# changelog

author: Miroslav Rezanina <mrezanin@redhat.com> - qemu-kvm-0.12.1.2-2.406.el6
changelog:
  - Reverted spurious fix for BZ 981623 [bz#1010930]
  - Resolves: bz#1010930
    (Qemu-kvm-rhev build verifytest failed (rpm -V))


author: Michal Novotny <minovotn@redhat.com> - qemu-kvm-0.12.1.2-2.407.el6
changelog:
  - kvm-usb-host-remove-message.patch [bz#1003771]
  - Qemu guest agent - move logfiles to new directory for easier SELinux tagging [bz#1009431]
  - kvm-qemu-kvm-fix-reset-value-of-MSR_PAT.patch [bz#976706]
  - Resolves: bz#1003771
    (warning msg not correct after hotplug invalid usb-host to guest)
  - Resolves: bz#1009431
    (move qga logfiles to new /var/log/qemu-ga/ directory)
  - Resolves: bz#976706
    ([HP BCS 6.5 Bug]Guest OS cannot boot after first reboot when enabling SR-IOV feature)


author: Michal Novotny <minovotn@redhat.com> - qemu-kvm-0.12.1.2-2.408.el6
changelog:
  - Fix Qemu guest agent - move logfiles to new directory for easier SELinux tagging [bz#1009431]
  - kvm-block-Introduce-bs-zero_beyond_eof.patch [bz#1007224]
  - Resolves: bz#1007224
    (Introduce bs->zero_beyond_eof)
  - Resolves: bz#1009431
    (move qga logfiles to new /var/log/qemu-ga/ directory)


author: Michal Novotny <minovotn@redhat.com> - qemu-kvm-0.12.1.2-2.409.el6
changelog:
  - kvm-exec-Simplify-allocation-of-guest-RAM.patch [bz#867921]
  - kvm-exec-Don-t-abort-when-we-can-t-allocate-guest-memory.patch [bz#867921]
  - kvm-block-better-error-message-for-read-only-format-name.patch [bz#999788]
  - kvm-vmdk-Add-migration-blocker.patch [bz#999358]
  - kvm-scsi-Fix-scsi_bus_legacy_add_drive-scsi-generic-with.patch [bz#1013478]
  - kvm-Add-support-for-JSON-pretty-printing.patch [bz#1010610]
  - kvm-qemu-img-add-dirty-flag-status.patch [bz#1010610]
  - kvm-qemu-img-make-info-backing-file-output-correct-and-e2.patch [bz#1010610]
  - kvm-qapi-Add-SnapshotInfo-and-ImageInfo.patch [bz#1010610]
  - kvm-qemu-img-Add-json-output-option-to-the-info-command.patch [bz#1010610]
  - kvm-qemu-img-Add-backing-chain-option-to-info-command.patch [bz#1010610]
  - kvm-block-get_block_status-set-pnum-0-on-error.patch [bz#1010610]
  - kvm-block-get_block_status-avoid-segfault-if-there-is-no.patch [bz#1010610]
  - Resolves: bz#1010610
    (Backport  option "--output=json|human" to qemu-img info command)
  - Resolves: bz#1013478
    (-device usb-storage,serial=... crashes with SCSI generic drive)
  - Resolves: bz#867921
    ([RFE] Nicer error report when qemu-kvm can't allocate guest RAM)
  - Resolves: bz#999358
    (do live migration with used VMDK format disk should fail with a friendly message prompt)
  - Resolves: bz#999788
    (qemu should give a more friendly prompt when didn't specify read-only for VMDK format disk)


author: Michal Novotny <minovotn@redhat.com> - qemu-kvm-0.12.1.2-2.410.el6
changelog:
  - kvm-chardev-fix-pty_chr_timer.patch [bz#995341]
  - Resolves: bz#995341
    (hot-unplug chardev with pty backend caused qemu Segmentation fault)


author: Michal Novotny <minovotn@redhat.com> - qemu-kvm-0.12.1.2-2.411.el6
changelog:
  - kvm-block-don-t-lose-data-from-last-incomplete-sector.patch [bz#1009370]
  - kvm-vmdk-fix-cluster-size-check-for-flat-extents.patch [bz#1009370]
  - Resolves: bz#1009370
    (qemu-img refuses to open the vmdk format image its created)


author: Michal Novotny <minovotn@redhat.com> - qemu-kvm-0.12.1.2-2.412.el6
changelog:
  - kvm-char-move-backends-io-watch-tag-to-CharDriverState.patch [bz#985205]
  - kvm-char-use-common-function-to-disable-callbacks-on-cha.patch [bz#985205]
  - kvm-char-remove-watch-callback-on-chardev-detach-from-fr.patch [bz#985205]
  - kvm-os-posix-block-SIGUSR2-in-os_setup_early_signal_hand.patch [bz#996814]
  - Resolves: bz#985205
    (QEMU core dumped when do hot-unplug virtio serial port during transfer file between host to guest with virtio serial through TCP socket)
  - Resolves: bz#996814
    (boot image with gluster native mode cant work with attach another device from local file system)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.12.1.2-2.413.el6
changelog:
  - kvm-scsi-Allocate-SCSITargetReq-r-buf-dynamically-CVE-20.patch [bz#1007330]
  - kvm-scsi-Fix-data-length-SCSI_SENSE_BUF_SIZE.patch [bz#956929]
  - Resolves: bz#1007330
    (CVE-2013-4344 qemu: buffer overflow in scsi_target_emulate_report_luns)
  - Resolves: bz#956929
    (/usr/libexec/qemu-kvm was killed by signal 6 (SIGABRT) when SCSI inquiry is sent to unsupported page inside the KVM guest)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.12.1.2-2.414.el6
changelog:
  - kvm-vmstate-Add-max_version_id-field-to-VMStateDescripti.patch [bz#1016736]
  - kvm-savevm-Introduce-max_version_id-field-to-SaveStateEn.patch [bz#1016736]
  - kvm-i386-Set-cpu-section-version_id-to-11.patch [bz#1016736]
  - kvm-qemu-ga-execute-fsfreeze-freeze-in-reverse-order-of-.patch [bz#1015633]
  - Resolves: bz#1015633
    (qemu-guest-agent: "guest-fsfreeze-freeze" deadlocks if the guest have mounted disk images)
  - Resolves: bz#1016736
    (CPU migration data has version_id 12 but version 11 format)


author: Michal Novotny <minovotn@redhat.com> - qemu-kvm-0.12.1.2-2.415.el6
changelog:
  - kvm-target-i386-don-t-migrate-steal-time-MSR-on-older-ma.patch [bz#1022821]
  - Resolves: bz#1022821
    (live-migration from RHEL6.5 to RHEL6.4.z fails with "error while loading state for instance 0x0 of device 'cpu'")


author: Michal Novotny <minovotn@redhat.com> - qemu-kvm-0.12.1.2-2.416.el6
changelog:
  - kvm-block-Avoid-unecessary-drv-bdrv_getlength-calls.patch [bz#1022548]
  - Resolves: bz#1022548
    (Read/Randread/Randrw performance regression)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.12.1.2-2.417.el6
changelog:
  - kvm-block-Round-up-total_sectors.patch [bz#1022548 bz#1025596]
  - kvm-monitor-monitor_puts-bail-out-when-mon-NULL.patch [bz#1015979]
  - Resolves: bz#1015979
    ([FJ6.5 Bug]:[REG] live migration with "--copy-storage-{all,inc}" option fails)
  - Resolves: bz#1022548
    (Read/Randread/Randrw performance regression)
  - Resolves: bz#1025596
    (Read/Randread/Randrw performance regression)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.12.1.2-2.418.el6
changelog:
  - kvm-qcow2-Flush-image-after-creation.patch [bz#1018451]
  - kvm-vmdk-Fix-vmdk_parse_extents.patch [bz#1028252]
  - kvm-vmdk-fix-VMFS-extent-parsing.patch [bz#1028252]
  - Resolves: bz#1018451
    ('qemu-img info' take too much time with 'cluster_size=512,preallocation=metadata' in the first time)
  - Resolves: bz#1028252
    (fix vmdk support to ESX images)


author: Michal Novotny <minovotn@redhat.com> - qemu-kvm-0.12.1.2-2.419.el6
changelog:
  - kvm-qxl-fix-local-renderer.patch [bz#1005037]
  - kvm-qxl-Fix-QXLRam-initialisation.patch [bz#1013300]
  - kvm-virtio-net-broken-RX-filtering-logic-fixed.patch [bz#1010688]
  - Resolves: bz#1005037
    (When using “-vga qxl” together with “-display vnc=:5” or “-display  sdl” qemu displays  pixel garbage)
  - Resolves: bz#1010688
    ([whql][netkvm][wlk] Virtio-net device handles RX multicast filtering improperly)
  - Resolves: bz#1013300
    (Guest coredump while boot guest with " MALLOC_PERTURB_=234 ....--vnc :10,acl,sasl -vga qxl")


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.12.1.2-2.420.el6
changelog:
  - kvm-build-add-rules-for-nesting.patch [bz#786407]
  - kvm-build-add-rule-to-create-directories.patch [bz#786407]
  - kvm-support-to-nested-declare-for-common-obj-y.patch [bz#786407]
  - kvm-qapi-add-string-based-visitors.patch [bz#786407]
  - kvm-introduce-two-error-to-qerror.h.patch [bz#786407]
  - kvm-qom-Unify-type-registration.patch [bz#786407]
  - kvm-qom-add-QEMU-Object-Model-infrastructure.patch [bz#786407]
  - kvm-vl-add-object-option-to-create-QOM-objects-from-the-.patch [bz#786407]
  - kvm-rng-add-RndBackend-abstract-object-class.patch [bz#786407]
  - kvm-rng-random-add-an-RNG-backend-that-uses-dev-random-v.patch [bz#786407]
  - kvm-rng-egd-introduce-EGD-compliant-RNG-backend.patch [bz#786407]
  - kvm-rng-egd-don-t-use-gslist_free_full.patch [bz#786407]
  - kvm-virtio-rng-hardware-random-number-generator-device.patch [bz#786407]
  - kvm-virtio-rng-add-rate-limiting-support.patch [bz#786407]
  - kvm-virtio-rng-pci-create-a-default-backend-if-none-exis.patch [bz#786407]
  - kvm-virtio-rng-remove-extra-request-for-entropy.patch [bz#786407]
  - kvm-virtio-use-unsigned-int-for-counting-bytes-in-vq.patch [bz#786407]
  - kvm-virtio-Introduce-virtqueue_get_avail_bytes.patch [bz#786407]
  - kvm-virtio-rng-use-virtqueue_get_avail_bytes-fix-migrati.patch [bz#786407]
  - kvm-virtio-limit-avail-bytes-lookahead.patch [bz#786407]
  - kvm-virtio-rng-disable-timer-on-device-removal.patch [bz#786407]
  - kvm-virtio-rng-fix-typos-comments.patch [bz#786407]
  - kvm-introduce-qemu_close.patch [bz#786407]
  - kvm-rng-random-Use-qemu_open-qemu_close.patch [bz#786407]
  - kvm-rng-random-backend-check-for-EAGAIN-errors-on-read.patch [bz#786407]
  - kvm-virtio-virtqueue_get_avail_bytes-fix-desc_pa-when-lo.patch [bz#786407]
  - kvm-qemu-options.hx-Document-missing-drive-options.patch [bz#1024335]
  - kvm-Monitor-Make-mon_set_cpu-public.patch [bz#1026903]
  - kvm-qapi-Convert-human-monitor-command.patch [bz#1026903]
  - kvm-hmp-human-monitor-command-stop-using-the-Memory-char.patch [bz#1026903]
  - kvm-chardev-drop-the-Memory-chardev-driver.patch [bz#1026903]
  - kvm-chardev-remove-the-headers-of-Memory-chardev-driver.patch [bz#1026903]
  - kvm-pc-drop-unused-compat-property-for-the-virtio-balloo.patch [bz#1027561]
  - kvm-blockdev-Clean-up-how-readonly-persists-across-virtu.patch [bz#1025235]
  - kvm-virtio-rng-add-check-of-period.patch [bz#786407]
  - kvm-rng-egd-remove-redundant-free.patch [bz#786407]
  - kvm-rng-egd-offset-the-point-when-repeatedly-read-from-t.patch [bz#786407]
  - kvm-Improve-reporting-of-fatal-errors.patch [bz#1054137]
  - kvm-vmdk-Allow-read-only-open-of-VMDK-version-3.patch [bz#1007708 bz#1029852]
  - Resolves: bz#1007708
    ([RFE] Enable qemu-img to support VMDK version 3)
  - Resolves: bz#1024335
    (Manpage doesn't document -drive rerror/werror/readonly)
  - Resolves: bz#1025235
    (the readonly permission of floppy will be changed after eject/change)
  - Resolves: bz#1026903
    (QMP: human-monitor-command: fix buffer duplication)
  - Resolves: bz#1027561
    (Cleanup unused event_idx compat property from rhel6.0.0 and rhel6.1.0 machine types)
  - Resolves: bz#1029852
    (qemu-img fails to convert vmdk image with "qemu-img: Could not open 'image.vmdk'")
  - Resolves: bz#1054137
    (improve error reporting)
  - Resolves: bz#786407
    ([RFE] Add ability to pull system entropy from host)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.12.1.2-2.421.el6
changelog:
  - kvm-monitor-Cleanup-mon-outbuf-on-write-error.patch [bz#1060024]
  - Resolves: bz#1060024
    (QMP socket breaks on unexpected close)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.12.1.2-2.422.el6
changelog:
  - kvm-block-Pass-filename-to-bdrv_get_full_backing_filenam.patch [bz#1067576]
  - Resolves: bz#1067576
    (RHEV: Cannot start VMs that have more than 23 snapshots.)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.12.1.2-2.423.el6
changelog:
  - kvm-ACPI-level-VCPU-enablement-info-for-libvirt-RHEL-6-o.patch [bz#1017858]
  - kvm-sasl-Avoid-Could-not-find-keytab-file-in-syslog.patch [bz#1018434]
  - Resolves: bz#1017858
    ([Intel 6.6 Bug] virsh setvcpus can not setup correct vcpu number)
  - Resolves: bz#1018434
    (qemu-kvm: Could not find keytab file: /etc/qemu/krb5.tab: No such file or directory)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.12.1.2-2.424.el6
changelog:
  - kvm-virtio-net-fix-guest-triggerable-buffer-overrun.patch [bz#1078605]
  - kvm-qcow2-Check-backing_file_offset-CVE-2014-0144.patch [bz#1079453]
  - kvm-qcow2-Check-refcount-table-size-CVE-2014-0144.patch [bz#1079453]
  - kvm-qcow2-Validate-refcount-table-offset.patch [bz#1079518]
  - kvm-qcow2-Validate-snapshot-table-offset-size-CVE-2014-0.patch [bz#1079453]
  - kvm-qcow2-Validate-active-L1-table-offset-and-size-CVE-2.patch [bz#1079453]
  - kvm-qcow2-Fix-backing-file-name-length-check.patch [bz#1079518]
  - kvm-qcow2-Don-t-rely-on-free_cluster_index-in-alloc_refc.patch [bz#1079338]
  - kvm-qcow2-Avoid-integer-overflow-in-get_refcount-CVE-201.patch [bz#1079319]
  - kvm-qcow2-Check-new-refcount-table-size-on-growth.patch [bz#1079518]
  - kvm-qcow2-Fix-types-in-qcow2_alloc_clusters-and-alloc_cl.patch [bz#1079518]
  - kvm-qcow2-Protect-against-some-integer-overflows-in-bdrv.patch [bz#1079518]
  - kvm-qcow2-Catch-some-L1-table-index-overflows.patch [bz#1079518]
  - kvm-qcow2-Fix-new-L1-table-size-check-CVE-2014-0143.patch [bz#1079319]
  - kvm-qcow2-Fix-NULL-dereference-in-qcow2_open-error-path-.patch [bz#1079331]
  - kvm-qcow2-Limit-snapshot-table-size.patch [bz#1079518]
  - kvm-block-cloop-validate-block_size-header-field-CVE-201.patch [bz#1079453]
  - kvm-block-cloop-prevent-offsets_size-integer-overflow-CV.patch [bz#1079319]
  - kvm-block-cloop-refuse-images-with-huge-offsets-arrays-C.patch [bz#1079453]
  - kvm-block-cloop-Fix-coding-style.patch [bz#1079518]
  - kvm-cloop-Fix-bdrv_open-error-handling.patch [bz#1079518]
  - kvm-block-cloop-refuse-images-with-bogus-offsets-CVE-201.patch [bz#1079453]
  - kvm-block-cloop-Use-g_free-instead-of-free.patch [bz#1079518]
  - kvm-block-cloop-fix-offsets-size-off-by-one.patch [bz#1079518]
  - kvm-bochs-Fix-bdrv_open-error-handling.patch [bz#1079518]
  - kvm-bochs-Unify-header-structs-and-make-them-QEMU_PACKED.patch [bz#1079518]
  - kvm-bochs-Use-unsigned-variables-for-offsets-and-sizes-C.patch [bz#1079338]
  - kvm-bochs-Check-catalog_size-header-field-CVE-2014-0143.patch [bz#1079319]
  - kvm-bochs-Check-extent_size-header-field-CVE-2014-0142.patch [bz#1079314]
  - kvm-bochs-Fix-bitmap-offset-calculation.patch [bz#1079518]
  - kvm-vpc-vhd-add-bounds-check-for-max_table_entries-and-b.patch [bz#1079453]
  - kvm-vpc-Validate-block-size-CVE-2014-0142.patch [bz#1079314]
  - kvm-vdi-add-bounds-checks-for-blocks_in_image-and-disk_s.patch [bz#1079453]
  - kvm-vhdx-Bounds-checking-for-block_size-and-logical_sect.patch [bz#1079344]
  - kvm-curl-check-data-size-before-memcpy-to-local-buffer.-.patch [bz#1079453]
  - kvm-dmg-Fix-bdrv_open-error-handling.patch [bz#1079518]
  - kvm-dmg-coding-style-and-indentation-cleanup.patch [bz#1079518]
  - kvm-dmg-prevent-out-of-bounds-array-access-on-terminator.patch [bz#1079518]
  - kvm-dmg-drop-broken-bdrv_pread-loop.patch [bz#1079518]
  - kvm-dmg-use-appropriate-types-when-reading-chunks.patch [bz#1079518]
  - kvm-dmg-sanitize-chunk-length-and-sectorcount-CVE-2014-0.patch [bz#1079324]
  - kvm-dmg-use-uint64_t-consistently-for-sectors-and-length.patch [bz#1079518]
  - kvm-dmg-prevent-chunk-buffer-overflow-CVE-2014-0145.patch [bz#1079324]
  - kvm-block-Limit-request-size-CVE-2014-0143.patch [bz#1079319]
  - kvm-parallels-Fix-catalog-size-integer-overflow-CVE-2014.patch [bz#1079319]
  - kvm-parallels-Sanity-check-for-s-tracks-CVE-2014-0142.patch [bz#1079314]
  - kvm-bochs-Fix-memory-leak-in-bochs_open-error-path.patch [bz#1079518]
  - kvm-bochs-Fix-catalog-size-check.patch [bz#1079518]
  - Resolves: bz#1078605
    (EMBARGOED CVE-2014-0150 qemu: virtio-net: fix guest-triggerable buffer overrun [rhel-6.6])
  - Resolves: bz#1079314
    (CVE-2014-0142 qemu-kvm: qemu: crash by possible division by zero [rhel-6.6])
  - Resolves: bz#1079319
    (CVE-2014-0143 qemu-kvm: Qemu: block: multiple integer overflow flaws [rhel-6.6])
  - Resolves: bz#1079324
    (CVE-2014-0145 qemu-kvm: Qemu: prevent possible buffer overflows [rhel-6.6])
  - Resolves: bz#1079331
    (CVE-2014-0146 qemu-kvm: Qemu: qcow2: NULL dereference in qcow2_open() error path [rhel-6.6])
  - Resolves: bz#1079338
    (CVE-2014-0147 qemu-kvm: Qemu: block: possible crash due signed types or logic error [rhel-6.6])
  - Resolves: bz#1079344
    ()
  - Resolves: bz#1079453
    (CVE-2014-0144 qemu-kvm: Qemu: block: missing input validation [rhel-6.6])
  - Resolves: bz#1079518
    (qemu-kvm: include leftover patches from block layer security audit)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.12.1.2-2.425.el6
changelog:
  - kvm-blkdebug-pass-getlength-to-underlying-file.patch [bz#1023874 bz#1031883]
  - kvm-qapi-generate-list-struct-and-visit_list-for-enum.patch [bz#1035162]
  - kvm-qapi-Fix-potential-NULL-pointer-segfault.patch [bz#1035162]
  - kvm-dump-change-cpu_get_note_size-to-return-ssize_t.patch [bz#1035162]
  - kvm-dump-guest-memory-Check-for-the-correct-return-value.patch [bz#1035162]
  - kvm-dump-const-qualify-the-buf-of-WriteCoreDumpFunction.patch [bz#1035162]
  - kvm-dump-add-argument-to-write_elfxx_notes.patch [bz#1035162]
  - kvm-dump-add-API-to-write-header-of-flatten-format.patch [bz#1035162]
  - kvm-dump-add-API-to-write-vmcore.patch [bz#1035162]
  - kvm-dump-add-API-to-write-elf-notes-to-buffer.patch [bz#1035162]
  - kvm-dump-add-support-for-lzo-snappy.patch [bz#1035162]
  - kvm-RPM-spec-build-qemu-kvm-with-lzo-and-snappy-enabled-.patch [bz#1035162]
  - kvm-dump-add-members-to-DumpState-and-init-some-of-them.patch [bz#1035162]
  - kvm-dump-add-API-to-write-dump-header.patch [bz#1035162]
  - kvm-dump-add-API-to-write-dump_bitmap.patch [bz#1035162]
  - kvm-dump-add-APIs-to-operate-DataCache.patch [bz#1035162]
  - kvm-dump-add-API-to-write-dump-pages.patch [bz#1035162]
  - kvm-dump-make-kdump-compressed-format-available-for-dump.patch [bz#1035162]
  - kvm-Define-the-architecture-for-compressed-dump-format.patch [bz#1035162]
  - kvm-dump-add-query-dump-guest-memory-capability-command.patch [bz#1035162]
  - kvm-x86-fix-migration-from-pre-version-12.patch [bz#1023268]
  - kvm-x86-cpuid-reconstruct-leaf-0Dh-data.patch [bz#1023268]
  - kvm-net-Update-netdev-peer-on-link-change.patch [bz#965396]
  - kvm-qga-Don-t-require-time-argument-in-guest-set-time-co.patch [bz#1066191]
  - kvm-only-unset-set-mask-notifier-when-kvm-irqchip-is-sup.patch [bz#1074762]
  - kvm-qdev-Allow-vlan-or-netdev-for-device-not-both.patch [bz#998865]
  - kvm-spice-add-SASL-support.patch [bz#1021575]
  - kvm-block-fix-snapshot-on-QED.patch [bz#1012244]
  - kvm-gluster-default-scheme-to-gluster-and-host-to-localh.patch [bz#1088610]
  - kvm-ide-Correct-improper-smart-self-test-counter-reset-i.patch [bz#1087979]
  - Resolves: bz#1012244
    (make live snapshot with QED disk specified qcow2 format will cause guest hang and host call trace)
  - Resolves: bz#1021575
    (Missing SASL support for SPICE)
  - Resolves: bz#1023268
    (Error Code: 0x0000000A at first reboot after fresh installing Win8.1-32 guest on AMD system)
  - Resolves: bz#1023874
    ([Regression] Prompt error of trigger blkdebug: BLKDBG_CLUSTER_FREE event is not the same as expected)
  - Resolves: bz#1031883
    (qemu-io error prompt "Operation is supported" is not expected)
  - Resolves: bz#1035162
    ([FEAT RHEL6.6]: qemu: Support compression for dump-guest-memory command)
  - Resolves: bz#1066191
    (RHEL6: backport guest-set-time command to qemu-guest-agent)
  - Resolves: bz#1074762
    (qemu-kvm  Segmentation fault when using -no-kvm-irqchip option and virtio-nic-pci device as the same time)
  - Resolves: bz#1087979
    (CVE-2014-2894 qemu-kvm: QEMU: out of bounds buffer accesses, guest triggerable via IDE SMART [rhel-6.6])
  - Resolves: bz#1088610
    (qemu-img coredumpd when try to create a gluster format image)
  - Resolves: bz#965396
    (turn down tap link off under hmp, rhel6.4 guest boot stalled  at "starting certmonger" after “system-reset”)
  - Resolves: bz#998865
    (Add vlan parameter in device_add command would cause device_add qemu_new_net_client: Assertion `!peer')


author: Jeff E. Nelson <jenelson@redhat.com> - 0.12.1.2-2.426.el6
changelog:
  - kvm-Python-lang-gdb-script-to-extract-x86_64-guest-vmcor.patch [bz#826266]
  - kvm-dump-guest-memory.py-port-guest_phys_blocks_append-t.patch [bz#826266]
  - kvm-dump-guest-memory.py-ram_blocks-is-a-QLIST-not-a-QTA.patch [bz#826266]
  - kvm-dump-guest-memory.py-convert-PhysPageDesc.phys_offse.patch [bz#826266]
  - kvm-dump-guest-memory.py-hoist-gdb-round-trip-from-inner.patch [bz#826266]
  - kvm-dump-guest-memory.py-trim-logs-in-memory-listener-ca.patch [bz#826266]
  - kvm-RPM-spec-install-dump-guest-memory.py-RHEL-only.patch [bz#826266]
  - kvm-enable-PCI-multiple-segments-for-pass-through-device.patch [bz#1081451]
  - kvm-spice-fix-info-spice.patch [bz#1029983]
  - kvm-virtio-out-of-bounds-buffer-write-on-invalid-state-l.patch [bz#1096089]
  - kvm-usb-sanity-check-setup_index-setup_len-in-post_load.patch [bz#1096117]
  - kvm-usb-sanity-check-setup_index-setup_len-in-post_02.patch [bz#1096117]
  - kvm-virtio-scsi-fix-buffer-overrun-on-invalid-state-load.patch [bz#1096097]
  - kvm-virtio-avoid-buffer-overrun-on-incoming-migration.patch [bz#1096093]
  - kvm-posix-aio-compat-fix-latency-issues.patch [bz#1097031]
  - kvm-virtio-validate-num_sg-when-mapping.patch [bz#1096124]
  - kvm-virtio-allow-mapping-up-to-max-queue-size.patch [bz#1096093 bz#1096124]
  - kvm-virtio-net-fix-buffer-overflow-on-invalid-state-load.patch [bz#1066430]
  - kvm-virtio-validate-config_len-on-load.patch [bz#1095780]
  - kvm-usb-fix-up-post-load-checks.patch [bz#1096826]
  - Resolves: bz#1029983
    (spice-server reports incorrect listening address on monitor with "ipv6" option)
  - Resolves: bz#1066430
    (CVE-2013-4148 qemu: virtio-net: buffer overflow on invalid state load [rhel-6.6])
  - Resolves: bz#1081451
    (qemu-kvm-rhev does not support Non Zero PCI domain for SRIOV Virtual Functions)
  - Resolves: bz#1095780
    (CVE-2014-0182 qemu-kvm: qemu: virtio: out-of-bounds buffer write on state load with invalid config_len [rhel-6.6])
  - Resolves: bz#1096089
    (CVE-2013-4151 qemu-kvm: qemu: virtio: out-of-bounds buffer write on invalid state load [rhel-6.6])
  - Resolves: bz#1096093
    (CVE-2013-6399 qemu-kvm: qemu: virtio: buffer overrun on incoming migration [rhel-6.6])
  - Resolves: bz#1096097
    (CVE-2013-4542 qemu-kvm: qemu: virtio-scsi: buffer overrun on invalid state load [rhel-6.6])
  - Resolves: bz#1096117
    (CVE-2013-4541 qemu-kvm: qemu: usb: insufficient sanity checking of setup_index+setup_len in post_load [rhel-6.6])
  - Resolves: bz#1096124
    (CVE-2013-4535 CVE-2013-4536 qemu-kvm: qemu: virtio: insufficient validation of num_sg when mapping [rhel-6.6])
  - Resolves: bz#1096826
    (CVE-2014-3461 qemu-kvm: Qemu: usb: fix up post load checks [rhel-6.6])
  - Resolves: bz#1097031
    (Improve posix-aio-compat latency by backporting upstream fix)
  - Resolves: bz#826266
    ([Hitachi 6.6 FEAT] Extract guest memory dump from qemu-kvm core)


author: Jeff E. Nelson <jenelson@redhat.com> - 0.12.1.2-2.427.el6
changelog:
  - kvm-Introduce-range.h.patch [bz#1004420]
  - kvm-qcow2-fix-typo-in-documentation-for-qcow2_get_cluste.patch [bz#1004420]
  - kvm-qcow2-Ignore-reserved-bits-in-get_cluster_offset.patch [bz#1004420]
  - kvm-qcow2-Ignore-reserved-bits-in-refcount-table-entries.patch [bz#1004420]
  - kvm-qcow2-handle_alloc-Get-rid-of-keep_clusters-paramete.patch [bz#1004420]
  - kvm-qcow2-Finalise-interface-of-handle_alloc.patch [bz#1004420]
  - kvm-qcow2-Metadata-overlap-checks.patch [bz#1004420]
  - kvm-qcow2-Employ-metadata-overlap-checks.patch [bz#1004420]
  - kvm-qcow2-refcount-Move-OFLAG_COPIED-checks.patch [bz#1004420]
  - kvm-qcow2-refcount-Repair-OFLAG_COPIED-errors.patch [bz#1004420]
  - kvm-qcow2-refcount-Repair-shared-refcount-blocks.patch [bz#1004420]
  - kvm-qmp-Documentation-for-BLOCK_IMAGE_CORRUPTED.patch [bz#1004420]
  - kvm-qcow2-Correct-snapshots-size-for-overlap-check.patch [bz#1004420]
  - kvm-qcow2-Correct-endianness-in-overlap-check.patch [bz#1004420]
  - kvm-qcow2-Switch-L1-table-in-a-single-sequence.patch [bz#1004420]
  - kvm-qcow2-Use-pread-for-inactive-L1-in-overlap-check.patch [bz#1004420]
  - kvm-qcow2-Remove-wrong-metadata-overlap-check.patch [bz#1004420]
  - kvm-qcow2-Use-negated-overflow-check-mask.patch [bz#1004420]
  - kvm-qcow2-Make-overlap-check-mask-variable.patch [bz#1004420]
  - kvm-qcow2-Add-more-overlap-check-bitmask-macros.patch [bz#1004420]
  - kvm-qcow2-fix-wrong-value-of-L1E_OFFSET_MASK-L2E_OFFSET_.patch [bz#1004420]
  - kvm-qcow2-refcount-Sanitize-refcount-table-entry.patch [bz#1004420]
  - kvm-qcow2-Correct-comment-for-realloc_refcount_block.patch [bz#1004420]
  - kvm-qcow2-Fix-fail-path-in-realloc_refcount_block.patch [bz#1004420]
  - kvm-CPU-hotplug-use-apic_id_for_cpu-round-2-RHEL-6-only.patch [bz#1099599]
  - kvm-device-assignment-don-t-update-msix-if-vector-s-unch.patch [bz#1096984]
  - Resolves: bz#1004420
    (Backport qcow2 corruption prevention patches)
  - Resolves: bz#1096984
    ([Intel 6.6 Bug] 2x RHEL 5.10 VM running on RHEL 6.5 KVM have low TCP_STREAM throughput)
  - Resolves: bz#1099599
    (Some vCPU topologies not accepted by libvirt)


author: Jeff E. Nelson <jenelson@redhat.com> - 0.12.1.2-2.428.el6
changelog:
  - kvm-qcow2-preserve-free_byte_offset-when-qcow2_alloc_byt.patch [bz#1101701]
  - kvm-block-Fix-bdrv_is_allocated-for-short-backing-files.patch [bz#1092117]
  - kvm-PCI-Convert-pci_info-to-QObject.patch [bz#813748]
  - kvm-PCI-do_pci_info-PCI-bridge-devices-support.patch [bz#813748]
  - kvm-PCI-show-also-host-bridge-data-in-info-pci-output.patch [bz#813748]
  - kvm-pci-fix-info-pci-with-host-bridge.patch [bz#813748]
  - kvm-qapi-Convert-query-pci.patch [bz#813748]
  - kvm-qdev-DEVICE_DELETED-event.patch [bz#813748]
  - kvm-hmp-Fix-freeing-of-PciInfoList.patch [bz#813748]
  - Resolves: bz#1092117
    (live incremental migration of vm with common shared base, size(disk) > size(base) transfers unallocated sectors, explodes disk on dest)
  - Resolves: bz#1101701
    (comparison always false at qcow2_refcount.c:613)
  - Resolves: bz#813748
    ([RFE] Report whether hot unplug completed)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.12.1.2-2.429.el6
changelog:
  - kvm-hw-qxl-support-client-monitor-configuration-via-devi.patch [bz#1075139]
  - kvm-usb-move-usb_-hi-lo-helpers-to-header-file.patch [bz#949547]
  - kvm-usb-add-vendor-request-defines.patch [bz#949547]
  - kvm-Add-rhel6.6.0-machine-type.patch [bz#949547]
  - kvm-add-msos-desc-compat-prop.patch [bz#949547]
  - kvm-usb-add-support-for-microsoft-os-descriptors.patch [bz#949547]
  - kvm-usb-hid-add-microsoft-os-descriptor-support.patch [bz#949547]
  - kvm-block-vhdx-account-for-identical-header-sections.patch [bz#1097021]
  - kvm-block-Ignore-duplicate-or-NULL-format_name-in-bdrv_i.patch [bz#998426]
  - kvm-qcow-Return-real-error-code-in-qcow_open.patch [bz#1097228]
  - kvm-qcow1-Make-padding-in-the-header-explicit.patch [bz#1097228]
  - kvm-qcow1-Check-maximum-cluster-size.patch [bz#1097228]
  - kvm-qcow1-Validate-L2-table-size-CVE-2014-0222.patch [bz#1097228]
  - kvm-qcow1-Validate-image-size-CVE-2014-0223.patch [bz#1097235]
  - kvm-qcow1-Stricter-backing-file-length-check.patch [bz#1097235]
  - kvm-virtio-scsi-add-ioeventfd-support.patch [bz#1106420]
  - kvm-Fix-pkgversion-value.patch [bz#1074396]
  - kvm-vl.c-Output-error-on-invalid-machine-type.patch [bz#990254]
  - kvm-block-fix-signed-int-overflow-in-qcow2_co_get_block_.patch [bz#1101430]
  - kvm-qemu-img-add-special-exit-code-if-bdrv_check-is-not-.patch [bz#1054753]
  - kvm-qemu-img-Report-error-even-with-oformat-json.patch [bz#1054753]
  - kvm-qemu-img-Document-check-exit-codes.patch [bz#1054753]
  - kvm-blockdev-preserve-readonly-and-snapshot-states-acros.patch [bz#1105428]
  - kvm-target-i386-Broadwell-CPU-model.patch [bz#1100380]
  - kvm-target-i386-support-invariant-tsc-flag.patch [bz#996771]
  - kvm-target-i386-block-migration-and-savevm-if-invariant-.patch [bz#996771]
  - Resolves: bz#1054753
    (qemu-img doesn't print error in json for raw images)
  - Resolves: bz#1074396
    (QMP: "query-version" doesn't include the -rhev prefix from the qemu-kvm-rhev package)
  - Resolves: bz#1075139
    (multi-monitor doesn't work with a RHEL 7 guest.)
  - Resolves: bz#1097021
    ([RFE] qemu-img: Add/improve Disk2VHD tools creating VHDX images)
  - Resolves: bz#1097228
    (CVE-2014-0222 qemu-kvm: Qemu: qcow1: validate L2 table size to avoid integer overflows [rhel-6.6])
  - Resolves: bz#1097235
    (CVE-2014-0223 qemu-kvm: Qemu: qcow1: validate image size to avoid out-of-bounds memory access [rhel-6.6])
  - Resolves: bz#1100380
    ([Intel 6.6 FEAT] Broadwell new instructions support for KVM - qemu-kvm)
  - Resolves: bz#1101430
    (qemu-kvm get "Unknown error 1539571707" when execute block-stream)
  - Resolves: bz#1105428
    (readonly=on has no effect for drive with no media)
  - Resolves: bz#1106420
    (Enable ioenventfd for virtio-scsi-pci)
  - Resolves: bz#949547
    (qemu-kvm process consumes 8% cpu even when windows guest is idle inside and 70% when guest uses 10% cpu inside)
  - Resolves: bz#990254
    (qemu-kvm failing when invalid machine type is provided)
  - Resolves: bz#996771
    (nonstop_tsc cpu flag support for KVM guests - QEMU support)
  - Resolves: bz#998426
    (there are four "gluster" in qemu-img supported format list)


author: Jeff E. Nelson <> - 0.12.1.2-2.430.el6
changelog:
  - kvm-qxl-render-add-sanity-check.txt [bz#1095612]
  - kvm-qxl-always-update-displaysurface-on-resize.txt [bz#1112078]
  - Resolves: bz#1095612
    (Machine type rhel6.0.0 & -vga qxl & vnc cause qemu-kvm core dump)
  - Resolves: bz#1112078
    (RHEL7 guest desktop hang when boot with qxl and vnc)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.12.1.2-2.431.el6
changelog:
  - kvm-dump-Drop-pointless-error_is_set-DumpState-member-er.patch [bz#1102659]
  - kvm-dump-fill-in-the-flat-header-signature-more-pleasing.patch [bz#1102659]
  - kvm-dump-simplify-write_start_flat_header.patch [bz#1102659]
  - kvm-dump-eliminate-DumpState.page_shift-guest-s-page-shi.patch [bz#1102659]
  - kvm-dump-eliminate-DumpState.page_size-guest-s-page-size.patch [bz#1102659]
  - kvm-dump-select-header-bitness-based-on-ELF-class-not-EL.patch [bz#1102659]
  - kvm-dump-hoist-lzo_init-from-get_len_buf_out-to-dump_ini.patch [bz#1102659]
  - kvm-dump-simplify-get_len_buf_out.patch [bz#1102659]
  - kvm-virtio-rng-check-return-value-of-virtio_load-RHEL-6-.patch [bz#1102668]
  - kvm-block-add-ROUND_UP-into-osdep.h.patch [bz#1063559]
  - kvm-block-vhdx-add-migration-blocker.patch [bz#1063559]
  - kvm-block-vhdx-minor-comments-and-typo-correction.patch [bz#1063559]
  - kvm-block-vhdx-add-header-update-capability.patch [bz#1063559]
  - kvm-block-vhdx-code-movement-VHDXMetadataEntries-and-BDR.patch [bz#1063559]
  - kvm-block-vhdx-log-support-struct-and-defines.patch [bz#1063559]
  - kvm-block-vhdx-break-endian-translation-functions-out.patch [bz#1063559]
  - kvm-block-vhdx-update-log-guid-in-header-and-first-write.patch [bz#1063559]
  - kvm-block-vhdx-code-movement-move-vhdx_close-above-vhdx_.patch [bz#1063559]
  - kvm-block-vhdx-log-parsing-replay-and-flush-support.patch [bz#1063559]
  - kvm-block-vhdx-add-region-overlap-detection-for-image-fi.patch [bz#1063559]
  - kvm-block-vhdx-add-log-write-support.patch [bz#1063559]
  - kvm-block-vhdx-write-support.patch [bz#1063559]
  - kvm-block-vhdx-remove-BAT-file-offset-bit-shifting.patch [bz#1063559]
  - kvm-block-vhdx-move-more-endian-translations-to-vhdx-end.patch [bz#1063559]
  - kvm-block-vhdx-break-out-code-operations-to-functions.patch [bz#1063559]
  - kvm-block-vhdx-fix-comment-typos-in-header-fix-incorrect.patch [bz#1063559]
  - kvm-block-vhdx-add-.bdrv_create-support.patch [bz#1063559]
  - kvm-vpc-Implement-.bdrv_has_zero_init.patch [bz#1063559]
  - kvm-block-vpc-use-QEMU_PACKED-for-on-disk-structures.patch [bz#1063559]
  - kvm-vpc-vhdx-add-get_info.patch [bz#1063559]
  - kvm-block-vhdx-improve-error-message-and-.bdrv_check-imp.patch [bz#1063559]
  - kvm-block-vhdx-Error-checking-fixes.patch [bz#1063559]
  - kvm-spec-explicitly-enable-vhdx-in-build.patch [bz#1063559]
  - kvm-Fix-multiboot-compilation.patch [bz#820641]
  - kvm-docs-update-qemu-img-man-page-to-reflect-vhdx-image-.patch [bz#1017649]
  - kvm-tracetool-add-tracetool-simpletrace_stap-format.patch [bz#905761]
  - kvm-trace-install-simpletrace-SystemTap-tapset.patch [bz#905761]
  - kvm-trace-install-trace-events.patch [bz#905761]
  - kvm-simpletrace-add-simpletrace.py-script.patch [bz#905761]
  - kvm-simpletrace-add-simpletrace.py-no-header-option.patch [bz#905761]
  - kvm-simpletrace-install-simpletrace.py.patch [bz#905761]
  - kvm-trace-add-SystemTap-init-scripts-for-simpletrace-bri.patch [bz#905761]
  - kvm-block-Create-proper-size-file-for-disk-mirror.patch [bz#1092117]
  - kvm-block-Fix-bdrv_is_allocated-return-value.patch [bz#1092117]
  - Resolves: bz#1017649
    (need to update qmeu-img man help docs page about "VHDX" format disk)
  - Resolves: bz#1063559
    (VHDX: journal log should not be replayed by default, but rather via qemu-img check -r all)
  - Resolves: bz#1092117
    (live incremental migration of vm with common shared base, size(disk) > size(base) transfers unallocated sectors, explodes disk on dest)
  - Resolves: bz#1102659
    (Use-after-free of file descriptor in create_kdump_vmcore)
  - Resolves: bz#1102668
    (Return value of virtio_load not checked in virtio_rng_load)
  - Resolves: bz#820641
    (Unable to run kvm unit tests with -append option)
  - Resolves: bz#905761
    ([Fujitsu 6.6 FEAT]: QEMU: enable easy introspection of the list of trace events and their arguments)


author: Jeff E. Nelson <jenelson@redhat.com> - 0.12.1.2-2.432.el6
changelog:
  - kvm-vmdk-refuse-enabling-zeroed-grain-with-flat-images.txt [bz#1088788]
  - kvm-vmdk-Only-read-cid-from-image-file-when-opening.txt [bz#1088788]
  - kvm-vmdk-Fix-creating-big-description-file.txt [bz#1088788]
  - kvm-vmdk-Check-VMFS-extent-line-field-number.txt [bz#1088788]
  - kvm-vmdk-Fix-big-flat-extent-IO.txt [bz#1088788]
  - kvm-scsi-disk-rd-wr-vr-protect-0-is-an-error.txt [bz#1064643]
  - kvm-scsi-disk-improve-the-lba-out-of-range-tests-for-read-.txt [bz#1064643]
  - kvm-scsi-disk-Fail-medium-writes-with-proper-sense-for-rea.txt [bz#1064643]
  - kvm-scsi-disk-improve-out-of-range-LBA-detection-for-WRITE.txt [bz#1064643]
  - kvm-scsi-disk-introduce-check_lba_range.txt [bz#1064643]
  - kvm-scsi-disk-fix-check-for-out-of-range-LBA.txt [bz#1064643]
  - kvm-virtio-blk-Fix-commit-f0f6bce-fail-unaligned-requests.txt [bz#1064643]
  - kvm-virtio-blk-Factor-common-checks-out-of-virtio_blk_hand.txt [bz#1064643]
  - kvm-virtio-blk-Bypass-error-action-and-I-O-accounting-on-i.txt [bz#1064643]
  - kvm-virtio-blk-Treat-read-write-beyond-end-as-invalid.txt [bz#1064643]
  - kvm-ide-Treat-read-write-beyond-end-as-invalid.txt [bz#1064643]
  - kvm-scsi-Report-error-when-lun-number-is-in-use.txt [bz#1095609]
  - Resolves: bz#1064643
    (qemu makes no distinction between external and guest triggered block I/O errors)
  - Resolves: bz#1088788
    (qemu-img creates truncated VMDK image with subformat=twoGbMaxExtentFlat)
  - Resolves: bz#1095609
    (qemu-kvm should give some hint when hot-plug a devices with the same existing "scsi-id  and lun")


author: Jeff E. Nelson <jenelson@redhat.com> - 0.12.1.2-2.433.el6
changelog:
  - kvm-qxl-dont-update-invalid-area.txt [bz#994388]
  - kvm-qxl-update_area_io-cleanup-invalid-parameters-handling.txt [bz#994388]
  - kvm-target-i386-remove-tabs-from-target-i386-cpu.h.txt [bz#845667]
  - kvm-migrate-vPMU-state.txt [bz#845667]
  - kvm-vPMU-do-not-migrate-for-M-rhel6.5.0-or-older.txt [bz#845667]
  - kvm-virtio-scsi-Fix-reset-callback-for-virtio-scsi.txt [bz#1123698]
  - kvm-scsi-bus-prepare-scsi_req_new-for-introduction-of-pars.txt [bz#1113917]
  - kvm-scsi-bus-introduce-parse_cdb-in-SCSIDeviceClass-and-SC.txt [bz#1113917]
  - kvm-scsi-block-extract-scsi_block_is_passthrough.txt [bz#1113917]
  - kvm-scsi-block-scsi-generic-implement-parse_cdb.txt [bz#1113917]
  - kvm-virtio-scsi-implement-parse_cdb.txt [bz#1113917]
  - Resolves: bz#1113917
    ([FJ6.5 Bug] SCSI command issued from KVM guest doesn't reach target device)
  - Resolves: bz#1123698
    (qemu-kvm core dump when hot-plug a virtio-scsi disk to guest and reboot)
  - Resolves: bz#845667
    (Virtual PMU support during live migration)
  - Resolves: bz#994388
    (SpiceWorker-CRITICAL **: red_worker.c:4894:red_update_area: condition `area->left >= 0 && area->top >= 0 && area->left < area->right && area->top < area->bottom' failed)


author: Jeff E. Nelson <jenelson@redhat.com> - 0.12.1.2-2.434.el6
changelog:
  - kvm-block-gluster-code-movements-state-storage-changes.txt [bz#1118543]
  - kvm-block-gluster-add-reopen-support.txt [bz#1118543]
  - Resolves: bz#1118543
    (Can not continue live commiting when using glusterfs(native) backend after relaunch qemu)


author: Jeff E. Nelson <> - 0.12.1.2-2.435.el6
changelog:
  - kvm-migration-dump-vmstate-info-as-a-json-file-for-stati.patch [bz#1118718]
  - kvm-vmstate-static-checker-script-to-validate-vmstate-ch.patch [bz#1118718]
  - kvm-tests-vmstate-static-checker-add-dump1-and-dump2-fil.patch [bz#1118718]
  - kvm-tests-vmstate-static-checker-incompat-machine-types.patch [bz#1118718]
  - kvm-tests-vmstate-static-checker-add-version-error-in-ma.patch [bz#1118718]
  - kvm-tests-vmstate-static-checker-version-mismatch-inside.patch [bz#1118718]
  - kvm-tests-vmstate-static-checker-minimum_version_id-chec.patch [bz#1118718]
  - kvm-tests-vmstate-static-checker-remove-a-section.patch [bz#1118718]
  - kvm-tests-vmstate-static-checker-remove-a-field.patch [bz#1118718]
  - kvm-tests-vmstate-static-checker-remove-last-field-in-a-.patch [bz#1118718]
  - kvm-tests-vmstate-static-checker-change-description-name.patch [bz#1118718]
  - kvm-tests-vmstate-static-checker-remove-Fields.patch [bz#1118718]
  - kvm-tests-vmstate-static-checker-remove-Description.patch [bz#1118718]
  - kvm-tests-vmstate-static-checker-remove-Description-insi.patch [bz#1118718]
  - kvm-tests-vmstate-static-checker-remove-a-subsection.patch [bz#1118718]
  - kvm-tests-vmstate-static-checker-remove-Subsections.patch [bz#1118718]
  - kvm-tests-vmstate-static-checker-add-substructure-for-us.patch [bz#1118718]
  - kvm-tests-vmstate-static-checker-add-size-mismatch-insid.patch [bz#1118718]
  - Resolves: bz#1118718
    (VMstate static checker: backport -dump-vmstate feature to export json-encoded vmstate info)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.436.el6
changelog:
  - kvm-qcow2-Reject-too-large-header-extensions.patch [bz#1124443]
  - kvm-block-Fix-is_allocated_above-with-resized-files.patch [bz#1122992]
  - kvm-block-mirror-Use-bdrv_is_allocated_above.patch [bz#1122992]
  - kvm-qemu-io-New-command-map.patch [bz#1122410]
  - kvm-qemu-io-Implement-write-c-for-compressed-clusters.patch [bz#1122410]
  - kvm-qemu-img-Add-compare-subcommand.patch [bz#1122410]
  - kvm-qemu-img-Fix-overwriting-ret-before-using.patch [bz#1122410]
  - kvm-QMP-add-get_events-wait-True-option.patch [bz#1122410]
  - kvm-qmp-Check-for-returned-data-from-__json_read-in-get_.patch [bz#1122410]
  - kvm-QMP-add-server-mode-to-QEMUMonitorProtocol.patch [bz#1122410]
  - kvm-qemu-iotests-Import-from-upstream.patch [bz#1122410]
  - kvm-qemu-iotests-Disable-tests-that-require-sample-image.patch [bz#1122410]
  - kvm-block-parse-cache-mode-flags-in-a-single-place.patch [bz#1122410]
  - kvm-qemu-io-Add-command-line-switch-for-cache-mode.patch [bz#1122410]
  - kvm-qemu-io-correctly-print-non-integer-values-as-decima.patch [bz#1122410]
  - kvm-qemu-iotests-Modify-scripts-to-run-with-qemu-kvm-rhe.patch [bz#1122410]
  - kvm-qemu-iotests-Disable-cases-requiring-not-backported-.patch [bz#1122410]
  - kvm-qemu-iotests-Backport-028.patch [bz#1122410]
  - kvm-qemu-iotests-Backport-029.patch [bz#1122410]
  - kvm-qemu-iotests-Backport-030.patch [bz#1122410]
  - kvm-qemu-iotests-Backport-060.patch [bz#1122410]
  - kvm-qemu-iotests-Backport-031.patch [bz#1122410]
  - kvm-qemu-iotests-Backport-040.patch [bz#1122410]
  - kvm-qemu-iotests-Backport-041.patch [bz#1122410]
  - kvm-qemu-iotests-Backport-049.patch [bz#1122410]
  - kvm-qemu-iotests.-Backport-067.patch [bz#1122410]
  - kvm-qemu-iotests-Backport-080.patch [bz#1122410]
  - kvm-qemu-iotests-Backport-086.patch [bz#1122410]
  - kvm-qemu-iotests-Trivial-test-case-backports.patch [bz#1122410]
  - kvm-virtio-rng-Add-human-readable-error-message-for-nega.patch [bz#1119207]
  - kvm-virtio-rng-Move-error-checking-forward-to-prevent-me.patch [bz#1119207]
  - Resolves: bz#1119207
    ([rng]qemu-kvm process still can start when specify negative value for max-bytes)
  - Resolves: bz#1122410
    (backport qemu-iotests to the RHEL 6 internal repository)
  - Resolves: bz#1122992
    (Full mirroring with smaller backing file causes qemu to hang)
  - Resolves: bz#1124443
    (qcow2 doesn't catch invalid header extension sizes)


author: Jeff E. Nelson <> - 0.12.1.2-2.437.el6
changelog:
  - kvm-vmschk-check-rhel6.py-quickly-compare-RHEL6-jsons-ba.patch [bz#1125792]
  - kvm-tests-add-rhel6.0-to-rhel6.6-vmstate-json-files.patch [bz#1125792]
  - kvm-scsi-Ensure-command-and-transfer-lengths-are-set-for.patch [bz#1113068]
  - kvm-Documentation-qemu-img-Mention-SIGUSR1-progress-repo.patch [bz#1122885]
  - Resolves: bz#1113068
    (Qemu crashes when some commands are passed from guest to host tape device.)
  - Resolves: bz#1122885
    (qemu-img man doc should tell "should report progress bar when receives "SIGUSR1" signal if -p option is not used")
  - Resolves: bz#1125792
    (Add vmstate json representation files for RHEL6 releases to source tree)


author: Jeff E. Nelson <> - 0.12.1.2-2.438.el6
changelog:
  - kvm-hda-audio-fix-non-mixer-codecs.patch [bz#1080546]
  - kvm-spice-stop-server-for-qxl-hard-reset.patch [bz#995931]
  - kvm-spice-move-qemu_spice_display_-from-spice-graphics-t.patch [bz#995931]
  - kvm-spice-move-spice_server_vm_-start-stop-calls-into-qe.patch [bz#995931]
  - Resolves: bz#1080546
    (pulse sound no longer works after changing KVM win 7 guest SID in RHEL 6.5)
  - Resolves: bz#995931
    (Qemu core dump (red_get_image: unknown type 184) when reboot a RHEL.6.4-64 guest 25 times)


author: Jeff E. Nelson <> - 0.12.1.2-2.439.el6
changelog:
  - kvm-spice-fix-libvirt-snapshots.patch [bz#1010670]
  - kvm-ide-Ignore-double-DMA-transfer-starts-stops.patch [bz#1104573]
  - kvm-ide-Reset-current_addr-after-stopping-DMA.patch [bz#1104573]
  - kvm-ide-Reset-BMIDEA-bit-when-the-bus-master-is-stopped.patch [bz#1104573]
  - Resolves: bz#1010670
    (spice session is closed when taking snapshot with ram)
  - Resolves: bz#1104573
    (DMA error when install RHEL.5.11.x86_64 guest (ide drive) on RHEL6.5.z host)


author: Jeff E. Nelson <> - 0.12.1.2-2.440.el6
changelog:
  - kvm-hw-qdev-emit-DEVICE_DELETED-event-only-if-the-device.patch [bz#1124314]
  - kvm-ide-Fix-segfault-when-flushing-a-device-that-doesn-t.patch [bz#1120541]
  - Resolves: bz#1120541
    (qemu-kvm crashed when doing iofuzz testing)
  - Resolves: bz#1124314
    (incorrect event reported by QMP on hot plugging an in-use VF to guest)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.441.el6
changelog:
  - kvm-block-Improve-bdrv_aio_co_cancel_em.patch [bz#1018537]
  - kvm-usb-Avoid-reentrancy-of-ehci_advance_async_state-dow.patch [bz#1018537]
  - kvm-scripts-add-sample-model-file-for-Coverity-Scan.patch [bz#1102409]
  - Resolves: bz#1018537
    (qemu core dump after run read/randwr fio in guest with usb or scsi disk)
  - Resolves: bz#1102409
    (Unable to handle NULL pointer dereference in qcow2_check_refcounts)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.442.el6
changelog:
  - kvm-Fix-TEXI-section-mark-imbalance-in-qemu-img-cmd.hx.patch [bz#1116558]
  - kvm-qemu-img-Allow-source-cache-mode-specification.patch [bz#1116558]
  - kvm-vl-Change-mem-prealloc-to-match-upstream.patch [bz#1006027]
  - Resolves: bz#1006027
    (-mem-prealloc option behaviour is opposite to expected)
  - Resolves: bz#1116558
    (Allow qemu-img to bypass the host cache (check, compare, convert, rebase, amend))


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.12.1.2-2.443.el6
changelog:
  - kvm-char-add-a-dummy-fe_open-implementation.patch [bz#1027181]
  - kvm-char-restore-read-callback-on-a-reattached-hotplug-c.patch [bz#1027181]
  - Resolves: bz#1027181
    (Guest can't receive any character transmitted from host after hot unplugging virtserialport then hot plugging again)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.443.el6
changelog:
  - kvm-qxl-render-add-more-sanity-checks.patch [bz#1095612]
  - Resolves: bz#1095612
    (Machine type rhel6.0.0 & -vga qxl & vnc cause qemu-kvm core dump)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.445.el6
changelog:
  - kvm-trace-add-systemtap-initscript-README-file-to-RPM.patch [bz#1139438]
  - Resolves: bz#1139438
    (README for qemu-kvm systemtap flight recorder)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.12.1.2-2.446.el6
changelog:
  - Properly adding missing README.systemtap [bz#1139438]
  - Resolves: bz#1139438
    (README for qemu-kvm systemtap flight recorder)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.447.el6
changelog:
  - kvm-net-Forbid-dealing-with-packets-when-VM-is-not-runni.patch [bz#1142756 bz#970103]
  - kvm-migration-set-speed-to-maximum-during-last-stage.patch [bz#1142756 bz#970103]
  - kvm-migration-only-call-append-when-there-is-something-t.patch [bz#1142756 bz#970103]
  - kvm-migration-avoid-no-op-memmove-of-potential-large-buf.patch [bz#1142756 bz#970103]
  - kvm-migration-remove-not-needed-ram_save_remaining-funct.patch [bz#1142756 bz#970103]
  - kvm-migration-move-bandwidth-calculation-to-inside-stage.patch [bz#1142756 bz#970103]
  - kvm-migration-Don-t-calculate-bandwidth-when-last-cycle-.patch [bz#1142756 bz#970103]
  - Resolves: bz#1142756
    (Downtime during live migration of busy VM is much higher than migration_downtime in vdsm.conf)
  - Resolves: bz#970103
    (Downtime during live migration of busy VM is much higher than migration_downtime in vdsm.conf)
  - Properly include README.systemtap [bz#1145672]
  - Resolves: bz#1145672
    (README for qemu-kvm systemtap flight recorder)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.448.el6
changelog:
  - kvm-Revert-migration-Don-t-calculate-bandwidth-when-last.patch [bz#970103]
  - kvm-Revert-migration-move-bandwidth-calculation-to-insid.patch [bz#970103]
  - kvm-Revert-migration-remove-not-needed-ram_save_remainin.patch [bz#970103]
  - kvm-Revert-migration-avoid-no-op-memmove-of-potential-la.patch [bz#970103]
  - kvm-Revert-migration-only-call-append-when-there-is-some.patch [bz#970103]
  - kvm-Revert-migration-set-speed-to-maximum-during-last-st.patch [bz#970103]
  - kvm-Revert-net-Forbid-dealing-with-packets-when-VM-is-no.patch [bz#970103]
  - Reverts attempt to solve: bz#970103
    (Downtime during live migration of busy VM is much higher than migration_downtime in vdsm.conf)


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.0-14
changelog:
  - Merge Pacemaker cluster resource agents:
    * Add Source1.
    * Drop noarch. We have real binaries now.
    * Update BuildRequires.
    * Update all relevant prep/build/install/files/description sections.


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.0-16
changelog:
  - Create an ldirectord package
  - Update Pacameker agents to upstream version: 2198dc90bec4
    + Build: Import ldirectord.
    + Ensure HA_VARRUNDIR has a value to substitute
    + High: Add findif tool (mandatory for IPaddr/IPaddr2)
    + High: IPv6addr: new nic and cidr_netmask parameters
    + High: postfix: new resource agent
    + Include license information
    + Low (LF 2159): Squid: make the regexp match more precisely output of netstat
    + Low: configure: Fix package name.
    + Low: ldirectord: add dependency on $remote_fs.
    + Low: ldirectord: add mandatory required header to init script.
    + Medium (LF 2165): IPaddr2: remove all colons from the mac address before passing it to send_arp
    + Medium: VirtualDomain: destroy domain shortly before timeout expiry
    + Medium: shellfuncs: Make the mktemp wrappers work.
    + Remove references to Echo function
    + Remove references to heartbeat shellfuncs.
    + Remove useless path lookups
    + findif: actually include the right header. Simplify configure.
    + ldirectord: Remove superfluous configure artifact.
    + ocf-tester: Fix package reference and path to DTD.


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.3-3
changelog:
  - Update Pacameker agents to upstream version: 099c0e5d80db
    + Add the ha_parameter function back into .ocf-shellfuncs.
    + Bug bnc#534803 - Provide a default for MAILCMD
    + Fix use of undefined macro @HA_NOARCHDATAHBDIR@
    + High (LF 2138): IPsrcaddr: replace 0/0 with proper ip prefix (thanks to Michael Ricordeau and Michael Schwartzkopff)
    + Import shellfuncs from heartbeat as badly written RAs use it
    + Medium (LF 2173): nfsserver: exit properly in nfsserver_validate
    + Medium: RA: Filesystem: implement monitor operation
    + Medium: RA: VirtualDomain: loop on status if libvirtd is unreachable
    + Medium: RA: VirtualDomain: loop on status if libvirtd is unreachable (addendum)
    + Medium: RA: iSCSILogicalUnit: use a 16-byte default SCSI ID
    + Medium: RA: iSCSITarget: be more persistent deleting targets on stop
    + Medium: RA: portblock: add per-IP filtering capability
    + Medium: mysql-proxy: log_level and keepalive parameters
    + Medium: oracle: drop spurious output from sqlplus
    + RA: Filesystem: allow configuring smbfs mounts as clones


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.4-2
changelog:
  - Update Pacameker agents to upstream version: e2338892f59f
    + High: send_arp - turn on unsolicited mode for compatibilty with the libnet version's exit codes
    + High: Trap sigterm for compatibility with the libnet version of send_arp
    + Medium: Bug - lf#2147: IPaddr2: behave if the interface is down
    + Medium: IPv6addr: recognize network masks properly
    + Medium: RA: VirtualDomain: avoid needlessly invoking "virsh define"


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.5-2
changelog:
  - Update Pacameker agents to upstream version: bc00c0b065d9
    + High: RA: introduce OCF_FUNCTIONS_DIR, allow it to be overridden (LF2239)
    + High: doc: add man pages for all RAs (LF2237)
    + High: syslog-ng: new RA
    + High: vmware: make meta-data work and several cleanups (LF 2212)
    + Medium: .ocf-shellfuncs: add ocf_is_probe function
    + Medium: Dev: make RAs executable (LF2239)
    + Medium: IPv6addr: ifdef out the ip offset hack for libnet v1.1.4 (LF 2034)
    + Medium: add mercurial repository version information to .ocf-shellfuncs
    + Medium: build: add perl-MailTools runtime dependency to ldirectord package (LF 1469)
    + Medium: iSCSITarget, iSCSILogicalUnit: support LIO
    + Medium: nfsserver: use check_binary properly in validate (LF 2211)
    + Medium: nfsserver: validate should not check if nfs_shared_infodir exists (thanks to eelco@procolix.com) (LF 2219)
    + Medium: oracle/oralsnr: export variables properly
    + Medium: pgsql: remove the previous backup_label if it exists
    + Medium: postfix: fix double stop (thanks to Dinh N. Quoc)
    + RA: LVM: Make monitor operation quiet in logs (bnc#546353)
    + RA: Xen: Remove instance_attribute "allow_migrate" (bnc#539968)
    + ldirectord: OCF agent: overhaul


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.6-1
changelog:
  - New rgmanager resource agents upstream release
  - spec file update:
    * use global instead of define
    * use new Source0 url
    * use resource-agents macro more aggressively


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.6-2
changelog:
  - Update Pacameker agents to upstream version: c76b4a6eb576
    + High: RA: VirtualDomain: fix forceful stop (LF 2283)
    + High: apache: monitor operation of depth 10 for web applications (LF 2234)
    + Medium: IPaddr2: CLUSTERIP/iptables rule not always inserted on failed monitor (LF 2281)
    + Medium: RA: Route: improve validate (LF 2232)
    + Medium: mark obsolete RAs as deprecated (LF 2244)
    + Medium: mysql: escalate stop to KILL if regular shutdown doesn't work


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.7-2
changelog:
  - Drop support for drbd and smb (PM-drop-support-for-drbd-and-smb-resource-agents.patch)
  - Explicitly list python as BuildRequires


author: Marek Grac <mgrac@redhat.com> - 3.0.7-4
changelog:
  - Checksum error occurs on HA-LVM
  - status on clusterfs "gfs" returned 1 (generic error)
  - Resolves rhbz#563555 rhbz#558664


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.9-1
changelog:
  - new upstream release
    Resolves: rhbz#569959
  - spec file update:
    * update spec file copyright date
    * use bz2 tarball


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.12-1
changelog:
  - Rebase on top of new upstream bug fix only release:
    * drop all bug fix patches.
    * refresh patches with official SHA1 git commits from RHEL6
      upstream branch:
      - drop_support_for_drbd_and_smb.patch
    * Addresses the follwing issues:
      from 3.0.12 release:
    Resolves: rhbz#582754, rhbz#582753, rhbz#585217, rhbz#583789
    * Rebase:
    Resolves: rhbz#582353
  - Stop build on ppc and ppc64.
    Resolves: rhbz#590997
  - Switch to file based Requires.
    Also address several other problems related to missing runtime
    components in different agents.
    With the current Requires: set, we guarantee all basic functionalities
    out of the box for lvm/fs/clusterfs/netfs/networking.
    Resolves: rhbz#584800
  - New pacemaker agents upstream release
    * Patched build process to correctly generate ldirectord man page
    + High: pgsql: properly implement pghost parameter
    + High: RA: mysql: fix syntax error
    + High: SAPInstance RA: do not rely on op target rc when monitoring clones (lf#2371)
    + High: set the HA_RSCTMP directory to /var/run/resource-agents (lf#2378)
    + High: RA: vmware: fix set_environment() invocation (LF 2342)
    + High: RA: vmware: update to version 0.2
    + Medium: IPaddr/IPaddr2: add a description of the assumption in meta-data
    + Medium: IPaddr: return the correct code if interface delete failed
    + Medium: nfsserver: rpc.statd as the notify cmd does not work with -v (thanks to Carl Lewis)
    + Medium: oracle: reduce output from sqlplus to the last line for queries (bnc#567815)
    + Medium: pgsql: implement "config" parameter
    + Medium: RA: iSCSITarget: follow changed IET access policy
    + Medium: Filesystem: prefer /proc/mounts to /etc/mtab for non-bind mounts (lf#2388)
    + Medium: IPaddr2: don't bring the interface down on stop (thanks to Lars Ellenberg)
    + Medium: IPsrcaddr: modify the interface route (lf#2367)
    + Medium: ldirectord: Allow multiple email addresses (LF 2168)
    + Medium: ldirectord: fix setting defaults for configfile and ldirectord (lf#2328)
    + Medium: meta-data: improve timeouts in most resource agents
    + Medium: nfsserver: use default values (lf#2321)
    + Medium: ocf-shellfuncs: don't log but print to stderr if connected to a terminal
    + Medium: ocf-shellfuncs: don't output to stderr if using syslog
    + Medium: oracle/oralsnr: improve exit codes if the environment isn't valid
    + Medium: RA: iSCSILogicalUnit: fix monitor for STGT
    + Medium: RA: make sure that OCF_RESKEY_CRM_meta_interval is always defined (LF 2284)
    + Medium: RA: ManageRAID: require bash
    + Medium: RA: ManageRAID: require bash
    + Medium: RA: VirtualDomain: bail out early if config file can't be read during probe (Novell 593988)
    + Medium: RA: VirtualDomain: fix incorrect use of __OCF_ACTION
    + Medium: RA: VirtualDomain: improve error messages
    + Medium: RA: VirtualDomain: spin on define until we definitely have a domain name
    + Medium: Route: add route table parameter (lf#2335)
    + Medium: sfex: don't use pid file (lf#2363,bnc#585416)
    + Medium: sfex: exit with success on stop if sfex has never been started (bnc#585416)


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.12-2
changelog:
  - Drop Requires on xfsprogs since package moved to another channel
    Resolves: rhbz#593433
  - Fix HALVM: lvm agent incorrectly reports vg is in volume_list
    (halvm_lvm_agent_incorrectly_reports_vg_in_volume_list.patch)
    Resolves: rhvz#593108


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.12-4
changelog:
  - Add missing man pages
    (Add Source2: ocf-tester.8 and Source3: sfex_init.8)
    Resolves: rhbz#594332


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.12-5
changelog:
  - Fix incorrect default for VM.sh agent
    (resolve_incorrect_default_for_vm_agent.patch)
    Resolves: rhbz#599643


author: Lon Hohberger <lhh@redhat.com> - 3.0.12-6
changelog:
  - Add missing documentation for resource agents
    (add_missing_resource_docs.patch)
  - Clean up recursion in scheman output and documentation
    (clean_up_recursion_and_documentation.patch)
    Resolves: rhbz#606470


author: Lon Hohberger <lhh@redhat.com> - 3.0.12-7
changelog:
  - Make vm.sh honor start and stop timeouts
    (Make_vm.sh_use_stop_start_timeouts.patch)
    Resolves: rhbz#606754


author: Lon Hohberger <lhh@redhat.com> - 3.0.12-8
changelog:
  - Make fs-lib resolve links before checking for block devices
    (fix_incorrect_link_resolution_in_fs_lib.patch)
    Resolves: rhbz#609579


author: Lon Hohberger <lhh@redhat.com> - 3.0.12-9
changelog:
  - Add NFSv4 server support
    (add_nfsv4_support.patch)
    (install_nfsv4_agent.patch)
    Resolves: rhbz#595547
  - Fix migration mapping behavior
    (fix_migration_mapping_behavior.patch)
    Resolves: rhbz#596918


author: Lon Hohberger <lhh@redhat.com> - 3.0.12-10
changelog:
  - Fix changelog for 3.0.12-9 date
  - Add RHEVM status program
    (add_rhevm_status_program.patch)
    Resolves: rhbz#609497


author: Marek Grac <mgrac@redhat.com> - 3.0.12-12
changelog:
  - postgres RA will fail to stop gracefully if there 
    is active client connected
    (sigquit_if_sigterm_was_not_fast_enough.patch)
    Resolves: rhbz#612165
  - new RA for tomcat6
    (resource_agent_tomcat-6.patch)
    (tomcat-6_change_build_system.patch)
    Resolves: rhbz#593721


author: Lon Hohberger <lhh@redhat.com> - 3.0.12-13
changelog:
  - Allow other values for "yes" in fs-lib when unmounting
    file systems
    (fs-lib_allow_other_values_for_yes.patch)
    Resolves: rhbz#614421


author: Lon Hohberger <lhh@redhat.com> - 3.0.12-14
changelog:
  - resource-agents: Drop tomcat-5 from build
    (drop_tomcat_5_from_build.patch)
    Resolves: rhbz#593721


author: Marek Grac <mgrac@redhat.com> - 3.0.12-15
changelog:
  - postgresql RA does not work correctly with netmask
    (psql_does_not_work_correctly_with_netmask.patch)
    Resolves: rhbz#614457


author: Lon Hohberger <lhh@redhat.com> - Version: 3.0.12-16
changelog:
  - resource-agents: fix utility to obtain data from ccs_tool
    (fix_utility_to_obtain_data_from_ccs_tool.patch)
    Resolves: rhbz#631943


author: Marek Grac <mgrac@redhat.com> - 3.0.12-17
changelog:
  - fix resource agent for named
    (resource-agents-fix-resource-agent-for-named.patch)
    Resolves: rhbz#648897


author: Marek Grac <mgrac@redhat.com> - 3.0.12-18
changelog:
  - Disable updates to static routes by RHCS IP tooling
    (resource-agents-Add-option-disable_rdisc-to-ip.sh.patch)
    Resolves: rhbz#621538


author: Lon Hohberger <lhh@redhat.com> - 3.0.12-19
changelog:
  - resource-agents: Add multi-instance Oracle database agents
    (add_multi_instance_oracle_database_agents.patch)
    Resolves: rhbz#629275
  - resource-agents: Stop using '-' as 1st char of log messages
    (stop_using_as_1st_char_of_log_messages.patch)
    Resolves: rhbz#633856
  - resource-agents: Use literal quotes for tr calls
    (use_literal_quotes_for_tr_calls.patch)
    Resolves: rhbz#639252
  - resource-agents: Fix migrateuriopt setting
    (fix_migrateuriopt_setting.patch)
    Resolves: rhbz#660337
  - resource-agents: Support convalesce w/ central_processing
    (support_convalesce_w_central_processing.patch)
    rgmanager: Add failure tolerances to resources.rng
    (add_failure_tolerances_to_resources_rng.patch)
    Resolves: rhbz#674710


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.12-20
changelog:
  - resource-agents: fs-lib: fix do_monitor device mapping
    (fs_lib_fix_do_monitor_device_mapping.patch)
    Resolves: rhbz#669832


author: Lon Hohberger <lhh@redhat.com> - Version: 3.0.12-21
changelog:
  - Mirror dev failure in HA LVM can cause service failur
    (fix_bug_683213_mirror_dev_failure_in_ha_lvm_can_cause_service_failure.patch)
    Resolves: rhbz#683213


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.12.1-1
changelog:
  - Rebase package on top of new upstream:
    resource-agents: Improve LD_LIBRARY_PATH handling by SAP*
    resource-agents: Add resource type to logging
    oracledb.sh resource script should attempt a clean shutdown first
    resource-agent does not remove nfs service temp dirs when using nfslock=1
    Listen line in generated httpd.conf incorrect
    Include rhev-check upstream
  - spec file update:
    * drop all patches
    * resync with upstream spec file. See top section for local deltas
    Resolves: rhbz#707127, rhbz#705763, rhbz#667217
  - Move rgmanager S/Lang from resource-agents to rgmanager:
    * Add versioned Conflicts on rgmanager to avoid file conflicts
    Resolves: rhbz#693518


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.9.2-1
changelog:
  - Rebase package on top of new upstream
    * ship xsl and rng files required to build relaxng schema
    * drop local copy of sfex_init.8
    * drop bz711852-Fix-ASEHAagent-to-allow-for-multiple-ASEHA-agents-on.patch
      included upstream
  - spec file update:
    add %post to generate new relaxng schema
    Resolves: rhbz#707127


author: Chris Feist <cfeist@redhat.com> - 3.9.2-2
changelog:
  - Postgres-8 resource agent now properly detects if postgresql was started
  - fs.sh resource agent now returns the proper response code when a device
    does not yet exist.
  - Resolves: rhbz#709400 rhbz#694816


author: Chris Feist <cfeist@redhat.com> - 3.9.2-3
changelog:
  - Main rgmanager resource agents now use proper return codes for use with
    pacemaker.
  - NFS mounts now unmount faster when the network is lost.
  - Resolves: rhbz#678497 rhbz#727643


author: Chris Feist <cfeist@redhat.com> - 3.9.2-4
changelog:
  - Create a link for the modified dtd for rgmanager
  - Fix ocf-tester so rgmanager agents requiring bash don't cause syntax errors
  - Resolves: rhbz#727643


author: Chris Feist <cfeist@redhat.com> - 3.9.2-9
changelog:
  - More SAPDatabase updates to fix SAP workloads
  - Allow rgmanager SAP resource agent to manage SAP Webdispatcher & TREX
  - Resolves: rhbz#726500 rhbz#746996


author: Chris Feist <cfeist@redhat.com> - 3.9.2-10
changelog:
  - Fix to prevent /dev/shm being filled up by ocf_log debug messages
  - NFS client resource are now recovered properly when they are missing in
    /var/lib/nfs/etab
  - Resolves: rhbz#797922 rhbz#749713


author: Chris Feist <cfeist@redhat.com> - 3.9.2-11
changelog:
  - In LVM HA agent, remove missing PVs before attempting to remove the tag
  - Rgmanager now properly detects when clvmd is not running when using HA LVM
  - vm.sh now supports a 'tunnelled' option
  - Resource agent script now have common directory set properly
  - Fixed apache resource agent configuration with IPv6
  - fs-lib.sh now will now properly work with all return codes of mount
  - netfs now allows you to have the same NFS export mounted in different locations
  - The timeout in rhev-check has been increased to 90 seconds
  - Resolves: rhbz#772773 rhbz#729481 rhbz#712174 rhbz#784357 rhbz#742859 rhbz#728086 rhbz#799998 rhbz#727546


author: Chris Feist <cfeist@redhat.com> - 3.9.2-12
changelog:
  - Fix for LVM HA agent for service relocation after leg failure (we now
    properly remove tag).
  - Resolves: rhbz#772773


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.9.2-13
changelog:
  - Add nfsrestart option to fs and clustefs agents as last resource to umount the filesystem
  - Resolves: rhbz#822053


author: Chris Feist <cfeist@redhat.com> - 3.9.2-14
changelog:
  - Fixed issue causing fs.sh to fail when a device is still mounted
  - Fixed random servie failures when starting multiple HA LVM services
  - Tomcat resource now uses the proper defaults
  - The pacemaker SAPInstance and SAPDatabase resources were updated to their
    latest version
  - Updated lvm resource agent to not produce errors when used with pacemaker
  - oracledb.sh script now properly checks the status of the Oracle database
  - HA-LVM now supports RAID logical volumes
  - ip.sh now properly assignes the ip address to the correct interface on
    hosts with multiple interfaces on the same network
  - Stopping a filesystem when a device doesn't exist no longer results in
    failure
  - Log output from the 'status' action from netfs is now properly logged
  - In HA LVM clusters using tags, changing the lvm.conf file is now possible
  - Using rg_test with HA LVM resources no longer results in a
    "too many arguments" error 
  - Resolves: rhbz#728365 rhbz#714156 rhbz#853249 rhbz#843049 rhbz#817550 rhbz#729812 rhbz#839181 rhbz#824153 rhbz#822244 rhbz#860328 rhbz#847335 rhbz#834293


author: Chris Feist <cfeist@redhat.com> - 3.9.2-15
changelog:
  - Fixes issue with rgmanager not recognizing a mounted cifs share due to
    trailing slashes
  - Resolves: rhbz#848642


author: Chris Feist <cfeist@redhat.com> - 3.9.2-16
changelog:
  - Add support for 'volume group per service HA-LVM support for RAID logical
    volumes'
  - Resolves: rhbz#824153


author: Chris Feist <cfeist@redhat.com> - 3.9.2-17
changelog:
  - HA LVM is now able to properly shutdown when device failures cause LVs
    to go missing which allows the service to migrate to another machine
  - Resolves: rhbz#860981


author: Chris Feist <cfeist@redhat.com> - 3.9.2-19
changelog:
  - Better error messages for the script resource have been added to aid
    debugging
  - Resolves: rhbz#773478


author: Chris Feist <cfeist@redhat.com> - 3.9.2-20
changelog:
  - Update the rgmanager SAPInstance agent so resource limits configured in
    /usr/sap/services are properly applied.
  - Resolves: rhbz#869695


author: Chris Feist <cfeist@redhat.com> - 3.9.2-21
changelog:
  - Fixed missing '$' in lvm_by_vg.sh script
  - Retry VG shutdown to cope with udev collisions
  - Resolves: rhbz#729812


author: David Vossel <dvossel@redhat.com> - 3.9.2-25
changelog:
  - fast filesystem mounts
  - properly handle NFS v4 mounts
  - fix uppercase ipv6 addresses
  - named transfer source options
  - fix restart postgres
  - fix honor self fence option
  - fix mount log level
  - fix wrong selinux context for nfs directory

    Resolves: rhbz#919231
    Resolves: rhbz#851188
    Resolves: rhbz#895075
    Resolves: rhbz#711586
    Resolves: rhbz#871659
    Resolves: rhbz#908457
    Resolves: rhbz#948730
    Resolves: rhbz#959520


author: David Vossel <dvossel@redhat.com> - 3.9.2-31
changelog:
  - Fixes lvm agent unncessarily removing PVs/LVs when some
    PVs in VG fail.

    Resolves: rhbz#884326


author: David Vossel <dvossel@redhat.com> - 3.9.2-35
changelog:
  - Fixes invalid return statement in LVM retry clvmd activation
  - Adds ability to disable findmnt to avoid autofs complications
    for fs-util based rgmanager agents.

    Resolves: rhbz#974941
    Resolves: rhbz#989284


author: David Vossel <dvossel@redhat.com> - 3.9.2-37
changelog:
  - Fixes lvm metadata corruption caused when activating by lv
    using tags.

    Resolves: rhbz#1009772


author: David Vossel <dvossel@redhat.com> - 3.9.2-38
changelog:
  - Removes usage of fuser -kvm from fs-lib.sh based agents.
    This resolves issue with fuser blocking netfs mounts.
  - tomcat-6.sh, Do not fail on stop if config validation fails.
  - tomcat-6.sh, Set tomcat usr correctly.

    Resolves: rhbz#981717 
    Resolves: rhbz#983273
    Resolves: rhbz#1014298


author: David Vossel <dvossel@redhat.com> - 3.9.2-39
changelog:
  - Fixes issue with mysql agent not being able to set transient
    attributes on local node correctly.

    Resolves: rhbz#989284


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.9.2-40.2
changelog:
  - Fix netnfs unmount self_fence integration in netfs.sh
  - Ship send_ua helper binary to allow IPaddr2 to manage IPv6 addresses

    Resolves: rhbz#1027410
    Resolves: rhbz#1027412


author: David Vossel <dvossel@redhat.com> - 3.9.2-41
changelog:
  - Add no_unmount functionality back into netfs.sh agent
  - Use crm_node instead of uname -n when referencing cluster nodes.
  - Adds Delay agent back into package.
  - Drops nginx rsyslog mysql-proxy tomcat and slapd agents.

    Resolves: rhbz#993329
    Resolves: rhbz#1023340
    Resolves: rhbz#1028421
    Resolves: rhbz#1022793


author: David Vossel <dvossel@redhat.com> - 3.9.2-42
changelog:
  - High: fs-lib.sh: Fixes failure to unmount local fs
    when process runs with cwd inside fs mount.

    Resolves: rhbz#1051115


author: David Vossel <dvossel@redhat.com> - 3.9.2-44
changelog:
  - New 'httpd' option for rgmanager apache.sh agent that allows
    custom httpd binary path to be set.
  - Fixes issue with pending sm-notify processes preventing
    nfs-server instances from stopping.
  - Fixes issue reported by coverity. 
  - Fixes syntax error in some log error messages in the LVM agent
  - Optimize fs-lib based agent's monitor operation
  - Allow monitoring of kvm based virtual machines using the
    VirtualDomain agent without requiring libvirtd.
  - Allows named to run as user other than root.

    Resolves: rhbz#952132
    Resolves: rhbz#974239
    Resolves: rhbz#999537
    Resolves: rhbz#1022277
    Resolves: rhbz#1023099
    Resolves: rhbz#1054327
    Resolves: rhbz#1067023


author: David Vossel <dvossel@redhat.com> - 3.9.2-46
changelog:
  - Updates the ocf:heartbeat:tomcat agent so it can be used
    in rhel6 with Pacemaker.

    Resolves: rhbz#1022792


author: David Vossel <dvossel@redhat.com> - 3.9.2-47
changelog:
  - Allow vm.sh to monitor kvm domains without requiring libvirtd
  - Adds 'no_kill' option to vm.sh to prevent force killing vm
    during stop operation after timeout expires.

    Resolves: rhbz#853698
    Resolves: rhbz#1079039


author: David Vossel <dvossel@redhat.com> - 3.9.2-48
changelog:
  - Configurable startup_wait timeout for rgmanager's 
    postgres-8.sh resource-agent
  - Allow non rhel builds to included unsupported agents.
  - Add bind-mount.sh rgmanager resource-agent.
  - Add 'statdport' option to nfsserver resource.

    Resolves: rhbz#1035380
    Resolves: rhbz#1069621
    Resolves: rhbz#1094789
    Resolves: rhbz#918315


author: David Vossel <dvossel@redhat.com> - 3.9.5-1
changelog:
  - Package cleanup. This change is a no-op. The heartbeat
    agents were updated to the 3.9.5 upstream release in this
    package months ago. The release number is now being
    incremented to reflect this.

    Resolves: rhbz#993431


author: David Vossel <dvossel@redhat.com> - 3.9.5-3
changelog:
  - Fix usage of findmnt in fs-lib.sh based rgmanager agents.
  - When executing force kill of processes using a mountpoint,
    take into account those processes accessing shared memory.
  - Add force_unount=safe option to avoid blocking Filesystem
    agent during the stop operation.
  - Do not fail during stop if oracle listener is already down. 
  - Correctly detect oracledb and orainstanch.sh shutdown.
  - Remove unused patches left over from before patches were
    consolidated into the new source files.

    Resolves: rhbz#1038474
    Resolves: rhbz#1089004
    Resolves: rhbz#1095943
    Resolves: rhbz#1047999
    Resolves: rhbz#960186
    Resolves: rhbz#993431


author: David Vossel <dvossel@redhat.com> - 3.9.5-5
changelog:
  - Add support for pacemaker db2 agent
  - Fix syntax error in nfsserver.sh
  - Updates pacemaker nfs server agents. Adds support for
    nfsnotify agent.

    Resolves: rhbz#1059981
    Resolves: rhbz#1091102
    Resolves: rhbz#974239


author: David Vossel <dvossel@redhat.com> - 3.9.5-7
changelog:
  - Update force_unmount=safe option so it does not process
    duplicate process ids.

    Resolves: rhbz#1095943


author: David Vossel <dvossel@redhat.com> - 3.9.5-8
changelog:
  - Revert accidental modification of exportfs's
    unlock_on_stop option.
  - Add on/off as valid value for ip.sh monitor_link

    Resolves: rhbz#1091102
    Resolves: rhbz#1039119


author: David Vossel <dvossel@redhat.com> - 3.9.5-9
changelog:
  - When signalling pids accessing a mount_point to exit,
    make sure to only signal each pid once.

    Resolves: rhbz#1089004


author: David Vossel <dvossel@redhat.com> - 3.9.5-11
changelog:
  - Updates required, unique, and primary fields in bind-mount.sh
    metadata

    Resolves: rhbz#1094789


author: Ryan McCabe <rmccabe@redhat.com> 0.15.0-5
changelog:
  - Generate the ricci NSS certificate database at startup if it doesn't exist
  - By default, set the "propagate" attribute to true when setting a new cluster
    configuration file with "ccs_sync"


author: Ryan McCabe <rmccabe@redhat.com> 0.15.0-6
changelog:
  - When setting a cluster.conf file with ccs_sync, only try to update the cman cluster version if the node is a member of a cluster.


author: Ryan McCabe <rmccabe@redhat.com> 0.15.0-7
changelog:
  - Fix a bug that caused some connections to be dropped prematurely.
  - Add better error reporting in the "ccs_sync" tool.


author: Ryan McCabe <rmccabe@redhat.com> 0.16.0-1
changelog:
  - Update for F11
  - Fix build issues uncovered by g++ 4.4
  - Remove legacy RHEL4 and RHEL5-specific code.


author: Ryan McCabe <rmccabe@redhat.com> 0.16.0-2
changelog:
  - Fix memory corruption bug.
  - Update package and service list.
  - Add missing dependency for nss-tools


author: Ryan McCabe <rmccabe@redhat.com> - 0.16.1-6
changelog:
  - Add a ricci function to set the cluster version, as it's no longer done
    while syncing the configuration files via ccs_sync.


author: Chris Feist <cfeist@redhat.com> - 0.16.2-3
changelog:
  - An issue with calling 'virsh nodelist' would cause ricci to hang for
    30 seconds during most requests resulting in timeouts to the web interface.
  - Resolves: rhbz#580575


author: Chris Feist <cfeist@redhat.com> - 0.16.2-6
changelog:
  - Init script now complies more closely with Fedora Guidelines
  - Passing a bad node to ccs_sync no longer results in a segfault
  - Resolves: rhbz#585126 rhbz#587526


author: Chris Feist <cfeist@redhat.com> - 0.16.2-27
changelog:
  - More fixes for ccs
  - Ricci no longer sends non-SSL over an SSL connection
  - Resolves: rhbz#652837 rhbz#614647


author: Chris Feist <cfeist@redhat.com> - 0.16.2-30
changelog:
  - Added ability to configure unfence section in ccs
  - Fixed --setmulticast to properly remove multicast settings
  - Resolves: rhbz#683192 rhbz#681646


author: Chris Feist <cfeist@redhat.com> - 0.16.2-32
changelog:
  - Add validation logic when first looking at the config file and after
    changing it
  - Resolves: rhbz#682868


author: Chris Feist <cfeist@redhat.com> - 0.16.2-34
changelog:
  - Fixed several minor documentation issues
  - Fixed --status errors
  - Fixed missing --debug option
  - Fixed traceback when using --help as an argument
  - Related: rhbz#682868


author: Chris Feist <cfeist@redhat.com> - 0.16.2-48
changelog:
  - Added ipv6 support (#724014)
  - Providing a useful error when passed a bad cluster.conf (#731113)
  - --checkconf on a local file now works (#738567)
  - Fixed issue with ccs backtrace with bad response (#721113)
  - Error gracefully when given a directory with '-f' (#734910)
  - Updated usage and man page for --start/--stop (#729168)
  - Show virtual machines when using --lsservices (#770637)
  - Added --getschema command and use remote schema for validation (#726722)
  - Log exec path and arguments when fork()/execv()ing in ricci and modcluster
  - Fixed ccs_sync to build with '-g' option.
  - If ricci user password isn't set, log a warning message
  - ccs_sync now returns 1 when there is an error syncing the file
  - Prevent deadlock when executing external programs such as yum
  - Resolves: rhbz#724014 rhbz#731113 rhbz#738567 rhbz#721113 rhbz#734910 rhbz#729168 rhbz#770637 rhbz#726722 rhbz#738797 rhbz#729011 rhbz#773383 rhbz#738008 rhbz#rhbz#736795


author: Chris Feist <cfeist@redhat.com> - 0.16.2-53
changelog:
  - --createcluster now verifies that a cluster.conf doesn't already exist.
  - Added support for altname & altmulticast to support RRP
  - Resolves: rhbz#797292 rhbz#758823


author: Chris Feist <cfeist@redhat.com> - 0.16.2-54
changelog:
  - Fix issue with non english languages with ricci detecting if a passwd
    is set
  - Resolves: rhbz#773383


author: Chris Feist <cfeist@redhat.com> - 0.16.2-56
changelog:
  - Fixed traceback when using ccs --stopall
  - Fixed return codes from ccs_sync
  - Fixed listing altmulticast with ccs --lsmisc
  - Ricci & ccs_sync should no longer crash when trying to update a cluster.conf 
    file that is too large 
  - Resolves: rhbz#811702 rhbz#841288 rhbz#839039 rhbz#815752 rhbz#818335


author: Chris Feist <cfeist@redhat.com> - 0.16.2-57
changelog:
  - Updated --addresource to properly add resources when rm section is missing
  - Fixed redirect which wouldn't allow creation of keys in a read-only folder
  - Resolves: rhbz#867019 rhbz#866894


author: Chris Feist <cfeist@redhat.com> - 0.16.2-60
changelog:
  - Fix issue causing conga to be unable to find/install packages due to line
    breaks in yum output
  - Resolves: rhbz#842939


author: Chris Feist <cfeist@redhat.com> - 0.16.2-63
changelog:
  - Synced cluster schema with latest cman, resource-agents, fence-agents
    fence-sanlock & fence_virt
  - Resolves: rhbz#878108


author: Chris Feist <cfeist@redhat.com> - 0.16.2-64
changelog:
  - Automatically add unfencing section when adding scsi fence agents
  - Prevent ccs_sync from segfaulting when multiple hostnames were provided
  - ccs --lsmisc now shows fence_daemon options
  - ccs --lsresourceopts has been added as an alias to --lsserviceopts
  - Resolves: rhbz#853890 rhbz#877863 rhbz#893574 rhbz#918555


author: Chris Feist <cfeist@redhat.com> - 0.16.2-70
changelog:
  - Added ability to create/remove uidgid entries for corosync in cluster.conf
  - Resolves: rhbz#1025053


author: Chris Feist <cfeist@redhat.com> - 0.16.2-71
changelog:
  - Added --noenable/--nodisable options when starting/stoping cluster
  - Only propagate/activate cluster on last node when using --activate
  - ccs no longer returns 0 when --startall/--stopall fails on a node
  - If not hostname or filename is specified, use 'localhost'
  - Don't leave tempfiles around from schema tests
  - Resolves: rhbz#1090642 rhbz#917809 rhbz#1062402 rhbz#1024962 rhbz#996196


author: Chris Feist <cfeist@redhat.com> - 0.16.2-72
changelog:
  - Added '-s' option to disable SSLv2 connections to ricci
  - Added ability to configure RICCIOPTS variable in /etc/sysconfig/cluster
    or /etc/sysconfig/ricci
  - Resolves: rhbz#1075176


author: Jan Pokorny <jpokorny@redhat.com> - 0.16.2-73
changelog:
  - ricci: fix end-use modules do not handle stdin polling correctly
  - ricci: fix missing deployment-time dependencies
  - ricci: prevent possible reboot loop
  - Resolves: rhbz#1076713 rhbz#1106842 rhbz#1044122


author: Jan Pokorny <jpokorny@redhat.com> - 0.16.2-74
changelog:
  - ccs: sync cluster.rng schema with latest updates from cluster packages
  - ricci: enhance possible reboot loop prevention (avoid stale batches)
  - Resolves: rhbz#1055424 rhbz#1044122


author: Jan Pokorny <jpokorny@redhat.com> - 0.16.2-75
changelog:
  - ccs: sync cluster.rng schema with latest updates from cluster packages
    (last-minute revamp)
  - Resolves: rhbz#1055424


author: Jan Pokorný <jpokorny@redhat.com> - 0.16.2-75.1
changelog:
  - ricci: fix modules cannot return values due to bug in Module::empty_response
           (introduced with rhbz#1044122 fix)
  - Resolves: rhbz#1199561 (Z-stream of 1187745)


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - adjust for rpmdb index name change
  - drop unnecessary vendor-macro patch for real
  - add ISA-dependencies among rpm subpackages
  - make lzma and sqlite deps conditional and disabled by default for now


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - rpm 4.5.90-0.git8424.1 (alpha snapshot)
  - adjust to build against Berkeley DB 4.5.20 from compat-db for now
  - add posttrans to clean up db environment mismatch after upgrade
  - forward-port devel autodeps patch


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - 4.5.90-0.git8426.5
  - flip back to external bdb
  - fix tab vs spaces complaints from rpmlint
  - add dep for lzma and require unzip instead of zip in build (#310694)
  - add pkgconfig dependency to rpm-devel
  - drop ISA-dependencies for initial introduction
  - new snapshot from upstream for documentation fixes


author: Florian Festi <ffesti@redhat.com>
changelog:
  - 4.5.90-0.git8426.10
  - rpm-4.5.90-posttrans.patch
  - use header from rpmdb in posttrans to make anaconda happy


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - 4.5.90-0.git8461.1
  - new snapshot from upstream
  - fixes #68290, #455972, #446202, #453364, #456708, #456103, #456321, #456913,
    - partial fix for #457360


author: Jindrich Novy <jnovy@redhat.com>
changelog:
  - add support for noarch subpackages
  - fix segfault in case of insufficient disk space detected (#460146)


author: Jindrich Novy <jnovy@redhat.com>
changelog:
  - fix parsing of boolean expressions in spec (#456103)
    (unbreaks pam, jpilot and maybe other builds)


author: Jindrich Novy <jnovy@redhat.com>
changelog:
  - create directory structure for rpmbuild prior to build if it doesn't exist (#455387)
  - create _topdir if it doesn't exist when installing SRPM
  - don't generate broken cpio in case of hardlink pointing on softlink,
    thanks to pixel@mandriva.com


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - add hack to support extracting gstreamer plugin provides (#438225)
  - fix another macro argument handling regression (#461180)


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - update to official 4.5.90 alpha tarball 
  - a big pile of misc bugfixes + translation updates
  - isa-macro generation fix for ppc (#464754)
  - avoid pulling in pile of perl dependencies for an unused script
  - handle both "invalid argument" and clear env version mismatch on posttrans


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - update to 4.6.0-rc1 
  - fixes #465586, #466597, #465409, #216221, #466503, #466009, #463447...
  - avoid using %configure macro for now, it has unwanted side-effects on rpm


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - Make noarch sub-packages actually work
  - Fix defaultdocdir logic in installplatform to avoid hardwiring mandir


author: Panu Matilainen <pmatilai@redhat.com>
changelog:
  - update to 4.6.0-rc2
  - fixes #471820, #473167, #469355, #468319, #472507, #247374, #426672, #444661
  - enable automatic generation of pkg-config and libtool dependencies #465377


author: Panu Matilainen <pmatilai@redhat.com> - 4.6.0-0.rc4.2
changelog:
  - change platform sharedstatedir to something more sensible (#185862)
  - add rpmdb_foo links to db utils for documentation compatibility


author: Panu Matilainen <pmatilai@redhat.com> - 4.6.0-0.rc4.3
changelog:
  - extract mimehandler provides from .desktop files
  - preliminaries for extracting font provides (not enabled yet)
  - dont classify font metrics data as fonts
  - only run script dep extraction once per file, duh


author: Panu Matilainen <pmatilai@redhat.com> - 4.6.0-1
changelog:
  - update to 4.6.0 final
  - revert libmagic looking into compressed files for now, breaks ooffice build


author: Jindrich Novy <jnovy@redhat.com> - 4.6.0-4
changelog:
  - inherit group tag from the main package (#470714)
  - ignore BuildArch tags for anyarch actions (#442105)
  - don't check package BuildRequires when doing --rmsource (#452477)
  - don't fail because of missing sources when only spec removal
    is requested (#472427)


author: Jindrich Novy <jnovy@redhat.com> - 4.6.0-5
changelog:
  - remove two offending hunks from anyarch patch causing that
    RPMTAG_BUILDARCHS isn't written to SRPMs


author: Panu Matilainen <pmatilai@redhat.com> - 4.6.0-7
changelog:
  - loosen up restrictions on dependency names (#455119)
  - handle inter-dependent pkg-config files for requires too (#473814)
  - error/warn on elf binaries in noarch package in build


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-0.beta1.9
changelog:
  - fix recorded file state of otherwise skipped files (#492947)
  - compress ChangeLog, drop old CHANGES file (#492440)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-1
changelog:
  - update to 4.7.0 final (http://rpm.org/wiki/Releases/4.7.0)
  - fixes #494049, #495429
  - dont permit test-suite failure anymore


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-2
changelog:
  - file classification tweaks for text files (#494817)
    - disable libmagic text token checks, it's way too error-prone
    - consistently classify all text as such and include description


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-3
changelog:
  - couple of merge-review fixes (#226377)
    - eliminate bogus leftover rpm:rpm rpmdb ownership
    - unescaped macro in changelog
  - fix find-lang --with-kde with KDE3 (#466009)
  - switch back to default file digest algorithm


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-4
changelog:
  - split cron-job into a sub-package to avoid silly deps on core rpm (#500722)
  - rpm requires coreutils but not in %post
  - build with libcap and libacl
  - fix pgp pubkey signature tag parsing


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-5
changelog:
  - don't mess up problem altNEVR in python ts.check() (#501068)
  - fix hardlink size calculation on build (#503020)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.0-8
changelog:
  - updated OSGi dependency extractor (#506471)
  - fix segfault in symlink fingerprinting (#505777)
  - fix invalid memory access causing bogus file dependency errors (#506323)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.1-5
changelog:
  - fix duplicate dependency filtering on build (#490378)
  - permit absolute paths in file lists again (#521760)
  - use permissions 444 for all .debug files (#522194)
  - add support for optional bugurl tag (#512774)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.1-6
changelog:
  - use relative paths within db environment (related to #507309, #507309...)
  - remove db environment on close in chrooted operation (related to above)
  - initialize rpmlib earlier in rpm2cpio (#523260)
  - fix file dependency tag extension formatting (#523282)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.1-7
changelog:
  - fix build with BDB 4.8.x by removing XA "support" from BDB backend 
  - perl dep extractor heredoc parsing improvements (#524929)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.1-8
changelog:
  - support multiple python implementations in brp-python-bytecompile (#531117)
  - make disk space problem reporting a bit saner (#517418)


author: Panu Matilainen <pmatilai@redhat.com> - 4.7.2-2
changelog:
  - missing error exit code from signing password checking (#496754)
  - dont fail build on unrecognized data files (#532489)
  - dont try to parse subkeys and secret keys (#436812)
  - fix chmod test on selinux, breaking %{_fixperms} macro (#543035)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-0.beta1.1
changelog:
  - update to 4.8.0-beta1 (http://rpm.org/wiki/Releases/4.8.0)
  - rpm-build conflicts with current ocaml-runtime


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-0.beta1.2
changelog:
  - fix noise from python bytecompile on non-python packages (#539635)
  - make all our -devel [build]requires isa-specific
  - trim out superfluous -devel dependencies from rpm-devel


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-5
changelog:
  - fix segfault on failed url retrieval (#557118)
  - fix verification error code depending on verbosity level (#557101)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-6
changelog:
  - Permit em64t architecture in query/erasure too (#547341)
  - Avoid accessing unrelated mount points in disk space checking (#495623)
  - Fix disk space reporting with erasures present in transaction (#561160)
  - Teach python bindings about RPMTRANS_FLAG_NOCONTEXTS (related to #573111)
  - Fix python match iterator regression wrt boolean representation
  - Support parallel python versions in python dependency extractor (#532118)
  - Python byte-compilation fixes + improvements (#538101)
  - Preserve empty lines in spec prep section (#573339)
  - Fix nosrc package generation regression
  - Avoid owning localized man directories through find_lang (#569536)
  - Lose useless symlink to berkeley_db_svc


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-9
changelog:
  - Handle non-existent dependency sets correctly in python (#593621)
  - Permit DOS-style line-endings in PGP armor headers (#532992)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-10
changelog:
  - Fix empty reply from server on url retrieve (#598988)
  - Drop suid/sgid bits and capabilities on upgrade/erase (#598832)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-13
changelog:
  - Require matching arch for freshen on colored transactions (#553108, #479608)
  - Verify that generated signature can be used by rpm (#608599)
  - Fix broken pipe on font provide generation + better error message (#609117)
  - Fix find-debuginfo.sh behavior on cross-directory hardlinks (#618428)
  - Generate gdb index for debuginfos (#652787)
  - Fix verifyscript return code on failure (#668629)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-14
changelog:
  - Fix signature comparison on package resigning (#608608)
  - Let error messages from gpg through on passphrase checking (#607222)
  - Only enforce default umask during transaction (#565843)


author: Florian Festi <ffesti@redhat.com> - 4.8.0-17
changelog:
  - Allow self conflicts (#651951)
  - Add support for xz compression in rpm2cpio.sh (#674348)
  - Don't error out on already imported GPG keys (#680889)
  - Fix file conflict handling for uncolored files (#705115)
  - Fix file attribute handling with %defattr(-) (#705993)
  - Don't error out when trying to add the same signature again (#707449)
  - Fix signature checking (#721363)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-20
changelog:
  - -D is for --define, not --predefine (#785236)
  - Add runtime detection for /usr move (#761000)
  - Fix brace matching on multiline constructs in perl.req (#752119)
  - Make pretrans scriptlet failure fail the package installation (#736960)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-22
changelog:
  - Proper region tag validation on package/header read (CVE-2012-0060)
  - Double-check region size against header size (CVE-2012-0061)
  - Validate negated offsets too in headerVerifyInfo() (CVE-2012-0815)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-25
changelog:
  - Fix Lua script current directory behavior (#746190)
  - Copy rpmpkgs "log" into place instead of moving (#746637)


author: Florian Festi <ffesti@redhat.com> - 4.8.0-28
changelog:
  - Handle identical binaries for debug-info (#727872)
  - Fix typos in Japanese rpm man page (#845065)
  - Document -D and -E options in man page (#845063)
  - Add --setperms and --setuids to the man page (#839126)
  - Update man page that SHA256 is also used for file digest (#804049)
  - Remove --fileid from man page to get rid of md5
  - Remove -s from patch calls (#773503)
  - Force _host_vendor to redhat to better match toolchain (#743229)
  - Backport reloadConfig for Python API (#825147)
  - Support for dpkg-style sorting of tilde in version/release (#825087)
  - Fix explicit directory %attr() when %defattr() is active (#730473)
  - Don't load keyring if signature checking is disabled (#664696)
  - Retry read() to fix rpm2cpio with pipe as stdin (#802839)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-33
changelog:
  - Fix build-time double-free on file capability processing (#904818)
  - Fix include-directive getting processed on false branch (#920190)


author: Florian Festi <ffesti@redhat.com> - 4.8.0-38
changelog:
  - Fix race condidition where unchecked data is exposed in the file system
    (CVE-2013-6435)(#1163059)


author: Peter Vrabec <pvrabec@redhat.com> 1.17.1-1
changelog:
  - upstream bug fix release
  - include html docs (#248712)
  - make "-r" option compatible with sysklogd config (248982)


author: Tomas Heinrich <theinric@redhat.com> 3.21.3-3
changelog:
  - fix a wrong module name in the rsyslog.conf manual page (#455086)
  - expand the rsyslog.conf manual page (#456030)


author: Peter Vrabec <pvrabec@redhat.com> 3.21.3-4
changelog:
  - use RPM_OPT_FLAGS
  - use same pid file and logrotate file as syslog-ng (#441664)
  - mark config files as noreplace (#428155)


author: Tomas Heinrich <theinric@redhat.com> - 4.4.2-1
changelog:
  - upgrade to new upstream stable version 4.4.2
    Resolves: #554998
  - add support for arbitrary number of open file descriptors
  - run libtoolize to avoid errors due mismatching libtool version
  - change exec-prefix to /


author: Tomas Heinrich <theinric@redhat.com> - 4.4.2-3
changelog:
  - remove '_smp_mflags' make argument as it seems to be
    producing corrupted builds
    Resolves: #556522


author: Tomas Heinrich <theinric@redhat.com> 4.6.2-1
changelog:
  - upgrade to new upstream stable version 4.6.2
    Resolves: #554998
  - correct the default value of the OMFileFlushOnTXEnd directive
  - add upstream fix for message-induced off-by-one error
  - change the default value of the HUPisRestart directive to enabled
  - remove autoconf, automake, libtool from BuildRequires
  - change exec-prefix to nil
  - redefine _libdir as it doesn't use _exec_prefix
    Resolves: #591860


author: Tomas Heinrich <theinric@redhat.com> 4.6.2-2
changelog:
  - Fix a potential segfault upon SIGHUP induced restart
    Resolves: #598421
  - Add Obsoletes: sysklogd
    Resolves: #513277


author: Tomas Heinrich <theinric@redhat.com> 4.6.2-3
changelog:
  - build rsyslog with PIE and RELRO
    Resolves: #642994
  - add ChangeLog file to documentation
  - add /etc/pki/rsyslog directory


author: Tomas Heinrich <theinric@redhat.com> 4.6.2-5
changelog:
  - provide omsnmp module in rsyslog-snmp subpackage
    Resolves: #618488
  - modify logrotate configuration to omit boot.log
    Resolves: #683537
  - use correct lock file name
    Resolves: #698705
  - provide ommail module
    Resolves: #702314


author: Tomas Heinrich <theinric@redhat.com> 4.6.2-7
changelog:
  - add patch to correct the behavior of the ActionExecOnlyOnceEveryInterval
    configuration directive
    Resolves: #727208


author: Tomas Heinrich <theinric@redhat.com> 4.6.2-8
changelog:
  - workaround the mysql_conf multilib issue by directly using
    the arch-specific script
    Resolves: #694414


author: Tomas Heinrich <theinric@redhat.com> 4.6.2-11
changelog:
  - provide configuration directive for sysklogd message format compatibility
  - provide log format template for sysklogd message format compatibility
    Resolves: #737096


author: Tomas Heinrich <theinric@redhat.com> 5.8.7-1
changelog:
  - rebase to rsyslog-5.8.7
    - change license from 'GPLv3+' to '(GPLv3+ and ASL 2.0)'
      http://blog.gerhards.net/2012/01/rsyslog-licensing-update.html
    - remove patches obsoleted by rebase
    - add patches for better sysklogd compatibility (taken from upstream)
    - update included files for the new major version
    Resolves: #672182
    Resolves: #727380
    Resolves: #756664
    Resolves: #767527
    Resolves: #769025
  - add several directories for storing auxiliary data
    Resolves: #740420
  - fix source package URL


author: Tomas Heinrich <theinric@redhat.com> 5.8.10-1
changelog:
  - rebase to rsyslog 5.8.10
    Resolves: #803550
    Resolves: #805424
    Resolves: #813079
    Resolves: #813084
  - consider lock file in 'status' action
    Resolves: #807608
  - add impstats and imptcp modules
  - include new license text files
  - specify which versions of sysklogd are obsoleted


author: Tomas Heinrich <theinric@redhat.com> 5.8.10-2
changelog:
  - add patch to update information on debugging in the man page
    Resolves: #820311
  - add patch to prevent debug output to stdout after forking
    Resolves: #820996
  - add patch to support ssl certificates with domain names longer than 128 chars
    Resolves: #822118


author: Tomas Heinrich <theinric@redhat.com> 5.8.10-5
changelog:
  - add a patch to permit RFC3339 timestamps in messages comming from
    the local log socket, patch taken from upstream - commit:
    bfae69d68b0032a383821a54bc52aeff36a90e52
    Resolves: #886004


author: Tomas Heinrich <theinric@redhat.com> 5.8.10-6
changelog:
  - the previous patch to enable RFC3339 timestamps revealed a bug
    in the upstream code - adding another patch
    Resolves: #886004


author: Tomas Heinrich <theinric@redhat.com> 5.8.10-7
changelog:
  - add a patch to support large groups in the $FileGroup directive
    resolves: #924754
  - add a patch to fix 'pri-text' property format
    resolves: #951727
  - add a patch to fix the behavior of the *QueueMaxFileSize directives
    resolves: #963942


author: Tomas Heinrich <theinric@redhat.com> 5.8.10-8
changelog:
  - drop patch 5 which introduced a regression
    resolves: #927405
    reverts: #847568
  - add a patch to prevent 'RepeatedMsgReduction' causing missing hostnames
    resolves: #893197
  - add a patch to enable specifying UID/GID as a number
    resolves: #886117
  - add a patch to prevent a segfault in gssapi
    resolves: #862517


author: Tomas Heinrich <theinric@redhat.com> 5.8.10-10.el6_6
changelog:
  - add a patch to fix a segfault in the regex module
    resolves: #1172165
  - explicitly disable systemd service file generation
  - turn on verbose make output


author: Tomas Heinrich <theinric@redhat.com> 7.4.10-1
changelog:
  - initial import of rsyslog7
    changes since rsyslog-5.8.10-8:
    - rebase to 7.4.10
    - drop patches merged upstream
    - regenerate patches for rhbz820311, rhbz886117
    - add a patch to remove dependency on liblogging-stdlog
    - add a patch to fix compilation of omelasticsearch
      on platforms without atomic instructions
    - mark package as conlicting with rsyslog
    - update specification of dependencies
    - add the rsyslog-recover-qi.pl script
    - add new plugins
      imdiag, mmanon, mmjsonparse, mmsnmptrapd, omelasticsearch,
      pmaixforwardedfrom, pmcisconames, pmsnare
    - add new subpackage rsyslog-elasticsearch
    - make the build more verbose by adding 'V=1' to make
    - update conf file for new omusrmsg syntax
      for details, see http://www.rsyslog.com/doc/v6compatibility.html
    - drop default compatibility mode from SYSLOGD_OPTIONS
      for details, see http://www.rsyslog.com/doc/v6compatibility.html
    - fix typos in the spec file
    resolves: #869600


author: Tomas Heinrich <theinric@redhat.com> 7.4.10-2
changelog:
  - amend rsyslog.conf man page with information on omitting file sync
    resolves: #994127
  - add a patch to support TCP KEEPALIVE in imrelp
    resolves: #1009048
  - add a patch to fix missing note about message repetition in imuxsock
    resolves: #1020431
  - add a patch to prevent division-by-zero errors
    resolves: #996862
  - add a patch to fix the name of the PID file in man page
    resolves: #1009882
  - add a patch to remove references to Google ads from the html docs
    resolves: #1030040
  - add missing image files referenced from the html docs
    resolves: #1031673
  - add a patch to backport the mmcount module
    resolves: #1030206
  - add a patch to support arbitrary number of listeners in imuxsock
    resolves: #1096732
  - remove clean section
    resolves: #869600
  - add a list of bugs fixed by rebasing to 7.4.10
    resolves: #996857, #1007409, #1029910, #1061614, #1070689


author: Toru Hoshina <hoshina@best.com>
changelog:
  - Modified SPEC in order to install libruby.a so that it should be used by
    another ruby entention.
  - 2nd release.


author: akira yamada <akira@redhat.com>
changelog:
  - Updated to version 1.4.4(06/12/2000 CVS).
  - Added manuals and FAQs.
  - Split into ruby, ruby-devel, ruby-tcltk, ruby-docs, irb.


author: akira yamada <akira@redhat.com>
changelog:
  - Updated to version 1.4.4(06/20/2000 CVS).
  - Removed ruby-list.23190.patch(included into ruby_cvs.patch).
  - Added ruby-dev.10054.patch.


author: akira yamada <akira@redhat.com>
changelog:
  - Updated to version 1.4.4(06/22/2000 CVS).
  - Removed ruby-dev.10054.patch(included into ruby_cvs.patch).


author: akira yamada <akira@redhat.com>
changelog:
  - Updated to version 1.4.6.
  - removed ruby-dev.10123.patch(included into ruby-1.4.6).
  - Added ruby_cvs.2000082901.patch(upgraded ruby to latest cvs version).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Updated to upstream version 1.6.1.
  - Removed ruby_cvs.2000082901.patch and added ruby_cvs.2000092718.patch
    (upgraded ruby to latest cvs version).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000092718.patch and added ruby_cvs.2000100218.patch
    (upgraded ruby to latest cvs version).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000100218.patch and added ruby_cvs.2000100313.patch
    (upgraded ruby to latest cvs version).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000100313.patch and added ruby_cvs.2000100313.patch
    (upgraded ruby to latest cvs version).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000100313.patch and added ruby_cvs.2000101117.patch
    (upgraded ruby to latest cvs version).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000101117.patch and added ruby_cvs.2000101901.patch
    (upgraded ruby to latest cvs version).
  - Added ruby-dev.11262.patch.
  - Added ruby-dev.11265.patch.


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000101901.patch, added ruby_cvs.2000121413.patch
    (upgraded ruby to latest cvs version).
  - Removed ruby-dev.11262.patch, ruby-dev.11265.patch,
    and ruby-dev.11268.patch (included into above patch).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000121413.patch, added ruby_cvs.2000122019.patch
    (upgraded ruby to latest cvs version).
  - new package: libruby


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000122019.patch, added ruby_cvs.2000122215.patch
    (upgraded ruby to latest cvs version, 1.6.2-preview4).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Applied patch: upgraded to cvs version (2001-01-15):
    fixed minor bugs(e.g. ruby makes extention librares too large...).


author: akira yamada <akira@vinelinux.org>
changelog:
  - fixed bad group for libruby.
  - Applied patch: upgraded to cvs version (2001-02-08):
    fixed minor bugs.


author: Bernhard Rosenkraenzer <bero@redhat.com> 1.6.4-2
changelog:
  - Remove Japanese description and summaries; they belong in specspo and
    break rpm
  - Clean up specfile
  - Mark language specific files (README.jp) as such
  - bzip2 sources
  - rename the libruby package to ruby-libs for consistency
  - Exclude ia64 (doesn't build - the code doesn't seem to be 64-bit clean
    [has been excluded on alpha forever])


author: Akira TAGOH <tagoh@redhat.com> 1.6.6-1
changelog:
  - New upstream release.
  - Applied bug fix patches:
    - ruby-1.6.6-501-ruby-mode.patch: ruby-talk#30479: disables font-lock
      coloring.
    - ruby-1.6.6-100.patch: ruby-talk#30203: Ruby 1.6.6 bug and fix
  			  ruby-list#33047: regex bug
  			  PR#230: problem with -d in 1.6.6
  - Added ruby-mode and ruby-mode-xemacs packages.
  - Ruby works fine for ia64. so re-enable to build with ia64.
    (probably it should be worked for alpha)


author: Akira TAGOH <tagoh@redhat.com> 1.6.7-1
changelog:
  - New upstream release.
  - ruby-1.6.6-100.patch, ruby-1.6.6-501-ruby-mode.patch:
    removed. these patches no longer should be needed.
  - ruby-1.6.7-500-marshal-proc.patch: applied a fix patch.
    (ruby-dev#16178: Marshal::dump should call Proc#call.)
  - ruby-1.6.7-501-class-var.patch: applied a fix patch.
    (ruby-talk#35157: class vars broken in 1.6.7)


author: Akira TAGOH <tagoh@redhat.com> 1.6.7-2
changelog:
  - ruby-man-1.4.6-jp.tar.bz2: removed.
  - ruby-refm-rdp-1.4.7-ja-html.tar.bz2: uses it instead of.
  - ruby-1.6.7-500-marshal-proc.patch, ruby-1.6.7-501-class-var.patch:
    removed.
  - ruby-1.6.7-100.patch: applied a bug fix patch.
    (ruby-dev#16274: patch for 'wm state')
    (PR#206ja: SEGV handle EXIT)
  - ruby-1.6.7-101.patch: applied a bug fix patch.
    (ruby-list#34313: singleton should not be Marshal.dump'ed)
    (ruby-dev#16411: block local var)
  - ruby-1.6.7-102.patch: applied a bug fix patch.
    (handling multibyte chars is partially broken)
  - ruby-1.6.7-103.patch: applied a bug fix patch.
    (ruby-dev#16462: preserve reference for GC, but link should be cut)


author: Akira TAGOH <tagoh@redhat.com> 1.6.7-10
changelog:
  - moved sitedir to /usr/lib/ruby/site_ruby again according as our perl and
    python.
  - ruby-1.6.7-resolv1.patch, ruby-1.6.7-resolv2.patch: applied to fix 'Too many
    open files - "/etc/resolv.conf"' issue. (Bug#64830)


author: Akira TAGOH <tagoh@redhat.com> 1.6.7-11
changelog:
  - use %configure macro instead of configure script.
  - use the latest config.{sub,guess}.
  - get archname from rbconfig.rb for %dir
  - applied some patches from Debian:
    - 801_extmk.rb-shellwords.patch: use Shellwords
    - 801_mkmf.rb-shellwords.patch: mkmf.rb creates bad Makefile. the Makefile
      links libruby.a to the target.
    - 803_sample-fix-shbang.patch: all sample codes should be
      s|/usr/local/bin|/usr/bin|g
    - 804_parse.y-new-bison.patch: fix syntax warning.
    - 805_uri-bugfix.patch: uri.rb could not handle correctly broken mailto-uri.
  - add ExcludeArch x86_64 temporarily to fix Bug#74581. Right now ruby can't be
    built on x86_64.


author: Elliot Lee <sopwith@redhat.com> 1.6.7-13
changelog:
  - Remove ExcludeArch: x86_64
  - Fix x86_64 ruby with long2int.patch (ruby was assuming that sizeof(long)
    == sizeof(int). The patch does not fix the source of the problem, just
    makes it a non-issue.)
  - _smp_mflags


author: Akira TAGOH <tagoh@redhat.com> 1.6.8-1
changelog:
  - New upstream release.
  - removed some patches. it's no longer needed.
    - ruby-1.6.7-100.patch
    - ruby-1.6.7-101.patch
    - ruby-1.6.7-102.patch
    - ruby-1.6.7-103.patch
    - 801_extmk.rb-shellwords.patch
    - 801_mkmf.rb-shellwords.patch
    - 804_parse.y-new-bison.patch
    - 805_uri-bugfix.patch
    - ruby-1.6.6-900_XXX_strtod.patch
    - ruby-1.6.7-sux0rs.patch
    - ruby-1.6.7-libobj.patch


author: Akira TAGOH <tagoh@redhat.com> 1.6.8-2
changelog:
  - ruby-1.6.8-require.patch: applied to fix the search bug in require.
  - don't apply long2int patch to s390 and s390x. it doesn't work.


author: Akira TAGOH <tagoh@redhat.com> 1.6.8-7
changelog:
  - fix the gcc warnings. (#82192)
  - ruby-1.6.8-fix-x86_64.patch: correct a patch.
    NOTE: DON'T USE THIS PATCH FOR BIG ENDIAN ARCHITECTURE.
  - ruby-1.6.7-long2int.patch: removed.


author: Akira TAGOH <tagoh@redhat.com> 1.6.8-9
changelog:
  - ruby-1.6.8-castnode.patch: handling the nodes with correct cast.
    use this patch now instead of ruby-1.6.8-fix-x86_64.patch.


author: Akira TAGOH <tagoh@redhat.com> 1.8.1-1
changelog:
  - New upstream release.
  - don't use any optimization for ia64 to avoid the build failure.
  - ruby-1.8.1-ia64-stack-limit.patch: applied to fix SystemStackError when the optimization is disabled.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.1-9
changelog:
  - ruby-1.8.1-cgi-dos.patch: security fix [CAN-2004-0983]
  - ruby-1.8.1-cgi_session_perms.patch: security fix [CAN-2004-0755]


author: Akira TAGOH <tagoh@redhat.com> - 1.8.2-1
changelog:
  - New upstream release.
  - ruby-1.8.1-ia64-stack-limit.patch: removed - it's no longer needed.
  - ruby-1.8.1-cgi_session_perms.patch: likewise.
  - ruby-1.8.1-cgi-dos.patch: likewise.
  - generated Ruby interactive documentation - senarated package.
    it's now provided as ri package. (#141806)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.2-7
changelog:
  - ruby-1.8.2-deadcode.patch: removed the dead code from the source. (#146108)
  - make sure that all documentation files in ruby-docs are the world-
    readable. (#147279)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.2-9
changelog:
  - ruby-1.8.2-xmlrpc-CAN-2005-1992.patch: fixed the arbitrary command execution
    on XMLRPC server. (#161096)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.3-1
changelog:
  - New upstream release.
  - Build-Requires xorg-x11-devel instead of XFree86-devel.
  - ruby-multilib.patch: applied for only 64-bit archs.
  - ruby-1.8.2-xmlrpc-CAN-2005-1992.patch: removed. it has already been in upstream.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.3-3
changelog:
  - fixed the wrong file list. the external library for tcl/tk was included
    in ruby-libs unexpectedly.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.3-4
changelog:
  - moved the documents from ruby-libs to ruby-docs, which contains the arch
    specific thing and to be multilib support. (#168826)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.4-0.4.preview2
changelog:
  - updates to 1.8.4-preview2.
  - renamed the packages to ruby-* (#175765)
    - irb -> ruby-irb
    - rdoc -> ruby-rdoc
    - ri -> ruby-ri
  - added tcl-devel and tk-devel into BuildRequires.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.4-1
changelog:
  - New upstream release.
    - fixed a missing return statement. (#140833)
    - fixed an use of uninitialized variable. (#144890)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.4-3
changelog:
  - ruby-1.8.4-no-eaccess.patch: backported from ruby CVS to avoid conflict
    between newer glibc. (#179835)


author: Akira TAGOH <tagoh@redhat.com>
changelog:
  - ruby-rubyprefix.patch: moved all arch-independent modules under /usr/lib/ruby
    and keep arch-dependent modules under /usr/lib64/ruby for 64bit archs.
    so 'rubylibdir', 'sitelibdir' and 'sitedir' in Config::CONFIG points to
    the kind of /usr/lib/ruby now. (#184199)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.4-6
changelog:
  - ruby-deprecated-search-path.patch: added the deprecated installation paths
    to the search path for the backward compatibility.
  - added a Provides: ruby(abi) to ruby-libs.
  - ruby-1.8.4-64bit-pack.patch: backport patch from upstream to fix unpack("l")
    not working on 64bit arch and integer overflow on template "w". (#189350)
  - updated License tag to be more comfortable, and with a pointer to get more
    details, like Python package does. (#179933)
  - clean up.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.4-7
changelog:
  - exclude ppc64 to make ruby-mode package. right now emacs.ppc64 isn't provided
    and buildsys became much stricter.
  - ruby-deprecated-sitelib-search-path.patch: applied to add more search path
    for backward compatiblity.
  - added byacc to BuildReq. (#194161)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.4-11
changelog:
  - security fixes [CVE-2006-3694]
    - ruby-1.8.4-fix-insecure-dir-operation.patch:
    - ruby-1.8.4-fix-insecure-regexp-modification.patch: fixed the insecure
      operations in the certain safe-level restrictions. (#199538)
    - ruby-1.8.4-fix-alias-safe-level.patch: fixed to not bypass the certain
      safe-level restrictions. (#199543)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.5-1
changelog:
  - New upstream release.
  - removed the unnecessary patches:
    - ruby-1.8.4-no-eaccess.patch
    - ruby-1.8.4-64bit-pack.patch
    - ruby-1.8.4-fix-insecure-dir-operation.patch
    - ruby-1.8.4-fix-insecure-regexp-modification.patch
    - ruby-1.8.4-fix-alias-safe-level.patch
  - build with --enable-pthread except on ppc.
  - ruby-1.8.5-hash-memory-leak.patch: backported from CVS to fix a memory leak
    on Hash. [ruby-talk:211233]


author: Akira TAGOH <tagoh@redhat.com> - 1.8.5-4
changelog:
  - security fix release.
  - ruby-1.8.5-cgi-CVE-2006-5467.patch: fix a CGI multipart parsing bug that
    causes the denial of service. (#212396)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.36-3
changelog:
  - ruby-r12567.patch: backport patch from upstream svn to get rid of
    the unnecessary declarations. (#245446)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.110-1
changelog:
  - New upstream release.
    - ruby-r12567.patch: removed.
  - ruby-1.8.6-CVE-2007-5162.patch: security fix for Net::HTTP that is
    insufficient verification of SSL certificate.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.110-2
changelog:
  - Enable pthread support for ppc too. (#201452)
  - Fix unexpected dependencies appears in ruby-libs. (#253325)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.111-1
changelog:
  - New upstream release.
  - ruby-1.8.6.111-CVE-2007-5162.patch: Update a bit with backporting the changes
     at trunk to enable the fix without any modifications on the users' scripts.
     Note that Net::HTTP#enable_post_connection_check isn't available anymore.
     If you want to disable this post-check, you should give OpenSSL::SSL::VERIFY_NONE
     to Net::HTTP#verify_mode= instead of.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.111-3
changelog:
  - Clean up the spec file.
  - Remove ruby-man-1.4.6 stuff. this is entirely the out-dated document.
    this could be replaced by ri.
  - Disable the static library building.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.114-1
changelog:
  - Security fix for CVE-2008-1145.
  - Improve a spec file. (#226381)
    - Correct License tag.
    - Fix a timestamp issue.
    - Own a arch-specific directory.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.230-1
changelog:
  - New upstream release.
  - Security fixes. (#452295)
    - CVE-2008-1891: WEBrick CGI source disclosure.
    - CVE-2008-2662: Integer overflow in rb_str_buf_append().
    - CVE-2008-2663: Integer overflow in rb_ary_store().
    - CVE-2008-2664: Unsafe use of alloca in rb_str_format().
    - CVE-2008-2725: Integer overflow in rb_ary_splice().
    - CVE-2008-2726: Integer overflow in rb_ary_splice().
  - ruby-1.8.6.111-CVE-2007-5162.patch: removed.
  - Build ruby-mode package for all archtectures.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.230-3
changelog:
  - Backported from upstream SVN to fix a segfault issue. (#452825)
  - Backported from upstream SVN to fix an integer overflow in rb_ary_fill.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.287-1
changelog:
  - New upstream release.
  - Security fixes.
    - CVE-2008-3655: Ruby does not properly restrict access to critical
  		   variables and methods at various safe levels.
    - CVE-2008-3656: DoS vulnerability in WEBrick.
    - CVE-2008-3657: Lack of taintness check in dl.
    - CVE-2008-1447: DNS spoofing vulnerability in resolv.rb.
    - CVE-2008-3443: Memory allocation failure in Ruby regex engine.
  - Remove the unnecessary backported patches.


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.6.383-4
changelog:
  - Use bison to regenerate parse.c to keep the original format of error
    messages (bug 530275 comment 4)


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.6.383-5
changelog:
  - Change mkmf.rb to use LIBRUBYARG_SHARED so that have_library() works
    without libruby-static.a (bug 428384)
  - And move libruby-static.a to -static subpackage


author: Jeroen van Meeuwen <j.van.meeuwen@ogd.nl> - 1.8.6.388-8
changelog:
  - Backport openssl/digest functions providing digest and hexdigest functions
    directly in OpenSSL::Digest.methods
  - Make sure that Red Hat people version their changelog entries
  - This is actually release #1, but now needs to be release #7


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.6.399-2
changelog:
  - tcltk: Give up using potentially unmaintained ruby_1_8_6 branch
    and instead completely replace with ruby_1_8 branch head
    (at this time, using rev 27738)
    (seems to fix 560053, 590503)
  - Fix Japanese encoding strings under ruby-tcltk/ext/tk/sample/


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.6.399-3
changelog:
  - ruby-1.8.x-null-class-must-be-Qnil.patch (bug 530407)
  - Recreate some patches using upstream svn when available, and
    add some comments for patches


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.6.399-4
changelog:
  - Patch36 (ruby-1.8.x-RHASH_SIZE-rb_hash_lookup-def.patch)
    also backport rb_hash_lookup definition (bug 592936)


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.6.399-5
changelog:
  - Retry for bug 559158, Simplify the OpenSSL::Digest class
    pull more change commits from ruby_1_8 branch


author: Jim Meyering <meyering@redhat.com> - 1.8.7.249-0.1
changelog:
  - Rebase to Ruby 1.8.7.  Based on Mohammed Morsi's port of the 1.9.1
    spec file to Fedora 11: <http://mo.morsi.org/blog/node/318>.
    * ruby-multilib.patch (aka patch23): Rewrite the mkconfig.rb patch so that
    it may be applied unconditionally.  This addresses an rpmlint complaint
    about the arch-dependent patch.  Now, the script itself tests the target
    architecture.  Remove the ".ifarch ppc64 s390x sparc64 x86_64" conditional.


author: Jim Meyering <meyering@redhat.com> - 1.8.7.249-0.2
changelog:
  - Integrate addition of patch101 by Mohammed Morsi.  This fixes
    the segv-inducing marshaling bug affecting rails-3.0.0.
  - Integrate Mamoru Tasaka's path-fixing feedback, including
    updates to ruby-1.8.7-lib-paths.patch


author: Jim Meyering <meyering@redhat.com> - 1.8.7.249-0.3
changelog:
  - split some long lines; as in Mamoru Tasaka's 1.8.7.x spec file
  - don't require emacs; remove vestiges of emacs


author: Jim Meyering <meyering@redhat.com> - 1.8.7.249-1
changelog:
  - Resolves: rhbz#602435
  - (sitelib2): remove unused definition
  - correct search path, using changes from Mohammed Morsi's
    http://mo.morsi.org/files/ruby-1.8.7.249-5.fc13.src.rpm


author: Jim Meyering <meyering@redhat.com> - 1.8.7.249-2
changelog:
  - Rebase to ruby-1.8.7.299
    * remove patch30, aka ruby-1.8.7-openssl-1.0.patch; subsumed
    * remove patch101, aka ruby-1.8.7-rb_gc_guard_ptr-optimization.patch; subsumed


author: Jim Meyering <meyering@redhat.com> - 1.8.7.299-4
changelog:
  - Address CVE-2010-0541 "Ruby WEBrick javascript injection flaw"
    by applying the patch from Apple as included in
    http://bugzilla.redhat.com/587731.
    * ruby-1.8.7-webrick-CVE.patch: New file.
  - Resolves: rhbz#605418


author: Jim Meyering <meyering@redhat.com> - 1.8.7.299-5
changelog:
  - avoid a false-positive readline-related test failure
    * ruby-readline-TERM-dumb.patch: New file.
    * Run "make test-all" in addition to "make test", in spite of its known
    failures (e.g., when using out of date gdbm).  Suggested by Ondrej Moris.
  - skip minor gdbm test to avoid failure
    * ruby-skip-gdbm-test.patch: New file.
  - avoid segfault on powerpc64
    * ruby-ppc64-segv-fix.patch: New file.
  - Resolves: rhbz#628715


author: Jim Meyering <meyering@redhat.com> - 1.8.7.299-6
changelog:
  - Now that ruby uses the two-clause BSDL, it may once again use the
  latest readline, which is covered by the LGPLv3.  2-clause BSDL is
  GPLv3-compatible, per http://www.gnu.org/philosophy/license-list.html
  Before, ruby used the GPLv2, which precluded use of readline6, so it
  had to resort to using the old readline5 library.
  Remove references to the old readline5 library.
  - Resolves: rhbz#631701


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.299-8
changelog:
  - Address CVE-2011-1004 "Symlink race condition by removing directory trees in
    fileutils module"
    * ruby-1.8.7-CVE-2011-1004.patch
  - Address CVE-2011-1005 "Untrusted codes able to modify arbitrary strings"
    * ruby-1.8.7-CVE-2011-1005.patch
  - Address CVE-2011-0188 "memory corruption in BigDecimal on 64bit platforms"
    * ruby-1.8.7-CVE-2011-0188.patch
  - Resolves: rhbz#709964


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-1
changelog:
  - Update to Ruby 1.8.7-p352.
    * Remove Patch43: ruby-1.8.7-CVE-2011-1004.patch; subsumed
    * Remove Patch44: ruby-1.8.7-CVE-2011-1005.patch; subsumed
    * Remove Patch200: ruby-1.8.7-webrick-CVE.patch; subsumed
  - Resolves: rhbz#706332
  - Fix of conflict between 32bit and 64bit library versions.
  - Resolves: rhbz#674787
  - Add systemtap static probes.
  - Resolves: rhbz#673162
  - Remove duplicate path entry
  - Resolves: rhbz#722887


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-3
changelog:
  - mkconfig.rb: fix for continued lines.
    * ruby-1.8.7-p352-mkconfig.rb-fix-for-continued-lines.patch
  - Resolves: rhbz#730287


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-4
changelog:
  - Address CVE-2011-4815 "DoS (excessive CPU use) via hash meet-in-the-middle
    attacks (oCERT-2011-003)"
    * ruby-1.8.7-p352-CVE-2011-4815.patch
  - Resolves: rhbz#768833


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-7
changelog:
  - Addresses segfauls in Marshal.load.
    * ruby-1.8.7-p358-marshal-load-segv-fix.patch
  - Resolves: rhbz#789120


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-8
changelog:
  - Addresses entity expansion DoS vulnerability in REXML.
    * ruby-2.0.0-entity-expansion-DoS-vulnerability-in-REXML.patch
  - Resolves: rhbz#915380


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-9
changelog:
  - Fix regression introduced by fix for entity expansion DOS vulnerability
    in REXML (https://bugs.ruby-lang.org/issues/7961)
    * ruby-2.0.0-add-missing-rexml-require.patch
  - Related: rhbz#915380


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-10
changelog:
  - $SAFE escaping vulnerability about Exception#to_s / NameError#to_s
    * ruby-1.8.7-p371-CVE-2012-4481.patch
    - Related: rhbz#915380


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-11
changelog:
  - hostname check bypassing vulnerability in SSL client.
    * ruby-1.8.7-p374-CVE-2013-4073-fix-hostname-verification.patch
    - Resolves: rhbz#979301


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-12
changelog:
  - Fix regression introduced by CVE-2013-4073
    https://bugs.ruby-lang.org/issues/8575
    * ruby-2.0.0-p255-Fix-SSL-client-connection-crash-for-SAN-marked-critical.patch
    - Related: rhbz#979301


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-13
changelog:
  - Workaround build issues against OpenSSL with enabled ECC curves.
  - Make DRb compatible with OpenSSL 1.0.1.
    * ruby-1.9.3-p222-generate-1024-bits-RSA-key-instead-of-512-bits.patch
  - Fix CVE-2013-4164 Heap Overflow in Floating Point Parsing
    * ruby-1.9.3-p484-CVE-2013-4164-ignore-too-long-fraction-part-which-does-not-affect-the-result.patch
    - Resolves: rhbz#1033502


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.374-1
changelog:
  - Update to Ruby 1.8.7-p374.
    * Remove Patch41: ruby-ppc64-segv-fix.patch; subsumed
    * Remove Patch45: ruby-1.8.7-CVE-2011-0188.patch; subsumed
    * Remove Patch46: ruby-1.8.7-FIPS.patch; subsumed
    * Remove Patch47: ruby-1.8.7-p352-mkconfig.rb-fix-for-continued-lines.patch; subsumed
    * Remove Patch48: ruby-1.8.7-p352-CVE-2011-4815.patch; subsumed
    * Remove Patch49: ruby-1.8.7-p358-marshal-load-segv-fix.patch; subsumed
    * Remove Patch50: ruby-2.0.0-entity-expansion-DoS-vulnerability-in-REXML.patch; subsumed
    * Remove Patch51: ruby-2.0.0-add-missing-rexml-require.patch; subsumed
    * Remove Patch52: ruby-1.8.7-p371-CVE-2012-4481.patch; subsumed
    * Remove Patch53: ruby-1.8.7-p374-CVE-2013-4073-fix-hostname-verification.patch; subsumed
    Resolves: rhbz#830098
  - Enable ECC support, provided by OpenSSL, in Ruby
    * ruby-1.9.3-p482-Fix-build-against-OpenSSL-with-enabled-ECC-curves.patch
    Resolves: rhbz#1033864
  - Exclude test that fails when issuing a certificate with RSA signature and
    DSS1 digest for earlier OpenSSL versions when used in conjunction with
    OpenSSL 1.0.1.
    * ruby-1.9.3-p172-Exclude-failing-tests-written-for-earlier-OpenSSL.patch
    Resolves: rhbz#1034351
  - Rename Tracer.fire to SystemTap.fire to avoid conflict with Ruby's tracer.
    Resolves: rhbz#784766


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.374-2
changelog:
  - Replace hardcoded MD5 by sha256 to prevent SSL server failure in FIPS mode.
    * ruby-1.8.7-p374-Replace-md5-by-sha256-to-fix-SSL-server-FIPS-compatibility.patch
  - Resolves: rhbz#802946


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.374-3
changelog:
  - Fix REXML billion laughs attack via parameter entity expansion
    (CVE-2014-8080).
    Resolves: rhbz#1163993
  - REXML incomplete fix for CVE-2014-8080 (CVE-2014-8090).
    Resolves: rhbz#1163993


author: John H Terpstra <jht@samba.anu.edu.au>
changelog:
  - Many optimisations (some suggested by Manoj Kasichainula <manojk@io.com>
  - Use of chkconfig in place of individual symlinks to /etc/rc.d/init/smb
  - Compounded make line
  - Updated smb.init restart mechanism
  - Use compound mkdir -p line instead of individual calls to mkdir
  - Fixed smb.conf file path for log files
  - Fixed smb.conf file path for incoming smb print spool directory
  - Added a number of options to smb.conf file
  - Added smbadduser command (missed from all previous RPMs) - Doooh!
  - Added smbuser file and smb.conf file updates for username map


author: Erik Troan <ewt@redhat.com>
changelog:
  - made the %postun script a tad less agressive; no reason to remove
    the logs or lock file (after all, if the lock file is still there,
    samba is still running)
  - the %postun and %preun should only exectute if this is the final
    removal
  - migrated %triggerpostun from Red Hat's samba package to work around
    packaging problems in some Red Hat samba releases


author: Bill Nottingham <notting@redhat.com>
changelog:
  - add a mount.smb to make smb mounting a little easier.
  - smb filesystems apparently don't work on alpha. Oops.


author: Bill Nottingham <notting@redhat.com>
changelog:
  - update to 2.0.5
  - fix mount.smb - smbmount options changed again.........
  - fix postun. oops.
  - update some stuff from the samba team's spec file.


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - use cp rather than mv to preserve /etc/services perms (#4938 et al).
  - use mktemp to generate /etc/tmp.XXXXXX file name.
  - add prereqs on sed/mktemp/killall (need to move killall to /bin).
  - fix trigger syntax (i.e. "samba < 1.9.18p7" not "samba < samba-1.9.18p7")


author: Bill Nottingham <notting@redhat.com>
changelog:
  - fix yp_get_default_domain in autoconf
  - only link against readline for smbclient
  - fix log rotation (#9909)


author: Than Ngo <than@redhat.de>
changelog:
  - add initdir macro to handle the initscript directory
  - add a new macro to handle /etc/pam.d/system-auth


author: Bill Nottingham <notting@redhat.com>
changelog:
  - move initscript back
  - remove 'Using Samba' book from %doc 
  - move stuff to /etc/samba (#13708)
  - default configuration tweaks (#13704)
  - some logrotate tweaks


author: Bill Nottingham <notting@redhat.com>
changelog:
  - fix swat only_from line (#18726, others)
  - fix attempt to write outside buildroot on install (#17943)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - set a default CA certificate path in smb.conf (#19010)
  - require openssl >= 0.9.5a-20 to make sure we have a ca-bundle.crt file


author: Bill Nottingham <notting@redhat.com>
changelog:
  - i18n-ize initscript
  - add a sysconfig file for daemon options (#23550)
  - clarify smbpasswd man page (#23370)
  - build with LFS support (#22388)
  - avoid extraneous pam error messages (#10666)
  - add Urban Widmark's bug fixes for smbmount (#19623)
  - fix setgid directory modes (#11911)
  - split swat into subpackage (#19706)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - tweak the PAM code some more to try to do a setcred() after initgroups()
  - pull in all of the optflags on i386 and sparc
  - don't explicitly enable Kerberos support -- it's only used for password
    checking, and if PAM is enabled it's a no-op anyway


author: Helge Deller <hdeller@redhat.de>
changelog:
  - updated to samba 2.2.0
  - moved codepages to %{_datadir}/samba/codepages
  - use all available CPUs for building rpm packages
  - use %{_xxx} defines at most places in spec-file
  - "License:" replaces "Copyright:"
  - dropped excludearch sparc
  - de-activated japanese patches 100 and 200 for now 
    (they need to be fixed and tested wth 2.2.0)
  - separated swat.desktop file from spec-file and added
    german translations
  - moved /etc/sysconfig/samba to a separate source-file
  - use htmlview instead of direct call to netscape in 
    swat.desktop-file


author: Helge Deller <hdeller@redhat.de>
changelog:
  - build as 2.2.0-1 release
  - skip the documentation-directories docbook, manpages and yodldocs
  - don't include *.sgml documentation in package
  - moved codepage-directory to /usr/share/samba/codepages
  - make it compile with glibc-2.2.3-10 and kernel-headers-2.4.2-2


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  (these changes are from the non-head version)
  - Don't include /usr/sbin/samba, it's the same as the initscript
  - unset TMPDIR, as samba can't write into a TMPDIR owned 
    by root (#41193)
  - Add pidfile: lines for smbd and nmbd and a config: line
    in the initscript  (#15343)
  - don't use make -j
  - explicitly include /usr/share/samba, not just the files in it


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - Use /var/cache/samba instead of /var/lock/samba 
  - Remove "domain controller" keyword from smb.conf, it's 
    deprecated (from #13704)
  - Sync some examples with smb.conf.default
  - Fix password synchronization (#16987)


author: Trond Eivind Glomsrød <teg@redhat.com>
changelog:
  - Don't include smbpasswd in samba, it's in samba-common (#51598)
  - Add a disabled "obey pam restrictions" statement - it's not
    active, as we use encrypted passwords, but if the admin turns
    encrypted passwords off the choice is available. (#31351)


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2.2-3
changelog:
  - Add "--with-utmp" to configure options (#55372)
  - Include winbind, pam_smbpass.so, rpcclient and smbcacls
  - start using /var/cache/samba, we need to keep state and there is
    more than just locks involved


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2.2-5
changelog:
  - Teach smbadduser about "getent passwd" 
  - Fix more pid-file references
  - Add (conditional) winbindd startup to the initscript, configured in
    /etc/sysconfig/samba


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2.2-6
changelog:
  - Move winbind files to samba-common. Add separate initscript for
    winbind 
  - Fixes for winbind - protect global variables with mutex, use
    more secure getenv


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.3a-3
changelog:
  - include interfaces.o in pam_smbpass.so, which needs symbols from interfaces.o
    (patch posted to samba-list by Ilia Chipitsine)


author: Trond Eivind Glomsrød <teg@redhat.com> 2.2.5-7
changelog:
  - Enable VFS support and compile the "recycling" module (#69796)
  - more selective includes of the examples dir


author: Jay Fenlason <fenlason@redhat.com> 2.2.7a-3
changelog:
  - edited spec file to put .so files in the correct directories
    on 64-bit platforms that have 32-bit compatability issues
    (sparc64, x86_64, etc).  This fixes bugzilla #83782.
  - Added samba-2.2.7a-error.patch from twaugh.  This fixes
    bugzilla #82454.


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.7a-4
changelog:
  - relink libnss_wins.so with SHLD="%{__cc} -lnsl" to force libnss_wins.so to
    link with libnsl, avoiding unresolved symbol errors on functions in libnsl


author: Jay Fenlason <fenlason@redhat.com> 2.2.8-0
changelog:
  - Upgrade to 2.2.8
  - removed commented out patches.
  - removed old patches and .md5 files from the repository.
  - remove duplicate /sbin/chkconfig --del winbind which causes
    warnings when removing samba.
  - Fixed minor bug in smbprint that causes it to fail when called with
    more than 10 parameters: the accounting file (and spool directory
    derived from it) were being set wrong due to missing {}.  This closes
    bug #86473.
  - updated smb.conf patch, includes new defaults to close bug #84822.


author: Jay Fenlason <fenlason@redhat.com> 2.2.8a-1
changelog:
  - upgrade to 2.2.8a
  - remove old .md5 files
  - add "pid directory = /var/run" to the smb.conf file.  Fixes #88495
  - Patch from jra@dp.samba.org to fix a delete-on-close regression


author: Jay Fenlason <fenlason@redhat.com> 2.2.8a-2
changelog:
  - add libsmbclient.so for gnome-vfs-extras
  - Edit specfile to specify /var/run for pid files
  - Move /tmp/.winbindd/socket to /var/run/winbindd/socket


author: Jay Fenlason <fenlason@redhat.com> 3.0.0-3beta3
changelog:
  - Merge from 3.0.0-2beta3.3E
  - (Correct log file names (#100981).)
  - (Fix pidfile directory in samab.log)
  - (Remove obsolete samba-3.0.0beta2.tar.bz2.md5 file)
  - (Move libsmbclient to the -common package (#99449))


author: Jay Fenlason <fenlason@redhat.com> 3.0.0-15
changelog:
  - New 3.0.0 final release
  - merge nmbd-netbiosname and testparm patches from 3E branch
  - updated the -logfiles patch to work against 3.0.0
  - updated the pie patch
  - update the VERSION file during build
  - use make -j if avaliable
  - merge the winbindd_privileged change from 3E
  - merge the "rm /usr/lib" patch that allows Samba to build on 64-bit
    platforms despite the broken Makefile


author: Felipe Alfaro Solana <felipe_alfaro@linuxmail.org> 3.0.1-1
changelog:
  - Update to 3.0.1
  - Removed testparm patch as it's already merged
  - Removed Samba.7* man pages
  - Fixed .buildroot patch
  - Fixed .pie patch
  - Added new /usr/bin/tdbdump file


author: Jay Fenlason <fenlason@redhat.com> 3.0.2-3rc2
changelog:
  - add %dir entries for %{_libdir}/samba and %{_libdir}/samba/charset
  - Upgrade to new upstream version
  - build mount.cifs for the new cifs filesystem in the 2.6 kernel.


author: Jay Fenlason <fenlason@redhat.com> 3.0.2-5
changelog:
  - New upstream version: 3.0.2 final includes security fix for #114995
    (CAN-2004-0082)
  - Edit postun script for the -common package to restart winbind when
    appropriate.  Fixes bugzilla #114051.


author: Jay Fenlason <fenlason@redhat.com>
changelog:
  - Change all requires lines to list an explicit epoch.  Closes #102715
  - Add an explicit Epoch so that %{epoch} is defined.


author: Jay Fenlason <fenlason@redhat.com> 3.0.3-1.pre1
changelog:
  - New upstream version.
  - Updated -pie and -logfiles patches for 3.0.3pre1
  - add krb5-devel to buildrequires, fixes #116560
  - Add patch from Miloslav Trmac (mitr@volny.cz) to allow non-root to run
    "service smb status".  This fixes #116559


author: Jay Fenlason <fenlason@redhat.com> 3.0.3-2.pre2
changelog:
  - New upstream version  
  - Updated configure line to remove --with-fhs and to explicitly set all
    the directories that --with-fhs was setting.  We were overriding most of
    them anyway.  This closes #118598


author: jay Fenlason <fenlason@redhat.com> 3.0.3-3.rc1
changelog:
  - New upstream version
  - updated spec file to make libsmbclient.so executable.  This closes
    bugzilla #121356


author: Jay Fenlason <fenlason@redhat.com> 3.0.3-5
changelog:
  - Patch to allow password changes from machines patched with
    Microsoft hotfix MS04-011.
  - Include patches for https://bugzilla.samba.org/show_bug.cgi?id=1302
    and https://bugzilla.samba.org/show_bug.cgi?id=1309


author: Jay Fenlason <fenlason@redhat.com> 3.0.5.0pre1.0
changelog:
  - New upstream version
  - use % { SOURCE1 } instead of a hardcoded path
  - include -winbind patch from Gerald (Jerry) Carter (jerry@samba.org)
    https://bugzilla.samba.org/show_bug.cgi?id=1315
    to make winbindd work against Windows versions that do not have
    128 bit encryption enabled.
  - Moved %{_bindir}/net to the -common package, so that folks who just
    want to use winbind, etc don't have to install -client in order to
    "net join" their domain.
  - New upstream version obsoletes the patches added in 3.0.3-5
  - Remove smbgetrc.5 man page, since we don't ship smbget.


author: Jay Fenlason <fenlason@redhat.com> 3.0.5-0.pre1.1
changelog:
  - Backport base64_decode patche to close CAN-2004-0500
  - Backport hash patch to close CAN-2004-0686
  - use_authtok patch from Nalin Dahyabhai <nalin@redhat.com>
  - smbclient-kerberos patch from Alexander Larsson <alexl@redhat.com>
  - passwd patch uses "*" instead of "x" for "hashed" passwords for
    accounts created by winbind.  "x" means "password is in /etc/shadow" to
    brain-damaged pam_unix module.


author: Jay Fenlason <fenlason@redhat.com> 3.0.5-2
changelog:
  - Upgrade to 3.0.5, which is a regression from 3.0.5pre1 for a
    security fix.
  - Include the 3.0.4-backport patch from the 3E branch.  This restores
    some of the 3.0.5pre1 and 3.0.5rc1 functionality.


author: Jason Vas Dias <jvdias@redhat.com> 3.0.5-3
changelog:
  - Removed '-pie' patch - 3.0.5 uses -fPIC/-PIC, and the combination
  - resulted in executables getting corrupt stacks, causing smbmnt to
  - get a SIGBUS in the mount() call (bug 127420).


author: Jay Fenlason <fenlason@redhat.com> 3.0.6-3
changelog:
  - New upstream version.
  - Include post 3.0.6 patch from "Gerald (Jerry) Carter" <jerry@samba.org>
    to fix a duplicate in the LDAP schema.
  - Include 64-bit timestamp patch from Ravikumar (rkumar@hp.com)
    to allow correct timestamp handling on 64-bit platforms and fix #126109.
  - reenable the -pie patch.  Samba is too widely used, and too vulnerable
    to potential security holes to disable an important security feature
    like -pie.  The correct fix is to have the toolchain not create broken
    executables when programs compiled -pie are stripped.
  - Remove obsolete patches.
  - Modify this spec file to put libsmbclient.{a,so} in the right place on
    x86_64 machines.


author: Jay Fenlason <fenlason@redhat.com> 3.0.7-3
changelog:
  - Upgrade to 3.0.7, which fixes CAN-2004-0807 CAN-2004-0808
    This obsoletes the 3.0.6-schema patch.
  - Update BuildRequires line to include openldap-devel openssl-devel
    and cups-devel


author: Jay Fenlason <fenlason@redhat.com> 3.0.7-4
changelog:
  - Update docs section to not carryover the docs/manpages directory
    This moved many files from /usr/share/doc/samba-3.0.7/docs/* to
    /usr/share/doc/samba-3.0.7/*
  - Modify spec file as suggested by Rex Dieter (rdieter@math.unl.edu)
    to correctly create libsmbclient.so.0 and to use %_initrddir instead
    of rolling our own.  This closes #132642
  - Add patch to default "use sendfile" to no, since sendfile appears to
    be broken
  - Add patch from Volker Lendecke <vl@samba.org> to help make
    ldapsam_compat work again.
  - Add patch from "Vince Brimhall" <vbrimhall@novell.com> for ldapsam_compat
    These two patches close bugzilla #132169


author: Jay Fenlason <fenlason@redhat.com>
changelog:
  - Include patch from Steven Lawrance (slawrance@yahoo.com) that modifies
    smbmnt to work with 32-bit uids.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-0.pre1.2
changelog:
  - Re-enable the x_fclose patch that was accidentally disabled
    in 3.0.8-0.pre1.1.  This closes #135832
  - include Nalin's -fqdn and -salt patches.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-0.pre1.3
changelog:
  - disable the -salt patch, because it causes undefined references in
    libsmbclient that prevent gnome-vfs from building.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-2
changelog:
  - New upstream version fixes CAN-2004-0930.  This obsoletes the
    disable-sendfile, salt, signing-shortkey and fqdn patches.
  - Add my <fenlason@redhat.com> ugly non-ascii-domain patch.
  - Updated the pie patch for 3.0.8.
  - Updated the logfiles patch for 3.0.8.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-3
changelog:
  - Include the corrected docs tarball, and use it instead of the
    obsolete docs from the upstream 3.0.8 tarball.
  - Update the logfiles patch to work with the updated docs.


author: Jay Fenlason <fenlason@redhat.com> 3.0.8-3.1
changelog:
  - Rescue the install.mount.smbfs patch from Juanjo Villaplana
    (villapla@si.uji.es) to prevent building the srpm from trashing your
    installed /usr/bin/smbmount


author: Than Ngo <than@redhat.com> 3.0.8-4
changelog:
  - fix unresolved symbols in libsmbclient which caused applications
    such as KDE's konqueror to fail when accessing smb:// URLs. #139894


author: Jay Fenlason <fenlason@redhat.com> 3.0.9-2
changelog:
  - New upstream release.  This obsoletes the -secret patch.
    Include my changetrustpw patch to make "net ads changetrustpw" stop
    aborting.  This closes #134694
  - Remove obsolete triggers for ancient samba versions.
  - Move /var/log/samba to the -common rpm.  This closes #76628
  - Remove the hack needed to get around the bad docs files in the
    3.0.8 tarball.
  - Change the comment in winbind.init to point at the correct pidfile.
    This closes #76641


author: Jay Fenlason <fenlason@redhat.com> 3.0.10-2
changelog:
  - New upstream release that closes CAN-2004-1154  bz#142544
  - Include the -64bit patch from Nalin.  This closes bz#142873
  - Update the -logfiles patch to work with 3.0.10
  - Create /var/run/winbindd and make it part of the -common rpm to close
    bz#142242


author: Jay Fenlason <fenlason@redhat.com> 3.0.10-4
changelog:
  - Update the -man patch to fix ntlm_auth.1 too.
  - Move pam_smbpass.so to the -common package, so both the 32
    and 64-bit versions will be installed on multiarch platforms.
    This closes bz#143617
  - Added new -delim patch to fix mount.cifs so it can accept
    passwords with commas in them (via environment or credentials
    file) to close bz#144198


author: Jay Fenlason <fenlason@redhat.com> 3.0.11-3
changelog:
  - add -gcc4 patch to compile with gcc 4.
  - remove the now obsolete -smbclient-kerberos.patch
  - Include four upstream patches from
    http://samba.org/~jerry/patches/post-3.0.11/
    (Slightly modified the winbind_find_dc_v2 patch to apply easily with
    rpmbuild).


author: Jay Fenlason <fenlason@redhat.com> 3.0.11-4
changelog:
  - Use the updated filter-requires-samba.sh file, so we don't accidentally
    pick up a dependency on perl(Crypt::SmbHash)


author: Jay Fenlason <fenlason@redhat.com> 3.0.13-2
changelog:
  - New upstream release
  - add my -quoting patch, to fix swat with strings that contain
    html meta-characters, and to use correct quote characters in
    lists, closing bz#134310
  - include the upstream winbindd_2k3sp1 patch
  - include the -smbclient patch.
  - include the -hang patch from upstream.


author: Jay Fenlason <fenlason@redhat.com> 3.0.14a-2
changelog:
  - New upstream release.
  - the -64bit-timestamps, -clitar, -establish_trust, user_rights_v1,
    winbind_find_dc_v2 patches are now obsolete.


author: Jay Fenlason <fenlason@redhat.com> 3.0.20-2
changelog:
  - New upstream release
    Includes five upstream patches -bug3010_v1, -groupname_enumeration_v3,
      -regcreatekey_winxp_v1, -usrmgr_groups_v1, and -winbindd_v1
    This obsoletes the -pie and -delim patches
    the -warning and -gcc4 patches are obsolete too
    The -man, -passwd, and -smbspool patches were updated to match 3.0.20pre1
    Also, the -quoting patch was implemented differently upstream
    There is now a umount.cifs executable and manpage
    We run autogen.sh as part of the build phase
    The testprns command is now gone
    libsmbclient now has a man page
  - Include -bug106483 patch to close
    bz#106483 smbclient: -N negates the provided password, despite documentation
  - Added the -warnings patch to quiet some compiler warnings.
  - Removed many obsolete patches from CVS.


author: Jay Fenlason <fenlason@redhat.com> 3.0.20b-2
changelog:
  - turn on -DLDAP_DEPRECATED to allow access to ldap functions that have
    been depricated in 2.3.11, but which don't have well-documented
    replacements (ldap_simple_bind_s(), for example).
  - Upgrade to 3.0.20b, which includes all the previous upstream patches.
  - Updated the -warnings patch for 3.0.20a.
  - Include  --with-shared-modules=idmap_ad,idmap_rid to close
    bz#156810 --with-shared-modules=idmap_ad,idmap_rid
  - Include the new samba.pamd from Tomas Mraz (tmraz@redhat.com) to close
    bz#170259 pam_stack is deprecated


author: Jay Fenlason <fenlason@redhat.com> 3.0.21b-2
changelog:
  - New upstream version.
  - Since the rawhide kernel has dropped support for smbfs, remove smbmount
    and smbumount.  Users should use mount.cifs instead.
  - Upgrade to 3.0.21b


author: Jay Fenlason <fenlason@redhat.com> 3.0.23-0.RC3
changelog:
  - New upstream RC release.
  - Update the -logfiles, and -passwd patches for
    3.0.23rc3
  - Include the change to smb.init from Bastien Nocera <bnocera@redhat.com>)
    to close
    bz#182560 Wrong retval for initscript when smbd is dead
  - Update this spec file to build with 3.0.23rc3
  - Remove the -install.mount.smbfs patch, since we don't install
    mount.smbfs any more.


author: Jay Fenlason <fenlason@redhat.com> 3.0.23-2
changelog:
  - New upstream release.
  - Use modified filter-requires-samba.sh from packaging/RHEL/setup/
    to get rid of bogus dependency on perl(Unicode::MapUTF8)
  - Update the -logfiles and -smb.conf patches to work with 3.0.23


author: Jay Fenlason <fenlason@redhat.com> 3.0.23a-3
changelog:
  - Fix the -logfiles patch to close
    bz#199607 Samba compiled with wrong log path.
    bz#199206 smb.conf has incorrect log file path


author: Simo Sorce <ssorce@redhat.com> 3.0.24-2.fc7
changelog:
  - New upstream release
  - Fix packaging issue wrt idmap modules used only by smbd
  - Addedd Vista Patchset for compatibility with Windows Vista
  - Change default of "msdfs root", it seem to cause problems with
    some applications and it has been proposed to change it for
    3.0.25 upstream


author: Simo Sorce <ssorce@redhat.com> 3.0.24-3.fc7
changelog:
  - Directories reorg, tdb files must go to /var/lib, not
    to /var/cache, add migration script in %post common
  - Split out libsmbclient, devel and doc packages
  - Remove libmsrpc.[h|so] for now as they are not really usable
  - Remove kill -HUP from rotate, samba use -HUP for other things
    noit to reopen logs


author: Simo Sorce <ssorce@redhat.com> 3.0.24-5.fc7
changelog:
  - actually use the correct samba.pamd file not the old samba.pamd.stack file
  - fix logifles and use upstream convention of log.* instead of our old *.log
    Winbindd creates its own log.* files anyway so we will be more consistent
  - install our own (enhanced) default smb.conf file
  - Fix pam_winbind acct_mgmt PAM result code (prevented local users from
    logging in). Fixed by Guenther.
  - move some files from samba to samba-common as they are used with winbindd
    as well


author: Simo Sorce <ssorce@redhat.com> 3.0.24-6.fc7
changelog:
  - do not put comments inline on smb.conf options, they may be read
    as part of the value (for example log files names)


author: Simo Sorce <ssorce@redhat.com> 3.0.24-7.fc7
changelog:
  - make winbindd start earlier in the init process, at the same time
    ypbind is usually started as well
  - add a sepoarate init script for nmbd called nmb, we need to be able
    to restart nmbd without dropping al smbd connections unnecessarily


author: Simo Sorce <ssorce@redhat.com>
changelog:
  - remove patch for bug 106483 as it introduces a new bug that prevents
    the use of a credentials file with the smbclient tar command
  - move the samba private dir from being the same as the config dir
    (/etc/samba) to /var/lib/samba/private


author: Simo Sorce <ssorce@redhat.com> 3.0.24-9.fc7
changelog:
  - integrate most of merge review proposed changes (bug #226387)
  - remove libsmbclient-devel-static and simply stop shipping the
    static version of smbclient as it seem this is deprecated and
    actively discouraged


author: Simo Sorce <ssorce@redhat.com> 3.0.24-10.fc7
changelog:
  - set passdb backend = tdbsam as default in smb.conf
  - remove samba-docs dependency from swat, that was a mistake
  - put back COPYING and other files in samba-common
  - put examples in samba not in samba-docs
  - leave only stuff under docs/ in samba-doc


author: Guenther Deschner <gdeschner@redhat.com> 3.0.24-11.fc7
changelog:
  - enable PAM and NSS dlopen checks during build
  - fix unresolved symbols in libnss_wins.so (bug #198230)


author: Simo Sorce <ssorce@redhat.com> 3.0.24-12.fc7
changelog:
  - fixes in smb.conf
  - advice in smb.conf to put scripts in /var/lib/samba/scripts
  - create /var/lib/samba/scripts so that selinux can be happy
  - fix Vista problems with msdfs errors


author: Simo Sorce <ssorce@redhat.com>
changelog:
  - fixes in the spec file
  - moved to 3.0.25rc1
  - addedd patches (merged upstream so they will be removed in 3.0.25rc2)


author: Simo Sorce <ssorce@redhat.com>
changelog:
  - update to 3.0.25a as it contains many fixes
  - add a fix for pam_smbpass made by Günther but committed upstream after 3.0.25a was cut.


author: Simo Sorce <ssorce@redhat.com> 3.2.0-0.pre1.fc9
changelog:
  - New major relase, minor switched from 0 to 2
  - License change, the code is now GPLv3+
  - Numerous improvements and bugfixes included
  - package libsmbsharemodes too
  - remove smbldap-tools as they are already packaged separately in Fedora
  - Fix bug 245506


author: Simo Sorce <ssorce@redhat.com> - 3.2.0-0.pre1.3
changelog:
  - Try to fix GCC 4.3 build
  - Add --with-dnsupdate flag and also make sure other flags are required just to
    be sure the features are included without relying on autodetection to be
    successful


author: Guenther Deschner <gdeschner@redhat.com> - 3.3.0-0.25
changelog:
  - Update to 3.3.0 final
  - Add upstream fix for ldap connections to AD (Bug #6073)
  - Remove bogus perl dependencies (resolves: #473051)


author: Simo Sorce <ssorce@redhat.com> - 3.3.1-0.29
changelog:
  - Make the talloc and ldb packages optionsl and disable their build within
    the samba3 package, they are now built as part of the samba4 package
    until they will both be released as independent packages.


author: Simo Sorce <ssorce@redhat.com> - 3.3.2-0.33
changelog:
  - Fix nmbd init script nmbd reload was causing smbd not nmbd to reload the
    configuration
  - Fix upstream bug 6224, nmbd was waiting 5+ minutes before running elections on
    startup, causing your own machine not to show up in the network for 5 minutes
    if it was the only client in that workgroup (fix committed upstream)


author: Guenther Deschner <gdeschner@redhat.com> - 3.4.0-0.41
changelog:
  - Fix Bug #6551 (vuid and tid not set in sessionsetupX and tconX)
  - Specify required talloc and tdb version for BuildRequires


author: Simo Sorce <ssorce@redhat.com> - 3.4.2-47
changelog:
  - Spec file cleanup
  - Fix sources upstream location
  - Remove conditionals to build talloc and tdb, now they are completely indepent
    packages in Fedora
  - Add defattr() where missing
  - Turn all tabs into 4 spaces
  - Remove unused migration script
  - Split winbind-clients out of main winbind package to avoid multilib to include
    huge packages for no good reason


author: Guenther Deschner <gdeschner@redhat.com> - 3.4.2-49
changelog:
  - Add missing defattrs in specfile
  - Fix upstream tarball url in specfile
  - Cleanup unapplied patch
  - related: #543948


author: Guenther Deschner <gdeschner@redhat.com> - 3.5.1-56
changelog:
  - Update to 3.5.1
  - Security update that resolves CVE-2010-0728
  - Remove cifs.upcall and mount.cifs entirely
  - related: #556558


author: Guenther Deschner <gdeschner@redhat.com> - 3.5.8-89
changelog:
  - Fix printcap handling and cups spooler interaction
  - resolves: #709070
  - Fix spoolss form index mixup (wrong papersize)
  - resolves: #703393


author: Guenther Deschner <gdeschner@redhat.com> - 3.5.8-91
changelog:
  - Fix lsa lookupsids calls over ncacn_ip_tcp that caused getent passwd queries
    to fail
  - resolves: #709641


author: - Andreas Schneider <asn@redhat.com> - 3.6.8-131
changelog:
  - Handle error if invalid ports have been specified gracefully.
  - resolves: #845760
  - Fix printing regression with builtin forms.
  - resolves: #860967


author: - Andreas Schneider <asn@redhat.com> - 3.6.8-136
changelog:
  - Fix loading the imap hash module.
  - resolves: #864045
  - Fix raw printing support.
  - related: #857942


author: - Alexander Bokovoy <abokovoy@redhat.com> - 3.6.8-137
changelog:
  - Use alternatives to configure winbind_krb5_locator.so.
  - Move wbinfo and ntlm_auth to the correct package so samba4 can
    correctly handle conflicts.
  - resolves: #864950


author: - Andreas Schneider <asn@redhat.com> - 3.6.9-152
changelog:
  - Fix 'map untrusted to domain' with NTLMv2.
  - resolves: #961932
  - Fix the username map optimization.
  - resolves: #952268
  - Fix 'net ads keytab add' not respecting the case.
  - resolves: #955683
  - Fix write operations as guest with security = share
  - resolves: #953025
  - Fix pam_winbind upn to username conversion if you have different seperator.
  - resolves: #949613
  - Change chkconfig order to start winbind before netfs.
  - resolves: #948623
  - Fix cache issue when resoliving groups without domain name.
  - resolves: #927383


author: - Andreas Schneider <asn@redhat.com> - 3.6.9-153
changelog:
  - Fix overwrite of errno in check_parent_exists().
  - resolves: #966489
  - Fix dir code using dirfd() without vectoring trough VFS calls.
  - resolves: #971283


author: - Andreas Schneider <asn@redhat.com> - 3.6.9-155
changelog:
  - Check for system libtevent and require version 0.9.18.
  - Use tevent epoll backend in winbind.
  - resolves: #951175


author: - Andreas Schneider <asn@redhat.com> - 3.6.9-156
changelog:
  - Fix PIDL parsing with newer versions of gcc.
  - Fix dereferencing a unique pointer in the WKSSVC server.
  - resolves: #980382


author: - Andreas Schneider <asn@redhat.com> - 3.6.9-158
changelog:
  - resolves: #984808 - CVE-2013-4124: DoS via integer overflow when reading
                        an EA list


author: - Andreas Schneider <asn@redhat.com> - 3.6.9-159
changelog:
  - resolves: #995109 - net ads join - segmentation fault if no realm has been
                        specified.
  - List all vfs, auth and charset modules in the spec file.


author: - Andreas Schneider <asn@redhat.com> - 3.6.9-160
changelog:
  - resolves: #948071 - Group membership is not correct on logins with new
                        AD groups.
  - resolves: #953985 - User and group info not return from a Trusted Domain.


author: - Andreas Schneider <asn@redhat.com> - 3.6.9-161
changelog:
  - resolves: #997338 - Fix smbstatus as non root user.
  - resolves: #1003689 - Fix Windows 8 printer driver support.


author: - Andreas Schneider <asn@redhat.com> - 3.6.9-164
changelog:
  - resolves: #1008574 - Fix offline logon cache not updating for cross child
                         domain group membership.


author: - Andreas Schneider <asn@redhat.com> - 3.6.22-1
changelog:
  - resolves: #1003921 - Rebase Samba to 3.6.22.
  - resolves: #1035332 - Fix force user with 'security = user'.


author: - Andreas Schneider <asn@redhat.com> - 3.6.23-1
changelog:
  - resolves: #1073356 - Fix CVE-2013-4496, CVE-2012-6150 and CVE-2013-6442.
  - resolves: #1018038 - Fix CVE-2013-4408.


author: - Andreas Schneider <asn@redhat.com> - 3.6.23-2
changelog:
  - resolves: #1022534 - Do not build Samba with fam support.
  - resolves: #1059301 - Fix nbt query with many components.
  - resolves: #1057332 - Fix force user with guest account.
  - resolves: #1021706 - Fix %G substitution in 'template homedir'.
  - resolves: #1040472 - Fix group expansion in service path.
  - resolves: #1069570 - Fix memory leak reading printer list.
  - resolves: #1067607 - Fix wbinfo -i with one-way trusts.
  - resolves: #1050887 - Fix 100% CPU utilization in winbindd when trying to
                         free memory in winbindd_reinit_after_fork.
  - resolves: #1029000 - Fix 'force user' with 'security = ads'.


author: - Guenther Deschner <gdeschner@redhat.com> - 3.6.23-4
changelog:
  - resolves: #1051656 - Fix gecos field copy debug warning.
  - resolves: #1061301 - Add glusterfs vfs module.
  - resolves: #1087472 - Fix libsmbclient crash when HOME variable isn't set.
  - resolves: #1099443 - 'net ads testjoin' fails with IPv6.
  - resolves: #1100670 - Fix 'force user' with 'security = ads'.
  - resolves: #1096522 - Fix enabling SMB2 causes file operations to fail.


author: - Guenther Deschner <gdeschner@redhat.com> - 3.6.23-6
changelog:
  - resolves: #1105500 - CVE-2014-0244: DoS in nmbd.
  - resolves: #1108841 - CVE-2014-3493: DoS in smbd with unicode path names.


author: - Andreas Schneider <asn@redhat.com> - 3.6.23-8
changelog:
  - resolves: #1110733 - Fix write operations as guest with 'security = share'.
  - resolves: #1053886 - Fix receiving the gecos field with winbind.


author: Andrew Bartlett <abartlet@samba.org> - 0:4.0.0-0.4.alpha5.fc10
changelog:
  - Remove talloc and tdb dependency (per https://bugzilla.redhat.com/show_bug.cgi?id=453083)
  - Fix deps on chkconfig and service to main pkg (not -common) 
    (per https://bugzilla.redhat.com/show_bug.cgi?id=453083)


author: Andrew Bartlett <abartlet@samba.org> - 0:4.0.0-0.5.alpha5.fc10
changelog:
  - Fix licence tag (the binaries are built into a GPLv3 whole, so the BSD licence need not be mentioned)


author: Matthew Barnes <mbarnes@redhat.com> - 4.0.0-0.7.alpha6.GIT.3508a66
changelog:
  - Disable the winbind subpackage because it conflicts with samba-winbind
    and isn't needed to support OpenChange.


author: Simo Sorce <ssorce@redhat.com> - 4.0.0-7alpha7
changelog:
  - Compile and have separate packages for additional samba libraries
    Package in their own packages: talloc, tdb, tevent, ldb


author: Simo Sorce <ssorce@redhat.com> - 4.0.0-9alpha7
changelog:
  - Make talloc,tdb,tevent,ldb easy to exclude using defines
  - Fix package for non-mock "dirty" systems by deleting additional
    files we are not interested in atm


author: - Andreas Schneider <asn@redhat.com> - 4.0.0-27.rc1
changelog:
  - Fix permission for init scripts.
  - Define a common KRB5CCNAME for smbd and winbind.
  - Set piddir back to /var/run in RHEL6.
  - related: #766333


author: - Andreas Schneider <asn@redhat.com> - 4.0.0-30.rc2
changelog:
  - Fix multilib package installation.
  - resolves: #862047
  - Filter out libsmbclient and libwbclient provides.
  - resolves: #861892
  - Rebase to version 4.0.0rc2.
  - related: #766333


author: - Andreas Schneider <asn@redhat.com> - 4.0.0-41.rc4
changelog:
  - Fix library dependencies found by rpmdiff.
  - Update winbind offline logon patch.
  - related: #766333


author: - Andreas Schneider <asn@redhat.com> - 4.0.0-54.rc4
changelog:
  - Fix summary and description of dc subpackages.
  - resolves: #896142
  - Remove conflicting libsmbclient.7 manpage.
  - resolves: #896240


author: - Andreas Schneider <asn@redhat.com> - 4.0.0-56.rc4
changelog:
  - Fix libwbclient.so.0 symlink.
  - resolves: #882338
  - Fix correct linking of libreplace with cmdline-credentials.
  - resolves: #911264


author: - Andreas Schneider <asn@redhat.com> - 4.0.0-57.rc4
changelog:
  - resolves: #984809 - CVE-2013-4124: DoS via integer overflow when reading
                        an EA list


author: - Andreas Schneider <asn@redhat.com> - 4.0.0-61.rc4
changelog:
  - resolves: #1073356 - Fix CVE-2012-6150.
  - resolves: #1073356 - Fix CVE-2013-4496.
  - resolves: #1073356 - Fix CVE-2013-6442.


author: - Guenther Deschner <gdeschner@redhat.com> - 4.0.0-62.rc4
changelog:
  - resolves: #1105502 - CVE-2014-0244: DoS in nmbd.
  - resolves: #1108843 - CVE-2014-3493: DoS in smbd with unicode path names.
  - resolves: #1105572 - CVE-2014-0178: Uninitialized memory exposure.


author: <ratliff@austin.ibm.com> - 1.3.0-1
changelog:
  - updated buildrequires to require libcurl-devel rather than curl-devel
  - removed requires to allow rpm to automatically generate the requires
  - removed echo to stdout
  - removed paranoia check around cleaning BuildRoot per Fedora MUST requirements
  - changed group to supress rpmlint complaint
  - added chkconfig to enable sfcb by default when it is installed
  - added patch0 to enable 1.3.0 to build on Fedora 9


author: <ratliff@austin.ibm.com> - 1.3.2-1
changelog:
  - updated upstream version and added CFLAGS to configure to work 
  - around http://sources.redhat.com/bugzilla/show_bug.cgi?id=6545


author: <ratliff@austin.ibm.com> - 1.3.2-2
changelog:
  - updated spec file based on comments from Srini Ramanatha as below:
  - updated the Release line to add dist to be consistent with sblim-sfcc
  - updated the source URL


author: <ratliff@austin.ibm.com> - 1.3.4-3
changelog:
  - re-ordered the top so that the name comes first
  - added the la files to the package list
  - removed the smp flags from make because that causes a build break
  - updated spec file to remove schema and require the cim-schema package
  - change provides statement to cim-server as suggested by Matt Domsch
  - updated to upstream version 1.3.4 which was released Jun 15 2009


author: <ratliff@austin.ibm.com> - 1.3.4-4
changelog:
  - added build requires for flex, bison, cim-schema suggested by Sean Swehla
  - added sfcbrepos directive to post section


author: <srinivas_ramanatha@dell.com> - 1.3.4-5
changelog:
  - added the devel package to fit in all the development files 
  - Made changes to the initscript not to start the service by default


author: <praveen_paladugu@dell.com>- 1.3.4-9
changelog:
  - LocalInterfaceInvokeMethodFix: CHARS and string were handled the same.
  -  They are differentiated in this patch.
  - destroyThreadKey: Local sfcb connect was creating thread specific data
  -  associating a key to it. This won't get deleted resulting in crash
  -  of opwsman, sfcc and sfcb. This patch deletes that data.


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.3.11-1
changelog:
  - Update to sblim-sfcb-1.3.11
    Resolves: #633580
  - Compile with --enable-uds, i. e. enable unix domain socket local connect functionality
    Resolves: #620303
  - Create sfcb system group (used by basic authentication with PAM) in pre install scriptlet,
    remove it in post uninstall scriptlet
    Resolves: #618081
  - Fix default location where sfcbrepos is looking for schema files
    and simplify sfcbrepos command in post install sciptlet
    Resolves: #618080


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.3.11-2
changelog:
  - Checks for valid pointer before calling free() in providerDrv.c,
    result.c and support.c (backported from upstream)


author: Jindrich Novy <jnovy@redhat.com> 0.1-6
changelog:
  - %stack_name: initial part of stack prefix and name of
    meta package providing scriptlets
  - %stack_prefix: stack namespacing part to be prepended to
    original non-stack package name, can be used for Provides
    namespacing as well
  - %stack_runtime: run-time package name providing scriptlets
  - %stack_require: macro to define dependency to other stacks


author: Jindrich Novy <jnovy@redhat.com> 0.1-9
changelog:
  - introduce stack enablement tracking
  - introduce "stack_enabled" helper utility to let a stack
    application figure out which stacks are actually enabled
  - disallow running stacks recursively


author: Jindrich Novy <jnovy@redhat.com> 0.1-11
changelog:
  - avoid redefinition of %_root* macros by multiple
    occurence of %stack_package
  - make the Stack root path configurable


author: Jindrich Novy <jnovy@redhat.com> 0.1-14
changelog:
  - define %_defaultdocdir to properly relocate docs into
    a stack
  - document a way how to pass command to stack via stdin


author: Jindrich Novy <jnovy@redhat.com> 20120209-1
changelog:
  - fix minor bugs (#788194)
    - clear temp files
    - handle commands from stdin properly
    - run command even if ran as "scl enable SCL command" from already
      enabled SCL


author: Jindrich Novy <jnovy@redhat.com> 20120423-1
changelog:
  - update to the latest upstream scl-utils-20120423 (#713147)
   - filesystem ownership by meta package
   - add man page
   - fix memory leak when parsing commands from stdin
   - use more descriptive error message if /etc/prefixes is missing
   - do not prepend scl_* prefix to package names
   - unify package naming to <SCL>-package-version
   - add scl --list functionality to list available SCLs


author: Jindrich Novy <jnovy@redhat.com> 20120613-2
changelog:
  - backport patch from upstream to correctly process buildroot
    after installation (compress man pages, etc.) (#844028)


author: Jan Zeleny <jzeleny@redhat.com> - 20120927-5
changelog:
  - Allow overriding values in macro scl_package (#957185)
  - Delete redundant argument from check_asprintf (#957183)
  - Enable all collections given as arguments, not just the first one (#949995)
  - Prevent collections to be enabled multiple times (#955669)


author: Jan Zeleny <jzeleny@redhat.com> - 20120927-9
changelog:
  - add scl_source script for intercollection dependencies (#874417)
  - updated macros in macros.scl-filesystem (#1029515, #1029516)
  - add delimiter between collections and command (#1029517)


author: Jan Zeleny <jzeleny@redhat.com> - 20120827-11
changelog:
  - reverted the last patch, as it breaks some collections. The revert
    is necessary for RHSCL compose, we are looking for other solutions.


author: Albert Uchytil <auchytil@redhat.com> 20120827-14
changelog:
  - updated man pages
  - changed debuginfo package handling (#1071834)
  - added capability of dynamically registering and deregistering collections (#1099394)


author: Jan Zeleny <jzeleny@redhat.com> - 20120927-20
changelog:
  - register and deregister: if there is an error registering or deregistering
    one or more collection, skip it but return non-zero return code
  - fix the problem with metapackage dependencies when BuildArch is specified


author: Jan Zeleny <jzeleny@redhat.com> - 20120927-21
changelog:
  - fix an obscure segfault when listing collections on i386
  - fix registration to work with slash-ended paths
  - add the %scl_dependency_generators macro
  - drop recursive ownership of /usr/lib within SCL root


author: Jan Zeleny <jzeleny@redhat.com> - 20120927-22
changelog:
  - Add execution of register and deregister scripts during registration
    and deregistration if they exist.
  - Add capability to make collection nfs mountable using macro nfsmountable.
  - removed the dependency generators and all related changes
    (maintainers' demands)


author: Lubos Kardos <lkardos@redhat.com - 20120927-23
changelog:
  - Modified paths of state and conf files
  - Add owning and creating of state and conf files if nfsmountable is defined
  - Add printing file names in error messages


author: Lubos Kardos <lkardos@redhat.com> - 20120927-25
changelog:
  - Creating filelist in build subdirectory instead of build directory.
  - Removing filelist before build.


author: Dan Walsh <dwalsh@redhat.com> 2.1.1-3
changelog:
  - Add two new httpd booleans, turned off by default
       * httpd_can_network_relay
       * httpd_can_network_connect_db


author: Dan Walsh <dwalsh@redhat.com> 2.1.2-1
changelog:
  - Update to upstream 
  - Turn off allow_execmem and allow_execmod booleans
  - Add tcpd and automount policies


author: Jeremy Katz <katzj@redhat.com> - 2.1.2-3
changelog:
  - fix requirements to be on the actual packages so that policy can get
    created properly at install time


author: Dan Walsh <dwalsh@redhat.com> 2.1.3-1
changelog:
  - Turn back on execmem since we need it for java, firefox, ooffice
  - Allow gpm to stream socket to itself


author: Dan Walsh <dwalsh@redhat.com> 2.1.6-13
changelog:
  - Add dri libs to textrel_shlib_t
  - Add system_r role for java
  - Add unconfined_exec_t for vncserver
  - Allow slapd to use kerberos


author: Dan Walsh <dwalsh@redhat.com> 2.1.12-3
changelog:
  - Fix for procmail/spamassasin
  - Update to upstream
  - Add rules to allow rpcd to work with unlabeled_networks.


author: Dan Walsh <dwalsh@redhat.com> 2.2.2-1
changelog:
  - Update to upstream
  - Turn off execheap execstack for unconfined users
  - Add mono/wine policy to allow execheap and execstack for them
  - Add execheap for Xdm policy


author: Dan Walsh <dwalsh@redhat.com> 2.2.19-2
changelog:
  - Fix swapon
  - allow httpd_sys_script_t to be entered via a shell
  - Allow httpd_sys_script_t to read eventpolfs


author: Dan Walsh <dwalsh@redhat.com> 2.2.20-1
changelog:
  - Fix load_policy to work on MLS
  - Fix cron_rw_system_pipes for postfix_postdrop_t
  - Allow audotmount to run showmount


author: Dan Walsh <dwalsh@redhat.com> 2.2.23-8
changelog:
  - Blkid changes
  - Allow udev access to usb_device_t
  - Fix post script to create targeted policy config file


author: Dan Walsh <dwalsh@redhat.com> 2.2.23-17
changelog:
  - MLS Fixes
       dmidecode needs mls_file_read_up
  - add ypxfr_t
  - run init needs access to nscd
  - udev needs setuid
  - another xen log file
  - Dontaudit mount getattr proc_kcore_t


author: Dan Walsh <dwalsh@redhat.com> 2.2.29-2
changelog:
  - Add mono dbus support
  - Lots of file_context fixes for textrel_shlib_t in FC5
  - Turn off execmem auditallow since they are filling log files


author: Russell Coker <rcoker@redhat.com> 2.2.29-5
changelog:
  - Fixed mailman with Postfix #183928
  - Allowed semanage to create file_context files.
  - Allowed amanda_t to access inetd_t TCP sockets and allowed amanda_recover_t
    to bind to reserved ports.  #149030
  - Don't allow devpts_t to be associated with tmp_t.
  - Allow hald_t to stat all mountpoints.
  - Added boolean samba_share_nfs to allow smbd_t full access to NFS mounts.
    - Make mount run in mount_t domain from unconfined_t to prevent mislabeling of
    /etc/mtab.
  - Changed the file_contexts to not have a regex before the first ^/[a-z]/
    whenever possible, makes restorecon slightly faster.
  - Correct the label of /etc/named.caching-nameserver.conf
  - Now label /usr/src/kernels/.+/lib(/.*)? as usr_t instead of
    /usr/src(/.*)?/lib(/.*)? - I don't think we need anything else under /usr/src
    hit by this.
  - Granted xen access to /boot, allowed mounting on xend_var_lib_t, and allowed
    xenstored_t rw access to the xen device node.


author: Dan Walsh <dwalsh@redhat.com> 2.2.29-6
changelog:
  - Allow secadm_t ability to relabel all files
  - Allow ftp to search xferlog_t directories
  - Allow mysql to communicate with ldap
  - Allow rsync to bind to rsync_port_t


author: Dan Walsh <dwalsh@redhat.com> 2.2.32-2
changelog:
  - Add unconfined_mount_t
  - Allow privoxy to connect to httpd_cache
  - fix cups labeleing on /var/cache/cups


author: Dan Walsh <dwalsh@redhat.com> 2.3.3-3
changelog:
  - Allow prelink to read bin_t symlink
  - allow xfs to read random devices
  - Change gfs to support xattr


author: Dan Walsh <dwalsh@redhat.com> 2.3.3-11
changelog:
  - Added Paul Howarth patch to only load policy packages shipped 
    with this package
  - Allow pidof from initrc to ptrace higher level domains
  - Allow firstboot to communicate with hal via dbus


author: Dan Walsh <dwalsh@redhat.com> 2.3.6-4
changelog:
  - Change allow_execstack to default to on, for RHEL5 Beta.  
    This is required because of a Java compiler problem.
    Hope to turn off for next beta


author: Dan Walsh <dwalsh@redhat.com> 2.3.9-4
changelog:
  - Set /usr/lib/ia32el/ia32x_loader to unconfined_execmem_exec_t for ia32 platform
  - Fix spec for /dev/adsp


author: Dan Walsh <dwalsh@redhat.com> 2.3.16-9
changelog:
  - Remove bluetooth-helper transition
  - Add selinux_validate for semanage
  - Require new version of libsemanage


author: James Antill <james.antill@redhat.com> 2.4.2-6
changelog:
  - Fix policygentool specfile problem.
  - Allow apache to send signals to it's logging helpers.
  - Resolves: rhbz#212731


author: Dan Walsh <dwalsh@redhat.com> 2.4.6-1
changelog:
  - Dontaudit appending hal_var_lib files 
  Resolves: #217452
  Resolves: #217571
  Resolves: #217611
  Resolves: #217640
  Resolves: #217725


author: Dan Walsh <dwalsh@redhat.com> 2.4.6-3
changelog:
  - Allow login programs to polyinstatiate homedirs
  Resolves: #216184
  - Allow quotacheck to create database files
  Resolves: #212957


author: Dan Walsh <dwalsh@redhat.com> 2.4.6-16
changelog:
  - Allow semanage to exec it self.  Label genhomedircon as semanage_exec_t
  Resolves: #219421
  - Allow sysadm_lpr_t to manage other print spool jobs
  Resolves: #220080


author: Dan Walsh <dwalsh@redhat.com> 2.5.1-1
changelog:
  - Allow prelink when run from rpm to create tmp files
  Resolves: #221865
  - Remove file_context for exportfs
  Resolves: #221181
  - Allow spamassassin to create ~/.spamassissin
  Resolves: #203290
  - Allow ssh access to the krb tickets
  - Allow sshd to change passwd
  - Stop newrole -l from working on non securetty
  Resolves: #200110
  - Fixes to run prelink in MLS machine
  Resolves: #221233
  - Allow spamassassin to read var_lib_t dir
  Resolves: #219234


author: Dan Walsh <dwalsh@redhat.com> 2.5.2-1
changelog:
  - Add ability to generate webadm_t policy
  - Lots of new interfaces for httpd
  - Allow sshd to login as unconfined_t


author: Dan Walsh <dwalsh@redhat.com> 2.5.2-4
changelog:
  - Fix spamassisin so crond can update spam files
  - Fixes to allow kpasswd to work
  - Fixes for bluetooth


author: Dan Walsh <dwalsh@redhat.com> 2.5.2-6
changelog:
  - Allow mozilla, evolution and thunderbird to read dev_random.
  Resolves: #227002
  - Allow spamd to connect to smtp port
  Resolves: #227184
  - Fixes to make ypxfr work
  Resolves: #227237


author: Dan Walsh <dwalsh@redhat.com> 2.5.4-2
changelog:
  - Revert Nemiver change
  - Set sudo as a corecmd so prelink will work,  remove sudoedit mapping, since this will not work, it does not transition.
  - Allow samba to execute useradd


author: Dan Walsh <dwalsh@redhat.com> 2.5.11-6
changelog:
  - Fix hald_acl_t to be able to getattr/setattr on usb devices
  - Dontaudit write to unconfined_pipes for load_policy


author: Dan Walsh <dwalsh@redhat.com> 2.6.4-5
changelog:
  - More fixes for alsactl
  - Transition from hal and modutils
  - Fixes for suspend resume.  
       - insmod domtrans to alsactl
       - insmod writes to hal log


author: Dan Walsh <dwalsh@redhat.com> 3.0.2-7
changelog:
  - Begin adding policy to separate setsebool from semanage
  - Fix xserver.if definition to not break sepolgen.if


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-7
changelog:
  - Allow cupsd_config_t to read/write usb_device_t
  - Support for finger print reader,
  - Many fixes for clvmd
  - dbus starting networkmanager


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-15
changelog:
  - Allow tmpreadper to read man_t
  - Allow racoon to bind to all nodes
  - Fixes for finger print reader


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-28
changelog:
  - Fixes for hald_mac 
  - Treat unconfined_home_dir_t as a home dir
  - dontaudit rhgb writes to fonts and root


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-30
changelog:
  - Allow XServer to read /proc/self/cmdline
  - Fix unconfined cron jobs
  - Allow fetchmail to transition to procmail
  - Fixes for hald_mac
  - Allow system_mail to transition to exim
  - Allow tftpd to upload files
  - Allow xdm to manage unconfined_tmp
  - Allow udef to read alsa config
  - Fix xguest to be able to connect to sound port


author: Dan Walsh <dwalsh@redhat.com> 3.2.5-6
changelog:
  - Fix role transition from unconfined_r to system_r when running rpm
  - Allow unconfined_domains to communicate with user dbus instances


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-5
changelog:
  - Allow nsplugin_config execstack/execmem
  - Allow nsplugin_t to read alsa config
  - Change apache to use user content


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-6
changelog:
  - Prepare policy for beta release
  - Change some of the system domains back to unconfined
  - Turn on some of the booleans


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-15
changelog:
  - Allow init to transition to initrc_t on shell exec.
  - Fix init to be able to sendto init_t.
  - Allow syslog to connect to mysql
  - Allow lvm to manage its own fifo_files
  - Allow bugzilla to use ldap
  - More mls fixes


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-20
changelog:
  - Fix bug in mozilla policy to allow xguest transition
  - This will fix the 

  libsemanage.dbase_llist_query: could not find record value
  libsemanage.dbase_llist_query: could not query record value (No such file or
  directory)
   bug in xguest


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-22
changelog:
  - Allow stunnel to transition to inetd children domains
  - Make unconfined_dbusd_t an unconfined domain


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-27
changelog:
  - Allow nsplugin to read /etc/mozpluggerrc, user_fonts
  - Allow syslog to manage innd logs.
  - Allow procmail to ioctl spamd_exec_t


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-28
changelog:
  - Allow radvd to use fifo_file
  - dontaudit setfiles reading links
  - allow semanage sys_resource
  - add allow_httpd_mod_auth_ntlm_winbind boolean
  - Allow privhome apps including dovecot read on nfs and cifs home 
  dirs if the boolean is set


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-44
changelog:
  - Change unconfined_t to transition to unconfined_mono_t when running mono
  - Change XXX_mono_t to transition to XXX_t when executing bin_t files, so gnome-do will work


author: Dan Walsh <dwalsh@redhat.com> 3.4.1-3
changelog:
  - Dontaudit search of admin_home for init_system_domain
  - Rewrite of xace interfaces
  - Lots of new fs_list_inotify
  - Allow livecd to transition to setfiles_mac


author: Dan Walsh <dwalsh@redhat.com> 3.4.2-7
changelog:
  - Allow confined users to use postgres
  - Allow system_mail_t to exec other mail clients
  - Label mogrel_rails as an apache server


author: Dan Walsh <dwalsh@redhat.com> 3.4.2-12
changelog:
  - Allow amanda to read tape
  - Allow prewikka cgi to use syslog, allow audisp_t to signal cgi
  - Add support for netware file systems


author: Dan Walsh <dwalsh@redhat.com> 3.5.1-1
changelog:
  - Fix xguest -> xguest_mozilla_t -> xguest_openiffice_t
  - Change dhclient to be able to red networkmanager_var_run


author: Dan Walsh <dwalsh@redhat.com> 3.5.1-4
changelog:
  - Consolodate pyzor,spamassassin, razor into one security domain
  - Fix xdm requiring additional perms.


author: Dan Walsh <dwalsh@redhat.com> 3.5.10-1
changelog:
  - Allow NetworkManager to transition to avahi and iptables
  - Allow domains to search other domains keys, coverup kernel bug


author: Dan Walsh <dwalsh@redhat.com> 3.5.13-14
changelog:
  - Additional fixes for cyphesis
  - Fix certmaster file context
  - Add policy for system-config-samba
  - Allow hal to read /var/run/video.rom


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-6
changelog:
  - Allow cupsd_t to create link files in print_spool_t
  - Fix iscsi_stream_connect typo
  - Fix labeling on /etc/acpi/actions
  - Don't reinstall unconfine and unconfineuser on upgrade if they are not installed


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-19
changelog:
  - Allow initrc_t to delete dev_null
  - Allow readahead to configure auditing
  - Fix milter policy
  - Add /var/lib/readahead


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-20
changelog:
  - Fix labeling on /var/lib/misc/prelink*
  - Allow xserver to rw_shm_perms with all x_clients
  - Allow prelink to execute files in the users home directory


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-21
changelog:
  - Allow confined users to manage virt_content_t, since this is home dir content
  - Allow all domains to read rpm_script_tmp_t which is what shell creates on redirection


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-27
changelog:
  - Fix /sbin/ip6tables-save context
  - Allod udev to transition to mount
  - Fix loading of mls policy file


author: Dan Walsh <dwalsh@redhat.com> 3.6.13-3
changelog:
  - Add fish as a shell
  - Allow fprintd to list usbfs_t
  - Allow consolekit to search mountpoints
  - Add proper labeling for shorewall


author: Dan Walsh <dwalsh@redhat.com> 3.6.25-1
changelog:
  - Fix polkit label
  - Remove hidebrokensymptoms for nss_ldap fix
  - Add modemmanager policy
  - Lots of merges from upstream
  - Begin removing textrel_shlib_t labels, from fixed libraries


author: Dan Walsh <dwalsh@redhat.com> 3.6.31-4
changelog:
  - Fix devicekit_disk_t to getattr on all domains sockets and fifo_files
  - Conflicts seedit (You can not use selinux-policy-targeted and seedit at the same time.)


author: Dan Walsh <dwalsh@redhat.com> 3.6.31-5
changelog:
  - Fix label on /usr/bin/notepad, /usr/sbin/vboxadd-service
  - Remove policycoreutils-python requirement except for minimum


author: Dan Walsh <dwalsh@redhat.com> 3.6.32-13
changelog:
  - Allow cupsd_config to read user tmp
  - Allow snmpd_t to signal itself
  - Allow sysstat_t to makedir in sysstat_log_t


author: Dan Walsh <dwalsh@redhat.com> 3.7.7-1
changelog:
  - Move users file to selection by spec file.
  - Allow vncserver to run as unconfined_u:unconfined_r:unconfined_t


author: Dan Walsh <dwalsh@redhat.com> 3.7.8-3
changelog:
  - Allow abrt_helper to getattr on all filesystems
  - Add label for /opt/real/RealPlayer/plugins/oggfformat\.so


author: Dan Walsh <dwalsh@redhat.com> 3.7.10-4
changelog:
  - Change allow_execstack and allow_execmem booleans to on
  - dontaudit acct using console
  - Add label for fping
  - Allow tmpreaper to delete sandbox_file_t
  - Fix wine dontaudit mmap_zero
  - Allow abrt to read var_t symlinks


author: Dan Walsh <dwalsh@redhat.com> 3.7.10-5
changelog:
  - Add MLS fixes found in RHEL6 testing
  - Allow domains to append to rpm_tmp_t
  - Add cachefilesfd policy
  - Dontaudit leaks when transitioning


author: Dan Walsh <dwalsh@redhat.com> 3.7.11-1
changelog:
  - Update to upstream - These are merges of my patches
  - Remove 389 labeling conflicts
  - Add MLS fixes found in RHEL6 testing
  - Allow pulseaudio to run as a service
  - Add label for mssql and allow apache to connect to this database port if boolean set
  - Dontaudit searches of debugfs mount point
  - Allow policykit_auth to send signals to itself
  - Allow modcluster to call getpwnam
  - Allow swat to signal winbind
  - Allow usbmux to run as a system role
  - Allow svirt to create and use devpts


author: Dan Walsh <dwalsh@redhat.com> 3.7.13-4
changelog:
  - Allow users to dbus chat with xdm
  - Allow users to r/w wireless_device_t
  - Dontaudit reading of process states by ipsec_mgmt


author: Dan Walsh <dwalsh@redhat.com> 3.7.14-2
changelog:
  - Dontaudit ipsec_mgmt sys_ptrace
  - Allow at to mail its spool files
  - Allow nsplugin to search in .pulse directory


author: Dan Walsh <dwalsh@redhat.com> 3.7.15-4
changelog:
  - Add label for /var/lib/upower
  - Allow logrotate to run sssd
  - dontaudit readahead on tmpfs blk files
  - Allow tmpreaper to setattr on sandbox files
  - Allow confined users to execute dos files
  - Allow sysadm_t to kill processes running within its clearance
  - Add accountsd policy
  - Fixes for corosync policy
  - Fixes from crontab policy
  - Allow svirt to manage svirt_image_t chr files
  - Fixes for qdisk policy
  - Fixes for sssd policy
  - Fixes for newrole policy


author: Dan Walsh <dwalsh@redhat.com> 3.7.16-1
changelog:
  - Update to upstream
  - Allow tmpreaper to delete sandbox sock files
  - Allow chrome-sandbox_t to use /dev/zero, and dontaudit getattr file systems
  - Fixes for gitosis
  - No transition on livecd to passwd or chfn
  - Fixes for denyhosts


author: Dan Walsh <dwalsh@redhat.com> 3.7.16-2
changelog:
  - Fix ~/.fontconfig label
  - Add /root/.cert label
  - Allow reading of the fixed_file_disk_t:lnk_file if you can read file
  - Allow qemu_exec_t as an entrypoint to svirt_t


author: Dan Walsh <dwalsh@redhat.com> 3.7.17-3
changelog:
  - Fix cgroup handling adding policy for /cgroup
  - Allow confined users to write to generic usb devices, if user_rw_noexattrfile boolean set


author: Dan Walsh <dwalsh@redhat.com> 3.7.17-4
changelog:
  - Fix /cgroup file context 
  - Fix broken afs use of unlabled_t
  - Allow getty to use the console for s390


author: Dan Walsh <dwalsh@redhat.com> 3.7.17-6
changelog:
  - Fix allow_httpd_mod_auth_pam to use 	auth_use_pam(httpd_t)
  - Allow accountsd to read shadow file
  - Allow apache to send audit messages when using pam
  - Allow asterisk to bind and connect to sip tcp ports
  - Fixes for dovecot 2.0
  - Allow initrc_t to setattr on milter directories
  - Add procmail_home_t for .procmailrc file


author: Dan Walsh <dwalsh@redhat.com> 3.7.18-1
changelog:
  - Update to upstream
  - Fix label for  /opt/google/chrome/chrome-sandbox
  - Allow modemmanager to dbus with policykit


author: Dan Walsh <dwalsh@redhat.com> 3.7.18-3
changelog:
  - Allow ipsec_t to create /etc/resolv.conf with the correct label
  - Fix reserved port destination
  - Allow autofs to transition to showmount
  - Stop crashing tuned


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-1
changelog:
  - Update to upstream
  - Allow abrt to delete sosreport
  Resolves: #579998
  - Allow snmp to setuid and gid
  Resolves: #582155
  - Allow smartd to use generic scsi devices
  Resolves: #582145


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-3
changelog:
  - Fix label on /root/.rhosts
  Resolves: #582760
  - Add labels for Picasa
  - Allow openvpn to read home certs
  - Allow plymouthd_t to use tty_device_t
  - Run ncftool as iptables_t
  - Allow mount to unmount unlabeled_t
  - Dontaudit hal leaks


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-5
changelog:
  - Allow rlogind_t to search /root for .rhosts
  Resolves: #582760
  - Fix path for cached_var_t
  - Fix prelink paths /var/lib/prelink	
  - Allow confined users to direct_dri
  - Allow mls lvm/cryptosetup to work


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-6
changelog:
  - Allow initrc_t to read slapd_db_t
  Resolves: #585476
  - Allow ipsec_mgmt to use unallocated devpts and to create /etc/resolv.conf
  Resolves: #585963


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-11
changelog:
  - Fix location of oddjob_mkhomedir
  Resolves: #587385
  - fix labeling on /root/.shosts and ~/.shosts
  - Allow ipsec_mgmt_t to manage net_conf_t
  Resolves: #586760


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-12
changelog:
  - Allow initrc_t to remove dhcpc_state_t
  - Fix label on sa-update.cron
  - Allow dhcpc to restart chrony initrc
  - Don't allow sandbox to send signals to its parent processes
  - Fix transition from unconfined_t -> unconfined_mount_t -> rpcd_t
  Resolves: #589136


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-14
changelog:
  - Fixes for sandbox_x_net_t  to match access for sandbox_web_t ++
  - Add xdm_etc_t for /etc/gdm directory, allow accountsd to manage this directory
  - Add dontaudit interface for bluetooth dbus
  - Add chronyd_read_keys, append_keys for initrc_t
  - Add log support for ksmtuned
  Resolves: #586663


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-15
changelog:
  - Allow gdm to edit ~/.gconf dir
  Resolves: #590677
  - Allow dovecot to create directories in /var/lib/dovecot
  Partially resolves 590224
  - Allow avahi to dbus chat with NetworkManager
  - Fix cobbler labels
  - Dontaudit iceauth_t leaks
  - fix /var/lib/lxdm file context
  - Allow aiccu to use tun tap devices
  - Dontaudit shutdown using xserver.log


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-16
changelog:
  - Allow xm_t to read network state and get and set capabilities
  - Allow policykit to getattr all processes
  - Allow denyhosts to connect to tcp port 9911
  - Allow pyranha to use raw ip sockets and ptrace itself
  - Allow unconfined_execmem_t and gconfsd mechanism to dbus
  - Allow staff to kill ping process
  - Add additional MLS rules


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-17
changelog:
  - Fix path for /var/spool/abrt
  - Allow nfs_t as an entrypoint for http_sys_script_t
  - Add policy for piranha
  - Lots of fixes for sosreport


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-19
changelog:
  - Add labels for /sys
  - Allow sshd to getattr on shutdown
  - Fixes for munin
  - Allow sssd to use the kernel key ring
  - Allow tor to send syslog messages
  - Allow iptabels to read usr files
  - allow policykit to read all domains state


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-20
changelog:
  - Allow mount to r/w abrt fifo file
  - Allow svirt_t to getattr on hugetlbfs
  - Allow abrt to create a directory under /var/spool


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-21
changelog:
  - Allow login programs to read krb5_home_t
  Resolves: 594833
  - Add obsoletes for cachefilesfd-selinux package
  Resolves: #575084


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-22
changelog:
  - Allow procmail to execute scripts in the users home dir that are labeled home_bin_t
  - Fix /var/run/abrtd.lock label


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-23
changelog:
  - Add cmirrord policy
  - Fixes for accountsd policy
  - Fixes for boinc policy
  - Allow cups-pdf to set attributes on fonts cache directory
  - Allow radiusd to setrlimit
  - Allow nscd sys_ptrace capability


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-24
changelog:
  - Add support for /dev/vhost-net
  - Allow psad to read files in /usr
  - Allow systat to use nscd socket
  - Fixes for boinc policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-25
changelog:
  - Fixes for cmirrord policy
  - Dontaudit xauth to list inotifyfs filesystem.
  - Allow xserver to translate contexts.
  - Allow kdumpgui domain sys_admin capability
  - Allow vpnc to relabelfrom tun_socket
  - Allow prelink_cron_system_t to signal
  - Fixes for gitolite
  - Allow virt domain to read symbolic links in device directories


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-26
changelog:
  - Allow krb5kdc to write krb5kdc_principal_t file
  - Allow hald to send generic signal to dhcp client
  - Fix dev_rw_vhost interface
  - Add /var/run/abrt.socket label


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-27
changelog:
  - Allow ftpd ipc_lock capability
  - Allow audisp-remote to getcap and setcap
  - Allow iscsid to read and write raw memory devices
  - Fixes for bitlbee policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-30
changelog:
  - Allow sysadm to run ncftool
  - Fixes for cobbler policy
  - Allow Network Manager to transition to ipsec_mgmt domain
  - Add label for /usr/libexec/nm-openswan-service
  - Add label for /dev


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-31
changelog:
  - Remove daemons dontaudit to search all dirs 
  - Add support for epylog
  - All all domains to read lib files
  - Allow denyhosts to send syslog messages
  - Allow mysql-safe setrlimit
  - Allow rpm to execute rpm_tmp_t
  - Allow dmesg to appen abrt_var_cache files
  - Fixed label for abrt.socket


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-32
changelog:
  - Allow sectool to connect to users over unix stream socket
  - Add label for /var/spool/abrt-upload
  - Add audio_home_t type for homedir/Music files
  - Allow aiccu to read network config files
  - Allow qpidd to setsched
  - Allow virt domains to manage svirt_image_t fifo files
  - Fixes for NM-openswan
  - Fixes for admin interfaces


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-36
changelog:
  - Allow netutils to read and write USB monitor devices
  - Fix label for /rhev
  - Add user_setrlimit boolean
  - Allow initrc to manage virt lib files
  - Add support for ebtables
  - Add label for /bin/mksh
  - Dontaudit aiccu sys_tty_config capability
  - Add httpd_setrlimit boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-37
changelog:
  - Redefine hi_reserved_port_t to include ports from 512 to 599 
  - Add label for /sbin/sushell
  - Fixes for munin plugin policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-38
changelog:
  - Allow xdm_t to manage gnome homedir content
  - Allow s-c-firewall to read and write virtual memory sysctls
  - Fixes for logwatch policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-39
changelog:
  - Allow munin_system_plugin to read files in /usr
  - Do not audit insmod attempts to write virt daemon unnamed pipes
  - Allow corosync to read ricci lib files


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-40
changelog:
  - Fixes for puppetmaster
  - Fix label for kadmin init script
  - Fixes for logwatch-mail policy
  - Allow arpwatch to request the kernel to load modules
  - Allow cron jobs to run with context of user that started them


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-41
changelog:
  - Allow logwatch_mail to read read the networking state information.
  - Add label for /usr/bin/dosbox
  - Allow systat sys_admin capability


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-42
changelog:
  - Allow kdump to read information from the debugging filesystem
  - Update boinc policy
  - Fixes for logwatch-mail policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-43
changelog:
  - Allow ncftool to run brctl
  - Fixes for ricci-modclusterd policy
  - Allow uucpd to execute ssh client
  - Add label for dayplanner
  - Allow sandbox_xserver execstack


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-45
changelog:
  - Fixes for cgroup policy
  - Fixes for ncftool policy
  - Add ncftool_read_user_content boolean
  - Fix label for boinc init script
  - Fix label for fence_tool
  - Allow vhostmd to write virt content
  - Allow ricci domtrans ot shutdown


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-47
changelog:
  - Fixes for boinc-project policy
  - Allow swat to read nmbd pid file
  - Allow fail2ban to read BIND log files
  - Fix cert handling from Dan 
  - Remove transition from unconfined to ncftool domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-48
changelog:
  - Fixes for shorewall policy
  - Allow sssd chown capability
  - Fix label for /usr/bin/mutter
  - Label dead.letter as mail_home_t
  - Allow pcscd to read  hardware state information 
  - Fixes for ulogd policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-49
changelog:
  - Add label for /var/cache/rpcbind directory
  - Add chrome_role for xguest
  - Fix amavis_read_spool_files interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-55
changelog:
  - Add cluster_var_lib_t type and label for /var/lib/cluster
  - Add labeling for /root/.debug
  - Remove permissive from cmirrord domain
  - Dontaudit cmirrord_t sys_tty_config capability
  - Allow virtd to read from processes up to its clearance
  - Allow dovecot-deliver to create tmp files
  - Allow tor to send signals to itself
  - Handle /var/db/sudo
  - Remove allow_corosync_rw_tmpfs boolean
  Resolves: #631564


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-56
changelog:
  - Allow smartd to read usr files
  - Allow devicekit-power transition to dhcpc
  - Add label for /etc/timezone
  - Remove transition from unconfined_t to iptables_t
  - Allow domains with different mcs levels to send each other signals as long as they are not identified as mcsconstrainproc
  Resolves: #634945
  - Allow nrpe to send signal and sigkill to the plugins
  - Fix up xguest to allow it to read hwdata and gconf_etc_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-57
changelog:
  - Allow system_mail_t to append ~/dead.letter
  - Allow mount to communicate with gfs_controld
  Resolves: #636683
  - Dontaudit hal leaks in setfiles
  - gpm needs to use the user terminal


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-58
changelog:
  - Fix httpd_setrlimit boolean to allow sys_resource capability
  - Fix label for ip6tables.save
  - Allow ssh_t to exec ssh_exec_t
  - Dontaudit init leaks
  Resolves: #639083


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-59
changelog:
  - Allow cdrecord setrlimiit
  Resolves: #615731
  - Define debugfs_t as mountpoint
  Resolves: #646856
  - Fix fenced_can_network_connect boolean description
  Resolves: #650136
  - Add label for /var/run/faillock
  - Add dirsrv and dirsrv-admin policy
  Resolves: #655206
  - Fixes for cobbler policy
  - Allow certmonger to manage dirsrv config
  Resolves: #658591


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-60
changelog:
  - Fixes for certmonger
  - Backport passenger policy
  - Allow run_init to read console_device
  Resolves: #657568
  - Add label for /var/lib/dkim-milter
  - Fixes for munin policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-61
changelog:
  - Fixes for passenger policy
  - Allow user_t to conditionally transition to ping_t and traceroute_t
  Resolves: #663054


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-64
changelog:
  - Add namespace policy
  - Allow udev to stream connect to init
  Resolves: #667370
  - Update for screen policy to handle pipe in homedir
  - Fixes for polyinstatiated homedir


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-69
changelog:
  - Make Spacewalk to work with selinux-policy
  Resolves: #673112
  - Fix /root/.ssh labeling
  Resolves: #637109	
  - Fix for the spec file


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-71
changelog:
  - Allow cmirrord to create physical disk devices in /dev
  - Allow cluster domains to use the system bus and send each other dbus messages
  - Add label for /dev/tgt


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-74
changelog:
  - Add virt_home_ type files located in ~/.libvirt directory
  - virt creates monitor sockets in the users home dir
  - Allow lvm setfscreate
  Resolves: #680388
  - Make lsusb and lsblk working on MLS
  Resolves: #680426


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-75
changelog:
  - Allow svirt to manage sock_file in ~/.libvirt directory
  - Allow sysamd to run udev in udev_t domain
  - Remove capability from svirt
  - Add lvm_exec_t label for kpartx


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-76
changelog:
  - Fixes for ssh_keygen policy
  - Allow sysadm_t to run ssh-keygen in ssh_keygen_t domain
  - Backport spice vdagent policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-79
changelog:
  - Fixes for sandbox/seunshare policy 
  Resolves:#684919
  - Allow ssh_keygen_t dac_override
  - Add matahari policy 
  - Add label for /etc/securetty 
  - Fixes for pirahna-pulse policy
  - Fixes for radius, samba, dirsrv, kerberos policies 
  - Allow console login on MLS
  - Fix file context to show several labels as SystemHigh
  - Add port definition for dogtag, matahari, movaz ports


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-80
changelog:
  - Add support for a new cluster service - foghorn
  - sssd needs to read ~/.k5login in nfs, cifs or fusefs file systems
  - sssd wants to read .k5login file in users homedir
  - Add support for vdsm
  - Allow syslogd setrlimit, sys_nice
  Resolves: #689431
  - ipsec_mgmt_t wants to cause ipsec_t to dump core, needs to be allowed


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-81
changelog:
  - Add allow_sysadm_manage_security boolean
  - Add label for /dev/dlm.*
  - Allow auditadm_screen_t and secadm_screen_t dac_override capability
  - SSH_USE_STRONG_RNG is 1 which requires /dev/random
  - Fix auth_rw_faillog definition
  - Fixes for nslcd policy
  Resolves: #693368
  - Allow qpidd to manage pid and lib matahari files
  - Allow rgmanager to send the kill signal to all users


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-83
changelog:
  - Add label for matahari-broker.pid file
  - Allow foghor to read snmp lib files
  - Make sysadm security admin
  - Fix ssh_sysadm_login boolean
  Resolves: #694551


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-87
changelog:
  - Allow $1_sudo_t to read default SELinux context
  - Allow tgtd to create a sock file
  - Allow initrc_t to manage faillock


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-95
changelog:
  - Allow secadm to manage selinux config files
  - Allow apache to use jboss management port
  - Add fenced_can_ssh boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-97
changelog:
  - Allow postfix-pickup to write files and directories regardless of their MCS category set.
  - Make xinetd trusted to write outbound packets regardless of the network's or node's MLS range
  Resolves: #705772


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-104
changelog:
  - Allow puppet to Check access to the passwd executable
  - Add label for /var/www/html/logs directory
  - Add label for /var/lib/squeezeboxserver directory
  - Allow rgmanager executes init script files in initrc_t domain which ensure proper transitions


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-107
changelog:
  - Make new domains as unconfined
  - Add abrt_handle_event_t domain for ABRT event script
  - Add selinux_mysql man page
  - Fix httpd selinux man page
  - Fix interfaces


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-108
changelog:
  - Add squid man page
  - Add git man page
  - Make puppet working with passenger
  - Allow procmail to execute hostname command


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-110
changelog:
  - Add label for passwd.adjunct
  - Allow pulse to execute  /usr/sbin/fos
  - Fix labeling for passenger
  - Add selinux policy support for IP-in-SSH tunnelling
  - Allow sulogin to write /dev/pts/0 in single user mode


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-111
changelog:
  - Add git_cgit_read_gitosis_content boolean
  - Add support for cma port
  - Add virt_use_sanlock boolean and make sanlock working together libvirt
  - Make passenger and puppet working together


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-112
changelog:
  - Fix description of allow_* booleans
  - Allow sanlock to manage libvirt lib files
  - Fix bug in lsassd policy
  - Add label for /var/run/luci
  - move port 18001 from http_port_t to jboss_management_port_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-114
changelog:
  - Fix httpd_selinux man page
  - Add corenet_packet() interface
  - Add support for Clustered Samba commands


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-115
changelog:
  - Add unlabelednet policy module
  - Add chrome role for xguest
  - Fix for vdagent policy
  - Add fix to allow confined apps to execmod on chrome


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-118
changelog:
  - Fix label for /root/.hushlogin
  - Allow domain to send/recv unlabeled packet
  - Allow sshd to relabel tun socket
  - Allow puppetmasterd to relabel puppet config files
  - Add label for lvs.conf
  - Fix labeling for matahari-netd agents


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-123
changelog:
  - MLS Overrides needed for a user running at a level to be able to use sudo and talk to sssd
  - Allow initrc_t to manage dirsrv pid files with disabled unconfined module
  - Fixed for deltacloudd policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-125
changelog:
  - Change the postinstall to load_policy separately from the semodule command
  - This will put the proper files in place even if the kernel rejects the policy.
  - Allow login programs to connect to the pki_ca_port
  - Allow vhostmd to read /dev/rand and signal


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-128
changelog:
  - Add cronjob_role for sysadm
  - Change label for /var/spool/cron
  - Add interface to allow exec of mongod


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-131
changelog:
  - Fixes for rhev policy
  - Make ssh-keygen as unconfined domain
  - Add sanlock_use_nfs boolean
  - Add ssh_dontaudit_search_user_home_dir interface
  - namespace_init and MLS fix


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-132
changelog:
  - Fixes for nagios policy
  - Add a new interface for libra
  - Fix spec file to be testing SELinux status correctly


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-134
changelog:
  - Backport ABRT policy
  - Backport matahari policy
  - Add interfaces for libra
  - Add jboss_dubeg port definition


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-135
changelog:
  - Add fixes for qpidd policy, support for tmpfs_t
  Resolves:#769352
  - Add fixes for mcelog policy, for new location of pid,sock files
  - Make sendmail and postfix working together


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-136
changelog:
  - backport mozilla_plugin policy
  - backport sandbox policy to support nacl
  - Add support for selinux_avcstat munin plugin
  - Treat hearbeat with corosync policy
  - Allow system cronjobs to read kernel network state
  - Allow corosync to read and write to qpidd shared memory
  - More fixes for qpidd
  Resolves:#769352
  - Add policy for quota-nld


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-137
changelog:
  - Remove nfs_* booleans because nfs runs in kernel_t domain
  Resolves:#760405
  - Add httpd_manage_ipa boolean
  - Dontaudit sys_ptrace for matahari-netd
  - Allow vhostmd to getattr on virtd
  - Allow snmpd to connect to the ricci_modcluster
  - qpidd should be allowed to connect to the amqp port


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-138
changelog:
  - Add new policy for cfengine
  - Add new policy for sge gridengine jobs
  - Add support for nagios eventhandlers
  - Make system cron jobs run in the proper domain
  - Add policy to support privsep ssh process running in user domain
  - Add fixes relates to nss/FIPS
  - Add new rsync_use_* booleans
  - Allow qpidd to connect to matahari ports
  - Allow sysadm_u to read system_r in MLS
  - Remove razor labeling because we treat razor with spam policy
  - Add support for matahari-qmf-sysconfig-consoled, clean up matahari policy
  - Fixes for interfaces
  Resolves:#791294
  Resolves:#796351


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-139
changelog:
  - Allow nfsd_t to getattr on all fs
  Resolves:#738628
  - Make mailx working together with cron without unconfined module
  - Allow sssd sys_resource capability


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-140
changelog:
  - Add additional fixes for nagios handlers
  Resolves:#749311
  - Add 7600 and 4447 as jboss_management ports


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-141
changelog:
  - Add man pages for apps, services
  - Allow nagios to use user terminals
  Resolves:#782325
  - Add support for unconfined certmonger scripts
  - Add support for matahari-qmf-rpcd service
  - Allow chsh to use PAM
  - Allow rpc.statd to execute sm-notify which has bin_t label
  - Make sure files which are created by /usr/bin/R get proper label in home directories


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-142
changelog:
  - Fixes for man pages
  - Allow rpcd to execute sm-notify
  Resolves:#802247
  - Add support for matahari-qmf-rpcd
  - Add support matahari vios-proxy-* apps
  - Allow quota-check to create files on nonxattr filesystems
  - Add support for ~/Maildir
  - Allow unconfined dyntransition
  - Fixes for certmonger_unconfined and certmonger
  - Fixes for certmonger policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-144
changelog:
  - Fixes for cfengine policy
    * changed labeling for /var/cfengine/outputs from var_log to cfengine_var_log_t
    * re-arranged policy to use template and cfengine_domain 
  - Allow dovecot to domtrans sendmail to handle sieve scripts
  - Bacport libvirt-qmf policy for Fedora
  - Remove labeling for postmaster.pid file 
  - Fix for virtual network which looses network connection
  - Add man pages for SELinux users
  - cgconfig needs to use getpw calls
  - Allow lvm and fsadm to write sysfs_t
  - Allow rpc.mounted to list user tmp files
  - Fix permissivedomains declarations
  Resolves:#806220
  - Fix spec file to instal minimum policy properly


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-146
changelog:
  - Add sysadm_secadm policy module to separate in secadm_r, sysadm_r
  Resolves:#787413
  - Fixes for libvirt-qmf
  - Add label for package-cleanup 
  - Add support for zfs
  - Make cfengine domains as unconfined
  Resolves:#753184
  - Allow sshd_t to dyntransition to sysadm_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-147
changelog:
  - Fix man pages for SELinux users
  - Allow all user domains to setexec
  - Allow cobblerd to get SELinux status and booleans
  - Add labeling for /etc/zipl.conf
  Resolves:#813803
  - Allow fenced to read SNMP lib files


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-149
changelog:
  - Add labeling for /usr/sbin/matahari-dbus-sysconfigd
  - Add additional labeling for zarafa
  - Allow guest_t to fix labeling
  - Corenet_tcp_bind_all_unreserved_ports(ssh_t) should be called with the user_tcp_server boolean
  - squashfs does not support xattr in RHEL6
  Resolves:#815898
  - Remove pyzor labeling and move it to spamassassin.fc
  - Fix config.tgz


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-151
changelog:
  - Add openstack-nova, openstack-keystone, openstack-glance, openstack-quantum policies
  - Allow sysadm_t to create other crontabs
  - Allow nfsd_t to read defaul_t link files
  - Fix labeling for /var/run/heartbeat
  - Fixes for admin_template() interface to make sysadm_secadm.pp module working correctly
  - More fixes for condor policy
  - Allow chfn_t to creat user_tmp_files
  - Allow chfn_t to execute bin_t
  - Fix auth_role() interface
  - Fixes to make privsep+SELinux working if we try to use chage to change passwd


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-152
changelog:
  - Add label for condor_starter
  Resolves:#807682
  - Dontaudit sys_module for brctl
  - Allow winbind to send signull to smbd
  - Add jacorb port definition


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-154
changelog:
  - Allow fenced to manage snmpd lib files
  - Allow certmonger to get attributes on init script files
  Resolves:#790967
  - Fix labeling for Firefox plugins
  Resolves:#747993
  - Add mta_signal_user_agent() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-155
changelog:
  - Allow setroubleshootd to execute rpm
  Resolves:#833053
  - Add labeling for /usr/lib/flash-plugin/libflashplayer.so


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-156
changelog:
  - Allow user to login using ssh with random MLS range
  Resolves:#837815
  - Allow virtd_t to create mtab with the proper labeling
  - Add support for check_icmp nagios plugin
  - Make chkconfig working on MLS for sysadm_t
  - Allow dovecot to manage mail_home_rw_t
  - Add support for fsav
  - Allow clamscan to use amavisd-new
  - Add support for rhnsd


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-157
changelog:
  - Allow procmail to manage mail home data
  - We should only block MCS node_bind on mcsuntrustedproc
  - Fixes for amavis
  Resolves:#837815


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-159
changelog:
  - Allow munin_stats to read munin logs
  - Allow updpwd to write all MLS levels
  - Make piranha_web_t as nsswitch domain
  - Allow munin mail plugins to read exim log files
  - Backport sanlock policy from Fedora
  Resolves:#831908
  - Allos dac_override, sys_nice for sasl
  - Add labeling for /var/named/chroot/usr/lib64
  - Add support for gitolite3
  - Allow confined users to send mail


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-160
changelog:
  - Add named_bind_http_port boolean
  - Add port definition for 8953/tcp
  - spice-vdagent(d)'s are going to log over to syslog
  - Fix labeling for /usr/sbin/rpc.* binaries to label them as rpcd_exec_t
  - Add sensord policy
  - Allow oddjob_mkhomedir to write on nfs share
  - Add virt_bridgehelper policy
  - Allow clamd to write/delete own pid file with clamd_var_run_t label
  - Add support for wdmd tmpfs
  - Add initrc_domain attribute 
  - Add bcfg2 policy
  - Modify ssh_chroot_rw_homedirs boolean to allow manage apache system r/w content if for /var/www as home
  - Add pacemaker policy
  - Allow snmpd to connect to corosync over unix stream socket
  - Allow crontab to read NFS
  - Add new type selinux_login_config_t for /etc/selinux/TYPE/logins directory and allow sssd to manage files in this directory
  Resolves:#843814
  - Add labeling for /opt/sartest directory
  - Add initrc_domain attribute to allow domains to work as initrc_t domain
  - heartbeat should be running as rgmanager_t instead of corosync_t
  - Add glusterd policy
  - Add l2tpd policy
  - Add numad policy
  Resolves:#801493


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-162
changelog:
  - Add pkcslotd policy
  Resolves:#851483
  - Allow cyrus-imapd init script to write cyrus data
  - Fix labeling for /dev/twa


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-166
changelog:
  - More fixes for openshift and add support for opeshift labeling instead of stickshift
  - /etc/selinux/<type>/logins should be owned by the policy package
  Resolves:#855889
  - Add labeling for /var/tmp/DNS_25      
  - Allow postfix_local_t to execute files on nfs_t
  - Add fixes for kadmind
  - Add rhnsd policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-167
changelog:
  - Allow postfix_locat to search stickshift lib files
  - Dontaudit sys_ptrace cap for httpd if httpd_stickshift is on
  - Allow openshift domains change process identity
  - SELinux is reporting that openshift domains are trying to write into their proc directories
  Resolves:#855889


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-168
changelog:
  - Add support for HTTPProxy* in /etc/freshclam.conf
  - pppd wants to read /usr/share/radiusclient-ng/dictionary
  - Add ssh_chroot_manage_apache_content and ssh_chroot_full_access booleans
  - snmp wants to also manage snmp dirs for amavisd-snmp support
  - Add labeling for virsh_fenced
  - Allow nmbd_t to crate dirs with samba_var_t labeling
  - Add clamscan_can_scan_system boolean
  - Allow all domains to getattr on prelink_exec_t
  - Add postgresql_can_rsync boolean
  - Allow pulse to domain transition to iptables
  - Allow nslcd sys_nice capability
  - Allow corosync to connect to saphostctrl ports
  - Allow passwd to read generic /tmp dirs
  - Add policy for qemu-qa
  - Add new antivirus policy module for antivirus programs
  Resolves:#838260


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-169
changelog:
  - Fix spec file to silent restorecon errors on files which do not exist
  - Fix passenger backport
  Resolves:#839831


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-172
changelog:
  - Update httpd_runstickshift boolean
  - Remove transition from sysadm_t to fsadm_t
  Resolves:#852763
  - Make vmware-host as unconfined domain
  - Allow all domains to read usr_t
  - Fix labeling for all log files


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-173
changelog:
  - syslogd_t now support kerberos
  Resolves:#867001
  - Fix openshift labeling for binaries
  - Allow passwd to read usr_t links/files
  - Add labeling for /var/lib/sss/mc


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-174
changelog:
  - openshift user domains wants to r/w ssh tcp sockets
  - Allow mount to relabelfrom unlabeled file systems
  - Additional fix for syslog/kerberos
  Resolves:#867001


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-175
changelog:
  - Add initial openswitch policy. Domains are unconfined
  Resolves:#845417
  - Add labeling for /usr/sbin/mcollectived
  - Allow openshift domains to read /dev/urandom


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-177
changelog:
  - Allow dnsmasq to manage virt run files
  Resolves:#843543
  - Allow setroubleshootd to read /proc/irq
  - Backport fixes for virt_use_* booleans
  - Allow qemu-ga to use ttyS0
  - Allow dhcpc to manage dhclient-eth0.pid labeled as virt_var_run_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-178
changelog:
  - Fix labeling for OpenShift binaries
  - Add samba_portmapper boolean and labeling for /var/run/samba
  Resolves:#871816
  - Backport dspam policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-180
changelog:
  - Allow openshift domains to execute tmux
  - Allow wdmd to getattr on tmpfs_t
  Resolves:#831908
  - Add labeling for /var/nmbd/unexpected
  - Allow winbind to create samba pid dir
  - Dontaudit write access on /var/lib/net-snmp/mib_indexes for syslogd
  - Fenced communicates with libvirt
  - Fix labeling for libflashplayer.so
  - Add labeling for /var/lib/zarafa-webapp
  - Allow dspam to read localization
  - Add labeling for Z-Push
  - Allow rpc.svcgssd to search nfsd_fs_t dirs
  - Allo cgred to read all sysctl


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-181
changelog:
  - Allow kdumpgui to read/write to zipl.conf
  Resolves:#877108
  - Add /proc/numactl support for confined users
  - Make proc_numa_t an MLS Trusted Object
  - Make ccs_tool and cman_tool labeled as rgmanager_exec_t
  - Fix cron_admin_role interface
  - Add support for opendkim


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-182
changelog:
  - Fix labeling for /var/named/chroot/usr/lib
  Resolves:#843732
  - Allow amavis to stream connect to snmpd
  Resolves:#839250
  - Additional fixes for log files related to logrotate
  - Allow all domains to read base etc_t file type
  - Allow logrotate to list root home directory
  - Fix labeling for /var/log/z-push
  - Allow cyrus init scriptu to manage cyrus data files
  - Dontaudit leaks of locks or generic log files to systemprocesses
  - Allow ricci-modrpm to send syslog msgs
  - Allow munin to have kill capability


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-184
changelog:
  - Add support for tcp/10026 port as dspam_port_t
  - Allow dspam to connect/bind to dspam_port_t
  - Add uconfined_munin_plugin_exec_t for all plugins which are not covered by munin plugins policy
  - Allow domains that can read sssd_public_t files to also list the directory
  Resolves:#881413
  - Allow programs to run in fips_mode using fips_mode boolean
  - Change oddjob to transition to a ranged openshift_initr_exec_t when run from oddjob
  - Allow sshd to look into the mysql home directory for authorized_keys
  - Make rsync as homemanager which allows to manage CIFS/NFS	  
  -


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-185
changelog:
  - Apache is sending sinal to openshift_initrc_t now
  -  Allow all directories/files in /var/log starting with passenger to be labeled passenger_log_t
  - Allow winbind to manage samba_var_t sock files
  - Allow git-daemon and httpd to serve the same dir
  Resolves:#883143
  - Allow dac_override for nrpe


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-186
changelog:
  - Allow virtd to manage dnsmasq pid files
  - Allow all samba domains to create samba directory in var_t directory
  - Dontaudit attempts by openshift to read apache logs
  - Add labeling for /usr/share/ovirt-guest-agent/ovirt-guest-agent.py
  Resolves:#885432


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-187
changelog:
  - Add missing labeling for /usr/share/ovirt-guest-agent/ovirt-guest-agent.py
  Resolves:#885432
  - Add labeling for /var/nmbd
  - apache/drupal can run clamscan on uploaded content


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-188
changelog:
  - Allow rpcd_t to read /var/run/utmp
  - Make glance domains as permissive instead of just glance_t
  - Allow kill capability for ftpd
  - Add labeling for prespawn helper script
  Resolves:#886619
  - Allow winbind to stream connect to nmbd
  - Allow transition from virt domains to bridgehelper domain
  - Add support for watchdog script from sanlock
  - Add labeling for tmp-inst
  - Fix rhev policy
  - Update virt_qemu_ga policy
  - Backport wm_domain policy
  - Backport virtd_lxc_t and make it as unconfined domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-189
changelog:
  - Allow virt_qemu_ga to execute shutdown
  - sssd needs to connect to kerberos password port if a user changes his password
  - More fixes for the dspam domain
  - Allow dovecot to execute bash
  - Additional fixes for passenger
  Resolves:#886619
  - Add labeling for /var/run/checkquorum-timer


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-190
changelog:
  - Allow virtd to settattr on virt image dirs in MLS
  Resolves:#885045
  - Allow all postfix domains to connect to mysql stream
  - Call init_daemon_domain for rsync_t
  - Add labeling for /var/lib/pgsql/ssh 
  - Allow certmonger to send signal to itself
  - Allow rsyslog to read user tmp files using logging_syslog_can_read_tmp boolean
  - Add support for 1228/tcp and 1228/udp ports and allow corosync touse them
  - Allow corosync to read wdmd tmpfs
  - Allow wdmd to execute consoletype
  - Update man pages using sepolicy from Fedora
  - Fix admin interfaces


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-191
changelog:
  - Remove pam_selinux due to conflict
  - Add labeling for /etc/multipath - lvm_metadata_t
  Resolves:#880407
  - Add additional gitolite3 labeling


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-192
changelog:
  - Label /usr/lib/yaboot/addnote as bin_t
  - Allow postfix_local to read/write /var/spool/postfix/active
  - Allow postfix domains to list /tmp
  - Allow wdmd to transition to kdump
  Resolves:#887793
  - Add labeling for /var/named/chroot/etc/localtime


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-193
changelog:
  - Fix ssh_sysadm_login boolean for MLS
  Resolves:#865759
  - Allow rpm_script_t to dbus communicate with certmonger_t
  - More fixes for qemu-ga to make "guest-fsfreeze-freeze" working


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-194
changelog:
  - qdiskd needs to read usr_t/bin_t files
  - Allow dpsam to connect/bind to spamd ports
  - Allow munin services plugins to bind to generic node
  Resolves:#865759


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-195
changelog:
  - Make matahari domains as unconfined
  - Allow nscd to connect to nmbd
  Resolves:#901565
  - Allow setcap/getcap for syslogd


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-196
changelog:
  - Backport openshfit fixes
  - Allow cgred to use notify 
  Resolves:#913673
  - Allow mount to transition to gluster 
  - Fix tuned policy to make it working with the lastet tuned package


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-197
changelog:
  - Fix /etc/dhcp labeling
  - Back port openshift fixes
  - Make dirsrv-admin server restarted from console working
  - Add ftpd_use_fusefs boolean
  Resolves:#913673
  - openshift_cron_t needs dac_override


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-198
changelog:
  - Allow dirsrv-admin script to exec apache modules
  - Add labeling for dirsrv-admin lock file
  - Add labeling for /var/lib/owncloud
  - Add labeling for /var/www/moodle
  Resolves:#913673


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-199
changelog:
  - qemu-ga needs to execute scripts in /usr/libexec/qemu-ga
  - Allow openshift_cron_t to manage openshift_var_lib_t sym links
  - Allow dovecot-auth to execute bin_t
  - Allow mysqld-safe to execute bin_t
  - Allow procmail to manage user tmp files
  - Allow sanlock to kill svirt_t
  Resolves:#913673


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-203
changelog:
  - Allow dnsmasq to stream connect to quantum
  - Allow ifconfig domtrans to iptables and execute ldconfig
  Resolves:#966106
  - Make openshift_initrc_t as initrc domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-204
changelog:
  - Allow iptables to read and write quantum inherited pipes
  - Allow iptables to send sigchld to quantum
  Resolves:#966106


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-205
changelog:
  - Remove domtrans for quantum which needs to stay in the same domain
  - Allow qemu to manage nova lib files
  - Allow hald to read svirt images
  Resolves:#966106


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-208
changelog:
  - Merge cluster administrative domains to cluster_t. Back ported from Fedora
  Resolves:#915151
  - Aadd additinal rules for disk plugins
  - Allow setuid/setgid caps for syslogd_t
  - Dontaudit sendmail to  write dovecote-deliver tmp files
  - Add suppport for /var/lib/openvpn
  - /var/spool/snmptt is a directory which snmdp needs to write to


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-210
changelog:
  - Allow nrpe to list /var
  - Allow apache to search automount tmp dirs if http_use_nfs is enabled
  - Add support for strongswan
  - Fix description of ftpd_use_fusefs boolean
  - Allow kdumpgui to write dos files for /boot/efi/EFI/fedora/grub.cfg
  - Back port tgtd fixes from Fedora to allow sys_rawio cap
  - Add support for OpenDMARCD
  Resolves:#983551
  - Allow openvpn to run unconfined scripts
  - Allow amavis to execute shell
  Resolves:#979421
  - man pages should be owned only by selinux-policy-doc package
  - Fix fs_manage_nfs_files and fs_manage_nfs_dirs boolean to allow to search autofs
  - Allow mysqld-safe sys_nice/sys_resource caps
  Resolves:#975921
  - Add labeling for /boot/etc/yaboot.conf
  Resolves:#973156
  - /var/log/syslog-ng should be labeled var_log_t
  - Back port munin-cgi fixes
  - Fix ftp_home_dir boolean 
  - Allow kdump to read kcore on MLS system
  - Add support for svn ports
  - Add labels for /dev/ptp*
  - Add labels for /etc/security/opasswd
  - Fix labeling for /etc/localtime lnk file
  - Add  tftp booleans for NFS/CIFS access
  - Merge amavis,clamd,clamscan,freshclam policies to antivirus policy
  - Label all nagios plugins as nagios_unconfined_plugin_exec_t by default
  - Add additional ports as mongod_port_t
  - Allow sandbox domains to use inherted terminals
  - Allow pegasus to execute mount in pegasus_t domain
  - Fix *_admin interfaces  and interface descriptions
  - Allow yppasswdd to use NIS
  - Allow nagios to manage nagios spool files
  - Allow ABRT to domtrans to prelink
  Resolves:#921234
  - Fix labeling for /var/lib/dspam/
  Resolves:#919456
  - Label postfix-policyd-spf-perl as bin_t
  - Allow nrpe to run sudo
  - Label /usr/bin/yum-builddep as rpm_exec_t
  - Label /usr/local/bin/x11vnc as xserver_exec_t
  - Allow logwatch to domtrans to mdadm
  - Allow postfix-master to list /tmp dir
  - Add lldpad policy and make it as unconfined domain
  - Allow sysadm to admin postfix
  - ALlow postfix_virtual to stream connect to mysql
  - Update zabbix policy
  - Activate watchod policy and make it as unconfined
  - Add httpd_serve_cobbler_files boolean
  - Make postfix_postdrop_t as mta_agent to allow domtrans to system mail if it is executed by apache
  - Add oracleasm policy
  - Add support for pand
  - Add awstats_purge_apache_log_files boolean
  - Back port smstools policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-212
changelog:
  - Update rules for antivirus domains
  Resolves:#999471
  - Allow virt_domain to read virt_var_run_t symlinks
  - Allow chroot_user_t to read/write inherited user domain pty
  - Allow to start guest while the libvirtd is started with valgrind
  - Allow lldpad to talk with fcoemon
  - Allow chronyd sched_setscheduler


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-213
changelog:
  - Add openhpid policy
  Resolves:#1000521
  - Fix rhcs_domain_template to allow cluster_t to create socket in /var/run with correct labeling


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-214
changelog:
  - Allow git daemons to read localization
  - Allow tgtd_t to connect to isns ports
  Resolves:#1003571
  - Cleanup antivirus policy and add additional fixes
  - Fix labeling for munin CGI scripts
  - Allow virtd_t also relabel unix stream sockets for virt_image_type
  - Fix fs_search_auto_mountpoints to allow search automount tmp dirs
  Resolves:#990661


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-215
changelog:
  - Add port definition of pka_ca to port 829 for openshift
  - Rename quantum to neutron
  - Allow rpcd to request the kernel to load a module
  - Allow ovsdb-server to create dirs/files in /tmp directory


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-216
changelog:
  - Remove transition from virtd_t to qemu_t to stay in virtd_t if selinux_driver is None in qemu.conf
  - Allow openshift_cron_t to run ssh-keygen in ssh_keygen_t to access host keys


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-217
changelog:
  - Fix virtd_lxc_t to be able to communicate with hal
  - Allow NM and wireless working together
  Resolves:#1009661
  - Allow my_print_default to read /dev/urand


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-218
changelog:
  - Add support for /var/log/qemu-ga directory
  - Regenerate man pages for domains
  Resolves:#880728
  - Allow setgid capability for ipsec_t
  - Allow ipsec to send signull to itself
  - Add tcp/9000 as http_port_t
  - Allow dirsrv_t to create tmpfs_t directories
  - Fix git_role() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-219
changelog:
  - Update httpd_can_sendmail boolean to allow read/write postfix spool maildrop
  - Allow tzdate to unlink etc_t lnk files
  - Allow jabberd to connect to jabber_interserver port
  - Fix description for logging_syslog_can_read_tmp boolean
  - Update ipsec rules and labels
  Resolves:#986883
  - Allow pegasus transition to mount_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-220
changelog:
  - Allow cobblerd to stream connect to MySQL
  - Allow cobblerd to execute ldconfig
  - Allow openstack-glance to access to amqp
  - Add labeling for /var/run/charon.*
  - Make munin "df" plugins working
  Resolves:#908095


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-221
changelog:
  - Fix /var/run/charon labeling
  - More fix for strongswant and ipsec.secretes
  - Allow sandbox domain to use inherited user terminals


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-223
changelog:
  - Fix dovecot_rw_pipes() interface
  - Allow piranha_pulse_t to search tmpfs
  - Allow sysadm to stream connect to postfix-master process
  - Label /usr/sbin/fence_sanlockd as fenced_exec_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-225
changelog:
  - Re-write rules to create tmpfs for all piranha tmpfs files/dirs
  - Allow piranha-lvs to manage piranha_tmpfs_t
  Resolves:#1018306


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-226
changelog:
  - Label /usr/sbin/fence_scsi as fenced_exec_t
  - Fix cluster domains to create dirs in /var/run/cluster as var_run_t to make resource scripts working
  Resolves:#915151


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-227
changelog:
  - Resource agents needs to manage /etc/cluster to place own config files
  Resolves:#915151
  - tgtd needs ipc_lock


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-228
changelog:
  - Add daemons_enable_cluster_mode boolean and turn on it by default until RHEL6.6
  Resolves:#915151
  - Add tcp/8893 as milter port
  - Allow antivirus domain to read localization without the boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-229
changelog:
  - Add bootloader_exec_t labeling for /sbin/grubby
  Resolves:#915729
  - Add etc_runtime_t label for zipl.conf
  - Allow daemons to manage cluster lib files if daemons_enable_cluster_mode is enabled


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-231
changelog:
  - Add named_cache_t label for /var/lib/unbound
  - Fix puppet_domtrans_master() interface to make passenger working correctly if it wants to read puppet config files
  - Allow anitvirus domains to manage own log dirs


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-232
changelog:
  - Add more fixes for zabbix-agent
  - Fix neutron labeling
  - Allow all domains to read sysfs_t due to glibc change
  - Allow ping to read inherited zabbix tmp files
  Resolves:#1039851
  - Allow hostname to read/write inherited rpm script files


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-233
changelog:
  - Add support for OpenShift syslog plugin
  - Allow snmpd to getattr on removeable and fixed disks
  - Add shmemnetgrp and getnetgrp to access_vectors
  Resolves:#1025758


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-235
changelog:
  - Add support for nginx
  Resolves:#1045041
  - Change shutdown_t to also read wtmp
  - Added support for hypervkvpd
  - Add preupgrade policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-236
changelog:
  - Added conman policy
  - Added label for conman port
  - Added support for mip6d policy
  - Added support for isns
  - Added rtas_errd policy
  - Added support for keepalived policy
  - Add label samba_spool_t for /var/spool/samba
  - Allow httpd_t to bind preupgrade port if httpd_run_preupgrade boolean is enabled
  - Allow openshift_cron_t to append to openshift log files
  - dontaudit sudo domains listing /dev
  - Allow read/write to login records
  - Allow auditctl getattr access on blk_file
  - Allow nova-scheduler to read utmp
  - Added stapserver policy
  - Added support for freeipmi services
  - Added lsm policy
  - Added support for pcp service
  - Added chown capability to dhcpd_t domain
  - Add boolean to allow openshift domains nfs access
  - Allow abrt to read man pages and getcap
  - Allow cgroupdrulesengd to create content in cgoups directories
  - Dontaudit smbd_t sending out random signuls
  - Backport all zabbix changes
  - Allow mcelog write access to nscd socket


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-237
changelog:
  - Fixes for mirrormanager
  - Fix swift interface
  - Allow lsmd_plugin_t to read localization
  - Allow keepalived read snmp libs, Allow keepalived connect to agentx port
  - Allow keepalived read localization
  - Added setuid capability to lsm service
  - Added some swift rules to rsync policy
  - Remove duplicate line entry in .fc
  - Do not send/receive packets when ftpd_use_passive_mode is disabled
  - Add mirrormanager policy to RHEL6 Fixes Bug 1042864
  - Update permissivedomains by mirrormanager
  - Add mirrormanager policy
  - Added support for openwsmand
  - Added policy for swift
  - Added support for sblim
  - label also 64bit heartbeat libs
  - Allow kill capability on varnish
  - Added haveged policy
  - Add missing kernel_rw_stream_socket_perms
  - Label tcp/udp port no. 3052 as apc, Allow apcups to bind on apc port
  - Allow logwatch stream connect to courier service
  - Fix mcelog policy
  - Back port rsyslog fixes from RHEL7 for rsyslog7
  - Fix whitespace
  - Add support for osad
  - Fix automount policy
  - Added policy for bacula
  - add radvd_read_pid_files inteface
  - Add missing syslog-conn port
  - Allow httpd_t write to kernel keyring
  - Allow httpd_sys_script_t domain to send system log messages 
  - Allow passwd_t to write to ipa trusted user files in /tmp 
  - Boolean to allow mcelog use all the user ttys 
  - Allow icecast to use any tcp ports 
  - Define oracleasm_t as a device node 
  - Allow sudomain to getattr of kernel interface
  - Add squid directory in /var/run
  - Allow automount read nfs symlinks
  - Allow asterisk to connect to the apache ports
  - allow abrt to read mcelog log file 
  - allow udev to search radvd files under the /run dir 
  - allow auditctl getattr access on blk_file 
  Resolves:#1080555
  - Allow ssh to manage nfs links


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-238
changelog:
  - Allow domain to read an append inherited tmp files
  - Dontauit leaks of var_t into ifconfig_t
  - Allow fsdaemon_t to read/write device_t char files 
  Resolves:#1035363
  - Remove sblim_filetrans_named_content in RHEL6
  - We don't have systemd in RHEL6.
  - one more fix for bacula_admin()
  - fix bacula_run_admin()
  - Remove shadow_t label from /etc/security/opasswd 
  - Fix logrotate_use_nfs boolean
  - Allow userdom to read inherited users files in /tmp 
  - Allow certmonger_t read puppet libs
  - Allow in logging_inherit_append_all_logs also ioctl and append
  - Label pacemaker_remoted as cluster_exec_t
  - Tag some conman exec files
  - Allow conman to read localization
  - Should use rw_socket_perms rather then sock_file on a unix_stream_socket
  - Added conman fixes
  - Allow apache to manage passenger sock_files
  - Allow bacula to bind on 9103 tcp port
  - Allow postfix stream connect to antivirus
  - Allow osad to read localization


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-239
changelog:
  - Fixed lsmd_plugin_t
  Resolves:#1111619
  - Added glusterd_conf_t alias glusterd_etc_t
  - Allow samba to touch/manage fifo_files or sock_files in a samba_share_t directory 
  Resolves:#982160
  - Label zabbix-proxy files
  Resolves:#1018211
  - allow sshd to write to all process levels in order to change passwd when running at a level
  Resolves:#837616
  - Allow updpwd_t to downgrade /etc/passwd file to s0, if it is not running with this range 
  Resolves:#837616
  - Rename quantum port to neutron 
  Resolves:#1024927
  - Added zarafa_read_lib_files interface
  - Added dont audit list non security files in xdm_t 
  Resolves:#1030760
  - Added more fixes relates to 
  Resolves:#1060656
  - Added dontaudit rules to xdm_t 
  Resolves:#1030760
  - Allow procmail to run zarafa-degent 
  Resolves:#1060656
  - Add userdom_user_application_domain in xauth 
  Resolves:#1013832
  - Allow dmesg read raw memory 
  Resolves:#1030762
  - Allow communication between postfix and cyrus 
  Resolves:#1057307


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-240
changelog:
  - Allow nagios to stream connect to postgresqlBZ #1015708
  Resolves:#1015708
  - Allow hypervkvp read localization
  - Fix postfix_admin()
  - Add lldpad policy for MLS


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-241
changelog:
  - Remove deny_ptrace from interfaces
  - Add setpgid procces to mip6d_t
  - Added support for hv_vss_daemon
  - Allow keepalived also managed snmp lib dirs
  - Allow chroot_user_t unconfined shell domtrans
  Resolves:#1082183
  - Label swift-object-expirer as swift_exec_t
  - Allow keepalived manage snmp files, dontaudit list tmp files
  Resolves:#1053450
  - Additional fix for calling postfix interfaces in sysadm.te to make postfix_admin() working


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-243
changelog:
  - Implement new prelink_mask_t domain to which transition all domain by default (using fips_mode boolean) except prelink_transition domains.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-244
changelog:
  - Add support for vdsm 
  Resolves:#1064270
  - Allow userdomain role to access prelink_mask_t
  - Rename module glusterfs to glusterd 
  Resolves:#1052206
  - Allow gfs_controld_t to getattr on all file systems 
  Resolves:#1110886
  - Allow apache to manage pid sock files 
  Resolves:#1042864
  - Bind TCP/UDP sockets to the nfs port
  - The /var/run/tuned directory is not a regular file 
  Resolves:#1117685
  - Allow utilize winbind for authentication to AD. 
  Resolves:#1084177
  - Dont audit access on /etc/init.d/mcollective for kdump_t
  - FIx labeling in networkmanager.fc
  - Allow passenger to connect to MySQL
  - ALlow passenger to read locales
  - Dontaudit relabelfrom/relabelto for all variablefiles for prelink_map_t
  - Change all var_lib_t types to have also variablestatefile attribute
  - Implement new prelink_mask_t domain to which transition all domain by default (using fips_mode boolean) except prelink_transition domains.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-245
changelog:
  - Allow setpgid for all sandbox domains.
  - Allow sandbox domains read all mountpoint symlinks to make symlinked homedirs working with sandbox.
  - One more fix for osad.te
  - Back port osad changes from RHEL7.
  - Rename svirt_lxc_file_t to svirt_sandbox_file_t.
  - Label nginx init script as httpd_initrc_exec_t 
  Resolves:#1045041
  - Allow postfix_smtpd to stream connect to antivirus 
  Resolves:#1105889
  - Label init thttpd file as httpd_initrc_exec_t 
  Resolves:#1069843
  - Allow httpd to setattr on httpd_log files
  Resolves:#1111581
  - Add tomcat
  - Allow zabbix to read system network state
  - Allow ndc to read random and urandom device 
  Resolves:#1110397
  - Add kerberos support for radiusd.
  - Allow procmail to ioctl on zarafa-deliver executable.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-246
changelog:
  - Add boolean to allow user login programs access to /etc/shadow
  - Use old icecast_connect_any boolean name and dontaudit list /tmp with tmp_t labeling
  - Remove unused interface rtas_errd_systemctl 
  Resolves:#1121169
  - Allow prelink_mask to use user terminals and dontaudit relabel tmpfiles.
  - Dontaudit r/w inherited lockfiles/tmpfiles for prelink_mask_t.
  - Allow prelink_mask to append all log files.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-247
changelog:
  - Add all login domain auth_can_read_shadow_passwords attribute.
  - Added support for dhcrelay service
  Resolves: #1123338
  - We need to call auth_tunable_read_shadow in auth_shadow boolean.
  - Move authlogin_shadow to authlogin.if.
  - Add filetrans also for bacula log files.
  - Dontaudit kdumpgui to read openshift_initrc_exec_t
  Resolves: #1023336
  - Allow squid to manage squid_var_run_t sock_file
  Resolves: #1102346
  - Alloe bacula manage bacula_log_t dirs
  Resolves: #1122545
  - Added sys_ptrace cap. to stapserver_t
  Resolves: #811366
  - Label also /var/run/glusterd.socket file as glusterd_var_run_t
  Resolves: #1052206
  - Added support for collectd daemon
  Resolves: #1024715
  - Label conmans pid file as conman_var_run_t, Resolves: #1122106
  - Fix authlogin_shadow boolean to have it for all login_pgm domains
  - Dontaudit r/w inherited all log files for prelink_mask_t
  - Label zabbix_var_lib_t directories
  Resolves: #1053205
  - Allow all sblim domain to read localization data
  Resolves:##1122022


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-248
changelog:
  - Allow openshift_cron_t to append to openshift log files, label /var/log/openshift 
  Resolves: #1034206
  - Do not send/receive packets when ftpd_use_passive_mode is disabled 
  Resolves: #1105544
  - Allow qemu-ga domtrans to hwclock 
  Resolves: #1062384
  - Allow sshd read access to files on ftp directory 
  Resolves: #1097387
  - dontaudit r/w inherited certs for prelink_mask_t.
  - Allow sblim_gatherd_t to search all mountpoints. This is caused by ps. Should not be needed in Fedora.
  - Fix labeling in dhcpc.fc.
  - Add labels also for glusterd sockets.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-249
changelog:
  - Add support for luci.
  - Add support for rhsmd and treat it with rhsmcertd_t.
  - Make zabbix_agent_t as unconfined domain for rhel6.6.
  - Allow chroot_user_t to change process identity.
  Resolves:#1082183
  - Revert "Remove shadow_t label from /etc/security/opasswd
  - Dontaudit relabel lib_t files for prelink_mask_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-250
changelog:
  - Dontaudit read/write/setattr all pipes for prelink domains on all domains
  Resolves:#1103674
  - Allow chroot_user_t to change the role.
  - Add sys_time caps for virt_qemu_ga_t
  - Add label for /usr/sbin/luci


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-251
changelog:
  - Allow tgtd service to read kernel network state
  Resolves: 1130040
  - Allow mail-servers policies to read pcp libs
  Resolves: 1130934
  - Allow passwd_t to read/write stream sockets
  Resolves: #1129296
  - Add support for zabbix external scripts for which zabbix_script_t domain has been created. This domain is unconfined by default and user needs to run 'semodule -d unconfined' to make system running without unconfined domains. 
  - Dontaudit zebra to read getattr for all files and dirs
  Resolves: 1122031
  - Allow zebra to read /dev/urandom
  Resolves: #1122031
  - Label /var/lib/asterisk/agi-bin as bin_t
  - Added to lldpad policy sys_resource cap. and allow read localization 
  Resolves:1021984
  - Fix path to luci(/usr/sbin/luci) 
  Resolves:1023202
  - Add auth_can_read_shadow_passwords for rlogind.
  - Add authlogin_shadow boolean for all login domains.
  - Dontaudit rw all non security leaks.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-252
changelog:
  - Allow aide_t to read /dev/random and /dev/urandom.
  - Allow sysadm to talk with lldpad over unix dgram socket.
  - Allow sysadm to send/recv with unix dgram socket.
  - Allow crond_t to read lastlog.
  - Allow xdm_t to read plymouthd_spool_t files
  Resolves:#1131195
  - Allow hald to rpm dbus chat
  - Additional dontaudits for prelink_mask_t.
  - Add samba_domain attribute also for smbcontrol_t and winbind_helper_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-253
changelog:
  - Add additional dontaudits for prelink_mask_t
  Resolves:#1103674
  - Allow local_login_t and xdm_t to manage shadow_t because of PAM


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-254
changelog:
  - Dontaudit to read/write all dev nodes for prelink_mask_t.
  - Add label for path /var/lib/ctdb
  - Allow escd access to /var/run/pcscd.events directory
  Resolves:#1103674


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-255
changelog:
  - Allow couriertcpd to read /var/spool/courier dir.
  - Allow prelink domain to rea /dev/mem.
  - ALlow transition to prelink_t instead of prelink_mask_t to ABRT domains/rpm.
  Resolves:#1103674


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-257
changelog:
  - Add fixes for sblim_sfcbd to make libvirt-cim working.
  - Allow keepalived stream connect to snmpd
  - Allow local_login_t and xdm_t to manage etc_t if authlogin_can_shadow boolean.
  - Allow prelink_transition_domain to send signal to prelink_mask_t.
  Resolves:#1103674


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-258
changelog:
  - Allow unlink lib_t located in /tmp for prelink_mask_t.
  Resolves:#1103674
  - Add support for pnp4nagios
  - Allow mysql to read all domain state
  - Allow sblim_sfcbd_t to search virt images
  - Revert "Remove shadow_t label from /etc/security/opasswd "


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-260
changelog:
  - Add virt_getattr_images and call it for sblim_sfcbd_t.
  - We also need to call virt_search_images for sblim.
  Resolves:#1140614


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-260.el6_6.1
changelog:
  - Allow osad to execute rhn_check
  - Make osad_t as unconfined domain
  - Allow osad connect to jabber client port
  Resolves:#1169688
  - Allow rhev-agentd to access /dev/.udev/db/block:sr0


author: Dan Walsh <dwalsh@redhat.com> - 0.7-1
changelog:
  - Fix setroubleshoot_dispatcher to catch all information from
     avc. Much cleaner interface and no longer uses audit2allow cruft.
  - Remove toolbar from popup window since it did nothing, and I
     think it looks better without it.
  - fix allow_execmod plugin to report better data.


author: Dan Walsh <dwalsh@redhat.com> - 0.8-1
changelog:
  - Added a bunch more plugins
      [Karl MacMillan <kmacmill@redhat.com>]
  - Add allow_cvs_read_shadow.py, allow_ftp_use_cifs, allow_ftp_use_nfs, and allow_gssd_read_tmp.
  - Change AVC to have additional helpers for matching messages.
  - Change Plugin to work better with more than one solution.


author: Dan Walsh <dwalsh@redhat.com> - 0.15-1
changelog:
  [Karl MacMillan <kmacmill@redhat.com>]
  - Add generic templating mechanism to Plugin
  - Ported all plugins to use templating mechanism


author: Dan Walsh <dwalsh@redhat.com> - 0.16-1
changelog:
  [John Dennis <jdennis@redhat.com>]
  - modify SetFilter in server to return errors instead of
     throwing an exception. Default the filter list on each alert display.
  - minor tweaks to alert queue handling
  - fix analyze() parameter list in ftp_is_daemon.py plugin
  - sealert now responds to pending alerts more correctly, it shows
     how many pending alerts are in the queue, if you filter the pending
     alert status is updated, the next alert button will advance you
     to the next alert in the queue
  - simplify major pieces of sealert by coalescing common code
     into subroutines.
      [Dan  Walsh <dwalsh@redhat.com>]
  - Complete all boolean plugins except disable
  - Make Close button work.
  - Make setroubleshoot_dispatcher exit if it gets an avc about itself


author: Dan Walsh <dwalsh@redhat.com> - 0.17-1
changelog:
  [John Dennis <jdennis@redhat.com>]
  - clean up and rework the timestamp code in util.py so that
     time zones are handled properly, there were a number of bugs.
     Hopefully it's correct now because timezone handling is a pain.
  - change the time format in the browser so all times are displayed
     identically, the friendly time relative format was hard to compare.
  - modify the plugin 'make install' to delete all existing plugin's
     prior to installing the new ones
  - add popup menu to status icon to choose between browser and
     alert GUI (not fully connected yet). Several bug fixes related
     to changing the filter_type from a string to an int.
  - add filter selection to bottom pane, change filter_type from
     string to integer constant. Enhance how columns are handled.
     Get init_combo_box to work. Remove unused RPM and Bugzilla
     fields from bottom pane. Modify the default size of the browser
     window. Fix missing import in util.py.
  - add ability in broswer to sort on columns, initially the report
     count column and the last seen date column. The date column now
     stores a TimeStamp object instead of a string. Add new method
     to TimeStamp to return a friendly string relative to the current
     time. The date column in the browser now has a cell data function
     which invokes the friendly format method of the TimeStamp object.
  - add ability fo serialize to/from xml for classes which can
     inititialized from strings and serialized as strings (e.g. numbers,
     TimeStamps, etc.)
  - add count of how many times a signature is reported, the date
     when first and last reported, add columns for report count and
     last date count to browser.
  - checkpoint browser code, list pane and detail pane now working.
  - add initial support for browser applet, move some functions which
     kept getting reused to util.py
  - add reporting of environment to email alert (email alerts still
     need work)
      [Dan  Walsh <dwalsh@redhat.com>]
  - Fix disable_trans.py set_boolean call
  - Complete all boolean plugins except disable
  - Change interface to use audit unix domain socket


author: Dan Walsh <dwalsh@redhat.com> - 0.19-1
changelog:
  2006-08-08  Dan Walsh <dwalsh@redhat.com>
  - Fix up handling of mls ranges in context
  - Cleanup some pychecker errors

  2006-08-07  John Dennis <jdennis@redhat.com>
  - add first seen, last seen, and report count to alert detail view
  - make the seen icon work, if the alert has been displayed more
     than N seconds, mark the alert as having been seen by the user
     and update the icon is the list view
  - change the schema for the xml data; the database now has a version,
     there is a local id attached to each signature, the filter list in
     the siginfo was replaced by a list of per user data, the per user
     data now contains the filter, seen_flag. Modify all the code which
     was operating on the filter information to use the new model.
  - fix the xml serialization so that booleans can be used as a basic
     type and also so that non-string types can be used in element
     attributes (e.g. int, bool) and the serialization code will
     automatically convert between python types and strings.


author: John Dennis <jdennis@redhat.com> - 0.27-1
changelog:
  - load_plugins() now catches exceptions when a plugin won't load,
     reports the traceback in the log file, and continues with the next
     plugin. Previously a bad plugin caused the entire plugin loading
     to abort and no plugins were loaded.
  - Add "daemon_name" to automake variables, change pid file to match
  - turn off "noreplace" on config file till things settle down a bit
  - browser.py now validates data, also test for missing column data in the
     cell_data function to avoid exceptions.
  - add stub for analyzie_logfile() rpc call
  - turn off balloon notifications by default in config file,
     libnotify is just plain busted at this point :-(
  - only the setroubleshootd daemon creates it's log file
     under /var/log now, the user app's do it in /tmp, change file
     permissions on /var/log/setroubleshoot back to 0644.
  - sealert now looks up the username rather than hardcoding it to "foo"
  - CamelCase to lowercase_underscore clean up


author: John Dennis <jdennis@redhat.com> - 0.30-1
changelog:
  - fix bug 203479, missing requires of audit-libs-python
  - add support to sealert to listen on a dbus session signal to display
     the gui. This is needed for when the status icon is not visible and
     the user wants to see the UI. There is now a seperate program
     setroubleshoot_launch_gui which emits the signal.


author: Dan Walsh <dwalsh@redhat.com> - 0.32-1
changelog:
  - Add avc_syslog to syslog translated avc message
  - Fix submitbug button
      [John Dennis <jdennis@redhat.com>]
  - fix signature inflation, all data attached to a signature is now
     encapsulated in a SEFaultSignatureInfo (siginfo) class. The GUI no
     longer reaches into a signature looking for information, it looks
     in the siginfo. The Plugin class now defines the method
     get_signature() which report() calls to obtain the signature. The
     default signature provided by the Plugin class includes the
     analysisID, an AVC with just the src & target contexts, and the
     object_path. All data accesses and parameters which had been "sig
     and solution" are now done via the unified siginfo class. There is
     still a bit more work to be done on this but this represents a
     reasonble point to checkpoint the code in CVS.


author: Dan Walsh <dwalsh@redhat.com> - 0.34-1
changelog:
  - Standardize on the browser. remove alert window
      [John Dennis <jdennis@redhat.com>]
  - remove all vestiges of popup alert, now browser is the only
     UI game in town
  - restore the automatic updating of the browser window which had
     been a regression, the AlertClient class now emits signals which
     the GUI classes can connect to receive signals from the fault server,
     also fix the "mark seen" regression
  - browser.py: restore mark_seen timeout


author: John Dennis <jdennis@redhat.com> - 0.35-1
changelog:
  - add sorting on category column and seen column in browser,
     fix reference to my_draw() in print function.

  - make browser window hidden by default so it does not flash
     when it's first realized, connect to the "realize" signal to
     initially position the vpane, add signal handlers to track
     when the browser is visible, the presentation of the status
     icon now checks if the browser is visible, the status icon is
     not presented if the browser is already displayed.


author: Dan Walsh <dwalsh@redhat.com> - 0.38-1
changelog:
  [Dan  Walsh]
  - Hook up the rest of the menu bars on browser window
  - Add public_content.py plugin
      [John Dennis <jdennis@redhat.com>]
  - add delete_signatures() method to AlertClient class
  - start using the AppBar in the browser.
  - "open logfile" now connected all the way from browser menu
     to server rpc, still needs implementation, but "plumbing" is working.
  - fixes for the date/time dialog
  - remove install of setroubleshoot.glade, we now only use
     setroubleshoot_browser.glade
  - some fixed to DateTimeDialog


author: Dan Walsh <dwalsh@redhat.com> - 0.39-1
changelog:
  - Add Icon
      [John Dennis <jdennis@redhat.com>]
  - dispatcher.py: rework how audit messages injected into the
     system and processed. Much of this work was in support of log file
     scanning which should be coupled to the exact same processing code
     as audit messages arriving from the audit socket. In essence log
     file scanning synthesizes an audit message and we inject it into
     the system the same way socket messages are injected. This was
     also an excellent moment correctly handle out of order audit
     messages, something we were not able to handle previously. This
     may have been contributing to splitting what should have been a
     single alert into two or more separate alerts because we didn't
     recongize the incoming audit events as a single event. Correctly
     assembling out of order messages introduced a fair amount of extra
     complexity as we now maintain a cache of recent audit events, this
     is fully documented in dispatcher.py
  - Turn notifications back on by default.
      [Karl MacMillan <kmacmill@redhat.com>]
  - Separated out HTML rendering and made it easier to translate.


author: Dan Walsh <dwalsh@redhat.com> - 0.40-1
changelog:
  - Fix notification window problems.  Now dissappears and does not regenerate if
  it has already been seen


author: Dan Walsh <dwalsh@redhat.com> - 0.42-1
changelog:
  [Karl MacMillan <kmacmill@redhat.com>]
  - Add rpm information for target.
  - Add hostname and uname to signature info
  - Add display of the full AVC
  - Add display of the analysis id
  - Change html generation to be separated out and us elemmenttree
      [John Dennis <jdennis@redhat.com>]
  - add CommunicationChannel class to encapsulate data transfer
     operations, in particular to provide an object threads can lock
     during data transfer.
  - checkpoint the logfile scanning code, somewhat working


author: Dan Walsh <dwalsh@redhat.com> - 0.43-1
changelog:
  - Fix mail handling
  - fix bugs related to recording per user per signature filtering
      [John Dennis <jdennis@redhat.com>]
  - fix bugs related to recording per user per signature filtering
      [Karl MacMillan <kmacmill@redhat.com>]
  - Add signal handling to client and server.
  - Fix minor plugin bugs.


author: Dan Walsh <dwalsh@redhat.com> - 0.46-1
changelog:
  - Add new plugins cvs_data, rsync_data, xen_image, swapfile, samba_share
      [John Dennis <jdennis@redhat.com>]
  - clear the GUI of old data before loading new data,
     fix the code used to display the filter icon in the filter column


author: Dan Walsh <dwalsh@redhat.com> - 0.48-1
changelog:
  - Sealert only notify dropped connection once
  - setroubleshoot shutdown cleanly
      [John Dennis <jdennis@redhat.com>]
  - Gui cleanups


author: Dan Walsh <dwalsh@redhat.com> - 1.0-1
changelog:
  - Release of first version
  - Fix icon
      [John Dennis <jdennis@redhat.com>]
  - Memory leak fixes
  - Substitution fixes
  - File names in hex fixes


author: Dan Walsh <dwalsh@redhat.com> - 1.3-1
changelog:
  - Speed enhancments
      [John Dennis <jdennis@redhat.com>]
  - log file parsing now approx 4 times faster
  - greatly enhance the statistics reporting capability in attempt
     to diagnose slow log file parsing performance
  - make gathering of environmenatal information optional,
     environment information is only relevant at the time the
     alert fires, not in a post processing scenario
  - clean up several places where environmental information was
     assumed and/or was always gathered, or gathered in the wrong place.


author: Dan Walsh <dwalsh@redhat.com> - 1.7-1
changelog:
  [John Dennis <jdennis@redhat.com>]
  - Add command line utilities
  - logfile scanning finally seems to work connected to browser
  - Additional Information section of report now includes line
     number information (if alert was generated from logfile)
  - replace database update_callback() with notify interface, a more
     generic solution more easily shared between components
  - object implementing rpc method is now explicitly attached via
     connect_rpc_interface() instead of walking the MRO chain with
     magic exclusions. explicitly connecting is more flexible and
     robust (no getting the wrong object by mistake)
  - fix handling of return args in local rpc case
  - fix signal connections between audit and logfile
  - split databae and database_properties for audit and logfile
  - fix initial connection state
  - fix lookup_local_id


author: John Dennis <jdennis@redhat.com> - 1.8.1-1
changelog:
  - Fixes 216936, bug 215290, add 'Copy Alert' edit menu item
  - clean up menu items, add tooltips
  - fix printing so it will work with multiple alerts, force font to
     monospace 10pt, display error dialog if printing fails.
  - Fixes 216908, platform and raw audit messages were not wrapped
     to fit on page.
  - Related: 216575, update i18n po files
  - Fixes 216941, set default folder for save operation, also set
     default filename
  - Fixes 216327 add menu items "toggle hide deleted", "select none". Add model
     filter to control visibility of alerts
  - Fixes 214218, sealert with no command line
     arguments induces startup as dbus service, this had been a
     regression.
  - Fixes 216327, rework how deletes are performed in browser. Delete
     now marks each seleted siginfo with a delete flag, expunge
     permanently deletes siginfo's marked for deletion, also add undelete
     command, removed delete confirmation dialog. Modify how text
     attributes in cell renderer are computed to allow for
     strike-throughs of alerts marked for deletion.
  - multiple alerts can now be selected, add select all command,


author: John Dennis <jdennis@redhat.com> - 1.8.3-1
changelog:
  - Fixes 217961, sealert needs pygtk2-libglade
  - more i18n translations
  - Fixes 217710, date representation did not respect locale,
     at the same time remove old date formatting code, now cruft since
     we can't use it because it was specific to US English.
  - fix how selections are handled when rows are expunged.
  - add Copy to Edit menu, for copying selection from detail pane,
     unfortunately gtkhtml2 widget does not preserve line breaks between
     table rows.


author: John Dennis <jdennis@redhat.com> - 1.8.5-1
changelog:
  - fix bug, "could not convert path to a GtkTreePath" when database 
     is initially empty, caused by last_selected_row == None


author: John Dennis <jdennis@redhat.com> - 1.8.6-1
changelog:
  - Fixes 218150,
     "If view is set to "hide delete" you cannot filter new entries"
     Actually, the bug was toggle cell renderer was connected to the
     base model instead of the model attached to the view, the sort
     model, this meant the toggle was occuring on the wrong row if
     the view was sorted differently than the base model.


author: John Dennis <jdennis@redhat.com> - 1.8.11-1
changelog:
  - Fixes 216575, more translations
  - Replace delete and expunge menu labels with something more intuitive
  - add ability for browser to be restarted with identical window
     position and state
  - add pkg version and protocol version to logon handshake, test for
     compatibility between clint and server, prompt for restart
  - add non-modal restart dialog
  - add dialog to display traceback if sealert faults with an uncaught
     exception, try to limit invisible errors
  - fix return args on rpc method
  - add instance id to server


author: John Dennis <jdennis@redhat.com> - 1.8.13-1
changelog:
  - update translations

  - change SETroubleshootDatabase so it is optional if it's backed
     by a file, this fixes the problem of us littering temporary files
     when scanning logfiles which does not require persistence.

  - disable the view logfile menu item if no logfile has been opened

  - fix redundant log messages for case where there is no log file and
     the console flag is set. When there is no log file the logging
     module opens a console stream, thus the console stream produced
     by the console flag was redundant.

  - add username and password command line arguments
     rework startup logic so that all command line args are processed
     before we do any real work
   
  - rework the email preferences so that each email address can
     have a filter type associated with it.

     add a new filter_type "Ignore After First Alert" which filters
     after the first alert has been delivered

  - add UI for setting the email addresses alerts are sent to.
     Add menu item to edit email list, add email list dialog.
     Remove 'recipient' config file entry, now list is stored
     in seperate file. Add rpc to query and set the email list,
     the GUI calls this to get the current list from the server
     and set it in the server, it is the server which reads and 
     writes the file. Add 'enable' flag to each email entry.
     Modify how the server iterates over the email list when it
     receives an alert. When marking an alert as having been sent
     the username is the email address but with 'email:' prepended so
     as not to collide with non-email filtering options for the same user.


author: John Dennis <jdennis@redhat.com> - 1.8.14-1
changelog:
  - Fixes 221850
     plugin module loading was failing in python 2.5 with the message
     "SystemError: Parent module 'plugins' not loaded". This is due to a
     change in behavior between python 2.4 and 2.5, in python 2.4 the lack
     of a parent module was silently ignored. The fix is to load
     plugins.__init__ first.


author: John Dennis <jdennis@redhat.com> - 1.8.16-1
changelog:
  [John Dennis <jdennis@redhat.com>]
  - Fixes Bug# 224343 sealert's "Aditional Info:" text should be in white box
  - Fixes Bug# 224336 sealert should have GtkRadioButtons in menu View
  - Related: bug 224351
     Rewrite parts of logging support to better support changing output
     categories, output destinations. Now -v -V verbose works in sealert.
  - Resolves bug 225161, granted AVC's incorrectly identified as a denial
  - add alert count to status bar
  - add "Help" command to Help menu, opens web browser on wiki User FAQ
      [Dan Walsh  <dwalsh@redhat.com>]
  - Make setroubleshoot.logrotate correctly


author: John Dennis <jdennis@redhat.com> - 1.9.3-1
changelog:
  - install icon in /usr/share/icons, refer to icon by name using standard API
  - Fix performance problems in setroubleshoot browser log file scanning
  - Significant rewrite of data/view management code in setroubleshoot
     browser. data and view now cleanly separated, can easily switch
     between data views while maintaining selections, view state, with
     proper update of status information in status area
  - Resolves Bug# 227806: right click context menu resets selection
  - Logfile scans now operate in independent thread, proper asynchronous
     updates of browser during scan, browser used to appear to hang
  - Resolves Bug# 224340: Rewrite Menu/Toobar/Popup to use UIManger instead of glade
  - Add toobar support
  - Implement GUI to edit email recipient list in setroubleshoot browser
  - Added user help to setroubleshoot browser
  - Related Bug# 224343: Fix setroubleshoot browser to respond to desktop theme changes
  - improve traceback error reporting in sealert
  - rewrite AboutDialog, replacing glade version
  - Resolves bug 229849  Bug# 230115, Relates bug 221850: fix uuid code to resolve
     '_uuid_generate_random' is not defined error


author: Dan Walsh <dwalsh@redhat.com> - 1.9.4-1
changelog:
  - Remove disable_trans boolean
  - Check for paths in filesystem before suggesting chcon -R 
  - Remove default to listen on local ports


author: John Dennis <jdennis@redhat.com> - 1.9.6-1
changelog:
  - add avc_auparse.py, now has option to use audit parsing library instead of
     built-in audit parsing.
  - fix bug in log file scanning and detail display update
  - Resolves Bug# 238516, python pkg directory not owned


author: John Dennis <jdennis@redhat.com> - 1.9.7-1
changelog:
  - Resolves Bug# 241739, this bug is the lead bug for several bug reports,
     all consequences of the same problem, setroubleshootd/sealert when run
     in a non latin language environment because of incompatibilities in
     i18n encoding between components.


author: John Dennis <jdennis@redhat.com> - 1.10.0-1
changelog:
  - move all plugins and their translations to independent package
  - wrap XML generation inside try/except
  - correct how access list is obtained in avc_auparse.py
  - add try/except around top level of AnalyzeThread.run so exceptions
     in the thread get reported and the analysis thread does not just die.
  - also add try/except around LogfileThread.process_logfile
  - add new function assure_file_ownership_permissions()
  - server now forces it's database file permissions/ownership to be 0600 root:root
  - rpm now forces the server's database file permissions/ownership to be 0600 root:root
  - Resolves Bug #251545: Review Request: setroubleshoot-plugins - analysis plugins for setroubleshoot
  - clean up some other rpmlint warnings in setroubleshoot.spec
  - fix missing install of setroubleshoot icon and sym link to it
  - Resolves Bug #251551, setroubleshoot shows up in in wrong desktop menu
     also run desktop-file-install in rpm install
  - add /etc/dbus-1/system.d/setroubleshootd.conf dbus configuration file
  - Resolves Bug #250979, Bug #250932 Missing dependencies
  - Restore plugins/Makefile.am which got nuked somehow
  - remove dus.dbus_bindings.bus_name_has_owner(), deprecated as of F7
  - wrap rpm transactions in try/except


author: John Dennis <jdennis@redhat.com> - 1.10.2-1
changelog:
  - remove all copied code from test_setroubleshootd, now we import
     from setroubleshoot
   
  - export ClientConnectionHandler from rpc.py as a base class.
     Derive SetroubleshootdClientConnectionHandler and
     AuditClientConnectionHandler from ClientConnectionHandler.

  - add audisp_listen as test program

  - create setroubleshoot sym link in top devel directory pointing
     to src so import setroubleshoot.foo if PYTHONPATH=topdir

  - add get_option, convert_cfg_type to config.py.in so that one
     can pass optional dict to override config file settings

  - rewrite log_init() so it's easier for other programs to use it,
     fix the import logic concering log & config

  - remove log code from test_setroubleshoot, now just does import
     from setroubleshoot.
   
  - test_setroubleshootd can now handle audit records in both text
     and binary formats, can be selected by command line arg. It can now
     either output to clients connecting on a socket or to stdout. Can
     now optionally exit after N socket client connections.

  - remove non audit record lines from test data

  - remove config_init() and log_init() from package __init__.py
     It was the wrong place to call them, now call them when the
     process initializes before the first setroubleshoot imports

  - add parse_config_setting() and set_config() to config module
  - setroubleshootd now accepts -c --config command line arg
  - test_sectroubleshoot: add err defines & program_error exception
     add is_valid() tests to assure we read a valid audit record
     log the unrecognized line if not valid, clean up socket close()

  - Relates Bug #247056, update initscript to LSB standards
     Note: LSB initscripts in Fedora is not yet a resolved issue,
     the changes implemented were to add an LSB block and support
     the new LSB try-restart and force-reload commands. However
     the new /lib/lsb/init-functions are NOT currently used as this
     is the unstable part.


author: John Dennis <jdennis@redhat.com> - 1.10.3-1
changelog:
  - modify avc_audit.py to use new audit_data.py implementation

  - can listen for audit events on either /var/run/audit_events
     in bindary protocol mode or /var/run/audisp_events in
     text protocol mode


author: John Dennis <jdennis@redhat.com> - 1.10.5-1
changelog:
  - update code for command line log file scanning to work with
     new log file scanning code introduced for the browser.

  - update Bulgarian translation (Doncho N. Gunchev (gunchev@gmail.com))

  - update Polish translation (Piotr Drąg (raven@pmail.pl))

  - Resolves bug 239893: sealert wakes up very often
     This was caused by the use of threads and pygtk's thread signal
     handling.  The only use of threads in sealert was for log file
     scanning so that the UI would remain responsive during a
     scan. Threads in sealert have now been completely
     removed. Instead the scanning work is performed in a gobject idle
     function called from the main loop. The idle function is written
     as a python generator function which allows for the function to
     perform a small amount of work, save it's execution state and
     return. The next time the idle function is called from the main
     loop it resumes execution from it's last state until it decides
     to yield control again. This way the long running scan/analysis
     can be performed in small successive units of work during the
     time the application is otherwise idle and it does not interfere
     with the rest of the GUI event processing. Everything now occurs
     in an event loop, think of it as the applications process/thread
     scheduler whose event handlers execute time slices.

  - rewrote parts of the audit input pipeline to use generators
     instead of callbacks, thus permitting the logfile scanning code
     to yield control with more granularity. Also updated
     test_setroubleshootd and audisp_listen to use the new
     generator/yield logic.

  - rewrote the dialog used for scanning log files, progress bar
     updates are now in the dialog, the scan can be terminated part
     way through, errors from the scan are reported in pop-up dialog,
     one can only dismiss the dialog with success if the scan had
     been successfully run to completion, otherwise the user is only
     left with the option to cancel.

  - Relates bug 252035  bug 247469, setroubleshootd and sealert should
     exit if SELinux is disabled.

  - add utility functions escape_html() and unescape_html()

  - fix initial sort order in browser, track sort order in browser

  - modify AVC.get_path() to only return a value if the 'path' field is
     set, formerly it also considered the fields 'name' & 'file' which were
     incorrect. get_path() now also looks to see if the string begins with a
     slash for a fully qualified path, if not it looks to see if its a 
     pseudo path such as 'pipe[12345]' or 'socket[12345]' and if so strips out
     the instance information inside the brackets and returns just the type of 
     the pseudo path. This is done because we do not want path information
     in the signature to be unique for each instance of the denial.

  - modify the TimeStamp class to hide it's internal datetime member,
     remove the cmp() method, the internal __cmp__ will be automatically invoked.

  - require selinux policy version in spec file to allow system dbus use
   
  - Resolves bug 256601: audit2allow generates incorrect syntax when comma "," in
     denied list

  - update po i18n files

  - Add support for pruning database by age and size


author: John Dennis <jdennis@redhat.com> - 1.10.7-1
changelog:
  - Fix spec file requires for opening an HTML page
     In configure.ac search for xdg-open and htmlview in priority order,
     set variable html_browser_open to the one found, in spec file require
     xdg-utils for fedora and htmlview for RHEL.

  - add "Host" column in browser
     add "Toggle Column Visibility" menu to toggle display of any column on/off

  - Resolves bug 310261: setroubleshoot notifications aren't throttled

  - add support for AUDIT_EOE, end-of-event, if AUDIT_EOE immediately
     emit cached event. Disable timeouts used to flush events if
     AUDIT_EOE has been seen.


author: <jdennis@redhat.com> - 2.0.0-1
changelog:
  - prepare for v2 test release
  - Completed most work for version 2 of setroubleshoot, prepare for test release
  - import Dan's changes from the mainline
     primarily allow_postfix_local_write_mail_spool plugin
  - escape html, fix siginfo.format_html(), siginfo.format_text()
  - add async-error signal
  - change identity to just username
  - make sure set_filter user validation works and reports error in browser
  - fix generation of line numbers and host when connected to audispd
  - add permissive notification, resolves bug 231334: Wording doesn't change for permissive mode
  - resolves bug 244345: avc path information incomplete
  - get the uid,gid when a client connects to the server
  - set_filter now verifies the filter is owned by the user,
  - resolves bug 288261: setroubleshoot lack of user authentication
  - remove filter options which weren't being used
  - change '@' in audit data hostname to '.'
  - remove restart dialog
     resolves bug 321171: sealert's dialog after update is higly confusing
  - fix rpc xml arg
  - fix handling of host value
  - tweak what fields are in signature
  - move data items which had been in 'avc' object into siginfo
  - clean up siginfo format
  - large parts of new audit data pipeline working, checkpoint
  - fix duplicate xml nodes when generating xml tree
  - audit event can now be xml serialized
  - switch from using int's for audit record types to strings
  - avoid conversion headaches and possibilty of not being
     able to convert a new unknown type
  - add logic to allow XmlSerialize to be subclassed and init_from_xml_node to be overridden
  - add support to xml serialize classes AuditEventID, AuditEvent, AuditRecord
  - use metaclass for xml class init
  - start adding xml support to audit data classes
  - Use metaclass to wrap class init
  - move xml serialization code from signature.py to xml_serialize.py
  - simplify aspect of the serialization code
  - add unstructured xml mapping, each xml element name has its content mapped to obj.name
  - modify xml serialization to be driven by xml contents
  - general clean up
  - checkpoint conversion of serialization to use metaclasses
  - clean up class/data specifications for XmlSerializable
  - add support for client rpc testing
  - add changelog entry
  - add SubProcess class to setroubleshootd in preparation to
  - run daemon as subprocess so we can gather results and
     compare them to the expected data we sent
  - rewrite all plugins to use new v2 audit data
  - add SubProcess class to setroubleshootd in preparation to 
            run daemon as subprocess so we can gather results and
            compare them to the expected data we sent
  - add new test support: add config section 'test', add boolean 'analyze' to
     config test section, add class TestPluginReportReceiver which is installed
     if test.analyze is True, it prints analysis report. In test_setroubleshootd
     send AUDIT_EOE to assure sequential event processing so analysis results
     have same ordering as events that are sent by test_setroubleshootd
  - alert signatures now include host information, alerts will be grouped by host


author: <jdennis@redhat.com> - 2.0.1-1
changelog:
  - make connection error message persist instead of timeout in browser
  - updated Brazilian Portuguese translation: Igor Pires Soares <igor@fedoraproject.org>
  - implement uid,username checks
  - rpc methods now check for authenticated state
  - fix html handling of summary string
  - add 'named' messages to status bar, make sure all messages either timeout or are named
  - fix ordering of menus, resolves bug 427418
  - add 'hide quiet' to browser view filtering, resolves bug 427421
  - tweak siginfo text formatting
  - add logon to SECommandLine so that sealert -l <local_id> works


author: <jdennis@redhat.com> - 2.0.2-1
changelog:
  - Resolve bug 428252: Problem with update/remove old version
  - Add code to validate xml database version, if file is incompatible it is not read,
     the next time the database is written it will be in the new version format.
     This means the database contents are not preserved across database version upgrades.
  - Remove postun trigger from spec file used to clear database between incompatible versions
     the new database version check during database read will handle this instead
  - bullet proof exit status in init script and rpm scriptlets
  - Resolve bug 247302: setroubleshoot's autostart .desktop file fails to start under a KDE session
  - Resolve bug 376041: Cannot check setroubleshoot service status as non-root
  - Resolve bug 332281: remove obsolete translation
  - Resolve bug 344331: No description in gnome-session-properties
  - Resolve bug 358581: missing libuser-python dependency
  - Resolve bug 426586: Renaming translation po file from sr@Latn to sr@latin
  - Resolve bug 427260: German Translation
  - enhance the sealert man page


author: <jdennis@redhat.com> - 2.0.4-1
changelog:
  - Resolve bug 430421: audit_listener_database.xml:3029: parser error in xmlParseDoc()
    rewrite the audit_msg_decode logic to beaware of specific audit fields
  - add new template substitution $SOURCE, a friendly name, $SOURCE_PATH still exists
    and is the full path name of $SOURCE, also add 'source' attribute in AVC class,
    fix how source and source_path are computed from audit's comm and exe fields
  - fix the computation of tpath to also look at the audit name field, formerly
    it had only been looking at path, fixes <Unknown> showing up for many targets
  - add exception handling around xml file writes (Alan Cox reports problem when /var is full)
  - add testing documentation
  - Resolve bug 430845: obsolete URL in setroubleshoot package description
  - Resolve bug 428960: Permissive message makes no sense.
  - init script now allows extra test options
  - show_browser() now opens and raises the window (e.g. presents) rather than just
    assuring it's realized (e.g. iconified, or hidden)
  - sealert -l message in syslog converts from html before writing to syslog
  - Resolve bug 320881: export setroubleshoot_selinux_symposium in PDF format
  - add code to verify all async rpc's have been cleared from the async rpc cache
  - add code to set a default rpc method return if the interface does not define a callbak
    (methods which did not have a callback were not returning anything and hence were no
     getting cleared from the cache)


author: John Dennis <jdennis@redhat.com> - 2.0.5-1
changelog:
  - allow sealert -l lookup to accept * wildcard
  - add a few more audit fields needing special decode handling


author: <jdennis@redhat.com> - 2.0.6-1
changelog:
  - add dialog to run a command in the background, capture it's stdout & stderr
      report it's status, kill it, and pass it a pseudo terminal for password prompts
      - separate the fix command into it's own section in formatted alerts
      - add UI for running the fix command, enable only if there is a single selection
        and the selected alert has a fix command
        - add a config parameters 'run_fix_cmd_enable' to control if fix commands
        can be run, defaults to False
        - Resolve bug 431380: prevent notify popups while setroubleshoot is open


author: Dan Walsh <dwalsh@redhat.com> - 2.0.11-1
changelog:
  - Update to upstream
    - 2008-10-22    <jdennis@redhat.com>
      - Fix pruning code
      - Fix time stamps


author: Dan Walsh <dwalsh@redhat.com> - 2.0.12-1
changelog:
  - Update to upstream
    - 2008-10-06  Dan Walsh <dwalsh@redhat.com>
    - remove .png from desktop files


author: Dan Walsh <dwalsh@redhat.com> - 2.1.3-1
changelog:
  - sedispatch needs to connect to dbus on avc arrival, 
    instead of startup, since the dbus daemon is not started 
    when sedispatch starts


author: Dan Walsh <dwalsh@redhat.com> - 2.2.1-1
changelog:
  - Update to upstream
    * Thomas Liu <tliu@redhat.com>
    Bug fixes to GUI, added Delete All Alerts menu item.


author: Dan Walsh <dwalsh@redhat.com> - 2.2.9-1
changelog:
  - Update to upstream
    2009-6-25  Thomas Liu <tliu@redhat.com>
    - Added a "Copy to Clipboard" button to the browser GUI.


author: Dan Walsh <dwalsh@redhat.com> - 2.2.11-1
changelog:
  - Update to upstream
    2009-7-01 Thomas Liu <tliu@redhat.com> 
    - Fixed browser behavior when there are no alerts
    - Fixed seapplet behavior when there are no alerts
    - Made delete all button delete alerts on server side and on local side


author: Dan Walsh <dwalsh@redhat.com> - 2.2.13-1
changelog:
  - Update to upstream
    2009-7-07 Thomas Liu <tliu@redhat.com> 
    - Fixed detail doc not clearing when deleting all alerts
    - Hid notify check when deleting all alerts.


author: Dan Walsh <dwalsh@redhat.com> - 2.2.14-1
changelog:
  - Update to upstream
    2009-7-15 Dan Walsh <dwalsh@redhat.com> 
    - Fix handling of syscall record a1 field
    - Translate "/" to mountpoint when returned by kernel


author: Dan Walsh <dwalsh@redhat.com> - 2.2.20-1
changelog:
  -Update to upstream 
          - 2009-8-18 Thomas Liu <tliu@redhat.com>
          - Added check for new policy.


author: Dan Walsh <dwalsh@redhat.com> - 2.2.35-1
changelog:
  - Fix translations, plurals and glade
    - Update Po
    - Fix plural form
    - Add support for Green Plugins


author: Dan Walsh <dwalsh@redhat.com> - 2.2.50-1
changelog:
  - Exit with error code if you run sealert as root and try to connect to session bus
  - Fix Crash when ino is not defined


author: Dan Walsh <dwalsh@redhat.com> - 2.2.61-1
changelog:
  - Add Gavin Romig-Koch report patch
  - Cleanup Browser window
  - Remove avc messages that are allowed or dontaudited in current poilcy


author: Dan Walsh <dwalsh@redhat.com> - 2.2.67-1
changelog:
  - Fix browser to handle ignore flag
  - Remove tpath for signature 
  - Fix audit2why handling for sealert and setroubleshoot
  - Fix sort order selection
  - Fix dontnotify handling


author: <dwalsh@redhat.com> - 3.0.7-1
changelog:
  - Apply patch from Yuri Chornoivan to fix spelling mistakes
  - Remove py files that are no longer used
  - Add details button


author: <dwalsh@redhat.com> - 3.0.11-1
changelog:
  - Better handling of tracebacks in terminal mode
  - Fix up messages on process and capability avc messages
  - Update translations


author: <dwalsh@redhat.com> - 3.0.19-1
changelog:
  - Fix man page to reflect change in gui
  - Fix sealert -fixit call to import load_plugins
  - update translations
  - Fix handling of empty tpath in gui


author: <dwalsh@redhat.com> - 3.0.30-1
changelog:
  - Change seapplet to only check for AVCs on login, if checkonlogin flag is turned on in ~/.setroubleshoot file
  - Fix list_all_alerts bug causing crash on bad type


author: <dwalsh@redhat.com> - 3.0.37-1
changelog:
  - Move serverconnection.py and FixIt commands from setroubleshoot to setroubleshoot-server
  - Remove run_cmd.py
  - Make work on RHEL6
  Resolves: #541634
  - Ignore errors from disabled IPv6
  Resolves: #674770


author: <dwalsh@redhat.com> - 3.0.38-1
changelog:
  - Remove dependancy on X from sedispatch
  - Setroubleshoot-server no longer requires X
  Resolves: #541634


author: Miroslav Grepl <mgrepl@redhat.com> - 3.0.38-2
changelog:
  - Needs to require libreport-gtk and pygtk2-libglade
  - sealert analyze option can not be used with another option
  - Fix setroubleshootd man page


author: <dwalsh@redhat.com> - 3.0.40-1
changelog:
  - Apply Miroslav patch that rewrites sealert option handling with using optparse. Fixing conflicting options problems.
  - Fix requires to include pygtk2-libglade


author: <dwalsh@redhat.com> - 3.0.45-1
changelog:
  - Patch from Mgrepl to stop printable from crashing if None is passed in
  - Update to latest translations


author: <dwalsh@redhat.com> - 3.0.47-3
changelog:
  - Sedispatch is not handling audit messages correctly, 
    this fix allows setroubleshoot to process alerts.
  Resolves: #575686


author: Miroslav Grepl <mgrepl@redhat.com> - 3.0.47-4
changelog:
  - Make sealert working if description contains parenthesis
  - Remove -H from man page
  Resolves:#788196


author: Erik Troan <ewt@redhat.com>
changelog:
  - added patch for XOPEN oddities in glibc headers
  - check for ut_user before checking for ut_name -- this works around some
    confusion on glibc 2.1 due to the utmpx header not defining the ut_name
    compatibility stuff. I used a gross sed hack here because I couldn't make
    automake work properly on the sparc (this could be a glibc 2.0.99 problem
    though). The utuser patch works fine, but I don't apply it.
  - sleep after running autoconf


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - updated the spec file
  - updated the patch so that new accounts created on shadowed system won't
    confuse pam_pwdb anymore ('!!' default password instead on '!')
  - fixed a bug that made useradd -G segfault
  - the check for the ut_user is now patched into configure


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - Note that /usr/sbin/mkpasswd conflicts with /usr/bin/mkpasswd;
    one of these (I think /usr/sbin/mkpasswd but other opinions are valid)
    should probably be renamed.  In any case, mkpasswd.8 from this package
    needs to be installed. (problem #823)


author: Michael K. Johnson <johnsonm@redhat.com>
changelog:
  - have userdel remove user private groups when it is safe to do so
  - allow -f to force user removal even when user appears busy in utmp


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - Serial: 1 because now we are using 19990827 (why the heck can't they have
    a normal version just like everybody else?!)
  - ported all patches to the new code base


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix usermod patch to check for shadow before doing any shadow-specific stuff
    and merge it into the pwlock patch


author: Matt Wilson <msw@redhat.com>
changelog:
  - use mandir for FHS
  - added patches in src/ and po/ to honor DESTDIR
  - use make install DESTDIR=$RPM_BUILD_ROOT


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - change symlinked man pages to includers
  - require /usr/bin/newgrp (util-linux) so that /usr/bin/sg isn't left dangling


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - Remove a fixed-size buffer that caused problems when adding a huge number
    of users to a group (>8192 bytes) (Bugs #3809, #11930)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - take LOG_CONS out of the openlog() call so that we don't litter the
    screen during text-mode upgrades


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - don't overwrite user dot files in useradd (#19982)
  - truncate new files when moving overwriting files with the contents of other
    files while moving directories (keeps files from looking weird later on)
  - configure using %{_prefix} as the prefix


author: Bernhard Rosenkraenzer <bero@redhat.com> 20000902-1
changelog:
  - Create an empty mailspool when creating a user so non-setuid/non-setgid
    MDAs (postfix+procmail) can deliver mail (#41811)
  - 20000902
  - adapt patches


author: Nalin Dahyabhai <nalin@redhat.com> 20000902-4
changelog:
  - use -O0 instead of -O on ia64
  - build in source directory
  - don't leave lock files on the filesystem when useradd creates a group for
    the user (#50269)
  - fix the -o option to check for duplicate UIDs instead of login names (#52187)


author: Nalin Dahyabhai <nalin@redhat.com> 20000902-12
changelog:
  - force .mo files to be regenerated with current gettext to flush out possible
    problems
  - fixup non-portable encodings in translations
  - make sv translation header non-fuzzy so that it will be included (#71281)


author: Nalin Dahyabhai <nalin@redhat.com> 20000902-13
changelog:
  - prevent libshadow from being built more than once, to keep automake happy
  - change how md5 and md5crypt are enabled, to keep autoconf happy
  - remove unpackaged files after %install


author: Nalin Dahyabhai <nalin@redhat.com> 4.0.3-6
changelog:
  - adjust mailspool patch to complain if no group named "mail" exists, even
    though that should never happen


author: Nalin Dahyabhai <nalin@redhat.com> 4.0.3-14
changelog:
  - lastlog: don't pass a possibly-smaller field to localtime (#109648)
  - configure: call AC_SYS_LARGEFILE to get large file support


author: Nalin Dahyabhai <nalin@redhat.com> 4.0.3-15
changelog:
  - don't convert man pages to UTF-8 for RHEL 3, conditionalized using macro
  - fixup dangling man page references


author: Dan Walsh <dwalsh@redhat.com> 4.0.3-23
changelog:
  - Add get_enforce checks
  - Clean up patch for potential upstream submission
  - Add removemalloc patch to get it to build on 3.4


author: Adrian Havill <havill@redhat.com> 2:4.0.3-31
changelog:
  - check for non-standard legacy place for ncsd HUP (/var/run/nscd.pid) and
    then the std FHS place (/var/run/nscd.pid) (#125421)


author: Adrian Havill <havill@redhat.com> 2:4.0.3-33
changelog:
  - allow for mixed case and dots in usernames (#135401)
  - all man pages to UTF-8, not just Japanese (#133883)
  - add Polish blurb for useradd -n man page option (#82177)


author: Adrian Havill <havill@redhat.com> 2:4.0.3-35
changelog:
  - make the limit for the group name the same as the username (determined
    by the header files, rather than a constant) (#56850)


author: Peter Vrabec <pvrabec@redhat.com> 2:4.0.7-4
changelog:
  - use newgrp binary
  - newgrp don't ask for password if user's default GID = group ID,
    ask for password if there is some in /etc/gshadow 
    and in /etc/group is 'x' (#149997)


author: Peter Vrabec <pvrabec@redhat.com> 2:4.0.7-5
changelog:
  - fix memory leak, and CPU spinning when grp_update() and 
    duplicate group entries in /etc/group (#151484)


author: Peter Vrabec <pvrabec@redhat.com> 2:4.0.17-6
changelog:
  - fix regression. Permissions on user* group* binaries 
    should be 0750, because of CAPP/LSPP certification
  - fix groupdel man page


author: Peter Vrabec <pvrabec@redhat.com> 2:4.0.18.1-2
changelog:
  - improve audit logging (#211659)
  - improve "-l" option. Do not reset faillog if it's used (#213450).


author: Peter Vrabec <pvrabec@redhat.com> 2:4.1.2-8
changelog:
  - groupmems: check username for valid character (#455603)
  - groupmems: don't segfault on nonexistent group (#456088)


author: Peter Vrabec <pvrabec@redhat.com> 2:4.1.2-11
changelog:
  - fix license tag (#226416)
  - get rid of tabs in spec file (#226416)
  - convert HOWTO to UTF8 (#226416)


author: Peter Vrabec <pvrabec@redhat.com> - 2:4.1.4.2-5
changelog:
  - newusers man page more informative
  - userdel should not need to run semanage
    Resolves: #586330 #586408


author: Peter Vrabec <pvrabec@redhat.com> - 2:4.1.4.2-10
changelog:
  - support ACLs under skel directory
  - refer to PAM in /etc/login.defs
  - userdel option to remove Linux login <-> SELinux login mapping
  - useradd special exit value if SELinux user mapping is invalid
  - usermod special exit value if SELinux user mapping is invalid
  - fix gshadow functions from shadow utils
  - fix find_new_uid/gid for big UID/GID_MAX
  - don't show users who were not logged in lastlog
    Resolves: #586796 #629277 #639900 
    Resolves: #639975 #639976 #667593 #672510
    Resolves: #693377 #706321


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.1.4.2-16
changelog:
  - document that parent of a new user's home directory must exist
  - avoid skipping 2nd consecutive failures in pwconv grpconv (#787742)
  - avoid segfault when merging group entries in useradd
  - properly report that userdel found process with user's uid
  - improve date parsing and error detecting in chage
  - avoid full group database scanning in newgrp in most common case
  - mention that PAM is not configured with login.defs in the man page
  - create new shadow entry if missing in usermod (#1016516)
  - report error if usermod asked for moving homedir and it does not
    exist (#1089666)
  - fix various typos and mistakes in useradd manpage (#907837)


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.1.4.2-19.1
changelog:
  - allow removal of expiration or last password change dates
    by using -1 as chage date argument again (#1183638)


author: Simo Sorce <ssorce@redhat.com> - 0.3.0-2
changelog:
  - Try to fix build adding automake as an explicit BuildRequire
  - Add also a couple of last minute patches from upstream


author: Jakub Hrozek <jhrozek@redhat.com> - 0.3.2-1
changelog:
  - bugfix release 0.3.2
  - includes previous release patches
  - change permissions of the /etc/sssd/sssd.conf to 0600


author: Simo Sorce <ssorce@redhat.com> - 0.4.1-1
changelog:
  - add missing configure check that broke stopping the daemon
  - also fix default config to add a missing required option


author: Jakub Hrozek <jhrozek@redhat.com> - 0.4.1-4
changelog:
  - Fix for CVE-2009-2410 - Native SSSD users with no password set could log in
    without a password. (Patch by Stephen Gallagher)


author: Stephen Gallagher <sgallagh@redhat.com> - 0.6.0-1
changelog:
  - Ensure that the configuration upgrade script always writes the config
    file with 0600 permissions
  - Eliminate an infinite loop in group enumerations


author: Stephen Gallagher <sgallagh@redhat.com> - 0.6.1-1
changelog:
  - Add SSSDConfig API
  - Update polish translation for 0.6.0
  - Fix long timeout on ldap operation
  - Make dp requests more robust


author: Stephen Gallagher <sgallagh@redhat.com> - 0.7.1-1
changelog:
  - Fix segfault in sssd_pam when cache_credentials was enabled
  - Update the sample configuration
  - Fix upgrade issues caused by data provider service removal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.0.2-1
changelog:
  - Fixes a bug in the failover code that prevented the SSSD from detecting when it went back online
  - Fixes a bug causing long (sometimes multiple-minute) waits for NSS requests
  - Several segfault bugfixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.0.3-1
changelog:
  - Fixes link error on platforms that do not do implicit linking
  - Fixes double-free segfault in PAM
  - Fixes double-free error in async resolver
  - Fixes support for TCP-based DNS lookups in async resolver
  - Fixes memory alignment issues on ARM processors
  - Manpage fixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-1.pre20100317git0ea7f19
changelog:
  - Release candidate for SSSD 1.1
  - Add simple access provider
  - Create subpackages for libcollection, libini_config, libdhash and librefarray
  - Support IPv6
  - Support LDAP referrals
  - Fix cache issues
  - Better feedback from PAM when offline


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.0-2
changelog:
  - Release SSSD 1.1.0 final
  - Fix two potential segfaults
  - Fix memory leak in monitor
  - Better error message for unusable confdb


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.1-1
changelog:
  - New upstream release 1.1.1
  - Fixed the IPA provider (which was segfaulting at start)
  - Fixed a bug in the SSSDConfig API causing some options to revert to
  - their defaults
  - This impacted the Authconfig UI
  - Ensure that SASL binds to LDAP auto-retry when interrupted by a signal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.91-10
changelog:
  - Release new upstream version 1.1.91
  - Enhancements when using SSSD with FreeIPA v2
  - Support for deferred kinit
  - Support for DNS SRV records for failover


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.92-11
changelog:
  - New LDAP access provider allows for filtering user access by LDAP attribute
  - Reduced default timeout for detecting offline status with LDAP
  - GSSAPI ticket lifetime made configurable
  - Better offline->online transition support in Kerberos


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.0-12
changelog:
  - New stable upstream version 1.2.0
  - Support ServiceGroups for FreeIPA v2 HBAC rules
  - Fix long-standing issue with auth_provider = proxy
  - Better logging for TLS issues in LDAP
  - Resolves: rhbz#584001 - Rebase sssd to 1.2
  - Resolves: rhbz#584017 - Unconfiguring sssd leaves KDC locator file
  - Resolves: rhbz#587384 - authconfig fails if krb5_kpasswd in sssd.conf
  - Resolves: rhbz#587743 - Need to replicate pam_ldap's pam_filter in sssd.conf
  - Resolves: rhbz#590134 - sssd: auth_provider = proxy regression
  - Resolves: rhbz#591131 - Kerberos provider needs to rewrite kdcinfo file when
  -                         going online
  - Resolves: rhbz#591136 - Change SSSD ipa BE to handle new structure of the
  -                         HBAC rule


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.0-13
changelog:
  - Resolves: rhbz#598670 - Ccache file of a user is removed too early
  - Resolves: rhbz#599057 - Incomplete comparison of a service name in
  -                         IPA access provider
  - Resolves: rhbz#598496 - Failure with IPA access provider
  - Resolves: rhbz#599027 - Makefile typo causes SSSD not to use the
  -                         kernel keyring


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.0-14
changelog:
  - Resolves: rhbz#593696 - Empty list of simple_allow_users causes sssd service
  -                         to fail while restart
  - Resolves: rhbz#600352 - Wrapping the value for "ldap_access_filter" in
  -                         parentheses causes ldap_search_ext to fail
  - Resolves: rhbz#600468 - Segfault in krb5_child
  - Related:  rhbz#601770 - SSSD in RHEL 6.0 should ship with zero open Coverity
  -                         bugs.


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-15
changelog:
  - New upstream bugfix release 1.2.1
  - Resolves: rhbz#601770 - SSSD in RHEL 6.0 should ship with zero open Coverity
  -                         bugs.
  - Resolves: rhbz#603041 - Remove unnecessary option krb5_changepw_principal
  - Resolves: rhbz#604704 - authconfig should provide error with no trace back
  -                         if disabling sssd when sssd is not enabled
  - Resolves: rhbz#591873 - Connecting to the network after an offline kerberos
  -                         auth logs continuous error messages to sssd_ldap.log
  - Resolves: rhbz#596295 - Authentication fails for user from the second domain
  -                         when the same user name is filtered out from the
  -                         first domain
  - Related:  rhbz#598559 - Update translation files for SSSD before RHEL 6
  -                         final


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-19
changelog:
  - Resolves: rhbz#606836 - libcollection needs an soname bump before RHEL 6
  -                         final
  - Resolves: rhbz#608661 - SASL with OpenLDAP server fails
  - Resolves: rhbz#608688 - SSSD doesn't properly request RootDSE attributes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-20
changelog:
  - Resolves: rhbz#591715 - sssd should emit warnings if there are problems with
  -                         /etc/krb5.keytab file


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-21
changelog:
  - Resolves: rhbz#607233 - SSSD users cannot log in through GDM
  -                       - Real issue was that long-running services
  -                       - do not reconnect if sssd is restarted


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-23
changelog:
  - Resolves: rhbz#617623 - SSSD suffers from serious performance issues on
  -                         initgroups calls


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-32
changelog:
  - Resolves: rhbz#633406 - the krb5 locator plugin isn't packaged for multilib
  - Resolves: rhbz#633487 - SSSD initgroups does not behave as expected


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-28.1
changelog:
  - Resolves: rhbz#637070 - the krb5 locator plugin isn't packaged for multilib
  - Resolves: rhbz#642412 - SSSD initgroups does not behave as expected


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-35
changelog:
  - Resolves: rhbz#645449 - 'getent passwd <username>' returns nothing if its
  -                         uidNumber gt 2147483647


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-28.4
changelog:
  - Resolves: rhbz#660592 - SSSD shutdown sometimes hangs
  - Resolves: rhbz#660585 - getent passwd <username>' returns nothing if its
  -                         uidNumber gt 2147483647


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.0-1
changelog:
  - Related: rhbz#644072 - Rebase SSSD to 1.5
  - New upstream release 1.5.0
  - Fixed issues with LDAP search filters that needed to be escaped
  - Add Kerberos FAST support on platforms that support it
  - Reduced verbosity of PAM_TEXT_INFO messages for cached credentials
  - Added a Kerberos access provider to honor .k5login
  - Addressed several thread-safety issues in the sss_client code
  - Improved support for delayed online Kerberos auth
  - Significantly reduced time between connecting to the network/VPN and
  - acquiring a TGT
  - Added feature for automatic Kerberos ticket renewal
  - Provides the kerberos ticket for long-lived processes or cron jobs
  - even when the user logs out
  - Added several new features to the LDAP access provider
  - Support for 'shadow' access control
  - Support for authorizedService access control
  - Ability to mix-and-match LDAP access control features
  - Added an option for a separate password-change LDAP server for those
  - platforms where LDAP referrals are not supported
  - Added support for manpage translations


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-1
changelog:
  - Resolves: rhbz#670259 - Refresh SSSD in 6.1 to 1.5.1
  - New upstream release 1.5.1
  - Addresses CVE-2010-4341 - DoS in sssd PAM responder can prevent logins
  - Vast performance improvements when enumerate = true
  - All PAM actions will now perform a forced initgroups lookup instead of just
  - a user information lookup
  -   This guarantees that all group information is available to other
  -   providers, such as the simple provider.
  - For backwards-compatibility, DNS lookups will also fall back to trying the
  - SSSD domain name as a DNS discovery domain.
  - Support for more password expiration policies in LDAP
  -    389 Directory Server
  -    FreeIPA
  -    ActiveDirectory
  - Support for ldap_tls_{cert,key,cipher_suite} config options
  - Assorted bugfixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-3
changelog:
  - Related:  rhbz#670259 - Refresh SSSD in 6.1 to 1.5.1
  - Also add the updated ding-libs to the BuildRequires


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-4
changelog:
  - Resolves: rhbz#674172 - Group members are not sanitized in nested group
  - processing
  - Put translated tool manpages into the sssd-tools subpackage


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-5
changelog:
  - Resolves: rhbz#674164 - sss_obfuscate fails if there's no domain named
  -                         "default"
  - Resolves: rhbz#674515 - -p option always uses empty string to obfuscate
  -                         password
  - Resolves: rhbz#674141 - Traceback call messages displayed while
  -                         "sss_obfuscate" command is executed as a non-root
  -                         user


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-6
changelog:
  - Resolves: rhbz#670511 - SSSD and sftp-only jailed users with pubkey login
  - Resolves: rhbz#675284 - "no matching rule" message logged on all successful
  -                         requests
  - Resolves: rhbz#676911 - SSSD attempts to use START_TLS over LDAPS for
  -                         authentication


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-7
changelog:
  - Resolves: rhbz#677588 - sssd crashes at the next tgt renewals it tries
  - Resolves: rhbz#678410 - name service caches names, so id command shows
  -                         recently deleted users
  - Resolves: rhbz#678614 - SSSD needs to look at IPA's compat tree for
  -                         netgroups


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-8
changelog:
  - Resolves: rhbz#678593 - User information not updated on login for secondary
  -                         domains
  - Resolves: rhbz#678777 - IPA provider does not update removed group
  -                         memberships on initgroups


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-9
changelog:
  - Resolves: rhbz#679082 - SSSD IPA provider should honor the krb5_realm option
  - Resolves: rhbz#677318 - Does not read renewable ccache at startup


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-10
changelog:
  - Related: rhbz#678614 - SSSD needs to look at IPA's compat tree for netgroups
  - Related: rhbz#679082 - SSSD IPA provider should honor the krb5_realm option


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-11
changelog:
  - Resolves: rhbz#682340 - sssd-be segmentation fault - ipa-client on
  -                         ipa-server
  - Resolves: rhbz#680440 - sssd does not handle kerberos server IP change
  - Resolves: rhbz#680442 - Dynamic DNS update fails if multiple servers are
  -                         given in ipa_server config option
  - Resolves: rhbz#680932 - Do not delete sysdb memberOf if there is no memberOf
  -                         attribute on the server
  - Resolves: rhbz#682807 - sssd_nss core dumps with certain lookups


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-12
changelog:
  - Resolves: rhbz#682850 - IPA provider should use realm instead of ipa_domain
  -                         for base DN


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-13
changelog:
  - Related: rhbz#680440 - sssd does not handle kerberos server IP change
  -   SSSD was staying with the old server if it was still online


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-14
changelog:
  - Resolves: rhbz#683255 - sudo/ldap lookup via sssd gets stuck for 5min
  -                         waiting on netgroup
  - Resolves: rhbz#683431 - sssd consumes 100% CPU
  - Related: rhbz#680440  - sssd does not handle kerberos server IP change


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-15
changelog:
  - Resolves: rhbz#683860 - Skip users and groups that have incomplete contents
  - Resolves: rhbz#688491 - authconfig fails when access_provider is set as krb5
  -                         in sssd.conf


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-16
changelog:
  - Resolves: rhbz#683158 - SSSD breaks on RDNs with a comma in them
  - Resolves: rhbz#689886 - group memberships are not populated correctly during
  -                         IPA provider initgroups
  - Resolves: rhbz#683885 - SSSD should skip over groups with multiple names


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-20
changelog:
  - Resolves: rhbz#690131 - Traceback messages seen while interrupting
  -                         sss_obfuscate using ctrl+d
  - Resolves: rhbz#690421 - [abrt] sssd-1.2.1-28.el6_0.4: _talloc_free: Process
  -                         /usr/libexec/sssd/sssd_be was killed by signal 11
  -                         (SIGSEGV)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-21
changelog:
  - Resolves: rhbz#690866 - Groups with a zero-length memberuid attribute can
  -                         cause SSSD to stop caching and responding to
  -                         requests


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-23
changelog:
  - Resolves: rhbz#691678 - SSSD needs to fall back to 'cn' for GECOS
  -                         information


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-24
changelog:
  - Resolves: rhbz#692472 - Process /usr/libexec/sssd/sssd_be was killed by
  -                         signal 11 (SIGSEGV)
  -                         Fix is to not attempt to resolve nameless servers


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-25
changelog:
  - Resolves: rhbz#694783 - SSSD crashes during getent when anonymous bind is
  -                         disabled


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-26
changelog:
  - Resolves: rhbz#694444 - Unable to resolve SRV record when called with
  -                         _srv_,<fixed ldap uri> in ldap_uri
  - Related:  rhbz#694783 - SSSD crashes during getent when anonymous bind is
  -                         disabled


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-27
changelog:
  - Related:  rhbz#694783 - SSSD crashes during getent when anonymous bind is
  -                         disabled


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-28
changelog:
  - Related:  rhbz#691678 - SSSD needs to fall back to 'cn' for GECOS
  -                         information


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-32
changelog:
  - Related: rhbz#693818 - Automatic TGT renewal overwrites cached password
  - Fix typo causing build breakage


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-33
changelog:
  - Related: rhbz#693818 - Automatic TGT renewal overwrites cached password
  - Fix segfault in TGT renewal


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-34
changelog:
  - Resolves: rhbz#701700 - sssd client libraries use select() but should use
  -                         poll() instead


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-35
changelog:
  - Resolves: rhbz#707282 - latest sssd fails if ldap_default_authtok_type is
  -                         not mentioned
  - Resolves: rhbz#692404 - rfc2307bis groups are being enumerated even when the
  -                         gidNumber is out of the range of min_id,max_id.
  - Resolves: rhbz#699530 - Users with a local group as their primary GID are
  -                         denied access by the simple access provider
  - Resolves: rhbz#700172 - RFE: SSSD should support paged LDAP lookups
  - Resolves: rhbz#705434 - IPA provider fails initgroups() if user is not a
  -                         member of any group
  - Resolves: rhbz#703624 - SSSD's async resolver only tries the first
  -                         nameserver in /etc/resolv.conf


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-36
changelog:
  - Resolves: rhbz#698723 - kpasswd fails when using sssd and
  -                         kadmin server != kdc server


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-37
changelog:
  - Resolves: rhbz#707513 - Unable to authenticate users when username
  -                         contains "\0"


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-38
changelog:
  - Resolves: rhbz#707627 - Include valid "ldap_uri" formats in sssd-ldap man
  -                         page


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-39
changelog:
  - Resolves: rhbz#709342 - Typo in negative cache notification for initgroups()
  - Resolves: rhbz#708009 - "renew_all_tgts" and "renew_handlers" messages are
  -                         being logged multiple times when the provider comes
  -                         back online
  - Resolves: rhbz#707997 - The IPA provider does not work with IPv6
  - Resolves: rhbz#677327 - [RFE] Support overriding attribute value
  - Resolves: rhbz#692090 - SSSD is not populating nested groups in
  -                         Active Directory


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-41
changelog:
  - Resolves: rhbz#713961 - libsss_ldap segfault at login against OpenLDAP
  - Resolves: rhbz#713438 - sssd shuts down if inotify crashes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-42
changelog:
  - Resolves: rhbz#711416 - During the change password operation the ccache is
  -                         not replaced by a new one if the old one isn't
  -                         active anymore
  - Resolves: rhbz#715609 - Certificate validation fails with message
  -                         "Connection error: TLS: hostname does not match CN
  -                         in peer certificate"
  - Resolves: rhbz#719089 - IPA dynamic DNS update mangles AAAA records
  - Resolves: rhbz#721052 - sssd does not handle kerberos server IP change
  -                         Honor TTL values when resolving hostnames


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-43
changelog:
  - Related:  rhbz#721052 - sssd does not handle kerberos server IP change
  -                         Use ares_search instead of ares_query to honor
  -                         search entries in /etc/resolv.conf


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-44
changelog:
  - Resolves: rhbz#700828 - Process /usr/libexec/sssd/sssd_be was killed by
                            signal 11 (SIGSEGV) when ldap_uri is misconfigured
  - Resolves: rhbz#726438 - sssd doesn't honor ldap supportedControls 
  - Resolves: rhbz#726466 - HBAC rule evaluation does not support extended
                            UTF-8 languages
  - Resolves: rhbz#718250 - Remove DENY rules from the HBAC access provider
  - Resolves: rhbz#728267 - When non-posix groups are skipped, initgroups
                            returns random GID
  - Resolves: rhbz#726475 - sssd_pam leaks file descriptors
  - Resolves: rhbz#725868 - Explicitly ignore groups with gidNumber = 0


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-45
changelog:
  - Related:  rhbz#726466 - HBAC rule evaluation does not support extended
                            UTF-8 languages
  - Related:  rhbz#718250 - Remove DENY rules from the HBAC access provider
  - Fixes an issue on big endian platforms


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-46
changelog:
  - Related:  rhbz#728267 - When non-posix groups are skipped, initgroups
                            returns random GID


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-47
changelog:
  - Resolves: rhbz#728961 - Provide a mechanism for vetoing the use of certain
                            shells


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-49
changelog:
  - Resolves: rhbz#732010 - LDAP+GSSAPI needs explicit Kerberos realm
  - Resolves: rhbz#733382 - SSSD should pick a user/group name when there are
                            multi-valued names
  - Resolves: rhbz#733409 - Improve password policy error message
  - Resolves: rhbz#733663 - Authentication fails when there exists an empty
                            hbacsvcgroup
  - Resolves: rhbz#732935 - Add LDAP provider option to set
                            LDAP_OPT_X_SASL_NOCANON
  - Resolves: rhbz#734101 - sssd blocks login of ipa-users


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-50
changelog:
  - Resolves: rhbz#736314 - sssd crashes during auth while there exists multiple
                            external hosts along with managed host
  - Resolves: rhbz#732974 - [RFE] Have SSSD cache properly with
    krb5_validate = True and SElinux enabled


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-51
changelog:
  - Resolves: rhbz#737157 - "System error" appears in log during change password
                            operation of a user in openldap server with ppolicy
                            enabled
  - Resolves: rhbz#737172 - "Unknown (private extension) error(21853), (null)"
                            messages are logged during change password operation
                            of a user in openldap server with ppolicy enabled


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-52
changelog:
  - Resolves: rhbz#728343 - SSSD taking 5 minutes to log in
  - Resolves: rhbz#739850 - Coverity defects newly introduced in rhel 6.2


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-53
changelog:
  - Resolves: rhbz#741751 - HBAC rule evaluation does not properly handle host
                            groups
  - Resolves: rhbz#740501 - SSSD not functional after "self" reboot
  - Resolves: rhbz#742539 - HBAC: Hostname comparisons should be
                            case-insensitive


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-55
changelog:
  - Resolves: rhbz#738621 - Lookup fails for non-primary usernames with
                            multi-valued uid
  - Resolves: rhbz#738629 - Group lookups doesn't return it's member for
                            sometime when the member has multi-valued uid
  - Resolves: rhbz#742295 - Use an explicit base 10 when converting uidNumber
                            to integer
  - Resolves: rhbz#733382 - SSSD should pick a user/group name when there are
                            multi-valued names


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-56
changelog:
  - Resolves: rhbz#742278 - Rework the example config
  - Resolves: rhbz#746037 - Only access sssd_nss internal hash table if it was
                            initialized
  - Resolves: rhbz#742526 - SSSD's man pages are missing information
  - Resolves: rhbz#743841 - SSSD can crash due to dbus server removing a UNIX
                            socket


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-57
changelog:
  - Resolves: rhbz#743925 - HBAC processing is very slow when dealing with
                            FreeIPA deployments with large numbers of hosts
  - Resolves: rhbz#745966 - sssd_pam segfaults on sssd restart
  - Related:  rhbz#743841 - SSSD can crash due to dbus server removing a UNIX
                            socket


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-59
changelog:
  - Resolves: rhbz#742288 - RFC2307bis initgroups calls are slow
  - Resolves: rhbz#746654 - SSSD backend gets killed on slow systems
  - Related:  rhbz#743925 - HBAC processing is very slow when dealing with
                            FreeIPA deployments with large numbers of hosts
                            Fixes a crash introduced by the earlier patch.
  - Related:  rhbz#733382 - SSSD should pick a user/group name when there are
                            multi-valued names
                            Fixes for internationalization


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-60
changelog:
  - Related:  rhbz#743841 - SSSD can crash due to dbus server removing a UNIX
                            socket


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-64
changelog:
  - Resolves: rhbz#749822 - SSSD may go into infinite loop during RFC2307bis
                            initgroups when groups appear in multiple nesting
                            levels


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-67
changelog:
  - Resolves: rhbz#753842 - sssd_nss crashes when passed invalid UTF-8 for the
                            username in getpwnam()
  - Resolves: rhbz#758157 - LDAP failover not working if server refuses
                            connections


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-2.beta2
changelog:
  - Related:  rhbz#735422 - Rebase SSSD to 1.8.0 in RHEL 6.3
  - Resolves: rhbz#786553 - sssd on ppc64 doesn't pull cyrus-sasl-gssapi.ppc as
                            a dependancy
  - Resolves: rhbz#785909 - --debug-timestamps=1 is not passed to providers
  - Resolves: rhbz#785908 - ldap_*_search_base doesn't fully limit the group and
                            netgroup search base correctly
  - Resolves: rhbz#785907 - [RFE] Add support to request canonicalization on krb
                            AS requests
  - Resolves: rhbz#785905 - [RFE] DEBUG timestamps should offer higher precision
  - Resolves: rhbz#785904 - [RFE] SSSD should have --version option
  - Resolves: rhbz#785902 - Errors with empty loginShell and proxy provider
  - Resolves: rhbz#785898 - Enable midway cache refresh by default
  - Resolves: rhbz#785888 - sssd returns empty netgroup at a second request for
                            a non-existing netgroup
  - Resolves: rhbz#785884 - Honour TTL when resolving host names
  - Resolves: rhbz#785883 - check DNS records before updates
  - Resolves: rhbz#785881 - List the keytab to pick the princiapl to use instead
                            of guessing
  - Resolves: rhbz#785880 - debug_level in sssd.conf overrides command-line
  - Resolves: rhbz#785879 - sss_obfuscate/python config parser modifies config
                            file too much
  - Resolves: rhbz#785877 - on reconnect we need to detect that a ipa/ds server
                            has been reinitialized
  - Resolves: rhbz#785741 - sssd.api.conf and sssd.api.d should not be in /etc
  - Resolves: rhbz#773660 - Kerberos errors should go to syslog
  - Resolves: rhbz#772163 - Iterator loop reuse cases a tight loop in the native
                            IPA netgroups code
  - Resolves: rhbz#771706 - sssd_be crashes during auth when there exists UTF
                            source host group in an hbacrule
  - Resolves: rhbz#771702 - sssd_pam crashes during change password operation
                            against a IPA server
  - Resolves: rhbz#771361 - case_sensitive function not working as intended for
                            ldap
  - Resolves: rhbz#768935 - Crash when applying settings
  - Resolves: rhbz#766941 - The full dyndns update message should be logged into
                            debug logs
  - Resolves: rhbz#766930 - [RFE] Add a new option to override home directory
                            value
  - Resolves: rhbz#766913 - [RFE] Add option to select validate and FAST keytab
                            principal name
  - Resolves: rhbz#766907 - Use [...] for IPv6 addresses in kdc info files
  - Resolves: rhbz#766904 - [RFE] Create a command line tool to change the debug
                            levels on the fly
  - Resolves: rhbz#766876 - [RFE] Make HBAC srchost processing optional
  - Resolves: rhbz#766141 - [RFE] SSSD should support FreeIPA's internal
                            netgroup representation
  - Resolves: rhbz#761582 - [RFE] Add ldap_sasl_minssf option
  - Resolves: rhbz#759186 - [abrt] sssd-1.6.3-1.fc16: ping_check: Process
                            /usr/sbin/sssd was killed by signal 11 (SIGSEGV)
  - Resolves: rhbz#755506 - [RFE] Add host-based (pam_host_attr) access control
  - Resolves: rhbz#753876 - [RFE] Add support for the services map
  - Resolves: rhbz#746181 - "getgrgid call returned more than one result" after
                            group name change in MSAD
  - Resolves: rhbz#744197 - [RFE] close LDAP connection to the server when idle
                            for some (configurable) time
  - Resolves: rhbz#742510 - [RFE] Separate Cache Timeouts for SSSD
  - Related:  rhbz#742509 - [RFE] Add SSSD Tool to purge cache
  - Resolves: rhbz#742052 - id -G group resolution takes extremely long
  - Resolves: rhbz#739312 - [RFE] sssd does not set shadowLastChange
  - Resolves: rhbz#736150 - [RFE] SSSD should support multiple search bases
  - Resolves: rhbz#735827 - [RFE] Ability to set a domain as case sensitive or
                            insensitive
  - Resolves: rhbz#735405 - [RFE] Option to disable warnings for unknown users
  - Resolves: rhbz#728212 - [RFE] sssd does not handle when paging control
                            disabled for openldap
  - Resolves: rhbz#726467 - SSSD takes 30+ seconds to login
  - Resolves: rhbz#721289 - Process /usr/libexec/sssd/sssd_be was killed by
                            signal 11 during auth when password for the user is
                            not set


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-3.beta2
changelog:
  - Handle filtering python Provides in a safer way
  - Related:  rhbz#735422 - Rebase SSSD to 1.8.0 in RHEL 6.3


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-4.beta3
changelog:
  - Resolves: rhbz#761570 - [RFE] support looking up autofs maps via SSSD
  - Resolves: rhbz#788979 - sssd crashes during initgroups against a user
                            belonging to nested rfc2307bis group


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-5
changelog:
  - Resolves: rhbz#753763 - Provide logging configuration compatibility on
                            SSSD 1.5/1.6 upgrade
  - Resolves: rhbz#785871 - wrong build dependency on nscd
  - Resolves: rhbz#785873 - IPA host search base cannot be set
  - Resolves: rhbz#791208 - Entries lacking a POSIX username value break group
                            lookups
  - Resolves: rhbz#796307 - Simple Paged Search control needs to be used more
                            sparingly
  - Resolves: rhbz#797282 - sssd-1.5.1-66.el6.x86_64 needs
                            openldap >= openldap-2.4.23-20.el6.x86_64
  - Resolves: rhbz#787035 - ipa - sssd slow response with thousands of user
                            entries
  - Resolves: rhbz#742509 - [RFE] Add SSSD Tool to purge cache
  - Resolves: rhbz#772297 - Fails to update if all nisNetgroupTriple or
                            memberNisNetgroup entries are deleted from a
                            netgroup
  - Resolves: rhbz#783138 - Backend occasionally goes offline under heavy load
  - Resolves: rhbz#797975 - sssd_be: The requested target is not configured is
                            logged at each login
  - Resolves: rhbz#735422 - Rebase SSSD to 1.8.0 in RHEL 6.3


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-6
changelog:
  - Fix multilib-clean issue due to upgrade script
  - Related:  rhbz#753763 - Provide logging configuration compatibility on
                            SSSD 1.5/1.6 upgrade


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-7
changelog:
  - Fix multilib-clean issue due to upgrade script
  - Use a patch and install the script to python_sitelib
  - Related:  rhbz#753763 - Provide logging configuration compatibility on
                            SSSD 1.5/1.6 upgrade


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-8
changelog:
  - Fix multilib-clean issue due to upgrade script
  - Fix typo in the patch
  - Related:  rhbz#753763 - Provide logging configuration compatibility on
                            SSSD 1.5/1.6 upgrade


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-9
changelog:
  - Fix multilib-clean issue due to upgrade script
  - Remove old copy from the spec file
  - Related:  rhbz#753763 - Provide logging configuration compatibility on
                            SSSD 1.5/1.6 upgrade


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-10
changelog:
  - Fix explicit requires to use openldap instead of openldap-libs
  - Related:  rhbz#797282 - sssd-1.5.1-66.el6.x86_64 needs
                            openldap >= openldap-2.4.23-20.el6.x86_64


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-11
changelog:
  - Do not auto-upgrade debug levels
  - Tool still available for manual use
  - Reverts:  rhbz#753763 - Provide logging configuration compatibility on
                            SSSD 1.5/1.6 upgrade
  - Resolves: rhbz#798881 - Install-time warnings
  - Resolves: rhbz#798774 - IPA provider should assume that ipa_domain is also
                            the dns_discovery_domain
  - Resolves: rhbz#798655 - Password logins failing due to a process with high
                            UID


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-12
changelog:
  - Resolves: rhbz#801407 - sssd_nss gets hung processing identical search
                            requests
  - Resolves: rhbz#801451 - Logging in with ssh pub key should consult
                            authentication authority policies
  - Resolves: rhbz#795562 - Infinite loop checking Kerberos credentials
  - Resolves: rhbz#798317 - sssd crashes when ipa_hbac_support_srchost is set to
                            true
  - Resolves: rhbz#799039 - --debug option for sss_debuglevel doesn't work
  - Resolves: rhbz#799915 - Unable to lookup netgroups with case_sensitive=false
  - Resolves: rhbz#799929 - Raise limits for max num of files sssd_nss/sssd_pam
                            can use
  - Resolves: rhbz#799971 - sssd_be crashes on shutdown
  - Resolves: rhbz#801533 - sssd_be crashes when resolving non-trivial nested
                            group structure
  - Resolves: rhbz#801368 - Group lookups doesn't return members with proxy
                            provider configured
  - Resolves: rhbz#801377 - getent returns non-existing netgroup name, when sssd
                            is configured as proxy provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-15
changelog:
  - Update translations
  - Resolves: rhbz#802372 - Pick up latest translation files for SSSD
  - Resolves: rhbz#802207 - getent netgroup hangs when
                            "use_fully_qualified_names = TRUE" in sssd
  - Related:  rhbz#801451 - Logging in with ssh pub key should consult
                            authentication authority policies


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-17
changelog:
  - Related:  rhbz#802207 - getent netgroup hangs when
                            "use_fully_qualified_names = TRUE" in sssd
  - Resolves: rhbz#801719 - "Error looking up public keys" while ssh to replica
                            using IP address
  - Resolves: rhbz#803659 - Service lookup shows case sensitive names twice with
                            case_sensitive=false
  - Resolves: rhbz#803842 - Unable to bind to LDAP server when minssf set
  - Resolves: rhbz#805034 - accessing an undefined variable might cause crash
  - Resolves: rhbz#805108 - sss_ssh_knownhostproxy infinite loop hangs SSH login


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-18
changelog:
  - Resolves: rhbz#804057 - Initial service lookups having name with uppercase
                            alphabets doesn't work
  - Resolves: rhbz#804065 - Service lookup using case-sensitive protocol names
                            doesn't work when case_sensitive=false
  - Resolves: rhbz#805281 - sssd: Uses the wrong key when there a multiple
                            realms in a single keytab
  - Resolves: rhbz#805452 - Unable to lookup user, group, netgroup aliases with
                            case_sensitive=false
  - Resolves: rhbz#805918 - Wrong resolv_status might cause crash when name
                            resolution times out
  - Resolves: rhbz#805431 - NFS files/folders are mapped to nobody user if NFS
                            top level directory is chowned by a SSSD user


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-20
changelog:
  - Related: rhbz#805452  - Unable to lookup user, group, netgroup aliases with
                            case_sensitive=false


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-21
changelog:
  - Resolves: rhbz#808458 - Authconfig crashes when sets krb realm
  - Resolves: rhbz#808597 - sssd_nss crashes on request when no back end is
                            running
  - Resolves: rhbz#808107 - Coverity revealed memory management defects


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-22
changelog:
  - Fix typo in patch for SSH umask
  - Related:  rhbz#808107 - Coverity revealed memory management defects


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-23
changelog:
  - Resolves: rhbz#805924 - SSSD should attempt to get the RootDSE after binding
  - Resolves: rhbz#814237 - sdap_check_aliases must not error when detects the
                            same user
  - Resolves: rhbz#812281 - autofs client: map name length used as key length
  - Related:  rhbz#784870 - SSSD fails during autodetection of search bases for
                            new LDAP features
  - Related:  rhbz#814269 - sssd-1.5.1-66.el6_2.3.x86_64 freezes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-24
changelog:
  - Resolves: rhbz#805431 - NFS files/folders are mapped to nobody user if NFS
                            top level directory is chowned by a SSSD user


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-25
changelog:
  - Resolves: rhbz#816616 - group members are now lowercased in case insensitive
                            domains


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-26
changelog:
  - Resolves: rhbz#818642 - Auth fails for user with non-default attribute names
  - Resolves: rhbz#819063 - sssd fails to provide partial data till paged search
                            returns "Size Limit Exceeded"
  - Resolves: rhbz#820585 - Group enumeration fails in proxy provider


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-27
changelog:
  - Resolves: rhbz#820759 - AVC denial seen on sssd upgrade during ipa-client
                            upgrade
  - Resolves: rhbz#821044 - sss_groupadd no longer detects duplicate GID numbers


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-28
changelog:
  - Resolves: rhbz#822236 - SSSD netgroups do not honor
                            entry_cache_nowait_percentage


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-29
changelog:
  - Resolves: rhbz#824062 - sssd_be crashed with SIGSEGV in
                            _tevent_schedule_immediate()


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-30
changelog:
  - Resolves: rhbz#824616 - sssd_nss crashes when configured with
                            use_fully_qualified_names = true


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-31
changelog:
  - Resolves: rhbz#825028 - Service lookups by port number doesn't work on
                            s390x/ppc64 arches


author: Stephen Gallagher <sgallagh@redhat.com> - 1.8.0-32
changelog:
  - Fix protocol break for services map
  - Related:  rhbz#825028 - Service lookups by port number doesn't work on
                            s390x/ppc64 arches


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.0-33
changelog:
  - Resolves: rhbz#840089 - Update the shadowLastChange attribute
                            with days since the Epoch, not seconds


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.0-1.rc1
changelog:
  - Rebase to 1.9.0 RC1
  - Resolves: rhbz#827606 - Rebase SSSD to 1.9 in 6.4
  - Bump the selinux-policy version number to pull in required fixes


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-2
changelog:
  - Fix the "ca" translation of the sssd-simple manual page
  - Related: rhbz#827606 - Rebase SSSD to 1.9 in 6.4


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-5
changelog:
  - Do not send SIGKILL to service right after sending SIGTERM
  - Resolves: #771975
  - Fix the initial sudo smart refresh
  - Resolves: #869013
  - Implement password authentication for users from trusted domains
  - Resolves: #869071
  - LDAP child crashed with a wrong keytab
  - Resolves: #869150
  - The sssd_nss process grows the memory consumption over time
  - Resolves: #869443


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-6
changelog:
  - Resolves: rhbz#871576 - sssd does not resolve group names from AD
  - Resolves: rhbz#872324 - pam: fd leak when writing the selinux login file
                            in the pam responder
  - Resolves: rhbz#871424 - authconfig chokes on sssd.conf with chpass_provider
                            directive


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-7
changelog:
  - Resolves: rhbz#873032 - Move sss_cache to the main subpackage
  - Resolves: rhbz#829740 - Init script reports complete before sssd is actually
                            working
  - Resolves: rhbz#869466 - SSSD starts multiple processes due to syntax error in
                            ldap_uri
  - Resolves: rhbz#870505 - sss_cache: Multiple domains not handled properly
  - Resolves: rhbz#867933 - invalidating the memcache with sss_cache doesn't work
                            if the sssd is not running
  - Resolves: rhbz#872110 - User appears twice on looking up a nested group


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-9
changelog:
  - Resolves: rhbz#873988 - Man page issue to list 'force_timeout' as an
                            option for the [sssd] section


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-10
changelog:
  - Resolves: rhbz#872180 - subdomains: Invalid sub-domain request type
  - Related: rhbz#867933 - invalidating the memcache with sss_cache doesn't work
                           if the sssd is not running


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-12
changelog:
  - Resolves: rhbz#870278 -  ipa client setup should configure host properly
                             in a trust is in place


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-16
changelog:
  - Resolves: rhbz#875738 - offline authentication failure always returns
                            System Error


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-19
changelog:
  - Resolves: rhbz#877130 - LDAP provider fails to save empty groups
  - Related: rhbz#869466 - check the return value of waitpid()


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-20
changelog:
  - Resolves: rhbz#877126 - subdomains code does not save the proper
                            user/group name


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-21
changelog:
  - Resolves: rhbz#877354 - ldap_connection_expire_timeout doesn't expire
                            ldap connections


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-22
changelog:
  - Resolves: rhbz#861075 - SSSD_NSS failure to gracefully restart
                            after sbus failure


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-25
changelog:
  - Resolves: rhbz#878262 - ipa password auth failing for user principal
                            name when shorter than IPA Realm name
  - Resolves: rhbz#871843 - Nested groups are not retrieved appropriately
                            from cache


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-26
changelog:
  - Resolves: rhbz#874673 - user id lookup fails using proxy provider
  - Fix a possibly uninitialized variable in the LDAP provider
  - Related: rhbz#877130


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-27
changelog:
  - Resolves: rhbz#824244 - sssd does not warn into sssd.log for broken
                            configurations


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-28
changelog:
  - Resolves: rhbz#874616 - Silence the DEBUG messages when ID mapping code
                            skips a built-in group


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-31
changelog:
  - Resolves: rhbz#882076 - SSSD crashes when c-ares returns success but an
                            empty hostent during the DNS update
  - Do not version libsss_sudo, it's not supposed to be linked against, but
    dlopened (Related: rhbz#761573)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-32
changelog:
  - Resolves: rhbz#875677 - password expiry warning message doesn't appear
                            during auth
  - Fix potential NULL dereference when skipping built-in AD groups
    (Related: rhbz#874616)
  - Add missing parameter to DEBUG message (Related: rhbz#829742)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-34
changelog:
  - Resolves: rhbz#877974 - updating top-level group does not reflect ghost
                            members correctly
  - Resolves: rhbz#880159 - delete operation is not implemented for ghost users


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-35
changelog:
  - Resolves: rhbz#882290 - arithmetic bug in the SSSD causes netgroup
                            midpoint refresh to be always set to 10 seconds


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-36
changelog:
  - Resolves: rhbz#883336 - sssd crashes during start if id_provider is
                            not mentioned


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-37
changelog:
  - Resolves: rhbz#884480 - user is not removed from group membership during
                            initgroups
  - Fix incorrect synchronization in mmap cache (Related: #789507)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-38
changelog:
  - Resolves: rhbz#882923 - Negative cache timeout is not working for proxy
                            provider
  - Link sss_ssh_authorizedkeys and sss_ssh_knowhostsproxy with the client
    libraries (Related: #870060)
  - Move sss_ssh_knownhosts documentation to the correct section
    (Related: #870060)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-39
changelog:
  - Resolves: rhbz#882221 - Offline sudo denies access with expired
                            entry_cache_timeout
  - Fix several bugs found by Coverity and clang:
  - Check the return value of diff_gid_lists (Related: #869071)
  - Move misplaced sysdb assignment (Related: #827606)
  - Remove dead assignment (Related: #827606)
  - Fix copy-n-paste error in the memberof plugin (Related: #877974)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-40
changelog:
  - Resolves: rhbz#880546 - krb5_kpasswd failover doesn't work
  - Fix the error handler in sss_mc_create_file (Related: #789507)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-42
changelog:
  - Resolves: rhbz#885105 - sudo denies access with disabled
                            ldap_sudo_use_host_filter


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-43
changelog:
  - Resolves: rhbz#880176 - memberUid required for primary groups to match
                            sudo rule


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-44
changelog:
  - Resolves: rhbz#878419 - sss_userdel doesn't remove entries from in-memory
                            cache


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-45
changelog:
  - Resolves: rhbz#858345 - pam_sss(crond:account): Request to sssd
                            failed. Timer expired


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-46
changelog:
  - Resolves: rhbz#884600 - ldap_chpass_uri failover fails on using same
                            hostname


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-47
changelog:
  - Resolves: rhbz#882923 - Negative cache timeout is not working for proxy
                            provider


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-48
changelog:
  - Resolves: rhbz#880956 - Primary server status is not always reset after
                            failover to backup server happened
  - Silence a compilation warning in the memberof plugin (Related: rhbz#877974)
  - Do not steal resolv result on error (Related: rhbz#882076)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-49
changelog:
  - Resolves: rhbz#884666 - sudo: if first full refresh fails, schedule
                            another first full refresh


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-50
changelog:
  - Resolves: rhbz#870045 - always reread the master map from LDAP
  - Resolves: rhbz#876531 - sss_cache does not work for automount maps


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-52
changelog:
  - Related: rhbz#875851 - sysdb upgrade failed converting db to 0.11
  - Include more debugging during the sysdb upgrade


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-53
changelog:
  - Resolves: rhbz#885078 - sssd_nss crashes during enumeration if the
                            enumeration is taking too long


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-54
changelog:
  - Resolves: rhbz#888614 - Failure in memberof can lead to failed database
                            update


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-57
changelog:
  - Resolves: rhbz#886091 - Disallow root SSH public key authentication
  - Add default section to switch statement (Related: rhbz#884666)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-58
changelog:
  - Resolves: rhbz#889168 - krb5 ticket renewal does not read the renewable
                            tickets from cache


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-62
changelog:
  - Resolves: rhbz#886848 - user id lookup fails for case sensitive users
                            using proxy provider


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-64
changelog:
  - Resolves: rhbz#891356 - Smart refresh doesn't notice "defaults" addition
                            with OpenLDAP


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-66
changelog:
  - Resolves: rhbz#874579 - sssd caching not working as expected for selinux
                            usermap contexts


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-67
changelog:
  - Resolves: rhbz#878583 - IPA Trust does not show secondary groups for AD
                            Users for commands like id and getent


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-68
changelog:
  - Resolves: rhbz#887961 - AD provider: getgrgid removes nested group
                            memberships


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-71
changelog:
  - Resolves: rhbz#895132 - Modifications using sss_usermod tool are not
                            reflected in memory cache


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-72
changelog:
  - Resolves: rhbz#894997 - sssd_be crashes looking up members with groups
                            outside the nesting limit


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-73
changelog:
  - Resolves: rhbz895615 - ipa-client-automount: autofs failed in s390x and
                           ppc64 platform


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-74
changelog:
  - Resolves: rhbz894381 - memory cache is not updated after user is deleted
                           from ldb cache


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-78
changelog:
  - Resolves: rhbz#896476 - SSSD should warn when pam_pwd_expiration_warning
                            value is higher than passwordWarning LDAP attribute.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-79
changelog:
  - Resolves: rhbz#902716 - Rule mismatch isn't noticed before smart refresh
                            on ppc64 and s390x


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-80
changelog:
  - Resolves: rhbz#903078 - Out-of-bounds read flaws in
                            autofs and ssh services responders


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-81
changelog:
  - Resolves: rhbz#903078 - TOCTOU race conditions by copying
                            and removing directory trees


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-82
changelog:
  - Resolves: rhbz#888614 - Failure in memberof can lead to failed
                            database update


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-84
changelog:
  - Resolves: rhbz#911329 - pwd_expiration_warning has wrong default for
                            Kerberos


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-85
changelog:
  - Fix pwd_expiration_warning=0
  - Resolves: rhbz#911329 - pwd_expiration_warning has wrong default for
                            Kerberos


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-86
changelog:
  - Resolves: rhbz#911299 - sssd: simple access provider flaw prevents intended
                            ACL use when client to an AD provider


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-88
changelog:
  - Resolves: #950874: Simple access control always denies uppercased users
                       in case insensitive domain


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-90
changelog:
  - Resolves: #953165 - Enabling enumeration causes sssd_be process to
                        utilize 100% of the CPU


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-91
changelog:
  - Resolves: #967636 - SSSD frequently fails to return automount maps
                        from LDAP


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-93
changelog:
  - Resolves: #987479 - libsss_sudo should depend on sudo package with
                        sssd support


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-94
changelog:
  - Call restorecon on memcache files to force the right context on upgrades
  - Resolves: #987456 - RHEL6 sssd upgrade restorecon workaround for
                        /var/lib/sss/mc context


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-95
changelog:
  - Mention that enumeration should be discouraged
  - Resolves: #988381 - clarify the disadvantages of enumeration in sssd.conf


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-96
changelog:
  - Resolves: #988525 - sssd fails instead of skipping when a sudo ldap
                        filter returns entries with multiple CNs


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-97
changelog:
  - Resolves: #986379 - sss_cache -N/-n should invalidate the hash table
                        in sssd_nss


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-98
changelog:
  - Resolves: #979046 - sssd_be goes to 99% CPU and causes significant login
                        delays when client is under load


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-99
changelog:
  - Clarify the min_id/max_id limits further
  - Resolves: #978994 - SSSD filter out ldap user/group if uid/gid is zero


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-101
changelog:
  - Resolves: #976273 - [RFE] Add a new override_homedir expansion for the
                        "original value"


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-104
changelog:
  - Resolves: #971435 - Enhance sssd init script so that it would source
                        a configuration


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-106
changelog:
  - Format patch to configure sysv script differently
  - RHEL-6 patch(1) apparently doesn't like the output of git format-patch
   -M -C and doesn't properly copy files on renames
  - Resolves: #971435 - Enhance sssd init script so that it would source a
    configuration.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-108
changelog:
  - Set correct state of SRV servers on resolving error
  - Resolves: #954275 - sssd fails connect to IPA server during boot when
                        spanning tree is enabled in network router.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-109
changelog:
  - Use permissive control when adding ghost users
  - Resolves: #928797 - cyclic group memberships may not work depending on
                        order of operations


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-112
changelog:
  - Resolves: #918394 - sssd etas 99% CPU and runs out of file descriptors
                        when clearing cache


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-113
changelog:
  - Resolves: #916997 - getgrnam / getgrgid for large user groups
                        is too slow due to range retrieval functionality


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-114
changelog:
  - Resolves: #914433 - sssd pam write_selinux_login_file creating the temp
                        file for SELinux data failed


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-115
changelog:
  - Apply a forgotten dependency for patch #254
  - Related: #916997 - getgrnam / getgrgid for large user groups
                       is too slow due to range retrieval functionality
  - Add two fixes for better handling of faulty SRV processing
  - Related: #954275 - sssd fails connect to IPA server during boot when
                       spanning tree is enabled in network router.
  - Remove enumerate=true from example in man page
  - Related: #988381 - clarify the disadvantages of enumeration in sssd.conf


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-117
changelog:
  - Resolves: #966757 - SSSD failover doesn't work if the first DNS server
                       in resolv.conf is unavailable


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-119
changelog:
  - Resolves: #948830 - sssd do too many disk writes causing delay in
                        "getent netgroup allmachines-netgroup" nested netgroups.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-120
changelog:
  - Resolves: #983028 - passwd returns "Authentication token manipulation
                        error" when entering wrong current password


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-121
changelog:
  - Print password complexity hint when password change fails with
    constraint violation
  - Related: #983028 - passwd returns "Authentication token manipulation
                       error" when entering wrong current password


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-122
changelog:
  - Make IPA SELinux provider aware of subdomain users
  - Resolves: #954342 - In IPA AD trust setup, the sssd logs throws
                        'sysdb_search_user_by_name failed' error when
                        AD user tries to login via ipa client.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-123
changelog:
  - Silence restorecon on clean install
  - Resolves: #987456 - RHEL6 sssd upgrade restorecon workaround for
                        /var/lib/sss/mc context


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-124
changelog:
  - Resolves: #1002161 - large number of sudo rules results in error -
                         Unable to create response: Invalid argument


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-125
changelog:
  - Resolves: #997406 - sssd_nss core dumps under load
  - Resolves: #984814 - sssd_nss terminated with segmentation fault


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-126
changelog:
  - Make IPA SELinux provider aware of subdomain users
  - A better version of already committed patch
  - Resolves: #954342 - In IPA AD trust setup, the sssd logs throws
                        'sysdb_search_user_by_name failed' error when
                        AD user tries to login via ipa client.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-128
changelog:
  - More upstream fixes to prevent memcache crashes
  - Related: #997406 - sssd_nss core dumps under load


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-129
changelog:
  - Do not crash when LDAP disconnects while a search is still in progress
  - Resolves: #1019979 - sssd_be segfault when authenticating against active
                         directory


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-130
changelog:
  - Inherit UID limits for subdomains
  - Resolves: #1020905 - Creating system accounts on a IdM client takes up
                         to 10 minutes when AD trust is configured in the IdM.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-131
changelog:
  - Allow combination of proxy id backend and LDAP auth backend
  - Resolves: #1025813 - SSSD: Allow for custom attributes in RDN when using
                         id_provider = proxy


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-132
changelog:
  - Resolves: #1038098 - sssd_nss grows memory footprint when netgroups
                         are requested


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-134
changelog:
  Resolves: #1036168 - sssd can't retrieve auto.master when using the
                       "default_domain_suffix"


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.5.1-3
changelog:
  - Backport the InfoPipe patches needed for Sat6 integration
  - Related: #1051164 - Rebase SSSD to 1.11+ in RHEL6


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-2
changelog:
  - Resolves: rhbz#1104145 - public key validator is too strict and does not
                             allow newlines anywhere in the public key string,
                             not even at the end


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-3
changelog:
  - Resolves: rhbz#1110369 - sssd is started before messagebus, making
                             sssd-ifp fail


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-5
changelog:
  - Fix potential NULL dereference in IFP code
  - Related: rhbz#1110369 - sssd is started before messagebus, making
                            sssd-ifp fail


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-7
changelog:
  - Resolves: rhbz#1042922 - [RFE] Add fallback to sudoRunAs when sudoRunAsUser
                             is not defined and no ldap_sudorule_runasuser mapping
                             has been defined in SSSD


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-9
changelog:
  - Resolves: rhbz#1122158 - ad: group membership is empty when id mapping
                             is off and tokengroups are enabled


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-11
changelog:
  - Resolves: rhbz#1109188 - dereferencing control failure against openldap
                             server


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-12
changelog:
  - Resolves: rhbz#1111317 - [RFE] Add option for sssd to replace space with
                             specified character in LDAP group


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-13
changelog:
  - Resolves: rhbz#1122873 -  Failover does not always happen from SRV
                              to hostname resolution(via /etc/hosts)
  - Remove spurious systemctl call on %postun


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-14
changelog:
  - Resolves: rhbz#1110226 - Requests queued during transition from offline
                             to online mode


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-19
changelog:
  - Resolves: rhbz#1127757 - sssd can't retrieve sudo rules when using the
                             "default_domain_suffix" option


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-20
changelog:
  - Resolves: rhbz#1127278 -  Auth fails when space in username is
                              replaced with character set by
                              override_default_whitespace


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-21
changelog:
  - Add notes about offline mode to sssd.conf
  - Related: rhbz#1110226 - Requests queued during transition from offline
                             to online mode


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-22
changelog:
  - Use the correct sudo iterator
  - Related: rhbz#1118336 - sudo: invalid sudoHost filter with asterisk


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-23
changelog:
  - Resolves: rhbz#1099290: RFE: Be able to configure sssd to honor openldap
                            account lock to restrict access via ssh key


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-25
changelog:
  - Resolves: rhbz#1111528 - Expired shadow policy user(shadowLastChange=0)
                             is not prompted for password change


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-26
changelog:
  - Resolves: rhbz#1130017 - Saving group membership fails if provider is AD,
                             POSIX attributes are used and primary group contains
                             the user as a member


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-28
changelog:
  - Resolves: rhbz#1125187 - simple_allow_groups does not lookup groups from
                             other AD domains


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-29
changelog:
  - Resolves: rhbz#1103487 - CVE-2014-0249 - sssd: incorrect expansion of group
                             membership when encountering a non-POSIX group


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-30.1
changelog:
  - Resolves: rhbz#1146198 - Password expiration policies are not being
                             enforced by SSSD


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-30.3
changelog:
  - Resolves: rhbz#1165074 - RHEL6.6 sssd (1.11) doesn't return all group
                             memberships against an IPA server


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-30.4
changelog:
  - Relax the libldb requirements
  - Backport removal of unused signal functions to avoid conflict with Samba
  - Resolves: rhbz#1201666 - Relax the libldb requirements to unblock RH Storage


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - move to Applications/Internet group
  - clean up %post script
  - make stunnel.pem %ghost %config(noreplace)
  - provide a sample file for use with xinetd


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - update to 3.11
  - chuck the SIGHUP patch (went upstream)
  - chuck parts of the 64-bit clean patch (went upstream)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - remove explicit requirement on openssl (specific version isn't enough,
    we have to depend on shared library version anyway)


author: Nalin Dahyabhai <nalin@redhat.com> 3.19-1
changelog:
  - update to 3.19 to avoid problems with stunnel being multithreaded, but
    tcp wrappers not being thrad-safe


author: Nalin Dahyabhai <nalin@redhat.com> 3.20-1
changelog:
  - log using LOG_AUTHPRIV facility by default (#47289)
  - make permissions on stunnel binary 0755
  - implicitly trust certificates in %{_datadir}/ssl/trusted (#24034)


author: Miloslav Trmac <mitr@redhat.com> - 4.11-1
changelog:
  - Update to stunnel-4.11
  - Fix int/size_t mismatches in stack_info ()
  - Update Certificate-Creation for /etc/pki


author: Miloslav Trmac <mitr@redhat.com> - 4.14-1
changelog:
  - Update to stunnel-4.14
  - Override changed default pid file location, keep it in %{_localstatedir}/run


author: Miloslav Trmač <mitr@redhat.com> - 4.20-4
changelog:
  - Revert the port to NSS, wait for NSS-based stunnel 5.x instead
    Resolves: #301971
  - Mark localized man pages with %lang (patch by Ville Skyttä)
    Resolves: #322281


author: Avesh Agarwal <avagarwa@redhat.com> - 4.29-1
changelog:
  - New upstream realease 4.29
  - Updated authpriv and sample patches for the new release
  - Modified spec file to include dist tag


author: Jeff Johnson <jbj@redhat.com> 0.15-3687.0
changelog:
  - first build from adapted spec file, only client and libraries for now.
  - internal apr/apr-utils/neon until incompatibilities sort themselves out.
  - avoid libdir issues on x86_64 for the moment.


author: Joe Orton <jorton@redhat.com> 0.22.2-1
changelog:
  - update to 0.22.2; add mod_dav_svn subpackage
  - include Python bindings
  - neon: force use of expat, enable SSL
  - drop check for specific apr version added in -3


author: Jeff Johnson <jbj@redhat.com> 0.22.2-2
changelog:
  - use external neon-0.23.9-2 (i.e. with neon-config), drop internal neon.
  - use db-4.1.25, not db-4.0.14.
  - do "make check" (but ignore failure for now).
  - s390x knows not of httpd >= 2.0.45.


author: Joe Orton <jorton@redhat.com> 1.0.0-2
changelog:
  - add fix for lack of apr_dir_read ordering guarantee (Philip Martin)
  - enable compression in ra_dav by default (Tobias Ringström)


author: Joe Orton <jorton@redhat.com> 1.0.2-2
changelog:
  - add perl MODULE_COMPAT requirement for -perl subpackage
  - move perl man pages into -perl subpackage
  - clean up -perl installation and dependencies (Ville Skyttä, #123045)


author: Joe Orton <jorton@redhat.com> 1.1.3-7
changelog:
  - restore swig bindings support (from upstream via Max Bowsher, #141343)
  - tweak SELinux commentary in default subversion.conf


author: Joe Orton <jorton@redhat.com> 1.1.3-8
changelog:
  - further swig bindings fix (upstream via Max Bowsher, #151798)
  - fix perl File::Path dependency in filter-requires.sh


author: Joe Orton <jorton@redhat.com> 1.2.0-3
changelog:
  - update to 1.2.1
  - fix BuildRequires for ruby and apr-util (#163126)
  - drop static library archives


author: Joe Orton <jorton@redhat.com> 1.2.3-3
changelog:
  - update to 1.2.3
  - update to psvn.el r16070 from Stefan Reichoer
  - merge subversion.conf changes from RHEL4
  - merge filter-requires.sh changes from FC4 updates


author: Joe Orton <jorton@redhat.com> 1.3.2-2
changelog:
  - update to 1.3.2
  - fix Ruby sitelibdir (Garrick Staples, #191611)
  - own /etc/subversion (#189071)
  - update to psvn.el r19857


author: Joe Orton <jorton@redhat.com> 1.4.3-3
changelog:
  - update to 1.4.3 (#228691)
  - remove trailing dot from Summary
  - use current preferred standard BuildRoot
  - add post/postun ldconfig scriptlets for -ruby and -javahl


author: Joe Orton <jorton@redhat.com> 1.4.4-2
changelog:
  - update to 1.4.4
  - add Provides: svn (#245087)
  - fix without-java build (Lennert Buytenhek, #245467)


author: Joe Orton <jorton@redhat.com> 1.4.4-3
changelog:
  - fix build with new glibc open()-as-macro
  - build all swig code in %build, not %install
  - BuildRequire perl(Test::More), perl(ExtUtils::MakeMaker)


author: Joe Orton <jorton@redhat.com> 1.4.4-4
changelog:
  - trim dependencies from .la files
  - detabify spec file
  - test suite disabled to ease stress on builders


author: Joe Orton <jorton@redhat.com> 1.5.6-3
changelog:
  - update to 1.5.6
  - autoload psvn (#238491, Tom Tromey)
  - regenerate swig bindings (#480503)
  - fix build with libtool 2.2 (#469524)


author: Ville Skyttä <ville.skytta@iki.fi> - 1.6.5-3
changelog:
  - Apply svn2cl upstream patch to fix newline issues with libxml2 2.7.4+,
    see http://bugs.debian.org/546990 for details.


author: Ville Skyttä <ville.skytta@iki.fi> - 1.6.6-5
changelog:
  - Include svn2cl and its man page only in the -svn2cl subpackage (#558598).
  - Do not include bash completion in docs, it's installed.


author: Joe Orton <jorton@redhat.com> - 1.6.11-4
changelog:
  - add security fixes for CVE-2011-1752, CVE-2011-1783, CVE-2011-1921 (#709221)
  - add security fix for CVE-2011-0715 (#681174)
  - add security fixes for CVE-2010-4644, CVE-2010-4539 (#672679)


author: Joe Orton <jorton@redhat.com> - 1.6.11-5
changelog:
  - add init script for svnserve (#720790, #711904)
  - fix segfault with "AuthzForceUsernameCase lower" (#751321)
  - fix parent directory access with merges (#749494)


author: Thomas Woerner <twoerner@redhat.com> 1.0.1-1
changelog:
  - fixed startup and description texts
  - added missing requirement for system-config-network-tui
  - moved base python files into tui sub package
  - fixed requirements
  - made package noarch


author: Thomas Woerner <twoerner@redhat.com> 1.0.1-2
changelog:
  - fixed disabled string in fw_gui
  - set mode after copying of ip*tables-config to 0600
  - fixed categories in desktop file


author: Thomas Woerner <twoerner@redhat.com> 1.0.2-1
changelog:
  - obsolete and provide system-config-securitylevel package
  - added compat files for anaconda, firstboot and system-config-kickstart
  - lokkit fixes for nostart option:
    - only write config for iptables and ip6tables if enabled
    - stop iptables and ip6tables if disabled
    - unlink iptables and ip6tables rule files if disabled
  - lokkit: new option --update to regenerate firewall configuration if not 
    disabled
  - check for include files only when writing firewall configuration
  - clean buildroot in install
  - made system-config-securitylevel a synonym for system-config-firewall
  - ip6tables: reject with icmp6-adm-prohibited instead of icmp6-port-unreachable
    (rhbz#250915)
  - moved config files from /etc/sysconfig into tui sub package
  - removed x bit from import files


author: Thomas Woerner <twoerner@redhat.com> 1.0.3-1
changelog:
  - added missing system-config-securitylevel compatibility files
  - string and documentation fixes
  - fixed typos reported by Alain Portal
  - more translations
  - fixed buildroot
  - cleanup and changes according to review (rhbz#253232)
  - moved doc to tui sub package


author: Thomas Woerner <twoerner@redhat.com> 1.0.4-1
changelog:
  - more translations
  - build environment changes
  - dropped build stage, because it is not needed at all


author: Thomas Woerner <twoerner@redhat.com> 1.0.5-4
changelog:
  - fixed problem if /etc/sysconfig/system-config-securtylevel and 
    /etc/sysconfig/system-config-firewall are not readable


author: Thomas Woerner <twoerner@redhat.com> 1.0.6-1
changelog:
  - dropped --stop option from fw_gui::genArgs
  - new translations
  - sysctl support for masquerading (net.ipv4.ip_forward will be set)
  - glade file: fixed spacings, dropped not needed containers


author: Thomas Woerner <twoerner@redhat.com> 1.0.7-1
changelog:
  - new translations
  - added openvpn to services (rhbz#)
  - fixed typo in description text for ipsec
  - using port numbers instead of port names for services
  - renamed some variables to be consistent
  - make tolltip better: bigger text, helper modules
  - dropped unused code: inconsistent handling
  - make port check button inactive in add_port_cb
  - new function _addDevice: code cleanup
  - allow to set variables in ipXtablesConfig, which were not set before
  - fixed os.system calls in ipXtablesClass to return proper return values
  - fixed status funciton in ipXtablesClass
  - new _append_unique function in fw_parser to prevent duplicates
  - added warning dialog for missing or unusable /etc/sysconfig/ip*tables files
  - fixed expand of the warning label in the startup dialog


author: Thomas Woerner <twoerner@redhat.com> 1.0.8-1
changelog:
  - use extension match for protocols (rhbz#229879)
  - use ipv6-icmp instead of icmpv6 (rhbz#291001)
  - use ':' in tui as port/proto delimiter for other ports (rhbz#292171)
  - some translation fixes


author: Thomas Woerner <twoerner@redhat.com> 1.0.8-2
changelog:
  - lokkit: write new config with nostart option (rhbz#353961)
  - translation fixes for de, it, nb, sr@latin


author: Thomas Woerner <twoerner@redhat.com> 1.0.9-1
changelog:
  - do not report configuration failed if ipv6 is disabled (rhbz#355561)
  - print messages if lokkit failed
  - lokkit be more verbose on restarting ipXtables in verbose mode


author: Thomas Woerner <twoerner@redhat.com> 1.0.10-1
changelog:
  - fixed problem with network devices (rhbz#331671)
  - dropped obsolete translation no.po (rhbz#332331)


author: Thomas Woerner <twoerner@redhat.com> 1.0.11-1
changelog:
  - fixed crash on startup for network device aliases (rhbz#384891)
    thanks to Loran Freval for the patch
  - added port entry max length in other ports dialog (rhbz#385931)
  - added version number to about dialog (rhbz#387891)
  - improved some english texts (rhbz#383741)
    thanks to Paul W. Frields for the initial patch
  - code cleanup with start speedup
  - do not allow to add custm rules for ipv6:nat
  - also translate parser error messages


author: Thomas Woerner <twoerner@redhat.com> 1.0.12-1
changelog:
  - allow to activate checkboxes by row activation in treeviews
  - code cleanup in view_toggle_cb
  - fixed port display for IPSec
  - use system icons where possible, new wizard icons
  - added fallback for CellRendererCheck if icons are missing, size fixes
  - added tooltips for toolbar and menu entries (if needed)
  - improved more english texts (rhbz#395801)
    thanks to Paul W. Frields for the initial patch


author: Thomas Woerner <twoerner@redhat.com> 1.1.0-0
changelog:
  - ports are ports and services are services: there is a new service tag to
    enable services; a port is not enabling a service anymore
  - new conversion tool for 1.0.X to 1.1.X configuration
  - new version option for lokkit
  - wizard
    - dropped network connection selection tab
    - using keep configuration check instead of clear configuration check
    - added default configuration selection
  - gui: new menu for skill level and load default configuration
  - use choices in optparse, removed obsolete check functions


author: Thomas Woerner <twoerner@redhat.com> 1.1.0-1
changelog:
  - new default configurations: server, desktop
  - cleanup of wizard: dropped network connection tab
  - new option in wizard to keep configuration or load a default configuration
  - new menu entry and dialog to configure iptables and ip6tables service settings
  - some enhancements to the gtk_cellrenderercheck for better look and feel


author: Thomas Woerner <twoerner@redhat.com> 1.1.1-1
changelog:
  - use radio buttons for skill menu entries to show active level
  - fixed convert-config problem if there is no configuration to convert
    (rhbz#426477)
  - minor string changes
  - new it and pt_BR translations


author: Thomas Woerner <twoerner@redhat.com> 1.1.2-1
changelog:
  - fw_gui: fixed row activation for masquerading
  - fw_gui: fixed _setInterfaces to use internal functions to correctly set
    toggles
  - fw_gui: show info dialog if no config exists and firewall gets enabled: new
    function enableFirewall
  - fw_gui, fw_tui: disable firewall if no config exists
  - fw_gui, fw_tui: do not print traceback if NCDeviceList.getDeviceList raises
    and exception
  - forward masqueraded connections
  - gtk_cellrenderercheck: fixed size calculations
  - fw_sysconfig: set config.filename to None for merged configuration in
    read_sysconfig_config if no configuration exists
  - new translations


author: Thomas Woerner <twoerner@redhat.com> 1.1.3-1
changelog:
  - new fw_compat, used in config-convert and fw_sysconfig to automatically 
    convert old system-config-securitylevel configurations
  - new wizard look
  - fixed range check for user defined ports
  - some code cleanup
  - updated translations for fi, fr and ja


author: Thomas Woerner <twoerner@redhat.com> 1.2.0-1
changelog:
  - added port forwarding
  - using INPUT chain in table filter instead of RH-Firewall-1-INPUT
  - fixed masquerading
  - rewrite of firewall generation code
  - trusted hosts now also allowed for FORWARD
  - lots of bug fixes
  - gui enhancements


author: Thomas Woerner <twoerner@redhat.com> 1.2.1-1
changelog:
  - fixed traceback for clean selinux configuration (rhbz#430963)
  - fixed icmp handling for ip6tables
  - updated translations: as, de, it, ja, pl, pt_BR, zh_CN


author: Thomas Woerner <twoerner@redhat.com> 1.2.2-1
changelog:
  - fixed icmp handling for ip6tables in FORWARD chain
  - do state established, related test early in FORWARD chain
  - fixed typo in address for port-forwarding
  - added IPv4 only message to masquerading and port-forwarding for lokkit
  - updated translations: es, pl


author: Thomas Woerner <twoerner@redhat.com> 1.2.3-1
changelog:
  - fixed traceback for empty configuration use in life installer (rhbz#430963)
  - use config-util for userhelper configuration (rhbz#428392)
  - mark dirty after applying new default configuration
  - do not overwrite attributes filename and converted in config
  - use new shared ChooserButton
  - fixed forward dialog and labels to use current dialog width
  - use tempfile.mkdtemp for better security
  - updated translations: fi, fr, it, ja, nl, pt_BR, sr and sr@latin


author: Thomas Woerner <twoerner@redhat.com> 1.2.4-1
changelog:
  - fixed overwrite problem if IPTABLES_SAVE_ON_RESTART is set (rhbz#431961)
  - use SELECTION_NONE for trustedView


author: Thomas Woerner <twoerner@redhat.com> 1.2.6-1
changelog:
  - new ICMP filter to block specified ICMP types
  - fixed minor problem in lokkit (initialize old_config)
  - set starting diretory for custom rules files to /etc/sysconfig
  - more build environment changes for git
  - use gtk.CellRendererToggle instead of own CellRendererCheck
  - several parser changes for transparent error handling and output
  - some minor enhancements
  - translation updates


author: Thomas Woerner <twoerner@redhat.com> 1.2.7-1
changelog:
  - fixed crash if encoding is not UTF-8 (rhbz#439902)
  - updated translations: bn_IN, cs, de, es, fi, fr, gu, hi, it, kn, ko, ml,
                          mr, pa, pl, pt_BR, ru, sr, sr@latin, ta, te, zh_CN


author: Thomas Woerner <twoerner@redhat.com> 1.2.8-1
changelog:
  - new tui interface
  - new system-config-firewall-tui
  - new client services for ipp and samba
  - lokkit: fixed disabling of firewall in force mode (rhbz#443411)
  - disabled port forwarding for IPv6
  - some minor fixes and enhancements


author: Thomas Woerner <twoerner@redhat.com> 1.2.9-1
changelog:
  - fixed format string to silence inttool
  - new remider to check if the ip*tables services are enabled
  - use proper dialog functions in the tui
  - updated translations: cs, de, es, gu, pl


author: Thomas Woerner <twoerner@redhat.com> 1.2.10-1
changelog:
  - lokkit: fixed path for system-config-firewall-tui (rhbz#454108)
  - updated translations for: it, fr, nl, ru, sr, sr@latin


author: Thomas Woerner <twoerner@redhat.com> 1.2.11-1
changelog:
  - use dialogs for parser errors in tui (rhbz#457485)
  - enable to add protocol specific (IPv4, IPv6) icmp types for ICMP filtering
  - updated translations for he, ja, ko and zh_CN


author: Thomas Woerner <twoerner@redhat.com> 1.2.12-1
changelog:
  - only provide lang files in tui sub-package (rhbz#465572)
  - updated translations for: as, bn_IN, ca, cs, es, fr, gu, it, ja, kn, mr, nl,
                              pa, or, pl, pt_BR, sk, zh_CN, zh_TW


author: Thomas Woerner <twoerner@redhat.com> 1.2.13-1
changelog:
  - fixed two typos in fw_icmp (rhbz#467334)
  - added ability to sort custom rules files (rhbz#467696)
  - fixed modified test in sysctl writer: fixes rhbz#462325
    also removed quotes around values for new keys
  - some build fixes
  - updated translations for: as, de, fi, fr, he, hi, ko, hu, it, ja, ko, ml,
                              pl, pt_BR, ru, sk, sr, sr@latin, sv, ta, te, 
                              zh_CN, zh_TW


author: Thomas Woerner <twoerner@redhat.com> 1.2.14-1
changelog:
  - new build environment using configure, autofoo and intltool
  - fixed typo in router-solicitation description (rhbz#490979)
  - new themable application icon: preferences-system-firewall (rhbz#454402)
  - make backup copies before overwriting files (rhbz#437374)
  - updated translations:


author: Thomas Woerner <twoerner@redhat.com> 1.2.15-1
changelog:
  - fixed icon reference in desktop file (rhbz#493674)
  - fixed po/POTFILES.in
  - updated translations: as, bn_IN, el, fi, gu, hi, hu, it, kn, ko, mai, ml, mr, or, pa, pt, ru, sk, sv, ta, te, zh_TW


author: Thomas Woerner <twoerner@redhat.com> 1.2.16-1
changelog:
  - fixed build system to update desktop file from desktop.in
    fixes icon reference in desktop file (rhbz#493674)
  - updated translations: fr


author: Thomas Woerner <twoerner@redhat.com> 1.2.17-1
changelog:
  - Added Red Hat Cluster Suite to trusted services (rhbz#493668)
  - Fixed wrong patch for system-config-firewall-tui (rhbz#461046)
  - Fixed sysctl parser to also support ';' for comments
  - Fixed port range check for service names containing '-'
  - New column in serviceView for conntrack helper, removed from tooltip
  - New column in icmpView for protocol types, removed from tooltip
  - Added TFTP and TFTP client support (rhbz#494417)
  - Fixed sensitiveness of OK button in portDialog if editing an Port
    (rhbz#500380)
  - Added missing tooltips for buttons in mainNotebook tabs. (rhbz#493872)
  - updated po files


author: Thomas Woerner <twoerner@redhat.com> 1.2.18-1
changelog:
  - added support for PolicyKit
  - removed unused inconsistent flag from CellRendererToggle in serviceView (rhbz#521144)
  - made "Port/Protocol" cell resizable in "Trusted Services"-view
  - fixed hidden one line label after resize caused by fix for bgo#315462
  - fixed startup busy loops if assistive technologies is enabled (rhbz#515048)
    by moving set_model after adding the columns to a TreeView
  - fixed tui to create valid empty self.config object (rhbz#518210)
  - failing to load the icon in fw_gui.setupScreen should not be fatal
    (rhbz#508186)
  - made description column in settings dialog resizable
  - removed rhpl usage (rhbz#508991)
  - fixed not reappearing TreeViewTooltips if mouse moved in the tooltip popup
  - hide TreeViewTooltips while scrolling
  - code cleanup
  - sort ports in fw_services by protocol, id
  - updated translations: as, bn_IN, ca, da, de, es, fi, fr, gu, hi, kn, hu, it, 
                          ja, ko, ml, mr, nl, or, pa, pl, pt, pt_BR, ru, sk, sr,
  			sr@latin, ta, te, uk, zh_CN, zh_TW


author: Thomas Woerner <twoerner@redhat.com> 1.2.19-1
changelog:
  - enhanced build environment to support usermode and policykit switches, new
    options for configure and spec file
  - make toplevel invisible to not show half initialized window while policykit
    dialog is shown
  - system-config-firewall.desktop.in moved to config subdir
  - disable dbus usage if gui is used as root (needed for policykit v0)
  - do not report dbus error if there is no firewall configuration (empty or
    missing /etc/sysconfig/system-config-firewall)
  - resize main window to comfortably fit in a 800x600 gnome desktop
  - moved all config files into config subdir: sysconfig, dekstop, pam and console
  - new infrastructure to enable policy translations
  - print exception if polkit authorization failes to console
  - show dbus error dialog if dbus conection can not be established
  - set title to APP_NAME for dialogs if there is no title
  - center dialogs on screen if there is no parent
  - make main app invisible at first to prevent to show an empty app while
    PolicyKit password dialog is visible
  - updated translations: as, bn_IN, ca, da, de, ca, cs, es, fi, fr, gu, hi, it,
                          ja, kn, ko, ml, mr, nl, or, pa, pl, pt, pt_BR, ru, sk,
                          sr, sr@latin, sv, ta, te, uk, zh_TW


author: Thomas Woerner <twoerner@redhat.com> 1.2.21-1
changelog:
  - fixed Policykit v0 compatibility for Fedora version 10 and 11: python-slip
    for PolicyKit v0 does not provide dbus
  - updated translations: bn_IN, uk, zh_CN


author: Thomas Woerner <twoerner@redhat.com> 1.2.22-1
changelog:
  - using NetworkManager DBUS interface to replace NCDeviceList from
    system-config-network
  - not opening orig port for local port forwarding, only new port is open
  - added isakmp support for IPsec (rhbz#504446)
  - added amanda client support (rhbz#541679)
  - fixed requirement for setenforce: libselinux-utils instead of libselinux
  - removed unused import socket
  - added download url to Source tag in spec file
  - fixed wrong license header in src/fw_tui.py (LGPL instead of GPL)
  - update cluster-suite service: disable rgmanager and cssd
  - removed separator at the end of the Options menu (rhbz#531635)
  - removed 2049/udp from NFS4 service (rhbz#532491)


author: Thomas Woerner <twoerner@redhat.com> 1.2.24-1
changelog:
  - DBUS-mechanism: report errors to syslog and print traceback (rhbz#563354)
  - fixed minor misspellings (rhbz#566468)
  - msgmerged po files
  - added missing default values for ip*tables-config content (rhbz#566869)
  - autofoo utils update
  - fixed max length of user defined interface name in interfaceDialog
  - added missing range check to port_entry_changed_cb
  - fixed sensitiveness of protocol label in portDialog
  - fixed misuse of MARK extension in nat table, now in mangle table
  - port forwarding dialog usability fixes (rhbz#507638)
  - use new fw_functions.checkInterface function in tui and gui
  - new function to check interface names in fw_functions
  - use new checkInterface function in parser for trust, masq and forward-port
  - add wlan standard device
  - fixed build (fw_nm.py not packaged)
  - updated translations: bn_IN, cs, da, de, el, en_GB, es, fi, fr, hu, is, it,
                          ja, nb, nl, or, pl, pt, pt_BR, ru, sr, sr@latin, sv,
                          te, uk


author: Thomas Woerner <twoerner@redhat.com> 1.2.25-1
changelog:
  - fixed lokkit: do not create or alter firewall in selinux only mode
    (rhbz#583986)
  - use new icons (rhbz#583715)
  - fixed treeviewtooltips to not show the tooltip if an overlapping window has
    the focus
  - updated translations: bn_IN, de, es, gu, it, kn, ml, mr, nl, or, pa, pl, pt,
                          pt_BR, ru, sk, sr, sr@latin, te


author: Thomas Woerner <twoerner@redhat.com> 1.2.26-1
changelog:
  - added libvirt services (rhbz#565625)
  - added Bakula service (rhbz#588377)
  - fixed DBUS mechanism to report complete syslog message (rhbz#604623)
  - fixed crash because of missing /etc/services file (rhbz#604726)
  - updated translations: ar, as, bn_IN, da, de, es, fi, fr, gu, he, hi, is, it,
                          ja, kn, ko, ml, mr, nl, or, pa, pl, pt, ru, ta, te, 
                          zh_CN


author: Thomas Woerner <twoerner@redhat.com> 1.2.27-1
changelog:
  - updated translations: bn_IN, de, fi, fr, gu, hi, it, ja, kn, ko, ml, mr, or,
                          pt_BR, ru, ta, te, zh_CN, zh_TW


author: Thomas Woerner <twoerner@redhat.com> 1.2.27-4
changelog:
  - fixed possible privilege escalation flaw via use of python pickle
    (CVE-2011-2520), replaced pickle by json (rhbz#717985, rhbz#719871)
  - stop D-BUS firewall mechanism on update


author: Thomas Woerner <twoerner@redhat.com> 1.2.27-6
changelog:
  - Added missing dependency for newt-python (RHBZ#756048)
  - Latest translations from transifex (RHBZ#819809)
  - Allow user to select and add trust and masq interfaces (RHBZ#720831)
  - New D-Bus methods to read an write service settings, use in s-c-fw (RHBZ#711231)
  - Drop eth from std device names list (rhbz#682391)


author: Thomas Woerner <twoerner@redhat.com> 1.2.27-7
changelog:
  - Fixed screen corruption introduced with (RHBZ#720831)
  - Replaced pickle by json introduced with (RHBZ#711231)


author: Thomas Woerner <twoerner@redhat.com> 1.2.27-7.2
changelog:
  - moved fw_nm into the base sub package to fix a bug introduced with the
    RHBZ#720831 fix (RHBZ#1164223)


author: Cristian Gafton <gafton@redhat.com>
changelog:
  - patch for using PATH_MAX instead of some silly internal #defines for
    variables that handle filenames.


author: Adrian Havill <havill@redhat.com>
changelog:
  - use <time.h> instead of <sys/time.h> for pickier lib (#25935)
  - allow arguments for login shells (#19926)


author: Miloslav Trmac <mitr@redhat.com> - 6.13-1
changelog:
  - Update to tcsh-6.13.00
  - Fix charset headers in some of the translations
  - Convert translated messages to LC_CTYPE locale
  - Fix automatic dspmbyte setting


author: Miloslav Trmac <mitr@redhat.com> - 6.13-2
changelog:
  - Make comparisons for ranges in bracket expressions symmetric (#59493)
  - Run perl2html with LC_ALL=C to workaround what seems to be a perl bug
    (#60664)
  - Define $HOSTTYPE and $MACHTYPE on x86_64 (#115531)
  - Fix setting of O_LARGEFILE (#122558)


author: Miloslav Trmac <mitr@redhat.com> - 6.13-5
changelog:
  - Fix HTML documentation generation, second attempt (#60664)
  - Set dspmbyte using nl_langinfo(CODESET) if possible, should cover all
    cases where lang.csh was correctly setting dspmbyte (#89549)


author: Miloslav Trmac <mitr@redhat.com> - 6.13-6
changelog:
  - Define $HOSTTYPE and $MACHTYPE also on IA-64 and s390x (#115531)
  - Don't close sockets to avoid file descriptor conflits with nss_ldap (#112453)


author: Miloslav Trmac <mitr@redhat.com> - 6.13-7
changelog:
  - Define $HOSTTYPE and $MACHTYPE for ppc64 and s390 (#115531),
    I hope that finally covers all architectures.


author: Miloslav Trmac <mitr@redhat.com> - 6.13-12
changelog:
  - Don't ship the HTML documentation (generated from the man page, contains
    also a copy of the man page)


author: Miloslav Trmac <mitr@redhat.com> - 6.14-7
changelog:
  - Fix a crash when reading scripts with multibyte characters (#183267)
  - Block SIGINT while waiting for children (#177366)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 6.15-4
changelog:
  - Fix '\' can not be used to quote all delimiters
    Related: #435421
  - Fix $name[selector] should fail when any number of 'selector' is out of range
    Related: #435398


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 6.15-5
changelog:
  - Rediffed all patches to work with patch --fuzz=0
  - Let tcsh know 'ca' colorls variable
    Resolves: #458716


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 6.15-6
changelog:
  - Fix UTF-8 Japanese character is garbled in tcsh script in
    a certain situation
    Related: #453785
  - Fix calculation order of operators description in tcsh manpage
    Related: #442536
  - Fix strings which begin with '0' are not recognized as octal numbers
    Related: #438109
  - Fix memoryuse description in tcsh manpage
    Related: #437095
  - Fix tcsh scripts with multiple case statement with end keywords
    break with error
    Related: #436956
  - Fix description of builtin command 'set' in tcsh manpage
    Related: #430459


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 6.16-1
changelog:
  - Update to tcsh-6.16.00
  - Merge Review (fix License, add BUGS and WishList to documentation, convert Fixes and
    WishList to UTF-8, remove root checking from buildroot cleaning, preserve timestamps,
    use smp_flags, remove unused patches, improve postun script and minor fix to %files)
    Resolves: #226483


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 6.17-9
changelog:
  - Don't set $REMOTEHOST on the local machine
    Resolves: #669176
  - Don't print history in verbose mode
    Resolves: #658171


author: Jan Kaluza <jkaluza@redhat.com> - 6.17-13
changelog:
  - Do not dereference null pointer in cwd
    Resolves: #700309
  - Exit when child killed
    Resolves: #690356
  - Do not allow variable names beginning with number
    Resolves: #672592
  - Fix status of pipelined/backquoted/list of commands
    Resolves: #658190
  - Fix unused res variable in sh.glob.c
    Resolves: #684063


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 6.17-14
changelog:
  - Remove obsolete glob-automount patch; the issue should have been
    resolved (and is now resolved) in glibc posix/glob.c (#684063)


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 6.17-15
changelog:
  - Handle pending signals before flush so that the the .history file
    does not get truncated
  - Implement file locking using shared readers, exclusive writer
    to prevent any .history file data corruption


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 6.17-16
changelog:
  - Revert exit status regression with it's opt-out variable $anyerror,
    added by "Fix status of pipelined/backquoted/list of commands" and
    opt-in the POSIX-like exit status behaviour by $status_posix_value
    variable instead (#784510)


author: Roman Kollar <rkollar@redhat.com> 6.17-21
changelog:
  - Fix dosource() calls after history file locking patch, requested release number bump
    Resolves: #847102


author: Roman Kollar <rkollar@redhat.com> 6.17-22
changelog:
  - Fixed .history patch issue breaking upstream multibyte tests
    Resolves: #821796
  - Revert history handling in loops
    Resolves: #814069


author: Adam Tkac <atkac redhat com> 0.0.90-0.4.20090403svn3751
changelog:
  - update to r3751
  - patches merged
    - tigervnc-xclients.patch
    - tigervnc-clipboard.patch
    - tigervnc-rh212985.patch
  - basic RandR support in Xvnc (resize of the desktop)
  - use built-in libjpeg (SSE2/MMX accelerated encoding on x86 platform)
  - use Tight encoding by default
  - use TigerVNC icons


author: Adam Tkac <atkac redhat com> 0.0.90-0.6.20090427svn3789
changelog:
  - update to r3789
    - tigervnc-rh494801.patch merged
  - tigervnc-newfbsize.patch is no longer needed
  - fix problems when vncviewer and Xvnc run on different endianess (#496653)
  - UltraVNC and TightVNC clients work fine again (#496786)


author: Adam Tkac <atkac redhat com> 0.0.90-0.10
changelog:
  - rebuild against 1.6.1.901 X server (#497835)
  - disable i18n, vncviewer is not UTF-8 compatible (#501832)


author: Adam Tkac <atkac redhat com> 0.0.91-0.11
changelog:
  - update to 0.0.91 (1.0.0 RC1)
  - patches merged
    - tigervnc10-rh499401.patch
    - tigervnc10-rh497592.patch
    - tigervnc10-rh501832.patch
  - after discusion in upstream drop tigervnc-bounds.patch
  - configure flags cleanup


author: Adam Tkac <atkac redhat com> 0.0.91-0.13
changelog:
  - temporary use F11 Xserver base to make Xvnc compilable
  - BuildRequires: libXi-devel
  - don't ship tigervnc-server-module on s390/s390x


author: Adam Tkac <atkac redhat com> 1.0.0-2
changelog:
  - update underlying X source to 1.6.4-0.3.fc11
  - remove bogus '-nohttpd' parameter from /etc/sysconfig/vncservers (#525629)
  - initscript LSB compliance fixes (#523974)
  - improve -LowColorSwitch documentation and handling (#510185)
  - honor dotWhenNoCursor option (and it's changes) every time (#524340)


author: Adam Tkac <atkac redhat com> 1.0.90-0.1.20100115svn3945
changelog:
  - update to 1.0.90 snapshot
  - X.Org 1.7 support
  - accelerated Tight encoding on x86_64
  - patches merged
    - tigervnc10-compat.patch
    - tigervnc10-rh510185.patch
    - tigervnc10-rh516274.patch
    - tigervnc10-rh524340.patch


author: Adam Tkac <atkac redhat com> 1.0.90-0.6.20100115svn3945
changelog:
  - add server-applet subpackage which contains Java vncviewer applet
  - fix Java applet; it didn't work when run from web browser
  - add xorg-x11-xkb-utils to server Requires


author: Adam Tkac <atkac redhat com> 1.0.90-0.7.20100115svn3945
changelog:
  - make libvnc.so module working again (r4005, r4024, r4025)
  - vncviewer could crash on slow links (r4003, r4004)


author: Adam Tkac <atkac redhat com> 1.0.90-0.8.20100115svn3945
changelog:
  - fix memory leak in Xvnc (#603731)
  - update URL about SSH tunneling in the sysconfig file (#601996)
  - add pam-devel to BuildRequires, X server needs it


author: Adam Tkac <atkac redhat com> 1.0.90-0.11.20110117svn4237
changelog:
  - rebase to r4237
  - patches merged
    - tigervnc11-noexecstack.patch
    - tigervnc11-r3963.patch
    - tigervnc11-r4002.patch
    - tigervnc11-r4014.patch
    - tigervnc11-r4003.patch
    - tigervnc11-r4004.patch
    - tigervnc11-r4005.patch
    - tigervnc11-r4024.patch
    - tigervnc11-r4025.patch
    - tigervnc11-rh603731.patch
    - tigervnc11-options.patch
  - build with TLS support


author: Adam Tkac <atkac redhat com> 1.0.90-0.12.20110117svn4237
changelog:
  - tigervnc-server now requires perl (#634161)
  - use locales specified in sysconfig/i18n (#632530)
  - read password file correctly when fread is interrupted (#645755)


author: Adam Tkac <atkac redhat com> 1.0.90-0.15.20110314svn4359
changelog:
  - flush internal Xvnc event queue early to avoid overflowing
  - improve compatibility with viewers with wrong VeNCrypt implementation
    (vinagre)
  - link libvnc.so with "-z now" to catch all undefined symbols
  - fix undefined symbol "getvnchomedir" in libvnc.so


author: Tim Waugh <twaugh@redhat.com> 1.1.0-9
changelog:
  - Init script fixes:
    - Attempt to start all configured servers (bug #562669, bug #768405).
    - Avoid problems when user's configured shell is not bash (bug #949522).
  - Applied Debian patch to fix busy loop when run from inetd in nowait
    mode (bug #958988, bug #920373).
  - Avoid initializing the vnc extension twice (bug #1004093).
  - Use exceptions instead of asserts for ZRLE decoding boundary checks
    (bug #1078508).


author: Tim Waugh <twaugh@redhat.com> 1.1.0-13
changelog:
  - Added versioned pixman and libX11 dependencies (bug #917717,
    bug #991285).
  - Link against system-wide libjpeg-turbo (bug #956779).
  - Describe -SecurityTypes option in man pages (bug #882952).
  - Fixed kbase URL in sysconfig file (bug #728981).


author: Tim Waugh <twaugh@redhat.com> 1.1.0-16
changelog:
  - Unknown pseudo-encodings (those with negative values) would cause
    vncviewer to crash (bug #1121041).
  - Set source as well as target when building java as some JDKs require
    this (bug #1078427).


author: Phil Knirsch <pknirsch@redhat.com> - 0.1.1-1
changelog:
  - Bump version
  - Added comment in empty __init__.py files
  - Fixed BuildRoot tag to use latest recommendation of FPG
  - Lots of whitespace changes
  - Some minor README changes
  - Added a changelog rule in Makefile
  - Fixed rpmlint error messages
  - Add init() methods to each plugin
  - Call plugin init() methods during tuned's init()
  - Add support for command line parameters
        o -c conffile|--config==conffile to specify the location of the config file
        o -d to start tuned as a daemon (instead of as normal app)
  - Readded the debug output in case tuned isn't started as as daemon
  - Fixed initialization of max transfer values for net tuning plugin
  - Added complete cleanup code in case of tuned exiting and/or
    getting a SIGTERM to restore default values
  - Made the disk tuning pluging less nosy if started as non-daemon
  - Fixed missing self. in the tuned.py config handling
  - Added a manpage
  - Fixed summary
  - Added missing GPL notic to tuned.py
  - Added explanation for Source entry in specfile
  - Added a distarchive target for the Makefile for proper tagging in git
  - Added a explanation how to create the tarball via git in the specfile
  - Fixed the defattr() lines in the specfile to conform FRG


