crashkernel= syntax in firstboot
  - Fix a localized string in firstboot
  - Configure kdump in firstboot
  - fix firstboot to ensure kdump svc is disabled properly
  - firstboot text domain fix
  - Update to use systemctl instead of sysv chkconfig
  - port force_rebuild kdump.conf option
  - Change return value to indicate the result of dump_raw() correctly.
  - call dracut function for default shell


author: Dave Young <ruyang@redhat.com> - 2.0.3-53
changelog:
  - refactor net option
  - use fstab-sys to mount nfs
  - rename function dump_localfs
  - dump_localfs error path fix
  - update kexec-kdump-howto.txt about systemctl commands
  - ssh propagate alert message fix
  - remove useless dracut cmdline '-c /dev/null'
  - remove useless dracut cmdline for kernel-modules and kdumpbase
  - install core_collector in module-setup.sh
  - install extra_bins in module-setup.sh
  - remove busybox dependency
  - improve warning message of space checking
  - do not mount root twice
  - do not add fstab-sys module in dracut cmdline
  - omit dash module
  - network dns config fix
  - shell exit value fix


author: Dave Young <ruyang@redhat.com> - 2.0.3-51
changelog:
  - add s390x netdev setup
  - Add s390x support
  - Cleanup temp file leaved at /tmp/
  - add check_size function for fs dump
  - add ssh check_size
  - blacklist patch apply fix
  - Respect bonding mode
  - Support dump over vlan tagged bonding


author: Dave Young <ruyang@redhat.com> - 2.0.3-50
changelog:
  - add blacklist option, Resolves: bz805774
  - Add kdump_post and kdump_pre support, Resolves: bz805773
  - Port check_config from rhel6, Resolves: bz805778
  - raw core_collector fix
  - ssh core_collector fix
  - drcut-kdump.sh: cleanup kdump.conf check


author: Dave Young <ruyang@redhat.com> - 2.0.3-49
changelog:
  - cleanup DUMP_INSTRUCTION handling
  - final reboot behavior fix
  - dump_rootfs for default target fix
  - add vlan support
  - fix and refactor bond handling code
  - fix and refactor bridge handling code
  - core_collector doc basic fix
  - omit plymouth module, Resolves: bz821997
  - mkdumprd manpage cleanup manpage
  - mkdumprd: remove --debug
  - mkdumprd: remove noconf
  - makedumprd: remove -d
  - kdump.conf add sshkey
  - kdump.conf remove disk_timeout
  - kdump.conf make path uncommented
  - kdump.conf.5 add default poweroff
  - kdump.conf default shell fix
  - kdump.conf default default action fix
  - kdump.conf.5 remove module option
  - kdump.conf remove kdump_pre/kdump_post
  - kdump.conf: remove link_delay


author: Dave Young <ruyang@redhat.com> - 2.0.3-48
changelog:
  - do_default_action cleanup, Resolves: bz805773
  - add rhcrashkernel-param for anaconda use, Resolves: bz707441
  - Basic iscsi target dump support (software initiator), Resolves bz822701
  - Static ip configuratio support, Resolves: bz822739
  - udev rules fix, Resolves: bz808817


author: Dave Young <ruyang@redhat.com> - 2.0.3-46
changelog:
  - mkdumprd: Start using --hostonly and --add kdumpbase while calling dracut
  - get_mp function cleanup
  - move kdump script order to the end of pre pivot
  - port raw dump from rhel6
  - remove multi dump


author: Dave Young <dyoung@redhat.com> - 2.0.3-44
changelog:
  - update ppc64 sysconfig, resolve bug 811449
  - deal with nic rename issue, resolve bug 810107
  - update x86_64 sysconfig, resolve bug 813711


author: Cong Wang <xiyou.wangcong@gmail.com> - 2.0.3-42
changelog:
  - get ip addr with getent
  - spec: depends on dracut-network
  - Handle net option for nfs in kdump.conf correctly


author: CAI Qian <caiqian@redhat.com> - 2.0.0-34
changelog:
  - Massive forward-port from RHEL6
  - Update kexec-kdump-howto.txt
  - Update docs to reflect use of ext4
  - Update mkdumprd to pull in all modules needed
  - Fix mkdumprd typo
  - Removed universal add of ata_piix from mkdumprd
  - Fix infinite loop from modprobe changes
  - Fixed kexec-kdump-howto.doc for RHEL6
  - Update makedumpfile to 1.3.5
  - Improved mkdumprd run time
  - Cai's fix for broken regex
  - Fixing crashkernel syntax parsing
  - Fix initscript to return proper LSB return codes
  - Fixed bad call to resolve_dm_name
  - Added poweroff option to mkdumprd
  - Fixed readlink issue
  - Fixed x86_64 page_offset specifictaion
  - Fixed lvm setup loop to not hang
  - Added utsname support to makedumpfile for 2.6.32
  - Fix critical_disks list to exclude cciss/md
  - Add help info for -b option
  - Add ability to handle firmware hotplug events
  - Update mkdumprd to deal with changes in busybox fsck
  - Vitaly's fix to detect need for 64 bit elf
  - Fix major/minor numbers on /dev/rtc
  - Fix ssh id propogation w/ selinux
  - Add blacklist feature to kdump.conf
  - Removed rhpl code from firstboot
  - Fixed firstboot enable sense
  - Remove bogus debug comment from mkdumprd.
  - Handle SPARSEMEM properly
  - Fix scp monitoring script
  - Fix firstboot to find grub on EFI systems
  - Fixed mkdumprd to remove dup insmod
  - Fixed kdump fsck pause
  - Fixed kdump option handling
  - fixed raid5 module detection


author: Neil Horman <nhorman@redhat.com> 2.0.0-18
changelog:
  - Updated initscript to use mkdumprd2 if manifest is present
  - Updated spec to require dash
  - Updated sample manifest to point to correct initscript
  - Updated populate_std_files helper to fix sh symlink


author: Neil Horman <nhorman@redhat.com> - 1.102pre-6
changelog:
  - Bringing rawhide up to date with bugfixes from RHEL5
  - Adding patch to prevent kexec buffer overflow on ppc (bz 428684)


author: Neil Horman <nhorman@redhat.com> - 1.102pre-3
changelog:
  - Fix ARCH placement in kdump init script (bz 427201)
  - Fix BuildRequires
  - Fix Makedumpfile to build with new libelf


author: Neil Horman <nhorman@redhat.com> - 1.102pre-1
changelog:
  - Bumping kexec version to latest horms tree (bz 257201)
  - Adding trigger to remove initrds when a kernel is removed


author: Neil Horman <nhorman@redhat.com> - 1.101-58
changelog:
  - Updating kdump.init and mkdumprd with most recent RHEL5 fixes
  - Fixing BuildReq to require elfutils-devel-static


author: Jarod Wilson <jwilson@redhat.com> - 1.101-46
changelog:
  - ppc64 fixups:
    - actually build ppc64 binaries (bug 203407)
    - correct usage output
    - avoid segfault in command-line parsing
  - install kexec man page
  - use regulation Fedora BuildRoot


author: Neil Horman <nhorman@redhat.com> - 1.101-45
changelog:
  - fixed typo in mkdumprd for bz 202983
  - fixed typo in mkdumprd for bz 203053
  - clarified docs in kdump.conf with examples per bz 203015


author: Thomas Graf <tgraf@redhat.com> - 1.101-15
changelog:
  - Don't add kdump service by default, let the user manually add it to
    avoid everyone seeing a warning.


author: Thomas Graf <tgraf@redhat.com> - 1.101-10
changelog:
  - kdump7.patch
     o Remove elf32 core headers support for x86_64
     o Fix x86 prepare elf core header routine
     o Fix ppc64 kexec -p failure for gcc 4.10
     o Fix few warnings for gcc 4.10
     o Add the missing --initrd option for ppc64
     o Fix ppc64 persistent root device bug
  - Remove --elf32-core-headers from default configuration, users
    may re-add it via KEXEC_ARGS.
  - Remove obsolete KEXEC_HEADERS


author: Jeff Moyer <jmoyer@redhat.com> - 1.101-8
changelog:
  - Fix the service stop case.  It was previously unloading the wrong kernel.
  - Implement the "restart" function.
  - Add the "irqpoll" option as a default kdump kernel commandline parameter.
  - Create a default kernel command line in the sysconfig file upon rpm install.


author: Jeff Moyer <jmoyer@redhat.com> - 1.101-4
changelog:
  - Build for x86_64 as well.  Kdump support doesn't work there, but users
    should be able to use kexec.


author: Mark Wielaard <mjw@redhat.com> - 0.176-1
changelog:
  - New upstream release (#1676504)
    CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7150,
    CVE-2019-7664, CVE-2019-7665, CVE-2018-16062, CVE-2018-16402,
    CVE-2018-16403, CVE-2018-18310, CVE-2018-18521, CVE-2018-18520.


author: Mark Wielaard <mjw@redhat.com> - 0.172-1
changelog:
  - New upstream release.
    - No functional changes compared to 0.171.
    - Various bug fixes in libdw and eu-readelf dealing with bad DWARF5
      data. Thanks to running the afl fuzzer on eu-readelf and various
      testcases.
    - eu-readelf -N is ~15% faster.


author: Mark Wielaard <mjw@redhat.com> - 0.171-1
changelog:
  - New upstream release.
    - DWARF5 and split dwarf, including GNU DebugFission, support.
    - readelf: Handle all new DWARF5 sections.
      --debug-dump=info+ will show split unit DIEs when found.
      --dwarf-skeleton can be used when inspecting a .dwo file.
      Recognizes GNU locviews with --debug-dump=loc.
    - libdw: New functions dwarf_die_addr_die, dwarf_get_units,
      dwarf_getabbrevattr_data and dwarf_cu_info.
      libdw will now try to resolve the alt file on first use
      when not set yet with dwarf_set_alt.
      dwarf_aggregate_size() now works with multi-dimensional arrays.
    - libdwfl: Use process_vm_readv when available instead of ptrace.
    - backends: Add a RISC-V backend.


author: Mark Wielaard <mjw@redhat.com> - 0.170-1
changelog:
  - New upstream release. Remove upstreamed patches.
  - Sync provide_yama_scope with fedora.
  - Add elfutils-0.170-x86_64-backtrace-test-override.patch.


author: Mark Wielaard <mjw@redhat.com> - 0.162-1
changelog:
  - Update to 0.162 (#1224169, #1223462, #1207799)
  - Include elfutils/known-dwarf.h
  - Drop BuildRequires glibc-headers


author: Mark Wielaard <mjw@redhat.com> 0.157-1
changelog:
  - Update to 0.157.
  - Remove elfutils-0.156-abi_cfi-ppc-s390-arm.patch.
  - Remove elfutils-0.156-et_dyn-kernels.patch.


author: Mark Wielaard <mjw@redhat.com> 0.156-5
changelog:
  - Add elfutils-0.156-abi_cfi-ppc-s390-arm.patch.
    Sets up initial CFI return register, CFA location expression and
    register rules for PPC, S390 and ARM (dwarf_cfi_addrframe support).


author: Mark Wielaard <mjw@redhat.com> 0.156-4
changelog:
  - Add elfutils-0.156-et_dyn-kernels.patch.
    Fixes an issue on ppc64 with systemtap kernel address placement.


author: Jan Kratochvil <jan.kratochvil@redhat.com> 0.156-1
changelog:
  - Update to 0.156.
    - #890447 - Add __bss_start and __TMC_END__ to elflint.
    - #909481 - Only try opening files with installed compression libraries.
    - #914908 - Add __bss_start__ to elflint.
    - #853757 - Updated Polish translation.
    - #985438 - Incorrect prototype of __libdwfl_find_elf_build_id.
    - Drop upstreamed elfutils-0.155-binutils-pr-ld-13621.patch.
    - Drop upstreamed elfutils-0.155-mem-align.patch.
    - Drop upstreamed elfutils-0.155-sizeof-pointer-memaccess.patch.


author: Mark Wielaard <mjw@redhat.com> - 0.155-5
changelog:
  - Add ARM variant to elfutils-0.155-binutils-pr-ld-13621.patch rhbz#914908.
  - rhel >= 5 has xz-devel


author: Mark Wielaard <mjw@redhat.com> - 0.155-1
changelog:
  - Update to 0.155.
    - #844270 - eu-nm invalid %N$ use detected.
    - #847454 - Ukrainian translation update.
    - Removed local ar 64-bit symbol patch, dwz support patch and xlatetom fix.


author: Mark Wielaard <mjw@redhat.com> - 0.154-1
changelog:
  - Update to 0.154
    - elflint doesn't recognize SHF_INFO_LINK on relocation sections (#807823)
    - Update license to GPLv3+ and (GPLv2+ or LGPLv3+)
    - Remove elfutils-0.153-dwfl_segment_report_module.patch
  - Add elfutils-0.154-binutils-pr-ld-13621.patch


author: Mark Wielaard <mjw@redhat.com> - 0.153-1
changelog:
  - Update to 0.153
    - New --disable-werror for portability.
    - Support for .zdebug sections (#679777)
    - type_units and DW_AT_GNU_odr_signature support (#679815)
    - low level support DW_OP_GNU_entry_value and DW_TAG_GNU_call_site (#688090)
    - FTBFS on rawhide with gcc 4.7 (#783506)
      - Remove gcc-4.7 patch


author: Roland McGrath <roland@redhat.com> - 0.152-1
changelog:
  - Update to 0.152
    - Various build and warning nits fixed for newest GCC and Autoconf.
    - libdwfl: Yet another prelink-related fix for another regression. (#674465)
    - eu-elfcmp: New flag --ignore-build-id to ignore differing build ID bits.
    - eu-elfcmp: New flag -l/--verbose to print all differences.


author: Roland McGrath <roland@redhat.com> - 0.151-1
changelog:
  - Update to 0.151
    - libdwfl: Fix for more prelink cases with separate debug file.
    - eu-strip: New flag --strip-sections to remove section headers entirely.


author: Roland McGrath <roland@redhat.com> - 0.150-1
changelog:
  - Update to 0.150
    - libdw: Fix for handling huge .debug_aranges section. (#638432)
    - libdwfl: Fix for handling prelinked DSO with separate debug file. (#652857)
    - findtextrel: Fix diagnostics to work with usual section ordering.


author: Roland McGrath <roland@redhat.com> - 0.149-1
changelog:
  - Update to 0.149
    - libdw: Decode new DW_OP_GNU_implicit_pointer operation;
             new function dwarf_getlocation_implicit_pointer.
    - libdwfl: New function dwfl_dwarf_line.
    - eu-addr2line: New flag -F/--flags to print more DWARF line info details.
    - eu-readelf: better .debug_loc processing (#627729)
    - eu-strings: Fix non-mmap file reading. (#609468)
    - eu-strip: -g recognizes .gdb_index as a debugging section. (#631997)


author: Roland McGrath <roland@redhat.com> - 0.148-1
changelog:
  - Update to 0.148
    - libdw: Accept DWARF 4 format: new functions dwarf_next_unit,
             dwarf_offdie_types.
             New functions dwarf_lineisa, dwarf_linediscriminator,
             dwarf_lineop_index.
    - libdwfl: Fixes in core-file handling, support cores from PIEs. (#588818)
               When working from build IDs, don't open a named file
               that mismatches.
    - readelf: Handle DWARF 4 formats.


author: Roland McGrath <roland@redhat.com> - 0.146-1
changelog:
  - Update to 0.146
    - libdwfl: New function dwfl_core_file_report.
    - libelf: Fix handling of phdrs in truncated file. (#577310)
    - libdwfl: Fix infinite loop handling clobbered link_map. (#576379)
  - Package translations.


author: Roland McGrath <roland@redhat.com> - 0.145-1
changelog:
  - Update to 0.145
    - Fix build with --disable-dependency-tracking. (#564646)
    - Fix build with most recent glibc headers.
    - libdw: Fix CFI decoding. (#563528)
    - libdwfl: Fix address bias returned by CFI accessors. (#563528)
               Fix core file module layout identification. (#559836)
    - readelf: Fix CFI decoding.


author: Roland McGrath <roland@redhat.com> - 0.144-1
changelog:
  - Update to 0.144
    - libdw: New function dwarf_aggregate_size for computing (constant) type
             sizes, including array_type cases with nontrivial calculation.
    - readelf: Don't give errors for missing info under -a.
               Handle Linux "VMCOREINFO" notes under -n.
  - Resolves: RHBZ #527004, RHBZ #530704, RHBZ #550858


author: Roland McGrath <roland@redhat.com> - 0.143-1
changelog:
  - Update to 0.143
    - libdw: Various convenience functions for individual attributes now use
             dwarf_attr_integrate to look up indirect inherited attributes.
             Location expression handling now supports DW_OP_implicit_value.
    - libdwfl: Support automatic decompression of files in XZ format,
               and of Linux kernel images made with bzip2 or LZMA
               (as well as gzip).


author: Roland McGrath <roland@redhat.com> - 0.142-1
changelog:
  - Update to 0.142
    - libelf: Bug fix in filling gaps between sections. (#512840)
    - libelf: Add elf_getshdrnum alias for elf_getshnum and elf_getshdrstrndx
              alias for elf_getshstrndx and deprecate original names.
    - libebl, elflint: Add support for STB_GNU_UNIQUE. (#511436)
    - readelf: Add -N option, speeds up DWARF printing
               without address->name lookups. (#505347)
    - libdw: Add support for decoding DWARF CFI into location description form.
             Handle some new DWARF 3 expression operations previously omitted.
             Basic handling of some new encodings slated for DWARF 4.


author: Roland McGrath <roland@redhat.com> - 0.141-1
changelog:
  - Update to 0.141
    - libebl: sparc backend fixes (#490585)
              some more arm backend support
    - libdwfl: fix dwfl_module_build_id for prelinked DSO case (#489439)
               fixes in core file support (#494858)
               dwfl_module_getsym interface improved for non-address symbols
    - eu-strip: fix infinite loop on strange inputs with -f
    - eu-addr2line: take -j/--section=NAME option for binutils compatibility
                    (same effect as '(NAME)0x123' syntax already supported)
  - Resolves: RHBZ #495213, RHBZ #465872, RHBZ #470055, RHBZ #484623


author: Roland McGrath <roland@redhat.com> - 0.139-1
changelog:
  - Update to 0.139
    - libcpu: Add Intel SSE4 disassembler support
    - readelf: Implement call frame information and exception handling dumping.
               Add -e option.  Enable it implicitly for -a.
    - elflint: Check PT_GNU_EH_FRAME program header entry.
    - libdwfl: Support automatic gzip/bzip2 decompression of ELF files. (#472136)


author: Roland McGrath <roland@redhat.com> - 0.138-1
changelog:
  - Update to 0.138
    - Install <elfutils/version.h> header file for applications to use in
      source version compatibility checks.
    - libebl: backend fixes for i386 TLS relocs; backend support for NT_386_IOPERM
    - libcpu: disassembler fixes (#469739)
    - libdwfl: bug fixes (#465878)
    - libelf: bug fixes
    - eu-nm: bug fixes for handling corrupt input files (#476136)


author: Roland McGrath <roland@redhat.com> - 0.137-2
changelog:
  - Update to 0.137
    - libdwfl: bug fixes; new segment interfaces;
               all the libdwfl-based tools now support --core=COREFILE option
  - Resolves: RHBZ #325021, RHBZ #447416


author: Roland McGrath <roland@redhat.com> - 0.135-1
changelog:
  - Update to 0.135
    - libdwfl: bug fixes
    - eu-strip: changed handling of ET_REL files wrt symbol tables and relocs


author: Roland McGrath <roland@redhat.com> - 0.134-1
changelog:
  - Update to 0.134
    - elflint: backend improvements for sparc, alpha (#204170)
    - libdwfl, libelf: bug fixes (#439344, #438867, #438263, #438190)
  - Remove Conflicts: libelf-devel from elfutils-libelf-devel. (#435742)


author: Roland McGrath <roland@redhat.com> - 0.133-2
changelog:
  - Update to 0.133
    - readelf, elflint, libebl: SHT_GNU_ATTRIBUTE section handling (readelf -A)
    - readelf: core note handling for NT_386_TLS, NT_PPC_SPE, Alpha NT_AUXV
    - libdwfl: bug fixes and optimization in relocation handling
    - elfcmp: bug fix for non-allocated section handling
    - ld: implement newer features of binutils linker.
  - Install eu-objdump and libasm, now has limited disassembler support.


author: Roland McGrath <roland@redhat.com> - 0.132-3
changelog:
  - Update to 0.132
    - libelf: Use loff_t instead of off64_t in libelf.h header. (#377241)
    - eu-readelf: Fix handling of ET_REL files in archives.
    - libcpu: Implement x86 and x86-64 disassembler.
    - libasm: Add interface for disassembler.
    - all programs: add debugging of branch prediction.
    - libelf: new function elf_scnshndx.


author: Roland McGrath <roland@redhat.com> - 0.131-1
changelog:
  - Update to 0.131
    - libdw: DW_FORM_ref_addr support; dwarf_formref entry point now deprecated;
             bug fixes for oddly-formatted DWARF
    - libdwfl: bug fixes in offline archive support, symbol table handling;
               apply partial relocations for dwfl_module_address_section on ET_REL
    - libebl: powerpc backend support for Altivec registers


author: Roland McGrath <roland@redhat.com> - 0.130-1
changelog:
  - Update to 0.130
    - eu-readelf -p option can take an argument like -x for one section
    - eu-readelf --archive-index (or -c)
    - eu-readelf -n improved output for core dumps
    - eu-readelf: handle SHT_NOTE sections without requiring phdrs (#249467)
    - eu-elflint: ditto
    - eu-elflint: stricter checks on debug sections
    - eu-unstrip: new options, --list (or -n), --relocate (or -R)
    - libelf: new function elf_getdata_rawchunk, replaces gelf_rawchunk;
              new functions gelf_getnote, gelf_getauxv, gelf_update_auxv
    - libebl: backend improvements (#324031)
    - libdwfl: build_id support, new functions for it
    - libdwfl: dwfl_module_addrsym fixes (#268761, #268981)
    - libdwfl offline archive support, new script eu-make-debug-archive


author: Roland McGrath <roland@redhat.com> - 0.129-1
changelog:
  - Update to 0.129
    - readelf: new options --hex-dump (or -x), --strings (or -p) (#250973)
    - addr2line: new option --symbols (or -S)
    - libdw: dwarf_getscopes fixes (#230235)
    - libdwfl: dwfl_module_addrsym fixes (#249490)


author: Roland McGrath <roland@redhat.com> - 0.128-2
changelog:
  - Update to 0.128
    - new program: unstrip
    - elfcmp: new option --hash-inexact
  - Replace Conflicts: with Provides/Requires using -arch


author: Roland McGrath <roland@redhat.com> - 0.127-1
changelog:
  - Update to 0.127
    - libdw: new function dwarf_getsrcdirs
    - libdwfl: new functions dwfl_module_addrsym, dwfl_report_begin_add,
               dwfl_module_address_section


author: Roland McGrath <roland@redhat.com> - 0.126-1
changelog:
  - Update to 0.126
    - New program eu-ar.
    - libdw: fix missing dwarf_getelf (#227206)
    - libdwfl: dwfl_module_addrname for st_size=0 symbols (#227167, #227231)


author: Roland McGrath <roland@redhat.com> - 0.125-1
changelog:
  - Update to 0.125
    - elflint: Compare DT_GNU_HASH tests.
    - move archives into -static RPMs
    - libelf, elflint: better support for core file handling
    - Really fix libdwfl sorting of modules with 64-bit addresses (#220817).
  - Resolves: RHBZ #220817, RHBZ #213792


author: Roland McGrath <roland@redhat.com> - 0.124-1
changelog:
  - eu-strip -f: copy symtab into debuginfo file when relocs use it (#203000)
  - Update to 0.124
    - libebl: fix ia64 reloc support (#206981)
    - libebl: sparc backend support for return value location
    - libebl, libdwfl: backend register name support extended with more info
    - libelf, libdw: bug fixes for unaligned accesses on machines that care
    - readelf, elflint: trivial bugs fixed


author: Roland McGrath <roland@redhat.com> 0.123-1
changelog:
  - Update to 0.123
    - libebl: Backend build fixes, thanks to Stepan Kasal.
    - libebl: ia64 backend support for register names, return value location
    - libdwfl: Handle truncated linux kernel module section names.
    - libdwfl: Look for linux kernel vmlinux files with .debug suffix.
    - elflint: Fix checks to permit --hash-style=gnu format.


author: Roland McGrath <roland@redhat.com> - 0.122-3
changelog:
  - Update to 0.122
    - Fix libdwfl sorting of modules with 64-bit addresses (#198225).
    - libebl: add function to test for relative relocation
    - elflint: fix and extend DT_RELCOUNT/DT_RELACOUNT checks
    - elflint, readelf: add support for DT_GNU_HASH
    - libelf: add elf_gnu_hash
    - elflint, readelf: add support for 64-bit SysV-style hash tables
    - libdwfl: new functions dwfl_module_getsymtab, dwfl_module_getsym.


author: Roland McGrath <roland@redhat.com> - 0.121-1
changelog:
  - Update to 0.121
    - libelf: bug fixes for rewriting existing files when using mmap (#187618).
    - make all installed headers usable in C++ code (#193153).
    - eu-readelf: better output format.
    - eu-elflint: fix tests of dynamic section content.
    - libdw, libdwfl: handle files without aranges info.


author: Roland McGrath <roland@redhat.com> - 0.120-2
changelog:
  - Update to 0.120
    - License changed to GPL, with some exceptions for using
      the libelf, libebl, libdw, and libdwfl library interfaces.
      Red Hat elfutils is an included package of the Open Invention Network.
    - dwarf.h updated for DWARF 3.0 final specification.
    - libelf: Fix corruption in ELF_C_RDWR uses (#187618).
    - libdwfl: New function dwfl_version; fixes for offline.


author: Roland McGrath <roland@redhat.com> - 0.118-1
changelog:
  - update to 0.118
    - elflint: more tests.
    - libdwfl: New function dwfl_module_register_names.
    - libebl: New backend hook for register names.
  - Make sure -fexceptions is always in CFLAGS.


author: Roland McGrath <roland@redhat.com> - 0.117-2
changelog:
  - update to 0.117
    - libdwfl: New function dwfl_module_return_value_location (#166118)
    - libebl: Backend improvements for several CPUs


author: Roland McGrath <roland@redhat.com> - 0.116-1
changelog:
  - update to 0.116
    - libdw fixes, API changes and additions
    - libdwfl fixes (#169672)
    - eu-strip/libelf fix to preserve setuid/setgid permission bits (#167745)


author: Roland McGrath <roland@redhat.com> - 0.115-2
changelog:
  - update to 0.115
    - New program eu-strings.
    - libdw: New function dwarf_getscopes_die.
    - libelf: speed-ups of non-mmap reading.
    - Implement --enable-gcov option for configure.


author: Roland McGrath <roland@redhat.com> - 0.114-1
changelog:
  - update to 0.114
    - new program eu-ranlib
    - libdw: new calls for inlines
    - libdwfl: new calls for offline modules


author: Roland McGrath <roland@redhat.com> - 0.113-2
changelog:
  - update to 0.113
    - elflint: relax a bit.  Allow version definitions for defined symbols
      against DSO versions also for symbols in nobits sections.
      Allow .rodata section to have STRINGS and MERGE flag set.
    - strip: add some more compatibility with binutils.
    - libdwfl: bug fixes.
  - Separate libdw et al into elfutils-libs subpackage.


author: Roland McGrath <roland@redhat.com> - 0.112-1
changelog:
  - update to 0.112
    - elfcmp: some more relaxation.
    - elflint: many more tests, especially regarding to symbol versioning.
    - libelf: Add elfXX_offscn and gelf_offscn.
    - libasm: asm_begin interface changes.
    - libebl: Add three new interfaces to directly access machine, class,
      and data encoding information.


author: Roland McGrath <roland@redhat.com> - 0.109-2
changelog:
  - update to 0.109
    - verify that libebl modules are from the same build
    - new eu-elflint checks on copy relocations
    - new program eu-elfcmp
    - new experimental libdwfl library


author: Roland McGrath <roland@redhat.com> - 0.108-1
changelog:
  - update to 0.108
    - merge strip fixes
    - sort records in dwarf_getsrclines, fix dwarf_getsrc_die searching
    - update elf.h from glibc


author: Roland McGrath <roland@redhat.com> - 0.107-1
changelog:
  - update to 0.107
    - readelf: improve DWARF output format
    - elflint: -d option to support checking separate debuginfo files
    - strip: fix ET_REL debuginfo files (#156341)


author: Jakub Jelinek <jakub@redhat.com> 0.92-1
changelog:
  - full version
  - macroized spec file for GPL or OSL builds
  - include only libelf under GPL plus wrapper scripts


author: Jakub Jelinek <jakub@redhat.com> 0.72-4
changelog:
  - fix arguments to gelf_getsymshndx and elf_getshstrndx
  - fix other warnings
  - reenable checks on s390x


author: Jeff Johnson <jbj@redhat.com> 0.69-4
changelog:
  - update to 0.69.
  - add "make check" and segfault avoidance patch.
  - elfutils-libelf needs to run ldconfig.


author: Hans de Goede <hdegoede@redhat.com> - 7.7-10
changelog:
  - fontsproto-2.1.3
  - videoproto-2.3.2
  - xextproto-7.3.0
  - xproto-7.0.26
  - Cherry pick some unreleased fixes from upstream git


author: Peter Hutterer <peter.hutterer@redhat.com> 7.6-24
changelog:
  - bigregsproto 1.1.2
  - compositeproto 0.4.2
  - damageproto 1.2.1
  - fontsproto 2.1.2
  - inputproto 2.2
  - kbproto 1.0.6
  - recordproto 1.14.2
  - scrnsaverproto 1.2.2
  - xcmiscproto 1.2.2
  - xextproto 7.2.1


author: Colin Walters <walters@verbum.org> - 1.30.0-6
changelog:
  - introspection: Add patch to export pkg-config file; necessary
    for dependent packages to build with introspection.


author: Havoc Pennington <hp@redhat.com>
changelog:
  - Version 0.7
  - add explicit check for required glib2 version before we do the build,
    so we don't end up with bad RPMs on --nodeps builds


author: Kamil Dudka <dkdudka@redhat.com> - 2.2.51-13
changelog:
  - avoid failure of %check when building as root (#1085389)
  - setfacl.1: document the meaning of '-' in perms (#1337039)


author: Kamil Dudka <kdudka@redhat.com> 2.2.49-4
changelog:
  - do not package a static library (#556036)
  - remove multilib patch no longer useful
  - cleanup in BuildRequires


author: Karsten Hopp <karsten@redhat.com> 2.2.39-3
changelog:
  - fix buildroot
  - remove trailing dot from summary
  - -devel requires same version of libacl
  - escape macro in changelog
  - make .so symlink relative


author: Thomas Woerner <twoerner@redhat.com> 2.2.39-1
changelog:
  - new version 2.2.39
  - fixed usage of long UTF-8 filenames (#183181)
    Thanks to Andrey for the initial patch.


author: Stephen C. Tweedie <sct@redhat.com> 2.2.7-3
changelog:
  - Add /usr/include/acl to files manifest
  - Fix location of doc files, add main doc dir to files manifest


author: Michael K. Johnson <johnsonm@redhat.com> 2.0.11-1
changelog:
  - Initial Red Hat package
    Made as few changes as possible relative to upstream packaging to
    make it easier to maintain long-term.  This means that some of
    the techniques used here are definitely not standard Red Hat
    techniques.  If you are looking for an example package to fit
    into Red Hat Linux transparently, this would not be the one to
    pick.
  - acl-devel -> libacl-devel


author: Fernando Nasser <fnasser.redhat.com> 2.0.8-3jpp
changelog:
  - Add AOT bits
  - Fix javadoc unversioned link handling
  - Add requires for post/postun javadoc sections added above


author: Guillaume Rousse <guillomovitch@users.sourceforge.net> 2.0.4-7jpp
changelog:
  - section macro
  - use sed instead of bash 2.x extension in link area to make spec compatible with distro using bash 1.1x


author: Guillaume Rousse <guillomovitch@users.sourceforge.net> 2.0.4-1mdk
changelog:
  - 2.0.4
  - vendor tag
  - packager tag
  - s/Copyright/License/
  - truncated description to 72 columns in spec
  - spec cleanup
  - used versioned jar
  - used new source packaging policy


author: Guillaume Rousse <g.rousse@linux-mandrake.com> 2.0.1-2mdk
changelog:
  - merged with Henri Gomez <hgomez@users.sourceforge.net> specs:
  - changed name to oro
  -  changed javadir to /usr/share/java
  -  dropped jdk & jre requirement
  -  added Jikes support
  - changed jar name to oro.jar
  - corrected doc
  - more macros


author: Zdenek Pavlas <zpavlas@redhat.com> - 3.10-0
changelog:
  - clamp timestamps from the future.  BZ 894630, 1013733
  - Fix the condition to enter single-connection mode. BZ 853432
  - Fix unit tests


author: Zdenek Pavlas <zpavlas@redhat.com> - 3.9.1-32
changelog:
  - Update to latest HEAD.
  - Fix traceback when entering single-connection mode with DEBUG off
  - Fix traceback when limit==None and DEBUG is on
  - Fix the condition to enter single-connection mode


author: Zdenek Pavlas <zpavlas@redhat.com> - 3.9.1-31
changelog:
  - Update to latest HEAD.
  - Switch to max_connections=1 after refused connect. BZ 853432
  - Never display negative downloading speed. BZ 1001767
  - clamp timestamps from the future.  BZ 894630, 1013733


author: Zdenek Pavlas <zpavlas@redhat.com> - 3.9.1-30
changelog:
  - Update to latest HEAD.
  - add ftp_disable_epsv option. BZ 849177
  - Spelling fixes.
  - docs: throttling is per-connection, suggest max_connections=1. BZ 998263
  - More robust "Content-Length" parsing. BZ 1000841


author: Zdenek Pavlas <zpavlas@redhat.com> - 3.9.1-29
changelog:
  - Update to latest HEAD.
  - Fix parsing of FTP 213 responses
  - Switch to max_connections=1 after timing out.  BZ 853432
  - max_connections=0 should imply the default limit.


author: Zdenek Pavlas <zpavlas@redhat.com> - 3.9.1-28
changelog:
  - Update to latest HEAD.
  - Add the "minrate" option. BZ 964298
  - Workaround progress "!!!" end for file:// repos.
  - add URLGrabError.code to the external downloader API
  - Disable GSSNEGOTIATE to work around a curl bug.  BZ 960163


author: Zdenek Pavlas <zpavlas@redhat.com> - 3.9.1-26
changelog:
  - Update to latest HEAD.
  - Handle HTTP 200 response to range requests correctly.  BZ 919076
  - Reset curl_obj to clear CURLOPT_RANGE from previous requests.  BZ 923951


author: Zdeněk Pavlas <zpavlas@redhat.com> - 3.9.1-25
changelog:
  - Update to latest HEAD.
  - fix some test cases that were failing.  BZ 918658
  - exit(1) or /bin/urlgrabber failures.  BZ 918613
  - clamp timestamps from the future.  BZ 894630
  - enable GSSNEGOTIATE if implemented correctly.
  - make error messages more verbose.


author: Zdeněk Pavlas <zpavlas@redhat.com> - 3.9.1-15
changelog:
  - Update to latest head, misc bugfixes: BZ 832028, 831904, 831291.
  - Disable Kerberos auth.  BZ 769254
  - copy_local bugfix. BZ 837018
  - send 'tries' counter to mirror failure callback


author: James Antill <james@fedoraproject.org> 3.0.0-8
changelog:
  - Tweak progress output so it's hopefully less confusing
  - Add dynamic resizing ability to progress bar
  - Resolves: bug#437197


author: James Antill <james@fedoraproject.org> 3.0.0-7
changelog:
  - Fix reget's against servers that don't allow Range requests, also tweaks
  - reget == check_timestamp, if anyone/thing uses that.
  - Resolves: bug#435156
  - Fix minor typo in progress for single instance.


author: James Antill <james@fedoraproject.org> 3.0.0-6
changelog:
  - Fix the ftp byterange port problem:
  - Resolves: bug#419241
  - Fixup the progress UI:
  -   add function for total progress
  -   add total progress percentagee current download line
  -   add rate to current download line
  -   use dead space when finished downloading
  -   don't confuse download rate on regets.


author: Honza Horak <hhorak@redhat.com> 1.2.4-2
changelog:
  - Changed license from GPLv2 to GPLv2+ to correspond with source
  - Added license LGPLv2+ due to make_isohybrid_mbr.c


author: Jesse Keating <jkeating@redhat.com> - 0.2.3-1
changelog:
  - Initial release split off of libburn package.
  - Disable docs for now, will be fixed in future upstream release


author: Kalev Lember <kalevlember@gmail.com> - 3.0-1
changelog:
  - Update to 3.0
  - Use license macro for the LICENCE file
  - Use desktop-file-validate instead of desktop-file-install


author: Hans de Goede <hdegoede@redhat.com> - 2.0-8
changelog:
  - Add a patch fixing various crashes due to referencing freed memory (#1133339)
  - Cherry-pick some other fixes from upstream git


author: Julian Sikorski <belegdol@fedoraproject.org> - 2.0-1
changelog:
  - Updated to 2.0
  - Made the make calls verbose
  - Dropped explicit pulsaudio-libs dependency
  - Updated the version in the pulseaudio-libs-devel BR


author: Julian Sikorski <belegdol@fedoraproject.org> - 1.0-1
changelog:
  - Updated to 1.0
  - Switched to .xz sources
  - Dropped obsolete Group, Buildroot, %clean and %defattr
  - Updated Source0 and URL
  - Switched to gtk3


author: Kalev Lember <kalev@smartlink.ee> - 2.2.8-4
changelog:
  - Spec cleanup
  - Use macro for automatically calculating ftp directory name with
    first two digits of tarball version.
  - Dropped R: pkgconfig from -devel as it's now automatically added by rpm
  - Own /usr/share/doc/libsigc++-2.0/ dir and mark /usr/share/devhelp/ as %doc
  - Require base package from -doc subpackage
  - Drop unneeded doxygen and graphviz BRs


author: Denis Leroy <denis@poolshark.org> - 2.2.4.1-1
changelog:
  - Update to upstream 2.2.4.1
  - Added devhelp book and necessary BRs
  - Split documentation into new subpackage
  - Moved documentation to gtk-doc dir


author: Dmitry V. Levin <ldv@fandra.org>
changelog:
  - filtering out -fno-rtti and -fno-exceptions options from $RPM_OPT_FLAGS
  - minor install section cleanup


author: Rex Dieter <rdieter@fedoraproject.org> - 5.6.0-0.3
changelog:
  - include BR: qt5-qdoc only in -doc subpkg
  - restore bootstrap macro support
  - make openal support unconditional (#1069231)


author: Milan Crha <mcrha@redhat.com> - 3.28.2-1
changelog:
  - Update to 3.28.2
  - Add patch for GNOME bug #795997 (Fails to parse Google OAuth2 authorization code)
  - Resolves: #1575495


author: Milan Crha <mcrha@redhat.com> - 3.22.7-7
changelog:
  - Add patch for RH bug #1504071 (Prefer SSL over STARTTLS for mail when both are set in GOA)
  - Add patch for RH bug #1476329 (Deadlock on exit under e-categories.c:finalize_categories())


author: Milan Crha <mcrha@redhat.com> - 3.22.7-4
changelog:
  - Add patch for RH bug #1441608 (Use-after-free when setting summary for component with alarms)
  - Add patch for RH bug #1439590 ([IMAPx] Unsubscribed folders shown after refresh)


author: Milan Crha <mcrha@redhat.com> - 3.12.11-37
changelog:
  - Update patch for RH bug #1362674 (CalDAV fails to recognize "Daily Limit Exceeded" error from Google/GOA)


author: Milan Crha <mcrha@redhat.com> - 3.12.11-32
changelog:
  - Add patch for RH bug #1337259 ([IMAPx] Disable and hide "Use Quick Resync if the server supports it")


author: Milan Crha <mcrha@redhat.com> - 3.12.11-25
changelog:
  - Correct patch for RH bug #1278701 (Missing chunk for initialization of the hash table and a mutex)
  - Add patch for RH bug #1264957 (Changing weather calendar Units won't take effect until restart)
  - Add patch for RH bug #1204373 (Do not use GTask for CamelSession thread jobs)
  - Add patch for RH bug #1265684 ([IMAPx] Update to the recent upstream version)


author: Milan Crha <mcrha@redhat.com> - 3.12.11-18
changelog:
  - Update patch for RH bug #1202372 (Discover and display all calendar shares associated with GOA Google account)


author: Milan Crha <mcrha@redhat.com> - 3.12.11-15
changelog:
  - Add patch for RH bug #1229812 (Preserve EWS autodiscovered hosts in GOA accounts)
  - Update patch for RH bug #1202372 (Discover and display all calendar shares associated with GOA Google account)


author: Milan Crha <mcrha@redhat.com> - 3.12.11-14
changelog:
  - Update patch for RH bug #1111600 ([IMAPx] Indefinite waiting for message download)
  - Add patch for RH bug #1226318 (Local Drafts folder is displayed twice after the first run)
  - Add patch for RH bug #1226924 (Add thread-safety into EAsyncClosure and CamelAsyncClosure)


author: Milan Crha <mcrha@redhat.com> - 3.12.11-13
changelog:
  - Update patch to address some of the Coverity Scan issues
  - Add patch for RH bug #1225981 (Truly disable gtk-doc build when asked to)


author: Milan Crha <mcrha@redhat.com> - 3.12.11-10
changelog:
  - Update patch for RH bug #1202372 (Do not overwrite calendar colors for Google and ownCloud)
  - Add patch for RH bug #1224901 (SMTP connection lost while reading message data)
  - Add patch for RH bug #1224736 (Extra 000D letters at the end of lines)
  - Add patch for RH bug #1101476 ([IMAPx] Temporarily workaround 'Empty cache file' error)


author: Milan Crha <mcrha@redhat.com> - 3.12.11-6
changelog:
  - Update patch for RH bug #1202372 (Discover and display all calendar shares associated with GOA Google account)
  - Add patch for RH bug #1223479 ([IMAPx] Process untagged EXPUNGE response only once)
  - Add patch for RH bug #1170647 ([Weather calendar] Merge day forecasts)


author: Milan Crha <mcrha@redhat.com> - 3.12.11-2
changelog:
  - Add patch for RH bug #1202372 (Discover and display all calendar shares associated with GOA Google account)
  - Add patch for RH bug #1211355 (Implement Refresh for WebDAV books and re-check availability during it too)
  - Add patch for RH bug #1211542 ("FOREIGN KEY constraint failed" trying to delete contact)


author: Milan Crha <mcrha@redhat.com> - 3.8.5-28
changelog:
  - Add patch for RH bug #1131927 (Crash in LDAP's stop_view function)
  - Add patch for RH bug #1150382 (Coverity scan warning in IMAPx)
  - Add patch for RH bug #1122644 (Weather calendar doesn't work)


author: Milan Crha <mcrha@redhat.com> - 3.8.5-24
changelog:
  - Add patch for RH bug #1083601 (IMAPx: Improve responsiveness)
  - Add patch for RH bug #1084088 (IMAPx: Avoid 'Empty cache file' error)
  - Add patch for RH bug #1084112 (IMAPx: Avoid 'Source stream returned no data' error)
  - Add patch for RH bug #1084973 (IMAPx: Refetching summary information for all msgs)
  - Add patch for RH bug #1090816 (Fix various memory leaks)


author: Milan Crha <mcrha@redhat.com> - 3.8.5-16
changelog:
  - Add patch for RH bug #1055893 (Prefer gpg2 over gpg)
  - Add patch for RH bug #1057107 (vFolder does not always refresh automatically)


author: Milan Crha <mcrha@redhat.com> - 3.8.5-13
changelog:
  - Fix unnecessary compiler warnings (RH bug #1052925)
  - Add patch for RH bug #1049960 (Crash in CalDAV's initialize_backend())
  - Add patch for RH bug #1053465 (IMAPx: Handle BODY[HEADER] in FETCH response)


author: Milan Crha <mcrha@redhat.com> - 3.8.5-1
changelog:
  - Update to 3.8.5
  - Bump nss version requirement to 3.14
  - Add patch for RH bug #995516 (Crash in certificate viewer)
  - Add patch for RH bug #995702 (Autocreate 'tmp' in maildir)


author: Matthew Barnes <mbarnes@redhat.com> - 3.8.0-2
changelog:
  - Add patch to (hopefully) fix stuck message retrievals in IMAPX.
    (evolution-data-server-3.8.0-imapx-stuck-get-message.patch)


author: Milan Crha <mcrha@redhat.com> - 3.7.91-1
changelog:
  - Update to 3.7.91
  - Remove an upstream .pc files fix for a libebook split (fixed upstream)
  - Remove patch gor GNOME bug #693101 (fixed upstream)
  - Remove patch for Red Hat bug #912503 (fixed upstream)


author: Milan Crha <mcrha@redhat.com> - 3.7.90-3
changelog:
  - Add patch gor GNOME bug #693101 (IMAPx vanishes folder summary)
  - Add patch for Red Hat bug #912503 (incorrect G_BEGIN/END_DECLS)


author: Matthew Barnes <mbarnes@redhat.com> - 3.7.3-1
changelog:
  - Update to 3.7.3
  - Remove obsolete BuildRequires:
      bison
      dbus-glib-devel
      libgnome-keyring-devel
      liboauth-devel


author: Matthew Barnes <mbarnes@redhat.com> - 3.1.3-1
changelog:
  - Update to 3.1.3
  - Remove patch for libgdata-0.9.0 (fixed upstream).
  - Disable SMP flags; some source directories are racy.
  - Remove keyring option; gnome-keyring is mandatory now.
  - Add BR: gnome-online-accounts-devel and liboauth-devel


author: Matthew Barnes <mbarnes@redhat.com> - 2.31.6-1.fc14
changelog:
  - Update to 2.31.6
  - Resume GSEAL usage.
  - Drop dbus-glib requirement.
  - Bump glib2 requirement to 2.25.12.
  - Roll back eds_base_version to 2.32.


author: Matthew Barnes <mbarnes@redhat.com> - 2.31.2-2.fc14
changelog:
  - Enable largefile support in Camel, to help debug GNOME bug #612082.
    Debian turned this on recently and is experiencing problems, and I
    want to get to the bottom of it and finally break this 2 GB barrier.


author: Milan Crha <mcrha@redhat.com> - 2.31.1-1.fc14
changelog:
  - Update to 2.31.1
  - Update BuildRequires.
  - Remove imap4 camel provider support (dropped upstream).


author: Matthew Barnes <mbarnes@redhat.com> - 2.29.1-1.fc13
changelog:
  - Update to 2.29.1
  - Bump eds_base_version to 2.30.
  - Add dbus-glib build requirement.
  - Drop Bonobo + ORBit dependency (yay!).
  - Remove option to use OpenSSL instead of NSS.
  - Drop eds_api_version definition since it will never change.
  - Remove patch for GNOME bug #373146 (deviates from upstream).


author: Matthew Barnes <mbarnes@redhat.com> - 2.26.0-1.fc11
changelog:
  - Update to 2.26.0
  - Remove patch for RH bug #568332 (fixed upstream).
  - Remove patch for GNOME bug #573240 (reverted upstream).


author: Matthew Barnes <mbarnes@redhat.com> - 2.25.90-5.fc11
changelog:
  - Update BuildRoot, License, Source and URL tags.
  - Require gnome-common so we don't have to patch it out.


author: Matthew Barnes <mbarnes@redhat.com> - 2.25.1-1.fc11
changelog:
  - Update to 2.25.1
  - Bump eds_base_version to 2.26.
  - Remove patch for RH bug #467804 (fixed upstream).


author: Matthew Barnes <mbarnes@redhat.com> - 2.23.2-1.fc10
changelog:
  - Update to 2.23.2
  - Add files for new libebackend library.
  - Remove patch for RH bug #202309 (fixed upstream).


author: Matthew Barnes <mbarnes@redhat.com> - 2.23.1-1.fc10
changelog:
  - Update to 2.23.1
  - Bump eds_base_version to 2.24.
  - Bump glib2 requirement to 2.16.1.
  - Drop gnome-vfs2 requirement.


author: Matthew Barnes <mbarnes@redhat.com> - 2.22.1-1.fc9
changelog:
  - Update to 2.22.1
  - Remove patch for RH bug #296671 (fixed upstream).
  - Remove patch for GNOME bug #523023 (fixed upstream).


author: Matthew Barnes <mbarnes@redhat.com> - 2.21.5-3.fc9
changelog:
  - Rename evolution-1.4.4-ldap-x86_64-hack.patch to avoid namespace
    collision with similarly named patch in evolution (RH bug #395551).


author: Matthew Barnes <mbarnes@redhat.com> - 2.21.5-2.fc9
changelog:
  - Add patch for GNOME bug #509644 (password dialog breakage).
  - Remove patch for RH bug #384741 (fixed upstream).
  - Remove patch for GNOME bug #363695 (obsolete).
  - Remove patch for GNOME bug #376991 (obsolete).


author: Matthew Barnes <mbarnes@redhat.com> - 2.21.1-1.fc9
changelog:
  - Update to 2.21.1
  - Bump eds_base_version to 2.22.
  - Remove patch for RH bug #212106 (fixed upstream).
  - Remove patch for GNOME bug #417999 (fixed upstream).


author: Matthew Barnes <mbarnes@redhat.com> - 1.12.1-4.fc9
changelog:
  - Remove the use_gtk_doc macro.
  - Remove redundant requirements.
  - Use the name tag where appropriate.
  - Add an evolution-data-server-doc subpackage.


author: Matthew Barnes <mbarnes@redhat.com> - 1.12.1-3.fc9
changelog:
  - Porting a couple patches over from RHEL5:
  - Add patch for RH bug #212106 (address book error on fresh install).
  - Add patch for RH bug #215702 (bad search filter for LDAP address books).


author: Matthew Barnes <mbarnes@redhat.com> - 1.12.1-2.fc8
changelog:
  - Disable patch for GNOME bug #376991 for now.  It may be contributing
    to password prompting problems as described in RH bug #296671.


author: Milan Crha <mcrha@redhat.com> - 1.11.91-1.fc8
changelog:
  - Update to 1.11.91
  - Removed patch for RH bug #215634 (fixed upstream).
  - Removed patch for GNOME bug #466987 (fixed upstream).


author: Adam Jackson <ajax@redhat.com> 1.11.90-4.fc8
changelog:
  - Add Requires: glib2 >= 2.14.0, since it's in the buildroot now, and
    forcibly introduces deps on symbols that don't exist in 2.13.  If
    only we had working symbol versioning.


author: Matthew Barnes <mbarnes@redhat.com> - 1.11.90-3.fc8
changelog:
  - Revise patch for GNOME bug #417999 to fix GNOME bug #447591
    (Automatic Contacts combo boxes don't work).


author: Matthew Barnes <mbarnes@redhat.com> - 1.11.90-1.fc8
changelog:
  - Update to 1.11.90
  - Add patch for GNOME bug #466987 (glibc redefines "open").
  - Remove patch for GNOME bug #415891 (fixed upstream).


author: Matthew Barnes <mbarnes@redhat.com> - 1.11.4-1.fc8
changelog:
  - Update to 1.11.4
  - Remove patch for RH bug #202309 (fixed upstream).
  - Remove patch for GNOME bug #312854 (fixed upstream).
  - Remove patch for GNOME bug #447414 (fixed upstream).


author: Matthew Barnes <mbarnes@redhat.com> - 1.11.2-1.fc8
changelog:
  - Update to 1.11.2
  - Bump eds_base_version to 1.12.
  - Add patch to fix implicit function declarations.
  - Remove patch for RH bug #203058 (fixed upstream).
  - Remove patch for RH bug #210142 (fixed upstream).
  - Remove patch for RH bug #235290 (fixed upstream).
  - Remove patch for GNOME bug #360240 (fixed upstream).
  - Remove patch for GNOME bug #360619 (fixed upstream).
  - Remove patch for GNOME bug #373117 (fixed upstream).
  - Revise patch for GNOME bug #415891 (partially fixed upstream).


author: Matthew Barnes <mbarnes@redhat.com> - 1.10.0-4.fc7
changelog:
  - Link to static evolution-openldap library (RH bug #210126).
  - Require openssl-devel when statically linking against openldap.
  - Add -Wdeclaration-after-statement to strict build settings.


author: Matthew Barnes <mbarnes@redhat.com> - 1.10.0-2.fc7
changelog:
  - Modify patch for GNOME bug #376991 to fix RH bug #231994.
  - Add patch for GNOME bug #417999 (avoid deprecated GTK+ symbols).
  - Remove evolution-data-server-1.0.2-workaround-cal-backend-leak.patch.
  - Remove evolution-data-server-1.2.2-fix_open_calendar_declaration.patch.
  - Remove evolution-data-server-1.3.8-fix-implicit-function-declarations.


author: Matthew Barnes <mbarnes@redhat.com> - 1.9.92-3.fc7
changelog:
  - Add patch for GNOME bug #415891 (introduce EFlag API).
  - Add patch for GNOME bug #376991 (refactor password handling).


author: Matthew Barnes <mbarnes@redhat.com> - 1.9.92-1.fc7
changelog:
  - Update to 1.9.92
  - Remove patch for GNOME bug #356177 (fixed upstream).
  - Add minimum version to intltool requirement (current >= 0.35.5).


author: Matthew Barnes <mbarnes@redhat.com> - 1.9.91-1.fc7
changelog:
  - Update to 1.9.91
  - Add flag to disable deprecated Pango symbols.
  - Remove patch for GNOME bug #359979 (fixed upstream).


author: Matthew Barnes <mbarnes@redhat.com> - 1.9.5-4.fc7
changelog:
  - Revise evolution-data-server-1.8.0-no-gnome-common.patch so that we no
    longer have to run autoconf before building.


author: Matthew Barnes <mbarnes@redhat.com> - 1.9.5-1.fc7
changelog:
  - Update to 1.9.5
  - Remove patch for GNOME bug #362638 (fixed upstream).
  - Remove patch for GNOME bug #387638 (fixed upstream).


author: Matthew Barnes <mbarnes@redhat.com> - 1.9.4-1.fc7
changelog:
  - Update to 1.9.4
  - Add patch for GNOME bug #373117 (storing color settings).
  - Add patch for GNOME bug #387638 (implicit function declaration).


author: Matthew Barnes <mbarnes@redhat.com> - 1.9.2-1.fc7
changelog:
  - Update to 1.9.2
  - Remove patch for Gnome.org bugs #369168, #369259, and #369261
    (fixed upstream).


author: Matthew Barnes <mbarnes@redhat.com> - 1.9.1-4.fc7
changelog:
  - Add patch for Gnome.org bug #369168, #369259, and #369261
    (misc camel bugs reported by Hans Petter Jansson).


author: Matthew Barnes <mbarnes@redhat.com> - 1.9.1-2.fc7
changelog:
  - Update to 1.9.1
  - Add patch for Gnome.org bug #356177 (deprecate EMutex).
  - Add patch for Gnome.org bug #363695 (deprecate EMemPool, EStrv, EPoolv).
  - Remove Jerusalem.ics timezone file (fixed upstream).
  - Remove patch for RH bug #198935 (fixed upstream).


author: Matthew Barnes <mbarnes@redhat.com> - 1.8.1-1.fc7
changelog:
  - Update to 1.8.1
  - Use stricter build settings.
  - Add patch for Gnome.org bug #360240 ("unused variable" warnings).
  - Add patch for Gnome.org bug #360619 ("incompatible pointer type" warnings).
  - Add patch for Gnome.org bug #362638 (deprecate EThread).
  - Remove patch for RH bug #198935 (fixed upstream).
  - Remove patch for RH bug #205187 (fixed upstream).
  - Remove patch for Gnome.org bug #353478 (fixed upstream).
  - Remove patch for Gnome.org bug #356828 (fixed upstream).
  - Remove patch for Gnome.org bug #357666 (fixed upstream).


author: Matthew Barnes <mbarnes@redhat.com> - 1.8.0-1.fc6
changelog:
  - Update to 1.8.0
  - Remove evolution-data-server-1.5.4-make_imap4_optional.patch (fixed upstream)
    and save remaining hunk as evolution-data-server-1.8.0-no-gnome-common.patch.
  - Remove patch for RH bug #202329 (fixed upstream).
  - Remove patch for Gnome.org bug #349847 (fixed upstream).


author: Matthew Barnes <mbarnes@redhat.com> - 1.7.4-5
changelog:
  - Remove patches for Gnome.org bug #309079 (rejected upstream).
  - One of these patches was causing RH bug #167157.


author: Matthew Barnes <mbarnes@redhat.com> - 1.7.4-3
changelog:
  - Revert to version 1.7.4 to prevent API/ABI breakage.
  - Add back patch to make --with-libdb configure option work.


author: Matthew Barnes <mbarnes@redhat.com> - 1.7.90.1-1
changelog:
  - Update to 1.7.90.1
  - Add patch for Gnome.org bug #348725.
  - Remove patch to make --with-db configure option work (fixed upstream).


author: Matthew Barnes <mbarnes@redhat.com> - 1.7.4-2
changelog:
  - Dynamically link to BDB.
  - Add patch to make --with-db configure option work.
  - Add Requires for db4 and BuildRequires for db4-devel.
  - Clean up spec file, renumber patches.


author: Matthew Barnes <mbarnes@redhat.com> - 1.7.1-2
changelog:
  - Add temporary patch evolution-data-server-1.7.1-nss_auto_detect.patch
    to help `configure' detect the SSL modules (closes #191567).


author: Matthew Barnes <mbarnes@redhat.com> - 1.7.1-1
changelog:
  - Update to 1.7.1
  - Bump eds_base_version from 1.6 to 1.8.
  - Disable evolution-data-server-1.2.0-validatehelo.patch (accepted upstream).


author: David Malcolm <dmalcolm@redhat.com> - 1.5.4-4
changelog:
  - updated patch 300 to remove usage of GNOME_COMPILE_WARNINGS from configure.in
    (since gnome-common might not be available when we rerun the autotools)


author: David Malcolm <dmalcolm@redhat.com> - 1.5.4-3
changelog:
  - added patch to make the "imap4"/"IMAP4rev1" backend optional; disable it in 
    our packages; re-run automake since we have touched various Makefile.am 
    files; rerun intltoolize to avoid incompatibilities between tarball copy of
    intltool-merge.in and intltool.m4 in intltool package (@EXPANDED_LIBDIR@
    renamed to @INTLTOOL_LIBDIR@) (#167574)
  - explicitly list the camel providers and e-d-s extension files in the spec file


author: David Malcolm <dmalcolm@redhat.com> - 1.5.4-2
changelog:
  - added patch from David Woodhouse to validate reverse DNS domain before using 
    in SMTP greeting (patch 103, #151121)


author: David Malcolm <dmalcolm@redhat.com> - 1.5.3-2
changelog:
  - Update specfile and patch 5 (evolution-data-server-1.3.5-nspr_fix.patch) to
    use nss rather than mozilla-nss throughout


author: David Malcolm <dmalcolm@redhat.com> - 1.4.1.1-2
changelog:
  - Updated license field to reflect change from GPL to LGPL
  - Remove all static libraries, not just those in /usr/lib; avoid listing libdir
    subdirectory so that we can be more explicit about the package payload (bug


author: David Malcolm <dmalcolm@redhat.com> - 1.4.1-2
changelog:
  - Updated patch 102 (fix-implicit-function-declarations) to include fix for 
    http calendar backend (thanks to Peter Robinson)


author: David Malcolm <dmalcolm@redhat.com> - 1.4.0-1
changelog:
  - 1.4.0
  - Removed evolution-data-server-1.3.8-fix-libical-vsnprintf.c.patch; a version
    of this is now upstream (was patch 103, added in 1.3.8-2)


author: David Malcolm <dmalcolm@redhat.com> - 1.3.8-5
changelog:
  - Add -Werror-implicit-function-declaration back to CFLAGS at the make stage, 
    after the configure, to spot 64-bit problems whilst avoiding breaking 
    configuration tests; expand patch 102 to avoid this breaking libdb's CFLAGS


author: David Malcolm <dmalcolm@redhat.com> - 1.3.8-4
changelog:
  - Remove -Werror-implicit-function-declaration from CFLAGS; this broke the
    configuration test for fast mutexes in the internal copy of libdb, and hence
    broke access to local addressbooks (#166742)
  - Introduce static_ldap macro; use it to link to static evolution-openldap 
    library, containing NTLM support for LDAP binds (needed by Exchange support)


author: David Malcolm <dmalcolm@redhat.com> - 1.3.8-1
changelog:
  - 1.3.8
  - Add -Werror-implicit-function-declaration to CFLAGS, to avoid 64-bit issues
    and add patch to fix these where they occur (patch 102)


author: David Malcolm <dmalcolm@redhat.com> - 1.3.5-2
changelog:
  - Added patch to use nspr rather than mozilla-nspr when doing pkg-config tests
    (Patch5: evolution-data-server-1.3.5-nspr_fix.patch)


author: David Malcolm <dmalcolm@redhat.com> - 1.3.5-1
changelog:
  - 1.3.5
  - Split eds_major (was 1.2) into eds_base_version (1.4) and eds_api_version
    (1.2) to correspond to BASE_VERSION and API_VERSION in configure.in; updated
    rest of specfile accordingly.
  - Removed upstreamed patch: 
    evolution-data-server-1.2.0-cope-with-a-macro-called-read.patch


author: David Malcolm <dmalcolm@redhat.com> - 1.2.2-3
changelog:
  - bumped libsoup requirement to 2.2.3; removed mozilla_build_version, using
    pkg-config instead for locating NSPRS and NSS headers/libraries (#158085)


author: David Malcolm <dmalcolm@redhat.com> - 1.2.0-3
changelog:
  - Removed explicit run-time spec-file requirement on mozilla.
    The Mozilla NSS API/ABI stabilised by version 1.7.3
    The libraries are always located in the libdir
    However, the headers are in /usr/include/mozilla-%{mozilla_build_version}
    and so they move each time the mozilla version changes.
    So we no longer have an explicit mozilla run-time requirement in the specfile; 
    a requirement on the appropriate NSS and NSPR .so files is automagically generated on build.
    We have an explicit, exact build-time version, so that we can find the headers (without
    invoking an RPM query from the spec file; to do so is considered bad practice)
  - Introduced mozilla_build_version, to replace mozilla_version
  - Set mozilla_build_version to 1.7.6 to reflect current state of tree


author: David Malcolm <dmalcolm@redhat.com> - 1.1.6-4
changelog:
  - added macro use_gtk_doc; added missing BuildRequires on gtk-doc; enabled gtk-doc generation on all platforms (had been disabled on ia64)


author: David Malcolm <dmalcolm@redhat.com> - 1.1.4.1-1
changelog:
  - Update from 1.0.3 to 1.1.4.1
  - Updated eds_major from 1.0 to 1.2; fixed translation search path.
  - Removed 64-bit patch for calendar backend hash table; upstream now stores pointers to ECalBackendFactory, rather than GType
  - Removed calendar optimisation patch for part of part of bug #141283 as this is now in the upstream tarball
  - Added /usr/lib/evolution-data-server-%{eds_major} to cover the extensions, plus the camel code now in e-d-s, rather than evolution
  - Added /usr/share/pixmaps/evolution-data-server-%{eds_major} to cover the category pixmaps
  - Camel code from evolution is now in evolution-data-server:
    - Added camel-index-control and camel-lock-helper to packaged files
    - Added mozilla dependency code from the evolution package
    - Ditto for LDAP
    - Ditto for krb5
    - Ditto for NNTP support handling
    - Ditto for --enable-file-locking and --enable-dot-locking
  - Added requirements on libbonobo, libgnomeui, gnome-vfs2, GConf2, libglade2
  - Updated libsoup requirement from 2.2.1 to 2.2.2
  - Enabled gtk-doc


author: David Malcolm <dmalcolm@redhat.com> - 1.0.3-2
changelog:
  - fixed packaging of translation files to reflect upstream change to GETTEXT_PACKAGE being evolution-data-server-1.0 rather than -1.5


author: David Malcolm <dmalcolm@redhat.com> - 1.0.3-1
changelog:
  - update from upstream 1.0.2 to 1.0.3:
    * Address Book
      - prevent e_book_commit_contact from crashing on multiple calls (Diego Gonzalez)
      - prevent file backend from crashing if uid of vcard is NULL (Diego Gonzalez)

    * Calendar
              - fix libical build for automake 1.9 (Rodney)
      - fix putenv usage for portability (Julio M. Merino Vidal)

    * Updated Translations:
      - sv (Christian Rose)

  - Removed patches to fix build on x86_64 and calendar optimisation for XB59004 as these are in the upstream tarball


author: David Malcolm <dmalcolm@redhat.com> - 1.0.2-6
changelog:
  - Amortize writes to a local cache of a webcal calendar, fixing further aspect of #141283 (upstream bugzilla #70267), as posted to mailing list here:
  http://lists.ximian.com/archives/public/evolution-patches/2004-December/008338.html
  (The groupwise part of that patch did not cleanly apply, so I removed it).


author: David Malcolm <dmalcolm@redhat.com> - 1.0.2-5
changelog:
  - Added fix for #141283 (upstream bugzilla XB 59904), a backported calendar 
  optimisation patch posted to upstream development mailing list here:
  http://lists.ximian.com/archives/public/evolution-patches/2004-November/008139.html


author: David Malcolm <dmalcolm@redhat.com> - 1.0.2-4
changelog:
  - Added patch to fix usage of GINT_TO_POINTER/GPOINTER_TO_INT for calendar backend GType hash table, breaking on ia64  (#136914)


author: David Malcolm <dmalcolm@redhat.com> - 1.0.2-3
changelog:
  - added workaround for a backend leak that causes the "contacts" calendar 
  backend to hold open an EBook for the local contacts (filed upstream at:
  http://bugzilla.ximian.com/show_bug.cgi?id=68533 ); this was causing e-d-s to
  never lose its last addressbook, and hence never quit.  We workaround this by
  detecting this condition and exiting when it occurs, fixing bug #134851 and #134849.


author: David Malcolm <dmalcolm@redhat.com> - 1.0.2-2
changelog:
  - added patch to fix build on x86_64 (had multiple definitions of mutex code in libdb/dbinc.mutex.h)


author: David Malcolm <dmalcolm@redhat.com> - 1.0.1-1
changelog:
  - update from 1.0.0 to 1.0.1
  - removed patch that fixed warnings in calendar code (now in upstream tarball)


author: David Malcolm <dmalcolm@redhat.com> - 1.0.0-2
changelog:
  - fixed various warnings in the calendar code 
    (filed upstream here: http://bugzilla.ximian.com/show_bug.cgi?id=66383)


author: David Malcolm <dmalcolm@redhat.com> - 0.0.99-1
changelog:
  - update from 0.0.98 to 0.0.99
  - increased libsoup requirement to 2.2.0 to match configuration script


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20-3
changelog:
  - Speedup DFA for long patterns and fixed begline/endline matching
    Resolves: rhbz#1413029
  - Added support for GREP_LEGACY_EGREP_FGREP_PS environmental variable which
    controls how egrep, fgrep show in ps output
    Resolves: rhbz#1297441


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20-2
changelog:
  - Fixed invalid UTF-8 byte sequence error in PCRE mode
    (by pcre-backported-fixes patch)
    Resolves: rhbz#1217080
  - Fixed buffer overrun for grep -F
    Resolves: CVE-2015-1345
  - Fixed \w and \W behaviour in multibyte locales
    Resolves: rhbz#1159012
  - Documented --fixed-regexp option
    Resolves: rhbz#1103259
  - Updated pcre buildrequires to require pcre-devel >= 7.8-7
    Related: rhbz#1217080


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.14-4
changelog:
  - Added group-separator, no-group-separator options decription
  - Aligned output of built-in help
  - Defuzzified gnulib-tests-rm-f patch


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.13-1
changelog:
  - New version
    Resolves: rhbz#837749
  - Fixed -i option
    Resolves: rhbz#828844
  - Added virtual provide and FPC ticket link for bundled gnulib
    Resolves: rhbz#821759


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.8-4
changelog:
  - dfa: don't overrun a malloc'd buffer for certain regexps
    (patch dfa-buffer-overrun-fix)
    Resolves: rhbz#713328


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.7-1
changelog:
  - New version: grep-2.7
  - Removed patches (already in upstream): dfa-optimize-period,
    glibc-matcher-fallback, mmap-option-fix, dfa-convert-to-wide-char,
    dfa-speedup-digit-xdigit


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.6.3-4
changelog:
  - Colors can be globally disabled via /etc/GREP_COLORS (#602867)
  - Fixed indentation in spec
  - Fixed defattr in spec


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.6.3-3
changelog:
  - Added auto-color profile.d scripts (thanks to Ville Skyttä #600832)
  - Removed description macro from changelog


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.6.3-2
changelog:
  - Added dfa-optimize-period patch (speedup for . patterns in UTF-8)
  - Added glibc-matcher-fallback patch (speedup for [a-z] patterns in UTF-8)
  - Added mmap-option-fix patch
  - Added dfa-convert-to-wide-char patch (speedup for -m and remove quadratic
    complexity when going to glibc)
  - Added dfa-speedup-digit-xdigit patch (speedup for [[:digit:]] [:xdigit:]])


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.6-1
changelog:
  - New version: grep-2.6
  - Added sigsegv patch (after release patch from upstream)
  - Dropped obsoleted patches: fedora-tests, pcrewrap, case, egf-speedup,
    bz460641, utf8, dfa-optional, w


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.5.4-1
changelog:
  - New version: grep-2.5.4
  - Fixed typos in description
  - Updated utf-8 patch
  - Added dfa-optional patch (#538423)


author: Lubomir Rintel <lkundrak@v3.sk> 2.5.3-1
changelog:
  - Update to latest upstream version
  - Drop upstreamed patches
  - Add a couple of regression tests
  - Temporarily disable tests
  - Minor cleanup


author: Lubomir Rintel <lkundrak@v3.sk> 2.5.1a-61
changelog:
  - Fix pcre-mode (-P) line wrapping (bug #324781)
  - Match the version with upstream
  - Recode AUTHORS to utf8


author: Stepan Kasal <skasal@redhat.com> - 2.5.1-58
changelog:
  - Adhere to packaging guidelines.
  - Resolves: #225857
  - Use CPPFLAGS= argument to configure to add an -I option.
  - Do not set LDFLAGS=-s for "make install".


author: Tim Waugh <twaugh@redhat.com> 2.5.1-47
changelog:
  - Run 'make check'.
  - Fixed -w handling for EGexecute.  Now 'make check' passes.
  - Cache MB_CUR_MAX value in egf-speedup patch.
  - Fixed variable shadowing in egf-speedup patch.
  - Removed redundant (and incorrect) code in prline.


author: Tim Waugh <twaugh@redhat.com> 2.5.1-45
changelog:
  - More tests (Jakub Jelinek).
  - Jakub Jelinek's much improved -Fi algorithm.
  - Removed bogus part of grep-2.5.1-fgrep patch.


author: Tim Waugh <twaugh@redhat.com> 2.5.1-42
changelog:
  - Further UTF-8 processing avoided since a '\n' byte is always an
    end-of-line character in that encoding.


author: Tim Waugh <twaugh@redhat.com> 2.5.1-38
changelog:
  - Applied patch from Karsten Hopp to fix background colour problems with
    --color output (bug #138913).


author: Tim Waugh <twaugh@redhat.com> 2.5.1-36
changelog:
  - Automatically disable DFA when processing multibyte input.  GREP_USE_DFA
    environment variable overrides.


author: Tim Waugh <twaugh@redhat.com> 2.5.1-35
changelog:
  - Fixes to egf-speedup patch: now it does not change any functionality,
    as intended.
  - GREP_NO_DFA now turns off the DFA engine, for performance testing.


author: Tim Waugh <twaugh@redhat.com> 2.5.1-32
changelog:
  - Remove mb-caching hack.
  - Better multibyte handling in EGexecute() and Fexecute().
  - Don't need regex.c changes in grep-2.5-i18n.patch.


author: Tim Waugh <twaugh@redhat.com> 2.5.1-31
changelog:
  - Make 'grep -F' avoid UTF-8 processing if the pattern contains no
    multibyte characters (bug #133932).


author: Tim Waugh <twaugh@redhat.com> 2.5.1-27
changelog:
  - Fix dfa multibyte character class matching when -i is used (bug #123363).
  - Use bracket patch before i18n patch to make it clear that the bug exists
    upstream.


author: Tim Waugh <twaugh@redhat.com> 2.5.1-24
changelog:
  - Work around glibc bug #112869 (segfault in re_compile_pattern).
  - Avoid patching Makefile.am, to avoid automake/autoconf weirdness.


author: Bernhard Rosenkraenzer <bero@redhat.com> 2.4.2-7
changelog:
  - Fix up the i18n patch - it used to break "grep '[]a]'" (#49003)
  - revert to 2.4.2 (latest official release) for now


author: Bernhard Rosenkraenzer <bero@redhat.com> 2.5e-2
changelog:
  - Fix up the --color option to behave like the one from ls (--color=auto)
    Sooner or later, some people will alias grep="grep --color" and wonder why
    their scripts break.
  - Update docs accordingly
  - Get rid of the annoying blinking in grep --color


author: Phil Sutter <psutter@redhat.com> - 1.4.21-31
changelog:
  - Fix iptables-restore with empty comment in rule (RHBZ#1668475)
  - Fix parsing and printing of -m ipvs --vproto option (RHBZ#1679726)
  - Fix for wrong location of devgroup definition file (RHBZ#1657075)
  - Fix for non-numeric devgroup name output (RHBZ#1657075)
  - Reject negative realm values (RHBZ#1657075)


author: Phil Sutter - 1.4.21-29
changelog:
  - Do not attempt to unload any modules when stopping the firewall (RHBZ#1520534)
  - Fix for covscan warnings (RHBZ#1525980)


author: Phil Sutter - 1.4.21-27
changelog:
  - libxt_tcpmss: Detect invalid ranges (RHBZ#1128510)
  - ip(6)tables-save/restore: Exit if invalid option was given (RHBZ#1465078)
  - ip(6)tables-save/restore: Require value to -W option (RHBZ#1465078)
  - ip(6)tables-save/restore: Don't accept -W without -w (RHBZ#1465078)
  - Ignore security table when setting policies (RHBZ#1494012)
  - Fix spec file changing SRPM content (RHBZ#1531290)


author: Phil Sutter - 1.4.21-25
changelog:
  - Fix for stopping iptables and ip6tables at the same time (RHBZ#1560012)
  - Propagate errors on service stop (RHBZ#1560012)


author: Phil Sutter - 1.4.21-20
changelog:
  - Prevent iptables.service and ip6tables.service from running in parallel
    (RHBZ#1486803)
  - Don't restart services upon upgrade (RHBZ#1380141)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-18
changelog:
  - Add support for --wait options to restore commands (RHBZ#1438597)
  - Do not set changed flag for rule check operations with module targets
    (RHBZ#1438597)
  - Add version option to restore commands (RHBZ#1438597)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-17
changelog:
  - Fixed init script not to fail on missing restorecon (RHBZ#1246380)
  - Adapted man page snipplet for TRACE to use proper logging backend names
    (RHBZ#1261238)
  - Warn about use of DROP in nat table (RHBZ#1298879)
  - Fixed modules unload in init script (RHBZ#1324102)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-16
changelog:
  - Fix important coverity findings: missing include for flock and use bash for
    init script (RHBZ#1264399)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-14
changelog:
  - Add cgroup support (RHBZ#1058660)
  - Add wait seonds support for commands (RHBZ#1156411)
  - Add dhcpv6-client in default IPv6 firewall rules (RHBZ#1169036)
  - Add message for init script error returns (RHBZ#1200415)
  - Use flock for wait option (RHBZ#1202435)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-9
changelog:
  - fixed missing system hang at shutdown if root device is network based
    (RHBZ#1007934)
  - Fixed iptables-save man page completely wrong (RHBZ#1054871)
  - Fixed missing reload action for iptables service (RHBZ#1066007)
  - Fixed regressions from RHEL-6 iptables services (RHBZ#1067670)


author: Jiri Popelka <jpopelka@redhat.com> - 1.4.21-3
changelog:
  - no need to support the pre-systemd things
  - use systemd macros (#850166)
  - remove scriptlets for migrating to a systemd unit from a SysV initscripts
  - ./configure -> %configure
  - spec clean up
  - fix self-obsoletion


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-2
changelog:
  - fixed system hang at shutdown if root device is network based (RHBZ#1007934)
    Thanks to Rodrigo A B Freire for the patch


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-1
changelog:
  - no connlabel.conf upstream anymore
  - new version 1.4.21
    - doc: clarify DEBUG usage macro
    - iptables: use autoconf to process .in man pages
    - extensions: libipt_ULOG: man page should mention NFLOG as replacement
    - extensions: libxt_connlabel: use libnetfilter_conntrack
    - Introduce a new revision for the set match with the counters support
    - libxt_CT: Add the "NOTRACK" alias
    - libip6t_mh: Correct command to list named mh types in manpage
    - extensions: libxt_DNAT, libxt_REDIRECT, libxt_NETMAP, libxt_SNAT, libxt_MASQUERADE, libxt_LOG: rename IPv4 manpage and tell about IPv6 support
    - extensions: libxt_LED: fix parsing of delay
    - ip{6}tables-restore: fix breakage due to new locking approach
    - libxt_recent: restore minimum value for --seconds
    - iptables-xml: fix parameter parsing (similar to 2165f38)
    - extensions: add copyright statements
    - xtables: improve get_modprobe handling
    - ip[6]tables: Add locking to prevent concurrent instances
    - iptables: Fix connlabel.conf install location
    - ip6tables: don't print out /128
    - libip6t_LOG: target output is different to libipt_LOG
    - build: additional include path required after UAPI changes
    - iptables: iptables-xml: Fix various parsing bugs
    - libxt_recent: restore reap functionality to recent module
    - build: fail in configure on missing dependency with --enable-bpf-compiler
    - extensions: libxt_NFQUEUE: add --queue-cpu-fanout parameter
    - extensions: libxt_set, libxt_SET: check the set family too
    - ip6tables: Use consistent exit code for EAGAIN
    - iptables: libxt_hashlimit.man: correct address
    - iptables: libxt_conntrack.man extraneous commas
    - iptables: libip(6)t_REJECT.man default icmp types
    - iptables: iptables-xm1.1 correct man section
    - iptables: libxt_recent.{c,man} dead URL
    - iptables: libxt_string.man add examples
    - extensions: libxt_LOG: use generic syslog reference in manpage
    - iptables: extensions/GNUMakefile.in use CPPFLAGS
    - iptables: correctly reference generated file
    - ip[6]tables: fix incorrect alignment in commands_v_options
    - build: add software version to manpage first line at configure stage
    - extensions: libxt_cluster: add note on arptables-jf
    - utils: nfsynproxy: fix error while compiling the BPF filter
    - extensions: add SYNPROXY extension
    - utils: add nfsynproxy tool
    - iptables: state match incompatibilty across versions
    - libxtables: xtables_ipmask_to_numeric incorrect with non-CIDR masks
    - iptables: improve chain name validation
    - iptables: spurious error in load_extension
    - xtables: trivial spelling fix


author: Thomas Woerner <twoerner@redhat.com> 1.4.19.1-1
changelog:
  - new version 1.4.19.1
    - libxt_NFQUEUE: fix bypass option documentation
    - extensions: add connlabel match
    - extensions: add connlabel match
    - ip[6]tables: show --protocol instead of --proto in usage
    - libxt_recent: Fix missing space in manpage for --mask option
    - extensions: libxt_multiport: Update manpage to list valid protocols
    - utils: nfnl_osf: use the right nfnetlink lib
    - libip6t_NETMAP: Use xtables_ip6mask_to_cidr and get rid of libip6tc dependency
    - Revert "build: resolve link failure for ip6t_NETMAP"
    - libxt_osf: fix missing --ttl and --log in save output
    - libxt_osf: fix bad location for location in --genre
    - libip6t_SNPT: add manpage
    - libip6t_DNPT: add manpage
    - utils: updates .gitignore to include nfbpf_compile
    - extensions: libxt_bpf: clarify --bytecode argument
    - libxtables: fix parsing of dotted network mask format
    - build: bump version to 1.4.19
    - libxt_conntrack: fix state match alias state parsing
    - extensions: add libxt_bpf extension
    - utils: nfbpf_compile
    - doc: mention SNAT in INPUT chain since kernel 2.6.36
  - fixed changelog date weekdays where needed


author: Thomas Woerner <twoerner@redhat.com> 1.4.18-1
changelog:
  - new version 1.4.18 
    - lots of documentation changes
    - Introduce match/target aliases
    - Add the "state" alias to the "conntrack" match
    - iptables: remove unused leftover definitions
    - libxtables: add xtables_rule_matches_free
    - libxtables: add xtables_print_num
    - extensions: libip6t_DNPT: fix wording in DNPT target
    - extension: libip6t_DNAT: allow port DNAT without address
    - extensions: libip6t_DNAT: set IPv6 DNAT --to-destination
    - extensions: S/DNPT: add missing save function
  - changes of 1.4.17:
    - libxt_time: add support to ignore day transition
    - Convert the NAT targets to use the kernel supplied nf_nat.h header
    - extensions: add IPv6 MASQUERADE extension
    - extensions: add IPv6 SNAT extension
    - extensions: add IPv6 DNAT target
    - extensions: add IPv6 REDIRECT extension
    - extensions: add IPv6 NETMAP extension
    - extensions: add NPT extension
    - extensions: libxt_statistic: Fix save output


author: Ville Skyttä <ville.skytta@iki.fi> - 1.4.16.2-6
changelog:
  - Own unowned -services libexec dirs (#894464, Michael Scherer).
  - Fix -services unit file permissions (#732936, Michal Schmidt).


author: Thomas Woerner <twoerner@redhat.com> 1.4.16.2-4
changelog:
  - fixed missing services for update of pre F-18 installations (rhbz#867960)
    - provide and obsolete old main package in services sub package
    - provide and obsolete old ipv6 sub package (pre F-17) in services sub package


author: Thomas Woerner <twoerner@redhat.com> 1.4.16.2-2
changelog:
  - new sub package services providing the systemd services (RHBZ#862922)
  - new sub package utils: provides nfnl_osf and the pf.os database
  - using %{_libexecdir}/iptables as script path for the original init scripts
  - added service iptables save funcitonality using the new way provided by 
    initscripts 9.37.1 (RHBZ#748134)
  - added virtual provide for libxtables.so.7


author: Thomas Woerner <twoerner@redhat.com> 1.4.16.2-1
changelog:
  - new version 1.4.16.2
    - build: support for automake-1.12
    - build: separate AC variable replacements from xtables.h
    - build: have `make clean` remove dep files too
    - doc: grammatical updates to libxt_SET
    - doc: clean up interpunction in state list for xt_conntrack
    - doc: deduplicate extension descriptions into a new manpage
    - doc: trim "state" manpage and reference conntrack instead
    - doc: have NOTRACK manpage point to CT instead
    - doc: mention iptables-apply in the SEE ALSO sections
    - extensions: libxt_addrtype: fix type in help message
    - include: add missing linux/netfilter_ipv4/ip_queue.h
    - iptables: fix wrong error messages
    - iptables: support for match aliases
    - iptables: support for target aliases
    - iptables-restore: warn about -t in rule lines
    - ip[6]tables-restore: cleanup to reduce one level of indentation
    - libip6t_frag: match any frag id by default
    - libxtables: consolidate preference logic
    - libxt_devgroup: consolidate devgroup specification parsing
    - libxt_devgroup: guard against negative numbers
    - libxt_LED: guard against negative numbers
    - libxt_NOTRACK: replace as an alias to CT --notrack
    - libxt_state: replace as an alias to xt_conntrack
    - libxt_tcp: print space before, not after "flags:"
    - libxt_u32: do bounds checking for @'s operands
    - libxt_*limit: avoid division by zero
    - Merge branch 'master' of git://git.inai.de/iptables
    - Merge remote-tracking branch 'nf/stable'
    - New set match revision with --return-nomatch flag support
  - dropped fixrestore patch, upstream


author: Thomas Woerner <twoerner@redhat.com> 1.4.15-1
changelog:
  - new version 1.4.15
    - extensions: add HMARK target
    - iptables-restore: fix parameter parsing (shows up with gcc-4.7)
    - iptables-restore: move code to add_param_to_argv, cleanup (fix gcc-4.7)
    - libxtables: add xtables_ip[6]mask_to_cidr
    - libxt_devgroup: add man page snippet
    - libxt_hashlimit: add support for byte-based operation
    - libxt_recent: add --mask netmask
    - libxt_recent: remove unused variable
    - libxt_HMARK: correct a number of errors introduced by Pablo's rework
    - libxt_HMARK: fix ct case example
    - libxt_HMARK: fix output of iptables -L
    - Revert "iptables-restore: move code to add_param_to_argv, cleanup (fix gcc-4.7)"


author: Thomas Woerner <twoerner@redhat.com> 1.4.14-1
changelog:
  - new version 1.4.14
    - extensions: add IPv6 capable ECN match extension
    - extensions: add nfacct match
    - extensions: add rpfilter module
    - extensions: libxt_rateest: output all options in save hook
    - iptables: missing free() in function cache_add_entry()
    - iptables: missing free() in function delete_entry()
    - libiptc: fix retry path in TC_INIT
    - libiptc: Returns the position the entry was inserted
    - libipt_ULOG: fix --ulog-cprange
    - libxt_CT: add --timeout option
    - ip(6)tables-restore: make sure argv is NULL terminated
    - Revert "libiptc: Returns the position the entry was inserted"
    - src: mark newly opened fds as FD_CLOEXEC (close on exec)
    - tests: add rateest match rules
  - dropped patch5 (cloexec), merged upstream


author: Thomas Woerner <twoerner@redhat.com> 1.4.12.2-1
changelog:
  - new version 1.4.12.2 with new pkgconfig/libip4tc.pc and pkgconfig/libip6tc.pc
    - build: make check stage not fail when building statically
    - build: restore build order of modules
    - build: scan for unreferenced symbols
    - build: sort file list before build
    - doc: clarification on the meaning of -p 0
    - doc: document iptables-restore's -T option
    - doc: fix undesired newline in ip6tables-restore(8)
    - ip6tables-restore: implement missing -T option
    - iptables: move kernel version find routing into libxtables
    - libiptc: provide separate pkgconfig files
    - libipt_SAME: set PROTO_RANDOM on all ranges
    - libxtables: Fix file descriptor leak in xtables_lmap_init on error
    - libxt_connbytes: fix handling of --connbytes FROM
    - libxt_CONNSECMARK: fix spacing in output
    - libxt_conntrack: improve error message on parsing violation
    - libxt_NFQUEUE: fix --queue-bypass ipt-save output
    - libxt_RATEEST: link with -lm
    - libxt_statistic: link with -lm
    - Merge branch 'stable'
    - Merge branch 'stable' of git://dev.medozas.de/iptables
    - nfnl_osf: add missing libnfnetlink_CFLAGS to compile process
    - xtoptions: fill in fallback value for nvals
    - xtoptions: simplify xtables_parse_interface


author: Thomas Woerner <twoerner@redhat.com> 1.4.12.1-1
changelog:
  - new version 1.4.12.1 with new pkgconfig/libipq.pc
    - build: abort autogen on subcommand failure
    - build: strengthen check for overlong lladdr components
    - build: workaround broken linux-headers on RHEL-5
    - doc: clarify libxt_connlimit defaults
    - doc: fix typo in libxt_TRACE
    - extensions: use multi-target registration
    - libip6t_dst: restore setting IP6T_OPTS_LEN flag
    - libip6t_frag: restore inversion support
    - libip6t_hbh: restore setting IP6T_OPTS_LEN flag
    - libipq: add pkgconfig file
    - libipt_ttl: document that negation is available
    - libxt_conntrack: fix --ctproto 0 output
    - libxt_conntrack: remove one misleading comment
    - libxt_dccp: fix deprecated intrapositional ordering of !
    - libxt_dccp: fix random output of ! on --dccp-option
    - libxt_dccp: provide man pages options in short help too
    - libxt_dccp: restore missing XTOPT_INVERT tags for options
    - libxt_dccp: spell out option name on save
    - libxt_dscp: restore inversion support
    - libxt_hashlimit: default htable-expire must be in milliseconds
    - libxt_hashlimit: observe new default gc-expire time when saving
    - libxt_hashlimit: remove inversion from hashlimit rev 0
    - libxt_owner: restore inversion support
    - libxt_physdev: restore inversion support
    - libxt_policy: remove superfluous inversion
    - libxt_set: put differing variable names in directly
    - libxt_set: update man page about kernel support on the feature
    - libxt_string: define _GNU_SOURCE for strnlen
    - libxt_string: escape the escaping char too
    - libxt_string: fix space around arguments
    - libxt_string: replace hex codes by char equivalents
    - libxt_string: simplify hex output routine
    - libxt_tcp: always print the mask parts
    - libxt_TCPMSS: restore build with IPv6-less libcs
    - libxt_TOS: update linux kernel version list for backported fix
    - libxt_u32: fix missing allowance for inversion
    - src: remove unused IPTABLES_MULTI define
    - tests: add negation tests for libxt_statistic
    - xtoptions: flag use of XTOPT_POINTER without XTOPT_PUT
  - removed include/linux/types.h before build to be able to compile


author: Thomas Woerner <twoerner@redhat.com> 1.4.12-1.1
changelog:
  - added temporary provides for libxtables.so.6 to be able to rebuild iproute,
    which is part of the standard build environment


author: Thomas Woerner <twoerner@redhat.com> 1.4.12-1
changelog:
  - new version 1.4.12 with support of all new features of kernel 3.0
    - build: attempt to fix building under Linux 2.4
    - build: bump soversion for recent data structure change
    - build: install modules in arch-dependent location
    - doc: fix group range in libxt_NFLOG's man
    - doc: fix version string in ip6tables.8
    - doc: include matches/targets in manpage again
    - doc: mention multiple verbosity flags
    - doc: the -m option cannot be inverted
    - extensions: support for per-extension instance global variable space
    - iptables-apply: select default rule file depending on call name
    - iptables: consolidate target/match init call
    - iptables: Coverity: DEADCODE
    - iptables: Coverity: NEGATIVE_RETURNS
    - iptables: Coverity: RESOURCE_LEAK
    - iptables: Coverity: REVERSE_INULL
    - iptables: Coverity: VARARGS
    - iptables: restore negation for -f
    - libip6t_HL: fix option names from ttl -> hl
    - libipt_LOG: fix ignoring all but last flags
    - libxtables: ignore whitespace in the multiaddress argument parser
    - libxtables: properly reject empty hostnames
    - libxtables: set clone's initial data to NULL
    - libxt_conntrack: move more data into the xt_option_entry
    - libxt_conntrack: restore network-byte order for v1,v2
    - libxt_hashlimit: use a more obvious expiry value by default
    - libxt_rateest: abolish global variables
    - libxt_RATEEST: abolish global variables
    - libxt_RATEEST: fix userspacesize field
    - libxt_RATEEST: use guided option parser
    - libxt_state: fix regression about inversion of main option
    - option: remove last traces of intrapositional negation
  - complete changelog:
    http://www.netfilter.org/projects/iptables/files/changes-iptables-1.4.12.txt


author: Thomas Woerner <twoerner@redhat.com> 1.4.11.1-3
changelog:
  - added support for native systemd file (rhbz#694738)
    - new iptables.service file
    - additional requires
    - moved sysv init scripts to /usr/libexec
    - added new post, preun and postun scripts and triggers


author: Thomas Woerner <twoerner@redhat.com> 1.4.11.1-1.1
changelog:
  -  added temporary provides for libxtables.so.5 to be able to rebuild iproute,
     which is part of the standard build environment


author: Thomas Woerner <twoerner@redhat.com> 1.4.11-1
changelog:
  - new version 1.4.11 with all new features of 2.6.37-39 (not usable)
    - lots of changes and bugfixes for base and extensions
    - complete changelog:
      http://www.netfilter.org/projects/iptables/files/changes-iptables-1.4.11.txt


author: Thomas Woerner <twoerner@redhat.com> 1.4.10-1
changelog:
  - new version 1.4.10 with all new features of 2.6.36
    - all: consistent syntax use in struct option
    - build: fix static linking
    - doc: let man(1) autoalign the text in xt_cpu
    - doc: remove extra empty line from xt_cpu
    - doc: minimal spelling updates to xt_cpu
    - doc: consistent use of markup
    - extensions: libxt_quota: don't ignore the quota value on deletion
    - extensions: REDIRECT: add random help
    - extensions: add xt_cpu match
    - extensions: add idletimer xt target extension
    - extensions: libxt_IDLETIMER: use xtables_param_act when checking options
    - extensions: libxt_CHECKSUM extension
    - extensions: libipt_LOG/libip6t_LOG: support macdecode option
    - extensions: fix compilation of the new CHECKSUM target
    - extensions: libxt_ipvs: user-space lib for netfilter matcher xt_ipvs
    - iptables-xml: resolve compiler warnings
    - iptables: limit chain name length to be consistent with targets
    - libiptc: add Libs.private to pkgconfig files
    - libiptc: build with -Wl,--no-as-needed
    - xtables: remove unnecessary cast
  - dropped xt_CHECKSUM, added upstream


author: Thomas Woerner <twoerner@redhat.com> 1.4.9-1
changelog:
  - new version 1.4.9 with all new features of 2.6.35
    - doc: xt_hashlimit: fix a typo
    - doc: xt_LED: nroff formatting requirements
    - doc: xt_string: correct copy-and-pasting in manpage
    - extensions: add the LED target
    - extensions: libxt_quota.c: Support option negation
    - extensions: libxt_rateest: fix bps options for iptables-save
    - extensions: libxt_rateest: fix typo in the man page
    - extensions: REDIRECT: add random help
    - includes: sync header files from Linux 2.6.35-rc1
    - libxt_conntrack: do print netmask
    - libxt_hashlimit: always print burst value
    - libxt_set: new revision added
    - utils: add missing include flags to Makefile
    - xtables: another try at chain name length checking
    - xtables: remove xtables_set_revision function
    - xt_quota: also document negation
    - xt_sctp: Trace DATA chunk that supports SACK-IMMEDIATELY extension
    - xt_sctp: support FORWARD_TSN chunk type


author: Thomas Woerner <twoerner@redhat.com> 1.4.8-1
changelog:
  - new version 1.4.8 all new features of 2.6.34 (rhbz#)
    - extensions: REDIRECT: fix --to-ports parser
    - iptables: add noreturn attribute to exit_tryhelp()
    - extensions: MASQUERADE: fix --to-ports parser
    - libxt_comment: avoid use of IPv4-specific examples
    - libxt_CT: add a manpage
    - iptables: correctly check for too-long chain/target/match names
    - doc: libxt_MARK: no longer restricted to mangle table
    - doc: remove claim that TCPMSS is limited to mangle
    - libxt_recent: add a missing space in output
    - doc: add manpage for libxt_osf
    - libxt_osf: import nfnl_osf program
    - extensions: add support for xt_TEE
    - CT: fix --ctevents parsing
    - extensions: add CT extension
    - libxt_CT: print conntrack zone in ->print/->save
    - xtables: fix compilation when debugging is enabled
    - libxt_conntrack: document --ctstate UNTRACKED
    - iprange: fix xt_iprange v0 parsing


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-2
changelog:
  - added default values for IPTABLES_STATUS_VERBOSE and
    IPTABLES_STATUS_LINENUMBERS in init script
  - added missing lsb keywords Required-Start and Required-Stop to init script


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-1
changelog:
  - new version 1.4.7 with support for all new features of 2.6.33 (rhbz#570767)
    - libip4tc: Add static qualifier to dump_entry()
    - libipq: build as shared library
    - recent: reorder cases in code (cosmetic cleanup)
    - several man page and documentation fixes
    - policy: fix error message showing wrong option
    - includes: header updates
    - Lift restrictions on interface names
  - fixed license and moved iptables-xml into base package according to review


author: Thomas Woerner <twoerner@redhat.com> 1.4.6-2
changelog:
  - moved libip*tc and libxtables libs to /lib[64], added symlinks for .so libs
    to /usr/lib[64] for compatibility (rhbz#558796)


author: Thomas Woerner <twoerner@redhat.com> 1.4.6-1
changelog:
  - new version 1.4.6 with support for all new features of 2.6.32
    - several man page fixes
    - Support for nommu arches
    - realm: remove static initializations
    - libiptc: remove unused functions
    - libiptc: avoid strict-aliasing warnings
    - iprange: do accept non-ranges for xt_iprange v1
    - iprange: warn on reverse range
    - iprange: roll address parsing into a loop
    - iprange: do accept non-ranges for xt_iprange v1 (log)
    - iprange: warn on reverse range (log)
    - libiptc: fix wrong maptype of base chain counters on restore
    - iptables: fix undersized deletion mask creation
    - style: reduce indent in xtables_check_inverse
    - libxtables: hand argv to xtables_check_inverse
    - iptables/extensions: make bundled options work again
    - CONNMARK: print mark rules with mask 0xffffffff as set instead of xset
    - iptables: take masks into consideration for replace command
    - doc: explain experienced --hitcount limit
    - doc: name resolution clarification
    - iptables: expose option to zero packet/byte counters for a specific rule
    - build: restore --disable-ipv6 functionality on system w/o v6 headers
    - MARK: print mark rules with mask 0xffffffff as --set-mark instead of --set-xmark
    - DNAT: fix incorrect check during parsing
    - extensions: add osf extension
    - conntrack: fix --expires parsing


author: Thomas Woerner <twoerner@redhat.com> 1.4.5-1
changelog:
  - new version 1.4.5 with support for all new features of 2.6.31
    - libxt_NFQUEUE: add new v1 version with queue-balance option
    - xt_conntrack: revision 2 for enlarged state_mask member
    - libxt_helper: fix invalid passed option to check_inverse
    - libiptc: split v4 and v6
    - extensions: collapse registration structures
    - iptables: allow for parse-less extensions
    - iptables: allow for help-less extensions
    - extensions: remove empty help and parse functions
    - xtables: add multi-registration functions
    - extensions: collapse data variables to use multi-reg calls
    - xtables: warn of missing version identifier in extensions
    - multi binary: allow subcommand via argv[1]
    - iptables: accept multiple IP address specifications for -s, -d
    - several build fixes
    - several man page fixes
  - fixed two leaked file descriptors on sockets (rhbz#521397)


author: Thomas Woerner <twoerner@redhat.com> 1.4.4-1
changelog:
  - new version 1.4.4 with support for all new features of 2.6.30
    - several man page fixes
    - iptables: replace open-coded sizeof by ARRAY_SIZE
    - libip6t_policy: remove redundant functions
    - policy: use direct xt_policy_info instead of ipt/ip6t
    - policy: merge ipv6 and ipv4 variant
    - extensions: add `cluster' match support
    - extensions: add const qualifiers in print/save functions
    - extensions: use NFPROTO_UNSPEC for .family field
    - extensions: remove redundant casts
    - iptables: close open file descriptors
    - fix segfault if incorrect protocol name is used
    - replace open-coded sizeof by ARRAY_SIZE
    - do not include v4-only modules in ip6tables manpage
    - use direct xt_policy_info instead of ipt/ip6t
    - xtables: fix segfault if incorrect protocol name is used
    - libxt_connlimit: initialize v6_mask
    - SNAT/DNAT: add support for persistent multi-range NAT mappings


author: Thomas Woerner <twoerner@redhat.com> 1.4.3.1-1
changelog:
  - new version 1.4.3.1
    - libiptc is now shared
    - supports all new features of the 2.6.29 kernel
  - dropped typo_latter patch


author: Thomas Woerner <twoerner@redhat.com> 1.4.2-3
changelog:
  - still more review fixes (rhbz#225906)
    - consistent macro usage
    - use sed instead of perl for rpath removal
    - use standard RPM CFLAGS, but also -fno-strict-aliasing (needed for libiptc*)


author: Thomas Woerner <twoerner@redhat.com> 1.4.2-1
changelog:
  - new version 1.4.2
  - removed TOS value mask patch (upstream)
  - more review fixes (rhbz#225906)
  - install all header files (rhbz#462207)
  - dropped nf_ext_init (rhbz#472548)


author: Thomas Woerner <twoerner@redhat.com> 1.4.1-1
changelog:
  - new version 1.4.1 with new build environment
  - additional ipv6 network mask patch from Jan Engelhardt
  - spec file cleanup
  - removed old patches


author: Tom "spot" Callaway <tcallawa@redhat.com> 1.4.0-5
changelog:
  - use normal kernel headers, not linux/compiler.h
  - change BuildRequires: kernel-devel to kernel-headers
  - We need to do this to be able to build for both sparcv9 and sparc64 
    (there is no kernel-devel.sparcv9)


author: Thomas Woerner <twoerner@redhat.com> 1.4.0-3
changelog:
  - use the kernel headers from the build tree for iptables for now to be able to 
    compile this package, but this makes the package more kernel dependant
  - use s6_addr32 instead of in6_u.u6_addr32


author: Thomas Woerner <twoerner@redhat.com> 1.4.0-1
changelog:
  - new version 1.4.0
  - fixed condrestart (rhbz#428148)
  - report the module in rmmod_r if there is an error
  - use nf_ext_init instead of my_init for extension constructors


author: Thomas Woerner <twoerner@redhat.com> 1.3.8-6
changelog:
  - fixed leaked file descriptor before fork/exec (rhbz#312191)
  - blacklisting is not working, use "install X /bin/(true|false)" test instead
  - return private exit code 150 for disabled ipv6 support
  - use script name for output messages


author: Thomas Woerner <twoerner@redhat.com> 1.3.8-5
changelog:
  - fixed error code for stopping a already stopped firewall (rhbz#321751)
  - moved blacklist test into start


author: Thomas Woerner <twoerner@redhat.com> 1.3.8-4.1
changelog:
  - do not start ip6tables if ipv6 is blacklisted (rhbz#236888)
  - use simpler fix for (rhbz#295611)
    Thanks to Linus Torvalds for the patch.


author: Thomas Woerner <twoerner@redhat.com> 1.3.8-4
changelog:
  - fixed IPv6 reject type (rhbz#295181)
  - fixed init script: start, stop and status
  - support netfilter compiled into kernel in init script (rhbz#295611)
  - dropped inversion for limit modules from man pages (rhbz#220780)
  - fixed typo in ip6tables man page (rhbz#236185)


author: Thomas Woerner <twoerner@redhat.com> 1.3.8-3
changelog:
  - do not depend on local_fs in lsb header - this delayes start after network
  - fixed exit code for initscript usage


author: Thomas Woerner <twoerner@redhat.com> 1.3.8-2
changelog:
  - fixed initscript for LSB conformance (rhbz#246953, rhbz#242459)
  - provide iptc interface again, but unsupported (rhbz#216733)
  - compile all extension, which are supported by the kernel-headers package
  - review fixes (rhbz#225906)


author: Thomas Woerner <twoerner@redhat.com> 1.3.7-1
changelog:
  - new verison 1.3.7
  - iptc is not a public interface and therefore not installed anymore
  - dropped upstream secmark patch


author: Thomas Woerner <twoerner@redhat.com> 1.3.4-2
changelog:
  - fix for plugin problem: link with "gcc -shared" instead of "ld -shared" and 
    replace "_init" with "__attribute((constructor)) my_init"


author: Thomas Woerner <twoerner@redhat.com> 1.3.4-1
changelog:
  - new version 1.3.4
  - dropped free_opts patch (upstream fixed)
  - made libipq PIC (#158623)
  - additional configuration options for iptables startup script (#172929)
    Thanks to Jan Gruenwald for the patch
  - spec file cleanup (dropped linux_header define and usage)


author: Thomas Woerner <twoerner@redhat.com> 1.3.0-2
changelog:
  - Remove unnecessary explicit kernel dep (#146142)
  - Fixed out of bounds accesses (#131848): Thanks to Steve Grubb
    for the patch
  - Adapted iptables-config to reference to modprobe.conf (#150143)
  - Remove misleading message (#140154): Thanks to Ulrich Drepper
    for the patch


author: Thomas Woerner <twoerner@redhat.com> 1.2.11-3.1
changelog:
  - changed default behaviour for IPTABLES_STATUS_NUMERIC to "yes" (#129731)
  - modified config file to match this change and un-commented variables with
    default values


author: Thomas Woerner <twoerner@redhat.com> 1.2.9-1
changelog:
  - vew version 1.2.9
  - new config options in ipXtables-config:
    IPTABLES_MODULES_UNLOAD
  - more documentation in ipXtables-config
  - fix for netlink security issue in libipq (devel package)
  - print fix for libipt_icmp (#109546)


author: Thomas Woerner <twoerner@redhat.com> 1.2.8-13
changelog:
  - marked all messages in iptables init script for translation (#107462)
  - enabled devel package (#105884, #106101)
  - bumped build for fedora for libipt_recent.so (#106002)


author: Thomas Woerner <twoerner@redhat.com> 1.2.8-12.1
changelog:
  - fixed lost udp port range in ip6tables-save (#104484)
  - fixed non numeric multiport port output in ipXtables-savs


author: Thomas Woerner <twoerner@redhat.com> 1.2.8-6
changelog:
  - IPTABLES_SAVE_COUNTER defaults to no, now
  - install config file in /etc/sysconfig
  - exchange unload of ip_tables and ip_conntrack
  - fixed start function


author: Thomas Woerner <twoerner@redhat.com> 1.2.8-5
changelog:
  - new config option IPTABLES_SAVE_ON_RESTART
  - init script: new status, save and restart
  - fixes #44905, #65389, #80785, #82860, #91040, #91560 and #91374


author: Florian La Roche <Florian.LaRoche@redhat.de>
changelog:
  - remove check for very old kernel versions in init scripts
  - sync up both init scripts and remove some further ugly things
  - add some docu into rpm


author: Karsten Hopp <karsten@redhat.de>
changelog:
  - fixed iptables and ip6tables initscript output, based on #70511
  - check return status of all iptables calls, not just the last one
    in a 'for' loop.


author: Bernhard Rosenkraenzer <bero@redhat.com> 1.2.5-2
changelog:
  - Merge ip6tables improvements from Ian Prowell <iprowell@prowell.org>
    - Update URL (#59354)
  - Use /sbin/chkconfig rather than chkconfig in %postun script


author: Bernhard Rosenkraenzer <bero@redhat.com> 1.2.4-1
changelog:
  - Update to 1.2.4 (various fixes, including security fixes; among others:
    - Fix init script (#31133)


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - Yet another initscript fix (#30173)
  - Fix the fixes; they fixed some issues but broke more important
    stuff :/ (#30176)


author: Karsten Hopp <karsten@redhat.de>
changelog:
  - fix bugzilla #25986 (initscript not marked as config file)
  - fix bugzilla #25962 (iptables-restore)
  - mv chkconfig --del from postun to preun


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - 1.2
  - fix up ipv6 split
  - add init script
  - Move the plugins from /usr/lib/iptables to /lib/iptables.
    This needs to work before /usr is mounted...
  - Use -O1 on alpha (compiler bug)


author: Preston Brown <pbrown@redhat.com>
changelog:
  - move iptables to /sbin.
  - excludearch alpha for now, not building there because of compiler bug(?)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.18.0-4
changelog:
  - cli: don't wait forever in the editor on update connection failure (rh #1702203)
  - team: fix setting validate_active, validate_inactive and send_always flags (rh #1720153)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.18.0-3
changelog:
  - team: don't kill teamd for external devices (rh #1711952)
  - ifcfg-rh: use PKCS#12 private key also as client certificate in reader (rh #1714610)
  - po: update translations (rh #1689962)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.18.0-2
changelog:
  - cli: hide certificate blobs unless --show-secrets is passed (rh #1702199)
  - device: fix reapply of MTU (rh #1702657)
  - settings: fix failed assertion when adding connections (rh #1707261)
  - core: ensure software devices are managed when networking gets enabled (rh #1701585)
  - device: restore IPv6 configuration on link up (rh #1548237)
  - dbus: fix return value for LoadConnection and avoid assertion for relative path (rh #1708660)
  - core: fix file permissions of /var/lib/NetworkManager/secret_key (rh #1709849)
  - tc: add suppor for mired action an fq_codel qdisc (rh #1546802)


author: Thomas Haller <thaller@redhat.com> - 1:1.18.0-1
changelog:
  - Update to 1.18.0 release
  - cli: fix crash handling gsm secrets (rh #1698495)
  - rules: fix duplicate policy routing rules (rh #1652653)


author: Francesco Giudici <fgiudici@redhat.com> - 1:1.18.0-0.4.20190408git43d9187c14
changelog:
  - keyfile: ensure keyfiles don't get a .nmconnection file name extension (rh#1697858)
  - dhcp: preserve legacy dhcp-client-id default for internal dhcp (rh #1695723)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.18.0-0.3.20190408git43d9187c14
changelog:
  - infiniband: allow large MTU (rh #1534869) (rh #1653494)
  - sr-iov: tolerate lack of sriov_drivers_autoprobe sysfs property (rh #1695093)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.18.0-0.2.20190404git9a8fe5f339
changelog:
  - Update to a 1.18 snapshot:
  - clients: only ask secrets for settings that require them (rh #1506536)
  - checkpoint: remove a device from checkpoint if it disappears (rh #1578335)
  - lldp: support more VLAN TLVs (rh #1652211)
  - bridge: add VLAN filtering support (rh #1652910)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.16.2-0.2.20190328git8ec0954570
changelog:
  - Update to a 1.16 snapshot:
  - device: apply static addresses immediately for DHCPv4 method (rh #1369905)
  - man/openvswitch: advise to use "master" instead of "conn.master" (rh #1519176)
  - manager: don't update ifindex of existing devices (rh #1542366)
  - ovs-interface: allow re-activating an already active interface (rh #1543557)
  - ovs: avoid reactivating devices when their master gets removed (rh #1540218)
  - cli: avoid possible crash on device disconnect (rh #1546061)
  - cli: fix upping of the connection after it was updated (rh #1546805)
  - device: restore IPv6 addresses when the link comes back up (rh #1548237)
  - device: set token only after router discovery was started (rh #1560652)
  - team: make teamd log to syslog (rh #1596917)
  - device: fix a possible crash on generating a connection (rh #1631741)
  - ovs: remove NetworkManager-ovs dependency on openvswitch (rh #1633190)
  - dhcp/internal: handle multiple Router DHCP options (rh #1634657)
  - cli: fix a possible crash when removing devices (rh #1639208)
  - device: avoid taking down link to change MAC address (rh #1639274)
  - libnm: fix crash in activate_info_complete() when cancelling (rh #1642625)
  - dhcp6: make sure we have enough space for the DHCP6 option header (rh #1643985)
  - lldp: fix parsing of vlan-name attribute (rh #1652210)
  - team: add support for 'vlanid' link-watchers property (rh #1652931)
  - manager: ignore ovs-system master when assuming connections (rh #1676551)
  - device: do ARP announcements only after masters have a slave (rh #1678796)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.12.0-7
changelog:
  - manager: accept non-null device for VPN activations (rh #1641174)
  - drop dependency of NetworkManager-ovs on openvswitch (rh #1633190)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.12.0-6
changelog:
  - dns: dnsmasq: avoid crash when no reverse domains exist (rh #1628576)
  - initscripts: fix ownership of ifup/ifdown executables (rh #1626517)
  - cli: fix parsing vpn secrets from password file (rh #1628946)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.12.0-3
changelog:
  - cli: remove assertion in nmc_device_state_to_color() (rh #1614691)
  - po: import Japanese translation (rh #1569438)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.12.0-2
changelog:
  - device: disable rp_filter handling (rh #1593194)
  - ibft: grant required CAP_SYS_ADMIN capabilities (rh#1596954)


author: Thomas Haller <thaller@redhat.com> - 1:1.12.0-1
changelog:
  - Update to upstream 1.12.0 release (rh #1592311)
  - device: improve MTU handling for VLAN (rh #1586191)


author: Thomas Haller <thaller@redhat.com> - 1:1.12.0-0.1
changelog:
  - Update to upstream release 1.11.90 (release candidate) (rh #1592311)
  - libnm: properly handle cancelling of async operations (rh #1555281)
  - libnm: support handling checkpoints (rh #1496739)
  - core: fix blocking/not-blocking autoconnect related to missing secrets (rh #1553113)
  - core: rework and improve IPv4 address collission detection (rh #1507864)
  - wifi: fix timeout handling for supplicant when no secrets provided (rh #1575501)
  - macsec: enable sending SCI by default and make it configurable (rh #1588041)
  - ethernet: support announcing duplex/speed in combination with autonegotiation (rh #1487477)
  - wwan: improve failure reason for unsupported IP methods (rh #1459529)
  - tun: use netlink kernel API for tun devices if available (rh #1547213)
  - ovs: fix assertion during shutdown of NetworkManager (rh #1543871)
  - dhcp: improve handling DHCP timeouts (rh #1573780)
  - dhcp: support specifying ipv6.dhcp-duid (rh #1414093)
  - dhcp: support generating ipv4.dhcp-client-id based on MAC/stable-id
  - dns: avoid updating resolv.conf when exiting (rh #1541031)
  - ifcfg-rh: fix IPv4 settings in combination with method "shared" (rh #1519299)
  - ifcfg-rh: fix handling unset Wi-Fi mode (rh #1549972)
  - iface-helper: fix invalid reentrant call to platform (rh #1546656)
  - doc: various improvments to documentation (rh #1543832)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-14
changelog:
  - manager: retry activating devices when the parent becomes managed (rh #1553595)
  - manager: allow autoconnect-slaves to reconnect the same connection (rh #1548265)
  - manager: fix starting teamd after service restart (rh #1551958)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-12
changelog:
  - ppp: don't start IPv6 configuration on the device (rh #1515829)
  - device: avoid setting the IPv4 rp_filter (rh #1492472)
  - nmcli: team: clear runner-tx-hash before adding new hashes (rh #1541922)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.10.2-11
changelog:
  - ovs-interface: avoid starting ip configuration twice (rh #1540063)
  - libnm-core: ensure alignment of team.config and other team properties (rh #1533830)
  - nmcli: clear link-watchers before adding the new ones (rh #1533926)
  - libnm-core: update team.runner description (rh #1533799)
  - libnm-core: team: fix runner sys_prio default value (rh #1533810)
  - libnm: avoid a symbol clash with json-glib (rh #1535905)
  - libnm-core: team: add support to runner "random" (rh #1538699)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-10
changelog:
  - device: skip IP configuration phase for external devices (rh #1530288)
  - platform: fix crash during route-get call (rh #1534721)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.10.2-7
changelog:
  - po: import translations (rh #1481186)
  - device: increase carrier wait time to 6 seconds (rh #1520826)


author: Thomas Haller <thaller@redhat.com> - 1:1.10.2-6
changelog:
  - core: use distinct route-metric to keep connectivity on first activated device (rh #1505893)
  - core: fix enabling connectivity-check-enabled via D-Bus (rh #1534477)
  - core: fix invalid assertion deleting volatile connection (rh #1506552)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-5
changelog:
  - wwan: add default route even if modem didn't return a gateway (rh #1527934)
  - dhcp: fix assertion failure for dhcp-client-id (rh #1531173)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-4
changelog:
  - settings: clear unsaved flag on new connections (rh #1525078)
  - platform-linux: reload qdiscs and tfilters after removing them (rh #1527197)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-1
changelog:
  - Update to upstream release 1.10.2
  - all: added support for onlink route attribute (rh #1428334)
  - device: don't necessarily fail the connection when ipv4 DAD fails (rh #1508001)
  - device: update device mtu from ip interface platform when required (rh #1460217)
  - device: extend carrier lost defer time after MTU change (rh #1487702)
  - ifcfg-rh: persist the wep key type (rh #1518177)
  - settings: introduce an Update2() D-Bus method (rh #1401515)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.0-0.2.rc1
changelog:
  - Update to first Release Candidate of NetworkManager 1.10
  - added basic OpenVSwitch support (rh #1470282)
  - fixed race condition in the nmcli secret agent (rh #1438476)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.0-0.1.git20171024.b16c853b
changelog:
  - Update to a 1.10.0 snapshot:
  - core: fix connection auto-activation after slave failure (rh #1310676)
  - bridge: introduce a bridge.group-forward-mask connection property (rh #1358615)
  - ifcfg-rh: fix write of 802.1X EAP-LEAP connections (rh #1374660)
  - vlan: fix setting MTU value (rh #1414901)
  - core: support multiple routing tables (rh #1436531)
  - ipv6: support multiple default routes (rh #1445417)
  - core: extend D-Bus API to better export active connection state (rh #1454883)
  - nmcli: fix crash (rh #1458311)
  - device: avoid touching IPv6 on external connections without IPv6 conf (rh #1462260)
  - core: downgrade warning messages about missing parent devices (rh #1490157)
  - device: fix delay startup complete for unrealized devices (rh #1498807)
  - device: fix frozen notify signals on unrealize error path (rh #1498755)
  - tui: improve tracking of activation state (rh #1500651)
  - ifcfg-rh: allow updates to connections with routing rule files (rh #1384799)
  - core: fix taking over external connection on modification (rh #1462223)
  - bond: ignore miimon option only when it is zero (rh #1463077)
  - core: don't re-add routes that already exist (rh #1470930)
  - tui: guess the prefix length (netmask) based on network class (rh #1474295)
  - dhcp: fix dhcp over Infiniband when using the internal client (rh #1477678)
  - device: extend wait time for carrier after MTU change (rh #1487702)
  - cli: wifi: connect with PSK when the AP supports WPA-PSK and WPA-EAP (rh #1492064)
  - core: fixed memory leak in dhcp code (rh #1461643)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-11
changelog:
  - core: fix wrongly delaying startup-complete for unrealized devices (rh#1498807)
  - core: fix unfreezing signals when unrealizing device fails (rh#1498755)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-9
changelog:
  - device: don't change MTU unless explicitly configured (rh #1460760)
  - core: don't remove external IPv4 addresses (rh #1459813)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.8.0-8
changelog:
  - cli: fix output of iface in overview output (rh#1460219)
  - ppp: unexport NMPPPManager instance on dispose (rh#1459579)
  - cli: remove spurious device names from wifi subcommands output (rh#1460527)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-7
changelog:
  - bond: fix crash comparing mode while generating bond connection (rh #1459580)
  - connectivity: fix route penalty if WWAN and BT device using ip-ifindex (rh #1459932)
  - device: persist nm-owned in run state (rh #1376199)
  - device: fix assuming master device on restart (rh #1452062)
  - device: apply route metric penality only when the default route exists (rh #1459604)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-6
changelog:
  - connectivity: fix periodic connectivity check (rh #1458399)
  - bond: improve option matching on daemon restart (rh #1457909)
  - device: fix touching device after external activation (rh #1457242)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-5
changelog:
  - ifcfg-rh: fix writing legacy NETMASK value (rh #1445414)
  - tui: fix crash during connect (rh #1456826)
  - libnm: fix libnm rejecting VLAN ID 4095 (rh #1456911)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.8.0-4
changelog:
  - device: update external configuration before commit (rh #1449873)
  - bluetooth: fix crash on connecting to a NAP (rh #1454385)
  - device: release removed devices from master on cleanup (rh #1448907)
  - core: activate slaves using ifindex order by default (rh #1452585)
  - nmcli: fix crash when setting 802-1x.password-raw (rh #1456362)
  - po: update translations (rh #1382625)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-3
changelog:
  - dhcp: don't add route to DHCP4 server (rh #1448987)
  - libnm: fix NUL termination of device's description (rh #1443114)
  - libnm, core: ensure valid UTF-8 in device properties (rh #1443114)
  - core: fix device's UDI property on D-Bus (rh #1443114)
  - ifcfg-rh: omit empty next hop for routes in legacy format (rh #1452648)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-2
changelog:
  - core: fix persisting managed state of device (rh #1440171)
  - proxy: fix use-after-free (rh #1450459)
  - device: don't wrongly delay startup complete waiting for carrier (rh #1450444)


author: Thomas Haller <thaller@redhat.com> - 1:1.8.0-1
changelog:
  - Update to upstream release 1.8.0
  - device: support dummy devices (rh#1398932)
  - core: support attaching user-data to connection profiles (rh#1421429)
  - core: fix allowing FQDN in dhcp-hostname setting (rh#1443437)
  - core: fix configuring firewall while device is activating (rh#1445242)
  - core: don't block activation without carrier for IPv6 DAD (rh#1446367)
  - tui: force writing master key to ifcfg file when editing connection (rh#1425409)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.8.0-0.4.rc3
changelog:
  - Update to third Release Candidate of NetworkManager 1.8
  - device: fix regressions in assuming devices on carryover from initrd (rh #1443878)
  - device: add support for SRIOV num_vfs (rh #1398934)
  - device: leave device up when setting it as unmanaged by user (rh #1371433)
  - core: properly track manager, route manager and default route manager references (rh #1440089)
  - route: properly deal with routes with non-empty host parts (rh #1439376)
  - vpn: fix a crash on disconnect (rh #1442064)
  - cli: fix hang on connection down (rh #1422786)
  - cli: fix interactive edit of bond slaves (rh #1440957)
  - vpn: fix early error handling on failed activations (rh #1440077)
  - core: only persist explicit managed state in device's state file (rh #1440171)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.8.0-0.4.rc2
changelog:
  - Update to second Release Candidate of NetworkManager 1.8
  - device: don't update disconnected devices routes after connectivity check (rh #1436978)
  - ifcfg-rh: also check BONDING_OPTS to determine the connection type (rh #1434555)
  - nmcli: fix nmcli con edit crash (rh #1436993)
  - nmcli: fix nmcli con down (rh #1436990)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.8.0-0.4.rc1
changelog:
  - Update to first Release Candidate of NetworkManager 1.8
  - nmcli: speedup with large numbers of VLANs (rh #1231526)
  - dns: avoid cleaning resolv.conf on exit if not needed (rh #1344303, rh #1426748)
  - device: bond: implement connection reapply (rh #1348198)
  - platform: add support for some route options (rh #1373698)
  - core: add mtu property to cdma and gsm settings (rh #1388613)
  - nmcli: fix output in terse mode (rh #1391170)
  - improve handling of unmanaged/assumed devices (rh #1394579)
  - policy: make DHCP hostname behaviour configurable (rh #1405275)
  - manager: ensure proper disposal of unrealized devices (rh #1433303)
  - nmcli: fix connection down (rh #1433883)
  - libnm-glib: fix memory leak (rh #1433912)
  - device: deal with non-existing IP settings in get_ip_config_may_fail() (rh #1436601)
  - nmcli: make --ask and --show-secrets global options (rh #1351263)
  - nmcli: improve error handling (rh #1394334)
  - device: apply a loose IPv4 rp_filter when it would interfere with multihoming (rh #1394344)
  - core: make connectivity checking per-device (rh #1394345)
  - manager: sort slaves to be autoconnected by device name (rh #1420708)
  - policy: add support to configurable hostname mode (rh #1422610)
  - team: support the ethernet.cloned-mac-address property (rh #1424641)
  - ifcfg-rh: fix reading team slave types of vlan type (rh #1427482)
  - default-route-manager: alyways force a sync of the default route (rh #1431268)
  - device: fail DHCPv6 if a link-local address is not present (rh #1432251)


author: Francesco Giudici <fgiudici@redhat.com> - 1:1.8.0-0.2.git20170215.1d40c5f4
changelog:
  - Update to a 1.7.1 snapshot:
  - rebase NetworkManger package to new upstream 1.8.x version (rh #1414103)
  - device: introduce support to ipv6.method=shared (rh #1256822)
  - device: add support to vlan on virtual devices (rh #1312359)
  - core/supplicant: introduce support to MACsec connections (rh #1337997)
  - core: allow enforcing of 802-3 link properties (rh #1353612)
  - manager: allow a slave connection which has slaves to autoactivate them (rh #1360386)
  - cli: check the active-connection state to detect activation failure (rh #1367752, rh #1384937)
  - cli: remove the separate thread when in editor mode to fix races (rh #1368353)
  - ifcfg-rh: write the master device name even if the master property is an UUID (rh #1369008)
  - ifcfg-rh: higly improved parsing of ifcfg files (rh #1369380)
  - checkpoint: improved the checkpoint/rollback functionality (rh #1369716)
  - core: core: don't unmanage devices on shutdown (rh #1371126, rh #1378418)
  - cli: properly set multiple addresses in questionnaire mode (rh #1380165)
  - manager: keep scheduling connectivity check if there is a default active connection (rh #1386106)
  - device: allow custom MAC address on bond and bridge interfaces (rh #1386872)
  - core: avoid race reading permanent MAC address before udev initialized (rh #1388286)
  - ifcfg-rh: fix import of 802.1x connections with empty EAP-TLS identity (rh #1391477)
  - libnm-core: remove INFERRABLE flag from dhcp-hostname property (rh #1393997)
  - platform: preserve the order when multiple ip addresses are present (rh #1394500)
  - device: avoid a crash when both IPv4 and IPv6 configurations fail (rh #1404148)
  - dns: export dns state to DBUS (rh #1404594)
  - ppp: moved PPP support into a separate package (rh #1404598)
  - dns: don't apply DNS configuration coming from non-active devices (rh #1405431)
  - vlan: inherit default MTU from parent device (rh #1414186)
  - bond: fix crash when reading from sysfs 'NULL' (rh #1420244)
  - build: rebuild with correct hardening flags (rh #1420771)
  - platform: downgrade warning about failure to detect kernel support to debug (rh #1421019)
  - dns: change behavior for "rc-manager=symlink" to preserve "/etc/resolv.conf" as file (rh #1367551)
  - libnm: order the property updates (rh #1417292)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.4.0-9
changelog:
  - clients: handle secret requests only for current connection (rh#1351272)
  - device: fix crash reapplying connection to slave devices (rh#1376784)
  - cli: fix autocompletion after ifname (rh#1375933)


author: Thomas Haller <thaller@redhat.com> - 1:1.4.0-8
changelog:
  - libnm: fix crash in nm_vpn_plugin_info_list_get_service_types() (rh#1374526)
  - device: wait for MAC address change before setting up interface (rh#1371623, rh#1374023)


author: Thomas Haller <thaller@redhat.com> - 1:1.4.0-7
changelog:
  - wifi: another fix activation failure due to error changing MAC address (rh#1371623, rh#1374023)
  - dhcp: fix race condition that may cause lost lease events and DHCP timeouts (rh#1373276)


author: Thomas Haller <thaller@redhat.com> - 1:1.4.0-5
changelog:
  - libnm,nmtui: fix handling empty cloned-mac-address property (rh#1372799)
  - ibft: grant required CAP_SYS_ADMIN capabilities (rh#1371201)


author: Thomas Haller <thaller@redhat.com> - 1:1.4.0-3
changelog:
  - wifi: fix activation failure due to error changing MAC address (rh#1371623)
  - core: fix wrong source interface for PropertiesChanged D-Bus signal (rh#1371920)
  - team: restore validation of JSON configuration (rh#1371967)
  - device: manage firewall zone for assumed persistent connections (rh#1366288)
  - device: don't let external changes cause a release of the slave (rh#1357738)


author: Thomas Haller <thaller@redhat.com> - 1:1.4.0-2
changelog:
  - ifcfg-rh: clear IP settings for slave connections (rh#1368761)
  - ifcfg-rh: accept TEAM connections also without DEVICETYPE setting (rh#1367180)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.4.0-1
changelog:
  - Update to 1.4.0 release
  - cli: show username when interactively connecting to a wireless network (rh #1351272)
  - ifcfg-rh: ensure master is cleared when updating a connection (rh #1355656)
  - policy: always try to update kernel hostname (rh #1362542)
  - cli: return sane error message for D-Bus policy permission errors (rh #1362542)
  - device: don't flush addresses when unmanaging assumed devices (rh #1364393)
  - team: be more tolerant when handling invalid or empty configuration (rh #1366300)
  - act-request: queue failing the slave when master fails (rh #1367702)
  - vpn: fix ipv6 configuration of VPNs without a separate interface (rh #1368354)
  - vpn: properly discard routes with invalid prefix length (rh #1368355)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.4.0-0.5.beta1
changelog:
  - Update to 1.4-beta1 release
  - core: fix setting hostname from DHCP (rh #1356015)
  - vlan: honor the REORDER_HDR flag (rh #1312281)
  - device: apply MTU setting also to devices without IPv4 configuration (rh #1364275)
  - bond: improved connection matching (rh #1304641)
  - team: check return value of g_dbus_connection_call_sync() (rh #1349749)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.4.0-0.3.git20160727.9446481f
changelog:
  - Update to a more recent 1.4.0 snapshot:
  - bond: fix defaults and be more liberal in accepting different formats of option values (rh #1352131)
  - bond: fix setting of "lp_interval" option (rh #1348573)
  - device: don't try to generate ipv6ll address for disconnected devices (rh #1351633)
  - device: make sure we update system hostname when DHCP configuration changes (rh #1356015)
  - device: tune down warning about failure to set userspace IPv6LL on non-existing device (rh #1323571)
  - nmcli: add "nmcli device modify" subcommand to do runtime configuration changes (rh #998000)
  - nmcli: crash on connection delete/down timeout (rh $1355740)
  - nmcli: fix 8021x settings tab-completion (rh #1301226)
  - secrets: increase timeout for getting the secrets from the agent (rh #1349740)
  - team: keep device config property up to date with actual configuration (rh #1310435)
  - team: make synchronization with teamd more robust (rh #1257237)
  - vpn: don't merge DNS properties into parent device's configuration (rh #1348901)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.4.0-0.2.git20160621.072358da
changelog:
  - enable JSON validation configure option
  - Update to a more recent 1.3.0 snapshot:
  - team: check return value of g_dbus_connection_call_sync() (rh #1347015)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.4.0-0.1.git20160606.b769b4df
changelog:
  - Update to a 1.3.0 snapshot:
  - cli: hide secret certificate blobs unless --show-secrets set (rh #1184530)
  - dns: add support for specifying dns priorities (rh #1228707)
  - core: wait for IPv6 DAD before completing activation (rh #1243958)
  - device: take care of default route of DHCP generated-assumed connections (rh #1265239)
  - team: improve matching of team connection upon service restart (rh #1294728)
  - device: apply MTU setting also to devices without IPv4 configuration (rh #1303968)
  - device: reconfigure IP addressing after bringing up device (rh #1309899)
  - team: expose current device configuration through D-Bus and nmcli (rh #1310435)
  - systemd: add "After=dbus.service" to NetworkManager.service (rh #1311988)
  - cli: handle device failure when activating (rh #1312726)
  - core,libnm: remove gateway from connection if never-default is set (rh #1313091)
  - platform: remove padding for IP address lifetimes (rh #1318945)
  - manager: run dispatcher scripts on suspend/sleep (rh #1330694)
  - device: remove pending dhcp actions also in IP_DONE state (rh #1330893)
  - wwan: fixed multiple crashes (rh #1331395)
  - nmcli: fix tab completion for libreswan import (rh #1337300)


author: Thomas Haller <thaller@redhat.com> - 1:1.2.0-2
changelog:
  - write /etc/resolv.conf as file by default instead of symlink (rh#1337222)
  - rename package config-routing-rules to dispatcher-routing-rules (rh #1334876)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.2.0-1
changelog:
  - Update to NetworkManager 1.2.0 release
  - vlan: keep the hardware address synchronized with parent device (rh #1325752)
  - bond: add more options (rh #1299103)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.2.0-0.1.beta2
changelog:
  - Update to a 1.2.0 snapshot:
  - core: add a connection defaults section to NetworkManager.conf (rh #1164677)
  - dhcp: make timeout configurable (rh #1262922)
  - pppoe: set the firewall zone on the correct ip interface (rh #1110465)
  - device: properly roll back the device activation attempt on failure (rh #1270814)
  - nmcli: add monitor command (rh #1034158)
  - nmcli: fix shell completion of bluetooth device names (rh #1271271)
  - ipv4: add an option to send full FQDN in DHCP requests (rh #1255507)
  - core: fix a use-after-free() when activating a secondary VPN connection (rh #1277247)
  - wifi: fix bssid cache updating (rh #1094298)
  - vlan: honor the reorder-header flag (rh #1250225)
  - ipv4: do a duplicate address detection (rh #1259063)
  - core: add LLDP listener to the daemon and utilities (rh #1142898)
  - vpn: don't fail activation when plugin supports interactive mode, but the VPN daemon does not (rh #1298732)
  - ipv6: readd the address when the MAC address changes (rh #1286105)
  - core: avoid generating excessively long names for virtual devices (rh #1300755)
  - nmcli: add connection import and export (rh #1034105)
  - vlan: fix matching of connections on assumption (rh #1276343)
  - core: fix matching of static route metrics on connection assumption (rh #1302532)
  - core: work around broken device drivers (AWS ENI) that initially have zero MAC address (rh #1288110)
  - infiniband: set the link down when changing mode, some drivers need that (rh #1281301)
  - infiniband: retry autoactivation of partitions when parent device changes (rh #1275875)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.0.6-25
changelog:
  - vpn: cancel the secrets request on agent timeout (rh #1272023)
  - vpn: cancel the connect timer when vpn reconnects (rh #1272023)


author: Thomas Haller <thaller@redhat.com> - 1:1.0.6-22
changelog:
  - platform: fix detection of s390 CTC device (rh #1272974)
  - core: fix queuing activation while waiting for carrier (rh #1079353)


author: Thomas Haller <thaller@redhat.com> - 1:1.0.6-17
changelog:
  - dhcp6: destroy the lease when destroying a client (rh #1260727)
  - device: fix race wrongly managing external-down device (rh #1269199)


author: Thomas Haller <thaller@redhat.com> - 1:1.0.6-14
changelog:
  - platform: updating link cache when moving link to other netns (rh #1264361)
  - nmtui: fix possible crash during secret request (rh #1267672)
  - vpn: increase the plugin inactivity quit timer (rh #1268030)
  - core: fix enslaving team device to bridge (rh #1183444)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.0.6-13
changelog:
  - vpn-connection: set the MTU for the VPN IP interface (rh #1267004)
  - modem-broadband: update modem's supported-ip-families (rh #1263959)
  - wifi: fix a crash in on_bss_proxy_acquired() (rh #1267462)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.0.6-6
changelog:
  - device: retry DHCP after timeout/expiration for assumed connections (rh #1246496)
  - device: retry creation of default connection after link is initialized (rh #1254089)


author: Thomas Haller <thaller@redhat.com> - 1:1.0.6-5
changelog:
  - config: add code comments to NetworkManager.conf file
  - iface-helper: enabled slaac/dhcp4 based on connection setting only (rh #1260243)
  - utils: avoid generation of duplicated assumed connection for veth devices (rh #1256430)
  - nmcli: improve handling of wake-on-lan property (rh #1260584)


author: Thomas Haller <thaller@redhat.com> - 1:1.0.6-4
changelog:
  - config: fix config-changed signal for s390x and ppc64 archs (rh #1062301)
  - device: fix handling ignore-auto-dns for IPv6 nameservers (rh #1261428)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.0.6-1
changelog:
  - Align with the upstream 1.0.6 release:
  - device: add support for configuring Wake-On-Lan (rh #1141417)
  - device: don't disconnect after DHCP failure when there's static addresses  (rh #1168388)
  - device: provide information about metered connections (rh #1200452)
  - device: fix an assert fail when cleaning up a slave connection (rh #1243371)
  - team: add support for setting MTU (rh #1255927)
  - config: avoid premature exit with configure-and-quit option (rh #1256772)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.0.4-0.1.git20150713.38bf2cb0
changelog:
  - Update to a bit newer 1.0.4 git snapshot, to fix test failures
  - device: restart ping process when it exits with an error (rh #1128581)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.0.3-1.git20150622.9c83d18d
changelog:
  - Update to a 1.0.4 git snapshot:
  - bond: add support for setting a MTU (rh #1177860)
  - core: delay initialization of the connection for devices without carrier at startup (rh #1079353)
  - route-manager: ensure the routes are set up properly with multiple interface in the same subnet (rh #1164441)
  - config: add support for reloading configuration (rh #1062301)
  - device: disallow ipv6.method=shared connections early during activation (rh #1183015)
  - device: don't save the newly added connection for a device until activation succeeds (rh #1174164)
  - rdisc: prevent solicitation loop for expiring DNS information (rh #1207730)
  - wifi: Indicate support of wireless radio bands (rh #1200451)
  - nmcli: Fix client hang upon multiple deletion attempts of the same connection (rh #1168657)
  - nmcli: Fix documentation for specifying a certificate path (rh #1182575)
  - device: add support for auto-connecting slave connection when activating a master (rh #1158529)
  - nmtui: Fix a crash when attempting an activation with no connection present (rh #1197203)
  - nmcli: Add auto-completion and hints for valid values in enumeration properties (rh #1034126)
  - core: load the the libnl library from the correct location (rh #1211859)
  - config: avoid duplicate connection UUIDs (rh #1171751)
  - device: enable IPv6 privacy extensions by default (rh #1187525)
  - device: fix handling if DHCP hostname for configure-and-quit (rh #1201497)
  - manager: reuse the device connection is active on when reactivating it (rh #1182085)
  - device: reject incorrect MTU settings from an IPv6 RA (rh #1194007)
  - default-route: allow preventing the connection to override externally configured default route (rh #1205405)
  - manager: reduce logging for interface activation (rh #1212196)
  - device: don't assume a connection for interfaces that only have an IPv6 link-local address (rh #1138426)
  - device: reject hop limits that are too low (CVE-2015-2924) (rh #1217090)


author: Dan Williams <dcbw@redhat.com> - 1:1.0.0-13.git20150121.b4ea599c
changelog:
  - core: remove IPv6LL address when deactivating managed devices (rh #1184997)
  - core: recognize external IP config earlier on startup
  - core: fix bridge default metric


author: Dan Williams <dcbw@redhat.com> - 1:1.0.0-9.git20150121.b4ea599c
changelog:
  - build: fix NetworkManager-libnm and old NetworkManager-glib conflict (rh #1066690)
  - core: accept numeric bond options (rh #1171009) (rh #1133544)
  - core/libnm: better validate setting properties (rh #1182567)
  - core: add dispatcher script to support policy based routing (rh #1160013)


author: Thomas Haller <thaller@redhat.com> - 1:1.0.0-7.git20150107.1ea95cd3
changelog:
  - platform: fix handling of routes with special metric (rh #1172780)
  - ifcfg-rh: add reading and writing of route-metric property


author: Dan Williams <dcbw@redhat.com> - 1:1.0.0-5.git20150107.1ea95cd3
changelog:
  - build: remove -bluetooth and -wwan Requires to prevent unwanted updates (rh #1066690)
  - build: remove erroneous libnm/libnm-devel dependencies


author: Dan Williams <dcbw@redhat.com> - 1:1.0.0-1.git20150107.1ea95cd3
changelog:
  - Update to 1.0 release
  - core: split device support into sub-packages (rh #1066690)
  - core: don't touch externally created software interfaces until IFF_UP (rh #1030947)
  - tui: fix handling of "Available to all users" checkbox (rh #1176042)


author: Dan Williams <dcbw@redhat.com> - 1:0.995.0.0-1
changelog:
  - core: fix DHCP lease expiry/nak during lease acquisition
  - core: don't step on external team interfaces when teamd appears


author: Dan Williams <dcbw@redhat.com> - 1:0.9.11.0-9.git20141211.da4a98bf
changelog:
  - core: recognize layer-2 connections (rh #1141266)
  - core: don't tear down assumed connections that fail (rh #1141264)
  - core: clean up IP operations when restarting them after re-authentication
  - core: fix some VPN issues with secrets and routing
  - core: fix regression parsing gateway from addresses (rh #1170199)
  - core: don't release slaves on exit (rh #1169936)
  - tui: fix deletion of slaves with master (rh #1131574)
  - cli: fix regression deactivating multiple connections (rh #1168383)


author: Dan Williams <dcbw@redhat.com> - 1:0.9.11.0-6.git20141125.f32075d2
changelog:
  - tui: fix missing IPv4/IPv6 method popup (rh #1167710)
  - core: inherit parent managed state for VLAN devices (rh #1114681)


author: Dan Williams <dcbw@redhat.com> - 1:0.9.11.0-5.git20141118.646f335d
changelog:
  - cli: fix showing secrets when editing connections
  - cli: ignore timestamp when comparing connections (rh #1122995)
  - core: fix a few issues with the internal DHCP client (rh #1066700)


author: Dan Williams <dcbw@redhat.com> - 1:0.9.11.0-4.git20141114.669f74b8
changelog:
  - core: wait for IPv6LL address before starting DHCPv6-only configurations
  - core: fix race with kernel IPv6LL when deactiving connections that ignored IPv6
  - cli: fix waiting for activation success/failure
  - core: silence warning about bad ifindex for non-netdev devices
  - core: fix default route ordering issues
  - core: don't change firewall zone for assumed devices (rh #1098281)
  - libnm: fix translations in clients and non-UTF-8 encodings
  - tui: fix unsetting the gateway (rh #1163896)
  - cli/tui: only handle secrets for connection being activated


author: Dan Williams <dcbw@redhat.com> - 1:0.9.11.0-1.git20141107.git289f7881
changelog:
  - core: DHCP address lifetime expires before it can be updated (rh #1139326)
  - core: apply static IPv6 configuration while waiting for an RA (rh #1101809)
  - core: fix activation of IP configurations on unmanaged interfaces (rh #1067299)
  - core: serialize dispatcher state changes (rh #1061212)
  - core: increased dispatcher timeout and blocking events (rh #1048345)
  - core: add support for "lacp_rate" bonding option (rh #1061702)
  - core: better handle slave state changes done externally (rh #1066706)
  - core: fix checking whether NM is running for root clients (rh #1096772)
  - ifcfg-rh: ignore tailing spaces (rh #1100336)
  - cli: fix warning setting DCB application priority (rh #1080510)
  - tui: fix inverted 'Require IPvX addressing' checkbox (rh #1108839)
  - tui: fix entry of some IP address formats (rh #1090422)
  - tui: fix disabled <Add> button in IP configuration (rh #1131434)


author: Lubomir Rintel <lrintel@redhat.com> - 1:0.9.9.1-39.git20140326
changelog:
  - platform: Increase NL buffer size for systems with a lot of interfaces (rh #1141256)
  - tui: Remove primary option if bond mode is not active-backup (rh #1142864)


author: Dan Winship <danw@redhat.com> - 1:0.9.9.1-38.git20140326
changelog:
  - tui: fix password handling (rh #1133967)
  - tui: save LEAP username correctly (rh #1133967)
  - tui: fix a crash when dismissing password dialog (rh #1132612)


author: Jiří Klimeš <jklimes@redhat.com> - 1:0.9.9.1-35.git20140326
changelog:
  - core: don't generate a connection for unmanaged devices (rh #1136843)
  - bluetooth: don't crash when switching off bluetooth (rh #1136387)
  - dhcp: fix dhclient abnormal exit due to SIGPIPE (rh #1136836)


author: Jiří Klimeš <jklimes@redhat.com> - 1:0.9.9.1-31.git20140326
changelog:
  - core, cli: D-Bus Delete() call; 'nmcli device delete <ifname>' for SW devices (rh #1034150)
  - cli: use readline library throughout nmcli when asking for input (rh #1007365)


author: Jiří Klimeš <jklimes@redhat.com> - 1:0.9.9.1-30.git20140326
changelog:
  - ifcfg-rh: fix a crash on setting hostname with SELinux disabled (rh #1122826)
  - cli: fix 'nmcli device wifi' crash with multiple wifi devices (rh #1131042)
  - policy: don't use default (localhost) hostname as configured hostname (rh #1110436)
  - ifcfg-rh: write GATEWAY instead of GATEWAY0 to be ifup-compatible (rh #1105770)
  - libnm-util, cli: make explicit that we only allow VPN as secondaries (rh #1094296)


author: Jiří Klimeš <jklimes@redhat.com> - 1:0.9.9.1-17.git20140326
changelog:
  - core: fix connection matching generally and for s390 as well (rh #1083196)
  - dhcp: fix DHCPv6 address lifetime handling (rh #1086237)


author: Dan Winship <danw@redhat.com> - 1:0.9.9.1-14.git20140326
changelog:
  - core: fix connection matching with IPv6 routes (rh #1086237)
  - core: wait with startup-complete for dynamic IPv4 and IPv6 addresses (rh #1096063, rh #1086906)


author: Dan Williams <dcbw@redhat.com> - 1:0.9.9.1-13.git20140326
changelog:
  - core: ignore IPv6 cache routes to fix initial connection generation (rh #1083153)
  - core: ensure slow DHCP emits 'dhcp4-change' and 'dhcp6-change' dispatcher events (rh #1091296)


author: Dan Williams <dcbw@redhat.com> - 1:0.9.9.1-12.git20140326
changelog:
  - core: fix master interface DHCP handling if ignore-carrier is set (rh #1083624)
  - core: fix startup state not finishing correctly (rh #1084554)


author: Dan Williams <dcbw@redhat.com> - 1:0.9.9.1-11.git20140326
changelog:
  - core: additional fixes for Data Center Bridging (DCB) (rh #799241) (rh #1081991)
  - core: ensure /etc/resolv.conf has the right SELinux label (rh #1070829)


author: Dan Williams <dcbw@redhat.com> - 1:0.9.9.1-8.git20140326
changelog:
  - core: fix management of some static configurations from initramfs (rh #1077743)
  - ifcfg-rh: add support for alias files (rh #1067170)
  - core: additional fixes for Data Center Bridging (DCB) (rh #799241)


author: Dan Winship <danw@redhat.com> - 1:0.9.9.1-7.git20140313
changelog:
  - ifcfg-rh: give a better error on "permission denied" (rh #1070617)
  - tui: allow cancelling with "Esc" from "nmtui connect" (rh #1080059)


author: Dan Williams <dcbw@redhat.com> - 1:0.9.9.1-4.git20140313
changelog:
  - core: fix startup auto-activation of slow carrier detect interfaces (rh #1076592)
  - core: align default bridge priority with kernel defaults (rh #1073664)


author: Dan Williams <dcbw@redhat.com> - 1:0.9.9.1-3.git20140313
changelog:
  - core: read and assume team port configuration (rh #1035859)
  - core: looser IPv6 existing configuration assumption (rh #1073824)
  - core: follow network interface renames (rh #907836)
  - core: add support for VXLAN interfaces (rh #1066705)
  - wifi: fix connections to hidden SSIDs (rh #1069844)
  - cli: allow using master connection name when creating slaves (rh #1057494)
  - ifcfg-rh: fix reading and writing of Team port configurations (rh #1074160)


author: Jiří Klimeš <jklimes@redhat.com> - 1:0.9.9.1-2.git20140228
changelog:
  - core: fix adding gateway route for IPv6 (rh #1072410)
  - core: unschedule deletion of sw device when activating request (rh #1073015)
  - cli: fix a crash when trying to set a white-space string as IP (rh #1071394)
  - core: correctly handle pre-activation dependency failure (rh #1069695)
  - libnm-util, libnm-glib: Add master/slave-matching utils (rh #1045203)
  - rdisc: set the expiration timer correctly (rh #1073560)
  - core,libnm-glib: support 'type', 'id' properties in NMActiveConnection (rh #1061822)
  - core: reenable auto activation for slave connections with a matching UUID master
  - core: implement function nm_active_connection_get_uuid()
  - core: rename function nm_active_connection_get_name() to nm_active_connection_get_id()
  - libnm-glib: fix a double free in NMDeviceVlan
  - platform: fix converting address flags in nm_platform_ip6_address_to_string()
  - core: postpone non-static master IP configuration until carrier
  - core: match IPv4 'disabled' method to 'auto' when device has no link
  - core: refactor connection matching and add testcase
  - policy: fix crash caused by calling functions on connection==NULL


author: Thomas Haller <thaller@redhat.com> - 1:0.9.9.1-0.git20140228
changelog:
  - new snapshot version 0.9.9.1
  - cli: show warning when setting band/channel for infrastructure mode wifi (rh #1000096)
  - cli: better checking of WEP key types in interactive editor (rh #1040964)
  - core: fix crash while wrongly switching device to state NEED_AUTH (rh #1058308)
  - core: fix crash during re-activation with pending activation request (rh #1058843)
  - cli: support set/appending container types in modify command and interactive editor (rh #1044027)


author: Dan Winship <danw@redhat.com> - 1:0.9.9.0-37.git20140131
changelog:
  - dbus: kill at_console usage in permissions (rh #979416)
  - policy: allow inactive (remote/SSH) sessions to perform some actions (rh #979416)
  - cli: consolidate active and configured connections (rh #997999)
  - core/rdisc: add support for IPv6 privacy (rh #1003859)
  - core/platform: revise failure to activate connection on error of setting route (rh #1005416)
  - core/platform: sort routes before adding them in nm_platform_ipX_route_sync() (rh #1005416)
  - vpn: handle missing tunnel interface for IP-based VPNs (rh #1030068)
  - core: make NMDeviceTun 'mode' immutable and set at construct time (rh #1034737)
  - core/rdisc: add autoconf addresses as /64 (instead of /128) (rh #1044590)
  - ifcfg-rh: unescape Team configuration (rh #1051517)
  - core: fix a crash with autoconnect masters with autoconnect slaves (rh #1054194)
  - libnm-glib: additional functions to get nameservers (rh #1056146)


author: Dan Williams <dcbw@redhat.com> - 1:0.9.9.0-32.git20140122
changelog:
  - core: add host route for DHCPv4 server if outside assigned subnet (rh #983325)
  - core: set classful prefix length for DHCPv4 static routes
  - core: only request wired 802.1x secrets during initial connection
  - cli: fix crash when edited connection removed by another client (rh #1011942)
  - cli: add help for second-level commands (rh #1034119)


author: Dan Williams <dcbw@redhat.com> - 1:0.9.9.0-30.git20130108
changelog:
  - core: ignore public-suffix search domains like ".com" or ".net" (#851521)
  - core: don't touch virtual devices on suspend/resume (rh #1038158)
  - core: fix handling of local nameservers in resolv.conf on startup (rh #1035861)
  - core: fix race with 'network' service at boot (rh #1034983)
  - core: fix stale information in dispatcher DHCP lease change events
  - cli: more compact 'nmcli dev' output format (rh #998003)
  - cli: make some mandatory parameters actually mandatory (rh #953397)
  - cli: enhance help documentation and bash completion (rh #1036545)
  - cli: show VPN connection information (rh #1036132)


author: Dan Williams <dcbw@redhat.com> - 0.9.9.0-28.git20131212
changelog:
  - core: fix auto-activation after deactivation (rh #1033187)
  - core: delay startup complete for initial carrier (rh #1030583)
  - wifi: fix possible crashes checking associated AP (rh #1025371)
  - core: fix sending of hostname to DHCP server (rh #1001529)
  - core: don't retry a failed connection indefinitely (rh #1040528)
  - core: add reconnect delay for PPPoE connections (rh #1023503)
  - core: fix handling of routes with gateway in keyfiles (bgo #719851)
  - core: fix wierd profile doubling on restart (rh #1029859)
  - core: ensure software connections can be auto-activated after creationg (rh #1035814)
  - core: fix setting broadcast address (rh #1032819)
  - core: fix handling of PtP addresses for VPNs (rh #1018317)
  - cli: fix help command for connection object (rh #1036545)
  - core: fix connection auto-activation based on timestamp order (rh #1029854)
  - core: fix connecting VLAN interfaces without a specific interface name (rh #1034908)
  - core: fix crash canceling secrets requests (rh #922855)
  - libnm-glib: fix crash when connections are deleted remotely (rh #1030403)
  - cli: add "nmcli con load file..." (bgo #709830)
  - core: use disable_ipv6 in the right situations (rh #1004255)
  - cli: fix crash on editing 'lo' connection (rh #1030395)
  - core: ignore RA-provided IPv6 default routes (rh #1042402)
  - core: fix various issues found by Coverity (rh #1025894)
  - cli: add bash completion for hostname commands (rh #1018510)
  - core: require secondary connections to be VPNs (rh #997039)
  - core: don't crash if ethernet device has no MAC address (rh #1029053)


author: Dan Williams <dcbw@redhat.com> - 0.9.9.0-19.git20131108
changelog:
  - core: fix various issues with ignore-carrier configuration (rh #1018403)
  - core: improve handling of NPAR/SRIOV devices in bonds (rh #804527)
  - ifcfg-rh: fix crash when reading connection (rh #1025007)
  - core: better handling of unrecognized connections (rh #1022256)
  - cli: add 'nmcli dev connect eth0' functionality (rh #961543)
  - core: add support for DCB/FCoE configuration (rh #799241)
  - cli: add 'activate' menu command for interactive editor (rh #1004883)
  - core: fix segfault when setting default IPv6 route for VPNs (rh #1019021)
  - core: track autoconnect for software devices that are removed (rh #1005913)
  - ifcfg-rh: always read and write static IP addresses (rh #998135)
  - cli: copy remove connection to local one on save (rh #997958)
  - core: don't crash when no DHCP client is available (rh #1015809)
  - libnm-glib: fix crash in nm_client_new() (rh #1010288)


author: Dan Williams <dcbw@redhat.com> - 0.9.9.0-16.git20131011
changelog:
  - core: fix IPv4 addressing when IPv6 is disabled at boot time (rh #1012151)
  - ifcfg-rh: fix handling of default routes in route6 files (rh #991807)
  - core: fix PropertiesChanged signals for IP-related properties
  - ifcfg-rh: make minimal ifcfg file handling consistent with initscripts


author: Dan Williams <dcbw@redhat.com> - 0.9.9.0-15.git20131004
changelog:
  - core: add support for 'primary' bond option (rh #1013727)
  - cli: fix creation of Dynamic WEP configurations (rh #1005171)


author: Dan Williams <dcbw@redhat.com> - 0.9.9.0-14.git20131003
changelog:
  - core: fix DHCPv6 address prefix length (rh #1013583)
  - cli: enhance bonding questionaire (rh #1007355)
  - core: fix crash with Bluez5 if PAN connection is not defined (rh #1014770)
  - libnm-glib: fix various memory leaks that could cause UIs to mis-report state
  - core: fix issues with mis-configured IPv6 router advertisements (rh #1008104)
  - cli: fix potential crash editing connections (rh #1011942)
  - core: fix crash deactivating team devices (rh #1013593)


author: Dan Winship <danw@redhat.com> - 0.9.9.0-13.git20131001
changelog:
  - core: fix bridge device creation (#1012532)
  - core,settings: do not call functions with connection==NULL (rh #1008151)
  - cli: accept gateway in the IP questionnaire of 'nmcli -a con add' (rh #1007368)
  - cli: always print success message (not only in --pretty mode) (rh #1006444)
  - cli: fix bond questionnaire to be able to set miimon (rh #1007355)
  - ifcfg-rh: if IPv4 is disabled put DNS domains (DOMAIN) into IPv6 (rh #1004866)
  - platform: fix a crash when nm_platform_sysctl_get() returns NULL (rh #1010522)
  - platform: fix InfiniBand partition handling (rh #1008568)
  - infiniband: only check the last 8 bytes when doing hwaddr matches (rh #1008566)
  - bluez: merge adding support for BlueZ 5 (bgo #701078)
  - api: clarify lifetime and behavior of ActiveConnection's SpecificObject property (rh #1012309)
  - vpn: fix connecting to VPN (bgo #708255) (rh #1014716)
  - rdisc: do not crash on NDP init failures (rh #1012151)
  - cli: be more verbose when adding IP addresses in questionnaire (rh #1006450)
  - team: chain up parent dispose() in NMDeviceTeam dispose() (rh #1013593)
  - translation updates


author: Dan Williams <dcbw@redhat.com> - 0.9.9.0-11.git20130913
changelog:
  - core: actually enable ModemManager 1.0 support
  - libnm-glib: fix nm_remote_connection_delete() not calling callback (rh #997568)
  - cli: ensure terminal is reset after quitting
  - cli: set wep-key-type properly when editing (rh #1003945)
  - man: fix typo in nmcli examples manpage (rh #1004117)
  - core: fix setting VLAN ingress/egress mappings
  - core: allow creating VLANs from interfaces other than Ethernet (rh #1003180)
  - cli: fix input/output format conversion (rh #998929)


author: Dan Williams <dcbw@redhat.com> - 0.9.9.0-10.git20130906
changelog:
  - core: fix bug which disallowed deleting connections (rh #997568)
  - core: add support for Team devices
  - core: enable NetworkManager-wait-online by default (rh #816655)
  - core: fix crash when 'gre' and 'macvlan' links change (rh #997396)
  - core: fail activation when invalid static routes are configured (rh #999544)
  - core: enhance connectivity checking to include portal detection
  - core: allow hyphens for MAC addresses (rh #1002553)
  - core: remove NetworkManager-created software devices when they are deactivated (rh #953300)
  - core: fix handling of some DHCP client identifiers (rh #999503)
  - core: correctly handle Open vSwitch interfaces as generic interfaces (rh #1004356)
  - core: better handle Layer-2-only connections (rh #979288)
  - cli: enhanced bash completion
  - cli: make the 'describe' command more visible (rh #998002)
  - cli: fix bug rejecting changes to Wi-Fi channels (rh #999999)
  - cli: update bash completion to suggest connection names (rh #997997)
  - cli: fix tab completion for aliases in edit mode
  - cli: ask whether to switch IP method to 'auto' when all addresses are deleted (rh #998137)
  - cli: request missing information when --ask is passed (rh #953291)
  - cli: add 'remove' command to edit mode
  - cli: fix creation of secure Wi-Fi connections (rh #997969) (rh #997555)
  - cli: default autoconnect to no and ask whether to activate on save (rh #953296)
  - man: clarify manpage text (rh #960071) (rh #953299)
  - man: fix errors in the nmcli help output and manpage (rh #997566)
  - ifcfg-rh: only write IPV6_DEFAULTGW when there's actually a default gateway (rh #997759)
  - ifcfg-rh: fix handling of legacy-format routes file with missing gateway


author: Dan Williams <dcbw@redhat.com> - 0.9.9.0-9.git20130807
changelog:
  - core: fix assert on multi-hop routes (rh #989022)
  - core: fix dispatcher systemd unit enabling (rh #948433)
  - ifcfg-rh: ignore emacs temporary lockfiles (rh #987629)
  - core: fix various routing issues and interaction with kernel events
  - cli: confirm saving connections when autoconnect is enabled (rh #953296)
  - cli: automatically change method when static IP addresses are added
  - core: preserve externally added IPv4 routes and addresses


author: Dan Winship <danw@redhat.com> - 0.9.9.0-6
changelog:
  - Belatedly update udev directory for UsrMove
  - Fix incorrect dates in old changelog entries to avoid rpm warnings


author: Dan Williams <dcbw@redhat.com> - 0.9.9.0-2.git20130515
changelog:
  - Update for systemd network-online.target (rh #787314)
  - Add system service for the script dispatcher (rh #948433)


author: Dan Williams <dcbw@redhat.com> - 0.9.9.0-1.git20130514
changelog:
  - Enable hardened build
  - Update to 0.9.10 snapshot
  - cli: new capabilities and somewhat re-arranged syntax
  - core: generic interface support
  - core: split config support; new "server mode" options
  - core: allow locking connections to interface names


author: Dan Williams <dcbw@redhat.com> - 0.9.8.1-2.git20130507
changelog:
  - core: fix issue with UI not showing disconnected on rfkill
  - core: memory leak fixes
  - core: silence warning about failure reading permanent MAC address (rh #907912)
  - core: wait up to 120s for slow-connecting modems
  - core: don't crash on PPPoE connections without a wired setting
  - core: ensure the AvailableConnections property is always correct
  - keyfile: ensure all-default VLAN connections are read correctly
  - core: suppress kernel's automatic creation of bond0 (rh #953466)
  - libnm-glib: make NMSecretAgent usable with GObject Introspection
  - libnm-util: fix GObject Introspection annotations of nm_connection_need_secrets()
  - core: documentation updates


author: Dan Williams <dcbw@redhat.com> - 0.9.8.1-1.git20130327
changelog:
  - Update to 0.9.8.2 snapshot
  - core: fix VLAN parent handling when identified by UUID
  - core: quiet warning about invalid interface index (rh #920145)
  - core: request 'static-routes' from DHCP servers (rh #922558)
  - core: fix crash when dbus-daemon is restarted (rh #918273)
  - core: copy leasefiles from /var/lib/dhclient to fix netboot (rh #916233)
  - core: memory leak and potential crash fixes
  - ifcfg-rh: ensure missing STP property is interpreted as off (rh #922702)


author: Dan Williams <dcbw@redhat.com> - 0.9.7.997-1
changelog:
  - Update to 0.9.8-beta2
  - core: ignore bridges managed by other tools (rh #905035)
  - core: fix libnl assert (rh #894653)
  - wifi: always use Proactive Key Caching with WPA Enterprise (rh #834444)
  - core: don't crash when Internet connection sharing fails to start (rh #883142)


author: Jiří Klimeš <jklimes@redhat.com> - 0.9.7.0-8.git20121004
changelog:
  - Apply patch from master to update hostname (rh #875085)
  - spec: create /etc/NetworkManager/dnsmasq.d (rh #873621)


author: Dan Williams <dcbw@redhat.com> - 0.9.7.0-3.git20121004
changelog:
  - Forward-port some forgotten fixes from F17
  - Fix networked-filesystem systemd dependencies (rh #787314)
  - Don't restart NM on upgrade, don't stop NM on uninstall (rh #811200)


author: Dan Williams <dcbw@redhat.com> - 0.9.5.96-1
changelog:
  - Update to 0.9.6-rc2
  - core: fix race between parallel DHCP client invocations
  - core: suppress a useless warning (rh #840580)
  - ifcfg-rh: fix segfault with malformed values (rh #841391)
  - ifcfg-rh: ignore IP config on bond slave configurations (rh #838907)


author: Jiří Klimeš <jklimes@redhat.com> - 0.9.5.95-1.git20120713
changelog:
  - Update to 0.9.5.95 (0.9.6-rc1) snapshot
  - core: add autoconnect, driver-versioni and firmware-version properties to NMDevice
  - core: various IPv6 improvements
  - core: reduce number of changes made to DNS information during connection setup
  - core: add Vala language bindings
  - vpn: support IPv6 over VPNs
  - wifi: add on-demand WiFi scan support


author: Dan Williams <dcbw@redhat.com> - 0.9.3.997-1
changelog:
  - applet: move to network-manager-applet RPM
  - editor: move to nm-connection-editor RPM
  - libnm-gtk: move to libnm-gtk RPM


author: Dan Williams <dcbw@redhat.com> - 0.9.3.997-0.7
changelog:
  - Update to 0.9.3.997 (0.9.4-rc1)
  - core: fix possible WiFi hang when connecting to Ad-Hoc networks
  - core: enhanced IPv6 compatibility
  - core: proxy DNSSEC data when using the 'dnsmasq' caching nameserver plugin
  - core: allow VPNs to specify multiple domain names given by the server
  - core: fix an issue creating new InfiniBand connections
  - core/applet/editor: disable WiFi Ad-Hoc WPA connections until kernel bugs are fixed


author: Dan Williams <dcbw@redhat.com> - 0.9.3.995-0.6
changelog:
  - core: fix issue with carrier changes not being recognized (rh #800690)
  - editor: warn user if CA certificate is left blank


author: Dan Williams <dcbw@redhat.com> - 0.9.3.995-0.5
changelog:
  - core: fix a crash with ipw2200 devices and adhoc networks
  - core: fix IPv6 addressing on newer kernels
  - core: fix issue with VPN plugin passwords (rh #802540)
  - cli: enhancements for Bonding, VLAN, and OLPC mesh devices
  - ifcfg-rh: fix quoting WPA passphrases that include quotes (rh #798102)
  - libnm-glib: fix some issues with duplicate devices shown in menus


author: Dan Williams <dcbw@redhat.com> - 0.9.3.995-0.4
changelog:
  - Update to 0.9.3.995 (0.9.4-beta1)
  - core: add support for bonding and VLAN interfaces
  - core: add support for Internet connectivity detection
  - core: add support for IPv6 Privacy Extensions
  - core: fix interaction with firewalld restarts


author: Dan Williams <dcbw@redhat.com> - 0.9.3-0.1
changelog:
  - Update to 0.9.4 snapshot
  - wimax: enable optional support for Intel WiMAX devices
  - core: use nl80211 for WiFi device control
  - core: add basic support for Infiniband IP interfaces
  - core: add basic support for bonded interfaces
  - core: in-process IP configuration no longer blocks connected state


author: Dan Williams <dcbw@redhat.com> - 0.9.2-1
changelog:
  - core: fix possible crash when talking to ModemManager
  - core: improve handling of rfkill on some machines (eeepc 1005HA and others)
  - ifcfg-rh: don't use spaces in ifcfg file names (rh #742273)
  - core: accept IPv6 Router Advertisements when forwarding is on
  - core: bump dnsmasq cache size to 400 entries
  - core: ensure IPv6 static routes are flushed when device is deactivated
  - ifcfg-rh: fix changing WPA connections to WEP
  - core: fix setting hostname from DHCP (rh #719100)
  - libnm-glib: fix various GObject introspection issues (rh #747302)
  - core: don't change routing or DNS if no devices are managed
  - core: ensure IPv6 RA-provided routes are honored


author: Adam Williamson <awilliam@redhat.com> - 1:0.9.1.90-5.git20110927
changelog:
  - Rebuilt for glibc (rh #747377)
  - core: fix setting hostname from DHCP options (rh #719100)
  - skip a release to keep up with F16


author: Jiří Klimeš <jklimes@redhat.com> - 0.9.1.90-2.git20110927
changelog:
  - core: ifcfg-rh: remove newlines when writing to ifcfg files (CVE-2011-3364) (rh #737338)
  - core: change iscsiadm path to /sbin/iscsiadm in ifcfg-rh plugin (rh #740753)
  - core: fix refcounting when deleting a default wired connection (lp:797868)


author: Dan Williams <dcbw@redhat.com> - 0.9.1.90-1
changelog:
  - Update to 0.9.1.90 (0.9.2-beta1)
  - core: fix IPv6 link-local DNS servers in the dnsmasq DNS plugin
  - cli: add ability to delete connections
  - keyfile: fix an issue with duplicated keyfile connections
  - core: ensure the 'novj' option is passed through to pppd
  - core: store timestamps for VPN connections too (rh #725353)


author: Dan Williams <dcbw@redhat.com> - 0.9.0-1
changelog:
  - Update to 0.9 release
  - core: fix issue where scan results could be ignored
  - core: ensure agent secrets are preserved when updating connections
  - core: don't autoconnect disabled modems
  - core: fix race when checking modem enabled/disabled status after disabling
  - core: ensure newly installed VPN plugins can actually talk to NM
  - core: add support for 802.1X certificate subject matching
  - libnm-glib: various introspection fixes
  - applet/editor: updated translations


author: Dan Williams <dcbw@redhat.com> - 0.8.9997-6.git20110721
changelog:
  - core: updated Russian translation (rh #652904)
  - core: fix possible crash if secrets are missing
  - core: append interface name for IPv6 link-local DNS server addresses (rh #720001)
  - core: fix setting hostname from DHCP options (rh #719100)
  - libnm-util: GObject introspection annotation fixes
  - libnm-util: ensure IP address/route prefixes are valid
  - ifcfg-rh: read anonymous identity for 802.1x PEAP connections (rh #708436)
  - applet: show notifications on CDMA home/roaming changes
  - applet: fix various issues saving VPN secrets
  - editor: allow exporting VPN secrets
  - editor: default to IPv6 "automatic" addressing mode


author: Dan Williams <dcbw@redhat.com> - 0.8.9997-5.git20110702
changelog:
  - core: ensure users are authorized for shared wifi connections (CVE-2011-2176) (rh #715492)
  - core: retry failed connections after 5 minute timeout
  - core: immediately request new 802.1x 'always ask' passwords if they fail
  - core: add MAC blacklisting capability for WiFi and Wired connections
  - core: retry failed connections when new users log in (rh #706204)
  - applet: updated translations
  - core: drop compat interface now that KDE bits are updated to NM 0.9 API


author: Dan Williams <dcbw@redhat.com> - 0.8.9997-4.git20110620
changelog:
  - core: don't cache "(none)" hostname at startup (rh #706094)
  - core: fix handling of VPN connections with only system-owned secrets
  - core: fix optional waiting for networking at startup behavior (rh #710502)
  - ifcfg-rh: fix possible crashes in error cases
  - ifcfg-rh: fix various IPv4 and IPv6 handling issues
  - applet: add notifications of GSM mobile broadband registration status
  - editor: move secrets when making connections available to all users or private
  - applet: don't show irrelevant options when asking for passwords


author: Dan Williams <dcbw@redhat.com> - 0.8.9997-3.git20110613
changelog:
  - keyfile: better handling of missing certificates/private keys
  - core: fix issues handling "always-ask" wired and WiFi 802.1x connections (rh #703785)
  - core: fix automatic handling of hidden WiFi networks (rh #707406)
  - editor: fix possible crash after reading network connections (rh #706906)
  - editor: make Enter/Return key close WiFi password dialogs (rh #708666)


author: Dan Williams <dcbw@redhat.com> - 0.8.9997-1.git20110531
changelog:
  - editor: fix resizing of UI elements (rh #707269)
  - core: retry wired connections when cable is replugged
  - core: fix a few warnings and remove some left-over debugging code


author: Dan Williams <dcbw@redhat.com> - 0.8.999-3.git20110526
changelog:
  - compat: fix activation/deactivation of VPN connections (rh #699786)
  - core: fix autodetection of previously-used hidden wifi networks
  - core: silence error if ConsoleKit database does not yet exist (rh #695617)
  - core: fix Ad-Hoc frequency handling (rh #699203)
  - core: fixes for migrated OpenConnect VPN plugin connections
  - core: various fixes for VPN connection secrets handling
  - core: send only short hostname to DHCP servers (rh #694758)
  - core: better handling of PKCS#8 private keys
  - core: fix dispatcher script interface name handling
  - editor: fix potential crash when connection is invalid (rh #704848)
  - editor: allow _ as a valid character for GSM APNs


author: Dan Williams <dcbw@redhat.com> - 0.8.999-2.git20110509
changelog:
  - core: fix possible crash when connections are deleted
  - core: fix exported symbols in libnm-util and libnm-glib
  - core/applet: updated translations


author: Dan Williams <dcbw@redhat.com> - 0.8.999-1
changelog:
  - core: ensure DER format certificates are correctly recognized (rh #699591)
  - core: fix WINS server handling in client helper libraries
  - core: enhance dispatcher script environment to include IPv6 and VPN details
  - applet: migrate openswan connections to 0.9
  - editor: improve usability of editing IP addresses (rh #698199)


author: Dan Williams <dcbw@redhat.com> - 0.8.998-4.git20110427
changelog:
  - core: enable optimized background roaming for WPA Enterprise configs
  - core: better handling of WiFi and WiMAX rfkill (rh #599002)
  - applet: fix crash detecting Bluetooth DUN devices a second time
  - ifcfg-rh: fix managed/unmanaged changes when removing connections (rh #698202)


author: Dan Williams <dcbw@redhat.com> - 0.8.998-3.git20110419
changelog:
  - core: systemd and startup enhancements for NFS mounts
  - core: more efficient startup process
  - core: fix handling of multiple logins when one is inactive
  - core: fix handling of S390/Hercules CTC network interfaces (rh #641986)
  - core: support Easytether interfaces for Android phones
  - core: fix handling of WWAN enable/disable states
  - ifcfg-rh: harmonize handling if IPADDR/PREFIX/NETMASK with initscripts (rh #658907)
  - applet: fix connection to WPA Enterprise networks (rh #694765)


author: Dan Williams <dcbw@redhat.com> - 0.8.998-1
changelog:
  - Update to 0.8.998 (0.9.0-rc1)
  - core: fix near-infinite requests for passwords (rh #692783)
  - core: fix handling of wired 802.1x connections
  - core: ignore Nokia PC-Suite ethernet devices we can't use yet
  - applet: migrate 0.8 OpenVPN passwords to 0.9 formats


author: Dan Williams <dcbw@redhat.com> - 0.8.997-8.git20110331
changelog:
  - core: resurrect default VPN username
  - core: don't stomp on crypto library users by de-initing the crypto library


author: Dan Williams <dcbw@redhat.com> - 0.8.997-7.git20110330
changelog:
  - core: fix creation of default wired connections
  - core: fix requesting new secrets when old ones fail (ex changing WEP keys)
  - editor: ensure all pages are sensitive after retrieving secrets
  - editor: fix crash when scrolling through connection lists (rh #693446)
  - applet: fix crash after using the wifi or wired secrets dialogs (rh #693446)


author: Dan Williams <dcbw@redhat.com> - 0.8.997-5.git20110328
changelog:
  - core: fix connection deactivation on the compat interface
  - core: give default wired connections a more friendly name
  - core: fix base type of newly created wired connections
  - applet: many updated translations


author: Dan Williams <dcbw@redhat.com> - 0.8.997-4.git20110325
changelog:
  - core: fix possible libnm-glib crash when activating connections
  - applet: fix various naming and dialog title issues


author: Dan Williams <dcbw@redhat.com> - 0.8.997-1
changelog:
  - Update to 0.8.997 (0.9-beta3)
  - ifcfg-rh: fix reading and writing of Dynamic WEP connections using LEAP as the eap method
  - wifi: fix signal strength for scanned access points with some drivers
  - applet: translation updates


author: Dan Williams <dcbw@redhat.com> - 0.8.995-1.git20110308
changelog:
  - Update to NetworkManager 0.9-beta1
  - core: consolidate user and system settings services into NM itself
  - core: add WiMAX support
  - applet: support Fast User Switching


author: Dan Williams <dcbw@redhat.com> - 0.8.1-9
changelog:
  - core: fix suspend/resume regression (rh #638640)
  - core: fix issue causing some nmcli requests to be ignored


author: Dan Williams <dcbw@redhat.com> - 0.8.1-6
changelog:
  - core: add dispatcher events on DHCPv4 and DHCPv6 lease changes
  - core: enforce access permissions when enabling/disabling WiFi and WWAN (rh #626337)
  - core: listen for UPower suspend/resume signals
  - applet: fix disabled Enable Networking and Enable Wireless menu items (rh #627365)
  - applet: updated translations
  - applet: obscure Mobile Broadband PIN in secondary unlock dialog


author: Dan Williams <dcbw@redhat.com> - 0.8.1-2
changelog:
  - core: quiet annoying warnings (rh #612991)
  - core: fix retrieval of various IP options in libnm-glib (rh #611141)
  - core: ship NetworkManager.conf instead of deprecated nm-system-settings.conf (rh #606160)
  - core: add short hostname to /etc/hosts too (rh #621910)
  - core: recheck autoactivation when new system connections appear
  - core: enable DHCPv6-only configurations (rh #612445)
  - core: don't fail connection immediately if DHCP lease expires (rh #616084) (rh #590874)
  - core: fix editing of PPPoE system connections
  - core: work around twitchy frequency reporting of various wifi drivers
  - core: don't tear down user connections on console changes (rh #614556)
  - cli: wait a bit for NM's permissions check to complete (rh #614866)
  - ifcfg-rh: ignore BRIDGE and VLAN configs and treat as unmanaged (rh #619863)
  - man: add manpage for nm-online
  - applet: fix crash saving ignore-missing-CA-cert preference (rh #619775)
  - applet: hide PIN/PUK by default in the mobile PIN/PUK dialog (rh #615085)
  - applet: ensure Enter closes the PIN/PUK dialog (rh #611831)
  - applet: fix another crash in ignore-CA-certificate handling (rh #557495)
  - editor: fix handling of Wired/s390 connections (rh #618620)
  - editor: fix crash when canceling editing in IP address pages (rh #610891)
  - editor: fix handling of s390-specific options
  - editor: really fix crash when changing system connections (rh #603566)


author: Dan Williams <dcbw@redhat.com> - 0.8.1-1
changelog:
  - core: read nm-system-settings.conf before NetworkManager.conf (rh #606160)
  - core: fix editing system DSL connections when using keyfile plugin
  - core: work around inconsistent proprietary driver associated AP reporting
  - core: ensure empty VPN secrets are not used (rh #587784)
  - core: don't request WiFi scans when connection is locked to a specific BSSID
  - cli: show IPv6 settings and configuration
  - applet: updated translations
  - editor: fix a PolicyKit-related crash editing connections (rh #603566)
  - applet: fix saving the ignore-missing-CA-cert preference (rh #610084)
  - editor: fix listing connections on PPC64 (rh #608663)
  - editor: ensure editor windows are destroyed when closed (rh #572466)


author: Dan Williams <dcbw@redhat.com> - 0.8.1-0.4
changelog:
  - Update to 0.8.1 release candidate
  - core: fix WWAN hardware enable state tracking (rh #591622)
  - core: fix Red Hat initscript return value on double-start (rh #584321)
  - core: add multicast route entry for IPv4 link-local connections
  - core: fix connection sharing in cases where a dnsmasq config file exists
  - core: fix handling of Ad-Hoc wifi connections to indicate correct network
  - core: ensure VPN interface name is passed to dispatcher when VPN goes down
  - ifcfg-rh: fix handling of ASCII WEP keys
  - ifcfg-rh: fix double-quoting of some SSIDs (rh #606518)
  - applet: ensure deleted connections are actually forgotten (rh #618973)
  - applet: don't crash if the AP's BSSID isn't availabe (rh #603236)
  - editor: don't crash on PolicyKit events after windows are closed (rh #572466)


author: Dan Williams <dcbw@redhat.com> - 0.8.1-0.3
changelog:
  - core: fix nm-online crash (rh #593677)
  - core: fix failed suspend disables network (rh #589108)
  - core: print out missing firmware errors (rh #594578)
  - applet: fix device descriptions for some mobile broadband devices
  - keyfile: bluetooth fixes
  - applet: updated translations (rh #589230)


author: Dan Williams <dcbw@redhat.com> - 0.8.1-0.2.git20100519
changelog:
  - core: use GIO in local mode only (rh #588745)
  - core: updated translations (rh #589230)
  - core: be more lenient in IPv6 RDNSS server expiry (rh #590202)
  - core: fix headers to be C++ compatible (rh #592783)
  - applet: updated translations (rh #589230)
  - applet: lock connections with well-known SSIDs to their specific AP


author: Dan Williams <dcbw@redhat.com> - 0.8.1-0.1.git20100510
changelog:
  - core: fix handling of IPv6 RA flags when router goes away (rh #588560)
  - bluetooth: fix crash configuring DUN connections from the wizard (rh #590666)


author: Dan Williams <dcbw@redhat.com> - 0.8-13.git20100509
changelog:
  - core: restore initial accept_ra value for IPv6 ignored connections (rh #588619)
  - bluetooth: fix bad timeout on PAN connections (rh #586961)
  - applet: updated translations


author: Dan Williams <dcbw@redhat.com> - 0.8-12.git20100504
changelog:
  - core: treat missing IPv6 configuration as ignored (rh #588814)
  - core: don't flush IPv6 link-local routes (rh #587836)
  - cli: update output formatting


author: Dan Williams <dcbw@redhat.com> - 0.8-11.git20100503
changelog:
  - core: allow IP configuration as long as one method completes (rh #567978)
  - core: don't prematurely remove IPv6 RDNSS nameservers (rh #588192)
  - core: ensure router advertisements are only used when needed (rh #588613)
  - editor: add IPv6 gateway editing capability


author: Dan Williams <dcbw@redhat.com> - 0.8-10.git20100502
changelog:
  - core: IPv6 autoconf, DHCP, link-local, and manual mode fixes
  - editor: fix saving IPv6 address in user connections


author: Dan Williams <dcbw@redhat.com> - 0.8-8.git20100426
changelog:
  - core: fix issues with IPv6 router advertisement mishandling (rh #530670)
  - core: many fixes for IPv6 RA and DHCP handling (rh #538499)
  - core: ignore WWAN ethernet devices until usable (rh #585214)
  - ifcfg-rh: fix handling of WEP passphrases (rh #581718)
  - applet: fix crashes (rh #582938) (rh #582428)
  - applet: fix crash with multiple concurrent authorization requests (rh #585405)
  - editor: allow disabling IPv4 on a per-connection basis
  - editor: add support for IPv6 DHCP-only configurations


author: Dan Williams <dcbw@redhat.com> - 0.8-7.git20100422
changelog:
  - core: fix crash during install (rh #581794)
  - wifi: fix crash when supplicant segfaults after resume (rh #538717)
  - ifcfg-rh: fix MTU handling for wired connections (rh #569319)
  - applet: fix display of disabled mobile broadband devices


author: Dan Williams <dcbw@redhat.com> - 0.8-5.git20100408
changelog:
  - core: more flexible logging
  - core: fix crash with OLPC mesh devices after suspend
  - applet: updated translations
  - applet: show mobile broadband signal strength and technology in the icon
  - applet: fix continuous password requests for 802.1x connections (rh #576925)
  - applet: many updated translations


author: Dan Williams <dcbw@redhat.com> - 0.8-3.git20100323
changelog:
  - core: don't exit early on non-fatal state file errors
  - core: fix Bluetooth connection issues (rh #572340)
  - applet: fix some translations (rh #576056)
  - applet: better feedback when wrong PIN/PUK is entered
  - applet: many updated translations
  - applet: PIN2 unlock not required for normal modem functionality
  - applet: fix wireless secrets dialog display


author: Dan Williams <dcbw@redhat.com> - 0.8-2.git20100317
changelog:
  - man: many manpage updates
  - core: determine classful prefix if non is given via DHCP
  - core: ensure /etc/hosts is always up-to-date and correct (rh #569914)
  - core: support GSM network and roaming preferences
  - applet: startup speed enhancements
  - applet: better support for OTP/token-based WiFi connections (rh #526383)
  - applet: show GSM and CDMA registration status and signal strength when available
  - applet: fix zombie GSM and CDMA devices in the menu
  - applet: remove 4-character GSM PIN/PUK code limit
  - applet: fix insensitive WiFi Create... button (rh #541163)
  - applet: allow unlocking of mobile devices immediately when plugged in


author: Dan Williams <dcbw@redhat.com> - 0.8-1.git20100219
changelog:
  - core: update to final 0.8 release
  - core: fix Bluetooth DUN connections when secrets are needed
  - ifcfg-rh: add helper for initscripts to determine ifcfg connection UUIDs
  - applet: fix Bluetooth connection secrets requests
  - applet: fix rare conflict with other gnome-bluetooth plugins


author: Dan Williams <dcbw@redhat.com> - 0.8-0.4.git20100211
changelog:
  - core: fix mobile broadband PIN handling (rh #543088) (rh #560742)
  - core: better handling of /etc/hosts if hostname was already added by the user
  - applet: crash less on D-Bus property errors (rh #557007)
  - applet: fix crash entering wired 802.1x connection details (rh #556763)


author: Kevin Kofler <Kevin@tigcc.ticalc.org> - 0.8-0.3.git20100129
changelog:
  - core: validate the autostart .desktop file
  - build: fix nmcli for the stricter ld (fixes FTBFS)
  - build: fix nm-connection-editor for the stricter ld (fixes FTBFS)
  - applet: don't autostart in KDE on F13+ (#541353)


author: Dan Williams <dcbw@redhat.com> - 0.8-0.2.git20100129
changelog:
  - core: add Bluetooth Dial-Up Networking (DUN) support (rh #136663)
  - core: start DHCPv6 on receipt of RA 'otherconf'/'managed' bits
  - nmcli: allow enable/disable of WiFi and WWAN


author: Dan Williams <dcbw@redhat.com> - 0.7.999-1.git20100120
changelog:
  - core: support for managed-mode DHCPv6 (rh #429710)
  - ifcfg-rh: gracefully handle missing PREFIX/NETMASK
  - cli: initial preview of command-line client
  - applet: add --help to explain what the applet is (rh #494641)


author: Dan Williams <dcbw@redhat.com> - 0.7.998-1.git20100106
changelog:
  - build: fix for new pppd (rh #548520)
  - core: add WWAN enable/disable functionality
  - ifcfg-rh: IPv6 addressing and routes support (rh #523288)
  - ifcfg-rh: ensure connection is updated when route/key files change
  - applet: fix crash when active AP isn't found (rh #546901)
  - editor: fix crash when editing connections (rh #549579)


author: Dan Williams <dcbw@redhat.com> - 0.7.997-2.git20091214
changelog:
  - core: fix recognition of standalone 802.1x private keys
  - applet: clean notification text to ensure it passes libnotify validation


author: Dan Williams <dcbw@redhat.com> - 0.7.997-1
changelog:
  - core: remove haldaemon from initscript dependencies (rh #542078)
  - core: handle PEM certificates without an ending newline (rh #507315)
  - core: fix rfkill reporting for ipw2x00 devices
  - core: increase PPPoE timeout to 30 seconds
  - core: fix re-activating system connections with secrets
  - core: fix crash when deleting automatically created wired connections
  - core: ensure that a VPN's DNS servers are used when sharing the VPN connection
  - ifcfg-rh: support routes files (rh #507307)
  - ifcfg-rh: warn when device will be managed due to missing HWADDR (rh #545003)
  - ifcfg-rh: interpret DEFROUTE as never-default (rh #528281)
  - ifcfg-rh: handle MODE=Auto correctly
  - rpm: fix rpmlint errors
  - applet: don't crash on various D-Bus and other errors (rh #545011) (rh #542617)
  - editor: fix various PolicyKit-related crashes (rh #462944)
  - applet+editor: notify user that private keys must be protected


author: Dan Williams <dcbw@redhat.com> - 0.7.996-7.git20091113
changelog:
  - nm: better pidfile handing (rh #517362)
  - nm: save WiFi and Networking enabled/disabled states across reboot
  - nm: fix crash with missing VPN secrets (rh #532084)
  - applet: fix system connection usage from the "Connect to hidden..." dialog
  - applet: show Bluetooth connections when no other devices are available (rh #532049)
  - applet: don't die when autoconfigured connections can't be made (rh #532680)
  - applet: allow system administrators to disable the "Create new wireless network..." menu item
  - applet: fix missing username connecting to VPNs the second time
  - applet: really fix animation stuttering
  - editor: fix IP config widget tooltips
  - editor: allow unlisted countries in the mobile broadband wizard (rh #530981)
  - ifcfg-rh: ignore .rpmnew files (rh #509621)


author: Dan Williams <dcbw@redhat.com> - 0.7.996-5.git20091021
changelog:
  - install: better fix for (rh #526519)
  - install: don't build Bluetooth bits on s390 (rh #529854)
  - nm: wired 802.1x connection activation fixes
  - nm: fix crash after modifying default wired connections like "Auto eth0"
  - nm: ensure VPN secrets are requested again after connection failure
  - nm: reset 'accept_ra' to previous value after deactivating IPv6 connections
  - nm: ensure random netlink events don't interfere with IPv6 connection activation
  - ifcfg-rh: fix writing out LEAP connections
  - ifcfg-rh: recognize 'static' as a valid BOOTPROTO (rh #528068)
  - applet: fix "could not find required resources" error (rh #529766)


author: Dan Williams <dcbw@redhat.com> - 0.7.996-4.git20091002
changelog:
  - install: fix -gnome package pre script failures (rh #526519)
  - nm: fix failures validating private keys when using the NSS crypto backend
  - applet: fix crashes when clicking on menu but not associated (rh #526535)
  - editor: fix crash editing wired 802.1x settings
  - editor: fix secrets retrieval when editing connections


author: Dan Williams <dcbw@redhat.com> - 0.7.996-3.git20090928
changelog:
  - nm: fix connection takeover when carrier is not on
  - nm: handle certificate paths (CA chain PEM files are now fully usable)
  - nm: defer action for 4 seconds when wired carrier drops
  - ifcfg-rh: fix writing WPA passphrases with odd characters
  - editor: fix editing of IPv4 settings with new connections (rh #525819)
  - editor: fix random crashes when editing due to bad widget refcounting
  - applet: debut reworked menu layout (not final yet...)


author: Dan Williams <dcbw@redhat.com> - 0.7.996-2.git20090921
changelog:
  - nm: allow disconnection of all device types
  - nm: ensure that wired connections are torn down when their hardware goes away
  - nm: fix crash when canceling a VPN's request for secrets
  - editor: fix issues changing connections between system and user scopes
  - editor: ensure changes are thrown away when editing is canceled
  - applet: ensure connection changes are noticed by NetworkManager
  - applet: fix crash when creating new connections
  - applet: actually use wired 802.1x secrets after they are requested


author: Dan Williams <dcbw@redhat.com> - 0.7.996-1.git20090826
changelog:
  - nm: IPv6 zeroconf support and fixes
  - nm: port to polkit (rh #499965)
  - nm: fixes for ehea devices (rh #511304) (rh #516591)
  - nm: work around PPP bug causing bogus nameservers for mobile broadband connections
  - editor: fix segfault with "Unlisted" plans in the mobile broadband assistant


author: Dan Williams <dcbw@redhat.com> - 0.7.995-3.git20090813
changelog:
  - nm: add iSCSI support
  - nm: add connection assume/takeover support for ethernet (rh #517333)
  - nm: IPv6 fixes
  - nm: re-add OLPC XO-1 mesh device support (removed with 0.7.0)
  - applet: better WiFi dialog focus handling


author: Dan Williams <dcbw@redhat.com> - 0.7.995-0.git20090728
changelog:
  - Update to upstream 'master' branch
  - Use modem-manager for better 3G modem support
  - Integrated system settings with NetworkManager itself
  - Use udev instead of HAL


author: Dan Williams <dcbw@redhat.com> - 0.7.1-7.git20090708
changelog:
  - nm: fixes for ZTE/Onda modem detection
  - nm: prevent re-opening serial port when the SIM has a PIN
  - applet: updated translations
  - editor: show list column headers


author: Dan Williams <dcbw@redhat.com> - 0.7.1-5.git20090617
changelog:
  - nm: fix AT&T Quicksilver modem connections (rh #502002)
  - nm: fix support for s390 bus types (rh #496820)
  - nm: fix detection of some CMOtech modems
  - nm: handle unsolicited wifi scans better
  - nm: resolv.conf fixes when using DHCP and overriding search domains
  - nm: handle WEP and WPA passphrases (rh #441070)
  - nm: fix removal of old APs when none are scanned
  - nm: fix Huawei EC121 and EC168C detection and handling (rh #496426)
  - applet: save WEP and WPA passphrases instead of hashed keys (rh #441070)
  - applet: fix broken notification bubble actions
  - applet: default to WEP encryption for Ad-Hoc network creation
  - applet: fix crash when connection editor dialogs are canceled
  - applet: add a mobile broadband provider wizard


author: Adam Jackson <ajax@redhat.com> 1:0.7.1-4.git20090414
changelog:
  - nm-save-the-leases.patch: Use per-connection lease files, and don't delete
    them on interface deactivate.


author: Dan Williams <dcbw@redhat.com> - 1:0.7.1-1
changelog:
  - nm: update to 0.7.1
  - nm: fix startup race with HAL causing unmanaged devices to sometimes be managed (rh #494527)


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0.100-2.git20090408
changelog:
  - nm: fix recognition of Option GT Fusion and Option GT HSDPA (nozomi) devices (rh #494069)
  - nm: fix handling of spaces in DHCP 'domain-search' option
  - nm: fix detection of newer Option 'hso' devices
  - nm: ignore low MTUs returned by broken DHCP servers


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0.100-1
changelog:
  - Update to 0.7.1-rc4
  - nm: use PolicyKit for system connection secrets retrieval
  - nm: correctly interpret errors returned from chmod(2) when saving keyfile system connections
  - editor: use PolicyKit to get system connection secrets


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0.99-5
changelog:
  - nm: fix crashes with out-of-tree modules that provide no driver link (rh #492246)
  - nm: fix USB modem probing on recent udev versions


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0.99-4
changelog:
  - nm: fix communication with Option GT Max 3.6 mobile broadband cards
  - nm: fix communication with Huawei mobile broadband cards (rh #487663)
  - nm: don't look up hostname when HOSTNAME=localhost unless asked (rh #490184)
  - nm: fix crash during IP4 configuration (rh #491620)
  - nm: ignore ONBOOT=no for minimal ifcfg files (f9 & f10 only) (rh #489398)
  - applet: updated translations


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0.99-3.5
changelog:
  - nm: work around unhandled device removals due to missing HAL events (rh #484530)
  - nm: improve handling of multiple modem ports
  - nm: support for Sony Ericsson F3507g / MD300 and Dell 5530
  - applet: updated translations


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0.99-2
changelog:
  - Fix conflict with NetworkManager-openconnect (rh #489271)
  - Fix possible crash when resynchronizing devices if HAL restarts


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0.99-1
changelog:
  - nm: make default wired "Auto ethX" connection modifiable if an enabled system settings
      plugin supports modifying connections (rh #485555)
  - nm: manpage fixes (rh #447233)
  - nm: CVE-2009-0365 - GetSecrets disclosure
  - applet: CVE-2009-0578 - local users can modify the connection settings
  - applet: fix inability to choose WPA Ad-Hoc networks from the menu
  - ifcfg-rh: add read-only support for WPA-PSK connections


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0.98-1.git20090225
changelog:
  - Fix getting secrets for system connections (rh #486696)
  - More compatible modem autodetection
  - Better handle minimal ifcfg files


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0.97-5.git20090220
changelog:
  - Use IFF_LOWER_UP for carrier detect instead of IFF_RUNNING
  - Add small delay before probing cdc-acm driven mobile broadband devices


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0.97-4.git20090219
changelog:
  - Fix PEAP version selection in the applet (rh #468844)
  - Match hostname behavior to 'network' service when hostname is localhost (rh #441453)


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0.97-1
changelog:
  - Update to 0.7.1rc1
  - nm: support for Huawei E160G mobile broadband devices (rh #466177)
  - nm: fix misleading routing error message (rh #477916)
  - nm: fix issues with 32-character SSIDs (rh #485312)
  - nm: allow root to activate user connections
  - nm: automatic modem detection with udev-extras
  - nm: massive manpage rewrite
  - applet: fix crash when showing the CA certificate ignore dialog a second time
  - applet: clear keyring items when deleting a connection
  - applet: fix max signal strength calculation in menu (rh #475123)
  - applet: fix VPN export (rh #480496)


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-2.git20090207
changelog:
  - applet: fix blank VPN connection message bubbles
  - applet: better handling of VPN routing on update
  - applet: silence pointless warning (rh #484136)
  - applet: desensitize devices in the menu until they are ready (rh #483879)
  - nm: Expose WINS servers in the IP4Config over D-Bus
  - nm: Better handling of GSM Mobile Broadband modem initialization
  - nm: Handle DHCP Classless Static Routes (RFC 3442)
  - nm: Fix Mobile Broadband and PPPoE to always use 'noauth'
  - nm: Better compatibility with older dual-SSID AP configurations (rh #445369)
  - nm: Mark nm-system-settings.conf as config (rh #465633)
  - nm-tool: Show VPN connection information
  - ifcfg-rh: Silence message about ignoring loopback config (rh #484060)
  - ifcfg-rh: Fix issue with wrong gateway for system connections (rh #476089)


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-1.git20090102
changelog:
  - Update to 0.7.1 pre-release
  - Allow connections to be ignored when determining the default route (rh #476089)
  - Own /usr/share/gnome-vpn-properties (rh #477155)
  - Fix log flooding due to netlink errors (rh #459205)
  - Pass connection UUID to dispatcher scripts via the environment
  - Fix possible crash after deactivating a VPN connection
  - Fix issues with editing wired 802.1x connections
  - Fix issues when using PKCS#12 certificates with 802.1x connections


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.12.svn4296
changelog:
  - Fix PIN/PUK issues with high-speed Option HSDPA mobile broadband cards
  - Fix desensitized OK button when asking for wireless keys


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.12.svn4295
changelog:
  - Fix issues reading ifcfg files
  - Previously fixed:
  - Doesn't send DHCP hostname (rh #469336)
  - 'Auto eth0' forgets settings (rh #468612)
  - DHCP renewal sometimes breaks VPN (rh #471852)
  - Connection editor menu item in the wrong place (rh #471495)
  - Cannot make system-wide connections (rh #471308)


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.12.svn4293
changelog:
  - Update to NetworkManager 0.7.0 RC2
  - Handle gateways on a different subnet from the interface
  - Clear VPN secrets on connection failure to ensure they are requested again (rh #429287)
  - Add support for PKCS#12 private keys (rh #462705)
  - Fix mangling of VPN's default route on DHCP renew
  - Fix type detection of qemu/kvm network devices (rh #466340)
  - Clear up netmask/prefix confusion in the connection editor
  - Make the secrets dialog go away when it's not needed
  - Fix inability to add system connections (rh #471308)


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.11.svn4229
changelog:
  - More reliable mobile broadband card initialization
  - Handle mobile broadband PINs correctly when PPP passwords are also used
  - Additional PolicyKit integration for editing system connections
  - Close the applet menu if a keyring password is needed (rh #353451)


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.11.svn4201
changelog:
  - Fix issues with hostname during anaconda installation (rh #461933)
  - Fix Ad-Hoc WPA connections (rh #461197)
  - Don't require gnome-panel or gnome-panel-devel (rh #427834)
  - Fix determination of WPA encryption capabilities on some cards
  - Fix conflicts with PPTP and vpnc plugins
  - Allow .cer file extensions when choosing certificates


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.11.svn4174
changelog:
  - Ensure that mobile broadband cards are powered up before trying to use them
  - Hostname changing support (rh #441453)
  - Fix mobile broadband secret requests to happen less often
  - Better handling of default devices and default routes
  - Better information in tooltips and notifications
  - Various UI cleanups; hide widgets that aren't used (rh #465397, rh #465395)
  - Accept different separators for DNS servers and searches
  - Make applet's icon accurately reflect signal strength of the current AP


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.11.svn4022
changelog:
  - Fix parsing of DOMAIN in ifcfg files (rh #459370)
  - Fix reconnection to mobile broadband networks after an auth failure
  - Fix recognition of timeouts of PPP during mobile broadband connection
  - More compatible connection sharing (rh #458625)
  - Fix DHCP in minimal environments without glibc locale information installed
  - Add support for Option mobile broadband devices (like iCON 225 and iCON 7.2)
  - Add IP4 config information to dispatcher script environment
  - Merge WEP ASCII and Hex key types for cleaner UI
  - Pre-fill PPPoE password when authentication fails
  - Fixed some changes not getting saved in the connection editor
  - Accept both prefix and netmask in the conection editor's IPv4 page


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.11.svn3927
changelog:
  - Expose DHCP-returned options over D-Bus and to dispatcher scripts
  - Add support for customized static routes
  - Handle multiple concurrent 3G or PPPoE connections
  - Fix GSM/CDMA username and password issues
  - Better handling of unmanaged devices from ifcfg files
  - Fix timeout handling of errors during 3G connections
  - Fix some routing issues (rh #456685)
  - Fix applet crashes after removing a device (rh #457380)


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.11.svn3846
changelog:
  - Convert stored IPv4 static IP addresses to new prefix-based scheme automatically
  - Fix pppd connections to some 3G providers (rh #455348)
  - Make PPPoE "Show Password" option work
  - Hide IPv4 config options that don't make sense in certain configurations


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.11.svn3830
changelog:
  - Expose server-returned DHCP options via D-Bus
  - Use avahi-autoipd rather than old built-in IPv4LL implementation
  - Send hostname to DHCP server if provided (DHCP_HOSTNAME ifcfg option)
  - Support sending DHCP Client Identifier to DHCP server
  - Allow forcing 802.1x PEAP Label to '0'
  - Make connection sharing more robust
  - Show status for shared and Ad-Hoc connections if no other connection is active


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.10.svn3801
changelog:
  - Move VPN configuration into connection editor
  - Fix mobile broadband username/password issues
  - Fix issues with broken rfkill setups (rh #448889)
  - Honor APN setting for GSM mobile broadband configurations
  - Fix adding CDMA connections in the connection editor


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.9.4.svn3675
changelog:
  - Move NM later in the shutdown process (rh #449070)
  - Move libnm-util into a subpackage to allow NM to be removed more easily (rh #351101)


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.9.3.svn3675
changelog:
  - Read global gateway from /etc/sysconfig/network if missing (rh #446527)
  - nm-system-settings now terminates when dbus goes away (rh #444976)


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.9.3.svn3667
changelog:
  - Restore behavior of marking wifi devices as "down" when disabling wireless
  - Fix a crash on resume when a VPN was active when going to sleep


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.9.3.svn3665
changelog:
  - Fix issues with the Fedora plugin not noticing changes made by
      system-config-network (rh #444502)
  - Allow autoconnection of GSM and CDMA connections
  - Multiple IP address support for user connections
  - Fixes for Mobile Broadband cards that return line speed on connect
  - Implement PIN entry for GSM mobile broadband connections
  - Fix crash when editing unencrypted WiFi connections in the connection editor


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.9.2.svn3622
changelog:
  - Guess WEP key type in applet when asking for new keys
  - Correct OK button sensitivity in applet when asking for new WEP keys


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.9.2.svn3619
changelog:
  - Fix device initialization race that caused ethernet devices to get stuck on
      startup
  - Fix PPPoE connections not showing up in the applet
  - Fix disabled OK button in connection editor some wireless and IP4 settings
  - Don't exit if HAL isn't up yet; wait for it
  - Fix a suspend/resume crash


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.9.2.svn3614
changelog:
  - Don't ask for wireless keys when the driver sends disconnect events during
  	association; wait until the entire assocation times out
  - Replace dispatcher daemon with D-Bus activated callout
  - Fix parsing of DNS2 and DNS3 ifcfg file items
  - Execute dispatcher scripts in alphabetical order
  - Be active at runlevel 2
  - Hook up MAC address widgets for wired & wireless; and BSSID widget for wireless
  - Pre-populate anonymous identity and phase2 widgets correctly
  - Clear out unused connection keys from GConf


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.9.2.svn3590
changelog:
  - Don't select devices without a default gateway as the default route (rh #437338)
  - Fill in broadcast address if not specified (rh #443474)
  - Respect manual VPN IPv4 configuration options
  - Show Connection Information for the device with the default route only


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.9.2.svn3578
changelog:
  - Add dbus-glib-devel BuildRequires for NetworkManager-glib-devel (rh #442978)
  - Add PPP settings page to connection editor
  - Fix a few crashes with PPPoE
  - Fix active connection state changes that confused clients


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.9.1.svn3566
changelog:
  - Turn on Add/Edit in the connection editor
  - Don't flush or change IPv6 addresses or routes
  - Enhance nm-online tool
  - Some serial communication fixes for mobile broadband


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.9.1.svn3547
changelog:
  - Fix WEP key index handling in UI
  - Fix handling of NM_CONTROLLED in ifcfg files
  - Show device managed state in applet menu
  - Show wireless enabled state in applet menu
  - Better handling of default DHCP connections for wired devices
  - Fix loading of connection editor on KDE (rh #435344)


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.9.1.svn3521
changelog:
  - Show VPN failures
  - Support Static WEP key indexes
  - Fix parsing of WEP keys from ifcfg files
  - Pre-fill wireless security UI bits in connection editor and applet


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.9.1.svn3472
changelog:
  - Fix crashes on suspend/resume and exit (rh #437426)
  - Ensure there's always an option to chose the wired device
  - Never set default route via an IPv4 link-local addressed device (rh #437338)


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.8.svn3417
changelog:
  - Honor DHCP rebinds
  - Multiple active device support
  - Better error handling of mobile broadband connection failures
  - Allow use of interface-specific dhclient config files
  - Recognize system settings which have no TYPE item


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.8.svn3370
changelog:
  - Fix crash of nm-system-settings on malformed ifcfg files (rh #434919)
  - Require gnome-icon-theme to pick up lock.png (rh #435344)
  - Fix applet segfault after connection removal via connection editor or GConf


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.8.svn3302
changelog:
  - Enable system settings service
  - Allow explicit disconnection of mobile broadband devices
  - Fix applet memory leaks (rh #430178)
  - Applet Connection Information dialog tweaks (gnome.org #505899)
  - Filter input characters to passphrase/key entry (gnome.org #332951)
  - Fix applet focus stealing prevention behavior


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.8.svn3261
changelog:
  - Add CDMA mobile broadband support (if supported by HAL)
  - Rework applet connection and icon handling
  - Enable connection editor (only for deleting connections)


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.8.svn3235
changelog:
  - Fix crash when activating a mobile broadband connection
  - Better handling of non-SSID-broadcasting APs on kernels that support it
      (gnome.org #464215) (rh #373841)
  - Honor DHCP-server provided MTU if present (gnome.org #332953)
  - Use previous DNS settings if the VPN concentrator doesn't provide any
      (gnome.org #346833)


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.8.svn3138
changelog:
  - Fix applet connection comparison which failed to send connection updated
      signals to NM in some cases
  - Make VPN connection applet more robust against plugin failures


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.8.svn3133
changelog:
  - Fix applet crash when choosing to ignore the CA certificate (rh #359001)
  - Fix applet crash when editing VPN properties and VPN connection failures (rh #409351)
  - Add file filter name in certificate file picker dialog (rh #410201)
  - No longer start named when starting NM (rh #381571)


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.6.3.svn3096
changelog:
  - Fix connections when picking a WPA Enterprise AP from the menu
  - Fix issue where applet would provide multiple same connections to NM


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.6.2.svn3080
changelog:
  - Clarify naming of WPA & WPA2 Personal encryption options (rh #374861, rh #373831)
  - Don't require a CA certificate for applicable EAP methods (rh #359001)
  - Fix certificate and private key handling for EAP-TTLS and EAP-TLS (rh #323371)
  - Fix applet crash with USB devices (rh #337191)
  - Support upgrades from NM 0.6.x GConf settings


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.4.svn3030
changelog:
  - Bring up ethernet devices by default if no connections are defined (rh #339201)
  - Fix crash when switching networks or bringing up secrets dialog (rh #353091)
  - Fix crash when editing VPN connection properties a second time
  - Fix crash when cancelling the secrets dialog if another connection was
      activated in the mean time
  - Fix disembodied notification bubbles (rh #333391)


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.4.svn3020
changelog:
  - Handle PEM certificates
  - Hide WPA-PSK Type combo since it's as yet unused
  - Fix applet crash when AP security options changed and old secrets are still
      in the keyring
  - Fix applet crash connecting to unencrypted APs via the other network dialog


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.3.svn3016
changelog:
  - Fix getting current access point
  - Fix WPA Enterprise connections
  - Wireless dialog now defaults to sensible choices based on the connection
  - Tell nscd to restart if needed, don't silently kill it


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.3.svn3014
changelog:
  - Suppress excessive GConf updates which sometimes caused secrets to be cleared
      at the wrong times, causing connections to fail
  - Various EAP and LEAP related fixes


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.3.svn3008
changelog:
  - Make WPA-EAP and Dynamic WEP options connect successfully
  - Static IPs are now handled correctly in NM itself


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.3.svn2994
changelog:
  - Re-enable "Connect to other network"
  - Switch to new GUI bits for wireless security config and password entry


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.3.svn2970
changelog:
  - Fix segfault with deferred connections
  - Fix default username with vpnc VPN plugin
  - Hidden SSID fixes


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.3.svn2962
changelog:
  - Fix merging of non-SSID-broadcasting APs into a device's scan list
  - Speed up opening of the applet menu


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.3.svn2961
changelog:
  - New snapshot
  	- Add timestamps to networks to connect to last used wireless network
  	- Turn autoconnect on in the applet
  	- Hidden SSID support
  	- Invalidate failed or cancelled connections again
  	- Fix issues with reactivation of the same device
  	- Handle connection updates in the applet (ex. find new VPN connections)
  	- Fix vertical sizing of menu items
  	- Fix AP list on wireless devices other than the first device in the applet
  	- Fix matching of current AP with the right menu item


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.3.svn2914
changelog:
  - New snapshot
  	- Add WPA passphrase support to password dialog
  	- Applet now reflects actual VPN behavior of one active connection
  	- Applet now notices VPN active connections on startup
  	- Fix connections with some WPA and WEP keys


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.3.svn2886
changelog:
  - New snapshot
  	- Make wired device carrier state work in the applet
  	- Fix handling of errors with unencrypted APs
  	- Fix "frozen" applet icon by reporting NM state better
  	- Fix output of AP frequency in nm-tool


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.3.svn2880
changelog:
  - New snapshot
  	- Fix applet icon sizing on start (mclasen)
  	- Fix nm-tool installation (mclasen)
  	- Fix 'state' method call return (#303271)
  	- Fix 40-bit WEP keys (again)
  	- Fix loop when secrets were wrong/invalid
  	- Fix applet crash when clicking Cancel in the password dialog
  	- Ensure NM doesn't get stuck waiting for the supplicant to re-appear
  		if it crashes or goes away
  	- Make VPN properties applet work again
  	- Increase timeout for network password entry


author: Dan Williams <dcbw@redhat.com> 1:0.6.5-6
changelog:
  - Update to stable branch snapshot:
      - More fixes for ethernet link detection (gnome #354565, rh #194124)
      - Support for HAL-detected rfkill switches


author: Dan Williams <dcbw@redhat.com> 1:0.6.5-5
changelog:
  - Fix applet crash on 64-bit platforms when choosing
      "Connect to other wireless network..." (gnome.org #435036)
  - Add debug output for ethernet device link changes


author: Dan Williams <dcbw@redhat.com> 1:0.6.5-4
changelog:
  - Fix ethernet link detection (gnome #354565, rh #194124)
  - Fix perpetual credentials request with private key passwords in the applet
  - Sleep a bit before activating wireless cards to work around driver bugs


author: Dan Williams <dcbw@redhat.com> - 1:0.6.5-0.7.svn2547
changelog:
  - Update from trunk
  	* Updated translations
  	* Cleaned-up VPN properties dialogs
  	* Fix 64-bit kernel leakage issues in WEXT
  	* Don't capture and redirect wpa_supplicant log output


author: Matthias Clasen <mclasen@redhat.com>
changelog:
  - Own the /etc/NetworkManager/dispatcher.d directory
  - Require pkgconfig for the -devel packages
  - Fix compilation with dbus 1.0


author: Dan Williams <dcbw@redhat.com> - 1:0.6.5-0.cvs20061025
changelog:
  - Update to a stable branch snapshot
      - Gnome applet timeout/redraw suppression when idle
      - Backport of LEAP patch from HEAD (from Thiago Bauermann)
      - Backport of asynchronous scanning patch from HEAD
      - Make renaming of VPN connections work (from Tambet Ingo)
      - Dial down wpa_supplicant debug spew
      - Cleanup of key/passphrase request scenarios (from Valentine Sinitsyn)
      - Shut down VPN connections on logout (from Robert Love)
      - Fix WPA passphrase hashing on PPC


author: Dan Williams <dcbw@redhat.com> - 1:0.6.4-2
changelog:
  - Revert FC6 to latest stable NM
  - Update to stable snapshot
  - Remove bind/caching-nameserver hard requirement


author: Dan Williams <dcbw@redhat.com> - 0.7.0-0.cvs20060529
changelog:
  - Update to latest CVS
  	o Gnome.org #333420: dialog do not have window icons
  	o Gnome.org #336913: HIG tweaks for vpn properties pages
  	o Gnome.org #336846: HIG tweaks for nm-vpn-properties
  	o Gnome.org #336847: some bugs in nm-vpn-properties args parsing
  	o Gnome.org #341306: nm-vpn-properties crashes on startup
  	o Gnome.org #341263: Version 0.6.2-0ubuntu5 crashes on nm_device_802_11_wireless_get_type
  	o Gnome.org #341297: displays repeated keyring dialogs on resume from suspend
  	o Gnome.org #342400: Building libnm-util --without-gcrypt results in linker error
  	o Gnome.org #342398: Eleminate Gnome dependency for NetworkManager
  	o Gnome.org #336532: declaration of 'link' shadows a global declaration
  - Specfile fixes (#rh187489#)


