# changelog

author: Alasdair Kergon <agk@redhat.com> - 2.02.66-2
changelog:
  - Simplify and fix Requires package headers.
  - If unable to obtain snapshot percentage leave value blank on reports.
  - Use new install_system_dirs and install_initscripts makefile targets.
  - Add lvm2app functions to lookup a vgname from a pvid and pvname.
  - Change internal processing of PVs in pvchange.
  - Validate internal lock ordering of orphan and VG_GLOBAL locks.


author: Alasdair Kergon <agk@redhat.com> - 2.02.65-1
changelog:
  - Disallow vgchange --clustered if there are active mirrors or snapshots.
  - Fix truncated total size displayed by pvscan.
  - Skip internal lvm devices in scan if ignore_suspended_devices is set.
  - Do not merge old device cache after we run full scan. (2.02.56)
  - Add new --sysinit compound option to vgchange and lvchange.
  - Fix clvmd init script never to deactivate non-clustered volume groups.
  - Drop duplicate errors for read failures and missing devices to verbose level.
  - Do not print encryption key in message debug output (cryptsetup luksResume).
  - Use -d to control level of messages sent to syslog by dmeventd.
  - Change -d to -f to run dmeventd in foreground.
  - Fix udev flags on remove in create_and_load error path.
  - Add dm_list_splice() function to join two lists together.
  - Use /bin/bash for scripts with bashisms.
  - Switch Libs.private to Requires.private in devmapper.pc and lvm2app.pc.
  - Use pkgconfig Requires.private for devmapper-event.pc.


author: Alasdair Kergon <agk@redhat.com> - 2.02.64-1
changelog:
  - Avoid pointless initialisation when the 'version' command is run directly.
  - Fix memory leak for invalid regex pattern input.
  - Display invalid regex pattern for filter configuration in case of error.
  - Fix -M and --type to use strings, not pointers that change on config refresh.
  - Fix lvconvert error message when existing mirrored LV is not found.
  - Set appropriate udev flags for reserved LVs.
  - Disallow the direct removal of a merging snapshot.
  - Don't preload the origin when removing a snapshot whose merge is pending.
  - Disallow the addition of mirror images while a conversion is happening.
  - Disallow primary mirror image removal when mirror is not in-sync.
  - Remove obsolete --name parameter from vgcfgrestore.
  - Add -S command to clvmd to restart the daemon preserving exclusive locks.
  - Increment lvm2app version from 1 to 2 (memory allocation changes).
  - Change lvm2app memory alloc/free for pv/vg/lv properties.
  - Change daemon lock filename from lvm2_monitor to lvm2-monitor for consistency.
  - Add support for new IMPORT{db} udev rule.
  - Add DM_UDEV_PRIMARY_SOURCE_FLAG udev flag to recognize proper DM events.
  - Also include udev libs in libdevmapper.pc.
  - Cache bitset locations to speed up _calc_states.
  - Add a regex optimisation pass for shared prefixes and suffixes.
  - Add dm_bit_and and dm_bitset_equal to libdevmapper.
  - Speed up dm_bit_get_next with ffs().


author: Alasdair Kergon <agk@redhat.com> - 2.02.63-2
changelog:
  - Remove 'lvmconf --lockinglibdir' from cluster post: locking is now built-in.
  - Move libdevmapper-event-lvm2.so to devel package.
  - Explicitly specify libdevmapper-event.so* attributes.
  - Drop support for upgrades from very old versions that used lvm not lvm2.
  - Move libdevmapper-event plug-in libraries into new device-mapper subdirectory.
  - Don't verify lvm.conf contents when using rpm --verify.


author: Alasdair Kergon <agk@redhat.com> - 2.02.63-1
changelog:
  - Move development links to shared objects to /usr (hard-coded temporarily).
  - Change libdevmapper deactivation to fail if device is open.
  - Wipe memory buffers for libdevmapper dm-ioctl parameters before releasing.
  - Strictly require libudev if udev_sync is used.
  - Add support for ioctl's DM_UEVENT_GENERATED_FLAG.
  - Allow incomplete mirror restore in lvconvert --repair upon insufficient space.
  - Do not reset position in metadata ring buffer on vgrename and vgcfgrestore.
  - Allow VGs with active LVs to be renamed.
  - Only pass visible LVs to tools in cmdline VG name/tag expansions without -a.
  - Use C locale and mlockall in clvmd and dmeventd.
  - Mask LCK_HOLD in cluster VG locks for upgrade compatibility with older clvmd.
  - Add activation/polling_interval to lvm.conf as --interval default.
  - Don't ignore error if resuming any LV fails when resuming groups of LVs.
  - Skip closing persistent filter cache file if open failed.
  - Permit mimage LVs to be striped in lvcreate, lvresize and lvconvert.
  - Fix pvmove allocation to take existing parallel stripes into account.
  - Fix incorrect removal of symlinks after LV deactivation fails.
  - Fix is_partitioned_dev not to attempt to reopen device.
  - Fix another thread race in clvmd.
  - Improve vg_validate to detect some loops in lists.
  - Change most remaining log_error WARNING messages to log_warn.
  - Always use blocking lock for VGs and orphan locks.
  - Allocate all memory for segments from private VG mempool.
  - Optimise searching PV segments for seeking the most recently-added.
  - Remove duplicated vg_validate checks when parsing cached metadata.
  - Use hash table of LVs to speed up parsing of text metadata with many LVs.
  - Fix two vg_validate messages, adding whitespace and parentheses.
  - When dmeventd is not forking because of -d flag, don't kill parent process.
  - Fix dso resource leak in error path of dmeventd.
  - Fix --alloc contiguous policy only to allocate one set of parallel areas.
  - Do not allow {vg|lv}change --ignoremonitoring if on clustered VG.
  - Add ability to create mirrored logs for mirror LVs.
  - Fix clvmd cluster propagation of dmeventd monitoring mode.
  - Allow ALLOC_ANYWHERE to split contiguous areas.
  - Add some assertions to allocation code.
  - Introduce pv_area_used into allocation algorithm and add debug messages.
  - Add activation/monitoring to lvm.conf.
  - Add --monitor and --ignoremonitoring to lvcreate.
  - Don't allow resizing of internal logical volumes.
  - Fix libdevmapper-event pkgconfig version string to match libdevmapper.
  - Avoid scanning all pvs in the system if operating on a device with mdas.
  - Disable long living process flag in lvm2app library.
  - Fix pvcreate device md filter check.
  - Suppress repeated errors about the same missing PV uuids.
  - Bypass full device scans when using internally-cached VG metadata.
  - Only do one full device scan during each read of text format metadata.
  - Look up missing PVs by uuid not dev_name in pvs to avoid invalid stat.


author: Alasdair Kergon <agk@redhat.com> - 2.02.62-1
changelog:
  - Rewrite clvmd init script.
  - Add default alternative to mlockall using mlock to reduce pinned memory size.
  - Add use_mlockall and mlock_filter to activation section of lvm.conf.
  - Handle misaligned devices that report alignment_offset of -1.
  - Extend core allocation code in preparation for mirrored log areas.
  - No longer fall back to looking up active devices by name if uuid not found.
  - Don't touch /dev in vgmknodes if activation is disabled.
  - Add --showkeys parameter description to dmsetup man page.
  - Add --help option as synonym for help command.
  - Add lvm2app functions lvm_{vg|lv}_{get|add|remove}_tag() functions.
  - Refactor snapshot-merge deptree and device removal to support info-by-uuid.


author: Alasdair Kergon <agk@redhat.com> - 2.02.61-1
changelog:
  - Add %ORIGIN support to lv{create,extend,reduce,resize} --extents.
  - Accept a list of LVs with 'lvconvert --merge @tag' using process_each_lv.
  - Remove false "failed to find tree node" error when activating merging origin.
  - Exit with success when lvconvert --repair --use-policies performs no action.
  - Avoid unnecessary second resync when adding mimage to core-logged mirror.
  - Make clvmd -V return status zero.
  - Fix cmirrord segfault in clog_cpg list processing when converting mirror log.
  - Deactivate temporary pvmove mirror cluster-wide when activating it fails.
  - Add missing metadata vg_reverts in pvmove error paths.
  - Unlock shared lock in clvmd if activation calls fail.
  - Add lvm_pv_get_size, lvm_pv_get_free and lvm_pv_get_dev_size to lvm2app.
  - Change lvm2app to return all sizes in bytes as documented (not sectors).
  - Exclude internal VG names and uuids from lists returned through lvm2app.
  - Add LVM_SUPPRESS_LOCKING_FAILURE_MESSAGES environment variable.
  - Add DM_UDEV_DISABLE_LIBRARY_FALLBACK udev flag to rely on udev only.
  - Remove hard-coding that skipped _mimage devices from 11-dm-lvm.rules.
  - Export dm_udev_create_cookie function to create new cookies on demand.
  - Add --udevcookie, udevcreatecookie and udevreleasecookie to dmsetup.
  - Set udev state automatically instead of using DM_UDEV_DISABLE_CHECKING.
  - Set udev state automatically instead of using LVM_UDEV_DISABLE_CHECKING.
  - Remove pointless versioned symlinks to dmeventd plugin libraries.


author: Alasdair Kergon <agk@redhat.com> - 2.02.60-4
changelog:
  - Extend cmirrord man page.
  - Sleep before first progress check iff pvmove/lvconvert interval has prefix '+'.
  - Fix cmirror initscript syntax problems.
  - Fix first syslog message prefix for dmeventd plugins.
  - Make failed locking initialisation messages more descriptive.


author: Alasdair Kergon <agk@redhat.com> - 2.02.59-3
changelog:
  - Fix dmeventd lvm2 wrapper (plug-ins unusable in last build).
  - Make failed locking initialisation messages more descriptive.


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 2.02.59-2
changelog:
  - Drop duplicated BuildRequires on openaislib-devel.
  - Drop Requires on clusterlib for cmirror subpackage.
  - clvmd subpackage should Requires cman (#506592).


author: Alasdair Kergon <agk@redhat.com> - 2.02.59-1
changelog:
  - Add cmirror subpackage for clustered mirrors.
  - Set 'preferred_names' in default lvm.conf.
  - Add libdevmapper-event-lvm2.so to serialise dmeventd plugin liblvm2cmd use.
  - Stop dmeventd trying to access already-removed snapshots.
  - Fix clvmd to never scan suspended devices.
  - Fix detection of completed snapshot merge.
  - Improve snapshot merge metadata import validation.


author: Alasdair Kergon <agk@redhat.com> - 2.02.58-1
changelog:
  - Fix clvmd automatic target module loading crash.
  - Fix allocation code not to stop at the first area of a PV that fits.
  - Add support for the "snapshot-merge" kernel target (2.6.33-rc1).
  - Add --merge to lvconvert to merge a snapshot into its origin.


author: Alasdair Kergon <agk@redhat.com> - 2.02.57-1
changelog:
  - Add --splitmirrors to lvconvert to split off part of a mirror.
  - Allow vgremove to remove a VG with PVs missing after a prompt.
  - Add activation/udev_rules config option in lvm.conf.
  - Add --poll flag to vgchange and lvchange to control background daemon launch.
  - Impose limit of 8 mirror images to match the in-kernel kcopyd restriction.
  - Log failure type and recognise type 'F' (flush) in dmeventd mirror plugin.
  - Add --noudevrules option for dmsetup to disable /dev node management by udev.
  - Fix 'dmsetup info -c -o all' to show all fields.
  - Fix coredump and memory leak for 'dmsetup help -c'.
  - Rename mirror_device_fault_policy to mirror_image_fault policy.
  - Use extended status of new kernel snapshot target 1.8.0 to detect when empty.
  - Allow use of precommitted metadata when a PV is missing.
  - Add global/abort_on_internal_errors to lvm.conf to assist testing.
  - If aborting due to internal error, always send that message to stderr.
  - Keep log type consistent when changing mirror image count.
  - Exit with success in lvconvert --repair --use-policies on failed allocation.
  - Ensure any background daemon exits without duplicating parent's functionality.
  - Change background daemon process names to "(lvm2)".
  - Fix internal lock state after forking.
  - Remove empty PV devices if lvconvert --repair is using defined policies.
  - Use fixed buffer to prevent stack overflow in persistent filter dump.
  - Propagate metadata commit and revert notifications to other cluster nodes.
  - Fix metadata caching and lock state propagation to remote nodes in clvmd.
  - Properly decode all flags in clvmd messages including VG locks.
  - Drop cached metadata after device was auto-repaired and removed from VG.
  - Clear MISSING_PV flag if PV reappeared and is empty.
  - Fix removal of multiple devices from a mirror.
  - Also clean up PVs flagged as missing in vgreduce --removemissing --force.
  - Fix some pvresize and toollib error paths with missing VG releases/unlocks.
  - Explicitly call suspend for temporary mirror layer.
  - Add memlock information to do_lock_lv debug output.
  - Always bypass calls to remote cluster nodes for non-clustered VGs.
  - Permit implicit cluster lock conversion in pre/post callbacks on local node.
  - Permit implicit cluster lock conversion to the lock mode already held.
  - Fix lock flag masking in clvmd so intended code paths get invoked.
  - Remove newly-created mirror log from metadata if initial deactivation fails.
  - Improve pvmove error message when all source LVs are skipped.
  - Fix memlock imbalance in lv_suspend if already suspended.
  - Fix pvmove test mode not to poll (and fail).
  - Fix vgcreate error message if VG already exists.
  - Fix tools to use log_error when aborted due to user response to prompt.
  - Fix ignored readahead setting in lvcreate --readahead.
  - Fix clvmd memory leak in lv_info_by_lvid by calling release_vg.
  - If LVM_UDEV_DISABLE_CHECKING is set in environment, disable udev warnings.
  - If DM_UDEV_DISABLE_CHECKING is set in environment, disable udev warnings.
  - Always set environment variables for an LVM2 device in 11-dm-lvm.rules.
  - Disable udev rules for change events with DISK_RO set.
  - Add dm_tree_add_dev_with_udev_flags to provide wider support for udev flags.
  - Correct activated or deactivated text in vgchange summary message.
  - Fix fsadm man page typo (fsdam).


author: Alasdair Kergon <agk@redhat.com> - 2.02.56-2
changelog:
  - Revert vg_read_internal change as clvmd was not ready for vg_read. (2.02.55)
  - Fix unbalanced memory locking when deactivating LVs.
  - Add missing vg_release to pvs and pvdisplay to fix memory leak.
  - Do not try to unlock VG which is not locked when processing a VG.
  - Update .cache file after every full device rescan in clvmd.
  - Refresh all device filters (including sysfs) before each full device rescan.
  - Return error status if vgchange fails to activate any volume.


author: Alasdair Kergon <agk@redhat.com> - 2.02.55-1
changelog:
  - Fix deadlock when changing mirrors due to unpaired memlock refcount changes.
  - Fix pvmove region_size overflow for very large PVs.
  - Fix lvcreate and lvresize %PVS argument always to use sensible total size.
  - Directly restrict vgchange to activating visible LVs.
  - Fix hash lookup segfault when keys compared are different lengths.
  - Flush stdout after yes/no prompt.
  - Recognise DRBD devices and handle them like md devices.
  - Add dmsetup --inactive support (requires kernel support targetted for 2.6.33).


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.54-3
changelog:
  - Support udev flags even when udev_sync is disabled.
  - Remove last_rule from udev_rules.
  - Udev rules cleanup.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.54-2
changelog:
  - Enable udev synchronisation code.
  - Install default udev rules for device-mapper and LVM2.
  - Add BuildRequires: libudev-devel.
  - Add Requires: libudev (to check udev is running).
  - Add Requires: util-linux-ng (blkid used in udev rules).
  - Add Conflicts: dracut < 002-18 (for dracut to install required udev rules)


author: Alasdair Kergon <agk@redhat.com> - 2.02.54-1
changelog:
  - Add implict pvcreate support to vgcreate and vgextend.
  - Add --pvmetadatacopies for pvcreate, vgcreate, vgextend, vgconvert.
  - Distinguish between powers of 1000 and powers of 1024 in unit suffixes.
  - Restart lvconverts in vgchange.
  - Don't attempt to deactivate an LV if any of its snapshots are in use.
  - Return error if lv_deactivate fails to remove device from kernel.
  - Treat input units of both 's' and 'S' as 512-byte sectors.  (2.02.49)
  - Use standard output units for 'PE Size' and 'Stripe size' in pv/lvdisplay.
  - Add global/si_unit_consistency to enable cleaned-up use of units in output.
  - Only do lock conversions in clvmd if we are explicitly asked for one.
  - Fix clvmd segfault when refresh_toolcontext fails.
  - Cleanup mimagetmp LV if allocation fails for new lvconvert mimage.
  - Handle metadata with unknown segment types more gracefully.
  - Make clvmd return 0 on success rather than 1.
  - Correct example.conf to indicate that lvm2 not lvm1 is the default format.
  - Delay announcing mirror monitoring to syslog until initialisation succeeded.
  - Update lvcreate/lvconvert man pages to explain PhysicalVolume parameter.
  - Document --all option in man pages and cleanup {pv|vg|lv}{s|display} pages.


author: Alasdair Kergon <agk@redhat.com> - 2.02.53-1
changelog:
  - Create any directories in /dev with umask 022. (#507397)
  - Handle paths supplied to dm_task_set_name by getting name from /dev/mapper.
  - Add splitname and --yes to dmsetup man page.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.52-3
changelog:
  - Enable udev synchronisation code.
  - Install default udev rules for device-mapper and LVM2.
  - Add BuildRequires: libudev-devel.
  - Add Requires: libudev (to check udev is running).
  - Add Requires: util-linux-ng (blkid used in udev rules).


author: Alasdair Kergon <agk@redhat.com> - 2.02.52-2
changelog:
  - Build dmeventd and place into a separate set of subpackages.
  - Remove no-longer-needed BuildRoot tag and buildroot emptying at install.


author: Alasdair Kergon <agk@redhat.com> - 2.02.52-1
changelog:
  - Prioritise write locks over read locks by default for file locking.
  - Add local lock files with suffix ':aux' to serialise locking requests.
  - Fix readonly locking to permit writeable global locks (for vgscan). (2.02.49)
  - Make readonly locking available as locking type 4.
  - Fix global locking in PV reporting commands (2.02.49).
  - Make lvchange --refresh only take a read lock on volume group.
  - Fix race where non-blocking file locks could be granted in error.
  - Fix pvcreate string termination in duplicate uuid warning message.
  - Don't loop reading sysfs with pvcreate on a non-blkext partition (2.02.51).
  - Fix vgcfgrestore error paths when locking fails (2.02.49).
  - Make clvmd check corosync to see what cluster interface it should use.
  - Fix vgextend error path - if ORPHAN lock fails, unlock / release vg (2.02.49).
  - Clarify use of PE ranges in lv{convert|create|extend|resize} man pages.
  - Restore umask when device node creation fails.
  - Check kernel vsn to use 'block_on_error' or 'handle_errors' in mirror table.


author: Milan Broz <mbroz@redhat.com> - 2.02.51-3
changelog:
  - Fix global locking in PV reporting commands (2.02.49).
  - Fix pvcreate on a partition (2.02.51).
  - Build clvmd with both cman and corosync support.


author: Alasdair Kergon <agk@redhat.com> - 2.02.51-2
changelog:
  - Fix clvmd locking broken in 2.02.50-1.
  - Only change LV /dev symlinks on ACTIVATE not PRELOAD (so not done twice).
  - Make lvconvert honour log mirror options combined with downconversion.
  - Add devices/data_alignment_detection to lvm.conf.
  - Add devices/data_alignment_offset_detection to lvm.conf.
  - Add --dataalignmentoffset to pvcreate to shift start of aligned data area.
  - Update synopsis in lvconvert manpage to mention --repair.
  - Document -I option of clvmd in the man page.


author: Alasdair Kergon <agk@redhat.com> - 2.02.50-1
changelog:
  - Add libs and devel subpackages to include shared libraries for applications.
    N.B. The liblvm2app API is not frozen yet and may still be changed
    Send any feedback to the mailing list lvm-devel@redhat.com.
  - Remove obsolete --with-dmdir from configure.
  - Add global/wait_for_locks to lvm.conf so blocking for locks can be disabled.
  - Fix race condition with vgcreate and vgextend on same device since 2.02.49.
  - Add an API version number, LVM_LIBAPI, to the VERSION string.
  - Return EINVALID_CMD_LINE not success when invalid VG name format is used.
  - Remove unnecessary messages after vgcreate/vgsplit code change in 2.02.49.
  - Store any errno and error messages issued while processing each command.


author: Alasdair Kergon <agk@redhat.com> - 2.02.49-1
changelog:
  - Exclude VG_GLOBAL from vg_write_lock_held so scans open devs read-only again.
  - Fix dev name mismatch in vgcreate man page example.
  - Check md devices for a partition table during device scan.
  - Add extended device (blkext) and md partition (mdp) types to filters.
  - Make text metadata read errors for segment areas more precise.
  - Fix text segment metadata read errors to mention correct segment name.
  - Include segment and LV names in text segment import error messages.
  - Fix memory leak in vgsplit when re-reading the vg.
  - Permit several segment types to be registered by a single shared object.
  - Update the man pages to document size units uniformly.
  - Allow commandline sizes to be specified in terms of bytes and sectors.
  - Update 'md_chunk_alignment' to use stripe-width to align PV data area.
  - Fix segfault in vg_release when vg->cmd is NULL.
  - Add dm_log_with_errno and dm_log_with_errno_init, deprecating the old fns.
  - Fix whitespace in linear target line to fix identical table line detection.
  - Add device number to more log messages during activation.


author: Fabio M. Di Nitto <fdinitto@redhat.com> 2.02.48-2
changelog:
  - BuildRequires and Requires on stable versions of both corosync-lib (1.0.0-1)
    and cluster-lib (3.0.0-20).


author: Alasdair Kergon <agk@redhat.com> - 2.02.48-1
changelog:
  - Abort if automatic metadata correction fails when reading VG to update it.
  - Don't fallback to default major number in libdm: use dm_task_set_major_minor.
  - Explicitly request fallback to default major number in device mapper.
  - Ignore suspended devices during repair.
  - Suggest using lvchange --resync when adding leg to not-yet-synced mirror.
  - Destroy toolcontext on clvmd exit to avoid memory pool leaks.
  - Fix lvconvert not to poll mirror if no conversion in progress.
  - Fix memory leaks in toolcontext error path.
  - Reinstate partial activation support in clustered mode.
  - Allow metadata correction even when PVs are missing.
  - Use 'lvm lvresize' instead of 'lvresize' in fsadm.
  - Do not use '-n' realine option in fsadm for rescue disk compatiblity.
  - Round up requested readahead to at least one page and print warning.
  - Try to repair vg before actual vgremove when force flag provided.
  - Unify error messages when processing inconsistent volume group.
  - Introduce lvconvert --use_policies (repair policy according to lvm.conf).
  - Fix rename of active snapshot with virtual origin.
  - Fix convert polling to ignore LV with different UUID.
  - Cache underlying device readahead only before activation calls.
  - Fix segfault when calculating readahead on missing device in vgreduce.
  - Remove verbose 'visited' messages.
  - Handle multi-extent mirror log allocation when smallest PV has only 1 extent.
  - Add LSB standard headers and functions (incl. reload) to clvmd initscript.
  - When creating new LV, double-check that name is not already in use.
  - Remove /dev/vgname/lvname symlink automatically if LV is no longer visible.
  - Rename internal vorigin LV to match visible LV.
  - Suppress 'removed' messages displayed when internal LVs are removed.
  - Fix lvchange -a and -p for sparse LVs.
  - Fix lvcreate --virtualsize to activate the new device immediately.
  - Make --snapshot optional with lvcreate --virtualsize.
  - Generalise --virtualoriginsize to --virtualsize.
  - Skip virtual origins in process_each_lv_in_vg() without --all.
  - Fix counting of virtual origin LVs in vg_validate.
  - Attempt to load dm-zero module if zero target needed but not present.
  - Add crypt target handling to libdevmapper tree nodes.
  - Add splitname command to dmsetup.
  - Add subsystem, vg_name, lv_name, lv_layer fields to dmsetup reports.
  - Make mempool optional in dm_split_lvm_name() in libdevmapper.


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 2.02.47-2
changelog:
  - BuildRequire newer version of corosynclib (0.97-1) to link against
    latest libraries version (soname 4.0.0).
  - Add lvm2-2_02_48-cluster-cpg-new-api.patch to port clvmd-corosync
    to new corosync cpg API.


author: Alasdair Kergon <agk@redhat.com> - 2.02.47-1
changelog:
  - Inherit readahead setting from underlying devices during activation.
  - Detect LVs active on remote nodes by querying locks if supported.
  - Enable online resizing of mirrors.
  - Use suspend with flush when device size was changed during table preload.
  - Implement query_resource_fn for cluster_locking.
  - Support query_resource_fn in locking modules.
  - Fix pvmove to revert operation if temporary mirror creation fails.
  - Fix metadata export for VG with missing PVs.
  - Add vgimportclone and install it and the man page by default.
  - Force max_lv restriction only for newly created LV.
  - Do not query nonexistent devices for readahead.
  - Reject missing PVs from allocation in toollib.
  - Fix PV datalignment for values starting prior to MDA area. (2.02.45)
  - Add sparse devices: lvcreate -s --virtualoriginsize (hidden zero origin).
  - Fix minimum width of devices column in reports.
  - Add lvs origin_size field.
  - Implement lvconvert --repair for repairing partially-failed mirrors.
  - Fix vgreduce --removemissing failure exit code.
  - Fix remote metadata backup for clvmd.
  - Fix metadata backup to run after vg_commit always.
  - Fix pvs report for orphan PVs when segment attributes are requested.
  - Fix pvs -a output to not read volume groups from non-PV devices.
  - Introduce memory pools per volume group (to reduce memory for large VGs).
  - Always return exit error status when locking of volume group fails.
  - Fix mirror log convert validation question.
  - Enable use of cached metadata for pvs and pvdisplay commands.
  - Fix memory leak in mirror allocation code.
  - Save and restore the previous logging level when log level is changed.
  - Fix error message when archive initialization fails.
  - Make sure clvmd-corosync releases the lockspace when it exits.
  - Fix segfault for vgcfgrestore on VG with missing PVs.
  - Block SIGTERM & SIGINT in clvmd subthreads.
  - Detect and conditionally wipe swapspace signatures in pvcreate.
  - Fix maximal volume count check for snapshots if max_lv set for volume group.
  - Fix lvcreate to remove unused cow volume if the snapshot creation fails.
  - Fix error messages when PV uuid or pe_start reading fails.
  - Flush memory pool and fix locking in clvmd refresh and backup command.
  - Fix unlocks in clvmd-corosync. (2.02.45)
  - Fix error message when adding metadata directory to internal list fails.
  - Fix size and error message of memory allocation at backup initialization.
  - Remove old metadata backup file after renaming VG.
  - Restore log_suppress state when metadata backup file is up-to-date.
  - Export dm_tree_node_size_changed() from libdevmapper.
  - Fix segfault when getopt processes dmsetup -U, -G and -M options.
  - Add _smp_mflags to compilation and remove DESTDIR.


author: Alasdair Kergon <agk@redhat.com> - 2.02.45-1
changelog:
  - Update clusterlib and corosync dependencies.
  - Attempt proper clean up in child before executing fsadm or modprobe.
  - Do not scan devices if reporting only attributes from PV label.
  - Use pkgconfig to obtain corosync library details during configuration.
  - Fix error returns in clvmd-corosync interface to DLM.
  - Add --refresh to vgchange and vgmknodes man pages.
  - Pass --test from lvresize to fsadm as --dry-run.
  - Prevent fsadm from checking mounted filesystems.
  - No longer treats any other key as 'no' when prompting in fsadm.
  - Add --dataalignment to pvcreate to specify alignment of data area.
  - Fix unblocking of interrupts after several commands.
  - Provide da and mda locations in debug message when writing text format label.
  - Mention the restriction on file descriptors at invocation on the lvm man page.
  - Index cached vgmetadata by vgid not vgname to cope with duplicate vgnames.
  - No longer require kernel and metadata major numbers to match.
  - If kernel supports only one dm major number, use in place of any supplied.
  - Add option to /etc/sysconfig/cluster to select cluster type for clvmd.
  - Allow clvmd to start up if its lockspace already exists.
  - Separate PV label attributes which do not need parse metadata when reporting.
  - Remove external dependency on the 'cut' command from fsadm.
  - Fix pvs segfault when pv mda attributes requested for unavailable PV.
  - Add fsadm support for reszing ext4 filesysystems.
  - Change lvm2-cluster to corosync instead of cman.
  - Fix some old changelog typos in email addresses.


author: Alasdair Kergon <agk@redhat.com> - 2.02.44-1
changelog:
  - Add --nameprefixes, --unquoted, --rows to pvs, vgs, lvs man pages.
  - Fix lvresize size conversion for fsadm when block size is not 1K.
  - Fix pvs segfault when run with orphan PV and some VG fields.
  - Display a 'dev_size' of zero for missing devices in reports.
  - Add pv_mda_size to pvs and vg_mda_size to vgs.
  - Fix lvmdump /sys listing to include virtual devices directory.
  - Add "--refresh" functionality to vgchange and vgmknodes.
  - Avoid exceeding LV size when wiping device.
  - Calculate mirror log size instead of using 1 extent.
  - Ensure requested device number is available before activating with it.
  - Fix incorrect exit status from 'help <command>'.
  - Fix vgrename using UUID if there are VGs with identical names.
  - Fix segfault when invalid field given in reporting commands.
  - Use better random seed value in temp file creation.
  - Add read_urandom to read /dev/urandom. Use in uuid calculation.
  - Fix race in vgcreate that would result in second caller overwriting first.
  - Fix uninitialised lv_count in vgdisplay -c.
  - Don't skip updating pvid hash when lvmcache_info struct got swapped.
  - Fix startup race in clvmd.
  - Cope with snapshot dependencies when removing a whole VG with lvremove.
  - Make man pages and tool help text consistent using | for alternative options.
  - Add "all" field to reports expanding to all fields of report type.
  - Enforce device name length and character limitations in libdm.


author: Alasdair Kergon <agk@redhat.com> - 2.02.43-1
changelog:
  - Upstream merge of device-mapper and lvm2 source.
  - Correct prototype for --permission on lvchange and lvcreate man pages.
  - Exit with non-zero status from vgdisplay if couldn't show any requested VG.
  - libdevmapper.pc: Use simplified x.y.z version number.
  - Accept locking fallback_to_* options in the global section as documented.
  - Several fixes to lvconvert involving mirrors.
  - Avoid overwriting in-use on-disk text metadata when metadataarea fills up.
  - Generate man pages from templates and include version.
  - Fix misleading error message when there are no allocatable extents in VG.
  - Fix handling of PVs which reappeared with old metadata version.
  - Fix validation of --minor and --major in lvcreate to require -My always.
  - Allow lvremove to remove LVs from VGs with missing PVs.
  - In VG with PVs missing, by default allow activation of LVs that are complete.
  - Require --force with --removemissing in vgreduce to remove partial LVs.
  - No longer write out PARTIAL flag into metadata backups.
  - Treat new default activation/missing_stripe_filler "error" as an error target.
  - Add devices/md_chunk_alignment to lvm.conf.
  - Pass struct physical_volume to pe_align and adjust for md chunk size.
  - Avoid shuffling remaining mirror images when removing one, retaining primary.
  - Prevent resizing an LV while lvconvert is using it.
  - Avoid repeatedly wiping cache while VG_GLOBAL is held in vgscan & pvscan.
  - Fix pvresize to not allow resize if PV has two metadata areas.
  - Fix setting of volume limit count if converting to lvm1 format.
  - Fix vgconvert logical volume id metadata validation.
  - Fix lvmdump metadata gather option (-m) to work correctly.
  - Fix allocation bug in text metadata format write error path.
  - Fix vgcfgbackup to properly check filename if template is used.
  - vgremove tries to remove lv snapshot first.
  - Improve file descriptor leak detection to display likely culprit and filename.
  - Avoid looping forever in _pv_analyze_mda_raw used by pvck.
  - Change lvchange exit status to indicate if any part of the operation failed.
  - Fix pvchange and pvremove to handle PVs without mdas.
  - Fix pvchange -M1 -u to preserve existing extent locations when there's a VG.
  - Cease recognising snapshot-in-use percentages returned by early devt kernels.
  - Add backward-compatible flags field to on-disk format_text metadata.
  - libdevmapper: Only resume devices in dm_tree_preload_children if size changes.
  - libdevmapper: Extend deptree buffers so the largest possible device numbers fit.
  - libdevmapper: Underline longer report help text headings.


author: Fabio M. Di Nitto <fdinitto@redhat.cm> - 2.02.39-5
changelog:
  - Add BuildRequires on cmanlib-devel. This is required after libcman split
    from cman and cman-devel into cmanlib and cmanlib-devel.
  - Make versioned BuildRequires on cman-devel and cmanlib-devel more strict
    to guarantee to get the right version.


author: Alasdair Kergon <agk@redhat.com> - 2.02.39-3
changelog:
  - Fix up cache for PVs without mdas after consistent VG metadata is processed.
  - Update validation of safe mirror log type conversions in lvconvert.
  - Fix lvconvert to disallow snapshot and mirror combinations.
  - Fix reporting of LV fields alongside unallocated PV segments.
  - Add --unquoted and --rows to reporting tools.
  - Avoid undefined status code after _memlock commands in lvm shell.
  - Fix and improve readahead 'auto' calculation for stripe_size.
  - Fix lvchange output for -r auto setting if auto is already set.
  - Fix add_mirror_images not to dereference uninitialized log_lv upon failure.
  - Add --force to lvextend and lvresize.
  - Fix vgchange to not activate component mirror volumes directly.


author: Alasdair Kergon <agk@redhat.com> - 2.02.38-2
changelog:
  - dmsetup: Add --unquoted and --rows to 'info -c' command.
  - libdevmapper: Fix inverted no_flush debug message.


author: Alasdair Kergon <agk@redhat.com> - 2.02.38-1
changelog:
  - libdevmapper: Make dm_hash_iter safe against deletion.
  - libdevmapper: Accept a NULL pointer to dm_free silently.
  - libdevmapper: Calculate string size within dm_pool_grow_object.
  - libdevmapper: Send reporting field help text to stderr not stdout.

  - dmsetup: Add tables_loaded, readonly and suspended columns to reports.
  - dmsetup: Add --nameprefixes for new report output format FIELD=VALUE.

  - Add --nameprefixes to reporting tools for field name prefix output format.
  - Fix return values for reporting commands when run with no PVs, LVs, or VGs.
  - Add omitted unlock_vg() call when sigint_caught() during vg processing.
  - Fix free_count when reading pool metadata.
  - Fix segfault when using pvcreate on a device containing pool metadata.
  - In script-processing mode, stop if any command fails.
  - Warn if command exits with non-zero status code without a prior log_error.
  - Correct config file line numbers in messages when parsing comments.
  - Add missing deactivation after activation failure in lvcreate -Zy.
  - When removing LV symlinks, skip any where the VG name is not determined.
  - Fix vgsplit internal counting of snapshot LVs.
  - Update vgsplit to only restrict split with active LVs involved in split.
  - Fix vgsplit to only move hidden 'snapshotN' LVs when necessary.
  - Update vgsplit man page to reflect lvnames on the cmdline.
  - Update vgsplit to take "-n LogicalVolumeName" on the cmdline.
  - Fix vgsplit error paths to release vg_to lock.
  - Avoid spurious duplicate VG messages referring to VGs that are gone.
  - Drop dev_name_confirmed error message to debug level.
  - Fix setpriority error message to signed int.
  - Add assertions to trap deprecated P_ and V_ lock usage.
  - Avoid using DLM locks with LCK_CACHE type P_ lock requests.
  - Don't touch /dev in vgrename if activation is disabled.
  - Exclude VG_GLOBAL from internal concurrent VG lock counter.
  - Fix vgmerge snapshot_count when source VG contains snapshots.
  - Fix internal LV counter when a snapshot is removed.
  - Fix metadata corruption writing lvm1-formatted metadata with snapshots.
  - Fix lvconvert -m0 allocatable space check.
  - Don't attempt remote metadata backups of non-clustered VGs.
  - Improve preferred_names lvm.conf example.
  - Fix vgdisplay 'Cur LV' field to match lvdisplay output.
  - Fix lv_count report field to exclude hidden LVs.
  - Fix some pvmove error status codes.
  - Indicate whether or not VG is clustered in vgcreate log message.
  - Mention default --clustered setting in vgcreate man page.
  - Fix vgreduce to use vg_split_mdas to check sufficient mdas remain.
  - Update lvmcache VG lock state for all locking types now.
  - Fix output if overriding command_names on cmdline.
  - Add check to vg_commit() ensuring VG lock held before writing new VG metadata.
  - Add validation of LV name to pvmove -n.
  - Add some basic internal VG lock validation.
  - Fix vgsplit internal counting of snapshot LVs.
  - Update vgsplit to only restrict split with active LVs involved in split.
  - Fix vgsplit to only move hidden 'snapshotN' LVs when necessary.
  - Update vgsplit man page to reflect lvnames on the cmdline.
  - Update vgsplit to take "-n LogicalVolumeName" on the cmdline.
  - Fix vgsplit error paths to release vg_to lock.
  - Fix vgsplit locking of new VG.
  - Avoid erroneous vgsplit error message for new VG.
  - Suppress duplicate message when lvresize fails because of invalid vgname.
  - Cache VG metadata internally while VG lock is held.
  - Fix redundant lvresize message if vg doesn't exist.
  - Make clvmd-cman use a hash rather than an array for node updown info.
  - Decode numbers in clvmd debugging output.
  - Fix uninitialised mutex in clvmd if all daemons are not running at startup.
  - Add config file overrides to clvmd when it reads the active LVs list.
  - Make clvmd refresh the context correctly when lvm.conf is updated.
  - Fix another allocation bug with clvmd and large node IDs.
  - Fix uninitialised variable in clvmd that could cause odd hangs.
  - Correct command name in lvmdiskscan man page.
  - clvmd no longer crashes if it sees nodeids over 50.
  - Fix potential deadlock in clvmd thread handling.
  - Update usage message for clvmd.
  - Fix clvmd man page not to print <br> and clarified debug options.
  - Escape double quotes and backslashes in external metadata and config data.
  - Correct a function name typo in _line_append error message.
  - Fix resetting of MIRROR_IMAGE and VISIBLE_LV after removal of LV.
  - Fix remove_layer_from_lv to empty the LV before removing it.
  - Add missing no-longer-used segs_using_this_lv test to check_lv_segments.
  - Fix lvconvert detection of mirror conversion in progress.
  - Avoid automatic lvconvert polldaemon invocation when -R specified.
  - Fix 'pvs -a' to detect VGs of PVs without metadata areas.
  - Divide up internal orphan volume group by format type.
  - Fix lvresize to support /dev/mapper prefix in the LV name.
  - Fix lvresize to pass new size to fsadm when extending device.
  - Fix unfilled parameter passed to fsadm from lvresize.
  - Update fsadm to call lvresize if the partition size differs (with option -l).
  - Fix fsadm to support VG/LV names.


author: Alasdair Kergon <agk@redhat.com> - 2.02.33-9
changelog:
  - Improve internal label caching performance while locks are held.
  - Fix mirror log name construction during lvconvert.


author: Alasdair Kergon <agk@redhat.com> - 2.02.32-8
changelog:
  - Fix pvs, vgs, lvs error exit status on some error paths.
  - Fix new parameter validation in vgsplit and test mode.
  - Fix internal metadata corruption in lvchange --resync.


author: Alasdair Kergon <agk@redhat.com> - 2.02.31-7
changelog:
  - Avoid readahead error message when using default setting of lvcreate -M1.
  - Fix lvcreate --nosync not to wait for non-happening sync.
  - Add very_verbose lvconvert messages.


author: Alasdair Kergon <agk@redhat.com> - 2.02.30-6
changelog:
  - Remove static libraries and binaries and move most binaries out of /usr.
  - Fix a segfault if using pvs with --all argument.
  - Fix vgreduce PV list processing not to process every PV in the VG.
  - Reinstate VG extent size and stripe size defaults (halved).
  - Set default readahead to twice maximium stripe size.
  - Detect non-orphans without MDAs correctly.
  - Prevent pvcreate from overwriting MDA-less PVs belonging to active VGs.
  - Don't use block_on_error with mirror targets version 1.12 and above.
  - Change vgsplit -l (for unimplemented --list) into --maxlogicalvolumes.
  - Update vgsplit to accept vgcreate options when new VG is destination.
  - Update vgsplit to accept existing VG as destination.
  - Major restructuring of pvmove and lvconvert code, adding stacking support.
  - Add new convert_lv field to lvs output.
  - Permit LV segment fields with PV segment reports.
  - Extend lvconvert to use polldaemon and wait for completion of initial sync.
  - Add seg_start_pe and seg_pe_ranges to reports.
  - Add fsadm interface to filesystem resizing tools.
  - Update --uuid argument description in man pages.
  - Print warning when lvm tools are running as non-root.


author: Alasdair Kergon <agk@redhat.com> - 2.02.29-1
changelog:
  - Make clvmd backup vg metadata on remote nodes.
  - Decode cluster locking state in log message.
  - Change file locking state messages from debug to very verbose.
  - Fix --addtag to drop @ prefix from name.
  - Stop clvmd going haywire if a pre_function fails.
  - Avoid nested vg_reads when processing PVs in VGs and fix associated locking.
  - Attempt to remove incomplete LVs with lvcreate zeroing/activation problems.
  - Add full read_ahead support.
  - Add lv_read_ahead and lv_kernel_read_ahead fields to reports and lvdisplay.
  - Prevent lvconvert -s from using same LV as origin and snapshot.
  - Fix human-readable output of odd numbers of sectors.
  - Add pv_mda_free and vg_mda_free fields to reports for raw text format.
  - Add LVM2 version to 'Generated by' comment in metadata.
  - Show 'not usable' space when PV is too large for device in pvdisplay.
  - Ignore and fix up any excessive device size found in metadata.
  - Fix error message when fixing up PV size in lvm2 metadata (2.02.11).
  - Fix orphan-related locking in pvdisplay and pvs.
  - Fix missing VG unlocks in some pvchange error paths.
  - Add some missing validation of VG names.
  - Detect md superblocks version 1.0, 1.1 and 1.2.
  - Add some pv-related error paths.
  - Handle future sysfs subsystem/block/devices directory structure.
  - Fix a bug in lvm_dump.sh checks for lvm/dmsetup binaries.
  - Fix underquotations in lvm_dump.sh.
  - Print --help output to stdout, not stderr.
  - After a cmdline processing error, don't print help text but suggest --help.
  - Add %PVS extents option to lvresize, lvextend, and lvcreate.
  - Remove no-longer-correct restrictions on PV arg count with stripes/mirrors.
  - Fix strdup memory leak in str_list_dup().
  - Link with -lpthread when static SELinux libraries require that.
  - Detect command line PE values that exceed their 32-bit range.
  - Include strerror string in dev_open_flags' stat failure message.
  - Avoid error when --corelog is provided without --mirrorlog. (2.02.28)
  - Correct --mirrorlog argument name in man pages (not --log).
  - Clear MIRROR_NOTSYNCED LV flag when converting from mirror to linear.
  - Modify lvremove to prompt for removal if LV active on other cluster nodes.
  - Add '-f' to vgremove to force removal of VG even if LVs exist.


author: Alasdair Kergon <agk@redhat.com> - 2.02.28-1
changelog:
  - vgscan and pvscan now trigger clvmd -R, which should now work.
  - Fix clvmd logging so you can get lvm-level debugging out of it.
  - Allow clvmd debug to be turned on in a running daemon using clvmd -d [-C].
  - Add more cluster info to lvmdump.
  - Fix lvdisplay man page to say LV size is reported in sectors, not KB.
  - Fix loading of persistent cache if cache_dir is used.
  - Only permit --force, --verbose and --debug arguments to be repeated.
  - Add support for renaming mirrored LVs.
  - Add --mirrorlog argument to specify log type for mirrors.
  - Don't leak a file descriptor if flock or fcntl fails.
  - Detect stream write failure reliably.
  - Reduce severity of lstat error messages to very_verbose.
  - Update to use autoconf 2.61, while still supporting 2.57.


author: Alasdair Kergon <agk@redhat.com> - 2.02.27-1
changelog:
  - Add -f to vgcfgrestore to list metadata backup files.
  - Add pvdisplay --maps implementation.
  - Add devices/preferred_names config regex list for displayed device names.
  - Add vg_mda_count and pv_mda_count columns to reports.
  - Change cling alloc policy attribute character from 'C' to l'.
  - Print warnings to stderr instead of stdout.
  - Fix snapshot cow area deactivation if origin is not active.
  - Reinitialise internal lvmdiskscan variables when called repeatedly.
  - Allow keyboard interrupt during user prompts when appropriate.
  - Fix deactivation code to follow dependencies and remove symlinks.
  - Fix a segfault in device_is_usable() if a device has no table.
  - Fix creation and conversion of mirrors with tags.
  - Add command stub for pvck.
  - Handle vgsplit of an entire VG as a vgrename.
  - Fix vgsplit for lvm1 format (set and validate VG name in PVs metadata).
  - Split metadata areas in vgsplit properly.
  - Fix and clarify vgsplit error messages.
  - Update lists of attribute characters in man pages.
  - Remove unsupported LVM1 options from vgcfgrestore man page.
  - Update vgcfgrestore man page to show mandatory VG name.
  - Update vgrename man page to include UUID and be consistent with lvrename.
  - Add some more debug messages to clvmd startup.
  - Fix thread race in clvmd.
  - Make clvmd cope with quorum devices.
  - Add extra internal error checking to clvmd.
  - Fix missing lvm_shell symbol in lvm2cmd library.
  - Move regex functions into libdevmapper.
  - Add kernel and device-mapper targets versions to lvmdump.
  - Add /sys/block listings to lvmdump.
  - Make lvmdump list /dev recursively.
  - Mark /etc/lvm subdirectories as directories in spec file.


author: Alasdair Kergon <agk@redhat.com> - 2.02.24-1
changelog:
  - Add BuildRequires readline-static until makefiles get fixed.
  - Fix processing of exit status in init scripts
  - Fix vgremove to require at least one vg argument.
  - Fix reading of striped LVs in LVM1 format.
  - Flag nolocking as clustered so clvmd startup sees clustered LVs.
  - Add a few missing pieces of vgname command line validation.
  - Support the /dev/mapper prefix on most command lines.


author: Alasdair Kergon <agk@redhat.com> - 2.02.23-1
changelog:
  - Fix vgrename active LV check to ignore differing vgids.
  - Fix two more segfaults if an empty config file section encountered.
  - Fix a leak in a reporting error path.
  - Add devices/cache_dir & devices/cache_file_prefix, deprecating devices/cache.


author: Alasdair Kergon <agk@redhat.com> - 2.02.22-1
changelog:
  - Add ncurses-static BuildRequires after package split.
  - Fix loading of segment_libraries.
  - If a PV reappears after it was removed from its VG, make it an orphan.
  - Don't update metadata automatically if VGIDs don't match.
  - Fix some vgreduce --removemissing command line validation.
  - Trivial man page corrections (-b and -P).
  - Add global/units to example.conf.
  - Remove readline support from lvm.static.


author: Alasdair Kergon <agk@redhat.com> - 2.02.21-1
changelog:
  - Fix vgsplit to handle mirrors.
  - Reorder fields in reporting field definitions.
  - Fix vgs to treat args as VGs even when PV fields are displayed.
  - Fix md signature check to handle both endiannesses.


author: Alasdair Kergon <agk@redhat.com> - 2.02.20-1
changelog:
  - Fix exit statuses of reporting tools.
  - Add some missing close() and fclose() return code checks.
  - Add devices/ignore_suspended_devices to ignore suspended dm devices.
  - Fix refresh_toolcontext() always to wipe persistent device filter cache.
  - Long-lived processes write out persistent dev cache in refresh_toolcontext().
  - Streamline dm_report_field_* interface.
  - Update reporting man pages.
  - Add --clustered to man pages.
  - Add field definitions to report help text.


author: Alasdair Kergon <agk@redhat.com> - 2.02.19-1
changelog:
  - Fix a segfault if an empty config file section encountered.
  - Fix partition table processing after sparc changes.
  - Fix cmdline PE range processing segfault.
  - Move basic reporting functions into libdevmapper.


author: Alasdair Kergon <agk@redhat.com> - 2.02.18-1
changelog:
  - Use CFLAGS when linking so mixed sparc builds can supply -m64.
  - Prevent permission changes on active mirrors.
  - Print warning instead of error message if lvconvert cannot zero volume.
  - Add snapshot options to lvconvert man page.
  - dumpconfig accepts a list of configuration variables to display.
  - Change dumpconfig to use --file to redirect output to a file.
  - Avoid vgreduce error when mirror code removes the log LV.
  - Fix ambiguous vgsplit error message for split LV.
  - Fix lvextend man page typo.
  - Use no flush suspending for mirrors.
  - Fix create mirror with name longer than 22 chars.


author: Alasdair Kergon <agk@redhat.com> - 2.02.17-1
changelog:
  - Add missing pvremove error message when device doesn't exist.
  - When lvconvert allocates a mirror log, respect parallel area constraints.
  - Check for failure to allocate just the mirror log.
  - Support mirror log allocation when there is only one PV: area_count now 0.
  - Fix detection of smallest area in _alloc_parallel_area() for cling policy.
  - Add manpage entry for clvmd -T
  - Fix hang in clvmd if a pre-command failed.


author: Alasdair Kergon <agk@redhat.com> - 2.02.16-1
changelog:
  - Fix VG clustered read locks to use PR not CR.
  - Adjust some alignments for ia64/sparc.
  - Fix mirror segment removal to use temporary error segment.
  - Always compile debug logging into clvmd.
  - Add startup timeout to clvmd startup script.
  - Add -T (startup timeout) switch to clvmd.
  - Improve lvm_dump.sh robustness.


author: Alasdair Kergon <agk@redhat.com> - 2.02.12-2
changelog:
  - Remove no-longer-used ldconfig from lvm2-cluster and fix lvmconf
    to cope without the shared library.


author: Alasdair Kergon <agk@redhat.com> - 2.02.11-1.0
changelog:
  - New upstream with numerous fixes and small enhancements.
    (See the WHATS_NEW documentation file for complete upstream changelog.)


author: Alasdair Kergon <agk@redhat.com> - 2.01.08-2.0
changelog:
  - No longer abort read operations if archive/backup directories aren't there.
  - Add runtime directories and file to the package.


author: Alasdair Kergon <agk@redhat.com> - 2.01.08-1.0
changelog:
  - Improve detection of external changes affecting internal cache.
  - Add clustered VG attribute.
  - Suppress rmdir opendir error message.


author: Alasdair Kergon <agk@redhat.com> - 2.01.07-1.0
changelog:
  - Remove build directory from built-in path.
  - Extra /dev scanning required for clustered operation.


author: Alasdair Kergon <agk@redhat.com> - 2.00.24-1
changelog:
  - More upstream fixes.  (Always check WHATS_NEW file for details.)
  - Add requested BuildRequires. [bz 124916, 132408]


author: Jeremy Katz <katzj@redhat.com> - 2.00.20-2
changelog:
  - add patch for iSeries viodasd support
  - add patch to check file type using stat(2) if d_type == DT_UNKNOWN (#129674)


author: Alasdair Kergon <agk@redhat.com> 2.00.12-1
changelog:
  - Install default /etc/lvm/lvm.conf.
  - Move non-static binaries to /usr/sbin.
  - Add temporary links in /sbin to lvm.static until rc.sysinit gets updated.


author: Alasdair Kergon <agk@redhat.com> 2.00.10-1
changelog:
  - Update to version 2.00.10, which incorporates the RH-specific patches
    and includes various fixes and enhancements detailed in WHATS_NEW.


author: Jeremy Katz <katzj@redhat.com> 2.00.08-5
changelog:
  - Fix sysfs patch to find sysfs
  - Take patch from dwalsh and tweak a little for setting SELinux contexts on
    device node creation and also do it on the symlink creation.  
    Part of this should probably be pushed down to device-mapper instead


author: Trond Eivind Glomsrød <teg@redhat.com> 1.0.2-1
changelog:
  - 1.0.2
  - Total overhaul of build precedure
  - Add many small helper programs added to 1.0.2
  - drop old patches


author: Trond Eivind Glomsrød <teg@redhat.com> 1.0.1-5
changelog:
  - Don't segfault when infile is a directory and "-f" is used (#56623)
  - Automake is evil. Add workaround


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - FHS packaging to build on solaris2.5.1.
  - remove config.cache from autoconf patch.
  - sparc: use %configure, but not the m4 macros.


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - autoconfed and libtoolized package 
  - fixed Copyright (it's BSD, not GPL)
  - dumped bzless (less works fine with bz2-files)
  - rewrote build and install parts
  - separated main package and devel package


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - force compilation with egcs to avoid gcc optimization bug (thank God 
    we haven't been beaten by it)


author: Ade Lee <alee@redhat.com> - 2.3.2-12
changelog:
  - Removed modules not needed for pki-core
  - Bugzilla # 973224 - resteasy-base must be split into subpackages to 
    simplify dependencies.  With help from msrb.


author: Ade Lee <alee@redhat.com> - 2.3.2-11
changelog:
  - Removed unneeded maven-checkstyle-plugin BR
  - Removed Tomcat 6 dependency
  - Replaced maven BR with maven-local


author: Tomáš Mráz <tmraz@redhat.com> 1.5.3-14
changelog:
  - add DRBG CAVS driver and other necessary CAVS driver updates (#1172568)
  - allow ath reinitialization in FIPS mode
  - allow for auto-initialization of DRBG


author: Tomáš Mráz <tmraz@redhat.com> 1.5.3-13
changelog:
  - touch only urandom in the selftest and when /dev/random is
    unavailable for example by SELinux confinement
  - fix the RSA selftest key (p q swap)


author: Tomáš Mráz <tmraz@redhat.com> 1.5.3-5
changelog:
  - add FIPS DRBG implementation
  - run the FIPS POST tests in shared library constructor
  - make it possible to run the test suite in the FIPS mode


author: Tomas Mraz <tmraz@redhat.com> 1.5.0-8
changelog:
  - fix multilib conflict in libgcrypt-config
  - fix minor memory leaks and other bugs found by Coverity scan


author: Tomas Mraz <tmraz@redhat.com> 1.4.6-3
changelog:
  - Make the FIPS-186-3 DSA implementation CAVS testable
  - add configurable source of RNG seed /etc/gcrypt/rngseed
    in the FIPS mode (#700388)


author: Tomas Mraz <tmraz@redhat.com> 1.4.5-5
changelog:
  - use /dev/urandom for seeding in the FIPS mode
  - make the tests to pass in the FIPS mode also fixing
    the FIPS-186-3 DSA keygen


author: Tomas Mraz <tmraz@redhat.com> 1.4.5-3
changelog:
  - drop the S390 build workaround as it is no longer needed
  - additional spec file cleanups for merge review (#226008)


author: Tomas Mraz <tmraz@redhat.com> 1.4.5-1
changelog:
  - workaround for build on S390 (#548825)
  - spec file cleanups
  - upgrade to new minor upstream release


author: Tomas Mraz <tmraz@redhat.com> 1.4.4-1
changelog:
  - update to 1.4.4
  - do not abort when the fips mode kernel flag is inaccessible
    due to permissions (#470219)
  - hobble the library to drop the ECC support


author: Nalin Dahyabhai <nalin@redhat.com> 1.4.1-1
changelog:
  - update to 1.4.1
  - bump libgpgerror-devel requirement to 1.4, matching the requirement enforced
    by the configure script


author: Nalin Dahyabhai <nalin@redhat.com> - 1.2.4-5
changelog:
  - add missing gawk buildrequirement
  - switch from explicitly specifying the /dev/random RNG to just verifying
    that the non-LGPL ones were disabled by the configure script


author: Nalin Dahyabhai <nalin@redhat.com> - 1.2.4-4
changelog:
  - clarify license
  - force use of the linux /dev/random RNG, to avoid accidentally falling back
    to others which would affect the license of the resulting library


author: Nalin Dahyabhai <nalin@redhat.com> 1.2.2-2
changelog:
  - remove file conflicts in libgcrypt-config by making the 64-bit version
    think the libraries are in /usr/lib (which is wrong, but which it also
    prunes from the suggest --libs output, so no harm done, hopefully)


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - update to 1.1.7
  - change license to LGPL.
  - include splint annotations patch.
  - install info pages.


author: Patsy Franklin <pfrankli@redhat.com> - 2.8.12.2-1
changelog:
  - Rebase to 2.8.12.2 including some recent patches. (BZ #1195919)
  - Fix to find python libs version 3.4 (BZ #1246369)
  - Don't fail if certain Qt modules are unavailable. (BZ #1192188)


author: Petr Machata <pmachata@redhat.com> - 2.8.11-2
changelog:
  - Pass -fno-strict-aliasing to cm_sha2.c to avoid strict aliasing
    problems that GCC warns about.
  - Icon name in CMake.desktop shouldn't include filename extension.


author: Orion Poplawski <orion@cora.nwra.com> - 2.8.10.2-5
changelog:
  - Add patch from upstream to fix UsrMove handling (bug #917407)
  - Drop %config from rpm macros
  - Define FCFLAGS in cmake macro


author: Orion Poplawski <orion@cora.nwra.com> - 2.8.5-0.3.rc3
changelog:
  - Update to 2.8.5 RC 3
  - Drop upstreamed swig patch
  - Apply upstream fix for issue 12307 (bug #723652)


author: Orion Poplawski <orion@cora.nwra.com> - 2.8.3-0.3.rc4
changelog:
  - Update to 2.8.3 RC 4
  - Drop python 2.7 patch fixed upstream
  - No need to fixup source file permissions anymore


author: Orion Poplawski <orion@cora.nwra.com> - 2.8.0-0.5.rc4
changelog:
  - Update to 2.8.0 RC 4
  - Add FindJNI patch
  - Add test patch from cvs to fix Fedora build test build error


author: Rex Dieter <rdieter@fedoraproject.org> - 2.6.2-3
changelog:
  - Add -DCMAKE_VERBOSE_MAKEFILE=ON to %cmake (#474053)
  - preserve timestamp of macros.cmake
  - cosmetics


author: Orion Poplawski <orion@cora.nwra.com> - 2.4.6-4
changelog:
  - Update macros.cmake to add CMAKE_INSTALL_LIBDIR, INCLUDE_INSTALL_DIR,
    LIB_INSTALL_DIR, SYSCONF_INSTALL_DIR, and SHARE_INSTALL_PREFIX


author: Orion Poplawski <orion@cora.nwra.com> - 2.4.3-2
changelog:
  - vim 7.0 now ships cmake files, so don't ship ours (bug #201018)
  - Add patch to Linux.cmake for Fortran soname support for plplot


author: Laine Stump <laine@redhat.com> - 0.2.8-1
changelog:
  - Rebase to netcf-0.2.8
   - resolve rhbz#1165965 - CVE-2014-8119
   - resolve rhbz#1159000
   - support multiple IPv4 addresses in interface config (redhat driver)
   - resolve rhbz#1113983
   - allow static IPv4 config simultaneous with DHCPv4 (redhat driver)
   - resolve rhbz#1170941
   - remove extra quotes from IPV6ADDR_SECONDARIES (redhat+suse drivers)
   - resolve rhbz#1090011
   - limit names of new interfaces to IFNAMSIZ characters
   - resolve rhbz#761246
   - properly parse ifcfg files with comments past column 1


author: - Laine Stump <laine@redhat.com> 0.2.6-2
changelog:
  - resolves rhbz#1138196
   - report file path and reason when aug_save fails
   - resolves rhbz#1147650
   - recognize IPADDR0/PREFIX0/NETMASK0/GATEWAY0
   - use git to apply patches to source tree


author: Laine Stump <laine@redhat.com> - 0.2.6-1
changelog:
  - resolves rhbz#1115176
   - rebase to upstream 0.2.6
   - allow interleaved elements in interface XML schema
   - allow <link> element in vlan and bond interfaces
   - report link state/speed in interface status
   - change DHCPv6 to DHCPV6C in ifcfg files
   - max vlan id is 4095, not 4096


author: Laine Stump <laine@redhat.com> - 0.2.3-8
changelog:
  - resolves rhbz 1060076
  - Transform STP value from yes/no to on/off
  - resolves rhbz 1060317
  - Require bridge-utils for netcf-libs in the specfile


author: Laine Stump <laine@redhat.com> - 0.2.3-6
changelog:
  - resolves rhbz#961184
  - wait for IFF_UP and IFF_RUNNING after calling ifup
  - resolves rhbz#1020204
  - remove extraneous quotes from BONDING_OPTS
  - resolves rhbz#1044681
  - eliminate use of uninitialized data when getting mac
  - resolves rhbz#1046594
  - support systemd based netcf transaction


author: Laine Stump <laine@redhat.com> - 0.2.3-1
changelog:
  - Rebase to netcf-0.2.3
  - eliminate calls to nl_cache_mngt_provide(), to avoid
    non-threadsafe code in libnl (and because it isn't needed
    anyway) (This non-threadsafe code could lead to a segfault)
  - portability fixes for FreeBSD
  - fix bug when a config file has two config parameters with
    identical names
  - add HACKING document
  - always bail immediately if get_augeas fails (doing otherwise
    could lead to a segfault)


author: Laine Stump <laine@redhat.com> - 0.2.2-1
changelog:
  - Rebase to netcf-0.2.2
  - specfile: require libnl3-devel for rpm builds on Fedora 18+ and
    RHEL7+. Likewise, force libnl1 for F17- and RHEL6.x-, even if
    libnl3-devel is installed.


author: Laine Stump <laine@redhat.com> - 0.2.1-1
changelog:
  - Rebase to netcf-0.2.1
  - update gnulib to fix broken build on systems with nwer glibc (which no
    longer provides gets()).
  - add ncftool manpage
  - interfaces are only "active" if both UP and RUNNING.
  - add "bundled(gnulib)" to specfile to indicate that we use a local
    copy of gnulib sources (used by Fedora/RHEL when determining the scope
    of security bugs).
  - Fix ipcalc_netmask, which was trimming off the last digit in
    character representations of full-length netmasks (all 4 octets
    having 3 chars each)
  - other minor bugfixes


author: Laine Stump <laine@redhat.com> - 0.1.9-1
changelog:
  - Rebase to netcf-0.1.9
  - always add <bridge> element to bridge, even if there is no physdev present
  - don't log error if interface isn't found in kernel during status report
  - allow building with C++
  - update gnulib


author: Laine Stump <laine@redhat.com> - 0.1.8-1
changelog:
  - Rebase to netcf-0.1.8
  - new transactional change APIs: ncf_change_(begin|commit|rollback)
  - add stdout/stderr to error text when an external program fails
  - make error reporting of failed execs more exact/correct
  - Remove unnecessary "Requires" of libxml2 and augeas from pkgconfig file
    to pulling in extra packages when building an application that uses netcf.


author: Laine Stump <laine@redhat.com> - 0.1.6-1
changelog:
  - New version
  - Remove patch n0001-src-dutil.c-add-missing-includes-for-stat.patch,
    included upstream


author: Mike A. Harris <mharris@redhat.com> 1.0.1-2
changelog:
  - Added "BuildRequires: pkgconfig" for (#193421)
  - Replace "makeinstall" with "make install DESTDIR=..."


author: Mike A. Harris <mharris@redhat.com> 0.99.3-1
changelog:
  - Updated libSM to version 0.99.3 from X11R7 RC3
  - Added "Requires(pre): xorg-x11-filesystem >= 0.99.2-3", to ensure
    that /usr/lib/X11 and /usr/include/X11 pre-exist.
  - Removed 'x' suffix from manpage directories to match RC3 upstream.


author: Mike A. Harris <mharris@redhat.com> 0.99.2-1
changelog:
  - Updated libSM to version 0.99.2 from X11R7 RC2
  - Changed 'Conflicts: XFree86-devel, xorg-x11-devel' to 'Obsoletes'
  - Changed 'Conflicts: XFree86-libs, xorg-x11-libs' to 'Obsoletes'


author: EL Errata <el-errata_ww@oracle.com> - 3.7-5.0.1
changelog:
  - Added bug28674897.patch (Recognize Oracle Linux distribution/vendor, fix plugin discovery on OL) [Orabug: 28674897]
  - Added sos-oraclelinux-vendor-vendorurl.patch


author: Pavel Moravec <pmoravec@redhat.com> = 3.7-3
changelog:
  - [katello] support both locations of qpid SSL certs
    Resolves: bz1711305
  - [plugins] add vdsm plugin
    Resolves: bz1706060


author: Pavel Moravec <pmoravec@redhat.com> = 3.7-2
changelog:
  - [sos] bump release
    Resolves: bz1656812
  - [pcp] collect pmlogger without a sizelimit
    Resolves: bz1639166
  - [maas,mysql,npm,pacemaker,postgresql] fix plugopts data types
    Resolves: bz1697854
  - [foreman,satellite] increase plugin default timeouts
    Resolves: bz1697813
  - [sosreport] update sos.conf manpages
    Resolves: bz1311129
  - [openstack_instack] add ansible.log
    Resolves: bz1702802


author: Pavel Moravec <pmoravec@redhat.com> = 3.6-12
changelog:
  - [ovirt_node] New plugin for oVirt Node
    Resolves: bz1591433
  - [podman] Add support for gathering information on podman
    Resolves: bz1646698
  - [postgresql] Do not limit dump size
    Resolves: bz1656278


author: Pavel Moravec <pmoravec@redhat.com> = 3.6-6
changelog:
  - [archive] fix leading path creation
    Resolves: bz1624043
  - [atomic] Define valid preset for RHEL Atomic
    Resolves: bz1626159
  - [utilities] wait till AsyncReader p.poll() returns None
    Resolves: bz1623070


author: Pavel Moravec <pmoravec@redhat.com> = 3.6-5
changelog:
  - [rhv-log-collector-analyzer] Add new plugin for RHV
    Resolves: bz1600158
  - [kubernetes|etcd] Support OpenShift 3.10 deployments
    Resolves: bz1616030


author: Pavel Moravec <pmoravec@redhat.com> = 3.6-4
changelog:
  - [apparmor,ceph] fix typo in add_forbidden_path
    Resolves: bz1609135
  - [policies] sanitize report label
    Resolves: bz1608384
  - [policies,process] make lsof execution optional, dont call on RHOSP
    Resolves: bz1613806


author: Pavel Moravec <pmoravec@redhat.com> = 3.6-3
changelog:
  - [sosreport] Add mechanism to encrypt final archive
    Resolves: bz1594327
  - [archive] fix stat typo
    Resolves: bz1597532
  - [rhui] Fix detection of CDS for RHUI3
    Resolves: bz1596494


author: Pavel Moravec <pmoravec@redhat.com> = 3.6-2
changelog:
  - [archive] fix add_string()/do_*_sub() regression
    Resolves: bz1474976
  - [kernel] handle case when bpftool installed but not implemented
    Resolves: bz1559756


author: Pavel Moravec <pmoravec@redhat.com> = 3.5-8
changelog:
  - [docker] backport three container related patches
    Resolves: bz1573907
  - [ovn] add two OpenVSwitch plugins
    Resoles: bz1560845


author: Pavel Moravec <pmoravec@redhat.com> = 3.5-7
changelog:
  - [kernel] Disable gathering /proc/timer* statistics
    Resolves: bz1566933
  - [openstack_octavia] Add new plugin
    Resolves: bz1541100
  - [ovirt-provider-ovn] A new plugin
    Resolves: bz1547544


author: Pavel Moravec <pmoravec@redhat.com> = 3.5-5
changelog:
  - [rabbitmq] Log collection when run in containerized OSP
    Resolves: bz1525620
  - [ipa] add KRA logs and correct PKI directories
    Resolves: bz1535390
  - [opendaylight] Enable plugin by puppet-opendaylight package
    Resolves: bz1483414
  - [etcd] Do not collect private etcd keys
    Resolves: bz1539038


author: Pavel Moravec <pmoravec@redhat.com> = 3.5-4
changelog:
  - [pcp] really apply sizelimit to logs collected
    Resolves: bz1353873
  - [opendaylight] collect more logs and puppet config
    Resolves: bz1483414
  - [plugins] allow add_cmd_output to collect binary output
    Resolves: bz1494420
  - [openstack_ironic] collect drivers, ports and much more
    Resolves: bz1517767
  - [openstack_cinder] check for api service running
    Resolves: bz1506908


author: Pavel Moravec <pmoravec@redhat.com> = 3.5-2
changelog:
  - [vdo] revise collected files
    Resolves: bz1509079
  - further updates to OSP plugins in containerized environment
    Resolves: bz1506908
  - [opendaylight] new plugin
    Resolves: bz1483414
  - collect all keystone domains
    Resolves: bz1491042
  - haproxy, etcd and docker tracebacks
    Resolves: bz1519267
  - [origin] fix typo in oc adm diagnostics
    Resolves: bz1463509
  - [postgresql] Call SCL pg_dump with proper path
    Resolves: bz1494420


author: Pavel Moravec <pmoravec@redhat.com> = 3.4-7
changelog:
  - [openstack plugins] Tripleo specific containerized services
    Resolves: bz1463635
  - [jars] Scan only /usr/{share,lib}/java by default
    Resolves: bz1482574
  - [gluster_block] Added new plugin gluster_block
    Resolves: bz1491964


author: Pavel Moravec <pmoravec@redhat.com> = 3.4-4
changelog:
  - [libvirt] fix per-process cgroup collection
    Resolves: bz1148381
  - [ceph] exclude temporary mount locations from collection
    Resolves: bz1449904
  - [policies/redhat] make missing 'filesystem' package non-fatal
    Resolves: bz1393961


author: Pavel Moravec <pmoravec@redhat.com> = 3.4-3
changelog:
  - [ceph] fix list formatting
    Resolves: bz1438269
  - [virsh] Handle properly cases when virsh commands fail
    Resolves: bz1444641
  - [openstack_*] fix issue with --verify option, extend pkglist for instack
    Resolves: bz1250346
  - [policies/redhat] accept 'oci' as a valid container type
    Resolves: bz1442078
  - [pacemaker] Collect user-defined logfile
    Resolves: bz1416535


author: Pavel Moravec <pmoravec@redhat.com> = 3.3-3
changelog:
  - [nodejs][nms]: new plugins
    Resolves: bz1368393
  - [docker]: Gather more data and expand plugin options
    Resolves: bz1351647


author: Pavel Moravec <pmoravec@redhat.com> = 3.3-2
changelog:
  - [grub2] grub2-mkconfig loads ext4 and brctl kernel
    Resolves: bz1116670
  - [ceph] skip collecting of all keyring and bindpass files
    Resolves: bz1260607
  - [omsa] add omreport storage controller
    Resolves: bz1299603
  - [atomichost] fix collection of 'docker info' output
    Resolves: bz1302146
  - [monit] fix add_copy_spec() arguments
    Resolves: bz1356945
  - [virtwho] add new plugin for virt-who agent
    Resolves: bz1353552


author: Pavel Moravec <pmoravec@redhat.com> = 3.2-36
changelog:
  - [ceph] collect /var/lib/ceph and /var/run/ceph
    Resolves: bz1260607
  - [sosreport] prepare report in a private subdirectory
    Resolves: bz1290955


author: Pavel Moravec <pmoravec@redhat.com> = 3.2-29
changelog:
  - [openvswitch] capture the logs, db and OVS bridges details
    Resolves: bz1242507
  - [logs] fix reference to missing 'rsyslog_conf' variable
    Resolves: bz1249705
  - [sapnw] Add check if saphostctrl is not present, dont use Set
    Resolves: bz1195608
  - [Plugin] fix handling of symlinks in non-sysroot environments
    Resolves: bz1248672


author: Pavel Moravec <pmoravec@redhat.com> = 3.2-27
changelog:
  - [plugin] pass stderr through _collect_cmd_output
  - split dependencies of bz1185990 fix from bz1185990 patch
    Resolves: bz1185990


author: Pavel Moravec <pmoravec@redhat.com> = 3.2-25
changelog:
  - [openstack] New Openstack Trove (DBaaS) plugin
    Resolves: bz1238349
  - [services] Add more diagnostics to applications
    Resolves: bz1195087
  - [openstack_neutron] Obscure passwords and secrets
    Resolves: bz1240666


author: Pavel Moravec <pmoravec@redhat.com> = 3.2-23
changelog:
  - [ceph] add calamari and ragos logs and configs
    Resolves: bz1210527
  - [iprconfig] enable plugin for ppc64* architectures
    Resolves: bz1238726


author: Pavel Moravec <pmoravec@redhat.com> = 3.2-22
changelog:
  - [general] verify --profile contains valid plugins only
    Resolves: bz1184602
  - [kernel,mpt,memory] additional kernel-related diagnostics
    Resolves: bz1194159


author: Pavel Moravec <pmoravec@redhat.com> = 3.2-21
changelog:
  - [cluster] enable crm_report password scrubbing
    Resolves: bz1164864
  - [sosreport] fix command-line report defaults
    Resolves: bz1219720
  - [virsh] add new plugin, add listing of qemu
    Resolves: bz1195086
  - [sap*,vhostmd] new plugins for SAP
    Resolves: bz1195608


author: Pavel Moravec <pmoravec@redhat.com> = 3.2-20
changelog:
  - [cluster] crm_report fails to run because dir already exists
    Resolves: bz1200526
  - [foreman] Skip collection of generic resources
    Resolves: bz1135317
  - [apache] Added collection of conf.modules.d dir for httpd 2.4
    Resolves: bz1183265
  - [pcp] collect /etc/pcp.conf
    Resolves: bz1183297
  - [puppet] adding new plugin for puppet
    Resolves: bz1183768
  - [block] Don't use parted human readable output
    Resolves: bz1183770
  - [general] Better handling --name and --ticket-number in
    Resolves: bz1185093
  - [networking] additional ip, firewall and traffic shaping
    Resolves: bz1194554
  - [infiniband] add opensm and infiniband-diags support
    Resolves: bz1194556
  - [plugins/rabbitmq] Added cluster_status command output
    Resolves: bz1197006
  - [networking] re-add 'ip addr' with a root symlink
    Resolves: bz1209454
  - [kimchi] add new plugin
    Resolves: bz1209840
  - [iprconfig] add plugin for IBM Power RAID adapters
    Resolves: bz1221932
  - [ovirt] Collect engine tunables and domain information.
    Resolves: bz1236101
  - [activemq] Honour all_logs and get config on RHEL
    Resolves: bz1236111
  - [cluster] Add luci to packages for standalone luci servers
    Resolves: bz1236124
  - [hpasm] hpasmcli commands hang under timeout
    Resolves: bz1214209
  - [mysql] Collect log file
    Resolves: bz1210906
  - [chrony] add chrony plugin
    Resolves: bz1165418


author: Pavel Moravec <pmoravec@redhat.com> = 3.2-17
changelog:
  - [openstack_neutron] neutron configuration and logs files not captured
    Resolves: bz1213315
  - [ovirt] remove ovirt-engine setup answer file password leak
    Resolves: bz1162788
  - [networking] network plugin fails if NetworkManager is disabled
    Resolves: bz1206633


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-12
changelog:
  - [plugin] limit path names to PC_NAME_MAX
    Resolves: bz1026962
  - [squid] collect files from /var/log/squid
    Resolves: bz1026962
  - [sosreport] log plugin exceptions to a file
    Resolves: bz1026962
  - [ctdb] fix collection of /etc/sysconfig/ctdb
    Resolves: bz1026962
  - [sosreport] fix silent exception handling
    Resolves: bz1026962


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-11
changelog:
  - [sosreport] do not make logging calls after OSError
    Resolves: bz1087977
  - [sosreport] catch OSError exceptions in SoSReport.execute()
    Resolves: bz1087977
  - [anaconda] make useradd password regex tolerant of whitespace
    Resolves: bz1112175


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-9
changelog:
  - [navicli] catch exceptions if stdin is unreadable
    Resolves: bz1166039
  - [docs] update man page for new options
    Resolves: bz1171658
  - [sosreport] make all utf-8 handling user errors=ignore
    Resolves: bz1164267


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-8
changelog:
  - [kpatch] do not attempt to collect data if kpatch is not installed
    Resolves: bz1110918
  - [archive] drop support for Zip archives
    Resolves: bz1118152


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-6
changelog:
  - [tomcat] add support for tomcat7 and default log size limits
    Resolves: bz1148375
  - [mysql] obtain database password from the environment
    Resolves: bz1126001


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-5
changelog:
  - [corosync] add postprocessing for corosync-objctl output
    Resolves: bz1087515
  - [ovirt_hosted_engine] fix exception when force-enabled
    Resolves: bz1148551


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-4
changelog:
  - [yum] call rhsm-debug with --no-subscriptions
    Resolves: bz1116349
  - [powerpc] allow PowerPC plugin to run on ppc64le
    Resolves: bz1140427
  - [package] add Obsoletes for sos-plugins-openstack
    Resolves: bz1140756


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-3
changelog:
  - [pam] add pam_tally2 and faillock support
    Resolves: bz1127631
  - [postgresql] obtain db password from the environment
    Resolves: bz1126001
  - [pcp] add Performance Co-Pilot plugin
    Resolves: bz1119833
  - [nfsserver] collect /etc/exports.d
    Resolves: bz1118921
  - [sosreport] handle --compression-type correctly
    Resolves: bz1118152
  - [anaconda] redact passwords in kickstart configurations
    Resolves: bz1112175
  - [haproxy] add new plugin
    Resolves: bz1107865
  - [keepalived] add new plugin
    Resolves: bz1105247
  - [lvm2] set locking_type=0 when calling lvm commands
    Resolves: bz1102285
  - [tuned] add new plugin
    Resolves: bz1095447
  - [cgroups] collect /etc/sysconfig/cgred
    Resolves: bz1083677
  - [plugins] ensure doc text is always displayed for plugins
    Resolves: bz1065473
  - [sosreport] fix the distribution version API call
    Resolves: bz1028111
  - [docker] add new plugin
    Resolves: bz1084990
  - [openstack_*] include broken-out openstack plugins
    Resolves: bz1140756
  - [mysql] support MariaDB
    Resolves: bz1106600
  - [openstack] do not collect /var/lib/nova
    Resolves: bz1106423
  - [grub2] collect grub.cfg on UEFI systems
    Resolves: bz1086648
  - [sosreport] handle out-of-space errors gracefully
    Resolves: bz1087977
  - [firewalld] new plugin
    Resolves: bz1100505
  - [networking] collect NetworkManager status
    Resolves: bz1100505
  - [kpatch] new plugin
    Resolves: bz1110918
  - [global] update to upstream 3.2 release
    Resolves: bz1026962


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-19
changelog:
  - Fix generation of volume names in gluster plugin
    Resolves: bz1036752
  - Add distupgrade plugin
    Resolves: bz1059760


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-18
changelog:
  - Prevent file descriptor leaks when using Popen
    Resolves: bz1051009
  - Disable zip archive creation when running rhsm-debug
    Resolves: bz1039036
  - Include volume geo-replication status in gluster plugin
    Resolves: bz1036752


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-17
changelog:
  - Fix get_option use in cluster plugin
    Resolves: bz1030553
  - Fix debug logging to file when given '-v'
    Resolves: bz1031126
  - Always treat rhevm plugin's vdsmlogs option as a string
    Resolves: bz1030617
  - Run the rhsm-debug script from yum plugin
    Resolves: bz1039036


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-16
changelog:
  - Add new plugin to collect OpenHPI configuration
    Resolves: bz1028121
  - Fix cluster plugin crm_report support
    Resolves: bz1030553
  - Fix file postprocessing in ldap plugin
    Resolves: bz1030602
  - Remove collection of anaconda-ks.cfg from general plugin
    Resolves: bz1034865


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-15
changelog:
  - Remove debug statements from logs plugin
    Resolves: bz1030042
  - Make ethernet interface detection more robust
    Resolves: bz1030824
  - Fix specifying multiple plugin options on the command line
    Resolves: bz1031124
  - Make log and message levels match previous versions
    Resolves: bz1031126
  - Log a warning message when external commands time out
    Resolves: bz1034956
  - Remove --upload command line option
    Resolves: bz1028484
  - Update sos UI text to match upstream
    Resolves: bz1034970


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-12
changelog:
  - Fix typo in yum plug-in add_forbidden_paths
    Resolves: bz829297
  - Add krb5 plug-in and drop collection of krb5.keytab
    Resolves: bz1028150


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-10
changelog:
  - Add nfs client plug-in
    Resolves: bz1028072
  - Fix traceback when sar module force-enabled
    Resolves: bz1028125


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-9
changelog:
  - Restore --build command line option
    Resolves: bz1015599
  - Collect saved vmcore-dmesg.txt files
    Resolves: bz1026959
  - Normalize temporary directory paths
    Resolves: bz829069


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-7
changelog:
  - Add domainname output to NIS plug-in
    Resolves: bz1026906
  - Collect /var/log/squid in squid plug-in
    Resolves: bz1026829
  - Collect mountstats and mountinfo in filesys plug-in
    Resolves: bz1026869
  - Add PowerPC plug-in from upstream
    Resolves: bz1025236


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-6
changelog:
  - Remove version checks in gluster plug-in
    Resolves: bz1015606
  - Check for usable temporary directory
    Resolves: bz1019517
  - Fix --alloptions command line option
    Resolves: bz1019356
  - Fix configuration fail regression
    Resolves: bz1019516


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-5
changelog:
  - Include /etc/yaboot.conf in boot plug-in
    Resolves: bz1001966
  - Fix collection of brctl output in networking plug-in
    Resolves: bz1019235
  - Verify limited set of RPM packages by default
    Resolves: bz1019863
  - Do not strip newlines from command output
    Resolves: bz1019338
  - Limit default sar data collection
    Resolves: bz1001599


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-4
changelog:
  - Do not attempt to read RPC pseudo files in networking plug-in
    Resolves: bz996992, bz996994
  - Restrict wbinfo collection to the current domain
    Resolves: bz997101
  - Add obfuscation of luci secrets to cluster plug-in
    Resolves: bz997090
  - Add XFS plug-in
    Resolves: bz997094
  - Fix policy class handling of --tmp-dir
    Resolves: bz997083
  - Do not set batch mode if stdin is not a TTY
    Resolves: bz1002943
  - Attempt to continue when reading bad input in interactive mode
    Resolves: bz1002943


author: Bryn M. Reeves <bmr@redhat.com> = 3.0-3
changelog:
  - Add crm_report support to cluster plug-in
    Resolves: bz839342
  - Fix rhel_version() usage in cluster and s390 plug-ins
    Resolves: bz916705
  - Strip trailing newline from command output
    Resolves: bz971420


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-35
changelog:
  - Report --name and --ticket values as defaults
  - Fix device-mapper command execution logging
  - Fix data collection and rename PostreSQL module to pgsql


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-33
changelog:
  - Add Red Hat Update Infrastructure module
  - Collect /proc/iomem in hardware module
  - Collect subscription-manager output in general module
  - Collect rhsm log files in general module
  - Fix exception in gluster module on non-gluster systems
  - Fix exception in psql module when dbname is not given


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-32
changelog:
  - Collect /proc/pagetypeinfo in memory module
  - Strip trailing newline from command output
  - Add sanlock module
  - Do not collect archived accounting files in psacct module
  - Call spacewalk-debug from rhn module to collect satellite data


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-31
changelog:
  - Avoid calling volume status when collecting gluster statedumps
  - Use a default report name if --name is empty
  - Quote tilde characters passed to shell in RPM module
  - Collect KDC and named configuration in ipa module
  - Sanitize hostname characters before using as report path
  - Collect /etc/multipath in device-mapper module
  - New plug-in for PostgreSQL
  - Add OpenStack module
  - Avoid deprecated sysctls in /proc/sys/net
  - Fix error logging when calling external programs
  - Use ip instead of ifconfig to generate network interface lists


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-29
changelog:
  - Collect the swift configuration directory in gluster module
  - Update IPA module and related plug-ins


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-22
changelog:
  - Correct aeolus debug invocation in CloudForms module
  - Update gluster module for gluster-3.3
  - Add additional command output to gluster module
  - Add support for collecting gluster configuration and logs


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-19
changelog:
  - Collect additional diagnostic information for realtime systems
  - Improve sanitization of RHN user and case number in report name
  - Fix verbose output and debug logging
  - Add basic support for CloudForms data collection
  - Add support for Subscription Asset Manager diagnostics


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-18
changelog:
  - Collect fence_virt.conf in cluster module
  - Fix collection of /proc/net directory tree
  - Gather output of cpufreq-info when present
  - Fix brctl showstp output when bridges contain multiple interfaces
  - Add /etc/modprobe.d to kernel module
  - Ensure relative symlink targets are correctly handled when copying
  - Fix satellite and proxy package detection in rhn plugin
  - Collect stderr output from external commands
  - Collect /proc/cgroups in the cgroups module
    Resolve: bz784874
  - Collect /proc/irq in the kernel module
  - Fix installed-rpms formatting for long package names
  - Add symbolic links for truncated log files
  - Collect non-standard syslog and rsyslog log files
  - Use correct paths for tomcat6 in RHN module
  - Obscure root password if present in anacond-ks.cfg
  - Do not accept embedded forward slashes in RHN usernames
  - Add new sunrpc module to collect rpcinfo for gluster systems


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-16
changelog:
  - Fix execution of RHN hardware.py from hardware plugin
  - Fix hardware plugin to support new lsusb path


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-15
changelog:
  - Fix brctl collection when a bridge contains no interfaces
  - Fix up2dateclient path in hardware plugin


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-11
changelog:
  - Truncate files that exceed specified size limit
  - Add support for collecting Red Hat Subscrition Manager configuration
  - Collect /etc/init on systems using upstart
  - Don't strip whitespace from output of external programs
  - Collect ipv6 neighbour table in network module
  - Collect basic cgroups configuration data


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-10
changelog:
  - Fix collection of data from LVM2 reporting tools in devicemapper plugin
  - Add /proc/vmmemctl collection to vmware plugin


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-9
changelog:
  - Collect yum repository list by default
  - Add basic Infiniband plugin
  - Add plugin for scsi-target-utils iSCSI target
  - Fix autofs plugin LC_ALL usage
  - Fix collection of lsusb and add collection of -t and -v outputs
  - Extend data collection by qpidd plugin
  - Add ethtool pause, coalesce and ring (-a, -c, -g) options to network plugin


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-6
changelog:
  - Fix collection of chkconfig output in startup.py
  - Collect /etc/dhcp in dhcp.py plugin
  - Collect dmsetup ls --tree output in devicemapper.py
  - Collect lsblk output in filesys.py


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-4
changelog:
  - Fix collection of logs and config files in sssd.py
  - Add support for collecting entitlement certificates in rhn.py


author: Bryn M. Reeves <bmr@redhat.com> = 2.2-3
changelog:
  - Fix cluster plugin dlm lockdump for el6
  - Add sssd plugin to collect configuration and logs
  - Collect /etc/anacrontab in system plugin
  - Correct handling of redhat-release for el6


author: Adam Stokes <ajs at redhat dot com> = 1.9-1
changelog:
  - version bump 1.9
  - replaced compression utility with xz
  - strip threading/multiprocessing
  - simplified progress indicator
  - pylint update
  - put global vars in class container
  - unittests
  - simple profiling
  - make use of xgettext as pygettext is deprecated


author: Adam Stokes <ajs at redhat dot com> = 1.8-21
changelog:
  - more sanitizing options for log files
  - rhbz fixes from RHEL version merged into trunk
  - progressbar update


author: Ville Skyttä <ville.skytta@iki.fi> - 0:20031021-1
changelog:
  - Sync with fedora-rpmdevtools' Perl spec template to fix x86_64 build.
  - Move version to the version field.


author: Simon Perreault <nomis80@nomis80.org> 20021130-2
changelog:
  - Changed architecture from i386 to noarch
  - Added my name as packager
  - Bumped up release number, which was forgotten by Anthony Rumble


author: Remi Collet <remi@fedoraproject.org> - 3.0.7-5
changelog:
  - add patch for https://bugs.php.net/59602
    segfault in getExtendedStats
  - also provides php-memcache


author: Joe Orton <jorton@redhat.com> - 3.0.6-4
changelog:
  - fix php_stream_cast() usage
  - fix memory corruption after unserialization (Paul Clifford)
  - package license


author: Remi Collet <Fedora@FamilleCollet.com> 2.2.0-1
changelog:
  - new version
  - add new INI directives (hash_strategy + hash_function) to config
  - add BR on php-devel >= 4.3.11


author: Ondrej Vasik <ovasik@redhat.com> 1.74.2-2
changelog:
  - updated Makefile: do ship .svg images(#486849), xsl
    stylesheets for website, xhtml-1_1, docbook -> epub
    convertor


author: Ondrej Vasik <ovasik@redhat.com> 1.73.2-8
changelog:
  - remove entries from xmlcatalog only on removal of package
    (required because of the change with droping release
     -caused drop of catalog entries during update)


author: Ondrej Vasik <ovasik@redhat.com> 1.73.2-7
changelog:
  - change a few non-constant expressions to constant that
    could now be handled by passivetex(#366441)


author: Ondrej Vasik <ovasik@redhat.com> 1.73.2-6
changelog:
  - fixed docbook-xsl-pagesetup.patch to follow Norman Walsh's
    documentation for nonpassivetex processing(#307001)


author: Ondrej Vasik <ovasik@redhat.com> 1.73.2-5
changelog:
  - convert all html files in doc to UTF-8 in prep
    (latest rpmlint gives warnings)
  - no longer using release in style-xsl dir(#389231)


author: Tim Waugh <twaugh@redhat.com> 1.69.1-2
changelog:
  - Patches from W. Michael Petullo:
    - Fix lists blocking (bug #161371).
    - Avoid proportional-column-width for passivetex (bug #176766).


author: Tim Waugh <twaugh@redhat.com> 1.64.1-6
changelog:
  - Fix last margin-left fix (bug #113456).
  - Reduce instances of itemized/ordered lists having misalignments.


author: Tim Waugh <twaugh@redhat.com> 1.62.4-1
changelog:
  - 1.62.4.
  - No longer need hyphens patch.
  - Avoid expressions in margin-left attributes, since passivetex does not
    understand them.


author: Chris Runge <crunge@pobox.com>
changelog:
  - added extensions and additional doc
  - bin added to doc; the Perl files are for Win32 Perl and so need some
    conversion first


author: Chris Runge <crunge@pobox.com>
changelog:
  - Initial RPM (based on docbook-style-dsssl RPM)
  - note: no catalog right now (I don't know how to do it; and not sure why
    it is necessary)


author: Petr Machata <pmachata@redhat.com> - 0.7.91-13
changelog:
  - Fix system_call_params.exp and system_calls.exp for aarch64.
    (#1225550)
  - xfail part of trace-irelative.exp for aarch64, fix trace-clone
    for aarch64 (#1225568)


author: Petr Machata <pmachata@redhat.com> - 0.7.91-12
changelog:
  - Add upstream fix for a bug in labeling PLT slots
    (ltrace-0.7.91-x86-plt_map.patch,
    ltrace-0.7.91-x86-unused_label.patch)
  - Add upstream fixes for tracing multi-threaded processes without -f
    (ltrace-0.7.91-multithread-no-f-1.patch,
    ltrace-0.7.91-multithread-no-f-2.patch)


author: Petr Machata <pmachata@redhat.com> - 0.7.91-6
changelog:
  - Fix a problem when attempting to trace a command that hasn't been
    found (ltrace-0.7.91-cant_open.patch)


author: Petr Machata <pmachata@redhat.com> - 0.7.91-5
changelog:
  - Fix crashing a prelinked PPC64 binary which makes PLT calls through
    slots that ltrace doesn't trace.
    (ltrace-0.7.91-breakpoint-on_install.patch,
    ltrace-0.7.91-ppc64-unprelink.patch)
  - Fix a problem in tracing across fork on PPC64
    (ltrace-0.7.91-ppc64-fork.patch)
  - Fix a couple nits in ltrace.1
    (ltrace-0.7.91-man.patch)


author: Petr Machata <pmachata@redhat.com> - 0.7.91-3
changelog:
  - Fix interpretation of x86_64 PLT with IRELATIVE slots.
    (ltrace-0.7.91-x86_64-irelative.patch)
  - Fix fetching of system call arguments on s390.
    (ltrace-0.7.91-s390-fetch-syscall.patch)
  - Enable tracing of IRELATIVE PLT slots on s390.
    (ltrace-0.7.91-s390-irelative.patch)


author: Petr Machata <pmachata@redhat.com> - 0.7.91-2
changelog:
  - Fix a problem in including in summary (-c) function calls that don't
    finish before exec or exit (ltrace-0.7.91-account_execl.patch)


author: Petr Machata <pmachata@redhat.com> - 0.7.2-5
changelog:
  - On s390, the highest bit in PC address is used to distinguish
    between 24-bit and 31-bit addressing modes.  Linux used to do this
    for us, but not anymore.
    (ltrace-0.7.2-s390-set_instruction_pointer.patch)


author: Petr Machata <pmachata@redhat.com> - 0.7.2-3
changelog:
  - Bring small fixes from master branch
    (ltrace-0.7.2-bits.patch; drop ltrace-0.7.2-man.patch)
  - Add a patch that implements ARM sofware singlestepping.  This mostly
    fixes test suite on ARM, though parameter passing conventions are
    still not implemented.  (ltrace-0.7.2-arm.patch)
  - Work around a new GCC warning (ltrace-0.7.2-unused-typedef.patch)


author: Petr Machata <pmachata@redhat.com> - 0.7.2-2
changelog:
  - Improve documentation: better correlation between ltrace(1) and
    --help, other minor improvements in ltrace(1).
    (ltrace-0.7.2-man.patch)


author: Petr Machata <pmachata@redhat.com> - 0.7.0-1
changelog:
  - Upstream 0.7.0
    - Drop all the patches
    - Upstream patch for missing sysdeps/linux-gnu/ppc/insn.h
      (ltrace-0.7.0-ppc-insn.h.patch)
    - Upstream patch for installing ltrace.conf.5 to man5
      (ltrace-0.7.0-man5.patch)


author: Petr Machata <pmachata@redhat.com> - 0.6.0-19
changelog:
  - Upstream patch for ia64 parameter passing
    (ltrace-0.6.0-abi-ia64.patch)
  - Upstream fix for a bug in computation of time spent in a syscall
    (ltrace-0.6.0-syscall-time.patch)
  - Upstream fix for a bug in passing struct(float,struct(float,float))
    on x86_64 (ltrace-0.6.0-x86_64-flatten.patch)
  - Upstream patch for support of -l option (ltrace-0.6.0-dash-l.patch)
  - Several more upstream patches with random cleanups.  Those were
    brought to Fedora to make porting of other patches easier.
    (ltrace-0.6.0-cleanups.patch)


author: Petr Machata <pmachata@redhat.com> - 0.6.0-16
changelog:
  - Look for __cxa_demangle in libstdc++ as well
  - Demangle test case should report it's unsupported if demangling
    support isn't compiled in (ltrace-0.6.0-demangle.patch)
  - Resolves: #827422


author: Petr Machata <pmachata@redhat.com> - 0.6.0-15
changelog:
  - Add upstream patches for parameter passing.  Apart from a couple of
    fixes, this brings in s390 support (ltrace-0.6.0-abi-s390.patch)


author: Petr Machata <pmachata@redhat.com> - 0.6.0-14
changelog:
  - Add upstream patch that improves parameter passing support (the
    upstream "revamp" branch) (ltrace-0.6.0-abi.patch)


author: Petr Machata <pmachata@redhat.com> - 0.6.0-13
changelog:
  - Check -n argument for validity (ltrace-0.6.0-dash-n.patch)
  - Resolves: #818529
  - ltrace-0.6.0-libs-fixes-1.patch
    - Fix double free when process initialization fails for some reason
    - Don't indent first level of calls


author: Petr Machata <pmachata@redhat.com> - 0.6.0-11
changelog:
  - Fix detach from sleeping process
  - Add limited support for return from tail call
  - Fix singlestep over atomic instruction sequence on PPC
  - Add extensive upstream patch that implements
    - tracing calls done from DSOs
    - better tools for filtering symbol tables
    - support for tracing PLT calls on PPC64 (not entry points read from .plt)
    - support for PPC32 old-style (BSS) PLT table
  - Drop ppc-shift patch that was superseded by the above
  - Drop demangle patch that hasn't been applied for some time now


author: Petr Machata <pmachata@redhat.com> - 0.6.0-6
changelog:
  - If we fail to attach to traced process, check whether deny_ptrace
    isn't enabled.  If yes, warn about it.
  - Resolves: #810973


author: Petr Machata <pmachata@redhat.com> - 0.6.0-5
changelog:
  - Add upstream patches for initial breakpoint insertion.  This mostly
    fixes tracing on PPC.
  - Resolves: #773050


author: Petr Machata <pmachata@redhat.com> - 0.6.0-3
changelog:
  - Add several upstream patches that fix various races in tracing
    multi-threaded processes
  - Add upstream patches for support of tracing across vfork
  - Add upstream patches for ppc: excessive shift, and fetching
    function arguments


author: Petr Machata <pmachata@redhat.com> - 0.6.0-2
changelog:
  - Add upstream patches for tracing multi-threaded processes, endian
    fixes, and a test suite fixlet


author: Petr Machata <pmachata@redhat.com> - 0.6.0-1
changelog:
  - Update to 0.6.0
    - Drop most patches
    - Port exec-stripped patch
    - Add return-string-n patch
    - Leave just the testsuite part in ia64-sigill patch


author: Petr Machata <pmachata@redhat.com> - 0.5-17.45svn
changelog:
  - Fix demangler resolution.  Libiberty is not in the default install
    anymore, and the fallback configure check for __cxa_demangle doesn't
    take into account the possibility that the symbol might be in
    libstdc++ instead.
  - Resolves: #631069 FTBFS


author: Petr Machata <pmachata@redhat.com> - 0.5-16.45svn.1
changelog:
  - When the value of undefined symbol in PPC 32-bit binary is 0, use
    PPC-specific magic to compute the PLT slots.
  - Fix a problem with tracing stripped binary after execl on
    architectures that need PLT reinitalisation breakpoint.
  - Support tracing of 31-bit binaries with 64-bit ltrace
  - Fix handling of the case where forked child is reported before
    parent's fork event
  - Patch from Supriya Kannery implements fetching 5th and further
    function arguments on s390


author: Petr Machata <pmachata@redhat.com> - 0.5-11.45svn
changelog:
  - Patch from James M. Leddy, fixes interaction of -c and -o
  - Fix compilation by using -D_LARGEFILE64_SOURCE
  - related: #447404


author: Petr Machata <pmachata@redhat.com> - 0.5-7.45svn
changelog:
  - added fork/exec patches, mostly IBM's work
  - added trace-exec tests into suite
  - added ia64 sigill patch


author: Petr Machata <pmachata@redhat.com> - 0.5-5.45svn
changelog:
  - fix plt handling on ppc32 (symval patch)
  - fix attaching to process (attach patch)
  - add fork & exec patches from IBM
  - adjust weak symbol handling (ppc32fc5 patch)


author: Petr Machata <pmachata@redhat.com> - 0.5-1.0.45svn.5
changelog:
  - adding .gnu.hash patch to support new ELF hash table section
  - adding testsuite patch to silent some bogus failures


author: Petr Machata <pmachata@redhat.com> - 0.5-1.0.45svn
changelog:
  - adding upstream (svn) version.  It contains most of patches that we
    already use, and has support for secure PLTs.


author: Petr Machata <pmachata@redhat.com> - 0.4-1.6
changelog:
  - e_entry patch: use elf's e_entry field instead of looking up _start
    symbol, which failed on stripped binaries.


author: Petr Machata <pmachata@redhat.com> - 0.4-1.4
changelog:
  - turn off opd translation on ia64, GElf already gives us function
    address.
  - turn on main-internal test, it should pass now.


author: Petr Machata <pmachata@redhat.com> - 0.4-1.2
changelog:
  - svn fix for opt_x patch
  - patches for testsuite for s390{,x}
  - turning off main-internal test. Fails on ia64, needs investigation.


author: Petr Machata <pmachata@redhat.com> - 0.4-1
changelog:
  - Upstream 0.4
  - opt_x patch: New structure for opt_x list elements, now with
    'found'.  Using it in options.c, elf.c.
  - testsuite patch: Automated testsuite for ltrace.


author: Jakub Jelinek <jakub@redhat.com> 0.3.36-2
changelog:
  - make x86_64 ltrace trace both 32-bit and 64-bit binaries (#141955,
    IT#55600)
  - fix tracing across execve
  - fix printf-style format handling on 64-bit arches


author: Jakub Jelinek <jakub@redhat.com> 0.3.32-1
changelog:
  - update to 0.3.32
    - fix dict.c assertion (#114359)
    - x86_64 support
  - rewrite elf.[ch] using libelf
  - don't rely on st_value of SHN_UNDEF symbols in binaries,
    instead walk .rel{,a}.plt and compute the addresses (#115299)
  - fix x86-64 support
  - some ltrace.conf additions
  - some format string printing fixes


author: Matt Wilson <msw@redhat.com>
changelog:
  - rebuilt for next release
  - patched Makefile.in to take a hint on mandir (patch2)
  - use %{_mandir} and %makeinstall


author: Paul Howarth <paul@city-fan.org> - 0.34-1
changelog:
  - Update to 0.34
    - Support anonymous stashes on newer perl versions
    - Prevent harmful effects from invalid settings for
      $ENV{PACKAGE_STASH_IMPLEMENTATION}
    - Switch to Module::Implementation
  - BR: perl(Module::Implementation) ≥ 0.06
  - BR: perl(base) for test suite
  - Bump Package::Stash::XS version requirement to 0.26
  - Explicitly run extra tests (except on RHEL ≥ 7, where the necessary
    build dependencies may not be available)
  - Update patch for building with old Test::More version in EPEL-5


author: Paul Howarth <paul@city-fan.org> - 0.33-6
changelog:
  - Drop EPEL-4 support
    - Drop %defattr, redundant since rpm 4.4
    - Test::LeakTrace, Test::Requires and Test::Script are now universally available
    - A suitably recent version of ExtUtils::MakeMaker is now universally available
  - Don't need to remove empty directories from the buildroot


author: Paul Howarth <paul@city-fan.org> - 0.32-1
changelog:
  - Update to 0.32
    - Bring the behavior of has_symbol for nonexistant scalars into line with the
      XS version
    - Invalid package names (for instance, Foo:Bar) are not allowed
    - Invalid stash entry names (anything containing ::) are not allowed
  - Update patches to apply cleanly
  - Bump perl(Package::Stash::XS) version requirement to 0.24


author: Paul Howarth <paul@city-fan.org> - 0.31-1
changelog:
  - Update to 0.31
    - Fix ->add_symbol('$foo', qr/sdlfk/) on 5.12+
    - Fix ->add_symbol('$foo', \v1.2.3) on 5.10+
  - Update patch for old Test::More versions
  - Update patch for no Test::Requires


author: Paul Howarth <paul@city-fan.org> - 0.30-1
changelog:
  - Update to 0.30
    - Fix compiler detection in Makefile.PL
  - Update patch for old ExtUtils::MakeMaker versions
  - Drop usage of macros for commands
  - Drop redundant %{?perl_default_filter}
  - perl(Pod::Coverage::TrustPod) now available everywhere


author: Paul Howarth <paul@city-fan.org> - 0.28-1
changelog:
  - Update to 0.28
    - META.json fixes
  - Update patch for old ExtUtils::MakeMaker versions to apply cleanly


author: Paul Howarth <paul@city-fan.org> - 0.26-1
changelog:
  - Update to 0.26
    - Make the namespace cache lazy and weak, in case the stash is deleted
    - However, this doesn't work on 5.8, so disable the namespace caching
      entirely there
  - Update patches to apply cleanly
  - Bump perl(Package::Stash::XS) version requirement to 0.22
  - Bump perl(Dist::CheckConflicts) version requirement to 0.02


author: Paul Howarth <paul@city-fan.org> - 0.25-1
changelog:
  - Update to 0.25 (make the leak tests author-only, since some smokers run
    release tests)
  - Update patches to apply cleanly
  - Bump perl(Package::Stash::XS) version requirement to 0.21
  - Drop buildreq perl(Test::Exception), no longer needed


author: Paul Howarth <paul@city-fan.org> - 0.23-1
changelog:
  - Update to 0.23
    - Lower perl prereq to 5.8.1
    - Make the leak tests release-only
  - Update patches to apply cleanly
  - Add patch to skip memory leak tests if we don't have Test::LeakTrace


author: Paul Howarth <paul@city-fan.org> - 0.22-1
changelog:
  - Update to 0.22 (bump Package::Stash::XS version requirement since a bug was
    fixed there)
  - Update patches for old ExtUtils::MakeMaker and Test::More versions
  - BR/R perl(Package::Stash::XS) >= 0.19
  - Content-free manpages for package-stash-conflicts and
    Package::Stash::Conflicts dropped upstream


author: Paul Howarth <paul@city-fan.org> - 0.20-1
changelog:
  - Update to 0.20
    - Methods were renamed for brevity: s/_package//
    - Convert Package::Stash into a module which loads either the XS or pure perl
      implementation, depending on what's available
    - Use Test::Fatal instead of Test::Exception
    - Use Dist::CheckConflicts
    - Silence deprecation warnings for the method renaming for now
  - New script and manpage: package-stash-conflicts
  - New modules and manpages: Package::Stash::Conflicts and Package::Stash::PP
  - New build requirements:
    - perl(Dist::CheckConflicts)
    - perl(Package::DeprecationManager)
    - perl(Package::Stash::XS)
    - perl(Test::LeakTrace)
    - perl(Test::Requires)
    - perl(Test::Script)
  - Update patches for old ExtUtils::MakeMaker and Test::More versions
  - Add new patch to work around absence of Test::Requires in EPEL-4
  - Require perl(Package::Stash::XS) for performance and consistency
  - Manually provide perl(Package::Stash::Conflicts), hidden from auto-provides


author: Paul Howarth <paul@city-fan.org> - 0.08-1
changelog:
  - Update to 0.08 (re-enable the caching of the stash)
  - Update patch for old ExtUtils::MakeMaker and Test::More versions


author: Paul Howarth <paul@city-fan.org> - 0.05-1
changelog:
  - Update to 0.05
    - Bump Test::More requirement for done_testing
    - Update packaging stuff
  - BR: perl(Test::EOL) and perl(Test::NoTabs)
  - Unify spec for all active branches, adding patches for back-compatibility


author: Paul Howarth <paul@city-fan.org> - 0.04-1
changelog:
  - Update to 0.04 (get_package_symbol now doesn't autovivify stash entries; a
    new method get_or_add_package_symbol can now be used for that behavior)


author: Paul Howarth <paul@city-fan.org> - 0.03-2
changelog:
  - Incorporate package review suggestions (#602597)
    - Use %{?perl_default_filter}
    - Use DESTDIR instead of PERL_INSTALL_ROOT


author: Mike A. Harris <mharris@redhat.com> 1.0.2-3
changelog:
  - Replace "makeinstall" with "make install DESTDIR=..."
  - Added "Requires: xorg-x11-proto-devel" to devel for dmx.pc
  - Remove package ownership of mandir/libdir/etc.


author: Mike A. Harris <mharris@redhat.com> 0.99.2-1
changelog:
  - Updated libdmx to version 0.99.2 from X11R7 RC3
  - Added "Requires(pre): xorg-x11-filesystem >= 0.99.2-3", to ensure
    that /usr/lib/X11 and /usr/include/X11 pre-exist.
  - Removed 'x' suffix from manpage directories to match RC3 upstream.


author: Petr Machata <pmachata@redhat.com> - 2.5.36-1
changelog:
  - Rebase to 2.5.36
    - Drop flex-2.5.35-sign.patch, flex-2.5.35-hardening.patch,
      flex-2.5.35-gcc44.patch, flex-2.5.35-missing-prototypes.patch
    - Add flex-2.5.36-bison-2.6.1.patch
    - Add a subpackage doc
  - Resolves #842073


author: Petr Machata <pmachata@redhat.com> - 2.5.35-15
changelog:
  - Rename flex-static to flex-devel so that it gets to repositories of
    minor multi-lib arch (i386 on x86_64 etc.)
  - Resolves: #674301


author: Petr Machata <pmachata@redhat.com> - 2.5.35-4
changelog:
  - Get rid of warning caused by ignoring return value of fwrite() in
    ECHO macro.  Debian patch.
  - Resolves: #484961


author: Petr Machata <pmachata@redhat.com> - 2.5.33-16
changelog:
  - Fix comparison between signed and unsigned in generated scanner.
    Patch by Roland McGrath.
  - Resolves: #431151


author: Stepan Kasal <skasal@redhat.com> - 2.5.33-15
changelog:
  - Do not run autogen.sh, it undoes the effect of includedir patch.
  - Adapt test-linedir-r.patch so that it fixes Makefile.in and works
    even though autogen.sh is not run.


author: Petr Machata <pmachata@redhat.com> - 2.5.33-8
changelog:
  - Don't emit yy-prefixed variables in C++ mode.  Thanks Srinivas Aji.
  - Related: #242742
  - Related: #244259


author: Petr Machata <pmachata@redhat.com> - 2.5.4a-39
changelog:
  - fileno is defined in posix standard, so adding #define _POSIX_SOURCE
    to compile without warnings (#195687)
  - dropping 183098 test, since the original bug was already resolved


author: Petr Machata <pmachata@redhat.com> - 2.5.4a-38
changelog:
  - Caught the real cause of #183098.  It failed because the parser
    built with `flex -f' *sometimes* made it into the final package, and
    -f assumes seven-bit tables.  Solution has two steps.  Move `make
    bigcheck' to `%check' part, where it belongs anyway, so that flexes
    built during `make bigcheck' don't overwrite original build.  And
    change makefile so that `make bigcheck' will *always* execute *all*
    check commands.


author: Petr Machata <pmachata@redhat.com> 2.5.4a-36
changelog:
  - Applying Jonathan S. Shapiro's bugfix-fixing patch. More std:: fixes
    and better way to silent warnings under gcc.


author: Petr Machata <pmachata@redhat.com> 2.5.4a-35
changelog:
  - Adding `std::' prefixes, got rid of `using namespace std'. (#115354)
  - Dummy use of `yy_flex_realloc' to silent warnings. (#30943)
  - Adding URL of flex home page to spec (#142675)


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - Fix generation of broken code (conflicting isatty() prototype w/ glibc 2.2)
    This broke, among other things, the kdelibs 2.0 build
  - Fix source URL


author: Petr Pisar <ppisar@redhat.com> 6.01-1
changelog:
  - Specfile autogenerated by cpanspec 1.78.
  - Remove BuildRoot stuff
  - Conflict with perl-libwww-perl-5* and older
  - Do not provide private modules


author: Honza Horak <hhorak@redhat.com> - 2.12-9
changelog:
  - Do not check old passwords using passwd.adjunct feature
  - Patch from Paul Wouters to handle crypt() returning NULL
    Resolves: #814803


author: Honza Horak <hhorak@redhat.com> - 2.12-7
changelog:
  - Added YP_PASSWD_HASH environment variable to set default
    algorithm for hashing a new password
    Resolves: #699666


author: Karel Klic <kklic@redhat.com> - 2.11-2
changelog:
  - Added patch to fix yppasswd utility when used with shadow
    passwords (rhbz#653921)
  - Removed %clean section


author: Karel Klic <kklic@redhat.com> - 2.10-3
changelog:
  - Added a new patch -passwords, which merges -md5 and -sha-2 patches
    together, and adds proper MD5/SHA support to verifypassword()


author: Nalin Dahyabhai <nalin@redhat.com> 2.7-3
changelog:
  - properly terminate an alloca'ed string in yppasswd which would lead to
    improper rejection of the request if the user's pw_passwd was visible


author: Alex Larsson <alexl@redhat.com> 2.6-3
changelog:
  - Add patch that handles MD5 passwords and HPU/X password aging.
  - This should hopefully fix #19045 and #22667


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - put yppasswd again in the package, 'cause it is the right thing to do
    (sorry djb!)
  - obsoletes old, unmaintained yppasswd package


author: Donnie Barnes <djb@redhat.com>
changelog:
  - pulled from contrib into distribution (got fresh sources).  Thanks
    to Thorsten Kukuk <kukuk@vt.uni-paderborn.de> for the original.
  - used fresh sources


author: Radek Novacek <rnovacek@redhat.com> 0.2.2-4
changelog:
  - Fix IPv6Type property of LMI_IPAssignmentSettingData class for DHCPv6
  - React to IP configuration change
  - Resolves: #1066853, #1069169


author: Radek Novacek <rnovacek@redhat.com> 0.2.2-3
changelog:
  - Fix LMI_IPElementSettingData refering bridging master setting instead of slave setting
  - Support connections that has interface-name option specified
  - Fix that bond slave names are not going above 2
  - allow virtual device name change for bonds
  - Resolves: #1064215, #1064324, #1064280, #1064334


author: Radek Novacek <rnovacek@redhat.com> 0.2.1-3
changelog:
  - Use proper classname of slave SettingData in CreateSlaveSetting
  - bridging: Don't forget master setting when modifying slave setting
  - fix the tests
  - Fix potential crash when setting master connection that not exists
  - Resolves: rhbz#1035674, rhbz#1035676


author: Radek Novacek <rnovacek@redhat.com> 0.2.0-1
changelog:
  - Version 0.2.0
  - Add -doc subpackage
  - Remove dependency on sblim-cmpi-base
  - Resolves: rhbz#1012549, rhbz#1011903


author: Radek Novacek <rnovacek@redhat.com> 0.0.3-1
changelog:
  - Update to 0.0.3
  - BR: cura-providers
  - Don't install files that are common with cura-providers
  - Prefix changed to LMI_


author: Xavier Bachelot <xavier@bachelot.org> - 0.2.904-13
changelog:
  - Update to svn921 for XO 1.5 regression and Xv crash fix (RHBZ #697901).
  - Update I420 patch (RHBZ #674551).


author: Xavier Bachelot <xavier@bachelot.org> - 0.2.904-6
changelog:
  - Sync with trunk (r853) and drop patches accordingly.
  - Add Xv acceleration for I420 on CME engine.


author: Xavier Bachelot <xavier@bachelot.org> - 0.2.904-5
changelog:
  - Sanitize SaveVideoRegister function.
  - Fix an Xv regression on CME chipsets introduced by the VX855 Xv patch.


author: Xavier Bachelot <xavier@bachelot.org> - 0.2.904-3
changelog:
  - Sync with trunk (r841) for assorted tweaks and fixes.
  - Add VX855 Xv support.
  - Fix colorkey on VX8xx.
  - Disable DMA and AGP by default on VX8xx.
  - Fix TV out flickering regression.
  - Add I2CDevices option (needed for XO-1.5).
  - Improve PCI 2D performances path.
  - Add a guard against HQV engine hang.


author: Xavier Bachelot <xavier@bachelot.org> - 0.2.903-12
changelog:
  - Update to latest snapshot (svn 758) :
    - Basic VX855 support.
    - Fix pci space corruption on P4M900 (RHBZ#506622).
    - Fix null pointer dereference in viaExaCheckComposite (RHBZ#449034).
  - Add patch to allow 1200x900 panel (X0-1.5).
  - Add patch to remove loader symbol lists, needed for xserver 1.7 (RHBZ#510206).
  - Add experimental patch for better VT1625 support.
  - Drop upstreamed patches.


author: Xavier Bachelot <xavier@bachelot.org> - 0.2.903-11
changelog:
  - Update to latest snapshot (svn 751) :
    - Add support for VX800 integrated TMDS encoder.
    - Make sure Chrome9 chipsets use software rasterizer for 3D.
    - Various small fixes.
  - Add patch for VX855 support.
  - Add patch to fix cursor on secondary display.
  - Add patch to disable TMDS by default.


author: Xavier Bachelot <xavier@bachelot.org> - 0.2.903-10
changelog:
  - Update to latest snapshot (svn 740) :
    - Fix panel resolution detection fallback (RHBZ#491417).
    - Fix 2D engine initialization.
    - Add support for CX700 integrated TMDS encoder.


author: Xavier Bachelot <xavier@bachelot.org> - 0.2.903-8
changelog:
  - Update to latest snapshot (svn 735) :
    - Fix green bars after VT switch (RHBZ#469504).
    - Set P4M890 primary FIFO.


author: Xavier Bachelot <xavier@bachelot.org> - 0.2.903-7
changelog:
  - Update to latest snapshot (svn 726) :
    - Bug fixes for XAA and EXA.
    - Fix 2d initialization for P4M900.


author: Xavier Bachelot <xavier@bachelot.org> - 0.2.903-2
changelog:
  - Update to latest snapshot (svn 685), most notably add basic VX800 support.
  - Turn on full debugging.


author: Xavier Bachelot <xavier@bachelot.org> - 0.2.902-9
changelog:
  - New version of the panel and hw cursor patch.
  - Rawhide is now using patch --fuzz=0, fixes for induced issues.


author: Xavier Bachelot <xavier@bachelot.org> - 0.2.902-2
changelog:
  - Add patch to properly report driver version in the libpciaccess code path.
  - Add patch to properly report chipset revision in the libpciaccess code path.


author: Xavier Bachelot <xavier@bachelot.org> - 0.2.902-1
changelog:
  - New upstream release.
  - Re-enable AGPDMA for K8M800 and VM800, as the drm bug is fixed in kernel
    >= 2.6.25rc7 (Patch #1).


author: Xavier Bachelot <xavier@bachelot.org> - 0.2.901-13
changelog:
  - Temporarily revert to old memory detection method. We need something that
    works out of the box for F9 Beta.


author: Adam Jackson <ajax@redhat.com> 0.2.900-8
changelog:
  - Obsolete xorg-x11-drv-via.  The king is dead, long live the king.
  - Munge xorg.conf in %post to change from via to openchrome.
  - Drive-by spec cleanups.


author: Xavier Bachelot <xavier@bachelot.org> - 0.2.900-7
changelog:
  - Replace broken VT1625 NTSC patch.
  - Add patch to announce as release not as development build.
  - First official Fedora build.


author: Xavier Bachelot <xavier@bachelot.org> - 0.2.900-4
changelog:
  - Update to release_0_3_0 branch rev. 384 plus all changes from experimental
    merged back
  - Remove upstream patch #2


author: Xavier Bachelot <xavier@bachelot.org> - 0.2.900-3
changelog:
  - Update to release_0_3_0 branch rev. 380 (fix a bug with XvMC acceleration)
  - Add a patch to allow proper detection of DDR667 (patch #2)


author: Honggang Li <honli@redhat.com> - 10.7.0.0.133-1
changelog:
  - Rebase to upstream release v10.7.0.0.133
  - Delete opapacketcapture
  - Resolves: bz1483552, bz1457762


author: Honggang Li <honli@redhat.com> - 10.3.1.0-9
changelog:
  - Rebase to latest upstream branch v10_3_1 as required.
  - Clean up change log.
  - Apply Epoch tag.
  - Resolves: bz1382796


author: Michal Schmidt <mschmidt@redhat.com> - 10.0.0.0-436
changelog:
  - Update to new upstream snapshot with unbundled 3rd party software.
  - Follow upstream spec file changes.
  - Related: bz1173309


author: Michal Ruprich <mruprich@redhat.com> - 20180605-1
changelog:
  - Resolves: #1643472 - Add geolite2 package
  - Lowering the NVR due to the package version in el8. Higher NVR could make problems during migration from el7 to el8


author: Rui Matos <rmatos@redhat.com> - 2.5.2-11
changelog:
  - Resolves: CVE-2017-13738, CVE-2017-13740, CVE-2017-13741,
    CVE-2017-13742, CVE-2017-13743, CVE-2017-13744, CVE-2014-8184


author: Martin Gieseking <martin.gieseking@uos.de> 2.4.1-1
changelog:
  - Updated to upstream release 2.4.1.
  - Made the devel package's dependency on the base package arch specific.


author: Lars Bjørndal <lars.bjorndal@broadpark.no> - 1.9.0-2
changelog:
  - In advice from Martin Gieseking: Removed some garbage from the file section, and added a PDF version of the liblouis documentation. See <https://bugzilla.redhat.com/show_bug.cgi?id=597597>.


author: Lars Bjørndal <lars.bjorndal@broadpark.no> - 1.9.0-1
changelog:
  - A new version was up to day. At the same time, fixed a minor spec issue according to a comment from Martin Gieseking, see <https://bugzilla.redhat.com/show_bug.cgi?id=597597>.


author: Lars Bjørndal <lars.bjorndal@broadpark.no> - 1.8.0-3
changelog:
  - Fixed some small problems, among them wrong destination directory for documentation. See <https://bugzilla.redhat.com/show_bug.cgi?id=597597> for further details.


author: Lars Bjørndal <lars.bjorndal@broadpark.no> 1.8.0-2
changelog:
  - Created the tools sub package and did a lot of clean ups, see <https://bugzilla.redhat.com/show_bug.cgi?id=597597>.


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-30
changelog:
  - don't ship /var/lock/ppp in rpm payload and create it in %post instead
  - fix installation of tmpfiles.d configuration
  - enable hardened build
  - fix bogus dates in changelog
  - compile all binaries with hardening flags
  - fix possible NULL pointer dereferencing


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-29
changelog:
  - make radius plugin config parser less strict
  - add creation of dip system group
  - resolves : #906913, #918296


author: Jiri Skala <jskala@redhat.com> - 2.4.5-18
changelog:
  - fixes #682381 - hardcodes eth0
  - fixes #708260 - SELinux is preventing access on the file LCK..ttyUSB3


author: Jiri Skala <jskala@redhat.com> - 2.4.5-12
changelog:
  - fixes #637513 - Missing: README.eap-tls
  - updated to latest eaptls upstream
  - fixes #637886 - EAP-TLS not working with enabled PPP Multilink Framing option


author: Jiri Skala <jskala@redhat.com> - 2.4.5-10
changelog:
  - fixes #613717 - Missing line in example script ip-up.local.add
  - removed /usr/kerberos/include from eaptls patch


author: Jiri Skala <jskala@redhat.com> - 2.4.4-14
changelog:
  - fixed #519042 - ppp package is missing URL in spec
  - fixed #524575 - ppp: no_strip patch modifies backup files created by previous patches


author: Martin Nagy <mnagy@redhat.com> 2.4.4-6
changelog:
  - call closelog earlier (#222295)
  - fix ChapMS2 (#217076)
  - moving header files to new -devel package (#203542)


author: Thomas Woerner <twoerner@redhat.com> 2.4.4-1
changelog:
  - new version 2.4.4 with lots of fixes
  - fixed reesolv.conf docs (#165072)
    Thanks to Matt Domsch for the initial patch
  - enabled CBCP (#199278)


author: Thomas Woerner <twoerner@redhat.com> 2.4.3-2
changelog:
  - dropped all executable bits in scripts directory to prevent rpm requiring
    programs used in there


author: Thomas Woerner <twoerner@redhat.com> 2.4.3-1
changelog:
  - new version 2.4.3
    - updated patches: make, lib64, dontwriteetc, fix, fix64, no_strip,
      radiusplugin
    - dropped patches: bpf, signal, pcap, pppoatm, pkgcheck


author: David Woodhouse <dwmw2@redhat.com> 2.4.2-6.2
changelog:
  - Link pppoatm plugin against libresolv.
  - Revert to linux-atm headers without the workaround for #127098


author: Thomas Woerner <twoerner@redhat.com> 2.4.2-5
changelog:
  - example scripts are using change_resolv_conf to modify /etc/resolv.conf
    (#132482)
  - require new libpcap library (>= 0.8.3-6) with a fix for inbound/outbound
    filter processing
  - not using internal libpcap structures anymore, fixes inbound/outbound
    filter processing (#128053)


author: Florian La Roche <Florian.LaRoche@redhat.de>
changelog:
  - add patch:
  	* Thu Jun 06 2002 Phil Knirsch <pknirsch@redhat.com>
  	- Fixed varargs problem for s390/s390x.


author: Nalin Dahyabhai <nalin@redhat.com> 2.4.1-2
changelog:
  - add buildprereq on pam-devel (#49559)
  - add patch to respond to CBCP LCP requests (#15738)
  - enable cbcp support at build-time
  - change the Copyright: tag to a License: tag


author: Michael K. Johnson <johnsonm@redhat.com>
changelog:
  - New version 2.3.9 required for kernel 2.3.13 and will be required
    for new initscripts.  auth patch removed; 2.3.9 does the same thing
    more readably than the previous patch.


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - updated to ppp-2.3.3, build against glibc-2.0.6 - previous patches not
    required any more.
  - added buildroot
  - fixed the PAM support, which was really, completely broken and against any
    standards (session support is still not here... :-( )
  - we build against running kernel and pray that it will work
  - added a samples patch; updated glibc patch


author: Erik Troan <ewt@redhat.com>
changelog:
  - added a patch to use our own route.h, rather then glibc's (which has
    alignment problems on Alpha's) -- I only applied this patch on the Alpha,
    though it should be safe everywhere


author: EL Errata <el-errata_ww@oracle.com> - 3.13.1-252.0.1
changelog:
  - Make rpm_transition_script() a nested optional policy in init policy module [Orabug: 29661269]
  - Allow cloud_init_t to dbus chat with systemd_logind_t [Orabug: 29399653]
  - Add fs_relabel_pstore_dirs() interface. [Orabug: 28260775]
  - Allow systemd running as init_t to relabel pstore directories. [Orabug: 28260775]
  - Allow udev_t to load modules [Orabug: 28260775]
  - Allow insmod_t to load modules BZ(1544189) [Orabug: 28260775]
  - Allow chronyd_t to execute shell scripts [Orabug: 28260775]
  - SELinux support for cgroup2 filesystem. [OraBug 28127822]
  - refpolicy: Define getrlimit permission for class process [OraBug 28229492]
  - Add vhost-scsi to be vhost_device_t type [OraBug 27774921]
  - Obsolete docker-engine-selinux [OraBug 26439663]
  - Fix container selinux policy [OraBug 26427364]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-249
changelog:
  - Allow nrpe_t domain to read process state of systemd_logind_t
  - Add interface systemd_logind_read_state()
  Resolves: rhbz#1653309


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-247
changelog:
  - Fix typo in gpg SELinux module
  - Update gpg policy to make ti working with confined users
  Resolves: rhbz#1535109
  - Alow nrpe_t to send signull to sssd domain when nagios_run_sudo boolean is turned on
  Resolves: rhbz#1653309
  - Allow nrpe_t domain to be dbus cliennt
  Resolves: rhbz#1653309
  - Add interface sssd_signull()
  Resolves: rhbz#1653309
  - Update userdomains to allow confined users to create gpg keys
  Resolves: rhbz#1535109


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-246
changelog:
  - Allow ngaios to use chown capability
  Resolves: rhbz#1653309
  - Dontaudit gpg_domain to create netlink_audit sockets
  Resolves: rhbz#1535109
  - Update fs_rw_cephfs_files() interface to allow also caller domain to read/write cephpfs_t lnk files
  Resolves: rhbz#1558836
  - Update domain_can_mmap_files() boolean to allow also mmap lnk files


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-241
changelog:
  - Update vmtools policy Resolves: rhbz#1656814 Allow domain transition from vmtools_t to vmtools_unconfined_t when shell_exec_t is entrypoint.
  - Allow virt_qemu_ga_t domain to read udev_var_run_t files
  Resolves: rhbz#1663092
  - Update nagios_run_sudo boolean with few allow rules related to accessing sssd
  Resolves: rhbz#1653309
  - Allow nfsd_t to read nvme block devices BZ(1562554)
  Resolves: rhbz#1655493
  - Allow tangd_t domain to bind on tcp ports labeled as tangd_port_t
  Resolves: rhbz#1650909
  - Allow all domains to send dbus msgs to vmtools_unconfined_t processes
  Resolves: rhbz#1656814
  - Label /dev/pkey as crypt_device_t
  Resolves: rhbz#1623068
  - Allow sudodomains to write to systemd_logind_sessions_t pipes.
  Resolves: rhbz#1687452
  - Allow all user domains to read realmd_var_lib_t files and dirs to check if IPA is configured on the system
  Resolves: rhbz#1667962
  - Fixes: xenconsole does not start
  Resolves: rhbz#1601525
  - Label /usr/lib64/libcuda.so.XX.XX library as textrel_shlib_t.
  Resolves: rhbz#1636197
  - Create tangd_port_t with default label tcp/7406
  Resolves: rhbz#1650909


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-240
changelog:
  - named wants to access /proc/sys/net/ipv4/ip_local_port_range to get ehphemeral range.
  Resolves: rhbz#1683754
  - Allow sbd_t domain to bypass permission checks for sending signals
  Resolves: rhbz#1671132
  - Allow sbd_t domain read/write all sysctls
  Resolves: rhbz#1671132
  - Allow kpatch_t domain to communicate with policykit_t domsin over dbus
  Resolves: rhbz#1602435
  - Allow boltd_t to stream connect to sytem dbus
  Resolves: rhbz#1589086
  - Update userdom_admin_user_template() and init_prog_run_bpf() interfaces to make working bpftool for confined admin
  Resolves: rhbz#1626115
  - Update unconfined_dbus_send() interface to allow both direction communication over dbus with unconfined process.
  Resolves: rhbz#1589086


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-239
changelog:
  - Allow sbd_t domain read/write all sysctls
  Resolves: rhbz#1671132
  - Allow kpatch_t domain to communicate with policykit_t domsin over dbus
  Resolves: rhbz#1602435
  - Allow boltd_t to stream connect to sytem dbus
  Resolves: rhbz#1589086
  - Update unconfined_dbus_send() interface to allow both direction communication over dbus with unconfined process.
  Resolves: rhbz#1589086


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-238
changelog:
  - Update redis_enable_notify() boolean to fix sending e-mail by redis when this boolean is turned on
  Resolves: rhbz#1646765


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-237
changelog:
  - Allow virtd_lxc_t domains use BPF
  Resolves: rhbz#1626115
  - F29 NetworkManager implements a new code for IPv4 address conflict detection (RFC 5227) based on n-acd [1], which uses eBPF to process ARP packets from the network.
  Resolves: rhbz#1626115
  - Allow unconfined user all perms under bpf class BZ(1565738
  Resolves: rhbz#1626115
  - Allow unconfined and sysadm users to use bpftool BZ(1591440)
  Resolves: rhbz#1626115
  - Allow systemd to manage bpf dirs/files
  Resolves: rhbz#1626115
  - Create new type bpf_t and label /sys/fs/bpf with this type
  Resolves:rhbz#1626115
  - Add new interface init_prog_run_bpf()
  Resolves:rhbz#1626115
  - add definition of bpf class and systemd perms
  Resolves: rhbz#1626115


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-236
changelog:
  - Update policy with multiple allow rules to make working installing VM in MLS policy
  Resolves: rhbz#1558121
  - Allow virt domain to use interited virtlogd domains fifo_file
  Resolves: rhbz#1558121
  - Allow chonyc_t domain to rw userdomain pipes
  Resolves: rhbz#1618757
  - Add file contexts in ganesha.fc file to label logging ganesha files properly.
  Resolves: rhbz#1628247


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-235
changelog:
  - Allow sandbox_xserver_t domain write to user_tmp_t files
  Resolves: rhbz#1646521
  - Allow virt_qemu_ga_t domain to read network state
  Resolves: rhbz#1630347
  - Bolt added d-bus API for force-powering the thunderbolt controller, so system-dbusd needs acces to boltd pipes
  Resolves: rhbz#1589086
  - Add boltd policy
  Resolves: rhbz#1589086
  - Allow virt domains to read/write cephfs filesystems
  Resolves: rhbz#1558836
  - Allow gpg_t to create own tmpfs dirs and sockets
  Resolves: rhbz#1535109
  - Allow gpg_agent_t to send msgs to syslog/journal
  Resolves: rhbz#1535109
  - Allow virtual machine to write to fixed_disk_device_t
  Resolves: rhbz#1499208
  - Update kdump_manage_crash() interface to allow also manage dirs by caller domain
  Resolves: rhbz#1491585
  - Add kpatch policy
  Resolves: rhbz#1602435
  - Label /usr/bin/mysqld_safe_helper as mysqld_exec_t instead of bin_t
  Resolves: rhbz#1623942
  - Allow svnserve_t domain to create in /tmp svn_0 file labeled as krb5_host_rcache_t
  Resolves: rhbz#1475271
  - Allow systemd to mount boltd_var_run_t dirs
  Resolves: rhbz#1589086
  - Allow systemd to mounont boltd lib dirs
  Resolves: rhbz#1589086
  - Allow sysadm_t,staff_t and unconfined_t domain to execute kpatch as kpatch_t domain
  Resolves: rhbz#1602435
  - Allow passwd_t domain chroot
  - Add miscfiles_filetrans_named_content_letsencrypt() to optional_block
  - Allow unconfined domains to create letsencrypt directory in /var/lib labeled as cert_t
  Resolves: rhbz#1447278
  - Allow staff_t user to systemctl iptables units.
  Resolves: rhbz#1360470


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-234
changelog:
  - Label /usr/bin/mysqld_safe_helper as mysqld_exec_t instead of bin_t
  Resolves: rhbz#1623942
  - Allow svnserve_t domain to create in /tmp svn_0 file labeled as krb5_host_rcache_t
  Resolves: rhbz#1475271
  - Allow passwd_t domain chroot
  - Add miscfiles_filetrans_named_content_letsencrypt() to optional_block
  - Allow unconfined domains to create letsencrypt directory in /var/lib labeled as cert_t
  Resolves: rhbz#1447278
  - Allow staff_t user to systemctl iptables units.
  Resolves: rhbz#1360470


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-233
changelog:
  - Allow gssd_t domain to manage kernel keyrings of every domain.
  Resolves: rhbz#1487350
  - Add new interface domain_manage_all_domains_keyrings()
  Resolves: rhbz#1487350


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-232
changelog:
  - Allow gssd_t domain to read/write kernel keyrings of every domain.
  Resolves: rhbz#1487350
  - Add interface domain_rw_all_domains_keyrings()
  Resolves: rhbz#1487350


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-230
changelog:
  -Allow nova_t domain to use pam
  Resolves: rhbz:#1640528
  - sysstat: grant sysstat_t the search_dir_perms set
  Resolves: rhbz#1637416
  - Allow cinder_volume_t domain to dbus chat with systemd_logind_t domain
  Resolves: rhbz#1630318
  - Allow staff_t userdomain and confined_admindomain attribute to allow use generic ptys because of new sudo feature 'io logging'
  Resolves: rhbz#1564470
  - Make ganesha policy active again
  Resolves: rhbz#1511489


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.5
changelog:
  - Remove disabling ganesha module in pre install phase of installation new selinux-policy package where ganesha is again standalone module
  Resolves: rhbz#1638257


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.4
changelog:
  - Allow staff_t userdomain and confined_admindomain attribute to allow use generic ptys because of new sudo feature 'io logging'
  Resolves: rhbz#1638427


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.3
changelog:
  - Run ganesha as ganesha_t domain again, revert changes where ganesha is running as nfsd_t
  Resolves: rhbz#1638257


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-228
changelog:
  - Allow tomcat_domain to read /dev/random
  Resolves: rhbz#1631666
  - Allow neutron_t domain to use pam
  Resolves: rhbz#1630318


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-227
changelog:
  - Add interface apache_read_tmp_dirs()
  - Allow dirsrvadmin_script_t domain to list httpd_tmp_t dirs
  Resolves: rhbz#1622602


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-226
changelog:
  - Allow tomcat servers to manage usr_t files
  Resolves: rhbz#1625678
  - Dontaudit tomcat serves to append to /dev/random device
  Resolves: rhbz#1625678
  - Allow sys_nice capability to mysqld_t domain
  - Allow dirsrvadmin_script_t domain to read httpd tmp files
  Resolves: rhbz#1622602
  - Allow syslogd_t domain to manage cert_t files
  Resolves: rhbz#1615995


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-225
changelog:
  - Allow sbd_t domain to getattr of all char files in /dev and read sysfs_t files and dirs
  Resolves: rhbz#1627114
  - Expand virt_read_lib_files() interface to allow list dirs with label virt_var_lib_t
  Resolves: rhbz#1567753


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-224
changelog:
  - Allow tomcat Tomcat to delete a temporary file used when compiling class files for JSPs.
  Resolves: rhbz#1625678
  - Allow chronyd_t domain to read virt_var_lib_t files
  - Allow virtual machines to use dri devices. This allows use openCL GPU calculations. BZ(1337333)
  Resolves: rhbz#1625613
  - Allow tomcat services create link file in /tmp
  Resolves: rhbz#1624289
  - Add boolean: domain_can_mmap_files.
  Resolves: rhbz#1460322


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-223
changelog:
  - Make working SELinux sandbox with Wayland.
  Resolves: rhbz#1624308
  - Allow svirt_t domain to mmap svirt_image_t block files
  Resolves: rhbz#1624224
  - Add caps dac_read_search and dav_override to pesign_t domain
  - Allow iscsid_t domain to mmap userio chr files
  Resolves: rhbz#1623589
  - Add boolean: domain_can_mmap_files.
  Resolves: rhbz#1460322
  - Add execute_no_trans permission to mmap_exec_file_perms pattern
  - Allow sudodomain to search caller domain proc info
  - Allow xdm_t domain to mmap and read cert_t files
  - Replace optional policy blocks to make dbus interfaces effective
  Resolves: rhbz#1624414
  - Add interface dev_map_userio_dev()


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-221
changelog:
  - Allow ovs-vswitchd labeled as openvswitch_t domain communicate with qemu-kvm via UNIX stream socket
  - Allow httpd_t domain to mmap tmp files
  Resolves: rhbz#1608355
  - Update dirsrv_read_share() interface to allow caller domain to mmap dirsrv_share_t files
  - Update dirsrvadmin_script_t policy to allow read httpd_tmp_t symlinks
  - Label /dev/tpmrm[0-9]* as tpm_device_t
  - Allow semanage_t domain mmap usr_t files
  Resolves: rhbz#1622607
  - Update dev_filetrans_all_named_dev() to allow create event22-30 character files with label event_device_t


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-220
changelog:
  - Allow nagios_script_t domain to mmap nagios_log_t files
  Resolves: rhbz#1620013
  - Allow nagios_script_t domain to mmap nagios_spool_t files
  Resolves: rhbz#1620013
  - Update userdom_security_admin() and userdom_security_admin_template() to allow use auditctl
  Resolves: rhbz#1622197
  - Update selinux_validate_context() interface to allow caller domain to mmap security_t files
  Resolves: rhbz#1622061


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-219
changelog:
  - Allow virtd_t domain to create netlink_socket
  - Allow rpm_t domain to write to audit
  - Allow rpm domain to mmap rpm_var_lib_t files
  Resolves: rhbz#1619785
  - Allow nagios_script_t domain to mmap nagios_etc_t files
  Resolves: rhbz#1620013
  - Update nscd_socket_use() to allow caller domain to stream connect to nscd_t
  Resolves: rhbz#1460715
  - Allow secadm_t domain to mmap audit config and log files
  - Allow insmod_t domain to read iptables pid files
  - Allow systemd to mounton /etc
  Resolves: rhbz#1619785


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-218
changelog:
  - Allow kdumpctl_t domain to getattr fixed disk device in mls
  Resolves: rhbz#1615342
  - Allow initrc_domain to mmap all binaries labeled as systemprocess_entry
  Resolves: rhbz#1615342


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-216
changelog:
  - Allow kdumpctl_t domain to manage kdumpctl_tmp_t fifo files
  Resolves: rhbz#1615342
  - Allow kdumpctl to write to files on all levels
  Resolves: rhbz#1615342
  - Fix typo in radius policy
  Resolves: rhbz#1619197
  - Allow httpd_t domain to mmap httpd_config_t files
  Resolves: rhbz#1615894
  - Add interface dbus_acquire_svc_system_dbusd()
  - Allow sanlock_t domain to connectto to unix_stream_socket
  Resolves: rhbz#1614965
  - Update nfsd_t policy because of ganesha features
  Resolves: rhbz#1511489
  - Allow conman to getattr devpts_t
  Resolves: rhbz#1377915
  - Allow tomcat_domain to connect to smtp ports
  Resolves: rhbz#1253502
  - Allow tomcat_t domain to mmap tomcat_var_lib_t files
  Resolves: rhbz#1618519
  - Allow slapd_t domain to mmap slapd_var_run_t files
  Resolves: rhbz#1615319
  - Allow nagios_t domain to mmap nagios_log_t files
  Resolves: rhbz#1618675
  - Allow nagios to exec itself and mmap nagios spool files BZ(1559683)
  - Allow nagios to mmap nagios config files BZ(1559683)
  - Allow kpropd_t domain to mmap krb5kdc_principal_t files
  Resolves: rhbz#1619252
  - Update syslogd policy to make working elasticsearch
  - Label tcp and udp ports 9200 as wap_wsp_port
  - Allow few domains to rw inherited kdumpctl tmp pipes
  Resolves: rhbz#1615342


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-215
changelog:
  - Allow systemd_dbusd_t domain read/write to nvme devices
  Resolves: rhbz#1614236
  - Allow mysqld_safe_t do execute itself
  - Allow smbd_t domain to chat via dbus with avahi daemon
  Resolves: rhbz#1600157
  - cupsd_t domain will create /etc/cupsd/ppd as cupsd_etc_rw_t
  Resolves: rhbz#1452595
  - Allow amanda_t domain to getattr on tmpfs filesystem BZ(1527645)
  Resolves: rhbz#1452444
  - Update screen_role_template to allow caller domain to have screen_exec_t as entrypoint do new domain
  Resolves: rhbz#1384769
  - Add alias httpd__script_t to _script_t to make sepolicy generate working
  Resolves: rhbz#1271324
  - Allow kprop_t domain to read network state
  Resolves: rhbz#1600705
  - Allow sysadm_t domain to accept socket
  Resolves: rhbz#1557299
  - Allow sshd_t domain to mmap user_tmp_t files
  Resolves: rhbz#1613437


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-212
changelog:
  - Allow kpropd domain to exec itself
  Resolves: rhbz#1600705
  - Allow ipmievd_t to mmap kernel modules BZ(1552535)
  - Allow hsqldb_t domain to mmap own temp files
  Resolves: rhbz#1612143
  - Allow hsqldb_t domain to read cgroup files
  Resolves: rhbz#1612143
  - Allow rngd_t domain to read generic certs
  Resolves: rhbz#1612456
  - Allow innd_t domain to mmap own var_lib_t files
  Resolves: rhbz#1600591
  - Update screen_role_temaplate interface
  Resolves: rhbz#1384769
  - Allow cupsd_t to create cupsd_etc_t dirs
  Resolves: rhbz#1452595
  - Allow chronyd_t domain to mmap own tmpfs files
  Resolves: rhbz#1596563
  - Allow cyrus domain to mmap own var_lib_t and var_run files
  Resolves: rhbz#1610374
  - Allow sysadm_t domain to create rawip sockets
  Resolves: rhbz#1571591
  - Allow sysadm_t domain to listen on socket
  Resolves: rhbz#1557299
  - Update sudo_role_template() to allow caller domain also setattr generic ptys
  Resolves: rhbz#1564470
  - Allow netutils_t domain to create bluetooth sockets
  Resolves: rhbz#1600586


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-211
changelog:
  - Allow innd_t domain to mmap own var_lib_t files
  Resolves: rhbz#1600591
  - Update screen_role_temaplate interface
  Resolves: rhbz#1384769
  - Allow cupsd_t to create cupsd_etc_t dirs
  Resolves: rhbz#1452595
  - Allow chronyd_t domain to mmap own tmpfs files
  Resolves: rhbz#1596563
  - Allow cyrus domain to mmap own var_lib_t and var_run files
  Resolves: rhbz#1610374
  - Allow sysadm_t domain to create rawip sockets
  Resolves: rhbz#1571591
  - Allow sysadm_t domain to listen on socket
  Resolves: rhbz#1557299
  - Update sudo_role_template() to allow caller domain also setattr generic ptys
  Resolves: rhbz#1564470
  - Allow netutils_t domain to create bluetooth sockets
  Resolves: rhbz#1600586


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-209
changelog:
  - Allow sblim_sfcbd_t domain to mmap own tmpfs files
  Resolves: rhbz#1609384
  - Update logging_manage_all_logs() interface to allow caller domain map all logfiles
  Resolves: rhbz#1592028


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-208
changelog:
  - Dontaudit oracleasm_t domain to request sys_admin capability
  - Allow iscsid_t domain to load kernel module
  Resolves: rhbz#1589295
  - Update rhcs contexts to reflects the latest fenced changes
  - Allow httpd_t domain to rw user_tmp_t files
  Resolves: rhbz#1608355
  - /usr/libexec/udisks2/udisksd should be labeled as devicekit_disk_exec_t
  Resolves: rhbz#1521063
  - Allow tangd_t dac_read_search
  Resolves: rhbz#1607810
  - Allow glusterd_t domain to mmap user_tmp_t files
  - Allow mongodb_t domain to mmap own var_lib_t files
  Resolves: rhbz#1607729
  - Allow iscsid_t domain to mmap sysfs_t files
  Resolves: rhbz#1602508
  - Allow tomcat_domain to search cgroup dirs
  Resolves: rhbz#1600188
  - Allow httpd_t domain to mmap own cache files
  Resolves: rhbz#1603505
  - Allow cupsd_t domain to mmap cupsd_etc_t files
  Resolves: rhbz#1599694
  - Allow kadmind_t domain to mmap krb5kdc_principal_t
  Resolves: rhbz#1601004
  - Allow virtlogd_t domain to read virt_etc_t link files
  Resolves: rhbz#1598593
  - Allow dirsrv_t domain to read crack db
  Resolves: rhbz#1599726
  - Dontaudit pegasus_t to require sys_admin capability
  Resolves: rhbz#1374570
  - Allow mysqld_t domain to exec mysqld_exec_t binary files
  - Allow abrt_t odmain to read rhsmcertd lib files
  Resolves: rhbz#1601389
  - Allow winbind_t domain to request kernel module loads
  Resolves: rhbz#1599236
  - Allow gpsd_t domain to getsession and mmap own tmpfs files
  Resolves: rhbz#1598388
  - Allow smbd_t send to nmbd_t via dgram sockets BZ(1563791)
  Resolves: rhbz#1600157
  - Allow tomcat_domain to read cgroup_t files
  Resolves: rhbz#1601151
  - Allow varnishlog_t domain to mmap varnishd_var_lib_t files
  Resolves: rhbz#1600704
  - Allow dovecot_auth_t domain to manage also dovecot_var_run_t fifo files. BZ(1320415)
  Resolves: rhbz#1600692
  - Fix ntp SELinux module
  - Allow innd_t domain to mmap news_spool_t files
  Resolves: rhbz#1600591
  - Allow haproxy daemon to reexec itself. BZ(1447800)
  Resolves: rhbz#1600578
  - Label HOME_DIR/mozilla.pdf file as mozilla_home_t instead of user_home_t
  Resolves: rhbz#1559859
  - Allow pkcs_slotd_t domain to mmap own tmpfs files
  Resolves: rhbz#1600434
  - Allow fenced_t domain to reboot
  Resolves: rhbz#1293384
  - Allow bluetooth_t domain listen on bluetooth sockets BZ(1549247)
  Resolves: rhbz#1557299
  - Allow lircd to use nsswitch. BZ(1401375)
  - Allow targetd_t domain mmap lvm config files
  Resolves: rhbz#1546671
  - Allow amanda_t domain to read network system state
  Resolves: rhbz#1452444
  - Allow abrt_t domain to read rhsmcertd logs
  Resolves: rhbz#1492059
  - Allow application_domain_type also mmap inherited user temp files BZ(1552765)
  Resolves: rhbz#1608421
  - Allow ipsec_t domain to read l2tpd pid files
  Resolves: rhbz#1607994
  - Allow systemd_tmpfiles_t do mmap system db files
  - Improve domain_transition_pattern to allow mmap entrypoint bin file.
  Resolves: rhbz#1460322
  - Allow nsswitch_domain to mmap passwd_file_t files BZ(1518655)
  Resolves: rhbz#1600528
  - Dontaudit syslogd to watching top llevel dirs when imfile module is enabled
  Resolves: rhbz#1601928
  - Allow ipsec_t can exec ipsec_exec_t
  Resolves: rhbz#1600684
  - Allow netutils_t domain to mmap usmmon device
  Resolves: rhbz#1600586
  - Allow netlabel_mgmt_t domain to read sssd public files, stream connect to sssd_t BZ(1483655)
  - Allow userdomain sudo domains to use generic ptys
  Resolves: rhbz#1564470
  - Allow traceroute to create icmp packets
  Resolves: rhbz#1548350
  - Allow systemd domain to mmap lvm config files BZ(1594584)
  - Add new interface lvm_map_config
  - refpolicy: Update for kernel sctp support Resolves: rhbz#1597111 Add additional entries to support the kernel SCTP implementation introduced in kernel 4.16


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-207
changelog:
  - Update oddjob_domtrans_mkhomedir() interface to allow caller domain also mmap oddjob_mkhomedir_exec_t files
  Resolves: rhbz#1596306
  - Update rhcs_rw_cluster_tmpfs() interface to allow caller domain to mmap cluster_tmpfs_t files
  Resolves: rhbz#1589257
  - Allow radiusd_t domain to read network sysctls
  Resolves: rhbz#1516233
  - Allow chronyc_t domain to use nscd shm
  Resolves: rhbz#1596563
  - Label /var/lib/tomcats dir as tomcat_var_lib_t
  Resolves: rhbz#1596367
  - Allow lsmd_t domain to mmap lsmd_plugin_exec_t files
  Resolves: rhbz#bea0c8174
  - Label /usr/sbin/rhn_check-[0-9]+.[0-9]+ as rpm_exec_t
  Resolves: rhbz#1596509
  - Update seutil_exec_loadpolicy() interface to allow caller domain to mmap load_policy_exec_t files
  Resolves: rhbz#1596072
  - Allow xdm_t to read systemd hwdb
  Resolves: rhbz#1596720
  - Allow dhcpc_t domain to mmap files labeled as ping_exec_t
  Resolves: rhbz#1596065


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-206
changelog:
  - Allow tangd_t domain to create tcp sockets
  Resolves: rhbz#1595775
  - Update postfix policy to allow postfix_master_t domain to mmap all postfix* binaries
  Resolves: rhbz#1595328
  - Allow amanda_t domain to have setgid capability
  Resolves: rhbz#1452444
  - Update usermanage_domtrans_useradd() to allow caller domain to mmap useradd_exec_t files
  Resolves: rhbz#1595667


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-205
changelog:
  - Allow abrt_watch_log_t domain to mmap binaries with label abrt_dump_oops_exec_t 
  Resolves: rhbz#1591191
  - Update cups_filetrans_named_content() to allow caller domain create ppd directory with cupsd_etc_rw_t label
  Resolves: rhbz#1452595
  - Allow abrt_t domain to write to rhsmcertd pid files
  Resolves: rhbz#1492059
  - Allow pegasus_t domain to eexec lvm binaries and allow read/write access to lvm control
  Resolves: rhbz#1463470
  - Add vhostmd_t domain to read/write to svirt images
  Resolves: rhbz#1465276
  - Dontaudit action when abrt-hook-ccpp is writing to nscd sockets
  Resolves: rhbz#1460715
  - Update openvswitch policy
  Resolves: rhbz#1594729
  - Update kdump_manage_kdumpctl_tmp_files() interface to allow caller domain also mmap kdumpctl_tmp_t files
  Resolves: rhbz#1583084
  - Allow sssd_t and slpad_t domains to mmap generic certs
  Resolves: rhbz#1592016
  Resolves: rhbz#1592019
  - Allow oddjob_t domain to mmap binary files as oddjob_mkhomedir_exec_t files
  Resolves: rhbz#1592022
  - Update dbus_system_domain() interface to allow system_dbusd_t domain to mmap binary file from second parameter
  Resolves: rhbz#1583080
  - Allow chronyc_t domain use inherited user ttys
  Resolves: rhbz#1593267
  - Allow stapserver_t domain to mmap own tmp files
  Resolves: rhbz#1593122
  - Allow sssd_t domain to mmap files labeled as sssd_selinux_manager_exec_t
  Resolves: rhbz#1592026
  - Update policy for ypserv_t domain
  Resolves: rhbz#1592032
  - Allow abrt_dump_oops_t domain to mmap all non security files
  Resolves: rhbz#1593728
  - Allow svirt_t domain mmap svirt_image_t files
  Resolves: rhbz#1592688
  - Allow virtlogd_t domain to write inhibit systemd pipes.
  Resolves: rhbz#1593740
  - Allow sysadm_t and staff_t domains to use sudo io logging
  Resolves: rhbz#1564470
  - Allow sysadm_t domain create sctp sockets
  Resolves: rhbz#1571591
  - Update mount_domtrans() interface to allow caller domain mmap mount_exec_t
  Resolves: rhbz#1592025
  - Allow dhcpc_t to mmap all binaries with label hostname_exec_t, ifconfig_exec_t and netutils_exec_t
  Resolves: rhbz#1594661


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-204
changelog:
  - Fix typo in logwatch interface file
  - Allow spamd_t to manage logwatch_cache_t files/dirs
  - Allow dnsmasw_t domain to create own tmp files and manage mnt files
  - Allow fail2ban_client_t to inherit rlimit information from parent process
  Resolves: rhbz#1513100
  - Allow nscd_t to read kernel sysctls
  Resolves: rhbz#1512852
  - Label /var/log/conman.d as conman_log_t
  Resolves: rhbz#1538363
  - Add dac_override capability to tor_t domain
  Resolves: rhbz#1540711
  - Allow certmonger_t to readwrite to user_tmp_t dirs
  Resolves: rhbz#1543382
  - Allow abrt_upload_watch_t domain to read general certs
  Resolves: rhbz#1545098
  - Update postfix_domtrans_master() interface to allow caller domain also mmap postfix_master_exec_t binary
  Resolves: rhbz#1583087
  - Allow postfix_domain to mmap postfix_qmgr_exec_t binaries
  Resolves: rhbz#1583088
  - Allow postfix_domain to mmap postfix_pickup_exec_t binaries
  Resolves: rhbz#1583091
  - Allow chornyd_t read phc2sys_t shared memory
  Resolves: rhbz#1578883
  - Allow virt_qemu_ga_t read utmp
  Resolves: rhbz#1571202
  - Add several allow rules for pesign policy: Resolves: rhbz#1468744 - Allow pesign domain to read /dev/random - Allow pesign domain to create netlink_kobject_uevent_t sockets - Allow pesign domain create own tmp files
  - Add setgid and setuid capabilities to mysqlfd_safe_t domain
  Resolves: rhbz#1474440
  - Add tomcat_can_network_connect_db boolean
  Resolves: rhbz#1477948
  - Update virt_use_sanlock() boolean to read sanlock state
  Resolves: rhbz#1448799
  - Add sanlock_read_state() interface
  - Allow postfix_cleanup_t domain to stream connect to all milter sockets BZ(1436026)
  Resolves: rhbz#1563423
  - Update abrt_domtrans and abrt_exec() interfaces to allow caller domain to mmap binary file
  Resolves:rhbz#1583080
  - Update nscd_domtrans and nscd_exec interfaces to allow caller domain also mmap nscd binaries
  Resolves: rhbz#1583086
  - Update snapperd_domtrans() interface to allow caller domain to mmap snapperd_exec_t file
  Resolves: rhbz#1583802
  - Allow zoneminder_t to getattr of fs_t
  Resolves: rhbz#1585328
  - Fix denials during ipa-server-install process on F27+
  Resolves: rhbz#1586029
  - Allow ipa_dnskey_t to exec ipa_dnskey_exec_t files
  Resolves: rhbz#1586033
  - Allow rhsmcertd_t domain to send signull to postgresql_t domain
  Resolves: rhbz#1588119
  - Allow policykit_t domain to dbus chat with dhcpc_t
  Resolves: rhbz#1364513
  - Adding new boolean keepalived_connect_any()
  Resolves: rhbz#1443473
  - Allow amanda to create own amanda_tmpfs_t files
  Resolves: rhbz#1452444
  - Add amanda_tmpfs_t label. BZ(1243752)
  - Allow gdomap_t domain to connect to qdomap_port_t
  Resolves: rhbz#1551944
  - Fix typos in sge
  - Fix typo in openvswitch policy
  - /usr/libexec/bluetooth/obexd should have only obexd_exec_t instead of bluetoothd_exec_t type
  - Allow sshd_keygen_t to execute plymouthd
  Resolves: rhbz#1583531
  - Update seutil_domtrans_setfiles() interface to allow caller domain to do mmap on setfiles_exec_t binary
  Resolves: rhbz#1583090
  - Allow systemd_networkd_t create and relabel tun sockets
  Resolves: rhbz#1583830
  - Allow map audisp_exec_t files fordomains executing this binary
  Resolves: rhbz#1586042
  - Add new interface postgresql_signull()
  - Add fs_read_xenfs_files() interface.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-203
changelog:
  - /usr/libexec/bluetooth/obexd should have only obexd_exec_t instead of bluetoothd_exec_t type
  - Allow dac override capability to mandb_t domain BZ(1529399)
  Resolves: rhbz#1423361
  - Allow inetd_child process to chat via dbus with abrt
  Resolves: rhbz#1428805
  - Allow zabbix_agent_t domain to connect to redis_port_t
  Resolves: rhbz#1418860
  - Allow rhsmcertd_t domain to read xenfs_t files
  Resolves: rhbz#1405870
  - Allow zabbix_agent_t to run zabbix scripts
  Resolves: rhbz#1380697
  - Allow rabbitmq_t domain to create own tmp files/dirs
  Resolves: rhbz#1546897
  - Allow policykit_t mmap policykit_auth_exec_t files
  Resolves: rhbz#1583082
  - Allow ipmievd_t domain to read general certs
  Resolves: rhbz#1514591
  - Add sys_ptrace capability to pcp_pmie_t domain
  - Allow squid domain to exec ldconfig
  Resolves: rhbz#1532017
  - Make working gpg agent in gpg_agent_t domain
  Resolves: rhbz#1535109
  - Update gpg SELinux policy module
  - Allow kexec to read kernel module files in /usr/lib/modules.
  Resolves: rhbz#1536690
  - Allow mailman_domain to read system network state
  Resolves: rhbz#1413510
  - Allow mailman_mail_t domain to search for apache configs
  Resolves: rhbz#1413510
  - Allow openvswitch_t domain to read neutron state and read/write fixed disk devices
  Resolves: rhbz#1499208
  - Allow antivirus_domain to read all domain system state
  Resolves: rhbz#1560986
  - Allow targetd_t domain to red gconf_home_t files/dirs
  Resolves: rhbz#1546671
  - Allow freeipmi domain to map sysfs_t files
  Resolves: rhbz#1575918
  - Label /usr/libexec/bluetooth/obexd as obexd_exec_t
  Resolves: rhbz#1351750
  - Update rhcs SELinux module
  Resolves: rhbz#1589257
  - Allow iscsid_t domain mmap kernel modules
  Resolves: rhbz#1589295
  - Allow iscsid_t domain mmap own tmp files
  Resolves: rhbz#1589295
  - Update iscsid_domtrans() interface to allow mmap iscsid_exec_t binary
  Resolves: rhbz#1589295
  - Update nscd_socket_use interface to allow caller domain also mmap nscd_var_run_t files.
  Resolves: rhbz#1589271
  - Allow nscd_t domain to mmap system_db_t files
  Resolves: rhbz#1589271
  - Add interface nagios_unconfined_signull()
  - Allow lircd_t domain read sssd public files Add setgid capability to lircd_t domain
  Resolves: rhbz#1550700
  - Add missing requires
  - Allow tomcat domain sends email
  Resolves: rhbz#1585184
  - Allow memcached_t domain nnp_transition becuase of systemd security features BZ(1514867)
  Resolves: rhbz#1585714
  - Allow kdump_t domain to map /boot files
  Resolves: rhbz#1588884
  - Fix typo in netutils policy
  - Allow confined users get AFS tokens
  Resolves: rhbz#1417671
  - Allow sysadm_t domain to chat via dbus
  Resolves: rhbz#1582146
  - Associate sysctl_kernel_t type with filesystem attribute
  - Allow confined users to use new socket classes for bluetooth, alg and tcpdiag sockets
  Resolves: rhbz#1557299
  - Allow user_t and staff_t domains create netlink tcpdiag sockets
  Resolves: rhbz#1557281
  - Add interface dev_map_sysfs
  - Allow xdm_t domain to execute xdm_var_lib_t files
  Resolves: rhbz#1589139
  - Allow syslogd_t domain to send signull to nagios_unconfined_plugin_t
  Resolves: rhbz#1569344
  - Label /dev/vhost-vsock char device as vhost_device_t
  - Add files_map_boot_files() interface
  Resolves: rhbz#1588884
  - Update traceroute_t domain to allow create dccp sockets
  Resolves: rhbz#1548350


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-202
changelog:
  - Update ctdb domain to support gNFS setup 
  Resolves: rhbz#1576818
  - Allow authconfig_t dbus chat with policykit
  Resolves: rhbz#1551241
  - Allow lircd_t domain to read passwd_file_t
  Resolves: rhbz:#1550700
  - Allow lircd_t domain to read system state
  Resolves: rhbz#1550700
  - Allow smbcontrol_t to mmap samba_var_t files and allow winbind create sockets BZ(1559795)
  Resolves: rhbz#1574521
  - Allow tangd_t domain read certs
  Resolves: rhbz#1509055
  - Allow httpd_sys_script_t to connect to mongodb_port_t if boolean httpd_can_network_connect_db  is turned on
  Resolves: rhbz:#1579219
  - Allow chronyc_t to redirect ourput to /var/lib /var/log and /tmp
  Resolves: rhbz#1574418
  - Allow ctdb_t domain modify ctdb_exec_t files
  Resolves: rhbz#1572584
  - Allow chrome_sandbox_t to mmap tmp files
  Resolves: rhbz#1574392
  - Allow ulogd_t to create netlink_netfilter sockets.
  Resolves: rhbz#1575924
  - Update ulogd SELinux security policy
  - Allow rhsmcertd_t domain send signull to apache processes
  Resolves: rhbz#1576555
  - Allow freeipmi domain to read sysfs_t files
  Resolves: rhbz#1575918
  - Allow smbcontrol_t to create dirs with samba_var_t label
  Resolves: rhbz#1574521
  - Allow swnserve_t domain to stream connect to sasl domain
  Resolves: rhbz#1574537
  - Allow SELinux users (except guest and xguest) to using bluetooth sockets
  Resolves: rhbz#1557299
  - Allow confined users to use new socket classes for bluetooth, alg and tcpdiag sockets
  Resolves: rhbz#1557299
  - Fix broken sysadm SELinux module
  Resolves: rhbz#1557311
  - Allow user_t and staff_t domains create netlink tcpdiag sockets
  Resolves: rhbz#1557281
  - Update ssh_domtrans_keygen interface to allow mmap ssh_keygen_exec_t binary file
  Resolves: rhbz#1583089
  - Allow systemd_networkd_t to read/write tun tap devices
  Resolves: rhbz#1583830
  - Add bridge_socket, dccp_socket, ib_socket and mpls_socket to socket_class_set
  Resolves: rhbz#1583771
  - Allow audisp_t domain to mmap audisp_exec_t binary
  Resolves: rhbz#1583551
  - Fix duplicates in sysadm.te file
  Resolves: rhbz#1307183
  - Allow sysadm_u use xdm
  Resolves: rhbz#1307183
  - Fix typo in sysnetwork.if file
  Resolves: rhbz#1581551


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-199
changelog:
  - Allow httpd_sys_script_t to connect to mongodb_port_t if boolean httpd_can_network_connect_db  is turned on
  Resolves: rhbz:#1579219
  - Allow chronyc_t to redirect ourput to /var/lib /var/log and /tmp
  Resolves: rhbz#1574418
  - Allow chrome_sandbox_t to mmap tmp files
  Resolves: rhbz#1574392
  - Allow ulogd_t to create netlink_netfilter sockets.
  Resolves: rhbz#1575924
  - Update ulogd SELinux security policy
  - Allow rhsmcertd_t domain send signull to apache processes
  Resolves: rhbz#1576555
  - Allow freeipmi domain to read sysfs_t files
  Resolves: rhbz#1575918
  - Allow smbcontrol_t to create dirs with samba_var_t label
  Resolves: rhbz#1574521
  - Allow swnserve_t domain to stream connect to sasl domain
  Resolves: rhbz#1574537
  - Fix typo in sysnetwork.if file
  Resolves: rhbz#1581551


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-197
changelog:
  - Improve procmail_domtrans() to allow mmaping procmail_exec_t
  - Allow hypervvssd_t domain to read fixed disk devices
  Resolves: rhbz#1581225
  - Improve modutils_domtrans_insmod() interface to mmap insmod_exec_t binaries
  Resolves: rhbz#1581551
  - Improve iptables_domtrans() interface to allow mmaping iptables_exec_t binary
  Resolves: rhbz#1581551
  - Improve auth_domtrans_login_programinterface to allow also mmap login_exec_t binaries
  Resolves: rhbz#1581551
  - Improve auth_domtrans_chk_passwd() interface to allow also mmaping chkpwd_exec_t binaries.
  Resolves: rhbz#1581551
  - Allow mmap dhcpc_exec_t binaries in sysnet_domtrans_dhcpc interface


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-196
changelog:
  - Add dbus_stream_connect_system_dbusd() interface.
  - Allow pegasus_t domain to mount tracefs_t filesystem
  Resolves:rhbz#1374570
  - Allow psad_t domain to read all domains state
  Resolves: rhbz#1558439
  - Add net_raw capability to named_t domain BZ(1545586)
  - Allow tomcat_t domain to connect to mongod_t tcp port
  Resolves:rhbz#1539748
  - Allow dovecot and postfix to connect to systemd stream sockets
  Resolves: rhbz#1368642
  - Label /usr/libexec/bluetooth/obexd as bluetoothd_exec_t to run process as bluetooth_t
  Resolves:rhbz#1351750
  - Rename tang policy to tangd
  - Add interface systemd_rfkill_domtrans()
  - Allow users staff and sysadm to run wireshark on own domain
  Resolves:rhbz#1546362
  - Allow systemd-bootchart to create own tmpfs files
  Resolves:rhbz#1510412


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-195
changelog:
  - Rename tang policy to tangd
  - Allow virtd_t domain to relabel virt_var_lib_t files 
  Resolves: rhbz#1558121
  - Allow logrotate_t domain to stop services via systemd
  Resolves: rhbz#1527522
  - Add tang policy
  Resolves: rhbz#1509055
  - Allow mozilla_plugin_t to create mozilla.pdf file in user homedir with label mozilla_home_t
  Resolves: rhbz#1559859
  - Improve snapperd SELinux policy
  Resolves: rhbz#1365555
  - Allow snapperd_t daemon to create unlabeled dirs.
  Resolves: rhbz#1365555
  - We have inconsistency in cgi templates with upstream, we use _content_t, but refpolicy use httpd__content_t. Created aliasses to make it consistence
  Resolves: rhbz#1271324
  - Allow Openvswitch adding netdev bridge ovs 2.7.2.10 FDP
  Resolves: rhbz#1503835
  - Add new Boolean tomcat_use_execmem
  Resolves: rhbz#1565226
  - Allow domain transition from logrotate_t to chronyc_t
  Resolves: rhbz#1568281
  - Allow nfsd_t domain to read/write sysctl fs files
  Resolves: rhbz#1516593
  - Allow conman to read system state
  Resolves: rhbz#1377915
  - Allow lircd_t to exec shell and add capabilities dac_read_search and dac_override
  Resolves: rhbz#1550700
  - Allow usbmuxd to access /run/udev/data/+usb:*.
  Resolves: rhbz#1521054
  - Allow abrt_t domain to manage kdump crash files 
  Resolves: rhbz#1491585
  - Allow systemd to use virtio console
  Resolves: rhbz#1558121
  - Allow transition from sysadm role into mdadm_t domain.
  Resolves: rhbz#1551568
  - Label /dev/op_panel and /dev/opal-prd as opal_device_t
  Resolves: rhbz#1537618
  - Label /run/ebtables.lock as iptables_var_run_t
  Resolves: rhbz#1511437
  - Allow udev_t domain to manage udev_rules_t char files.
  Resolves: rhbz#1545094
  - Allow nsswitch_domain to read virt_var_lib_t files, because of libvirt NSS plugin.
  Resolves: rhbz#1567753
  - Fix filesystem inteface file, we don't have nsfs_fs_t type, just nsfs_t
  Resolves: rhbz#1547700
  - Allow iptables_t domain to create dirs in etc_t with system_conf_t labels


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-194
changelog:
  - Add new boolean redis_enable_notify()
  Resolves: rhbz#1421326
  - Label  /var/log/shibboleth-www(/.*) as httpd_sys_rw_content_t
  Resolves: rhbz#1549514
  - Add new label for vmtools scripts and label it as vmtools_unconfined_t stored in /etc/vmware-tools/
  Resolves: rbhz#1463593
  - Remove labeling for /etc/vmware-tools to bin_t it should be vmtools_unconfined_exec_t
  Resolves: rbhz#1463593


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-193
changelog:
  - Backport several changes for snapperdfrom Fedora Rawhide
  Resolves: rhbz#1556798
  - Allow snapperd_t to set priority for kernel processes
  Resolves: rhbz#1556798
  - Make ganesha nfs server.
  Resolves: rhbz#1511489
  - Allow vxfs filesystem to use SELinux labels
  Resolves: rhbz#1482880
  - Add map permission to selinux-policy
  Resolves: rhbz#1460322


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-192
changelog:
  - Label /usr/libexec/dbus-1/dbus-daemon-launch-helper  as dbusd_exec_t to have systemd dbus services running in the correct domain instead of unconfined_service_t if unconfined.pp module is enabled.
  Resolves: rhbz#1546721


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-190
changelog:
  - Allow openvswitch domain to manage svirt_tmp_t sock files
  Resolves: rhbz#1540702
  - Fix broken systemd_tmpfiles_run() interface


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-189
changelog:
  - Allow dirsrv_t domain to create tmp link files
  Resolves: rhbz#1536011
  - Label /usr/sbin/ldap-agent as dirsrv_snmp_exec_t
  Resolves: rhbz#1428568
  - Allow ipsec_mgmt_t execute ifconfig_exec_t binaries
  - Allow ipsec_mgmt_t nnp domain transition to ifconfig_t
  Resolves: rhbz#1539416


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-188
changelog:
  - Allow svirt_domain to create socket files in /tmp with label svirt_tmp_t
  Resolves: rhbz#1540702
  - Allow keepalived_t domain getattr proc filesystem
  Resolves: rhbz#1477542
  - Rename svirt_sandbox_file_t to container_file_t and svirt_lxc_net_t to container_t
  Resolves: rhbz#1538544
  - Allow ipsec_t nnp transistions to domains ipsec_mgmt_t and ifconfig_t
  Resolves: rhbz:#1539416
  - Allow systemd_logind_t domain to bind on dhcpd_port_t,pki_ca_port_t,flash_port_t
  Resolves: rhbz#1479350


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-187
changelog:
  - Allow openvswitch_t domain to read cpuid, write to sysfs files and creating openvswitch_tmp_t sockets
  Resolves: rhbz#1535196
  - Add new interface ppp_filetrans_named_content()
  Resolves: rhbz#1530601
  - Allow keepalived_t read sysctl_net_t files
  Resolves: rhbz#1477542
  - Allow puppetmaster_t domtran to puppetagent_t
  Resolves: rhbz#1376893
  - Allow kdump_t domain to read kernel ring buffer
  Resolves: rhbz#1540004
  - Allow ipsec_t domain to exec ifconfig_exec_t binaries.
  Resolves: rhbz#1539416
  - Allow unconfined_domain_typ to create pppd_lock_t directory in /var/lock
  Resolves: rhbz#1530601
  - Allow updpwd_t domain to create files in /etc with shadow_t label
  Resolves: rhbz#1412838
  - Allow iptables sysctl load list support with SELinux enforced
  Resolves: rhbz#1535572


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-186
changelog:
  - Allow virt_domains to acces infiniband pkeys.
  Resolves: rhbz#1533183
  - Label /usr/libexec/ipsec/addconn as ipsec_exec_t to run this script as ipsec_t instead of init_t
  Resolves: rhbz#1535133
  - Allow audisp_remote_t domain write to files on all levels
  Resolves: rhbz#1534924


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-185
changelog:
  - Allow vmtools_t domain creating vmware_log_t files
  Resolves: rhbz#1507048
  - Allow openvswitch_t domain to acces infiniband devices
  Resolves: rhbz#1532705


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-184
changelog:
  - Allow chronyc_t domain to manage chronyd_keys_t files.
  Resolves: rhbz#1530525
  - Make virtlog_t domain system dbus client
  Resolves: rhbz#1481109
  - Update openvswitch SELinux module
  Resolves: rhbz#1482682
  - Allow virtd_t to create also sock_files with label virt_var_run_t
  Resolves: rhbz#1484075


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-182
changelog:
  - Label /dev/drm_dp_aux* as xserver_misc_device_t
  Resolves: rhbz#1520897
  - Allow sysadm_t to run puppet_exec_t binaries as puppet_t
  Resolves: rhbz#1255745


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-181
changelog:
  - Allow tomcat_t to manage pki_tomcat pid files
  Resolves: rhbz#1478371
  - networkmanager: allow talking to openvswitch
  Resolves: rhbz#1517247
  - Allow networkmanager_t and opensm_t to manage subned endports for IPoIB VLANs
  Resolves: rhbz#1517895
  - Allow domains networkmanager_t and opensm_t to control IPoIB VLANs
  Resolves: rhbz#1517744
  - Fix typo in guest interface file
  Resolves: rhbz#1468254
  - Allow isnsd_t domain to accept tcp connections.
  Resolves: rhbz#1390208


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-179
changelog:
  - Allow ldap_t domain to manage also slapd_tmp_t lnk files
  Resolves: rhbz#1510883
  - Allow cluster_t domain creating bundles directory with label var_log_t instead of cluster_var_log_t
  Resolves: rhbz:#1508360
  - Add dac_read_search and dac_override capabilities to ganesha
  Resolves: rhbz#1483451


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-178
changelog:
  - Add dependency for policycoreutils-2.5.18 becuase of new cgroup_seclabel policy capability
  Resolves: rhbz#1510145


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-177
changelog:
  - Allow jabber domains to connect to postgresql ports
  Resolves: rhbz#1438489
  - Dontaudit accountsd domain creating dirs in /root
  Resolves: rhbz#1456760 
  - Dontaudit slapd_t to block suspend system
  Resolves: rhbz: #1479759 
  - Allow spamc_t to stream connect to cyrus.
  Resolves: rhbz#1382955 
  - allow imapd to read /proc/net/unix file
  Resolves: rhbz#1393030 
  - Allow passenger to connect to mysqld_port_t
  Resolves: rhbz#1433464


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-176
changelog:
  - Allow chronyc_t domain to use user_ptys
  Resolves: rhbz#1470150
  - allow ptp4l to read /proc/net/unix file
  - Allow conmand to use usb ttys.
  Resolves: rhbz#1505121
  - Label all files /var/log/opensm.* as opensm_log_t because opensm creating new log files with name opensm-subnet.lst
  Resolves: rhbz#1505845
  - Allow chronyd daemon to execute chronyc.
  Resolves: rhbz#1508486
  - Allow firewalld exec ldconfig.
  Resolves: rhbz#1375576
  - Allow mozilla_plugin_t domain to dbus chat with devicekit
  Resolves: rhbz#1460477
  - Dontaudit leaked logwatch pipes
  Resolves: rhbz#1450119
  - Label /usr/bin/VGAuthService as vmtools_exec_t to confine this daemon.
  Resolves: rhbz#1507048
  - Allow httpd_t domain to execute hugetlbfs_t files
  Resolves: rhbz#1507682
  - Allow nfsd_t domain to read configfs_t files/dirs
  Resolves: rhbz#1439442
  - Hide all allow rules with ptrace inside deny_ptrace boolean
  Resolves: rhbz#1421075
  - Allow tgtd_t domain to read generic certs
  Resolves: rhbz#1438532
  - Allow ptp4l to send msgs via dgram socket to unprivileged user domains
  Resolves: rhbz#1429853
  - Allow dirsrv_snmp_t to use inherited user ptys and read system state
  Resolves: rhbz#1428568
  - Allow glusterd_t domain to create own tmpfs dirs/files
  Resolves: rhbz#1411310
  - Allow keepalived stream connect to snmp
  Resolves: rhbz#1401556
  - After fix in kernel where LSM hooks for dac_override and dac_search_read capability was swaped we need to fix it also in policy
  Resolves: rhbz#1507089


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-175
changelog:
  - Allow pegasus_openlmi_services_t to read generic certs
  Resolves: rhbz#1462292
  - Allow ganesha_t domain to read random device
  Resolves: rhbz#1494382
  - Allow zabbix_t domain to change its resource limits
  Resolves: rhbz:#1504074
  - Add new boolean nagios_use_nfs
  Resolves: rhbz#1504826
  - Allow system_mail_t to search network sysctls
  Resolves: rhbz#1505779
  - Add samba_manage_var_dirs() interface
  - Fix typo bug in virt filecontext file
  - Allow nagios_script_t to read nagios_spool_t files
  Resolves: rhbz#1426824
  - Allow samba to manage var dirs/files
  Resolves: rhbz#1415088
  - Allow sbd_t to create own sbd_tmpfs_t dirs/files
  Resolves: rhbz#1380795
  - Allow firewalld and networkmanager to chat with hypervkvp via dbus
  Resolves: rhbz#1377276
  - Allow dmidecode to read rhsmcert_log_t files
  Resolves: rhbz#1300799
  - Allow mail system to connect mariadb sockets.
  Resolves: rhbz#1368642
  - Allow logrotate_t to change passwd and reloead services
  Resolves: rhbz#1450789
  - Allow mail system to connect mariadb sockets.
  Resolves: rhbz#1368642
  - Allow logrotate_t to change passwd and reloead services
  Resolves: rhbz#1450789
  - Allow pegasus_openlmi_services_t to read generic certs
  Resolves: rhbz#1462292
  - Allow ganesha_t domain to read random device
  Resolves: rhbz#1494382
  - Allow zabbix_t domain to change its resource limits
  Resolves: rhbz:#1504074
  - Add new boolean nagios_use_nfs
  Resolves: rhbz#1504826
  - Allow system_mail_t to search network sysctls
  Resolves: rhbz#1505779
  - Add samba_manage_var_dirs() interface
  - Fix typo bug in virt filecontext file
  - Allow nagios_script_t to read nagios_spool_t files
  Resolves: rhbz#1426824
  - Allow samba to manage var dirs/files
  Resolves: rhbz#1415088
  - Allow sbd_t to create own sbd_tmpfs_t dirs/files
  Resolves: rhbz#1380795
  - Allow firewalld and networkmanager to chat with hypervkvp via dbus
  Resolves: rhbz#1377276
  - Allow dmidecode to read rhsmcert_log_t files
  Resolves: rhbz#1300799
  - Allow mail system to connect mariadb sockets.
  Resolves: rhbz#1368642
  - Allow logrotate_t to change passwd and reloead services
  Resolves: rhbz#1450789
  - Allow chronyd_t do request kernel module and block_suspend capability
  Resolves: rhbz#1350765
  - Allow system_cronjob_t to create /var/lib/letsencrypt dir with right label
  Resolves: rhbz#1447278
  - Allow httpd_t also read httpd_user_content_type dirs when httpd_enable_homedirs is enables
  Resolves: rhbz#1491994
  - Allow svnserve to use kerberos
  Resolves: rhbz#1475271
  - Allow conman to use ptmx. Add conman_use_nfs boolean
  Resolves: rhbz#1377915
  - Add nnp transition for services using: NoNewPrivileges systemd security feature
  Resolves: rhbz#1311430
  - Add SELinux support for chronyc
  Resolves: rhbz#1470150
  - Add dac_read_search capability to openvswitch_t domain
  Resolves: rhbz#1501336
  - Allow svnserve to manage own svnserve_log_t files/dirs
  Resolves: rhbz#1480741
  - Allow keepalived_t to search network sysctls
  Resolves: rhbz#1477542
  - Allow puppetagent_t domain dbus chat with rhsmcertd_t domain
  Resolves: rhbz#1446777
  - Add dccp_socket into socker_class_set subset
  Resolves: rhbz#1459941
  - Allow iptables_t to run setfiles to restore context on system
  Resolves: rhbz#1489118
  - Label 20514 tcp/udp ports as syslogd_port_t Label 10514 tcp/udp portas as syslog_tls_port_t
  Resolves: rhbz:#1411400
  - Make nnp transition Active
  Resolves: rhbz#1480518
  - Label tcp 51954 as isns_port_t
  Resolves: rhbz#1390208
  - Add dac_read_search capability chkpwd_t
  Resolves: rhbz#1376991
  - Add support for running certbot(letsencrypt) in crontab
  Resolves: rhbz#1447278
  - Add init_nnp_daemon_domain interface
  - Allow xdm_t to gettattr /dev/loop-control device
  Resolves: rhbz#1462925
  - Allow nnp trasintion for unconfined_service_t
  Resolves: rhbz#1311430
  - Allow unpriv user domains and unconfined_service_t to use chronyc
  Resolves: rhbz#1470150
  - Allow iptables to exec plymouth.
  Resolves: rhbz#1480374
  - Fix typo in fs_unmount_tracefs interface.
  Resolves: rhbz#1371057
  - Label postgresql-check-db-dir as postgresql_exec_t
  Resolves: rhbz#1490956


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-174
changelog:
  - We should not ship selinux-policy with permissivedomains enabled.
  Resolves: rhbz#1494172
  - Fix order of installing selinux-policy-sandbox, because of depedencied in sandbox module, selinux-policy-targeted needs to be installed before selinux-policy-sandbox
  Resolves: rhbz#1492606


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-173
changelog:
  - Allow tomcat to setsched 
  Resolves: rhbz#1492730
  - Fix rules blocking ipa-server upgrade process
  Resolves: rhbz#1478371
  - Add new boolean tomcat_read_rpm_db()
  Resolves: rhbz#1477887
  - Allow tomcat to connect on mysqld tcp ports
  - Add ctdbd_t domain sys_source capability and allow setrlimit
  Resolves: rhbz#1491235
  - Fix keepalived SELinux module
  - Allow automount domain to manage mount pid files
  Resolves: rhbz#1482381
  - Allow stunnel_t domain setsched
  Resolves: rhbz#1479383
  - Add keepalived domain setpgid capability
  Resolves: rhbz#1486638
  - Allow tomcat domain to connect to mssql port
  Resolves: rhbz#1484572
  - Remove snapperd_t from unconfined domaines
  Resolves: rhbz#1365555
  - Fix typo bug in apache module
  Resolves: rhbz#1397311
  - Dontaudit that system_mail_t is trying to read /root/ files
  Resolves: rhbz#1147945
  - Make working webadm_t userdomain
  Resolves: rhbz#1323792
  - Allow redis domain to execute shell scripts.
  Resolves: rhbz#1421326
  - Allow system_cronjob_t to create redhat-access-insights.log with var_log_t
  Resolves: rhbz#1473303
  - Add couple capabilities to keepalived domain and allow get attributes of all domains
  Resolves: rhbz#1429327
  - Allow dmidecode read rhsmcertd lock files
  Resolves: rhbz#1300799
  - Add new interface rhsmcertd_rw_lock_files()
  Resolves: rhbz#1300799
  - Label all plymouthd archives as plymouthd_var_log_t
  Resolves: rhbz#1478323
  - Allow cloud_init_t to dbus chat with systemd_timedated_t
  Resolves: rhbz#1440730
  - Allow logrotate_t to write to kmsg
  Resolves: rhbz#1397744
  - Add capability kill to rhsmcertd_t
  Resolves: rhbz#1398338
  - Disable mysqld_safe_t secure mode environment cleansing.
  Resolves: rhbz#1464063
  - Allow winbind to manage smbd_tmp_t files
  Resolves: rhbz#1475566
  - Dontaudit that system_mail_t is trying to read /root/ files
  Resolves: rhbz#1147945
  - Make working webadm_t userdomain
  Resolves: rhbz#1323792
  - Allow redis domain to execute shell scripts.
  Resolves: rhbz#1421326
  - Allow system_cronjob_t to create redhat-access-insights.log with var_log_t
  Resolves: rhbz#1473303
  - Add couple capabilities to keepalived domain and allow get attributes of all domains
  Resolves: rhbz#1429327
  - Allow dmidecode read rhsmcertd lock files
  Resolves: rhbz#1300799
  - Add new interface rhsmcertd_rw_lock_files()
  Resolves: rhbz#1300799
  - Label all plymouthd archives as plymouthd_var_log_t
  Resolves: rhbz#1478323 
  - Allow cloud_init_t to dbus chat with systemd_timedated_t
  Resolves: rhbz#1440730
  - Allow logrotate_t to write to kmsg
  Resolves: rhbz#1397744
  - Add capability kill to rhsmcertd_t
  Resolves: rhbz#1398338
  - Disable mysqld_safe_t secure mode environment cleansing.
  Resolves: rhbz#1464063
  - Allow winbind to manage smbd_tmp_t files
  Resolves: rhbz#1475566
  - Add interface systemd_tmpfiles_run
  - End of file cannot be in comment
  - Allow systemd-logind to use ypbind
  Resolves: rhbz#1479350
  - Add creating opasswd file with shadow_t SELinux label in auth_manage_shadow() interface
  Resolves: rhbz#1412838
  - Allow sysctl_irq_t assciate with proc_t
  Resolves: rhbz#1485909
  - Enable cgourp sec labeling
  Resolves: rhbz#1485947
  - Add cgroup_seclabel policycap.
  Resolves: rhbz#1485947
  - Allow sshd_t domain to send signull to xdm_t processes
  Resolves: rhbz#1448959
  - Allow updpwd_t domain auth file name trans
  Resolves: rhbz#1412838
  - Allow sysadm user to run systemd-tmpfiles
  Resolves: rbhz#1325364
  - Add support labeling for vmci and vsock device
  Resolves: rhbz#1451358
  - Add userdom_dontaudit_manage_admin_files() interface
  Resolves: rhbz#1323792
  - Allow iptables_t domain to read files with modules_conf_t label
  Resolves: rhbz#1373220
  - init: Add NoNewPerms support for systemd.
  Resolves: rhbz#1480518
  - Add nnp_nosuid_transition policycap and related class/perm definitions.
  Resolves: rhbz#1480518
  - refpolicy: Infiniband pkeys and endports
  Resolves: rhbz#1464484


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-171
changelog:
  - Allow targetd_t to create own tmp files.
  - Dontaudit targetd_t to exec rpm binary file.
  Resolves: rhbz#1373860
  Resolves: rhbz#1424621


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-170
changelog:
  - Add few rules to make working targetd daemon with SELinux
  Resolves: rhbz#1373860
  - Allow ipmievd_t domain to load kernel modules
  Resolves: rhbz#1441081
  - Allow logrotate to reload transient systemd unit
  Resolves: rhbz#1440515
  - Add certwatch_t domain dac_override and dac_read_search capabilities
  Resolves: rhbz#1422000
  - Allow postgrey to execute bin_t files and add postgrey into nsswitch_domain
  Resolves: rhbz#1412072
  - Allow nscd_t domain to search network sysctls
  Resolves: rhbz#1432361
  - Allow iscsid_t domain to read mount pid files
  Resolves: rhbz#1482097
  - Allow ksmtuned_t domain manage sysfs_t files/dirs
  Resolves: rhbz#1413865
  - Allow keepalived_t domain domtrans into iptables_t
  Resolves: rhbz#1477719
  - Allow rshd_t domain reads net sysctls
  Resolves: rhbz#1477908
  - Add interface seutil_dontaudit_read_module_store()
  - Update interface lvm_rw_pipes() by adding also open permission
  - Label /dev/clp device as vfio_device_t
  Resolves: rhbz#1477624
  - Allow ifconfig_t domain unmount fs_t
  Resolves: rhbz#1477445
  - Label /dev/gpiochip* devices as gpio_device_t
  Resolves: rhbz#1477618
  - Add interface  dev_manage_sysfs()
  Resolves: rhbz#1474989


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-166
changelog:
  - Add new boolean gluster_use_execmem
  Resolves: rhbz#1469027
  - Allow cluster_t and glusterd_t domains to dbus chat with ganesha service
  Resolves: rhbz#1468581


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-164
changelog:
  - Allow couple rules needed to start targetd daemon with SELinux in enforcing mode
  Resolves: rhbz#1424621
  - Add interface lvm_manage_metadata
  Resolves: rhbz#1424621


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-163
changelog:
  - Allow sssd_t to read realmd lib files.
  Resolves: rhbz#1436689
  - Add permission open to files_read_inherited_tmp_files() interface
  Resolves: rhbz#1290633
  Resolves: rhbz#1457106


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-160
changelog:
  - Allow named_t to bind on udp 4321 port
  Resolves: rhbz#1312972
  - Allow systemd-sysctl cap. sys_ptrace
  Resolves: rhbz#1458999


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-158
changelog:
  - Allow iscsi domain load kernel module.
  Resolves: rhbz#1457874
  - Allow keepalived domain connect to squid tcp port
  Resolves: rhbz#1457455
  - Allow krb5kdc_t domain read realmd lib files.
  Resolves: rhbz#1436689
  - xdm_t should view kernel keys
  Resolves: rhbz#1432645


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-157
changelog:
  - Allow tomcat to connect on all unreserved ports
  - Allow ganesha to connect to all rpc ports
  Resolves: rhbz#1448090
  - Update ganesha with another fixes.
  Resolves: rhbz#1448090
  - Update rpc_read_nfs_state_data() interface to allow read also lnk_files.
  Resolves: rhbz#1448090
  - virt_use_glusterd boolean should be in optional block Update ganesha module to allow create tmp files
  Resolves: rhbz#1448090
  - Hide broken symptoms when machine is configured with network bounding.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-156
changelog:
  - Add new boolean virt_use_glusterd
  Resolves: rhbz#1455994
  - Add capability sys_boot for sbd_t domain
  - Allow sbd_t domain to create rpc sysctls.
  Resolves: rhbz#1455631
  - Allow ganesha_t domain to manage glusterd_var_run_t pid files.
  Resolves: rhbz#1448090


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-155
changelog:
  - Create new interface: glusterd_read_lib_files()
  - Allow ganesha read glusterd lib files.
  - Allow ganesha read network sysctls
  Resolves: rhbz#1448090


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-154
changelog:
  - Add few allow rules to ganesha module
  Resolves: rhbz#1448090
  - Allow condor_master_t to read sysctls.
  Resolves: rhbz#1277506
  - Add dac_override cap to ctdbd_t domain
  Resolves: rhbz#1435708
  - Label 8750 tcp/udp port as dey_keyneg_port_t
  Resolves: rhbz#1448090


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-152
changelog:
  - Allow httpd_t reading kerberos kdc config files
  Resolves: rhbz#1452215
  - Allow tomcat_t domain connect to ibm_dt_2 tcp port.
  Resolves: rhbz#1447436
  - Allow stream connect to initrc_t domains
  Resolves: rhbz#1447436
  - Allow  dnsmasq_t domain to read systemd-resolved pid files.
  Resolves: rhbz#1453114
  - Allow tomcat domain name_bind on tcp bctp_port_t
  Resolves: rhbz#1451757
  - Allow smbd_t domain generate debugging files under /var/run/gluster. These files are created through the libgfapi.so library that provides integration of a GlusterFS client in the Samba (vfs_glusterfs) process.
  Resolves: rhbz#1447669
  - Allow condor_master_t write to sysctl_net_t
  Resolves: rhbz#1277506
  - Allow nagios check disk plugin read /sys/kernel/config/
  Resolves: rhbz#1277718
  - Allow pcp_pmie_t domain execute systemctl binary
  Resolves: rhbz#1271998
  - Allow nagios to connect to stream sockets. Allow nagios start httpd via systemctl
  Resolves: rhbz#1247635
  - Label tcp/udp port 1792 as ibm_dt_2_port_t
  Resolves: rhbz#1447436
  - Add interface fs_read_configfs_dirs()
  - Add interface fs_read_configfs_files()
  - Fix systemd_resolved_read_pid interface
  - Add interface systemd_resolved_read_pid()
  Resolves: rhbz#1453114
  - Allow sshd_net_t domain read/write into crypto devices
  Resolves: rhbz#1452759
  - Label 8999 tcp/udp as bctp_port_t
  Resolves: rhbz#1451757


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-151
changelog:
  - nmbd_t needs net_admin capability like smbd
  Resolves: rhbz#1431859
  - Dontaudit net_admin capability for domains postfix_master_t and postfix_qmgr_t
  Resolves: rhbz#1431859
  - Allow rngd domain read sysfs_t
  Resolves: rhbz#1451735
  - Add interface pki_manage_common_files()
  Resolves: rhbz#1447436
  - Allow tomcat_t domain to manage pki_common_t files and dirs
  Resolves: rhbz#1447436
  - Use stricter fc rules for sssd sockets in /var/run
  Resolves: rhbz#1448060
  - Allow certmonger reads httpd_config_t files
  Resolves: rhbz#1436689
  - Allow keepalived_t domain creating netlink_netfilter_socket.
  Resolves: rhbz#1451684
  - Allow tomcat domain read rpm_var_lib_t files Allow tomcat domain exec rpm_exec_t files Allow tomcat domain name connect on oracle_port_t Allow tomcat domain read cobbler_var_lib_t files.
  Resolves: rhbz#1451318
  - Make able deply overcloud via neutron_t to label nsfs as fs_t
  Resolves: rhbz#1373321


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-150
changelog:
  - Allow tomcat domain read rpm_var_lib_t files Allow tomcat domain exec rpm_exec_t files Allow tomcat domain name connect on oracle_port_t Allow tomcat domain read cobbler_var_lib_t files.
  Resolves: rhbz#1451318
  - Allow sssd_t domain creating sock files labeled as sssd_var_run_t in /var/run/
  Resolves: rhbz#1448056 Resolves: rhbz#1448060
  - Allow tomcat_domain connect to    * postgresql_port_t    * amqp_port_t Allow tomcat_domain read network sysctls
  Resolves: rhbz#1450819
  - Make able deply overcloud via neutron_t to label nsfs as fs_t
  Resolves: rhbz#1373321
  - Allow netutils setpcap capability
  Resolves:1444438


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-149
changelog:
  - Update targetd policy to accommodate changes in the service
  Resolves: rhbz#1424621
  - Allow tomcat_domain connect to    * postgresql_port_t    * amqp_port_t Allow tomcat_domain read network sysctls
  Resolves: rhbz#1450819
  - Update virt_rw_stream_sockets_svirt() interface to allow confined users set socket options.
  Resolves: rhbz#1415841
  - Allow radius domain stream connec to postgresql
  Resolves: rhbz#1446145
  - Allow virt_domain to read raw fixed_disk_device_t to make working blockcommit
  Resolves: rhbz#1449977
  - Allow glusterd_t domain start ganesha service
  Resolves: rhbz#1448090
  - Made few cosmetic changes in sssd SELinux module
  Resolves: rhbz#1448060
  - sssd-kcm should not run as unconfined_service_t BZ(1447411)
  Resolves: rhbz#1448060
  - Add sssd_secrets labeling Also add named_filetrans interface to make sure all labels are correct
  Resolves: rhbz#1448056
  - Allow keepalived_t domain read usermodehelper_t
  Resolves: rhbz#1449769
  - Allow tomcat_t domain read pki_common_t files
  Resolves: rhbz#1447436
  - Add interface pki_read_common_files()
  Resolves: rhbz#1447436


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-148
changelog:
  - Allow hypervkvp_t domain execute hostname
  Resolves: rhbz#1449064
  - Dontaudit sssd_selinux_manager_t use of net_admin capability
  Resolves: rhbz#1444955
  - Allow tomcat_t stream connect to pki_common_t
  Resolves: rhbz#1447436
  - Dontaudit xguest_t's attempts to listen to its tcp_socket
  - Allow sssd_selinux_manager_t to ioctl init_t sockets
  Resolves: rhbz#1436689
  - Allow <role>_su_t to create netlink_selinux_socket
  Resolves rhbz#1146987
  - Allow unconfined_t to module_load any file
  Resolves rhbz#1442994


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-147
changelog:
  - Improve ipa_cert_filetrans_named_content() interface to also allow caller domain manage ipa_cert_t type.
  Resolves: rhbz#1436689


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-146
changelog:
  - Allow pki_tomcat_t domain read /etc/passwd.
  Resolves: rhbz#1436689
  - Allow tomcat_t domain read ipa_tmp_t files
  Resolves: rhbz#1436689
  - Label new path for ipa-otpd
  Resolves: rhbz#1446353
  - Allow radiusd_t domain stream connect to postgresql_t
  Resolves: rhbz#1446145
  - Allow rhsmcertd_t to execute hostname_exec_t binaries.
  Resolves: rhbz#1445494
  - Allow virtlogd to append nfs_t files when virt_use_nfs=1
  Resolves: rhbz#1402561


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-145
changelog:
  - Update tomcat policy to adjust for removing unconfined_domain attr.
  Resolves: rhbz#1432083
  - Allow httpd_t domain read also httpd_user_content_type lnk_files.
  Resolves: rhbz#1383621
  - Allow httpd_t domain create /etc/httpd/alias/ipaseesion.key with label ipa_cert_t
  Resolves: rhbz#1436689
  - Dontaudit <user>_gkeyringd_t stream connect to system_dbusd_t
  Resolves: rhbz#1052880
  - Label /var/www/html/nextcloud/data as httpd_sys_rw_content_t
  Resolves: rhbz#1425530
  - Add interface ipa_filetrans_named_content()
  Resolves: rhbz#1432115
  - Allow tomcat use nsswitch
  Resolves: rhbz#1436689
  - Allow certmonger_t start/status generic services
  Resolves: rhbz#1436689
  - Allow dirsrv read cgroup files.
  Resolves: rhbz#1436689
  - Allow ganesha_t domain read/write infiniband devices.
  Resolves: rhbz#1383784
  - Allow sendmail_t domain sysctl_net_t files
  Resolves: rhbz#1369376
  - Allow targetd_t domain read network state and getattr on loop_control_device_t
  Resolves: rhbz#1373860
  - Allow condor_schedd_t domain send mails.
  Resolves: rhbz#1277506
  - Alow certmonger to create own systemd unit files.
  Resolves: rhbz#1436689
  - Allow staff to systemctl virt server when staff_use_svirt=1
  Resolves: rhbz#1415841
  - Allow unconfined_t create /tmp/ca.p12 file with ipa_tmp_t context
  Resolves: rhbz#1432115
  - Label /sysroot/ostree/deploy/rhel-atomic-host/* as root_t
  Resolves: rhbz#1428112


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-143
changelog:
  - Hide broken symptoms when using kernel 3.10.0-514+ with network bonding. Postfix_picup_t domain requires NET_ADMIN capability which is not really needed.
  Resolves: rhbz#1431859
  - Fix policy to reflect all changes in new IPA release
  Resolves: rhbz#1432115
  Resolves: rhbz#1436689


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-142
changelog:
  - Allow sbd_t to read/write fixed disk devices
  Resolves: rhbz#1440165
  - Add sys_ptrace capability to radiusd_t domain
  Resolves: rhbz#1426641
  - Allow cockpit_session_t domain connects to ssh tcp ports.
  Resolves: rhbz#1413509


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-140
changelog:
  - Allow pcp_pmcd_t net_admin capability.
  - Allow pcp_pmcd_t read net sysctls
  - Allow system_cronjob_t create /var/run/pcp with pcp_var_run_t
  Resolves: rhbz#1336211


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-139
changelog:
  - Fix all AVC denials during pkispawn of CA
  Resolves: rhbz#1436383
  - Update pki interfaces and tomcat module
  Resolves: rhbz#1436689


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-137
changelog:
  - Dontaudit firewalld wants write to /root
  Resolves: rhbz#1438708
  - Dontaudit firewalld to create dirs in /root/
  Resolves: rhbz#1438708
  - Allow sendmail to search network sysctls
  Resolves: rhbz#1369376
  - Add interface gssd_noatsecure()
  Resolves: rhbz#1438036
  - Add interface gssproxy_noatsecure()
  Resolves: rhbz#1438036
  - Dontaudit pcp_pmlogger_t search for xserver logs. Allow pcp_pmlogger_t to send signals to unconfined doamins Allow pcp_pmlogger_t to send logs to journals
  Resolves: rhbz#1379371
  - Allow chronyd_t net_admin capability to allow support HW timestamping.
  Resolves: rhbz#1416015
  - Update tomcat policy
  Resolves: rhbz#1436689
  Resolves: rhbz#1436383
  - Allow certmonger to start haproxy service
  Resolves: rhbz#1349394
  - Allow init noatsecure for gssd and gssproxy
  Resolves: rhbz#1438036


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-136
changelog:
  - geoclue wants to dbus chat with avahi
  Resolves: rhbz#1434286
  - Allow iptables get list of kernel modules
  Resolves: rhbz#1367520
  - Allow unconfined_domain_type to enable/disable transient unit
  Resolves: rhbz#1337041
  - Add interfaces init_enable_transient_unit() and init_disable_transient_unit
  - Revert "Allow sshd setcap capability. This is needed due to latest changes in sshd"
  Resolves: rhbz#1435264
  - Label sysroot dir under ostree as root_t
  Resolves: rhbz#1428112


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-134
changelog:
  - Allow named_t domain bind on several udp ports
  Resolves: rhbz#1312972
  - Update nscd_use() interface
  Resolves: rhbz#1281716
  - Allow radius_t domain ptrace
  Resolves: rhbz#1426641
  - Update nagios to allos exec systemctl
  Resolves: rhbz#1247635
  - Update pcp SELinux module to reflect all pcp changes
  Resolves: rhbz#1271998
  - Label /var/lib/ssl_db as squid_cache_t Label /etc/squid/ssl_db as squid_cache_t
  Resolves: rhbz#1325527
  - Allow pcp_pmcd_t domain search for network sysctl Allow pcp_pmcd_t domain sys_ptrace capability Resolves: rhbz#1336211


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-133
changelog:
  - Allow drbd load modules
  Resolves: rhbz#1134883
  - Revert "Add sys_module capability for drbd
  Resolves: rhbz#1134883"
  - Allow stapserver list kernel modules
  Resolves: rhbz#1325976
  - Update targetd policy
  Resolves: rhbz#1373860
  - Add sys_admin capability to amanda
  Resolves: rhbz#1371561
  - Allow hypervvssd_t to read all dirs.
  Resolves: rhbz#1331309
  - Label /run/haproxy.sock socket as haproxy_var_run_t
  Resolves: rhbz#1386233
  - Allow oddjob_mkhomedir_t to mamange autofs_t dirs.
  Resolves: rhbz#1408819
  - Allow tomcat to connect on http_cache_port_t
  Resolves: rhbz#1432083
  - Allow geoclue to send msgs to syslog.
  Resolves: rhbz#1434286
  - Allow condor_master_t domain capability chown.
  Resolves: rhbz#1277506
  - Update mta_filetrans_named_content() interface to allow calling domain create files labeled as etc_aliases_t in dir labeled as etc_mail_t.
  Resolves: rhbz#1167468
  - Allow nova domain search for httpd configuration.
  Resolves: rhbz#1190761
  - Add sys_module capability for drbd
  Resolves: rhbz#1134883
  - Allow user_u users stream connect to dirsrv, Allow sysadm_u and staff_u users to manage dirsrv files
  Resolves: rhbz#1286474
  - Allow systemd_networkd_t communicate with systemd_networkd_t via dbus
  Resolves: rhbz#1278010


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-132
changelog:
  - Add haproxy_t domain fowner capability
  Resolves: rhbz#1386233
  - Allow domain transition from ntpd_t to hwclock_t domains
  Resolves: rhbz#1375624
  - Allow cockpit_session_t setrlimit and sys_resource
  Resolves: rhbz#1402316
  - Dontaudit svirt_t read state of libvirtd domain
  Resolves: rhbz#1426106
  - Update httpd and gssproxy modules to reflects latest changes in freeipa
  Resolves: rhbz#1432115
  - Allow iptables read modules_conf_t
  Resolves: rhbz#1367520


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-131
changelog:
  - Remove tomcat_t domain from unconfined domains
  Resolves: rhbz#1432083
  - Create new boolean: sanlock_enable_home_dirs()
  Resolves: rhbz#1432783
  - Allow mdadm_t domain to read/write nvme_device_t
  Resolves: rhbz#1431617
  - Remove httpd_user_*_content_t domains from user_home_type attribute. This tighten httpd policy and acces to user data will be more strinct, and also fix mutual influente between httpd_enable_homedirs and httpd_read_user_content
  Resolves: rhbz#1383621
  - Dontaudit domain to create any file in /proc. This is kernel bug.
  Resolves: rhbz#1412679
  - Add interface dev_rw_nvme
  Resolves: rhbz#1431617


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-130
changelog:
  - Allow gssproxy to get attributes on all filesystem object types.
  Resolves: rhbz#1430295
  - Allow ganesha to chat with unconfined domains via dbus
  Resolves: rhbz#1426554
  - add the policy required for nextcloud
  Resolves: rhbz#1425530
  - Add nmbd_t capability2 block_suspend
  Resolves: rhbz#1425357
  - Label /var/run/chrony as chronyd_var_run_t
  Resolves: rhbz#1416015
  - Add domain transition from sosreport_t to iptables_t
  Resolves: rhbz#1359789
  - Fix path to /usr/lib64/erlang/erts-5.10.4/bin/epmd
  Resolves: rhbz:#1332803


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-128
changelog:
  - Add handling booleans via selinux-policy macros in custom policy spec files.
  Resolves: rhbz#1380854


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-125
changelog:
  - Update ganesha policy
  Resolves: rhbz#1426554
  Resolves: rhbz#1383784
  - Allow chronyd to read adjtime
  Resolves: rhbz#1416015
  - Fixes for chrony version 2.2
  Resolves: rhbz#1416015
  - Add interface virt_rw_stream_sockets_svirt()
  Resolves: rhbz#1415841
  - Label /dev/ss0 as gpfs_device_t
  Resolves: rhbz#1383784
  - Allow staff to rw svirt unix stream sockets.
  Resolves: rhbz#1415841
  - Label /rhev/data-center/mnt as mnt_t
  Resolves: rhbz#1408275
  - Associate sysctl_rpc_t with proc filesystems
  Resolves: rhbz#1350927
  - Add new boolean: domain_can_write_kmsg
  Resolves: rhbz#1415715


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-124
changelog:
  - Allow rhsmcertd_t dbus chat with system_cronjob_t
  Resolves: rhbz#1405341
  - Allow openvswitch exec hostname and readinitrc_t files
  Resolves: rhbz#1405479
  - Improve SELinux context for mysql_db_t objects.
  Resolves: rhbz#1391521
  - Allow postfix_postdrop to communicate with postfix_master via pipe.
  Resolves: rhbz#1379736
  - Add radius_use_jit boolean
  Resolves: rhbz#1426205
  - Label /var/lock/subsys/iptables as iptables_lock_t
  Resolves: rhbz#1405441
  - Label /usr/lib64/erlang/erts-5.10.4/bin/epmd as lib_t
  Resolves: rhbz#1332803
  - Allow can_load_kernmodule to load kernel modules.
  Resolves: rhbz#1423427
  Resolves: rhbz#1424621


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-123
changelog:
  - Allow nfsd_t domain to create sysctls_rpc_t files
  Resolves: rhbz#1405304
  - Allow openvswitch to create netlink generic sockets.
  Resolves: rhbz#1397974
  - Create kernel_create_rpc_sysctls() interface
  Resolves: rhbz#1405304


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-122
changelog:
  - Allow nfsd_t domain rw sysctl_rpc_t dirs
  Resolves: rhbz#1405304
  - Allow cgdcbxd_t to manage cgroup files.
  Resolves: rhbz#1358493
  - Allow cmirrord_t domain to create netlink_connector sockets
  Resolves: rhbz#1412670
  - Allow fcoemon to create netlink scsitransport sockets
  Resolves: rhbz#1362496
  - Allow quota_nld_t create netlink_generic sockets
  Resolves: rhbz#1358679
  - Allow cgred_t create netlink_connector sockets
  Resolves: rhbz#1376357
  - Add dhcpd_t domain fowner capability
  Resolves: rhbz#1358485
  - Allow acpid to attempt to connect to the Linux kernel via generic netlink socket.
  Resolves: rhbz#1358478
  - Rename docker module to container module
  Resolves: rhbz#1386916
  - Allow setflies to mount tracefs
  Resolves: rhbz#1376357
  - Allow iptables to read nsfs files.
  Resolves: rhbz#1411316
  - Allow systemd_bootchart_t domain create dgram sockets.
  Resolves: rhbz#1365953
  - Rename docker interfaces to container
  Resolves: rhbz#1386916


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-120
changelog:
  - Allow initrc_t domain to run rhel-autorelabel script properly during boot process
  Resolves: rhbz#1379722
  - Allow systemd_initctl_t to create and connect unix_dgram sockets
  Resolves: rhbz#1365947
  - Allow ifconfig_t to mount/unmount nsfs_t filesystem
  Resolves: rhbz#1349814
  - Add interfaces allowing mount/unmount nsfs_t filesystem
  Resolves: rhbz#1349814


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-119
changelog:
  - Add interface init_stream_connectto()
  Resolves:rhbz#1365947
  - Allow rhsmcertd domain signull kernel.
  Resolves: rhbz#1379781
  - Allow kdumpgui domain to read nvme device
  - Allow insmod_t to load kernel modules
  Resolves: rhbz#1421598
  - Add interface files_load_kernel_modules()
  Resolves: rhbz#1421598
  - Add SELinux support for systemd-initctl daemon
  Resolves:rhbz#1365947
  - Add SELinux support for systemd-bootchart
  Resolves: rhbz#1365953


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-118
changelog:
  - Allow firewalld to getattr open search read modules_object_t:dir
  Resolves: rhbz#1418391
  - Fix label for nagios plugins in nagios file conxtext file
  Resolves: rhbz#1277718
  - Add sys_ptrace capability to pegasus domain
  Resolves: rhbz#1381238
  - Allow sssd_t domain setpgid
  Resolves:rhbz#1416780
  - After the latest changes in nfsd. We should allow nfsd_t to read raw fixed disk.
  Resolves: rhbz#1350927
  - Allow kdumpgui domain to read nvme device
  Resolves: rhbz#1415084
  - su using libselinux and creating netlink_selinux socket is needed to allow libselinux initialization.
  Resolves: rhbz#1146987
  - Add user namespace capability object classes.
  Resolves: rhbz#1368057
  - Add module_load permission to class system
  Resolves:rhbz#1368057
  - Add the validate_trans access vector to the security class 
  Resolves: rhbz#1368057
  - Add "binder" security class and access vectors
  Resolves: rhbz#1368057
  - Allow ifconfig_t domain read nsfs_t
  Resolves: rhbz#1349814
  - Allow ping_t domain to load kernel modules.
  Resolves: rhbz#1388363


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-117
changelog:
  - Allow systemd container to read/write usermodehelperstate
  Resolves: rhbz#1403254
  - Label udp ports in range 24007-24027 as gluster_port_t
  Resolves: rhbz#1404152


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-116
changelog:
  - Allow glusterd_t to bind on glusterd_port_t udp ports.
  Resolves: rhbz#1404152
  - Revert: Allow glusterd_t to bind on med_tlp port.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-115
changelog:
  - Allow glusterd_t to bind on med_tlp port.
  Resolves: rhbz#1404152
  - Update ctdbd_t policy to reflect all changes.
  Resolves: rhbz#1402451
  - Label tcp port 24009 as med_tlp_port_t
  Resolves: rhbz#1404152
  -  Issue appears during update directly from RHEL-7.0 to RHEL-7.3 or above. Modules pkcsslotd and vbetools missing in selinux-policy package for RHEL-7.3 which causing warnings during SELinux policy store migration process. Following patch fixes issue by skipping pkcsslotd and vbetools modules migration.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-113
changelog:
  - Fixes for containers Allow containers to attempt to write to unix_sysctls. Allow cotainers to use the FD's leaked to them from parent processes.
  Resolves: rhbz#1403254


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-112
changelog:
  - Allow glusterd_t send signals to userdomain. Label new glusterd binaries as glusterd_exec_t
  Resolves: rhbz#1404152
  - Allow systemd to stop glusterd_t domains.
  Resolves: rhbz#1400493


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-109
changelog:
  - Allow puppetagent_t to access timedated dbus. Use the systemd_dbus_chat_timedated interface to allow puppetagent_t the access.
  Resolves: rhbz#1399250


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-108
changelog:
  - Update systemd on RHEL-7.2 box to version from RHEL-7.3 and then as a separate yum command update the selinux policy systemd will start generating USER_AVC denials and will start returning "Access Denied" errors to DBus clients
  Resolves: rhbz#1393505


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-106
changelog:
  - Fix error message during update from RHEL-7.2 to RHEL-7.3, when /usr/sbin/semanage command is not installed and selinux-policy-migrate-local-changes.sh script is executed in %post install phase of selinux-policy package
  Resolves: rhbz#1392010


author: Miroslav Grepl <mgrepl@redhat.com> - 3.13.1-105
changelog:
  - Allow GlusterFS with RDMA transport to be started correctly. It requires ipc_lock capability together with rw permission on rdma_cm device.
  Resolves: rhbz#1384488
  - Allow glusterd to get attributes on /sys/kernel/config directory.
  Resolves: rhbz#1384483


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-104
changelog:
  - Use selinux-policy-migrate-local-changes.sh instead of migrateStore* macros
  - Add selinux-policy-migrate-local-changes service
  Resolves: rhbz#1381588


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-103
changelog:
  - Allow sssd_selinux_manager_t to manage also dir class.
  Resolves: rhbz#1368097
  - Add interface seutil_manage_default_contexts_dirs()
  Resolves: rhbz#1368097


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-101
changelog:
  - Allow pcp_pmcd_t domain transition to lvm_t Add capability kill and sys_ptrace to pcp_pmlogger_t
  Resolves: rhbz#1309883


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-100
changelog:
  - Allow ftp daemon to manage apache_user_content
  Resolves: rhbz#1097775
  - Label /etc/sysconfig/oracleasm as oracleasm_conf_t
  Resolves: rhbz#1331383
  - Allow oracleasm to rw inherited fixed disk device
  Resolves: rhbz#1331383
  - Allow collectd to connect on unix_stream_socket
  Resolves: rhbz#1377259


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-99
changelog:
  - Allow iscsid create netlink iscsid sockets.
  Resolves: rhbz#1358266
  - Improve regexp for power_unit_file_t files. To catch just systemd power unit files.
  Resolves: rhbz#1375462


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-98
changelog:
  - Update oracleasm SELinux module that can manage oracleasmfs_t blk files. Add dac_override cap to oracleasm_t domain.
  Resolves: rhbz#1331383
  - Add few rules to pcp SELinux module to make ti able to start pcp_pmlogger service
  Resolves: rhbz#1206525


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-97
changelog:
  - Add oracleasm_conf_t type and allow oracleasm_t to create /dev/oracleasm
  Resolves: rhbz#1331383
  - Label /usr/share/pcp/lib/pmie as pmie_exec_t and /usr/share/pcp/lib/pmlogger as pmlogger_exec_t
  Resolves: rhbz#1206525
  - Allow mdadm_t to getattr all device nodes
  Resolves: rhbz#1365171
  - Add interface dbus_dontaudit_stream_connect_system_dbusd()
  Resolves:rhbz#1052880
  - Add virt_stub_* interfaces for docker policy which is no longer a part of our base policy.
  Resolves: rhbz#1372705
  - Allow guest-set-user-passwd to set users password.
  Resolves: rhbz#1369693
  - Allow samdbox domains to use msg class
  Resolves: rhbz#1372677
  - Allow domains using kerberos to read also kerberos config dirs
  Resolves: rhbz#1368492
  - Allow svirt_sandbox_domains to r/w onload sockets
  Resolves: rhbz#1342930
  - Add interface fs_manage_oracleasm()
  Resolves: rhbz#1331383
  - Label /dev/kfd as hsa_device_t
  Resolves: rhbz#1373488
  - Update seutil_manage_file_contexts() interface that caller domain can also manage file_context_t dirs
  Resolves: rhbz#1368097
  - Add interface to write to nsfs inodes
  Resolves: rhbz#1372705
  - Allow systemd services to use PrivateNetwork feature
  Resolves: rhbz#1372705
  - Add a type and genfscon for nsfs.
  Resolves: rhbz#1372705
  - Allow run sulogin_t in range mls_systemlow-mls_systemhigh.
  Resolves: rhbz#1290400


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-96
changelog:
  - Allow arpwatch to create netlink netfilter sockets. Resolves: rhbz#1358261
  - Fix file context for /etc/pki/pki-tomcat/ca/
  - new interface oddjob_mkhomedir_entrypoint()
  - Move label for /var/lib/docker/vfs/ to proper SELinux module
  - Allow mdadm to get attributes from all devices.
  - Label /etc/puppetlabs as puppet_etc_t.
  - Allow systemd-machined to communicate to lxc container using dbus
  - Allow systemd_resolved to send dbus msgs to userdomains Resolves: rhbz#1236579
  - Allow systemd-resolved to read network sysctls Resolves: rhbz#1236579
  - Allow systemd_resolved to connect on system bus. Resolves: rhbz#1236579
  - Make entrypoint oddjob_mkhomedir_exec_t for unconfined_t
  - Label all files in /dev/oracleasmfs/ as oracleasmfs_t Resolves: rhbz#1331383


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-95
changelog:
  - Label /etc/pki/pki-tomcat/ca/ as pki_tomcat_cert_t
  Resolves:rhbz#1366915
  - Allow certmonger to manage all systemd unit files
  Resolves:rhbz#1366915
  - Grant certmonger "chown" capability
  Resolves:rhbz#1366915
  - Allow ipa_helper_t stream connect to dirsrv_t domain
  Resolves: rhbz#1368418
  - Update oracleasm SELinux module
  Resolves: rhbz#1331383
  - label /var/lib/kubelet as svirt_sandbox_file_t
  Resolves: rhbz#1369159
  - Add few interfaces to cloudform.if file
  Resolves: rhbz#1367834
  - Label /var/run/corosync-qnetd and /var/run/corosync-qdevice as cluster_var_run_t. Note: corosync policy is now par of rhcs module
  Resolves: rhbz#1347514
  - Allow krb5kdc_t to read krb4kdc_conf_t dirs.
  Resolves: rhbz#1368492
  - Update networkmanager_filetrans_named_content() interface to allow source domain to create also temad dir in /var/run.
  Resolves: rhbz#1365653
  - Allow teamd running as NetworkManager_t to access netlink_generic_socket to allow multiple network interfaces to be teamed together.
  Resolves: rhbz#1365653
  - Label /dev/oracleasmfs as oracleasmfs_t. Add few interfaces related to oracleasmfs_t type
  Resolves: rhbz#1331383
  - A new version of cloud-init that supports the effort to provision RHEL Atomic on Microsoft Azure requires some a new rules that allows dhclient/dhclient hooks to call cloud-init.
  Resolves: rhbz#1367834
  - Allow iptables to creating netlink generic sockets.
  Resolves: rhbz#1364359


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-94
changelog:
  - Allow ipmievd domain to create lock files in /var/lock/subsys/
  Resolves:rhbz#1349058
  - Update policy for ipmievd daemon.
  Resolves:rhbz#1349058
  - Dontaudit hyperkvp to getattr on non security files.
  Resolves: rhbz#1349356
  - Label /run/corosync-qdevice and /run/corosync-qnetd as corosync_var_run_t
  Resolves: rhbz#1347514
  - Fixed lsm SELinux module
  - Add sys_admin capability to sbd domain
  Resolves: rhbz#1322725
  - Allow vdagent to comunnicate with systemd-logind via dbus
  Resolves: rhbz#1366731
  - Allow lsmd_plugin_t domain to create fixed_disk device.
  Resolves: rhbz#1238066
  - Allow opendnssec domain to create and manage own tmp dirs/files
  Resolves: rhbz#1366649
  - Allow opendnssec domain to read system state
  Resolves: rhbz#1366649
  - Update opendnssec_manage_config() interface to allow caller domain also manage opendnssec_conf_t dirs
  Resolves: rhbz#1366649
  - Allow rasdaemon to mount/unmount tracefs filesystem.
  Resolves: rhbz#1364380
  - Label /usr/libexec/iptables/iptables.init as iptables_exec_t Allow iptables creating lock file in /var/lock/subsys/
  Resolves: rhbz#1367520
  - Modify interface den_read_nvme() to allow also read nvme_device_t block files.
  Resolves: rhbz#1362564
  - Label /var/run/storaged as lvm_var_run_t.
  Resolves: rhbz#1264390
  - Allow unconfineduser to run ipa_helper_t.
  Resolves: rhbz#1361636


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-93
changelog:
  - Dontaudit mock to write to generic certs.
  Resolves: rhbz#1271209
  - Add labeling for corosync-qdevice and corosync-qnetd daemons, to run as cluster_t
  Resolves: rhbz#1347514
  - Revert "Label corosync-qnetd and corosync-qdevice as corosync_t domain"
  - Allow modemmanager to write to systemd inhibit pipes
  Resolves: rhbz#1365214
  - Label corosync-qnetd and corosync-qdevice as corosync_t domain
  Resolves: rhbz#1347514
  - Allow ipa_helper to read network state
  Resolves: rhbz#1361636
  - Label oddjob_reqiest as oddjob_exec_t
  Resolves: rhbz#1361636
  - Add interface oddjob_run()
  Resolves: rhbz#1361636
  - Allow modemmanager chat with systemd_logind via dbus
  Resolves: rhbz#1362273
  - Allow NetworkManager chat with puppetagent via dbus
  Resolves: rhbz#1363989
  - Allow NetworkManager chat with kdumpctl via dbus
  Resolves: rhbz#1363977
  - Allow sbd send msgs to syslog Allow sbd create dgram sockets. Allow sbd to communicate with kernel via dgram socket Allow sbd r/w kernel sysctls.
  Resolves: rhbz#1322725
  - Allow ipmievd_t domain to re-create ipmi devices Label /usr/libexec/openipmi-helper as ipmievd_exec_t
  Resolves: rhbz#1349058
  - Allow rasdaemon to use tracefs filesystem.
  Resolves: rhbz#1364380
  - Fix typo bug in dirsrv policy
  - Some logrotate scripts run su and then su runs unix_chkpwd. Allow logrotate_t domain to check passwd.
  Resolves: rhbz#1283134
  - Add ipc_lock capability to sssd domain. Allow sssd connect to http_cache_t
  Resolves: rhbz#1362688
  - Allow dirsrv to read dirsrv_share_t content
  Resolves: rhbz#1363662
  - Allow virtlogd_t to append svirt_image_t files.
  Resolves: rhbz#1358140
  - Allow hypervkvp domain to read hugetlbfs dir/files.
  Resolves: rhbz#1349356
  - Allow mdadm daemon to read nvme_device_t blk files
  Resolves: rhbz#1362564
  - Allow selinuxusers and unconfineduser to run oddjob_request
  Resolves: rhbz#1361636
  - Allow sshd server to acces to Crypto Express 4 (CEX4) devices.
  Resolves: rhbz#1362539
  - Fix labeling issue in init.fc file. Path /usr/lib/systemd/fedora-* changed to /usr/lib/systemd/rhel-*.
  Resolves: rhbz#1363769
  - Fix typo in device interfaces
  Resolves: rhbz#1349058
  - Add interfaces for managing ipmi devices
  Resolves: rhbz#1349058
  - Add interfaces to allow mounting/umounting tracefs filesystem
  Resolves: rhbz#1364380
  - Add interfaces to allow rw tracefs filesystem
  Resolves: rhbz#1364380
  - Add interface dev_read_nvme() to allow reading Non-Volatile Memory Host Controller devices.
  Resolves: rhbz#1362564
  - Label /sys/kernel/debug/tracing filesystem
  Resolves: rhbz#1364380
  - Allow sshd setcap capability. This is needed due to latest changes in sshd
  Resolves: rhbz#1357857


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-92
changelog:
  - Dontaudit mock_build_t can list all ptys.
  Resolves: rhbz#1271209
  - Allow ftpd_t to mamange userhome data without any boolean.
  Resolves: rhbz#1097775
  - Add logrotate permissions for creating netlink selinux sockets.
  Resolves: rhbz#1283134
  - Allow lsmd_plugin_t to exec ldconfig.
  Resolves: rhbz#1238066
  - Allow vnstatd domain to read /sys/class/net/ files
  Resolves: rhbz#1358243
  - Remove duplicate allow rules in spamassassin SELinux module
  Resolves:rhbz#1358175
  - Allow spamc_t and spamd_t domains create .spamassassin file in user homedirs
  Resolves:rhbz#1358175
  - Allow sshd setcap capability. This is needed due to latest changes in sshd
  Resolves: rhbz#1357857
  - Add new MLS attribute to allow relabeling objects higher than system low. This exception is needed for package managers when processing sensitive data.
  Resolves: rhbz#1330464
  - Allow gnome-keyring also manage user_tmp_t sockets.
  Resolves: rhbz#1257057
  - corecmd: Remove fcontext for /etc/sysconfig/libvirtd
  Resolves:rhbz#1351382


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-90
changelog:
  - Allow ipa-dnskey read system state.
  Reasolves: rhbz#1350957
  - Allow dogtag-ipa-ca-renew-agent-submit labeled as certmonger_t to create /var/log/ipa/renew.log file
  Resolves: rhbz#1350957


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-89
changelog:
  - Allow firewalld to manage net_conf_t files.
  Resolves:rhbz#1304723
  - Allow logrotate read logs inside containers.
  Resolves: rhbz#1303514
  - Allow sssd to getattr on fs_t
  Resolves: rhbz#1356082
  - Allow opendnssec domain to manage bind chace files
  Resolves: rhbz#1350957
  - Fix typo in rhsmcertd  policy module
  Resolves: rhbz#1329475
  - Allow systemd to get status of systemd-logind daemon
  Resolves: rhbz#1356141
  - Label more ndctl devices not just ndctl0
  Resolves: rhbz#1355809


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-88
changelog:
  - Allow rhsmcertd to copy certs into /etc/docker/cert.d
  - Add interface docker_rw_config()
  Resolves: rhbz#1344500
  - Fix logrotate fc file to label also /var/lib/logrotate/ dir as logrotate_var_lib_t
  Resolves: rhbz#1355632
  - Allow rhsmcertd to read network sysctls
  Resolves: rhbz#1329475
  - Label /var/log/graphite-web dir as httpd_log_t
  Resolves: rhbz#1310898
  - Allow mock to use generic ptys
  Resolves: rhbz#1271209
  - Allow adcli running as sssd_t to write krb5.keytab file.
  Resolves: rhbz#1356082
  - Allow openvswitch connect to openvswitch_port_t type.
  Resolves: rhbz#1335024
  - Add SELinux policy for opendnssec service.
  Resolves: rhbz#1350957
  - Create new SELinux type for /usr/libexec/ipa/ipa-dnskeysyncd
  Resolves: rhbz#1350957
  - label /dev/ndctl0 device as nvram_device_t
  Resolves: rhbz#1355809


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-87
changelog:
  - Allow lttng tools to block suspending
  Resolves: rhbz#1256374
  - Allow creation of vpnaas in openstack
  Resolves: rhbz#1352710
  - virt: add strict policy for virtlogd daemon
  Resolves:rhbz#1311606
  - Update makefile to support snapperd_contexts file
  Resolves: rhbz#1352681


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-86
changelog:
  - Allow udev to manage systemd-hwdb files
  - Add interface systemd_hwdb_manage_config()
  Resolves: rhbz#1350756
  - Fix paths to infiniband devices. This allows use more then two infiniband interfaces.
  Resolves: rhbz#1210263


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-85
changelog:
  - Allow virtual machines to rw infiniband devices.
  Resolves: rhbz#1210263
  - Allow opensm daemon to rw infiniband_mgmt_device_t
  Resolves: rhbz#1210263
  - Allow systemd_hwdb_t to relabel /etc/udev/hwdb.bin file.
  Resolves: rhbz#1350756
  - Make label for new infiniband_mgmt deivices
  Resolves: rhbz#1210263


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-84
changelog:
  - Fix typo in brltty SELinux module
  - Add new SELinux module sbd
  Resolves: rhbz#1322725
  - Allow pcp dmcache metrics collection
  Resolves: rhbz#1309883
  - Allow pkcs_slotd_t to create dir in /var/lock Add label pkcs_slotd_log_t
  Resolves: rhbz#1350782
  - Allow openvpn to create sock files labeled as openvpn_var_run_t
  Resolves: rhbz#1328246
  - Allow hypervkvp daemon to getattr on  all filesystem types.
  Resolves: rhbz#1349356
  - Allow firewalld to create net_conf_t files
  Resolves: rhbz#1304723
  - Allow mock to use lvm
  Resolves: rhbz#1271209
  - Allow keepalived to create netlink generic sockets.
  Resolves: rhbz#1349809
  - Allow mirromanager creating log files in /tmp
  Resolves:rhbz#1328818
  - Rename few modules to make it consistent with source files
  Resolves: rhbz#1351445
  - Allow vmtools_t to transition to rpm_script domain
  Resolves: rhbz#1342119
  - Allow nsd daemon to manage nsd_conf_t dirs and files
  Resolves: rhbz#1349791
  - Allow cluster to create dirs in /var/run labeled as cluster_var_run_t
  Resolves: rhbz#1346900
  - Allow sssd read also sssd_conf_t dirs
  Resolves: rhbz#1350535
  - Dontaudit su_role_template interface to getattr /proc/kcore Dontaudit su_role_template interface to getattr /dev/initctl
  Resolves: rhbz#1086240
  - Add interface lvm_getattr_exec_files()
  Resolves: rhbz#1271209
  - Fix typo Compliling vs. Compiling
  Resolves: rhbz#1351445


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-83
changelog:
  - Allow krb5kdc_t to communicate with sssd
  Resolves: rhbz#1319933
  - Allow prosody to bind on prosody ports
  Resolves: rhbz#1304664
  - Add dac_override caps for fail2ban-client
  Resolves: rhbz#1316678
  - dontaudit read access for svirt_t on the file /var/db/nscd/group
  Resolves: rhbz#1301637
  - Allow inetd child process to communicate via dbus with systemd-logind
  Resolves: rhbz#1333726
  - Add label for brltty log file
  Resolves: rhbz#1328818
  - Allow dspam to read the passwd file
  Resolves: rhbz#1286020
  - Allow snort_t to communicate with sssd
  Resolves: rhbz#1284908
  - svirt_sandbox_domains need to be able to execmod for badly built libraries.
  Resolves: rhbz#1206339
  - Add policy for lttng-tools package.
  Resolves: rhbz#1256374
  - Make mirrormanager as application domain.
  Resolves: rhbz#1328234
  - Add support for the default lttng-sessiond port - tcp/5345.  This port is used by LTTng 2.x central tracing registry session daemon.
  - Add prosody ports
  Resolves: rhbz#1304664
  - Allow sssd read also sssd_conf_t dirs
  Resolves: rhbz#1350535


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-82
changelog:
  - Label /var/lib/softhsm as named_cache_t. Allow named_t to manage named_cache_t dirs.
  Resolves:rhbz#1331315
  - Label named-pkcs11 binary as named_exec_t.
  Resolves: rhbz#1331315
  - Allow glusterd daemon to get systemd status
  Resolves: rhbz#1321785
  - Allow logrotate dbus-chat with system_logind daemon
  Resolves: rhbz#1283134
  - Allow pcp_pmlogger to read kernel network state Allow pcp_pmcd to read cron pid files
  Resolves: rhbz#1336211
  - Add interface cron_read_pid_files()
  Resolves: rhbz#1336211
  - Allow pcp_pmlogger to create unix dgram sockets
  Resolves: rhbz#1336211
  - Add hwloc-dump-hwdata SELinux policy
  Resolves: rhbz#1344054
  - Remove non-existing jabberd_spool_t() interface and add new jabbertd_var_spool_t.
  Resolves: rhbz#1121171
  - Remove non-existing interface salk_resetd_systemctl() and replace it with sanlock_systemctl_sanlk_resetd()
  Resolves: rhbz#1259764
  - Create label for openhpid log files. 
  esolves: rhbz#1259764
  - Label /var/lib/ganglia as httpd_var_lib_t
  Resolves: rhbz#1260536
  - Allow firewalld_t to create entries in net_conf_t dirs.
  Resolves: rhbz#1304723
  - Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals
  Resolves: rhbz#1288255
  - Include patch from distgit repo: policy-RHEL-7.1-flask.patch.
  Resolves: rhbz#1329560
  - Update refpolicy to handle hwloc
  Resolves: rhbz#1344054
  - Label /etc/dhcp/scripts dir as bin_t
  - Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals.
  Resolves: rhbz#1288255


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-81
changelog:
  - Allow firewalld_t to create entries in net_conf_t dirs.
  Resolves: rhbz#1304723
  - Allow journalctl to read syslogd_var_run_t files. This allows to staff_t and sysadm_t to read journals
  Resolves: rhbz#1288255
  - Allow mongod log to syslog.
  Resolves: rhbz#1306995
  - Allow rhsmcertd connect to port tcp 9090
  Resolves: rhbz#1337319
  - Label for /bin/mail(x) was removed but /usr/bin/mail(x) not. This path is also needed to remove. 
  Resolves: rhbz#1262483
  Resolves: rhbz#1277506
  - Label /usr/libexec/mimedefang-wrapper as spamd_exec_t.
  Resolves: rhbz#1301516
  - Add new boolean spamd_update_can_network.
  Resolves: rhbz#1305469
  - Allow rhsmcertd connect to tcp netport_port_t
  Resolves: rhbz#1329475
  - Fix SELinux context for /usr/share/mirrormanager/server/mirrormanager to Label all binaries under dir as mirrormanager_exec_t.
  Resolves: rhbz#1328234
  - Allow prosody to bind to fac_restore tcp port.
  Resolves: rhbz#1321787
  - Allow ninfod to read raw packets
  Resolves: rhbz#1317964
  - Allow pegasus get attributes from qemu binary files.
  Resolves: rhbz#1260835
  - Allow pegasus get attributes from qemu binary files.
  Resolves: rhbz#1271159
  - Allow tuned to use policykit. This change is required by cockpit.
  Resolves: rhbz#1346464
  - Allow conman_t to read dir with conman_unconfined_script_t binary files.
  Resolves: rhbz#1297323
  - Allow pegasus to read /proc/sysinfo.
  Resolves: rhbz#1265883
  - Allow sysadm_role to run journalctl_t domain. This allows sysadm user to read journals.
  Resolves: rhbz#1288255
  - Label tcp ports:16379, 26379 as redis_port_t
  Resolves: rhbz#1348471
  - Allow systemd to relabel /var and /var/lib directories during boot.
  - Add files_relabel_var_dirs() and files_relabel_var_dirs() interfaces.
  - Add files_relabelto_var_lib_dirs() interface.
  - Label tcp port 2004 as mailbox_port_t.
  Resolves: rhbz#1332843
  - Label tcp and udp port 5582 as fac_restore_port_t
  Resolves: rhbz#1321787
  - Allow sysadm_t user to run postgresql-setup.
  Resolves: rhbz#1282543
  - Allow sysadm_t user to dbus chat with oddjob_t. This allows confined admin run oddjob mkhomedirfor script.
  Resolves: rhbz#1297480
  - Update netlink socket classes.


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-80
changelog:
  - Allow conman to kill conman_unconfined_script.
  Resolves: rhbz#1297323
  - Make conman_unconfined_script_t as init_system_domain.
  Resolves:rhbz#1297323
  - Allow init dbus chat with apmd.
  Resolves:rhbz#995898
  - Patch /var/lib/rpm is symlink to /usr/share/rpm on Atomic, due to this change we need to label also /usr/share/rpm as rpm_var_lib_t.
  Resolves: rhbz#1233252
  - Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_t
  Resolves: rhbz#1052880
  - Add mediawiki rules to proper scope
  Resolves: rhbz#1301186
  - Dontaudit xguest_gkeyringd_t stream connect to system_dbusd_t
  Resolves: rhbz#1052880
  - Allow mysqld_safe to inherit rlimit information from mysqld
  Resolves: rhbz#1323673
  - Allow collectd_t to stream connect to postgresql.
  Resolves: rhbz#1344056
  - Allow mediawiki-script to read /etc/passwd file.
  Resolves: rhbz#1301186
  - Add filetrans rule that NetworkManager_t can create net_conf_t files in /etc.
  Resolves: rhbz#1344505
  - Add labels for mediawiki123
  Resolves: rhbz#1293872
  - Fix label for all fence_scsi_check scripts
  - Allow ip netns to mounton root fs and unmount proc_t fs.
  Resolves: rhbz#1343776
  Resolves: rhbz#1286851
  - Allow sysadm_t to run newaliases command.
  Resolves: rhbz#1344828
  - Add interface sysnet_filetrans_named_net_conf()
  Resolves: rhbz#1344505


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-78
changelog:
  - Allow glusterd domain read krb5_keytab_t files.
  Resolves: rhbz#1343929
  - Fix typo in files_setattr_non_security_dirs.
  Resolves: rhbz#1115987


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-77
changelog:
  - Allow tmpreaper_t to read/setattr all non_security_file_type dirs
  Resolves: rhbz#1115987
  - Allow firewalld to create firewalld_var_run_t directory.
  Resolves: rhbz#1304723
  - Add interface firewalld_read_pid_files()
  Resolves: rhbz#1304723
  - Label /usr/libexec/rpm-ostreed as rpm_exec_t.
  Resolves: rhbz#1340542
  - Allow sanlock service to read/write cephfs_t files.
  Resolves: rhbz#1315332
  - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
  - Added missing docker interfaces:  - docker_typebounds  - docker_entrypoint
  Resolves: rhbz#1236580
  - Add interface files_setattr_non_security_dirs()
  Resolves: rhbz#1115987
  - Add support for onloadfs
  - Allow iptables to read firewalld pid files.
  Resolves: rhbz#1304723
  - Add SELinux support for ceph filesystem.
  Resolves: rhbz#1315332
  - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
  Resolves: rhbz#1236580


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-76
changelog:
  - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
  - Added missing docker interfaces:  - docker_typebounds  - docker_entrypoint
  Resolves: rhbz#1236580
  - New interfaces needed for systemd-machinectl
  Resolves: rhbz#1236580
  - New interfaces needed by systemd-machine
  Resolves: rhbz#1236580
  - Add interface allowing sending and receiving messages from virt over dbus.
  Resolves: rhbz#1236580
  - Backport docker policy from Fedora.
  Related: #1303123
  Resolves: #1341257
  - Allow NetworkManager_t and policykit_t read access to systemd-machined pid files.
  Resolves: rhbz#1236580
  - Fixed to make SELinux work with docker and prctl(NO_NEW_PRIVS)
  - Added interfaces needed by new docker policy.
  Related: rhbz#1303123
  - Add support for systemd-machined daemon
  Resolves: rhbz#1236580
  - Allow rpm-ostree domain transition to install_t domain from init_t.
  Resolves: rhbz#1340542


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-75
changelog:
  - dnsmasq: allow NetworkManager to control dnsmasq via D-Bus
  Resolves: rhbz#1336722
  - Directory Server (389-ds-base) has been updated to use systemd-ask-password. In order to function correctly we need the following added to dirsrv.te
  Resolves: rhbz#1333198
  - sftpd_* booleans are functionless these days.
  Resolves: rhbz#1335656
  - Label /var/log/ganesha.log as gluster_log_t Allow glusterd_t domain to create glusterd_log_t files. Label /var/run/ganesha.pid as gluster_var_run_t.
  Resolves: rhbz#1335828
  - Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus.
  Resolves: rhbz#1336760
  - Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t.
  Resolves: rhbz#1336737
  - Label /usr/libexec/storaged/storaged as lvm_exec_t to run storaged daemon in lvm_t SELinux domain.
  Resolves: rhbz#1264390
  - Allow systemd_hostanmed_t to read /proc/sysinfo labeled as sysctl_t.
  Resolves: rhbz#1337061
  - Revert "Allow all domains some process flags."
  Resolves: rhbz#1303644
  - Revert "Remove setrlimit to all domains."
  Resolves: rhbz#1303644
  - Label /usr/sbin/xrdp* files as bin_t
  Resolves: rhbz#1276777
  - Add mls support for some db classes
  Resolves: rhbz#1303651
  - Allow systemd_resolved_t to check if ipv6 is disabled.
  Resolves: rhbz#1236579
  - Allow systemd_resolved to read systemd_networkd run files.
  Resolves: rhbz#1236579


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-74
changelog:
  - Allow ganesha-ha.sh script running under unconfined_t domain communicate with glusterd_t domains via dbus.
  Resolves: rhbz#1336760
  - Allow ganesha daemon labeled as glusterd_t create /var/lib/nfs/ganesha dir labeled as var_lib_nfs_t.
  Resolves: rhbz#1336737


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-73
changelog:
  - Allow logwatch to domtrans to postqueue
  Resolves: rhbz#1331542
  - Label /var/log/ganesha.log as gluster_log_t
  - Allow glusterd_t domain to create glusterd_log_t files.
  - Label /var/run/ganesha.pid as gluster_var_run_t.
  Resolves: rhbz#1335828
  - Allow zabbix to connect to postgresql port
  Resolves: rhbz#1330479
  - Add userdom_destroy_unpriv_user_shared_mem() interface.
  Related: rhbz#1306403
  - systemd-logind remove all IPC objects owned by a user on a logout. This covers also SysV memory. This change allows to destroy unpriviledged user SysV shared memory segments.
  Resolves: rhbz#1306403


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-72
changelog:
  - We need to restore contexts on /etc/passwd*,/etc/group*,/etc/*shadow* during install phase to get proper labeling for these files until selinux-policy pkgs are installed.
  Resolves: rhbz#1333952


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-71
changelog:
  - Add interface glusterd_dontaudit_read_lib_dirs()
  Resolves: rhbz#1295680
  - Dontaudit Occasionally observing AVC's while running geo-rep automation
  Resolves: rhbz#1295680
  - Allow glusterd to manage socket files labeled as glusterd_brick_t.
  Resolves: rhbz#1331561
  - Create new apache content template for files stored in user homedir. This change is needed to make working booleans: - httpd_enable_homedirs - httpd_read_user_content 
  Resolves: rhbz#1246522
  - Allow stunnel create log files. 
  Resolves: rhbz#1296851
  - Label tcp port 8181 as intermapper_port_t.
  Resolves: rhbz#1334783
  - Label tcp/udp port 2024 as xinuexpansion4_port_t
  Resolves: rhbz#1334783
  - Label tcp port 7002 as afs_pt_port_t Label tcp/udp port 2023 as xinuexpansion3_port_t
  Resolves: rhbz#1334783
  - Dontaudit ldconfig read gluster lib files.
  Resolves: rhbz#1295680
  - Add interface auth_use_nsswitch() to systemd_domain_template.
  Resolves: rhbz#1236579


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-70
changelog:
  - Label /usr/bin/ganesha.nfsd as glusterd_exec_t to run ganesha as glusterd_t. Allow glusterd_t stream connect to rpbind_t. Allow cluster_t to create symlink /var/lib/nfs labeled as var_lib_nfs_t. Add interface rpc_filetrans_var_lib_nfs_content() Add new boolean: rpcd_use_fusefs to allow rpcd daemon use fusefs.
   Resolves: rhbz#1312809
   Resolves: rhbz#1323947
  - Allow dbus chat between httpd_t and oddjob_t. Resolves: rhbz#1324144
  - Label /usr/libexec/ipa/oddjob/org.freeipa.server.conncheck as ipa_helper_exec_t.
  Resolves: rhbz#1324144
  - Label /var/log/ipareplica-conncheck.log file as ipa_log_t Allow ipa_helper_t domain to manage logs labeledas ipa_log_t Allow ipa_helper_t to connect on http and kerberos_passwd ports.
  Resolves: rhbz#1324144
  - Allow prosody to listen on port 5000 for mod_proxy65.
  Resolves: rhbz#1316918
  - Allow pcp_pmcd_t domain to manage docker lib files. This rule is needed to allow pcp to collect container information when SELinux is enabled.
  Resolves: rhbz#1309454


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-69
changelog:
  - Allow runnig php7 in fpm mode. From selinux-policy side, we need to allow httpd to read/write hugetlbfs.
  Resolves: rhbz#1319442
  - Allow openvswitch daemons to run under openvswitch Linux user instead of root. This change needs allow set capabilities: chwon, setgid, setuid, setpcap.
  Resolves: rhbz#1296640
  - Remove ftpd_home_dir() boolean from distro policy. Reason is that we cannot make this working due to m4 macro language limits.
  Resolves: rhbz#1097775
  - /bin/mailx is labeled sendmail_exec_t, and enters the sendmail_t domain on execution.  If /usr/sbin/sendmail does not have its own domain to transition to, and is not one of several products whose behavior is allowed by the sendmail_t policy, execution will fail. In this case we need to label /bin/mailx as bin_t.
  Resolves: rhbz#1262483
  - Allow nsd daemon to create log file in /var/log as nsd_log_t
  Resolves: rhbz#1293140
  - Sanlock policy update.   - New sub-domain for sanlk-reset daemon
  Resolves: rhbz#1212324
  - Label all run tgtd files, not just socket files
  Resolves: rhbz#1280280
  - Label all run tgtd files, not just socket files.
  Resolves: rhbz#1280280
  - Allow prosody to stream connect to sasl. This will allow using cyrus authentication in prosody.
  Resolves: rhbz#1321049
  - unbound wants to use ephemeral ports as a default configuration. Allow to use also udp sockets.
  Resolves: rhbz#1318224
  - Allow prosody to listen on port 5000 for mod_proxy65.
  Resolves: rhbz#1316918
  - Allow targetd to read/write to /dev/mapper/control device.
  Resolves: rhbz#1063714
  - Allow KDM to get status about power services. This change allow kdm to be able do shutdown.
  Resolves: rhbz#1316724
  - Allow systemd-resolved daemon creating netlink_route sockets.
  Resolves:rhbz#1236579
  - Allow systemd_resolved_t to read /etc/passwd file. Allow systemd_resolved_t to write to kmsg_device_t when 'systemd.log_target=kmsg' option is used
  Resolves: rhbz#1065362
  - Label /etc/selinux/(minimum|mls|targeted)/active/ as semanage_store_t
  Resolves: rhbz#1321943
  - Label all nvidia binaries as xserver_exec_t
  Resolves: rhbz#1322283


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-68
changelog:
  - Create new permissivedomains CIL module and make it active.
  Resolves: rhbz#1320451
  - Add support for new mock location - /usr/libexec/mock/mock.
  Resolves: rhbz#1271209
  - Allow bitlee to create bitlee_var_t dirs.
  Resolves: rhbz#1268651
  - Allow CIM provider to read sssd public files.
  Resolves: rhbz#1263339
  - Fix some broken interfaces in distro policy.
  Resolves: rhbz#1121171
  - Allow power button to shutdown the laptop.
  Resolves: rhbz#995898
  - Allow lsm plugins to create named fixed disks.
  Resolves: rhbz#1238066
  - Add default labeling for /etc/Pegasus/cimserver_current.conf. It is a correct patch instead of the current /etc/Pegasus/pegasus_current.confResolves: rhbz#1278777
  - Allow hyperv domains to rw hyperv devices.
  Resolves: rhbz#1309361
  - Label /var/www/html(/.*)?/wp_backups(/.*)? as httpd_sys_rw_content_t.Resolves: rhbz#1246780
  - Create conman_unconfined_script_t type for conman script stored in /use/share/conman/exec/
  Resolves: rhbz#1297323
  - Fix rule definitions for httpd_can_sendmail boolean. We need to distinguish between base and contrib.
  - Add support for /dev/mptctl device used to check RAID status.
   Resolves: rhbz#1258029
  - Create hyperv* devices and create rw interfaces for this devices.
  Resolves: rhbz#1309361
  - Add fixes for selinux userspace moving the policy store to /var/lib/selinux.
  - Remove optional else block for dhcp ping


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-67
changelog:
  - Allow rsync_export_all_ro boolean to read also non_auth_dirs/files/symlinks.
  Resolves: rhbz#1263770
  - Fix context of "/usr/share/nginx/html".
  Resolves: rhbz#1261857
  - Allow pmdaapache labeled as pcp_pmcd_t access to port 80 for apache diagnostics
  Resolves: rhbz#1270344
  - Allow pmlogger to create pmlogger.primary.socket link file.
   Resolves: rhbz#1270344
  - Label nagios scripts as httpd_sys_script_exec_t.
  Resolves: rhbz#1260306
  - Add dontaudit interface for kdumpctl_tmp_t
  Resolves: rhbz#1156442
  - Allow mdadm read files in EFI partition.
  Resolves: rhbz#1291801
  - Allow nsd_t to bind on nsf_control tcp port. Allow nsd_crond_t to read nsd pid.
  Resolves: rhbz#1293140
  - Label some new nsd binaries as nsd_exec_t Allow nsd domain net_admin cap. Create label nsd_tmp_t for nsd tmp files/dirs
  Resolves: rhbz#1293140
  - Add filename transition that /etc/princap will be created with cupsd_rw_etc_t label in cups_filetrans_named_content() interface.
  Resolves: rhbz#1265102
  - Add missing labeling for /usr/libexec/abrt-hook-ccpp.
  Resolves: rhbz#1213409
  - Allow pcp_pmie and pcp_pmlogger to read all domains state.
  Resolves: rhbz#1206525
  - Label /etc/redis-sentinel.conf as redis_conf_t. Allow redis_t write to redis_conf_t. Allow redis_t to connect on redis tcp port.
  Resolves: rhbz#1275246
  - cockpit has grown content in /var/run directory
  Resolves: rhbz#1279429
  - Allow collectd setgid capability
  Resolves:#1310898
  - Remove declaration of empty booleans in virt policy.
  Resolves: rhbz#1103153
  - Fix typo in drbd policy
  - Add new drbd file type: drbd_var_run_t. Allow drbd_t to manage drbd_var_run_t files/dirs. Allow drbd_t create drbd_tmp_t files in /tmp.
  Resolves: rhbz#1134883
  - Label /etc/ctdb/events.d/* as ctdb_exec_t. Allow ctdbd_t to setattr on ctdbd_exec_t files.
  Resolves: rhbz#1293788
  - Allow abrt-hook-ccpp to get attributes of all processes because of core_pattern.
  Resolves: rhbz#1254188
  - Allow abrt_t to read sysctl_net_t files.
  Resolves: rhbz#1254188
  - The ABRT coredump handler has code to emulate default core file creation The handler runs in a separate process with abrt_dump_oops_t SELinux process type. abrt-hook-ccpp also saves the core dump file in the very same way as kernel does and a user can specify CWD location for a coredump. abrt-hook-ccpp has been made as a SELinux aware apps to create this coredumps with correct labeling and with this commit the policy rules have been updated to allow access all non security files on a system.
  - Allow abrt-hook-ccpp to getattr on all executables.
  - Allow setuid/setgid capabilities for abrt-hook-ccpp.
   Resolves: rhbz#1254188
  - abrt-hook-ccpp needs to have setfscreate access because it is SELinux aware and compute a target labeling.
   Resolves: rhbz#1254188
  - Allow abrt-hook-ccpp to change SELinux user identity for created objects.
   Resolves: rhbz#1254188
  - Dontaudit write access to inherited kdumpctl tmp files.
   Resolves: rbhz#1156442
  - Add interface to allow reading files in efivarfs - contains Linux Kernel configuration options for UEFI systems (UEFI Runtime Variables)
   Resolves: rhbz#1291801
  - Label 8952 tcp port as nsd_control.
   Resolves: rhbz#1293140
  - Allow ipsec to use pam.
   Resolves: rhbz#1315700
  - Allow to log out to gdm after screen was resized in session via vdagent.
  Resolves: rhbz#1249020
  - Allow setrans daemon to read /proc/meminfo.
   Resolves: rhbz#1316804
  - Allow systemd_networkd_t to write kmsg, when kernel was started with following params: systemd.debug systemd.log_level=debug systemd.log_target=kmsg
  Resolves: rhbz#1298151
  - Label tcp port 5355 as llmnr-> Link-Local Multicast Name Resolution
  Resolves: rhbz#1236579
  - Add new selinux policy for systemd-resolved dawmon.
  Resolves: rhbz#1236579
  - Add interface ssh_getattr_server_keys() interface.
  Resolves: rhbz#1306197
  - Allow run sshd-keygen on second boot if first boot fails after some reason and content is not syncedon the disk. These changes are reflecting this commit in sshd. http://pkgs.fedoraproject.org/cgit/rpms/openssh.git/commit/?id=af94f46861844cbd6ba4162115039bebcc8f78ba rhbz#1299106
  Resolves: rhbz#1306197
  - Allow systemd_notify_t to write to kmsg_device_t when 'systemd.log_target=kmsg' option is used.
  Resolves: rhbz#1309417
  - Remove bin_t label for /etc/ctdb/events.d/. We need to label this scripts as ctdb_exec_t.
  Resolves: rhbz#1293788


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-65
changelog:
  - Allow sending dbus msgs between firewalld and system_cronjob domains. Resolves: rhbz#1284902
  - Allow zabbix-agentd to connect to following tcp sockets. One of zabbix-agentd functions is get service status of ftp,http,innd,pop,smtp protocols.
  Resolves:  rhbz#1242506
  - Add new boolean tmpreaper_use_cifs() to allow tmpreaper to run on local directories being shared with Samba.
  Resolves: rhbz#1284972
  - Add support for systemd-hwdb daemon.
   Resolves: rhbz#1257940
  - Add interface fs_setattr_cifs_dirs().
   Resolves: rhbz#1284972


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-64
changelog:
  - Add new SELinux policy fo targetd daemon.
  Resolves: rhbz#1063714
  - Add new SELinux policy fo ipmievd daemon.
  Resolves: rhbz#1083031
  - Add new SELinux policy fo hsqldb daemon.
  Resolves: rhbz#1083171
  - Add new SELinux policy for blkmapd daemon.
  Resolves: rhbz#1072997
  - Allow p11-child to connect to apache ports.
  - Label /usr/sbin/lvmlockd binary file as lvm_exec_t.
  Resolves: rhbz#1278028
  - Add interface "lvm_manage_lock" to lvm policy.
  Resolves: rhbz#1063714


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-62
changelog:
  - Allow openvswitch to manage hugetlfs files and dirs.
  Resolves: rhbz#1278495
  - Add fs_manage_hugetlbfs_files() interface.
  Resolves: rhbz#1278495


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-61
changelog:
  - Allow smbcontrol domain to send sigchld to ctdbd domain.
  Resolves: #1293784
  - Allow openvswitch read/write hugetlb filesystem.
  Resolves: #1278495


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-60
changelog:
  Allow hypervvssd to list all mountpoints to have VSS live backup working correctly.
  Resolves:#1247880


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-58
changelog:
  - Allow search dirs in sysfs types in kernel_read_security_state.
  Resolves: #1254188
  - Fix kernel_read_security_state interface that source domain of this interface can search sysctl_fs_t dirs.
  Resolves: #1254188


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-57
changelog:
  - Add missing labeling for /usr/libexec/abrt-hook-ccpp as a part of #1245477 and #1242467 bugs
  Resolves: #1254188
  - We need allow connect to xserver for all sandbox_x domain because we have one type for all sandbox processes.
  Resolves:#1261938


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-56
changelog:
  - Remove labeling for modules_dep_t file contexts to have labeled them as modules_object_t.
  - Update files_read_kernel_modules() to contain modutils_read_module_deps_files() calling because module deps labeling could remain and it allows to avoid regressions.
  Resolves:#1266928


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-55
changelog:
  - We need to require sandbox_web_type attribute in sandbox_x_domain_template(). 
  Resolves: #1261938
  - ipsec: The NM helper needs to read the SAs
  Resolves: #1259786
  - ipsec: Allow ipsec management to create ptys
  Resolves: #1259786


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-54
changelog:
  - Add temporary fixes for sandbox related to #1103622. It allows to run everything under one sandbox type.
  Resolves:#1261938
  - Allow abrt_t domain to write to kernel msg device.
  Resolves: #1257828
  - Allow rpcbind_t domain to change file owner and group
  Resolves: #1265266


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-53
changelog:
  - Allow smbcontrol to create a socket in /var/samba which uses for a communication with smbd, nmbd and winbind. 
  Resolves: #1256459


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-52
changelog:
  - Allow dirsrv-admin script to read passwd file. Allow dirsrv-admin script to read httpd pid files. Label dirsrv-admin unit file and allow dirsrv-admin domains to use it.
  Resolves: #1230300
  - Allow qpid daemon to connect on amqp tcp port.
  Resolves: #1261805


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-51
changelog:
  - Label /etc/ipa/nssdb dir as cert_t
  Resolves:#1262718
  - Do not provide docker policy files which is shipped by docker-selinux.rpm
  Resolves:#1262812


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-50
changelog:
  - Add labels for afs binaries: dafileserver, davolserver, salvageserver, dasalvager 
  Resolves: #1192338
  - Add lsmd_plugin_t sys_admin capability, Allow lsmd_plugin_t getattr from sysfs filesystem.
   Resolves: #1238079
  - Allow rhsmcertd_t send signull to unconfined_service_t domains. 
  Resolves: #1176078
  - Remove file transition from snmp_manage_var_lib_dirs() interface which created snmp_var_lib_t dirs in var_lib_t.
  - Allow openhpid_t daemon to manage snmp files and dirs. 
  Resolves: #1243902
  - Allow mdadm_t domain read/write to general ptys and unallocated ttys. 
  Resolves: #1073314
  - Add interface unconfined_server_signull() to allow domains send signull to unconfined_service_t
   Resolves: #1176078


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-49
changelog:
  - Allow systemd-udevd to access netlink_route_socket to change names for network interfaces without unconfined.pp module. It affects also MLS. 
  Resolves:#1250456


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-48
changelog:
  - Fix labeling for fence_scsi_check script
  Resolves: #1255020
  - Allow openhpid to read system state Allow openhpid to connect to tcp http port.
   Resolves: #1244248
  - Allow openhpid to read snmp var lib files.
   Resolves: #1243902
  - Allow openvswitch_t domains read kernel dependencies due to openvswitch run modprobe
  - Allow unconfined_t domains to create /var/run/xtables.lock with iptables_var_run_t
  Resolves: #1243403
  - Remove bin_t label for /usr/share/cluster/fence_scsi_check\.pl 
  Resolves: #1255020


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-47
changelog:
  - Fix regexp in chronyd.fc file
  Resolves: #1243764
  - Allow passenger to getattr filesystem xattr
  Resolves: #1196555
  - Label mdadm.conf.anackbak as mdadm_conf_t file.
  Resolves: #1088904
  - Revert "Allow pegasus_openlmi_storage_t create mdadm.conf.anacbak file in /etc."
  - Allow watchdog execute fenced python script.
  Resolves: #1255020
  - Added inferface watchdog_unconfined_exec_read_lnk_files()
  - Remove labeling for /var/db/.*\.db as etc_t to label db files as system_db_t.
  Resolves: #1230877


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-46
changelog:
  - Allow watchdog execute fenced python script. Resolves: #1255020
  - Added inferface watchdog_unconfined_exec_read_lnk_files()
  - Label /var/run/chrony-helper dir as chronyd_var_run_t. Resolves: #1243764
  - Allow dhcpc_t domain transition to chronyd_t Resolves: #1243764


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-45
changelog:
  - Fix postfix_spool_maildrop_t,postfix_spool_flush_t contexts in postfix.fc file.
  Resolves: #1252442


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-44
changelog:
  - Allow exec pidof under hypervkvp domain.
  Resolves: #1254870
  - Allow hypervkvp daemon create connection to the system DBUS
  Resolves: #1254870


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-43
changelog:
  - Allow openhpid_t to read system state.
  Resolves: #1244248
  - Added labels for files provided by rh-nginx18 collection
  Resolves: #1249945
  - Dontaudit block_suspend capability for ipa_helper_t, this is kernel bug. Allow ipa_helper_t capability net_admin. Allow ipa_helper_t to list /tmp. Allow ipa_helper_t to read rpm db.
  Resolves: #1252968
  - Allow rhsmcertd exec rhsmcertd_var_run_t files and rhsmcerd_tmp_t files. This rules are in hide_broken_sympthons until we find better solution.
  Resolves: #1243431
  - Allow abrt_dump_oops_t to read proc_security_t files.
  - Allow abrt_dump_oops to signull all domains Allow abrt_dump_oops to read all domains state Allow abrt_dump_oops to ptrace all domains
  - Add interface abrt_dump_oops_domtrans()
  - Add mountpoint dontaudit access check in rhsmcertd policy.
  Resolves: #1243431
  - Allow samba_net_t to manage samba_var_t sock files.
  Resolves: #1252937
  - Allow chrome setcap to itself.
  Resolves: #1251996
  - Allow httpd daemon to manage httpd_var_lib_t lnk_files.
  Resolves: #1253706
  - Allow chronyd exec systemctl
  Resolves: #1243764
  - Add inteface chronyd_signal Allow timemaster_t send generic signals to chronyd_t.
  Resolves: #1243764
  - Added interface fs_dontaudit_write_configfs_dirs
  - Add label for kernel module dep files in /usr/lib/modules
  Resolves:#916635
  - Allow kernel_t domtrans to abrt_dump_oops_t
  - Added to files_dontaudit_write_all_mountpoints intefface new dontaudit rule, that domain included this interface dontaudit capability dac_override.
  - Allow systemd-networkd to send logs to systemd-journald.
  Resolves: #1236616


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-42
changelog:
  - Fix label on /var/tmp/kiprop_0
  Resolves:#1220763
  - Allow lldpad_t to getattr tmpfs_t.
  Resolves: #1246220
  - Label /dev/shm/lldpad.* as lldapd_tmpfs_t
  Resolves: #1246220
  - Allow audisp client to read system state.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-41
changelog:
  - Allow pcp_domain to manage pcp_var_lib_t lnk_files.
  Resolves: #1252341
  - Label /var/run/xtables.* as iptables_var_run_t
  Resolves: #1243403


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-40
changelog:
  - Add interface to read/write watchdog device
  - Add labels for /dev/memory_bandwith and /dev/vhci. Thanks ssekidde
  Resolves:#1210237
  - Allow apcupsd_t to read /sys/devices 
  Resolves:#1189185
  - Allow logrotate to reload services.
  Resolves: #1242453
  - Allow openhpid use libwatchdog plugin. (Allow openhpid_t rw watchdog device)
  Resolves: #1244260
  - Allow openhpid liboa_soap plugin to read generic certs.
  Resolves: #1244248
  - Allow openhpid liboa_soap plugin to read resolv.conf file.
  Resolves: #1244248
  - Label /usr/libexec/chrony-helper as chronyd_exec_t
  - Allow chronyd_t to read dhcpc state.
  - Allow chronyd to execute mkdir command.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-39
changelog:
  - Allow mdadm to access /dev/random and add support to create own files/dirs as mdadm_tmpfs_t.
  Resolves:#1073314
  - Allow udev, lvm and fsadm to access systemd-cat in /var/tmp/dracut if 'dracut -fv' is executed in MLS.
  - Allow admin SELinu users to communicate with kernel_t. It is needed to access /run/systemd/journal/stdout if 'dracut -vf' is executed. We allow it for other SELinux users.
  - Allow sysadm to execute systemd-sysctl in the sysadm_t domain. It is needed for ifup command in MLS mode.
  - Add fstools_filetrans_named_content_fsadm() and call it for named_filetrans_domain domains. We need to be sure that /run/blkid is created with correct labeling.
  Resolves:#1183503
  - Add support for /etc/sanlock which is writable by sanlock daemon.
  Resolves:#1231377
  - Allow useradd add homedir located in /var/lib/kdcproxy in ipa-server RPM scriplet.
  Resolves:#1243775 
  - Allow snapperd to pass data (one way only) via pipe negotiated over dbus
  Resolves:#1250550
  - Allow lsmd also setuid capability. Some commands need to executed under root privs. Other commands are executed under unprivileged user.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-38
changelog:
  - Allow openhpid to use libsnmp_bc plugin (allow read snmp lib files).
    Resolves: #1243902
  - Allow lsm_plugin_t to read sysfs, read hwdata, rw to scsi_generic_device
    Resolves: #1238079
  - Allow lsm_plugin_t to rw raw_fixed_disk.
    Resolves:#1238079
  - Allow rhsmcertd to send signull to unconfined_service.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-37
changelog:
  - Allow httpd_suexec_t to read and write Apache stream sockets 
  Resolves: #1243569
  - Allow qpid to create lnk_files in qpid_var_lib_t
  Resolves: #1247279


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-36
changelog:
  - Allow drbd to get attributes from filesystems.
  - Allow redis to read kernel parameters.
  Resolves: #1209518
  - Allow virt_qemu_ga_t domtrans to passwd_t
  - Allow audisp_remote_t to start power unit files domain to allow halt system.
  Resolves: #1186780
  - Allow audisp_remote_t to read/write user domain pty.
  Resolves: #1186780
  - Label /usr/sbin/chpasswd as passwd_exec_t.
  - Allow sysadm to administrate ldap environment and allow to bind ldap port to allow to setup an LDAP server (389ds).
  Resolves:#1221121


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-35
changelog:
  - gnome_dontaudit_search_config() needs to be a part of optinal_policy in pegasus.te
  - Allow pcp_pmcd daemon to read postfix config files.
  - Allow pcp_pmcd daemon to search postfix spool dirs.
  Resolves: #1213740
  - Added Booleans: pcp_read_generic_logs.
  Resolves: #1213740
  - Allow drbd to read configuration options used when loading modules.
  Resolves: #1134883
  - Allow glusterd to manage nfsd and rpcd services.
  - Allow glusterd to communicate with cluster domains over stream socket.
  - glusterd call pcs utility which calls find for cib.* files and runs pstree under glusterd. Dontaudit access to security files and update gluster boolean to reflect these changes.


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-34
changelog:
  - Allow glusterd to manage nfsd and rpcd services.
  - Allow networkmanager to  communicate via dbus with systemd_hostanmed. 
  Resolves: #1234954
  - Allow stream connect logrotate to prosody.
  - Add prosody_stream_connect() interface.
  -  httpd should be able to send signal/signull to httpd_suexec_t, instead of httpd_suexec_exec_t.
  - Allow prosody to create own tmp files/dirs.
  Resolves:#1212498


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-33
changelog:
  - Allow networkmanager read rfcomm port.
  Resolves:#1212498
  - Remove non exists label.
  - Fix *_admin intefaces where body is not consistent with header.
  - Label /usr/afs/ as afs_files_t, Allow afs_bosserver_t create afs_config_t and afs_dbdir_t dirs under afs_files_t, Allow afs_bosserver_t read kerberos config
  - Remove non exits nfsd_ro_t label.
  - Make all interfaces related to openshift_cache_t as deprecated.
  - Add rpm_var_run_t label to rpm_admin header
  - Add jabberd_lock_t label to jabberd_admin header.
  - Add samba_unconfined_script_exec_t to samba_admin header.
  - inn daemon should create innd_log_t objects in var_log_t instead of innd_var_run_t
  - Fix ctdb policy
  - Add samba_signull_winbind()
  - Add samba_signull_unconfined_net()
  - Allow ctdbd_t send signull to samba_unconfined_net_t.
  - Allow openshift_initrc_t to communicate with firewalld over dbus 
  Resolves:#1221326


author: Lukas Vrabec <lvrabec@redhat.com> 3.13.1-32
changelog:
  - Allow gluster to connect to all ports. It is required by random services executed by gluster.
  - Add interfaces winbind_signull(), samba_unconfined_net_signull().
  - Dontaudit smbd_t block_suspend capability. This is kernel bug.
  - Allow ctdbd sending signull to process winbind, samba_unconfined_net, to
      checking if processes exists.
  - Add tmpreaper booleans to use nfs_t and samba_share_t.
  - Fix path from /usr/sbin/redis-server to /usr/bin/redis-server
  - Allow connect ypserv to portmap_port_t
  - Fix paths in inn policy, Allow innd read innd_log_t dirs, Allow innd execute innd_etc_t files
  - Add support for openstack-nova-* packages
  - Allow NetworkManager_t send signull to dnssec_trigger_t.
  - Allow glusterd to execute showmount in the showmount domain.
  - Label swift-container-reconciler binary as swift_t.
  - Allow dnssec_trigger_t relabelfrom dnssec_trigger_var_run_t files.
  - Add cobbler_var_lib_t to "/var/lib/tftpboot/boot(/.*)?"
  Resolves:#1213540
  - Merge all nova_* labels under one nova_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-31
changelog:
  - Add logging_syslogd_run_nagios_plugins boolean for rsyslog to allow transition to nagios unconfined plugins
  Resolves:#1233550
  - Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/
  - Add support for oddjob based helper in FreeIPA.
  - Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob.
  - Add nagios_domtrans_unconfined_plugins() interface.
  - Update mta_filetrans_named_content() interface to cover more db files. 
  Resolves:#1167468
  - Add back ftpd_use_passive_mode boolean with fixed description.
  - Allow pmcd daemon stream connect to mysqld.
  - Allow pcp domains to connect to own process using unix_stream_socket. 
  Resolves:#1213709
  - Allow  abrt-upload-watch service to dbus chat with ABRT daemon and fsetid capability to allow run reporter-upload correctly.
  - Add new boolean - httpd_run_ipa to allow httpd process to run IPA helper and dbus chat with oddjob.
  - Add support for oddjob based helper in FreeIPA.
  - Allow dnssec_trigger_t create dnssec_trigger_tmp_t files in /var/tmp/


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-30
changelog:
  - Allow iptables to read ctdbd lib files.
  Resolves:#1224879
  - Add systemd_networkd_t to nsswitch domains.
  - Allow drbd_t write to fixed_disk_device. Reason: drbdmeta needs write to fixed_disk_device during initialization. 
  Resolves:#1130675
  - Allow NetworkManager write to sysfs. 
  - Fix cron_system_cronjob_use_shares boolean to call fs interfaces which contain only entrypoint permission.
  - Add cron_system_cronjob_use_shares boolean to allow system cronjob to be executed from shares - NFS, CIFS, FUSE. It requires "entrypoint" permissios on nfs_t, cifs_t and fusefs_t SELinux types.
  - Allow NetworkManager write to sysfs. 
  - Allow ctdb_t sending signull to smbd_t, for checking if smbd process exists. 
  - Dontaudit apache to manage snmpd_var_lib_t files/dirs. 
  - Add interface snmp_dontaudit_manage_snmp_var_lib_files().
  - Dontaudit mozilla_plugin_t cap. sys_ptrace. 
  - Rename xodbc-connect port to xodbc_connect
  - Allow ovsdb-server to connect on xodbc-connect and ovsdb tcp ports. 
  - Allow iscsid write to fifo file kdumpctl_tmp_t. Appears when kdump generates the initramfs during the kernel boot. 
  - Dontaudit chrome to read passwd file. 
  - nrpe needs kill capability to make gluster moniterd nodes working. 
  Resolves:#1235587


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-29
changelog:
  - We allow can_exec() on ssh_keygen on gluster. But there is a transition defined by init_initrc_domain() because we need to allow execute unconfined services by glusterd. So ssh-keygen ends up with ssh_keygen_t and we need to allow to manage /var/lib/glusterd/geo-replication/secret.pem.
  - Allow sshd to execute gnome-keyring if there is configured pam_gnome_keyring.so.
  - Allow gnome-keyring executed by passwd to access /run/user/UID/keyring to change a password. 
  - Label gluster python hooks also as bin_t.
  - Allow glusterd to interact with gluster tools running in a user domain
  - Add glusterd_manage_lib_files() interface.
  - ntop reads /var/lib/ntop/macPrefix.db and it needs dac_override. It has setuid/setgid. 
  - Allow samba_t net_admin capability to make CIFS mount working.
  - S30samba-start gluster hooks wants to search audit logs. Dontaudit it.
  Resolves:#1224879


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-28
changelog:
  - Allow glusterd to send generic signals to systemd_passwd_agent processes.
  - Allow glusterd to access init scripts/units without defined policy
  - Allow glusterd to run init scripts.
  - Allow glusterd to execute /usr/sbin/xfs_dbin glusterd_t domain.
  Resolves:#1224879


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-27
changelog:
  - Calling cron_system_entry() in pcp_domain_template needs to be a part of optional_policy block.
  - Allow samba-net to access /var/lib/ctdbd dirs/files.
  - Allow glusterd to send a signal to smbd.
  - Make ctdbd as home manager to access also FUSE.
  - Allow glusterd to use geo-replication gluster tool.
  - Allow glusterd to execute ssh-keygen.
  - Allow glusterd to interact with cluster services.
  - Allow glusterd to connect to the system DBUS for service (acquire_svc).
  - Label /dev/log correctly.
  Resolves:#1230932


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-26
changelog:
  - Back port the latest F22 changes to RHEL7. It should fix most of RHEL7.2 bugs
  - Add cgdcbxd policy 
  Resolves:#1072493
  - Fix ftp_homedir boolean
  Resolve:#1097775
  - Dontaudit ifconfig writing inhertited /var/log/pluto.log.
  - Allow cluster domain to dbus chat with systemd-logind.
  Resolves:#1145215
  - Dontaudit write access to inherited kdumpctl tmp files
  Resolves:#1156442
  - Allow isnsd_t to communicate with sssd
  Resolves:#1167702
  - Allow rwho_t to communicate with sssd
  Resolves:#1167718
  - Allow sblim_gatherd_t to communicate with sssd
  Resolves:#1167732
  - Allow pkcs_slotd_t to communicate with sssd
  Resolves:#1167737
  - Allow openvswitch_t to communicate with sssd
  Resolves:#1167816
  - Allow mysqld_safe_t to communicate with sssd
  Resolves:#1167832
  - Allow sshd_keygen_t to communicate with sssd
  Resolves:#1167840
  - Add support for iprdbg logging files in /var/log.
  Resolves:#1174363
  - Allow tmpreaper_t to manage ntp log content
  Resolves:#1176965
  - Allow gssd_t to manage ssh keyring
  Resolves:#1184791
  - Allow httpd_sys_script_t to send system log messages
  Resolves:#1185231
  - Allow apcupsd_t to read /sys/devices
  Resolves:#1189185
  - Allow dovecot_t sys_resource capability
  Resolves:#1191143
  - Add support for mongod/mongos systemd unit files.
  Resolves:#1197038
  - Add bacula fixes
  - Added label mysqld_etc_t for /etc/my.cnf.d/ dir.
  Resolves:#1203991


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-25
changelog:
  - Label /usr/libexec/postgresql-ctl as postgresql_exec_t. 
  - Add more restriction on entrypoint for unconfined domains.
  - Only allow semanage_t to be able to setenforce 0, no all domains that use selinux_semanage interface
  - Allow all domains to read /dev/urandom. It is needed by all apps/services linked to libgcrypt. There is no harm to allow it by default.
  - Update policy/mls for sockets related to access perm. Rules were contradictory.
  - Add nagios_run_pnp4nagios and nagios_run_sudo booleans to allow r
  un sudo from NRPE utils scripts and allow run nagios in conjunction w
  ith PNP4Nagios.
  Resolves:#1201054
  - Don't use deprecated userdom_manage_tmpfs_role() interface calliing and use userdom_manage_tmp_role() instead.
  - Update virt_read_pid_files() interface to allow read also symlinks with virt_var_run_t type
  - Label /var/lib/tftpboot/aarch64(/.*)? and /var/lib/tftpboot/images2(/.*)?
  - Add support for iprdbg logging files in /var/log.
  - Add fixes to rhsmcertd_t
  - Allow puppetagent_t to transfer firewalld messages over dbus
  - Add support for /usr/libexec/mongodb-scl-helper RHSCL helper script.
  - Added label mysqld_etc_t for /etc/my.cnf.d/ dir.
  - Add support for mongod/mongos systemd unit files.
  - cloudinit and rhsmcertd need to communicate with dbus
  - Allow dovecot_t sys_resource capability


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-24
changelog:
  - ALlow mongod execmem by default.
  - Update policy/mls for sockets. Rules were contradictory.
  Resolves:#1207133
  - Allow a user to login with different security level via ssh.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-23
changelog:
  - Update seutil_manage_config() interface.
  Resolves:#1185962
  - Allow pki-tomcat relabel pki_tomcat_etc_rw_t.
  - Turn on docker_transition_unconfined by default


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-21
changelog:
  - pkcsslotd_lock_t should be an alias for pkcs_slotd_lock_t.
  - Allow fowner capability for sssd because of selinux_child handling.
  - ALlow bind to read/write inherited ipsec pipes
  - Allow hypervkvp to read /dev/urandom and read  addition states/config files.
  - Allow gluster rpm scripletto create glusterd socket with correct labeling. This is a workaround until we get fix in glusterd.
  - Add glusterd_filetrans_named_pid() interface
  - Allow radiusd to connect to radsec ports.
  - Allow setuid/setgid for selinux_child
  - Allow lsmd plugin to connect to tcp/5988 by default.
  - Allow lsmd plugin to connect to tcp/5989 by default.
  - Update ipsec_manage_pid() interface.
  Resolves:#1184978


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-18
changelog:
  - Add auditing support for ipsec.
  Resolves:#1182524
  - Label /ostree/deploy/rhel-atomic-host/deploy directory as system_conf_t
  - Allow netutils chown capability to make tcpdump working with -w


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-17
changelog:
  - Allow ipsec to execute _updown.netkey script to run unbound-control.
  - Allow neutron to read rpm DB.
  - Add additional fixes for hyperkvp
   * creates new ifcfg-{name} file
   * Runs hv_set_ifconfig.sh, which does the following
   * Copies ifcfg-{name} to /etc/sysconfig/network-scripts
  - Allow svirt to read symbolic links in /sys/fs/cgroups labeled as tmpfs_t
  - Add labeling for pacemaker.log.
  - Allow radius to connect/bind radsec ports.
  - Allow pm-suspend running as virt_qemu_ga to read /var/log/pm-suspend.log
  - Allow  virt_qemu_ga to dbus chat with rpm.
  - Update virt_read_content() interface to allow read also char devices.
  - Allow glance-registry to connect to keystone port.
  Resolves:#1181818


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-16
changelog:
  - Allow sssd to send dbus all user domains.
  Resolves:#1172291
  - Allow lsm plugin to read certificates.
  - Fix labeling for keystone CGI scripts.
  - Make snapperd back as unconfined domain.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-15
changelog:
  - Fix bugs in interfaces discovered by sepolicy.
  - Allow slapd to read /usr/share/cracklib/pw_dict.hwm.
  - Allow lsm plugins to connect to tcp/18700 by default.
  - Allow brltty mknod capability to allow create /var/run/brltty/vcsa.
  - Fix pcp_domain_template() interface.
  - Fix conman.te.
  - Allow mon_fsstatd to read /proc/sys/fs/binfmt_misc
  - Allow glance-scrubber to connect tcp/9191.
  - Add missing setuid capability for sblim-sfcbd.
  - Allow pegasus ioctl() on providers.
  - Add conman_can_network.
  - Allow chronyd to read chrony conf files located in /run/timemaster/.
  - Allow radius to bind on tcp/1813 port.
  - dontaudit block suspend access for openvpn_t 
  - Allow conman to create files/dirs in /tmp.
  - Update xserver_rw_xdm_keys() interface to have 'setattr'.
  Resolves:#1172291 
  - Allow sulogin to read /dev/urandom and /dev/random.
  - Update radius port definition to have also tcp/18121
  - Label prandom as random_device_t.
  - Allow charon to manage files in /etc/strongimcv labeled as ipsec_conf_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-14
changelog:
  - Allow virt_qemu_ga_t to execute kmod.
  - Add missing files_dontaudit_list_security_dirs() for smbd_t in samba_export_all_ro boolean.
  - Add additionnal MLS attribute for oddjob_mkhomedir to create homedirs.
  Resolves:#1113725
  - Enable OpenStack cinder policy
  - Add support for /usr/share/vdsm/daemonAdapter
  - Add support for /var/run/gluster


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-13
changelog:
  - Remove old pkcsslotd.pp from minimum package
  - Allow rlogind to use also rlogin ports.
  - Add support for /usr/libexec/ntpdate-wrapper. Label it as ntpdate_exec_t.
  - Allow bacula to connect also to postgresql.
  - Label /usr/libexec/tomcat/server as tomcat_exec_t
  - Add support for /usr/sbin/ctdbd_wrapper
  - Add support for /usr/libexec/ppc64-diag/rtas_errd
  - Allow rpm_script_roles to access system_mail_t
  - Allow brltty to create /var/run/brltty
  - Allow lsmd plugin to access netlink_route_socket
  - Allow smbcontrol to read passwd
  - Add support for /usr/libexec/sssd/selinux_child and create sssd_selinux_manager_t domain for it
  Resolves:#1140106
  - Allow osad to execute rhn_check
  - Allow load_policy to rw inherited sssd pipes because of selinux_child
  - Allow admin SELinux users mounting / as private within a new mount namespace as root in MLS
  - Add additional fixes for su_restricted_domain_template to make moving to sysadm_r and trying to su working correctly
  - Add additional booleans substitions


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-12
changelog:
  - Add seutil_dontaudit_access_check_semanage_module_store() interface
  Resolves:#1140106
  - Update to have all _systemctl() interface also init_reload_services().
  - Dontaudit access check on SELinux module store for sssd.
  - Add labeling for /sbin/iw.
  - Allow named_filetrans_domain to create ibus directory with correct labeling.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-11
changelog:
  - Allow radius to bind tcp/1812 radius port.
  - Dontaudit list user_tmp files for system_mail_t.
  - Label virt-who as virtd_exec_t.
  - Allow rhsmcertd to send a null signal to virt-who running as virtd_t.
  - Add missing alias for _content_rw_t.
  Resolves:#1089177
  - Allow spamd to access razor-agent.log.
  - Add fixes for sfcb from libvirt-cim TestOnly bug.
  - Allow NetworkManager stream connect on openvpn.
  - Make /usr/bin/vncserver running as unconfined_service_t.
  - getty_t should be ranged in MLS. Then also local_login_t runs as ranged domain.
  - Label /etc/docker/certs.d as cert_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-10
changelog:
  - Label /etc/strongimcv as ipsec_conf_file_t.
  - Add support for /usr/bin/start-puppet-ca helper script
  Resolves:#1160727
  - Allow rpm scripts to enable/disable transient systemd units.
  Resolves:#1154613 
  - Make kpropdas nsswitch domain
  Resolves:#1153561
  - Make all glance domain as nsswitch domains
  Resolves:#1113281
  - Allow selinux_child running as sssd access check on /etc/selinux/targeted/modules/active
  - Allow access checks on setfiles/load_policy/semanage_lock for selinux_child running as sssd_t
  Resolves:#1140106


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-9
changelog:
  - Dontaudit access check on setfiles/load_policy for sssd_t.
  Resolves:#1140106
  - Add kdump_rw_inherited_kdumpctl_tmp_pipes()
  Resolves:#1156442
  - Make linuxptp services as unconfined.
  - Added new policy linuxptp.
  Resolves:#1149693
  - Label keystone cgi files as keystone_cgi_script_exec_t.
  Resolves:#1138424
  - Make tuned as unconfined domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-8
changelog:
  - Allow guest to connect to libvirt using unix_stream_socket.
  - Allow all bus client domains to dbus chat with unconfined_service_t.
  - Allow inetd service without own policy to run in inetd_child_t which is unconfined domain.
  - Make opensm as nsswitch domain to make it working with sssd.
  - Allow brctl to read meminfo.
  - Allow winbind-helper to execute ntlm_auth in the caller domain.
  Resolves:#1160339
  - Make plymouthd as nsswitch domain to make it working with sssd.
  Resolves:#1160196
  - Make drbd as nsswitch domain to make it working with sssd.
  - Make conman as nsswitch domain to make ipmitool.exp runing as conman_t working.
  - Add support for /var/lib/sntp directory.
  - Add fixes to allow docker to create more content in tmpfs ,and donaudit reading /proc
  - Allow winbind to read usermodehelper
  - Allow telepathy domains to execute shells and bin_t
  - Allow gpgdomains to create netlink_kobject_uevent_sockets
  - Allow mongodb to bind to the mongo port and mongos to run as mongod_t
  - Allow abrt to read software raid state.
  - Allow nslcd to execute netstat.
  - Allow dovecot to create user's home directory when they log into IMAP.
  - Allow login domains to create kernel keyring with different level.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-7
changelog:
  - Allow modemmanger to connectto itself
  Resolves:#1120152 
  - Allow pki_tomcat to create link files in /var/lib/pki-ca.
  Resolves:#1121744 
  - varnishd needs to have fsetid capability
  Resolves:#1125165
  - Allow snapperd to dbus chat with system cron jobs.
  Resolves:#1152447
  - Allow dovecot to create user's home directory when they log into IMAP 
  Resolves:#1152773   
  - Add labeling for /usr/sbin/haproxy-systemd-wrapper wrapper to make haproxy running haproxy_t.
  - ALlow listen and accept on tcp socket for init_t in MLS. Previously it was for xinetd_t. 
  - Allow nslcd to execute netstat.
  - Add suppor for keepalived unconfined scripts and allow keepalived to read all domain state and kill capability.
  - Allow nslcd to read /dev/urandom.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-5
changelog:
  - Add back kill permisiion for service class
  Resolves:#1150011
  - Make rhsmcertd_t also as dbus domain.
  - Allow named to create DNS_25 with correct labeling.
  - Add cloudform_dontaudit_write_cloud_log()
  - Call auth_use_nsswitch to apache to read/write cloud-init keys.
  - Allow cloud-init to dbus chat with certmonger.
  - Fix path to mon_statd_initrc_t script.
  - Allow all RHCS services to read system state.
  - Allow dnssec_trigger_t to execute unbound-control in own domain.
  - kernel_read_system_state needs to be called with type. Moved it to antivirus.if.
  - Added policy for mon_statd and mon_procd services. BZ (1077821)
  - Allow opensm_t to read/write /dev/infiniband/umad1.
  - Allow mongodb to manage own log files.
  - Allow neutron connections to system dbus.
  - Add support for /var/lib/swiftdirectory.
  - Allow nova-scheduler to read certs.
  - Allow openvpn to access /sys/fs/cgroup dir.
  - Allow openvpn to execute  systemd-passwd-agent in  systemd_passwd_agent_t to make openvpn working with systemd.
  - Fix samba_export_all_ro/samba_export_all_rw booleans to dontaudit search/read security files.
  - Add auth_use_nsswitch for portreserve to make it working with sssd.
  - automount policy is non-base module so it needs to be called in optional block.
  - ALlow sensord to getattr on sysfs.
  - Label /usr/share/corosync/corosync as cluster_exec_t.
  - Allow lmsd_plugin to read passwd file. BZ(1093733)
  - Allow read antivirus domain all kernel sysctls.
  - Allow mandb to getattr on file systems
  - Allow nova-console to connect to mem_cache port.
  - Make sosreport as unconfined domain.
  - Allow mondogdb to  'accept' accesses on the tcp_socket port.
  - ALlow sanlock to send a signal to virtd_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-3
changelog:
  - Add back kill permisiion for system class
  - Allow iptables read fail2ban logs.
  - Fix radius labeled ports
  - Add userdom_manage_user_tmpfs_files interface
  - Allow libreswan to connect to VPN via NM-libreswan.
  - Label 4101 tcp port as brlp port
  - fix dev_getattr_generic_usb_dev interface
  - Allow all domains to read fonts
  - Make sure /run/systemd/generator and system is labeled correctly on creation.
  - Dontaudit aicuu to search home config dir. 
  - Make keystone_cgi_script_t domain. 
  Resolves:#1138424
  - Fix bug in drbd policy, 
  - Added support for cpuplug. 
  - ALlow sanlock_t to read sysfs_t.
  - Added sendmail_domtrans_unconfined interface
  - Fix broken interfaces
  - radiusd wants to write own log files.
  - Label /usr/libexec/rhsmd as rhsmcertd_exec_t
  - Allow rhsmcertd send signull to setroubleshoot. 
  - Allow rhsmcertd manage rpm db. 
  - Added policy for blrtty. 
  - Fix keepalived policy
  - Allow rhev-agentd dbus chat with systemd-logind.
  - Allow keepalived manage snmp var lib sock files.
  - Add support for /var/lib/graphite-web
  - Allow NetworkManager to create Bluetooth SDP sockets
  - It's going to do the the discovery for DUN service for modems with Bluez 5.
  - Allow swift to connect to all ephemeral ports by default.
  - Allow sssd to read selinux config to add SELinux user mapping.
  - Allow lsmd to search own plguins.
  - Allow abrt to read /dev/memto generate an unique machine_id and uses  sosuploader's algorithm based off dmidecode[1] fields.
  - ALlow zebra for user/group look-ups.
  - Allow nova domains to getattr on all filesystems.
  - Allow collectd sys_ptrace and dac_override caps because of reading of /proc/%i/io for several processes.
  - Allow pppd to connect to /run/sstpc/sstpc-nm-sstp-service-28025 over unix stream socket.
  - Allow rhnsd_t to manage also rhnsd config symlinks.
  - ALlow user mail domains to create dead.letter.
  - Allow rabbitmq_t read rabbitmq_var_lib_t lnk files. 
  - Allow pki-tomcat to change SELinux object identity.
  - Allow radious to connect to apache ports to do OCSP check
  - Allow git cgi scripts to create content in /tmp
  - Allow cockpit-session to do GSSAPI logins.
  - Allow sensord read in /proc 
  - Additional access required by usbmuxd


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-2
changelog:
  - Allow locate to look at files/directories without labels, and chr_file and blk_file on non dev file systems
  - Label /usr/lib/erlang/erts.*/bin files as bin_t
  - Add files_dontaudit_access_check_home_dir() inteface.
  - Allow udev_t mounton udev_var_run_t dirs #(1128618)
  - Add systemd_networkd_var_run_t labeling for /var/run/systemd/netif and allow systemd-networkd to manage it.
  - Add init_dontaudit_read_state() interface.
  - Add label for ~/.local/share/fonts
  - Allow unconfined_r to access unconfined_service_t.
  - Allow init to read all config files
  - Add new interface to allow creation of file with lib_t type
  - Assign rabbitmq port.
  - Allow unconfined_service_t to dbus chat with all dbus domains
  - Add new interfaces to access users keys.
  - Allow domains to are allowed to mounton proc to mount on files as well as dirs
  - Fix labeling for HOME_DIR/tmp and HOME_DIR/.tmp directories.
  - Add a port definition for shellinaboxd
  - Label ~/tmp and ~/.tmp directories in user tmp dirs as user_tmp_t
  - Allow userdomains to stream connect to pcscd for smart cards
  - Allow programs to use pam to search through user_tmp_t dires (/tmp/.X11-unix)
  - Update to rawhide-contrib changes
  Resolves:#1123844


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-154
changelog:
  - Add support for us_cli ports
  - Fix labeling for /var/run/user/<UID>/gvfs
  - add support for tcp/9697
  - Additional rules required by openstack,  needs backport to F20 and RHEL7
  - Additional access required by docker
  - ALlow motion to use tcp/8082 port
  - Allow init_t to setattr/relabelfrom dhcp state files
  - Dontaudit antivirus domains read access on all security files by default
  - Add missing alias for old amavis_etc_t type
  - Allow block_suspend cap for haproxy
  - Additional fixes for  instack overcloud
  - Allow OpenStack to read mysqld_db links and connect to MySQL
  - Remove dup filename rules in gnome.te
  - Allow sys_chroot cap for httpd_t and setattr on httpd_log_t
  - Allow iscsid to handle own unit files
  - Add iscsi_systemctl()
  - Allow mongod to create also sock_files in /run with correct labeling
  - Allow httpd to send signull to apache script domains and don't audit leaks
  - Allow rabbitmq_beam to connect to httpd port
  - Allow aiccu stream connect to pcscd
  - Allow dmesg to read hwdata and memory dev
  - Allow all freeipmi domains to read/write ipmi devices
  - Allow sblim_sfcbd to use also pegasus-https port
  - Allow rabbitmq_epmd to manage rabbit_var_log_t files
  - Allow chronyd to read /sys/class/hwmon/hwmon1/device/temp2_input
  - Allow docker to status any unit file and allow it to start generic unit files


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-152
changelog:
  - Fix Multiple same specifications for /var/named/chroot/dev/zero
  - Add labels for /var/named/chroot_sdb/dev devices
  - Add support for strongimcv
  - Use kerberos_keytab_domains in auth_use_nsswitch
  - Update auth_use_nsswitch to make all these types as kerberos_keytab_domain to
  - Allow net_raw cap for neutron_t and send sigkill to dnsmasq
  - Fix ntp_filetrans_named_content for sntp-kod file
  - Add httpd_dbus_sssd boolean
  - Dontaudit exec insmod in boinc policy
  - Rename kerberos_keytab_domain to kerberos_keytab_domains
  - Add kerberos_keytab_domain()
  - Fix kerberos_keytab_template()
  - Make all domains which use kerberos as kerberos_keytab_domain
  Resolves:#1083670
  - Allow kill capability to winbind_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-151
changelog:
  - varnishd wants chown capability
  - update ntp_filetrans_named_content() interface
  - Add additional fixes for neutron_t. #1083335
  - Dontaudit getattr on proc_kcore_t
  - Allow pki_tomcat_t to read ipa lib files
  - Allow named_filetrans_domain to create /var/cache/ibus with correct labelign
  - Allow init_t run /sbin/augenrules
  - Add dev_unmount_sysfs_fs and sysnet_manage_ifconfig_run interfaces
  - Allow unpriv SELinux user to use sandbox
  - Add default label for /tmp/hsperfdata_root


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-149
changelog:
  - Allow xauth_t to read user_home_dir_t lnk_file
  - Add labeling for lightdm-data
  - Allow certmonger to manage ipa lib files
  - Add support for /var/lib/ipa
  - Allow pegasus to getattr virt_content
  - Added some new rules to pcp policy
  - Allow chrome_sandbox to execute config_home_t
  - Add support for ABRT FAF


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-148
changelog:
  - Allow kdm to send signull to remote_login_t process
  - Add gear policy
  - Turn on gear_port_t
  - Allow cgit to read gitosis lib files by default
  - Allow vdagent to read xdm state
  - Allow NM and fcoeadm to talk together over unix_dgram_socket


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-147
changelog:
  - Back port fixes for pegasus_openlmi_admin_t from rawhide
  Resolves:#1080973
  - Add labels for ostree
  - Add SELinux awareness for NM
  - Label /usr/sbin/pwhistory_helper as updpwd_exec_t


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-146
changelog:
  - add gnome_append_home_config()
  - Allow thumb to append GNOME config home files
  - Allow rasdaemon to rw /dev/cpu//msr
  - fix /var/log/pki file spec
  - make bacula_t as auth_nsswitch domain
  - Identify pki_tomcat_cert_t as a cert_type
  - Define speech-dispater_exec_t as an application executable
  - Add a new file context for /var/named/chroot/run directory
  - update storage_filetrans_all_named_dev for sg* devices
  - Allow auditctl_t  to getattr on all removeable devices
  - Allow nsswitch_domains to stream connect to nmbd
  - Allow unprivusers to connect to memcached
  - label /var/lib/dirsrv/scripts-INSTANCE as bin_t


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-145
changelog:
  - Allow also unpriv user to run vmtools
  - Allow secadm to read /dev/urandom and meminfo
  Resolves:#1079250
  - Add booleans to allow docker processes to use nfs and samba
  - Add mdadm_tmpfs support
  - Dontaudit net_amdin for /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.51-2.4.5.1.el7.x86_64/jre-abrt/bin/java running as pki_tomcat_t
  - Allow vmware-user-sui to use user ttys
  - Allow talk 2 users logged via console too
  - Allow ftp services to manage xferlog_t
  - Make all pcp domanis as unconfined for RHEL7.0 beucause of new policies
  - allow anaconda to dbus chat with systemd-localed


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-144
changelog:
  - allow anaconda to dbus chat with systemd-localed
  - Add fixes for haproxy based on bperkins@redhat.com
  - Allow cmirrord to make dmsetup working
  - Allow NM to execute arping
  - Allow users to send messages through talk
  - Add userdom_tmp_role for secadm_t


author: Lukas Vrabec <lvrabec@redhat.com> 3.12.1-143
changelog:
  - Add additional fixes for rtas_errd
  - Fix transitions for tmp/tmpfs in rtas.te
  - Allow rtas_errd to readl all sysctls


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-142
changelog:
  - Add support for /var/spool/rhsm/debug
  - Make virt_sandbox_use_audit as True by default
  - Allow svirt_sandbox_domains to ptrace themselves


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-140
changelog:
  - Allow docker to read tmpfs_t symlinks
  - Allow sandbox svirt_lxc_net_t to talk to syslog and to sssd over stream sockets


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-139
changelog:
  - Allow collectd to talk to libvirt
  - Allow chrome_sandbox to use leaked unix_stream_sockets
  - Dontaudit leaks of sockets into chrome_sandbox_t
  - If you create a cups directory in /var/cache then it should be labeled cups_rw_etc_t
  - Run vmtools as unconfined domains
  - Allow snort to manage its log files
  - Allow systemd_cronjob_t to be entered via bin_t
  - Allow procman to list doveconf_etc_t
  - allow keyring daemon to create content in tmpfs directories
  - Add proper labelling for icedtea-web
  - vpnc is creating content in networkmanager var run directory
  - Label sddm as xdm_exec_t to make KDE working again
  - Allow postgresql to read network state
  - Allow java running as pki_tomcat to read network sysctls
  - Fix cgroup.te to allow cgred to read cgconfig_etc_t
  - Allow beam.smp to use ephemeral ports
  - Allow winbind to use the nis to authenticate passwords


author: Lukas Vrabec <lvrabec@redhat.com> 3.12.1-138
changelog:
  - Make rtas_errd_t as unconfined domain for F20.It needs additional fixes. It runs rpm at least.
  - Allow net_admin cap for fence_virtd running as fenced_t
  - Make  abrt-java-connector working
  - Make cimtest script 03_defineVS.py of ComputerSystem group working
  - Fix git_system_enable_homedirs boolean
  - Allow munin mail plugins to read network systcl


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-137
changelog:
  - Allow vmtools_helper_t to execute bin_t
  - Add support for /usr/share/joomla
  - /var/lib/containers should be labeled as openshift content for now
  - Allow docker domains to talk to the login programs, to allow a process to login into the container
  - Allow install_t do dbus chat with NM
  - Fix interface names in anaconda.if
  - Add install_t for anaconda. A new type is a part of anaconda policy
  - sshd to read network sysctls


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-134
changelog:
  - Allow unpriv SELinux users to dbus chat with firewalld
  - Add lvm_write_metadata()
  - Label /etc/yum.reposd dir as system_conf_t. Should be safe because system_conf_t is base_ro_file_type
  - Allow pegasus_openlmi_storage_t to write lvm metadata
  - Add hide_broken_symptoms for kdumpgui because of systemd bug
  - Make kdumpgui_t as unconfined domain
  Resolves:#1044299
  - Allow docker to connect to tcp/5000


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-133
changelog:
  - Allow numad to write scan_sleep_millisecs
  - Turn on entropyd_use_audio boolean by default
  - Allow cgred to read /etc/cgconfig.conf because it contains templates used together with rules from /etc/cgrules.conf.
  - Allow lscpu running as rhsmcertd_t to read /proc/sysinfo
  - Fix label on irclogs in the homedir
  - Allow kerberos_keytab_domain domains to manage keys until we get sssd fix
  - Allow postgresql to use ldap
  - Add missing syslog-conn port
  - Add support for /dev/vmcp and /dev/sclp
  Resolves:#1069310


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-132
changelog:
  - Modify xdm_write_home to allow create files/links in /root with xdm_home_
  - Allow virt domains to read network state
  Resolves:#1072019


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-131
changelog:
  - Added pcp rules
  - dontaudit openshift_cron_t searching random directories, should be back ported to RHEL6
  - clean up ctdb.te
  - Allow ctdbd to connect own ports
  - Fix samba_export_all_rw booleanto cover also non security dirs
  - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs
  - Allow neutron to create /run/netns with correct labeling
  - Allow certmonger to list home dirs


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-130
changelog:
  - Change userdom_use_user_inherited_ttys to userdom_use_user_ttys for systemd-tty-ask
  - Add sysnet_filetrans_named_content_ifconfig() interface
  - Allow ctdbd to connect own ports
  - Fix samba_export_all_rw booleanto cover also non security dirs
  - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs
  - Allow neutron to create /run/netns with correct labeling
  - Allow kerberos keytab domains to manage sssd/userdomain keys"
  - Allow to run ip cmd in neutron_t domain


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-129
changelog:
  - Allow block_suspend cap2 for systemd-logind and rw dri device
  - Add labeling for /usr/libexec/nm-libreswan-service
  - Allow locallogin to rw xdm key to make Virtual Terminal login providing smartcard pin working
  - Add xserver_rw_xdm_keys()
  - Allow rpm_script_t to dbus chat also with systemd-located
  - Fix ipa_stream_connect_otpd()
  - update lpd_manage_spool() interface
  - Allow krb5kdc to stream connect to ipa-otpd
  - Add ipa_stream_connect_otpd() interface
  - Allow vpnc to unlink NM pids
  - Add networkmanager_delete_pid_files()
  - Allow munin plugins to access unconfined plugins
  - update abrt_filetrans_named_content to cover /var/spool/debug
  - Label /var/spool/debug as abrt_var_cache_t
  - Allow rhsmcertd to connect to squid port
  - Make docker_transition_unconfined as optional boolean
  - Allow certmonger to list home dirs


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-128
changelog:
  - Make snapperd as unconfined domain and add additional fixes for it
  - Remove nsplugin.pp module on upgrade


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-127
changelog:
  - Add snapperd_home_t for HOME_DIR/.snapshots directory
  - Make sosreport as unconfined domain
  - Allow sosreport to execute grub2-probe
  - Allow NM to manage hostname config file
  - Allow systemd_timedated_t to dbus chat with rpm_script_t
  - Allow lsmd plugins to connect to http/ssh/http_cache ports by default
  - Add lsmd_plugin_connect_any boolean
  - Allow mozilla_plugin to attempt to set capabilities
  - Allow lsdm_plugins to use tcp_socket
  - Dontaudit mozilla plugin from getattr on /proc or /sys
  - Dontaudit use of the keyring by the services in a sandbox
  - Dontaudit attempts to sys_ptrace caused by running ps for mysqld_safe_t
  - Allow rabbitmq_beam to connect to jabber_interserver_port
  - Allow logwatch_mail_t to transition to qmail_inject and queueu
  - Added new rules to pcp policy
  - Allow vmtools_helper_t to change role to system_r
  - Allow NM to dbus chat with vmtools
  - Fix couchdb_manage_files() to allow manage couchdb conf files
  - Add support for /var/run/redis.sock
  - dontaudit gpg trying to use audit
  - Allow consolekit to create log directories and files
  - Fix vmtools policy to allow user roles to access vmtools_helper_t
  - Allow block_suspend cap2 for ipa-otpd
  - Allow pkcsslotd to read users state
  - Add ioctl to init_dontaudit_rw_stream_socket
  - Add systemd_hostnamed_manage_config() interface
  - Remove transition for temp dirs created by init_t
  - gdm-simple-slave uses use setsockopt
  - sddm-greater is a xdm type program


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-126
changelog:
  - Add lvm_read_metadata()
  - Allow auditadm to search /var/log/audit dir
  - Add lvm_read_metadata() interface
  - Allow confined users to run vmtools helpers
  - Fix userdom_common_user_template()
  - Generic systemd unit scripts do write check on /
  - Allow init_t to create init_tmp_t in /tmp.This is for temporary content created by generic unit files
  - Add additional fixes needed for init_t and setup script running in generic unit files
  - Allow general users to create packet_sockets
  - added connlcli port
  - Add init_manage_transient_unit() interface
  - Allow init_t (generic unit files) to manage rpc state date as we had it for initrc_t
  - Fix userdomain.te to require passwd class
  - devicekit_power sends out a signal to all processes on the message bus when power is going down
  - Dontaudit rendom domains listing /proc and hittping system_map_t
  - Dontauit leaks of var_t into ifconfig_t
  - Allow domains that transition to ssh_t to manipulate its keyring
  - Define oracleasm_t as a device node
  - Change to handle /root as a symbolic link for os-tree
  - Allow sysadm_t to create packet_socket, also move some rules to attributes
  - Add label for openvswitch port
  - Remove general transition for files/dirs created in /etc/mail which got etc_aliases_t label.
  - Allow postfix_local to read .forward in pcp lib files
  - Allow pegasus_openlmi_storage_t to read lvm metadata
  - Add additional fixes for pegasus_openlmi_storage_t
  - Allow bumblebee to manage debugfs
  - Make bumblebee as unconfined domain
  - Allow snmp to read etc_aliases_t
  - Allow lscpu running in pegasus_openlmi_storage_t to read /dev/mem
  - Allow pegasus_openlmi_storage_t to read /proc/1/environ
  - Dontaudit read gconf files for cupsd_config_t
  - make vmtools as unconfined domain
  - Add vmtools_helper_t for helper scripts. Allow vmtools shutdonw a host and run ifconfig.
  - Allow collectd_t to use a mysql database
  - Allow ipa-otpd to perform DNS name resolution
  - Added new policy for keepalived
  - Allow openlmi-service provider to manage transitient units and allow stream connect to sssd
  - Add additional fixes new pscs-lite+polkit support
  - Add labeling for /run/krb5kdc
  - Change w3c_validator_tmp_t to httpd_w3c_validator_tmp_t in F20
  - Allow pcscd to read users proc info
  - Dontaudit smbd_t sending out random signuls
  - Add boolean to allow openshift domains to use nfs
  - Allow w3c_validator to create content in /tmp
  - zabbix_agent uses nsswitch
  - Allow procmail and dovecot to work together to deliver mail
  - Allow spamd to execute files in homedir if boolean turned on
  - Allow openvswitch to listen on port 6634
  - Add net_admin capability in collectd policy
  - Fixed snapperd policy
  - Fixed bugsfor pcp policy
  - Allow dbus_system_domains to be started by init
  - Fixed some interfaces
  - Add kerberos_keytab_domain attribute
  - Fix snapperd_conf_t def


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-125
changelog:
  - Addopt corenet rules for unbound-anchor to rpm_script_t
  - Allow runuser to send send audit messages.
  - Allow postfix-local to search .forward in munin lib dirs
  - Allow udisks to connect to D-Bus
  - Allow spamd to connect to spamd port
  - Fix syntax error in snapper.te
  - Dontaudit osad to search gconf home files
  - Allow rhsmcertd to manage /etc/sysconf/rhn director
  - Fix pcp labeling to accept /usr/bin for all daemon binaries
  - Fix mcelog_read_log() interface
  - Allow iscsid to manage iscsi lib files
  - Allow snapper domtrans to lvm_t. Add support for /etc/snapper and allow snapperd to manage it.
  - Make tuned_t as unconfined domain for RHEL7.0
  - Allow ABRT to read puppet certs
  - Add sys_time capability for virt-ga
  - Allow gemu-ga to domtrans to hwclock_t
  - Allow additional access for virt_qemu_ga_t processes to read system clock and send audit messages
  - Fix some AVCs in pcp policy
  - Add to bacula capability setgid and setuid and allow to bind to bacula ports
  - Changed label from rhnsd_rw_conf_t to rhnsd_conf_t
  - Add access rhnsd and osad to /etc/sysconfig/rhn
  - drbdadm executes drbdmeta
  - Fixes needed for docker
  - Allow epmd to manage /var/log/rabbitmq/startup_err file
  - Allow beam.smp connect to amqp port
  - Modify xdm_write_home to allow create also links as xdm_home_t if the boolean is on true
  - Allow init_t to manage pluto.ctl because of init_t instead of initrc_t
  - Allow systemd_tmpfiles_t to manage all non security files on the system
  - Added labels for bacula ports
  - Fix label on /dev/vfio/vfio
  - Add kernel_mounton_messages() interface
  - init wants to manage lock files for iscsi


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-124
changelog:
  - Added osad policy
  - Allow postfix to deliver to procmail
  - Allow bumblebee to seng kill signal to xserver
  - Allow vmtools to execute /usr/bin/lsb_release
  - Allow docker to write system net ctrls
  - Add support for rhnsd unit file
  - Add dbus_chat_session_bus() interface
  - Add dbus_stream_connect_session_bus() interface
  - Fix pcp.te
  - Fix logrotate_use_nfs boolean
  - Add lot of pcp fixes found in RHEL7
  - fix labeling for pmie for pcp pkg
  - Change thumb_t to be allowed to chat/connect with session bus type
  - Allow call renice in mlocate
  - Add logrotate_use_nfs boolean
  - Allow setroubleshootd to read rpc sysctl


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-123
changelog:
  - Turn on bacula, rhnsd policy
  - Add support for rhnsd unit file
  - Add dbus_chat_session_bus() interface
  - Add dbus_stream_connect_session_bus() interface
  - Fix logrotate_use_nfs boolean
  - Add lot of pcp fixes found in RHEL7
  - fix labeling for pmie for pcp pkg
  - Change thumb_t to be allowed to chat/connect with session bus type
  - Allow call renice in mlocate
  - Add logrotate_use_nfs boolean
  - Allow setroubleshootd to read rpc sysctl
  - Fixes for *_admin interfaces
  - Add pegasus_openlmi_storage_var_run_t type def
  - Add support for /var/run/openlmi-storage
  - Allow tuned to create syslog.conf with correct labeling
  - Add httpd_dontaudit_search_dirs boolean
  - Add support for winbind.service
  - ALlow also fail2ban-client to read apache logs
  - Allow vmtools to getattr on all fs
  - Add support for dey_sapi port
  - Add logging_filetrans_named_conf()
  - Allow passwd_t to use ipc_lock, so that it can change the password in gnome-keyring


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-122
changelog:
  - Update snapper policy
  - Allow domains to append rkhunter lib files
  - Allow snapperd to getattr on all fs
  - Allow xdm to create /var/gdm with correct labeling
  - Add label for snapper.log
  - Allow fail2ban-client to read apache log files
  - Allow thumb_t to execute dbus-daemon in thumb_t


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-121
changelog:
  - Allow gdm to create /var/gdm with correct labeling
  - Allow domains to append rkhunterl lib files. #1057982
  - Allow systemd_tmpfiles_t net_admin to communicate with journald
  - Add interface to getattr on an isid_type for any type of file
  - Update libs_filetrans_named_content() to have support for /usr/lib/debug directory
  - Allow initrc_t domtrans to authconfig if unconfined is enabled
  - Allow docker and mount on devpts chr_file
  - Allow docker to transition to unconfined_t if boolean set
  - init calling needs to be optional in domain.te
  - Allow uncofined domain types to handle transient unit files
  - Fix labeling for vfio devices
  - Allow net_admin capability and send system log msgs
  - Allow lldpad send dgram to NM
  - Add networkmanager_dgram_send()
  - rkhunter_var_lib_t is correct type
  - Back port pcp policy from rawhide
  - Allow openlmi-storage to read removable devices
  - Allow system cron jobs to manage rkhunter lib files
  - Add rkhunter_manage_lib_files()
  - Fix ftpd_use_fusefs boolean to allow manage also symlinks
  - Allow smbcontrob block_suspend cap2
  - Allow slpd to read network and system state info
  - Allow NM domtrans to iscsid_t if iscsiadm is executed
  - Allow slapd to send a signal itself
  - Allow sslget running as pki_ra_t to contact port 8443, the secure port of the CA.
  - Fix plymouthd_create_log() interface
  - Add rkhunter policy with files type definition for /var/lib/rkhunter until it is fixed in rkhunter package
  - Add mozilla_plugin_exec_t for /usr/lib/firefox/plugin-container
  - Allow postfix and cyrus-imapd to work out of box
  - Allow fcoemon to talk with unpriv user domain using unix_stream_socket
  - Dontaudit domains that are calling into journald to net_admin
  - Add rules to allow vmtools to do what it does
  - snapperd is D-Bus service
  - Allow OpenLMI PowerManagement to call 'systemctl --force reboot'
  - Add haproxy_connect_any boolean
  - Allow haproxy also to use http cache port by default
  Resolves:#1058248


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-120
changelog:
  - Allow apache to write to the owncloud data directory in /var/www/html...
  - Allow consolekit to create log dir
  - Add support for icinga CGI scripts
  - Add support for icinga
  - Allow kdumpctl_t to create kdump lock file
  Resolves:#1055634
  - Allow kdump to create lnk lock file
  - Allow nscd_t block_suspen capability
  - Allow unconfined domain types to manage own transient unit file
  - Allow systemd domains to handle transient init unit files
  - Add interfaces to handle transient


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-119
changelog:
  - Add cron unconfined role support for uncofined SELinux user
  - Call corenet_udp_bind_all_ports() in milter.te
  - Allow fence_virtd to connect to zented port
  - Fix header for mirrormanager_admin()
  - Allow dkim-milter to bind udp ports
  - Allow milter domains to send signull itself
  - Allow block_suspend for yum running as mock_t
  - Allow beam.smp to manage couchdb files
  - Add couchdb_manage_files()
  - Add labeling for /var/log/php_errors.log
  - Allow bumblebee to stream connect to xserver
  - Allow bumblebee to send a signal to xserver
  - gnome-thumbnail to stream connect to bumblebee
  - Allow xkbcomp running as bumblebee_t to execute  bin_t
  - Allow logrotate to read squid.conf
  - Additional rules to get docker and lxc to play well with SELinux
  - Allow bumbleed to connect to xserver port
  - Allow pegasus_openlmi_storage_t to read hwdata


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-118
changelog:
  - Allow init_t to work on transitient and snapshot unit files
  - Add logging_manage_syslog_config()
  - Update sysnet_dns_name_resolve() to allow connect to dnssec por
  - Allow pegasus_openlmi_storage_t to read hwdata
  Resolves:#1031721
  - Fix rhcs_rw_cluster_tmpfs()
  - Allow fenced_t to bind on zented udp port
  - Added policy for vmtools
  - Fix mirrormanager_read_lib_files()
  - Allow mirromanager scripts running as httpd_t to manage mirrormanager pid files
  - Allow ctdb to create sock files in /var/run/ctdb
  - Add sblim_filetrans_named_content() interface
  - Allow rpm scritplets to create /run/gather with correct labeling
  - Allow gnome keyring domains to create gnome config dirs
  - Dontaudit read/write to init stream socket for lsmd_plugin_t
  - Allow automount to read nfs link files
  - Allow lsm plugins to read/write lsmd stream socket
  - Allow certmonger to connect ldap port to make IPA CA certificate renewal working.
  - Add also labeling for /var/run/ctdb
  - Add missing labeling for /var/lib/ctdb
  - ALlow tuned to manage syslog.conf. Should be fixed in tuned. #1030446
  - Dontaudit hypervkvp to search homedirs
  - Dontaudit hypervkvp to search admin homedirs
  - Allow hypervkvp to execute bin_t and ifconfig in the caller domain
  - Dontaudit xguest_t to read ABRT conf files
  - Add abrt_dontaudit_read_config()
  - Allow namespace-init to getattr on fs
  - Add thumb_role() also for xguest
  - Add filename transitions to create .spamassassin with correct labeling
  - Allow apache domain to read mirrormanager pid files
  - Allow domains to read/write shm and sem owned by mozilla_plugin_t
  - Allow alsactl to send a generic signal to kernel_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-116
changelog:
  - Add missing files_create_var_lib_dirs()
  - Fix typo in ipsec.te
  - Allow passwd to create directory in /var/lib
  - Add filename trans also for event21
  - Allow iptables command to read /dev/rand
  - Add sigkill capabilityfor ipsec_t
  - Add filename transitions for bcache devices
  - Add additional rules to create /var/log/cron by syslogd_t with correct labeling
  - Add give everyone full access to all key rings
  - Add default lvm_var_run_t label for /var/run/multipathd
  - Fix log labeling to have correct default label for them after logrotate
  - Labeled ~/.nv/GLCache as being gstreamer output
  - Allow nagios_system_plugin to read mrtg lib files
  - Add mrtg_read_lib_files()
  - Call rhcs_rw_cluster_tmpfs for dlm_controld
  - Make authconfing as named_filetrans domain
  - Allow virsh to connect to user process using stream socket
  - Allow rtas_errd to read rand/urand devices and add chown capability
  - Fix labeling from /var/run/net-snmpd to correct /var/run/net-snmp
  Resolves:#1051497
  - Add also chown cap for abrt_upload_watch_t. It already has dac_override
  - Allow sosreport to manage rhsmcertd pid files
  - Add rhsmcertd_manage_pid_files()
  - Allow also setgid cap for rpc.gssd
  - Dontaudit access check for abrt on cert_t
  - Allow pegasus_openlmi_system providers to dbus chat with systemd-logind


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-114
changelog:
  - Add default lvm_var_run_t label for /var/run/multipathd
  Resolves:#1051430
  - Fix log labeling to have correct default label for them after logrotate
  - Add files_write_root_dirs
  - Add new openflow port label for 6653/tcp and 6633/tcp
  - Add xserver_manage_xkb_libs()
  - Label tcp/8891 as milter por
  - Allow gnome_manage_generic_cache_files also create cache_home_t files
  - Fix aide.log labeling
  - Fix log labeling to have correct default label for them after logrotate
  - Allow mysqld-safe write access on /root to make mysqld working
  - Allow sosreport domtrans to prelikn
  - Allow OpenvSwitch to connec to openflow ports
  - Allow NM send dgram to lldpad
  - Allow hyperv domains to execute shell
  - Allow lsmd plugins stream connect to lsmd/init
  - Allow sblim domains to create /run/gather with correct labeling
  - Allow httpd to read ldap certs
  - Allow cupsd to send dbus msgs to process with different MLS level
  - Allow bumblebee to stream connect to apmd
  - Allow bumblebee to run xkbcomp
  - Additional allow rules to get libvirt-lxc containers working with docker
  - Additional allow rules to get libvirt-lxc containers working with docker
  - Allow docker to getattr on itself
  - Additional rules needed for sandbox apps
  - Allow mozilla_plugin to set attributes on usb device if use_spice boolean enabled
  - httpd should be able to send signal/signull to httpd_suexec_t
  - Add more fixes for neturon. Domtrans to dnsmasq, iptables. Make neutron as filenamtrans domain.


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-112
changelog:
  - Allow sshd to write to all process levels in order to change passwd when running at a level
  - Allow updpwd_t to downgrade /etc/passwd file to s0, if it is not running with this range
  - Allow apcuspd_t to status and start the power unit file
  - Allow udev to manage kdump unit file
  - Added new interface modutils_dontaudit_exec_insmod
  - Allow cobbler to search dhcp_etc_t directory
  - systemd_systemctl needs sys_admin capability
  - Allow sytemd_tmpfiles_t to delete all directories
  - passwd to create gnome-keyring passwd socket
  - Add missing zabbix_var_lib_t type
  - Fix filename trans for zabbixsrv in zabbix.te
  - Allow fprintd_t to send syslog messages
  - Add  zabbix_var_lib_t for /var/lib/zabbixsrv, also allow zabix to connect to smtp port
  - Allow mozilla plugin to chat with policykit, needed for spice
  - Allow gssprozy to change user and gid, as well as read user keyrings
  - Label upgrades directory under /var/www as httpd_sys_rw_content_t, add other filetrans rules to label content correctly
  - Allow polipo to connect to http_cache_ports
  - Allow cron jobs to manage apache var lib content
  - Allow yppassword to manage the passwd_file_t
  - Allow showall_t to send itself signals
  - Allow cobbler to restart dhcpc, dnsmasq and bind services
  - Allow certmonger to manage home cert files
  - Add userdom filename trans for user mail domains
  - Allow apcuspd_t to status and start the power unit file
  - Allow cgroupdrulesengd to create content in cgoups directories
  - Allow smbd_t to signull cluster
  - Allow gluster daemon to create fifo files in glusterd_brick_t and sock_file in glusterd_var_lib_t
  - Add label for /var/spool/cron.aquota.user
  - Allow sandbox_x domains to use work with the mozilla plugin semaphore
  - Added new policy for speech-dispatcher
  - Added dontaudit rule for insmod_exec_t  in rasdaemon policy
  - Updated rasdaemon policy
  - Allow system_mail_t to transition to postfix_postdrop_t
  - Clean up mirrormanager policy
  - Allow virt_domains to read cert files, needs backport to RHEL7
  - Allow sssd to read systemd_login_var_run_t
  - Allow irc_t to execute shell and bin-t files:
  - Add new access for mythtv
  - Allow rsync_t to manage all non auth files
  - allow modemmanger to read /dev/urand
  - Allow sandbox apps to attempt to set and get capabilties


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-111
changelog:
  - Add labeling for /var/lib/servicelog/servicelog.db-journal
  - Add support for freeipmi port
  - Add sysadm_u_default_contexts
  - Make new type to texlive files in homedir
  - Allow subscription-manager running as sosreport_t to manage rhsmcertd
  - Additional fixes for docker.te
  - Remove ability to do mount/sys_admin by default in virt_sandbox domains
  - New rules required to run docker images within libivrt
  - Add label for ~/.cvsignore
  - Change mirrormanager to be run by cron
  - Add mirrormanager policy
  - Fixed bumblebee_admin() and mip6d_admin()
  - Add log support for sensord
  - Fix typo in docker.te
  - Allow amanda to do backups over UDP
  - Allow bumblebee to read /etc/group and clean up bumblebee.te
  - type transitions with a filename not allowed inside conditionals
  - Don't allow virt-sandbox tools to use netlink out of the box, needs back port to RHEL7
  - Make new type to texlive files in homedir


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-110
changelog:
  - Allow freeipmi_ipmidetectd_t to use freeipmi port
  - Update freeipmi_domain_template()
  - Allow journalctl running as ABRT to read /run/log/journal
  - Allow NM to read dispatcher.d directory
  - Update freeipmi policy
  - Type transitions with a filename not allowed inside conditionals
  - Allow tor to bind to hplip port
  - Make new type to texlive files in homedir
  - Allow zabbix_agent to transition to dmidecode
  - Add rules for docker
  - Allow sosreport to send signull to unconfined_t
  - Add virt_noatsecure and virt_rlimitinh interfaces
  - Fix labeling in thumb.fc to add support for /usr/lib64/tumbler-1/tumblerddd support for freeipmi port
  - Add sysadm_u_default_contexts
  - Add logging_read_syslog_pid()
  - Fix userdom_manage_home_texlive() interface
  - Make new type to texlive files in homedir
  - Add filename transitions for /run and /lock links
  - Allow virtd to inherit rlimit information
  Resolves:#975358


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-109
changelog:
  - Change labeling for /usr/libexec/nm-dispatcher.action to NetworkManager_exec_t
  Resolves:#1039879
  - Add labeling for /usr/lib/systemd/system/mariadb.service
  - Allow hyperv_domain to read sysfs
  - Fix ldap_read_certs() interface to allow acess also link files
  - Add support for /usr/libexec/pegasus/cmpiLMI_Journald-cimprovagt
  - Allow tuned to run modprobe
  - Allow portreserve to search /var/lib/sss dir
  - Add SELinux support for the teamd package contains team network device control daemon.
  - Dontaudit access check on /proc for bumblebee
  - Bumblebee wants to load nvidia modules
  - Fix rpm_named_filetrans_log_files and wine.te
  - Add conman policy for rawhide
  - DRM master and input event devices are used by  the TakeDevice API
  - Clean up bumblebee policy
  - Update pegasus_openlmi_storage_t policy
  - Add freeipmi_stream_connect() interface
  - Allow logwatch read madm.conf to support RAID setup
  - Add raid_read_conf_files() interface
  - Allow up2date running as rpm_t create up2date log file with rpm_log_t labeling
  - add rpm_named_filetrans_log_files() interface
  - Allow dkim-milter to create files/dirs in /tmp
  - update freeipmi policy
  - Add policy for freeipmi services
  - Added rdisc_admin and rdisc_systemctl interfaces
  - opensm policy clean up
  - openwsman policy clean up
  - ninfod policy clean up
  - Added new policy for ninfod
  - Added new policy for openwsman
  - Added rdisc_admin and rdisc_systemctl interfaces
  - Fix kernel_dontaudit_access_check_proc()
  - Add support for /dev/uhid
  - Allow sulogin to get the attributes of initctl and sys_admin cap
  - Add kernel_dontaudit_access_check_proc()
  - Fix dev_rw_ipmi_dev()
  - Fix new interface in devices.if
  - DRM master and input event devices are used by  the TakeDevice API
  - add dev_rw_inherited_dri() and dev_rw_inherited_input_dev()
  - Added support for default conman port
  - Add interfaces for ipmi devices


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-108
changelog:
  - Allow sosreport to send a signal to ABRT
  - Add proper aliases for pegasus_openlmi_service_exec_t and pegasus_openlmi_service_t
  - Label /usr/sbin/htcacheclean as httpd_exec_t
  Resolves:#1037529
  - Added support for rdisc unit file
  - Add antivirus_db_t labeling for /var/lib/clamav-unofficial-sigs
  - Allow runuser running as logrotate connections to system DBUS
  - Label bcache devices as fixed_disk_device_t
  - Allow systemctl running in ipsec_mgmt_t to access /usr/lib/systemd/system/ipsec.service
  - Label /usr/lib/systemd/system/ipsec.service as ipsec_mgmt_unit_file_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-105
changelog:
  - Dontaudit openshift domains trying to use rawip_sockets, this is caused by a bad check in the kernel.
  - Allow git_system_t to read git_user_content if the git_system_enable_homedirs boolean is turned on
  - Add lsmd_plugin_t for lsm plugins
  - Allow dovecot-deliver to search mountpoints
  - Add labeling for /etc/mdadm.conf
  - Allow opelmi admin providers to dbus chat with init_t
  - Allow sblim domain to read /dev/urandom and /dev/random
  - Allow apmd to request the kernel load modules
  - Add glusterd_brick_t type
  - label mate-keyring-daemon with gkeyringd_exec_t
  - Add plymouthd_create_log()
  - Dontaudit leaks from openshift domains into mail domains, needs back port to RHEL6
  - Allow sssd to request the kernel loads modules
  - Allow gpg_agent to use ssh-add
  - Allow gpg_agent to use ssh-add
  - Dontaudit access check on /root for myslqd_safe_t
  - Allow ctdb to getattr on al filesystems
  - Allow abrt to stream connect to syslog
  - Allow dnsmasq to list dnsmasq.d directory
  - Watchdog opens the raw socket
  - Allow watchdog to read network state info
  - Dontaudit access check on lvm lock dir
  - Allow sosreport to send signull to setroubleshootd
  - Add setroubleshoot_signull() interface
  - Fix ldap_read_certs() interface
  - Allow sosreport all signal perms
  - Allow sosreport to run systemctl
  - Allow sosreport to dbus chat with rpm
  - Add glusterd_brick_t files type
  - Allow zabbix_agentd to read all domain state
  - Clean up rtas.if
  - Allow smoltclient to execute ldconfig
  - Allow sosreport to request the kernel to load a module
  - Fix userdom_confined_admin_template()
  - Add back exec_content boolean for secadm, logadm, auditadm
  - Fix files_filetrans_system_db_named_files() interface
  - Allow sulogin to getattr on /proc/kcore
  - Add filename transition also for servicelog.db-journal
  - Add files_dontaudit_access_check_root()
  - Add lvm_dontaudit_access_check_lock() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-104
changelog:
  - Allow watchdog to read /etc/passwd
  - Allow browser plugins to connect to bumblebee
  - New policy for bumblebee and freqset
  - Add new policy for mip6d daemon
  - Add new policy for opensm daemon
  - Allow condor domains to read/write condor_master udp_socket
  - Allow openshift_cron_t to append to openshift log files, label /var/log/openshift
  - Add back file_pid_filetrans for /var/run/dlm_controld
  - Allow smbd_t to use inherited tmpfs content
  - Allow mcelog to use the /dev/cpu device
  - sosreport runs rpcinfo
  - sosreport runs subscription-manager
  - Allow staff_t to run frequency command
  - Allow systemd_tmpfiles to relabel log directories
  - Allow staff_t to read xserver_log file
  - Label hsperfdata_root as tmp_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-102
changelog:
  - Fix files_dontaudit_unmount_all_mountpoints()
  - Add support for 2608-2609 tcp/udp ports
  - Should allow domains to lock the terminal device
  - More fixes for user config files to make crond_t running in userdomain
  - Add back disable/reload/enable permissions for system class
  - Fix manage_service_perms macro
  - We need to require passwd rootok
  - Fix zebra.fc
  - Fix dnsmasq_filetrans_named_content() interface
  - Allow all sandbox domains create content in svirt_home_t
  - Allow zebra domains also create zebra_tmp_t files in /tmp
  - Add support for new zebra services:isisd,babeld. Add systemd support for zebra services.
  - Fix labeling on neutron and remove transition to iconfig_t
  - abrt needs to read mcelog log file
  - Fix labeling on dnsmasq content
  - Fix labeling on /etc/dnsmasq.d
  - Allow glusterd to relabel own lib files
  - Allow sandbox domains to use pam_rootok, and dontaudit attempts to unmount file systems, this is caused by a bug in systemd
  - Allow ipc_lock for abrt to run journalctl


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-100
changelog:
  - Fix passenger_stream_connect interface
  - setroubleshoot_fixit wants to read network state
  - Allow procmail_t to connect to dovecot stream sockets
  - Allow cimprovagt service providers to read network states
  - Add labeling for /var/run/mariadb
  - pwauth uses lastlog() to update system's lastlog
  - Allow account provider to read login records
  - Add support for texlive2013
  - More fixes for user config files to make crond_t running in userdomain
  - Add back disable/reload/enable permissions for system class
  - Fix manage_service_perms macro
  - Allow passwd_t to connect to gnome keyring to change password
  - Update mls config files to have cronjobs in the user domains
  - Remove access checks that systemd does not actually do


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-99
changelog:
  - Add support for yubikey in homedir
  - Add support for upd/3052 port
  - Allow apcupsd to use PowerChute Network Shutdown
  - Allow lsmd to execute various lsmplugins
  - Add labeling also for /etc/watchdog\.d where are watchdog scripts located too
  - Update gluster_export_all_rw boolean to allow relabel all base file types
  - Allow x86_energy_perf  tool to modify the MSR
  - Fix /var/lib/dspam/data labeling


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-98
changelog:
  - Add files_relabel_base_file_types() interface
  - Allow netlabel-config to read passwd
  - update gluster_export_all_rw boolean to allow relabel all base file types caused by lsetxattr()
  - Allow x86_energy_perf  tool to modify the MSR
  - Fix /var/lib/dspam/data labeling
  - Allow pegasus to domtrans to mount_t
  - Add labeling for unconfined scripts in /usr/libexec/watchdog/scripts
  - Add support for unconfined watchdog scripts
  - Allow watchdog to manage own log files


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-97
changelog:
  - Add label only for redhat.repo instead of /etc/yum.repos.d. But probably we will need to switch for the directory.
  - Label /etc/yum.repos.d as system_conf_t
  - Use sysnet_filetrans_named_content in udev.te instead of generic transition for net_conf_t
  - Allow dac_override for sysadm_screen_t
  - Allow init_t to read ipsec_conf_t as we had it for initrc_t. Needed by ipsec unit file.
  - Allow netlabel-config to read meminfo
  - Add interface to allow docker to mounton file_t
  - Add new interface to exec unlabeled files
  - Allow lvm to use docker semaphores
  - Setup transitons for .xsessions-errors.old
  - Change labels of files in /var/lib/*/.ssh to transition properly
  - Allow staff_t and user_t to look at logs using journalctl
  - pluto wants to manage own log file
  - Allow pluto running as ipsec_t to create pluto.log
  - Fix alias decl in corenetwork.te.in
  - Add support for fuse.glusterfs
  - Allow dmidecode to read/write /run/lock/subsys/rhsmcertd
  - Allow rhsmcertd to manage redhat.repo which is now labeled as system.conf. Allow rhsmcertd to manage all log files.
  - Additional access for docker
  - Added more rules to sblim policy
  - Fix kdumpgui_run_bootloader boolean
  - Allow dspam to connect to lmtp port
  - Included sfcbd service into sblim policy
  - rhsmcertd wants to manaage /etc/pki/consumer dir
  - Add kdumpgui_run_bootloader boolean
  - Add support for /var/cache/watchdog
  - Remove virt_domain attribute for virt_qemu_ga_unconfined_t
  - Fixes for handling libvirt containes
  - Dontaudit attempts by mysql_safe to write content into /
  - Dontaudit attempts by system_mail to modify network config
  - Allow dspam to bind to lmtp ports
  - Add new policy to allow staff_t and user_t to look at logs using journalctl
  - Allow apache cgi scripts to list sysfs
  - Dontaudit attempts to write/delete user_tmp_t files
  - Allow all antivirus domains to manage also own log dirs
  - Allow pegasus_openlmi_services_t to stream connect to sssd_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-95
changelog:
  - Fix alias decl in corenetwork.te.in
  - Add support for fuse.glusterfs
  - Add file transition rules for content created by f5link
  - Rename quantum_port information to neutron
  - Allow all antivirus domains to manage also own log dirs
  - Rename quantum_port information to neutron
  - Allow pegasus_openlmi_services_t to stream connect to sssd_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-94
changelog:
  - Allow sysadm_t to read login information
  - Allow systemd_tmpfiles to setattr on var_log_t directories
  - Udpdate Makefile to include systemd_contexts
  - Add systemd_contexts
  - Add fs_exec_hugetlbfs_files() interface
  - Add daemons_enable_cluster_mode boolean
  - Fix rsync_filetrans_named_content()
  - Add rhcs_read_cluster_pid_files() interface
  - Update rhcs.if with additional interfaces from RHEL6
  - Fix rhcs_domain_template() to not create run dirs with cluster_var_run_t
  - Allow glusterd_t to mounton glusterd_tmp_t
  - Allow glusterd to unmout al filesystems
  - Allow xenstored to read virt config
  - Add label for swift_server.lock and make add filetrans_named_content to make sure content gets created with the correct label
  - Allow mozilla_plugin_t to mmap hugepages as an executable


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-93
changelog:
  - Allow sshd_t to read openshift content, needs backport to RHEL6.5
  - Label /usr/lib64/sasl2/libsasldb.so.3.0.0 as textrel_shlib_t
  - Make sur kdump lock is created with correct label if kdumpctl is executed
  - gnome interface calls should always be made within an optional_block
  - Allow syslogd_t to connect to the syslog_tls port
  - Add labeling for /var/run/charon.ctl socket
  - Add kdump_filetrans_named_content()
  - Allo setpgid for fenced_t
  - Allow setpgid and r/w cluster tmpfs for fenced_t
  - gnome calls should always be within optional blocks
  - wicd.pid should be labeled as networkmanager_var_run_t
  - Allow sys_resource for lldpad


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-91
changelog:
  - Allow mailserver_domains to manage and transition to mailman data
  - Dontaudit attempts by mozilla plugin to relabel content, caused by using mv and cp commands
  - Allow mailserver_domains to manage and transition to mailman data
  - Allow svirt_domains to read sysctl_net_t
  - Allow thumb_t to use tmpfs inherited from the user
  - Allow mozilla_plugin to bind to the vnc port if running with spice
  - Add new attribute to discover confined_admins and assign confined admin to it
  - Fix zabbix to handle attributes in interfaces
  - Fix zabbix to read system states for all zabbix domains
  - Fix piranha_domain_template()
  - Allow ctdbd to create udp_socket. Allow ndmbd to access ctdbd var files.
  - Allow lldpad sys_rouserce cap due to #986870
  - Allow dovecot-auth to read nologin
  - Allow openlmi-networking to read /proc/net/dev
  - Allow smsd_t to execute scripts created on the fly labeled as smsd_spool_t
  - Add zabbix_domain attribute for zabbix domains to treat them together
  - Add labels for zabbix-poxy-* (#1018221)
  - Update openlmi-storage policy to reflect #1015067
  - Back port piranha tmpfs fixes from RHEL6
  - Update httpd_can_sendmail boolean to allow read/write postfix spool maildrop
  - Add postfix_rw_spool_maildrop_files interface
  - Call new userdom_admin_user_templat() also for sysadm_secadm.pp
  - Fix typo in userdom_admin_user_template()
  - Allow SELinux users to create coolkeypk11sE-Gate in /var/cache/coolkey
  - Add new attribute to discover confined_admins
  - Fix labeling for /etc/strongswan/ipsec.d
  - systemd_logind seems to pass fd to anyone who dbus communicates with it
  - Dontaudit leaked write descriptor to dmesg


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-89
changelog:
  - Fix gnome_read_generic_data_home_files()
  - allow openshift_cgroup_t to read/write inherited openshift file types
  - Remove httpd_cobbler_content * from cobbler_admin interface
  - Allow svirt sandbox domains to setattr on chr_file and blk_file svirt_sandbox_file_t, so sshd will work within a container
  - Allow httpd_t to read also git sys content symlinks
  - Allow init_t to read gnome home data
  - Dontaudit setroubleshoot_fixit_t execmem, since it does not seem to really need it.
  - Allow virsh to execute systemctl
  - Fix for nagios_services plugins
  - add type defintion for ctdbd_var_t
  - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file
  - Allow net_admin/netlink_socket all hyperv_domain domains
  - Add labeling for zarafa-search.log and zarafa-search.pid
  - Fix hypervkvp.te
  - Fix nscd_shm_use()
  - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services.
  - Add hypervkvp_unit_file_t type
  - Fix logging policy
  - Allow syslog to bind to tls ports
  - Update labeling for /dev/cdc-wdm
  - Allow to su_domain to read init states
  - Allow init_t to read gnome home data
  - Make sure if systemd_logind creates nologin file with the correct label
  - Clean up ipsec.te


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-88
changelog:
  - Add auth_exec_chkpwd interface
  - Fix port definition for ctdb ports
  - Allow systemd domains to read /dev/urand
  - Dontaudit attempts for mozilla_plugin to append to /dev/random
  - Add label for /var/run/charon.*
  - Add labeling for /usr/lib/systemd/system/lvm2.*dd policy for motion service
  - Fix for nagios_services plugins
  - Fix some bugs in zoneminder policy
  - add type defintion for ctdbd_var_t
  - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file
  - Allow net_admin/netlink_socket all hyperv_domain domains
  - Add labeling for zarafa-search.log and zarafa-search.pid
  - glusterd binds to random unreserved ports
  - Additional allow rules found by testing glusterfs
  - apcupsd needs to send a message to all users on the system so needs to look them up
  - Fix the label on ~/.juniper_networks
  - Dontaudit attempts for mozilla_plugin to append to /dev/random
  - Allow polipo_daemon to connect to flash ports
  - Allow gssproxy_t to create replay caches
  - Fix nscd_shm_use()
  - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services.
  - Add hypervkvp_unit_file_t type


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-87
changelog:
  - init reload  from systemd_localed_t
  - Allow domains that communicate with systemd_logind_sessions to use systemd_logind_t fd
  - Allow systemd_localed_t to ask systemd to reload the locale.
  - Add systemd_runtime_unit_file_t type for unit files that systemd creates in memory
  - Allow readahead to read /dev/urand
  - Fix lots of avcs about tuned
  - Any file names xenstored in /var/log should be treated as xenstored_var_log_t
  - Allow tuned to inderact with hugepages
  - Allow condor domains to list etc rw dirs


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-86
changelog:
  - Fix nscd_shm_use()
  - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services.
  - Add hypervkvp_unit_file_t type
  - Add additional fixes forpegasus_openlmi_account_t
  - Allow mdadm to read /dev/urand
  - Allow pegasus_openlmi_storage_t to create mdadm.conf and write it
  - Add label/rules for /etc/mdadm.conf
  - Allow pegasus_openlmi_storage_t to transition to fsadm_t
  - Fixes for interface definition problems
  - Dontaudit dovecot-deliver to gettatr on all fs dirs
  - Allow domains to search data_home_t directories
  - Allow cobblerd to connect to mysql
  - Allow mdadm to r/w kdump lock files
  - Add support for kdump lock files
  - Label zarafa-search as zarafa-indexer
  - Openshift cgroup wants to read /etc/passwd
  - Add new sandbox domains for kvm
  - Allow mpd to interact with pulseaudio if mpd_enable_homedirs is turned on
  - Fix labeling for /usr/lib/systemd/system/lvm2.*
  - Add labeling for /usr/lib/systemd/system/lvm2.*
  - Fix typos to get a new build. We should not cover filename trans rules to prevent duplicate rules
  - Add sshd_keygen_t policy for sshd-keygen
  - Fix alsa_home_filetrans interface name and definition
  - Allow chown for ssh_keygen_t
  - Add fs_dontaudit_getattr_all_dirs()
  - Allow init_t to manage etc_aliases_t and read xserver_var_lib_t and chrony keys
  - Fix up patch to allow systemd to manage home content
  - Allow domains to send/recv unlabeled traffic if unlabelednet.pp is enabled
  - Allow getty to exec hostname to get info
  - Add systemd_home_t for ~/.local/share/systemd directory


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-84
changelog:
  - Fix labeling for /usr/libexec/kde4/kcmdatetimehelper
  - Allow tuned to search all file system directories
  - Allow alsa_t to sys_nice, to get top performance for sound management
  - Add support for MySQL/PostgreSQL for amavis
  - Allow openvpn_t to manage openvpn_var_log_t files.
  - Allow dirsrv_t to create tmpfs_t directories
  - Allow dirsrv to create dirs in /dev/shm with dirsrv_tmpfs label
  - Dontaudit leaked unix_stream_sockets into gnome keyring
  - Allow telepathy domains to inhibit pipes on telepathy domains
  - Allow cloud-init to domtrans to rpm
  - Allow abrt daemon to manage abrt-watch tmp files
  - Allow abrt-upload-watcher to search /var/spool directory
  - Allow nsswitch domains to manage own process key
  - Fix labeling for mgetty.* logs
  - Allow systemd to dbus chat with upower
  - Allow ipsec to send signull to itself
  - Allow setgid cap for ipsec_t
  - Match upstream labeling


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-82
changelog:
  - wine_tmp is no longer needed
  - Allow setroubleshoot to look at /proc
  - Allow telepathy domains to dbus with systemd logind
  - Fix handling of fifo files of rpm
  - Allow mozilla_plugin to transition to itself
  - Allow certwatch to write to cert_t directories
  - New abrt application
  - Allow NetworkManager to set the kernel scheduler
  - Make wine_domain shared by all wine domains
  - Allow mdadm_t to read images labeled svirt_image_t
  - Allow amanda to read /dev/urand
  - ALlow my_print_default to read /dev/urand
  - Allow mdadm to write to kdumpctl fifo files
  - Allow nslcd to send signull to itself
  - Allow yppasswd to read /dev/urandom
  - Fix zarafa_setrlimit
  - Add support for /var/lib/php/wsdlcache
  - Add zarafa_setrlimit boolean
  - Allow fetchmail to send mails
  - Add additional alias for user_tmp_t because wine_tmp_t is no longer used
  - More handling of ther kernel keyring required by kerberos
  - New privs needed for init_t when running without transition to initrc_t over bin_t, and without unconfined domain installed


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-81
changelog:
  - Dontaudit attempts by sosreport to read shadow_t
  - Allow browser sandbox plugins to connect to cups to print
  - Add new label mpd_home_t
  - Label /srv/www/logs as httpd_log_t
  - Add support for /var/lib/php/wsdlcache
  - Add zarafa_setrlimit boolean
  - Allow fetchmail to send mails
  - Add labels for apache logs under miq package
  - Allow irc_t to use tcp sockets
  - fix labels in puppet.if
  - Allow tcsd to read utmp file
  - Allow openshift_cron_t to run ssh-keygen in ssh_keygen_t to access host keys
  - Define svirt_socket_t as a domain_type
  - Take away transition from init_t to initrc_t when executing bin_t, allow init_t to run chk_passwd_t
  - Fix label on pam_krb5 helper apps


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-80
changelog:
  - Allow ldconfig to write to kdumpctl fifo files
  - allow neutron to connect to amqp ports
  - Allow kdump_manage_crash to list the kdump_crash_t directory
  - Allow glance-api to connect to amqp port
  - Allow virt_qemu_ga_t to read meminfo
  - Add antivirus_home_t type for antivirus date in HOMEDIRS
  - Allow mpd setcap which is needed by pulseaudio
  - Allow smbcontrol to create content in /var/lib/samba
  - Allow mozilla_exec_t to be used as a entrypoint to mozilla_domtrans_spec
  - Add additional labeling for qemu-ga/fsfreeze-hook.d scripts
  - amanda_exec_t needs to be executable file
  - Allow block_suspend cap for samba-net
  - Allow apps that read ipsec_mgmt_var_run_t to search ipsec_var_run_t
  - Allow init_t to run crash utility
  - Treat usr_t just like bin_t for transitions and executions
  - Add port definition of pka_ca to port 829 for openshift
  - Allow selinux_store to use symlinks


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-79
changelog:
  - Allow block_suspend cap for samba-net
  - Allow t-mission-control to manage gabble cache files
  - Allow nslcd to read /sys/devices/system/cpu
  - Allow selinux_store to use symlinks


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-78
changelog:
  - Allow xdm_t to transition to itself
  - Call neutron interfaces instead of quantum
  - Allow init to change targed role to make uncofined services (xrdp which now has own systemd unit file) working. We want them to have in unconfined_t
  - Make sure directories in /run get created with the correct label
  - Make sure /root/.pki gets created with the right label
  - try to remove labeling for motion from zoneminder_exec_t to bin_t
  - Allow inetd_t to execute shell scripts
  - Allow cloud-init to read all domainstate
  - Fix to use quantum port
  - Add interface netowrkmanager_initrc_domtrans
  - Fix boinc_execmem
  - Allow t-mission-control to read gabble cache home
  - Add labeling for ~/.cache/telepathy/avatars/gabble
  - Allow memcache to read sysfs data
  - Cleanup antivirus policy and add additional fixes
  - Add boolean boinc_enable_execstack
  - Add support for couchdb in rabbitmq policy
  - Add interface couchdb_search_pid_dirs
  - Allow firewalld to read NM state
  - Allow systemd running as git_systemd to bind git port
  - Fix mozilla_plugin_rw_tmpfs_files()


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-77
changelog:
  - Split out rlogin ports from inetd
  - Treat files labeld as usr_t like bin_t when it comes to transitions
  - Allow staff_t to read login config
  - Allow ipsec_t to read .google authenticator data
  - Allow systemd running as git_systemd to bind git port
  - Fix mozilla_plugin_rw_tmpfs_files()
  - Call the correct interface - corenet_udp_bind_ktalkd_port()
  - Allow all domains that can read gnome_config to read kde config
  - Allow sandbox domain to read/write mozilla_plugin_tmpfs_t so pulseaudio will work
  - Allow mdadm to getattr any file system
  - Allow a confined domain to executes mozilla_exec_t via dbus
  - Allow cupsd_lpd_t to bind to the printer port
  - Dontaudit attempts to bind to ports < 1024 when nis is turned on
  - Allow apache domain to connect to gssproxy socket
  - Allow rlogind to bind to the rlogin_port
  - Allow telnetd to bind to the telnetd_port
  - Allow ktalkd to bind to the ktalkd_port
  - Allow cvs to bind to the cvs_port


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-76
changelog:
  - Cleanup related to init_domain()+inetd_domain fixes
  - Use just init_domain instead of init_daemon_domain in inetd_core_service_domain
  - svirt domains neeed to create kobject_uevint_sockets
  - Lots of new access required for sosreport
  - Allow tgtd_t to connect to isns ports
  - Allow init_t to transition to all inetd domains:
  - openct needs to be able to create netlink_object_uevent_sockets
  - Dontaudit leaks into ldconfig_t
  - Dontaudit su domains getattr on /dev devices, move su domains to attribute based calls
  - Move kernel_stream_connect into all Xwindow using users
  - Dontaudit inherited lock files in ifconfig o dhcpc_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-75
changelog:
  - Also sock_file trans rule is needed in lsm
  - Fix labeling for fetchmail pid files/dirs
  - Add additional fixes for abrt-upload-watch
  - Fix polipo.te
  - Fix transition rules in asterisk policy
  - Add fowner capability to networkmanager policy
  - Allow polipo to connect to tor ports
  - Cleanup lsmd.if
  - Cleanup openhpid policy
  - Fix kdump_read_crash() interface
  - Make more domains as init domain
  - Fix cupsd.te
  - Fix requires in rpm_rw_script_inherited_pipes
  - Fix interfaces in lsm.if
  - Allow munin service plugins to manage own tmpfs files/dirs
  - Allow virtd_t also relabel unix stream sockets for virt_image_type
  - Make ktalk as init domain
  - Fix to define ktalkd_unit_file_t correctly
  - Fix ktalk.fc
  - Add systemd support for talk-server
  - Allow glusterd to create sock_file in /run
  - Allow xdm_t to delete gkeyringd_tmp_t files on logout
  - Add fixes for hypervkvp policy
  - Add logwatch_can_sendmail boolean
  - Allow mysqld_safe_t to handle also symlinks in /var/log/mariadb
  - Allow xdm_t to delete gkeyringd_tmp_t files on logout


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-73
changelog:
  0 
  - Allow rhsmcertd to read init state
  - Allow fsetid for pkcsslotd
  - Fix labeling for /usr/lib/systemd/system/pkcsslotd.service
  - Allow fetchmail to create own pid with correct labeling
  - Fix rhcs_domain_template()
  - Allow roles which can run mock to read mock lib files to view results
  - Allow rpcbind to use nsswitch
  - Fix lsm.if summary
  - Fix collectd_t can read /etc/passwd file
  - Label systemd unit files under dracut correctly
  - Add support for pam_mount to mount user's encrypted home When a user logs in and logs out using ssh
  - Add support for .Xauthority-n
  - Label umount.crypt as lvm_exec_t
  - Allow syslogd to search psad lib files
  - Allow ssh_t to use /dev/ptmx
  - Make sure /run/pluto dir is created with correct labeling
  - Allow syslog to run shell and bin_t commands
  - Allow ip to relabel tun_sockets
  - Allow mount to create directories in files under /run
  - Allow processes to use inherited fifo files


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-72
changelog:
  - Add policy for lsmd
  - Add support for /var/log/mariadb dir and allow mysqld_safe to list this directory
  - Update condor_master rules to allow read system state info and allow logging
  - Add labeling for /etc/condor and allow condor domain to write it (bug)
  - Allow condor domains to manage own logs
  - Allow glusterd to read domains state
  - Fix initial hypervkvp policy
  - Add policy for hypervkvpd
  - Fix redis.if summary


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-71
changelog:
  - Allow boinc to connect to  @/tmp/.X11-unix/X0
  - Allow beam.smp to connect to tcp/5984
  - Allow named to manage own log files
  - Add label for /usr/libexec/dcc/start-dccifd  and domtrans to dccifd_t
  - Add virt_transition_userdomain boolean decl
  - Allow httpd_t to sendto unix_dgram sockets on its children
  - Allow nova domains to execute ifconfig
  - bluetooth wants to create fifo_files in /tmp
  - exim needs to be able to manage mailman data
  - Allow sysstat to getattr on all file systems
  - Looks like bluetoothd has moved
  - Allow collectd to send ping packets
  - Allow svirt_lxc domains to getpgid
  - Remove virt-sandbox-service labeling as virsh_exec_t, since it no longer does virsh_t stuff
  - Allow frpintd_t to read /dev/urandom
  - Allow asterisk_t to create sock_file in /var/run
  - Allow usbmuxd to use netlink_kobject
  - sosreport needs to getattr on lots of devices, and needs access to netlink_kobject_uevent_socket
  - More cleanup of svirt_lxc policy
  - virtd_lxc_t now talks to dbus
  - Dontaudit leaked ptmx_t
  - Allow processes to use inherited fifo files
  - Allow openvpn_t to connect to squid ports
  - Allow prelink_cron_system_t to ask systemd to reloaddd miscfiles_dontaudit_access_check_cert()
  - Allow ssh_t to use /dev/ptmx
  - Make sure /run/pluto dir is created with correct labeling
  - Allow syslog to run shell and bin_t commands
  - Allow ip to relabel tun_sockets
  - Allow mount to create directories in files under /run
  - Allow processes to use inherited fifo files
  - Allow user roles to connect to the journal socket


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-70
changelog:
  - selinux_set_enforce_mode needs to be used with type
  - Add append to the dontaudit for unix_stream_socket of xdm_t leak
  - Allow xdm_t to create symlinks in log direcotries
  - Allow login programs to read afs config
  - Label 10933 as a pop port, for dovecot
  - New policy to allow selinux_server.py to run as semanage_t as a dbus service
  - Add fixes to make netlabelctl working on MLS
  - AVCs required for running sepolicy gui as staff_t
  - Dontaudit attempts to read symlinks, sepolicy gui is likely to cause this type of AVC
  - New dbus server to be used with new gui
  - After modifying some files in /etc/mail, I saw this needed on the next boot
  - Loading a vm from /usr/tmp with virt-manager
  - Clean up oracleasm policy for Fedora
  - Add oracleasm policy written by rlopez@redhat.com
  - Make postfix_postdrop_t as mta_agent to allow domtrans to system mail if it is executed by apache
  - Add label for /var/crash
  - Allow fenced to domtrans to sanclok_t
  - Allow nagios to manage nagios spool files
  - Make tfptd as home_manager
  - Allow kdump to read kcore on MLS system
  - Allow mysqld-safe sys_nice/sys_resource caps
  - Allow apache to search automount tmp dirs if http_use_nfs is enabled
  - Allow crond to transition to named_t, for use with unbound
  - Allow crond to look at named_conf_t, for unbound
  - Allow mozilla_plugin_t to transition its home content
  - Allow dovecot_domain to read all system and network state
  - Allow httpd_user_script_t to call getpw
  - Allow semanage to read pid files
  - Dontaudit leaked file descriptors from user domain into thumb
  - Make PAM authentication working if it is enabled in ejabberd
  - Add fixes for rabbit to fix ##992920,#992931
  - Allow glusterd to mount filesystems
  - Loading a vm from /usr/tmp with virt-manager
  - Trying to load a VM I got an AVC from devicekit_disk for loopcontrol device
  - Add fix for pand service
  - shorewall touches own log
  - Allow nrpe to list /var
  - Mozilla_plugin_roles can not be passed into lpd_run_lpr
  - Allow afs domains to read afs_config files
  - Allow login programs to read afs config
  - Allow virt_domain to read virt_var_run_t symlinks
  - Allow smokeping to send its process signals
  - Allow fetchmail to setuid
  - Add kdump_manage_crash() interface
  - Allow abrt domain to write abrt.socket


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-69
changelog:
  - Add more aliases in pegasus.te
  - Add more fixes for *_admin interfaces
  - Add interface fixes
  - Allow nscd to stream connect to nmbd
  - Allow gnupg apps to write to pcscd socket
  - Add more fixes for openlmi provides. Fix naming and support for additionals
  - Allow fetchmail to resolve host names
  - Allow firewalld to interact also with lnk files labeled as firewalld_etc_rw_t
  - Add labeling for cmpiLMI_Fan-cimprovagt
  - Allow net_admin for glusterd
  - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/
  - Add pegasus_openlmi_system_t
  - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te
  - Fix corecmd_exec_chroot()
  - Fix logging_relabel_syslog_pid_socket interface
  - Fix typo in unconfineduser.te
  - Allow system_r to access unconfined_dbusd_t to run hp_chec


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-68
changelog:
  - Allow xdm_t to act as a dbus client to itsel
  - Allow fetchmail to resolve host names
  - Allow gnupg apps to write to pcscd socket
  - Add labeling for cmpiLMI_Fan-cimprovagt
  - Allow net_admin for glusterd
  - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/
  - Add pegasus_openlmi_system_t
  - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te
  -httpd_t does access_check on certs


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-67
changelog:
  - Add support for cmpiLMI_Service-cimprovagt
  - Allow pegasus domtrans to rpm_t to make pycmpiLMI_Software-cimprovagt running as rpm_t
  - Label pycmpiLMI_Software-cimprovagt as rpm_exec_t
  - Add support for pycmpiLMI_Storage-cimprovagt
  - Add support for cmpiLMI_Networking-cimprovagt
  - Allow system_cronjob_t to create user_tmpfs_t to make pulseaudio working
  - Allow virtual machines and containers to run as user doains, needed for virt-sandbox
  - Allow buglist.cgi to read cpu info


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-66
changelog:
  - Allow systemd-tmpfile to handle tmp content in print spool dir
  - Allow systemd-sysctl to send system log messages
  - Add support for RTP media ports and fmpro-internal
  - Make auditd working if audit is configured to perform SINGLE action on disk error
  - Add interfaces to handle systemd units
  - Make systemd-notify working if pcsd is used
  - Add support for netlabel and label /usr/sbin/netlabelctl as iptables_exec_t
  - Instead of having all unconfined domains get all of the named transition rules,
  - Only allow unconfined_t, init_t, initrc_t and rpm_script_t by default.
  - Add definition for the salt ports
  - Allow xdm_t to create link files in xdm_var_run_t
  - Dontaudit reads of blk files or chr files leaked into ldconfig_t
  - Allow sys_chroot for useradd_t
  - Allow net_raw cap for ipsec_t
  - Allow sysadm_t to reload services
  - Add additional fixes to make strongswan working with a simple conf
  - Allow sysadm_t to enable/disable init_t services
  - Add additional glusterd perms
  - Allow apache to read lnk files in the /mnt directory
  - Allow glusterd to ask the kernel to load a module
  - Fix description of ftpd_use_fusefs boolean
  - Allow svirt_lxc_net_t to sys_chroot, modify policy to tighten up svirt_lxc_domain capabilties and process controls, but add them to svirt_lxc_net_t
  - Allow glusterds to request load a kernel module
  - Allow boinc to stream connect to xserver_t
  - Allow sblim domains to read /etc/passwd
  - Allow mdadm to read usb devices
  - Allow collectd to use ping plugin
  - Make foghorn working with SNMP
  - Allow sssd to read ldap certs
  - Allow haproxy to connect to RTP media ports
  - Add additional trans rules for aide_db
  - Add labeling for /usr/lib/pcsd/pcsd
  - Add labeling for /var/log/pcsd
  - Add support for pcs which is a corosync and pacemaker configuration tool


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-65
changelog:
  - Label /var/lib/ipa/pki-ca/publish as pki_tomcat_cert_t
  - Add labeling for /usr/libexec/kde4/polkit-kde-authentication-agent-1
  - Allow all domains that can domtrans to shutdown, to start the power services script to shutdown
  - consolekit needs to be able to shut down system
  - Move around interfaces
  - Remove nfsd_rw_t and nfsd_ro_t, they don't do anything
  - Add additional fixes for rabbitmq_beam to allow getattr on mountpoints
  - Allow gconf-defaults-m to read /etc/passwd
  - Fix pki_rw_tomcat_cert() interface to support lnk_files


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-64
changelog:
  - Add support for gluster ports
  - Make sure that all keys located in /etc/ssh/ are labeled correctly
  - Make sure apcuspd lock files get created with the correct label
  - Use getcap in gluster.te
  - Fix gluster policy
  - add additional fixes to allow beam.smp to interact with couchdb files
  - Additional fix for #974149
  - Allow gluster to user gluster ports
  - Allow glusterd to transition to rpcd_t and add additional fixes for #980683
  - Allow tgtd working when accessing to the passthrough device
  - Fix labeling for mdadm unit files


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-61
changelog:
  - Allow mdamd to execute systemctl
  - Allow mdadm to read /dev/kvm
  - Allow ipsec_mgmt_t to read l2tpd pid content


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-60
changelog:
  - Allow nsd_t to read /dev/urand
  - Allow mdadm_t to read framebuffer
  - Allow rabbitmq_beam_t to read process info on rabbitmq_epmd_t
  - Allow mozilla_plugin_config_t to create tmp files
  - Cleanup openvswitch policy
  - Allow mozilla plugin to getattr on all executables
  - Allow l2tpd_t to create fifo_files in /var/run
  - Allow samba to touch/manage fifo_files or sock_files in a samba_share_t directory
  - Allow mdadm to connecto its own unix_stream_socket
  - FIXME: nagios changed locations to /log/nagios which is wrong. But we need to have this workaround for now.
  - Allow apache to access smokeping pid files
  - Allow rabbitmq_beam_t to getattr on all filesystems
  - Add systemd support for iodined
  - Allow nup_upsdrvctl_t to execute its entrypoint
  - Allow fail2ban_client to write to fail2ban_var_run_t, Also allow it to use nsswitch
  - add labeling for ~/.cache/libvirt-sandbox
  - Add interface to allow domains transitioned to by confined users to send sigchld to screen program
  - Allow sysadm_t to check the system status of files labeled etc_t, /etc/fstab
  - Allow systemd_localed to start /usr/lib/systemd/system/systemd-vconsole-setup.service
  - Allow an domain that has an entrypoint from a type to be allowed to execute the entrypoint without a transition,  I can see no case where this is  a bad thing, and elminiates a whole class of AVCs.
  - Allow staff to getsched all domains, required to run htop
  - Add port definition for redis port
  - fix selinuxuser_use_ssh_chroot boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-59
changelog:
  - Add prosody policy written by Michael Scherer
  - Allow nagios plugins to read /sys info
  - ntpd needs to manage own log files
  - Add support for HOME_DIR/.IBMERS
  - Allow iptables commands to read firewalld config
  - Allow consolekit_t to read utmp
  - Fix filename transitions on .razor directory
  - Add additional fixes to make DSPAM with LDA working
  - Allow snort to read /etc/passwd
  - Allow fail2ban to communicate with firewalld over dbus
  - Dontaudit openshift_cgreoup_file_t read/write leaked dev
  - Allow nfsd to use mountd port
  - Call th proper interface
  - Allow openvswitch to read sys and execute plymouth
  - Allow tmpwatch to read /var/spool/cups/tmp
  - Add support for /usr/libexec/telepathy-rakia
  - Add systemd support for zoneminder
  - Allow mysql to create files/directories under /var/log/mysql
  - Allow zoneminder apache scripts to rw zoneminder tmpfs
  - Allow httpd to manage zoneminder lib files
  - Add zoneminder_run_sudo boolean to allow to start zoneminder
  - Allow zoneminder to send mails
  - gssproxy_t sock_file can be under /var/lib
  - Allow web domains to connect to whois port.
  - Allow sandbox_web_type to connect to the same ports as mozilla_plugin_t.
  - We really need to add an interface to corenet to define what a web_client_domain is and
  - then define chrome_sandbox_t, mozilla_plugin_t and sandbox_web_type to that domain.
  - Add labeling for cmpiLMI_LogicalFile-cimprovagt
  - Also make pegasus_openlmi_logicalfile_t as unconfined to have unconfined_domain attribute for filename trans rules
  - Update policy rules for pegasus_openlmi_logicalfile_t
  - Add initial types for logicalfile/unconfined OpenLMI providers
  - mailmanctl needs to read own log
  - Allow logwatch manage own lock files
  - Allow nrpe to read meminfo
  - Allow httpd to read certs located in pki-ca
  - Add pki_read_tomcat_cert() interface
  - Add support for nagios openshift plugins
  - Add port definition for redis port
  - fix selinuxuser_use_ssh_chroot boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-58
changelog:
  - Shrink the size of policy by moving to attributes, also add dridomain so that mozilla_plugin can follow selinuxuse_dri boolean. 
  - Allow bootloader to manage generic log files 
  - Allow ftp to bind to port 989 
  - Fix label of new gear directory 
  - Add support for new directory /var/lib/openshift/gears/ 
  - Add openshift_manage_lib_dirs() 
  - allow virtd domains to manage setrans_var_run_t 
  - Allow useradd to manage all openshift content 
  - Add support so that mozilla_plugin_t can use dri devices 
  - Allow chronyd to change the scheduler 
  - Allow apmd to shut downthe system 
  - Devicekit_disk_t needs to manage /etc/fstab


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-57
changelog:
  - Make DSPAM to act as a LDA working
  - Allow ntop to create netlink socket
  - Allow policykit to send a signal to policykit-auth
  - Allow stapserver to dbus chat with avahi/systemd-logind
  - Fix labeling on haproxy unit file
  - Clean up haproxy policy
  - A new policy for haproxy and placed it to rhcs.te
  - Add support for ldirectord and treat it with cluster_t
  - Make sure anaconda log dir is created with var_log_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-56
changelog:
  - Allow lvm_t to create default targets for filesystem handling
  - Fix labeling for razor-lightdm binaries
  - Allow insmod_t to read any file labeled var_lib_t
  - Add policy for pesign
  - Activate policy for cmpiLMI_Account-cimprovagt
  - Allow isnsd syscall=listen
  - /usr/libexec/pegasus/cimprovagt needs setsched caused by sched_setscheduler
  - Allow ctdbd to use udp/4379
  - gatherd wants sys_nice and setsched
  - Add support for texlive2012
  - Allow NM to read file_t (usb stick with no labels used to transfer keys for example)
  - Allow cobbler to execute apache with domain transition


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-55
changelog:
  - condor_collector uses tcp/9000
  - Label /usr/sbin/virtlockd as virtd_exec_t for now
  - Allow cobbler to execute ldconfig
  - Allow NM to execute ssh
  - Allow mdadm to read /dev/crash
  - Allow antivirus domains to connect to snmp port
  - Make amavisd-snmp working correctly
  - Allow nfsd_t to mounton nfsd_fs_t
  - Add initial snapper policy
  - We still need to have consolekit policy
  - Dontaudit firefox attempting to connect to the xserver_port_t if run within sandbox_web_t
  - Dontaudit sandbox apps attempting to open user_devpts_t
  - Allow dirsrv to read network state
  - Fix pki_read_tomcat_lib_files
  - Add labeling for /usr/libexec/nm-ssh-service
  - Add label cert_t for /var/lib/ipa/pki-ca/publish
  - Lets label /sys/fs/cgroup as cgroup_t for now, to keep labels consistant
  - Allow nfsd_t to mounton nfsd_fs_t
  - Dontaudit sandbox apps attempting to open user_devpts_t
  - Allow passwd_t to change role to system_r from unconfined_r


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-54
changelog:
  - Don't audit access checks by sandbox xserver on xdb var_lib
  - Allow ntop to read usbmon devices
  - Add labeling for new polcykit authorizor
  - Dontaudit access checks from fail2ban_client
  - Don't audit access checks by sandbox xserver on xdb var_lib
  - Allow apps that connect to xdm stream to conenct to xdm_dbusd_t stream
  - Fix labeling for all /usr/bim/razor-lightdm-* binaries
  - Add filename trans for /dev/md126p1


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-53
changelog:
  - Make vdagent able to request loading kernel module
  - Add support for cloud-init make it as unconfined domain
  - Allow snmpd to run smartctl in fsadm_t domain
  - remove duplicate openshift_search_lib() interface
  - Allow mysqld to search openshift lib files
  - Allow openshift cgroup to interact with passedin file descriptors
  - Allow colord to list directories inthe users homedir
  - aide executes prelink to check files
  - Make sure cupsd_t creates content in /etc/cups with the correct label
  - Lest dontaudit apache read all domains, so passenger will not cause this avc
  - Allow gssd to connect to gssproxy
  - systemd-tmpfiles needs to be able to raise the level to fix labeling on /run/setrans in MLS
  - Allow systemd-tmpfiles to relabel also lock files
  - Allow useradd to add homdir in /var/lib/openshift
  - Allow setfiles and semanage to write output to /run/files


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-52
changelog:
  - Add labeling for /dev/tgt
  - Dontaudit leak fd from firewalld for modprobe
  - Allow runuser running as rpm_script_t to create netlink_audit socket
  - Allow mdadm to read BIOS non-volatile RAM


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-51
changelog:
  - accountservice watches when accounts come and go in wtmp
  - /usr/java/jre1.7.0_21/bin/java needs to create netlink socket
  - Add httpd_use_sasl boolean
  - Allow net_admin for tuned_t
  - iscsid needs sys_module to auto-load kernel modules
  - Allow blueman to read bluetooth conf
  - Add nova_manage_lib_files() interface
  - Fix mplayer_filetrans_home_content()
  - Add mplayer_filetrans_home_content()
  - mozilla_plugin_config_roles need to be able to access mozilla_plugin_config_t
  - Revert "Allow thumb_t to append inherited xdm stream socket"
  - Add iscsi_filetrans_named_content() interface
  - Allow to create .mplayer with the correct labeling for unconfined
  - Allow iscsiadmin to create lock file with the correct labeling


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-50
changelog:
  - Allow wine to manage wine home content
  - Make amanda working with socket actiovation
  - Add labeling for /usr/sbin/iscsiadm
  - Add support for /var/run/gssproxy.sock
  - dnsmasq_t needs to read sysctl_net_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-49
changelog:
  - Fix courier_domain_template() interface
  - Allow blueman to write ip_forward
  - Allow mongodb to connect to mongodb port
  - Allow mongodb to connect to mongodb port
  - Allow java to bind jobss_debug port
  - Fixes for *_admin interfaces
  - Allow iscsid auto-load kernel modules needed for proper iSCSI functionality
  - Need to assign attribute for courier_domain to all courier_domains
  - Fail2ban reads /etc/passwd
  - postfix_virtual will create new files in postfix_spool_t
  - abrt triggers sys_ptrace by running pidof
  - Label ~/abc as mozilla_home_t, since java apps as plugin want to create it
  - Add passenger fixes needed by foreman
  - Remove dup interfaces
  - Add additional interfaces for quantum
  - Add new interfaces for dnsmasq
  - Allow  passenger to read localization and send signull to itself
  - Allow dnsmasq to stream connect to quantum
  - Add quantum_stream_connect()
  - Make sure that mcollective starts the service with the correct labeling
  - Add labels for ~/.manpath
  - Dontaudit attempts by svirt_t to getpw* calls
  - sandbox domains are trying to look at parent process data
  - Allow courior auth to create its pid file in /var/spool/courier subdir
  - Add fixes for beam to have it working with couchdb
  - Add labeling for /run/nm-xl2tpd.con
  - Allow apache to stream connect to thin
  - Add systemd support for amand
  - Make public types usable for fs mount points
  - Call correct mandb interface in domain.te
  - Allow iptables to r/w quantum inherited pipes and send sigchld
  - Allow ifconfig domtrans to iptables and execute ldconfig
  - Add labels for ~/.manpath
  - Allow systemd to read iscsi lib files
  - seunshare is trying to look at parent process data


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-48
changelog:
  - Fix openshift_search_lib
  - Add support for abrt-uefioops-oops
  - Allow colord to getattr any file system
  - Allow chrome processes to look at each other
  - Allow sys_ptrace for abrt_t
  - Add new policy for gssproxy
  - Dontaudit leaked file descriptor writes from firewalld
  - openshift_net_type is interface not template
  - Dontaudit pppd to search gnome config
  - Update openshift_search_lib() interface
  - Add fs_list_pstorefs()
  - Fix label on libbcm_host.so since it is built incorrectly on raspberry pi, needs back port to F18
  - Better labels for raspberry pi devices
  - Allow init to create devpts_t directory
  - Temporarily label rasbery pi devices as memory_device_t, needs back port to f18
  - Allow sysadm_t to build kernels
  - Make sure mount creates /var/run/blkid with the correct label, needs back port to F18
  - Allow userdomains to stream connect to gssproxy
  - Dontaudit leaked file descriptor writes from firewalld
  - Allow xserver to read /dev/urandom
  - Add additional fixes for ipsec-mgmt
  - Make SSHing into an Openshift Enterprise Node working


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-47
changelog:
  - Add transition rules to unconfined domains and to sysadm_t to create /etc/adjtime
  - with the proper label.
  - Update files_filetrans_named_content() interface to get right labeling for pam.d conf files
  - Allow systemd-timedated to create adjtime
  - Add clock_create_adjtime()
  - Additional fix ifconfing for #966106
  - Allow kernel_t to create boot.log with correct labeling
  - Remove unconfined_mplayer for which we don't have rules
  - Rename interfaces
  - Add userdom_manage_user_home_files/dirs interfaces
  - Fix files_dontaudit_read_all_non_security_files
  - Fix ipsec_manage_key_file()
  - Fix ipsec_filetrans_key_file()
  - Label /usr/bin/razor-lightdm-greeter as xdm_exec_t instead of spamc_exec_t
  - Fix labeling for ipse.secrets
  - Add interfaces for ipsec and labeling for ipsec.info and ipsec_setup.pid
  - Add files_dontaudit_read_all_non_security_files() interface
  - /var/log/syslog-ng should be labeled var_log_t
  - Make ifconfig_var_run_t a mountpoint
  - Add transition from ifconfig to dnsmasq
  - Allow ifconfig to execute bin_t/shell_exec_t
  - We want to have hwdb.bin labeled as etc_t
  - update logging_filetrans_named_content() interface
  - Allow systemd_timedate_t to manage /etc/adjtime
  - Allow NM to send signals to l2tpd
  - Update antivirus_can_scan_system boolean
  - Allow devicekit_disk_t to sys_config_tty
  - Run abrt-harvest programs as abrt_t, and allow abrt_t to list all filesystem directories
  - Make printing from vmware working
  - Allow php-cgi from php54 collection to access /var/lib/net-snmp/mib_indexes
  - Add virt_qemu_ga_data_t for qemu-ga
  - Make chrome and mozilla able to connect to same ports, add jboss_management_port_t to both
  - Fix typo in virt.te
  - Add virt_qemu_ga_unconfined_t for hook scripts
  - Make sure NetworkManager files get created with the correct label
  - Add mozilla_plugin_use_gps boolean
  - Fix cyrus to have support for net-snmp
  - Additional fixes for dnsmasq and quantum for #966106
  - Add plymouthd_create_log()
  - remove httpd_use_oddjob for which we don't have rules
  - Add missing rules for httpd_can_network_connect_cobbler
  - Add missing cluster_use_execmem boolean
  - Call userdom_manage_all_user_home_type_files/dirs
  - Additional fix for ftp_home_dir
  - Fix ftp_home_dir boolean
  - Allow squit to recv/send client squid packet
  - Fix nut.te to have nut_domain attribute
  - Add support for ejabberd; TODO: revisit jabberd and rabbit policy
  - Fix amanda policy
  - Add more fixes for domains which use libusb
  - Make domains which use libusb working correctly
  - Allow l2tpd to create ipsec key files with correct labeling and manage them
  - Fix cobbler_manage_lib_files/cobbler_read_lib_files to cover also lnk files
  - Allow rabbitmq-beam to bind generic node
  - Allow l2tpd to read ipse-mgmt pid files
  - more fixes for l2tpd, NM and pppd from #967072


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-46
changelog:
  - Dontaudit to getattr on dirs for dovecot-deliver
  - Allow raiudusd server connect to postgresql socket
  - Add kerberos support for radiusd
  - Allow saslauthd to connect to ldap port
  - Allow postfix to manage postfix_private_t files
  - Add chronyd support for #965457
  - Fix labeling for HOME_DIR/\.icedtea
  - CHange squid and snmpd to be allowed also write own logs
  - Fix labeling for /usr/libexec/qemu-ga
  - Allow virtd_t to use virt_lock_t
  - Allow also sealert to read the policy from the kernel
  - qemu-ga needs to execute scripts in /usr/libexec/qemu-ga and to use /tmp content
  - Dontaudit listing of users homedir by sendmail Seems like a leak
  - Allow passenger to transition to puppet master
  - Allow apache to connect to mythtv
  - Add definition for mythtv ports


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-45
changelog:
  - Add additional fixes for #948073 bug
  - Allow sge_execd_t to also connect to sge ports
  - Allow openshift_cron_t to manage openshift_var_lib_t sym links
  - Allow openshift_cron_t to manage openshift_var_lib_t sym links
  - Allow sge_execd to bind sge ports. Allow kill capability and reads cgroup files
  - Remove pulseaudio filetrans pulseaudio_manage_home_dirs which is a part of pulseaudio_manage_home_files
  - Add networkmanager_stream_connect()
  - Make gnome-abrt wokring with staff_t
  - Fix openshift_manage_lib_files() interface
  - mdadm runs ps command which seems to getattr on random log files
  - Allow mozilla_plugin_t to create pulseaudit_home_t directories
  - Allow qemu-ga to shutdown virtual hosts
  - Add labelling for cupsd-browsed
  - Add web browser plugins to connect to aol ports
  - Allow nm-dhcp-helper to stream connect to NM
  - Add port definition for sge ports


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-44
changelog:
  - Make sure users and unconfined domains create .hushlogin with the correct label
  - Allow pegaus to chat with realmd over DBus
  - Allow cobblerd to read network state
  - Allow boicn-client to stat on /dev/input/mice
  - Allow certwatch to read net_config_t when it executes apache
  - Allow readahead to create /run/systemd and then create its own directory with the correct label


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-43
changelog:
  - Transition directories and files when in a user_tmp_t directory
  - Change certwatch to domtrans to apache instead of just execute
  - Allow virsh_t to read xen lib files
  - update policy rules for pegasus_openlmi_account_t
  - Add support for svnserve_tmp_t
  - Activate account openlmi policy
  - pegasus_openlmi_domain_template needs also require pegasus_t
  - One more fix for policykit.te
  - Call fs_list_cgroups_dirs() in policykit.te
  - Allow nagios service plugin to read mysql config files
  - Add labeling for /var/svn
  - Fix chrome.te
  - Fix pegasus_openlmi_domain_template() interfaces
  - Fix dev_rw_vfio_dev definiton, allow virtd_t to read tmpfs_t symlinks
  - Fix location of google-chrome data
  - Add support for chome_sandbox to store content in the homedir
  - Allow policykit to watch for changes in cgroups file system
  - Add boolean to allow  mozilla_plugin_t to use spice
  - Allow collectd to bind to udp port
  - Allow collected_t to read all of /proc
  - Should use netlink socket_perms
  - Should use netlink socket_perms
  - Allow glance domains to connect to apache ports
  - Allow apcupsd_t to manage its log files
  - Allow chrome objects to rw_inherited unix_stream_socket from callers
  - Allow staff_t to execute virtd_exec_t for running vms
  - nfsd_t needs to bind mountd port to make nfs-mountd.service working
  - Allow unbound net_admin capability because of setsockopt syscall
  - Fix fs_list_cgroup_dirs()
  - Label /usr/lib/nagios/plugins/utils.pm as bin_t
  - Remove uplicate definition of fs_read_cgroup_files()
  - Remove duplicate definition of fs_read_cgroup_files()
  - Add files_mountpoint_filetrans interface to be used by quotadb_t and snapperd
  - Additional interfaces needed to list and read cgroups config
  - Add port definition for collectd port
  - Add labels for /dev/ptp*
  - Allow staff_t to execute virtd_exec_t for running vms


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-42
changelog:
  - Allow samba-net to also read realmd tmp files
  - Allow NUT to use serial ports
  - realmd can be started by systemctl now


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-41
changelog:
  - Remove userdom_home_manager for xdm_t and move all rules to xserver.te directly
  - Add new xdm_write_home boolean to allow xdm_t to create files in HOME dirs with xdm_home_t
  - Allow postfix-showq to read/write unix.showq in /var/spool/postfix/pid
  - Allow virsh to read xen lock file
  - Allow qemu-ga to create files in /run with proper labeling
  - Allow glusterd to connect to own socket in /tmp
  - Allow glance-api to connect to http port to make glance image-create working
  - Allow keystonte_t to execute rpm


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-39
changelog:
  - Allow tcpd to execute leafnode
  - Allow samba-net to read realmd cache files
  - Dontaudit sys_tty_config for alsactl
  - Fix allow rules for postfix_var_run
  - Allow cobblerd to read /etc/passwd
  - Allow pegasus to read exports
  - Allow systemd-timedate to read xdm state
  - Allow mout to stream connect to rpcbind
  - Add labeling just for /usr/share/pki/ca-trust-source instead of /usr/share/pki


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-38
changelog:
  - Allow thumbnails to share memory with apps which run thumbnails
  - Allow postfix-postqueue block_suspend
  - Add lib interfaces for smsd
  - Add support for nginx
  - Allow s2s running as jabberd_t to connect to jabber_interserver_port_t
  - Allow pki apache domain to create own tmp files and execute httpd_suexec
  - Allow procmail to manger user tmp files/dirs/lnk_files
  - Add virt_stream_connect_svirt() interface
  - Allow dovecot-auth to execute bin_t
  - Allow iscsid to request that kernel load a kernel module
  - Add labeling support for /var/lib/mod_security
  - Allow iw running as tuned_t to create netlink socket
  - Dontaudit sys_tty_config for thumb_t
  - Add labeling for nm-l2tp-service
  - Allow httpd running as certwatch_t to open tcp socket
  - Allow useradd to manager smsd lib files
  - Allow useradd_t to add homedirs in /var/lib
  - Fix typo in userdomain.te
  - Cleanup userdom_read_home_certs
  - Implement userdom_home_reader_certs_type to allow read certs also on encrypt /home with ecryptfs_t
  - Allow staff to stream connect to svirt_t to make gnome-boxes working


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-37
changelog:
  - Allow lvm to create its own unit files
  - Label /var/lib/sepolgen as selinux_config_t
  - Add filetrans rules for tw devices
  - Add transition from cupsd_config_t to cupsd_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-35
changelog:
  - Fix lockdev_manage_files()
  - Allow setroubleshootd to read var_lib_t to make email_alert working
  - Add lockdev_manage_files()
  - Call proper interface in virt.te
  - Allow gkeyring_domain to create /var/run/UID/config/dbus file
  - system dbus seems to be blocking suspend
  - Dontaudit attemps to sys_ptrace, which I believe gpsd does not need
  - When you enter a container from root, you generate avcs with a leaked file descriptor
  - Allow mpd getattr on file system directories
  - Make sure realmd creates content with the correct label
  - Allow systemd-tty-ask to write kmsg
  - Allow mgetty to use lockdev library for device locking
  - Fix selinuxuser_user_share_music boolean name to selinuxuser_share_music
  - When you enter a container from root, you generate avcs with a leaked file descriptor
  - Make sure init.fc files are labeled correctly at creation
  - File name trans vconsole.conf
  - Fix labeling for nagios plugins
  - label shared libraries in /opt/google/chrome as testrel_shlib_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-33
changelog:
  - Fix mozilla specification of homedir content
  - Allow certmonger to read network state
  - Allow tmpwatch to read tmp in /var/spool/{cups,lpd}
  - Label all nagios plugin as unconfined by default
  - Add httpd_serve_cobbler_files()
  - Allow mdadm to read /dev/sr0 and create tmp files
  - Allow certwatch to send mails
  - Fix labeling for nagios plugins
  - label shared libraries in /opt/google/chrome as testrel_shlib_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-32
changelog:
  - Allow realmd to run ipa, really needs to be an unconfined_domain
  - Allow sandbox domains to use inherted terminals
  - Allow pscd to use devices labeled svirt_image_t in order to use cat cards.
  - Add label for new alsa pid
  - Alsa now uses a pid file and needs to setsched 
  - Fix oracleasmfs_t definition
  - Add support for sshd_unit_file_t
  - Add oracleasmfs_t
  - Allow unlabeled_t files to be stored on unlabeled_t filesystems


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-31
changelog:
  - Fix description of deny_ptrace boolean
  - Remove allow for execmod lib_t for now
  - Allow quantum to connect to keystone port
  - Allow nova-console to talk with mysql over unix stream socket
  - Allow dirsrv to stream connect to uuidd
  - thumb_t needs to be able to create ~/.cache if it does not exist
  - virtd needs to be able to sys_ptrace when starting and stoping containers


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-30
changelog:
  - Allow alsa_t signal_perms, we probaly should search for any app that can execute something without transition and give it signal_perms...
  - Add dontaudit for mozilla_plugin_t looking at the xdm_t sockets
  - Fix deny_ptrace boolean, certain ptrace leaked into the system
  - Allow winbind to manage kerberos_rcache_host
  - Allow spamd to create spamd_var_lib_t directories
  - Remove transition to mozilla_tmp_t by mozilla_t, to allow it to manage the users tmp dirs
  - Add mising nslcd_dontaudit_write_sock_file() interface
  - one more fix
  - Fix pki_read_tomcat_lib_files() interface
  - Allow certmonger to read pki-tomcat lib files
  - Allow certwatch to execute bin_t
  - Allow snmp to manage /var/lib/net-snmp files
  - Call snmp_manage_var_lib_files(fogorn_t) instead of snmp_manage_var_dirs
  - Fix vmware_role() interface
  - Fix cobbler_manage_lib_files() interface
  - Allow nagios check disk plugins to execute bin_t
  - Allow quantum to transition to openvswitch_t
  - Allow postdrop to stream connect to postfix-master
  - Allow quantum to stream connect to openvswitch
  - Add xserver_dontaudit_xdm_rw_stream_sockets() interface
  - Allow daemon to send dgrams to initrc_t
  - Allow kdm to start the power service to initiate a reboot or poweroff


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-29
changelog:
  - Add mising nslcd_dontaudit_write_sock_file() interface
  - one more fix
  - Fix pki_read_tomcat_lib_files() interface
  - Allow certmonger to read pki-tomcat lib files
  - Allow certwatch to execute bin_t
  - Allow snmp to manage /var/lib/net-snmp files
  - Don't audit attempts to write to stream socket of nscld by thumbnailers
  - Allow git_system_t to read network state
  - Allow pegasas to execute mount command
  - Fix desc for drdb_admin
  - Fix condor_amin()
  - Interface fixes for uptime, vdagent, vnstatd
  - Fix labeling for moodle in /var/www/moodle/data
  - Add interface fixes
  - Allow bugzilla to read certs
  - /var/www/moodle needs to be writable by apache
  - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest
  - Fix namespace_init_t to create content with proper labels, and allow it to manage all user content
  - Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean
  - Fixes for dlm_controld
  - Fix apache_read_sys_content_rw_dirs() interface
  - Allow logrotate to read /var/log/z-push dir
  - Fix sys_nice for cups_domain
  - Allow postfix_postdrop to acces postfix_public socket
  - Allow sched_setscheduler for cupsd_t
  - Add missing context for /usr/sbin/snmpd
  - Kernel_t needs mac_admin in order to support labeled NFS
  - Fix systemd_dontaudit_dbus_chat() interface
  - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest
  - Allow consolehelper domain to write Xauth files in /root
  - Add port definition for osapi_compute port
  - Allow unconfined to create /etc/hostname with correct labeling
  - Add systemd_filetrans_named_hostname() interface


author: Dan Walsh <dwalsh@redhat.com> 3.12.1-28
changelog:
  - Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean
  - Fixes for dlm_controld
  - Fix apache_read_sys_content_rw_dirs() interface
  - Allow logrotate to read /var/log/z-push dir
  - Allow postfix_postdrop to acces postfix_public socket
  - Allow sched_setscheduler for cupsd_t
  - Add missing context for /usr/sbin/snmpd
  - Allow consolehelper more access discovered by Tom London
  - Allow fsdaemon to send signull to all domain
  - Add port definition for osapi_compute port
  - Allow unconfined to create /etc/hostname with correct labeling
  - Add systemd_filetrans_named_hostname() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-26
changelog:
  - Try to label on controlC devices up to 30 correctly
  - Add mount_rw_pid_files() interface
  - Add additional mount/umount interfaces needed by mock
  - fsadm_t sends audit messages in reads kernel_ipc_info when doing livecd-iso-to-disk
  - Fix tabs
  - Allow initrc_domain to search rgmanager lib files
  - Add more fixes which make mock working together with confined users
    * Allow mock_t to manage rpm files
    * Allow mock_t to read rpm log files
    * Allow mock to setattr on tmpfs, devpts
    * Allow mount/umount filesystems
  - Add rpm_read_log() interface
  - yum-cron runs rpm from within it.
  - Allow tuned to transition to dmidecode
  - Allow firewalld to do net_admin
  - Allow mock to unmont tmpfs_t
  - Fix virt_sigkill() interface
  - Add additional fixes for mock. Mainly caused by mount running in mock_t
  - Allow mock to write sysfs_t and mount pid files
  - Add mailman_domain to mailman_template()
  - Allow openvswitch to execute shell
  - Allow qpidd to use kerberos
  - Allow mailman to use fusefs, needs back port to RHEL6
  - Allow apache and its scripts to use anon_inodefs
  - Add alias for git_user_content_t and git_sys_content_t so that RHEL6 will update to RHEL7
  - Realmd needs to connect to samba ports, needs back port to F18 also
  - Allow colord to read /run/initial-setup-
  - Allow sanlock-helper to send sigkill to virtd which is registred to sanlock
  - Add virt_kill() interface
  - Add rgmanager_search_lib() interface
  - Allow wdmd to getattr on all filesystems. Back ported from RHEL6


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-25
changelog:
  - Allow realmd to create tmp files
  - FIx ircssi_home_t type to irssi_home_t
  - Allow adcli running as realmd_t to connect to ldap port
  - Allow NetworkManager to transition to ipsec_t, for running strongswan
  - Make openshift_initrc_t an lxc_domain
  - Allow gssd to manage user_tmp_t files
  - Fix handling of irclogs in users homedir
  - Fix labeling for drupal an wp-content in subdirs of /var/www/html
  - Allow abrt to read utmp_t file
  - Fix openshift policy to transition lnk_file, sock-file an fifo_file when created in a tmpfs_t, needs back port to RHEL6
  - fix labeling for (oo|rhc)-restorer-wrapper.sh
  - firewalld needs to be able to write to network sysctls
  - Fix mozilla_plugin_dontaudit_rw_sem() interface
  - Dontaudit generic ipc read/write to a mozilla_plugin for sandbox_x domains
  - Add mozilla_plugin_dontaudit_rw_sem() interface
  - Allow svirt_lxc_t to transition to openshift domains
  - Allow condor domains block_suspend and dac_override caps
  - Allow condor_master to read passd
  - Allow condor_master to read system state
  - Allow NetworkManager to transition to ipsec_t, for running strongswan
  - Lots of access required by lvm_t to created encrypted usb device
  - Allow xdm_t to dbus communicate with systemd_localed_t
  - Label strongswan content as ipsec_exec_mgmt_t for now
  - Allow users to dbus chat with systemd_localed
  - Fix handling of .xsession-errors in xserver.if, so kde will work
  - Might be a bug but we are seeing avc's about people status on init_t:service
  - Make sure we label content under /var/run/lock as <<none>>
  - Allow daemon and systemprocesses to search init_var_run_t directory
  - Add boolean to allow xdm to write xauth data to the home directory
  - Allow mount to write keys for the unconfined domain
  - Add unconfined_write_keys() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-24
changelog:
  - Add labeling for /usr/share/pki
  - Allow programs that read var_run_t symlinks also read var_t symlinks
  - Add additional ports as mongod_port_t for  27018, 27019, 28017, 28018 and 28019 ports
  - Fix labeling for /etc/dhcp directory
  - add missing systemd_stub_unit_file() interface
  - Add files_stub_var() interface
  - Add lables for cert_t directories
  - Make localectl set-x11-keymap working at all
  - Allow abrt to manage mock build environments to catch build problems.
  - Allow virt_domains to setsched for running gdb on itself
  - Allow thumb_t to execute user home content
  - Allow pulseaudio running as mozilla_plugin_t to read /run/systemd/users/1000
  - Allow certwatch to execut /usr/bin/httpd
  - Allow cgred to send signal perms to itself, needs back port to RHEL6
  - Allow openshift_cron_t to look at quota
  - Allow cups_t to read inhered tmpfs_t from the kernel
  - Allow yppasswdd to use NIS
  - Tuned wants sys_rawio capability
  - Add ftpd_use_fusefs boolean
  - Allow dirsrvadmin_t to signal itself


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-23
changelog:
  - Allow localectl to read /etc/X11/xorg.conf.d directory
  - Revert "Revert "Fix filetrans rules for kdm creates .xsession-errors""
  - Allow mount to transition to systemd_passwd_agent
  - Make sure abrt directories are labeled correctly
  - Allow commands that are going to read mount pid files to search mount_var_run_t
  - label /usr/bin/repoquery as rpm_exec_t
  - Allow automount to block suspend
  - Add abrt_filetrans_named_content so that abrt directories get labeled correctly
  - Allow virt domains to setrlimit and read file_context


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-22
changelog:
  - Allow nagios to manage nagios spool files
  - /var/spool/snmptt is a directory which snmdp needs to write to, needs back port to RHEL6
  - Add swift_alias.* policy files which contain typealiases for swift types
  - Add support for /run/lock/opencryptoki
  - Allow pkcsslotd chown capability
  - Allow pkcsslotd to read passwd
  - Add rsync_stub() interface
  - Allow systemd_timedate also manage gnome config homedirs
  - Label /usr/lib64/security/pam_krb5/pam_krb5_cchelper as bin_t
  - Fix filetrans rules for kdm creates .xsession-errors
  - Allow sytemd_tmpfiles to create wtmp file
  - Really should not label content  under /var/lock, since it could have labels on it different from var_lock_t
  - Allow systemd to list all file system directories
  - Add some basic stub interfaces which will be used in PRODUCT policies


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-21
changelog:
  - Fix log transition rule for cluster domains
  - Start to group all cluster log together
  - Dont use filename transition for POkemon Advanced Adventure until a new checkpolicy update
  - cups uses usbtty_device_t devices
  - These fixes were all required to build a MLS virtual Machine with single level desktops
  - Allow domains to transiton using httpd_exec_t
  - Allow svirt domains to manage kernel key rings
  - Allow setroubleshoot to execute ldconfig
  - Allow firewalld to read generate gnome data
  - Allow bluetooth to read machine-info
  - Allow boinc domain to send signal to itself
  - Fix gnome_filetrans_home_content() interface
  - Allow mozilla_plugins to list apache modules, for use with gxine
  - Fix labels for POkemon in the users homedir
  - Allow xguest to read mdstat
  - Dontaudit virt_domains getattr on /dev/*
  - These fixes were all required to build a MLS virtual Machine with single level desktops
  - Need to back port this to RHEL6 for openshift
  - Add tcp/8891 as milter port
  - Allow nsswitch domains to read sssd_var_lib_t files
  - Allow ping to read network state.
  - Fix typo
  - Add labels to /etc/X11/xorg.d and allow systemd-timestampd_t to manage them


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-20
changelog:
  - Adopt swift changes from lhh@redhat.com
  - Add rhcs_manage_cluster_pid_files() interface
  - Allow screen domains to configure tty and setup sock_file in ~/.screen directory
  - ALlow setroubleshoot to read default_context_t, needed to backport to F18
  - Label /etc/owncloud as being an apache writable directory
  - Allow sshd to stream connect to an lxc domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-19
changelog:
  - Allow postgresql to manage rgmanager pid files
  - Allow postgresql to read ccs data
  - Allow systemd_domain to send dbus messages to policykit
  - Add labels for /etc/hostname and /etc/machine-info and allow systemd-hostnamed to create them
  - All systemd domains that create content are reading the file_context file and setfscreate
  - Systemd domains need to search through init_var_run_t
  - Allow sshd to communicate with libvirt to set containers labels
  - Add interface to manage pid files
  - Allow NetworkManger_t to read /etc/hostname
  - Dontaudit leaked locked files into openshift_domains
  - Add fixes for oo-cgroup-read - it nows creates tmp files
  - Allow gluster to manage all directories as well as files
  - Dontaudit chrome_sandbox_nacl_t using user terminals
  - Allow sysstat to manage its own log files
  - Allow virtual machines to setrlimit and send itself signals.
  - Add labeling for /var/run/hplip


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-16
changelog:
  - Fix authconfig.py labeling
  - Make any domains that write homedir content do it correctly
  - Allow glusterd to read/write anyhwere on the file system by default
  - Be a little more liberal with the rsync log files
  - Fix iscsi_admin interface
  - Allow iscsid_t to read /dev/urand
  - Fix up iscsi domain for use with unit files
  - Add filename transition support for spamassassin policy
  - Allow web plugins to use badly formated libraries
  - Allow nmbd_t to create samba_var_t directories
  - Add filename transition support for spamassassin policy
  - Add filename transition support for tvtime
  - Fix alsa_home_filetrans_alsa_home() interface
  - Move all userdom_filetrans_home_content() calling out of booleans
  - Allow logrotote to getattr on all file sytems
  - Remove duplicate userdom_filetrans_home_content() calling
  - Allow kadmind to read /etc/passwd
  - Dontaudit append .xsession-errors file on ecryptfs for  policykit-auth
  - Allow antivirus domain to manage antivirus db links
  - Allow logrotate to read /sys
  - Allow mandb to setattr on man dirs
  - Remove mozilla_plugin_enable_homedirs boolean
  - Fix ftp_home_dir boolean
  - homedir mozilla filetrans has been moved to userdom_home_manager
  - homedir telepathy filetrans has been moved to userdom_home_manager
  - Remove gnome_home_dir_filetrans() from gnome_role_gkeyringd()
  - Might want to eventually write a daemon on fusefsd.
  - Add policy fixes for sshd [net] child from plautrba@redhat.com
  - Tor uses a new port
  - Remove bin_t for authconfig.py
  - Fix so only one call to userdom_home_file_trans
  - Allow home_manager_types to create content with the correctl label
  - Fix all domains that write data into the homedir to do it with the correct label
  - Change the postgresql to use proper boolean names, which is causing httpd_t to
  - not get access to postgresql_var_run_t
  - Hostname needs to send syslog messages
  - Localectl needs to be able to send dbus signals to users
  - Make sure userdom_filetrans_type will create files/dirs with user_home_t labeling by default
  - Allow user_home_manger domains to create spam* homedir content with correct labeling
  - Allow user_home_manger domains to create HOMEDIR/.tvtime with correct labeling
  - Add missing miscfiles_setattr_man_pages() interface and for now comment some rules for userdom_filetrans_type to make build process working
  - Declare userdom_filetrans_type attribute
  - userdom_manage_home_role() needs to be called withoout usertype attribute because of userdom_filetrans_type attribute
  - fusefsd is mounding a fuse file system on /run/user/UID/gvfs


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-14
changelog:
  - Allow gluster to get attrs on all fs
  - New access required for virt-sandbox
  - Allow dnsmasq to execute bin_t
  - Allow dnsmasq to create content in /var/run/NetworkManager
  - Fix openshift_initrc_signal() interface
  - Dontaudit openshift domains doing getattr on other domains
  - Allow consolehelper domain to communicate with session bus
  - Mock should not be transitioning to any other domains,  we should keep mock_t as mock_t
  - Update virt_qemu_ga_t policy
  - Allow authconfig running from realmd to restart oddjob service
  - Add systemd support for oddjob
  - Add initial policy for realmd_consolehelper_t which if for authconfig executed by realmd
  - Add labeling for gnashpluginrc
  - Allow chrome_nacl to execute /dev/zero
  - Allow condor domains to read /proc
  - mozilla_plugin_t will getattr on /core if firefox crashes
  - Allow condor domains to read /etc/passwd
  - Allow dnsmasq to execute shell scripts, openstack requires this access
  - Fix glusterd labeling
  - Allow virtd_t to interact with the socket type
  - Allow nmbd_t to override dac if you turned on sharing all files
  - Allow tuned to created kobject_uevent socket
  - Allow guest user to run fusermount
  - Allow openshift to read /proc and locale
  - Allow realmd to dbus chat with rpm
  - Add new interface for virt
  - Remove depracated interfaces
  - Allow systemd_domains read access on etc, etc_runtime and usr files, also allow them to connect stream to syslog socket
  - /usr/share/munin/plugins/plugin.sh should be labeled as bin_t
  - Remove some more unconfined_t process transitions, that I don't believe are necessary
  - Stop transitioning uncofnined_t to checkpc
  - dmraid creates /var/lock/dmraid
  - Allow systemd_localed to creatre unix_dgram_sockets
  - Allow systemd_localed to write kernel messages.
  - Also cleanup systemd definition a little.
  - Fix userdom_restricted_xwindows_user_template() interface
  - Label any block devices or char devices under /dev/infiniband as fixed_disk_device_t
  - User accounts need to dbus chat with accountsd daemon
  - Gnome requires all users to be able to read /proc/1/


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-13
changelog:
  - virsh now does a setexeccon call
  - Additional rules required by openshift domains
  - Allow svirt_lxc_domains to use inherited terminals, needed to make virt-sandbox-service execute work
  - Allow spamd_update_t to search spamc_home_t
  - Avcs discovered by mounting an isci device under /mnt
  - Allow lspci running as logrotate to read pci.ids
  - Additional fix for networkmanager_read_pid_files()
  - Fix networkmanager_read_pid_files() interface
  - Allow all svirt domains to connect to svirt_socket_t
  - Allow virsh to set SELinux context for a process.
  - Allow tuned to create netlink_kobject_uevent_socket
  - Allow systemd-timestamp to set SELinux context
  - Add support for /var/lib/systemd/linger
  - Fix ssh_sysadm_login to be working on MLS as expected


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-12
changelog:
  - Rename files_rw_inherited_tmp_files to files_rw_inherited_tmp_file
  - Add missing files_rw_inherited_tmp_files interface
  - Add additional interface for ecryptfs
  - ALlow nova-cert to connect to postgresql
  - Allow keystone to connect to postgresql
  - Allow all cups domains to getattr on filesystems
  - Allow pppd to send signull
  - Allow tuned to execute ldconfig
  - Allow gpg to read fips_enabled
  - Add additional fixes for ecryptfs
  - Allow httpd to work with posgresql
  - Allow keystone getsched and setsched


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-11
changelog:
  - Allow gpg to read fips_enabled
  - Add support for /var/cache/realmd
  - Add support for /usr/sbin/blazer_usb and systemd support for nut
  - Add labeling for fenced_sanlock and allow sanclok transition to fenced_t
  - bitlbee wants to read own log file
  - Allow glance domain to send a signal itself
  - Allow xend_t to request that the kernel load a kernel module
  - Allow pacemaker to execute heartbeat lib files
  - cleanup new swift policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-10
changelog:
  - Fix smartmontools
  - Fix userdom_restricted_xwindows_user_template() interface
  - Add xserver_xdm_ioctl_log() interface
  - Allow Xusers to ioctl lxdm.log to make lxdm working
  - Add MLS fixes to make MLS boot/log-in working
  - Add mls_socket_write_all_levels() also for syslogd
  - fsck.xfs needs to read passwd
  - Fix ntp_filetrans_named_content calling in init.te
  - Allow postgresql to create pg_log dir
  - Allow sshd to read rsync_data_t to make rsync <backuphost> working
  - Change ntp.conf to be labeled net_conf_t
  - Allow useradd to create homedirs in /run.  ircd-ratbox does this and we should just allow it
  - Allow xdm_t to execute gstreamer home content
  - Allod initrc_t and unconfined domains, and sysadm_t to manage ntp
  - New policy for openstack swift domains
  - More access required for openshift_cron_t
  - Use cupsd_log_t instead of cupsd_var_log_t
  - rpm_script_roles should be used in rpm_run
  - Fix rpm_run() interface
  - Fix openshift_initrc_run()
  - Fix sssd_dontaudit_stream_connect() interface
  - Fix sssd_dontaudit_stream_connect() interface
  - Allow LDA's job to deliver mail to the mailbox
  - dontaudit block_suspend for mozilla_plugin_t
  - Allow l2tpd_t to all signal perms
  - Allow uuidgen to read /dev/random
  - Allow mozilla-plugin-config to read power_supply info
  - Implement cups_domain attribute for cups domains
  - We now need access to user terminals since we start by executing a command outside the tty
  - We now need access to user terminals since we start by executing a command outside the tty
  - svirt lxc containers want to execute userhelper apps, need these changes to allow this to happen
  - Add containment of openshift cron jobs
  - Allow system cron jobs to create tmp directories
  - Make userhelp_conf_t a config file
  - Change rpm to use rpm_script_roles
  - More fixes for rsync to make rsync <backuphost> wokring
  - Allow logwatch to domtrans to mdadm
  - Allow pacemaker to domtrans to ifconfig
  - Allow pacemaker to setattr on corosync.log
  - Add pacemaker_use_execmem for memcheck-amd64 command
  - Allow block_suspend capability
  - Allow create fifo_file in /tmp with pacemaker_tmp_t
  - Allow systat to getattr on fixed disk
  - Relabel /etc/ntp.conf to be net_conf_t
  - ntp_admin should create files in /etc with the correct label
  - Add interface to create ntp_conf_t files in /etc
  - Add additional labeling for quantum
  - Allow quantum to execute dnsmasq with transition


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-9
changelog:
  - boinc_cliean wants also execmem as boinc projecs have
  - Allow sa-update to search admin home for /root/.spamassassin
  - Allow sa-update to search admin home for /root/.spamassassin
  - Allow antivirus domain to read net sysctl
  - Dontaudit attempts from thumb_t to connect to ssd
  - Dontaudit attempts by readahead to read sock_files
  - Dontaudit attempts by readahead to read sock_files
  - Create tmpfs file while running as wine as user_tmpfs_t
  - Dontaudit attempts by readahead to read sock_files
  - libmpg ships badly created librarie


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-8
changelog:
  - Change ssh_use_pts to use macro and only inherited sshd_devpts_t
  - Allow confined users to read systemd_logind seat information
  - libmpg ships badly created libraries
  - Add support for strongswan.service
  - Add labeling for strongswan
  - Allow l2tpd_t to read network manager content in /run directory
  - Allow rsync to getattr any file in rsync_data_t
  - Add labeling and filename transition for .grl-podcasts


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-7
changelog:
  - mount.glusterfs executes glusterfsd binary
  - Allow systemd_hostnamed_t to stream connect to systemd
  - Dontaudit any user doing a access check
  - Allow obex-data-server to request the kernel to load a module
  - Allow gpg-agent to manage gnome content (~/.cache/gpg-agent-info)
  - Allow gpg-agent to read /proc/sys/crypto/fips_enabled
  - Add new types for antivirus.pp policy module
  - Allow gnomesystemmm_t caps because of ioprio_set
  - Make sure if mozilla_plugin creates files while in permissive mode, they get created with the correct label, user_home_t
  - Allow gnomesystemmm_t caps because of ioprio_set
  - Allow NM rawip socket
  - files_relabel_non_security_files can not be used with boolean
  - Add interface to thumb_t dbus_chat to allow it to read remote process state
  - ALlow logrotate to domtrans to mdadm_t
  - kde gnomeclock wants to write content to /tmp


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-6
changelog:
  - kde gnomeclock wants to write content to /tmp
  - /usr/libexec/kde4/kcmdatetimehelper attempts to create /root/.kde
  - Allow blueman_t to rwx zero_device_t, for some kind of jre
  - Allow mozilla_plugin_t to rwx zero_device_t, for some kind of jre
  - Ftp full access should be allowed to create directories as well as files
  - Add boolean to allow rsync_full_acces, so that an rsync server can write all
  - over the local machine
  - logrotate needs to rotate logs in openshift directories, needs back port to RHEL6
  - Add missing vpnc_roles type line
  - Allow stapserver to write content in /tmp
  - Allow gnome keyring to create keyrings dir in ~/.local/share
  - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on
  - Add interface to colord_t dbus_chat to allow it to read remote process state
  - Allow colord_t to read cupsd_t state
  - Add mate-thumbnail-font as thumnailer
  - Allow sectoolm to sys_ptrace since it is looking at other proceses /proc data.
  - Allow qpidd to list /tmp. Needed by ssl
  - Only allow init_t to transition to rsync_t domain, not initrc_t.  This should be back ported to F17, F18
  - - Added systemd support for ksmtuned
  - Added booleans
   	ksmtuned_use_nfs
   	ksmtuned_use_cifs
  - firewalld seems to be creating mmap files which it needs to execute in /run /tmp and /dev/shm.  Would like to clean this up but for now we will allow
  - Looks like qpidd_t needs to read /dev/random
  - Lots of probing avc's caused by execugting gpg from staff_t
  - Dontaudit senmail triggering a net_admin avc
  - Change thumb_role to use thumb_run, not sure why we have a thumb_role, needs back port
  - Logwatch does access check on mdadm binary
  - Add raid_access_check_mdadm() iterface


