# changelog

author: Brian C. Lane <bcl@redhat.com> - 0.30-1
changelog:
  - Always run action's cancel method as part of cancelAction. (dlehman)
  - Show Invalid Disk Label for damaged GPT (#1020974) (bcl)
  - Make error message in setDefaultFSType more informative (#1019766) (amulhern)
  - Set sysfsPath of LUKSDevice when adding to device tree (#1019638) (jsafrane)
  - Use given format type as format's name instead of type (vpodzime)


author: Brian C. Lane <bcl@redhat.com> - 0.31-1
changelog:
  - Make RAIDLevel an abstract class using abc. (amulhern)
  - Restore a util import that was removed in a recent commit. (amulhern)


author: Brian C. Lane <bcl@redhat.com> - 0.32-1
changelog:
  - Work on devicelibs.btrfs methods that require that the device be mounted.
    (amulhern)
  - Remove some methods from devicelibs.btrfs. (amulhern)
  - Add a comment to btrfs.create_volume. (amulhern)
  - Add a file to run btrfs tests. (amulhern)
  - Remove format.luks.LUKS.removeKeyFromFile. (amulhern)
  - Changes to devicelibs.mdraid.mdactivate. (amulhern)
  - Restore an import removed in a previous commit. (amulhern)
  - Add a PE for LUKS metadata (#1038969) (bcl)
  - Adjust currentSize methods slightly. (amulhern)
  - Put additional constraints on the ActionResizeDevice initializer. (amulhern)
  - Remove redundant checks in existing resize() methods. (amulhern)
  - Add some baseline unit tests for BTRFS devices. (amulhern)
  - Robustify use of defaultSubVolumeID field. (amulhern)
  - Check that a BTRFS subvolume has exactly one parent in constructor.
    (amulhern)
  - BTRFSSubVolume.volume checks the class of its return value. (amulhern)
  - Raise ValueError in BTRFS constructor if no parents specified. (amulhern)
  - Add tests for a couple of additional properties for MDRaidArrayDevice.
    (amulhern)
  - Factor state testing behavior into a separate class. (amulhern)
  - Remove redundant condition in if statement. (amulhern)


author: Brian C. Lane <bcl@redhat.com> - 0.33-1
changelog:
  - Add initial 64-bit ARM (aarch64) support (#1034435) (dmarlin)
  - Convert to sphinx docstrings. (dlehman)
  - Add some documentation. (dlehman)
  - Move getActiveMounts from Blivet into DeviceTree. (dlehman)
  - Add an example of creating lvs using growable requests. (dlehman)
  - Remove a whole bunch of unused stuff from Blivet. (dlehman)
  - Remove usage of float in Size.humanReadable. (dlehman)
  - Add missing abbreviations for binary size units. (dlehman)
  - Fix shouldClear for devices with protected descendants. (#902417) (dlehman)
  - Use // division so that it continues to be floor division in Python 3.
    (amulhern)


author: Brian C. Lane <bcl@redhat.com> - 0.34-1
changelog:
  - Forget existing partitions of device becoming a multipath member (#1043444)
    (rvykydal)
  - Include blivet.devicelibs.raid in the generated documentation. (amulhern)
  - Upgrade the comments in raid.py to be compatible with sphinx. (amulhern)
  - Make space for LUKS metadata if creating encrypted device (#1038847)
    (vpodzime)
  - fcoe: give error message in case of fail when adding device (#903122)
    (rvykydal)
  - fcoe: adapt bnx2fc detection to changed sysfs path structure (#903122)
    (rvykydal)
  - Update format of iscsi device becoming multipath member (#1039086) (rvykydal)


author: Brian C. Lane <bcl@redhat.com> - 0.35-1
changelog:
  - Convert everything to use Size. (dlehman)
  - Allow negative sizes. (dlehman)
  - Fix return value of Size.convertTo with a spec of bytes. (dlehman)
  - Discard partial bytes in Size constructor. (dlehman)
  - Prefer binary prefixes since everything is really based on them. (dlehman)
  - Fix a few minor problems introduced by recent raid level changes. (dlehman)
  - Move label setter and getter into DeviceFormat class (#1038590) (amulhern)
  - Add a test for labeling swap devices (#1038590) (amulhern)
  - Default to None to mean none, rather than empty string (#1038590) (amulhern)
  - Add a labelFormatOK method to the DeviceFormat's interface (#1038590)
    (amulhern)
  - Indicate whether the filesystem can label (#1038590) (amulhern)
  - Restore ability to write an empty label where possible (#1038590) (amulhern)
  - More tests to check writing and reading labels (#1038590) (amulhern)
  - Remove fsConfigFromFile (#1038590) (amulhern)
  - Changes to the handling of filesystem labeling (#1038590) (amulhern)
  - Add some simple tests for file formats. (amulhern)
  - Give DeviceFormat objects an id (#1043763) (amulhern)
  - Refactor to use ObjectID class (#1043763) (amulhern)
  - Make a class that creates a unique-per-class id for objects (#1043763)
    (amulhern)
  - Revert "Make a class that creates a unique-per-class id for objects
    (#1043763)" (amulhern)
  - Revert "Give DeviceFormat objects an object_id (#1043763)" (amulhern)
  - Make the maximum end sector for PReP boot more benevolent (#1029893)
    (vpodzime)
  - Give DeviceFormat objects an object_id (#1043763) (amulhern)
  - Make a class that creates a unique-per-class id for objects (#1043763)
    (amulhern)
  - Make get_device_format_class return None if class not found (#1043763)
    (amulhern)
  - A few simple unit tests for some formats methods (#1043763) (amulhern)
  - Don't translate format names (dshea)


author: Brian C. Lane <bcl@redhat.com> - 0.36-1
changelog:
  - Update the TODO list. (dlehman)
  - Multipath, fwraid members need not be in exclusiveDisks. (#1032919) (dlehman)
  - Convert parted getLength values to Size (dshea)
  - Last of the Device._id -> Device.id (bcl)
  - iscsi: in installer automatically log into firmware iscsi targets (#1034291)
    (rvykydal)
  - Use isinstance for testing numeric types (vpodzime)
  - Device._id -> Device.id (clumens)
  - Allow resetting partition size to current on-disk size. (#1040352) (dlehman)


author: Brian C. Lane <bcl@redhat.com> - 0.37-1
changelog:
  - Only do SELinux context resets if in installer mode (#1038146) (amulhern)
  - Look up SELinux context for lost+found where it is needed (#1038146)
    (amulhern)
  - Don't reset the SELinux context before the filesystem is mounted (#1038146)
    (amulhern)
  - Test setting selinux context on lost+found (#1038146) (amulhern)
  - Only retrieve the unit specifier once (dshea)
  - Fix the Device.id usage. (dshea)
  - Accept both English and localized sizes in Size specs. (dshea)
  - Use a namedtuple to store information on unit prefixes (dshea)
  - Remove en_spec Size parameters. (dshea)
  - Fix potential traceback in devicetree.populate. (#1055523) (dlehman)
  - Fall back on relabeling app where available (#1038590) (amulhern)
  - Change the meaning of label field values (#1038590) (amulhern)
  - Enable labeling on NTFS filesystem (#1038590) (amulhern)
  - Enable labeling on HFS filesystem (#1038590) (amulhern)
  - Add a method that indicates ability to relabel (#1038590) (amulhern)
  - Use filesystem creation app to set filesystem label (#1038590) (amulhern)
  - Import errors so FSError name is resolved (#1038590) (amulhern)
  - Remove BTRFS._getFormatOptions (#1038590) (amulhern)
  - Make an additional class for labeling abstractions (#1038590) (amulhern)
  - Fix copyright date (#1038590) (amulhern)
  - Remove redundant _defaultFormatOptions field (#1038590) (amulhern)
  - Remove code about unsetting a label (#1038590) (amulhern)
  - Return None if the filesystem has no label (#1038590) (amulhern)
  - Removed redundant check for existance of filesystem (#1038590) (amulhern)
  - Have writeLabel throw a more informative exception (#1038590) (amulhern)


author: Brian C. Lane <bcl@redhat.com> - 0.38-1
changelog:
  - Some simple tests for _verifyLUKSDevicesHaveKey (#1023442) (amulhern)
  - Verify that LUKS devices have some encryption key (#1023442) (amulhern)


author: Brian C. Lane <bcl@redhat.com> - 0.39-1
changelog:
  - escrow: make sure the output directory exists (#1026653) (wwoods)
  - provide a more useful error message if user fails to create an ESP (awilliam)
  - Tell lvcreate not to ask us any questions and do its job. (#1057066)
    (dlehman)


author: Brian C. Lane <bcl@redhat.com> - 0.40-1
changelog:
  - makebumpver: Only remove from list if action is not Resolves (bcl)
  - Update bumpver to allow Related bugs (bcl)
  - Remove all dependent devices of san device becoming multipath (#1058939)
    (rvykydal)
  - When repopulating multipath members mark them as multipath (#1056024)
    (rvykydal)
  - fcoe: parse yet another sysfs structure for bnx2fc devices (#903122)
    (rvykydal)
  - fcoe: add fcoe=<NIC>:<EDB> to boot options for nics added manually (#1040215)
    (rvykydal)
  - Convert the ntfs minsize to an int (#1060031) (dshea)
  - Convert the string representation of Size to a str type. (#1060382) (dshea)
  - don't display stage2 missing error as well if the real problem is stage1
    (awilliam)
  - Provide a mechanism for platform-specific error messages for stage1 failure
    (awilliam)
  - Don't add None value to req_disks (#981316) (amulhern)
  - Make error message more informative (#1022497) (amulhern)
  - Check that file that loop device is going to use exists (#982164) (amulhern)
  - Use os.path.isabs to check whether path name is absolute (#994488) (amulhern)


author: Brian C. Lane <bcl@redhat.com> - 0.41-1
changelog:
  - ntfs _getSize needs to use Decimal (#1063077) (bcl)
  - Separate sanityCheck-ing from doAutoPartition (#1060255) (amulhern)
  - Change messages to SanityExceptions objects (#1060255) (amulhern)
  - Make a small SanityException hierarchy (#1060255) (amulhern)
  - Remove unused exception class (#1060255) (amulhern)
  - Add another .decode("utf-8") to humanReadable (#1059807) (dshea)
  - makebumpver: Any failure should cancel the bump (bcl)


author: Brian C. Lane <bcl@redhat.com> - 0.42-1
changelog:
  - Wait for udev to create device node for new md arrays. (#1036014) (dlehman)
  - Fix detection of thin pool with non-standard segment types. (#1022810)
    (dlehman)
  - NFSDevice does not accept the exists kwarg. (#1063413) (dlehman)
  - Don't run mpathconf for disk image installations. (#1066008) (dlehman)
  - If /etc/os-release exists, check it to identify an installed system.
    (clumens)
  - Get the unit tests into a runnable state. (dlehman)
  - Update Source URL in spec file to use github. (dlehman)


author: Brian C. Lane <bcl@redhat.com> - 0.43-1
changelog:
  - Include tmpfs mounts in post-install kickstart (#1061063) (mkolman)
  - Count with the extra metadata extents for RAID consistently (#1065737)
    (vpodzime)
  - Make partitioning error message more friendly (#1020388) (amulhern)
  - Fix partition handling across multiple processActions calls. (#1065522)
    (dlehman)
  - Let the udev queue settle before populating the devicetree. (#1049772)
    (dlehman)
  - Don't activate or deactivate devices from the action classes. (#1064898)
    (dlehman)
  - Improve handling of parted.DiskLabelCommitError slightly. (dlehman)
  - Make teardownAll work regardless of flags. (dlehman)
  - Fix maxSize test when setting device target size. (dlehman)
  - Size.convertTo should return a Decimal. (dlehman)
  - Don't use float for anything. (dlehman)
  - Fix type of block count in PartitionDevice._wipe. (dlehman)
  - Fix handling of size argument to devicelibs.lvm.thinlvcreate. (#1062223)
    (dlehman)
  - return empty set when no matching fcoe nic (#1067159) (bcl)
  - Return str from Size.humanReadable (#1066721) (dshea)
  - Add a coverage test target (#1064895) (amulhern)
  - Filesystem labeling tests will not run without utilities (#1065422)
    (amulhern)
  - Rename misc_test.py to something more descriptive (#1065422) (amulhern)
  - Refactor labeling tests (#1065422) (amulhern)
  - Move SwapSpace tests into a separate class (#1065422) (amulhern)


author: Brian C. Lane <bcl@redhat.com> - 0.44-1
changelog:
  - Fix an old typo in zeroing out a PReP partition. (#1072781) (dlehman)
  - Only count with the extra metadata extents in new VGs and LVs (#1072999)
    (vpodzime)
  - Use container's parent's name for PV if available (#1065737) (vpodzime)
  - Fix traceback with write_dasd_conf. (#1072911) (sbueno+anaconda)
  - When copying a root, also copy hidden devices (#1043763) (amulhern)
  - Add hidden flag to devicetree.getDeviceByID (#1043763) (amulhern)
  - Only set device for mountpoint if it is not None (#1043763) (amulhern)
  - Extend the list of things to be omitted if moddisk is False (#1043763)
    (amulhern)
  - Set req_name to None at the top of initializer (#1043763) (amulhern)
  - Log action cancelation (#1043763) (amulhern)
  - Make DeviceTree.hide() remove a larger set (#1043763) (amulhern)
  - Re-write the DASD storage code. (#1001070) (sbueno+anaconda)
  - Include image install flag when updating from anaconda flags. (#1066008)
    (dlehman)


author: Brian C. Lane <bcl@redhat.com> - 0.45-1
changelog:
  - Changes to allow pylint checks to be run on a distribution of the source.
    (amulhern)
  - Remove non-doing check target (amulhern)
  - Add a script to relate pylint errors to lines changed. (amulhern)
  - Change output format so that it is suitable for diff-cover. (amulhern)
  - Do an initial setup for running pylint tests in blivet. (amulhern)
  - Handle None in devicePathToName(#996303) (dshea)
  - Remove bootloader.packages from storage.packages (#1074522). (clumens)
  - Whitespace fixes for the crypto devicelib module (vpodzime)
  - Use random.choice for generating LUKS backup passphrase (vpodzime)
  - Trivial fixes for the lvm devicelib module (vpodzime)
  - Make vginfo work the same way as pvinfo and other LVM functions (vpodzime)
  - Allow NTFS to be mountable. (#748780) (dshea)
  - Limit the LV size to VG's free space size (vpodzime)


author: Brian C. Lane <bcl@redhat.com> - 0.46-1
changelog:
  - Adapt callers to use the new parent list interface. (dlehman)
  - Change management of Device parents to use a simple list interface. (dlehman)
  - Convert ContainerDevice to an abstract base class. (dlehman)
  - Set device uuid before calling Device ctor. (dlehman)
  - Improve the mechanism for VG completeness. (dlehman)
  - Support mutually-obsoleting actions. (dlehman)
  - Add some checking to MDRaidArrayDevice._setSpares. (dlehman)
  - Make sorting by action type part of the action classes. (dlehman)
  - Add action classes for container member set management. (dlehman)
  - Add a property to provide consistent access to parent container device.
    (dlehman)
  - Add type-specific methods for member set management. (dlehman)
  - Adapt callers to new method names for add/remove member device. (dlehman)
  - Add a ContainerDevice class to consolidate member management code. (dlehman)
  - Add backend functions for container member set management. (dlehman)
  - Teardown RAID device once testing is over (amulhern)
  - Make lvm tests runnable. (amulhern)
  - Make crypt tests runnable. (amulhern)
  - Replace unnecessarily complicated expression with string multiplication
    (amulhern)
  - Suppress unused variable warning for index in range (amulhern)
  - Suppress some unused variable warnings. (amulhern)
  - Suppress some unused variable warnings (amulhern)
  - Update to the new raise syntax (dshea)
  - Removed an unnecessary semicolon (dshea)
  - Removed a redundant definition of NoDisksError (dshea)
  - Specify regular expressions containing backslashes as raw strings (dshea)
  - Fixed some questionable indentation (dshea)
  - Fix logging function string format warnings. (dshea)
  - All size specifications should be Size instances (#1077163) (vpodzime)
  - Make sure StorageDevice's self._size is a Size instance (#1077179) (vpodzime)
  - Allow creating Size instance from another Size instance (vpodzime)
  - Force removal of hidden devices (#1078163) (amulhern)
  - Get action_test into working order. (dlehman)
  - Update action_test.py to specify sizes using blivet.size.Size. (dlehman)
  - Don't corrupt the environment when setting up StorageTestCase. (dlehman)
  - Make minSize, maxSize consistent and correct. (dlehman)
  - Don't prevent grow actions on devices with no max size. (dlehman)


author: Brian C. Lane <bcl@redhat.com> - 0.47-1
changelog:
  - Change labelApp to a more concisely defined abstract property (amulhern)
  - Change defaultLabel to a more concisely defined abstract property. (amulhern)
  - Change _labelstrRegex to a more concisely defined abstract property.
    (amulhern)
  - Make reads property a bit more succinct. (amulhern)
  - Make name an abstract property and omit _name (amulhern)
  - Remove an unused import from devicelibs/raid.py (vpodzime)
  - Fix all pylint errors in pylintcodediff (amulhern)
  - Don't run test if the git branch is dirty (amulhern)
  - Exit if the specified log file does not exist. (amulhern)
  - Update lvm devicelibs tests to reflect recent changes. (dlehman)
  - Add required LVs as needed instead of trying to sort by attrs. (dlehman)
  - Fix missed conversion of rm->missing in vgreduce call. (dlehman)
  - Only gather lvm information one time per DeviceTree.populate call. (dlehman)
  - Add support for listing everything to pvinfo and lvs. (dlehman)
  - Get lv list from lvm in a more straightforward format. (dlehman)
  - Gather lv list where we use it to save from having to stash it. (dlehman)
  - Split out common lvm parsing code. (dlehman)
  - Add tests that use ParentList as part of Device. (dlehman)
  - Parent list length doesn't reflect new member in _addParent. (dlehman)
  - Rearrange _startEdd to be a little more obvious. (amulhern)
  - Raise exceptions using the new syntax (amulhern)
  - Do not import logging twice. (amulhern)
  - Suppress unused variable warning (amulhern)
  - Get rid of writeRandomUUID. (amulhern)
  - Remove unused variable but retain call for its side-effects (amulhern)
  - Put docstring in class (amulhern)
  - Remove appendiceal assignment (amulhern)
  - Keep first parameter "self" (amulhern)
  - Omit compile flag (amulhern)
  - Move lines beneath __main__ into a main method (amulhern)
  - Indent with spaces, not tabs (amulhern)
  - Change param default [] to None and convert in method (amulhern)
  - Change to a semantically equivalent version of FileDevice.path (amulhern)
  - Adapt existing tests to changed signature of some methods (amulhern)
  - Don't assign return value to unused variable (amulhern)
  - Be specific when catching exceptions (dshea)
  - Remove appendiceal assignments (amulhern)
  - Remove a lot of unused variables extracted from udev info (amulhern)
  - Don't get return values from communicate() if they are ignored (amulhern)
  - Use the disk's name in log message (amulhern)
  - Get rid of old exception unpacking syntax (dshea)
  - Rearranged some iffy exception checking (dshea)
  - Replace with a semantically equivalent chunk. (amulhern)
  - Remove some unused exception names. (amulhern)
  - Remove unused assignment to boot. (amulhern)
  - Delete method-local pruneFile function. (amulhern)
  - Don't comment out function headers but leave their bodies uncommented
    (amulhern)
  - Get rid of unnecessary pass statements (amulhern)
  - Put a field and a method in the base class (amulhern)
  - Spell parameter self correctly (amulhern)
  - Give abstract method the same signature as its overriding methods. (amulhern)
  - Catch correct error and disable warning. (amulhern)


author: Brian C. Lane <bcl@redhat.com> - 0.48-1
changelog:
  - Do not execute smallestMember property method twice. (amulhern)
  - Remove unnecessary function definitions in abstract properties (amulhern)
  - Pass format args as arguments to debug method (#1085057) (amulhern)
  - Move udev_settle call from util into fs to break circular dependency
    (amulhern)
  - Change implicit relative imports to explicit relative imports (amulhern)
  - Remove unused imports (amulhern)
  - Get rid of os.path import (amulhern)
  - Really avoid dynamic import of formats/__init__.py by itself (amulhern)
  - Ignore E1101 errors in savePassphrase. (amulhern)
  - Add a bunch of E1120 errors to the false positives file (amulhern)
  - Make LabelingAsRoot class an abstract class and define two properties
    (amulhern)
  - Suppress false positive W0631 error. (amulhern)
  - Use self.nic instead of nic (amulhern)
  - Make sure _state_functions is a dictionary in base class (amulhern)
  - Remove unnecessary lambda wrappers on assertion functions (amulhern)
  - Obvious fix inspired by an "Undefined variable warning" (amulhern)
  - Remove all references to lvm_vg_blacklist and blacklistVG. (amulhern)
  - Update for changes in the anaconda errorHandler API. (dshea)
  - Remove unused imports. (amulhern)
  - Import from the defining module. (amulhern)
  - Move import to top level. (amulhern)
  - Do not use implicit relative imports (amulhern)
  - Remove wildcard import (amulhern)
  - Fix a bug and catch a change in lvm's thin pool layout. (dlehman)
  - Plumb uuid down through DMDevice. (dlehman)


author: Brian C. Lane <bcl@redhat.com> - 0.49-1
changelog:
  - Slightly reduce loop and get rid of obsolete comment (amulhern)
  - Slightly rewrite loop to avoid a redefining builtin error (amulhern)
  - Simplify find_library and fix redefining built-in errors. (amulhern)
  - Make loop variables a little more descriptive (amulhern)
  - Make regular expressions raw strings. (amulhern)
  - Suppress unused variable warning and check for failure. (amulhern)
  - Add W0105 warning about attribute docstrings to false positives (amulhern)
  - Make signature of setup() in parent class same as in children (amulhern)
  - Suppress some correct pylint warnings (amulhern)
  - Get _loopMap.values() when all that's needed is the values (amulhern)
  - Obvious fix inspired by pylint E0602 error (amulhern)
  - Suppress W0631 warning for abbr and prefix. (amulhern)
  - Do not do formatting operation in the argument of the translation (amulhern)
  - Remove unnecessary global statements (amulhern)
  - Disable W0703 message in test (amulhern)
  - Explicitly set the module level platform variable (amulhern)


author: Brian C. Lane <bcl@redhat.com> - 0.50-1
changelog:
  - Don't apply action until after all checks have passed. (dlehman)
  - Apply action for extended partition creation. (dlehman)
  - Fix an issue introduced in commit a210eb5c. (dlehman)
  - Move changes from action ctors into apply methods. (dlehman)
  - Tell lvm to prefer /dev/mapper/ and /dev/md/ to dm-X and mdX nodes. (dlehman)
  - Use the right md UUID when trying to look one up from addUdevDevice.
    (dlehman)
  - Pass UUID of existing md array to superclass constructor. (dlehman)
  - Fix accounting related to addition of md member devices. (dlehman)
  - Add some more tests for the Size.humanReadable method (vpodzime)
  - If size is an integer value, show it as an integer value (vpodzime)
  - Make sure that using just k/m/g/... results in KiB/MiB/GiB/... (vpodzime)
  - Make humanReadable size use binary prefixes and nicer units (vpodzime)
  - Round sizes in humanReadable instead of flooring them (vpodzime)
  - Do not assign result of evaluating EddTestFS() to a variable (amulhern)
  - Rename bits() to numBits() (amulhern)
  - Rename to avoid conflict with name in outer scope. (amulhern)
  - Put module level code in a method (amulhern)
  - Do not use strip() incorrectly (amulhern)
  - Disable E1101 (no-member) error (amulhern)
  - Use isResize in isShrink and isGrow. (amulhern)
  - Suppress W0612 (unused-variable) false positives (amulhern)
  - Suppress W0621 warnings (amulhern)
  - Add a stub function for get_bootloader (amulhern)
  - Suppress W0602 false positives (amulhern)
  - Remove BootLoaderError definitions (amulhern)
  - Disable E1003 warning. (amulhern)
  - Do not cache the DeviceFormat object (amulhern)
  - Suppress W0201 error where attribute is set in __new__. (amulhern)
  - Add to false positives an error which is not suppressed by a pragma.
    (amulhern)
  - Suppress W0201 errors (amulhern)
  - Make signature of Size.__str__ match signature of Decimal.__str__ (amulhern)
  - Do not evaluate % operator in log message arguments (amulhern)
  - Remove suite() methods in tests (amulhern)
  - Remove addKeyFromFile() method (amulhern)
  - Import name 'deviceaction' where needed (amulhern)
  - Setting variables in __init__ (amulhern)
  - Log exception information and disable W0703 warning. (amulhern)
  - Disable some W0703 warnings (amulhern)
  - Disable some W0703 warnings. (amulhern)
  - Add a function that logs available exception info. (amulhern)
  - Restrict scope of pylint pragmas as much as possible (amulhern)
  - Change all pylint numeric codes to mnemonic strings. (amulhern)


author: Brian C. Lane <bcl@redhat.com> - 0.51-1
changelog:
  - Adjust the available size on each disk using chunk size. (amulhern)
  - Removed some now unused methods from devices (#1085474) (amulhern)
  - Rename size() method to get_size() method. (amulhern)
  - Remove unused get_size method (#1085474) (amulhern)
  - Use raid.size method to get size of device (#1085474) (amulhern)
  - Add a size() method to the raid classes (#1085474) (amulhern)
  - Move line that might throw an MDRaid exception inside try block (#1085474)
    (amulhern)
  - Check whether type is mdbiosraidarray before checking smallest member
    (#1085474) (amulhern)
  - Log if there was a failure to calculate the size of the MDRaidArrayDevice
    (#1085474) (amulhern)
  - Rename get_raw_array_size to get_net_array_size (#1085474) (amulhern)
  - Rename _get_size to _trim, which describes its function better (#1085474)
    (amulhern)
  - Improve comments on a few methods (#1085474) (amulhern)
  - Make RAIDLevels iterable (#1085474) (amulhern)
  - Update makebumpver for python-bugzilla 1.0.0 (bcl)
  - Disable unused argument warning for 'key_file' in devicelibs.crypto methods
    (amulhern)
  - Disable unused argument warning for 'del_passphrase' in luks_remove_key
    (amulhern)
  - Disable unused argument warning for 'data' in doAutoPartition (amulhern)
  - Disable unused argument warning for 'info' in handleUdevLuksFormat (amulhern)
  - Disable unused argument warning for 'disks' in get_pv_space. (amulhern)
  - Remove pointless parameters from unittest methods. (amulhern)
  - Disable a no member warning for EddTestFS initializer. (amulhern)
  - Get rid of unused argument 'args' in MakeBumpVer constructors (amulhern)
  - Changes to _parseOneLine() and its single invocation. (amulhern)
  - Remove obsolete comment (amulhern)
  - Rename to avoid redefining parameter built-ins (amulhern)
  - Change name to avoid redefining built-in (amulhern)
  - Remove unused parameter in makeupdates. (amulhern)
  - Removed unused argument 'options' from testMount (amulhern)
  - Make signature of _setSize match that of the method it overrrides. (amulhern)
  - Actually use argv parameter (amulhern)
  - Pass fname as first argument to shutil.copy2 (amulhern)
  - Remove minimumSector method and _minimumSector attribute (amulhern)
  - Disable not-callable pylint warning. (amulhern)
  - Set child_factory_fstype to None in DeviceFactory (amulhern)
  - Suppress unpacking-non-sequence pylint warning (amulhern)
  - Prefix name with defining package (amulhern)
  - Update Platform instance from flags instead of replacing it. (#1090646)
    (dlehman)
  - Rename to avoid redefining built-ins where the redefinition is method local.
    (amulhern)
  - Set device.format in else block of try/except/else. (amulhern)
  - Do not run pylint on sphinx generated conf.py (amulhern)
  - Get rid of a redefined builtin while simplifying method. (amulhern)
  - Compress loop into generator list comprehension (amulhern)
  - Rewrite resize() method to depend on _resizable. (amulhern)
  - Remove definition of LVMThinLogicalVolumeDevice._resizable (amulhern)
  - Add an attribute docstring for _resizable. (amulhern)
  - Correct comment on resizable property (amulhern)


author: Brian C. Lane <bcl@redhat.com> - 0.52-1
changelog:
  - Split ROOT_PATH usage into getTargetPhysicalRoot()/getSysroot() (walters)
  - Update and fix copyright info for docs. (dlehman)
  - Add some tests for extended partition management. (dlehman)
  - Add some tests that verify the results of DeviceTree.populate. (dlehman)
  - Add a base class for tests backed by disk image storage. (dlehman)
  - Adapt examples to examples/common.py function dispersement. (dlehman)
  - Change devices.SparseFileDevice._create to use util.create_sparse_file.
    (dlehman)
  - Move set_up_logging and create_sparse_file into blivet.util for reuse.
    (dlehman)
  - Make examples.common.tear_down_disk_images a DeviceTree method. (dlehman)
  - Fix handling of devices activated as a side-effect of actions. (dlehman)
  - Check for problematic active devices before processing any actions. (dlehman)
  - Split some large blocks out of DeviceTree.processActions. (dlehman)
  - Explicitly requested extended partitions already have an action. (dlehman)
  - Fix handling of extended partitions across various modes of operation.
    (dlehman)
  - Handle the case of md arrays getting activated from outside blivet. (dlehman)
  - Make an extra effort to remove dm partition nodes that want to stay.
    (dlehman)
  - Fix handling of clearing a partitioned disk and leaving it cleared. (dlehman)
  - Don't check for disklabels on partitions. (dlehman)
  - Update targetSize to reflect actual size after a device is created. (dlehman)
  - Remove redundant msecs from logging timestamp. (dlehman)
  - Make signature of Size.__new__ match signature of Decimal.__new__ (amulhern)
  - Change Size so that it takes a single value parameter. (amulhern)
  - Change all 'format' keyword args to 'fmt' in Device constructors (amulhern)
  - Change format keyword argument to fmt in scheduleCreateFormat (amulhern)
  - Change keyword parameters in devicetree.findActions (amulhern)
  - Change ActionCreateFormat constructor keyword argument to 'fmt' (amulhern)
  - Remove unused parameter 'ignoreErrors' from umountFilesystems() (amulhern)
  - Remove parameter 'raiseErrors' from mountFilesystems() methods. (amulhern)
  - Disable unused argument warning for 'major' and 'minor' (amulhern)
  - Set dummy functions as values rather than via function definition syntax.
    (amulhern)
  - Pass size value to superconstructor for LVMVolumeGroupDevice. (amulhern)
  - Sort the pylint-false-positives file (amulhern)
  - Do not disable unused argument warning. (amulhern)
  - Omit pylint warning about disabled warnings or errors from pylint log.
    (amulhern)
  - Put the pyblock warning in pylint-false-positives (amulhern)
  - Remove obsolete documentation for parameter 'label'. (amulhern)


author: Brian C. Lane <bcl@redhat.com> - 0.53-1
changelog:
  - Remove extra quotes from the xfs_db arguments. (dshea)
  - Factor duplicate code in __deepcopy__ methods into one method (#1095244)
    (amulhern)
  - Rearrange code related to handleUdevDeviceFormat() (#1095329) (amulhern)
  - Make dumpState catch and log all AttributeErrors (#1095329) (amulhern)
  - Add sectorSize property to catch and handle missing partedDevice (#1095329)
    (amulhern)
  - Get rid of remaining uses of spec keyword for Size() in examples directory.
    (amulhern)
  - Generalize false positive regular expression for multiple pylint versions
    (amulhern)
  - Do not run some tests unless running on Jenkins. (amulhern)
  - Miscellaneous pylint fixes. (amulhern)
  - Globally disable pointless string statement warning (amulhern)
  - Disable unused argument warning for 'args' in TmpFSDevice constructor
    (amulhern)
  - Omit 'args' parameter from formats constructors (amulhern)
  - Disabled unused argument warning for kwargs in formats.destroy() (amulhern)
  - Omit *args from parameters for format.create() and formats.destroy()
    (amulhern)
  - Omit *args from parameters in formats.setup() (amulhern)
  - Make formats.teardown() not take any extra parameters. (amulhern)
  - Make formats.mount use explicit keywords instead of kwargs. (amulhern)
  - Remove non-self params from FS.doResize method (amulhern)
  - Make doFormat use regular style keyword parameters (amulhern)
  - Do not use *args, **kwargs idiom in scheduleCreateFormat. (amulhern)
  - Do not use *args, **kwargs idiom in various schedule* auxiliary test methods.
    (amulhern)
  - Remove upgrading param from turnOnSwap() (amulhern)
  - Disable unused-argument warning (amulhern)
  - Disable pylint unused-argument warning. (amulhern)


author: Brian C. Lane <bcl@redhat.com> - 0.54-1
changelog:
  - Add tests for setting device's parent list directly (vpodzime)
  - Do not alter the ParentList being iterated over (#1083581) (vpodzime)
  - Do not limit ThinLV's size to VG's free space (vpodzime)
  - Take extra RAID metadata into account when growing LV (#1093144) (vpodzime)
  - Move apply_chunk_growth outside of a for-cycle (vpodzime)
  - Multiple arguments for string formatting need to be in parentheses (#1100263)
    (mkolman)
  - Make print statements Python 3 compatible (mkolman)
  - Validate device names (dshea)
  - Use a setter for Device.name as foretold by the prophecy of TODO (dshea)


author: Vratislav Podzimek <vpodzime@redhat.com> - 0.55-1
changelog:
  - IPSeriesPPC now supports GPT in Open Firmware (hamzy)
  - Fix device name validation for devices that can contain / (#1103751) (dshea)
  - Add a getRaidLevel() convenience method to raid.py (amulhern)
  - Make a StorageDevice.raw_device property and use it where appropriate
    (amulhern)
  - Simplify a small chunk of Blivet.updateKSData() (amulhern)
  - Move the code for getting a space requirement from devicefactory to raid.
    (amulhern)
  - Make all devicefactory classes uses RAID objects instead of strings.
    (amulhern)
  - Remove devicefactory.get_raid_level from blivet (amulhern)
  - Put get_supported_raid_levels in devicefactory.py (amulhern)
  - Make BTRFS devices use RAID objects instead of strings for levels (amulhern)
  - Add lists of supported RAID levels for btrfs and lvm (amulhern)
  - Add "linear" to mdraid's list of supported raid levels. (amulhern)
  - Remove getRaidLevel() from mdraid file and make RAID_levels public (amulhern)
  - Check for required methods in MDRaidLevels.isRaidLevel. (amulhern)
  - Use has_redundancy property to decide how to add a member to an array.
    (amulhern)
  - Update the mdraid.mdadd comments (amulhern)
  - Use has_redundancy raid property when checking whether a device is removable
    (amulhern)
  - Make createBitmap() a property and update tests appropriately. (amulhern)
  - Add a Dup class to the various descendants of RAIDLevel. (amulhern)
  - Add an is_uniform property to the RAID levels. (amulhern)
  - Add a has_redundancy method that returns True if there is actual redundancy
    (amulhern)
  - Add Linear and Single to the RAID classes. (amulhern)
  - Move Container class to raid package and tidy it up (amulhern)
  - Allow the RAID object itself to be a valid RAID descriptor for lookup.
    (amulhern)
  - Adjust RaidLevel hierarchy so that all raid level objects extend RAIDLevel
    (amulhern)
  - No longer use _standard_levels as the default set of RAID levels. (amulhern)
  - Extract selection of members in complete() into a separate method. (amulhern)
  - Remove DMRaidArrayDevice.members property. (amulhern)
  - Comment mdraid.mdcreate() and update tests appropriately. (amulhern)
  - Import name 'lvm' instead of names from lvm package. (amulhern)


author: Brian C. Lane <bcl@redhat.com> - 0.56-1
changelog:
  - Skip device name validation for some device types. (dlehman)
  - Add a property indicating whether a device is directly accessible. (dlehman)
  - Add support for read-only btrfs snapshots. (dlehman)
  - Add tests for snapshots. (dlehman)
  - Special treatment for getting parted device for old-style lvm snapshots.
    (dlehman)
  - Some devices have immutable formatting. (dlehman)
  - Detect existing btrfs snapshots. (dlehman)
  - Drop special accounting for snapshot space usage in VG. (dlehman)
  - Use LVMSnapshotDevice when populating the devicetree. (dlehman)
  - Add Device classes for snapshots. (dlehman)
  - Add ignore_skip keyword arg to lvactivate. (dlehman)
  - Add optional kwarg to force removal of a logical volume. (dlehman)
  - Add backend functions for creating and managing snapshots. (dlehman)
  - Add docstrings for BTRFSVolumeDevice and BTRFSSubVolumeDevice. (dlehman)
  - Remove duplicate portion of lvm config string. (dlehman)
  - Reset the devicetree before tearing everything down in _cleanUp. (dlehman)
  - Make sure disk filters are applied even if populate fails. (dlehman)
  - Sync the spec file with downstream (vpodzime)


author: Brian C. Lane <bcl@redhat.com> - 0.57-1
changelog:
  - Make DevicelibsTestCase devices configurable. (amulhern)
  - Use correct parameters in __init__() in subclasses of unittest.TestCase.
    (amulhern)
  - Add num_blocks parameter to makeLoopDev(). (amulhern)
  - Move skipUnless decorator to the top level class of skipped classes.
    (amulhern)
  - Explicitly accept a string as well as a RAIDLevel object. (amulhern)
  - Update BTRFS initializer comments for level type. (amulhern)
  - Remove some extra imports. (amulhern)
  - Add method to set the default disklabel (#1078537) (bcl)
  - Do not try to activate dmraid sets if the dmraid usage flag is false
    (mkolman)
  - Use the value of the Anaconda dmraid flag to set the Blivet dmraid flag
    (mkolman)
  - Use the value of the Anaconda ibft flag to set the Blivet ibft flag (mkolman)
  - Ignore _build directory in doc directory. (amulhern)
  - Change intersphinx mapping to avoid linkcheck redirect errors. (amulhern)
  - Remove doctest target from Makefile. (amulhern)
  - Allow the table of contents to go one level deeper. (amulhern)
  - Automate generation of the .rst files which just set up the modules.
    (amulhern)


author: Brian C. Lane <bcl@redhat.com> - 0.58-1
changelog:
  - Only import ROOT_PATH if needed (bcl)
  - Add early keyword to setUpBootLoader (#1086811) (bcl)
  - Only log a warning about labeling if something is wrong (#1075136) (amulhern)
  - When adding an md array, allow adding incomplete arrays (#1090009) (amulhern)
  - Add a flag to control whether a degraded md raid array is used (#1090009)
    (amulhern)
  - Remove preferLeaves parameter from getDeviceByPath() (amulhern)
  - Factor out commonalities among getDevice[s|]By* methods. (amulhern)
  - Omit special check for md devices in addUdevDevice(). (amulhern)
  - Remove unused 'slaves' variable. (amulhern)
  - Move down or remove assignment to device in add* methods. (amulhern)
  - Move DevicelibsTestCase up to the top level of the testing directory.
    (amulhern)
  - Accept None for btrfs raid levels (#1109195) (amulhern)
  - Add a test for a btrfs error associated with small devices (#1109195)
    (amulhern)


author: Brian C. Lane <bcl@redhat.com> - 0.60-1
changelog:
  - Do not use udev info to get the name of the device. (amulhern)
  - Remove unnecessary fanciness about importing devices. (amulhern)
  - Disable some pylint warnings that arise due to anaconda versions. (amulhern)
  - Allow RAID1 on EFI (#788313) (amulhern)


author: Brian C. Lane <bcl@redhat.com> - 0.61-1
changelog:
  - Fix conf.py version bumping (bcl)
  - Add some tests for Chunk and Request class hierarchy. (dlehman)
  - Honor the skip list when allocating leftover sectors. (dlehman)
  - A Chunk is done growing when its pool is empty. (dlehman)
  - Don't use integer division to calculate a fraction. (dlehman)
  - Bump version in sphinx config from scripts/makebumpver. (dlehman)
  - Remove spec= from Size usage in intro.rst. (dlehman)
  - Attempt to reset the uuid of the mdraid member device (#1070095) (amulhern)
  - Add new method udev.device_get_md_device_uuid() method (#1070095) (amulhern)
  - Canonicalize mdadm generated UUIDS (#1070095) (amulhern)
  - Add a udev.device_get_md_metadata() method to udev and use it. (amulhern)
  - Change use of METADATA to MD_METADATA. (amulhern)
  - Check for md_level of None (amulhern)
  - Do not convert the result of udev.device_get_md_devices() to int. (amulhern)
  - Add documentation to udev.device_get_md_*() methods. (amulhern)
  - Document udev.device_get_uuid() method. (amulhern)
  - Add a few small tests for mdexamine (amulhern)
  - Add test for raid level descriptor None. (amulhern)
  - Use context manager with assertRaises*() tests. (amulhern)
  - Change uuid parameter to array_uuid (amulhern)
  - Remove udev_ prefix from udev methods. (amulhern)
  - Remove all references to DeviceFormat.majorminor (amulhern)
  - Use add_metaclass instead of with_metaclass. (amulhern)
  - Disable redefined-builtin warning. (amulhern)
  - Use range instead of xrange in generateBackupPassphrase() (amulhern)
  - Add a simple test of generateBackupPassphrase() result format (amulhern)
  - Python3 compatibility (rkuska)
  - Replace python-setuptools-devel BR with python-setuptools (bcl)


author: David Lehman <dlehman@redhat.com> - 0.61.0.1-1
changelog:
  - Remove dependency on python-six. (dlehman)
    Related: rhbz#1075561
  - Update transifex config for rhel7-branch. (dlehman)
    Related: rhbz#1075561
  - Don't pass md array UUID as member format UUID. (dlehman)
    Related: rhbz#1075561
  - Make prefering leaves the default in getDeviceByPath (amulhern)
    Related: rhbz#1075561
  - Make _filterDevices() return a generator consistently (amulhern)
    Related: rhbz#1075561
  - Add some tests for blivet.partitioning.addPartition. (dlehman)
    Related: rhbz#1075561
  - Add a couple of tests for blivet.partitioning.DiskChunk. (dlehman)
    Related: rhbz#1075561
  - Add a DiskFile class for testing partitioning code as a non-root user.
    (dlehman)
    Related: rhbz#1075561
  - Add a contextmanager to create and remove sparse tempfiles. (dlehman)
    Related: rhbz#1075561
  - Make missing encryption key error message more helpful (amulhern)
    Resolves: rhbz#1074441


author: Brian C. Lane <bcl@redhat.com> - 0.61.0.2-1
changelog:
  - Condense and comment some devicelibs.dasd methods (amulhern)
    Related: rhbz#1070115
  - Add a test file for DASD handling (amulhern)
    Related: rhbz#1070115
  - Pylint inspired cleanup (amulhern)
    Related: rhbz#1070115
  - Add a property for read-only devices. (dshea)
    Resolves: rhbz#1072619
  - Allow user code creating free space snapshot (vpodzime)
    Related: rhbz#1132436
  - Add two functions to enable manual addition of ECKD DASDs. (sbueno+anaconda)
    Related: rhbz#1070115


author: Brian C. Lane <bcl@redhat.com> - 0.61.0.3-1
changelog:
  - Disable MacEFI platform type and hfs+ ESP (bcl)
    Related: rhbz#1119305
  - Prefer ID_SERIAL over ID_SERIAL_SHORT (vpodzime)
    Resolves: rhbz#1138254


author: Brian C. Lane <bcl@redhat.com> - 0.61.0.4-1
changelog:
  - Check if device has enough members when setting RAID level (amulhern)
    Related: rhbz#1019685
  - Add BTRFSValueError error and use in btrfs related code (amulhern)
    Related: rhbz#1019685
  - iscsi: mount partitions in initramfs for root on iscsi (rvykydal)
    Related: rhbz#740106
  - Remove poolMetaData (amulhern)
    Resolves: rhbz#1021505


author: Brian C. Lane <bcl@redhat.com> - 0.61.0.5-1
changelog:
  - Make sure autopart requests fit in somewhere (vpodzime)
    Resolves: rhbz#978266
  - Work with free region sizes instead of parted.Geometry objects (vpodzime)
    Related: rhbz#978266
  - Check that we have big enough free space for the partition request (vpodzime)
    Related: rhbz#978266
  - Allow specifying minimum entropy when creating LUKS (vpodzime)
    Related: rhbz#1073679
  - Allow user code provide callbacks for various actions/events (vpodzime)
    Related: rhbz#1073679
  - Fix pylint errors from recent btrfs commits. (dlehman)
    Related: rhbz#1015072
    Related: rhbz#1095866
  - Only cancel actions on disks related to the one we are hiding. (dlehman)
    Related: rhbz#1085201
    Related: rhbz#1129595
    Related: rhbz#1075671
  - Cancel actions before hiding descendent devices. (dlehman)
    Related: rhbz#1085201
    Related: rhbz#1129595
    Related: rhbz#1075671
  - Improve handling of device removals/additions from the devicetree. (dlehman)
    Resolves: rhbz#1077906
    Resolves: rhbz#1085201
    Resolves: rhbz#1129595
    Resolves: rhbz#1075671
  - The first format destroy action should obsolete any others. (dlehman)
    Related: rhbz#1085201
    Related: rhbz#1075671
  - Propagate mount options for btrfs members to all volumes/subvolumes.
    (dlehman)
    Resolves: rhbz#1095866
  - Properly identify dm devices even when udev info is incomplete. (dlehman)
    Resolves: rhbz#1080727
  - Do not mount btrfs to list subvolumes outside installer_mode. (dlehman)
    Resolves: rhbz#1015072
  - Reset default subvolume prior to removing the default subvolume. (dlehman)
    Resolves: rhbz#1076383
  - Increase max size for btrfs to 16 EiB. (dlehman)
    Resolves: rhbz#1114435
  - Improve adjustment for removal of a subvol in BTRFSFactory. (dlehman)
    Resolves: rhbz#1078995
  - Set dummy mountpoint in ksdata for lvm thin pools. (dlehman)
    Resolves: rhbz#1100244


author: Brian C. Lane <bcl@redhat.com> - 0.61.0.6-1
changelog:
  - Disable LVM autobackup when doing image installs (wwoods)
    Resolves: rhbz#1066004
  - Add attribute 'flags.lvm_metadata_backup' (wwoods)
    Related: rhbz#1066004
  - lvm_test: refactoring + minor fix (wwoods)
    Related: rhbz#1066004
  - devicelibs.lvm: refactor _getConfigArgs()/lvm() (wwoods)
    Related: rhbz#1066004
  - devicelibs.lvm: fix pvmove(src, dest=DESTPATH) (wwoods)
    Related: rhbz#1066004
  - Align free regions used for partition growing calculations. (dlehman)
    Resolves: rhbz#1083687
  - Try to align end sector up when aligning new partitions. (dlehman)
    Related: rhbz#1090477
  - Remove obsolete conversion of size to float. (dlehman)
    Resolves: rhbz#1140642
  - Honor size specified for explicit extended partition requests. (dlehman)
    Resolves: rhbz#1077250
  - Honor zerombr regardless of clearpart setting. (dlehman)
    Resolves: rhbz#1117946
  - Fix treatment of percent as lvm lv size spec. (dlehman)
    Related: rhbz#1116435
  - Change variable keyword (amulhern)
    Related: rhbz#1075671
  - Remove unused import (amulhern)
    Related: rhbz#1075671
  - Remove unused import (amulhern)
    Related: rhbz#1073679
  - Don't mix target and discovery credentials (mkolman)
    Resolves: rhbz#1037564
  - Make sure /boot/efi is metadata 1.0 if it's on mdraid. (pjones)
    Related: rhbz#788313
  - iscsi: fix root argument being overriden by local variable (rvykydal)
    Resolves: rhbz#1144463
  - iscsi: add iscsi singleton back (rvykydal)
    Related: rhbz#1144463


author: Brian C. Lane <bcl@redhat.com> - 0.61.0.7-1
changelog:
  - Remove all traces of singlePV. (sbueno+anaconda)
    Related: rhbz#1147501
  - Change the default /boot part on s390x to not be lvm. (sbueno+anaconda)
    Resolves: rhbz#1147501
  - Remove redundant check for parents in Blivet.newBTRFS. (dlehman)
    Resolves: rhbz#1072285
  - Filter out free regions too small for alignment of partitions. (dlehman)
    Related: rhbz#1083687
  - Return early when setting new size for non-existent partition. (dlehman)
    Related: rhbz#978266


author: Brian C. Lane <bcl@redhat.com> - 0.61.0.10-1
changelog:
  - Raise an exception when we find orphan partitions. (dlehman)
    Related: rhbz#1144410
  - Fall back to parted to detect dasd disklabels. (dlehman)
    Resolves: rhbz#1144410


author: Brian C. Lane <bcl@redhat.com> - 0.61.0.11-1
changelog:
  - Convert int to str before passing it to run_program (#1151129)
    Related: rhbz#1076383
  - Avoid unneccesarily tripping raid-level member count checks. (dlehman)
    Related: rhbz#1148980
  - Allow toggling encryption of raid container members. (dlehman)
    Related: rhbz#1148980


author: Brian C. Lane <bcl@redhat.com> - 0.61.0.12-1
changelog:
  - Take care when checking relationship of parent and child UUIDs (amulhern)
    Related: rhbz#1151649
  - Canonicalize MD_UUID* values in udev.py (amulhern)
    Resolves: rhbz#1153096
  - Add a test for activation (amulhern)
    Related: rhbz#1153096
  - Add a test for mddetail on containers (amulhern)
    Related: rhbz#1153096
  - Still attempt to destroy even if remove failed (amulhern)
    Related: rhbz#1153096
  - Use long messages for unittest errors (amulhern)
    Related: rhbz#1153096
  - Fix mdnominate error message (amulhern)
    Related: rhbz#1153096
  - Break once metadata value is found (amulhern)
    Related: rhbz#1153096
  - Split mdadd into separate functions (amulhern)
    Related: rhbz#1153096
  - Refactor mdraid tests (amulhern)
    Related: rhbz#1153096
  - Add a method to extract information about an mdraid array (amulhern)
    Related: rhbz#1153096
  - Extend mdadm() to capture output (amulhern)
    Related: rhbz#1153096
  - Be more robust in the face of possible changes to mdadm's UUIDs (amulhern)
    Related: rhbz#1153096
  - Factor canonicalize_UUID() into separate method (amulhern)
    Related: rhbz#1153096
  - Add a docstring to mdraid.mdexamine (amulhern)
    Related: rhbz#1153096
  - Update tests to bring into line w/ previous commit (amulhern)
    Related: rhbz#1151649
  - Abstract ContainerDevice member format check into a method (amulhern)
    Resolves: rhbz#1151649
  - Register DeviceFormat class (amulhern)
    Related: rhbz#1151649


author: Brian C. Lane <bcl@redhat.com> - 0.61.0.13-1
changelog:
  - Set _partedDevice attribute before calling device constructor (amulhern)
    Related: rhbz#1151649
  - Set sysfsPath attribute before calling Device constructor (amulhern)
    Related: rhbz#1151649


author: Brian C. Lane <bcl@redhat.com> - 0.61.0.15-1
changelog:
  - Add testing for MDRaidArrayDevice.mdadmFormatUUID (amulhern)
    Related: rhbz#1155151
  - Give mdadm format uuids to the outside world (amulhern)
    Resolves: rhbz#1155151


author: Brian C. Lane <bcl@redhat.com> - 0.61.0.16-1
changelog:
  - Add ability to set a default fstype for the boot partition (bcl)
    Related: rhbz#1112697
  - Pass a list of string items to log_method_return. (sbueno+anaconda)
    Resolves: rhbz#1155984


author: Brian C. Lane <bcl@redhat.com> - 0.61.0.17-1
changelog:
  - getArch should return ppc64 or ppc64le (bcl)
    Resolves: rhbz#1159271
  - Pack data for the wait_for_entropy callback (vpodzime)
    Related: rhbz#1073679
  - Allow the wait_for_entropy callback enforce continue (vpodzime)
    Related: rhbz#1073679


author: Brian C. Lane <bcl@redhat.com> - 0.61.0.21-1
changelog:
  - Use _netdev mount option as needed. (dlehman)
    Resolves: rhbz#1166509
  - Don't crash when a free region is too small for an aligned partition.
    (dlehman)
    Resolves: rhbz#1167292
  - Avoid exception when aligned start and end are crossed over (exclusion)
    Resolves: rhbz#1167233
  - Multiple loops shouldn't be fatal (bcl)
    Resolves: rhbz#980510
  - If allowing degraded array, attempt to start it (amulhern)
    Resolves: rhbz#1090009
  - Add a method that looks at DEVNAME (amulhern)
    Related: rhbz#1090009
  - Add mdrun method to just start, not assemble, an array. (amulhern)
    Related: rhbz#1090009
  - Change allow_degraded_mdraid flag to allow_imperfect_devices (amulhern)
    Related: rhbz#1090009


author: Brian C. Lane <bcl@redhat.com> - 0.61.0.23-1
changelog:
  - Raise a more descriptive exception for corrupt gpt disklabels. (dlehman)
    Resolves: rhbz#1123450
  - Don't raise an exception for failure to scan an ignored disk. (dlehman)
    Related: rhbz#1123450
  - Try to deactivate lvm on corrupted gpt disks. (dlehman)
    Related: rhbz#1123450


author: Brian C. Lane <bcl@redhat.com> - 0.61.0.25-1
changelog:
  - Fallback implicit partition size must be big enough for BTRFS (vpodzime)
    Related: rhbz#1171116
  - Make implicit partitions smaller if real requests don't fit anywhere
    (vpodzime)
    Resolves: rhbz#1171116
  - Revert "Try to deactivate lvm on corrupted gpt disks." (dlehman)
    Resolves: rhbz#1186317


author: Brian C. Lane <bcl@redhat.com> - 0.61.0.26-1
changelog:
  - Use a safer method to get a dm partition's disk name. (dlehman)
    Resolves: rhbz#1190886
    Related: rhbz#1181336


author: Arun SAG <sagarun@gmail.com> - 0.5.1-2
changelog:
  - Remove OPT_FLAGS from build section since it is a noarch package
  - Fix use of mixed tabs and space
  - Remove extra space around the word cumbersome in description


author: Arun SAG <sagarun@gmail.com> - 0.9.3-1
changelog:
  - Updated to new upstream version 0.9.3
  - Include python-gevent as a dependency for requests.async
  - Clean up shebangs in requests/setup.py,test_requests.py and test_requests_ext.py


author: Arun S A G <sagarun@gmail.com> 0.13.1-1
changelog:
  - Updated to latest upstream release 0.13.1
  - Use system provided ca-certificates
  - No more async requests use grrequests https://github.com/kennethreitz/grequests
  - Remove gevent as it is no longer required by requests


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.14.1-4
changelog:
  - Let brp_python_bytecompile run again, take care of the non-python{2,3} modules
    by removing them from the python{,3}-requests package that they did not belong
    in.
  - Use the certificates in the ca-certificates package instead of the bundled one
    + https://bugzilla.redhat.com/show_bug.cgi?id=904614
  - Fix a problem with cookie handling
    + https://bugzilla.redhat.com/show_bug.cgi?id=906924


author: Ralph Bean <rbean@redhat.com> - 1.1.0-1
changelog:
  - Latest upstream.
  - Relicense to ASL 2.0 with upstream.
  - Removed cookie handling patch (fixed in upstream tarball).
  - Updated cert unbundling patch to match upstream.
  - Added check section, but left it commented out for koji.


author: Ralph Bean <rbean@redhat.com> - 1.1.0-2
changelog:
  - Unbundled python-charade/chardet.  Using system python-chardet now.
  - Removed deprecated comments and actions against oauthlib unbundling.
    Those are no longer necessary in 1.1.0.
  - Added links to bz tickets over Patch declarations.


author: Ralph Bean <rbean@redhat.com> - 1.1.0-3
changelog:
  - Unbundled python-urllib3.  Using system python-urllib3 now.
  - Conditionally include python-ordereddict for el6.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.1-5
changelog:
  - Resolves: #906427 - Do not use lib64 in specfile for the nss and
                        pam libraries


author: Ralph Bean <rbean@redhat.com> - 1.5-3
changelog:
  - Renamed patches to python-urllib3-*
  - Fixed ssl check patch to use the correct cert path for Fedora.
  - Included dependency on ca-certificates
  - Cosmetic indentation changes to the .spec file.


author: Ralph Bean <rbean@redhat.com> - 1.5-4
changelog:
  - Upstream patch to fix Accept header when behind a proxy.
  - Reorganize patch numbers to more clearly distinguish them.


author: bkabrda <bkabrda@redhat.com> - 1.10.2-2
changelog:
  - Fix the way we unbundle six to make ovirt work even when they remove .py files
  Resolves: rhbz#1247189


author: Aristeu Rozanski <aris@redhat.com> 0.4.1-8.el7
changelog:
  - Revert patch in 0.4.1-7.el7, replaced by a better patch
  - Fix sizeof() usage on pointer [1035742]
  - Added macro to build the package with stack protector [1092558]
  - Handle failures of snprintf() [1035741]
  - Fix range checking on signed char variables [1035746]
  - Added aarch64 as architecture [1070973]
  - Start recording by default [1117366] [1117367]


author: Leon Ho <llch@redhat.com> 1.3-9
changelog:
  - Sync what we have changed on the branches
    Wed Nov 24 2004 Harald Hoyer <harald@redhat.com>
    - added post section to recreate the softlink in emul mode (bug 140739)
    Mon Nov 15 2004 Phil Knirsch <pknirsch@redhat.com>
    Tiny correction of bug in new triggers


author: Leon Ho <llch@redhat.com> 3.0-6.EL
changelog:
  - Made the /etc/lsb-release useful (RH#154605)
  - Added redhat_lsb_trigger to fix RH#160585 (Jakub Jelinek)
  - Fixed AMD64 base libraries requirement parsing (RH#154605)


author: Leon Ho <llch@redhat.com> 3.0-7.EL
changelog:
  - Fixed multilib problem on lsb_release not to read /etc/lsb-release and solely
    depends on /etc/lsb-release.d/ (Advised by LSB committee)
  - Removed /etc/lsb-release (Advised by LSB committee)


author: Lawrence Lim <llim@redhat.com> - 3.0-10
changelog:
  - Rewrite most part of the mkredhat-lsb to obtain information directly via specdb 
    rather than sniffing through sgml
  - remove redundent script and bump up tarball version


author: Lawrence Lim <llim@redhat.com> - 3.1-10.1
changelog:
  - generate spec file on RHEL5-Alpha system
  - fix vsw4 test suite setup by creating symlink for X11 SecurityPolicy and XFontPath


author: Lawrence Lim <llim@redhat.com> - 3.1-10.2
changelog:
  - for some strange reason, ld-lsb-x86-64.so need to be ld-lsb-x86-64.so.3 (LSB3.0) rather than ld-lsb-x86-64.so.3.1 (LSB3.1)


author: Lawrence Lim <llim@redhat.com> - 3.1-12.3.EL
changelog:
  - Resolves: #217566 - rewrite /lib/lsb/init-functions file needs to define the commands as true shell functions rather than aliases.
  - Resolves: #233530 - LSB pidofproc misspelled as pidofprof.
  - Resolves: #240916 - "log_warning_message" replaced with "log_warning_msg" per the LSB 3.1 spec


author: Lawrence Lim <llim@redhat.com> - 3.1-15.f8
changelog:
  - Resolved: #239842 - /lib/lsb/init-functions shall use aliases but not functions
  - forward port the patch from 3.1-12.3.EL which fix #217566, #233530, #240916


author: Lawrence Lim <llim@redhat.com> - 3.1-16
changelog:
  - update spec file in accordance to feedback provided through merge review - merge-review.patch - #226363


author: Hao Liu <hliu@redhat.com> - 3.1-22
changelog:
  - Remove 2 requires which provided by redhat-lsb
  - Add comments explaining why hard-coded path is kept
  - Resolve some hard-coded path problems
  - Add comments explaining why importing '-static' option while compiling redhat_lsb_trigger
  - Replace %{_libdir}/lsb with /usr/lib/lsb
  - Replace /%{_lib}/* with /%{_lib}/*so*
  - Replace /lib/lsb with /lib/lsb*


author: Hao Liu <hliu@redhat.com> 3.2-1
changelog:
  - Port forward to LSB 3.2
  - Remove symlink for mailx if user is upgrading from the redhat-lsb of older version 
  - Since F10 put mailx under /usr/bin, change the corresponding requires


author: Parag <pnemade AT redhat.com> - 4.0-5
changelog:
  - Fix directory ownership issue for %{_sysconfdir}/lsb-release.d
  - Fix duplicate files issue as reported in bodhi testing for 4.0-4


author: xning <xning AT redhat DOT com> - 4.1-1
changelog:
  - Update to 4.1 release
  - Added -core, -cxx, -desktop, -languages, -printing modules as subpackages
  - Added submod-security, -submod-multimedia subpackages
  - Implements http://refspecs.linux-foundation.org/LSB_4.1.0/ 
  - Resolves:rh#800249: new package update review by Parag.


author: xning <xning AT redhat DOT com> - 4.1-2
changelog:
  - Resolves:rh:#806190: gethostbyaddr sets h_errno to 3, not HOST_NOT_FOUND
  - Resolves:rh:#799284: perl(Pod::Plainer) is required by LSB 4.1
  - Resolves:rh:#821308: redhat-lsb 4.1 test libpn12.so.0 failed on fedora 17


author: Ondrej Vasik <ovasik@redhat.com> - 4.1-7
changelog:
  - add new subpackage -supplemental for LSB testuite-only dependencies
  - require net-tools in -supplemental (#882122)
  - require xorg-x11-fonts-ISO8859-1-{75,100}dpi in -supplemental
    (#883385)
  - require perl(XML::LibXML) (#880954)
  - keep usermodified /etc/nsswitch.conf as /etc/nsswitch.conf.rpmsave,
    warn about modification (#867124)


author: Ondrej Vasik <ovasik@redhat.com> - 4.1-11
changelog:
  - require perl(Pod::LaTeX) in languages (#908705)
  - require xorg-x11-server-Xvfb in supplemental (#896058)


author: Ondrej Vasik <ovasik@redhat.com> - 4.1-14
changelog:
  - require spax instead of pax (more POSIX compatible) (#965658)
  - require another set of perl modules in -languages (#959129)
  - polish a bit the nsswitch.conf hack - include mdns4_minimal (#915147)


author: Ondrej Vasik <ovasik@redhat.com> - 4.1-16
changelog:
  - add provides/obsoletes for redhat-lsb-compat to better
    deal with possible upgrade RHEL-6->RHEL-7 (#976792)


author: Ondrej Vasik <ovasik@redhat.com> - 4.1-18
changelog:
  - Require sil-abyssinica-fonts in supplemental(#994341)
  - Fully specify requirements on subpackages(#971386)


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.0-14
changelog:
  - Merge Pacemaker cluster resource agents:
    * Add Source1.
    * Drop noarch. We have real binaries now.
    * Update BuildRequires.
    * Update all relevant prep/build/install/files/description sections.


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.0-16
changelog:
  - Create an ldirectord package
  - Update Pacameker agents to upstream version: 2198dc90bec4
    + Build: Import ldirectord.
    + Ensure HA_VARRUNDIR has a value to substitute
    + High: Add findif tool (mandatory for IPaddr/IPaddr2)
    + High: IPv6addr: new nic and cidr_netmask parameters
    + High: postfix: new resource agent
    + Include license information
    + Low (LF 2159): Squid: make the regexp match more precisely output of netstat
    + Low: configure: Fix package name.
    + Low: ldirectord: add dependency on $remote_fs.
    + Low: ldirectord: add mandatory required header to init script.
    + Medium (LF 2165): IPaddr2: remove all colons from the mac address before passing it to send_arp
    + Medium: VirtualDomain: destroy domain shortly before timeout expiry
    + Medium: shellfuncs: Make the mktemp wrappers work.
    + Remove references to Echo function
    + Remove references to heartbeat shellfuncs.
    + Remove useless path lookups
    + findif: actually include the right header. Simplify configure.
    + ldirectord: Remove superfluous configure artifact.
    + ocf-tester: Fix package reference and path to DTD.


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.3-3
changelog:
  - Update Pacameker agents to upstream version: 099c0e5d80db
    + Add the ha_parameter function back into .ocf-shellfuncs.
    + Bug bnc#534803 - Provide a default for MAILCMD
    + Fix use of undefined macro @HA_NOARCHDATAHBDIR@
    + High (LF 2138): IPsrcaddr: replace 0/0 with proper ip prefix (thanks to Michael Ricordeau and Michael Schwartzkopff)
    + Import shellfuncs from heartbeat as badly written RAs use it
    + Medium (LF 2173): nfsserver: exit properly in nfsserver_validate
    + Medium: RA: Filesystem: implement monitor operation
    + Medium: RA: VirtualDomain: loop on status if libvirtd is unreachable
    + Medium: RA: VirtualDomain: loop on status if libvirtd is unreachable (addendum)
    + Medium: RA: iSCSILogicalUnit: use a 16-byte default SCSI ID
    + Medium: RA: iSCSITarget: be more persistent deleting targets on stop
    + Medium: RA: portblock: add per-IP filtering capability
    + Medium: mysql-proxy: log_level and keepalive parameters
    + Medium: oracle: drop spurious output from sqlplus
    + RA: Filesystem: allow configuring smbfs mounts as clones


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.4-2
changelog:
  - Update Pacameker agents to upstream version: e2338892f59f
    + High: send_arp - turn on unsolicited mode for compatibilty with the libnet version's exit codes
    + High: Trap sigterm for compatibility with the libnet version of send_arp
    + Medium: Bug - lf#2147: IPaddr2: behave if the interface is down
    + Medium: IPv6addr: recognize network masks properly
    + Medium: RA: VirtualDomain: avoid needlessly invoking "virsh define"


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.5-2
changelog:
  - Update Pacameker agents to upstream version: bc00c0b065d9
    + High: RA: introduce OCF_FUNCTIONS_DIR, allow it to be overridden (LF2239)
    + High: doc: add man pages for all RAs (LF2237)
    + High: syslog-ng: new RA
    + High: vmware: make meta-data work and several cleanups (LF 2212)
    + Medium: .ocf-shellfuncs: add ocf_is_probe function
    + Medium: Dev: make RAs executable (LF2239)
    + Medium: IPv6addr: ifdef out the ip offset hack for libnet v1.1.4 (LF 2034)
    + Medium: add mercurial repository version information to .ocf-shellfuncs
    + Medium: build: add perl-MailTools runtime dependency to ldirectord package (LF 1469)
    + Medium: iSCSITarget, iSCSILogicalUnit: support LIO
    + Medium: nfsserver: use check_binary properly in validate (LF 2211)
    + Medium: nfsserver: validate should not check if nfs_shared_infodir exists (thanks to eelco@procolix.com) (LF 2219)
    + Medium: oracle/oralsnr: export variables properly
    + Medium: pgsql: remove the previous backup_label if it exists
    + Medium: postfix: fix double stop (thanks to Dinh N. Quoc)
    + RA: LVM: Make monitor operation quiet in logs (bnc#546353)
    + RA: Xen: Remove instance_attribute "allow_migrate" (bnc#539968)
    + ldirectord: OCF agent: overhaul


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.6-1
changelog:
  - New rgmanager resource agents upstream release
  - spec file update:
    * use global instead of define
    * use new Source0 url
    * use resource-agents macro more aggressively


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.6-2
changelog:
  - Update Pacameker agents to upstream version: c76b4a6eb576
    + High: RA: VirtualDomain: fix forceful stop (LF 2283)
    + High: apache: monitor operation of depth 10 for web applications (LF 2234)
    + Medium: IPaddr2: CLUSTERIP/iptables rule not always inserted on failed monitor (LF 2281)
    + Medium: RA: Route: improve validate (LF 2232)
    + Medium: mark obsolete RAs as deprecated (LF 2244)
    + Medium: mysql: escalate stop to KILL if regular shutdown doesn't work


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.8-1
changelog:
  - New rgmanager resource agents upstream release
    Resolves: rhbz#548133, rhbz#565907, rhbz#545602, rhbz#555901
    Resolves: rhbz#564471, rhbz#515717, rhbz#557128, rhbz#536157
    Resolves: rhbz#455300, rhbz#561416, rhbz#562237, rhbz#537201
    Resolves: rhbz#536962, rhbz#553383, rhbz#556961, rhbz#555363
    Resolves: rhbz#557128, rhbz#455300, rhbz#557167, rhbz#459630
    Resolves: rhbz#532808, rhbz#556603, rhbz#554968, rhbz#555047
    Resolves: rhbz#554968, rhbz#555047
  - spec file update:
    * update spec file copyright date
    * use bz2 tarball


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.9-1
changelog:
  - New rgmanager resource agents upstream release
    Resolves: rhbz#455300, rhbz#568446, rhbz#561862, rhbz#536902
    Resolves: rhbz#512171, rhbz#519491


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.9-2
changelog:
  - Resolves: rhbz#572993 - Patched build process to correctly generate ldirectord man page
  - Resolves: rhbz#574732 - Add libnet-devel as a dependancy to ensure IPaddrv6 is built


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.10-1
changelog:
  - New rgmanager resource agents upstream release
    Resolves: rhbz#519491, rhbz#570525, rhbz#571806, rhbz#574027
    Resolves: rhbz#574215, rhbz#574886, rhbz#576322, rhbz#576335
    Resolves: rhbz#575103, rhbz#577856, rhbz#577874, rhbz#578249
    Resolves: rhbz#578625, rhbz#578626, rhbz#578628, rhbz#578626
    Resolves: rhbz#579621, rhbz#579623, rhbz#579625, rhbz#579626
    Resolves: rhbz#579059


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.10-2
changelog:
  - New pacemaker agents upstream release
    + High: RA: vmware: fix set_environment() invocation (LF 2342)
    + High: RA: vmware: update to version 0.2
    + Medium: Filesystem: prefer /proc/mounts to /etc/mtab for non-bind mounts (lf#2388)
    + Medium: IPaddr2: don't bring the interface down on stop (thanks to Lars Ellenberg)
    + Medium: IPsrcaddr: modify the interface route (lf#2367)
    + Medium: ldirectord: Allow multiple email addresses (LF 2168)
    + Medium: ldirectord: fix setting defaults for configfile and ldirectord (lf#2328)
    + Medium: meta-data: improve timeouts in most resource agents
    + Medium: nfsserver: use default values (lf#2321)
    + Medium: ocf-shellfuncs: don't log but print to stderr if connected to a terminal
    + Medium: ocf-shellfuncs: don't output to stderr if using syslog
    + Medium: oracle/oralsnr: improve exit codes if the environment isn't valid
    + Medium: RA: iSCSILogicalUnit: fix monitor for STGT
    + Medium: RA: make sure that OCF_RESKEY_CRM_meta_interval is always defined (LF 2284)
    + Medium: RA: ManageRAID: require bash
    + Medium: RA: ManageRAID: require bash
    + Medium: RA: VirtualDomain: bail out early if config file can't be read during probe (Novell 593988)
    + Medium: RA: VirtualDomain: fix incorrect use of __OCF_ACTION
    + Medium: RA: VirtualDomain: improve error messages
    + Medium: RA: VirtualDomain: spin on define until we definitely have a domain name
    + Medium: Route: add route table parameter (lf#2335)
    + Medium: sfex: don't use pid file (lf#2363,bnc#585416)
    + Medium: sfex: exit with success on stop if sfex has never been started (bnc#585416)


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.11-1
changelog:
  - new upstream release
    Resolves: rhbz#583945, rhbz#581047, rhbz#576330, rhbz#583017
    Resolves: rhbz#583019, rhbz#583948, rhbz#584003, rhbz#582017
    Resolves: rhbz#555901, rhbz#582754, rhbz#582573, rhbz#581533
  - Switch to file based Requires.
    Also address several other problems related to missing runtime
    components in different agents.
    With the current Requires: set, we guarantee all basic functionalities
    out of the box for lvm/fs/clusterfs/netfs/networking.
    Resolves: rhbz#570008


author: Andrew Beekhof <andrew@beekhof.net> - 3.0.12-1
changelog:
  - New pacemaker agents upstream release: a7c0f35916bf
    + High: pgsql: properly implement pghost parameter
    + High: RA: mysql: fix syntax error
    + High: SAPInstance RA: do not rely on op target rc when monitoring clones (lf#2371)
    + High: set the HA_RSCTMP directory to /var/run/resource-agents (lf#2378)
    + Medium: IPaddr/IPaddr2: add a description of the assumption in meta-data
    + Medium: IPaddr: return the correct code if interface delete failed
    + Medium: nfsserver: rpc.statd as the notify cmd does not work with -v (thanks to Carl Lewis)
    + Medium: oracle: reduce output from sqlplus to the last line for queries (bnc#567815)
    + Medium: pgsql: implement "config" parameter
    + Medium: RA: iSCSITarget: follow changed IET access policy


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.12-1
changelog:
  - new upstream release
    Resolves: rhbz#585217, rhbz#586100, rhbz#581533, rhbz#582753
    Resolves: rhbz#582754, rhbz#585083, rhbz#587079, rhbz#588890
    Resolves: rhbz#588925, rhbz#583789, rhbz#589131, rhbz#588010
    Resolves: rhbz#576871, rhbz#576871, rhbz#590000, rhbz#589823


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.13-1
changelog:
  - new upstream release
    Resolves: rhbz#592103, rhbz#593108, rhbz#578617, rhbz#594626
    Resolves: rhbz#594511, rhbz#596046, rhbz#594111, rhbz#597002
    Resolves: rhbz#599643


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.14-1
changelog:
  - new upstream release
    Resolves: rhbz#553383, rhbz#557563, rhbz#578625, rhbz#591003
    Resolves: rhbz#593721, rhbz#593726, rhbz#595455, rhbz#595547
    Resolves: rhbz#596918, rhbz#601315, rhbz#604298, rhbz#606368
    Resolves: rhbz#606470, rhbz#606480, rhbz#606754, rhbz#606989
    Resolves: rhbz#607321, rhbz#608154, rhbz#608887, rhbz#609181
    Resolves: rhbz#609866, rhbz#609978, rhbz#612097, rhbz#612110
    Resolves: rhbz#612165, rhbz#612941, rhbz#614127, rhbz#614356
    Resolves: rhbz#614421, rhbz#614457, rhbz#614961, rhbz#615202
    Resolves: rhbz#615203, rhbz#615255, rhbz#617163, rhbz#617566
    Resolves: rhbz#618534, rhbz#618703, rhbz#618806, rhbz#618814


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.16-1
changelog:
  - new upstream release
    Resolves: rhbz#619096, rhbz#614046, rhbz#620679, rhbz#619680
    Resolves: rhbz#621562, rhbz#621694, rhbz#608887, rhbz#622844
    Resolves: rhbz#623810, rhbz#617306, rhbz#623816, rhbz#624691
    Resolves: rhbz#622576


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.17-1
changelog:
  - new upstream release
    Resolves: rhbz#632595, rhbz#633856, rhbz#632385, rhbz#628013
    Resolves: rhbz#621313, rhbz#595383, rhbz#580492, rhbz#605733
    Resolves: rhbz#636243, rhbz#591003, rhbz#637913, rhbz#634718
    Resolves: rhbz#617247, rhbz#617247, rhbz#617234, rhbz#631943
    Resolves: rhbz#639018


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.1.0-1
changelog:
  - new upstream release
  - spec file update:
    Update upstream URL
    Update source URL
    use standard configure macro
    use standard make invokation


author: Chris Feist <cfeist@redhat.com> - 3.9.2-3.8
changelog:
  - Remove cluster-glue-libs-devel
  - Disable IPv6addr & sfex to fix deps on libplumgpl & libplum (due to
    disappearance of cluster-glue in F18)


author: David Vossel <dvossel@redhat.com> - 3.9.5-5
changelog:
  - Merges redhat provider into heartbeat provider. Remove
    rgmanager's redhat provider.

    Resolves: rhbz#917681
    Resolves: rhbz#928890
    Resolves: rhbz#952716
    Resolves: rhbz#960555


author: David Vossel <dvossel@redhat.com> - 3.9.5-7
changelog:
  - Detect duplicate resources with the same volgrpname
    name when using exclusive activation with tags

    Resolves: # rhbz984054


author: David Vossel <dvossel@redhat.com> - 3.9.5-8
changelog:
  - Add runtime dependencies section for Heartbeat agents.
  - Fix multi-lib inconsistencies found during rpm diff testing.
  - Add dist field back to rpm release name.


author: David Vossel <dvossel@redhat.com> - 3.9.5-10
changelog:
  - Removes ldirectord package
  - Puts sap agents and connector script in subpackage
  - exclude unsupported packages
  - symlink ipaddr to ipaddr2 so only a single agent is supported


author: David Vossel <dvossel@redhat.com> - 3.9.5-14
changelog:
  - Add ability for apache agent to perform simple monitoring
    of server request/response without requiring server-status
    to be enabled.
  - Fixes invalid return statement in LVM agent.
  - Oracle TNS_ADMIN option 

    Resolves: rhbz#917806
    Resolves: rhbz#917681
    Resolves: rhbz#799065


author: David Vossel <dvossel@redhat.com> - 3.9.5-15
changelog:
  - Update VirtualDomain heartbeat agent for heartbeat merger.
  - Includes upstream fixes for pacemaker_remote lxc test case.

    Resolves: rhbz#917681


author: David Vossel <dvossel@redhat.com> - 3.9.5-16
changelog:
  - Fixes issue with mysql agent not being able to set transient
    attributes on local node correctly.
  - Fixes bash syntax error in VirtualDomain during 'stop'
  - Fixes VirtualDomain default hypervisor usage.
  - Fixes VirtualDomain 'start' of pre-defined domain

    Resolves: rhbz#917681
    Resolves: rhbz#1014641
    Resolves: rhbz#1016140


author: David Vossel <dvossel@redhat.com> - 3.9.5-17
changelog:
  - Split send_ua utility out of IPv6addr.c source so it can be
    re-used in IPaddr2 without requiring cluster-glue.
  - Fixes issue with pgsql and SAPInstance not setting transient
    attributes correctly when local corosync node name is not
    equal to 'uname -n'
  - High: ocft: Fedora supported test cases

    Resolves: rhbz#917681


author: David Vossel <dvossel@redhat.com> - 3.9.5-18
changelog:
  - Remove support for (nginx, mysql-proxy, rsyslog). nginx and
    mysql-proxy are not a supported projects. Rsyslog is not an
    agent we will be supporting in an HA environment.

    Resolves: rhbz#917681


author: David Vossel <dvossel@redhat.com> - 3.9.5-20
changelog:
  - tomcat agent updates for pacemaker support
  - slapd agent updates for pacemaker support
  - Fixes missing etab file required for nfsserver

    Resolves: rhbz#1033016
    Resolves: rhbz#917681


author: David Vossel <dvossel@redhat.com> - 3.9.5-24
changelog:
  - Addition of the clvmd resource-agent
  - Support monitoring qemu based VirtualDomain resources without
    requiring libvirtd to be running.

    Resolves: rhbz#1064512
    Resolves: rhbz#1060367


author: David Vossel <dvossel@redhat.com> - 3.9.5-25
changelog:
  - Rename clvmd agent to clvm to avoid problems associated
    with having a resource-agent named the same exact name
    as the binary the agent manages.

    Resolves: rhbz#1064512


author: David Vossel <dvossel@redhat.com> - 3.9.5-26
changelog:
  - Handle monitor qemu based VirtualDomain resources without
    requiring libvirtd even if configuration file does not
    contain an 'emulator' value pointing to the emulator binary.

    Resolves: rhbz#1060367


author: David Vossel <dvossel@redhat.com> - 3.9.5-28
changelog:
  - Updates to nfs server related agent.
  - Introduces nfsnotify for sending NFSv3 NSM state change
    notifications allowing NFSv3 clients to reclaim locks.

    Resolves: rhbz#1091101


author: David Vossel <dvossel@redhat.com> - 3.9.5-29
changelog:
  - Support the check_user and check_passwd galera resource-agent
    options.
  - Minor NFS agent updates.

    Resolves: rhbz#1116166
    Resolves: rhbz#1091101


author: David Vossel <dvossel@redhat.com> - 3.9.5-30
changelog:
  - Support monitor of lxc without requiring libvirt.
  - Wait for filesystem modules to load during start.
  - Warn users managing clustered LVM when lvmetad is in use.
  - Restore VirtualDomain default start stop timeout values.
  - Support exit reason string
  - Auto set lvm locking type to clustered when clvmd is in use.

  Resolves: rhbz# 1083041
  Resolves: rhbz# 1083231
  Resolves: rhbz# 1097593
  Resolves: rhbz# 1105655
  Resolves: rhbz# 1128933
  Resolves: rhbz# 773395


author: David Vossel <dvossel@redhat.com> - 3.9.5-31
changelog:
  - Man page updates give pcs config examples
  - add iscsi agent support
  - add infiniband support to ethmonitor
  - add resource-agent support of exit reason string
  - add safe umount option to Filesystem resource agent

    Resolves: rhbz#1058102
    Resolves: rhbz#1118029
    Resolves: rhbz#1122285
    Resolves: rhbz#1128933
    Resolves: rhbz#1095944


author: David Vossel <dvossel@redhat.com> - 3.9.5-32
changelog:
  - Fixes iSCSILogicalUnit syntax error
  - Fixes mysql stop operation when db storage is unavailable

    Resolves: rhbz#1118029
    Resolves: rhbz#1138871


author: David Vossel <dvossel@redhat.com> - 3.9.5-33
changelog:
  - Merges latest upstream patches for galera agent
  - Merges latest upstream patchs for exit reason string

    Resolves: rhbz#1116166
    Resolves: rhbz#1128933


author: David Vossel <dvossel@redhat.com> - 3.9.5-34
changelog:
  - Fixes mysql agents behavior when monitoring resource instance
    when environment validation fails.

    Resolves: rhbz#1138871


author: David Vossel <dvossel@redhat.com> - 3.9.5-35
changelog:
  - Introduces docker resource-agent for managing docker containers.
    The docker agent is being released as tech preview.

    Resolves: rhbz#1135026


author: David Vossel <dvossel@redhat.com> - 3.9.5-36
changelog:
  - Fixes cleaning up stale docker containers during stop if
    container instance failed.

    Resolves: rhbz#1135026


author: David Vossel <dvossel@redhat.com> - 3.9.5-37
changelog:
  - Rename docker agent's 'container' arg to 'name' to avoid confusion
    with pacemaker's metadata 'container' argument.
  - Introduce monitor_cmd into docker agent.

    Resolves: rhbz#1135026


author: David Vossel <dvossel@redhat.com> - 3.9.5-40.6
changelog:
  - Improve galera resource-agent to not require use of read-only
    mode to retrieve last known write sequence number.

    Resolves: rhbz#1242339


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - rexec needs pam_set_item() (#60).
  - clarify protocol in rexecd.8.
  - add rexec client from contrib.


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - expunge all mentions of kerberos authentication or DES encryption using
    kerberos from the man pages


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix PAM config files to always honor nologin and securetty, to use rhosts,
    and to fall back to password auth only for rlogin and rexec (#17183)
  - add references to pam_env to the PAM configs as well (#16170)
  - disable rlogin and rsh by default


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - securetty is screwy because rsh doesn't allocate one and rlogin does auth
    before it has a tty, so change the hard-coded TTYs used from "tty" for all
    to "rsh" or "rlogin" or "rexec"


author: Phil Knirsch <pknirsch@redhat.com>
changelog:
  - Fixed really missing BuildPrereq: libtermcap-devel (#49577)
  - Fixed security problem with rexec.pam (#49181)


author: Nalin Dahyabhai <nalin@redhat.com> 0.17-11
changelog:
  - remove directory names from PAM configuration files, allowing them to be used
    for all arches on multilib systems


author: Karel Zak <kzak@redhat.com> 0.17-25
changelog:
  - rexecd uses PAM session now (#68590)
  - fixed errno usage in rcp (#67361)
  - fixed rexec fails with "Invalid Argument" (#118630)


author: Karel Zak <kzak@redhat.com> 0.17-35
changelog:
  - added support for IPv6 (patch by Jan Pazdziora)
  - fix #198632 - add keyinit instructions to the rsh, rlogin and rexec PAM scripts
    (patch by David Howells)
  - fix #191390 - improve linefeed patch


author: Adam Tkac <atkac redhat com> 0.17-40
changelog:
  - improved -D option to rlogind - when name won't be resolved rlogind uses IP address
  - added smp_mflags to make


author: Adam Tkac <atkac redhat com> 0.17-43
changelog:
  - removed -D option from rshd and rlogind (we have -a option when
    we need force reverse DNS lookup)
  - patches netkit-rsh-0.17-nodns.patch and netkit-rsh-0.17-nohostcheck.patch
    are substituted by netkit-rsh-0.17-dns.patch


author: Adam Tkac <atkac redhat com> 0.17-50
changelog:
  - fixed typos in arg_max and audit patches (#445606)
  - use pam_rhosts, not pam_rhosts_auth (#445606)


author: Adam Tkac <atkac redhat com> 0.17-51
changelog:
  - updated ipv6 patch due rpm 4.6 (#465053)
  - make in.rshd working on kernels without audit support (#448904)


author: Adam Tkac <atkac redhat com> - 0.17-59
changelog:
  - merge review related fixes (#226379)
  - remove unused patches
    - netkit-rsh-0.16-pamfix.patch
    - netkit-rsh-0.16-jbj2.patch
    - netkit-rsh-0.16-jbj3.patch


author: Michal Sekletar <msekleta@redhat.com> - 0.17-71
changelog:
  - resolves: RHBZ #737244 #896583 #947213
  - migrate from xinetd to systemd configuration
  - close pam session correctly when client does not ask for separate error channel
  - fix pty handling which was broken by changes in /bin/login


author: Michal Sekletar <msekleta@redhat.com> - 0.17-72
changelog:
  - unit files must not be marked as config files
  - fix handling of non-native IPv6 connections via AF_INET6 socket


author: Peter Vrabec <pvrabec@redhat.com> 1.17.1-1
changelog:
  - upstream bug fix release
  - include html docs (#248712)
  - make "-r" option compatible with sysklogd config (248982)


author: Tomas Heinrich <theinric@redhat.com> 3.21.3-3
changelog:
  - fix a wrong module name in the rsyslog.conf manual page (#455086)
  - expand the rsyslog.conf manual page (#456030)


author: Peter Vrabec <pvrabec@redhat.com> 3.21.3-4
changelog:
  - use RPM_OPT_FLAGS
  - use same pid file and logrotate file as syslog-ng (#441664)
  - mark config files as noreplace (#428155)


author: Tomas Heinrich <theinric@redhat.com> 4.4.2-1
changelog:
  - upgrade to new upstream stable version 4.4.2
  - add support for arbitrary number of open file descriptors


author: Tomas Heinrich <theinric@redhat.com> 4.4.2-6
changelog:
  - modify rsyslog-4.4.2-unlimited-select.patch so that
    running autoreconf is not needed
  - remove autoconf, automake, libtool from BuildRequires
  - change exec-prefix to nil


author: Tomas Heinrich <theinric@redhat.com> 4.6.2-1
changelog:
  - upgrade to new upstream stable version 4.6.2
  - correct the default value of the OMFileFlushOnTXEnd directive


author: Tomas Heinrich <theinric@redhat.com> 5.5.7-1
changelog:
  - upgrade to upstream version 5.5.7
  - update configuration and init files for the new major version
  - add several directories for storing auxiliary data
  - add ChangeLog to documentation
  - drop unlimited-select.patch; integrated upstream
  - add rsyslog-5.5.7-remove_include.patch to fix compilation


author: Tomas Heinrich <theinric@redhat.com> 5.6.2-1
changelog:
  - upgrade to new upstream stable version 5.6.2
  - drop rsyslog-5.5.7-remove_include.patch; applied upstream
  - provide omsnmp module
  - use correct name for lock file (#659398)
  - enable specification of the pid file (#579411)
  - init script adjustments


author: Tomas Heinrich <theinric@redhat.com> 5.7.9-1
changelog:
  - upgrade to new upstream version 5.7.9
  - enable compilation of several new modules,
    create new subpackages for some of them
  - integrate changes from Lennart Poettering
    to add support for systemd
    - add rsyslog-5.7.9-systemd.patch to tweak the upstream
      service file to honour configuration from /etc/sysconfig/rsyslog


author: Tomas Heinrich <theinric@redhat.com> 5.8.7-1
changelog:
  - upgrade to new upstream version 5.8.7
  - change license from 'GPLv3+' to '(GPLv3+ and ASL 2.0)'
    http://blog.gerhards.net/2012/01/rsyslog-licensing-update.html
  - use a specific version for obsoleting sysklogd
  - add patches for better sysklogd compatibility (taken from upstream)


author: Tomas Heinrich <theinric@redhat.com> 5.8.11-1
changelog:
  - upgrade to new upstream stable version 5.8.11
  - add impstats and imptcp modules
  - include new license text files
  - consider lock file in 'status' action
  - add patch to update information on debugging in the man page
  - add patch to prevent debug output to stdout after forking
  - add patch to support ssl certificates with domain names longer than 128 chars


author: Tomas Heinrich <theinric@redhat.com> 7.2.2-1
changelog:
  - upgrade to upstream version 7.2.2
    update BuildRequires
  - remove patches merged upstream
    rsyslog-5.8.7-sysklogd-compat-1-template.patch
    rsyslog-5.8.7-sysklogd-compat-2-option.patch
    rsyslog-5.8.11-close-fd1-when-forking.patch
  - add patch from Milan Bartos <mbartos@redhat.com>
    rsyslog-7.2.1-msg_c_nonoverwrite_merge.patch
  - remove the rsyslog-sysvinit package
  - clean up BuildRequires, Requires
  - remove the 'BuildRoot' tag
  - split off a doc package
  - compile additional modules (some of them in separate packages):
    elasticsearch
    hiredis
    mmjsonparse
    mmnormalize
    mmaudit
    mmsnmptrapd
    mongodb
  - correct impossible timestamps in older changelog entries
  - correct typos, trailing spaces, etc
  - s/RPM_BUILD_ROOT/{buildroot}/
  - remove the 'clean' section
  - replace post* scriptlets with systemd macros


author: Tomas Heinrich <theinric@redhat.com> 7.3.10-1
changelog:
  - rebase to 7.3.10
  - add a patch to resolve #950088 - ratelimiter segfault, merged upstream
    rsyslog-7.3.10-ratelimit-segv.patch
  - add a patch to correct a default value, merged upstream
    rsyslog-7.3.10-correct-def-val.patch
  - drop patch 5 - fixed upstream


author: Tomas Heinrich <theinric@redhat.com> 7.3.15-1.20130604git6e72fa6
changelog:
  - rebase to an upstream snapshot, effectively version 7.3.15
    plus several more changes
  - drop patches 3, 4 - merged upstream
  - add a patch to silence warnings emitted by the imuxsock module
  - drop the imkmsg plugin
  - enable compilation of additional modules
    imjournal, mmanon, omjournal, omrabbitmq
  - new subpackages: crypto, rabbitmq
  - add python-docutils and autoconf to global BuildRequires
  - drop the option for backwards compatibility from the
    sysconfig file - it is no longer supported
  - call autoreconf to prepare the snapshot for building
  - switch the local message source from imuxsock to imjournal
    the imuxsock module is left enabled so it is easy to swich back to
    it and because systemd drops a file into /etc/rsyslog.d which only
    imuxsock can parse


author: Tomas Heinrich <theinric@redhat.com> 7.4.0-1
changelog:
  - rebase to 7.4.0
  - drop autoconf automake libtool from BuildRequires
  - depends on systemd >= 201 because of the sd_journal_get_events() api
  - add a patch to prevent a segfault in imjournal caused by a bug in
    systemd journal
  - add a patch to prevent an endless loop in the ratelimiter
  - add a patch to prevent another endless loop in the ratelimiter
  - add a patch to prevent a segfault in imjournal for undefined state file
  - add a patch to correctly reset state in the ratelimiter


author: Tomas Heinrich <theinric@redhat.com> 7.4.1-1
changelog:
  - rebase to 7.4.1
    this release adds code that somewhat mitigates damage in cases
    where large amounts of messages are received from systemd
    journal (see rhbz#974132)
  - regenerate patch 0
  - drop patches merged upstream: 4..8
  - add a dependency on the version of systemd which resolves the bug
    mentioned above
  - update option name in rsyslog.conf


author: Tomas Heinrich <theinric@redhat.com> 7.4.2-1
changelog:
  - rebase to 7.4.2
    most importantly, this release fixes a potential vulnerability,
    see http://www.lsexperts.de/advisories/lse-2013-07-03.txt
    the impact should be low as only those using the omelasticsearch
    plugin with a specific configuration are exposed


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-1
changelog:
  - rebase to 7.4.7
    add requirement on libestr >= 0.1.9
    resolves: #836485
    resolves: #1020854
    resolves: #1040036
  - drop patch 4; not needed anymore
    rsyslog-7.4.2-imuxsock-rfc3339.patch
  - install the rsyslog-recover-qi.pl tool
  - fix a typo in a package description
  - add missing defattr directives
  - add a patch to remove references to Google ads in the html docs
    rsyslog-7.4.7-bz1030044-remove-ads.patch
    Resolves: #1030043
  - add a patch to allow numeric specification of UIDs/GUIDs
    rsyslog-7.4.7-numeric-uid.patch
    resolves: #1032198
  - change the installation prefix to "/usr"
    resolves: #1032223
  - fix a bad date in the changelog
    resolves: #1043622
  - resolve a build issue with missing mysql_config by adding
    additional BuildRequires for the mysql package
  - add a patch to resolve build issue on ppc
    rsyslog-7.4.7-omelasticsearch-atomic-inst.patch


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-3
changelog:
  - replace rsyslog-7.3.15-imuxsock-warning.patch
    with rsyslog-7.4.7-bz1053669-imuxsock-wrn.patch
    resolves: #1053669
  - add rsyslog-7.4.7-bz1052266-dont-link-libee.patch to prevent
    linking the main binary with libee
    resolves: #1052266
  - add rsyslog-7.4.7-bz1054171-omjournal-warning.patch to fix
    a condition for issuing a warning in omjournal
    resolves: #1054171
  - drop the "v5" string from the conf file as it's misleading
    resolves: #1040036


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-5
changelog:
  - move the rscryutil man page to the crypto subpackage
    resolves: #1056565
  - add a patch to prevent message loss in imjournal
    rsyslog-7.4.7-bz1038136-imjournal-message-loss.patch
    resolves: #1038136


author: Tomas Heinrich <theinric@redhat.com> 7.4.7-6
changelog:
  - disable the imklog plugin by default
    the patch for rhbz#1038136 caused duplication of kernel messages since the
    messages read by the imklog plugin were now also pulled in from journald
    resolves: #1078654


author: Toru Hoshina <hoshina@best.com>
changelog:
  - Modified SPEC in order to install libruby.a so that it should be used by
    another ruby entention.
  - 2nd release.


author: akira yamada <akira@redhat.com>
changelog:
  - Updated to version 1.4.4(06/12/2000 CVS).
  - Added manuals and FAQs.
  - Split into ruby, ruby-devel, ruby-tcltk, ruby-docs, irb.


author: akira yamada <akira@redhat.com>
changelog:
  - Updated to version 1.4.4(06/20/2000 CVS).
  - Removed ruby-list.23190.patch(included into ruby_cvs.patch).
  - Added ruby-dev.10054.patch.


author: akira yamada <akira@redhat.com>
changelog:
  - Updated to version 1.4.4(06/22/2000 CVS).
  - Removed ruby-dev.10054.patch(included into ruby_cvs.patch).


author: akira yamada <akira@redhat.com>
changelog:
  - Updated to version 1.4.6.
  - removed ruby-dev.10123.patch(included into ruby-1.4.6).
  - Added ruby_cvs.2000082901.patch(upgraded ruby to latest cvs version).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Updated to upstream version 1.6.1.
  - Removed ruby_cvs.2000082901.patch and added ruby_cvs.2000092718.patch
    (upgraded ruby to latest cvs version).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000092718.patch and added ruby_cvs.2000100218.patch
    (upgraded ruby to latest cvs version).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000100218.patch and added ruby_cvs.2000100313.patch
    (upgraded ruby to latest cvs version).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000100313.patch and added ruby_cvs.2000100313.patch
    (upgraded ruby to latest cvs version).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000100313.patch and added ruby_cvs.2000101117.patch
    (upgraded ruby to latest cvs version).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000101117.patch and added ruby_cvs.2000101901.patch
    (upgraded ruby to latest cvs version).
  - Added ruby-dev.11262.patch.
  - Added ruby-dev.11265.patch.


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000101901.patch, added ruby_cvs.2000121413.patch
    (upgraded ruby to latest cvs version).
  - Removed ruby-dev.11262.patch, ruby-dev.11265.patch,
    and ruby-dev.11268.patch (included into above patch).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000121413.patch, added ruby_cvs.2000122019.patch
    (upgraded ruby to latest cvs version).
  - new package: libruby


author: akira yamada <akira@vinelinux.org>
changelog:
  - Removed ruby_cvs.2000122019.patch, added ruby_cvs.2000122215.patch
    (upgraded ruby to latest cvs version, 1.6.2-preview4).


author: akira yamada <akira@vinelinux.org>
changelog:
  - Applied patch: upgraded to cvs version (2001-01-15):
    fixed minor bugs(e.g. ruby makes extention librares too large...).


author: akira yamada <akira@vinelinux.org>
changelog:
  - fixed bad group for libruby.
  - Applied patch: upgraded to cvs version (2001-02-08):
    fixed minor bugs.


author: Bernhard Rosenkraenzer <bero@redhat.com> 1.6.4-2
changelog:
  - Remove Japanese description and summaries; they belong in specspo and
    break rpm
  - Clean up specfile
  - Mark language specific files (README.jp) as such
  - bzip2 sources
  - rename the libruby package to ruby-libs for consistency
  - Exclude ia64 (doesn't build - the code doesn't seem to be 64-bit clean
    [has been excluded on alpha forever])


author: Akira TAGOH <tagoh@redhat.com> 1.6.6-1
changelog:
  - New upstream release.
  - Applied bug fix patches:
    - ruby-1.6.6-501-ruby-mode.patch: ruby-talk#30479: disables font-lock
      coloring.
    - ruby-1.6.6-100.patch: ruby-talk#30203: Ruby 1.6.6 bug and fix
                            ruby-list#33047: regex bug
                            PR#230: problem with -d in 1.6.6
  - Added ruby-mode and ruby-mode-xemacs packages.
  - Ruby works fine for ia64. so re-enable to build with ia64.
    (probably it should be worked for alpha)


author: Akira TAGOH <tagoh@redhat.com> 1.6.7-1
changelog:
  - New upstream release.
  - ruby-1.6.6-100.patch, ruby-1.6.6-501-ruby-mode.patch:
    removed. these patches no longer should be needed.
  - ruby-1.6.7-500-marshal-proc.patch: applied a fix patch.
    (ruby-dev#16178: Marshal::dump should call Proc#call.)
  - ruby-1.6.7-501-class-var.patch: applied a fix patch.
    (ruby-talk#35157: class vars broken in 1.6.7)


author: Akira TAGOH <tagoh@redhat.com> 1.6.7-2
changelog:
  - ruby-man-1.4.6-jp.tar.bz2: removed.
  - ruby-refm-rdp-1.4.7-ja-html.tar.bz2: uses it instead of.
  - ruby-1.6.7-500-marshal-proc.patch, ruby-1.6.7-501-class-var.patch:
    removed.
  - ruby-1.6.7-100.patch: applied a bug fix patch.
    (ruby-dev#16274: patch for 'wm state')
    (PR#206ja: SEGV handle EXIT)
  - ruby-1.6.7-101.patch: applied a bug fix patch.
    (ruby-list#34313: singleton should not be Marshal.dump'ed)
    (ruby-dev#16411: block local var)
  - ruby-1.6.7-102.patch: applied a bug fix patch.
    (handling multibyte chars is partially broken)
  - ruby-1.6.7-103.patch: applied a bug fix patch.
    (ruby-dev#16462: preserve reference for GC, but link should be cut)


author: Akira TAGOH <tagoh@redhat.com> 1.6.7-10
changelog:
  - moved sitedir to /usr/lib/ruby/site_ruby again according as our perl and
    python.
  - ruby-1.6.7-resolv1.patch, ruby-1.6.7-resolv2.patch: applied to fix 'Too many
    open files - "/etc/resolv.conf"' issue. (Bug#64830)


author: Akira TAGOH <tagoh@redhat.com> 1.6.7-11
changelog:
  - use %configure macro instead of configure script.
  - use the latest config.{sub,guess}.
  - get archname from rbconfig.rb for %dir
  - applied some patches from Debian:
    - 801_extmk.rb-shellwords.patch: use Shellwords
    - 801_mkmf.rb-shellwords.patch: mkmf.rb creates bad Makefile. the Makefile
      links libruby.a to the target.
    - 803_sample-fix-shbang.patch: all sample codes should be
      s|/usr/local/bin|/usr/bin|g
    - 804_parse.y-new-bison.patch: fix syntax warning.
    - 805_uri-bugfix.patch: uri.rb could not handle correctly broken mailto-uri.
  - add ExcludeArch x86_64 temporarily to fix Bug#74581. Right now ruby can't be
    built on x86_64.


author: Elliot Lee <sopwith@redhat.com> 1.6.7-13
changelog:
  - Remove ExcludeArch: x86_64
  - Fix x86_64 ruby with long2int.patch (ruby was assuming that sizeof(long)
    == sizeof(int). The patch does not fix the source of the problem, just
    makes it a non-issue.)
  - _smp_mflags


author: Akira TAGOH <tagoh@redhat.com> 1.6.8-1
changelog:
  - New upstream release.
  - removed some patches. it's no longer needed.
    - ruby-1.6.7-100.patch
    - ruby-1.6.7-101.patch
    - ruby-1.6.7-102.patch
    - ruby-1.6.7-103.patch
    - 801_extmk.rb-shellwords.patch
    - 801_mkmf.rb-shellwords.patch
    - 804_parse.y-new-bison.patch
    - 805_uri-bugfix.patch
    - ruby-1.6.6-900_XXX_strtod.patch
    - ruby-1.6.7-sux0rs.patch
    - ruby-1.6.7-libobj.patch


author: Akira TAGOH <tagoh@redhat.com> 1.6.8-2
changelog:
  - ruby-1.6.8-require.patch: applied to fix the search bug in require.
  - don't apply long2int patch to s390 and s390x. it doesn't work.


author: Akira TAGOH <tagoh@redhat.com> 1.6.8-7
changelog:
  - fix the gcc warnings. (#82192)
  - ruby-1.6.8-fix-x86_64.patch: correct a patch.
    NOTE: DON'T USE THIS PATCH FOR BIG ENDIAN ARCHITECTURE.
  - ruby-1.6.7-long2int.patch: removed.


author: Akira TAGOH <tagoh@redhat.com> 1.6.8-9
changelog:
  - ruby-1.6.8-castnode.patch: handling the nodes with correct cast.
    use this patch now instead of ruby-1.6.8-fix-x86_64.patch.


author: Akira TAGOH <tagoh@redhat.com> 1.8.1-1
changelog:
  - New upstream release.
  - don't use any optimization for ia64 to avoid the build failure.
  - ruby-1.8.1-ia64-stack-limit.patch: applied to fix SystemStackError when the optimization is disabled.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.1-9
changelog:
  - ruby-1.8.1-cgi-dos.patch: security fix [CAN-2004-0983]
  - ruby-1.8.1-cgi_session_perms.patch: security fix [CAN-2004-0755]


author: Akira TAGOH <tagoh@redhat.com> - 1.8.2-1
changelog:
  - New upstream release.
  - ruby-1.8.1-ia64-stack-limit.patch: removed - it's no longer needed.
  - ruby-1.8.1-cgi_session_perms.patch: likewise.
  - ruby-1.8.1-cgi-dos.patch: likewise.
  - generated Ruby interactive documentation - senarated package.
    it's now provided as ri package. (#141806)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.2-7
changelog:
  - ruby-1.8.2-deadcode.patch: removed the dead code from the source. (#146108)
  - make sure that all documentation files in ruby-docs are the world-
    readable. (#147279)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.2-9
changelog:
  - ruby-1.8.2-xmlrpc-CAN-2005-1992.patch: fixed the arbitrary command execution
    on XMLRPC server. (#161096)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.3-1
changelog:
  - New upstream release.
  - Build-Requires xorg-x11-devel instead of XFree86-devel.
  - ruby-multilib.patch: applied for only 64-bit archs.
  - ruby-1.8.2-xmlrpc-CAN-2005-1992.patch: removed. it has already been in upstream.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.3-3
changelog:
  - fixed the wrong file list. the external library for tcl/tk was included
    in ruby-libs unexpectedly.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.3-4
changelog:
  - moved the documents from ruby-libs to ruby-docs, which contains the arch
    specific thing and to be multilib support. (#168826)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.4-0.4.preview2
changelog:
  - updates to 1.8.4-preview2.
  - renamed the packages to ruby-* (#175765)
    - irb  -> ruby-irb
    - rdoc -> ruby-rdoc
    - ri   -> ruby-ri
  - added tcl-devel and tk-devel into BuildRequires.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.4-1
changelog:
  - New upstream release.
    - fixed a missing return statement. (#140833)
    - fixed an use of uninitialized variable. (#144890)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.4-3
changelog:
  - ruby-1.8.4-no-eaccess.patch: backported from ruby CVS to avoid conflict
    between newer glibc. (#179835)


author: Akira TAGOH <tagoh@redhat.com>
changelog:
  - ruby-rubyprefix.patch: moved all arch-independent modules under /usr/lib/ruby
    and keep arch-dependent modules under /usr/lib64/ruby for 64bit archs.
    so 'rubylibdir', 'sitelibdir' and 'sitedir' in Config::CONFIG points to
    the kind of /usr/lib/ruby now. (#184199)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.4-6
changelog:
  - ruby-deprecated-search-path.patch: added the deprecated installation paths
    to the search path for the backward compatibility.
  - added a Provides: ruby(abi) to ruby-libs.
  - ruby-1.8.4-64bit-pack.patch: backport patch from upstream to fix unpack("l")
    not working on 64bit arch and integer overflow on template "w". (#189350)
  - updated License tag to be more comfortable, and with a pointer to get more
    details, like Python package does. (#179933)
  - clean up.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.4-7
changelog:
  - exclude ppc64 to make ruby-mode package. right now emacs.ppc64 isn't provided
    and buildsys became much stricter.
  - ruby-deprecated-sitelib-search-path.patch: applied to add more search path
    for backward compatiblity.
  - added byacc to BuildReq. (#194161)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.4-11
changelog:
  - security fixes [CVE-2006-3694]
    - ruby-1.8.4-fix-insecure-dir-operation.patch:
    - ruby-1.8.4-fix-insecure-regexp-modification.patch: fixed the insecure
      operations in the certain safe-level restrictions. (#199538)
    - ruby-1.8.4-fix-alias-safe-level.patch: fixed to not bypass the certain
      safe-level restrictions. (#199543)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.5-1
changelog:
  - New upstream release.
  - removed the unnecessary patches:
    - ruby-1.8.4-no-eaccess.patch
    - ruby-1.8.4-64bit-pack.patch
    - ruby-1.8.4-fix-insecure-dir-operation.patch
    - ruby-1.8.4-fix-insecure-regexp-modification.patch
    - ruby-1.8.4-fix-alias-safe-level.patch
  - build with --enable-pthread except on ppc.
  - ruby-1.8.5-hash-memory-leak.patch: backported from CVS to fix a memory leak
    on Hash. [ruby-talk:211233]


author: Akira TAGOH <tagoh@redhat.com> - 1.8.5-4
changelog:
  - security fix release.
  - ruby-1.8.5-cgi-CVE-2006-5467.patch: fix a CGI multipart parsing bug that
    causes the denial of service. (#212396)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.36-3
changelog:
  - ruby-r12567.patch: backport patch from upstream svn to get rid of
    the unnecessary declarations. (#245446)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.110-1
changelog:
  - New upstream release.
    - ruby-r12567.patch: removed.
  - ruby-1.8.6-CVE-2007-5162.patch: security fix for Net::HTTP that is
    insufficient verification of SSL certificate.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.110-2
changelog:
  - Enable pthread support for ppc too. (#201452)
  - Fix unexpected dependencies appears in ruby-libs. (#253325)


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.111-1
changelog:
  - New upstream release.
  - ruby-1.8.6.111-CVE-2007-5162.patch: Update a bit with backporting the changes
     at trunk to enable the fix without any modifications on the users' scripts.
     Note that Net::HTTP#enable_post_connection_check isn't available anymore.
     If you want to disable this post-check, you should give OpenSSL::SSL::VERIFY_NONE
     to Net::HTTP#verify_mode= instead of.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.111-3
changelog:
  - Clean up the spec file.
  - Remove ruby-man-1.4.6 stuff. this is entirely the out-dated document.
    this could be replaced by ri.
  - Disable the static library building.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.114-1
changelog:
  - Security fix for CVE-2008-1145.
  - Improve a spec file. (#226381)
    - Correct License tag.
    - Fix a timestamp issue.
    - Own a arch-specific directory.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.230-1
changelog:
  - New upstream release.
  - Security fixes. (#452295)
    - CVE-2008-1891: WEBrick CGI source disclosure.
    - CVE-2008-2662: Integer overflow in rb_str_buf_append().
    - CVE-2008-2663: Integer overflow in rb_ary_store().
    - CVE-2008-2664: Unsafe use of alloca in rb_str_format().
    - CVE-2008-2725: Integer overflow in rb_ary_splice().
    - CVE-2008-2726: Integer overflow in rb_ary_splice().
  - ruby-1.8.6.111-CVE-2007-5162.patch: removed.
  - Build ruby-mode package for all archtectures.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.230-3
changelog:
  - Backported from upstream SVN to fix a segfault issue. (#452825)
  - Backported from upstream SVN to fix an integer overflow in rb_ary_fill.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.6.287-1
changelog:
  - New upstream release.
  - Security fixes.
    - CVE-2008-3655: Ruby does not properly restrict access to critical
                     variables and methods at various safe levels.
    - CVE-2008-3656: DoS vulnerability in WEBrick.
    - CVE-2008-3657: Lack of taintness check in dl.
    - CVE-2008-1447: DNS spoofing vulnerability in resolv.rb.
    - CVE-2008-3443: Memory allocation failure in Ruby regex engine.
  - Remove the unnecessary backported patches.


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.6.383-4
changelog:
  - Use bison to regenerate parse.c to keep the original format of error
    messages (bug 530275 comment 4)


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.6.383-5
changelog:
  - Change mkmf.rb to use LIBRUBYARG_SHARED so that have_library() works
    without libruby-static.a (bug 428384)
  - And move libruby-static.a to -static subpackage


author: Jeroen van Meeuwen <j.van.meeuwen@ogd.nl> - 1.8.6.388-8
changelog:
  - Backport openssl/digest functions providing digest and hexdigest functions
    directly in OpenSSL::Digest.methods
  - Make sure that Red Hat people version their changelog entries
  - This is actually release #1, but now needs to be release #7


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.6.399-2
changelog:
  - tcltk: Give up using potentially unmaintained ruby_1_8_6 branch
    and instead completely replace with ruby_1_8 branch head
    (at this time, using rev 27738)
    (seems to fix 560053, 590503)
  - Fix Japanese encoding strings under ruby-tcltk/ext/tk/sample/


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.6.399-3
changelog:
  - ruby-1.8.x-null-class-must-be-Qnil.patch (bug 530407)
  - Recreate some patches using upstream svn when available, and
    add some comments for patches


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.6.399-4
changelog:
  - Patch36 (ruby-1.8.x-RHASH_SIZE-rb_hash_lookup-def.patch)
    also backport rb_hash_lookup definition (bug 592936)


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.6.399-5
changelog:
  - Retry for bug 559158, Simplify the OpenSSL::Digest class
    pull more change commits from ruby_1_8 branch


author: Mohammed Morsi <mmorsi@redhat.com> - 1.8.7.249-3
changelog:
  - Integrated Jim Meyering's feedback and changes in to:
  - remove trailing blanks
  - placate rpmlint
  - ruby_* definitions: do not use trailing slashes in directory names
  - _normalized_cpu: simplify definition


author: Mohammed Morsi <mmorsi@redhat.com> - 1.8.7.299-1
changelog:
  - integrate more of jmeyering's and mtaska's feedback
  - removed emacs bits that are now shipped with the emacs package
  - various patch and spec cleanup
  - rebased to ruby 1.8.7 patch 299, removed patches no longer needed:
     ruby-1.8.7-openssl-1.0.patch, ruby-1.8.7-rb_gc_guard_ptr-optimization.patch


author: Mohammed Morsi <mmorsi@redhat.com> - 1.8.7.299-2
changelog:
  - readded bits to pull tk package from upstream source branch
  - removed unecessary .tk.old dir
  - renamed macros which may cause confusion, removed unused ones


author: Mohammed Morsi <mmorsi@redhat.com> - 1.8.7.299-3
changelog:
  - updated packaged based on feedback (from mtasaka)
  - added comments to all patches / sources
  - obsoleted ruby-mode, as it's now provided by the emacs package itself
  - readded missing documentation
  - various small compatability/regression fixes


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.7.299-4
changelog:
  - Cleanup spec file
  - Make -irb, -rdoc subpackage noarch
  - Make dependencies between arch-dependent subpackages isa specific
  - Improve sample documentation gathering


author: Mamoru Tasaka <mtasaka@ioa.s.u-tokyo.ac.jp> - 1.8.7.302-1
changelog:
  - Update to 1.8.7.302
  - CVE-2010-0541 (bug 587731) is fixed in this version
  - Update ext/tk to the latest head


author: Mamoru Tasaka <mtasaka@fedoraproject.org> - 1.8.7.352-1
changelog:
  - Update to 1.8.7 p352
  - CVE-2011-2686 is fixed in this version (bug 722415)
  - Update ext/tk to the latest git
  - Remove duplicate path entry (bug 718695)


author: Vít Ondruch <vondruch@redhat.com> - 1.9.3.0-2
changelog:
  - Install RubyGems outside of Ruby directory structure.
  - RubyGems has not its own -devel subpackage.
  - Enhanced macros.ruby and macros.rubygems.
  - All tests are green now (bkabrda).


author: Vít Ondruch <vondruch@redhat.com> - 1.9.3.0-4
changelog:
  - Bundled gems moved into dedicated directories and subpackages.
  - Create and own RubyGems directories for binary extensions.
  - Fix build with GCC 4.7.


author: Vít Ondruch <vondruch@redhat.com> - 1.9.3.0-5
changelog:
  - Initial release of Ruby 1.9.3.
  - Add rubygems dependency on io-console for user interactions.
  - Gems license clarification.


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.9.3.286-19
changelog:
  - Update to 1.9.3 p286
  - Don't create files when NUL-containing path name is passed
    (bug 865940, CVE-2012-4522)


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.9.3.327-21
changelog:
  - Update to 1.9.3.327
  - Fix Hash-flooding DoS vulnerability on MurmurHash function
    (CVE-2012-5371)


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.9.3.374-27
changelog:
  - Update to 1.9.3 p374
  - Fix provided variables in pkgconfig (bug 789532:
    Vít Ondruch <vondruch@redhat.com>)


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.0-0.1.r39387
changelog:
  - Upgrade to Ruby 2.0.0 (r39387).
  - Introduce %gem_install macro.
  - Build against libdb instead of libdb4 (rhbz#894022).
  - Move native extensions from exts to ruby directory.
  - Enable most of the PPC test suite.
  - Change ruby(abi) -> ruby(release).
  - Rename ruby executable to ruby-mri, to be prepared for RubyPick.
  - Add ruby(runtime_executable) virtual provide, which is later used
    by RubyPick.
  - RDoc now depends on JSON.
  - Try to make -doc subpackage noarch again, since the new RDoc should resolve
    the arch dependent issues (https://github.com/rdoc/rdoc/issues/71).
  - Enable SystemTap support.
  - Add TapSet for Ruby.
  - Split Psych into rubygem-psych subpackage.


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.0-1
changelog:
  - Update to Ruby 2.0.0-p0.
  - Change %{ruby_extdir} to %{ruby_extdir_mri} in preparation for better
    JRuby support.


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.0-3
changelog:
  - Avoid "method redefined;" warnings due to modified operating_system.rb.
  - Fix strange paths created during build of binary gems.


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.0-7
changelog:
  - Macro definition moved into macros.ruby and macros.rubygems files.
  - Added filtering macros.
  - Filter automatically generated provides of private libraries (rhbz#947408).


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.195-8
changelog:
  - Update to Ruby 2.0.0-p195 (rhbz#917374).
  - Fix object taint bypassing in DL and Fiddle (CVE-2013-2065).
  - Fix build against OpenSSL with enabled ECC curves.
  - Add aarch64 support (rhbz#926463).


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.247-9
changelog:
  - Update to Ruby 2.0.0-p247 (rhbz#979605).
  - Fix CVE-2013-4073.
  - Fix for wrong makefiles created by mkmf (rhbz#921650).
  - Add support for ABRT autoloading.


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.247-13
changelog:
  - Fixes multilib conlicts of .gemspec files.
  - Make symlinks for psych gem to ruby stdlib dirs (rhbz#979133).
  - Use system-wide cert.pem.


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.247-14
changelog:
  - Add forgotten psych.rb link into rubygem-psych to fix "private method `load'
    called for Psych:Moduler" error (rhbz#979133).


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.247-15
changelog:
  - Fix version regex algorithmic complexity vulnerability (CVE-2013-4287).
    - Resolves: rhbz#1006429


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.247-16
changelog:
  - Fix version regex algorithmic complexity vulnerability (CVE for incomplete
    fix for CVE-2013-4287) (CVE-2013-4363).
    - Related: rhbz#1006429


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.247-17
changelog:
  - Heap overflow in floating point parsing (CVE-2013-4164).
    * ruby-2.0.0-p353-CVE-2013-4164-ignore-too-long-fraction-part.patch
    - Resolves: rhbz#1033503
  - Allow MD5 in OpenSSL tests.


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.247-18
changelog:
  - Fix FTBFS due to expired certificate for IMAP test case.
  - Fix test_aes_gcm_wrong_tag random failures.
    - Resolves: rhbz#1048899


author: Josef Stribny <jstribny@redhat.com> - 2.0.0.353-22
changelog:
  - Fix FTBFS with new tzdata
    Resolves: rhbz#1144023
  - Fix FTBFS due to a support for RFC 5649 in OpenSSL
    Resolves: rhbz#1145692


author: Josef Stribny <jstribny@redhat.com> - 2.0.0.353-23
changelog:
  - Add missing patch for new tzdata
    Related: rhbz#1144023
  - Add missing patch for RFC 5649 in OpenSSL
    Related: rhbz#1145692


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.598-24
changelog:
  - Rebased to Ruby 2.0.0-p598.
    * Remove Patch19: ruby-2.0.0-p247-Make-stable-Gem-Specification.files-in-
        default-.gems.patch; subsumed
    * Remove Patch20: ruby-2.1.1-fix-test-failures-due-to-expired-certs.patch;
        subsumed
    * Remove Patch21: ruby-2.1.0-test_aes_gcm_wrong_tag-Dont-use-String
        -succ.patch; subsumed
    * Remove Patch22: ruby-2.2.0-fix-error-with-tzdata.patch; subsumed
    Resolves: rhbz#1071187
  - Incorporates fixes for CVE-2014-8080 and CVE-2015-8090.
    Resolves: rhbz#1164000
  - Fix for Proxy Realm feature.
    Resolves: rhbz#1122140
  - Fix off-by-one stack-based buffer overflow in the encodes() function
    (CVE-2014-4975).
    Related: rhbz#1164000


author: Jindrich Novy <jnovy@redhat.com> 0.1-6
changelog:
  - %stack_name: initial part of stack prefix and name of
    meta package providing scriptlets
  - %stack_prefix: stack namespacing part to be prepended to
    original non-stack package name, can be used for Provides
    namespacing as well
  - %stack_runtime: run-time package name providing scriptlets
  - %stack_require: macro to define dependency to other stacks


author: Jindrich Novy <jnovy@redhat.com> 0.1-9
changelog:
  - introduce stack enablement tracking
  - introduce "stack_enabled" helper utility to let a stack
    application figure out which stacks are actually enabled
  - disallow running stacks recursively


author: Jindrich Novy <jnovy@redhat.com> 0.1-11
changelog:
  - avoid redefinition of %_root* macros by multiple
    occurence of %stack_package
  - make the Stack root path configurable


author: Jindrich Novy <jnovy@redhat.com> 0.1-14
changelog:
  - define %_defaultdocdir to properly relocate docs into
    a stack
  - document a way how to pass command to stack via stdin


author: Jindrich Novy <jnovy@redhat.com> 20120209-1
changelog:
  - fix minor bugs (#788194)
    - clear temp files
    - handle commands from stdin properly
    - run command even if ran as "scl enable SCL command" from already
      enabled SCL


author: Jindrich Novy <jnovy@redhat.com> 20120229-1
changelog:
  - do not prepend scl_* prefix to package names
  - unify package naming to <SCL>-package-version
  - add scl --list functionality to list available SCLs


author: Jindrich Novy <jnovy@redhat.com> 20120413-1
changelog:
  - filesystem ownership by meta package
  - add man page
  - fix memory leak when parsing commands from stdin
  - use more descriptive error message if /etc/prefixes is missing


author: Jindrich Novy <jnovy@redhat.com> 20120613-1
changelog:
  - Requires: iso-codes for basic filesystem in build subpackage
  - add scl_require_package() macro to depend on a particular package
    from the collection
  - fix filesystem file list
  - tighten runtime package dependency via scl_require()
  - fix _localstatedir to point to the correct path according to redhat-rpm-config
  - thanks to Bohuslav Kabrda for feature proposals/QA/fixes


author: Jindrich Novy <jnovy@redhat.com> 20120927-1
changelog:
  - update to 20120927
  - better BUILDROOT processing
  - bash completition for scl command
  - debuginfo package now has SCL-specific provide
  - non-SCL builds are without warning in build log
  - improved help


author: Jindrich Novy <jnovy@redhat.com> 20121110-1
changelog:
  - introduce sclbuild utility
  - fix exporting of env. variables when mutiple collections are
    enabled at the same time
  - better bash completion
  - fix changelog


author: Jan Zeleny <jzeleny@redhat.com> - 20130529-2
changelog:
  - add scl_source script for intercollection dependencies (#1032444)
  - updated macros in macros.scl-filesystem (#1032451, #1032451)
  - add delimiter between collections and command (#1032460)
  - fix the name of attr macros (#1023628)


author: Jan Zeleny <jzeleny@redhat.com> - 20130529-4
changelog:
  - fixed some coverity-reported bugs (related: #1032616)
  - a note about env. variables in man page (#968954)
  - drop the /var/spool/uucp from the default fs structure (#1033674)


author: Jan Zeleny <jzeleny@redhat.com> - 20130529-6
changelog:
  Catch up with Fedora and RHEL6
  - add automatic Provides: scl-package(%scl) to all scl packages
    (except for metapackages)
  - add automatic Requires: %scl_runtime to all scl packages
    (except for metapackages)
  - the "filesystem" file renamed back to "filelist"
  - add correct dependencies to debug packages.
  - allow disabling debuginfo generation
  - remove automatic creation of debuginfo for metapackage.
  - rephrase command description in man page
  - fix system paths in __os_install_post
  - remove the sclbuild utility, as it's mostly useless
  - add the command set to register/deregister collection
  - fix missing allocation check in read_script_output()
  - drop recursive ownership of /usr/lib within SCL root
  - introduce %scl_dependency_generators macro


author: Lubos Kardos <lkardos@redhat.com - 20130529-7
changelog:
  Support for importing collections from NFS mounts
  - Add execution of register and deregister scripts during registration
    and deregistration if they exist.
  - Add capability to make collection nfs mountable using macro nfsmountable.


author: Lubos Kardos <lkardos@redhat.com - 20130529-8
changelog:
  - Modified paths of state and conf files
  - Add owning and creating of state and conf files if nfsmountable is defined
  - Add printing file names in error messages


author: Lubos Kardos <lkardos@redhat.com> - 20130529-10
changelog:
  - Allow to use vendor prefix in packages names
  - Include %nfsmountable macro into scl's rpm macros file


author: Jan Zeleny <jzeleny@redhat.com> - 20130529-13
changelog:
  - bump the version to get in sync with 7.1 branch
  - Reflect the state of %nfsmountable macro in collections' rpm macro files
  - escape all the % chars in changelog


author: Dan Walsh <dwalsh@redhat.com> 2.1.1-3
changelog:
  - Add two new httpd booleans, turned off by default
       * httpd_can_network_relay
       * httpd_can_network_connect_db


author: Dan Walsh <dwalsh@redhat.com> 2.1.2-1
changelog:
  - Update to upstream 
  - Turn off allow_execmem and allow_execmod booleans
  - Add tcpd and automount policies


author: Jeremy Katz <katzj@redhat.com> - 2.1.2-3
changelog:
  - fix requirements to be on the actual packages so that policy can get
    created properly at install time


author: Dan Walsh <dwalsh@redhat.com> 2.1.3-1
changelog:
  - Turn back on execmem since we need it for java, firefox, ooffice
  - Allow gpm to stream socket to itself


author: Dan Walsh <dwalsh@redhat.com> 2.1.6-13
changelog:
  - Add dri libs to textrel_shlib_t
  - Add system_r role for java
  - Add unconfined_exec_t for vncserver
  - Allow slapd to use kerberos


author: Dan Walsh <dwalsh@redhat.com> 2.1.12-3
changelog:
  - Fix for procmail/spamassasin
  - Update to upstream
  - Add rules to allow rpcd to work with unlabeled_networks.


author: Dan Walsh <dwalsh@redhat.com> 2.2.2-1
changelog:
  - Update to upstream
  - Turn off execheap execstack for unconfined users
  - Add mono/wine policy to allow execheap and execstack for them
  - Add execheap for Xdm policy


author: Dan Walsh <dwalsh@redhat.com> 2.2.19-2
changelog:
  - Fix swapon
  - allow httpd_sys_script_t to be entered via a shell
  - Allow httpd_sys_script_t to read eventpolfs


author: Dan Walsh <dwalsh@redhat.com> 2.2.20-1
changelog:
  - Fix load_policy to work on MLS
  - Fix cron_rw_system_pipes for postfix_postdrop_t
  - Allow audotmount to run showmount


author: Dan Walsh <dwalsh@redhat.com> 2.2.23-8
changelog:
  - Blkid changes
  - Allow udev access to usb_device_t
  - Fix post script to create targeted policy config file


author: Dan Walsh <dwalsh@redhat.com> 2.2.23-17
changelog:
  - MLS Fixes
       dmidecode needs mls_file_read_up
  - add ypxfr_t
  - run init needs access to nscd
  - udev needs setuid
  - another xen log file
  - Dontaudit mount getattr proc_kcore_t


author: Dan Walsh <dwalsh@redhat.com> 2.2.29-2
changelog:
  - Add mono dbus support
  - Lots of file_context fixes for textrel_shlib_t in FC5
  - Turn off execmem auditallow since they are filling log files


author: Russell Coker <rcoker@redhat.com> 2.2.29-5
changelog:
  - Fixed mailman with Postfix #183928
  - Allowed semanage to create file_context files.
  - Allowed amanda_t to access inetd_t TCP sockets and allowed amanda_recover_t
    to bind to reserved ports.  #149030
  - Don't allow devpts_t to be associated with tmp_t.
  - Allow hald_t to stat all mountpoints.
  - Added boolean samba_share_nfs to allow smbd_t full access to NFS mounts.
    - Make mount run in mount_t domain from unconfined_t to prevent mislabeling of
    /etc/mtab.
  - Changed the file_contexts to not have a regex before the first ^/[a-z]/
    whenever possible, makes restorecon slightly faster.
  - Correct the label of /etc/named.caching-nameserver.conf
  - Now label /usr/src/kernels/.+/lib(/.*)? as usr_t instead of
    /usr/src(/.*)?/lib(/.*)? - I don't think we need anything else under /usr/src
    hit by this.
  - Granted xen access to /boot, allowed mounting on xend_var_lib_t, and allowed
    xenstored_t rw access to the xen device node.


author: Dan Walsh <dwalsh@redhat.com> 2.2.29-6
changelog:
  - Allow secadm_t ability to relabel all files
  - Allow ftp to search xferlog_t directories
  - Allow mysql to communicate with ldap
  - Allow rsync to bind to rsync_port_t


author: Dan Walsh <dwalsh@redhat.com> 2.2.32-2
changelog:
  - Add unconfined_mount_t
  - Allow privoxy to connect to httpd_cache
  - fix cups labeleing on /var/cache/cups


author: Dan Walsh <dwalsh@redhat.com> 2.3.3-3
changelog:
  - Allow prelink to read bin_t symlink
  - allow xfs to read random devices
  - Change gfs to support xattr


author: Dan Walsh <dwalsh@redhat.com> 2.3.3-11
changelog:
  - Added Paul Howarth patch to only load policy packages shipped 
    with this package
  - Allow pidof from initrc to ptrace higher level domains
  - Allow firstboot to communicate with hal via dbus


author: Dan Walsh <dwalsh@redhat.com> 2.3.6-4
changelog:
  - Change allow_execstack to default to on, for RHEL5 Beta.  
    This is required because of a Java compiler problem.
    Hope to turn off for next beta


author: Dan Walsh <dwalsh@redhat.com> 2.3.9-4
changelog:
  - Set /usr/lib/ia32el/ia32x_loader to unconfined_execmem_exec_t for ia32 platform
  - Fix spec for /dev/adsp


author: Dan Walsh <dwalsh@redhat.com> 2.3.16-9
changelog:
  - Remove bluetooth-helper transition
  - Add selinux_validate for semanage
  - Require new version of libsemanage


author: James Antill <james.antill@redhat.com> 2.4.2-6
changelog:
  - Fix policygentool specfile problem.
  - Allow apache to send signals to it's logging helpers.
  - Resolves: rhbz#212731


author: Dan Walsh <dwalsh@redhat.com> 2.4.6-1
changelog:
  - Dontaudit appending hal_var_lib files 
  Resolves: #217452
  Resolves: #217571
  Resolves: #217611
  Resolves: #217640
  Resolves: #217725


author: Dan Walsh <dwalsh@redhat.com> 2.4.6-3
changelog:
  - Allow login programs to polyinstatiate homedirs
  Resolves: #216184
  - Allow quotacheck to create database files
  Resolves: #212957


author: Dan Walsh <dwalsh@redhat.com> 2.4.6-16
changelog:
  - Allow semanage to exec it self.  Label genhomedircon as semanage_exec_t
  Resolves: #219421
  - Allow sysadm_lpr_t to manage other print spool jobs
  Resolves: #220080


author: Dan Walsh <dwalsh@redhat.com> 2.5.1-1
changelog:
  - Allow prelink when run from rpm to create tmp files
  Resolves: #221865
  - Remove file_context for exportfs
  Resolves: #221181
  - Allow spamassassin to create ~/.spamassissin
  Resolves: #203290
  - Allow ssh access to the krb tickets
  - Allow sshd to change passwd
  - Stop newrole -l from working on non securetty
  Resolves: #200110
  - Fixes to run prelink in MLS machine
  Resolves: #221233
  - Allow spamassassin to read var_lib_t dir
  Resolves: #219234


author: Dan Walsh <dwalsh@redhat.com> 2.5.2-1
changelog:
  - Add ability to generate webadm_t policy
  - Lots of new interfaces for httpd
  - Allow sshd to login as unconfined_t


author: Dan Walsh <dwalsh@redhat.com> 2.5.2-4
changelog:
  - Fix spamassisin so crond can update spam files
  - Fixes to allow kpasswd to work
  - Fixes for bluetooth


author: Dan Walsh <dwalsh@redhat.com> 2.5.2-6
changelog:
  - Allow mozilla, evolution and thunderbird to read dev_random.
  Resolves: #227002
  - Allow spamd to connect to smtp port
  Resolves: #227184
  - Fixes to make ypxfr work
  Resolves: #227237


author: Dan Walsh <dwalsh@redhat.com> 2.5.4-2
changelog:
  - Revert Nemiver change
  - Set sudo as a corecmd so prelink will work,  remove sudoedit mapping, since this will not work, it does not transition.
  - Allow samba to execute useradd


author: Dan Walsh <dwalsh@redhat.com> 2.5.11-6
changelog:
  - Fix hald_acl_t to be able to getattr/setattr on usb devices
  - Dontaudit write to unconfined_pipes for load_policy


author: Dan Walsh <dwalsh@redhat.com> 2.6.4-5
changelog:
  - More fixes for alsactl
  - Transition from hal and modutils
  - Fixes for suspend resume.  
       - insmod domtrans to alsactl
       - insmod writes to hal log


author: Dan Walsh <dwalsh@redhat.com> 3.0.2-7
changelog:
  - Begin adding policy to separate setsebool from semanage
  - Fix xserver.if definition to not break sepolgen.if


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-7
changelog:
  - Allow cupsd_config_t to read/write usb_device_t
  - Support for finger print reader,
  - Many fixes for clvmd
  - dbus starting networkmanager


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-15
changelog:
  - Allow tmpreadper to read man_t
  - Allow racoon to bind to all nodes
  - Fixes for finger print reader


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-28
changelog:
  - Fixes for hald_mac 
  - Treat unconfined_home_dir_t as a home dir
  - dontaudit rhgb writes to fonts and root


author: Dan Walsh <dwalsh@redhat.com> 3.0.8-30
changelog:
  - Allow XServer to read /proc/self/cmdline
  - Fix unconfined cron jobs
  - Allow fetchmail to transition to procmail
  - Fixes for hald_mac
  - Allow system_mail to transition to exim
  - Allow tftpd to upload files
  - Allow xdm to manage unconfined_tmp
  - Allow udef to read alsa config
  - Fix xguest to be able to connect to sound port


author: Dan Walsh <dwalsh@redhat.com> 3.2.5-6
changelog:
  - Fix role transition from unconfined_r to system_r when running rpm
  - Allow unconfined_domains to communicate with user dbus instances


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-5
changelog:
  - Allow nsplugin_config execstack/execmem
  - Allow nsplugin_t to read alsa config
  - Change apache to use user content


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-6
changelog:
  - Prepare policy for beta release
  - Change some of the system domains back to unconfined
  - Turn on some of the booleans


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-15
changelog:
  - Allow init to transition to initrc_t on shell exec.
  - Fix init to be able to sendto init_t.
  - Allow syslog to connect to mysql
  - Allow lvm to manage its own fifo_files
  - Allow bugzilla to use ldap
  - More mls fixes


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-20
changelog:
  - Fix bug in mozilla policy to allow xguest transition
  - This will fix the 

  libsemanage.dbase_llist_query: could not find record value
  libsemanage.dbase_llist_query: could not query record value (No such file or
  directory)
   bug in xguest


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-22
changelog:
  - Allow stunnel to transition to inetd children domains
  - Make unconfined_dbusd_t an unconfined domain


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-27
changelog:
  - Allow nsplugin to read /etc/mozpluggerrc, user_fonts
  - Allow syslog to manage innd logs.
  - Allow procmail to ioctl spamd_exec_t


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-28
changelog:
  - Allow radvd to use fifo_file
  - dontaudit setfiles reading links
  - allow semanage sys_resource
  - add allow_httpd_mod_auth_ntlm_winbind boolean
  - Allow privhome apps including dovecot read on nfs and cifs home 
  dirs if the boolean is set


author: Dan Walsh <dwalsh@redhat.com> 3.3.1-44
changelog:
  - Change unconfined_t to transition to unconfined_mono_t when running mono
  - Change XXX_mono_t to transition to XXX_t when executing bin_t files, so gnome-do will work


author: Dan Walsh <dwalsh@redhat.com> 3.4.1-3
changelog:
  - Dontaudit search of admin_home for init_system_domain
  - Rewrite of xace interfaces
  - Lots of new fs_list_inotify
  - Allow livecd to transition to setfiles_mac


author: Dan Walsh <dwalsh@redhat.com> 3.4.2-7
changelog:
  - Allow confined users to use postgres
  - Allow system_mail_t to exec other mail clients
  - Label mogrel_rails as an apache server


author: Dan Walsh <dwalsh@redhat.com> 3.4.2-12
changelog:
  - Allow amanda to read tape
  - Allow prewikka cgi to use syslog, allow audisp_t to signal cgi
  - Add support for netware file systems


author: Dan Walsh <dwalsh@redhat.com> 3.5.1-1
changelog:
  - Fix xguest -> xguest_mozilla_t -> xguest_openiffice_t
  - Change dhclient to be able to red networkmanager_var_run


author: Dan Walsh <dwalsh@redhat.com> 3.5.1-4
changelog:
  - Consolodate pyzor,spamassassin, razor into one security domain
  - Fix xdm requiring additional perms.


author: Dan Walsh <dwalsh@redhat.com> 3.5.10-1
changelog:
  - Allow NetworkManager to transition to avahi and iptables
  - Allow domains to search other domains keys, coverup kernel bug


author: Dan Walsh <dwalsh@redhat.com> 3.5.13-14
changelog:
  - Additional fixes for cyphesis
  - Fix certmaster file context
  - Add policy for system-config-samba
  - Allow hal to read /var/run/video.rom


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-6
changelog:
  - Allow cupsd_t to create link files in print_spool_t
  - Fix iscsi_stream_connect typo
  - Fix labeling on /etc/acpi/actions
  - Don't reinstall unconfine and unconfineuser on upgrade if they are not installed


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-19
changelog:
  - Allow initrc_t to delete dev_null
  - Allow readahead to configure auditing
  - Fix milter policy
  - Add /var/lib/readahead


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-20
changelog:
  - Fix labeling on /var/lib/misc/prelink*
  - Allow xserver to rw_shm_perms with all x_clients
  - Allow prelink to execute files in the users home directory


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-21
changelog:
  - Allow confined users to manage virt_content_t, since this is home dir content
  - Allow all domains to read rpm_script_tmp_t which is what shell creates on redirection


author: Dan Walsh <dwalsh@redhat.com> 3.6.12-27
changelog:
  - Fix /sbin/ip6tables-save context
  - Allod udev to transition to mount
  - Fix loading of mls policy file


author: Dan Walsh <dwalsh@redhat.com> 3.6.13-3
changelog:
  - Add fish as a shell
  - Allow fprintd to list usbfs_t
  - Allow consolekit to search mountpoints
  - Add proper labeling for shorewall


author: Dan Walsh <dwalsh@redhat.com> 3.6.25-1
changelog:
  - Fix polkit label
  - Remove hidebrokensymptoms for nss_ldap fix
  - Add modemmanager policy
  - Lots of merges from upstream
  - Begin removing textrel_shlib_t labels, from fixed libraries


author: Dan Walsh <dwalsh@redhat.com> 3.6.31-4
changelog:
  - Fix devicekit_disk_t to getattr on all domains sockets and fifo_files
  - Conflicts seedit (You can not use selinux-policy-targeted and seedit at the same time.)


author: Dan Walsh <dwalsh@redhat.com> 3.6.31-5
changelog:
  - Fix label on /usr/bin/notepad, /usr/sbin/vboxadd-service
  - Remove policycoreutils-python requirement except for minimum


author: Dan Walsh <dwalsh@redhat.com> 3.6.32-13
changelog:
  - Allow cupsd_config to read user tmp
  - Allow snmpd_t to signal itself
  - Allow sysstat_t to makedir in sysstat_log_t


author: Dan Walsh <dwalsh@redhat.com> 3.7.7-1
changelog:
  - Move users file to selection by spec file.
  - Allow vncserver to run as unconfined_u:unconfined_r:unconfined_t


author: Dan Walsh <dwalsh@redhat.com> 3.7.8-3
changelog:
  - Allow abrt_helper to getattr on all filesystems
  - Add label for /opt/real/RealPlayer/plugins/oggfformat\.so


author: Dan Walsh <dwalsh@redhat.com> 3.7.10-4
changelog:
  - Change allow_execstack and allow_execmem booleans to on
  - dontaudit acct using console
  - Add label for fping
  - Allow tmpreaper to delete sandbox_file_t
  - Fix wine dontaudit mmap_zero
  - Allow abrt to read var_t symlinks


author: Dan Walsh <dwalsh@redhat.com> 3.7.10-5
changelog:
  - Add MLS fixes found in RHEL6 testing
  - Allow domains to append to rpm_tmp_t
  - Add cachefilesfd policy
  - Dontaudit leaks when transitioning


author: Dan Walsh <dwalsh@redhat.com> 3.7.11-1
changelog:
  - Update to upstream - These are merges of my patches
  - Remove 389 labeling conflicts
  - Add MLS fixes found in RHEL6 testing
  - Allow pulseaudio to run as a service
  - Add label for mssql and allow apache to connect to this database port if boolean set
  - Dontaudit searches of debugfs mount point
  - Allow policykit_auth to send signals to itself
  - Allow modcluster to call getpwnam
  - Allow swat to signal winbind
  - Allow usbmux to run as a system role
  - Allow svirt to create and use devpts


author: Dan Walsh <dwalsh@redhat.com> 3.7.13-4
changelog:
  - Allow users to dbus chat with xdm
  - Allow users to r/w wireless_device_t
  - Dontaudit reading of process states by ipsec_mgmt


author: Dan Walsh <dwalsh@redhat.com> 3.7.14-2
changelog:
  - Dontaudit ipsec_mgmt sys_ptrace
  - Allow at to mail its spool files
  - Allow nsplugin to search in .pulse directory


author: Dan Walsh <dwalsh@redhat.com> 3.7.15-4
changelog:
  - Add label for /var/lib/upower
  - Allow logrotate to run sssd
  - dontaudit readahead on tmpfs blk files
  - Allow tmpreaper to setattr on sandbox files
  - Allow confined users to execute dos files
  - Allow sysadm_t to kill processes running within its clearance
  - Add accountsd policy
  - Fixes for corosync policy
  - Fixes from crontab policy
  - Allow svirt to manage svirt_image_t chr files
  - Fixes for qdisk policy
  - Fixes for sssd policy
  - Fixes for newrole policy


author: Dan Walsh <dwalsh@redhat.com> 3.7.16-1
changelog:
  - Update to upstream
  - Allow tmpreaper to delete sandbox sock files
  - Allow chrome-sandbox_t to use /dev/zero, and dontaudit getattr file systems
  - Fixes for gitosis
  - No transition on livecd to passwd or chfn
  - Fixes for denyhosts


author: Dan Walsh <dwalsh@redhat.com> 3.7.16-2
changelog:
  - Fix ~/.fontconfig label
  - Add /root/.cert label
  - Allow reading of the fixed_file_disk_t:lnk_file if you can read file
  - Allow qemu_exec_t as an entrypoint to svirt_t


author: Dan Walsh <dwalsh@redhat.com> 3.7.17-3
changelog:
  - Fix cgroup handling adding policy for /cgroup
  - Allow confined users to write to generic usb devices, if user_rw_noexattrfile boolean set


author: Dan Walsh <dwalsh@redhat.com> 3.7.17-4
changelog:
  - Fix /cgroup file context 
  - Fix broken afs use of unlabled_t
  - Allow getty to use the console for s390


author: Dan Walsh <dwalsh@redhat.com> 3.7.17-6
changelog:
  - Fix allow_httpd_mod_auth_pam to use 	auth_use_pam(httpd_t)
  - Allow accountsd to read shadow file
  - Allow apache to send audit messages when using pam
  - Allow asterisk to bind and connect to sip tcp ports
  - Fixes for dovecot 2.0
  - Allow initrc_t to setattr on milter directories
  - Add procmail_home_t for .procmailrc file


author: Dan Walsh <dwalsh@redhat.com> 3.7.18-1
changelog:
  - Update to upstream
  - Fix label for  /opt/google/chrome/chrome-sandbox
  - Allow modemmanager to dbus with policykit


author: Dan Walsh <dwalsh@redhat.com> 3.7.18-3
changelog:
  - Allow ipsec_t to create /etc/resolv.conf with the correct label
  - Fix reserved port destination
  - Allow autofs to transition to showmount
  - Stop crashing tuned


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-1
changelog:
  - Update to upstream
  - Allow abrt to delete sosreport
  Resolves: #579998
  - Allow snmp to setuid and gid
  Resolves: #582155
  - Allow smartd to use generic scsi devices
  Resolves: #582145


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-3
changelog:
  - Fix label on /root/.rhosts
  Resolves: #582760
  - Add labels for Picasa
  - Allow openvpn to read home certs
  - Allow plymouthd_t to use tty_device_t
  - Run ncftool as iptables_t
  - Allow mount to unmount unlabeled_t
  - Dontaudit hal leaks


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-5
changelog:
  - Allow rlogind_t to search /root for .rhosts
  Resolves: #582760
  - Fix path for cached_var_t
  - Fix prelink paths /var/lib/prelink	
  - Allow confined users to direct_dri
  - Allow mls lvm/cryptosetup to work


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-6
changelog:
  - Allow initrc_t to read slapd_db_t
  Resolves: #585476
  - Allow ipsec_mgmt to use unallocated devpts and to create /etc/resolv.conf
  Resolves: #585963


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-11
changelog:
  - Fix location of oddjob_mkhomedir
  Resolves: #587385
  - fix labeling on /root/.shosts and ~/.shosts
  - Allow ipsec_mgmt_t to manage net_conf_t
  Resolves: #586760


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-12
changelog:
  - Allow initrc_t to remove dhcpc_state_t
  - Fix label on sa-update.cron
  - Allow dhcpc to restart chrony initrc
  - Don't allow sandbox to send signals to its parent processes
  - Fix transition from unconfined_t -> unconfined_mount_t -> rpcd_t
  Resolves: #589136


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-14
changelog:
  - Fixes for sandbox_x_net_t  to match access for sandbox_web_t ++
  - Add xdm_etc_t for /etc/gdm directory, allow accountsd to manage this directory
  - Add dontaudit interface for bluetooth dbus
  - Add chronyd_read_keys, append_keys for initrc_t
  - Add log support for ksmtuned
  Resolves: #586663


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-15
changelog:
  - Allow gdm to edit ~/.gconf dir
  Resolves: #590677
  - Allow dovecot to create directories in /var/lib/dovecot
  Partially resolves 590224
  - Allow avahi to dbus chat with NetworkManager
  - Fix cobbler labels
  - Dontaudit iceauth_t leaks
  - fix /var/lib/lxdm file context
  - Allow aiccu to use tun tap devices
  - Dontaudit shutdown using xserver.log


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-16
changelog:
  - Allow xm_t to read network state and get and set capabilities
  - Allow policykit to getattr all processes
  - Allow denyhosts to connect to tcp port 9911
  - Allow pyranha to use raw ip sockets and ptrace itself
  - Allow unconfined_execmem_t and gconfsd mechanism to dbus
  - Allow staff to kill ping process
  - Add additional MLS rules


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-17
changelog:
  - Fix path for /var/spool/abrt
  - Allow nfs_t as an entrypoint for http_sys_script_t
  - Add policy for piranha
  - Lots of fixes for sosreport


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-19
changelog:
  - Add labels for /sys
  - Allow sshd to getattr on shutdown
  - Fixes for munin
  - Allow sssd to use the kernel key ring
  - Allow tor to send syslog messages
  - Allow iptabels to read usr files
  - allow policykit to read all domains state


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-20
changelog:
  - Allow mount to r/w abrt fifo file
  - Allow svirt_t to getattr on hugetlbfs
  - Allow abrt to create a directory under /var/spool


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-21
changelog:
  - Allow login programs to read krb5_home_t
  Resolves: 594833
  - Add obsoletes for cachefilesfd-selinux package
  Resolves: #575084


author: Dan Walsh <dwalsh@redhat.com> 3.7.19-22
changelog:
  - Allow procmail to execute scripts in the users home dir that are labeled home_bin_t
  - Fix /var/run/abrtd.lock label


author: Dan Walsh <dwalsh@redhat.com> 3.8.1-2
changelog:
  - Fix label on /var/lib/dokwiki
  - Change permissive domains to enforcing
  - Fix libvirt policy to allow it to run on mls


author: Dan Walsh <dwalsh@redhat.com> 3.8.8-7
changelog:
  - Update boinc policy
  - Fix sysstat policy to allow sys_admin
  - Change failsafe_context to unconfined_r:unconfined_t:s0


author: Dan Walsh <dwalsh@redhat.com> 3.8.8-18
changelog:
  - Allow clamscan to read proc_t
  - Allow mount_t to write to debufs_t dir
  - Dontaudit mount_t trying to write to security_t dir


author: Dan Walsh <dwalsh@redhat.com> 3.8.8-20
changelog:
  - Allow cron to look at user_cron_spool links
  - Lots of fixes for mozilla_plugin_t
  - Add sysv file system
  - Turn unconfined domains to permissive to find additional avcs


author: Dan Walsh <dwalsh@redhat.com> 3.9.1-2
changelog:
  - Dominic Grift Cleanup
  - Miroslav Grepl policy for jabberd
  - Various fixes for mount/livecd and prelink


author: Dan Walsh <dwalsh@redhat.com> 3.9.2-1
changelog:
  - Merge upstream fix of mmap_zero
  - Allow mount to write files in debugfs_t
  - Allow corosync to communicate with clvmd via tmpfs
  - Allow certmaster to read usr_t files
  - Allow dbus system services to search cgroup_t
  - Define rlogind_t as a login pgm


author: Dan Walsh <dwalsh@redhat.com> 3.9.3-1
changelog:
  Allow iptables to read shorewall tmp files
  Change chfn and passwd to use auth_use_pam so they can send dbus messages to fpr
  intd
  label vlc as an execmem_exec_t 
  Lots of fixes for mozilla_plugin to run google vidio chat
  Allow telepath_msn to execute ldconfig and its own tmp files
  Fix labels on hugepages
  Allow mdadm to read files on /dev
  Remove permissive domains and change back to unconfined
  Allow freshclam to execute shell and bin_t
  Allow devicekit_power to transition to dhcpc
  Add boolean to allow icecast to connect to any port


author: Dan Walsh <dwalsh@redhat.com> 3.9.3-2
changelog:
  - Handle /var/db/sudo
  - Allow pulseaudio to read alsa config
  - Allow init to send initrc_t dbus messages


author: Dan Walsh <dwalsh@redhat.com> 3.9.4-2
changelog:
  - Allow all domains that can use cgroups to search tmpfs_t directory
  - Allow init to send audit messages


author: Dan Walsh <dwalsh@redhat.com> 3.9.4-3
changelog:
  - Add the ability to send audit messages to confined admin policies
  - Remove permissive domain from cmirrord and dontaudit sys_tty_config
  - Split out unconfined_domain() calls from other unconfined_ calls so we can d
  - virt needs to be able to read processes to clearance for MLS


author: Dan Walsh <dwalsh@redhat.com> 3.9.5-4
changelog:
  - Cleanup policy via dgrift
  - Allow dovecot_deliver to append to inherited log files
  - Lots of fixes for consolehelper


author: Dan Walsh <dwalsh@redhat.com> 3.9.5-5
changelog:
  - Pull in cleanups from dgrift
  - Allow mozilla_plugin_t to execute mozilla_home_t
  - Allow rpc.quota to do quotamod


author: Dan Walsh <dwalsh@redhat.com> 3.9.5-6
changelog:
  - Rearrange firewallgui policy to be more easily updated to upstream, dontaudit search of /home
  - Allow clamd to send signals to itself
  - Allow mozilla_plugin_t to read user home content.  And unlink pulseaudio shm.
  - Allow haze to connect to yahoo chat and messenger port tcp:5050.
  Bz #637339
  - Allow guest to run ps command on its processes by allowing it to read /proc
  - Allow firewallgui to sys_rawio which seems to be required to setup masqerading
  - Allow all domains to search through default_t directories, in order to find differnet labels.  For example people serring up /foo/bar to be share via samba.
  - Add label for /var/log/slim.log


author: Dan Walsh <dwalsh@redhat.com> 3.9.5-7
changelog:
  - Fixes to allow mozilla_plugin_t to create nsplugin_home_t directory.
  - Allow mozilla_plugin_t to create tcp/udp/netlink_route sockets
  - Allow confined users to read xdm_etc_t files
  - Allow xdm_t to transition to xauth_t for lxdm program


author: Dan Walsh <dwalsh@redhat.com> 3.9.5-9
changelog:
  - Turn off default transition to mozilla_plugin and telepathy domains from unconfined user 
  - Turn off iptables from unconfined user 
  - Allow sudo to send signals to any domains the user could have transitioned to.
  - Passwd in single user mode needs to talk to console_device_t
  - Mozilla_plugin_t needs to connect to web ports, needs to write to video device, and read alsa_home_t alsa setsup pulseaudio
  - locate tried to read a symbolic link, will dontaudit
  - New labels for telepathy-sunshine content in homedir
  - Google is storing other binaries under /opt/google/talkplugin
  - bluetooth/kernel is creating unlabeled_t socket that I will allow it to use until kernel fixes bug
  - Add boolean for unconfined_t transition to mozilla_plugin_t and telepathy domains, turned off in F14 on in F15
  - modemmanger and bluetooth send dbus messages to devicekit_power
  - Samba needs to getquota on filesystems labeld samba_share_t


author: Dan Walsh <dwalsh@redhat.com> 3.9.5-10
changelog:
  - Start adding support for use_fusefs_home_dirs
  - Add /var/lib/syslog directory file context
  - Add /etc/localtime as locale file context


author: Dan Walsh <dwalsh@redhat.com> 3.9.5-11
changelog:
  - Fix fusefs handling
  - Do not allow sandbox to manage nsplugin_rw_t
  - Allow mozilla_plugin_t to connecto its parent
  - Allow init_t to connect to plymouthd running as kernel_t
  - Add mediawiki policy
  - dontaudit sandbox sending signals to itself.  This can happen when they are running at different mcs.
  - Disable transition from dbus_session_domain to telepathy for F14
  - Allow boinc_project to use shm
  - Allow certmonger to search through directories that contain certs
  - Allow fail2ban the DAC Override so it can read log files owned by non root users


author: Dan Walsh <dwalsh@redhat.com> 3.9.6-2
changelog:
  - Lots of fixes for systemd
  - systemd now executes readahead and tmpwatch type scripts
  - Needs to manage random seed


author: Dan Walsh <dwalsh@redhat.com> 3.9.6-3
changelog:
  -Mount command from a confined user generates setattr on /etc/mtab file, need to dontaudit this access
  - dovecot-auth_t needs ipc_lock
  - gpm needs to use the user terminal
  - Allow system_mail_t to append ~/dead.letter
  - Allow NetworkManager to edit /etc/NetworkManager/NetworkManager.conf
  - Add pid file to vnstatd
  - Allow mount to communicate with gfs_controld
  - Dontaudit hal leaks in setfiles


author: Dan Walsh <dwalsh@redhat.com> 3.9.7-4
changelog:
  - Allow sandbox_x_domains to work with nfs/cifs/fusefs home dirs.
  - Allow devicekit_power to domtrans to mount
  - Allow dhcp to bind to udp ports > 1024 to do named stuff
  - Allow ssh_t to exec ssh_exec_t
  - Remove telepathy_butterfly_rw_tmp_files(), dev_read_printk() interfaces which are nolonger used
  - Fix clamav_append_log() intefaces
  - Fix 'psad_rw_fifo_file' interface


author: Dan Walsh <dwalsh@redhat.com> 3.9.7-5
changelog:
  - Allow chome to create netlink_route_socket
  - Add additional MATHLAB file context
  - Define nsplugin as an application_domain
  - Dontaudit sending signals from sandboxed domains to other domains
  - systemd requires init to build /tmp /var/auth and /var/lock dirs
  - mount wants to read devicekit_power /proc/ entries
  - mpd wants to connect to soundd port
  - Openoffice causes a setattr on a lib_t file for normal users, add dontaudit
  - Treat lib_t and textrel_shlib_t directories the same
  - Allow mount read access on virtual images


author: Dan Walsh <dwalsh@redhat.com> 3.9.7-7
changelog:
  - Dontaudit sandbox sending sigkill to all user domains
  - Add policy for rssh_chroot_helper
  - Add missing flask definitions
  - Allow udev to relabelto removable_t
  - Fix label on /var/log/wicd.log
  - Transition to initrc_t from init when executing bin_t
  - Add audit_access permissions to file
  - Make removable_t a device_node 
  - Fix label on /lib/systemd/*


author: Dan Walsh <dwalsh@redhat.com> 3.9.7-8
changelog:
  - Allow NetworkManager to read openvpn_etc_t
  - Dontaudit hplip to write of /usr dirs
  - Allow system_mail_t to create /root/dead.letter as mail_home_t
  - Add vdagent policy for spice agent daemon


author: Dan Walsh <dwalsh@redhat.com> 3.9.7-9
changelog:
  - Add virt_home_t, allow init to setattr on xserver_tmp_t and relabel it
  - Udev needs to stream connect to init and kernel
  - Add xdm_exec_bootloader boolean, which allows xdm to execute /sbin/grub and read files in /boot directory


author: Dan Walsh <dwalsh@redhat.com> 3.9.7-10
changelog:
  - Fix sandbox to work on nfs homedirs
  - Allow cdrecord to setrlimit
  - Allow mozilla_plugin to read xauth
  - Change label on systemd-logger to syslogd_exec_t
  - Install dirsrv policy from dirsrv package


author: Dan Walsh <dwalsh@redhat.com> 3.9.8-3
changelog:
  - Fix up corecommands.fc to match upstream
  - Make sure /lib/systemd/* is labeled init_exec_t
  - mount wants to setattr on all mountpoints
  - dovecot auth wants to read dovecot etc files
  - nscd daemon looks at the exe file of the comunicating daemon
  - openvpn wants to read utmp file
  - postfix apps now set sys_nice and lower limits
  - remote_login (telnetd/login) wants to use telnetd_devpts_t and user_devpts_t to work correctly
  - Also resolves nsswitch
  - Fix labels on /etc/hosts.*
  - Cleanup to make upsteam patch work
  - allow abrt to read etc_runtime_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.8-4
changelog:
  - Allow groupd transition to fenced domain when executes fence_node
  - Fixes for rchs policy
  - Allow mpd to be able to read samba/nfs files


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.8-5
changelog:
  - Turn on mediawiki policy
  - kdump leaks kdump_etc_t to ifconfig, add dontaudit
  - uux needs to transition to uucpd_t
  - More init fixes relabels man,faillog
  - Remove maxima defs in libraries.fc
  - insmod needs to be able to create tmpfs_t files
  - ping needs setcap


author: Dan Walsh <dwalsh@redhat.com> 3.9.8-6
changelog:
  - Remove saslauthd_tmp_t and transition tmp files to krb5_host_rcache_t
  - Allow saslauthd_t to create krb5_host_rcache_t files in /tmp
  - Fix xserver interface
  - Fix definition of /var/run/lxdm


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.8-7
changelog:
  - Allow nagios plugins to read usr files
  - Allow mysqld-safe to send system log messages
  - Fixes fpr ddclient policy
  - Fix sasl_admin interface
  - Allow apache to search zarafa config
  - Allow munin plugins to search /var/lib directory
  - Allow gpsd to read sysfs_t
  - Fix labels on /etc/mcelog/triggers to bin_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.9-1
changelog:
  - Update to upstream
  - Dontaudit leaked sockets from userdomains to user domains
  - Fixes for mcelog to handle scripts
  - Apply patch from Ruben Kerkhof
  - Allow syslog to search spool dirs


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.9-2
changelog:
  - Turn on allow_postfix_local_write_mail_spool
  - Allow initrc_t to transition to shutdown_t
  - Allow logwatch and cron to mls_read_to_clearance for MLS boxes
  - Allow wm to send signull to all applications and receive them from users
  - lircd patch from field
  - Login programs have to read /etc/samba
  - New programs under /lib/systemd
  - Abrt needs to read config files


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.9-4
changelog:
  - Allow ddclient to fix file mode bits of ddclient conf file
  - init leaks file descriptors to daemons
  - Add labels for /etc/lirc/ and
  - Allow amavis_t to exec shell
  - Add label for gssd_tmp_t for /var/tmp/nfs_0


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.10-3
changelog:
  - fixes to allow /var/run and /var/lock as tmpfs
  - Allow chrome sandbox to connect to web ports
  - Allow dovecot to listem on lmtp and sieve ports
  - Allov ddclient to search sysctl_net_t
  - Transition back to original domain if you execute the shell


author: Dan Walsh <dwalsh@redhat.com> 3.9.10-4
changelog:
  - Fix up handling of dnsmasq_t creating /var/run/libvirt/network
  - Turn on sshd_forward_ports boolean by default
  - Allow sysadmin to dbus chat with rpm
  - Add interface for rw_tpm_dev
  - Allow cron to execute bin
  - fsadm needs to write sysfs
  - Dontaudit consoletype reading /var/run/pm-utils
  - Lots of new privs fro mozilla_plugin_t running java app, make mozilla_plugin
  - certmonger needs to manage dirsrv data
  - /var/run/pm-utils should be labeled as devicekit_var_run_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.10-5
changelog:
  - Fix cron to run ranged when started by init
  - Fix devicekit to use log files
  - Dontaudit use of devicekit_var_run_t for fstools
  - Allow init to setattr on logfile directories
  - Allow hald to manage files in /var/run/pm-utils/ dir which is now labeled as devicekit_var_run_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.10-6
changelog:
  - Fix gnome_manage_data interface
  - Dontaudit sys_ptrace capability for iscsid
  - Fixes for nagios plugin policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.10-7
changelog:
  - Fix the label for wicd log
  - plymouthd creates force-display-on-active-vt file
  - Allow avahi to request the kernel to load a module
  - Dontaudit hal leaks
  - Fix gnome_manage_data interface
  - Add new interface corenet_packet to define a type as being an packet_type.
  - Removed general access to packet_type from icecast and squid.
  - Allow mpd to read alsa config
  - Fix the label for wicd log
  - Add systemd policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.10-10
changelog:
  - Fixes for clamscan and boinc policy
  - Add boinc_project_t setpgid
  - Allow alsa to create tmp files in /tmp


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.10-11
changelog:
  - Turn on systemd policy
  - mozilla_plugin needs to read certs in the homedir.
  - Dontaudit leaked file descriptors from devicekit
  - Fix ircssi to use auth_use_nsswitch
  - Change to use interface without param in corenet to disable unlabelednet packets
  - Allow init to relabel sockets and fifo files in /dev
  - certmonger needs dac* capabilities to manage cert files not owned by root
  - dovecot needs fsetid to change group membership on mail
  - plymouthd removes /var/log/boot.log
  - systemd is creating symlinks in /dev
  - Change label on /etc/httpd/alias to be all cert_t


author: Dan Walsh <dwalsh@redhat.com> 3.9.10-12
changelog:
  - Allow domains that transition to ping or traceroute, kill them
  - Allow user_t to conditionally transition to ping_t and traceroute_t
  - Add fixes to systemd- tools, including new labeling for systemd-fsck, systemd-cryptsetup


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.10-13
changelog:
  - Allow sandbox to run on nfs partitions, fixes for systemd_tmpfs
  - remove per sandbox domains devpts types
  - Allow dkim-milter sending signal to itself


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.12-1
changelog:
  - Update to upstream
  - Fixes for systemd policy
  - Fixes for passenger policy
  - Allow staff users to run mysqld in the staff_t domain, akonadi needs this
  - Add bin_t label for /usr/share/kde4/apps/kajongg/kajongg.py
  - auth_use_nsswitch does not need avahi to read passwords,needed for resolving data
  - Dontaudit (xdm_t) gok attempting to list contents of /var/account
  - Telepathy domains need to read urand
  - Need interface to getattr all file classes in a mock library for setroubleshoot


author: Dan Walsh <dwalsh@redhat.com> 3.9.12-2
changelog:
  - New labels for ghc http content
  - nsplugin_config needs to read urand, lvm now calls setfscreate to create dev
  - pm-suspend now creates log file for append access so we remove devicekit_wri
  - Change authlogin_use_sssd to authlogin_nsswitch_use_ldap
  - Fixes for greylist_milter policy


author: Dan Walsh <dwalsh@redhat.com> 3.9.12-3
changelog:
  - Allow xdm and syslog to use /var/log/boot.log
  - Allow users to communicate with mozilla_plugin and kill it
  - Add labeling for ipv6 and dhcp


author: Dan Walsh <dwalsh@redhat.com> 3.9.12-4
changelog:
  - Gnome apps list config_home_t
  - mpd creates lnk files in homedir
  - apache leaks write to mail apps on tmp files
  - /var/stockmaniac/templates_cache contains log files
  - Abrt list the connects of mount_tmp_t dirs
  - passwd agent reads files under /dev and reads utmp file
  - squid apache script connects to the squid port
  - fix name of plymouth log file
  - teamviewer is a wine app
  - allow dmesg to read system state
  - Stop labeling files under /var/lib/mock so restorecon will not go into this 
  - nsplugin needs to read network state for google talk


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.12-5
changelog:
  - Add initial policy for system-setup-keyboard which is now daemon
  - Label /var/lock/subsys/shorewall as shorewall_lock_t
  - Allow users to communicate with the gpg_agent_t
  - Dontaudit mozilla_plugin_t using the inherited terminal
  - Allow sambagui to read files in /usr
  - webalizer manages squid log files
  - Allow unconfined domains to bind ports to raw_ip_sockets
  - Allow abrt to manage rpm logs when running yum
  - Need labels for /var/run/bittlebee
  - Label .ssh under amanda
  - Remove unused genrequires for virt_domain_template
  - Allow virt_domain to use fd inherited from virtd_t
  - Allow iptables to read shorewall config


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.12-6
changelog:
  - Add firewalld policy
  - Allow vmware_host to read samba config
  - Kernel wants to read /proc Fix duplicate grub def in cobbler
  - Chrony sends mail, executes shell, uses fifo_file and reads /proc
  - devicekitdisk getattr all file systems
  - sambd daemon writes wtmp file
  - libvirt transitions to dmidecode


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.12-7
changelog:
  - gnomeclock executes a shell
  - Update for screen policy to handle pipe in homedir
  - Fixes for polyinstatiated homedir
  - Fixes for namespace policy and other fixes related to polyinstantiation
  - Add namespace policy
  - Allow dovecot-deliver transition to sendmail which is needed by sieve scripts
  - Fixes for init, psad policy which relate with confined users
  - Do not audit bootloader attempts to read devicekit pid files
  - Allow nagios service plugins to read /proc


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.12-8
changelog:
  - Add oracle ports and allow apache to connect to them if the connect_db boolean is turned on
  - Add puppetmaster_use_db boolean
  - Fixes for zarafa policy
  - Fixes for gnomeclock poliy
  - Fix systemd-tmpfiles to use auth_use_nsswitch


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.13-3
changelog:
  - NetworkManager wants to read consolekit_var_run_t
  - Allow readahead to create /dev/.systemd/readahead
  - Remove permissive domains
  - Allow newrole to run namespace_init


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.13-4
changelog:
  - nslcd needs setsched and to read /usr/tmp
  - Invalid call in likewise policy ends up creating a bogus role
  - Cannon puts content into /var/lib/bjlib that cups needs to be able to write
  - Allow screen to create screen_home_t in /root
  - dirsrv sends syslog messages
  - pinentry reads stuff in .kde directory
  - Add labels for .kde directory in homedir
  - Treat irpinit, iprupdate, iprdump services with raid policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.13-5
changelog:
  - Allow nagios plugin to read /proc/meminfo
  - Fix for mozilla_plugin
  - Allow samba_net_t to create /etc/keytab
  - pppd_t setting up vpns needs to run unix_chkpwd, setsched its process and write wtmp_t
  - nslcd can read user credentials
  - Allow nsplugin to delete mozilla_plugin_tmpfs_t
  - abrt tries to create dir in rpm_var_lib_t
  - virt relabels fifo_files
  - sshd needs to manage content in fusefs homedir
  - mock manages link files in cache dir


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.13-6
changelog:
  - Fix xserver_dontaudit_read_xdm_pid
  - Change oracle_port_t to oracledb_port_t to prevent conflict with satellite
  - Allow dovecot_deliver_t to read/write postfix_master_t:fifo_file. 
  	* These fifo_file is passed from postfix_master_t to postfix_local_t to dovecot_deliver_t
  - Allow readahead to manage readahead pid dirs
  - Allow readahead to read all mcs levels
  - Allow mozilla_plugin_t to use nfs or samba homedirs


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.13-7
changelog:
  - ricci_modclusterd_t needs to bind to rpc ports 500-1023
  - Allow dbus to use setrlimit to increase resoueces
  - Mozilla_plugin is leaking to sandbox
  - Allow confined users  to connect to lircd over unix domain stream socket which allow to use remote control
  - Allow awstats to read squid logs
  - seunshare needs to manage tmp_t
  - apcupsd cgi scripts have a new directory


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.13-9
changelog:
  - syslog_t needs syslog capability
  - dirsrv needs to be able to create /var/lib/snmp
  - Fix labeling for dirsrv
  - Fix for dirsrv policy missing manage_dirs_pattern
  - corosync needs to delete clvm_tmpfs_t files
  - qdiskd needs to list hugetlbfs
  - Move setsched to sandbox_x_domain, so firefox can run without network access
  - Allow hddtemp to read removable devices
  - Adding syslog and read_policy permissions to policy
  	* syslog
  		Allow unconfined, sysadm_t, secadm_t, logadm_t
  	* read_policy
  		allow unconfined, sysadm_t, secadm_t, staff_t on Targeted
  		allow sysadm_t (optionally), secadm_t on MLS
  - mdadm application will write into /sys/.../uevent whenever arrays are
  assembled or disassembled.


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.13-10
changelog:
  - New labeling for postfmulti #675654
  - dontaudit xdm_t listing noxattr file systems
  - dovecot-auth needs to be able to connect to mysqld via the network as well as locally
  - shutdown is passed stdout to a xdm_log_t file
  - smartd creates a fixed disk device
  - dovecot_etc_t contains a lnk_file that domains need to read
  - mount needs to be able to read etc_runtim_t:lnk_file since in rawhide this is a link created at boot


author: Dan Walsh <dwalsh@redhat.com> 3.9.14-1
changelog:
  - Update to ref policy
  - cgred needs chown capability
  - Add /dev/crash crash_dev_t
  - systemd-readahead wants to use fanotify which means readahead_t needs sys_admin capability


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.15-2
changelog:
  - Allow usbhid-ups to read hardware state information
  - systemd-tmpfiles has moved
  - Allo cgroup to sys_tty_config
  - For some reason prelink is attempting to read gconf settings
  - Add allow_daemons_use_tcp_wrapper boolean
  - Add label for ~/.cache/wocky to make telepathy work in enforcing mode
  - Add label for char devices /dev/dasd*
  - Fix for apache_role
  - Allow amavis to talk to nslcd
  - allow all sandbox to read selinux poilcy config files
  - Allow cluster domains to use the system bus and send each other dbus messages


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.15-5
changelog:
  - gpg_t needs to talk to gnome-keyring
  - nscd wants to read /usr/tmp->/var/tmp to generate randomziation in unixchkpwd
  - enforce MCS labeling on nodes
  - Allow arpwatch to read meminfo
  - Allow gnomeclock to send itself signals
  - init relabels /dev/.udev files on boot
  - gkeyringd has to transition back to staff_t when it runs commands in bin_t or shell_exec_t
  - nautilus checks access on /media directory before mounting usb sticks, dontaudit access_check on mnt_t
  - dnsmasq can run as a dbus service, needs acquire service
  - mysql_admin should  be allowed to connect to mysql service
  - virt creates monitor sockets in the users home dir


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-1
changelog:
  - Update to upstream
  - Fixes for telepathy
  - Add port defition for ssdp port
  - add policy for /bin/systemd-notify from Dan
  - Mount command requires users read mount_var_run_t
  - colord needs to read konject_uevent_socket
  - User domains connect to the gkeyring socket
  - Add colord policy and allow user_t and staff_t to dbus chat with it
  - Add lvm_exec_t label for kpartx
  - Dontaudit reading the mail_spool_t link from sandbox -X
  - systemd is creating sockets in avahi_var_run and system_dbusd_var_run


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-2
changelog:
  - Add policykit fixes from Tim Waugh
  - dontaudit sandbox domains sandbox_file_t:dir mounton
  - Add new dontaudit rules for sysadm_dbusd_t
  - Change label for /var/run/faillock
  	* other fixes which relate with this change


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-3
changelog:
  - mozilla_plugin_tmp_t needs to be treated as user tmp files
  - More dontaudits of writes from readahead
  - Dontaudit readahead_t file_type:dir write, to cover up kernel bug
  - systemd_tmpfiles needs to relabel faillog directory as well as the file
  - Allow hostname and consoletype to r/w inherited initrc_tmp_t files handline hostname >> /tmp/myhost


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-4
changelog:
  - Initial policy for matahari
  - Add dev_read_watchdog
  - Allow clamd to connect clamd port
  - Add support for kcmdatetimehelper
  - Allow shutdown to setrlimit and sys_nice
  - Allow systemd_passwd to talk to /dev/log before udev or syslog is running
  - Purge chr_file and blk files on /tmp
  - Fixes for pads
  - Fixes for piranha-pulse
  - gpg_t needs to be able to encyprt anything owned by the user


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-5
changelog:
  - Fix multiple specification for boot.log
  - devicekit leaks file descriptors to setfiles_t
  - Change all all_nodes to generic_node and all_if to generic_if
  - Should not use deprecated interface
  - Switch from using all_nodes to generic_node and from all_if to generic_if
  - Add support for xfce4-notifyd
  - Fix file context to show several labels as SystemHigh
  - seunshare needs to be able to mounton nfs/cifs/fusefs homedirs
  - Add etc_runtime_t label for /etc/securetty
  - Fixes to allow xdm_t to start gkeyringd_USERTYPE_t directly
  - login.krb needs to be able to write user_tmp_t
  - dirsrv needs to bind to port 7390 for dogtag
  - Fix a bug in gpg policy
  - gpg sends audit messages
  - Allow qpid to manage matahari files


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-7
changelog:
  - Allow $1_sudo_t and $1_su_t open access to user terminals
  - Allow initrc_t to use generic terminals
  - Make Makefile/Rules.modular run sepolgen-ifgen during build to check if files for bugs
  -systemd is going to be useing /run and /run/lock for early bootup files.
  - Fix some comments in rlogin.if
  - Add policy for KDE backlighthelper
  - sssd needs to read ~/.k5login in nfs, cifs or fusefs file systems
  - sssd wants to read .k5login file in users homedir
  - setroubleshoot reads executables to see if they have TEXTREL
  - Add /var/spool/audit support for new version of audit
  - Remove kerberos_connect_524() interface calling
  - Combine kerberos_master_port_t and kerberos_port_t
  - systemd has setup /dev/kmsg as stderr for apps it executes
  - Need these access so that init can impersonate sockets on unix_dgram_socket


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-10
changelog:
  - Add file_contexts.subs to handle /run and /run/lock
  - Add other fixes relating to /run changes from F15 policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-12
changelog:
  - Add /var/run/lock /var/lock definition to file_contexts.subs
  - nslcd_t is looking for kerberos cc files
  - SSH_USE_STRONG_RNG is 1 which requires /dev/random
  - Fix auth_rw_faillog definition
  - Allow sysadm_t to set attributes on fixed disks
  - allow user domains to execute lsof and look at application sockets
  - prelink_cron job calls telinit -u if init is rewritten
  - Fixes to run qemu_t from staff_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-14
changelog:
  - Add Dan's patch to remove 64 bit variants
  - Allow colord to use unix_dgram_socket 
  - Allow apps that search pids to read /var/run if it is a lnk_file 
  - iscsid_t creates its own directory 
  - Allow init to list var_lock_t dir 
  - apm needs to verify user accounts auth_use_nsswitch
  - Add labeling for systemd unit files
  - Allow gnomeclok to enable ntpd service using systemctl - systemd_systemctl_t domain was added
  - Add label for matahari-broker.pid file
  - We want to remove untrustedmcsprocess from ability to read /proc/pid
  - Fixes for matahari policy
  - Allow system_tmpfiles_t to delete user_home_t files in the /tmp dir
  - Allow sshd to transition to sysadm_t if ssh_sysadm_login is turned on


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-15
changelog:
  - xdm_t needs getsession for switch user 
  - Every app that used to exec init is now execing systemdctl 
  - Allow squid to manage krb5_host_rcache_t files 
  - Allow foghorn to connect to agentx port - Fixes for colord policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-16
changelog:
  - Fixes for zarafa policy
  - Add support for AEOLUS project
  - Change labeling of fping6
  - Allow plymountd to send signals to init
  - Allow initrc_t domain to manage abrt pid files
  - Virt_admin should be allowed to manage images and processes


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-17
changelog:
  - Add support for ABRT retrace server
  - Allow user_t and staff_t access to generic scsi to handle locally plugged in scanners
  - Allow telepath_msn_t to read /proc/PARENT/cmdline
  - ftpd needs kill capability
  - Allow telepath_msn_t to connect to sip port
  - keyring daemon does not work on nfs homedirs
  - Allow $1_sudo_t to read default SELinux context
  - Add label for tgtd sock file in /var/run/
  - Add apache_exec_rotatelogs interface
  - allow all zaraha domains to signal themselves, server writes to /tmp
  - Allow syslog to read the process state
  - Add label for /usr/lib/chromium-browser/chrome
  - Remove the telepathy transition from unconfined_t
  - Dontaudit sandbox domains trying to mounton sandbox_file_t, this is caused by fuse mounts
  - Allow initrc_t domain to manage abrt pid files
  - Add support for AEOLUS project
  - Virt_admin should be allowed to manage images and processes
  - Allow plymountd to send signals to init
  - Change labeling of fping6


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-18
changelog:
  - Allow init_t getcap and setcap
  - Allow namespace_init_t to use nsswitch
  - aisexec will execute corosync
  - colord tries to read files off noxattr file systems
  - Allow init_t getcap and setcap


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-19
changelog:
  - Forard port changes from F15 for telepathy
  - NetworkManager should be allowed to use /dev/rfkill
  - Fix dontaudit messages to say Domain to not audit
  - Allow telepathy domains to read/write gnome_cache files
  - Allow telepathy domains to call getpw
  - Fixes for colord and vnstatd policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-20
changelog:
  - Fix label for /usr/share/munin/plugins/munin_* plugins
  - Add support for zarafa-indexer
  - Fix boolean description
  - Allow colord to getattr on /proc/scsi/scsi
  - Add label for /lib/upstart/init
  - Colord needs to list /mnt


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-21
changelog:
  - Dontaudit sys_module for ifconfig
  - Make telepathy and gkeyringd daemon working with confined users
  - colord wants to read files in users homedir
  - Remote login should be creating user_tmp_t not its own tmp files


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-22
changelog:
  - Allow logrotate to execute systemctl
  - Allow nsplugin_t to getattr on gpmctl
  - Fix dev_getattr_all_chr_files() interface
  - Allow shorewall to use inherited terms
  - Allow userhelper to getattr all chr_file devices
  - sandbox domains should be able to getattr and dontaudit search of sysctl_kernel_t
  - Fix labeling for ABRT Retrace Server


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-25
changelog:
  - Fixes for sanlock policy
  - Fixes for colord policy
  - Other fixes
  	* http://git.fedorahosted.org/git/?p=selinux-policy.git;a=log


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-26
changelog:
  - Add mailscanner policy from dgrift
  - Allow chrome to optionally be transitioned to
  - Zabbix needs these rules when starting the zabbix_server_mysql
  - Implement a type for freedesktop openicc standard (~/.local/share/icc)
  - Allow system_dbusd_t to read inherited icc_data_home_t files.
  - Allow colord_t to read icc_data_home_t content. #706975
  - Label stuff under /usr/lib/debug as if it was labeled under /


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-27
changelog:
  - Fixes for zabbix
  - init script needs to be able to manage sanlock_var_run_...
  - Allow sandlock and wdmd to create /var/run directories... 
  - mixclip.so has been compiled correctly
  - Fix passenger policy module name


author: Miroslav Grepl <mgrepl@redhat.com> 3.9.16-29
changelog:
  - Add dspam policy
  - Add lldpad policy
  - dovecot auth wants to search statfs #713555
  - Allow systemd passwd apps to read init fifo_file
  - Allow prelink to use inherited terminals
  - Run cherokee in the httpd_t domain
  - Allow mcs constraints on node connections
  - Implement pyicqt policy
  - Fixes for zarafa policy
  - Allow cobblerd to send syslog messages


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-2
changelog:
  - Change usbmuxd_t to dontaudit attempts to read chr_file
  - Add mysld_safe_exec_t for libra domains to be able to start private mysql domains
  - Allow pppd to search /var/lock dir
  - Add rhsmcertd policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-3
changelog:
  - A lot of users are running yum -y update while in /root which is causing ldconfig to list the contents, adding dontaudit
  - Allow colord to interact with the users through the tmpfs file system
  - Since we changed the label on deferred, we need to allow postfix_qmgr_t to be able to create maildrop_t files
  - Add label for /var/log/mcelog
  - Allow asterisk to read /dev/random if it uses TLS
  - Allow colord to read ini files which are labeled as bin_t
  - Allow dirsrvadmin sys_resource and setrlimit to use ulimit
  - Systemd needs to be able to create sock_files for every label in /var/run directory, cupsd being the first.  
  - Also lists /var and /var/spool directories
  - Add openl2tpd to l2tpd policy
  - qpidd is reading the sysfs file


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-4
changelog:
  - Allow setsched for virsh
  - Systemd needs to impersonate cups, which means it needs to create tcp_sockets in cups_t domain, as well as manage spool directories
  - iptables: the various /sbin/ip6?tables.* are now symlinks for
  /sbin/xtables-multi


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-5
changelog:
  - Initial systemd_logind policy
  - Add policy for systemd_logger and additional proivs for systemd_logind
  - More fixes for systemd policies


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-6
changelog:
  - Add initial policy for abrt_dump_oops_t
  - xtables-multi wants to getattr of the proc fs
  - Smoltclient is connecting to abrt
  - Dontaudit leaked file descriptors to postdrop
  - Allow abrt_dump_oops to look at kernel sysctls
  - Abrt_dump_oops_t reads kernel ring buffer
  - Allow mysqld to request the kernel to load modules
  - systemd-login needs fowner
  - Allow postfix_cleanup_t to searh maildrop


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-8
changelog:
  - Fix oracledb_port definition
  - Allow mount to mounton the selinux file system
  - Allow users to list /var directories


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-9
changelog:
  - Allow systemd_logind to send dbus messages with users
  - allow accountsd to read wtmp file
  - Allow dhcpd to get and set capabilities


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-10
changelog:
  - Allow rcsmcertd to perform DNS name resolution
  - Add dirsrvadmin_unconfined_script_t domain type for 389-ds admin scripts
  - Allow tmux to run as screen
  - New policy for collectd
  - Allow gkeyring_t to interact with all user apps
  - Add rules to allow firstboot to run on machines with the unconfined.pp module removed


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-13
changelog:
  - Add abrt_domain attribute
  - Allow corosync to manage cluster lib files
  - Allow corosync to connect to the system DBUS


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-16
changelog:
  - fetchmail can use kerberos
  - ksmtuned reads in shell programs
  - gnome_systemctl_t reads the process state of ntp
  - dnsmasq_t asks the kernel to load multiple kernel modules
  - Add rules for domains executing systemctl
  - Bogus text within fc file


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-18
changelog:
  - Turn on allow_domain_fd_use boolean on F16
  - Allow syslog to manage all log files
  - Add use_fusefs_home_dirs boolean for chrome
  - Make vdagent working with confined users
  - Add abrt_handle_event_t domain for ABRT event scripts
  - Labeled /usr/sbin/rhnreg_ks as rpm_exec_t and added changes related to this change
  - Allow httpd_git_script_t to read passwd data
  - Allow openvpn to set its process priority when the nice parameter is used


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-19
changelog:
  - Add policy for sa-update being run out of cron jobs
  - Add create perms to postgresql_manage_db
  - ntpd using a gps has to be able to read/write generic tty_device_t
  - If you disable unconfined and unconfineduser, rpm needs more privs to manage /dev
  - fix spec file
  - Remove qemu_domtrans_unconfined() interface
  - Make passenger working together with puppet
  - Add init_dontaudit_rw_stream_socket interface
  - Fixes for wordpress


author: Dan Walsh <dwalsh@redhat.com> 3.10.0-20
changelog:
  - Make users_extra and seusers.final into config(noreplace) so semanage users and login does not get overwritten


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-21
changelog:
  - Allow insmod_t to use fds leaked from devicekit
  - dontaudit getattr between insmod_t and init_t unix_stream_sockets
  - Change sysctl unit file interfaces to use systemctl
  - Add support for chronyd unit file
  - Allow mozilla_plugin to read gnome_usr_config
  - Add policy for new gpsd
  - Allow cups to create kerberos rhost cache files
  - Add authlogin_filetrans_named_content, to unconfined_t to make sure shadow and other log files get labeled correctly


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-22
changelog:
  - Allow Postfix to deliver to Dovecot LMTP socket
  - Ignore bogus sys_module for lldpad
  - Allow chrony and gpsd to send dgrams, gpsd needs to write to the real time clock
  - systemd_logind_t sets the attributes on usb devices
  - Allow hddtemp_t to read etc_t files
  - Add permissivedomains module
  - Move all permissive domains calls to permissivedomain.te
  - Allow pegasis to send kill signals to other UIDs


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-23
changelog:
  - Add glance policy
  - Allow mdadm setsched
  - /var/run/initramfs should not be relabeled with a restorecon run
  - memcache can be setup to override sys_resource
  - Allow httpd_t to read tetex data
  - Allow systemd_tmpfiles to delete kernel modules left in /tmp directory.


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-24
changelog:
  - pki needs another port
  - Add more labels for cluster scripts
  - Fix label on nfs-utils scripts directories
  - Fixes for cluster
  - Allow gatherd to read /dev/rand and /dev/urand
  - abrt leaks fifo files


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-25
changelog:
  - Add exim_exec_t label for /usr/sbin/exim_tidydb
  - Call init_dontaudit_rw_stream_socket() interface in mta policy
  - sssd need to search /var/cache/krb5rcache directory
  - Allow corosync to relabel own tmp files
  - Allow zarafa domains to send system log messages
  - Allow ssh to do tunneling
  - Allow initrc scripts to sendto init_t unix_stream_socket
  - Changes to make sure dmsmasq and virt directories are labeled correctly
  - Changes needed to allow sysadm_t to manage systemd unit files
  - init is passing file descriptors to dbus and on to system daemons
  - Allow sulogin additional access Reported by dgrift and Jeremy Miller
  - Steve Grubb believes that wireshark does not need this access
  - Fix /var/run/initramfs to stop restorecon from looking at
  - pki needs another port
  - Add more labels for cluster scripts
  - Allow apps that manage cgroup_files to manage cgroup link files
  - Fix label on nfs-utils scripts directories
  - Allow gatherd to read /dev/rand and /dev/urand


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-26
changelog:
  - removing unconfined_notrans_t no longer necessary
  - Clean up handling of secure_mode_insmod and secure_mode_policyload
  - Remove unconfined_mount_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-27
changelog:
  -  Allow collectd to read hardware state information
  - Add loop_control_device_t
  - Allow mdadm to request kernel to load module
  - Allow domains that start other domains via systemctl to search unit dir
  - systemd_tmpfiles, needs to list any file systems mounted on /tmp
  - No one can explain why radius is listing the contents of /tmp, so we will dontaudit
  - If I can manage etc_runtime files, I should be able to read the links
  - Dontaudit hostname writing to mock library chr_files
  - Have gdm_t setup labeling correctly in users home dir
  - Label content unde /var/run/user/NAME/dconf as config_home_t
  - Allow sa-update to execute shell
  - Make ssh-keygen working with fips_enabled
  - Make mock work for staff_t user
  - Tighten security on mock_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-28
changelog:
  - Allow systemd-tmpfiles to set the correct labels on /var/run, /tmp and other files
  - We want any file type that is created in /tmp by a process running as initrc_t to be labeled initrc_tmp_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-29
changelog:
  - Allow sanlock to manage virt lib files
  - Add virt_use_sanlock booelan
  - ksmtuned is trying to resolve uids
  - Make sure .gvfs is labeled user_home_t in the users home directory
  - Sanlock sends kill signals and needs the kill capability
  - Allow mockbuild to work on nfs homedirs
  - Fix kerberos_manage_host_rcache() interface
  - Allow exim to read system state


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-33
changelog:
  - Change screen to use screen_domain attribute and allow screen_domains to read all process domain state
  - Add SELinux support for ssh pre-auth net process in F17
  - Add logging_syslogd_can_sendmail boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-34
changelog:
  - Make mta_role() active
  - Allow asterisk to connect to jabber client port
  - Allow procmail to read utmp
  - Add NIS support for systemd_logind_t
  - Allow systemd_logind_t to manage /run/user/$USER/dconf dir which is labeled as config_home_t
  - Fix systemd_manage_unit_dirs() interface
  - Allow ssh_t to manage directories passed into it
  - init needs to be able to create and delete unit file directories
  - Fix typo in apache_exec_sys_script
  - Add ability for logrotate to transition to awstat domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-34.3
changelog:
  - Add support for Clustered Samba commands
  - Allow ricci_modrpm_t to send log msgs
  - move permissive virt_qmf_t from virt.te to permissivedomains.te
  - Allow ssh_t to use kernel keyrings
  - Add policy for libvirt-qmf and more fixes for linux containers
  - Initial Polipo
  - Sanlock needs to run ranged in order to kill svirt processes
  - Allow smbcontrol to stream connect to ctdbd


author: Dan Walsh <dwalsh@redhat.com> 3.10.0-34.4
changelog:
  - Fixes caused by the labeling of /etc/passwd
  - Add thumb.patch to transition unconfined_t to thumb_t for Rawhide


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-36
changelog:
  - Allow logrotate setuid and setgid since logrotate is supposed to do it
  - Fixes for thumb policy by grift
  - Add new nfsd ports
  - Added fix to allow confined apps to execmod on chrome
  - Add labeling for additional vdsm directories
  - Allow Exim and Dovecot SASL
  - Add label for /var/run/nmbd
  - Add fixes to make virsh and xen working together
  - Colord executes ls
  - /var/spool/cron  is now labeled as user_cron_spool_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-37
changelog:
  - Allow nmbd to manage sock file in /var/run/nmbd
  - ricci_modservice send syslog msgs
  - Stop transitioning from unconfined_t to ldconfig_t, but make sure /etc/ld.so.cache is labeled correctly
  - Allow systemd_logind_t to manage /run/USER/dconf/user


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-38
changelog:
  - Allow virsh to read xenstored pid file
  - Backport corenetwork fixes from upstream
  - Do not audit attempts by thumb to search config_home_t dirs (~/.config)
  - label ~/.cache/telepathy/logger telepathy_logger_cache_home_t
  - allow thumb to read generic data home files (mime.type)


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-39
changelog:
  - Fixes for bootloader policy
  - $1_gkeyringd_t needs to read $HOME/%USER/.local/share/keystore
  - Allow nsplugin to read /usr/share/config
  - Allow sa-update to update rules
  - Add use_fusefs_home_dirs for chroot ssh option
  - Fixes for grub2
  - Update systemd_exec_systemctl() interface
  - Allow gpg to read the mail spool
  - More fixes for sa-update running out of cron job
  - Allow ipsec_mgmt_t to read hardware state information
  - Allow pptp_t to connect to unreserved_port_t
  - Dontaudit getattr on initctl in /dev from chfn
  - Dontaudit getattr on kernel_core from chfn
  - Add systemd_list_unit_dirs to systemd_exec_systemctl call
  - Fixes for collectd policy
  - CHange sysadm_t to create content as user_tmp_t under /tmp


author: Dan Walsh <dwalsh@redhat.com> 3.10.0-39.1
changelog:
  - Remove allow_ptrace and replace it with deny_ptrace, which will remove all 
  ptrace from the system
  - Remove 2000 dontaudit rules between confined domains on transition
  and replace with single
  dontaudit domain domain:process { noatsecure siginh rlimitinh } ;


author: Dan Walsh <dwalsh@redhat.com> 3.10.0-39.3
changelog:
  - Move dontaudit sys_ptrace line from permissive.te to domain.te
  - Remove policy for hal, it no longer exists


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-40
changelog:
  - Dontaudit access checks for all executables, gnome-shell is doing access(EXEC, X_OK)
  - Make corosync to be able to relabelto cluster lib fies
  - Allow samba domains to search /var/run/nmbd
  - Allow dirsrv to use pam
  - Allow thumb to call getuid
  - chrome less likely to get mmap_zero bug so removing dontaudit
  - gimp help-browser has built in javascript
  - Best guess is that devices named /dev/bsr4096 should be labeled as cpu_device_t
  - Re-write glance policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-41
changelog:
  - Allow svirt_lxc_domain to chr_file and blk_file devices if they are in the domain
  - Allow init process to setrlimit on itself
  - Take away transition rules for users executing ssh-keygen
  - Allow setroubleshoot_fixit_t to read /dev/urand
  - Allow sshd to relbale tunnel sockets
  - Allow fail2ban domtrans to shorewall in the same way as with iptables
  - Add support for lnk files in the /var/lib/sssd directory
  - Allow system mail to connect to courier-authdaemon over an unix stream socket


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-47
changelog:
  - Fixes for cloudform policies which need to connect to random ports
  - Make sure if an admin creates modules content it creates them with the correct label
  - Add port 8953 as a dns port used by unbound
  - Fix file name transition for alsa and confined users


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-48
changelog:
  - Allow named to connect to dirsrv by default
  - add ldapmap1_0 as a krb5_host_rcache_t file
  - Google chrome developers asked me to add bootstrap policy for nacl stuff
  - Allow rhev_agentd_t to getattr on mountpoints
  - Postfix_smtpd_t needs access to milters and cleanup seems to read/write postfix_smtpd_t unix_stream_sockets


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-49
changelog:
  - Change bootstrap name to nacl
  - Chrome still needs execmem
  - Missing role for chrome_sandbox_bootstrap
  - Add boolean to remove execmem and execstack from virtual machines
  - Dontaudit xdm_t doing an access_check on etc_t directories


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-50
changelog:
  - Allow policykit to talk to the systemd via dbus
  - Move chrome_sandbox_nacl_t to permissive domains
  - Additional rules for chrome_sandbox_nacl


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-51
changelog:
  -  Begin removing qemu_t domain, we really no longer need this domain.  
  - systemd_passwd needs dac_overide to communicate with users TTY's
  - Allow svirt_lxc domains to send kill signals within their container


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-53
changelog:
  - Make nvidia* to be labeled correctly
  - Fix abrt_manage_cache() interface
  - Make filetrans rules optional so base policy will build
  - Dontaudit chkpwd_t access to inherited TTYS
  - Make sure postfix content gets created with the correct label
  - Allow gnomeclock to read cgroup
  - Fixes for cloudform policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-55
changelog:
  - Add more MCS fixes to make sandbox working
  - Make faillog MLS trusted to make sudo_$1_t working
  - Allow sandbox_web_client_t to read passwd_file_t
  - Add .mailrc file context
  - Remove execheap from openoffice domain
  - Allow chrome_sandbox_nacl_t to read cpu_info
  - Allow virtd to relabel generic usb which is need if USB device
  - Fixes for virt.if interfaces to consider chr_file as image file type


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-58
changelog:
  - Add ssh_dontaudit_search_home_dir
  - Changes to allow namespace_init_t to work
  - Add interface to allow exec of mongod, add port definition for mongod port, 27017
  - Label .kde/share/apps/networkmanagement/certificates/ as home_cert_t
  - Allow spamd and clamd to steam connect to each other
  - Add policy label for passwd.OLD
  - More fixes for postfix and postfix maildro
  - Add ftp support for mozilla plugins
  - Useradd now needs to manage policy since it calls libsemanage
  - Fix devicekit_manage_log_files() interface
  - Allow colord to execute ifconfig
  - Allow accountsd to read /sys
  - Allow mysqld-safe to execute shell
  - Allow openct to stream connect to pcscd
  - Add label for /var/run/nm-dns-dnsmasq\.conf
  - Allow networkmanager to chat with virtd_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-59
changelog:
  - Allow mcelog_t to create dir and file in /var/run and label it correctly
  - Allow dbus to manage fusefs
  - Mount needs to read process state when mounting gluster file systems
  - Allow collectd-web to read collectd lib files
  - Allow daemons and system processes started by init to read/write the unix_stream_socket passed in from as stdin/stdout/stderr
  - Allow colord to get the attributes of tmpfs filesystem
  - Add sanlock_use_nfs and sanlock_use_samba booleans
  - Add bin_t label for /usr/lib/virtualbox/VBoxManage


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-63
changelog:
  - Change port 9050 to tor_socks_port_t and then allow openvpn to connect to it
  - Allow all postfix domains to use the fifo_file
  - Allow sshd_t to getattr on all file systems in order to generate avc on nfs_t
  - Allow apmd_t to read grub.cfg
  - Let firewallgui read the selinux config
  - Allow systemd-tmpfiles to delete content in /root that has been moved to /tmp
  - Fix devicekit_manage_pid_files() interface
  - Allow squid to check the network state
  - Dontaudit colord getattr on file systems
  - Allow ping domains to read zabbix_tmp_t files


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-64
changelog:
  - Use fs_use_xattr for squashf
  -  Fix procs_type interface
  - Dovecot has a new fifo_file /var/run/dovecot/stats-mail
  - Dovecot has a new fifo_file /var/run/stats-mail
  - Colord does not need to connect to network
  - Allow system_cronjob to dbus chat with NetworkManager
  - Puppet manages content, want to make sure it labels everything correctly


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-65
changelog:
  - Fixes related to  /bin, /sbin
  - Allow abrt to getattr on blk files
  - Add type for rhev-agent log file
  - Fix labeling for /dev/dmfm
  - Dontaudit wicd leaking
  - Allow systemd_logind_t to look at process info of apps that exchange dbus messages with it
  - Label /etc/locale.conf correctly
  - Allow user_mail_t to read /dev/random
  - Allow postfix-smtpd to read MIMEDefang
  - Add label for /var/log/suphp.log
  - Allow swat_t to connect and read/write nmbd_t sock_file
  - Allow systemd-tmpfiles to setattr for /run/user/gdm/dconf
  - Allow systemd-tmpfiles to change user identity in object contexts
  - More fixes for rhev_agentd_t consolehelper policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-67
changelog:
  - Allow mozilla_plugin_t to manage mozilla_home_t
  - Allow ssh derived domain to execute ssh-keygen in the ssh_keygen_t domain
  - Add label for tumblerd


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-68
changelog:
  - Allow abrt  to request the kernel to load a module
  - Make sure mozilla content is labeled correctly
  - Allow tgtd to read system state
  - More fixes for boinc
    * allow to resolve dns name
    * re-write boinc policy to use boinc_domain attribute
  - Allow munin services plugins to use NSCD services


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-69
changelog:
  - Add label for /var/lib/iscan/interpreter
  - Dont audit writes to leaked file descriptors or redirected output for nacl
  - NetworkManager needs to write to /sys/class/net/ib*/mode


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-70
changelog:
  - Add httpd_can_connect_ldap() interface
  - apcupsd_t needs to use seriel ports connected to usb devices
  - Kde puts procmail mail directory under ~/.local/share
  - nfsd_t can trigger sys_rawio on tests that involve too many mountpoints, dontaudit for now
  - Add labeling for /sbin/iscsiuio


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-71
changelog:
  - default trans rules for Rawhide policy
  -  Make sure sound_devices controlC* are labeled correctly on creation
  - sssd now needs sys_admin
  - Allow snmp to read all proc_type
  - Allow to setup users homedir with quota.group


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-72
changelog:
  - New fix for seunshare, requires seunshare_domains to be able to mounton /
  - Allow systemctl running as logrotate_t to connect to private systemd socket
  - Allow tmpwatch to read meminfo
  - Allow rpc.svcgssd to read supported_krb5_enctype
  - Allow zarafa domains to read /dev/random and /dev/urandom
  - Allow snmpd to read dev_snmp6
  - Allow procmail to talk with cyrus
  - Add fixes for check_disk and check_nagios plugins


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-73
changelog:
  - Fixed destined form libvirt-sandbox
  - Allow apps that list sysfs to also read sympolicy links in this filesystem
  - Add ubac_constrained rules for chrome_sandbox
  - Need interface to allow domains to use tmpfs_t files created by the kernel, used by libra
  - Allow postgresql to be executed by the caller
  - Standardize interfaces of daemons 
  - Add new labeling for mm-handler
  - Allow all matahari domains to read network state and etc_runtime_t files


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-74
changelog:
  - Add labeling for /var/run/systemd/journal/syslog
  - libvirt sends signals to ifconfig
  - Allow domains that read logind session files to list them


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-75
changelog:
  - Merge systemd patch
  - systemd-tmpfiles wants to relabel /sys/devices/system/cpu/online
  - Allow deltacloudd dac_override, setuid, setgid  caps
  - Allow aisexec to execute shell
  - Add use_nfs_home_dirs boolean for ssh-keygen


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-76
changelog:
  - Setup labeling of /var/rsa and /var/lib/rsa to allow login programs to write there
  - bluetooth says they do not use /tmp and want to remove the type
  - Allow init to transition to colord
  - Mongod needs to read /proc/sys/vm/zone_reclaim_mode
  - Allow postfix_smtpd_t to connect to spamd
  - Add boolean to allow ftp to connect to all ports > 1023
  - Allow sendmain to write to inherited dovecot tmp files
  - setroubleshoot needs to be able to execute rpm to see what version of packages


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-77
changelog:
  - Treat Bip with bitlbee policy
        * Bip is an IRC proxy
  - Add port definition for interwise port
  - Add support for ipa_memcached socket
  - systemd_jounald needs to getattr on all processes
  - mdadmin fixes
       * uses getpw
  - amavisd calls getpwnam()
  - denyhosts calls getpwall()


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-79
changelog:
  - Turn on deny_ptrace boolean for the Rawhide run, so we can test this out
  - Cups exchanges dbus messages with init
  - udisk2 needs to send syslog messages
  - certwatch needs to read /etc/passwd


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-80
changelog:
  - Add zabbix_can_network boolean
  - Add httpd_can_connect_zabbix boolean
  - Prepare file context labeling for usrmove functions
  - Allow system cronjobs to read kernel network state
  - Add support for selinux_avcstat munin plugin
  - Treat hearbeat with corosync policy
  - Allow corosync to read and write to qpidd shared mem
  -  mozilla_plugin is trying to run pulseaudio 
  - Fixes for new sshd patch for running priv sep domains as the users context
  - Turn off dontaudit rules when turning on allow_ypbind
  - udev now reads /etc/modules.d directory


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-82
changelog:
  - Allow gpg and gpg_agent to store sock_file in gpg_secret_t directory
  - lxdm startup scripts should be labeled bin_t, so confined users will work
  - mcstransd now creates a pid, needs back port to F16
  - qpidd should be allowed to connect to the amqp port
  - Label devices 010-029 as usb devices
  - ypserv packager says ypserv does not use tmp_t so removing selinux policy types
  - Remove all ptrace commands that I believe are caused by the kernel/ps avcs
  - Add initial Obex policy
  - Add logging_syslogd_use_tty boolean
  - Add polipo_connect_all_unreserved bolean
  - Allow zabbix to connect to ftp port
  - Allow systemd-logind to be able to switch VTs
  - Allow apache to communicate with memcached through a sock_file


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-83
changelog:
  - Add new sysadm_secadm.pp module
  	* contains secadm definition for sysadm_t
  - Move user_mail_domain access out of the interface into the te file
  - Allow httpd_t to create httpd_var_lib_t directories as well as files
  - Allow snmpd to connect to the ricci_modcluster stream
  - Allow firewalld to read /etc/passwd
  - Add auth_use_nsswitch for colord
  - Allow smartd to read network state
  - smartdnotify needs to read /etc/group


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-85
changelog:
  - sshd fixes seem to be causing unconfined domains to dyntrans to themselves
  - fuse file system is now being mounted in /run/user
  - systemd_logind is sending signals to processes that are dbus messaging with it
  - Add support for winshadow port and allow iscsid to connect to this port
  - httpd should be allowed to bind to the http_port_t udp socket
  - zarafa_var_lib_t can be a lnk_file
  - A couple of new .xsession-errors files
  - Seems like user space and login programs need to read logind_sessions_files
  - Devicekit disk seems to be being launched by systemd
  - Cleanup handling of setfiles so most of rules in te file
  - Correct port number for dnssec
  - logcheck has the home dir set to its cache


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-86
changelog:
  - make consoletype_exec optional, so we can remove consoletype policy
  - remove unconfined_permisive.patch
  - Allow openvpn_t to inherit user home content and tmp content
  - Fix dnssec-trigger labeling
  - Turn on obex policy for staff_t
  - Pem files should not be secret
  - Add lots of rules to fix AVC's when playing with containers
  - Fix policy for dnssec
  - Label ask-passwd directories correctly for systemd


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-87
changelog:
  - Allow firewalld to read urand
  - Alias java, execmem_mono to bin_t to allow third parties
  - Add label for kmod
  - /etc/redhat-lsb contains binaries
  - Add boolean to allow gitosis to send mail
  - Add filename transition also for "event20"
  - Allow systemd_tmpfiles_t to delete all file types
  - Allow collectd to ipc_lock


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-88
changelog:
  - Need to add sys_ptrace back in since reading any content in /proc can cause these accesses
  - Add additional systemd interfaces which are needed fro *_admin interfaces
  - Fix bind_admin() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-89
changelog:
  - Allow boinc project to getattr on fs
  - Allow init to execute initrc_state_t
  - rhev-agent package was rename to ovirt-guest-agent
  - If initrc_t creates /etc/local.conf then we need to make sure it is labeled correctly
  - sytemd writes content to /run/initramfs and executes it on shutdown
  - kdump_t needs to read /etc/mtab, should be back ported to F16
  - udev needs to load kernel modules in early system boot


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-90
changelog:
  - Add proxy class and read access for gssd_proxy
  - Separate out the sharing public content booleans
  - Allow certmonger to execute a script and send signals to  apache and dirsrv to reload the certificate
  -  Add label transition for gstream-0.10 and 12
  - Add booleans to allow rsync to share nfs and cifs file sytems
  - chrome_sandbox wants to read the /proc/PID/exe file of the program that executed it
  - Fix filename transitions for cups files
  - Allow denyhosts to read "unix"
  - Add file name transition for locale.conf.new
  - Allow boinc projects to gconf config files
  - sssd needs to be able to increase the socket limit under certain loads
  - sge_execd needs to read /etc/passwd
  - Allow denyhost to check network state
  - NetworkManager needs to read sessions data
  - Allow denyhost to check network state
  - Allow xen to search virt images directories
  - Add label for /dev/megaraid_sas_ioctl_node
  - Add autogenerated man pages


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-93
changelog:
  - Add user_fonts_t alias xfs_tmp_t
  - Since depmod now runs as insmod_t we need to write to kernel_object_t
  - Allow firewalld to dbus chat with networkmanager
  - Allow qpidd to connect to matahari ports
  - policykit needs to read /proc for uses not owned by it
  - Allow systemctl apps to connecto the init stream


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-94
changelog:
  - Allow ksysguardproces to send system log msgs
  - Allow  boinc setpgid and signull
  - Allow xdm_t to sys_ptrace to run pidof command
  - Allow smtpd_t to manage spool files/directories and symbolic links
  - Add labeling for jetty
  - Needed changes to get unbound/dnssec to work with openswan


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-95
changelog:
  - Allow sysadm_u to reach system_r by default #784011
  - Allow nagios plugins to use inherited user terminals
  - Razor labeling is not used no longer
  - Add systemd support for matahari
  - Add port_types to man page, move booleans to the top, fix some english
  - Add support for matahari-sysconfig-console
  - Clean up matahari.fc
  - Fix matahari_admin() interfac
  - Add labels for/etc/ssh/ssh_host_*.pub keys


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-96
changelog:
  - Add labeling for /var/spool/postfix/dev/log
  - NM reads sysctl.conf
  - Iscsi log file context specification fix
  -  Allow mozilla plugins to send dbus messages to user domains that transition to it
  - Allow mysql to read the passwd file
  - Allow mozilla_plugin_t to create mozilla home dirs in user homedir
  - Allow deltacloud to read kernel sysctl
  - Allow postgresql_t to connectto itselfAllow postgresql_t to connectto itself
  - Allow postgresql_t to connectto itself
  - Add login_userdomain attribute for users which can log in using terminal


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-97
changelog:
  - Fix man pages fro domains
  - Add man pages for SELinux users and roles
  - Add storage_dev_filetrans_named_fixed_disk() and use it for smartmon
  - Add policy for matahari-rpcd
  - nfsd executes mount command on restart
  - Matahari domains execute renice and setsched
  - Dontaudit leaked tty in mozilla_plugin_config
  - mailman is changing to a per instance naming
  - Add 7600 and 4447 as jboss_management ports
  - Add fixes for nagios event handlers
  - Label httpd.event as httpd_exec_t, it is an apache daemon


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-98
changelog:
  - Add policy for nove-cert
  - Add labeling for nova-openstack  systemd unit files
  - Add policy for keystoke


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-99
changelog:
  - Back port some of the access that was allowed in nsplugin_t
  - Add definitiona for couchdb ports
  - Allow nagios to use inherited users ttys
  - Add git support for mock
  - Allow inetd to use rdate port
  - Add own type for rdate port
  - Allow samba to act as a portmapper
  - Dontaudit chrome_sandbox attempts to getattr on chr_files in /dev
  - New fixes needed for samba4
  - Allow apps that use lib_t to read lib_t symlinks


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-100
changelog:
  - Add additional fixes for icmp nagios plugin
  - Allow cron jobs to open fifo_files from cron, since service script opens /dev/stdin
  - Add certmonger_unconfined_exec_t
  - Make sure tap22 device is created with the correct label
  - Allow staff users to read systemd unit files
  - Merge in previously built policy
  - Arpwatch needs to be able to start netlink sockets in order to start
  - Allow cgred_t to sys_ptrace to look at other DAC Processes


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-102
changelog:
  - More fixes for boinc policy
  - Allow polipo domain to create its own cache dir and pid file
  - Add systemctl support to httpd domain
  - Add systemctl support to polipo, allow NetworkManager to manage the service
  - Add policy for jockey-backend
  - Add support for motion daemon which is now covered by zoneminder policy
  - Allow colord to read/write motion tmpfs
  - Allow vnstat to search through var_lib_t directories
  - Stop transitioning to quota_t, from init an sysadm_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-103
changelog:
  - Add a new type for /etc/firewalld and allow firewalld to write to this directory
  - Add definition for ~/Maildir, and allow mail deliver domains to write there
  - Allow polipo to run from a cron job
  - Allow rtkit to schedule wine processes
  - Allow mozilla_plugin_t to acquire a bug, and allow it to transition gnome content in the home dir to the proper label
  - Allow users domains to send signals to consolehelper domains


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-105
changelog:
  - Allow chronyd to read unix
  - Allow hpfax to read /etc/passwd
  - Add support matahari vios-proxy-* apps and add virtd_exec_t label for them
  - Allow rpcd to read quota_db_t
  - Update to man pages to match latest policy
  - Fix bug in jockey interface for sepolgen-ifgen
  - Add initial svirt_prot_exec_t policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-106
changelog:
  - Allow auditctl getcap
  - Allow vdagent to use libsystemd-login
  - Allow abrt-dump-oops to search /etc/abrt
  - Got these avc's while trying to print a boarding pass from firefox
  - Devicekit is now putting the media directory under /run/media
  - Allow thumbnailers to create content in ~/.thumbails directory
  - Add support for proL2TPd by Dominick Grift
  - Allow all domains to call getcap
  - wdmd seems to get a random chown capability check that it does not need
  - Allow vhostmd to read kernel sysctls


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-107
changelog:
  - Add numad policy and numad man page
  - Add fixes for interface bugs discovered by SEWatch
  - Add /tmp support for squid
  - Add fix for #799102
       * change default labeling for /var/run/slapd.* sockets
  - Make thumb_t as userdom_home_reader
  - label /var/lib/sss/mc same as pubconf, so getpw domains can read it
  - Allow smbspool running as cups_t to stream connect to nmbd
  - accounts needs to be able to execute passwd on behalf of users
  - Allow systemd_tmpfiles_t to delete boot flags
  - Allow dnssec_trigger to connect to apache ports
  - Allow gnome keyring to create sock_files in ~/.cache
  - google_authenticator is using .google_authenticator
  - sandbox running from within firefox is exposing more leaks
  - Dontaudit thumb to read/write /dev/card0
  - Dontaudit getattr on init_exec_t for gnomeclock_t
  - Allow certmonger to do a transition to certmonger_unconfined_t
  - Allow dhcpc setsched which is caused by nmcli
  - Add rpm_exec_t for /usr/sbin/bcfg2
  - system cronjobs are sending dbus messages to systemd_logind
  - Thumnailers read /dev/urand


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-108
changelog:
  - Add new policy and man page for bcfg2
  - cgconfig needs to use getpw calls
  - Allow domains that communicate with the keyring to use cache_home_t instead of gkeyringd_tmpt
  - gnome-keyring wants to create a directory in cache_home_t
  - sanlock calls getpw


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-109
changelog:
  - Ensure lastlog is labeled correctly
  - Allow accountsd to read /proc data about gdm
  - Add fixes for tuned
  - Add bcfg2 fixes which were discovered during RHEL6 testing
  - More fixes for gnome-keyring socket being moved
  - Run semanage as a unconfined domain, and allow initrc_t to create tmpfs_t sym links on shutdown
  - Fix description for files_dontaudit_read_security_files() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-110
changelog:
  - /var/run/postmaster.* labeling is no longer needed
  - Alllow drbdadmin to read /dev/urandom
  - l2tpd_t seems to use ptmx
  - group+ and passwd+ should be labeled as /etc/passwd
  - Zarafa-indexer is a socket


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-111
changelog:
  - Rename rdate port to time port, and allow gnomeclock to connect to it
  - We no longer need to transition to ldconfig from rpm, rpm_script, or anaconda
  - /etc/auto.* should be labeled bin_t
  - Add httpd_use_fusefs boolean
  - Add fixes for heartbeat
  - Allow sshd_t to signal processes that it transitions to
  - Add condor policy
  - Allow svirt to create monitors in ~/.libvirt
  - Allow dovecot to domtrans sendmail to handle sieve scripts
  - Lot of fixes for cfengine


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-112
changelog:
  - upowered needs to setsched on the kernel
  - Allow mpd_t to manage log files
  - Allow xdm_t to create /var/run/systemd/multi-session-x
  - Add rules for missedfont.log to be used by thumb.fc
  - Additional access required for virt_qmf_t
  - Allow dhclient to dbus chat with the firewalld
  - Add label for lvmetad
  - Allow systemd_logind_t to remove userdomain sock_files
  - Allow cups to execute usr_t files
  - Fix labeling on nvidia shared libraries
  - wdmd_t needs access to sssd and /etc/passwd
  - Add boolean to allow ftp servers to run in passive mode
  - Allow namepspace_init_t to relabelto/from a different user system_u from the user the namespace_init running with
  - Fix using httpd_use_fusefs
  - Allow chrome_sandbox_nacl to write inherited user tmp files as we allow it for chrome_sandbox


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-113
changelog:
  - Allow svirt_t to create content in the users homedir under ~/.libvirt
  - Fix label on /var/lib/heartbeat
  - Allow systemd_logind_t to send kill signals to all processes started by a user
  - Fuse now supports Xattr Support


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-114
changelog:
  - Add support for clamd+systemd
  - Allow fresclam to execute systemctl to handle clamd
  - Change labeling for /usr/sbin/rpc.ypasswd.env
  	- Allow yppaswd_t to execute yppaswd_exec_t
  	- Allow yppaswd_t to read /etc/passwd
  - Gnomekeyring socket has been moved to /run/user/USER/
  - Allow samba-net to connect to ldap port
  - Allow signal for vhostmd
  - allow mozilla_plugin_t to read user_home_t socket
  - New access required for secure Linux Containers
  - zfs now supports xattrs
  - Allow quantum to execute sudo and list sysfs
  - Allow init to dbus chat with the firewalld
  - Allow zebra to read /etc/passwd


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-115
changelog:
  - Allow condor domains to connect to ephemeral ports
  - More fixes for condor policy
  - Allow keystone to stream connect to mysqld
  - Allow mozilla_plugin_t to read generic USB device to support GPS devices
  - Allow thum to file name transition gstreamer home content
  - Allow thum to read all non security files
  - Allow glance_api_t to connect to ephemeral ports
  - Allow nagios plugins to read /dev/urandom
  - Allow syslogd to search postfix spool to support postfix chroot env
  - Fix labeling for /var/spool/postfix/dev
  - Allow wdmd chown
  - Label .esd_auth as pulseaudio_home_t
  - Have no idea why keyring tries to write to /run/user/dwalsh/dconf/user, but we can dontaudit for now


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-116
changelog:
  - More access required for virt_qmf_t
  - Additional assess required for systemd-logind to support multi-seat
  - Allow mozilla_plugin to setrlimit
  - Revert changes to fuse file system to stop deadlock


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-117
changelog:
  - Add policy for abrt-watch-log
  - Add definitions for jboss_messaging ports
  - Allow systemd_tmpfiles to manage printer devices
  - Allow oddjob to use nsswitch
  - Fix labeling of log files for postgresql
  - Allow mozilla_plugin_t to execmem and execstack by default
  - Allow firewalld to execute shell
  - Fix /etc/wicd content files to get created with the correct label
  - Allow mcelog to exec shell
  - Add ~/.orc as a gstreamer_home_t
  - /var/spool/postfix/lib64 should be labeled lib_t
  - mpreaper should be able to list all file system labeled directories
  - Add support for apache to use openstack
  - Add labeling for /etc/zipl.conf and zipl binary
  - Turn on allow_execstack and turn off telepathy transition for final release


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-118
changelog:
  - Add unconfined_execmem_exec_t as an alias to bin_t
  - Allow fenced to read snmp var lib files, also allow it to read usr_t
  - ontaudit access checks on all executables from mozilla_plugin
  - Allow all user domains to setexec, so that sshd will work properly if it call setexec(NULL) while running withing a user mode
  - Allow systemd_tmpfiles_t to getattr all pipes and sockets
  - Allow glance-registry to send system log messages
  - semanage needs to manage mock lib files/dirs


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-119
changelog:
  - Allow logrotate to getattr on systemd unit files
  - Add support for tor systemd unit file
  - Allow apmd to create /var/run/pm-utils with the correct label
  - Allow l2tpd to send sigkill to pppd
  - Allow pppd to stream connect to l2tpd
  - Add label for scripts in /etc/gdm/
  - Allow systemd_logind_t to ignore mcs constraints on sigkill
  - Fix files_filetrans_system_conf_named_files() interface
  - Add labels for /usr/share/wordpress/wp-includes/*.php
  - Allow cobbler to get SELinux mode and booleans


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-120
changelog:
  - Add clamscan_can_scan_system boolean
  - Allow mysqld to read kernel network state
  - Allow sshd to read/write condor lib files
  - Allow sshd to read/write condor-startd tcp socket
  - Fix description on httpd_graceful_shutdown
  - Allow glance_registry to communicate with mysql
  - dbus_system_domain is using systemd to lauch applications
  - add interfaces to allow domains to send kill signals to user mail agents
  - Remove unnessary access for svirt_lxc domains, add privs for virtd_lxc_t
  - Lots of new access required for secure containers
  - Corosync needs sys_admin capability
  - ALlow colord to create shm
  - .orc should be allowed to be created by any app that can create gstream home content, thumb_t to be specific
  - Add boolean to control whether or not mozilla plugins can create random content in the users homedir
  -  Add new interface to allow domains to list msyql_db directories, needed for libra
  - shutdown has to be allowed to delete etc_runtime_t
  - Fail2ban needs to read /etc/passwd
  -  Allow ldconfig to create /var/cache/ldconfig
  - Allow tgtd to read hardware state information
  - Allow collectd to create packet socket
  - Allow chronyd to send signal to itself
  - Allow collectd to read /dev/random
  - Allow collectd to send signal to itself
  - firewalld needs to execute restorecon
  - Allow restorecon and other login domains to execute restorecon


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-121
changelog:
  - Add labeling for /usr/share/jetty/bin/jetty.sh
  - Add jetty policy which contains file type definitios
  - Allow jockey to use its own fifo_file and make this the default for all domains
  - Allow mozilla_plugins to use spice (vnc_port/couchdb)
  - asterisk wants to read the network state
  - Blueman now uses /var/lib/blueman- Add label for nodejs_debug
  - Allow mozilla_plugin_t to create ~/.pki directory and content


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-122
changelog:
  - Allow jetty running as httpd_t to read hugetlbfs files
  - Allow sys_nice and setsched for rhsmcertd
  - Dontaudit attempts by mozilla_plugin_t to bind to ssdp ports
  - Allow setfiles to append to xdm_tmp_t
  - Add labeling for /export as a usr_t directory
  - Add labels for .grl files created by gstreamer


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-123
changelog:
  - Fix zarafa labeling
  - Allow guest_t to fix labeling
  - corenet_tcp_bind_all_unreserved_ports(ssh_t) should be called with the user_tcp_server boolean
  - add lxc_contexts
  - Allow accountsd to read /proc
  - Allow restorecond to getattr on all file sytems
  - tmpwatch now calls getpw
  - Allow apache daemon to transition to pwauth domain
  - Label content under /var/run/user/NAME/keyring* as gkeyringd_tmp_t
  - The obex socket seems to be a stream socket
  - dd label for /var/run/nologin


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-125
changelog:
  - Fix pulseaudio port definition
  - Add labeling for condor_starter
  - Allow chfn_t to creat user_tmp_files
  - Allow chfn_t to execute bin_t
  - Allow prelink_cron_system_t to getpw calls
  - Allow sudo domains to manage kerberos rcache files
  - Allow user_mail_domains to work with courie
  - Port definitions necessary for running jboss apps within openshift
  -  Add support for openstack-nova-metadata-api
  - Add support for nova-console*
  - Add support for openstack-nova-xvpvncproxy
  - Fixes to make privsep+SELinux working if we try to use chage to change passwd
  - Fix auth_role() interface
  - Allow numad to read sysfs
  - Allow matahari-rpcd to execute shell
  - Add label for ~/.spicec
  - xdm is executing lspci as root which is requesting a sys_admin priv but seems to succeed without it
  - Devicekit_disk wants to read the logind sessions file when writing a cd
  - Add fixes for condor to make condor jobs working correctly
  - Change label of /var/log/rpmpkgs to cron_log_t
  - Access requires to allow systemd-tmpfiles --create to work.
  - Fix obex to be a user application started by the session bus.
  - Add additional filename trans rules for kerberos
  - Fix /var/run/heartbeat labeling
  - Allow apps that are managing rcache to file trans correctly
  - Allow openvpn to authenticate against ldap server
  - Containers need to listen to network starting and stopping events


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-126
changelog:
  - Dontaudit lpr_t to read/write leaked mozilla tmp files
  - Add file name transition for .grl-podcasts directory
  - Allow corosync to read user tmp files
  - Allow fenced to create snmp lib dirs/files
  - More fixes for sge policy
  - Allow mozilla_plugin_t to execute any application
  - Allow dbus to read/write any open file descriptors to any non security file on the system that it inherits to that it can pass them to another domain
  - Allow mongod to read system state information
  -  Fix wrong type, we should dontaudit sys_admin for xdm_t not xserver_t
  - Allow polipo to manage polipo_cache dirs
  - Add jabbar_client port to mozilla_plugin_t
  - Cleanup procmail policy
  - system bus will pass around open file descriptors on files that do not have labels on them
  - Allow l2tpd_t to read system state
  - Allow tuned to run ls /dev
  - Allow sudo domains to read usr_t files
  - Add label to machine-id 
  - Fix corecmd_read_bin_symlinks cut and paste error


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-127
changelog:
  - Add policy for subversion daemon
  - Allow boinc to read passwd
  - Allow pads to read kernel network state
  - Fix man2html interface for sepolgen-ifgen
  - Remove extra /usr/lib/systemd/system/smb
  - Remove all /lib/systemd and replace with /usr/lib/systemd
  - Add policy for man2html
  - Fix the label of kerberos_home_t to krb5_home_t
  - Allow mozilla plugins to use Citrix
  - Allow tuned to read /proc/sys/kernel/nmi_watchdog
  - Allow tune /sys options via systemd's tmpfiles.d "w" type


author: Miroslav Grepl <mgrepl@redhat.com> 3.10.0-128
changelog:
  - Fix description of authlogin_nsswitch_use_ldap
  - Fix transition rule for rhsmcertd_t needed for RHEL7
  - Allow useradd to list nfs state data
  - Allow openvpn to manage its log file and directory
  - We want vdsm to transition to mount_t when executing mount command to make sure /etc/mtab remains labeled correctly
  - Allow thumb to use nvidia devices
  -  Allow local_login to create user_tmp_t files for kerberos
  - Pulseaudio needs to read systemd_login /var/run content
  - virt should only transition named system_conf_t config files
  - Allow  munin to execute its plugins
  - Allow nagios system plugin to read /etc/passwd
  - Allow plugin to connect to soundd port
  - Fix httpd_passwd to be able to ask passwords
  - Radius servers can use ldap for backing store
  - Seems to need to mount on /var/lib for xguest polyinstatiation to work.
  - Allow systemd_logind to list the contents of gnome keyring
  - VirtualGL need xdm to be able to manage content in /etc/opt/VirtualGL
  - Add policy for isns-utils


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-1
changelog:
  - Mass merge with upstream
    * new policy topology to include contrib policy modules
    * we have now two base policy patches


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-3
changelog:
  - PolicyKit path has changed
  - Allow httpd connect to dirsrv socket
  - Allow tuned to write generic kernel sysctls
  - Dontaudit logwatch to gettr on /dev/dm-2
  - Allow policykit-auth to manage kerberos files
  - Make condor_startd and rgmanager as initrc domain
  - Allow virsh to read /etc/passwd
  - Allow mount to mount on user_tmp_t for /run/user/dwalsh/gvfs
  - xdm now needs to execute xsession_exec_t
  - Need labels for /var/lib/gdm
  - Fix files_filetrans_named_content() interface
  - Add new attribute - initrc_domain
  - Allow systemd_logind_t to signal, signull, sigkill all processes
  - Add filetrans rules for etc_runtime files


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-4
changelog:
  - Add support for ecryptfs
    * ecryptfs does not support xattr
    * we need labeling for HOMEDIR
  - Add policy for (u)mount.ecryptfs*
  - Fix labeling of kerbero host cache files, allow rpc.svcgssd to manage host cache
  - Allow dovecot to manage Maildir content, fix transitions to Maildir
  - Allow postfix_local to transition to dovecot_deliver
  - Dontaudit attempts to setattr on xdm_tmp_t, looks like bogus code
  - Cleanup interface definitions
  - Allow apmd to change with the logind daemon
  - Changes required for sanlock in rhel6
  - Label /run/user/apache as httpd_tmp_t
  - Allow thumb to use lib_t as execmod if boolean turned on
  - Allow squid to create the squid directory in /var with the correct labe
  - Add a new policy for glusterd from Bryan Bickford (bbickfor@redhat.com)
  - Allow virtd to exec xend_exec_t without transition
  - Allow virtd_lxc_t to unmount all file systems


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-5
changelog:
  - apcupsd needs to read /etc/passwd
  - Sanlock allso sends sigkill
  - Allow glance_registry to connect to the mysqld port
  - Dontaudit mozilla_plugin trying to getattr on /dev/gpmctl
  - Allow firefox plugins/flash to connect to port 1234
  - Allow mozilla plugins to delete user_tmp_t files
  - Add transition name rule for printers.conf.O
  - Allow virt_lxc_t to read urand
  - Allow systemd_loigind to list gstreamer_home_dirs
  - Fix labeling for /usr/bin
  - Fixes for cloudform services
    * support FIPS
  - Allow polipo to work as web caching
  - Allow chfn to execute tmux


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-6
changelog:
  - Add tomcat policy
  - Remove pyzor/razor policy
  - rhsmcertd reads the rpm database
  - Dontaudit  thumb to setattr on xdm_tmp dir
  - Allow wicd to execute ldconfig in the networkmanager_t domain
  - Add /var/run/cherokee\.pid labeling
  - Allow mozilla_plugin to create mozilla_plugin_tmp_t lnk files too
  - Allow postfix-master to r/w pipes other postfix domains
  - Allow snort to create netlink_socket
  - Add kdumpctl policy
  - Allow firstboot to create tmp_t files/directories
  - /usr/bin/paster should not be labeled as piranha_exec_t
  - remove initrc_domain from tomcat
  - Allow ddclient to read /etc/passwd
  - Allow useradd to delete all file types stored in the users homedir
  - Allow ldconfig and insmod to manage kdumpctl tmp files
  - Firstboot should be just creating tmp_t dirs and xauth should be allowed to write to those
  - Transition xauth files within firstboot_tmp_t
  - Fix labeling of /run/media to match /media
  - Label all lxdm.log as xserver_log_t
  - Add port definition for mxi port
  - Allow local_login_t to execute tmux


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-7
changelog:
  - add ptrace_child access to process
  - remove files_read_etc_files() calling from all policies which have auth_use_nsswith()
  - Allow boinc domains to manage boinc_lib_t lnk_files
  - Add support for boinc-client.service unit file
  - Add support for boinc.log
  - Allow mozilla_plugin execmod on mozilla home files if allow_ex
  - Allow dovecot_deliver_t to read dovecot_var_run_t
  - Allow ldconfig and insmod to manage kdumpctl tmp files
  - Move thin policy out from cloudform.pp and add a new thin poli
  - pacemaker needs to communicate with corosync streams
  - abrt is now started on demand by dbus
  - Allow certmonger to talk directly to Dogtag servers
  - Change labeling for /var/lib/cobbler/webui_sessions to httpd_c
  - Allow mozila_plugin to execute gstreamer home files
  - Allow useradd to delete all file types stored in the users hom
  - rhsmcertd reads the rpm database
  - Add support for lightdm


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-8
changelog:
  - initrc is calling exportfs which is not confined so it attempts to read nfsd_files
  - Fixes for passenger running within openshift.
  - Add labeling for all tomcat6 dirs
  - Add support for tomcat6
  - Allow cobblerd to read /etc/passwd
  - Allow jockey to read sysfs and and execute binaries with bin_t
  - Allow thum to use user terminals
  - Allow cgclear to read cgconfig config files
  - Fix bcf2g.fc
  - Remove sysnet_dns_name_resolve() from policies where auth_use_nsswitch() is used for other domains
  - Allow dbomatic to execute ruby
  - abrt_watch_log should be abrt_domain
  - Allow mozilla_plugin to connect to gatekeeper port


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-9
changelog:
  - Until we figure out how to fix systemd issues, allow all apps that send syslog messages to send them to kernel_t
  - Add init_access_check() interface
  - Fix label on /usr/bin/pingus to not be labeled as ping_exec_t
  - Allow tcpdump to create a netlink_socket
  - Label newusers like useradd
  - Change xdm log files to be labeled xdm_log_t
  - Allow sshd_t with privsep to work in MLS
  - Allow freshclam to update databases thru HTTP proxy
  - Allow s-m-config to access check on systemd
  - Allow abrt to read public files by default
  - Fix amavis_create_pid_files() interface
  - Add labeling and filename transition for dbomatic.log
  - Allow system_dbusd_t to stream connect to bluetooth, and use its socket
  - Allow amavisd to execute fsav
  - Allow tuned to use sys_admin and sys_nice capabilities
  - Add php-fpm policy from Bryan
  - Add labeling for aeolus-configserver-thinwrapper
  - Allow thin domains to execute shell
  - Fix gnome_role_gkeyringd() interface description
  - Lot of interface fixes
  - Allow OpenMPI job running as condor_startd_ssh_t to manage condor lib files
  - Allow OpenMPI job to use kerberos
  - Make deltacloudd_t as nsswitch_domain
  - Allow xend_t to run lsscsi
  - Allow qemu-dm running as xend_t to create tun_socket
  - Add labeling for /opt/brother/Printers(.*/)?inf
  - Allow jockey-backend to read pyconfig-64.h labeled as usr_t
  - Fix clamscan_can_scan_system boolean
  - Allow lpr to connectto to /run/user/$USER/keyring-22uREb/pkcs11


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-10
changelog:
  - Add realmd and stapserver policies
  - Allow useradd to manage stap-server lib files
  - Tighten up capabilities for confined users
  - Label /etc/security/opasswd as shadow_t
  - Add label for /dev/ecryptfs
  - Allow condor_startd_t to start sshd with the ranged
  - Allow lpstat.cups to read fips_enabled file
  - Allow pyzor running as spamc_t to create /root/.pyzor directory
  - Add labelinf for amavisd-snmp init script
  - Add support for amavisd-snmp
  - Allow fprintd sigkill self
  - Allow xend (w/o libvirt) to start virtual machines
  - Allow aiccu to read /etc/passwd
  - Allow condor_startd to Make specified domain MCS trusted for setting any category set for the processes it executes
  - Add condor_startd_ranged_domtrans_to() interface
  - Add ssd_conf_t for /etc/sssd
  - accountsd needs to fchown some files/directories
  - Add ICACLient and zibrauserdata as mozilla_filetrans_home_content
  - SELinux reports afs_t needs dac_override to read /etc/mtab, even though everything works, adding dontaudit
  - Allow xend_t to read the /etc/passwd file


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-12
changelog:
  - Add interface to dontaudit getattr access on sysctls
  - Allow sshd to execute /bin/login
  - Looks like xdm is recreating the xdm directory in ~/.cache/ on login
  - Allow syslog to use the leaked kernel_t unix_dgram_socket from system-jounald
  -  Fix semanage to work with unconfined domain disabled on F18
  - Dontaudit attempts by mozilla plugins to getattr on all kernel sysctls
  - Virt seems to be using lock files
  - Dovecot seems to be searching directories of every mountpoint
  - Allow jockey to read random/urandom, execute shell and install third-party drivers
  - Add aditional params to allow cachedfiles to manage its content
  - gpg agent needs to read /dev/random
  - The kernel hands an svirt domains /SYSxxxxx which is a tmpfs that httpd wants to read and write
  - Add a bunch of dontaudit rules to quiet svirt_lxc domains
  - Additional perms needed to run svirt_lxc domains
  - Allow cgclear to read cgconfig
  - Allow sys_ptrace capability for snmp
  - Allow freshclam to read /proc
  - Allow procmail to manage /home/user/Maildir content
  - Allow NM to execute wpa_cli
  - Allow amavis to read clamd system state
  - Regenerate man pages


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.0-13
changelog:
  - Add systemd_logind_inhibit_var_run_t attribute
  - Remove corenet_all_recvfrom_unlabeled() for non-contrib policies because we moved it to domain.if for all domain_type
  - Add interface for mysqld to dontaudit signull to all processes
  - Label new /var/run/journal directory correctly
  - Allow users to inhibit suspend via systemd
  - Add new type for the /var/run/inhibit directory
  - Add interface to send signull to systemd_login so avahi can send them
  - Allow systemd_passwd to send syslog messages
  - Remove corenet_all_recvfrom_unlabeled() calling fro policy files
  - Allow       editparams.cgi running as httpd_bugzilla_script_t to read /etc/group
  - Allow smbd to read cluster config
  - Add additional labeling for passenger
  - Allow dbus to inhibit suspend via systemd
  - Allow avahi to send signull to systemd_login


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-1
changelog:
  - Fix saslauthd when it tries to read /etc/shadow
  - Label gnome-boxes as a virt homedir
  - Need to allow svirt_t ability to getattr on nfs_t file systems
  - Update sanlock policy to solve all AVC's
  - Change confined users can optionally manage virt content
  - Handle new directories under ~/.cache
  - Add block suspend to appropriate domains
  - More rules required for containers
  - Allow login programs to read /run/ data created by systemd_logind
  - Allow staff users to run svirt_t processes


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-2
changelog:
  - Add new type selinux_login_config_t for /etc/selinux/<type>/logins/
  - Additional fixes for seutil_manage_module_store()
  - dbus_system_domain() should be used with optional_policy
  - Fix svirt to be allowed to use fusefs file system
  - Allow login programs to read /run/ data created by systemd_login
  - sssd wants to write /etc/selinux/<policy>/logins/ for SELinux PAM module
  - Fix svirt to be allowed to use fusefs file system
  - Allow piranha domain to use nsswitch
  - Sanlock needs to send Kill Signals to non root processes
  - Pulseaudio wants to execute /run/user/PID/.orc


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-4
changelog:
  - Fix ecryptfs interfaces
  - Bootloader seems to be trolling around /dev/shm and /dev
  - init wants to create /etc/systemd/system-update.target.wants
  - Fix systemd_filetrans call to move it out of tunable
  - Fix up policy to work with systemd userspace manager
  - Add secure_firmware capability and remove bogus epolwakeup
  - Call seutil_*_login_config interfaces where should be needed
  - Allow rhsmcertd to send signal to itself
  - Allow thin domains to send signal to itself
  - Allow Chrome_ChildIO to read dosfs_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-5
changelog:
  - Put placeholder back in place for proper numbering of capabilities
  - Systemd also configures init scripts


author: Dan Walsh <dwalsh@redhat.com> 3.11.1-6
changelog:
  - Fix Boolean settings
  - Add new libjavascriptcoregtk as textrel_shlib_t
  - Allow xdm_t to create xdm_home_t directories
  - Additional access required for systemd
  - Dontaudit mozilla_plugin attempts to ipc_lock
  - Allow tmpreaper to delete unlabeled files
  - Eliminate screen_tmp_t and allow it to manage user_tmp_t
  - Dontaudit mozilla_plugin_config_t to append to leaked file descriptors
  - Allow web plugins to connect to the asterisk ports
  - Condor will recreate the lock directory if it does not exist
  - Oddjob mkhomedir needs to connectto user processes
  - Make oddjob_mkhomedir_t a userdom home manager


author: Dan Walsh <dwalsh@redhat.com> 3.11.1-7
changelog:
  - Fix bogus regex found by eparis
  - Fix manage run interface since lvm needs more access
  - syslogd is searching cgroups directory
  - Fixes to allow virt-sandbox-service to manage lxc var run content


author: Dan Walsh <dwalsh@redhat.com> 3.11.1-8
changelog:
  - Fix labeling of content in /run created by virsh_t
  - Allow condor domains to read kernel sysctls
  - Allow condor_master to connect to amqp
  - Allow thumb drives to create shared memory and semaphores
  - Allow abrt to read mozilla_plugin config files
  - Add labels for lightsquid
  - Default files in /opt and /usr that end in .cgi as httpd_sys_script_t, allow
  - dovecot_auth_t uses ldap for user auth
  - Allow domains that can read dhcp_etc_t to read lnk_files
  - Add more then one watchdog device
  - Allow useradd_t to manage etc_t files so it can rename it and edit them
  - Fix invalid class dir should be fifo_file
  - Move /run/blkid to fsadm and make sure labeling is correct


author: Dan Walsh <dwalsh@redhat.com> 3.11.1-9
changelog:
  - Allow postfix, sssd, rpcd to block_suspend
  - udev seems to need secure_firmware capability
  - Allow virtd to send dbus messages to firewalld so it can configure the firewall


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-10
changelog:
  - Make "snmpwalk -mREDHAT-CLUSTER-MIB ...." working
  - Allow dlm_controld to execute dlm_stonith labeled as bin_t
  - Allow GFS2 working on F17
  - Abrt needs to execute dmesg
  - Allow jockey to list the contents of modeprobe.d
  - Add policy for lightsquid as squid_cron_t
  - Mailscanner is creating files and directories in /tmp
  - dmesg is now reading /dev/kmsg
  - Allow xserver to communicate with secure_firmware
  - Allow fsadm tools (fsck) to read /run/mount contnet
  - Allow sysadm types to read /dev/kmsg
  -


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-11
changelog:
  - Allow svirt domains to manage the network since this is containerized
  - Allow svirt_lxc_net_t to send audit messages


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-12
changelog:
  - Add file name transitions for ttyACM0
  - spice-vdagent(d)'s are going to log over to syslog
  - Add sensord policy
  - Add more fixes for passenger policy related to puppet
  - Allow wdmd to create wdmd_tmpfs_t
  - Fix labeling for /var/run/cachefilesd\.pid
  - Add thumb_tmpfs_t files type


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-14
changelog:
  - Allow realmd to read resolv.conf
  - Add pegasus_cache_t type
  - Label /usr/sbin/fence_virtd as virsh_exec_t
  - Add policy for pkcsslotd
  - Add support for cpglockd
  - Allow polkit-agent-helper to read system-auth-ac
  - telepathy-idle wants to read gschemas.compiled
  - Allow plymouthd to getattr on fs_t
  - Add slpd policy
  - Allow ksysguardproces to read/write config_usr_t


author: Dan Walsh <dwalsh@redhat.com> 3.11.1-15
changelog:
  - Separate sandbox policy into sandbox and sandboxX, and disable sandbox by default on fresh installs
  - Allow domains that can read etc_t to read etc_runtime_t 
  - Allow all domains to use inherited tmpfiles


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-16
changelog:
  - nmbd wants to create /var/nmbd
  -  Stop transitioning out of anaconda and firstboot, just causes AVC messages
  - Allow clamscan to read /etc files
  - Allow bcfg2 to bind cyphesis port
  - heartbeat should be run as rgmanager_t instead of corosync_t
  - Add labeling for /etc/openldap/certs
  - Add labeling for /opt/sartest directory
  - Make crontab_t as userdom home reader
  - Allow tmpreaper to list admin_home dir
  - Add defition for imap_0 replay cache file
  - Add support for gitolite3
  - Allow virsh_t to send syslog messages
  - allow domains that can read samba content to be able to list the directories also
  - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd
  - Separate out sandbox from sandboxX policy so we can disable it by default
  - Run dmeventd as lvm_t
  - Mounting on any directory requires setattr and write permissions
  - Fix use_nfs_home_dirs() boolean
  - New labels for pam_krb5
  - Allow init and initrc domains to sys_ptrace since this is needed to look at processes not owned by uid 0
  - Add realmd_dbus_chat to allow all apps that use nsswitch to talk to realmd


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-17
changelog:
  - Merge openshift policy
  - Allow xauth to read /dev/urandom
  - systemd needs to relabel content in /run/systemd directories
  - Files unconfined should be able to perform all services on all files
  - Puppet tmp file can be leaked to all domains
  - Dontaudit rhsmcertd-worker to search /root/.local
  - Allow chown capability for zarafa domains
  -  Allow system cronjobs to runcon into openshift domains
  - Allow virt_bridgehelper_t to manage content in the svirt_home_t labeled directories


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-18
changelog:
  - Allow postalias to read postfix config files
  - Allow man2html to read man pages
  - Allow rhev-agentd to search all mountpoints
  - Allow rhsmcertd to read /dev/random
  - Add tgtd_stream_connect() interface
  - Add cyrus_write_data() interface
  - Dontaudit attempts by sandboxX clients connectiing to the xserver_port_t
  - Add port definition for tcp/81 as http_port_t
  - Fix /dev/twa labeling
  - Allow systemd to read modules config


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-20
changelog:
  -  Fix auth_login_pgm_domain() interface to allow domains also managed user tmp dirs because of #856880 related to pam_systemd
  - Remove pam_selinux.8 which conflicts with man page owned by the pam package
  - Allow glance-api to talk to mysql
  - ABRT wants to read Xorg.0.log if if it detects problem with Xorg
  - Fix gstreamer filename trans. interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-21
changelog:
  - Add interfaces to ignore setattr until kernel fixes this to be checked after the DAC check
  - Change pam_t to pam_timestamp_t
  - Add dovecot_domain attribute and allow this attribute block_suspend capability2
  - Add sanlock_use_fusefs boolean
  - numad wants send/recieve msg
  - Allow rhnsd to send syslog msgs
  - Make piranha-pulse as initrc domain
  - Update openshift instances to dontaudit setattr until the kernel is fixed.


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-22
changelog:
  - Stop using attributes form netlabel_peer and syslog, auth_use_nsswitch setsup netlabel_peer
  - Move netlable_peer check out of booleans
  - Remove call to recvfrom_netlabel for kerberos call
  - Remove use of attributes when calling syslog call 
  - Move -miscfiles_read_localization to domain.te to save hundreds of allow rules
  - Allow all domains to read locale files.  This eliminates around 1500 allow rules- Cleanup nis_use_ypbind_uncond interface
  - Allow rndc to block suspend
  - tuned needs to modify the schedule of the kernel
  - Allow svirt_t domains to read alsa configuration files
  - ighten security on irc domains and make sure they label content in homedir correctly
  - Add filetrans_home_content for irc files
  - Dontaudit all getattr access for devices and filesystems for sandbox domains
  - Allow stapserver to search cgroups directories
  - Allow all postfix domains to talk to spamd


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-23
changelog:
  - Fixes to safe more rules
  - Re-write tomcat_domain_template()
  - Fix passenger labeling
  - Allow all domains to read man pages
  - Add ephemeral_port_t to the 'generic' port interfaces
  - Fix the names of postgresql booleans


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-24
changelog:
  - dbus needs to start getty unit files
  - Add interface to allow system_dbusd_t to start the poweroff service
  - xdm wants to exec telepathy apps
  - Allow users to send messages to systemdlogind
  - Additional rules needed for systemd and other boot apps
  - systemd wants to list /home and /boot
  - Allow gkeyringd to write dbus/conf file
  - realmd needs to read /dev/urand
  - Allow readahead to delete /.readahead if labeled root_t, might get created before policy is loaded


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-27
changelog:
  - Remove init_systemd and init_upstart boolean, Move init_daemon_domain and init_system_domain to use attributes
  - Add attribute to all base os types.  Allow all domains to read all ro base OS types


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-29
changelog:
  -  Add mei_device_t
  - Make sure gpg content in homedir created with correct label
  - Allow dmesg to write to abrt cache files
  - automount wants to search  virtual memory sysctls
  - Add support for hplip logs stored in /var/log/hp/tmp
  - Add labeling for /etc/owncloud/config.php
  - Allow setroubleshoot to send analysys to syslogd-journal
  - Allow virsh_t to interact with new fenced daemon
  - Allow gpg to write to /etc/mail/spamassassiin directories
  - Make dovecot_deliver_t a mail server delivery type
  - Add label for /var/tmp/DNS25


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-30
changelog:
  - Add fixes for ctbd
  - Allow nmbd to stream connect to ctbd
  - Make cglear_t as nsswitch_domain
  - Fix bogus in interfaces
  - Allow openshift to read/write postfix public pipe
  - Add postfix_manage_spool_maildrop_files() interface
  - stickshift paths have been renamed to openshift
  - gnome-settings-daemon wants to write to /run/systemd/inhibit/ pipes
  - Update man pages, adding ENTRYPOINTS


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-31
changelog:
  - Add new mandb policy
  - ALlow systemd-tmpfiles_t to relabel mandb_cache_t
  - Allow logrotate to start all unit files


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-33
changelog:
  - Add kernel_read_system_state to sandbox_client_t
  - Add some of the missing access to kdumpgui
  - Allow systemd_dbusd_t to status the init system
  - Allow vmnet-natd to request the kernel to load a module
  - Allow gsf-office-thum to append .cache/gdm/session.log
  - realmd wants to read .config/dconf/user
  - Firewalld wants sys_nice/setsched
  - Allow tmpreaper to delete mandb cache files
  - Firewalld wants sys_nice/setsched
  - Allow firewalld to perform  a DNS name resolution
  - Allown winbind to read /usr/share/samba/codepages/lowcase.dat
  - Add support for HTTPProxy* in /etc/freshclam.conf
  - Fix authlogin_yubike boolean
  - Extend smbd_selinux man page to include samba booleans
  - Allow dhcpc to execute consoletype
  - Allow ping to use inherited tmp files created in init scripts
  - On full relabel with unconfined domain disabled, initrc was running some chcon's
  - Allow people who delete man pages to delete mandb cache files


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-34
changelog:
  - Add policy for qemu-qa
  - Allow razor to write own config files
  -  Add an initial antivirus policy to collect all antivirus program
  - Allow qdisk to read usr_t
  - Add additional caps for vmware_host
  - Allow tmpfiles_t to setattr on mandb_cache_t
  - Dontaudit leaked files into mozilla_plugin_config_t
  - Allow wdmd to getattr on tmpfs
  - Allow realmd to use /dev/random
  - allow containers to send audit messages
  - Allow root mount any file via loop device with enforcing mls policy
  - Allow tmpfiles_t to setattr on mandb_cache_t
  - Allow tmpfiles_t to setattr on mandb_cache_t
  - Make userdom_dontaudit_write_all_ not allow open
  - Allow init scripts to read all unit files
  - Add support for saphostctrl ports


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-35
changelog:
  - tuned wants to getattr on all filesystems
  - tuned needs also setsched. The build is needed for test day


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-36
changelog:
  - Allow semanage to verify types
  - Allow sudo domain to execute user home files
  - Allow session_bus_type to transition to user_tmpfs_t
  - Add dontaudit caused by yum updates
  - Implement pki policy but not activated


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-37
changelog:
  - Allow xdm to search all file systems
  - Add interface to allow the config of all files
  - Add rngd policy
  - Remove kgpg as a gpg_exec_t type
  - Allow plymouthd to block suspend
  - Allow systemd_dbus to config any file
  - Allow system_dbus_t to configure all services
  - Allow freshclam_t to read usr_files
  - varnishd requires execmem to load modules


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-39
changelog:
  - Add interfaces to read kernel_t proc info
  - Missed this version of exec_all
  - Allow anyone who can load a kernel module to compromise kernel
  - Add oddjob_dbus_chat to openshift apache policy
  - Allow chrome_sandbox_nacl_t to send signals to itself
  - Add unit file support to usbmuxd_t
  - Allow all openshift domains to read sysfs info
  - Allow openshift domains to getattr on all domains


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-40
changelog:
  - Additional requirements for disable unconfined module when booting
  - Fix label of systemd script files
  - semanage can use -F /dev/stdin to get input
  - syslog now uses kerberos keytabs
  - Allow xserver to compromise_kernel access
  -  Allow nfsd to write to mount_var_run_t when running the mount command
  - Add filename transition rule for bin_t directories
  - Allow files to read usr_t lnk_files
  - dhcpc wants chown
  - Add support for new openshift labeling
  - Clean up for tunable+optional statements
  - Add labeling for /usr/sbin/mkhomedir_helper
  - Allow antivirus domain to managa amavis spool files
  - Allow rpcbind_t to read passwd 
  - Allow pyzor running as spamc to manage amavis spool


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-41
changelog:
  - Allow mount to relabelfrom unlabeled file systems
  - systemd_logind wants to send and receive messages from devicekit disk over dbus to make connected mouse working
  - Add label to get bin files under libreoffice labeled correctly
  - Fix interface to allow executing of base_ro_file_type
  - Add fixes for realmd
  - Update pki policy
  - Add tftp_homedir boolean
  - Allow blueman sched_setscheduler
  - openshift user domains wants to r/w ssh tcp sockets


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-42
changelog:
  - pki is leaking which we dontaudit until a pki code fix
  - Allow setcap for arping
  - Update man pages
  - Add labeling for /usr/sbin/mcollectived
  - pki fixes
  - Allow smokeping to execute fping in the netutils_t domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-44
changelog:
  - Change default label of all files in /var/run/rpcbind
  - Allow sandbox domains (java) to read hugetlbfs_t
  - Allow awstats cgi content to create tmp files and read apache log files
  - Allow setuid/setgid for cupsd-config
  - Allow setsched/sys_nice pro cupsd-config
  -  Fix /etc/localtime sym link to be labeled locale_t
  - Allow sshd to search postgresql db t since this is a homedir
  - Allow xwindows users to chat with realmd
  - Allow unconfined domains to configure all files and null_device_t service


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-45
changelog:
  - Add new selinuxuser_use_ssh_chroot boolean
  - dbus needs to be able to read/write inherited fixed disk device_t passed through it
  - Cleanup netutils process allow rule
  - Dontaudit leaked fifo files from openshift to ping
  - sanlock needs to read mnt_t lnk files
  - Fail2ban needs to setsched and sys_nice


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-46
changelog:
  - Allow loging programs to dbus chat with realmd
  - Make apache_content_template calling as optional
  - realmd is using policy kit


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-47
changelog:
  - Allow getty to setattr on usb ttys
  - Allow sshd to search all directories for sshd_home_t content
  - Allow staff domains to send dbus messages to kdumpgui
  - Fix labels on /etc/.pwd.lock and friends to be passwd_file_t
  - Dontaudit setfiles reading urand
  - Add files_dontaudit_list_tmp() for domains to which we added sys_nice/setsched
  - Allow staff_gkeyringd_t to read /home/$USER/.local/share/keyrings dir
  - Allow systemd-timedated to read /dev/urandom
  - Allow entropyd_t to read proc_t (meminfo)
  - Add unconfined munin plugin
  - Fix networkmanager_read_conf() interface
  - Allow blueman to list /tmp which is needed by sys_nic/setsched
  - Fix label of /etc/mail/aliasesdb-stamp
  - numad is searching cgroups
  - realmd is communicating with networkmanager using dbus
  - Lots of fixes to try to get kdump to work


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-48
changelog:
  - Fix label on /etc/group.lock
  - Allow gnomeclock to create lnk_file in /etc
  - label /root/.pki as a home_cert_t
  - Add interface to make sure rpcbind.sock is created with the correct label
  - Add definition for new directory /var/lib/os-probe and bootloader wants to read udev rules
  - opendkim should be a part of milter
  - Allow libvirt to set the kernel sched algorythm
  - Allow mongod to read sysfs_t
  - Add authconfig policy
  - Remove calls to miscfiles_read_localization all domains get this
  - Allow virsh_t to read /root/.pki/ content
  - Add label for log directory under /var/www/stickshift


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-49
changelog:
  - Add smsd policy
  - Add support for OpenShift sbin labelin
  - Add boolean to allow virt to use rawip
  - Allow mozilla_plugin to read all file systems with noxattrs support
  - Allow kerberos to write on anon_inodefs fs
  - Additional access required by fenced
  - Add filename transitions for passwd.lock/group.lock
  - UPdate man pages
  - Create coolkey directory in /var/cache with the correct label


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-50
changelog:
  - Allow all domains to read /proc/sys/vm/overcommit_memory
  - Make proc_numa_t an MLS Trusted Object
  - Add /proc/numactl support for confined users
  - Allow ssh_t to connect to any port > 1023
  - Add openvswitch domain
  - Pulseaudio tries to create directories in gnome_home_t directories
  - New ypbind pkg wants to search /var/run which is caused by sd_notify
  - Allow NM to read certs on NFS/CIFS using use_nfs_*, use_samba_* booleans
  - Allow sanlock to read /dev/random
  - Treat php-fpm with httpd_t
  - Allow domains that can read named_conf_t to be able to list the directories
  - Allow winbind to create sock files in /var/run/samba


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-51
changelog:
  - Add port defintion for tcp/9000
  - Fix labeling for /usr/share/cluster/checkquorum to label also checkquorum.wdmd
  - Add rules and labeling for $HOME/cache/\.gstreamer-.* directory
  - Add support for CIM provider openlmi-networking which uses NetworkManager dbus API
  - Allow shorewall_t to create netlink_socket
  - Allow krb5admind to block suspend
  - Fix labels on /var/run/dlm_controld /var/log/dlm_controld
  - Allow krb5kdc to block suspend
  - gnomessytemmm_t needs to read /etc/passwd
  - Allow cgred to read all sysctls


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-52
changelog:
  - Define usbtty_device_t as a term_tty
  - Allow svnserve to accept a connection
  - Allow xend manage default virt_image_t type
  - Allow prelink_cron_system_t to overide user componant when executing cp
  - Add labeling for z-push
  - Gnomeclock sets the realtime clock
  - Openshift seems to be storing apache logs in /var/lib/openshift/.log/httpd
  - Allow lxc domains to use /dev/random and /dev/urandom


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-53
changelog:
  - Fix storage_rw_inherited_fixed_disk_dev() to cover also blk_file
  - Dontaudit setfiles reading /dev/random
  - On initial boot gnomeclock is going to need to be set buy gdm
  - Fix tftp_read_content() interface
  - Random apps looking at kernel file systems
  - Testing virt with lxc requiers additional access for virsh_t
  - New allow rules requied for latest libvirt, libvirt talks directly to journald,lxc setup tool needs compromize_kernel,and we need ipc_lock in the container
  - Allow MPD to read /dev/radnom
  - Allow sandbox_web_type to read logind files which needs to read pulseaudio
  - Allow mozilla plugins to read /dev/hpet
  - Add labeling for /var/lib/zarafa-webap
  - Allow BOINC client to use an HTTP proxy for all connections
  - Allow rhsmertd to domain transition to dmidecod
  -  Allow setroubleshootd to send D-Bus msg to ABRT


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-54
changelog:
  - Fix filetrans interface definitions
  - Dontaudit xdm_t to getattr on BOINC lib files
  - Add systemd_reload_all_services() interface
  - Dontaudit write access on /var/lib/net-snmp/mib_indexes 
  - Only stop mcsuntrustedproc from relableing files
  - Allow accountsd to dbus chat with gdm
  - Allow realmd to getattr on all fs
  - Allow logrotate to reload all services
  - Add systemd unit file for radiusd
  - Allow winbind to create samba pid dir
  - Add labeling for /var/nmbd/unexpected
  - Allow chrome and mozilla plugin to connect to msnp ports


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-55
changelog:
  - Fix userhelper_console_role_template()
  - Allow enabling Network Access Point service using blueman
  - Make vmware_host_t as unconfined domain
  - Allow authenticate users in webaccess via squid, using mysql as backend
  - Allow gathers to get various metrics on mounted file systems
  - Allow firewalld to read /etc/hosts
  - Fix cron_admin_role() to make sysadm cronjobs running in the sysadm_t instead of cronjob_t
  - Allow kdumpgui to read/write to zipl.conf
  - Commands needed to get mock to build from staff_t in enforcing mode
  - Allow mdadm_t to manage cgroup files
  - Allow all daemons and systemprocesses to use inherited initrc_tmp_t files
  - dontaudit ifconfig_t looking at fifo_files that are leaked to it
  - Add lableing for Quest Authentication System


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-56
changelog:
  - Allow syslogd to request the kernel to load a module
  - Allow syslogd_t to read the network state information
  - Allow xdm_dbusd_t connect to the system DBUS
  - Add support for 7389/tcp port
  - Allow domains to read/write all inherited sockets
  - Allow staff_t to read kmsg
  - Add awstats_purge_apache_log boolean
  - Allow ksysguardproces to read /.config/Trolltech.conf
  - Allow passenger to create and append puppet log files
  - Add puppet_append_log and puppet_create_log interfaces
  - Add puppet_manage_log() interface
  - Allow tomcat domain to search tomcat_var_lib_t
  - Allow pki_tomcat_t to connect to pki_ca ports
  - Allow pegasus_t to have net_admin capability
  - Allow pegasus_t to write /sys/class/net/<interface>/flags
  - Allow mailserver_delivery to manage mail_home_rw_t lnk_files
  - Allow fetchmail to create log files
  - Allow gnomeclock to manage home config in .kde
  - Allow bittlebee to read kernel sysctls
  - Allow logrotate to list /root


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-57
changelog:
  - Add support for 4567/tcp port
  - Random fixes from Tuomo Soini
  - xdm wants to get init status
  - Allow programs to run in fips_mode
  - Add interface to allow the reading of all blk device nodes
  - Allow init to relabel rpcbind sock_file
  - Fix labeling for lastlog and faillog related to logrotate
  - ALlow aeolus_configserver to use TRAM port
  - Add fixes for aeolus_configserver
  - Allow snmpd to connect to snmp port
  - Allow spamd_update to create spamd_var_lib_t directories
  - Allow domains that can read sssd_public_t files to also list the directory
  - Remove miscfiles_read_localization, this is defined for all domains


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-58
changelog:
  - Add back consolekit policy
  - Silence bootloader trying to use inherited tty
  - Silence xdm_dbusd_t trying to execute telepathy apps
  - Fix shutdown avcs when machine has unconfined.pp disabled
  - The host and a virtual machine can share the same printer on a usb device
  - Change oddjob to transition to a ranged openshift_initr_exec_t when run from oddjob
  - Allow abrt_watch_log_t to execute bin_t
  - Allow chrome sandbox to write content in ~/.config/chromium
  - Dontaudit setattr on fontconfig dir for thumb_t
  - Allow lircd to request the kernel to load module
  - Make rsync as userdom_home_manager
  - Allow rsync to search automount filesystem
  - Add fixes for pacemaker


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-60
changelog:
  - Add openshift_initrc_signal() interface
  - Fix typos
  - dspam port is treat as spamd_port_t
  - Allow setroubleshoot to getattr on all executables
  - Allow tuned to execute profiles scripts in /etc/tuned
  - Allow apache to create directories to store its log files
  - Allow all directories/files in /var/log starting with passenger to be labeled passenger_log_t
  - Looks like apache is sending sinal to openshift_initrc_t now,needs back port to RHEL6
  - Allow Postfix to be configured to listen on TCP port 10026 for email from DSPAM
  - Add filename transition for /etc/tuned/active_profile
  - Allow condor_master to send mails
  - Allow condor_master to read submit.cf
  - Allow condor_master to create /tmp files/dirs
  - Allow condor_mater to send sigkill to other condor domains
  - Allow condor_procd sigkill capability
  - tuned-adm wants to talk with tuned daemon
  - Allow kadmind and krb5kdc to also list sssd_public_t
  - Allow accountsd to dbus chat with init
  - Fix git_read_generic_system_content_files() interface
  - pppd wants sys_nice by nmcli because of "syscall=sched_setscheduler"
  - Fix mozilla_plugin_can_network_connect to allow to connect to all ports
  - Label all munin plugins which are not covered by munin plugins policy  as unconfined_munin_plugin_exec_t
  - dspam wants to search /var/spool for opendkim data
  - Revert "Add support for tcp/10026 port as dspam_port_t"
  - Turning on labeled networking requires additional access for netlabel_peer_t; these allow rules need to be back ported to RHEL6
  - Allow all application domains to use fifo_files passed in from userdomains, also allow them to write to tmp_files inherited from userdomain
  - Allow systemd_tmpfiles_t to setattr on mandb_cache_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-61
changelog:
  - Label /var/lib/pgsql/.ssh as ssh_home_t
  - Add labeling for /usr/bin/pg_ctl
  - Allow systemd-logind to manage keyring user tmp dirs
  - Add support for 7389/tcp port
  - gems seems to be placed in lots of places
  - Since xdm is running a full session, it seems to be trying to execute lots of executables via dbus
  - Add back tcp/8123 port as http_cache port
  - Add ovirt-guest-agent\.pid labeling
  - Allow xend to run scsi_id
  - Allow rhsmcertd-worker to read "physical_package_id"
  - Allow pki_tomcat to connect to ldap port
  - Allow lpr to read /usr/share/fonts
  - Allow open file from CD/DVD drive on domU
  - Allow munin services plugins to talk to SSSD
  - Allow all samba domains to create samba directory in var_t directories
  - Take away svirt_t ability to use nsswitch
  - Dontaudit attempts by openshift to read apache logs
  - Allow apache to create as well as append _ra_content_t
  - Dontaudit sendmail_t reading a leaked file descriptor
  - Add interface to have admin transition /etc/prelink.cache to the proper label
  - Add sntp support to ntp policy
  - Allow firewalld to dbus chat with devicekit_power
  - Allow tuned to call lsblk
  - Allow tor to read /proc/sys/kernel/random/uuid
  - Add tor_can_network_relay boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-62
changelog:
  - Fix MCS Constraints to control ingres and egres controls on the network.
  - Change name of svirt_nokvm_t to svirt_tcg_t
  - Allow tuned to request the kernel to load kernel modules


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-63
changelog:
  - Add label for efivarfs
  - Allow certmonger to send signal to itself
  - Allow plugin-config to read own process status
  - Add more fixes for pacemaker
  - apache/drupal can run clamscan on uploaded content
  - Allow chrome_sandbox_nacl_t to read pid 1 content


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-65
changelog:
  - Allow svirt to use netlink_route_socket which was a part of auth_use_nsswitch
  - Add additional labeling for /var/www/openshift/broker
  - Fix rhev policy
  - Allow openshift_initrc domain to dbus chat with systemd_logind
  - Allow httpd to getattr passenger log file if run_stickshift
  - Allow consolehelper-gtk to connect to xserver
  - Add labeling for the tmp-inst directory defined in pam_namespace.conf
  - Add lvm_metadata_t labeling for /etc/multipath


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-66
changelog:
  - Allow munin disk plugins to get attributes of all directories
  - Allow munin disk plugins to get attributes of all directorie
  - Allow logwatch to get attributes of all directories
  - Fix networkmanager_manage_lib() interface
  - Fix gnome_manage_config() to allow to manage sock_file
  - Fix virtual_domain_context
  - Add support for dynamic DNS for DHCPv6


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-67
changelog:
  - systemd_logind_t is looking at all files under /run/user/apache
  - Allow systemd to manage all user tmp files
  - Add labeling for /var/named/chroot/etc/localtime
  - Allow netlabel_peer_t type to flow over netif_t and node_t, and only be hindered by MLS, need back port to RHEL6
  - Keystone is now using a differnt port
  - Allow xdm_t to use usbmuxd daemon to control sound
  - Allow passwd daemon to execute gnome_exec_keyringd
  - Fix chrome_sandbox policy
  - Add labeling for /var/run/checkquorum-timer
  - More fixes for the dspam domain, needs back port to RHEL6
  - More fixes for the dspam domain, needs back port to RHEL6
  - sssd needs to connect to kerberos password port if a user changes his password
  - Lots of fixes from RHEL testing of dspam web
  - Allow chrome and mozilla_plugin to create msgq and semaphores
  - Fixes for dspam cgi scripts
  - Fixes for dspam cgi scripts
  - Allow confine users to ptrace screen
  - Backport virt_qemu_ga_t changes from RHEL
  - Fix labeling for dspam.cgi needed for RHEL6
  - We need to back port this policy to RHEL6, for lxc domains
  - Dontaudit attempts to set sys_resource of logrotate
  - Allow corosync to read/write wdmd's tmpfs files
  - I see a ptrace of mozilla_plugin_t by staff_t, will allow without deny_ptrace being set
  - Allow cron jobs to read bind config for unbound
  - libvirt needs to inhibit systemd
  - kdumpctl needs to delete boot_t files
  - Fix duplicate gnome_config_filetrans
  - virtd_lxc_t is using /dev/fuse
  - Passenger needs to create a directory in /var/log, needs a backport to RHEL6 for openshift
  - apcupsd can be setup to listen to snmp trafic
  - Allow transition from kdumpgui to kdumpctl
  - Add fixes for munin CGI scripts
  - Allow deltacloud to connect to openstack at the keystone port
  - Allow domains that transition to svirt domains to be able to signal them
  - Fix file context of gstreamer in .cache directory
  - libvirt is communicating with logind
  - NetworkManager writes to the systemd inhibit pipe


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-68
changelog:
  - Allow setroubleshoot_fixit to execute rpm
  - zoneminder needs to connect to httpd ports where remote cameras are listening
  - Allow firewalld to execute content created in /run directory
  - Allow svirt_t to read generic certs
  - Dontaudit leaked ps content to mozilla plugin
  - Allow sshd_t sys_admin for use with afs logins
  - Allow systemd to read/write all sysctls
  - init scripts are creating systemd_unit_file_t directories


author: Miroslav Grepl <mgrepl@redhat.com> 3.11.1-69
changelog:
  - Add systemd_status_all_unit_files() interface
  - Add support for nshadow
  - Allow sysadm_t to administrate the postfix domains
  - Add interface to setattr on isid directories for use by tmpreaper
  - Allow sshd_t sys_admin for use with afs logins
  - Allow systemd to read/write all sysctls
  - Allow sshd_t sys_admin for use with afs logins
  - Allow systemd to read/write all sysctls
  - Add systemd_status_all_unit_files() interface
  - Add support for nshadow
  - Allow sysadm_t to administrate the postfix domains
  - Add interface to setattr on isid directories for use by tmpreaper
  - Allow sshd_t sys_admin for use with afs logins
  - Allow systemd to read/write all sysctls
  - Allow sshd_t sys_admin for use with afs logins
  - Add labeling for /var/named/chroot/etc/localtim


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-2
changelog:
  - Remove all mcs overrides and replace with t1 != mcs_constrained_types
  - Add attribute_role for iptables
  - mcs_process_set_categories needs to be called for type
  - Implement additional role_attribute statements
  - Sodo domain is attempting to get the additributes of proc_kcore_t
  - Unbound uses port 8953
  - Allow svirt_t images to compromise_kernel when using pci-passthrough
  - Add label for dns lib files
  - Bluetooth aquires a dbus name
  - Remove redundant files_read_usr_file calling
  - Remove redundant files_read_etc_file calling
  - Fix mozilla_run_plugin()
  - Add role_attribute support for more domains


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-3
changelog:
  - Allow gnomeclock to talk to puppet over dbus
  - Allow numad access discovered by Dominic
  - Add support for HOME_DIR/.maildir
  - Fix attribute_role for mozilla_plugin_t domain to allow staff_r to access this domain
  - Allow udev to relabel udev_var_run_t lnk_files
  - New bin_t file in mcelog


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-4
changelog:
  - Allow systemd-tmpfiles to relabel lpd spool files
  - Ad labeling for texlive bash scripts
  - Add xserver_filetrans_fonts_cache_home_content() interface
  - Remove duplicate rules from *.te
  - Add support for /var/lock/man-db.lock
  - Add support for /var/tmp/abrt(/.*)?
  - Add additional labeling for munin cgi scripts
  - Allow httpd_t to read munin conf files
  - Allow certwatch to read meminfo
  - Fix nscd_dontaudit_write_sock_file() interfac
  - Fix gnome_filetrans_home_content() to include also "fontconfig" dir as cache_home_t
  - llow mozilla_plugin_t to create HOMEDIR/.fontconfig with the proper labeling


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-5
changelog:
  - Fix systemd_manage_unit_symlinks() interface
  - Call systemd_manage_unit_symlinks(() which is correct interface
  - Add filename transition for opasswd
  - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock
  - Allow sytstemd-timedated to get status of init_t
  - Add new systemd policies for hostnamed and rename gnomeclock_t to systemd_timedate_t
  - colord needs to communicate with systemd and systemd_logind, also remove duplicate rules
  - Switch gnomeclock_dbus_chat to systemd_dbus_chat_timedated since we have switched the name of gnomeclock
  - Allow gpg_t to manage all gnome files
  - Stop using pcscd_read_pub_files
  - New rules for xguest, dontaudit attempts to dbus chat
  - Allow firewalld to create its mmap files in tmpfs and tmp directories
  - Allow firewalld to create its mmap files in tmpfs and tmp directories
  - run unbound-chkconf as named_t, so it can read dnssec
  - Colord is reading xdm process state, probably reads state of any apps that sends dbus message
  - Allow mdadm_t to change the kernel scheduler
  - mythtv policy
  - Update mandb_admin() interface
  - Allow dsspam to listen on own tpc_socket
  - seutil_filetrans_named_content needs to be optional
  - Allow sysadm_t to execute content in his homedir
  - Add attach_queue to tun_socket, new patch from Paul Moore
  - Change most of selinux configuration types to security_file_type.
  - Add filename transition rules for selinux configuration
  - ssh into a box with -X -Y requires ssh_use_ptys
  - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on
  - Allow all unpriv userdomains to send dbus messages to hostnamed and timedated
  - New allow rules found by Tom London for systemd_hostnamed


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-6
changelog:
  - kde gnomeclock wants to write content to /tmp
  - /usr/libexec/kde4/kcmdatetimehelper attempts to create /root/.kde
  - Allow blueman_t to rwx zero_device_t, for some kind of jre
  - Allow mozilla_plugin_t to rwx zero_device_t, for some kind of jre
  - Ftp full access should be allowed to create directories as well as files
  - Add boolean to allow rsync_full_acces, so that an rsync server can write all
  - over the local machine
  - logrotate needs to rotate logs in openshift directories, needs back port to RHEL6
  - Add missing vpnc_roles type line
  - Allow stapserver to write content in /tmp
  - Allow gnome keyring to create keyrings dir in ~/.local/share
  - Dontaudit thumb drives trying to bind to udp sockets if nis_enabled is turned on
  - Add interface to colord_t dbus_chat to allow it to read remote process state
  - Allow colord_t to read cupsd_t state
  - Add mate-thumbnail-font as thumnailer
  - Allow sectoolm to sys_ptrace since it is looking at other proceses /proc data.
  - Allow qpidd to list /tmp. Needed by ssl
  - Only allow init_t to transition to rsync_t domain, not initrc_t.  This should be back ported to F17, F18
  - - Added systemd support for ksmtuned
  - Added booleans
   	ksmtuned_use_nfs
   	ksmtuned_use_cifs
  - firewalld seems to be creating mmap files which it needs to execute in /run /tmp and /dev/shm.  Would like to clean this up but for now we will allow
  - Looks like qpidd_t needs to read /dev/random
  - Lots of probing avc's caused by execugting gpg from staff_t
  - Dontaudit senmail triggering a net_admin avc
  - Change thumb_role to use thumb_run, not sure why we have a thumb_role, needs back port
  - Logwatch does access check on mdadm binary
  - Add raid_access_check_mdadm() iterface


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-7
changelog:
  - mount.glusterfs executes glusterfsd binary
  - Allow systemd_hostnamed_t to stream connect to systemd
  - Dontaudit any user doing a access check
  - Allow obex-data-server to request the kernel to load a module
  - Allow gpg-agent to manage gnome content (~/.cache/gpg-agent-info)
  - Allow gpg-agent to read /proc/sys/crypto/fips_enabled
  - Add new types for antivirus.pp policy module
  - Allow gnomesystemmm_t caps because of ioprio_set
  - Make sure if mozilla_plugin creates files while in permissive mode, they get created with the correct label, user_home_t
  - Allow gnomesystemmm_t caps because of ioprio_set
  - Allow NM rawip socket
  - files_relabel_non_security_files can not be used with boolean
  - Add interface to thumb_t dbus_chat to allow it to read remote process state
  - ALlow logrotate to domtrans to mdadm_t
  - kde gnomeclock wants to write content to /tmp


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-8
changelog:
  - Change ssh_use_pts to use macro and only inherited sshd_devpts_t
  - Allow confined users to read systemd_logind seat information
  - libmpg ships badly created libraries
  - Add support for strongswan.service
  - Add labeling for strongswan
  - Allow l2tpd_t to read network manager content in /run directory
  - Allow rsync to getattr any file in rsync_data_t
  - Add labeling and filename transition for .grl-podcasts


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-9
changelog:
  - boinc_cliean wants also execmem as boinc projecs have
  - Allow sa-update to search admin home for /root/.spamassassin
  - Allow sa-update to search admin home for /root/.spamassassin
  - Allow antivirus domain to read net sysctl
  - Dontaudit attempts from thumb_t to connect to ssd
  - Dontaudit attempts by readahead to read sock_files
  - Dontaudit attempts by readahead to read sock_files
  - Create tmpfs file while running as wine as user_tmpfs_t
  - Dontaudit attempts by readahead to read sock_files
  - libmpg ships badly created librarie


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-10
changelog:
  - Fix smartmontools
  - Fix userdom_restricted_xwindows_user_template() interface
  - Add xserver_xdm_ioctl_log() interface
  - Allow Xusers to ioctl lxdm.log to make lxdm working
  - Add MLS fixes to make MLS boot/log-in working
  - Add mls_socket_write_all_levels() also for syslogd
  - fsck.xfs needs to read passwd
  - Fix ntp_filetrans_named_content calling in init.te
  - Allow postgresql to create pg_log dir
  - Allow sshd to read rsync_data_t to make rsync <backuphost> working
  - Change ntp.conf to be labeled net_conf_t
  - Allow useradd to create homedirs in /run.  ircd-ratbox does this and we should just allow it
  - Allow xdm_t to execute gstreamer home content
  - Allod initrc_t and unconfined domains, and sysadm_t to manage ntp
  - New policy for openstack swift domains
  - More access required for openshift_cron_t
  - Use cupsd_log_t instead of cupsd_var_log_t
  - rpm_script_roles should be used in rpm_run
  - Fix rpm_run() interface
  - Fix openshift_initrc_run()
  - Fix sssd_dontaudit_stream_connect() interface
  - Fix sssd_dontaudit_stream_connect() interface
  - Allow LDA's job to deliver mail to the mailbox
  - dontaudit block_suspend for mozilla_plugin_t
  - Allow l2tpd_t to all signal perms
  - Allow uuidgen to read /dev/random
  - Allow mozilla-plugin-config to read power_supply info
  - Implement cups_domain attribute for cups domains
  - We now need access to user terminals since we start by executing a command outside the tty
  - We now need access to user terminals since we start by executing a command outside the tty
  - svirt lxc containers want to execute userhelper apps, need these changes to allow this to happen
  - Add containment of openshift cron jobs
  - Allow system cron jobs to create tmp directories
  - Make userhelp_conf_t a config file
  - Change rpm to use rpm_script_roles
  - More fixes for rsync to make rsync <backuphost> wokring
  - Allow logwatch to domtrans to mdadm
  - Allow pacemaker to domtrans to ifconfig
  - Allow pacemaker to setattr on corosync.log
  - Add pacemaker_use_execmem for memcheck-amd64 command
  - Allow block_suspend capability
  - Allow create fifo_file in /tmp with pacemaker_tmp_t
  - Allow systat to getattr on fixed disk
  - Relabel /etc/ntp.conf to be net_conf_t
  - ntp_admin should create files in /etc with the correct label
  - Add interface to create ntp_conf_t files in /etc
  - Add additional labeling for quantum
  - Allow quantum to execute dnsmasq with transition


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-11
changelog:
  - Allow gpg to read fips_enabled
  - Add support for /var/cache/realmd
  - Add support for /usr/sbin/blazer_usb and systemd support for nut
  - Add labeling for fenced_sanlock and allow sanclok transition to fenced_t
  - bitlbee wants to read own log file
  - Allow glance domain to send a signal itself
  - Allow xend_t to request that the kernel load a kernel module
  - Allow pacemaker to execute heartbeat lib files
  - cleanup new swift policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-12
changelog:
  - Rename files_rw_inherited_tmp_files to files_rw_inherited_tmp_file
  - Add missing files_rw_inherited_tmp_files interface
  - Add additional interface for ecryptfs
  - ALlow nova-cert to connect to postgresql
  - Allow keystone to connect to postgresql
  - Allow all cups domains to getattr on filesystems
  - Allow pppd to send signull
  - Allow tuned to execute ldconfig
  - Allow gpg to read fips_enabled
  - Add additional fixes for ecryptfs
  - Allow httpd to work with posgresql
  - Allow keystone getsched and setsched


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-13
changelog:
  - virsh now does a setexeccon call
  - Additional rules required by openshift domains
  - Allow svirt_lxc_domains to use inherited terminals, needed to make virt-sandbox-service execute work
  - Allow spamd_update_t to search spamc_home_t
  - Avcs discovered by mounting an isci device under /mnt
  - Allow lspci running as logrotate to read pci.ids
  - Additional fix for networkmanager_read_pid_files()
  - Fix networkmanager_read_pid_files() interface
  - Allow all svirt domains to connect to svirt_socket_t
  - Allow virsh to set SELinux context for a process.
  - Allow tuned to create netlink_kobject_uevent_socket
  - Allow systemd-timestamp to set SELinux context
  - Add support for /var/lib/systemd/linger
  - Fix ssh_sysadm_login to be working on MLS as expected


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-14
changelog:
  - Allow gluster to get attrs on all fs
  - New access required for virt-sandbox
  - Allow dnsmasq to execute bin_t
  - Allow dnsmasq to create content in /var/run/NetworkManager
  - Fix openshift_initrc_signal() interface
  - Dontaudit openshift domains doing getattr on other domains
  - Allow consolehelper domain to communicate with session bus
  - Mock should not be transitioning to any other domains,  we should keep mock_t as mock_t
  - Update virt_qemu_ga_t policy
  - Allow authconfig running from realmd to restart oddjob service
  - Add systemd support for oddjob
  - Add initial policy for realmd_consolehelper_t which if for authconfig executed by realmd
  - Add labeling for gnashpluginrc
  - Allow chrome_nacl to execute /dev/zero
  - Allow condor domains to read /proc
  - mozilla_plugin_t will getattr on /core if firefox crashes
  - Allow condor domains to read /etc/passwd
  - Allow dnsmasq to execute shell scripts, openstack requires this access
  - Fix glusterd labeling
  - Allow virtd_t to interact with the socket type
  - Allow nmbd_t to override dac if you turned on sharing all files
  - Allow tuned to created kobject_uevent socket
  - Allow guest user to run fusermount
  - Allow openshift to read /proc and locale
  - Allow realmd to dbus chat with rpm
  - Add new interface for virt
  - Remove depracated interfaces
  - Allow systemd_domains read access on etc, etc_runtime and usr files, also allow them to connect stream to syslog socket
  - /usr/share/munin/plugins/plugin.sh should be labeled as bin_t
  - Remove some more unconfined_t process transitions, that I don't believe are necessary
  - Stop transitioning uncofnined_t to checkpc
  - dmraid creates /var/lock/dmraid
  - Allow systemd_localed to creatre unix_dgram_sockets
  - Allow systemd_localed to write kernel messages.
  - Also cleanup systemd definition a little.
  - Fix userdom_restricted_xwindows_user_template() interface
  - Label any block devices or char devices under /dev/infiniband as fixed_disk_device_t
  - User accounts need to dbus chat with accountsd daemon
  - Gnome requires all users to be able to read /proc/1/


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-16
changelog:
  - Fix authconfig.py labeling
  - Make any domains that write homedir content do it correctly
  - Allow glusterd to read/write anyhwere on the file system by default
  - Be a little more liberal with the rsync log files
  - Fix iscsi_admin interface
  - Allow iscsid_t to read /dev/urand
  - Fix up iscsi domain for use with unit files
  - Add filename transition support for spamassassin policy
  - Allow web plugins to use badly formated libraries
  - Allow nmbd_t to create samba_var_t directories
  - Add filename transition support for spamassassin policy
  - Add filename transition support for tvtime
  - Fix alsa_home_filetrans_alsa_home() interface
  - Move all userdom_filetrans_home_content() calling out of booleans
  - Allow logrotote to getattr on all file sytems
  - Remove duplicate userdom_filetrans_home_content() calling
  - Allow kadmind to read /etc/passwd
  - Dontaudit append .xsession-errors file on ecryptfs for  policykit-auth
  - Allow antivirus domain to manage antivirus db links
  - Allow logrotate to read /sys
  - Allow mandb to setattr on man dirs
  - Remove mozilla_plugin_enable_homedirs boolean
  - Fix ftp_home_dir boolean
  - homedir mozilla filetrans has been moved to userdom_home_manager
  - homedir telepathy filetrans has been moved to userdom_home_manager
  - Remove gnome_home_dir_filetrans() from gnome_role_gkeyringd()
  - Might want to eventually write a daemon on fusefsd.
  - Add policy fixes for sshd [net] child from plautrba@redhat.com
  - Tor uses a new port
  - Remove bin_t for authconfig.py
  - Fix so only one call to userdom_home_file_trans
  - Allow home_manager_types to create content with the correctl label
  - Fix all domains that write data into the homedir to do it with the correct label
  - Change the postgresql to use proper boolean names, which is causing httpd_t to
  - not get access to postgresql_var_run_t
  - Hostname needs to send syslog messages
  - Localectl needs to be able to send dbus signals to users
  - Make sure userdom_filetrans_type will create files/dirs with user_home_t labeling by default
  - Allow user_home_manger domains to create spam* homedir content with correct labeling
  - Allow user_home_manger domains to create HOMEDIR/.tvtime with correct labeling
  - Add missing miscfiles_setattr_man_pages() interface and for now comment some rules for userdom_filetrans_type to make build process working
  - Declare userdom_filetrans_type attribute
  - userdom_manage_home_role() needs to be called withoout usertype attribute because of userdom_filetrans_type attribute
  - fusefsd is mounding a fuse file system on /run/user/UID/gvfs


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-19
changelog:
  - Allow postgresql to manage rgmanager pid files
  - Allow postgresql to read ccs data
  - Allow systemd_domain to send dbus messages to policykit
  - Add labels for /etc/hostname and /etc/machine-info and allow systemd-hostnamed to create them
  - All systemd domains that create content are reading the file_context file and setfscreate
  - Systemd domains need to search through init_var_run_t
  - Allow sshd to communicate with libvirt to set containers labels
  - Add interface to manage pid files
  - Allow NetworkManger_t to read /etc/hostname
  - Dontaudit leaked locked files into openshift_domains
  - Add fixes for oo-cgroup-read - it nows creates tmp files
  - Allow gluster to manage all directories as well as files
  - Dontaudit chrome_sandbox_nacl_t using user terminals
  - Allow sysstat to manage its own log files
  - Allow virtual machines to setrlimit and send itself signals.
  - Add labeling for /var/run/hplip


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-20
changelog:
  - Adopt swift changes from lhh@redhat.com
  - Add rhcs_manage_cluster_pid_files() interface
  - Allow screen domains to configure tty and setup sock_file in ~/.screen directory
  - ALlow setroubleshoot to read default_context_t, needed to backport to F18
  - Label /etc/owncloud as being an apache writable directory
  - Allow sshd to stream connect to an lxc domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-21
changelog:
  - Fix log transition rule for cluster domains
  - Start to group all cluster log together
  - Dont use filename transition for POkemon Advanced Adventure until a new checkpolicy update
  - cups uses usbtty_device_t devices
  - These fixes were all required to build a MLS virtual Machine with single level desktops
  - Allow domains to transiton using httpd_exec_t
  - Allow svirt domains to manage kernel key rings
  - Allow setroubleshoot to execute ldconfig
  - Allow firewalld to read generate gnome data
  - Allow bluetooth to read machine-info
  - Allow boinc domain to send signal to itself
  - Fix gnome_filetrans_home_content() interface
  - Allow mozilla_plugins to list apache modules, for use with gxine
  - Fix labels for POkemon in the users homedir
  - Allow xguest to read mdstat
  - Dontaudit virt_domains getattr on /dev/*
  - These fixes were all required to build a MLS virtual Machine with single level desktops
  - Need to back port this to RHEL6 for openshift
  - Add tcp/8891 as milter port
  - Allow nsswitch domains to read sssd_var_lib_t files
  - Allow ping to read network state.
  - Fix typo
  - Add labels to /etc/X11/xorg.d and allow systemd-timestampd_t to manage them


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-22
changelog:
  - Allow nagios to manage nagios spool files
  - /var/spool/snmptt is a directory which snmdp needs to write to, needs back port to RHEL6
  - Add swift_alias.* policy files which contain typealiases for swift types
  - Add support for /run/lock/opencryptoki
  - Allow pkcsslotd chown capability
  - Allow pkcsslotd to read passwd
  - Add rsync_stub() interface
  - Allow systemd_timedate also manage gnome config homedirs
  - Label /usr/lib64/security/pam_krb5/pam_krb5_cchelper as bin_t
  - Fix filetrans rules for kdm creates .xsession-errors
  - Allow sytemd_tmpfiles to create wtmp file
  - Really should not label content  under /var/lock, since it could have labels on it different from var_lock_t
  - Allow systemd to list all file system directories
  - Add some basic stub interfaces which will be used in PRODUCT policies


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-23
changelog:
  - Allow localectl to read /etc/X11/xorg.conf.d directory
  - Revert "Revert "Fix filetrans rules for kdm creates .xsession-errors""
  - Allow mount to transition to systemd_passwd_agent
  - Make sure abrt directories are labeled correctly
  - Allow commands that are going to read mount pid files to search mount_var_run_t
  - label /usr/bin/repoquery as rpm_exec_t
  - Allow automount to block suspend
  - Add abrt_filetrans_named_content so that abrt directories get labeled correctly
  - Allow virt domains to setrlimit and read file_context


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-24
changelog:
  - Add labeling for /usr/share/pki
  - Allow programs that read var_run_t symlinks also read var_t symlinks
  - Add additional ports as mongod_port_t for  27018, 27019, 28017, 28018 and 28019 ports
  - Fix labeling for /etc/dhcp directory
  - add missing systemd_stub_unit_file() interface
  - Add files_stub_var() interface
  - Add lables for cert_t directories
  - Make localectl set-x11-keymap working at all
  - Allow abrt to manage mock build environments to catch build problems.
  - Allow virt_domains to setsched for running gdb on itself
  - Allow thumb_t to execute user home content
  - Allow pulseaudio running as mozilla_plugin_t to read /run/systemd/users/1000
  - Allow certwatch to execut /usr/bin/httpd
  - Allow cgred to send signal perms to itself, needs back port to RHEL6
  - Allow openshift_cron_t to look at quota
  - Allow cups_t to read inhered tmpfs_t from the kernel
  - Allow yppasswdd to use NIS
  - Tuned wants sys_rawio capability
  - Add ftpd_use_fusefs boolean
  - Allow dirsrvadmin_t to signal itself


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-25
changelog:
  - Allow realmd to create tmp files
  - FIx ircssi_home_t type to irssi_home_t
  - Allow adcli running as realmd_t to connect to ldap port
  - Allow NetworkManager to transition to ipsec_t, for running strongswan
  - Make openshift_initrc_t an lxc_domain
  - Allow gssd to manage user_tmp_t files
  - Fix handling of irclogs in users homedir
  - Fix labeling for drupal an wp-content in subdirs of /var/www/html
  - Allow abrt to read utmp_t file
  - Fix openshift policy to transition lnk_file, sock-file an fifo_file when created in a tmpfs_t, needs back port to RHEL6
  - fix labeling for (oo|rhc)-restorer-wrapper.sh
  - firewalld needs to be able to write to network sysctls
  - Fix mozilla_plugin_dontaudit_rw_sem() interface
  - Dontaudit generic ipc read/write to a mozilla_plugin for sandbox_x domains
  - Add mozilla_plugin_dontaudit_rw_sem() interface
  - Allow svirt_lxc_t to transition to openshift domains
  - Allow condor domains block_suspend and dac_override caps
  - Allow condor_master to read passd
  - Allow condor_master to read system state
  - Allow NetworkManager to transition to ipsec_t, for running strongswan
  - Lots of access required by lvm_t to created encrypted usb device
  - Allow xdm_t to dbus communicate with systemd_localed_t
  - Label strongswan content as ipsec_exec_mgmt_t for now
  - Allow users to dbus chat with systemd_localed
  - Fix handling of .xsession-errors in xserver.if, so kde will work
  - Might be a bug but we are seeing avc's about people status on init_t:service
  - Make sure we label content under /var/run/lock as <<none>>
  - Allow daemon and systemprocesses to search init_var_run_t directory
  - Add boolean to allow xdm to write xauth data to the home directory
  - Allow mount to write keys for the unconfined domain
  - Add unconfined_write_keys() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-26
changelog:
  - Try to label on controlC devices up to 30 correctly
  - Add mount_rw_pid_files() interface
  - Add additional mount/umount interfaces needed by mock
  - fsadm_t sends audit messages in reads kernel_ipc_info when doing livecd-iso-to-disk
  - Fix tabs
  - Allow initrc_domain to search rgmanager lib files
  - Add more fixes which make mock working together with confined users
    * Allow mock_t to manage rpm files
    * Allow mock_t to read rpm log files
    * Allow mock to setattr on tmpfs, devpts
    * Allow mount/umount filesystems
  - Add rpm_read_log() interface
  - yum-cron runs rpm from within it.
  - Allow tuned to transition to dmidecode
  - Allow firewalld to do net_admin
  - Allow mock to unmont tmpfs_t
  - Fix virt_sigkill() interface
  - Add additional fixes for mock. Mainly caused by mount running in mock_t
  - Allow mock to write sysfs_t and mount pid files
  - Add mailman_domain to mailman_template()
  - Allow openvswitch to execute shell
  - Allow qpidd to use kerberos
  - Allow mailman to use fusefs, needs back port to RHEL6
  - Allow apache and its scripts to use anon_inodefs
  - Add alias for git_user_content_t and git_sys_content_t so that RHEL6 will update to RHEL7
  - Realmd needs to connect to samba ports, needs back port to F18 also
  - Allow colord to read /run/initial-setup-
  - Allow sanlock-helper to send sigkill to virtd which is registred to sanlock
  - Add virt_kill() interface
  - Add rgmanager_search_lib() interface
  - Allow wdmd to getattr on all filesystems. Back ported from RHEL6


author: Dan Walsh <dwalsh@redhat.com> 3.12.1-28
changelog:
  - Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean
  - Fixes for dlm_controld
  - Fix apache_read_sys_content_rw_dirs() interface
  - Allow logrotate to read /var/log/z-push dir
  - Allow postfix_postdrop to acces postfix_public socket
  - Allow sched_setscheduler for cupsd_t
  - Add missing context for /usr/sbin/snmpd
  - Allow consolehelper more access discovered by Tom London
  - Allow fsdaemon to send signull to all domain
  - Add port definition for osapi_compute port
  - Allow unconfined to create /etc/hostname with correct labeling
  - Add systemd_filetrans_named_hostname() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-29
changelog:
  - Add mising nslcd_dontaudit_write_sock_file() interface
  - one more fix
  - Fix pki_read_tomcat_lib_files() interface
  - Allow certmonger to read pki-tomcat lib files
  - Allow certwatch to execute bin_t
  - Allow snmp to manage /var/lib/net-snmp files
  - Don't audit attempts to write to stream socket of nscld by thumbnailers
  - Allow git_system_t to read network state
  - Allow pegasas to execute mount command
  - Fix desc for drdb_admin
  - Fix condor_amin()
  - Interface fixes for uptime, vdagent, vnstatd
  - Fix labeling for moodle in /var/www/moodle/data
  - Add interface fixes
  - Allow bugzilla to read certs
  - /var/www/moodle needs to be writable by apache
  - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest
  - Fix namespace_init_t to create content with proper labels, and allow it to manage all user content
  - Allow httpd_t to connect to osapi_compute port using httpd_use_openstack bolean
  - Fixes for dlm_controld
  - Fix apache_read_sys_content_rw_dirs() interface
  - Allow logrotate to read /var/log/z-push dir
  - Fix sys_nice for cups_domain
  - Allow postfix_postdrop to acces postfix_public socket
  - Allow sched_setscheduler for cupsd_t
  - Add missing context for /usr/sbin/snmpd
  - Kernel_t needs mac_admin in order to support labeled NFS
  - Fix systemd_dontaudit_dbus_chat() interface
  - Add interface to dontaudit attempts to send dbus messages to systemd domains, for xguest
  - Allow consolehelper domain to write Xauth files in /root
  - Add port definition for osapi_compute port
  - Allow unconfined to create /etc/hostname with correct labeling
  - Add systemd_filetrans_named_hostname() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-30
changelog:
  - Allow alsa_t signal_perms, we probaly should search for any app that can execute something without transition and give it signal_perms...
  - Add dontaudit for mozilla_plugin_t looking at the xdm_t sockets
  - Fix deny_ptrace boolean, certain ptrace leaked into the system
  - Allow winbind to manage kerberos_rcache_host
  - Allow spamd to create spamd_var_lib_t directories
  - Remove transition to mozilla_tmp_t by mozilla_t, to allow it to manage the users tmp dirs
  - Add mising nslcd_dontaudit_write_sock_file() interface
  - one more fix
  - Fix pki_read_tomcat_lib_files() interface
  - Allow certmonger to read pki-tomcat lib files
  - Allow certwatch to execute bin_t
  - Allow snmp to manage /var/lib/net-snmp files
  - Call snmp_manage_var_lib_files(fogorn_t) instead of snmp_manage_var_dirs
  - Fix vmware_role() interface
  - Fix cobbler_manage_lib_files() interface
  - Allow nagios check disk plugins to execute bin_t
  - Allow quantum to transition to openvswitch_t
  - Allow postdrop to stream connect to postfix-master
  - Allow quantum to stream connect to openvswitch
  - Add xserver_dontaudit_xdm_rw_stream_sockets() interface
  - Allow daemon to send dgrams to initrc_t
  - Allow kdm to start the power service to initiate a reboot or poweroff


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-31
changelog:
  - Fix description of deny_ptrace boolean
  - Remove allow for execmod lib_t for now
  - Allow quantum to connect to keystone port
  - Allow nova-console to talk with mysql over unix stream socket
  - Allow dirsrv to stream connect to uuidd
  - thumb_t needs to be able to create ~/.cache if it does not exist
  - virtd needs to be able to sys_ptrace when starting and stoping containers


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-32
changelog:
  - Allow realmd to run ipa, really needs to be an unconfined_domain
  - Allow sandbox domains to use inherted terminals
  - Allow pscd to use devices labeled svirt_image_t in order to use cat cards.
  - Add label for new alsa pid
  - Alsa now uses a pid file and needs to setsched 
  - Fix oracleasmfs_t definition
  - Add support for sshd_unit_file_t
  - Add oracleasmfs_t
  - Allow unlabeled_t files to be stored on unlabeled_t filesystems


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-33
changelog:
  - Fix mozilla specification of homedir content
  - Allow certmonger to read network state
  - Allow tmpwatch to read tmp in /var/spool/{cups,lpd}
  - Label all nagios plugin as unconfined by default
  - Add httpd_serve_cobbler_files()
  - Allow mdadm to read /dev/sr0 and create tmp files
  - Allow certwatch to send mails
  - Fix labeling for nagios plugins
  - label shared libraries in /opt/google/chrome as testrel_shlib_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-35
changelog:
  - Fix lockdev_manage_files()
  - Allow setroubleshootd to read var_lib_t to make email_alert working
  - Add lockdev_manage_files()
  - Call proper interface in virt.te
  - Allow gkeyring_domain to create /var/run/UID/config/dbus file
  - system dbus seems to be blocking suspend
  - Dontaudit attemps to sys_ptrace, which I believe gpsd does not need
  - When you enter a container from root, you generate avcs with a leaked file descriptor
  - Allow mpd getattr on file system directories
  - Make sure realmd creates content with the correct label
  - Allow systemd-tty-ask to write kmsg
  - Allow mgetty to use lockdev library for device locking
  - Fix selinuxuser_user_share_music boolean name to selinuxuser_share_music
  - When you enter a container from root, you generate avcs with a leaked file descriptor
  - Make sure init.fc files are labeled correctly at creation
  - File name trans vconsole.conf
  - Fix labeling for nagios plugins
  - label shared libraries in /opt/google/chrome as testrel_shlib_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-37
changelog:
  - Allow lvm to create its own unit files
  - Label /var/lib/sepolgen as selinux_config_t
  - Add filetrans rules for tw devices
  - Add transition from cupsd_config_t to cupsd_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-38
changelog:
  - Allow thumbnails to share memory with apps which run thumbnails
  - Allow postfix-postqueue block_suspend
  - Add lib interfaces for smsd
  - Add support for nginx
  - Allow s2s running as jabberd_t to connect to jabber_interserver_port_t
  - Allow pki apache domain to create own tmp files and execute httpd_suexec
  - Allow procmail to manger user tmp files/dirs/lnk_files
  - Add virt_stream_connect_svirt() interface
  - Allow dovecot-auth to execute bin_t
  - Allow iscsid to request that kernel load a kernel module
  - Add labeling support for /var/lib/mod_security
  - Allow iw running as tuned_t to create netlink socket
  - Dontaudit sys_tty_config for thumb_t
  - Add labeling for nm-l2tp-service
  - Allow httpd running as certwatch_t to open tcp socket
  - Allow useradd to manager smsd lib files
  - Allow useradd_t to add homedirs in /var/lib
  - Fix typo in userdomain.te
  - Cleanup userdom_read_home_certs
  - Implement userdom_home_reader_certs_type to allow read certs also on encrypt /home with ecryptfs_t
  - Allow staff to stream connect to svirt_t to make gnome-boxes working


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-39
changelog:
  - Allow tcpd to execute leafnode
  - Allow samba-net to read realmd cache files
  - Dontaudit sys_tty_config for alsactl
  - Fix allow rules for postfix_var_run
  - Allow cobblerd to read /etc/passwd
  - Allow pegasus to read exports
  - Allow systemd-timedate to read xdm state
  - Allow mout to stream connect to rpcbind
  - Add labeling just for /usr/share/pki/ca-trust-source instead of /usr/share/pki


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-41
changelog:
  - Remove userdom_home_manager for xdm_t and move all rules to xserver.te directly
  - Add new xdm_write_home boolean to allow xdm_t to create files in HOME dirs with xdm_home_t
  - Allow postfix-showq to read/write unix.showq in /var/spool/postfix/pid
  - Allow virsh to read xen lock file
  - Allow qemu-ga to create files in /run with proper labeling
  - Allow glusterd to connect to own socket in /tmp
  - Allow glance-api to connect to http port to make glance image-create working
  - Allow keystonte_t to execute rpm


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-42
changelog:
  - Allow samba-net to also read realmd tmp files
  - Allow NUT to use serial ports
  - realmd can be started by systemctl now


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-43
changelog:
  - Transition directories and files when in a user_tmp_t directory
  - Change certwatch to domtrans to apache instead of just execute
  - Allow virsh_t to read xen lib files
  - update policy rules for pegasus_openlmi_account_t
  - Add support for svnserve_tmp_t
  - Activate account openlmi policy
  - pegasus_openlmi_domain_template needs also require pegasus_t
  - One more fix for policykit.te
  - Call fs_list_cgroups_dirs() in policykit.te
  - Allow nagios service plugin to read mysql config files
  - Add labeling for /var/svn
  - Fix chrome.te
  - Fix pegasus_openlmi_domain_template() interfaces
  - Fix dev_rw_vfio_dev definiton, allow virtd_t to read tmpfs_t symlinks
  - Fix location of google-chrome data
  - Add support for chome_sandbox to store content in the homedir
  - Allow policykit to watch for changes in cgroups file system
  - Add boolean to allow  mozilla_plugin_t to use spice
  - Allow collectd to bind to udp port
  - Allow collected_t to read all of /proc
  - Should use netlink socket_perms
  - Should use netlink socket_perms
  - Allow glance domains to connect to apache ports
  - Allow apcupsd_t to manage its log files
  - Allow chrome objects to rw_inherited unix_stream_socket from callers
  - Allow staff_t to execute virtd_exec_t for running vms
  - nfsd_t needs to bind mountd port to make nfs-mountd.service working
  - Allow unbound net_admin capability because of setsockopt syscall
  - Fix fs_list_cgroup_dirs()
  - Label /usr/lib/nagios/plugins/utils.pm as bin_t
  - Remove uplicate definition of fs_read_cgroup_files()
  - Remove duplicate definition of fs_read_cgroup_files()
  - Add files_mountpoint_filetrans interface to be used by quotadb_t and snapperd
  - Additional interfaces needed to list and read cgroups config
  - Add port definition for collectd port
  - Add labels for /dev/ptp*
  - Allow staff_t to execute virtd_exec_t for running vms


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-44
changelog:
  - Make sure users and unconfined domains create .hushlogin with the correct label
  - Allow pegaus to chat with realmd over DBus
  - Allow cobblerd to read network state
  - Allow boicn-client to stat on /dev/input/mice
  - Allow certwatch to read net_config_t when it executes apache
  - Allow readahead to create /run/systemd and then create its own directory with the correct label


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-45
changelog:
  - Add additional fixes for #948073 bug
  - Allow sge_execd_t to also connect to sge ports
  - Allow openshift_cron_t to manage openshift_var_lib_t sym links
  - Allow openshift_cron_t to manage openshift_var_lib_t sym links
  - Allow sge_execd to bind sge ports. Allow kill capability and reads cgroup files
  - Remove pulseaudio filetrans pulseaudio_manage_home_dirs which is a part of pulseaudio_manage_home_files
  - Add networkmanager_stream_connect()
  - Make gnome-abrt wokring with staff_t
  - Fix openshift_manage_lib_files() interface
  - mdadm runs ps command which seems to getattr on random log files
  - Allow mozilla_plugin_t to create pulseaudit_home_t directories
  - Allow qemu-ga to shutdown virtual hosts
  - Add labelling for cupsd-browsed
  - Add web browser plugins to connect to aol ports
  - Allow nm-dhcp-helper to stream connect to NM
  - Add port definition for sge ports


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-46
changelog:
  - Dontaudit to getattr on dirs for dovecot-deliver
  - Allow raiudusd server connect to postgresql socket
  - Add kerberos support for radiusd
  - Allow saslauthd to connect to ldap port
  - Allow postfix to manage postfix_private_t files
  - Add chronyd support for #965457
  - Fix labeling for HOME_DIR/\.icedtea
  - CHange squid and snmpd to be allowed also write own logs
  - Fix labeling for /usr/libexec/qemu-ga
  - Allow virtd_t to use virt_lock_t
  - Allow also sealert to read the policy from the kernel
  - qemu-ga needs to execute scripts in /usr/libexec/qemu-ga and to use /tmp content
  - Dontaudit listing of users homedir by sendmail Seems like a leak
  - Allow passenger to transition to puppet master
  - Allow apache to connect to mythtv
  - Add definition for mythtv ports


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-47
changelog:
  - Add transition rules to unconfined domains and to sysadm_t to create /etc/adjtime
  - with the proper label.
  - Update files_filetrans_named_content() interface to get right labeling for pam.d conf files
  - Allow systemd-timedated to create adjtime
  - Add clock_create_adjtime()
  - Additional fix ifconfing for #966106
  - Allow kernel_t to create boot.log with correct labeling
  - Remove unconfined_mplayer for which we don't have rules
  - Rename interfaces
  - Add userdom_manage_user_home_files/dirs interfaces
  - Fix files_dontaudit_read_all_non_security_files
  - Fix ipsec_manage_key_file()
  - Fix ipsec_filetrans_key_file()
  - Label /usr/bin/razor-lightdm-greeter as xdm_exec_t instead of spamc_exec_t
  - Fix labeling for ipse.secrets
  - Add interfaces for ipsec and labeling for ipsec.info and ipsec_setup.pid
  - Add files_dontaudit_read_all_non_security_files() interface
  - /var/log/syslog-ng should be labeled var_log_t
  - Make ifconfig_var_run_t a mountpoint
  - Add transition from ifconfig to dnsmasq
  - Allow ifconfig to execute bin_t/shell_exec_t
  - We want to have hwdb.bin labeled as etc_t
  - update logging_filetrans_named_content() interface
  - Allow systemd_timedate_t to manage /etc/adjtime
  - Allow NM to send signals to l2tpd
  - Update antivirus_can_scan_system boolean
  - Allow devicekit_disk_t to sys_config_tty
  - Run abrt-harvest programs as abrt_t, and allow abrt_t to list all filesystem directories
  - Make printing from vmware working
  - Allow php-cgi from php54 collection to access /var/lib/net-snmp/mib_indexes
  - Add virt_qemu_ga_data_t for qemu-ga
  - Make chrome and mozilla able to connect to same ports, add jboss_management_port_t to both
  - Fix typo in virt.te
  - Add virt_qemu_ga_unconfined_t for hook scripts
  - Make sure NetworkManager files get created with the correct label
  - Add mozilla_plugin_use_gps boolean
  - Fix cyrus to have support for net-snmp
  - Additional fixes for dnsmasq and quantum for #966106
  - Add plymouthd_create_log()
  - remove httpd_use_oddjob for which we don't have rules
  - Add missing rules for httpd_can_network_connect_cobbler
  - Add missing cluster_use_execmem boolean
  - Call userdom_manage_all_user_home_type_files/dirs
  - Additional fix for ftp_home_dir
  - Fix ftp_home_dir boolean
  - Allow squit to recv/send client squid packet
  - Fix nut.te to have nut_domain attribute
  - Add support for ejabberd; TODO: revisit jabberd and rabbit policy
  - Fix amanda policy
  - Add more fixes for domains which use libusb
  - Make domains which use libusb working correctly
  - Allow l2tpd to create ipsec key files with correct labeling and manage them
  - Fix cobbler_manage_lib_files/cobbler_read_lib_files to cover also lnk files
  - Allow rabbitmq-beam to bind generic node
  - Allow l2tpd to read ipse-mgmt pid files
  - more fixes for l2tpd, NM and pppd from #967072


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-48
changelog:
  - Fix openshift_search_lib
  - Add support for abrt-uefioops-oops
  - Allow colord to getattr any file system
  - Allow chrome processes to look at each other
  - Allow sys_ptrace for abrt_t
  - Add new policy for gssproxy
  - Dontaudit leaked file descriptor writes from firewalld
  - openshift_net_type is interface not template
  - Dontaudit pppd to search gnome config
  - Update openshift_search_lib() interface
  - Add fs_list_pstorefs()
  - Fix label on libbcm_host.so since it is built incorrectly on raspberry pi, needs back port to F18
  - Better labels for raspberry pi devices
  - Allow init to create devpts_t directory
  - Temporarily label rasbery pi devices as memory_device_t, needs back port to f18
  - Allow sysadm_t to build kernels
  - Make sure mount creates /var/run/blkid with the correct label, needs back port to F18
  - Allow userdomains to stream connect to gssproxy
  - Dontaudit leaked file descriptor writes from firewalld
  - Allow xserver to read /dev/urandom
  - Add additional fixes for ipsec-mgmt
  - Make SSHing into an Openshift Enterprise Node working


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-49
changelog:
  - Fix courier_domain_template() interface
  - Allow blueman to write ip_forward
  - Allow mongodb to connect to mongodb port
  - Allow mongodb to connect to mongodb port
  - Allow java to bind jobss_debug port
  - Fixes for *_admin interfaces
  - Allow iscsid auto-load kernel modules needed for proper iSCSI functionality
  - Need to assign attribute for courier_domain to all courier_domains
  - Fail2ban reads /etc/passwd
  - postfix_virtual will create new files in postfix_spool_t
  - abrt triggers sys_ptrace by running pidof
  - Label ~/abc as mozilla_home_t, since java apps as plugin want to create it
  - Add passenger fixes needed by foreman
  - Remove dup interfaces
  - Add additional interfaces for quantum
  - Add new interfaces for dnsmasq
  - Allow  passenger to read localization and send signull to itself
  - Allow dnsmasq to stream connect to quantum
  - Add quantum_stream_connect()
  - Make sure that mcollective starts the service with the correct labeling
  - Add labels for ~/.manpath
  - Dontaudit attempts by svirt_t to getpw* calls
  - sandbox domains are trying to look at parent process data
  - Allow courior auth to create its pid file in /var/spool/courier subdir
  - Add fixes for beam to have it working with couchdb
  - Add labeling for /run/nm-xl2tpd.con
  - Allow apache to stream connect to thin
  - Add systemd support for amand
  - Make public types usable for fs mount points
  - Call correct mandb interface in domain.te
  - Allow iptables to r/w quantum inherited pipes and send sigchld
  - Allow ifconfig domtrans to iptables and execute ldconfig
  - Add labels for ~/.manpath
  - Allow systemd to read iscsi lib files
  - seunshare is trying to look at parent process data


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-50
changelog:
  - Allow wine to manage wine home content
  - Make amanda working with socket actiovation
  - Add labeling for /usr/sbin/iscsiadm
  - Add support for /var/run/gssproxy.sock
  - dnsmasq_t needs to read sysctl_net_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-51
changelog:
  - accountservice watches when accounts come and go in wtmp
  - /usr/java/jre1.7.0_21/bin/java needs to create netlink socket
  - Add httpd_use_sasl boolean
  - Allow net_admin for tuned_t
  - iscsid needs sys_module to auto-load kernel modules
  - Allow blueman to read bluetooth conf
  - Add nova_manage_lib_files() interface
  - Fix mplayer_filetrans_home_content()
  - Add mplayer_filetrans_home_content()
  - mozilla_plugin_config_roles need to be able to access mozilla_plugin_config_t
  - Revert "Allow thumb_t to append inherited xdm stream socket"
  - Add iscsi_filetrans_named_content() interface
  - Allow to create .mplayer with the correct labeling for unconfined
  - Allow iscsiadmin to create lock file with the correct labeling


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-52
changelog:
  - Add labeling for /dev/tgt
  - Dontaudit leak fd from firewalld for modprobe
  - Allow runuser running as rpm_script_t to create netlink_audit socket
  - Allow mdadm to read BIOS non-volatile RAM


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-53
changelog:
  - Make vdagent able to request loading kernel module
  - Add support for cloud-init make it as unconfined domain
  - Allow snmpd to run smartctl in fsadm_t domain
  - remove duplicate openshift_search_lib() interface
  - Allow mysqld to search openshift lib files
  - Allow openshift cgroup to interact with passedin file descriptors
  - Allow colord to list directories inthe users homedir
  - aide executes prelink to check files
  - Make sure cupsd_t creates content in /etc/cups with the correct label
  - Lest dontaudit apache read all domains, so passenger will not cause this avc
  - Allow gssd to connect to gssproxy
  - systemd-tmpfiles needs to be able to raise the level to fix labeling on /run/setrans in MLS
  - Allow systemd-tmpfiles to relabel also lock files
  - Allow useradd to add homdir in /var/lib/openshift
  - Allow setfiles and semanage to write output to /run/files


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-54
changelog:
  - Don't audit access checks by sandbox xserver on xdb var_lib
  - Allow ntop to read usbmon devices
  - Add labeling for new polcykit authorizor
  - Dontaudit access checks from fail2ban_client
  - Don't audit access checks by sandbox xserver on xdb var_lib
  - Allow apps that connect to xdm stream to conenct to xdm_dbusd_t stream
  - Fix labeling for all /usr/bim/razor-lightdm-* binaries
  - Add filename trans for /dev/md126p1


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-55
changelog:
  - condor_collector uses tcp/9000
  - Label /usr/sbin/virtlockd as virtd_exec_t for now
  - Allow cobbler to execute ldconfig
  - Allow NM to execute ssh
  - Allow mdadm to read /dev/crash
  - Allow antivirus domains to connect to snmp port
  - Make amavisd-snmp working correctly
  - Allow nfsd_t to mounton nfsd_fs_t
  - Add initial snapper policy
  - We still need to have consolekit policy
  - Dontaudit firefox attempting to connect to the xserver_port_t if run within sandbox_web_t
  - Dontaudit sandbox apps attempting to open user_devpts_t
  - Allow dirsrv to read network state
  - Fix pki_read_tomcat_lib_files
  - Add labeling for /usr/libexec/nm-ssh-service
  - Add label cert_t for /var/lib/ipa/pki-ca/publish
  - Lets label /sys/fs/cgroup as cgroup_t for now, to keep labels consistant
  - Allow nfsd_t to mounton nfsd_fs_t
  - Dontaudit sandbox apps attempting to open user_devpts_t
  - Allow passwd_t to change role to system_r from unconfined_r


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-56
changelog:
  - Allow lvm_t to create default targets for filesystem handling
  - Fix labeling for razor-lightdm binaries
  - Allow insmod_t to read any file labeled var_lib_t
  - Add policy for pesign
  - Activate policy for cmpiLMI_Account-cimprovagt
  - Allow isnsd syscall=listen
  - /usr/libexec/pegasus/cimprovagt needs setsched caused by sched_setscheduler
  - Allow ctdbd to use udp/4379
  - gatherd wants sys_nice and setsched
  - Add support for texlive2012
  - Allow NM to read file_t (usb stick with no labels used to transfer keys for example)
  - Allow cobbler to execute apache with domain transition


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-57
changelog:
  - Make DSPAM to act as a LDA working
  - Allow ntop to create netlink socket
  - Allow policykit to send a signal to policykit-auth
  - Allow stapserver to dbus chat with avahi/systemd-logind
  - Fix labeling on haproxy unit file
  - Clean up haproxy policy
  - A new policy for haproxy and placed it to rhcs.te
  - Add support for ldirectord and treat it with cluster_t
  - Make sure anaconda log dir is created with var_log_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-58
changelog:
  - Shrink the size of policy by moving to attributes, also add dridomain so that mozilla_plugin can follow selinuxuse_dri boolean. 
  - Allow bootloader to manage generic log files 
  - Allow ftp to bind to port 989 
  - Fix label of new gear directory 
  - Add support for new directory /var/lib/openshift/gears/ 
  - Add openshift_manage_lib_dirs() 
  - allow virtd domains to manage setrans_var_run_t 
  - Allow useradd to manage all openshift content 
  - Add support so that mozilla_plugin_t can use dri devices 
  - Allow chronyd to change the scheduler 
  - Allow apmd to shut downthe system 
  - Devicekit_disk_t needs to manage /etc/fstab


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-59
changelog:
  - Add prosody policy written by Michael Scherer
  - Allow nagios plugins to read /sys info
  - ntpd needs to manage own log files
  - Add support for HOME_DIR/.IBMERS
  - Allow iptables commands to read firewalld config
  - Allow consolekit_t to read utmp
  - Fix filename transitions on .razor directory
  - Add additional fixes to make DSPAM with LDA working
  - Allow snort to read /etc/passwd
  - Allow fail2ban to communicate with firewalld over dbus
  - Dontaudit openshift_cgreoup_file_t read/write leaked dev
  - Allow nfsd to use mountd port
  - Call th proper interface
  - Allow openvswitch to read sys and execute plymouth
  - Allow tmpwatch to read /var/spool/cups/tmp
  - Add support for /usr/libexec/telepathy-rakia
  - Add systemd support for zoneminder
  - Allow mysql to create files/directories under /var/log/mysql
  - Allow zoneminder apache scripts to rw zoneminder tmpfs
  - Allow httpd to manage zoneminder lib files
  - Add zoneminder_run_sudo boolean to allow to start zoneminder
  - Allow zoneminder to send mails
  - gssproxy_t sock_file can be under /var/lib
  - Allow web domains to connect to whois port.
  - Allow sandbox_web_type to connect to the same ports as mozilla_plugin_t.
  - We really need to add an interface to corenet to define what a web_client_domain is and
  - then define chrome_sandbox_t, mozilla_plugin_t and sandbox_web_type to that domain.
  - Add labeling for cmpiLMI_LogicalFile-cimprovagt
  - Also make pegasus_openlmi_logicalfile_t as unconfined to have unconfined_domain attribute for filename trans rules
  - Update policy rules for pegasus_openlmi_logicalfile_t
  - Add initial types for logicalfile/unconfined OpenLMI providers
  - mailmanctl needs to read own log
  - Allow logwatch manage own lock files
  - Allow nrpe to read meminfo
  - Allow httpd to read certs located in pki-ca
  - Add pki_read_tomcat_cert() interface
  - Add support for nagios openshift plugins
  - Add port definition for redis port
  - fix selinuxuser_use_ssh_chroot boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-60
changelog:
  - Allow nsd_t to read /dev/urand
  - Allow mdadm_t to read framebuffer
  - Allow rabbitmq_beam_t to read process info on rabbitmq_epmd_t
  - Allow mozilla_plugin_config_t to create tmp files
  - Cleanup openvswitch policy
  - Allow mozilla plugin to getattr on all executables
  - Allow l2tpd_t to create fifo_files in /var/run
  - Allow samba to touch/manage fifo_files or sock_files in a samba_share_t directory
  - Allow mdadm to connecto its own unix_stream_socket
  - FIXME: nagios changed locations to /log/nagios which is wrong. But we need to have this workaround for now.
  - Allow apache to access smokeping pid files
  - Allow rabbitmq_beam_t to getattr on all filesystems
  - Add systemd support for iodined
  - Allow nup_upsdrvctl_t to execute its entrypoint
  - Allow fail2ban_client to write to fail2ban_var_run_t, Also allow it to use nsswitch
  - add labeling for ~/.cache/libvirt-sandbox
  - Add interface to allow domains transitioned to by confined users to send sigchld to screen program
  - Allow sysadm_t to check the system status of files labeled etc_t, /etc/fstab
  - Allow systemd_localed to start /usr/lib/systemd/system/systemd-vconsole-setup.service
  - Allow an domain that has an entrypoint from a type to be allowed to execute the entrypoint without a transition,  I can see no case where this is  a bad thing, and elminiates a whole class of AVCs.
  - Allow staff to getsched all domains, required to run htop
  - Add port definition for redis port
  - fix selinuxuser_use_ssh_chroot boolean


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-61
changelog:
  - Allow mdamd to execute systemctl
  - Allow mdadm to read /dev/kvm
  - Allow ipsec_mgmt_t to read l2tpd pid content


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-64
changelog:
  - Add support for gluster ports
  - Make sure that all keys located in /etc/ssh/ are labeled correctly
  - Make sure apcuspd lock files get created with the correct label
  - Use getcap in gluster.te
  - Fix gluster policy
  - add additional fixes to allow beam.smp to interact with couchdb files
  - Additional fix for #974149
  - Allow gluster to user gluster ports
  - Allow glusterd to transition to rpcd_t and add additional fixes for #980683
  - Allow tgtd working when accessing to the passthrough device
  - Fix labeling for mdadm unit files


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-65
changelog:
  - Label /var/lib/ipa/pki-ca/publish as pki_tomcat_cert_t
  - Add labeling for /usr/libexec/kde4/polkit-kde-authentication-agent-1
  - Allow all domains that can domtrans to shutdown, to start the power services script to shutdown
  - consolekit needs to be able to shut down system
  - Move around interfaces
  - Remove nfsd_rw_t and nfsd_ro_t, they don't do anything
  - Add additional fixes for rabbitmq_beam to allow getattr on mountpoints
  - Allow gconf-defaults-m to read /etc/passwd
  - Fix pki_rw_tomcat_cert() interface to support lnk_files


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-66
changelog:
  - Allow systemd-tmpfile to handle tmp content in print spool dir
  - Allow systemd-sysctl to send system log messages
  - Add support for RTP media ports and fmpro-internal
  - Make auditd working if audit is configured to perform SINGLE action on disk error
  - Add interfaces to handle systemd units
  - Make systemd-notify working if pcsd is used
  - Add support for netlabel and label /usr/sbin/netlabelctl as iptables_exec_t
  - Instead of having all unconfined domains get all of the named transition rules,
  - Only allow unconfined_t, init_t, initrc_t and rpm_script_t by default.
  - Add definition for the salt ports
  - Allow xdm_t to create link files in xdm_var_run_t
  - Dontaudit reads of blk files or chr files leaked into ldconfig_t
  - Allow sys_chroot for useradd_t
  - Allow net_raw cap for ipsec_t
  - Allow sysadm_t to reload services
  - Add additional fixes to make strongswan working with a simple conf
  - Allow sysadm_t to enable/disable init_t services
  - Add additional glusterd perms
  - Allow apache to read lnk files in the /mnt directory
  - Allow glusterd to ask the kernel to load a module
  - Fix description of ftpd_use_fusefs boolean
  - Allow svirt_lxc_net_t to sys_chroot, modify policy to tighten up svirt_lxc_domain capabilties and process controls, but add them to svirt_lxc_net_t
  - Allow glusterds to request load a kernel module
  - Allow boinc to stream connect to xserver_t
  - Allow sblim domains to read /etc/passwd
  - Allow mdadm to read usb devices
  - Allow collectd to use ping plugin
  - Make foghorn working with SNMP
  - Allow sssd to read ldap certs
  - Allow haproxy to connect to RTP media ports
  - Add additional trans rules for aide_db
  - Add labeling for /usr/lib/pcsd/pcsd
  - Add labeling for /var/log/pcsd
  - Add support for pcs which is a corosync and pacemaker configuration tool


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-67
changelog:
  - Add support for cmpiLMI_Service-cimprovagt
  - Allow pegasus domtrans to rpm_t to make pycmpiLMI_Software-cimprovagt running as rpm_t
  - Label pycmpiLMI_Software-cimprovagt as rpm_exec_t
  - Add support for pycmpiLMI_Storage-cimprovagt
  - Add support for cmpiLMI_Networking-cimprovagt
  - Allow system_cronjob_t to create user_tmpfs_t to make pulseaudio working
  - Allow virtual machines and containers to run as user doains, needed for virt-sandbox
  - Allow buglist.cgi to read cpu info


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-68
changelog:
  - Allow xdm_t to act as a dbus client to itsel
  - Allow fetchmail to resolve host names
  - Allow gnupg apps to write to pcscd socket
  - Add labeling for cmpiLMI_Fan-cimprovagt
  - Allow net_admin for glusterd
  - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/
  - Add pegasus_openlmi_system_t
  - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te
  -httpd_t does access_check on certs


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-69
changelog:
  - Add more aliases in pegasus.te
  - Add more fixes for *_admin interfaces
  - Add interface fixes
  - Allow nscd to stream connect to nmbd
  - Allow gnupg apps to write to pcscd socket
  - Add more fixes for openlmi provides. Fix naming and support for additionals
  - Allow fetchmail to resolve host names
  - Allow firewalld to interact also with lnk files labeled as firewalld_etc_rw_t
  - Add labeling for cmpiLMI_Fan-cimprovagt
  - Allow net_admin for glusterd
  - Allow telepathy domain to create dconf with correct labeling in /home/userX/.cache/
  - Add pegasus_openlmi_system_t
  - Fix puppet_domtrans_master() to make all puppet calling working in passenger.te
  - Fix corecmd_exec_chroot()
  - Fix logging_relabel_syslog_pid_socket interface
  - Fix typo in unconfineduser.te
  - Allow system_r to access unconfined_dbusd_t to run hp_chec


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-70
changelog:
  - selinux_set_enforce_mode needs to be used with type
  - Add append to the dontaudit for unix_stream_socket of xdm_t leak
  - Allow xdm_t to create symlinks in log direcotries
  - Allow login programs to read afs config
  - Label 10933 as a pop port, for dovecot
  - New policy to allow selinux_server.py to run as semanage_t as a dbus service
  - Add fixes to make netlabelctl working on MLS
  - AVCs required for running sepolicy gui as staff_t
  - Dontaudit attempts to read symlinks, sepolicy gui is likely to cause this type of AVC
  - New dbus server to be used with new gui
  - After modifying some files in /etc/mail, I saw this needed on the next boot
  - Loading a vm from /usr/tmp with virt-manager
  - Clean up oracleasm policy for Fedora
  - Add oracleasm policy written by rlopez@redhat.com
  - Make postfix_postdrop_t as mta_agent to allow domtrans to system mail if it is executed by apache
  - Add label for /var/crash
  - Allow fenced to domtrans to sanclok_t
  - Allow nagios to manage nagios spool files
  - Make tfptd as home_manager
  - Allow kdump to read kcore on MLS system
  - Allow mysqld-safe sys_nice/sys_resource caps
  - Allow apache to search automount tmp dirs if http_use_nfs is enabled
  - Allow crond to transition to named_t, for use with unbound
  - Allow crond to look at named_conf_t, for unbound
  - Allow mozilla_plugin_t to transition its home content
  - Allow dovecot_domain to read all system and network state
  - Allow httpd_user_script_t to call getpw
  - Allow semanage to read pid files
  - Dontaudit leaked file descriptors from user domain into thumb
  - Make PAM authentication working if it is enabled in ejabberd
  - Add fixes for rabbit to fix ##992920,#992931
  - Allow glusterd to mount filesystems
  - Loading a vm from /usr/tmp with virt-manager
  - Trying to load a VM I got an AVC from devicekit_disk for loopcontrol device
  - Add fix for pand service
  - shorewall touches own log
  - Allow nrpe to list /var
  - Mozilla_plugin_roles can not be passed into lpd_run_lpr
  - Allow afs domains to read afs_config files
  - Allow login programs to read afs config
  - Allow virt_domain to read virt_var_run_t symlinks
  - Allow smokeping to send its process signals
  - Allow fetchmail to setuid
  - Add kdump_manage_crash() interface
  - Allow abrt domain to write abrt.socket


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-71
changelog:
  - Allow boinc to connect to  @/tmp/.X11-unix/X0
  - Allow beam.smp to connect to tcp/5984
  - Allow named to manage own log files
  - Add label for /usr/libexec/dcc/start-dccifd  and domtrans to dccifd_t
  - Add virt_transition_userdomain boolean decl
  - Allow httpd_t to sendto unix_dgram sockets on its children
  - Allow nova domains to execute ifconfig
  - bluetooth wants to create fifo_files in /tmp
  - exim needs to be able to manage mailman data
  - Allow sysstat to getattr on all file systems
  - Looks like bluetoothd has moved
  - Allow collectd to send ping packets
  - Allow svirt_lxc domains to getpgid
  - Remove virt-sandbox-service labeling as virsh_exec_t, since it no longer does virsh_t stuff
  - Allow frpintd_t to read /dev/urandom
  - Allow asterisk_t to create sock_file in /var/run
  - Allow usbmuxd to use netlink_kobject
  - sosreport needs to getattr on lots of devices, and needs access to netlink_kobject_uevent_socket
  - More cleanup of svirt_lxc policy
  - virtd_lxc_t now talks to dbus
  - Dontaudit leaked ptmx_t
  - Allow processes to use inherited fifo files
  - Allow openvpn_t to connect to squid ports
  - Allow prelink_cron_system_t to ask systemd to reloaddd miscfiles_dontaudit_access_check_cert()
  - Allow ssh_t to use /dev/ptmx
  - Make sure /run/pluto dir is created with correct labeling
  - Allow syslog to run shell and bin_t commands
  - Allow ip to relabel tun_sockets
  - Allow mount to create directories in files under /run
  - Allow processes to use inherited fifo files
  - Allow user roles to connect to the journal socket


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-72
changelog:
  - Add policy for lsmd
  - Add support for /var/log/mariadb dir and allow mysqld_safe to list this directory
  - Update condor_master rules to allow read system state info and allow logging
  - Add labeling for /etc/condor and allow condor domain to write it (bug)
  - Allow condor domains to manage own logs
  - Allow glusterd to read domains state
  - Fix initial hypervkvp policy
  - Add policy for hypervkvpd
  - Fix redis.if summary


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-73
changelog:
  0 
  - Allow rhsmcertd to read init state
  - Allow fsetid for pkcsslotd
  - Fix labeling for /usr/lib/systemd/system/pkcsslotd.service
  - Allow fetchmail to create own pid with correct labeling
  - Fix rhcs_domain_template()
  - Allow roles which can run mock to read mock lib files to view results
  - Allow rpcbind to use nsswitch
  - Fix lsm.if summary
  - Fix collectd_t can read /etc/passwd file
  - Label systemd unit files under dracut correctly
  - Add support for pam_mount to mount user's encrypted home When a user logs in and logs out using ssh
  - Add support for .Xauthority-n
  - Label umount.crypt as lvm_exec_t
  - Allow syslogd to search psad lib files
  - Allow ssh_t to use /dev/ptmx
  - Make sure /run/pluto dir is created with correct labeling
  - Allow syslog to run shell and bin_t commands
  - Allow ip to relabel tun_sockets
  - Allow mount to create directories in files under /run
  - Allow processes to use inherited fifo files


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-75
changelog:
  - Also sock_file trans rule is needed in lsm
  - Fix labeling for fetchmail pid files/dirs
  - Add additional fixes for abrt-upload-watch
  - Fix polipo.te
  - Fix transition rules in asterisk policy
  - Add fowner capability to networkmanager policy
  - Allow polipo to connect to tor ports
  - Cleanup lsmd.if
  - Cleanup openhpid policy
  - Fix kdump_read_crash() interface
  - Make more domains as init domain
  - Fix cupsd.te
  - Fix requires in rpm_rw_script_inherited_pipes
  - Fix interfaces in lsm.if
  - Allow munin service plugins to manage own tmpfs files/dirs
  - Allow virtd_t also relabel unix stream sockets for virt_image_type
  - Make ktalk as init domain
  - Fix to define ktalkd_unit_file_t correctly
  - Fix ktalk.fc
  - Add systemd support for talk-server
  - Allow glusterd to create sock_file in /run
  - Allow xdm_t to delete gkeyringd_tmp_t files on logout
  - Add fixes for hypervkvp policy
  - Add logwatch_can_sendmail boolean
  - Allow mysqld_safe_t to handle also symlinks in /var/log/mariadb
  - Allow xdm_t to delete gkeyringd_tmp_t files on logout


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-76
changelog:
  - Cleanup related to init_domain()+inetd_domain fixes
  - Use just init_domain instead of init_daemon_domain in inetd_core_service_domain
  - svirt domains neeed to create kobject_uevint_sockets
  - Lots of new access required for sosreport
  - Allow tgtd_t to connect to isns ports
  - Allow init_t to transition to all inetd domains:
  - openct needs to be able to create netlink_object_uevent_sockets
  - Dontaudit leaks into ldconfig_t
  - Dontaudit su domains getattr on /dev devices, move su domains to attribute based calls
  - Move kernel_stream_connect into all Xwindow using users
  - Dontaudit inherited lock files in ifconfig o dhcpc_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-77
changelog:
  - Split out rlogin ports from inetd
  - Treat files labeld as usr_t like bin_t when it comes to transitions
  - Allow staff_t to read login config
  - Allow ipsec_t to read .google authenticator data
  - Allow systemd running as git_systemd to bind git port
  - Fix mozilla_plugin_rw_tmpfs_files()
  - Call the correct interface - corenet_udp_bind_ktalkd_port()
  - Allow all domains that can read gnome_config to read kde config
  - Allow sandbox domain to read/write mozilla_plugin_tmpfs_t so pulseaudio will work
  - Allow mdadm to getattr any file system
  - Allow a confined domain to executes mozilla_exec_t via dbus
  - Allow cupsd_lpd_t to bind to the printer port
  - Dontaudit attempts to bind to ports < 1024 when nis is turned on
  - Allow apache domain to connect to gssproxy socket
  - Allow rlogind to bind to the rlogin_port
  - Allow telnetd to bind to the telnetd_port
  - Allow ktalkd to bind to the ktalkd_port
  - Allow cvs to bind to the cvs_port


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-78
changelog:
  - Allow xdm_t to transition to itself
  - Call neutron interfaces instead of quantum
  - Allow init to change targed role to make uncofined services (xrdp which now has own systemd unit file) working. We want them to have in unconfined_t
  - Make sure directories in /run get created with the correct label
  - Make sure /root/.pki gets created with the right label
  - try to remove labeling for motion from zoneminder_exec_t to bin_t
  - Allow inetd_t to execute shell scripts
  - Allow cloud-init to read all domainstate
  - Fix to use quantum port
  - Add interface netowrkmanager_initrc_domtrans
  - Fix boinc_execmem
  - Allow t-mission-control to read gabble cache home
  - Add labeling for ~/.cache/telepathy/avatars/gabble
  - Allow memcache to read sysfs data
  - Cleanup antivirus policy and add additional fixes
  - Add boolean boinc_enable_execstack
  - Add support for couchdb in rabbitmq policy
  - Add interface couchdb_search_pid_dirs
  - Allow firewalld to read NM state
  - Allow systemd running as git_systemd to bind git port
  - Fix mozilla_plugin_rw_tmpfs_files()


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-79
changelog:
  - Allow block_suspend cap for samba-net
  - Allow t-mission-control to manage gabble cache files
  - Allow nslcd to read /sys/devices/system/cpu
  - Allow selinux_store to use symlinks


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-80
changelog:
  - Allow ldconfig to write to kdumpctl fifo files
  - allow neutron to connect to amqp ports
  - Allow kdump_manage_crash to list the kdump_crash_t directory
  - Allow glance-api to connect to amqp port
  - Allow virt_qemu_ga_t to read meminfo
  - Add antivirus_home_t type for antivirus date in HOMEDIRS
  - Allow mpd setcap which is needed by pulseaudio
  - Allow smbcontrol to create content in /var/lib/samba
  - Allow mozilla_exec_t to be used as a entrypoint to mozilla_domtrans_spec
  - Add additional labeling for qemu-ga/fsfreeze-hook.d scripts
  - amanda_exec_t needs to be executable file
  - Allow block_suspend cap for samba-net
  - Allow apps that read ipsec_mgmt_var_run_t to search ipsec_var_run_t
  - Allow init_t to run crash utility
  - Treat usr_t just like bin_t for transitions and executions
  - Add port definition of pka_ca to port 829 for openshift
  - Allow selinux_store to use symlinks


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-81
changelog:
  - Dontaudit attempts by sosreport to read shadow_t
  - Allow browser sandbox plugins to connect to cups to print
  - Add new label mpd_home_t
  - Label /srv/www/logs as httpd_log_t
  - Add support for /var/lib/php/wsdlcache
  - Add zarafa_setrlimit boolean
  - Allow fetchmail to send mails
  - Add labels for apache logs under miq package
  - Allow irc_t to use tcp sockets
  - fix labels in puppet.if
  - Allow tcsd to read utmp file
  - Allow openshift_cron_t to run ssh-keygen in ssh_keygen_t to access host keys
  - Define svirt_socket_t as a domain_type
  - Take away transition from init_t to initrc_t when executing bin_t, allow init_t to run chk_passwd_t
  - Fix label on pam_krb5 helper apps


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-82
changelog:
  - wine_tmp is no longer needed
  - Allow setroubleshoot to look at /proc
  - Allow telepathy domains to dbus with systemd logind
  - Fix handling of fifo files of rpm
  - Allow mozilla_plugin to transition to itself
  - Allow certwatch to write to cert_t directories
  - New abrt application
  - Allow NetworkManager to set the kernel scheduler
  - Make wine_domain shared by all wine domains
  - Allow mdadm_t to read images labeled svirt_image_t
  - Allow amanda to read /dev/urand
  - ALlow my_print_default to read /dev/urand
  - Allow mdadm to write to kdumpctl fifo files
  - Allow nslcd to send signull to itself
  - Allow yppasswd to read /dev/urandom
  - Fix zarafa_setrlimit
  - Add support for /var/lib/php/wsdlcache
  - Add zarafa_setrlimit boolean
  - Allow fetchmail to send mails
  - Add additional alias for user_tmp_t because wine_tmp_t is no longer used
  - More handling of ther kernel keyring required by kerberos
  - New privs needed for init_t when running without transition to initrc_t over bin_t, and without unconfined domain installed


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-84
changelog:
  - Fix labeling for /usr/libexec/kde4/kcmdatetimehelper
  - Allow tuned to search all file system directories
  - Allow alsa_t to sys_nice, to get top performance for sound management
  - Add support for MySQL/PostgreSQL for amavis
  - Allow openvpn_t to manage openvpn_var_log_t files.
  - Allow dirsrv_t to create tmpfs_t directories
  - Allow dirsrv to create dirs in /dev/shm with dirsrv_tmpfs label
  - Dontaudit leaked unix_stream_sockets into gnome keyring
  - Allow telepathy domains to inhibit pipes on telepathy domains
  - Allow cloud-init to domtrans to rpm
  - Allow abrt daemon to manage abrt-watch tmp files
  - Allow abrt-upload-watcher to search /var/spool directory
  - Allow nsswitch domains to manage own process key
  - Fix labeling for mgetty.* logs
  - Allow systemd to dbus chat with upower
  - Allow ipsec to send signull to itself
  - Allow setgid cap for ipsec_t
  - Match upstream labeling


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-86
changelog:
  - Fix nscd_shm_use()
  - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services.
  - Add hypervkvp_unit_file_t type
  - Add additional fixes forpegasus_openlmi_account_t
  - Allow mdadm to read /dev/urand
  - Allow pegasus_openlmi_storage_t to create mdadm.conf and write it
  - Add label/rules for /etc/mdadm.conf
  - Allow pegasus_openlmi_storage_t to transition to fsadm_t
  - Fixes for interface definition problems
  - Dontaudit dovecot-deliver to gettatr on all fs dirs
  - Allow domains to search data_home_t directories
  - Allow cobblerd to connect to mysql
  - Allow mdadm to r/w kdump lock files
  - Add support for kdump lock files
  - Label zarafa-search as zarafa-indexer
  - Openshift cgroup wants to read /etc/passwd
  - Add new sandbox domains for kvm
  - Allow mpd to interact with pulseaudio if mpd_enable_homedirs is turned on
  - Fix labeling for /usr/lib/systemd/system/lvm2.*
  - Add labeling for /usr/lib/systemd/system/lvm2.*
  - Fix typos to get a new build. We should not cover filename trans rules to prevent duplicate rules
  - Add sshd_keygen_t policy for sshd-keygen
  - Fix alsa_home_filetrans interface name and definition
  - Allow chown for ssh_keygen_t
  - Add fs_dontaudit_getattr_all_dirs()
  - Allow init_t to manage etc_aliases_t and read xserver_var_lib_t and chrony keys
  - Fix up patch to allow systemd to manage home content
  - Allow domains to send/recv unlabeled traffic if unlabelednet.pp is enabled
  - Allow getty to exec hostname to get info
  - Add systemd_home_t for ~/.local/share/systemd directory


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-87
changelog:
  - init reload  from systemd_localed_t
  - Allow domains that communicate with systemd_logind_sessions to use systemd_logind_t fd
  - Allow systemd_localed_t to ask systemd to reload the locale.
  - Add systemd_runtime_unit_file_t type for unit files that systemd creates in memory
  - Allow readahead to read /dev/urand
  - Fix lots of avcs about tuned
  - Any file names xenstored in /var/log should be treated as xenstored_var_log_t
  - Allow tuned to inderact with hugepages
  - Allow condor domains to list etc rw dirs


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-88
changelog:
  - Add auth_exec_chkpwd interface
  - Fix port definition for ctdb ports
  - Allow systemd domains to read /dev/urand
  - Dontaudit attempts for mozilla_plugin to append to /dev/random
  - Add label for /var/run/charon.*
  - Add labeling for /usr/lib/systemd/system/lvm2.*dd policy for motion service
  - Fix for nagios_services plugins
  - Fix some bugs in zoneminder policy
  - add type defintion for ctdbd_var_t
  - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file
  - Allow net_admin/netlink_socket all hyperv_domain domains
  - Add labeling for zarafa-search.log and zarafa-search.pid
  - glusterd binds to random unreserved ports
  - Additional allow rules found by testing glusterfs
  - apcupsd needs to send a message to all users on the system so needs to look them up
  - Fix the label on ~/.juniper_networks
  - Dontaudit attempts for mozilla_plugin to append to /dev/random
  - Allow polipo_daemon to connect to flash ports
  - Allow gssproxy_t to create replay caches
  - Fix nscd_shm_use()
  - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services.
  - Add hypervkvp_unit_file_t type


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-89
changelog:
  - Fix gnome_read_generic_data_home_files()
  - allow openshift_cgroup_t to read/write inherited openshift file types
  - Remove httpd_cobbler_content * from cobbler_admin interface
  - Allow svirt sandbox domains to setattr on chr_file and blk_file svirt_sandbox_file_t, so sshd will work within a container
  - Allow httpd_t to read also git sys content symlinks
  - Allow init_t to read gnome home data
  - Dontaudit setroubleshoot_fixit_t execmem, since it does not seem to really need it.
  - Allow virsh to execute systemctl
  - Fix for nagios_services plugins
  - add type defintion for ctdbd_var_t
  - Add support for /var/ctdb. Allow ctdb block_suspend and read /etc/passwd file
  - Allow net_admin/netlink_socket all hyperv_domain domains
  - Add labeling for zarafa-search.log and zarafa-search.pid
  - Fix hypervkvp.te
  - Fix nscd_shm_use()
  - Add initial policy for /usr/sbin/hypervvssd in hypervkvp policy which should be renamed to hyperv. Also add hyperv_domain attribute to treat these HyperV services.
  - Add hypervkvp_unit_file_t type
  - Fix logging policy
  - Allow syslog to bind to tls ports
  - Update labeling for /dev/cdc-wdm
  - Allow to su_domain to read init states
  - Allow init_t to read gnome home data
  - Make sure if systemd_logind creates nologin file with the correct label
  - Clean up ipsec.te


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-91
changelog:
  - Allow mailserver_domains to manage and transition to mailman data
  - Dontaudit attempts by mozilla plugin to relabel content, caused by using mv and cp commands
  - Allow mailserver_domains to manage and transition to mailman data
  - Allow svirt_domains to read sysctl_net_t
  - Allow thumb_t to use tmpfs inherited from the user
  - Allow mozilla_plugin to bind to the vnc port if running with spice
  - Add new attribute to discover confined_admins and assign confined admin to it
  - Fix zabbix to handle attributes in interfaces
  - Fix zabbix to read system states for all zabbix domains
  - Fix piranha_domain_template()
  - Allow ctdbd to create udp_socket. Allow ndmbd to access ctdbd var files.
  - Allow lldpad sys_rouserce cap due to #986870
  - Allow dovecot-auth to read nologin
  - Allow openlmi-networking to read /proc/net/dev
  - Allow smsd_t to execute scripts created on the fly labeled as smsd_spool_t
  - Add zabbix_domain attribute for zabbix domains to treat them together
  - Add labels for zabbix-poxy-* (#1018221)
  - Update openlmi-storage policy to reflect #1015067
  - Back port piranha tmpfs fixes from RHEL6
  - Update httpd_can_sendmail boolean to allow read/write postfix spool maildrop
  - Add postfix_rw_spool_maildrop_files interface
  - Call new userdom_admin_user_templat() also for sysadm_secadm.pp
  - Fix typo in userdom_admin_user_template()
  - Allow SELinux users to create coolkeypk11sE-Gate in /var/cache/coolkey
  - Add new attribute to discover confined_admins
  - Fix labeling for /etc/strongswan/ipsec.d
  - systemd_logind seems to pass fd to anyone who dbus communicates with it
  - Dontaudit leaked write descriptor to dmesg


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-93
changelog:
  - Allow sshd_t to read openshift content, needs backport to RHEL6.5
  - Label /usr/lib64/sasl2/libsasldb.so.3.0.0 as textrel_shlib_t
  - Make sur kdump lock is created with correct label if kdumpctl is executed
  - gnome interface calls should always be made within an optional_block
  - Allow syslogd_t to connect to the syslog_tls port
  - Add labeling for /var/run/charon.ctl socket
  - Add kdump_filetrans_named_content()
  - Allo setpgid for fenced_t
  - Allow setpgid and r/w cluster tmpfs for fenced_t
  - gnome calls should always be within optional blocks
  - wicd.pid should be labeled as networkmanager_var_run_t
  - Allow sys_resource for lldpad


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-94
changelog:
  - Allow sysadm_t to read login information
  - Allow systemd_tmpfiles to setattr on var_log_t directories
  - Udpdate Makefile to include systemd_contexts
  - Add systemd_contexts
  - Add fs_exec_hugetlbfs_files() interface
  - Add daemons_enable_cluster_mode boolean
  - Fix rsync_filetrans_named_content()
  - Add rhcs_read_cluster_pid_files() interface
  - Update rhcs.if with additional interfaces from RHEL6
  - Fix rhcs_domain_template() to not create run dirs with cluster_var_run_t
  - Allow glusterd_t to mounton glusterd_tmp_t
  - Allow glusterd to unmout al filesystems
  - Allow xenstored to read virt config
  - Add label for swift_server.lock and make add filetrans_named_content to make sure content gets created with the correct label
  - Allow mozilla_plugin_t to mmap hugepages as an executable


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-95
changelog:
  - Fix alias decl in corenetwork.te.in
  - Add support for fuse.glusterfs
  - Add file transition rules for content created by f5link
  - Rename quantum_port information to neutron
  - Allow all antivirus domains to manage also own log dirs
  - Rename quantum_port information to neutron
  - Allow pegasus_openlmi_services_t to stream connect to sssd_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-97
changelog:
  - Add label only for redhat.repo instead of /etc/yum.repos.d. But probably we will need to switch for the directory.
  - Label /etc/yum.repos.d as system_conf_t
  - Use sysnet_filetrans_named_content in udev.te instead of generic transition for net_conf_t
  - Allow dac_override for sysadm_screen_t
  - Allow init_t to read ipsec_conf_t as we had it for initrc_t. Needed by ipsec unit file.
  - Allow netlabel-config to read meminfo
  - Add interface to allow docker to mounton file_t
  - Add new interface to exec unlabeled files
  - Allow lvm to use docker semaphores
  - Setup transitons for .xsessions-errors.old
  - Change labels of files in /var/lib/*/.ssh to transition properly
  - Allow staff_t and user_t to look at logs using journalctl
  - pluto wants to manage own log file
  - Allow pluto running as ipsec_t to create pluto.log
  - Fix alias decl in corenetwork.te.in
  - Add support for fuse.glusterfs
  - Allow dmidecode to read/write /run/lock/subsys/rhsmcertd
  - Allow rhsmcertd to manage redhat.repo which is now labeled as system.conf. Allow rhsmcertd to manage all log files.
  - Additional access for docker
  - Added more rules to sblim policy
  - Fix kdumpgui_run_bootloader boolean
  - Allow dspam to connect to lmtp port
  - Included sfcbd service into sblim policy
  - rhsmcertd wants to manaage /etc/pki/consumer dir
  - Add kdumpgui_run_bootloader boolean
  - Add support for /var/cache/watchdog
  - Remove virt_domain attribute for virt_qemu_ga_unconfined_t
  - Fixes for handling libvirt containes
  - Dontaudit attempts by mysql_safe to write content into /
  - Dontaudit attempts by system_mail to modify network config
  - Allow dspam to bind to lmtp ports
  - Add new policy to allow staff_t and user_t to look at logs using journalctl
  - Allow apache cgi scripts to list sysfs
  - Dontaudit attempts to write/delete user_tmp_t files
  - Allow all antivirus domains to manage also own log dirs
  - Allow pegasus_openlmi_services_t to stream connect to sssd_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-98
changelog:
  - Add files_relabel_base_file_types() interface
  - Allow netlabel-config to read passwd
  - update gluster_export_all_rw boolean to allow relabel all base file types caused by lsetxattr()
  - Allow x86_energy_perf  tool to modify the MSR
  - Fix /var/lib/dspam/data labeling
  - Allow pegasus to domtrans to mount_t
  - Add labeling for unconfined scripts in /usr/libexec/watchdog/scripts
  - Add support for unconfined watchdog scripts
  - Allow watchdog to manage own log files


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-99
changelog:
  - Add support for yubikey in homedir
  - Add support for upd/3052 port
  - Allow apcupsd to use PowerChute Network Shutdown
  - Allow lsmd to execute various lsmplugins
  - Add labeling also for /etc/watchdog\.d where are watchdog scripts located too
  - Update gluster_export_all_rw boolean to allow relabel all base file types
  - Allow x86_energy_perf  tool to modify the MSR
  - Fix /var/lib/dspam/data labeling


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-100
changelog:
  - Fix passenger_stream_connect interface
  - setroubleshoot_fixit wants to read network state
  - Allow procmail_t to connect to dovecot stream sockets
  - Allow cimprovagt service providers to read network states
  - Add labeling for /var/run/mariadb
  - pwauth uses lastlog() to update system's lastlog
  - Allow account provider to read login records
  - Add support for texlive2013
  - More fixes for user config files to make crond_t running in userdomain
  - Add back disable/reload/enable permissions for system class
  - Fix manage_service_perms macro
  - Allow passwd_t to connect to gnome keyring to change password
  - Update mls config files to have cronjobs in the user domains
  - Remove access checks that systemd does not actually do


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-102
changelog:
  - Fix files_dontaudit_unmount_all_mountpoints()
  - Add support for 2608-2609 tcp/udp ports
  - Should allow domains to lock the terminal device
  - More fixes for user config files to make crond_t running in userdomain
  - Add back disable/reload/enable permissions for system class
  - Fix manage_service_perms macro
  - We need to require passwd rootok
  - Fix zebra.fc
  - Fix dnsmasq_filetrans_named_content() interface
  - Allow all sandbox domains create content in svirt_home_t
  - Allow zebra domains also create zebra_tmp_t files in /tmp
  - Add support for new zebra services:isisd,babeld. Add systemd support for zebra services.
  - Fix labeling on neutron and remove transition to iconfig_t
  - abrt needs to read mcelog log file
  - Fix labeling on dnsmasq content
  - Fix labeling on /etc/dnsmasq.d
  - Allow glusterd to relabel own lib files
  - Allow sandbox domains to use pam_rootok, and dontaudit attempts to unmount file systems, this is caused by a bug in systemd
  - Allow ipc_lock for abrt to run journalctl


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-104
changelog:
  - Allow watchdog to read /etc/passwd
  - Allow browser plugins to connect to bumblebee
  - New policy for bumblebee and freqset
  - Add new policy for mip6d daemon
  - Add new policy for opensm daemon
  - Allow condor domains to read/write condor_master udp_socket
  - Allow openshift_cron_t to append to openshift log files, label /var/log/openshift
  - Add back file_pid_filetrans for /var/run/dlm_controld
  - Allow smbd_t to use inherited tmpfs content
  - Allow mcelog to use the /dev/cpu device
  - sosreport runs rpcinfo
  - sosreport runs subscription-manager
  - Allow staff_t to run frequency command
  - Allow systemd_tmpfiles to relabel log directories
  - Allow staff_t to read xserver_log file
  - Label hsperfdata_root as tmp_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-105
changelog:
  - Dontaudit openshift domains trying to use rawip_sockets, this is caused by a bad check in the kernel.
  - Allow git_system_t to read git_user_content if the git_system_enable_homedirs boolean is turned on
  - Add lsmd_plugin_t for lsm plugins
  - Allow dovecot-deliver to search mountpoints
  - Add labeling for /etc/mdadm.conf
  - Allow opelmi admin providers to dbus chat with init_t
  - Allow sblim domain to read /dev/urandom and /dev/random
  - Allow apmd to request the kernel load modules
  - Add glusterd_brick_t type
  - label mate-keyring-daemon with gkeyringd_exec_t
  - Add plymouthd_create_log()
  - Dontaudit leaks from openshift domains into mail domains, needs back port to RHEL6
  - Allow sssd to request the kernel loads modules
  - Allow gpg_agent to use ssh-add
  - Allow gpg_agent to use ssh-add
  - Dontaudit access check on /root for myslqd_safe_t
  - Allow ctdb to getattr on al filesystems
  - Allow abrt to stream connect to syslog
  - Allow dnsmasq to list dnsmasq.d directory
  - Watchdog opens the raw socket
  - Allow watchdog to read network state info
  - Dontaudit access check on lvm lock dir
  - Allow sosreport to send signull to setroubleshootd
  - Add setroubleshoot_signull() interface
  - Fix ldap_read_certs() interface
  - Allow sosreport all signal perms
  - Allow sosreport to run systemctl
  - Allow sosreport to dbus chat with rpm
  - Add glusterd_brick_t files type
  - Allow zabbix_agentd to read all domain state
  - Clean up rtas.if
  - Allow smoltclient to execute ldconfig
  - Allow sosreport to request the kernel to load a module
  - Fix userdom_confined_admin_template()
  - Add back exec_content boolean for secadm, logadm, auditadm
  - Fix files_filetrans_system_db_named_files() interface
  - Allow sulogin to getattr on /proc/kcore
  - Add filename transition also for servicelog.db-journal
  - Add files_dontaudit_access_check_root()
  - Add lvm_dontaudit_access_check_lock() interface


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-108
changelog:
  - Allow sosreport to send a signal to ABRT
  - Add proper aliases for pegasus_openlmi_service_exec_t and pegasus_openlmi_service_t
  - Label /usr/sbin/htcacheclean as httpd_exec_t
  Resolves:#1037529
  - Added support for rdisc unit file
  - Add antivirus_db_t labeling for /var/lib/clamav-unofficial-sigs
  - Allow runuser running as logrotate connections to system DBUS
  - Label bcache devices as fixed_disk_device_t
  - Allow systemctl running in ipsec_mgmt_t to access /usr/lib/systemd/system/ipsec.service
  - Label /usr/lib/systemd/system/ipsec.service as ipsec_mgmt_unit_file_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-109
changelog:
  - Change labeling for /usr/libexec/nm-dispatcher.action to NetworkManager_exec_t
  Resolves:#1039879
  - Add labeling for /usr/lib/systemd/system/mariadb.service
  - Allow hyperv_domain to read sysfs
  - Fix ldap_read_certs() interface to allow acess also link files
  - Add support for /usr/libexec/pegasus/cmpiLMI_Journald-cimprovagt
  - Allow tuned to run modprobe
  - Allow portreserve to search /var/lib/sss dir
  - Add SELinux support for the teamd package contains team network device control daemon.
  - Dontaudit access check on /proc for bumblebee
  - Bumblebee wants to load nvidia modules
  - Fix rpm_named_filetrans_log_files and wine.te
  - Add conman policy for rawhide
  - DRM master and input event devices are used by  the TakeDevice API
  - Clean up bumblebee policy
  - Update pegasus_openlmi_storage_t policy
  - Add freeipmi_stream_connect() interface
  - Allow logwatch read madm.conf to support RAID setup
  - Add raid_read_conf_files() interface
  - Allow up2date running as rpm_t create up2date log file with rpm_log_t labeling
  - add rpm_named_filetrans_log_files() interface
  - Allow dkim-milter to create files/dirs in /tmp
  - update freeipmi policy
  - Add policy for freeipmi services
  - Added rdisc_admin and rdisc_systemctl interfaces
  - opensm policy clean up
  - openwsman policy clean up
  - ninfod policy clean up
  - Added new policy for ninfod
  - Added new policy for openwsman
  - Added rdisc_admin and rdisc_systemctl interfaces
  - Fix kernel_dontaudit_access_check_proc()
  - Add support for /dev/uhid
  - Allow sulogin to get the attributes of initctl and sys_admin cap
  - Add kernel_dontaudit_access_check_proc()
  - Fix dev_rw_ipmi_dev()
  - Fix new interface in devices.if
  - DRM master and input event devices are used by  the TakeDevice API
  - add dev_rw_inherited_dri() and dev_rw_inherited_input_dev()
  - Added support for default conman port
  - Add interfaces for ipmi devices


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-110
changelog:
  - Allow freeipmi_ipmidetectd_t to use freeipmi port
  - Update freeipmi_domain_template()
  - Allow journalctl running as ABRT to read /run/log/journal
  - Allow NM to read dispatcher.d directory
  - Update freeipmi policy
  - Type transitions with a filename not allowed inside conditionals
  - Allow tor to bind to hplip port
  - Make new type to texlive files in homedir
  - Allow zabbix_agent to transition to dmidecode
  - Add rules for docker
  - Allow sosreport to send signull to unconfined_t
  - Add virt_noatsecure and virt_rlimitinh interfaces
  - Fix labeling in thumb.fc to add support for /usr/lib64/tumbler-1/tumblerddd support for freeipmi port
  - Add sysadm_u_default_contexts
  - Add logging_read_syslog_pid()
  - Fix userdom_manage_home_texlive() interface
  - Make new type to texlive files in homedir
  - Add filename transitions for /run and /lock links
  - Allow virtd to inherit rlimit information
  Resolves:#975358


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-111
changelog:
  - Add labeling for /var/lib/servicelog/servicelog.db-journal
  - Add support for freeipmi port
  - Add sysadm_u_default_contexts
  - Make new type to texlive files in homedir
  - Allow subscription-manager running as sosreport_t to manage rhsmcertd
  - Additional fixes for docker.te
  - Remove ability to do mount/sys_admin by default in virt_sandbox domains
  - New rules required to run docker images within libivrt
  - Add label for ~/.cvsignore
  - Change mirrormanager to be run by cron
  - Add mirrormanager policy
  - Fixed bumblebee_admin() and mip6d_admin()
  - Add log support for sensord
  - Fix typo in docker.te
  - Allow amanda to do backups over UDP
  - Allow bumblebee to read /etc/group and clean up bumblebee.te
  - type transitions with a filename not allowed inside conditionals
  - Don't allow virt-sandbox tools to use netlink out of the box, needs back port to RHEL7
  - Make new type to texlive files in homedir


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-112
changelog:
  - Allow sshd to write to all process levels in order to change passwd when running at a level
  - Allow updpwd_t to downgrade /etc/passwd file to s0, if it is not running with this range
  - Allow apcuspd_t to status and start the power unit file
  - Allow udev to manage kdump unit file
  - Added new interface modutils_dontaudit_exec_insmod
  - Allow cobbler to search dhcp_etc_t directory
  - systemd_systemctl needs sys_admin capability
  - Allow sytemd_tmpfiles_t to delete all directories
  - passwd to create gnome-keyring passwd socket
  - Add missing zabbix_var_lib_t type
  - Fix filename trans for zabbixsrv in zabbix.te
  - Allow fprintd_t to send syslog messages
  - Add  zabbix_var_lib_t for /var/lib/zabbixsrv, also allow zabix to connect to smtp port
  - Allow mozilla plugin to chat with policykit, needed for spice
  - Allow gssprozy to change user and gid, as well as read user keyrings
  - Label upgrades directory under /var/www as httpd_sys_rw_content_t, add other filetrans rules to label content correctly
  - Allow polipo to connect to http_cache_ports
  - Allow cron jobs to manage apache var lib content
  - Allow yppassword to manage the passwd_file_t
  - Allow showall_t to send itself signals
  - Allow cobbler to restart dhcpc, dnsmasq and bind services
  - Allow certmonger to manage home cert files
  - Add userdom filename trans for user mail domains
  - Allow apcuspd_t to status and start the power unit file
  - Allow cgroupdrulesengd to create content in cgoups directories
  - Allow smbd_t to signull cluster
  - Allow gluster daemon to create fifo files in glusterd_brick_t and sock_file in glusterd_var_lib_t
  - Add label for /var/spool/cron.aquota.user
  - Allow sandbox_x domains to use work with the mozilla plugin semaphore
  - Added new policy for speech-dispatcher
  - Added dontaudit rule for insmod_exec_t  in rasdaemon policy
  - Updated rasdaemon policy
  - Allow system_mail_t to transition to postfix_postdrop_t
  - Clean up mirrormanager policy
  - Allow virt_domains to read cert files, needs backport to RHEL7
  - Allow sssd to read systemd_login_var_run_t
  - Allow irc_t to execute shell and bin-t files:
  - Add new access for mythtv
  - Allow rsync_t to manage all non auth files
  - allow modemmanger to read /dev/urand
  - Allow sandbox apps to attempt to set and get capabilties


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-114
changelog:
  - Add default lvm_var_run_t label for /var/run/multipathd
  Resolves:#1051430
  - Fix log labeling to have correct default label for them after logrotate
  - Add files_write_root_dirs
  - Add new openflow port label for 6653/tcp and 6633/tcp
  - Add xserver_manage_xkb_libs()
  - Label tcp/8891 as milter por
  - Allow gnome_manage_generic_cache_files also create cache_home_t files
  - Fix aide.log labeling
  - Fix log labeling to have correct default label for them after logrotate
  - Allow mysqld-safe write access on /root to make mysqld working
  - Allow sosreport domtrans to prelikn
  - Allow OpenvSwitch to connec to openflow ports
  - Allow NM send dgram to lldpad
  - Allow hyperv domains to execute shell
  - Allow lsmd plugins stream connect to lsmd/init
  - Allow sblim domains to create /run/gather with correct labeling
  - Allow httpd to read ldap certs
  - Allow cupsd to send dbus msgs to process with different MLS level
  - Allow bumblebee to stream connect to apmd
  - Allow bumblebee to run xkbcomp
  - Additional allow rules to get libvirt-lxc containers working with docker
  - Additional allow rules to get libvirt-lxc containers working with docker
  - Allow docker to getattr on itself
  - Additional rules needed for sandbox apps
  - Allow mozilla_plugin to set attributes on usb device if use_spice boolean enabled
  - httpd should be able to send signal/signull to httpd_suexec_t
  - Add more fixes for neturon. Domtrans to dnsmasq, iptables. Make neutron as filenamtrans domain.


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-116
changelog:
  - Add missing files_create_var_lib_dirs()
  - Fix typo in ipsec.te
  - Allow passwd to create directory in /var/lib
  - Add filename trans also for event21
  - Allow iptables command to read /dev/rand
  - Add sigkill capabilityfor ipsec_t
  - Add filename transitions for bcache devices
  - Add additional rules to create /var/log/cron by syslogd_t with correct labeling
  - Add give everyone full access to all key rings
  - Add default lvm_var_run_t label for /var/run/multipathd
  - Fix log labeling to have correct default label for them after logrotate
  - Labeled ~/.nv/GLCache as being gstreamer output
  - Allow nagios_system_plugin to read mrtg lib files
  - Add mrtg_read_lib_files()
  - Call rhcs_rw_cluster_tmpfs for dlm_controld
  - Make authconfing as named_filetrans domain
  - Allow virsh to connect to user process using stream socket
  - Allow rtas_errd to read rand/urand devices and add chown capability
  - Fix labeling from /var/run/net-snmpd to correct /var/run/net-snmp
  Resolves:#1051497
  - Add also chown cap for abrt_upload_watch_t. It already has dac_override
  - Allow sosreport to manage rhsmcertd pid files
  - Add rhsmcertd_manage_pid_files()
  - Allow also setgid cap for rpc.gssd
  - Dontaudit access check for abrt on cert_t
  - Allow pegasus_openlmi_system providers to dbus chat with systemd-logind


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-118
changelog:
  - Allow init_t to work on transitient and snapshot unit files
  - Add logging_manage_syslog_config()
  - Update sysnet_dns_name_resolve() to allow connect to dnssec por
  - Allow pegasus_openlmi_storage_t to read hwdata
  Resolves:#1031721
  - Fix rhcs_rw_cluster_tmpfs()
  - Allow fenced_t to bind on zented udp port
  - Added policy for vmtools
  - Fix mirrormanager_read_lib_files()
  - Allow mirromanager scripts running as httpd_t to manage mirrormanager pid files
  - Allow ctdb to create sock files in /var/run/ctdb
  - Add sblim_filetrans_named_content() interface
  - Allow rpm scritplets to create /run/gather with correct labeling
  - Allow gnome keyring domains to create gnome config dirs
  - Dontaudit read/write to init stream socket for lsmd_plugin_t
  - Allow automount to read nfs link files
  - Allow lsm plugins to read/write lsmd stream socket
  - Allow certmonger to connect ldap port to make IPA CA certificate renewal working.
  - Add also labeling for /var/run/ctdb
  - Add missing labeling for /var/lib/ctdb
  - ALlow tuned to manage syslog.conf. Should be fixed in tuned. #1030446
  - Dontaudit hypervkvp to search homedirs
  - Dontaudit hypervkvp to search admin homedirs
  - Allow hypervkvp to execute bin_t and ifconfig in the caller domain
  - Dontaudit xguest_t to read ABRT conf files
  - Add abrt_dontaudit_read_config()
  - Allow namespace-init to getattr on fs
  - Add thumb_role() also for xguest
  - Add filename transitions to create .spamassassin with correct labeling
  - Allow apache domain to read mirrormanager pid files
  - Allow domains to read/write shm and sem owned by mozilla_plugin_t
  - Allow alsactl to send a generic signal to kernel_t


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-119
changelog:
  - Add cron unconfined role support for uncofined SELinux user
  - Call corenet_udp_bind_all_ports() in milter.te
  - Allow fence_virtd to connect to zented port
  - Fix header for mirrormanager_admin()
  - Allow dkim-milter to bind udp ports
  - Allow milter domains to send signull itself
  - Allow block_suspend for yum running as mock_t
  - Allow beam.smp to manage couchdb files
  - Add couchdb_manage_files()
  - Add labeling for /var/log/php_errors.log
  - Allow bumblebee to stream connect to xserver
  - Allow bumblebee to send a signal to xserver
  - gnome-thumbnail to stream connect to bumblebee
  - Allow xkbcomp running as bumblebee_t to execute  bin_t
  - Allow logrotate to read squid.conf
  - Additional rules to get docker and lxc to play well with SELinux
  - Allow bumbleed to connect to xserver port
  - Allow pegasus_openlmi_storage_t to read hwdata


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-120
changelog:
  - Allow apache to write to the owncloud data directory in /var/www/html...
  - Allow consolekit to create log dir
  - Add support for icinga CGI scripts
  - Add support for icinga
  - Allow kdumpctl_t to create kdump lock file
  Resolves:#1055634
  - Allow kdump to create lnk lock file
  - Allow nscd_t block_suspen capability
  - Allow unconfined domain types to manage own transient unit file
  - Allow systemd domains to handle transient init unit files
  - Add interfaces to handle transient


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-121
changelog:
  - Allow gdm to create /var/gdm with correct labeling
  - Allow domains to append rkhunterl lib files. #1057982
  - Allow systemd_tmpfiles_t net_admin to communicate with journald
  - Add interface to getattr on an isid_type for any type of file
  - Update libs_filetrans_named_content() to have support for /usr/lib/debug directory
  - Allow initrc_t domtrans to authconfig if unconfined is enabled
  - Allow docker and mount on devpts chr_file
  - Allow docker to transition to unconfined_t if boolean set
  - init calling needs to be optional in domain.te
  - Allow uncofined domain types to handle transient unit files
  - Fix labeling for vfio devices
  - Allow net_admin capability and send system log msgs
  - Allow lldpad send dgram to NM
  - Add networkmanager_dgram_send()
  - rkhunter_var_lib_t is correct type
  - Back port pcp policy from rawhide
  - Allow openlmi-storage to read removable devices
  - Allow system cron jobs to manage rkhunter lib files
  - Add rkhunter_manage_lib_files()
  - Fix ftpd_use_fusefs boolean to allow manage also symlinks
  - Allow smbcontrob block_suspend cap2
  - Allow slpd to read network and system state info
  - Allow NM domtrans to iscsid_t if iscsiadm is executed
  - Allow slapd to send a signal itself
  - Allow sslget running as pki_ra_t to contact port 8443, the secure port of the CA.
  - Fix plymouthd_create_log() interface
  - Add rkhunter policy with files type definition for /var/lib/rkhunter until it is fixed in rkhunter package
  - Add mozilla_plugin_exec_t for /usr/lib/firefox/plugin-container
  - Allow postfix and cyrus-imapd to work out of box
  - Allow fcoemon to talk with unpriv user domain using unix_stream_socket
  - Dontaudit domains that are calling into journald to net_admin
  - Add rules to allow vmtools to do what it does
  - snapperd is D-Bus service
  - Allow OpenLMI PowerManagement to call 'systemctl --force reboot'
  - Add haproxy_connect_any boolean
  - Allow haproxy also to use http cache port by default
  Resolves:#1058248


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-122
changelog:
  - Update snapper policy
  - Allow domains to append rkhunter lib files
  - Allow snapperd to getattr on all fs
  - Allow xdm to create /var/gdm with correct labeling
  - Add label for snapper.log
  - Allow fail2ban-client to read apache log files
  - Allow thumb_t to execute dbus-daemon in thumb_t


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-123
changelog:
  - Turn on bacula, rhnsd policy
  - Add support for rhnsd unit file
  - Add dbus_chat_session_bus() interface
  - Add dbus_stream_connect_session_bus() interface
  - Fix logrotate_use_nfs boolean
  - Add lot of pcp fixes found in RHEL7
  - fix labeling for pmie for pcp pkg
  - Change thumb_t to be allowed to chat/connect with session bus type
  - Allow call renice in mlocate
  - Add logrotate_use_nfs boolean
  - Allow setroubleshootd to read rpc sysctl
  - Fixes for *_admin interfaces
  - Add pegasus_openlmi_storage_var_run_t type def
  - Add support for /var/run/openlmi-storage
  - Allow tuned to create syslog.conf with correct labeling
  - Add httpd_dontaudit_search_dirs boolean
  - Add support for winbind.service
  - ALlow also fail2ban-client to read apache logs
  - Allow vmtools to getattr on all fs
  - Add support for dey_sapi port
  - Add logging_filetrans_named_conf()
  - Allow passwd_t to use ipc_lock, so that it can change the password in gnome-keyring


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-124
changelog:
  - Added osad policy
  - Allow postfix to deliver to procmail
  - Allow bumblebee to seng kill signal to xserver
  - Allow vmtools to execute /usr/bin/lsb_release
  - Allow docker to write system net ctrls
  - Add support for rhnsd unit file
  - Add dbus_chat_session_bus() interface
  - Add dbus_stream_connect_session_bus() interface
  - Fix pcp.te
  - Fix logrotate_use_nfs boolean
  - Add lot of pcp fixes found in RHEL7
  - fix labeling for pmie for pcp pkg
  - Change thumb_t to be allowed to chat/connect with session bus type
  - Allow call renice in mlocate
  - Add logrotate_use_nfs boolean
  - Allow setroubleshootd to read rpc sysctl


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-125
changelog:
  - Addopt corenet rules for unbound-anchor to rpm_script_t
  - Allow runuser to send send audit messages.
  - Allow postfix-local to search .forward in munin lib dirs
  - Allow udisks to connect to D-Bus
  - Allow spamd to connect to spamd port
  - Fix syntax error in snapper.te
  - Dontaudit osad to search gconf home files
  - Allow rhsmcertd to manage /etc/sysconf/rhn director
  - Fix pcp labeling to accept /usr/bin for all daemon binaries
  - Fix mcelog_read_log() interface
  - Allow iscsid to manage iscsi lib files
  - Allow snapper domtrans to lvm_t. Add support for /etc/snapper and allow snapperd to manage it.
  - Make tuned_t as unconfined domain for RHEL7.0
  - Allow ABRT to read puppet certs
  - Add sys_time capability for virt-ga
  - Allow gemu-ga to domtrans to hwclock_t
  - Allow additional access for virt_qemu_ga_t processes to read system clock and send audit messages
  - Fix some AVCs in pcp policy
  - Add to bacula capability setgid and setuid and allow to bind to bacula ports
  - Changed label from rhnsd_rw_conf_t to rhnsd_conf_t
  - Add access rhnsd and osad to /etc/sysconfig/rhn
  - drbdadm executes drbdmeta
  - Fixes needed for docker
  - Allow epmd to manage /var/log/rabbitmq/startup_err file
  - Allow beam.smp connect to amqp port
  - Modify xdm_write_home to allow create also links as xdm_home_t if the boolean is on true
  - Allow init_t to manage pluto.ctl because of init_t instead of initrc_t
  - Allow systemd_tmpfiles_t to manage all non security files on the system
  - Added labels for bacula ports
  - Fix label on /dev/vfio/vfio
  - Add kernel_mounton_messages() interface
  - init wants to manage lock files for iscsi


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-126
changelog:
  - Add lvm_read_metadata()
  - Allow auditadm to search /var/log/audit dir
  - Add lvm_read_metadata() interface
  - Allow confined users to run vmtools helpers
  - Fix userdom_common_user_template()
  - Generic systemd unit scripts do write check on /
  - Allow init_t to create init_tmp_t in /tmp.This is for temporary content created by generic unit files
  - Add additional fixes needed for init_t and setup script running in generic unit files
  - Allow general users to create packet_sockets
  - added connlcli port
  - Add init_manage_transient_unit() interface
  - Allow init_t (generic unit files) to manage rpc state date as we had it for initrc_t
  - Fix userdomain.te to require passwd class
  - devicekit_power sends out a signal to all processes on the message bus when power is going down
  - Dontaudit rendom domains listing /proc and hittping system_map_t
  - Dontauit leaks of var_t into ifconfig_t
  - Allow domains that transition to ssh_t to manipulate its keyring
  - Define oracleasm_t as a device node
  - Change to handle /root as a symbolic link for os-tree
  - Allow sysadm_t to create packet_socket, also move some rules to attributes
  - Add label for openvswitch port
  - Remove general transition for files/dirs created in /etc/mail which got etc_aliases_t label.
  - Allow postfix_local to read .forward in pcp lib files
  - Allow pegasus_openlmi_storage_t to read lvm metadata
  - Add additional fixes for pegasus_openlmi_storage_t
  - Allow bumblebee to manage debugfs
  - Make bumblebee as unconfined domain
  - Allow snmp to read etc_aliases_t
  - Allow lscpu running in pegasus_openlmi_storage_t to read /dev/mem
  - Allow pegasus_openlmi_storage_t to read /proc/1/environ
  - Dontaudit read gconf files for cupsd_config_t
  - make vmtools as unconfined domain
  - Add vmtools_helper_t for helper scripts. Allow vmtools shutdonw a host and run ifconfig.
  - Allow collectd_t to use a mysql database
  - Allow ipa-otpd to perform DNS name resolution
  - Added new policy for keepalived
  - Allow openlmi-service provider to manage transitient units and allow stream connect to sssd
  - Add additional fixes new pscs-lite+polkit support
  - Add labeling for /run/krb5kdc
  - Change w3c_validator_tmp_t to httpd_w3c_validator_tmp_t in F20
  - Allow pcscd to read users proc info
  - Dontaudit smbd_t sending out random signuls
  - Add boolean to allow openshift domains to use nfs
  - Allow w3c_validator to create content in /tmp
  - zabbix_agent uses nsswitch
  - Allow procmail and dovecot to work together to deliver mail
  - Allow spamd to execute files in homedir if boolean turned on
  - Allow openvswitch to listen on port 6634
  - Add net_admin capability in collectd policy
  - Fixed snapperd policy
  - Fixed bugsfor pcp policy
  - Allow dbus_system_domains to be started by init
  - Fixed some interfaces
  - Add kerberos_keytab_domain attribute
  - Fix snapperd_conf_t def


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-127
changelog:
  - Add snapperd_home_t for HOME_DIR/.snapshots directory
  - Make sosreport as unconfined domain
  - Allow sosreport to execute grub2-probe
  - Allow NM to manage hostname config file
  - Allow systemd_timedated_t to dbus chat with rpm_script_t
  - Allow lsmd plugins to connect to http/ssh/http_cache ports by default
  - Add lsmd_plugin_connect_any boolean
  - Allow mozilla_plugin to attempt to set capabilities
  - Allow lsdm_plugins to use tcp_socket
  - Dontaudit mozilla plugin from getattr on /proc or /sys
  - Dontaudit use of the keyring by the services in a sandbox
  - Dontaudit attempts to sys_ptrace caused by running ps for mysqld_safe_t
  - Allow rabbitmq_beam to connect to jabber_interserver_port
  - Allow logwatch_mail_t to transition to qmail_inject and queueu
  - Added new rules to pcp policy
  - Allow vmtools_helper_t to change role to system_r
  - Allow NM to dbus chat with vmtools
  - Fix couchdb_manage_files() to allow manage couchdb conf files
  - Add support for /var/run/redis.sock
  - dontaudit gpg trying to use audit
  - Allow consolekit to create log directories and files
  - Fix vmtools policy to allow user roles to access vmtools_helper_t
  - Allow block_suspend cap2 for ipa-otpd
  - Allow pkcsslotd to read users state
  - Add ioctl to init_dontaudit_rw_stream_socket
  - Add systemd_hostnamed_manage_config() interface
  - Remove transition for temp dirs created by init_t
  - gdm-simple-slave uses use setsockopt
  - sddm-greater is a xdm type program


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-128
changelog:
  - Make snapperd as unconfined domain and add additional fixes for it
  - Remove nsplugin.pp module on upgrade


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-129
changelog:
  - Allow block_suspend cap2 for systemd-logind and rw dri device
  - Add labeling for /usr/libexec/nm-libreswan-service
  - Allow locallogin to rw xdm key to make Virtual Terminal login providing smartcard pin working
  - Add xserver_rw_xdm_keys()
  - Allow rpm_script_t to dbus chat also with systemd-located
  - Fix ipa_stream_connect_otpd()
  - update lpd_manage_spool() interface
  - Allow krb5kdc to stream connect to ipa-otpd
  - Add ipa_stream_connect_otpd() interface
  - Allow vpnc to unlink NM pids
  - Add networkmanager_delete_pid_files()
  - Allow munin plugins to access unconfined plugins
  - update abrt_filetrans_named_content to cover /var/spool/debug
  - Label /var/spool/debug as abrt_var_cache_t
  - Allow rhsmcertd to connect to squid port
  - Make docker_transition_unconfined as optional boolean
  - Allow certmonger to list home dirs


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-130
changelog:
  - Change userdom_use_user_inherited_ttys to userdom_use_user_ttys for systemd-tty-ask
  - Add sysnet_filetrans_named_content_ifconfig() interface
  - Allow ctdbd to connect own ports
  - Fix samba_export_all_rw booleanto cover also non security dirs
  - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs
  - Allow neutron to create /run/netns with correct labeling
  - Allow kerberos keytab domains to manage sssd/userdomain keys"
  - Allow to run ip cmd in neutron_t domain


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-131
changelog:
  - Added pcp rules
  - dontaudit openshift_cron_t searching random directories, should be back ported to RHEL6
  - clean up ctdb.te
  - Allow ctdbd to connect own ports
  - Fix samba_export_all_rw booleanto cover also non security dirs
  - Allow swift to exec rpm in swift_t and allow to create tmp files/dirs
  - Allow neutron to create /run/netns with correct labeling
  - Allow certmonger to list home dirs


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-132
changelog:
  - Modify xdm_write_home to allow create files/links in /root with xdm_home_
  - Allow virt domains to read network state
  Resolves:#1072019


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-133
changelog:
  - Allow numad to write scan_sleep_millisecs
  - Turn on entropyd_use_audio boolean by default
  - Allow cgred to read /etc/cgconfig.conf because it contains templates used together with rules from /etc/cgrules.conf.
  - Allow lscpu running as rhsmcertd_t to read /proc/sysinfo
  - Fix label on irclogs in the homedir
  - Allow kerberos_keytab_domain domains to manage keys until we get sssd fix
  - Allow postgresql to use ldap
  - Add missing syslog-conn port
  - Add support for /dev/vmcp and /dev/sclp
  Resolves:#1069310


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-134
changelog:
  - Allow unpriv SELinux users to dbus chat with firewalld
  - Add lvm_write_metadata()
  - Label /etc/yum.reposd dir as system_conf_t. Should be safe because system_conf_t is base_ro_file_type
  - Allow pegasus_openlmi_storage_t to write lvm metadata
  - Add hide_broken_symptoms for kdumpgui because of systemd bug
  - Make kdumpgui_t as unconfined domain
  Resolves:#1044299
  - Allow docker to connect to tcp/5000


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-137
changelog:
  - Allow vmtools_helper_t to execute bin_t
  - Add support for /usr/share/joomla
  - /var/lib/containers should be labeled as openshift content for now
  - Allow docker domains to talk to the login programs, to allow a process to login into the container
  - Allow install_t do dbus chat with NM
  - Fix interface names in anaconda.if
  - Add install_t for anaconda. A new type is a part of anaconda policy
  - sshd to read network sysctls


author: Lukas Vrabec <lvrabec@redhat.com> 3.12.1-138
changelog:
  - Make rtas_errd_t as unconfined domain for F20.It needs additional fixes. It runs rpm at least.
  - Allow net_admin cap for fence_virtd running as fenced_t
  - Make  abrt-java-connector working
  - Make cimtest script 03_defineVS.py of ComputerSystem group working
  - Fix git_system_enable_homedirs boolean
  - Allow munin mail plugins to read network systcl


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-139
changelog:
  - Allow collectd to talk to libvirt
  - Allow chrome_sandbox to use leaked unix_stream_sockets
  - Dontaudit leaks of sockets into chrome_sandbox_t
  - If you create a cups directory in /var/cache then it should be labeled cups_rw_etc_t
  - Run vmtools as unconfined domains
  - Allow snort to manage its log files
  - Allow systemd_cronjob_t to be entered via bin_t
  - Allow procman to list doveconf_etc_t
  - allow keyring daemon to create content in tmpfs directories
  - Add proper labelling for icedtea-web
  - vpnc is creating content in networkmanager var run directory
  - Label sddm as xdm_exec_t to make KDE working again
  - Allow postgresql to read network state
  - Allow java running as pki_tomcat to read network sysctls
  - Fix cgroup.te to allow cgred to read cgconfig_etc_t
  - Allow beam.smp to use ephemeral ports
  - Allow winbind to use the nis to authenticate passwords


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-140
changelog:
  - Allow docker to read tmpfs_t symlinks
  - Allow sandbox svirt_lxc_net_t to talk to syslog and to sssd over stream sockets


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-142
changelog:
  - Add support for /var/spool/rhsm/debug
  - Make virt_sandbox_use_audit as True by default
  - Allow svirt_sandbox_domains to ptrace themselves


author: Lukas Vrabec <lvrabec@redhat.com> 3.12.1-143
changelog:
  - Add additional fixes for rtas_errd
  - Fix transitions for tmp/tmpfs in rtas.te
  - Allow rtas_errd to readl all sysctls


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-144
changelog:
  - allow anaconda to dbus chat with systemd-localed
  - Add fixes for haproxy based on bperkins@redhat.com
  - Allow cmirrord to make dmsetup working
  - Allow NM to execute arping
  - Allow users to send messages through talk
  - Add userdom_tmp_role for secadm_t


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-145
changelog:
  - Allow also unpriv user to run vmtools
  - Allow secadm to read /dev/urandom and meminfo
  Resolves:#1079250
  - Add booleans to allow docker processes to use nfs and samba
  - Add mdadm_tmpfs support
  - Dontaudit net_amdin for /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.51-2.4.5.1.el7.x86_64/jre-abrt/bin/java running as pki_tomcat_t
  - Allow vmware-user-sui to use user ttys
  - Allow talk 2 users logged via console too
  - Allow ftp services to manage xferlog_t
  - Make all pcp domanis as unconfined for RHEL7.0 beucause of new policies
  - allow anaconda to dbus chat with systemd-localed


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-146
changelog:
  - add gnome_append_home_config()
  - Allow thumb to append GNOME config home files
  - Allow rasdaemon to rw /dev/cpu//msr
  - fix /var/log/pki file spec
  - make bacula_t as auth_nsswitch domain
  - Identify pki_tomcat_cert_t as a cert_type
  - Define speech-dispater_exec_t as an application executable
  - Add a new file context for /var/named/chroot/run directory
  - update storage_filetrans_all_named_dev for sg* devices
  - Allow auditctl_t  to getattr on all removeable devices
  - Allow nsswitch_domains to stream connect to nmbd
  - Allow unprivusers to connect to memcached
  - label /var/lib/dirsrv/scripts-INSTANCE as bin_t


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-147
changelog:
  - Back port fixes for pegasus_openlmi_admin_t from rawhide
  Resolves:#1080973
  - Add labels for ostree
  - Add SELinux awareness for NM
  - Label /usr/sbin/pwhistory_helper as updpwd_exec_t


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-148
changelog:
  - Allow kdm to send signull to remote_login_t process
  - Add gear policy
  - Turn on gear_port_t
  - Allow cgit to read gitosis lib files by default
  - Allow vdagent to read xdm state
  - Allow NM and fcoeadm to talk together over unix_dgram_socket


author: Miroslav Grepl<mgrepl@redhat.com> 3.12.1-149
changelog:
  - Allow xauth_t to read user_home_dir_t lnk_file
  - Add labeling for lightdm-data
  - Allow certmonger to manage ipa lib files
  - Add support for /var/lib/ipa
  - Allow pegasus to getattr virt_content
  - Added some new rules to pcp policy
  - Allow chrome_sandbox to execute config_home_t
  - Add support for ABRT FAF


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-151
changelog:
  - varnishd wants chown capability
  - update ntp_filetrans_named_content() interface
  - Add additional fixes for neutron_t. #1083335
  - Dontaudit getattr on proc_kcore_t
  - Allow pki_tomcat_t to read ipa lib files
  - Allow named_filetrans_domain to create /var/cache/ibus with correct labelign
  - Allow init_t run /sbin/augenrules
  - Add dev_unmount_sysfs_fs and sysnet_manage_ifconfig_run interfaces
  - Allow unpriv SELinux user to use sandbox
  - Add default label for /tmp/hsperfdata_root


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-152
changelog:
  - Fix Multiple same specifications for /var/named/chroot/dev/zero
  - Add labels for /var/named/chroot_sdb/dev devices
  - Add support for strongimcv
  - Use kerberos_keytab_domains in auth_use_nsswitch
  - Update auth_use_nsswitch to make all these types as kerberos_keytab_domain to
  - Allow net_raw cap for neutron_t and send sigkill to dnsmasq
  - Fix ntp_filetrans_named_content for sntp-kod file
  - Add httpd_dbus_sssd boolean
  - Dontaudit exec insmod in boinc policy
  - Rename kerberos_keytab_domain to kerberos_keytab_domains
  - Add kerberos_keytab_domain()
  - Fix kerberos_keytab_template()
  - Make all domains which use kerberos as kerberos_keytab_domain
  Resolves:#1083670
  - Allow kill capability to winbind_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.12.1-154
changelog:
  - Add support for us_cli ports
  - Fix labeling for /var/run/user/<UID>/gvfs
  - add support for tcp/9697
  - Additional rules required by openstack,  needs backport to F20 and RHEL7
  - Additional access required by docker
  - ALlow motion to use tcp/8082 port
  - Allow init_t to setattr/relabelfrom dhcp state files
  - Dontaudit antivirus domains read access on all security files by default
  - Add missing alias for old amavis_etc_t type
  - Allow block_suspend cap for haproxy
  - Additional fixes for  instack overcloud
  - Allow OpenStack to read mysqld_db links and connect to MySQL
  - Remove dup filename rules in gnome.te
  - Allow sys_chroot cap for httpd_t and setattr on httpd_log_t
  - Allow iscsid to handle own unit files
  - Add iscsi_systemctl()
  - Allow mongod to create also sock_files in /run with correct labeling
  - Allow httpd to send signull to apache script domains and don't audit leaks
  - Allow rabbitmq_beam to connect to httpd port
  - Allow aiccu stream connect to pcscd
  - Allow dmesg to read hwdata and memory dev
  - Allow all freeipmi domains to read/write ipmi devices
  - Allow sblim_sfcbd to use also pegasus-https port
  - Allow rabbitmq_epmd to manage rabbit_var_log_t files
  - Allow chronyd to read /sys/class/hwmon/hwmon1/device/temp2_input
  - Allow docker to status any unit file and allow it to start generic unit files


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-2
changelog:
  - Allow locate to look at files/directories without labels, and chr_file and blk_file on non dev file systems
  - Label /usr/lib/erlang/erts.*/bin files as bin_t
  - Add files_dontaudit_access_check_home_dir() inteface.
  - Allow udev_t mounton udev_var_run_t dirs #(1128618)
  - Add systemd_networkd_var_run_t labeling for /var/run/systemd/netif and allow systemd-networkd to manage it.
  - Add init_dontaudit_read_state() interface.
  - Add label for ~/.local/share/fonts
  - Allow unconfined_r to access unconfined_service_t.
  - Allow init to read all config files
  - Add new interface to allow creation of file with lib_t type
  - Assign rabbitmq port.
  - Allow unconfined_service_t to dbus chat with all dbus domains
  - Add new interfaces to access users keys.
  - Allow domains to are allowed to mounton proc to mount on files as well as dirs
  - Fix labeling for HOME_DIR/tmp and HOME_DIR/.tmp directories.
  - Add a port definition for shellinaboxd
  - Label ~/tmp and ~/.tmp directories in user tmp dirs as user_tmp_t
  - Allow userdomains to stream connect to pcscd for smart cards
  - Allow programs to use pam to search through user_tmp_t dires (/tmp/.X11-unix)
  - Update to rawhide-contrib changes
  Resolves:#1123844


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-3
changelog:
  - Add back kill permisiion for system class
  - Allow iptables read fail2ban logs.
  - Fix radius labeled ports
  - Add userdom_manage_user_tmpfs_files interface
  - Allow libreswan to connect to VPN via NM-libreswan.
  - Label 4101 tcp port as brlp port
  - fix dev_getattr_generic_usb_dev interface
  - Allow all domains to read fonts
  - Make sure /run/systemd/generator and system is labeled correctly on creation.
  - Dontaudit aicuu to search home config dir. 
  - Make keystone_cgi_script_t domain. 
  Resolves:#1138424
  - Fix bug in drbd policy, 
  - Added support for cpuplug. 
  - ALlow sanlock_t to read sysfs_t.
  - Added sendmail_domtrans_unconfined interface
  - Fix broken interfaces
  - radiusd wants to write own log files.
  - Label /usr/libexec/rhsmd as rhsmcertd_exec_t
  - Allow rhsmcertd send signull to setroubleshoot. 
  - Allow rhsmcertd manage rpm db. 
  - Added policy for blrtty. 
  - Fix keepalived policy
  - Allow rhev-agentd dbus chat with systemd-logind.
  - Allow keepalived manage snmp var lib sock files.
  - Add support for /var/lib/graphite-web
  - Allow NetworkManager to create Bluetooth SDP sockets
  - It's going to do the the discovery for DUN service for modems with Bluez 5.
  - Allow swift to connect to all ephemeral ports by default.
  - Allow sssd to read selinux config to add SELinux user mapping.
  - Allow lsmd to search own plguins.
  - Allow abrt to read /dev/memto generate an unique machine_id and uses  sosuploader's algorithm based off dmidecode[1] fields.
  - ALlow zebra for user/group look-ups.
  - Allow nova domains to getattr on all filesystems.
  - Allow collectd sys_ptrace and dac_override caps because of reading of /proc/%i/io for several processes.
  - Allow pppd to connect to /run/sstpc/sstpc-nm-sstp-service-28025 over unix stream socket.
  - Allow rhnsd_t to manage also rhnsd config symlinks.
  - ALlow user mail domains to create dead.letter.
  - Allow rabbitmq_t read rabbitmq_var_lib_t lnk files. 
  - Allow pki-tomcat to change SELinux object identity.
  - Allow radious to connect to apache ports to do OCSP check
  - Allow git cgi scripts to create content in /tmp
  - Allow cockpit-session to do GSSAPI logins.
  - Allow sensord read in /proc 
  - Additional access required by usbmuxd


